@happyvertical/smrt-profiles 0.51.32 → 0.51.34

package/dist/internal/oidc-provisioning.d.ts

@@ -1,122 +1,17 @@
-import { getDatabase } from '@happyvertical/sql';
-
-/**
- * Coordinate one OIDC provisioning operation across adapters.
- *
- * Root adapters must expose `beginTransaction`. Already-bound adapters must
- * support savepoints. An adapter that exposes only `transaction()` is
- * intentionally ambiguous and fails closed instead of risking a nested
- * transaction that could roll back its caller's work.
- */
-export declare function coordinateOidcProvisioning<T>(options: OidcProvisioningCoordinatorOptions<T>): Promise<T>;
-
-/**
- * Trusted integration surface for framework packages participating in the
- * owner-aware OIDC provisioning transaction.
- *
- * Application code should use UserCollection.getOrCreateFromOidc() instead.
- * The generic result avoids duplicating nominal SMRT model declarations across
- * package entry bundles; trusted callers bind it to the root package model.
- */
-export declare function createOidcProvisioningPerson<TProfile>(db: DatabaseInterface, input: OidcProvisioningPersonInput): Promise<TProfile>;
-
-declare type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
-
-declare type DatabaseInterface_2 = Awaited<ReturnType<typeof getDatabase>>;
-
-/** Trusted integration insert after the caller proves Profile ownership. */
-export declare function insertOidcProvisioningIdentity<TIdentity>(db: DatabaseInterface, input: OidcProvisioningIdentityInput): Promise<TIdentity>;
-
-/**
- * Detect an adapter error caused by an aborted transaction.
- *
- * Reduced to the framework contract in #2366. The heuristic this replaced
- * matched a bare `/transaction.*aborted/` against every message in the chain,
- * which would misclassify a genuine foreign-key or check violation whose text
- * happened to mention a transaction. Core now recognizes PostgreSQL's
- * `25P02 in_failed_sql_transaction` from the driver's own SQLSTATE, whichever
- * layer wrapped it.
- *
- * Kept as a named export because it is part of this package's provisioning
- * API surface; the body is now a single delegation.
- */
-export declare function isOidcAbortedTransactionError(error: unknown): boolean;
-
-/** Classify only the durable constraints used to converge OIDC retries. */
-export declare function isOidcProvisioningRaceConflict(error: unknown, options?: OidcProvisioningRaceClassifierOptions): boolean;
-
-/** Shared transaction and concurrency policy for OIDC provisioning. */
-export declare interface OidcProvisioningCoordinatorOptions<T> {
-    /** Root or transaction-bound database used for every provisioning write. */
-    db: DatabaseInterface_2;
-    /**
-     * Stable keys used for local serialization. Supply both the exact
-     * issuer/subject key and normalized email when available.
-     */
-    lockKeys: readonly string[];
-    /** Package-specific durable race-arbiter classifier. */
-    isRaceConflict: (error: unknown) => boolean;
-    /** Package-specific transaction failure mapping. */
-    createTransactionError: (message: string, cause?: unknown) => Error;
-    /** Package-specific terminal concurrency failure mapping. */
-    createConcurrencyError: (cause?: unknown) => Error;
-    /** Provision atomically using the supplied transaction-bound handle. */
-    provision: (tx: DatabaseInterface_2) => Promise<T>;
-    /**
-     * Rehydrate root-owned results after commit so models do not retain a
-     * released transaction client. Omit for non-model results.
-     */
-    rebindRootResult?: (result: T, rootDb: DatabaseInterface_2) => Promise<T>;
-}
-
-export declare interface OidcProvisioningIdentityInput {
-    email?: string;
-    issuer: string;
-    profileId: string;
-    provider: string;
-    subject: string;
-}
-
-export declare interface OidcProvisioningPersonInput {
-    email?: string;
-    name?: string;
-    preferredUsername?: string;
-    subject: string;
-}
-
-export declare interface OidcProvisioningRaceClassifierOptions {
-    /** Package-specific database constraint messages. */
-    messagePatterns?: readonly RegExp[];
-}
-
-/** Wrap a known OIDC arbiter write so only its unique failure is retryable. */
-export declare function saveOidcRaceArbiter<T>(operation: () => Promise<T>): Promise<T>;
-
-export { }
-
-
+import type { getDatabase } from '@happyvertical/sql';
+export { coordinateOidcProvisioning, isOidcAbortedTransactionError, isOidcProvisioningRaceConflict, type OidcProvisioningCoordinatorOptions, type OidcProvisioningRaceClassifierOptions, saveOidcRaceArbiter, } from '../auth/oidcProvisioningCoordinator.js';
+import { type OidcProvisioningIdentityInput, type OidcProvisioningPersonInput } from '../auth/oidcProvisioningPrimitives';
+type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
+export type { OidcProvisioningIdentityInput, OidcProvisioningPersonInput };
 /**
- * Extend globalThis to include reciprocal handlers registry.
- * Using globalThis ensures all module instances share the same handlers,
- * which is critical in monorepos where the same package can be loaded
- * from different paths (e.g., pnpm store vs workspace symlink).
+ * Trusted integration surface for framework packages participating in the
+ * owner-aware OIDC provisioning transaction.
  *
- * @see https://github.com/happyvertical/smrt/issues/543
+ * Application code should use UserCollection.getOrCreateFromOidc() instead.
+ * The generic result avoids duplicating nominal SMRT model declarations across
+ * package entry bundles; trusted callers bind it to the root package model.
  */
-declare global {
-    var __smrtProfileRelationshipHandlers: Map<string, ReciprocalHandler> | undefined;
-    var __smrtProfileRelationshipHandlersInitialized: boolean | undefined;
-}
-
-
-/**
- * Extend globalThis to include custom validators registry.
- * Using globalThis ensures all module instances share the same validators,
- * which is critical in monorepos where the same package can be loaded
- * from different paths (e.g., pnpm store vs workspace symlink).
- *
- * @see https://github.com/happyvertical/smrt/issues/543
- */
-declare global {
-    var __smrtProfileMetafieldValidators: Map<string, ValidatorFunction> | undefined;
-}
+export declare function createOidcProvisioningPerson<TProfile>(db: DatabaseInterface, input: OidcProvisioningPersonInput): Promise<TProfile>;
+/** Trusted integration insert after the caller proves Profile ownership. */
+export declare function insertOidcProvisioningIdentity<TIdentity>(db: DatabaseInterface, input: OidcProvisioningIdentityInput): Promise<TIdentity>;
+//# sourceMappingURL=oidc-provisioning.d.ts.map

