@happyvertical/smrt-profiles 0.39.13 → 0.39.15

package/dist/chunks/oidcProvisioningPrimitives-ZuVcDPt-.js

@@ -0,0 +1,138 @@
+import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { a as ProfileType, f as saveOidcRaceArbiter, i as Profile, n as ProfileCollection } from "./ProfileCollection-Bix9yAiy.js";
+import { t as OidcIdentity } from "./OidcIdentity-ChkiT6hg.js";
+import { SmrtCollection, smrt } from "@happyvertical/smrt-core";
+import { isSystemContext } from "@happyvertical/smrt-tenancy";
+//#region src/collections/ProfileTypeCollection.ts
+var ProfileTypeCollection_exports = /* @__PURE__ */ __exportAll({ ProfileTypeCollection: () => ProfileTypeCollection });
+var ProfileTypeCollection = class extends SmrtCollection {
+	static _itemClass = ProfileType;
+	/**
+	* Get profile type by slug
+	*
+	* @param slug - The slug to search for
+	* @returns ProfileType instance or null
+	*/
+	async getBySlug(slug) {
+		return await this.get({ slug });
+	}
+	/**
+	* Get or create a profile type by slug
+	*
+	* @param slug - The slug to search for
+	* @param defaults - Default values if creating
+	* @returns ProfileType instance
+	*/
+	async getOrCreateBySlug(slug, defaults) {
+		const existing = await this.getBySlug(slug);
+		if (existing) return existing;
+		const profileType = await this.create({
+			slug,
+			...defaults
+		});
+		await profileType.save();
+		return profileType;
+	}
+	/**
+	* Atomically create or load a global ProfileType from trusted system code.
+	*
+	* This intentionally bypasses tenant auto-population and therefore refuses
+	* to run outside an explicit `withSystemContext()` boundary.
+	*/
+	async getOrCreateGlobalBySlug(slug, defaults) {
+		if (!isSystemContext()) throw new Error("Global ProfileType creation requires an explicit system context.");
+		const existing = await this.loadGlobalBySlug(slug);
+		if (existing) return existing;
+		await this.db.query(`INSERT INTO profile_types
+        (id, slug, context, _meta_type, tenant_id, name, description)
+       VALUES (?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?)
+       ON CONFLICT (slug, context, _meta_type) DO NOTHING`, crypto.randomUUID(), slug, defaults.name, defaults.description ?? null);
+		const profileType = await this.loadGlobalBySlug(slug);
+		if (!profileType) throw new Error(`Global ProfileType '${slug}' could not be created or loaded.`);
+		return profileType;
+	}
+	async loadGlobalBySlug(slug) {
+		const id = (await this.db.query(`SELECT id
+       FROM profile_types
+       WHERE slug = ?
+         AND context = ''
+         AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'
+         AND tenant_id IS NULL
+       LIMIT 1`, slug)).rows[0]?.id;
+		return typeof id === "string" ? this.get({ id }) : null;
+	}
+};
+//#endregion
+//#region src/models/ProfileTypes.ts
+var ProfileTypes_exports = /* @__PURE__ */ __exportAll({
+	Bot: () => Bot,
+	Organization: () => Organization,
+	Person: () => Person
+});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var Person = class extends Profile {
+	constructor(options = {}) {
+		super(options);
+	}
+};
+Person = __decorateClass([smrt({ tableStrategy: "sti" })], Person);
+var Organization = class extends Profile {
+	constructor(options = {}) {
+		super(options);
+	}
+};
+Organization = __decorateClass([smrt({ tableStrategy: "sti" })], Organization);
+var Bot = class extends Profile {
+	constructor(options = {}) {
+		super(options);
+	}
+};
+Bot = __decorateClass([smrt({ tableStrategy: "sti" })], Bot);
+//#endregion
+//#region src/auth/oidcProvisioningPrimitives.ts
+async function createOidcProvisioningPerson(db, input) {
+	const typeId = requireProvisioningId((await (await ProfileTypeCollection.create({ db })).getOrCreateGlobalBySlug("person", {
+		name: "Person",
+		description: "Individual person profile"
+	})).id, "Person ProfileType");
+	let profile = new Person({
+		db,
+		slug: `oidc-${crypto.randomUUID()}`,
+		tenantId: null,
+		typeId,
+		email: input.email ?? "",
+		name: input.name || input.preferredUsername || input.subject
+	});
+	await profile.initialize();
+	await saveOidcRaceArbiter(() => profile.save());
+	if (input.email) profile = await (await ProfileCollection.create({ db })).reserveCanonicalIdentityEmail(requireProvisioningId(profile.id, "Created Profile"), input.email);
+	return profile;
+}
+async function insertOidcProvisioningIdentity(db, input) {
+	const identity = new OidcIdentity({
+		db,
+		email: input.email ?? "",
+		issuer: input.issuer,
+		profileId: input.profileId,
+		provider: input.provider,
+		subject: input.subject
+	});
+	await identity.initialize();
+	await saveOidcRaceArbiter(() => identity.save());
+	return identity;
+}
+function requireProvisioningId(value, label) {
+	if (typeof value !== "string" || !value) throw new Error(`${label} did not produce an id.`);
+	return value;
+}
+//#endregion
+export { Person as a, ProfileTypeCollection_exports as c, Organization as i, insertOidcProvisioningIdentity as n, ProfileTypes_exports as o, Bot as r, ProfileTypeCollection as s, createOidcProvisioningPerson as t };
+
+//# sourceMappingURL=oidcProvisioningPrimitives-ZuVcDPt-.js.map

package/dist/chunks/oidcProvisioningPrimitives-ZuVcDPt-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcProvisioningPrimitives-ZuVcDPt-.js","names":[],"sources":["../../src/collections/ProfileTypeCollection.ts","../../src/models/ProfileTypes.ts","../../src/auth/oidcProvisioningPrimitives.ts"],"sourcesContent":["/**\n * ProfileTypeCollection - Collection manager for ProfileType objects\n *\n * Provides querying for profile type lookup table.