@primusclaw/personal-agent-runtime 0.2.0 → 0.3.0

package/dist/index.js

@@ -3360,6 +3360,7 @@ var SqliteIdempotencyRepository = class {
 };
 
 // packages/runtime/src/sqlite/link-repository.ts
+import { createHash as createHash2 } from "node:crypto";
 import {
   CODE_ALPHABET,
   CODE_LENGTH,
@@ -3378,8 +3379,12 @@ function forgetRepos(db, userId) {
 }
 
 // packages/runtime/src/sqlite/link-repository.ts
+function tokenHash(credential) {
+  return createHash2("sha256").update(credential).digest("hex");
+}
 var PERSON_TABLES = [
   "links",
+  "bound_users",
   "sessions",
   "conversation_refs",
   "held_events",
@@ -3478,6 +3483,7 @@ var SqliteLinkRepository = class {
       col.bytes(row, "key_enc"),
       now
     );
+    db.run("DELETE FROM bound_users WHERE aad_id = ?", userId);
     forgetNotifySub(db, userId);
     forgetRepos(db, userId);
     db.run("DELETE FROM sessions WHERE aad_id = ?", userId);
@@ -3510,12 +3516,39 @@ var SqliteLinkRepository = class {
   setClawUserId(userId, clawUserId) {
     this.ctx.db.run("UPDATE links SET claw_user_id = ? WHERE aad_id = ?", clawUserId, userId);
   }
+  boundClawUser(userId, credential) {
+    const row = this.ctx.db.get("SELECT claw_user_id, token_hash FROM bound_users WHERE aad_id = ?", userId);
+    if (row === void 0) return null;
+    return { clawUserId: col.str(row, "claw_user_id"), current: col.str(row, "token_hash") === tokenHash(credential) };
+  }
+  /** Ignored for a linked person (a link's id is read for its key). Another account than before forgets the subscription. */
+  setBoundClawUser(userId, clawUserId, credential) {
+    const { db } = this.ctx;
+    if (db.get("SELECT 1 AS one FROM links WHERE aad_id = ?", userId) !== void 0) return;
+    const before = db.get("SELECT claw_user_id FROM bound_users WHERE aad_id = ?", userId);
+    if (before !== void 0 && col.str(before, "claw_user_id") !== clawUserId) forgetNotifySub(db, userId);
+    db.run(
+      "INSERT OR REPLACE INTO bound_users (aad_id, claw_user_id, token_hash, updated_at) VALUES (?, ?, ?, ?)",
+      userId,
+      clawUserId,
+      tokenHash(credential),
+      this.ctx.now()
+    );
+  }
+  /** Ignored for a linked person: their link keeps its own subscription. */
+  forgetBound(userId) {
+    const { db } = this.ctx;
+    if (db.get("SELECT 1 AS one FROM links WHERE aad_id = ?", userId) !== void 0) return;
+    if (db.run("DELETE FROM bound_users WHERE aad_id = ?", userId) > 0) forgetNotifySub(db, userId);
+  }
   needsClawUserId(userId) {
     const row = this.ctx.db.get("SELECT claw_user_id FROM links WHERE aad_id = ?", userId);
     return row !== void 0 && !col.bool(row, "claw_user_id");
   }
+  /** The link's (a linked person's id is never taken from anywhere else), else the bound person's. */
   clawUserIdOf(userId) {
-    const row = this.ctx.db.get("SELECT claw_user_id FROM links WHERE aad_id = ?", userId);
+    const { db } = this.ctx;
+    const row = db.get("SELECT claw_user_id FROM links WHERE aad_id = ?", userId) ?? db.get("SELECT claw_user_id FROM bound_users WHERE aad_id = ?", userId);
     return row && col.bool(row, "claw_user_id") ? col.str(row, "claw_user_id") : null;
   }
   linkedUsers() {

package/dist/sqlite/schema.sql

@@ -122,3 +122,5 @@ CREATE TABLE IF NOT EXISTS observe_cards (
 CREATE INDEX IF NOT EXISTS observe_cards_by_suggestion ON observe_cards (aad_id, run_id, seq);
 CREATE TABLE IF NOT EXISTS group_context_off (
   conversation_id TEXT PRIMARY KEY, updated_at REAL NOT NULL);
+CREATE TABLE IF NOT EXISTS bound_users (
+  aad_id TEXT PRIMARY KEY, claw_user_id TEXT NOT NULL, token_hash TEXT NOT NULL, updated_at REAL NOT NULL);

package/dist/types/sqlite/link-repository.d.ts

@@ -1,4 +1,3 @@
-/** LinkRepository on SQLite (tables `links`, `pending_keys`, `link_attempts`). */
 import { type LinkLimits, type LinkRepository, type RedeemOutcome } from "@primusclaw/personal-agent";
 import { type StoreContext, type SecurityEventSink } from "./context.js";
 export declare class SqliteLinkRepository implements LinkRepository {
@@ -19,7 +18,16 @@ export declare class SqliteLinkRepository implements LinkRepository {
     getKey(userId: string): string | null;
     unlink(userId: string): void;
     setClawUserId(userId: string, clawUserId: string): void;
+    boundClawUser(userId: string, credential: string): {
+        clawUserId: string;
+        current: boolean;
+    } | null;
+    /** Ignored for a linked person (a link's id is read for its key). Another account than before forgets the subscription. */
+    setBoundClawUser(userId: string, clawUserId: string, credential: string): void;
+    /** Ignored for a linked person: their link keeps its own subscription. */
+    forgetBound(userId: string): void;
     needsClawUserId(userId: string): boolean;
+    /** The link's (a linked person's id is never taken from anywhere else), else the bound person's. */
     clawUserIdOf(userId: string): string | null;
     linkedUsers(): string[];
     userForClawUser(clawUserId: string): string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primusclaw/personal-agent-runtime",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Node adapters for the personal agent's ports: clock, randomness, logging (and, as the port lands, storage, Claw, metrics, HTTP).",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@primusclaw/personal-agent": "0.2.0",
+    "@primusclaw/personal-agent": "0.3.0",
     "fastify": "^5.12.8",
     "zod": "^4.6.7"
   }