package/dist/internal/oidc-provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provisioning.d.ts","sourceRoot":"","sources":["../../src/internal/oidc-provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,qCAAqC,EAC1C,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAGL,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EACjC,MAAM,oCAAoC,CAAC;AAE5C,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE,YAAY,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAAC,QAAQ,EACzD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,QAAQ,CAAC,CAEnB;AAED,4EAA4E;AAC5E,wBAAsB,8BAA8B,CAAC,SAAS,EAC5D,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,SAAS,CAAC,CAEpB"}

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-profiles",
-  "packageVersion": "0.51.32",
+  "packageVersion": "0.51.34",
   "objects": {
     "@happyvertical/smrt-profiles:ApiKeyCollection": {
       "name": "apikeycollection",

package/dist/migrations/backfillProfileEmailKeys.d.ts

@@ -0,0 +1,16 @@
+import type { getDatabase } from '@happyvertical/sql';
+type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
+export declare const PROFILE_EMAIL_KEY_BACKFILL_NAME = "@happyvertical/smrt-profiles:profile-email-keys:v1";
+export interface BackfillProfileEmailKeysResult {
+    updated: number;
+}
+/**
+ * Populate adapter-independent Profile email keys after the schema migration.
+ *
+ * Run this from one deploy process after legacy writers are stopped or
+ * upgraded. Every read and update runs in one transaction, and repeats are a
+ * no-op.
+ */
+export declare function backfillProfileEmailKeys(db: DatabaseInterface): Promise<BackfillProfileEmailKeysResult>;
+export {};
+//# sourceMappingURL=backfillProfileEmailKeys.d.ts.map