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { isSystemContext } from '@happyvertical/smrt-tenancy';\nimport { ProfileType } from '../models/ProfileType';\n\nexport class ProfileTypeCollection extends SmrtCollection<ProfileType> {\n  static readonly _itemClass = ProfileType;\n\n  /**\n   * Get profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileType instance or null\n   */\n  async getBySlug(slug: string): Promise<ProfileType | null> {\n    return await this.get({ slug });\n  }\n\n  /**\n   * Get or create a profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @param defaults - Default values if creating\n   * @returns ProfileType instance\n   */\n  async getOrCreateBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    const existing = await this.getBySlug(slug);\n    if (existing) return existing;\n\n    const profileType = await this.create({ slug, ...defaults });\n    await profileType.save();\n    return profileType;\n  }\n\n  /**\n   * Atomically create or load a global ProfileType from trusted system code.\n   *\n   * This intentionally bypasses tenant auto-population and therefore refuses\n   * to run outside an explicit `withSystemContext()` boundary.\n   */\n  async getOrCreateGlobalBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    if (!isSystemContext()) {\n      throw new Error(\n        'Global ProfileType creation requires an explicit system context.',\n      );\n    }\n\n    const existing = await this.loadGlobalBySlug(slug);\n    if (existing) return existing;\n\n    // A plain SMRT create is an upsert and may replace the winning row's id\n    // when two first-login transactions race. Keep the canonical id stable by\n    // using a cross-adapter insert-if-absent and then hydrating the winner.\n    await this.db.query(\n      `INSERT INTO profile_types\n        (id, slug, context, _meta_type, tenant_id, name, description)\n       VALUES (?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?)\n       ON CONFLICT (slug, context, _meta_type) DO NOTHING`,\n      crypto.randomUUID(),\n      slug,\n      defaults.name,\n      defaults.description ?? null,\n    );\n    const profileType = await this.loadGlobalBySlug(slug);\n    if (!profileType) {\n      throw new Error(\n        `Global ProfileType '${slug}' could not be created or loaded.`,\n      );\n    }\n    return profileType;\n  }\n\n  private async loadGlobalBySlug(slug: string): Promise<ProfileType | null> {\n    const result = await this.db.query(\n      `SELECT id\n       FROM profile_types\n       WHERE slug = ?\n         AND context = ''\n         AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n         AND tenant_id IS NULL\n       LIMIT 1`,\n      slug,\n    );\n    const id = result.rows[0]?.id;\n    return typeof id === 'string' ? this.get({ id }) : null;\n  }\n}\n","/**\n * Profile subclasses for STI (Single Table Inheritance)\n *\n * These classes inherit from Profile and automatically use the shared\n * profiles table with _meta_type discriminator.\n */\n\nimport { smrt } from '@happyvertical/smrt-core';\nimport { Profile, type ProfileOptions } from './Profile';\n\n/**\n * Person profile type\n *\n * Represents individual people/users.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Person extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Person-specific initialization can go here\n  }\n}\n\n/**\n * Organization profile type\n *\n * Represents companies, groups, institutions, and other organizational entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Organization extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Organization-specific initialization can go here\n  }\n}\n\n/**\n * Bot profile type\n *\n * Represents automated agents, bots, and AI entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Bot extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Bot-specific initialization can go here\n  }\n}\n","import type { getDatabase } from '@happyvertical/sql';\nimport { ProfileCollection } from '../collections/ProfileCollection';\nimport { ProfileTypeCollection } from '../collections/ProfileTypeCollection';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { Person } from '../models/ProfileTypes';\nimport { saveOidcRaceArbiter } from './oidcProvisioningCoordinator';\n\ntype DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;\n\nexport interface OidcProvisioningPersonInput {\n  email?: string;\n  name?: string;\n  preferredUsername?: string;\n  subject: string;\n}\n\nexport interface OidcProvisioningIdentityInput {\n  email?: string;\n  issuer: string;\n  profileId: string;\n  provider: string;\n  subject: string;\n}\n\n/** Create and reserve a fresh global Person inside the caller's transaction. */\nexport async function createOidcProvisioningPerson(\n  db: DatabaseInterface,\n  input: OidcProvisioningPersonInput,\n): Promise<Profile> {\n  const typeCollection = await ProfileTypeCollection.create({ db });\n  const personType = await typeCollection.getOrCreateGlobalBySlug('person', {\n    name: 'Person',\n    description: 'Individual person profile',\n  });\n  const typeId = requireProvisioningId(personType.id, 'Person ProfileType');\n  let profile: Profile = new Person({\n    db,\n    // OIDC display names are not identity keys. A per-profile slug keeps\n    // SMRT's natural-key upsert from replacing an unrelated Person.\n    slug: `oidc-${crypto.randomUUID()}`,\n    tenantId: null,\n    typeId,\n    email: input.email ?? '',\n    name: input.name || input.preferredUsername || input.subject,\n  });\n  await profile.initialize();\n  await saveOidcRaceArbiter(() => profile.save());\n\n  if (input.email) {\n    const profiles = await ProfileCollection.create({ db });\n    profile = await profiles.reserveCanonicalIdentityEmail(\n      requireProvisioningId(profile.id, 'Created Profile'),\n      input.email,\n    );\n  }\n  return profile;\n}\n\n/** Insert the identity after the caller proves Profile ownership. */\nexport async function insertOidcProvisioningIdentity(\n  db: DatabaseInterface,\n  input: OidcProvisioningIdentityInput,\n): Promise<OidcIdentity> {\n  const identity = new OidcIdentity({\n    db,\n    email: input.email ?? '',\n    issuer: input.issuer,\n    profileId: input.profileId,\n    provider: input.provider,\n    subject: input.subject,\n  });\n  await identity.initialize();\n  await saveOidcRaceArbiter(() => identity.save());\n  return identity;\n}\n\nfunction requireProvisioningId(value: unknown, label: string): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`${label} did not produce an id.