@minion-stack/db 0.2.0 → 0.3.0

package/dist/pg/crypto.d.ts

@@ -0,0 +1,8 @@
+/** Seal plaintext → { ciphertext, iv }. ciphertext = hex(encrypted || authTag). */
+export declare function sealSecret(plaintext: string): {
+    ciphertext: string;
+    iv: string;
+};
+/** Open hex(encrypted || authTag) + hex(iv) → plaintext. Throws on auth failure. */
+export declare function openSecret(ciphertext: string, iv: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/pg/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/pg/crypto.ts"],"names":[],"mappings":"AAyBA,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAOhF;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAOjE"}

package/dist/pg/crypto.js

@@ -0,0 +1,42 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+// MUST match minion_hub/src/server/auth/crypto.ts so hub + site interoperate:
+//   key = scryptSync(ENCRYPTION_KEY, 'minion-hub-salt', 32)
+//   ciphertext (hex) = encrypted || authTag   (16-byte tag LAST)
+//   iv (hex) = 12 random bytes, stored separately
+let cachedKey = null;
+function key() {
+    if (cachedKey)
+        return cachedKey;
+    const raw = process.env.ENCRYPTION_KEY;
+    if (!raw) {
+        if (process.env.NODE_ENV === 'production') {
+            throw new Error('ENCRYPTION_KEY environment variable must be set in production');
+        }
+        cachedKey = scryptSync('minion-hub-dev-key', 'minion-hub-salt', 32);
+        return cachedKey;
+    }
+    cachedKey = scryptSync(raw, 'minion-hub-salt', 32);
+    return cachedKey;
+}
+/** Seal plaintext → { ciphertext, iv }. ciphertext = hex(encrypted || authTag). */
+export function sealSecret(plaintext) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGORITHM, key(), iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const combined = Buffer.concat([encrypted, authTag]);
+    return { ciphertext: combined.toString('hex'), iv: iv.toString('hex') };
+}
+/** Open hex(encrypted || authTag) + hex(iv) → plaintext. Throws on auth failure. */
+export function openSecret(ciphertext, iv) {
+    const combined = Buffer.from(ciphertext, 'hex');
+    const encrypted = combined.subarray(0, combined.length - AUTH_TAG_BYTES);
+    const authTag = combined.subarray(combined.length - AUTH_TAG_BYTES);
+    const decipher = createDecipheriv(ALGORITHM, key(), Buffer.from(iv, 'hex'));
+    decipher.setAuthTag(authTag);
+    return decipher.update(encrypted) + decipher.final('utf8');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/pg/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/pg/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,8EAA8E;AAC9E,4DAA4D;AAC5D,iEAAiE;AACjE,kDAAkD;AAClD,IAAI,SAAS,GAAkB,IAAI,CAAC;AACpC,SAAS,GAAG;IACV,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,SAAS,GAAG,UAAU,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,EAAU;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/pg/crypto.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=crypto.test.d.ts.map

package/dist/pg/crypto.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.test.d.ts","sourceRoot":"","sources":["../../src/pg/crypto.test.ts"],"names":[],"mappings":""}

package/dist/pg/crypto.test.js

@@ -0,0 +1,25 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { sealSecret, openSecret } from './crypto.js';
+beforeAll(() => {
+    process.env.ENCRYPTION_KEY = 'test-key-do-not-use-in-prod';
+});
+describe('identity secret crypto', () => {
+    it('round-trips a plaintext through seal/open', () => {
+        const plaintext = JSON.stringify({ type: 'authorized_user', refresh_token: 'abc123' });
+        const { ciphertext, iv } = sealSecret(plaintext);
+        expect(ciphertext).toMatch(/^[0-9a-f]+$/);
+        expect(iv).toMatch(/^[0-9a-f]+$/);
+        expect(openSecret(ciphertext, iv)).toBe(plaintext);
+    });
+    it('fails to open with a tampered ciphertext (GCM auth)', () => {
+        const { ciphertext, iv } = sealSecret('hello');
+        const tampered = ciphertext.slice(0, -2) + (ciphertext.endsWith('00') ? '11' : '00');
+        expect(() => openSecret(tampered, iv)).toThrow();
+    });
+    it('is wire-compatible with hub layout (ciphertext = hex(encrypted || authTag), 16-byte tag last)', () => {
+        const { ciphertext } = sealSecret('x');
+        // hex of (>=0 bytes ciphertext) + 16-byte tag → at least 32 hex chars of tag.
+        expect(ciphertext.length).toBeGreaterThanOrEqual(32);
+    });
+});
+//# sourceMappingURL=crypto.test.js.map

package/dist/pg/crypto.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.test.js","sourceRoot":"","sources":["../../src/pg/crypto.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,6BAA6B,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvF,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACvG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,8EAA8E;QAC9E,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pg/identity-mapper.d.ts