package/dist/migrations/backfillProfileEmailKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backfillProfileEmailKeys.d.ts","sourceRoot":"","sources":["../../src/migrations/backfillProfileEmailKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE,eAAO,MAAM,+BAA+B,uDACU,CAAC;AAEvD,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,8BAA8B,CAAC,CAiDzC"}

package/dist/models/ApiKey.d.ts

@@ -0,0 +1,94 @@
+/**
+ * ApiKey - API keys for CLI and CI authentication
+ *
+ * Provides secure API key management with hashing, scopes, and expiration.
+ * Keys are stored as hashes - the plaintext is only returned on creation.
+ */
+import { SmrtObject, type SmrtObjectOptions } from '@happyvertical/smrt-core';
+import type { Profile } from './Profile';
+export interface ApiKeyOptions extends SmrtObjectOptions {
+    profileId?: string;
+    name?: string;
+    scopes?: string[];
+    expiresAt?: Date | null;
+}
+export interface GenerateKeyResult {
+    key: string;
+    apiKey: ApiKey;
+}
+export declare class ApiKey extends SmrtObject {
+    /**
+     * Link to the Profile (Person, Organization, Bot)
+     */
+    profileId?: string;
+    /**
+     * SHA-256 hash of the API key.
+     *
+     * Indexed: `verify()` looks keys up by this hash on every authenticated
+     * request (#2364, epic #2382 finding A3).
+     */
+    keyHash: string;
+    /**
+     * First 8 characters of the key for identification (e.g., "sk_live_a1b2...")
+     */
+    keyPrefix: string;
+    /**
+     * Human-readable name for the key (e.g., "CI Bot", "Local CLI")
+     */
+    name: string;
+    /**
+     * Scopes/permissions for this key
+     */
+    scopes: string[];
+    /**
+     * Last time this key was used
+     */
+    lastUsedAt: Date | null;
+    /**
+     * When this key expires (null = never)
+     */
+    expiresAt: Date | null;
+    /**
+     * When this key was revoked (null = active)
+     */
+    revokedAt: Date | null;
+    constructor(options?: ApiKeyOptions);
+    /**
+     * Get the linked Profile
+     */
+    getProfile(): Promise<Profile | null>;
+    /**
+     * Check if this key is valid (not expired, not revoked)
+     */
+    isValid(): boolean;
+    /**
+     * Check if this key has a specific scope
+     */
+    hasScope(scope: string): boolean;
+    /**
+     * Revoke this key
+     */
+    revoke(): Promise<void>;
+    /**
+     * Record usage of this key
+     */
+    recordUsage(): Promise<void>;
+    /**
+     * Hash an API key
+     */
+    static hashKey(key: string): string;
+    /**
+     * Generate a new API key for a profile
+     */
+    static generate(profile: Profile, options: {
+        name: string;
+        scopes?: string[];
+        expiresAt?: Date | null;
+        db?: SmrtObjectOptions['db'];
+    }): Promise<GenerateKeyResult>;
+    /**
+     * Verify an API key and return the ApiKey record if valid
+     */
+    static verify(key: string, options?: SmrtObjectOptions): Promise<ApiKey | null>;
+}
+//# sourceMappingURL=ApiKey.d.ts.map

package/dist/models/ApiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey.d.ts","sourceRoot":"","sources":["../../src/models/ApiKey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAUa,MAAO,SAAQ,UAAU;IACpC;;OAEG;IAEH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IAEH,OAAO,EAAE,MAAM,CAAM;IAErB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAM;IAElB;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAM;IAEtB;;OAEG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;IAE9B;;OAEG;IACH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAElB,OAAO,GAAE,aAAkB;IAQvC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI3C;;OAEG;IACH,OAAO,IAAI,OAAO;IAMlB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBlC;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAInC;;OAEG;WACU,QAAQ,CACnB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;QACxB,EAAE,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;KAC9B,GACA,OAAO,CAAC,iBAAiB,CAAC;IAuB7B;;OAEG;WACU,MAAM,CACjB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAwB1B"}

