auramaxx 0.0.17 → 0.0.19

package/src/server/index.ts

@@ -28,6 +28,7 @@ import strategyRoutes from './routes/strategy';
 import appRoutes from './routes/apps';
 import actionsRoutes from './routes/actions';
 import credentialAgentRoutes from './routes/credential-agents';
+import agentHubRoutes from './routes/agent-hub';
 import credentialsRoutes from './routes/credentials';
 import agentProfilesRoutes from './routes/agent-profiles';
 import credentialSharesRoutes from './routes/credential-shares';
@@ -49,6 +50,8 @@ import heartbeatRoutes from './routes/heartbeat';
 import securityRoutes from './routes/security';
 import flagsRoutes from './routes/flags';
 import viewsRoutes from './routes/views';
+import socialRoutes from './routes/social';
+import verifiedCredentialRoutes from './routes/verified-credentials';
 import { preloadCache, onDefaultChanged, parseRateLimit, getDefaultSync } from './lib/defaults';
 import { SocketServer } from './cli/socket';
 
@@ -196,6 +199,7 @@ app.use('/strategies', strategyRoutes);
 app.use('/apps', appRoutes);
 app.use('/actions', actionsRoutes);
 app.use('/agents/credential', credentialAgentRoutes);
+app.use('/agent-hub', agentHubRoutes);
 app.use('/credentials/import', importRoutes);
 app.use('/credentials/passkey', passkeyCredentialRoutes);
 app.use('/credentials', credentialsRoutes);
@@ -214,6 +218,8 @@ app.use('/bookmarks', bookmarkRoutes);
 app.use('/security', securityRoutes);
 app.use('/flags', flagsRoutes);
 app.use('/views', viewsRoutes);
+app.use('/social', socialRoutes);
+app.use('/verified-credentials', verifiedCredentialRoutes);
 
 // Health check
 app.get('/health', (_req, res) => {
@@ -264,6 +270,14 @@ async function startServer() {
   // Apply pending migrations before anything else
   await autoMigrate();
 
+  // One-time migration: agent-profiles.json → Prisma AgentProfile table
+  try {
+    const { migrateAgentProfilesToPrisma } = await import('./lib/migrate-agent-profiles');
+    await migrateAgentProfilesToPrisma();
+  } catch (err) {
+    log.warn({ err }, 'Agent profile migration failed (non-fatal)');
+  }
+
   // Load system defaults into memory cache before handling any requests
   await preloadCache().catch(err => {
     log.warn({ err }, 'Failed to preload defaults cache (will use seed values)');

package/src/server/lib/agent-profiles.ts

@@ -92,7 +92,16 @@ const BUILTIN_PROFILES: AgentPolicyProfileV1[] = [
     displayName: 'Dev',
     description: 'Developer profile for local agent automation with non-financial scope.',
     rationale: 'Use for day-to-day local dev workflows without granting financial operations.',
-    permissions: ['wallet:list', 'secret:read', 'secret:write', 'action:create', 'action:read', 'action:resolve'],
+    permissions: [
+      'wallet:list',
+      'secret:read',
+      'secret:write',
+      'action:create',
+      'action:read',
+      'action:resolve',
+      'social:read',
+      'social:write',
+    ],
     credentialAccess: {
       // Keep legacy `agent` alias for migrated installs while scoping to primary-only access.
       readScopes: ['agent:primary', 'agent:agent'],

package/src/server/lib/cold.ts

@@ -15,7 +15,6 @@ const COLD_FILE = 'cold.json';
 const AGENT_PREFIX = 'agent-';
 const PRIMARY_AGENT_ID = 'primary';
 export const AGENT_AGENT_NAME = 'agent';
-export const DAILY_LOGS_AGENT_NAME = 'daily-logs';
 
 export type AgentMode = 'primary' | 'linked' | 'independent';
 
@@ -566,36 +565,6 @@ export function ensureDefaultLinkedAgentAgent(): { created: boolean; agentId: st
   return { created: true, agentId: created.id };
 }
 