@@ -0,0 +1,36 @@
+export interface GoTrueUserLike {
+    id: string;
+    email: string | null;
+    user_metadata?: {
+        full_name?: string;
+        name?: string;
+        provider_id?: string;
+    } | null;
+    app_metadata?: {
+        provider?: string;
+    } | null;
+}
+export interface GoogleGrant {
+    refreshToken: string | null;
+    scope: string | null;
+}
+export interface MappedProfile {
+    id: string;
+    email: string;
+    displayName: string | null;
+}
+export interface MappedIdentity {
+    userId: string;
+    provider: 'google';
+    kind: 'oauth';
+    externalId: string;
+    displayName: string | null;
+    scope: string | null;
+    hasSecret: boolean;
+}
+/** Pure mapping — no DB, no crypto. Caller seals the secret and upserts. */
+export declare function mapGoogleIdentity(user: GoTrueUserLike, grant: GoogleGrant): {
+    profile: MappedProfile;
+    identity: MappedIdentity;
+};
+//# sourceMappingURL=identity-mapper.d.ts.map

package/dist/pg/identity-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-mapper.d.ts","sourceRoot":"","sources":["../../src/pg/identity-mapper.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnF,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,WAAW,GACjB;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,CAetD"}

package/dist/pg/identity-mapper.js

@@ -0,0 +1,18 @@
+/** Pure mapping — no DB, no crypto. Caller seals the secret and upserts. */
+export function mapGoogleIdentity(user, grant) {
+    const email = user.email ?? '';
+    const displayName = user.user_metadata?.full_name ?? user.user_metadata?.name ?? null;
+    return {
+        profile: { id: user.id, email, displayName },
+        identity: {
+            userId: user.id,
+            provider: 'google',
+            kind: 'oauth',
+            externalId: email,
+            displayName,
+            scope: grant.scope,
+            hasSecret: Boolean(grant.refreshToken),
+        },
+    };
+}
+//# sourceMappingURL=identity-mapper.js.map

package/dist/pg/identity-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-mapper.js","sourceRoot":"","sources":["../../src/pg/identity-mapper.ts"],"names":[],"mappings":"AA4BA,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,IAAoB,EACpB,KAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC5C,QAAQ,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,KAAK;YACjB,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/pg/identity-mapper.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=identity-mapper.test.d.ts.map

package/dist/pg/identity-mapper.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-mapper.test.d.ts","sourceRoot":"","sources":["../../src/pg/identity-mapper.test.ts"],"names":[],"mappings":""}

package/dist/pg/identity-mapper.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+import { mapGoogleIdentity } from './identity-mapper.js';
+const gotrueUser = {
+    id: '11111111-1111-1111-1111-111111111111',
+    email: 'nik@example.com',
+    user_metadata: { full_name: 'Nik P', provider_id: 'google-sub-123' },
+    app_metadata: { provider: 'google' },
+};
+describe('mapGoogleIdentity', () => {
+    it('produces a profile row from the GoTrue user', () => {
+        const { profile } = mapGoogleIdentity(gotrueUser, { refreshToken: 'rt', scope: 'email profile' });
+        expect(profile).toEqual({
+            id: '11111111-1111-1111-1111-111111111111',
+            email: 'nik@example.com',
+            displayName: 'Nik P',
+        });
+    });
+    it('produces a google oauth identity keyed by email as externalId', () => {
+        const { identity } = mapGoogleIdentity(gotrueUser, { refreshToken: 'rt', scope: 'email profile' });
+        expect(identity.provider).toBe('google');
+        expect(identity.kind).toBe('oauth');
+        expect(identity.externalId).toBe('nik@example.com');
+        expect(identity.userId).toBe(gotrueUser.id);
+        expect(identity.scope).toBe('email profile');
+        expect(identity.hasSecret).toBe(true);
+    });
+    it('marks hasSecret false when no refresh token present', () => {
+        const { identity } = mapGoogleIdentity(gotrueUser, { refreshToken: null, scope: null });
+        expect(identity.hasSecret).toBe(false);
+    });
+});
+//# sourceMappingURL=identity-mapper.test.js.map

package/dist/pg/identity-mapper.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-mapper.test.js","sourceRoot":"","sources":["../../src/pg/identity-mapper.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAuB,MAAM,sBAAsB,CAAC;AAE9E,MAAM,UAAU,GAAmB;IACjC,EAAE,EAAE,sCAAsC;IAC1C,KAAK,EAAE,iBAAiB;IACxB,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACpE,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;CACrC,CAAC;AAEF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAClG,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,EAAE,EAAE,sCAAsC;YAC1C,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACnG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pg/schema/index.d.ts