package/dist/models/AuditLog.d.ts

@@ -0,0 +1,71 @@
+/**
+ * AuditLog - Tracks all actions for full audit trail
+ *
+ * Records who did what, when, and how (web, CLI, CI, webhook, MCP).
+ * Supports pass-through identity for CI workflows.
+ */
+import { SmrtObject, type SmrtObjectOptions } from '@happyvertical/smrt-core';
+import type { Profile } from './Profile';
+export type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';
+export interface AuditLogOptions extends SmrtObjectOptions {
+    profileId?: string;
+    action?: string;
+    resourceType?: string;
+    resourceId?: string;
+    source?: AuditSource;
+    metadata?: Record<string, unknown>;
+    onBehalfOfId?: string | null;
+    tenantId?: string | null;
+}
+export declare class AuditLog extends SmrtObject {
+    tenantId: string | null;
+    /**
+     * The profile who performed the action
+     */
+    profileId?: string;
+    /**
+     * Action performed (e.g., 'issue.update', 'feedback.incorporate')
+     */
+    action: string;
+    /**
+     * Type of resource affected (e.g., 'Issue', 'Repository')
+     */
+    resourceType: string;
+    /**
+     * ID of the affected resource
+     */
+    resourceId: string;
+    /**
+     * Source of the action
+     */
+    source: AuditSource;
+    /**
+     * Additional context (CI run ID, request ID, etc.)
+     */
+    metadata: Record<string, unknown>;
+    /**
+     * For pass-through identity in CI - the actual person who triggered
+     */
+    onBehalfOfId?: string | null;
+    constructor(options?: AuditLogOptions);
+    /**
+     * Get the profile who performed the action
+     */
+    getProfile(): Promise<Profile | null>;
+    /**
+     * Get the profile on whose behalf the action was performed (if any)
+     */
+    getOnBehalfOf(): Promise<Profile | null>;
+    /**
+     * Get the effective actor (onBehalfOf if set, otherwise profile)
+     */
+    getEffectiveActor(): Promise<Profile | null>;
+    /**
+     * Create an audit log entry
+     */
+    static record(options: AuditLogOptions & {
+        profile: Profile;
+        onBehalfOf?: Profile | null;
+    }): Promise<AuditLog>;
+}
+//# sourceMappingURL=AuditLog.d.ts.map

package/dist/models/AuditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLog.d.ts","sourceRoot":"","sources":["../../src/models/AuditLog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC;AAEnE,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,qBAOa,QAAS,SAAQ,UAAU;IAEtC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IAEH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAM;IAEpB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAM;IAE1B;;OAEG;IACH,UAAU,EAAE,MAAM,CAAM;IAExB;;OAEG;IACH,MAAM,EAAE,WAAW,CAAS;IAE5B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;IAEvC;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEjB,OAAO,GAAE,eAAoB;IAYzC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI3C;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAK9C;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMlD;;OAEG;WACU,MAAM,CACjB,OAAO,EAAE,eAAe,GAAG;QACzB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;KAC7B,GACA,OAAO,CAAC,QAAQ,CAAC;CAUrB"}

