@happyvertical/smrt-profiles 0.40.70 → 0.41.0

package/dist/chunks/{oidcProvisioningPrimitives-BWHPpJde.js → oidcProvisioningPrimitives-Bzv4VTcn.js}

@@ -1,10 +1,13 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { a as Profile, m as saveOidcRaceArbiter, n as ProfileCollection, o as ProfileType } from "./ProfileCollection-BOwbNCgG.js";
-import { t as OidcIdentity } from "./OidcIdentity-Bd68oFpZ.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { a as Profile, m as saveOidcRaceArbiter, n as ProfileCollection, o as ProfileType } from "./ProfileCollection-BsKhR5Dp.js";
+import { t as OidcIdentity } from "./OidcIdentity-DANnAbfU.js";
 import { SmrtCollection, smrt } from "@happyvertical/smrt-core";
 import { isSystemContext } from "@happyvertical/smrt-tenancy";
 //#region src/collections/ProfileTypeCollection.ts
 var ProfileTypeCollection_exports = /* @__PURE__ */ __exportAll({ ProfileTypeCollection: () => ProfileTypeCollection });
+function isPostgresUrl(url) {
+	return /^postgres(?:ql)?:/iu.test(url ?? "");
+}
 var ProfileTypeCollection = class extends SmrtCollection {
 	static _itemClass = ProfileType;
 	/**
@@ -43,10 +46,22 @@ var ProfileTypeCollection = class extends SmrtCollection {
 		if (!isSystemContext()) throw new Error("Global ProfileType creation requires an explicit system context.");
 		const existing = await this.loadGlobalBySlug(slug);
 		if (existing) return existing;
-		await this.db.query(`INSERT INTO profile_types
-        (id, slug, context, _meta_type, tenant_id, name, description)
-       VALUES (?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?)
-       ON CONFLICT (slug, context, _meta_type) DO NOTHING`, crypto.randomUUID(), slug, defaults.name, defaults.description ?? null);
+		const insertIfAbsent = async (db) => {
+			if (isPostgresUrl(db.url)) await db.query("SELECT pg_advisory_xact_lock(hashtext(?), hashtext(?))", "@happyvertical/smrt-profiles:profile_types:global", slug);
+			await db.query(`INSERT INTO profile_types
+          (id, slug, context, _meta_type, tenant_id, name, description)
+         SELECT ?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?
+         WHERE NOT EXISTS (
+           SELECT 1 FROM profile_types
+           WHERE slug = ?
+             AND context = ''
+             AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'
+             AND tenant_id IS NULL
+         )`, crypto.randomUUID(), slug, defaults.name, defaults.description ?? null, slug);
+		};
+		const isTransactionBound = typeof this.db.commit === "function";
+		if (isPostgresUrl(this.db.url) && !isTransactionBound && typeof this.db.transaction === "function") await this.db.transaction((tx) => insertIfAbsent(tx));
+		else await insertIfAbsent(this.db);
 		const profileType = await this.loadGlobalBySlug(slug);
 		if (!profileType) throw new Error(`Global ProfileType '${slug}' could not be created or loaded.`);
 		return profileType;
@@ -135,4 +150,4 @@ function requireProvisioningId(value, label) {
 //#endregion
 export { Person as a, ProfileTypeCollection_exports as c, Organization as i, insertOidcProvisioningIdentity as n, ProfileTypes_exports as o, Bot as r, ProfileTypeCollection as s, createOidcProvisioningPerson as t };
 
-//# sourceMappingURL=oidcProvisioningPrimitives-BWHPpJde.js.map
+//# sourceMappingURL=oidcProvisioningPrimitives-Bzv4VTcn.js.map

package/dist/chunks/oidcProvisioningPrimitives-Bzv4VTcn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcProvisioningPrimitives-Bzv4VTcn.js","names":[],"sources":["../../src/collections/ProfileTypeCollection.ts","../../src/models/ProfileTypes.ts","../../src/auth/oidcProvisioningPrimitives.ts"],"sourcesContent":["/**\n * ProfileTypeCollection - Collection manager for ProfileType objects\n *\n * Provides querying for profile type lookup table.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { isSystemContext } from '@happyvertical/smrt-tenancy';\nimport { ProfileType } from '../models/ProfileType';\n\nfunction isPostgresUrl(url: string | undefined): boolean {\n  return /^postgres(?:ql)?:/iu.test(url ?? '');\n}\n\nexport class ProfileTypeCollection extends SmrtCollection<ProfileType> {\n  static readonly _itemClass = ProfileType;\n\n  /**\n   * Get profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileType instance or null\n   */\n  async getBySlug(slug: string): Promise<ProfileType | null> {\n    return await this.get({ slug });\n  }\n\n  /**\n   * Get or create a profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @param defaults - Default values if creating\n   * @returns ProfileType instance\n   */\n  async getOrCreateBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    const existing = await this.getBySlug(slug);\n    if (existing) return existing;\n\n    const profileType = await this.create({ slug, ...defaults });\n    await profileType.save();\n    return profileType;\n  }\n\n  /**\n   * Atomically create or load a global ProfileType from trusted system code.\n   *\n   * This intentionally bypasses tenant auto-population and therefore refuses\n   * to run outside an explicit `withSystemContext()` boundary.\n   */\n  async getOrCreateGlobalBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    if (!isSystemContext()) {\n      throw new Error(\n        'Global ProfileType creation requires an explicit system context.',\n      );\n    }\n\n    const existing = await this.loadGlobalBySlug(slug);\n    if (existing) return existing;\n\n    // A plain SMRT create is an upsert and may replace the winning row's id\n    // when two first-login transactions race. Keep the canonical id stable by\n    // using a cross-adapter insert-if-absent and then hydrating the winner.\n    //\n    // The table's unique key is `(tenant_id, slug, context, _meta_type)` since\n    // smrt#2360, and a global row's NULL tenant never conflicts at the\n    // database level (NULLs are distinct in a unique index), so a raw\n    // `ON CONFLICT (…) DO NOTHING` can no longer arbitrate this race. Serialize\n    // the global create per slug instead: PostgreSQL through a\n    // transaction-scoped advisory lock (the arbiter the SDK's null-aware\n    // upsert uses too); the embedded engines through the provisioning\n    // coordinator's in-process lock plus their single-writer transactions.\n    const insertIfAbsent = async (db: typeof this.db): Promise<void> => {\n      if (isPostgresUrl(db.url)) {\n        await db.query(\n          'SELECT pg_advisory_xact_lock(hashtext(?), hashtext(?))',\n          '@happyvertical/smrt-profiles:profile_types:global',\n          slug,\n        );\n      }\n      await db.query(\n        `INSERT INTO profile_types\n          (id, slug, context, _meta_type, tenant_id, name, description)\n         SELECT ?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?\n         WHERE NOT EXISTS (\n           SELECT 1 FROM profile_types\n           WHERE slug = ?\n             AND context = ''\n             AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n             AND tenant_id IS NULL\n         )`,\n        crypto.randomUUID(),\n        slug,\n        defaults.name,\n        defaults.description ?? null,\n        slug,\n      );\n    };\n\n    // A transaction-scoped advisory lock only spans both statements when they\n    // run on one transaction. On PostgreSQL, any handle that is NOT already\n    // transaction-bound may route each query to a different pooled connection\n    // — a root adapter (`beginTransaction` present) and equally a view\n    // wrapper (only `transaction()` present) — so open a transaction for the\n    // pair on every such handle. A transaction-bound handle (fingerprint: it\n    // carries `commit`) already keeps both statements on one client and must\n    // not nest. Embedded engines run directly: a nested root transaction\n    // would deadlock their single-writer adapters, and the provisioning\n    // coordinator's in-process lock already serializes them.\n    const isTransactionBound =\n      typeof (this.db as { commit?: unknown }).commit === 'function';\n    if (\n      isPostgresUrl(this.db.url) &&\n      !isTransactionBound &&\n      typeof this.db.transaction === 'function'\n    ) {\n      await this.db.transaction((tx) => insertIfAbsent(tx));\n    } else {\n      await insertIfAbsent(this.db);\n    }\n    const profileType = await this.loadGlobalBySlug(slug);\n    if (!profileType) {\n      throw new Error(\n        `Global ProfileType '${slug}' could not be created or loaded.`,\n      );\n    }\n    return profileType;\n  }\n\n  private async loadGlobalBySlug(slug: string): Promise<ProfileType | null> {\n    const result = await this.db.query(\n      `SELECT id\n       FROM profile_types\n       WHERE slug = ?