@helyx/bot 1.5.0 → 1.5.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.5.2
+
+### Patch Changes
+
+- Supply hosted shard workers with the purpose-derived Creator invite key instead
+  of requiring the application-wide data encryption key in those workers. Preserve
+  existing v1 invite ciphertext and fingerprints, and keep startup fail-closed
+  when the required scoped key is absent or invalid.
+
+## 1.5.1
+
+### Patch Changes
+
+- Add the server-scoped `/diag` command with administrator access, one active
+  run per server, guarded repair passes and fresh checks before reporting fixes.
+  Preserve records and configuration outside the explicitly supported repairs.
+- Require PostgreSQL adapter 2.4.1 or MySQL adapter 0.2.1 for the active,
+  non-blacklisted server lookup used by diagnostic admission checks.
+
 ## 1.5.0
 
 ### Minor Changes

package/dist/command-registration-policy.js

@@ -1,6 +1,7 @@
 import { isCustomerSelectableModule } from "@helyx/module-manifest";
 const platformGlobalModuleIds = new Set([
     "helyx.management",
+    "helyx.diagnostics",
     "helyx.support",
     "helyx.oauth",
     "helyx.permissions",

package/dist/creator-invite-key.d.ts

@@ -0,0 +1,6 @@
+/** Internal launch material, never the application-wide data encryption key. */
+export declare const creatorInviteWorkerKeyName = "HELYX_INTERNAL_CREATOR_INVITE_KEY";
+export declare function decodeCreatorInviteKey(encodedKey: string): Buffer;
+/** Keep the existing v1 derivation: old ciphertext and fingerprints stay valid. */
+export declare function deriveCreatorInviteKey(encodedDataEncryptionKey: string): Buffer;
+//# sourceMappingURL=creator-invite-key.d.ts.map

package/dist/creator-invite-key.js

@@ -0,0 +1,16 @@
+import { createHmac } from "node:crypto";
+/** Internal launch material, never the application-wide data encryption key. */
+export const creatorInviteWorkerKeyName = "HELYX_INTERNAL_CREATOR_INVITE_KEY";
+export function decodeCreatorInviteKey(encodedKey) {
+    const key = Buffer.from(encodedKey, "base64");
+    if (key.length !== 32)
+        throw new Error("Creator invites require a 32-byte encryption key");
+    return key;
+}
+/** Keep the existing v1 derivation: old ciphertext and fingerprints stay valid. */
+export function deriveCreatorInviteKey(encodedDataEncryptionKey) {
+    return createHmac("sha256", decodeCreatorInviteKey(encodedDataEncryptionKey))
+        .update("helyx.creator-owned-invites.v1")
+        .digest();
+}
+//# sourceMappingURL=creator-invite-key.js.map

package/dist/creator-invite-service.d.ts

@@ -8,7 +8,9 @@ export declare class DiscordCreatorInviteService implements CreatorInviteService
     private readonly repository;
     private readonly services;
     private readonly module;
-    constructor(client: Client, repository: CreatorInviteRepository, services: ServiceAccess, module: ModuleDefinition | undefined, encodedEncryptionKey: string);
+    constructor(client: Client, repository: CreatorInviteRepository, services: ServiceAccess, module: ModuleDefinition | undefined, encryption: string | {
+        inviteEncryptionKey: string;
+    });
     selectableRoles(input: Parameters<CreatorInviteService["selectableRoles"]>[0]): ReturnType<CreatorInviteService["selectableRoles"]>;
     create(input: Parameters<CreatorInviteService["create"]>[0]): Promise<CreatorOwnedInvite>;
     inspect(input: Parameters<CreatorInviteService["inspect"]>[0]): Promise<CreatorOwnedInvite>;

package/dist/creator-invite-service.js

@@ -5,6 +5,7 @@ import { createCipheriv, createDecipheriv, createHmac, createHash, randomBytes,
 import { normalizeDiscordPermission } from "./interactions.js";
 import { canAccessModule } from "./premium-access.js";
 import { discordRestOptions } from "./discord-rest.js";
+import { decodeCreatorInviteKey, deriveCreatorInviteKey, } from "./creator-invite-key.js";
 const MODULE_ID = "helyx.creator-connections";
 const snowflake = /^\d{17,20}$/u;
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
@@ -18,17 +19,17 @@ export class DiscordCreatorInviteService {
     #key;
     #rest = null;
     #cleanupCursor;
-    constructor(client, repository, services, module, encodedEncryptionKey) {
+    constructor(client, repository, services, module, encryption) {
         this.client = client;
         this.repository = repository;
         this.services = services;
         this.module = module;
-        const rootKey = Buffer.from(encodedEncryptionKey, "base64");
-        if (rootKey.length !== 32)
-            throw new Error("Creator invites require a 32-byte data encryption key");
-        this.#key = createHmac("sha256", rootKey)
-            .update("helyx.creator-owned-invites.v1")
-            .digest();
+        // Unsharded runtimes derive locally; workers receive only this scoped key.
+        // Do not derive again in workers: existing v1 records use this exact key.
+        this.#key =
+            typeof encryption === "string"
+                ? deriveCreatorInviteKey(encryption)
+                : decodeCreatorInviteKey(encryption.inviteEncryptionKey);
     }
     async selectableRoles(input) {
         validateId(input.guildId);

