@helyx/bot 1.5.1 → 1.5.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.5.2
+
+### Patch Changes
+
+- Supply hosted shard workers with the purpose-derived Creator invite key instead
+  of requiring the application-wide data encryption key in those workers. Preserve
+  existing v1 invite ciphertext and fingerprints, and keep startup fail-closed
+  when the required scoped key is absent or invalid.
+
 ## 1.5.1
 
 ### Patch Changes

package/dist/creator-invite-key.d.ts

@@ -0,0 +1,6 @@
+/** Internal launch material, never the application-wide data encryption key. */
+export declare const creatorInviteWorkerKeyName = "HELYX_INTERNAL_CREATOR_INVITE_KEY";
+export declare function decodeCreatorInviteKey(encodedKey: string): Buffer;
+/** Keep the existing v1 derivation: old ciphertext and fingerprints stay valid. */
+export declare function deriveCreatorInviteKey(encodedDataEncryptionKey: string): Buffer;
+//# sourceMappingURL=creator-invite-key.d.ts.map

package/dist/creator-invite-key.js

@@ -0,0 +1,16 @@
+import { createHmac } from "node:crypto";
+/** Internal launch material, never the application-wide data encryption key. */
+export const creatorInviteWorkerKeyName = "HELYX_INTERNAL_CREATOR_INVITE_KEY";
+export function decodeCreatorInviteKey(encodedKey) {
+    const key = Buffer.from(encodedKey, "base64");
+    if (key.length !== 32)
+        throw new Error("Creator invites require a 32-byte encryption key");
+    return key;
+}
+/** Keep the existing v1 derivation: old ciphertext and fingerprints stay valid. */
+export function deriveCreatorInviteKey(encodedDataEncryptionKey) {
+    return createHmac("sha256", decodeCreatorInviteKey(encodedDataEncryptionKey))
+        .update("helyx.creator-owned-invites.v1")
+        .digest();
+}
+//# sourceMappingURL=creator-invite-key.js.map

package/dist/creator-invite-service.d.ts

@@ -8,7 +8,9 @@ export declare class DiscordCreatorInviteService implements CreatorInviteService
     private readonly repository;
     private readonly services;
     private readonly module;
-    constructor(client: Client, repository: CreatorInviteRepository, services: ServiceAccess, module: ModuleDefinition | undefined, encodedEncryptionKey: string);
+    constructor(client: Client, repository: CreatorInviteRepository, services: ServiceAccess, module: ModuleDefinition | undefined, encryption: string | {
+        inviteEncryptionKey: string;
+    });
     selectableRoles(input: Parameters<CreatorInviteService["selectableRoles"]>[0]): ReturnType<CreatorInviteService["selectableRoles"]>;
     create(input: Parameters<CreatorInviteService["create"]>[0]): Promise<CreatorOwnedInvite>;
     inspect(input: Parameters<CreatorInviteService["inspect"]>[0]): Promise<CreatorOwnedInvite>;

package/dist/creator-invite-service.js

@@ -5,6 +5,7 @@ import { createCipheriv, createDecipheriv, createHmac, createHash, randomBytes,
 import { normalizeDiscordPermission } from "./interactions.js";
 import { canAccessModule } from "./premium-access.js";
 import { discordRestOptions } from "./discord-rest.js";
+import { decodeCreatorInviteKey, deriveCreatorInviteKey, } from "./creator-invite-key.js";
 const MODULE_ID = "helyx.creator-connections";
 const snowflake = /^\d{17,20}$/u;
 const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
@@ -18,17 +19,17 @@ export class DiscordCreatorInviteService {
     #key;
     #rest = null;
     #cleanupCursor;
-    constructor(client, repository, services, module, encodedEncryptionKey) {
+    constructor(client, repository, services, module, encryption) {
         this.client = client;
         this.repository = repository;
         this.services = services;
         this.module = module;
-        const rootKey = Buffer.from(encodedEncryptionKey, "base64");
-        if (rootKey.length !== 32)
-            throw new Error("Creator invites require a 32-byte data encryption key");
-        this.#key = createHmac("sha256", rootKey)
-            .update("helyx.creator-owned-invites.v1")
-            .digest();
+        // Unsharded runtimes derive locally; workers receive only this scoped key.
+        // Do not derive again in workers: existing v1 records use this exact key.
+        this.#key =
+            typeof encryption === "string"
+                ? deriveCreatorInviteKey(encryption)
+                : decodeCreatorInviteKey(encryption.inviteEncryptionKey);
     }
     async selectableRoles(input) {
         validateId(input.guildId);

package/dist/creator-onboarding-platform.d.ts

@@ -8,6 +8,7 @@ export declare function installCreatorInvitePlatform(input: {
     services: ServiceAccess;
     modules: readonly ModuleDefinition[];
     encryptionKey: string | undefined;
+    inviteEncryptionKey?: string;
     oauthBroker?: {
         baseUrl: string;
         secret: string;

package/dist/creator-onboarding-platform.js

@@ -8,9 +8,12 @@ export async function installCreatorInvitePlatform(input) {
     const repository = new CreatorInviteRepository(input.database);
     if (!module && !(await repository.isInstalled()))
         return undefined;
-    if (!input.encryptionKey)
+    const encryption = input.inviteEncryptionKey
+        ? { inviteEncryptionKey: input.inviteEncryptionKey }
+        : input.encryptionKey;
+    if (!encryption)
         throw new Error("Hosted Creator Connections invites require HELYX_DATA_ENCRYPTION_KEY");
-    const service = new DiscordCreatorInviteService(input.client, repository, input.services, module, input.encryptionKey);
+    const service = new DiscordCreatorInviteService(input.client, repository, input.services, module, encryption);
     input.register(HELYX_SERVICE_NAMES.creatorInvites, service);
     if (input.oauthBroker) {
         const broker = input.oauthBroker;