\n         AND context = ''\n         AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n         AND tenant_id IS NULL\n       LIMIT 1`,\n      slug,\n    );\n    const id = result.rows[0]?.id;\n    return typeof id === 'string' ? this.get({ id }) : null;\n  }\n}\n","/**\n * Profile subclasses for STI (Single Table Inheritance)\n *\n * These classes inherit from Profile and automatically use the shared\n * profiles table with _meta_type discriminator.\n */\n\nimport { smrt } from '@happyvertical/smrt-core';\nimport { Profile, type ProfileOptions } from './Profile';\n\n/**\n * Person profile type\n *\n * Represents individual people/users.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Person extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Person-specific initialization can go here\n  }\n}\n\n/**\n * Organization profile type\n *\n * Represents companies, groups, institutions, and other organizational entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Organization extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Organization-specific initialization can go here\n  }\n}\n\n/**\n * Bot profile type\n *\n * Represents automated agents, bots, and AI entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Bot extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Bot-specific initialization can go here\n  }\n}\n","import type { getDatabase } from '@happyvertical/sql';\nimport { ProfileCollection } from '../collections/ProfileCollection';\nimport { ProfileTypeCollection } from '../collections/ProfileTypeCollection';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { Person } from '../models/ProfileTypes';\nimport { saveOidcRaceArbiter } from './oidcProvisioningCoordinator';\n\ntype DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;\n\nexport interface OidcProvisioningPersonInput {\n  email?: string;\n  name?: string;\n  preferredUsername?: string;\n  subject: string;\n}\n\nexport interface OidcProvisioningIdentityInput {\n  email?: string;\n  issuer: string;\n  profileId: string;\n  provider: string;\n  subject: string;\n}\n\n/** Create and reserve a fresh global Person inside the caller's transaction. */\nexport async function createOidcProvisioningPerson(\n  db: DatabaseInterface,\n  input: OidcProvisioningPersonInput,\n): Promise<Profile> {\n  const typeCollection = await ProfileTypeCollection.create({ db });\n  const personType = await typeCollection.getOrCreateGlobalBySlug('person', {\n    name: 'Person',\n    description: 'Individual person profile',\n  });\n  const typeId = requireProvisioningId(personType.id, 'Person ProfileType');\n  let profile: Profile = new Person({\n    db,\n    // OIDC display names are not identity keys. A per-profile slug keeps\n    // SMRT's natural-key upsert from replacing an unrelated Person.\n    slug: `oidc-${crypto.randomUUID()}`,\n    tenantId: null,\n    typeId,\n    email: input.email ?? '',\n    name: input.name || input.preferredUsername || input.subject,\n  });\n  await profile.initialize();\n  await saveOidcRaceArbiter(() => profile.save());\n\n  if (input.email) {\n    const profiles = await ProfileCollection.create({ db });\n    profile = await profiles.reserveCanonicalIdentityEmail(\n      requireProvisioningId(profile.id, 'Created Profile'),\n      input.email,\n    );\n  }\n  return profile;\n}\n\n/** Insert the identity after the caller proves Profile ownership. */\nexport async function insertOidcProvisioningIdentity(\n  db: DatabaseInterface,\n  input: OidcProvisioningIdentityInput,\n): Promise<OidcIdentity> {\n  const identity = new OidcIdentity({\n    db,\n    email: input.email ?? '',\n    issuer: input.issuer,\n    profileId: input.profileId,\n    provider: input.provider,\n    subject: input.subject,\n  });\n  await identity.initialize();\n  await saveOidcRaceArbiter(() => identity.save());\n  return identity;\n}\n\nfunction requireProvisioningId(value: unknown, label: string): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`${label} did not produce an id.`);\n  }\n  return value;\n}\n"],"mappings":";;;;;;;AAUA,SAAS,cAAc,KAAkC;CACvD,OAAO,sBAAsB,KAAK,OAAO,EAAE;AAC7C;AAEO,IAAM,wBAAN,cAAoC,eAA4B;CACrE,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,UAAU,MAA2C;EACzD,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC;CAChC;;;;;;;;CASA,MAAM,kBACJ,MACA,UACsB;EACtB,MAAM,WAAW,MAAM,KAAK,UAAU,IAAI;EAC1C,IAAI,UAAU,OAAO;EAErB,MAAM,cAAc,MAAM,KAAK,OAAO;GAAE;GAAM,GAAG;EAAS,CAAC;EAC3D,MAAM,YAAY,KAAK;EACvB,OAAO;CACT;;;;;;;CAQA,MAAM,wBACJ,MACA,UACsB;EACtB,IAAI,CAAC,gBAAgB,GACnB,MAAM,IAAI,MACR,kEACF;EAGF,MAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;EACjD,IAAI,UAAU,OAAO;EAcrB,MAAM,iBAAiB,OAAO,OAAsC;GAClE,IAAI,cAAc,GAAG,GAAG,GACtB,MAAM,GAAG,MACP,0DACA,qDACA,IACF;GAEF,MAAM,GAAG,MACP;;;;;;;;;aAUA,OAAO,WAAW,GAClB,MACA,SAAS,MACT,SAAS,eAAe,MACxB,IACF;EACF;EAYA,MAAM,qBACJ,OAAQ,KAAK,GAA4B,WAAW;EACtD,IACE,cAAc,KAAK,GAAG,GAAG,KACzB,CAAC,sBACD,OAAO,KAAK,GAAG,gBAAgB,YAE/B,MAAM,KAAK,GAAG,aAAa,OAAO,eAAe,EAAE,CAAC;OAEpD,MAAM,eAAe,KAAK,EAAE;EAE9B,MAAM,cAAc,MAAM,KAAK,iBAAiB,IAAI;EACpD,IAAI,CAAC,aACH,MAAM,IAAI,MACR,uBAAuB,KAAI,kCAC7B;EAEF,OAAO;CACT;CAEA,MAAc,iBAAiB,MAA2C;EAWxE,MAAM,MAAK,MAVU,KAAK,GAAG,MAC3B;;;;;;iBAOA,IACF,EAAA,CACkB,KAAK,EAAC,EAAG;EAC3B,OAAO,OAAO,OAAO,WAAW,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI;CACrD;AACF;;;;;;;;;;;;;;;;AClIO,IAAM,SAAN,cAAqB,QAAQ;CAClC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,SAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,MAAA;AAeN,IAAM,eAAN,cAA2B,QAAQ;CACxC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,eAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,YAAA;AAeN,IAAM,MAAN,cAAkB,QAAQ;CAC/B,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,MAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,GAAA;;;ACtBb,eAAsB,6BACpB,IACA,OACkB;CAMlB,MAAM,SAAS,uBAAsB,OAJZ,MADI,sBAAsB,OAAO,EAAE,GAAG,CAAC,EAAA,CACxB,wBAAwB,UAAU;EACxE,MAAM;EACN,aAAa;CACf,CAAC,EAAA,CAC+C,IAAI,oBAAoB;CACxE,IAAI,UAAmB,IAAI,OAAO;EAChC;EAGA,MAAM,QAAQ,OAAO,WAAW;EAChC,UAAU;EACV;EACA,OAAO,MAAM,SAAS;EACtB,MAAM,MAAM,QAAQ,MAAM,qBAAqB,MAAM;CACvD,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,0BAA0B,QAAQ,KAAK,CAAC;CAE9C,IAAI,MAAM,OAER,UAAU,OAAM,MADO,kBAAkB,OAAO,EAAE,GAAG,CAAC,EAAA,CAC7B,8BACvB,sBAAsB,QAAQ,IAAI,iBAAiB,GACnD,MAAM,KACR;CAEF,OAAO;AACT;AAGA,eAAsB,+BACpB,IACA,OACuB;CACvB,MAAM,WAAW,IAAI,aAAa;EAChC;EACA,OAAO,MAAM,SAAS;EACtB,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,SAAS,WAAW;CAC1B,MAAM,0BAA0B,SAAS,KAAK,CAAC;CAC/C,OAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,GAAG,MAAK,wBAAyB;CAEnD,OAAO;AACT"}

package/dist/chunks/{resolveIdentity-F6aErDyh.js → resolveIdentity-DusCiNZo.js}

@@ -1,8 +1,8 @@
-import { _ as verifyAuthEvent, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { d as coordinateOidcProvisioning, h as normalizeIdentityEmail, p as isOidcProvisioningRaceConflict } from "./ProfileCollection-BOwbNCgG.js";
-import { t as ApiKey } from "./ApiKey-Br9NGBnr.js";
-import { t as OidcIdentity } from "./OidcIdentity-Bd68oFpZ.js";
-import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-BWHPpJde.js";
+import { _ as verifyAuthEvent, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { d as coordinateOidcProvisioning, h as normalizeIdentityEmail, p as isOidcProvisioningRaceConflict } from "./ProfileCollection-BsKhR5Dp.js";
+import { t as ApiKey } from "./ApiKey-CMm509C4.js";
+import { t as OidcIdentity } from "./OidcIdentity-DANnAbfU.js";
+import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-Bzv4VTcn.js";
 import { resolveDatabase } from "@happyvertical/smrt-core";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
 //#region src/auth/resolveIdentity.ts
@@ -65,13 +65,13 @@ async function resolveIdentity(context) {
 	};
 }
 async function findProfileByExternalId(provider, externalId, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-DmllRnCw.js").then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 	const identities = await (await OidcIdentityCollection.create(options)).findByProvider(provider);
 	for (const identity of identities) if (identity.subject === externalId || identity.email?.includes(externalId)) {
 		const profile = await identity.getProfile();
 		if (profile) return profile;
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-BOwbNCgG.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 	const profiles = await (await ProfileCollection.create(options)).list({
 		where: { email: `${externalId}@users.noreply.github.com` },
 		limit: 1
@@ -92,7 +92,7 @@ async function reuseExistingOidcIdentityForProfile(profileId, claims, provider,