`);\n  }\n  return value;\n}\n"],"mappings":";;;;;;;AAUO,IAAM,wBAAN,cAAoC,eAA4B;CACrE,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,UAAU,MAA2C;EACzD,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC;CAChC;;;;;;;;CASA,MAAM,kBACJ,MACA,UACsB;EACtB,MAAM,WAAW,MAAM,KAAK,UAAU,IAAI;EAC1C,IAAI,UAAU,OAAO;EAErB,MAAM,cAAc,MAAM,KAAK,OAAO;GAAE;GAAM,GAAG;EAAS,CAAC;EAC3D,MAAM,YAAY,KAAK;EACvB,OAAO;CACT;;;;;;;CAQA,MAAM,wBACJ,MACA,UACsB;EACtB,IAAI,CAAC,gBAAgB,GACnB,MAAM,IAAI,MACR,kEACF;EAGF,MAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;EACjD,IAAI,UAAU,OAAO;EAKrB,MAAM,KAAK,GAAG,MACZ;;;4DAIA,OAAO,WAAW,GAClB,MACA,SAAS,MACT,SAAS,eAAe,IAC1B;EACA,MAAM,cAAc,MAAM,KAAK,iBAAiB,IAAI;EACpD,IAAI,CAAC,aACH,MAAM,IAAI,MACR,uBAAuB,KAAI,kCAC7B;EAEF,OAAO;CACT;CAEA,MAAc,iBAAiB,MAA2C;EAWxE,MAAM,MAAK,MAVU,KAAK,GAAG,MAC3B;;;;;;iBAOA,IACF,EAAA,CACkB,KAAK,EAAC,EAAG;EAC3B,OAAO,OAAO,OAAO,WAAW,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI;CACrD;AACF;;;;;;;;;;;;;;;;AC/EO,IAAM,SAAN,cAAqB,QAAQ;CAClC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,SAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,MAAA;AAeN,IAAM,eAAN,cAA2B,QAAQ;CACxC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,eAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,YAAA;AAeN,IAAM,MAAN,cAAkB,QAAQ;CAC/B,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,MAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,GAAA;;;ACtBb,eAAsB,6BACpB,IACA,OACkB;CAMlB,MAAM,SAAS,uBAAsB,OAJZ,MADI,sBAAsB,OAAO,EAAE,GAAG,CAAC,EAAA,CACxB,wBAAwB,UAAU;EACxE,MAAM;EACN,aAAa;CACf,CAAC,EAAA,CAC+C,IAAI,oBAAoB;CACxE,IAAI,UAAmB,IAAI,OAAO;EAChC;EAGA,MAAM,QAAQ,OAAO,WAAW;EAChC,UAAU;EACV;EACA,OAAO,MAAM,SAAS;EACtB,MAAM,MAAM,QAAQ,MAAM,qBAAqB,MAAM;CACvD,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,0BAA0B,QAAQ,KAAK,CAAC;CAE9C,IAAI,MAAM,OAER,UAAU,OAAM,MADO,kBAAkB,OAAO,EAAE,GAAG,CAAC,EAAA,CAC7B,8BACvB,sBAAsB,QAAQ,IAAI,iBAAiB,GACnD,MAAM,KACR;CAEF,OAAO;AACT;AAGA,eAAsB,+BACpB,IACA,OACuB;CACvB,MAAM,WAAW,IAAI,aAAa;EAChC;EACA,OAAO,MAAM,SAAS;EACtB,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,SAAS,WAAW;CAC1B,MAAM,0BAA0B,SAAS,KAAK,CAAC;CAC/C,OAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,GAAG,MAAK,wBAAyB;CAEnD,OAAO;AACT"}

package/dist/chunks/resolveIdentity-_h_2sGqJ.js

@@ -0,0 +1,260 @@
+import { _ as verifyAuthEvent, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { d as isOidcProvisioningRaceConflict, l as coordinateOidcProvisioning, p as normalizeIdentityEmail } from "./ProfileCollection-Bix9yAiy.js";
+import { t as ApiKey } from "./ApiKey-Br9NGBnr.js";
+import { t as OidcIdentity } from "./OidcIdentity-ChkiT6hg.js";
+import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-ZuVcDPt-.js";
+import { resolveDatabase } from "@happyvertical/smrt-core";
+import { withSystemContext } from "@happyvertical/smrt-tenancy";
+//#region src/auth/resolveIdentity.ts
+var resolveIdentity_exports = /* @__PURE__ */ __exportAll({
+	createProfileFromNostr: () => createProfileFromNostr,
+	createProfileFromOidc: () => createProfileFromOidc,
+	resolveIdentity: () => resolveIdentity,
+	reuseExistingOidcIdentityForProfile: () => reuseExistingOidcIdentityForProfile
+});
+async function resolveIdentity(context) {
+	const options = { db: context.db };
+	if (context.apiKey) {
+		const apiKey = await ApiKey.verify(context.apiKey, options);
+		if (apiKey) {
+			const profile = await apiKey.getProfile();
+			if (profile) return {
+				profile,
+				source: "api_key",
+				apiKey
+			};
+		}
+	}
+	if (context.oidcSession?.sub && context.oidcSession?.iss) {
+		const oidcIdentity = await OidcIdentity.findBySubject(context.oidcSession.iss, context.oidcSession.sub, options);
+		if (oidcIdentity) {
+			await oidcIdentity.recordUsage();
+			const profile = await oidcIdentity.getProfile();
+			if (profile) return {
+				profile,
+				source: "oidc",
+				oidcIdentity
+			};
+		}
+	}
+	if (context.nostrAuth?.event && context.nostrAuth?.challenge) {
+		const { event, challenge } = context.nostrAuth;
+		if (verifyAuthEvent(event, challenge).valid) {
+			const nostrIdentity = await NostrIdentity.findByPubkey(event.pubkey, options);
+			if (nostrIdentity) {
+				await nostrIdentity.recordUsage();
+				const profile = await nostrIdentity.getProfile();
+				if (profile) return {
+					profile,
+					source: "nostr",
+					nostrIdentity
+				};
+			}
+		}
+	}
+	if (context.actor) {
+		const profile = await findProfileByExternalId("github", context.actor, options);
+		if (profile) return {
+			profile,
+			source: "actor"
+		};
+	}
+	return {
+		profile: null,
+		source: "none"
+	};
+}
+async function findProfileByExternalId(provider, externalId, options) {
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-Ce4yv8p0.js").then((n) => n.r);
+	const identities = await (await OidcIdentityCollection.create(options)).findByProvider(provider);
+	for (const identity of identities) if (identity.subject === externalId || identity.email?.includes(externalId)) {
+		const profile = await identity.getProfile();
+		if (profile) return profile;
+	}
+	const { ProfileCollection } = await import("./ProfileCollection-Bix9yAiy.js").then((n) => n.r);
+	const profiles = await (await ProfileCollection.create(options)).list({
+		where: { email: `${externalId}@users.noreply.github.com` },
+		limit: 1
+	});
+	if (profiles.length > 0) return profiles[0];
+	return null;
+}
+async function createProfileFromOidc(claims, provider, options) {
+	return coordinateProfileOidcProvisioning(claims, provider, options);
+}
+async function reuseExistingOidcIdentityForProfile(profileId, claims, provider, options) {
+	const normalizedClaims = normalizeOidcProfileClaims(claims);
+	return coordinateOidcProvisioning({
+		db: await resolveOidcProfileDatabase(options.db),
+		lockKeys: [`identity:${OidcIdentity.buildIdentityKey(normalizedClaims.iss, normalizedClaims.sub)}`],
+		isRaceConflict: isOidcProvisioningRaceConflict,
+		createTransactionError: (message, cause) => new Error(message, cause === void 0 ? void 0 : { cause }),
+		createConcurrencyError: (cause) => new Error("Concurrent exact OIDC identity reuse did not converge.", cause === void 0 ? void 0 : { cause }),