package/dist/shard-supervisor.js

@@ -13,6 +13,7 @@ import { CloudConnectorController, } from "./cloud-connector.js";
 import { createCloudManagementModule } from "./cloud-management-module.js";
 import { BotControlService, createBotControlServer, mapBotControlError, } from "./control-server.js";
 import { createManagementModule } from "./management-module.js";
+import { creatorInviteWorkerKeyName, deriveCreatorInviteKey, } from "./creator-invite-key.js";
 import { createDiagnosticModule } from "./diagnostic-command.js";
 import { buildApplicationCommandDefinitions } from "./interactions.js";
 import { resolveModulePackageSpecifiers } from "./module-configuration.js";
@@ -1716,6 +1717,9 @@ export function buildShardWorkerEnvironment(source, identity, restartCount) {
     const selectionKey = source.HELYX_DATA_ENCRYPTION_KEY
         ? Buffer.from(deriveSecureRandomSelectionKey(source.HELYX_DATA_ENCRYPTION_KEY)).toString("base64")
         : undefined;
+    const creatorInviteKey = source.HELYX_DATA_ENCRYPTION_KEY
+        ? deriveCreatorInviteKey(source.HELYX_DATA_ENCRYPTION_KEY).toString("base64")
+        : undefined;
     const hostedModerationCredential = source.HELYX_HOSTED_MODERATION_ENABLED === "true" &&
         source.HELYX_BOT_CONTROL_SECRET
         ? { HELYX_BOT_CONTROL_SECRET: source.HELYX_BOT_CONTROL_SECRET }
@@ -1726,6 +1730,9 @@ export function buildShardWorkerEnvironment(source, identity, restartCount) {
         ...(selectionKey
             ? { [secureRandomSelectionWorkerKeyName]: selectionKey }
             : {}),
+        ...(creatorInviteKey
+            ? { [creatorInviteWorkerKeyName]: creatorInviteKey }
+            : {}),
         SHARDING_MANAGER: "true",
         SHARDING_MANAGER_MODE: "process",
         SHARDS: String(identity.shardId),

package/dist/shard-worker.d.ts

@@ -23,6 +23,7 @@ export declare function startShardWorker(processEnvironment?: NodeJS.ProcessEnv,
 export declare function executeShardScheduledTaskRequest(identity: ShardIdentity, request: ShardScheduledTaskRequest, route: ScheduledTaskRoute, now?: number): Promise<ShardScheduledTaskResponse>;
 export declare function parseShardWorkerLaunchContract(value: string | undefined): ShardIdentity;
 export declare function parseShardWorkerEnvironment(processEnvironment: NodeJS.ProcessEnv, identity: ShardIdentity): {
+    HELYX_INTERNAL_CREATOR_INVITE_KEY?: string;
     HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY?: string;
     HELYX_DATA_ENCRYPTION_KEY: undefined;
     HELYX_SHARD_WORKERS_PER_REPLICA: number;

package/dist/shard-worker.js

@@ -15,6 +15,7 @@ import { HttpVerificationService } from "./verification-service.js";
 import { DiscordMessageDeliveryService, DiscordMemberRoleService, DiscordVerificationMemberService, DiscordResourceInspection, installModuleEvents, } from "./events.js";
 import { DiscordModerationMemberEnforcementAdapter } from "./discord-member-enforcement-service.js";
 import { installCreatorInvitePlatform } from "./creator-onboarding-platform.js";
+import { creatorInviteWorkerKeyName, decodeCreatorInviteKey, } from "./creator-invite-key.js";
 import { installGuildTracking, } from "./guilds.js";
 import { installInteractions, } from "./interactions.js";
 import { createManagementModule } from "./management-module.js";
@@ -318,6 +319,11 @@ export async function startShardWorker(processEnvironment = process.env, identit
                 services: serviceAccess,
                 modules: publicModules,
                 encryptionKey: environment.HELYX_DATA_ENCRYPTION_KEY,
+                ...(environment.HELYX_INTERNAL_CREATOR_INVITE_KEY
+                    ? {
+                        inviteEncryptionKey: environment.HELYX_INTERNAL_CREATOR_INVITE_KEY,
+                    }
+                    : {}),
                 ...(environment.HELYX_CLOUD_API_URL &&
                     environment.HELYX_OAUTH_INTERNAL_SECRET
                     ? {
@@ -582,12 +588,18 @@ export function parseShardWorkerEnvironment(processEnvironment, identity) {
         environment.HELYX_SHARD_SCOPE !== identity.scope)
         throw new Error("Shard worker launch contract conflicts with configuration");
     const internalSelectionKey = processEnvironment[secureRandomSelectionWorkerKeyName];
+    const internalCreatorInviteKey = processEnvironment[creatorInviteWorkerKeyName];
+    if (internalCreatorInviteKey !== undefined)
+        decodeCreatorInviteKey(internalCreatorInviteKey);
     return {
         ...environment,
         HELYX_DATA_ENCRYPTION_KEY: undefined,
         ...(internalSelectionKey
             ? { HELYX_INTERNAL_SECURE_RANDOM_SELECTION_KEY: internalSelectionKey }
             : {}),
+        ...(internalCreatorInviteKey
+            ? { HELYX_INTERNAL_CREATOR_INVITE_KEY: internalCreatorInviteKey }
+            : {}),
     };
 }
 export function shardWorkerCommandRegistration(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/bot",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Production Discord runtime for the modular Helyx platform.",
   "keywords": [
     "helyx",