 		createConcurrencyError: (cause) => new Error("Concurrent exact OIDC identity reuse did not converge.", cause === void 0 ? void 0 : { cause }),
 		rebindRootResult: rebindOidcProfileResult,
 		provision: (tx) => withSystemContext(async () => {
-			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-DmllRnCw.js").then((n) => n.r);
+			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 			const identity = await (await OidcIdentityCollection.create({ db: tx })).findBySubject(normalizedClaims.iss, normalizedClaims.sub);
 			if (!identity) throw new Error("OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().");
 			if (identity.profileId !== profileId) throw new Error(`OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`);
@@ -126,7 +126,7 @@ async function coordinateProfileOidcProvisioning(claims, provider, options) {
 	});
 }
 async function provisionOidcProfile(claims, provider, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-DmllRnCw.js").then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 	const existingIdentity = await (await OidcIdentityCollection.create(options)).findBySubject(claims.iss, claims.sub);
 	if (existingIdentity) {
 		const profile2 = await existingIdentity.getProfile();
@@ -140,7 +140,7 @@ async function provisionOidcProfile(claims, provider, options) {
 			created: false
 		};
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-BOwbNCgG.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 	const profileCollection = await ProfileCollection.create(options);
 	if (claims.email) {
 		if (await profileCollection.findUniqueGlobalPersonByEmail(claims.email)) {
@@ -167,8 +167,8 @@ async function provisionOidcProfile(claims, provider, options) {
 	};
 }
 async function rebindOidcProfileResult(result, rootDb) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-DmllRnCw.js").then((n) => n.r);
-	const { ProfileCollection } = await import("./ProfileCollection-BOwbNCgG.js").then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 	const profileId = requireOidcProfileId(result.profile.id);
 	const identityId = requireOidcProfileId(result.oidcIdentity.id);
 	const [profile, oidcIdentity] = await withSystemContext(async () => {
@@ -214,11 +214,11 @@ async function createProfileFromNostr(email, nostrData, options) {
 			created: false
 		};
 	}
-	const { Person } = await import("./oidcProvisioningPrimitives-BWHPpJde.js").then((n) => n.o);
-	const { ProfileTypeCollection } = await import("./oidcProvisioningPrimitives-BWHPpJde.js").then((n) => n.c);
+	const { Person } = await import("./oidcProvisioningPrimitives-Bzv4VTcn.js").then((n) => n.o);
+	const { ProfileTypeCollection } = await import("./oidcProvisioningPrimitives-Bzv4VTcn.js").then((n) => n.c);
 	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
 	if (!personType) {
-		const { ProfileType } = await import("./ProfileCollection-BOwbNCgG.js").then((n) => n.s);
+		const { ProfileType } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.s);
 		personType = new ProfileType({
 			...options,
 			slug: "person",
@@ -257,4 +257,4 @@ async function createProfileFromNostr(email, nostrData, options) {
 //#endregion
 export { resolveIdentity_exports as i, createProfileFromOidc as n, resolveIdentity as r, createProfileFromNostr as t };
 
-//# sourceMappingURL=resolveIdentity-F6aErDyh.js.map
+//# sourceMappingURL=resolveIdentity-DusCiNZo.js.map

package/dist/chunks/{resolveIdentity-F6aErDyh.js.map → resolveIdentity-DusCiNZo.js.map}

@@ -1 +1 @@
-{"version":3,"file":"resolveIdentity-F6aErDyh.js","names":["profile"],"sources":["../../src/auth/resolveIdentity.ts"],"sourcesContent":["/**\n * resolveIdentity - Resolves authentication context to a Profile\n *\n * Used by apps (blindmanpress.com) to resolve incoming auth to a Profile.\n * Modules (aedile, praeco) should receive the resolved profile from the app.\n *\n * Resolution order:\n * 1. API key header → ApiKey → Profile\n * 2. OIDC session → OidcIdentity → Profile\n * 3. Nostr auth → NostrIdentity → Profile\n * 4. Actor header (CI pass-through) → Profile lookup\n */\n\nimport {\n  resolveDatabase,\n  type SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport { withSystemContext } from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { ApiKey } from '../models/ApiKey';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { normalizeIdentityEmail } from './normalizeIdentityEmail';\nimport { type NostrEvent, verifyAuthEvent } from './nostrCrypto';\nimport {\n  coordinateOidcProvisioning,\n  isOidcProvisioningRaceConflict,\n} from './oidcProvisioningCoordinator';\nimport {\n  createOidcProvisioningPerson,\n  insertOidcProvisioningIdentity,\n} from './oidcProvisioningPrimitives';\n\n/**\n * Context provided to resolveIdentity\n */\nexport interface AuthContext {\n  /**\n   * API key from X-API-Key header or similar\n   */\n  apiKey?: string | null;\n\n  /**\n   * OIDC session data (from @auth/sveltekit or similar)\n   */\n  oidcSession?: {\n    sub?: string;\n    iss?: string;\n    email?: string;\n    name?: string;\n  } | null;\n\n  /**\n   * Actor identifier for CI pass-through identity\n   * Usually the GitHub actor (username) who triggered the workflow\n   */\n  actor?: string | null;\n\n  /**\n   * Nostr authentication data (NIP-42 style)\n   */\n  nostrAuth?: {\n    /** Signed Nostr event for authentication */\n    event: NostrEvent;\n    /** Expected challenge (to prevent replay attacks) */\n    challenge: string;\n  } | null;\n\n  /**\n   * Database/persistence options\n   */\n  db?: SmrtObjectOptions['db'];\n}\n\n/**\n * Result of identity resolution\n */\nexport interface ResolveIdentityResult {\n  /**\n   * The resolved profile, or null if not authenticated\n   */\n  profile: Profile | null;\n\n  /**\n   * How the identity was resolved\n   */\n  source: 'api_key' | 'oidc' | 'nostr' | 'actor' | 'none';\n\n  /**\n   * The API key record if authenticated via API key\n   */\n  apiKey?: ApiKey;\n\n  /**\n   * The OIDC identity record if authenticated via OIDC\n   */\n  oidcIdentity?: OidcIdentity;\n\n  /**\n   * The Nostr identity record if authenticated via Nostr\n   */\n  nostrIdentity?: NostrIdentity;\n}\n\n/**\n * Resolve authentication context to a Profile\n *\n * @param context - The authentication context from the request\n * @returns The resolved profile and metadata\n *\n * @example\n * ```typescript\n * // In SvelteKit hooks.server.ts\n * import { resolveIdentity } from '@happyvertical/smrt-profiles';\n *\n * const identityMiddleware: Handle = async ({ event, resolve }) => {\n *   const session = await event.locals.auth();\n *\n *   const { profile, source } = await resolveIdentity({\n *     oidcSession: session,\n *     apiKey: event.request.headers.get('X-API-Key'),\n *     actor: event.request.headers.get('X-Actor'),\n *     db: { type: 'postgres', url: DATABASE_URL },\n *   });\n *\n *   event.locals.profile = profile;\n *   event.locals.authSource = source;\n *\n *   return resolve(event);\n * };\n * ```\n */\nexport async function resolveIdentity(\n  context: AuthContext,\n): Promise<ResolveIdentityResult> {\n  const options: SmrtObjectOptions = { db: context.db };\n\n  // 1. Check API key header first (highest priority for programmatic access)\n  if (context.apiKey) {\n    const apiKey = await ApiKey.verify(context.apiKey, options);\n    if (apiKey) {\n      const profile = await apiKey.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'api_key',\n          apiKey,\n        };\n      }\n    }\n  }\n\n  // 2. Check OIDC session (web users)\n  if (context.oidcSession?.sub && context.oidcSession?.iss) {\n    const oidcIdentity = await OidcIdentity.findBySubject(\n      context.oidcSession.iss,\n      context.oidcSession.sub,\n      options,\n    );\n\n    if (oidcIdentity) {\n      // Record usage\n      await oidcIdentity.recordUsage();\n\n      const profile = await oidcIdentity.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'oidc',\n          oidcIdentity,\n        };\n      }\n    }\n  }\n\n  // 3. Check Nostr auth (NIP-42 style signed event)\n  if (context.nostrAuth?.event && context.nostrAuth?.challenge) {\n    const { event, challenge } = context.nostrAuth;\n\n    // Verify the auth event\n    const verifyResult = verifyAuthEvent(event, challenge);\n    if (verifyResult.valid) {\n      // Look up identity by public key\n      const nostrIdentity = await NostrIdentity.findByPubkey(\n        event.pubkey,\n        options,\n      );\n\n      if (nostrIdentity) {\n        // Record usage\n        await nostrIdentity.recordUsage();\n\n        const profile = await nostrIdentity.getProfile();\n        if (profile) {\n          return {\n            profile,\n            source: 'nostr',\n            nostrIdentity,\n          };\n        }\n      }\n    }\n  }\n\n  // 4. Check actor for CI pass-through (look up by metadata)\n  if (context.actor) {\n    const profile = await findProfileByExternalId(\n      'github',\n      context.actor,\n      options,\n    );\n    if (profile) {\n      return {\n        profile,\n        source: 'actor',\n      };\n    }\n  }\n\n  // No authentication found\n  return {\n    profile: null,\n    source: 'none',\n  };\n}\n\n/**\n * Find a profile by external ID (e.g., GitHub username)\n *\n * This looks up profiles by their linked external identities or metadata.