-export function ensureDefaultDailyLogsAgent(): { created: boolean; agentId: string | null; parentAgentId: string | null } {
-  ensureMigration();
-  if (!primaryAgentId || !primaryAgentPassword) {
-    return { created: false, agentId: null, parentAgentId: null };
-  }
-
-  const defaultParentAgentId = primaryAgentId;
-
-  const agents = listAgents();
-  const existingUnderPrimary = agents.find(
-    v => (v.name || '').trim().toLowerCase() === DAILY_LOGS_AGENT_NAME && (v.parentAgentId || v.linkedTo) === defaultParentAgentId,
-  );
-  if (existingUnderPrimary) {
-    return { created: false, agentId: existingUnderPrimary.id, parentAgentId: defaultParentAgentId };
-  }
-
-  const created = createAgent(primaryAgentPassword, DAILY_LOGS_AGENT_NAME, {
-    mode: 'linked',
-    parentAgentId: defaultParentAgentId,
-    seedOnboardingSecret: false,
-  });
-  return { created: true, agentId: created.id, parentAgentId: defaultParentAgentId };
-}
-
-export function ensureDefaultAgentHierarchy(): { agentAgentId: string | null; dailyLogsAgentId: string | null } {
-  // New default hierarchy is primary -> daily-logs.
-  // We intentionally do not auto-create a linked "agent" vault anymore.
-  const dailyLogs = ensureDefaultDailyLogsAgent();
-  return { agentAgentId: null, dailyLogsAgentId: dailyLogs.agentId };
-}
 
 function sortAgentsByCreatedAt(a: AgentInfo, b: AgentInfo): number {
   const createdDelta = new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime();
@@ -788,13 +757,6 @@ export function createColdWallet(password: string): CreateWalletResult {
     console.warn('[cold] Failed to seed primary WORKING_WITH_SECRETS onboarding note:', err);
   }
 
-  // Create default linked diary hierarchy once at setup time.
-  try {
-    ensureDefaultAgentHierarchy();
-  } catch (err) {
-    console.warn('[cold] Failed to create default diary agent hierarchy:', err);
-  }
-
   clearNukeStateMarker();
 
   return {
@@ -1025,13 +987,6 @@ export function importColdWallet(mnemonic: string, password: string): WalletInfo
     console.warn('[cold] Failed to seed primary WORKING_WITH_SECRETS onboarding note:', err);
   }
 
-  // Create default linked diary hierarchy once at import time.
-  try {
-    ensureDefaultAgentHierarchy();
-  } catch (err) {
-    console.warn('[cold] Failed to create default diary agent hierarchy:', err);
-  }
-
   clearNukeStateMarker();
 
   return {

package/src/server/lib/credential-import.ts

@@ -9,6 +9,7 @@
 import { parse } from 'csv-parse/sync';
 import { CredentialType, CredentialField } from '../types';
 import { listCredentials } from './credentials';
+import { getCredentialFieldSpec } from '../../../shared/credential-field-schema';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -59,6 +60,11 @@ export type ImportFormat =
 // Helpers
 // ---------------------------------------------------------------------------
 
+/** Derive field sensitivity from the credential schema; default to false for unknown fields. */
+function fieldSensitive(type: CredentialType, key: string): boolean {
+  return getCredentialFieldSpec(type, key)?.sensitive ?? false;
+}
+
 /** Strip UTF-8 BOM if present */
 function stripBOM(text: string): string {
   return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
@@ -249,29 +255,29 @@ export function parse1PasswordCSV(csv: string): ImportedCredential[] {
   }) as Record<string, string>[];
 
   return records.map((row) => {
+    // Map 1Password types to AuraMaxx types
+    let type: CredentialType = 'login';
+    const rawType = (row.Type || '').toLowerCase();
+    if (rawType.includes('card') || rawType.includes('credit')) type = 'card';
+    else if (rawType.includes('note')) type = 'note';
+    else if (rawType.includes('api')) type = 'api';
+    else if (rawType.includes('identity')) type = 'custom';
+
     const fields: ImportedField[] = [];
 
     if (row.Username) {
-      fields.push({ key: 'username', value: row.Username, sensitive: false });
+      fields.push({ key: 'username', value: row.Username, sensitive: fieldSensitive(type, 'username') });
     }
     if (row.Password) {
-      fields.push({ key: 'password', value: row.Password, sensitive: true });
+      fields.push({ key: 'password', value: row.Password, sensitive: fieldSensitive(type, 'password') });
     }
     if (row.Notes) {
-      fields.push({ key: 'notes', value: row.Notes, sensitive: false });
+      fields.push({ key: 'notes', value: row.Notes, sensitive: fieldSensitive(type, 'notes') });
     }
     if (row.OTP) {
-      fields.push({ key: 'totp', value: row.OTP, sensitive: true });
+      fields.push({ key: 'totp', value: row.OTP, sensitive: fieldSensitive(type, 'totp') });
     }
 