+		rebindRootResult: rebindOidcProfileResult,
+		provision: (tx) => withSystemContext(async () => {
+			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-Ce4yv8p0.js").then((n) => n.r);
+			const identity = await (await OidcIdentityCollection.create({ db: tx })).findBySubject(normalizedClaims.iss, normalizedClaims.sub);
+			if (!identity) throw new Error("OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().");
+			if (identity.profileId !== profileId) throw new Error(`OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`);
+			const profile = await identity.getProfile();
+			if (!profile) throw new Error("The exact OIDC identity has no linked Profile.");
+			identity.provider = provider;
+			if (normalizedClaims.email) identity.email = normalizedClaims.email;
+			identity.lastUsedAt = /* @__PURE__ */ new Date();
+			await identity.save();
+			return {
+				profile,
+				oidcIdentity: identity,
+				created: false
+			};
+		})
+	});
+}
+async function coordinateProfileOidcProvisioning(claims, provider, options) {
+	const normalizedClaims = normalizeOidcProfileClaims(claims);
+	return coordinateOidcProvisioning({
+		db: await resolveOidcProfileDatabase(options.db),
+		lockKeys: [`identity:${OidcIdentity.buildIdentityKey(normalizedClaims.iss, normalizedClaims.sub)}`, ...normalizedClaims.email ? [`email:${normalizedClaims.email}`] : []],
+		isRaceConflict: isOidcProvisioningRaceConflict,
+		createTransactionError: (message, cause) => new Error(message, cause === void 0 ? void 0 : { cause }),
+		createConcurrencyError: (cause) => new Error("Concurrent OIDC Profile provisioning did not converge.", cause === void 0 ? void 0 : { cause }),
+		rebindRootResult: rebindOidcProfileResult,
+		provision: (tx) => withSystemContext(() => provisionOidcProfile(normalizedClaims, provider, {
+			...options,
+			db: tx
+		}))
+	});
+}
+async function provisionOidcProfile(claims, provider, options) {
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-Ce4yv8p0.js").then((n) => n.r);
+	const existingIdentity = await (await OidcIdentityCollection.create(options)).findBySubject(claims.iss, claims.sub);
+	if (existingIdentity) {
+		const profile2 = await existingIdentity.getProfile();
+		if (!profile2) throw new Error("The exact OIDC identity has no linked Profile.");
+		if (claims.email) existingIdentity.email = claims.email;
+		existingIdentity.lastUsedAt = /* @__PURE__ */ new Date();
+		await existingIdentity.save();
+		return {
+			profile: profile2,
+			oidcIdentity: existingIdentity,
+			created: false
+		};
+	}
+	const { ProfileCollection } = await import("./ProfileCollection-Bix9yAiy.js").then((n) => n.r);
+	const profileCollection = await ProfileCollection.create(options);
+	if (claims.email) {
+		if (await profileCollection.findUniqueGlobalPersonByEmail(claims.email)) {
+			if (claims.email_verified !== true) throw new Error(`OIDC email ${claims.email} is not verified and already belongs to a Profile.`);
+			throw new Error(`OIDC email ${claims.email} already belongs to a Profile; createProfileFromOidc() cannot prove that Profile is unowned. Use UserCollection.getOrCreateFromOidc() for owner-aware linking.`);
+		}
+	}
+	const profile = await createOidcProvisioningPerson(options.db, {
+		email: claims.email ?? "",
+		name: claims.name,
+		preferredUsername: claims.preferred_username,
+		subject: claims.sub
+	});
+	return {
+		profile,
+		oidcIdentity: await insertOidcProvisioningIdentity(options.db, {
+			email: claims.email,
+			issuer: claims.iss,
+			profileId: requireOidcProfileId(profile.id),
+			provider,
+			subject: claims.sub
+		}),
+		created: true
+	};
+}
+async function rebindOidcProfileResult(result, rootDb) {
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-Ce4yv8p0.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-Bix9yAiy.js").then((n) => n.r);
+	const profileId = requireOidcProfileId(result.profile.id);
+	const identityId = requireOidcProfileId(result.oidcIdentity.id);
+	const [profile, oidcIdentity] = await withSystemContext(async () => {
+		const profiles = await ProfileCollection.create({ db: rootDb });
+		const identities = await OidcIdentityCollection.create({ db: rootDb });
+		return Promise.all([profiles.get({ id: profileId }), identities.get({ id: identityId })]);
+	});
+	if (!profile || !oidcIdentity) throw new Error("Committed OIDC Profile provisioning result was not found.");
+	return {
+		...result,
+		profile,
+		oidcIdentity
+	};
+}
+function normalizeOidcProfileClaims(claims) {
+	const sub = claims?.sub;
+	const iss = claims?.iss;
+	if (typeof sub !== "string" || sub.trim().length === 0 || typeof iss !== "string" || iss.trim().length === 0) throw new Error("Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.");
+	const suppliedEmail = claims.email;
+	return {
+		...claims,
+		sub,
+		iss,
+		email: typeof suppliedEmail === "string" && suppliedEmail.trim() ? normalizeIdentityEmail(suppliedEmail) : void 0
+	};
+}
+function requireOidcProfileId(value) {
+	if (typeof value !== "string" || !value) throw new Error("OIDC Profile provisioning did not produce an id.");
+	return value;
+}
+async function resolveOidcProfileDatabase(db) {
+	if (!db) throw new Error("OIDC Profile provisioning requires an initialized database.");
+	return resolveDatabase(db);
+}
+async function createProfileFromNostr(email, nostrData, options) {
+	const normalizedEmail = normalizeIdentityEmail(email);
+	const existingIdentity = await NostrIdentity.findByEmail(normalizedEmail, options);
+	if (existingIdentity) {
+		const profile2 = await existingIdentity.getProfile();
+		if (profile2) return {
+			profile: profile2,
+			nostrIdentity: existingIdentity,
+			created: false
+		};
+	}
+	const { Person } = await import("./oidcProvisioningPrimitives-ZuVcDPt-.js").then((n) => n.o);
+	const { ProfileTypeCollection } = await import("./oidcProvisioningPrimitives-ZuVcDPt-.js").then((n) => n.c);
+	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
+	if (!personType) {
+		const { ProfileType } = await import("./ProfileCollection-Bix9yAiy.js").then((n) => n.o);