\n *\n * @param provider - The external provider (e.g., 'github')\n * @param externalId - The external identifier (e.g., GitHub username)\n * @param options - Database options\n * @returns The profile or null\n */\nasync function findProfileByExternalId(\n  provider: string,\n  externalId: string,\n  options: SmrtObjectOptions,\n): Promise<Profile | null> {\n  // First check OIDC identities (if they use the provider)\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n\n  const oidcCollection = await OidcIdentityCollection.create(options);\n  const identities = await oidcCollection.findByProvider(provider);\n\n  for (const identity of identities) {\n    // Check if the subject matches the external ID\n    if (\n      identity.subject === externalId ||\n      identity.email?.includes(externalId)\n    ) {\n      const profile = await identity.getProfile();\n      if (profile) return profile;\n    }\n  }\n\n  // Could also check profile metadata for external IDs\n  // This would require a standardized metadata field like 'github_username'\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n\n  // Try to find by email that looks like a GitHub noreply\n  const profiles = await profileCollection.list({\n    where: {\n      email: `${externalId}@users.noreply.github.com`,\n    },\n    limit: 1,\n  });\n\n  if (profiles.length > 0) {\n    return profiles[0];\n  }\n\n  return null;\n}\n\n/**\n * Create a profile from OIDC claims if it doesn't exist\n *\n * Resolution order:\n * 1. If OIDC identity (iss + sub) already exists → return linked profile\n * 2. If the email matches an existing Profile, fail closed because this\n *    package cannot prove whether a User owns it\n * 3. Otherwise, create new profile + identity\n *\n * Security considerations:\n * - Existing issuer/subject links always keep their already-linked Profile,\n *   including legacy tenant-scoped or non-Person Profiles, and refresh the\n *   cached identity email. This exact-link compatibility does not perform\n *   email-based canonical reuse.\n * - New identities never attach to an existing email match through this\n *   Profile-only helper because Profile ownership belongs to the users package.\n *   Use `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email\n *   reuse and its supported pre-provision resolver hook.\n * - This function trusts the OIDC provider to assert correct email_verified status.\n *   Only use with trusted providers.\n *\n * @param claims - OIDC token claims\n * @param provider - Provider name (e.g., 'keycloak', 'google', 'github')\n * @param options - Database options\n * @returns The created or existing profile with linked OIDC identity\n */\nexport async function createProfileFromOidc(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  return coordinateProfileOidcProvisioning(claims, provider, options);\n}\n\n/**\n * @internal Transactionally reuse one exact legacy issuer/subject link.\n *\n * This path cannot create or rebind authority. It intentionally preserves\n * existing tenant-scoped and non-Person Profile links; canonical global Person\n * validation remains mandatory for every path that creates a User/session.\n */\nexport async function reuseExistingOidcIdentityForProfile(\n  profileId: string,\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: false }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent exact OIDC identity reuse did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(async () => {\n        const { OidcIdentityCollection } = await import(\n          '../collections/OidcIdentityCollection'\n        );\n        const identity = await (\n          await OidcIdentityCollection.create({ db: tx })\n        ).findBySubject(normalizedClaims.iss, normalizedClaims.sub);\n        if (!identity) {\n          throw new Error(\n            'OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().',\n          );\n        }\n        if (identity.profileId !== profileId) {\n          throw new Error(\n            `OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`,\n          );\n        }\n        const profile = await identity.getProfile();\n        if (!profile) {\n          throw new Error('The exact OIDC identity has no linked Profile.');\n        }\n        identity.provider = provider;\n        if (normalizedClaims.email) identity.email = normalizedClaims.email;\n        identity.lastUsedAt = new Date();\n        await identity.save();\n        return { profile, oidcIdentity: identity, created: false as const };\n      }),\n  });\n}\n\nasync function coordinateProfileOidcProvisioning(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n      ...(normalizedClaims.email ? [`email:${normalizedClaims.email}`] : []),\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent OIDC Profile provisioning did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(() =>\n        provisionOidcProfile(normalizedClaims, provider, {\n          ...options,\n          db: tx,\n        }),\n      ),\n  });\n}\n\nasync function provisionOidcProfile(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions & { db: DatabaseInterface },\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const identityCollection = await OidcIdentityCollection.create(options);\n  const existingIdentity = await identityCollection.findBySubject(\n    claims.iss,\n    claims.sub,\n  );\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (!profile) {\n      throw new Error('The exact OIDC identity has no linked Profile.');\n    }\n    if (claims.email) existingIdentity.email = claims.email;\n    existingIdentity.lastUsedAt = new Date();\n    await existingIdentity.save();\n    return { profile, oidcIdentity: existingIdentity, created: false };\n  }\n\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n  if (claims.email) {\n    const collision = await profileCollection.findUniqueGlobalPersonByEmail(\n      claims.email,\n    );\n    if (collision) {\n      if (claims.email_verified !== true) {\n        throw new Error(\n          `OIDC email ${claims.email} is not verified and already belongs to a Profile.`,\n        );\n      }\n      throw new Error(\n        `OIDC email ${claims.email} already belongs to a Profile; createProfileFromOidc() cannot prove that Profile is unowned. Use UserCollection.getOrCreateFromOidc() for owner-aware linking.`,\n      );\n    }\n  }\n\n  const profile = await createOidcProvisioningPerson(options.db, {\n    email: claims.email ?? '',\n    name: claims.name,\n    preferredUsername: claims.preferred_username,\n    subject: claims.sub,\n  });\n  const oidcIdentity = await insertOidcProvisioningIdentity(options.db, {\n    email: claims.email,\n    issuer: claims.iss,\n    profileId: requireOidcProfileId(profile.id),\n    provider,\n    subject: claims.sub,\n  });\n  return { profile, oidcIdentity, created: true };\n}\n\nasync function rebindOidcProfileResult<\n  T extends {\n    profile: Profile;\n    oidcIdentity: OidcIdentity;\n    created: boolean;\n  },\n>(result: T, rootDb: DatabaseInterface): Promise<T> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileId = requireOidcProfileId(result.profile.id);\n  const identityId = requireOidcProfileId(result.oidcIdentity.id);\n  const [profile, oidcIdentity] = await withSystemContext(async () => {\n    const profiles = await ProfileCollection.create({ db: rootDb });\n    const identities = await OidcIdentityCollection.create({ db: rootDb });\n    // Read one statement at a time. SQLite and DuckDB handles multiplex a\n    // single native connection, so overlapping statements on it fail the\n    // losing prepared statement or abort the process outright (#2352). These\n    // are primary-key reads, so the sequential cost is one extra round trip.