-    // Map 1Password types to AuraMaxx types
-    let type: CredentialType = 'login';
-    const rawType = (row.Type || '').toLowerCase();
-    if (rawType.includes('card') || rawType.includes('credit')) type = 'card';
-    else if (rawType.includes('note')) type = 'note';
-    else if (rawType.includes('api')) type = 'api';
-    else if (rawType.includes('identity')) type = 'custom';
-
     return {
       name: row.Title || 'Untitled',
       type,
@@ -300,27 +306,27 @@ export function parseBitwardenCSV(csv: string): ImportedCredential[] {
   }) as Record<string, string>[];
 
   return records.map((row) => {
+    let type: CredentialType = 'login';
+    const rawType = (row.type || '').toLowerCase();
+    if (rawType === 'card') type = 'card';
+    else if (rawType === 'securenote' || rawType === 'note') type = 'note';
+    else if (rawType === 'identity') type = 'custom';
+
     const fields: ImportedField[] = [];
 
     if (row.login_username) {
-      fields.push({ key: 'username', value: row.login_username, sensitive: false });
+      fields.push({ key: 'username', value: row.login_username, sensitive: fieldSensitive(type, 'username') });
     }
     if (row.login_password) {
-      fields.push({ key: 'password', value: row.login_password, sensitive: true });
+      fields.push({ key: 'password', value: row.login_password, sensitive: fieldSensitive(type, 'password') });
     }
     if (row.notes) {
-      fields.push({ key: 'notes', value: row.notes, sensitive: false });
+      fields.push({ key: 'notes', value: row.notes, sensitive: fieldSensitive(type, 'notes') });
     }
     if (row.login_totp) {
-      fields.push({ key: 'totp', value: row.login_totp, sensitive: true });
+      fields.push({ key: 'totp', value: row.login_totp, sensitive: fieldSensitive(type, 'totp') });
     }
 
-    let type: CredentialType = 'login';
-    const rawType = (row.type || '').toLowerCase();
-    if (rawType === 'card') type = 'card';
-    else if (rawType === 'securenote' || rawType === 'note') type = 'note';
-    else if (rawType === 'identity') type = 'custom';
-
     const tags: string[] = [];
     if (row.folder) tags.push(row.folder);
 
@@ -355,13 +361,13 @@ export function parseChromeCSV(csv: string): ImportedCredential[] {
     const fields: ImportedField[] = [];
 
     if (row.username) {
-      fields.push({ key: 'username', value: row.username, sensitive: false });
+      fields.push({ key: 'username', value: row.username, sensitive: fieldSensitive('login', 'username') });
     }
     if (row.password) {
-      fields.push({ key: 'password', value: row.password, sensitive: true });
+      fields.push({ key: 'password', value: row.password, sensitive: fieldSensitive('login', 'password') });
     }
     if (row.note) {
-      fields.push({ key: 'notes', value: row.note, sensitive: false });
+      fields.push({ key: 'notes', value: row.note, sensitive: fieldSensitive('login', 'notes') });
     }
 
     return {
@@ -395,10 +401,10 @@ export function parseFirefoxCSV(csv: string): ImportedCredential[] {
     const fields: ImportedField[] = [];
 
     if (row.username) {
-      fields.push({ key: 'username', value: row.username, sensitive: false });
+      fields.push({ key: 'username', value: row.username, sensitive: fieldSensitive('login', 'username') });
     }
     if (row.password) {
-      fields.push({ key: 'password', value: row.password, sensitive: true });
+      fields.push({ key: 'password', value: row.password, sensitive: fieldSensitive('login', 'password') });
     }
 