@@ -0,0 +1,6 @@
+export { profiles } from './profiles.js';
+export { userIdentities } from './user-identities.js';
+export { mapGoogleIdentity } from '../identity-mapper.js';
+export type { GoTrueUserLike, GoogleGrant, MappedProfile, MappedIdentity, } from '../identity-mapper.js';
+export { sealSecret, openSecret } from '../crypto.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/pg/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/pg/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EACV,cAAc,EACd,WAAW,EACX,aAAa,EACb,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/pg/schema/index.js

@@ -0,0 +1,6 @@
+export { profiles } from './profiles.js';
+export { userIdentities } from './user-identities.js';
+// Identity helpers (consumed by minion_site auth path)
+export { mapGoogleIdentity } from '../identity-mapper.js';
+export { sealSecret, openSecret } from '../crypto.js';
+//# sourceMappingURL=index.js.map

package/dist/pg/schema/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/pg/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,uDAAuD;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO1D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/pg/schema/profiles.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Canonical app-level user. 1:1 with GoTrue `auth.users` (id is the same uuid).
+ * GoTrue owns auth.users; this row is created post-signup by identity-sync.
+ * We intentionally do NOT add a Drizzle FK to auth.users (auth schema is
+ * GoTrue-managed); the FK is declared in the hand-written RLS/constraints
+ * migration instead.
+ */
+export declare const profiles: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "profiles";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        email: import("drizzle-orm/pg-core").PgColumn<{
+            name: "email";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        displayName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "display_name";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        role: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: "user" | "admin";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["user", "admin"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        personalAgentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "personal_agent_id";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "profiles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "profiles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/pg/schema/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../src/pg/schema/profiles.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUnB,CAAC"}

package/dist/pg/schema/profiles.js

@@ -0,0 +1,20 @@
+import { pgTable, uuid, text, timestamp } from 'drizzle-orm/pg-core';
+/**
+ * Canonical app-level user. 1:1 with GoTrue `auth.users` (id is the same uuid).
+ * GoTrue owns auth.users; this row is created post-signup by identity-sync.
+ * We intentionally do NOT add a Drizzle FK to auth.users (auth schema is
+ * GoTrue-managed); the FK is declared in the hand-written RLS/constraints
+ * migration instead.
+ */
+export const profiles = pgTable('profiles', {
+    id: uuid('id').primaryKey(), // == auth.users.id
+    email: text('email').notNull(),
+    displayName: text('display_name'),
+    role: text('role', { enum: ['user', 'admin'] })
+        .notNull()
+        .default('user'),
+    personalAgentId: text('personal_agent_id'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+});
+//# sourceMappingURL=profiles.js.map

package/dist/pg/schema/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/pg/schema/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE;IAC1C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,mBAAmB;IAChD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;SAC5C,OAAO,EAAE;SACT,OAAO,CAAC,MAAM,CAAC;IAClB,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACjF,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CAClF,CAAC,CAAC"}

package/dist/pg/schema/user-identities.d.ts

@@ -0,0 +1,237 @@
+/**
+ * Canonical per-user identity row linking a user to BOTH OAuth providers
+ * (kind='oauth', e.g. google) AND channel identities (kind='channel',
+ * e.g. whatsapp/telegram/discord/signal/slack). This is the single link
+ * table replacing the SQLite channel_identities + the oauth side of account.
+ * Secret material (OAuth refresh-token ADC blob) is app-level AES-256-GCM
+ * sealed into secretCiphertext/secretIv; null for channel identities.
+ */
+export declare const userIdentities: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "user_identities";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: "oauth" | "channel";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["oauth", "channel"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        externalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "external_id";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        displayName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "display_name";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretCiphertext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_ciphertext";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretIv: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_iv";
+            tableName: "user_identities";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "user_identities";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        verifiedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "verified_at";
+            tableName: "user_identities";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "user_identities";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "user_identities";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=user-identities.d.ts.map

package/dist/pg/schema/user-identities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-identities.d.ts","sourceRoot":"","sources":["../../../src/pg/schema/user-identities.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,CAAC"}