@happyvertical/smrt-profiles 0.51.32 → 0.51.34

package/dist/__smrt-register__.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=__smrt-register__.d.ts.map

package/dist/__smrt-register__.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"__smrt-register__.d.ts","sourceRoot":"","sources":["../src/__smrt-register__.ts"],"names":[],"mappings":""}

package/dist/agent-profile.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Agent (bot) profile resolution (#2995).
+ *
+ * An automated agent that participates in a conversation is still an author,
+ * and every authoring seam in the framework — `ChatMessage.senderProfileId`,
+ * `ChatParticipant.profileId`, `ChatReaction.profileId`, a persona's
+ * `actsAsProfileId` — is a `crossPackageRef` to a {@link Profile} and therefore
+ * a native uuid column on PostgreSQL/DuckDB. A slug-style agent identifier
+ * (`anytown_site_assistant`) is not a representable author there: it fails the
+ * uuid cast (22P02) at the boundary that owns it.
+ *
+ * `Profile` already models this: the `bot` profile type is "automated agents,
+ * bots, and AI entities". This module is the owning-package API that turns a
+ * stable agent identifier into that Profile's uuid, so consumers never have to
+ * mint bot profiles themselves and never have to weaken a uuid column to text.
+ *
+ * Identity is keyed on `(tenantId, slug = agentId, context =
+ * {@link AGENT_PROFILE_CONTEXT})`. The reserved slug context keeps an agent
+ * profile from ever colliding with an unrelated human/organization profile that
+ * happens to share the slug, and matches the model's
+ * `(tenant_id, slug, context, _meta_type)` unique key.
+ *
+ * @module
+ */
+import type { ProfileCollection } from './collections/ProfileCollection';
+import type { Profile } from './models/Profile';
+/**
+ * Reserved slug context for agent-owned profiles.
+ *
+ * Agent identifiers come from application configuration, not from the profile
+ * namespace, so they are scoped into their own slug context rather than
+ * competing with person/organization slugs.
+ */
+export declare const AGENT_PROFILE_CONTEXT = "smrt:agent";
+/** Slug of the {@link ProfileType} agent profiles are classified under. */
+export declare const AGENT_PROFILE_TYPE_SLUG = "bot";
+/** Inputs for {@link resolveAgentProfile}. */
+export interface ResolveAgentProfileParams {
+    /** Stable agent identifier (e.g. `anytown_site_assistant`). */
+    agentId: string;
+    /** Owning tenant, or `null` for an untenanted agent. */
+    tenantId?: string | null;
+    /** Display name for a newly created profile. Defaults to `agentId`. */
+    name?: string;
+}
+/**
+ * Resolve — creating on first use — the {@link Profile} an agent authors as.
+ *
+ * The lookup is tenant-bound: an agent identifier resolves to a distinct
+ * profile per tenant, so one tenant's assistant can never author into another
+ * tenant's conversation. Resolution is idempotent; repeated calls for the same
+ * `(tenantId, agentId)` return the same profile.
+ *
+ * @param profiles - Profile collection bound to the caller's database options.
+ * @param params - Agent identity to resolve.
+ * @returns The agent's profile, whose `id` is a real uuid.
+ * @throws Error when `agentId` is empty.
+ */
+export declare function resolveAgentProfile(profiles: ProfileCollection, params: ResolveAgentProfileParams): Promise<Profile>;
+/**
+ * Resolve an agent profile and return its uuid.
+ *
+ * Convenience wrapper for the common case — an authoring seam that needs the
+ * id, not the row.
+ *
+ * @param profiles - Profile collection bound to the caller's database options.
+ * @param params - Agent identity to resolve.
+ * @returns The agent profile's uuid.
+ */
+export declare function resolveAgentProfileId(profiles: ProfileCollection, params: ResolveAgentProfileParams): Promise<string>;
+//# sourceMappingURL=agent-profile.d.ts.map