+		personType = new ProfileType({
+			...options,
+			slug: "person",
+			name: "Person",
+			description: "Individual person profile"
+		});
+		await personType.initialize();
+		await personType.save();
+	}
+	const profile = new Person({
+		...options,
+		typeId: personType.id,
+		email: normalizedEmail,
+		name: normalizedEmail.split("@")[0]
+	});
+	await profile.initialize();
+	await profile.save();
+	const nostrIdentity = new NostrIdentity({
+		...options,
+		profileId: profile.id,
+		pubkey: nostrData.pubkey,
+		encryptedPrivkey: nostrData.encryptedPrivkey,
+		encryptionIv: nostrData.encryptionIv,
+		encryptionTag: nostrData.encryptionTag,
+		email: normalizedEmail,
+		nip05Username: nostrData.nip05Username?.toLowerCase() || normalizedEmail.split("@")[0]
+	});
+	await nostrIdentity.initialize();
+	await nostrIdentity.save();
+	return {
+		profile,
+		nostrIdentity,
+		created: true
+	};
+}
+//#endregion
+export { resolveIdentity_exports as i, createProfileFromOidc as n, resolveIdentity as r, createProfileFromNostr as t };
+
+//# sourceMappingURL=resolveIdentity-_h_2sGqJ.js.map

package/dist/chunks/resolveIdentity-_h_2sGqJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveIdentity-_h_2sGqJ.js","names":["profile"],"sources":["../../src/auth/resolveIdentity.ts"],"sourcesContent":["/**\n * resolveIdentity - Resolves authentication context to a Profile\n *\n * Used by apps (blindmanpress.com) to resolve incoming auth to a Profile.\n * Modules (aedile, praeco) should receive the resolved profile from the app.\n *\n * Resolution order:\n * 1. API key header → ApiKey → Profile\n * 2. OIDC session → OidcIdentity → Profile\n * 3. Nostr auth → NostrIdentity → Profile\n * 4. Actor header (CI pass-through) → Profile lookup\n */\n\nimport {\n  resolveDatabase,\n  type SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport { withSystemContext } from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { ApiKey } from '../models/ApiKey';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { normalizeIdentityEmail } from './normalizeIdentityEmail';\nimport { type NostrEvent, verifyAuthEvent } from './nostrCrypto';\nimport {\n  coordinateOidcProvisioning,\n  isOidcProvisioningRaceConflict,\n} from './oidcProvisioningCoordinator';\nimport {\n  createOidcProvisioningPerson,\n  insertOidcProvisioningIdentity,\n} from './oidcProvisioningPrimitives';\n\n/**\n * Context provided to resolveIdentity\n */\nexport interface AuthContext {\n  /**\n   * API key from X-API-Key header or similar\n   */\n  apiKey?: string | null;\n\n  /**\n   * OIDC session data (from @auth/sveltekit or similar)\n   */\n  oidcSession?: {\n    sub?: string;\n    iss?: string;\n    email?: string;\n    name?: string;\n  } | null;\n\n  /**\n   * Actor identifier for CI pass-through identity\n   * Usually the GitHub actor (username) who triggered the workflow\n   */\n  actor?: string | null;\n\n  /**\n   * Nostr authentication data (NIP-42 style)\n   */\n  nostrAuth?: {\n    /** Signed Nostr event for authentication */\n    event: NostrEvent;\n    /** Expected challenge (to prevent replay attacks) */\n    challenge: string;\n  } | null;\n\n  /**\n   * Database/persistence options\n   */\n  db?: SmrtObjectOptions['db'];\n}\n\n/**\n * Result of identity resolution\n */\nexport interface ResolveIdentityResult {\n  /**\n   * The resolved profile, or null if not authenticated\n   */\n  profile: Profile | null;\n\n  /**\n   * How the identity was resolved\n   */\n  source: 'api_key' | 'oidc' | 'nostr' | 'actor' | 'none';\n\n  /**\n   * The API key record if authenticated via API key\n   */\n  apiKey?: ApiKey;\n\n  /**\n   * The OIDC identity record if authenticated via OIDC\n   */\n  oidcIdentity?: OidcIdentity;\n\n  /**\n   * The Nostr identity record if authenticated via Nostr\n   */\n  nostrIdentity?: NostrIdentity;\n}\n\n/**\n * Resolve authentication context to a Profile\n *\n * @param context - The authentication context from the request\n * @returns The resolved profile and metadata\n *\n * @example\n * ```typescript\n * // In SvelteKit hooks.server.ts\n * import { resolveIdentity } from '@happyvertical/smrt-profiles';\n *\n * const identityMiddleware: Handle = async ({ event, resolve }) => {\n *   const session = await event.locals.auth();\n *\n *   const { profile, source } = await resolveIdentity({\n *     oidcSession: session,\n *     apiKey: event.request.headers.get('X-API-Key'),\n *     actor: event.request.headers.get('X-Actor'),\n *     db: { type: 'postgres', url: DATABASE_URL },\n *   });\n *\n *   event.locals.profile = profile;\n *   event.locals.authSource = source;\n *\n *   return resolve(event);\n * };\n * ```\n */\nexport async function resolveIdentity(\n  context: AuthContext,\n): Promise<ResolveIdentityResult> {\n  const options: SmrtObjectOptions = { db: context.db };\n\n  // 1. Check API key header first (highest priority for programmatic access)\n  if (context.apiKey) {\n    const apiKey = await ApiKey.verify(context.apiKey, options);\n    if (apiKey) {\n      const profile = await apiKey.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'api_key',\n          apiKey,\n        };\n      }\n    }\n  }\n\n  // 2. Check OIDC session (web users)\n  if (context.oidcSession?.sub && context.oidcSession?.iss) {\n    const oidcIdentity = await OidcIdentity.findBySubject(\n      context.oidcSession.iss,\n      context.oidcSession.sub,\n      options,\n    );\n\n    if (oidcIdentity) {\n      // Record usage\n      await oidcIdentity.recordUsage();\n\n      const profile = await oidcIdentity.