\n    const rebound = await profiles.get({ id: profileId });\n    const reboundIdentity = await identities.get({ id: identityId });\n    return [rebound, reboundIdentity] as const;\n  });\n  if (!profile || !oidcIdentity) {\n    throw new Error(\n      'Committed OIDC Profile provisioning result was not found.',\n    );\n  }\n  return { ...result, profile, oidcIdentity };\n}\n\nfunction normalizeOidcProfileClaims(claims: {\n  sub: string;\n  iss: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  preferred_username?: string;\n}) {\n  const sub = claims?.sub;\n  const iss = claims?.iss;\n  if (\n    typeof sub !== 'string' ||\n    sub.trim().length === 0 ||\n    typeof iss !== 'string' ||\n    iss.trim().length === 0\n  ) {\n    throw new Error(\n      'Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.',\n    );\n  }\n  const suppliedEmail = claims.email;\n  return {\n    ...claims,\n    sub,\n    iss,\n    email:\n      typeof suppliedEmail === 'string' && suppliedEmail.trim()\n        ? normalizeIdentityEmail(suppliedEmail)\n        : undefined,\n  };\n}\n\nfunction requireOidcProfileId(value: unknown): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error('OIDC Profile provisioning did not produce an id.');\n  }\n  return value;\n}\n\nasync function resolveOidcProfileDatabase(\n  db: SmrtObjectOptions['db'],\n): Promise<DatabaseInterface> {\n  if (!db) {\n    throw new Error(\n      'OIDC Profile provisioning requires an initialized database.',\n    );\n  }\n  return resolveDatabase(db as Parameters<typeof resolveDatabase>[0]);\n}\n\n/**\n * Create a profile from Nostr identity (used by magic link service)\n *\n * This is typically called internally by the magic link service,\n * but can be used directly if needed.\n *\n * @param email - Email address for the profile\n * @param nostrData - Encrypted Nostr keypair data\n * @param options - Database options\n * @returns The created profile with linked Nostr identity\n */\nexport async function createProfileFromNostr(\n  email: string,\n  nostrData: {\n    pubkey: string;\n    encryptedPrivkey: string;\n    encryptionIv: string;\n    encryptionTag: string;\n    nip05Username?: string;\n  },\n  options: SmrtObjectOptions,\n): Promise<{\n  profile: Profile;\n  nostrIdentity: NostrIdentity;\n  created: boolean;\n}> {\n  const normalizedEmail = normalizeIdentityEmail(email);\n\n  // Check if Nostr identity already exists\n  const existingIdentity = await NostrIdentity.findByEmail(\n    normalizedEmail,\n    options,\n  );\n\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (profile) {\n      return {\n        profile,\n        nostrIdentity: existingIdentity,\n        created: false,\n      };\n    }\n  }\n\n  // Create new profile\n  const { Person } = await import('../models/ProfileTypes');\n  const { ProfileTypeCollection } = await import(\n    '../collections/ProfileTypeCollection'\n  );\n\n  // Get or create the 'person' type\n  const typeCollection = await ProfileTypeCollection.create(options);\n  let personType = await typeCollection.getBySlug('person');\n\n  if (!personType) {\n    const { ProfileType } = await import('../models/ProfileType');\n    personType = new ProfileType({\n      ...options,\n      slug: 'person',\n      name: 'Person',\n      description: 'Individual person profile',\n    });\n    await personType.initialize();\n    await personType.save();\n  }\n\n  const profile = new Person({\n    ...options,\n    typeId: personType.id as string,\n    email: normalizedEmail,\n    name: normalizedEmail.split('@')[0], // Default name from email\n  });\n  await profile.initialize();\n  await profile.save();\n\n  // Create Nostr identity\n  const nostrIdentity = new NostrIdentity({\n    ...options,\n    profileId: profile.id as string,\n    pubkey: nostrData.pubkey,\n    encryptedPrivkey: nostrData.encryptedPrivkey,\n    encryptionIv: nostrData.encryptionIv,\n    encryptionTag: nostrData.encryptionTag,\n    email: normalizedEmail,\n    nip05Username:\n      nostrData.nip05Username?.toLowerCase() || normalizedEmail.split('@')[0],\n  });\n  await nostrIdentity.initialize();\n  await nostrIdentity.save();\n\n  return {\n    profile,\n    nostrIdentity,\n    created: true,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAqIA,eAAsB,gBACpB,SACgC;CAChC,MAAM,UAA6B,EAAE,IAAI,QAAQ,GAAG;CAGpD,IAAI,QAAQ,QAAQ;EAClB,MAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,QAAQ,OAAO;EAC1D,IAAI,QAAQ;GACV,MAAM,UAAU,MAAM,OAAO,WAAW;GACxC,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,aAAa,OAAO,QAAQ,aAAa,KAAK;EACxD,MAAM,eAAe,MAAM,aAAa,cACtC,QAAQ,YAAY,KACpB,QAAQ,YAAY,KACpB,OACF;EAEA,IAAI,cAAc;GAEhB,MAAM,aAAa,YAAY;GAE/B,MAAM,UAAU,MAAM,aAAa,WAAW;GAC9C,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,WAAW;EAC5D,MAAM,EAAE,OAAO,cAAc,QAAQ;EAIrC,IADqB,gBAAgB,OAAO,SACxC,CAAA,CAAa,OAAO;GAEtB,MAAM,gBAAgB,MAAM,cAAc,aACxC,MAAM,QACN,OACF;GAEA,IAAI,eAAe;IAEjB,MAAM,cAAc,YAAY;IAEhC,MAAM,UAAU,MAAM,cAAc,WAAW;IAC/C,IAAI,SACF,OAAO;KACL;KACA,QAAQ;KACR;IACF;GAEJ;EACF;CACF;CAGA,IAAI,QAAQ,OAAO;EACjB,MAAM,UAAU,MAAM,wBACpB,UACA,QAAQ,OACR,OACF;EACA,IAAI,SACF,OAAO;GACL;GACA,QAAQ;EACV;CAEJ;CAGA,OAAO;EACL,SAAS;EACT,QAAQ;CACV;AACF;AAYA,eAAe,wBACb,UACA,YACA,SACyB;CAEzB,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAIF,MAAM,aAAa,OAAM,MADI,uBAAuB,OAAO,OAAO,EAAA,CAC1B,eAAe,QAAQ;CAE/D,KAAA,MAAW,YAAY,YAErB,IACE,SAAS,YAAY,cACrB,SAAS,OAAO,SAAS,UAAU,GACnC;EACA,MAAM,UAAU,MAAM,SAAS,WAAW;EAC1C,IAAI,SAAS,OAAO;CACtB;CAKF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,MAAM,WAAW,OAAM,MAHS,kBAAkB,OAAO,OAAO,EAAA,CAGvB,KAAK;EAC5C,OAAO,EACL,OAAO,GAAG,WAAU,2BACtB;EACA,OAAO;CACT,CAAC;CAED,IAAI,SAAS,SAAS,GACpB,OAAO,SAAS;CAGlB,OAAO;AACT;AA4BA,eAAsB,sBACpB,QAQA,UACA,SAC6E;CAC7E,OAAO,kCAAkC,QAAQ,UAAU,OAAO;AACpE;AASA,eAAsB,oCACpB,WACA,QAQA,UACA,SAC2E;CAC3E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,GACF;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,kBAAkB,YAAY;GAC5B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAEF,MAAM,WAAW,OACf,MAAM,uBAAuB,OAAO,EAAE,IAAI,GAAG,CAAC,EAAA,CAC9C,cAAc,iBAAiB,KAAK,iBAAiB,GAAG;GAC1D,IAAI,CAAC,UACH,MAAM,IAAI,MACR,0IACF;GAEF,IAAI,SAAS,cAAc,WACzB,MAAM,IAAI,MACR,iBAAiB,iBAAiB,IAAG,WAAY,iBAAiB,IAAG,iCACvE;GAEF,MAAM,UAAU,MAAM,SAAS,WAAW;GAC1C,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,SAAS,WAAW;GACpB,IAAI,iBAAiB,OAAO,SAAS,QAAQ,iBAAiB;GAC9D,SAAS,6BAAa,IAAI,KAAK;GAC/B,MAAM,SAAS,KAAK;GACpB,OAAO;IAAE;IAAS,cAAc;IAAU,SAAS;GAAe;EACpE,CAAC;CACL,CAAC;AACH;AAEA,eAAe,kCACb,QAQA,UACA,SAC6E;CAC7E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,KACA,GAAI,iBAAiB,QAAQ,CAAC,SAAS,iBAAiB,OAAO,IAAI,CAAC,CACtE;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,wBACE,qBAAqB,kBAAkB,UAAU;GAC/C,GAAG;GACH,IAAI;EACN,CAAC,CACH;CACJ,CAAC;AACH;AAEA,eAAe,qBACb,QAQA,UACA,SAC6E;CAC7E,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAGF,MAAM,mBAAmB,OAAM,MADE,uBAAuB,OAAO,OAAO,EAAA,CACpB,cAChD,OAAO,KACP,OAAO,GACT;CACA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAI,CAACA,UACH,MAAM,IAAI,MAAM,gDAAgD;EAElE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,OAAO;EAClD,iBAAiB,6BAAa,IAAI,KAAK;EACvC,MAAM,iBAAiB,KAAK;EAC5B,OAAO;GAAE,SAAAA;GAAS,cAAc;GAAkB,SAAS;EAAM;CACnE;CAEA,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO;CAChE,IAAI,OAAO;MAIL,MAHoB,kBAAkB,8BACxC,OAAO,KACT,GACe;GACb,IAAI,OAAO,mBAAmB,MAC5B,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,mDAC5B;GAEF,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,+JAC5B;EACF;;CAGF,MAAM,UAAU,MAAM,6BAA6B,QAAQ,IAAI;EAC7D,OAAO,OAAO,SAAS;EACvB,MAAM,OAAO;EACb,mBAAmB,OAAO;EAC1B,SAAS,OAAO;CAClB,CAAC;CAQD,OAAO;EAAE;EAAS,cAAA,MAPS,+BAA+B,QAAQ,IAAI;GACpE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,WAAW,qBAAqB,QAAQ,EAAE;GAC1C;GACA,SAAS,OAAO;EAClB,CAAC;EAC+B,SAAS;CAAK;AAChD;AAEA,eAAe,wBAMb,QAAW,QAAuC;CAClD,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,YAAY,qBAAqB,OAAO,QAAQ,EAAE;CACxD,MAAM,aAAa,qBAAqB,OAAO,aAAa,EAAE;CAC9D,MAAM,CAAC,SAAS,gBAAgB,MAAM,kBAAkB,YAAY;EAClE,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE,IAAI,OAAO,CAAC;EAC9D,MAAM,aAAa,MAAM,uBAAuB,OAAO,EAAE,IAAI,OAAO,CAAC;EAOrE,OAAO,CAAC,MAFc,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,GAEnC,MADa,WAAW,IAAI,EAAE,IAAI,WAAW,CAAC,CAC/B;CAClC,CAAC;CACD,IAAI,CAAC,WAAW,CAAC,cACf,MAAM,IAAI,MACR,2DACF;CAEF,OAAO;EAAE,GAAG;EAAQ;EAAS;CAAa;AAC5C;AAEA,SAAS,2BAA2B,QAOjC;CACD,MAAM,MAAM,QAAQ;CACpB,MAAM,MAAM,QAAQ;CACpB,IACE,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,KACtB,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,GAEtB,MAAM,IAAI,MACR,0EACF;CAEF,MAAM,gBAAgB,OAAO;CAC7B,OAAO;EACL,GAAG;EACH;EACA;EACA,OACE,OAAO,kBAAkB,YAAY,cAAc,KAAK,IACpD,uBAAuB,aAAa,IACpC,KAAA;CACR;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,eAAe,2BACb,IAC4B;CAC5B,IAAI,CAAC,IACH,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,gBAAgB,EAA2C;AACpE;AAaA,eAAsB,uBACpB,OACA,WAOA,SAKC;CACD,MAAM,kBAAkB,uBAAuB,KAAK;CAGpD,MAAM,mBAAmB,MAAM,cAAc,YAC3C,iBACA,OACF;CAEA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAIA,UACF,OAAO;GACL,SAAAA;GACA,eAAe;GACf,SAAS;EACX;CAEJ;CAGA,MAAM,EAAE,WAAW,MAAM,OAAO,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAChC,MAAM,EAAE,0BAA0B,MAAM,OACtC,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,IAAI,aAAa,OAAM,MADM,sBAAsB,OAAO,OAAO,EAAA,CAC3B,UAAU,QAAQ;CAExD,IAAI,CAAC,YAAY;EACf,MAAM,EAAE,gBAAgB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EACrC,aAAa,IAAI,YAAY;GAC3B,GAAG;GACH,MAAM;GACN,MAAM;GACN,aAAa;EACf,CAAC;EACD,MAAM,WAAW,WAAW;EAC5B,MAAM,WAAW,KAAK;CACxB;CAEA,MAAM,UAAU,IAAI,OAAO;EACzB,GAAG;EACH,QAAQ,WAAW;EACnB,OAAO;EACP,MAAM,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACnC,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,QAAQ,KAAK;CAGnB,MAAM,gBAAgB,IAAI,cAAc;EACtC,GAAG;EACH,WAAW,QAAQ;EACnB,QAAQ,UAAU;EAClB,kBAAkB,UAAU;EAC5B,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,OAAO;EACP,eACE,UAAU,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACzE,CAAC;CACD,MAAM,cAAc,WAAW;CAC/B,MAAM,cAAc,KAAK;CAEzB,OAAO;EACL;EACA;EACA,SAAS;CACX;AACF"}