package/dist/models/MagicLinkToken.d.ts

@@ -0,0 +1,104 @@
+/**
+ * MagicLinkToken - Temporary tokens for email verification
+ *
+ * Stores hashed magic link tokens with expiration. Tokens are single-use
+ * and automatically invalidated after verification or expiration.
+ */
+import { SmrtObject, type SmrtObjectOptions } from '@happyvertical/smrt-core';
+import type { NostrIdentity } from './NostrIdentity';
+export interface MagicLinkTokenOptions extends SmrtObjectOptions {
+    nostrIdentityId?: string;
+    tokenHash?: string;
+    email?: string;
+    expiresAt?: Date;
+    usedAt?: Date | null;
+    requestedFromIp?: string;
+    createdAt?: Date;
+}
+export interface GenerateTokenResult {
+    /** The plaintext token (only available at creation time) */
+    token: string;
+    /** The MagicLinkToken record */
+    magicLinkToken: MagicLinkToken;
+}
+export declare class MagicLinkToken extends SmrtObject {
+    /**
+     * Link to the NostrIdentity this token is for
+     */
+    nostrIdentityId?: string;
+    /**
+     * SHA-256 hash of the token (never store plaintext).
+     *
+     * Indexed: `verify()` looks tokens up by this hash on every magic-link
+     * click (#2364, epic #2382 finding A3).
+     */
+    tokenHash: string;
+    /**
+     * Email this token was sent to
+     */
+    email: string;
+    /**
+     * When this token expires
+     */
+    expiresAt: Date;
+    /**
+     * When this token was used (null = unused)
+     */
+    usedAt: Date | null;
+    /**
+     * IP address that requested the token (for rate limiting)
+     */
+    requestedFromIp: string;
+    /**
+     * When this token was created (for rate limiting)
+     */
+    createdAt: Date;
+    constructor(options?: MagicLinkTokenOptions);
+    /**
+     * Hash a token using SHA-256
+     */
+    static hashToken(token: string): string;
+    /**
+     * Generate a new magic link token
+     * @param nostrIdentity - The identity this token is for
+     * @param email - The email address to send to
+     * @param options - Additional options
+     */
+    static generate(nostrIdentity: NostrIdentity, email: string, options?: {
+        expiresInMinutes?: number;
+        requestedFromIp?: string;
+        db?: SmrtObjectOptions['db'];
+    }): Promise<GenerateTokenResult>;
+    /**
+     * Verify a token and return the MagicLinkToken if valid
+     * @param token - The plaintext token to verify
+     * @param options - Database options
+     * @returns The MagicLinkToken if valid, null otherwise
+     */
+    static verify(token: string, options?: SmrtObjectOptions): Promise<MagicLinkToken | null>;
+    /**
+     * Check if this token is valid (not expired and not used)
+     */
+    isValid(): boolean;
+    /**
+     * Check if this token has expired
+     */
+    isExpired(): boolean;
+    /**
+     * Check if this token has been used
+     */
+    isUsed(): boolean;
+    /**
+     * Mark this token as used
+     */
+    markUsed(): Promise<void>;
+    /**
+     * Get the NostrIdentity this token is for
+     */
+    getNostrIdentity(): Promise<NostrIdentity | null>;
+    /**
+     * Get time remaining until expiration in seconds
+     */
+    getTimeRemainingSeconds(): number;
+}
+//# sourceMappingURL=MagicLinkToken.d.ts.map

package/dist/models/MagicLinkToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkToken.d.ts","sourceRoot":"","sources":["../../src/models/MagicLinkToken.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,cAAc,EAAE,cAAc,CAAC;CAChC;AAKD,qBASa,cAAe,SAAQ,UAAU;IAC5C;;OAEG;IAEH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;OAKG;IAEH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAM;IAEnB;;OAEG;IACH,SAAS,EAAE,IAAI,CAEb;IAEF;;OAEG;IACH,MAAM,EAAE,IAAI,GAAG,IAAI,CAAQ;IAE3B;;OAEG;IACH,eAAe,EAAE,MAAM,CAAM;IAE7B;;OAEG;IACH,SAAS,EAAE,IAAI,CAAc;gBAEjB,OAAO,GAAE,qBAA0B;IAW/C;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIvC;;;;;OAKG;WACU,QAAQ,CACnB,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACP,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,EAAE,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;KACzB,GACL,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;;OAKG;WACU,MAAM,CACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAwBjC;;OAEG;IACH,OAAO,IAAI,OAAO;IAUlB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAK/B;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIvD;;OAEG;IACH,uBAAuB,IAAI,MAAM;CAKlC"}