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'oidc',\n          oidcIdentity,\n        };\n      }\n    }\n  }\n\n  // 3. Check Nostr auth (NIP-42 style signed event)\n  if (context.nostrAuth?.event && context.nostrAuth?.challenge) {\n    const { event, challenge } = context.nostrAuth;\n\n    // Verify the auth event\n    const verifyResult = verifyAuthEvent(event, challenge);\n    if (verifyResult.valid) {\n      // Look up identity by public key\n      const nostrIdentity = await NostrIdentity.findByPubkey(\n        event.pubkey,\n        options,\n      );\n\n      if (nostrIdentity) {\n        // Record usage\n        await nostrIdentity.recordUsage();\n\n        const profile = await nostrIdentity.getProfile();\n        if (profile) {\n          return {\n            profile,\n            source: 'nostr',\n            nostrIdentity,\n          };\n        }\n      }\n    }\n  }\n\n  // 4. Check actor for CI pass-through (look up by metadata)\n  if (context.actor) {\n    const profile = await findProfileByExternalId(\n      'github',\n      context.actor,\n      options,\n    );\n    if (profile) {\n      return {\n        profile,\n        source: 'actor',\n      };\n    }\n  }\n\n  // No authentication found\n  return {\n    profile: null,\n    source: 'none',\n  };\n}\n\n/**\n * Find a profile by external ID (e.g., GitHub username)\n *\n * This looks up profiles by their linked external identities or metadata.\n *\n * @param provider - The external provider (e.g., 'github')\n * @param externalId - The external identifier (e.g., GitHub username)\n * @param options - Database options\n * @returns The profile or null\n */\nasync function findProfileByExternalId(\n  provider: string,\n  externalId: string,\n  options: SmrtObjectOptions,\n): Promise<Profile | null> {\n  // First check OIDC identities (if they use the provider)\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n\n  const oidcCollection = await OidcIdentityCollection.create(options);\n  const identities = await oidcCollection.findByProvider(provider);\n\n  for (const identity of identities) {\n    // Check if the subject matches the external ID\n    if (\n      identity.subject === externalId ||\n      identity.email?.includes(externalId)\n    ) {\n      const profile = await identity.getProfile();\n      if (profile) return profile;\n    }\n  }\n\n  // Could also check profile metadata for external IDs\n  // This would require a standardized metadata field like 'github_username'\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n\n  // Try to find by email that looks like a GitHub noreply\n  const profiles = await profileCollection.list({\n    where: {\n      email: `${externalId}@users.noreply.github.com`,\n    },\n    limit: 1,\n  });\n\n  if (profiles.length > 0) {\n    return profiles[0];\n  }\n\n  return null;\n}\n\n/**\n * Create a profile from OIDC claims if it doesn't exist\n *\n * Resolution order:\n * 1. If OIDC identity (iss + sub) already exists → return linked profile\n * 2. If the email matches an existing Profile, fail closed because this\n *    package cannot prove whether a User owns it\n * 3. Otherwise, create new profile + identity\n *\n * Security considerations:\n * - Existing issuer/subject links always keep their already-linked Profile,\n *   including legacy tenant-scoped or non-Person Profiles, and refresh the\n *   cached identity email. This exact-link compatibility does not perform\n *   email-based canonical reuse.\n * - New identities never attach to an existing email match through this\n *   Profile-only helper because Profile ownership belongs to the users package.\n *   Use `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email\n *   reuse and its supported pre-provision resolver hook.\n * - This function trusts the OIDC provider to assert correct email_verified status.\n *   Only use with trusted providers.\n *\n * @param claims - OIDC token claims\n * @param provider - Provider name (e.g., 'keycloak', 'google', 'github')\n * @param options - Database options\n * @returns The created or existing profile with linked OIDC identity\n */\nexport async function createProfileFromOidc(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  return coordinateProfileOidcProvisioning(claims, provider, options);\n}\n\n/**\n * @internal Transactionally reuse one exact legacy issuer/subject link.\n *\n * This path cannot create or rebind authority. It intentionally preserves\n * existing tenant-scoped and non-Person Profile links; canonical global Person\n * validation remains mandatory for every path that creates a User/session.\n */\nexport async function reuseExistingOidcIdentityForProfile(\n  profileId: string,\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: false }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent exact OIDC identity reuse did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(async () => {\n        const { OidcIdentityCollection } = await import(\n          '../collections/OidcIdentityCollection'\n        );\n        const identity = await (\n          await OidcIdentityCollection.create({ db: tx })\n        ).findBySubject(normalizedClaims.iss, normalizedClaims.sub);\n        if (!identity) {\n          throw new Error(\n            'OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().',\n          );\n        }\n        if (identity.profileId !== profileId) {\n          throw new Error(\n            `OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`,\n          );\n        }\n        const profile = await identity.getProfile();\n        if (!profile) {\n          throw new Error('The exact OIDC identity has no linked Profile.');\n        }\n        identity.provider = provider;\n        if (normalizedClaims.email) identity.email = normalizedClaims.email;\n        identity.lastUsedAt = new Date();\n        await identity.save();\n        return { profile, oidcIdentity: identity, created: false as const };\n      }),\n  });\n}\n\nasync function coordinateProfileOidcProvisioning(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n      ...