+{"version":3,"file":"resolveIdentity-DusCiNZo.js","names":["profile"],"sources":["../../src/auth/resolveIdentity.ts"],"sourcesContent":["/**\n * resolveIdentity - Resolves authentication context to a Profile\n *\n * Used by apps (blindmanpress.com) to resolve incoming auth to a Profile.\n * Modules (aedile, praeco) should receive the resolved profile from the app.\n *\n * Resolution order:\n * 1. API key header → ApiKey → Profile\n * 2. OIDC session → OidcIdentity → Profile\n * 3. Nostr auth → NostrIdentity → Profile\n * 4. Actor header (CI pass-through) → Profile lookup\n */\n\nimport {\n  resolveDatabase,\n  type SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport { withSystemContext } from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { ApiKey } from '../models/ApiKey';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { normalizeIdentityEmail } from './normalizeIdentityEmail';\nimport { type NostrEvent, verifyAuthEvent } from './nostrCrypto';\nimport {\n  coordinateOidcProvisioning,\n  isOidcProvisioningRaceConflict,\n} from './oidcProvisioningCoordinator';\nimport {\n  createOidcProvisioningPerson,\n  insertOidcProvisioningIdentity,\n} from './oidcProvisioningPrimitives';\n\n/**\n * Context provided to resolveIdentity\n */\nexport interface AuthContext {\n  /**\n   * API key from X-API-Key header or similar\n   */\n  apiKey?: string | null;\n\n  /**\n   * OIDC session data (from @auth/sveltekit or similar)\n   */\n  oidcSession?: {\n    sub?: string;\n    iss?: string;\n    email?: string;\n    name?: string;\n  } | null;\n\n  /**\n   * Actor identifier for CI pass-through identity\n   * Usually the GitHub actor (username) who triggered the workflow\n   */\n  actor?: string | null;\n\n  /**\n   * Nostr authentication data (NIP-42 style)\n   */\n  nostrAuth?: {\n    /** Signed Nostr event for authentication */\n    event: NostrEvent;\n    /** Expected challenge (to prevent replay attacks) */\n    challenge: string;\n  } | null;\n\n  /**\n   * Database/persistence options\n   */\n  db?: SmrtObjectOptions['db'];\n}\n\n/**\n * Result of identity resolution\n */\nexport interface ResolveIdentityResult {\n  /**\n   * The resolved profile, or null if not authenticated\n   */\n  profile: Profile | null;\n\n  /**\n   * How the identity was resolved\n   */\n  source: 'api_key' | 'oidc' | 'nostr' | 'actor' | 'none';\n\n  /**\n   * The API key record if authenticated via API key\n   */\n  apiKey?: ApiKey;\n\n  /**\n   * The OIDC identity record if authenticated via OIDC\n   */\n  oidcIdentity?: OidcIdentity;\n\n  /**\n   * The Nostr identity record if authenticated via Nostr\n   */\n  nostrIdentity?: NostrIdentity;\n}\n\n/**\n * Resolve authentication context to a Profile\n *\n * @param context - The authentication context from the request\n * @returns The resolved profile and metadata\n *\n * @example\n * ```typescript\n * // In SvelteKit hooks.server.ts\n * import { resolveIdentity } from '@happyvertical/smrt-profiles';\n *\n * const identityMiddleware: Handle = async ({ event, resolve }) => {\n *   const session = await event.locals.auth();\n *\n *   const { profile, source } = await resolveIdentity({\n *     oidcSession: session,\n *     apiKey: event.request.headers.get('X-API-Key'),\n *     actor: event.request.headers.get('X-Actor'),\n *     db: { type: 'postgres', url: DATABASE_URL },\n *   });\n *\n *   event.locals.profile = profile;\n *   event.locals.authSource = source;\n *\n *   return resolve(event);\n * };\n * ```\n */\nexport async function resolveIdentity(\n  context: AuthContext,\n): Promise<ResolveIdentityResult> {\n  const options: SmrtObjectOptions = { db: context.db };\n\n  // 1. Check API key header first (highest priority for programmatic access)\n  if (context.apiKey) {\n    const apiKey = await ApiKey.verify(context.apiKey, options);\n    if (apiKey) {\n      const profile = await apiKey.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'api_key',\n          apiKey,\n        };\n      }\n    }\n  }\n\n  // 2. Check OIDC session (web users)\n  if (context.oidcSession?.sub && context.oidcSession?.iss) {\n    const oidcIdentity = await OidcIdentity.findBySubject(\n      context.oidcSession.iss,\n      context.oidcSession.sub,\n      options,\n    );\n\n    if (oidcIdentity) {\n      // Record usage\n      await oidcIdentity.recordUsage();\n\n      const profile = await oidcIdentity.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'oidc',\n          oidcIdentity,\n        };\n      }\n    }\n  }\n\n  // 3. Check Nostr auth (NIP-42 style signed event)\n  if (context.nostrAuth?.event && context.nostrAuth?.challenge) {\n    const { event, challenge } = context.nostrAuth;\n\n    // Verify the auth event\n    const verifyResult = verifyAuthEvent(event, challenge);\n    if (verifyResult.valid) {\n      // Look up identity by public key\n      const nostrIdentity = await NostrIdentity.findByPubkey(\n        event.pubkey,\n        options,\n      );\n\n      if (nostrIdentity) {\n        // Record usage\n        await nostrIdentity.recordUsage();\n\n        const profile = await nostrIdentity.getProfile();\n        if (profile) {\n          return {\n            profile,\n            source: 'nostr',\n            nostrIdentity,\n          };\n        }\n      }\n    }\n  }\n\n  // 4. Check actor for CI pass-through (look up by metadata)\n  if (context.actor) {\n    const profile = await findProfileByExternalId(\n      'github',\n      context.actor,\n      options,\n    );\n    if (profile) {\n      return {\n        profile,\n        source: 'actor',\n      };\n    }\n  }\n\n  // No authentication found\n  return {\n    profile: null,\n    source: 'none',\n  };\n}\n\n/**\n * Find a profile by external ID (e.g., GitHub username)\n *\n * This looks up profiles by their linked external identities or metadata.\n *\n * @param provider - The external provider (e.g., 'github')\n * @param externalId - The external identifier (e.g., GitHub username)\n * @param options - Database options\n * @returns The profile or null\n */\nasync function findProfileByExternalId(\n  provider: string,\n  externalId: string,\n  options: SmrtObjectOptions,\n): Promise<Profile | null> {\n  // First check OIDC identities (if they use the provider)\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n\n  const oidcCollection = await OidcIdentityCollection.create(options);\n  const identities = await oidcCollection.findByProvider(provider);\n\n  for (const identity of identities) {\n    // Check if the subject matches the external ID\n    if (\n      identity.subject === externalId ||\n      identity.email?.includes(externalId)\n    ) {\n      const profile = await identity.getProfile();\n      if (profile) return profile;\n    }\n  }\n\n  // Could also check profile metadata for external IDs\n  // This would require a standardized metadata field like 'github_username'\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n\n  // Try to find by email that looks like a GitHub noreply\n  const profiles = await profileCollection.list({\n    where: {\n      email: `${externalId}@users.noreply.github.com`,\n    },\n    limit: 1,\n  });\n\n  if (profiles.length > 0) {\n    return profiles[0];\n  }\n\n  return null;\n}\n\n/**\n * Create a profile from OIDC claims if it doesn't exist\n *\n * Resolution order:\n * 1. If OIDC identity (iss + sub) already exists → return linked profile\n * 2. If the email matches an existing Profile, fail closed because this\n *    package cannot prove whether a User owns it\n * 3. Otherwise, create new profile + identity\n *\n * Security considerations:\n * - Existing issuer/subject links always keep their already-linked Profile,\n *   including legacy tenant-scoped or non-Person Profiles, and refresh the\n *   cached identity email. This exact-link compatibility does not perform\n *   email-based canonical reuse.