package/dist/agent-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profile.d.ts","sourceRoot":"","sources":["../src/agent-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/auth/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Auth module exports for smrt-profiles
+ *
+ * Provides identity resolution and authentication primitives.
+ * Apps configure auth (OIDC providers, Nostr), modules receive resolved profiles.
+ */
+export { createMagicLinkService, type InitiateResult, type MagicLinkConfig, type MagicLinkService, type VerifyResult, } from './magicLinkService';
+export { createNip05Handler, isValidNip05Identifier, type Nip05HandlerConfig, type Nip05HandlerResult, type Nip05Request, parseNip05Identifier, } from './nip05Handler';
+export { normalizeIdentityEmail } from './normalizeIdentityEmail';
+export { computeEventId, createAuthEvent, decryptPrivkey, deriveEncryptionKey, type EncryptedKey, encryptPrivkey, generateNostrKeypair, getPublicKey, isValidPrivkey, isValidPubkey, type NostrEvent, type NostrKeypair, npubToPubkey, nsecToPrivkey, privkeyToNsec, pubkeyToNpub, signEvent, verifyAuthEvent, verifyNostrSignature, } from './nostrCrypto';
+export { type AuthContext, createProfileFromNostr, createProfileFromOidc, type ResolveIdentityResult, resolveIdentity, } from './resolveIdentity';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,KAAK,YAAY,EACjB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,WAAW,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/auth/magicLinkService.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Magic Link Service
+ *
+ * Handles the magic link authentication flow including:
+ * - Token generation and storage
+ * - Email sending (via callback)
+ * - Token verification
+ * - Rate limiting checks
+ */
+import type { SmrtObjectOptions } from '@happyvertical/smrt-core';
+import type { NostrIdentity } from '../models/NostrIdentity';
+import type { Profile } from '../models/Profile';
+export interface MagicLinkConfig {
+    /** Base URL for magic links (e.g., "https://example.com") */
+    baseUrl: string;
+    /** Path for verification endpoint (default: "/auth/verify") */
+    verifyPath?: string;
+    /** Token expiration in minutes (default: 15) */
+    expiresInMinutes?: number;
+    /** Maximum tokens per email per hour (default: 5) */
+    maxTokensPerEmailPerHour?: number;
+    /** Maximum tokens per IP per hour (default: 10) */
+    maxTokensPerIpPerHour?: number;
+    /** Server master secret for encryption */
+    masterSecret: string;
+    /** Callback to send the email */
+    sendEmail: (to: string, magicLink: string) => Promise<void>;
+    /** Database options */
+    db: SmrtObjectOptions['db'];
+}
+export interface InitiateResult {
+    success: boolean;
+    /** The Nostr identity (existing or new) */
+    nostrIdentity?: NostrIdentity;
+    /** The profile (existing or new) */
+    profile?: Profile;
+    /** True if a new profile was created */
+    created: boolean;
+    /** Error message if success is false */
+    error?: string;
+    /** Error code for programmatic handling */
+    errorCode?: 'RATE_LIMITED_EMAIL' | 'RATE_LIMITED_IP' | 'EMAIL_SEND_FAILED';
+}
+export interface VerifyResult {
+    success: boolean;
+    /** The profile */
+    profile?: Profile;
+    /** The Nostr identity */
+    nostrIdentity?: NostrIdentity;
+    /** The decrypted keypair (only on success) */
+    keypair?: {
+        pubkey: string;
+        privkey: string;
+        npub: string;
+        nsec: string;
+    };
+    /** Error message if success is false */
+    error?: string;
+    /** Error code for programmatic handling */
+    errorCode?: 'INVALID_TOKEN' | 'EXPIRED_TOKEN' | 'USED_TOKEN' | 'NOT_FOUND';
+}
+export interface MagicLinkService {
+    /**
+     * Initiate magic link flow - generates token and sends email
+     */
+    initiate(email: string, options?: {
+        requestedFromIp?: string;
+        nip05Username?: string;
+    }): Promise<InitiateResult>;
+    /**
+     * Verify a magic link token and return decrypted keypair
+     */
+    verify(token: string): Promise<VerifyResult>;
+}
+/**
+ * Create a magic link service instance
+ */
+export declare function createMagicLinkService(config: MagicLinkConfig): MagicLinkService;
+//# sourceMappingURL=magicLinkService.d.ts.map

package/dist/auth/magicLinkService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magicLinkService.d.ts","sourceRoot":"","sources":["../../src/auth/magicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,uBAAuB;IACvB,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yBAAyB;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,eAAe,GAAG,eAAe,GAAG,YAAY,GAAG,WAAW,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,CACN,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,GACtB,gBAAgB,CAuOlB"}