(normalizedClaims.email ? [`email:${normalizedClaims.email}`] : []),\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent OIDC Profile provisioning did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(() =>\n        provisionOidcProfile(normalizedClaims, provider, {\n          ...options,\n          db: tx,\n        }),\n      ),\n  });\n}\n\nasync function provisionOidcProfile(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions & { db: DatabaseInterface },\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const identityCollection = await OidcIdentityCollection.create(options);\n  const existingIdentity = await identityCollection.findBySubject(\n    claims.iss,\n    claims.sub,\n  );\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (!profile) {\n      throw new Error('The exact OIDC identity has no linked Profile.');\n    }\n    if (claims.email) existingIdentity.email = claims.email;\n    existingIdentity.lastUsedAt = new Date();\n    await existingIdentity.save();\n    return { profile, oidcIdentity: existingIdentity, created: false };\n  }\n\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n  if (claims.email) {\n    const collision = await profileCollection.findUniqueGlobalPersonByEmail(\n      claims.email,\n    );\n    if (collision) {\n      if (claims.email_verified !== true) {\n        throw new Error(\n          `OIDC email ${claims.email} is not verified and already belongs to a Profile.`,\n        );\n      }\n      throw new Error(\n        `OIDC email ${claims.email} already belongs to a Profile; createProfileFromOidc() cannot prove that Profile is unowned. Use UserCollection.getOrCreateFromOidc() for owner-aware linking.`,\n      );\n    }\n  }\n\n  const profile = await createOidcProvisioningPerson(options.db, {\n    email: claims.email ?? '',\n    name: claims.name,\n    preferredUsername: claims.preferred_username,\n    subject: claims.sub,\n  });\n  const oidcIdentity = await insertOidcProvisioningIdentity(options.db, {\n    email: claims.email,\n    issuer: claims.iss,\n    profileId: requireOidcProfileId(profile.id),\n    provider,\n    subject: claims.sub,\n  });\n  return { profile, oidcIdentity, created: true };\n}\n\nasync function rebindOidcProfileResult<\n  T extends {\n    profile: Profile;\n    oidcIdentity: OidcIdentity;\n    created: boolean;\n  },\n>(result: T, rootDb: DatabaseInterface): Promise<T> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileId = requireOidcProfileId(result.profile.id);\n  const identityId = requireOidcProfileId(result.oidcIdentity.id);\n  const [profile, oidcIdentity] = await withSystemContext(async () => {\n    const profiles = await ProfileCollection.create({ db: rootDb });\n    const identities = await OidcIdentityCollection.create({ db: rootDb });\n    return Promise.all([\n      profiles.get({ id: profileId }),\n      identities.get({ id: identityId }),\n    ]);\n  });\n  if (!profile || !oidcIdentity) {\n    throw new Error(\n      'Committed OIDC Profile provisioning result was not found.',\n    );\n  }\n  return { ...result, profile, oidcIdentity };\n}\n\nfunction normalizeOidcProfileClaims(claims: {\n  sub: string;\n  iss: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  preferred_username?: string;\n}) {\n  const sub = claims?.sub;\n  const iss = claims?.iss;\n  if (\n    typeof sub !== 'string' ||\n    sub.trim().length === 0 ||\n    typeof iss !== 'string' ||\n    iss.trim().length === 0\n  ) {\n    throw new Error(\n      'Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.',\n    );\n  }\n  const suppliedEmail = claims.email;\n  return {\n    ...claims,\n    sub,\n    iss,\n    email:\n      typeof suppliedEmail === 'string' && suppliedEmail.trim()\n        ? normalizeIdentityEmail(suppliedEmail)\n        : undefined,\n  };\n}\n\nfunction requireOidcProfileId(value: unknown): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error('OIDC Profile provisioning did not produce an id.');\n  }\n  return value;\n}\n\nasync function resolveOidcProfileDatabase(\n  db: SmrtObjectOptions['db'],\n): Promise<DatabaseInterface> {\n  if (!db) {\n    throw new Error(\n      'OIDC Profile provisioning requires an initialized database.',\n    );\n  }\n  return resolveDatabase(db as Parameters<typeof resolveDatabase>[0]);\n}\n\n/**\n * Create a profile from Nostr identity (used by magic link service)\n *\n * This is typically called internally by the magic link service,\n * but can be used directly if needed.\n *\n * @param email - Email address for the profile\n * @param nostrData - Encrypted Nostr keypair data\n * @param options - Database options\n * @returns The created profile with linked Nostr identity\n */\nexport async function createProfileFromNostr(\n  email: string,\n  nostrData: {\n    pubkey: string;\n    encryptedPrivkey: string;\n    encryptionIv: string;\n    encryptionTag: string;\n    nip05Username?: string;\n  },\n  options: SmrtObjectOptions,\n): Promise<{\n  profile: Profile;\n  nostrIdentity: NostrIdentity;\n  created: boolean;\n}> {\n  const normalizedEmail = normalizeIdentityEmail(email);\n\n  // Check if Nostr identity already exists\n  const existingIdentity = await NostrIdentity.findByEmail(\n    normalizedEmail,\n    options,\n  );\n\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (profile) {\n      return {\n        profile,\n        nostrIdentity: existingIdentity,\n        created: false,\n      };\n    }\n  }\n\n  // Create new profile\n  const { Person } = await import('../models/ProfileTypes');\n  const { ProfileTypeCollection } = await import(\n    '../collections/ProfileTypeCollection'\n  );\n\n  // Get or create the 'person' type\n  const typeCollection = await ProfileTypeCollection.create(options);\n  let personType = await typeCollection.getBySlug('person');\n\n  if (!personType) {\n    const { ProfileType } = await import('../models/ProfileType');\n    personType = new ProfileType({\n      ...options,\n      slug: 'person',\n      name: 'Person',\n      description: 'Individual person profile',\n    });\n    await personType.initialize();\n    await personType.save();\n  }\n\n  const profile = new Person({\n    ...options,\n    typeId: personType.id as string,\n    email: normalizedEmail,\n    name: normalizedEmail.split('@')[0], // Default name from email\n  });\n  await profile.initialize();\n  await profile.save();\n\n  // Create Nostr identity\n  const nostrIdentity = new NostrIdentity({\n    ...options,\n    profileId: profile.id as string,\n    pubkey: nostrData.pubkey,\n    encryptedPrivkey: nostrData.encryptedPrivkey,\n    