package/dist/models/NostrIdentity.d.ts

@@ -0,0 +1,112 @@
+/**
+ * NostrIdentity - Links Nostr identity to Profile
+ *
+ * Stores the Nostr keypair with encrypted private key for custodial auth.
+ * The private key is encrypted using AES-256-GCM with the SERVER_MASTER_SECRET.
+ * The public key serves as the unique identifier for NIP-05 verification.
+ */
+import { SmrtObject, type SmrtObjectOptions } from '@happyvertical/smrt-core';
+import type { Profile } from './Profile';
+export interface NostrIdentityOptions extends SmrtObjectOptions {
+    profileId?: string;
+    pubkey?: string;
+    encryptedPrivkey?: string;
+    encryptionIv?: string;
+    encryptionTag?: string;
+    email?: string;
+    nip05Username?: string;
+    lastUsedAt?: Date | null;
+    verifiedAt?: Date | null;
+}
+export declare class NostrIdentity extends SmrtObject {
+    /**
+     * Link to the Profile (Person, Organization, Bot)
+     */
+    profileId?: string;
+    /**
+     * Hex-encoded secp256k1 public key (64 characters).
+     *
+     * Indexed: `findByPubkey()` looks identities up by this column (#2364,
+     * epic #2382 finding A3).
+     */
+    pubkey: string;
+    /**
+     * AES-256-GCM encrypted private key (base64-encoded ciphertext)
+     */
+    encryptedPrivkey: string;
+    /**
+     * Initialization vector for AES-GCM decryption (base64)
+     */
+    encryptionIv: string;
+    /**
+     * Authentication tag from AES-GCM (base64)
+     */
+    encryptionTag: string;
+    /**
+     * Email address associated with this identity
+     */
+    email: string;
+    /**
+     * Username for NIP-05 verification (e.g., "alice" for alice@domain.com)
+     */
+    nip05Username: string;
+    /**
+     * Last time this identity was used for authentication
+     */
+    lastUsedAt: Date | null;
+    /**
+     * When this identity was verified via magic link
+     */
+    verifiedAt: Date | null;
+    constructor(options?: NostrIdentityOptions);
+    /**
+     * Get the linked Profile
+     */
+    getProfile(): Promise<Profile | null>;
+    /**
+     * Find identity by public key
+     */
+    static findByPubkey(pubkey: string, options?: SmrtObjectOptions): Promise<NostrIdentity | null>;
+    /**
+     * Find identity by email
+     */
+    static findByEmail(email: string, options?: SmrtObjectOptions): Promise<NostrIdentity | null>;
+    /**
+     * Find identity by NIP-05 username
+     */
+    static findByNip05(username: string, options?: SmrtObjectOptions): Promise<NostrIdentity | null>;
+    /**
+     * Decrypt the private key using the server master secret
+     * @param masterSecret - SERVER_MASTER_SECRET from environment
+     * @returns Hex-encoded private key
+     */
+    decryptPrivkey(masterSecret: string): string;
+    /**
+     * Get the full keypair (requires master secret)
+     * @param masterSecret - SERVER_MASTER_SECRET from environment
+     */
+    getKeypair(masterSecret: string): {
+        pubkey: string;
+        privkey: string;
+        npub: string;
+        nsec: string;
+    };
+    /**
+     * Record usage of this identity
+     */
+    recordUsage(): Promise<void>;
+    /**
+     * Mark this identity as verified
+     */
+    markVerified(): Promise<void>;
+    /**
+     * Check if this identity is verified
+     */
+    isVerified(): boolean;
+    /**
+     * Get the NIP-05 identifier (username@domain)
+     * Note: Domain must be provided by the application
+     */
+    getNip05Identifier(domain: string): string;
+}
+//# sourceMappingURL=NostrIdentity.d.ts.map

package/dist/models/NostrIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NostrIdentity.d.ts","sourceRoot":"","sources":["../../src/models/NostrIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,qBASa,aAAc,SAAQ,UAAU;IAC3C;;OAEG;IAEH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IAEH,MAAM,EAAE,MAAM,CAAM;IAEpB;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAM;IAE9B;;OAEG;IACH,YAAY,EAAE,MAAM,CAAM;IAE1B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAM;IAE3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAM;IAEnB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAM;IAE3B;;OAEG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAEnB,OAAO,GAAE,oBAAyB;IAc9C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI3C;;OAEG;WACU,YAAY,CACvB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAUhC;;OAEG;WACU,WAAW,CACtB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAUhC;;OAEG;WACU,WAAW,CACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAUhC;;;;OAIG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAS5C;;;OAGG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG;QAChC,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd;IAUD;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBlC;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC;;OAEG;IACH,UAAU,IAAI,OAAO;IAIrB;;;OAGG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAI3C"}