package/dist/auth/nip05Handler.d.ts

@@ -0,0 +1,73 @@
+/**
+ * NIP-05 Handler
+ *
+ * Provides a helper for serving the /.well-known/nostr.json endpoint
+ * for NIP-05 identity verification.
+ *
+ * @see https://github.com/nostr-protocol/nips/blob/master/05.md
+ */
+import type { SmrtObjectOptions } from '@happyvertical/smrt-core';
+import { type Nip05Response } from '../collections/NostrIdentityCollection';
+export interface Nip05HandlerConfig {
+    /** Database options */
+    db: SmrtObjectOptions['db'];
+    /** Optional: Additional relays to include for all users */
+    defaultRelays?: string[];
+    /** Optional: Cache TTL in seconds (default: 300 = 5 minutes) */
+    cacheTtlSeconds?: number;
+}
+export interface Nip05Request {
+    /** The 'name' query parameter from the request */
+    name?: string | null;
+}
+export interface Nip05HandlerResult {
+    /** The NIP-05 response body */
+    body: Nip05Response;
+    /** Suggested headers for the response */
+    headers: Record<string, string>;
+    /** HTTP status code */
+    status: number;
+}
+/**
+ * Create a NIP-05 handler
+ *
+ * @example
+ * // SvelteKit
+ * import { createNip05Handler } from '@happyvertical/smrt-profiles';
+ *
+ * const handler = createNip05Handler({ db: { type: 'postgres', url: DATABASE_URL } });
+ *
+ * export async function GET({ url }) {
+ *   const result = await handler({ name: url.searchParams.get('name') });
+ *   return new Response(JSON.stringify(result.body), {
+ *     status: result.status,
+ *     headers: result.headers,
+ *   });
+ * }
+ *
+ * @example
+ * // Express
+ * import { createNip05Handler } from '@happyvertical/smrt-profiles';
+ *
+ * const handler = createNip05Handler({ db: { type: 'postgres', url: DATABASE_URL } });
+ *
+ * app.get('/.well-known/nostr.json', async (req, res) => {
+ *   const result = await handler({ name: req.query.name });
+ *   res.status(result.status).set(result.headers).json(result.body);
+ * });
+ */
+export declare function createNip05Handler(config: Nip05HandlerConfig): (request: Nip05Request) => Promise<Nip05HandlerResult>;
+/**
+ * Validate a NIP-05 identifier format
+ * @param identifier - The identifier to validate (e.g., "alice@example.com")
+ */
+export declare function isValidNip05Identifier(identifier: string): boolean;
+/**
+ * Parse a NIP-05 identifier into its parts
+ * @param identifier - The identifier to parse (e.g., "alice@example.com")
+ */
+export declare function parseNip05Identifier(identifier: string): {
+    localPart: string;
+    domain: string;
+} | null;
+//# sourceMappingURL=nip05Handler.d.ts.map

package/dist/auth/nip05Handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nip05Handler.d.ts","sourceRoot":"","sources":["../../src/auth/nip05Handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,IAIzD,SAAS,YAAY,KACpB,OAAO,CAAC,kBAAkB,CAAC,CAqC/B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAoBlE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAOP"}

package/dist/auth/normalizeIdentityEmail.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Canonicalize an email used as an external identity key.
+ *
+ * Keep this in application code: SQL `trim()` and `lower()` have
+ * adapter-specific whitespace and Unicode behavior.
+ */
+export declare function normalizeIdentityEmail(email: string): string;
+//# sourceMappingURL=normalizeIdentityEmail.d.ts.map

package/dist/auth/normalizeIdentityEmail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizeIdentityEmail.d.ts","sourceRoot":"","sources":["../../src/auth/normalizeIdentityEmail.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5D"}