     // Derive a name from the URL
@@ -441,10 +447,10 @@ export function parseICloudCSV(csv: string): ImportedCredential[] {
     const totp = getRowValue(row, ['OTPAuth', 'TOTP', 'One-Time Code', 'One-Time Password']);
 
     const fields: ImportedField[] = [];
-    if (username) fields.push({ key: 'username', value: username, sensitive: false });
-    if (password) fields.push({ key: 'password', value: password, sensitive: true });
-    if (notes) fields.push({ key: 'notes', value: notes, sensitive: false });
-    if (totp) fields.push({ key: 'totp', value: totp, sensitive: true });
+    if (username) fields.push({ key: 'username', value: username, sensitive: fieldSensitive('login', 'username') });
+    if (password) fields.push({ key: 'password', value: password, sensitive: fieldSensitive('login', 'password') });
+    if (notes) fields.push({ key: 'notes', value: notes, sensitive: fieldSensitive('login', 'notes') });
+    if (totp) fields.push({ key: 'totp', value: totp, sensitive: fieldSensitive('login', 'totp') });
 
     let name = title || 'Untitled';
     if (!title && url) {
@@ -486,10 +492,10 @@ export function parseLastPassCSV(csv: string): ImportedCredential[] {
     const grouping = getRowValue(row, ['grouping', 'group', 'folder']);
 
     const fields: ImportedField[] = [];
-    if (username) fields.push({ key: 'username', value: username, sensitive: false });
-    if (password) fields.push({ key: 'password', value: password, sensitive: true });
-    if (notes) fields.push({ key: 'notes', value: notes, sensitive: false });
-    if (totp) fields.push({ key: 'totp', value: totp, sensitive: true });
+    if (username) fields.push({ key: 'username', value: username, sensitive: fieldSensitive('login', 'username') });
+    if (password) fields.push({ key: 'password', value: password, sensitive: fieldSensitive('login', 'password') });
+    if (notes) fields.push({ key: 'notes', value: notes, sensitive: fieldSensitive('login', 'notes') });
+    if (totp) fields.push({ key: 'totp', value: totp, sensitive: fieldSensitive('login', 'totp') });
 
     let name = nameFromRow || 'Untitled';
     if (!nameFromRow && url) {
@@ -524,9 +530,9 @@ export function parse1PasswordJSON(json: string): ImportedCredential[] {
     const login = item?.login ?? {};
     const fields: ImportedField[] = [];
 
-    if (login.username) fields.push({ key: 'username', value: String(login.username), sensitive: false });
-    if (login.password) fields.push({ key: 'password', value: String(login.password), sensitive: true });
-    if (item?.notesPlain || item?.notes) fields.push({ key: 'notes', value: String(item.notesPlain || item.notes), sensitive: false });
+    if (login.username) fields.push({ key: 'username', value: String(login.username), sensitive: fieldSensitive('login', 'username') });
+    if (login.password) fields.push({ key: 'password', value: String(login.password), sensitive: fieldSensitive('login', 'password') });
+    if (item?.notesPlain || item?.notes) fields.push({ key: 'notes', value: String(item.notesPlain || item.notes), sensitive: fieldSensitive('login', 'notes') });
 
     const url = login?.urls?.[0]?.href || login?.uris?.[0]?.uri || login?.uris?.[0]?.url || item?.url || undefined;
     return {
@@ -546,10 +552,10 @@ export function parseBitwardenJSON(json: string): ImportedCredential[] {
     const login = item?.login ?? {};
     const fields: ImportedField[] = [];
 
-    if (login.username) fields.push({ key: 'username', value: String(login.username), sensitive: false });
-    if (login.password) fields.push({ key: 'password', value: String(login.password), sensitive: true });
-    if (item?.notes) fields.push({ key: 'notes', value: String(item.notes), sensitive: false });
-    if (login?.totp) fields.push({ key: 'totp', value: String(login.totp), sensitive: true });
+    if (login.username) fields.push({ key: 'username', value: String(login.username), sensitive: fieldSensitive('login', 'username') });
+    if (login.password) fields.push({ key: 'password', value: String(login.password), sensitive: fieldSensitive('login', 'password') });
+    if (item?.notes) fields.push({ key: 'notes', value: String(item.notes), sensitive: fieldSensitive('login', 'notes') });
+    if (login?.totp) fields.push({ key: 'totp', value: String(login.totp), sensitive: fieldSensitive('login', 'totp') });
 
     return {
       name: String(item?.name || 'Untitled'),
@@ -566,9 +572,9 @@ export function parseChromeJSON(json: string): ImportedCredential[] {
 