package/dist/models/OidcIdentity.d.ts

@@ -0,0 +1,82 @@
+/**
+ * OidcIdentity - Links OIDC provider identities to Profile
+ *
+ * Stores the mapping between external OIDC providers (Keycloak, Google, GitHub)
+ * and internal Profile records. Multiple identities can link to a single profile.
+ */
+import { SmrtObject, type SmrtObjectOptions } from '@happyvertical/smrt-core';
+import type { Profile } from './Profile';
+export interface OidcIdentityOptions extends SmrtObjectOptions {
+    profileId?: string;
+    provider?: string;
+    issuer?: string;
+    subject?: string;
+    email?: string;
+    lastUsedAt?: Date | null;
+}
+export declare class OidcIdentity extends SmrtObject {
+    /**
+     * Link to the Profile (Person, Organization, Bot)
+     */
+    profileId?: string;
+    /**
+     * Provider name (e.g., 'keycloak', 'google', 'github')
+     */
+    provider: string;
+    /**
+     * OIDC issuer URL (e.g., https://keycloak.example.com/realms/bmp)
+     */
+    issuer: string;
+    /**
+     * OIDC subject claim - unique identifier from the provider
+     */
+    subject: string;
+    /**
+     * Stable issuer+subject key used as the database race arbiter.
+     *
+     * Nullable for legacy rows; every newly linked or reused identity backfills
+     * it. A separate unique constraint makes concurrent first login fail with a
+     * retryable conflict instead of creating two identities.
+     */
+    identityKey: string | null;
+    /**
+     * Cached email from the IdP (for display/lookup)
+     */
+    email: string;
+    /**
+     * Last time this identity was used for authentication
+     */
+    lastUsedAt: Date | null;
+    constructor(options?: OidcIdentityOptions);
+    /**
+     * Get the linked Profile
+     */
+    getProfile(): Promise<Profile | null>;
+    /**
+     * Find identity by issuer and subject
+     */
+    static findBySubject(issuer: string, subject: string, options?: SmrtObjectOptions): Promise<OidcIdentity | null>;
+    /** Build the collision-free natural key for one OIDC issuer subject. */
+    static buildIdentityKey(issuer: string, subject: string): string;
+    /** Keep the durable key derived from its natural-key source fields. */
+    save(): Promise<this>;
+    /**
+     * Reuse an existing exact identity for its unchanged Profile.
+     *
+     * @deprecated Authentication links must be created through transactional
+     * provisioning. This compatibility method only refreshes a unique mapping
+     * that already belongs to the supplied Profile, including legacy Profile
+     * types, and deliberately refuses to create or rebind authority.
+     */
+    static findOrCreate(profile: Profile, oidcData: {
+        provider: string;
+        issuer: string;
+        subject: string;
+        email?: string;
+    }, options?: SmrtObjectOptions): Promise<OidcIdentity>;
+    /**
+     * Record usage of this identity
+     */
+    recordUsage(): Promise<void>;
+}
+//# sourceMappingURL=OidcIdentity.d.ts.map

package/dist/models/OidcIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcIdentity.d.ts","sourceRoot":"","sources":["../../src/models/OidcIdentity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED,qBASa,YAAa,SAAQ,UAAU;IAC1C;;OAEG;IAEH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IAEH,QAAQ,EAAE,MAAM,CAAM;IAEtB;;OAEG;IAEH,MAAM,EAAE,MAAM,CAAM;IAEpB;;OAEG;IAEH,OAAO,EAAE,MAAM,CAAM;IAErB;;;;;;OAMG;IAEH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAQ;IAElC;;OAEG;IAEH,KAAK,EAAE,MAAM,CAAM;IAEnB;;OAEG;IAEH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAEnB,OAAO,GAAE,mBAAwB;IAU7C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI3C;;OAEG;WACU,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAQ/B,wEAAwE;IACxE,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAIhE,uEAAuE;IACxD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQpC;;;;;;;OAOG;WACU,YAAY,CACvB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,YAAY,CAAC;IA0BxB;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAwBnC"}