package/dist/auth/nostrCrypto.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Nostr cryptographic utilities
+ *
+ * Handles keypair generation, encryption/decryption of private keys,
+ * signature verification, and bech32 encoding for Nostr authentication.
+ */
+export interface NostrKeypair {
+    /** Hex-encoded public key (64 characters) */
+    pubkey: string;
+    /** Hex-encoded private key (64 characters) */
+    privkey: string;
+}
+export interface EncryptedKey {
+    /** Base64-encoded ciphertext */
+    ciphertext: string;
+    /** Base64-encoded initialization vector */
+    iv: string;
+    /** Base64-encoded authentication tag */
+    tag: string;
+}
+export interface NostrEvent {
+    id?: string;
+    pubkey: string;
+    created_at: number;
+    kind: number;
+    tags: string[][];
+    content: string;
+    sig?: string;
+}
+/**
+ * Generate a new Nostr keypair (secp256k1)
+ */
+export declare function generateNostrKeypair(): NostrKeypair;
+/**
+ * Derive an encryption key from the master secret using HKDF
+ * @param masterSecret - Server master secret
+ */
+export declare function deriveEncryptionKey(masterSecret: string): Buffer;
+/**
+ * Encrypt a private key using AES-256-GCM
+ * @param privkey - Hex-encoded private key
+ * @param masterSecret - Server master secret (from env)
+ */
+export declare function encryptPrivkey(privkey: string, masterSecret: string): EncryptedKey;
+/**
+ * Decrypt a private key using AES-256-GCM
+ * @param encrypted - Encrypted key data
+ * @param masterSecret - Server master secret (from env)
+ */
+export declare function decryptPrivkey(encrypted: EncryptedKey, masterSecret: string): string;
+/**
+ * Compute the event ID (SHA-256 hash of serialized event)
+ */
+export declare function computeEventId(event: NostrEvent): string;
+/**
+ * Sign a Nostr event using Schnorr signatures (BIP-340)
+ * @param event - Event to sign (without id and sig)
+ * @param privkey - Hex-encoded private key
+ */
+export declare function signEvent(event: Omit<NostrEvent, 'id' | 'sig'>, privkey: string): NostrEvent;
+/**
+ * Verify a Nostr event Schnorr signature (BIP-340)
+ * @param event - Nostr event object with sig field
+ */
+export declare function verifyNostrSignature(event: NostrEvent): boolean;
+/**
+ * Create a Nostr event for authentication (NIP-42 style)
+ * @param privkey - Private key to sign with
+ * @param challenge - Server challenge string
+ * @param relay - Relay URL (optional)
+ */
+export declare function createAuthEvent(privkey: string, challenge: string, relay?: string): NostrEvent;
+/**
+ * Verify an authentication event
+ * @param event - Auth event to verify
+ * @param expectedChallenge - Expected challenge string
+ * @param maxAgeSeconds - Maximum age of the event in seconds (default: 300 = 5 minutes)
+ */
+export declare function verifyAuthEvent(event: NostrEvent, expectedChallenge: string, maxAgeSeconds?: number): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Convert hex public key to npub (bech32)
+ */
+export declare function pubkeyToNpub(pubkey: string): string;
+/**
+ * Convert npub (bech32) to hex public key
+ */
+export declare function npubToPubkey(npub: string): string;
+/**
+ * Convert hex private key to nsec (bech32)
+ */
+export declare function privkeyToNsec(privkey: string): string;
+/**
+ * Convert nsec (bech32) to hex private key
+ */
+export declare function nsecToPrivkey(nsec: string): string;
+/**
+ * Get public key from private key
+ */
+export declare function getPublicKey(privkey: string): string;
+/**
+ * Validate a hex-encoded public key
+ */
+export declare function isValidPubkey(pubkey: string): boolean;
+/**
+ * Validate a hex-encoded private key
+ */
+export declare function isValidPrivkey(privkey: string): boolean;
+//# sourceMappingURL=nostrCrypto.d.ts.map

package/dist/auth/nostrCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nostrCrypto.d.ts","sourceRoot":"","sources":["../../src/auth/nostrCrypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,YAAY,CAWnD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,YAAY,CAgBd;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,YAAY,EACvB,YAAY,EAAE,MAAM,GACnB,MAAM,CAeR;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAWxD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,KAAK,CAAC,EACrC,OAAO,EAAE,MAAM,GACd,UAAU,CAcZ;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAqB/D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,UAAU,CAmBZ;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,GAAE,MAAY,GAC1B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAYrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvD"}