\n * - New identities never attach to an existing email match through this\n *   Profile-only helper because Profile ownership belongs to the users package.\n *   Use `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email\n *   reuse and its supported pre-provision resolver hook.\n * - This function trusts the OIDC provider to assert correct email_verified status.\n *   Only use with trusted providers.\n *\n * @param claims - OIDC token claims\n * @param provider - Provider name (e.g., 'keycloak', 'google', 'github')\n * @param options - Database options\n * @returns The created or existing profile with linked OIDC identity\n */\nexport async function createProfileFromOidc(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  return coordinateProfileOidcProvisioning(claims, provider, options);\n}\n\n/**\n * @internal Transactionally reuse one exact legacy issuer/subject link.\n *\n * This path cannot create or rebind authority. It intentionally preserves\n * existing tenant-scoped and non-Person Profile links; canonical global Person\n * validation remains mandatory for every path that creates a User/session.\n */\nexport async function reuseExistingOidcIdentityForProfile(\n  profileId: string,\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: false }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent exact OIDC identity reuse did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(async () => {\n        const { OidcIdentityCollection } = await import(\n          '../collections/OidcIdentityCollection'\n        );\n        const identity = await (\n          await OidcIdentityCollection.create({ db: tx })\n        ).findBySubject(normalizedClaims.iss, normalizedClaims.sub);\n        if (!identity) {\n          throw new Error(\n            'OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().',\n          );\n        }\n        if (identity.profileId !== profileId) {\n          throw new Error(\n            `OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`,\n          );\n        }\n        const profile = await identity.getProfile();\n        if (!profile) {\n          throw new Error('The exact OIDC identity has no linked Profile.');\n        }\n        identity.provider = provider;\n        if (normalizedClaims.email) identity.email = normalizedClaims.email;\n        identity.lastUsedAt = new Date();\n        await identity.save();\n        return { profile, oidcIdentity: identity, created: false as const };\n      }),\n  });\n}\n\nasync function coordinateProfileOidcProvisioning(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n      ...(normalizedClaims.email ? [`email:${normalizedClaims.email}`] : []),\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent OIDC Profile provisioning did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(() =>\n        provisionOidcProfile(normalizedClaims, provider, {\n          ...options,\n          db: tx,\n        }),\n      ),\n  });\n}\n\nasync function provisionOidcProfile(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions & { db: DatabaseInterface },\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const identityCollection = await OidcIdentityCollection.create(options);\n  const existingIdentity = await identityCollection.findBySubject(\n    claims.iss,\n    claims.sub,\n  );\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (!profile) {\n      throw new Error('The exact OIDC identity has no linked Profile.');\n    }\n    if (claims.email) existingIdentity.email = claims.email;\n    existingIdentity.lastUsedAt = new Date();\n    await existingIdentity.save();\n    return { profile, oidcIdentity: existingIdentity, created: false };\n  }\n\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n  if (claims.email) {\n    const collision = await profileCollection.findUniqueGlobalPersonByEmail(\n      claims.email,\n    );\n    if (collision) {\n      if (claims.email_verified !== true) {\n        throw new Error(\n          `OIDC email ${claims.email} is not verified and already belongs to a Profile.`,\n        );\n      }\n      throw new Error(\n        `OIDC email ${claims.email} already belongs to a Profile; createProfileFromOidc() cannot prove that Profile is unowned. Use UserCollection.getOrCreateFromOidc() for owner-aware linking.`,\n      );\n    }\n  }\n\n  const profile = await createOidcProvisioningPerson(options.db, {\n    email: claims.email ?? '',\n    name: claims.name,\n    preferredUsername: claims.preferred_username,\n    subject: claims.sub,\n  });\n  const oidcIdentity = await insertOidcProvisioningIdentity(options.db, {\n    email: claims.email,\n    issuer: claims.iss,\n    profileId: requireOidcProfileId(profile.id),\n    provider,\n    subject: claims.sub,\n  });\n  return { profile, oidcIdentity, created: true };\n}\n\nasync function rebindOidcProfileResult<\n  T extends {\n    profile: Profile;\n    oidcIdentity: OidcIdentity;\n    created: boolean;\n  },\n>(result: T, rootDb: DatabaseInterface): Promise<T> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileId = requireOidcProfileId(result.profile.id);\n  const identityId = requireOidcProfileId(result.oidcIdentity.id);\n  const [profile, oidcIdentity] = await withSystemContext(async () => {\n    const profiles = await ProfileCollection.create({ db: rootDb });\n    const identities = await OidcIdentityCollection.create({ db: rootDb });\n    // Read one statement at a time. SQLite and DuckDB handles multiplex a\n    // single native connection, so overlapping statements on it fail the\n    // losing prepared statement or abort the process outright (#2352). These\n    // are primary-key reads, so the sequential cost is one extra round trip.\n    const rebound = await profiles.get({ id: profileId });\n    const reboundIdentity = await identities.get({ id: identityId });\n    return [rebound, reboundIdentity] as const;\n  });\n  if (!profile || !oidcIdentity) {\n    throw new Error(\n      'Committed OIDC Profile provisioning result was not found.',\n    );\n  }\n  return { ...result, profile, oidcIdentity };\n}\n\nfunction normalizeOidcProfileClaims(claims: {\n  sub: string;\n  iss: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  preferred_username?: string;\n}) {\n  const sub = claims?.sub;\n  const iss = claims?.iss;\n  if (\n    typeof sub !== 'string' ||\n    sub.trim().length === 0 ||\n    typeof iss !== 'string' ||\n    iss.trim().length === 0\n  ) {\n    throw new Error(\n      'Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.',\n    );\n  }\n  const suppliedEmail = claims.email;\n  return {\n    ...claims,\n    sub,\n    iss,\n    email:\n      typeof suppliedEmail === 'string' && suppliedEmail.trim()\n        ? normalizeIdentityEmail(suppliedEmail)\n        : undefined,\n  };\n}\n\nfunction requireOidcProfileId(value: unknown): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error('OIDC Profile provisioning did not produce an id.');\n  }\n  return value;\n}\n\nasync function resolveOidcProfileDatabase(\n  db: SmrtObjectOptions['db'],\n): Promise<DatabaseInterface> {\n  if (!db) {\n    throw new Error(\n      'OIDC Profile provisioning requires an initialized database.',\n    );\n  }\n  return resolveDatabase(db as Parameters<typeof resolveDatabase>[0]);\n}\n\n/**\n * Create a profile from Nostr identity (used by magic link service)\n *\n * This is typically called internally by the magic link service,\n * but can be used directly if needed.