   return items.map((item: any) => {
     const fields: ImportedField[] = [];
-    if (item?.username) fields.push({ key: 'username', value: String(item.username), sensitive: false });
-    if (item?.password) fields.push({ key: 'password', value: String(item.password), sensitive: true });
-    if (item?.note || item?.notes) fields.push({ key: 'notes', value: String(item.note || item.notes), sensitive: false });
+    if (item?.username) fields.push({ key: 'username', value: String(item.username), sensitive: fieldSensitive('login', 'username') });
+    if (item?.password) fields.push({ key: 'password', value: String(item.password), sensitive: fieldSensitive('login', 'password') });
+    if (item?.note || item?.notes) fields.push({ key: 'notes', value: String(item.note || item.notes), sensitive: fieldSensitive('login', 'notes') });
 
     return {
       name: String(item?.name || item?.title || 'Untitled'),
@@ -585,8 +591,8 @@ export function parseFirefoxJSON(json: string): ImportedCredential[] {
 
   return items.map((item: any) => {
     const fields: ImportedField[] = [];
-    if (item?.username) fields.push({ key: 'username', value: String(item.username), sensitive: false });
-    if (item?.password) fields.push({ key: 'password', value: String(item.password), sensitive: true });
+    if (item?.username) fields.push({ key: 'username', value: String(item.username), sensitive: fieldSensitive('login', 'username') });
+    if (item?.password) fields.push({ key: 'password', value: String(item.password), sensitive: fieldSensitive('login', 'password') });
 
     const url = item?.url || item?.hostname || undefined;
     let name = 'Untitled';

package/src/server/lib/defaults.ts

@@ -105,6 +105,10 @@ export const SEED_DEFAULTS: SeedDefault[] = [
   { key: 'defaults.credential.excludeFields.login', value: ['password'], type: 'credential', label: 'Login Excluded Fields', description: 'Fields excluded by default when reading login credentials' },
   { key: 'defaults.credential.excludeFields.note', value: [], type: 'credential', label: 'Note Excluded Fields', description: 'Fields excluded by default when reading note credentials' },
 
+  // Social
+  { key: 'social.hub_url', value: 'https://hub.auramaxx.com', type: 'social', label: 'Hub URL', description: 'Base URL for the auramaxx hub (registration, sync, credentials)' },
+  { key: 'social.required_credentials', value: [], type: 'social', label: 'Required Credentials for Social Writes', description: 'Credential type slugs an agent must have verified before posting (empty = no requirement)' },
+
   // Balance sync
   { key: 'sync.active_interval', value: 15000, type: 'sync', label: 'Active Sync Interval (ms)', description: 'Interval for syncing active/cold wallets' },
   { key: 'sync.background_interval', value: 120000, type: 'sync', label: 'Background Sync Interval (ms)', description: 'Interval for syncing background wallets' },
@@ -376,6 +380,13 @@ export function parseRateLimit(value: unknown): { max: number; windowMs: number
   return { max: 10, windowMs: 60000 };
 }
 
+// ─── Convenience Accessors ──────────────────────────────────────────
+
+/** Hub URL from defaults — single source of truth for all social/credential routes + cron. */
+export function getHubUrl(): string {
+  return getDefaultSync<string>('social.hub_url', 'https://hub.auramaxx.com');
+}
+
 // ─── Test Helpers ───────────────────────────────────────────────────
 
 /** Reset cache state (for tests only) */

package/src/server/lib/feature-flags.ts

@@ -14,6 +14,9 @@ export interface FeatureFlags {
 const DEFAULT_FLAGS: FeatureFlags = {
   DEMO_FEATURE: false,
   EXPERIMENTAL_WALLET: false,
+  SOCIAL: false,
+  SHOW_DISCOVER_HUB: false,
+  CREDENTIALS: false,
 };
 
 const root = path.resolve(__dirname, '..', '..', '..');