package/dist/auth/oidcProvisioningCoordinator.d.ts

@@ -0,0 +1,58 @@
+import type { getDatabase } from '@happyvertical/sql';
+type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
+/** Shared transaction and concurrency policy for OIDC provisioning. */
+export interface OidcProvisioningCoordinatorOptions<T> {
+    /** Root or transaction-bound database used for every provisioning write. */
+    db: DatabaseInterface;
+    /**
+     * Stable keys used for local serialization. Supply both the exact
+     * issuer/subject key and normalized email when available.
+     */
+    lockKeys: readonly string[];
+    /** Package-specific durable race-arbiter classifier. */
+    isRaceConflict: (error: unknown) => boolean;
+    /** Package-specific transaction failure mapping. */
+    createTransactionError: (message: string, cause?: unknown) => Error;
+    /** Package-specific terminal concurrency failure mapping. */
+    createConcurrencyError: (cause?: unknown) => Error;
+    /** Provision atomically using the supplied transaction-bound handle. */
+    provision: (tx: DatabaseInterface) => Promise<T>;
+    /**
+     * Rehydrate root-owned results after commit so models do not retain a
+     * released transaction client. Omit for non-model results.
+     */
+    rebindRootResult?: (result: T, rootDb: DatabaseInterface) => Promise<T>;
+}
+/**
+ * Coordinate one OIDC provisioning operation across adapters.
+ *
+ * Root adapters must expose `beginTransaction`. Already-bound adapters must
+ * support savepoints. An adapter that exposes only `transaction()` is
+ * intentionally ambiguous and fails closed instead of risking a nested
+ * transaction that could roll back its caller's work.
+ */
+export declare function coordinateOidcProvisioning<T>(options: OidcProvisioningCoordinatorOptions<T>): Promise<T>;
+/**
+ * Detect an adapter error caused by an aborted transaction.
+ *
+ * Reduced to the framework contract in #2366. The heuristic this replaced
+ * matched a bare `/transaction.*aborted/` against every message in the chain,
+ * which would misclassify a genuine foreign-key or check violation whose text
+ * happened to mention a transaction. Core now recognizes PostgreSQL's
+ * `25P02 in_failed_sql_transaction` from the driver's own SQLSTATE, whichever
+ * layer wrapped it.
+ *
+ * Kept as a named export because it is part of this package's provisioning
+ * API surface; the body is now a single delegation.
+ */
+export declare function isOidcAbortedTransactionError(error: unknown): boolean;
+export interface OidcProvisioningRaceClassifierOptions {
+    /** Package-specific database constraint messages. */
+    messagePatterns?: readonly RegExp[];
+}
+/** Classify only the durable constraints used to converge OIDC retries. */
+export declare function isOidcProvisioningRaceConflict(error: unknown, options?: OidcProvisioningRaceClassifierOptions): boolean;
+/** Wrap a known OIDC arbiter write so only its unique failure is retryable. */
+export declare function saveOidcRaceArbiter<T>(operation: () => Promise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=oidcProvisioningCoordinator.d.ts.map

package/dist/auth/oidcProvisioningCoordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcProvisioningCoordinator.d.ts","sourceRoot":"","sources":["../../src/auth/oidcProvisioningCoordinator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AA0CjE,uEAAuE;AACvE,MAAM,WAAW,kCAAkC,CAAC,CAAC;IACnD,4EAA4E;IAC5E,EAAE,EAAE,iBAAiB,CAAC;IACtB;;;OAGG;IACH,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,wDAAwD;IACxD,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC5C,oDAAoD;IACpD,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;IACpE,6DAA6D;IAC7D,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;IACnD,wEAAwE;IACxE,SAAS,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACzE;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAChD,OAAO,EAAE,kCAAkC,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAoCZ;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,qCAAqC;IACpD,qDAAqD;IACrD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAaD,2EAA2E;AAC3E,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,qCAA0C,GAClD,OAAO,CAkDT;AAED,+EAA+E;AAC/E,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAaZ"}

package/dist/auth/oidcProvisioningPrimitives.d.ts

@@ -0,0 +1,23 @@
+import type { getDatabase } from '@happyvertical/sql';
+import { OidcIdentity } from '../models/OidcIdentity';
+import type { Profile } from '../models/Profile';
+type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
+export interface OidcProvisioningPersonInput {
+    email?: string;
+    name?: string;
+    preferredUsername?: string;
+    subject: string;
+}
+export interface OidcProvisioningIdentityInput {
+    email?: string;
+    issuer: string;
+    profileId: string;
+    provider: string;
+    subject: string;
+}
+/** Create and reserve a fresh global Person inside the caller's transaction. */
+export declare function createOidcProvisioningPerson(db: DatabaseInterface, input: OidcProvisioningPersonInput): Promise<Profile>;
+/** Insert the identity after the caller proves Profile ownership. */
+export declare function insertOidcProvisioningIdentity(db: DatabaseInterface, input: OidcProvisioningIdentityInput): Promise<OidcIdentity>;
+export {};
+//# sourceMappingURL=oidcProvisioningPrimitives.d.ts.map

package/dist/auth/oidcProvisioningPrimitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcProvisioningPrimitives.d.ts","sourceRoot":"","sources":["../../src/auth/oidcProvisioningPrimitives.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAIjD,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gFAAgF;AAChF,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CA4BlB;AAED,qEAAqE;AACrE,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,YAAY,CAAC,CAYvB"}