package/dist/creator-onboarding-platform.d.ts

@@ -8,6 +8,7 @@ export declare function installCreatorInvitePlatform(input: {
     services: ServiceAccess;
     modules: readonly ModuleDefinition[];
     encryptionKey: string | undefined;
+    inviteEncryptionKey?: string;
     oauthBroker?: {
         baseUrl: string;
         secret: string;

package/dist/creator-onboarding-platform.js

@@ -8,9 +8,12 @@ export async function installCreatorInvitePlatform(input) {
     const repository = new CreatorInviteRepository(input.database);
     if (!module && !(await repository.isInstalled()))
         return undefined;
-    if (!input.encryptionKey)
+    const encryption = input.inviteEncryptionKey
+        ? { inviteEncryptionKey: input.inviteEncryptionKey }
+        : input.encryptionKey;
+    if (!encryption)
         throw new Error("Hosted Creator Connections invites require HELYX_DATA_ENCRYPTION_KEY");
-    const service = new DiscordCreatorInviteService(input.client, repository, input.services, module, input.encryptionKey);
+    const service = new DiscordCreatorInviteService(input.client, repository, input.services, module, encryption);
     input.register(HELYX_SERVICE_NAMES.creatorInvites, service);
     if (input.oauthBroker) {
         const broker = input.oauthBroker;

package/dist/diagnostic-command.d.ts

@@ -0,0 +1,76 @@
+import type { DatabasePool } from "@helyx/database";
+import type { MysqlPool } from "@helyx/database-mysql";
+import { type ModuleDefinition, type ModuleRecordService, type PermissionActor, type ServiceAccess } from "@helyx/sdk";
+import { type Client } from "discord.js";
+export interface DiagnosticIssue {
+    kind: "repairable" | "human" | "technical" | "incomplete";
+    message: string;
+    evidence?: Readonly<Record<string, unknown>>;
+    afterRepair?: string;
+}
+export interface DiagnosticProbe {
+    id: string;
+    moduleId?: string;
+    label: string;
+    inspect(this: void): Promise<DiagnosticIssue | null>;
+    repair?(round: 1 | 2, issue: DiagnosticIssue): Promise<"attempted" | "unchanged" | "stale">;
+    verify?(issue: DiagnosticIssue): Promise<boolean>;
+}
+export interface DiagnosticLease {
+    signal: AbortSignal;
+    assertOwned(): Promise<void>;
+}
+export type DiagnosticRunExclusive = (guildId: string, operation: (lease: DiagnosticLease) => Promise<void>) => Promise<boolean>;
+export interface DiagnosticResources {
+    actor(userId: string): Promise<PermissionActor>;
+    message(channelId: string, messageId: string): Promise<"present" | "absent" | "unknown">;
+    channel(channelId: string, types: readonly string[], permissions: readonly string[]): Promise<DiagnosticIssue | null>;
+    role(roleId: string, managed: boolean): Promise<DiagnosticIssue | null>;
+    capabilities(): {
+        guildMembers: boolean;
+        messageContent: boolean;
+    };
+    guildCommands?(): Promise<{
+        definitionHash: string;
+        rootCount: number;
+    }>;
+}
+export interface DiagnosticModuleOptions {
+    modules: readonly ModuleDefinition[];
+    client?: Client;
+    resources?: (guildId: string) => DiagnosticResources;
+    runExclusive?: DiagnosticRunExclusive;
+    assertGuildAvailable?: (guildId: string) => Promise<void>;
+    listEnabledModules?: (guildId: string) => Promise<readonly {
+        moduleId: string;
+    }[]>;
+    commandStatus?: {
+        get(guildId: string): Promise<unknown>;
+        refresh(input: {
+            guildId: string;
+            actorUserId: string;
+            correlationId: string;
+        }): Promise<unknown>;
+    };
+    stageMilliseconds?: number;
+    maximumRunMilliseconds?: number;
+}
+export interface DiagnosticRecordEnvironment {
+    guildId: string;
+    actorUserId: string;
+    correlationId: string;
+    modules: readonly ModuleDefinition[];
+    records: ModuleRecordService;
+    services: ServiceAccess;
+    assertCanInspect(): Promise<void>;
+    assertCanMutate(moduleId: string): Promise<void>;
+    inspectMessage(channelId: string, messageId: string): Promise<"present" | "absent" | "unknown">;
+    now(): Date;
+}
+/** A core command, never a selectable module or a module-repair hook. */
+export declare function createDiagnosticModule(options: DiagnosticModuleOptions): ModuleDefinition;
+/** Reserve at most four sessions, leaving at least two pool slots for repairs. */
+export declare function createPostgresDiagnosticLock(pool: DatabasePool): DiagnosticRunExclusive;
+/** Reserve at most four sessions, leaving at least two pool slots for repairs. */
+export declare function createMysqlDiagnosticLock(pool: MysqlPool): DiagnosticRunExclusive;
+//# sourceMappingURL=diagnostic-command.d.ts.map