package/src/server/lib/hub-auth.ts

@@ -0,0 +1,159 @@
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { deriveSigningSeed } from './social/sign';
+import { HubRpcClient, HubRpcError } from './social/hub-rpc-client';
+import { getAgentMnemonic, getPrimaryAgentId } from './cold';
+
+const REFRESH_SKEW_MS = 30_000;
+
+interface HubSessionCacheEntry {
+  token: string;
+  publicKeyB64: string;
+  expiresAtMs: number;
+}
+
+interface HubTokenResponse {
+  token: string;
+  expiresAt: string;
+  publicKey: string;
+}
+
+export interface HubAuthIdentity {
+  agentId: string;
+  mnemonic: string;
+}
+
+type HubSessionLogger = {
+  debug?: (...args: unknown[]) => void;
+  warn?: (...args: unknown[]) => void;
+};
+
+const sessionCache = new Map<string, HubSessionCacheEntry>();
+
+function toCacheKey(hubUrl: string, publicKeyB64: string): string {
+  return `${hubUrl}::${publicKeyB64}`;
+}
+
+function derivePublicKeyB64(mnemonic: string): string {
+  const seed = deriveSigningSeed(mnemonic);
+  const pubKeyBytes = ed25519.getPublicKey(seed);
+  return Buffer.from(pubKeyBytes).toString('base64');
+}
+
+function parseExpiry(expiresAt: string): number {
+  const parsed = Date.parse(expiresAt);
+  return Number.isFinite(parsed) ? parsed : (Date.now() + 5 * 60_000);
+}
+
+/**
+ * Resolve which unlocked local agent should authenticate to a hub.
+ * Primary agent is preferred, then optional caller-provided fallback.
+ */
+export function resolveHubAuthIdentity(
+  preferredAgentId?: string,
+): HubAuthIdentity | null {
+  const primaryAgentId = getPrimaryAgentId() ?? 'primary';
+  const candidates = [primaryAgentId];
+
+  const preferred = typeof preferredAgentId === 'string' ? preferredAgentId.trim() : '';
+  if (preferred && !candidates.includes(preferred)) {
+    candidates.push(preferred);
+  }
+
+  for (const agentId of candidates) {
+    const mnemonic = getAgentMnemonic(agentId);
+    if (mnemonic) {
+      return { agentId, mnemonic };
+    }
+  }
+
+  return null;
+}
+
+async function mintSessionToken(
+  hubUrl: string,
+  mnemonic: string,
+  publicKeyB64: string,
+): Promise<HubSessionCacheEntry> {
+  const seed = deriveSigningSeed(mnemonic);
+  const rpc = new HubRpcClient(hubUrl);
+
+  const challengeRes = await rpc.call<{ challenge: string }>('auth.challenge', { publicKey: publicKeyB64 });
+  const challenge = challengeRes.challenge;
+  const signature = Buffer.from(ed25519.sign(new TextEncoder().encode(challenge), seed)).toString('base64');
+
+  const tokenRes = await rpc.call<HubTokenResponse>('auth.token', {
+    publicKey: publicKeyB64,
+    challenge,
+    signature,
+  });
+
+  return {
+    token: tokenRes.token,
+    publicKeyB64,
+    expiresAtMs: parseExpiry(tokenRes.expiresAt),
+  };
+}
+
+export function invalidateHubSessionToken(hubUrl: string, publicKeyB64: string): void {
+  sessionCache.delete(toCacheKey(hubUrl, publicKeyB64));
+}
+
+export async function getHubSessionToken(
+  hubUrl: string,
+  mnemonic: string,
+  opts?: { forceRefresh?: boolean; log?: HubSessionLogger },
+): Promise<HubSessionCacheEntry> {
+  const publicKeyB64 = derivePublicKeyB64(mnemonic);
+  const key = toCacheKey(hubUrl, publicKeyB64);
+
+  if (!opts?.forceRefresh) {
+    const cached = sessionCache.get(key);
+    if (cached && (cached.expiresAtMs - REFRESH_SKEW_MS) > Date.now()) {
+      return cached;
+    }
+  }
+
+  const fresh = await mintSessionToken(hubUrl, mnemonic, publicKeyB64);
+  sessionCache.set(key, fresh);
+  opts?.log?.debug?.({ hubUrl, expiresAtMs: fresh.expiresAtMs }, 'Minted hub session token');
+  return fresh;
+}
+
+export async function callHubWithSessionAuth<R>(
+  hubUrl: string,
+  method: string,
+  params: Record<string, unknown>,
+  mnemonic: string,
+  opts?: { log?: HubSessionLogger; timeoutMs?: number },
+): Promise<R> {
+  const rpc = new HubRpcClient(hubUrl);
+  let session = await getHubSessionToken(hubUrl, mnemonic, { log: opts?.log });
+  rpc.setBearerToken(session.token);
+
+  try {
+    return await rpc.call<R>(method, params, { timeoutMs: opts?.timeoutMs });
+  } catch (error) {
+    if (error instanceof HubRpcError && error.statusCode === 401) {
+      opts?.log?.warn?.({ hubUrl, method }, 'Hub session token expired/invalid; refreshing and retrying once');
+      invalidateHubSessionToken(hubUrl, session.publicKeyB64);
+      session = await getHubSessionToken(hubUrl, mnemonic, { forceRefresh: true, log: opts?.log });
+      rpc.setBearerToken(session.token);
+      return rpc.call<R>(method, params, { timeoutMs: opts?.timeoutMs });
+    }
+    throw error;
+  }
+}
+
+export async function tryCallHubWithSessionAuth<R>(
+  hubUrl: string,
+  method: string,
+  params: Record<string, unknown>,
+  mnemonic: string,
+  opts?: { log?: HubSessionLogger; timeoutMs?: number },
+): Promise<R | null> {
+  try {
+    return await callHubWithSessionAuth<R>(hubUrl, method, params, mnemonic, opts);
+  } catch {
+    return null;
+  }
+}