encryptionIv: nostrData.encryptionIv,\n    encryptionTag: nostrData.encryptionTag,\n    email: normalizedEmail,\n    nip05Username:\n      nostrData.nip05Username?.toLowerCase() || normalizedEmail.split('@')[0],\n  });\n  await nostrIdentity.initialize();\n  await nostrIdentity.save();\n\n  return {\n    profile,\n    nostrIdentity,\n    created: true,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAqIA,eAAsB,gBACpB,SACgC;CAChC,MAAM,UAA6B,EAAE,IAAI,QAAQ,GAAG;CAGpD,IAAI,QAAQ,QAAQ;EAClB,MAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,QAAQ,OAAO;EAC1D,IAAI,QAAQ;GACV,MAAM,UAAU,MAAM,OAAO,WAAW;GACxC,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,aAAa,OAAO,QAAQ,aAAa,KAAK;EACxD,MAAM,eAAe,MAAM,aAAa,cACtC,QAAQ,YAAY,KACpB,QAAQ,YAAY,KACpB,OACF;EAEA,IAAI,cAAc;GAEhB,MAAM,aAAa,YAAY;GAE/B,MAAM,UAAU,MAAM,aAAa,WAAW;GAC9C,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,WAAW;EAC5D,MAAM,EAAE,OAAO,cAAc,QAAQ;EAIrC,IADqB,gBAAgB,OAAO,SACxC,CAAA,CAAa,OAAO;GAEtB,MAAM,gBAAgB,MAAM,cAAc,aACxC,MAAM,QACN,OACF;GAEA,IAAI,eAAe;IAEjB,MAAM,cAAc,YAAY;IAEhC,MAAM,UAAU,MAAM,cAAc,WAAW;IAC/C,IAAI,SACF,OAAO;KACL;KACA,QAAQ;KACR;IACF;GAEJ;EACF;CACF;CAGA,IAAI,QAAQ,OAAO;EACjB,MAAM,UAAU,MAAM,wBACpB,UACA,QAAQ,OACR,OACF;EACA,IAAI,SACF,OAAO;GACL;GACA,QAAQ;EACV;CAEJ;CAGA,OAAO;EACL,SAAS;EACT,QAAQ;CACV;AACF;AAYA,eAAe,wBACb,UACA,YACA,SACyB;CAEzB,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAIF,MAAM,aAAa,OAAM,MADI,uBAAuB,OAAO,OAAO,EAAA,CAC1B,eAAe,QAAQ;CAE/D,KAAA,MAAW,YAAY,YAErB,IACE,SAAS,YAAY,cACrB,SAAS,OAAO,SAAS,UAAU,GACnC;EACA,MAAM,UAAU,MAAM,SAAS,WAAW;EAC1C,IAAI,SAAS,OAAO;CACtB;CAKF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,MAAM,WAAW,OAAM,MAHS,kBAAkB,OAAO,OAAO,EAAA,CAGvB,KAAK;EAC5C,OAAO,EACL,OAAO,GAAG,WAAU,2BACtB;EACA,OAAO;CACT,CAAC;CAED,IAAI,SAAS,SAAS,GACpB,OAAO,SAAS;CAGlB,OAAO;AACT;AA4BA,eAAsB,sBACpB,QAQA,UACA,SAC6E;CAC7E,OAAO,kCAAkC,QAAQ,UAAU,OAAO;AACpE;AASA,eAAsB,oCACpB,WACA,QAQA,UACA,SAC2E;CAC3E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,GACF;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,kBAAkB,YAAY;GAC5B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAEF,MAAM,WAAW,OACf,MAAM,uBAAuB,OAAO,EAAE,IAAI,GAAG,CAAC,EAAA,CAC9C,cAAc,iBAAiB,KAAK,iBAAiB,GAAG;GAC1D,IAAI,CAAC,UACH,MAAM,IAAI,MACR,0IACF;GAEF,IAAI,SAAS,cAAc,WACzB,MAAM,IAAI,MACR,iBAAiB,iBAAiB,IAAG,WAAY,iBAAiB,IAAG,iCACvE;GAEF,MAAM,UAAU,MAAM,SAAS,WAAW;GAC1C,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,SAAS,WAAW;GACpB,IAAI,iBAAiB,OAAO,SAAS,QAAQ,iBAAiB;GAC9D,SAAS,6BAAa,IAAI,KAAK;GAC/B,MAAM,SAAS,KAAK;GACpB,OAAO;IAAE;IAAS,cAAc;IAAU,SAAS;GAAe;EACpE,CAAC;CACL,CAAC;AACH;AAEA,eAAe,kCACb,QAQA,UACA,SAC6E;CAC7E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,KACA,GAAI,iBAAiB,QAAQ,CAAC,SAAS,iBAAiB,OAAO,IAAI,CAAC,CACtE;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,wBACE,qBAAqB,kBAAkB,UAAU;GAC/C,GAAG;GACH,IAAI;EACN,CAAC,CACH;CACJ,CAAC;AACH;AAEA,eAAe,qBACb,QAQA,UACA,SAC6E;CAC7E,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAGF,MAAM,mBAAmB,OAAM,MADE,uBAAuB,OAAO,OAAO,EAAA,CACpB,cAChD,OAAO,KACP,OAAO,GACT;CACA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAI,CAACA,UACH,MAAM,IAAI,MAAM,gDAAgD;EAElE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,OAAO;EAClD,iBAAiB,6BAAa,IAAI,KAAK;EACvC,MAAM,iBAAiB,KAAK;EAC5B,OAAO;GAAE,SAAAA;GAAS,cAAc;GAAkB,SAAS;EAAM;CACnE;CAEA,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO;CAChE,IAAI,OAAO;MAIL,MAHoB,kBAAkB,8BACxC,OAAO,KACT,GACe;GACb,IAAI,OAAO,mBAAmB,MAC5B,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,mDAC5B;GAEF,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,+JAC5B;EACF;;CAGF,MAAM,UAAU,MAAM,6BAA6B,QAAQ,IAAI;EAC7D,OAAO,OAAO,SAAS;EACvB,MAAM,OAAO;EACb,mBAAmB,OAAO;EAC1B,SAAS,OAAO;CAClB,CAAC;CAQD,OAAO;EAAE;EAAS,cAAA,MAPS,+BAA+B,QAAQ,IAAI;GACpE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,WAAW,qBAAqB,QAAQ,EAAE;GAC1C;GACA,SAAS,OAAO;EAClB,CAAC;EAC+B,SAAS;CAAK;AAChD;AAEA,eAAe,wBAMb,QAAW,QAAuC;CAClD,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,YAAY,qBAAqB,OAAO,QAAQ,EAAE;CACxD,MAAM,aAAa,qBAAqB,OAAO,aAAa,EAAE;CAC9D,MAAM,CAAC,SAAS,gBAAgB,MAAM,kBAAkB,YAAY;EAClE,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE,IAAI,OAAO,CAAC;EAC9D,MAAM,aAAa,MAAM,uBAAuB,OAAO,EAAE,IAAI,OAAO,CAAC;EACrE,OAAO,QAAQ,IAAI,CACjB,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,GAC9B,WAAW,IAAI,EAAE,IAAI,WAAW,CAAC,CACnC,CAAC;CACH,CAAC;CACD,IAAI,CAAC,WAAW,CAAC,cACf,MAAM,IAAI,MACR,2DACF;CAEF,OAAO;EAAE,GAAG;EAAQ;EAAS;CAAa;AAC5C;AAEA,SAAS,2BAA2B,QAOjC;CACD,MAAM,MAAM,QAAQ;CACpB,MAAM,MAAM,QAAQ;CACpB,IACE,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,KACtB,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,GAEtB,MAAM,IAAI,MACR,0EACF;CAEF,MAAM,gBAAgB,OAAO;CAC7B,OAAO;EACL,GAAG;EACH;EACA;EACA,OACE,OAAO,kBAAkB,YAAY,cAAc,KAAK,IACpD,uBAAuB,aAAa,IACpC,KAAA;CACR;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,eAAe,2BACb,IAC4B;CAC5B,IAAI,CAAC,IACH,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,gBAAgB,EAA2C;AACpE;AAaA,eAAsB,uBACpB,OACA,WAOA,SAKC;CACD,MAAM,kBAAkB,uBAAuB,KAAK;CAGpD,MAAM,mBAAmB,MAAM,cAAc,YAC3C,iBACA,OACF;CAEA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAIA,UACF,OAAO;GACL,SAAAA;GACA,eAAe;GACf,SAAS;EACX;CAEJ;CAGA,MAAM,EAAE,WAAW,MAAM,OAAO,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAChC,MAAM,EAAE,0BAA0B,MAAM,OACtC,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,IAAI,aAAa,OAAM,MADM,sBAAsB,OAAO,OAAO,EAAA,CAC3B,UAAU,QAAQ;CAExD,IAAI,CAAC,YAAY;EACf,MAAM,EAAE,gBAAgB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EACrC,aAAa,IAAI,YAAY;GAC3B,GAAG;GACH,MAAM;GACN,MAAM;GACN,aAAa;EACf,CAAC;EACD,MAAM,WAAW,WAAW;EAC5B,MAAM,WAAW,KAAK;CACxB;CAEA,MAAM,UAAU,IAAI,OAAO;EACzB,GAAG;EACH,QAAQ,WAAW;EACnB,OAAO;EACP,MAAM,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACnC,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,QAAQ,KAAK;CAGnB,MAAM,gBAAgB,IAAI,cAAc;EACtC,GAAG;EACH,WAAW,QAAQ;EACnB,QAAQ,UAAU;EAClB,kBAAkB,UAAU;EAC5B,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,OAAO;EACP,eACE,UAAU,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACzE,CAAC;CACD,MAAM,cAAc,WAAW;CAC/B,MAAM,cAAc,KAAK;CAEzB,OAAO;EACL;EACA;EACA,SAAS;CACX;AACF"}