\n *\n * @param email - Email address for the profile\n * @param nostrData - Encrypted Nostr keypair data\n * @param options - Database options\n * @returns The created profile with linked Nostr identity\n */\nexport async function createProfileFromNostr(\n  email: string,\n  nostrData: {\n    pubkey: string;\n    encryptedPrivkey: string;\n    encryptionIv: string;\n    encryptionTag: string;\n    nip05Username?: string;\n  },\n  options: SmrtObjectOptions,\n): Promise<{\n  profile: Profile;\n  nostrIdentity: NostrIdentity;\n  created: boolean;\n}> {\n  const normalizedEmail = normalizeIdentityEmail(email);\n\n  // Check if Nostr identity already exists\n  const existingIdentity = await NostrIdentity.findByEmail(\n    normalizedEmail,\n    options,\n  );\n\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (profile) {\n      return {\n        profile,\n        nostrIdentity: existingIdentity,\n        created: false,\n      };\n    }\n  }\n\n  // Create new profile\n  const { Person } = await import('../models/ProfileTypes');\n  const { ProfileTypeCollection } = await import(\n    '../collections/ProfileTypeCollection'\n  );\n\n  // Get or create the 'person' type\n  const typeCollection = await ProfileTypeCollection.create(options);\n  let personType = await typeCollection.getBySlug('person');\n\n  if (!personType) {\n    const { ProfileType } = await import('../models/ProfileType');\n    personType = new ProfileType({\n      ...options,\n      slug: 'person',\n      name: 'Person',\n      description: 'Individual person profile',\n    });\n    await personType.initialize();\n    await personType.save();\n  }\n\n  const profile = new Person({\n    ...options,\n    typeId: personType.id as string,\n    email: normalizedEmail,\n    name: normalizedEmail.split('@')[0], // Default name from email\n  });\n  await profile.initialize();\n  await profile.save();\n\n  // Create Nostr identity\n  const nostrIdentity = new NostrIdentity({\n    ...options,\n    profileId: profile.id as string,\n    pubkey: nostrData.pubkey,\n    encryptedPrivkey: nostrData.encryptedPrivkey,\n    encryptionIv: nostrData.encryptionIv,\n    encryptionTag: nostrData.encryptionTag,\n    email: normalizedEmail,\n    nip05Username:\n      nostrData.nip05Username?.toLowerCase() || normalizedEmail.split('@')[0],\n  });\n  await nostrIdentity.initialize();\n  await nostrIdentity.save();\n\n  return {\n    profile,\n    nostrIdentity,\n    created: true,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAqIA,eAAsB,gBACpB,SACgC;CAChC,MAAM,UAA6B,EAAE,IAAI,QAAQ,GAAG;CAGpD,IAAI,QAAQ,QAAQ;EAClB,MAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,QAAQ,OAAO;EAC1D,IAAI,QAAQ;GACV,MAAM,UAAU,MAAM,OAAO,WAAW;GACxC,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,aAAa,OAAO,QAAQ,aAAa,KAAK;EACxD,MAAM,eAAe,MAAM,aAAa,cACtC,QAAQ,YAAY,KACpB,QAAQ,YAAY,KACpB,OACF;EAEA,IAAI,cAAc;GAEhB,MAAM,aAAa,YAAY;GAE/B,MAAM,UAAU,MAAM,aAAa,WAAW;GAC9C,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,WAAW;EAC5D,MAAM,EAAE,OAAO,cAAc,QAAQ;EAIrC,IADqB,gBAAgB,OAAO,SACxC,CAAA,CAAa,OAAO;GAEtB,MAAM,gBAAgB,MAAM,cAAc,aACxC,MAAM,QACN,OACF;GAEA,IAAI,eAAe;IAEjB,MAAM,cAAc,YAAY;IAEhC,MAAM,UAAU,MAAM,cAAc,WAAW;IAC/C,IAAI,SACF,OAAO;KACL;KACA,QAAQ;KACR;IACF;GAEJ;EACF;CACF;CAGA,IAAI,QAAQ,OAAO;EACjB,MAAM,UAAU,MAAM,wBACpB,UACA,QAAQ,OACR,OACF;EACA,IAAI,SACF,OAAO;GACL;GACA,QAAQ;EACV;CAEJ;CAGA,OAAO;EACL,SAAS;EACT,QAAQ;CACV;AACF;AAYA,eAAe,wBACb,UACA,YACA,SACyB;CAEzB,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAIF,MAAM,aAAa,OAAM,MADI,uBAAuB,OAAO,OAAO,EAAA,CAC1B,eAAe,QAAQ;CAE/D,KAAA,MAAW,YAAY,YAErB,IACE,SAAS,YAAY,cACrB,SAAS,OAAO,SAAS,UAAU,GACnC;EACA,MAAM,UAAU,MAAM,SAAS,WAAW;EAC1C,IAAI,SAAS,OAAO;CACtB;CAKF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,MAAM,WAAW,OAAM,MAHS,kBAAkB,OAAO,OAAO,EAAA,CAGvB,KAAK;EAC5C,OAAO,EACL,OAAO,GAAG,WAAU,2BACtB;EACA,OAAO;CACT,CAAC;CAED,IAAI,SAAS,SAAS,GACpB,OAAO,SAAS;CAGlB,OAAO;AACT;AA4BA,eAAsB,sBACpB,QAQA,UACA,SAC6E;CAC7E,OAAO,kCAAkC,QAAQ,UAAU,OAAO;AACpE;AASA,eAAsB,oCACpB,WACA,QAQA,UACA,SAC2E;CAC3E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,GACF;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,kBAAkB,YAAY;GAC5B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAEF,MAAM,WAAW,OACf,MAAM,uBAAuB,OAAO,EAAE,IAAI,GAAG,CAAC,EAAA,CAC9C,cAAc,iBAAiB,KAAK,iBAAiB,GAAG;GAC1D,IAAI,CAAC,UACH,MAAM,IAAI,MACR,0IACF;GAEF,IAAI,SAAS,cAAc,WACzB,MAAM,IAAI,MACR,iBAAiB,iBAAiB,IAAG,WAAY,iBAAiB,IAAG,iCACvE;GAEF,MAAM,UAAU,MAAM,SAAS,WAAW;GAC1C,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,SAAS,WAAW;GACpB,IAAI,iBAAiB,OAAO,SAAS,QAAQ,iBAAiB;GAC9D,SAAS,6BAAa,IAAI,KAAK;GAC/B,MAAM,SAAS,KAAK;GACpB,OAAO;IAAE;IAAS,cAAc;IAAU,SAAS;GAAe;EACpE,CAAC;CACL,CAAC;AACH;AAEA,eAAe,kCACb,QAQA,UACA,SAC6E;CAC7E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,KACA,GAAI,iBAAiB,QAAQ,CAAC,SAAS,iBAAiB,OAAO,IAAI,CAAC,CACtE;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,wBACE,qBAAqB,kBAAkB,UAAU;GAC/C,GAAG;GACH,IAAI;EACN,CAAC,CACH;CACJ,CAAC;AACH;AAEA,eAAe,qBACb,QAQA,UACA,SAC6E;CAC7E,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAGF,MAAM,mBAAmB,OAAM,MADE,uBAAuB,OAAO,OAAO,EAAA,CACpB,cAChD,OAAO,KACP,OAAO,GACT;CACA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAI,CAACA,UACH,MAAM,IAAI,MAAM,gDAAgD;EAElE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,OAAO;EAClD,iBAAiB,6BAAa,IAAI,KAAK;EACvC,MAAM,iBAAiB,KAAK;EAC5B,OAAO;GAAE,SAAAA;GAAS,cAAc;GAAkB,SAAS;EAAM;CACnE;CAEA,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO;CAChE,IAAI,OAAO;MAIL,MAHoB,kBAAkB,8BACxC,OAAO,KACT,GACe;GACb,IAAI,OAAO,mBAAmB,MAC5B,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,mDAC5B;GAEF,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,+JAC5B;EACF;;CAGF,MAAM,UAAU,MAAM,6BAA6B,QAAQ,IAAI;EAC7D,OAAO,OAAO,SAAS;EACvB,MAAM,OAAO;EACb,mBAAmB,OAAO;EAC1B,SAAS,OAAO;CAClB,CAAC;CAQD,OAAO;EAAE;EAAS,cAAA,MAPS,+BAA+B,QAAQ,IAAI;GACpE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,WAAW,qBAAqB,QAAQ,EAAE;GAC1C;GACA,SAAS,OAAO;EAClB,CAAC;EAC+B,SAAS;CAAK;AAChD;AAEA,eAAe,wBAMb,QAAW,QAAuC;CAClD,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,YAAY,qBAAqB,OAAO,QAAQ,EAAE;CACxD,MAAM,aAAa,qBAAqB,OAAO,aAAa,EAAE;CAC9D,MAAM,CAAC,SAAS,gBAAgB,MAAM,kBAAkB,YAAY;EAClE,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE,IAAI,OAAO,CAAC;EAC9D,MAAM,aAAa,MAAM,uBAAuB,OAAO,EAAE,IAAI,OAAO,CAAC;EAOrE,OAAO,CAAC,MAFc,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,GAEnC,MADa,WAAW,IAAI,EAAE,IAAI,WAAW,CAAC,CAC/B;CAClC,CAAC;CACD,IAAI,CAAC,WAAW,CAAC,cACf,MAAM,IAAI,MACR,2DACF;CAEF,OAAO;EAAE,GAAG;EAAQ;EAAS;CAAa;AAC5C;AAEA,SAAS,2BAA2B,QAOjC;CACD,MAAM,MAAM,QAAQ;CACpB,MAAM,MAAM,QAAQ;CACpB,IACE,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,KACtB,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,GAEtB,MAAM,IAAI,MACR,0EACF;CAEF,MAAM,gBAAgB,OAAO;CAC7B,OAAO;EACL,GAAG;EACH;EACA;EACA,OACE,OAAO,kBAAkB,YAAY,cAAc,KAAK,IACpD,uBAAuB,aAAa,IACpC,KAAA;CACR;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,eAAe,2BACb,IAC4B;CAC5B,IAAI,CAAC,IACH,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,gBAAgB,EAA2C;AACpE;AAaA,eAAsB,uBACpB,OACA,WAOA,SAKC;CACD,MAAM,kBAAkB,uBAAuB,KAAK;CAGpD,MAAM,mBAAmB,MAAM,cAAc,YAC3C,iBACA,OACF;CAEA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAIA,UACF,OAAO;GACL,SAAAA;GACA,eAAe;GACf,SAAS;EACX;CAEJ;CAGA,MAAM,EAAE,WAAW,MAAM,OAAO,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAChC,MAAM,EAAE,0BAA0B,MAAM,OACtC,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,IAAI,aAAa,OAAM,MADM,sBAAsB,OAAO,OAAO,EAAA,CAC3B,UAAU,QAAQ;CAExD,IAAI,CAAC,YAAY;EACf,MAAM,EAAE,gBAAgB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EACrC,aAAa,IAAI,YAAY;GAC3B,GAAG;GACH,MAAM;GACN,MAAM;GACN,aAAa;EACf,CAAC;EACD,MAAM,WAAW,WAAW;EAC5B,MAAM,WAAW,KAAK;CACxB;CAEA,MAAM,UAAU,IAAI,OAAO;EACzB,GAAG;EACH,QAAQ,WAAW;EACnB,OAAO;EACP,MAAM,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACnC,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,QAAQ,KAAK;CAGnB,MAAM,gBAAgB,IAAI,cAAc;EACtC,GAAG;EACH,WAAW,QAAQ;EACnB,QAAQ,UAAU;EAClB,kBAAkB,UAAU;EAC5B,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,OAAO;EACP,eACE,UAAU,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACzE,CAAC;CACD,MAAM,cAAc,WAAW;CAC/B,MAAM,cAAc,KAAK;CAEzB,OAAO;EACL;EACA;EACA,SAAS;CACX;AACF"}

package/dist/index.d.ts

@@ -20,7 +20,10 @@ export declare class ApiKey extends SmrtObject {
      */
     profileId?: string;
     /**
-     * SHA-256 hash of the API key
+     * SHA-256 hash of the API key.
+     *
+     * Indexed: `verify()` looks keys up by this hash on every authenticated
+     * request (#2364, epic #2382 finding A3).
      */
     keyHash: string;
     /**
@@ -542,7 +545,10 @@ export declare class MagicLinkToken extends SmrtObject {
      */
     nostrIdentityId?: string;
     /**
-     * SHA-256 hash of the token (never store plaintext)
+     * SHA-256 hash of the token (never store plaintext).
+     *
+     * Indexed: `verify()` looks tokens up by this hash on every magic-link
+     * click (#2364, epic #2382 finding A3).
      */
     tokenHash: string;
     /**
@@ -729,7 +735,10 @@ export declare class NostrIdentity extends SmrtObject {
      */
     profileId?: string;
     /**
-     * Hex-encoded secp256k1 public key (64 characters)
+     * Hex-encoded secp256k1 public key (64 characters).
+     *
+     * Indexed: `findByPubkey()` looks identities up by this column (#2364,
+     * epic #2382 finding A3).
      */
     pubkey: string;
     /**