package/src/server/lib/migrate-agent-profiles.ts

@@ -0,0 +1,96 @@
+/**
+ * One-time boot migration: agent-profiles.json → Prisma AgentProfile table.
+ *
+ * Runs on server startup. If the JSON file exists, reads all entries,
+ * inserts them into the AgentProfile table, then deletes the JSON file.
+ * Idempotent: if the file doesn't exist, this is a no-op.
+ */
+import fs from 'fs';
+import path from 'path';
+import { prisma } from './db';
+import { DATA_PATHS } from './config';
+import { log } from './pino';
+
+const AGENT_PROFILES_FILE = 'agent-profiles.json';
+
+interface LegacyProfileRecord {
+  agentId: string;
+  email?: string;
+  phone?: string;
+  address?: string;
+  profileImage?: string;
+  attributes?: Record<string, string>;
+  createdAt?: string;
+  updatedAt?: string;
+}
+
+interface LegacyProfilesFile {
+  version: number;
+  profiles: Record<string, LegacyProfileRecord>;
+}
+
+export async function migrateAgentProfilesToPrisma(): Promise<void> {
+  const filePath = path.join(DATA_PATHS.wallets, AGENT_PROFILES_FILE);
+
+  if (!fs.existsSync(filePath)) {
+    return; // Nothing to migrate
+  }
+
+  let store: LegacyProfilesFile;
+  try {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    store = JSON.parse(raw) as LegacyProfilesFile;
+  } catch (err) {
+    log.warn({ err, filePath }, 'Failed to read agent-profiles.json for migration, skipping');
+    return;
+  }
+
+  if (!store || typeof store !== 'object' || !store.profiles || typeof store.profiles !== 'object') {
+    log.warn({ filePath }, 'agent-profiles.json has unexpected format, skipping migration');
+    return;
+  }
+
+  const entries = Object.values(store.profiles);
+  if (entries.length === 0) {
+    // Empty file, just delete it
+    fs.unlinkSync(filePath);
+    log.info('Deleted empty agent-profiles.json');
+    return;
+  }
+
+  let migrated = 0;
+  for (const entry of entries) {
+    if (!entry.agentId) continue;
+    try {
+      await prisma.agentProfile.upsert({
+        where: { agentId: entry.agentId },
+        create: {
+          agentId: entry.agentId,
+          email: entry.email ?? null,
+          phone: entry.phone ?? null,
+          address: entry.address ?? null,
+          profileImage: entry.profileImage ?? null,
+          attributes: entry.attributes ? JSON.stringify(entry.attributes) : null,
+        },
+        update: {
+          email: entry.email ?? null,
+          phone: entry.phone ?? null,
+          address: entry.address ?? null,
+          profileImage: entry.profileImage ?? null,
+          attributes: entry.attributes ? JSON.stringify(entry.attributes) : null,
+        },
+      });
+      migrated++;
+    } catch (err) {
+      log.error({ err, agentId: entry.agentId }, 'Failed to migrate agent profile');
+    }
+  }
+
+  // Delete the JSON file after successful migration
+  try {
+    fs.unlinkSync(filePath);
+    log.info({ migrated, total: entries.length }, 'Migrated agent profiles from JSON to Prisma');
+  } catch (err) {
+    log.warn({ err, filePath }, 'Failed to delete agent-profiles.json after migration');
+  }
+}