@happyvertical/smrt-cli 0.53.4 → 0.53.5

package/AGENTS.md

@@ -45,6 +45,8 @@ smrt dispatch:*              # Dispatch management (list/process/retry/cleanup)
 smrt app <op>                # App install/setup/start/migrate/worker…: agents/app-commands.md
 ```
 
+DB target: config `database.url` > `DATABASE_URL` > `:memory:` (README).
+
 File-backed SQL/TypeScript migration generation is not supported. SMRT schema
 migrations are manifest-driven through registered objects and project manifests.
 

package/README.md

@@ -208,6 +208,13 @@ Run the project's package-manager install command after initialization. Existing
 versions are preserved; s-m-r-t workspace projects receive `workspace:*` ranges and
 consumer projects receive the CLI's published release line.
 
+The generated `src/lib/server/smrt.ts` exports only `runtime` (`classOptions()`
+and `getCollection()` over `DATABASE_URL`/`DATABASE_TYPE`), which generated API
+routes call per request; it no longer exports the deprecated
+`getCollection`/`getSmrtConfig` accessors. To adopt the full application
+runtime, replace that object with `createSmrtSvelteKitRuntime()` from
+`@happyvertical/smrt-app-runtime/sveltekit` and mount its `handle`/`init`.
+
 ### Dispatch
 
 | Command | Description |
@@ -364,6 +371,23 @@ export default {
 };
 ```
 
+### Database precedence
+
+Every `db:*` command resolves its database once, at startup:
+
+1. `packages.cli.database.url` from any config layer — an explicit project
+   setting always wins, so a stray shell `DATABASE_URL` never retargets it.
+2. `DATABASE_URL`, with the engine from the config's `database.type`, else
+   `DATABASE_TYPE` (`sqlite` | `postgres`), else the URL scheme
+   (`postgres://` / `postgresql://` → postgres, anything else sqlite). An
+   unsupported `DATABASE_TYPE` disables this step with a warning.
+3. The `:memory:` default, which schema commands refuse.
+
+`smrt app setup` and `smrt app migrate` hand `smrt db:migrate` the profile's
+database through step 2, so an application does not forward
+`DATABASE_URL` in its own config. The rule is smrt-config's
+`resolveCliDatabaseConfig()`, which `smrt-dev-mcp` uses too.
+
 ### Entry Point Discovery
 
 The CLI loads s-m-r-t objects from your project entry point:

package/agents/app-commands.md

@@ -10,9 +10,10 @@ template's scripts so an app's `package.json` scripts become one-liners.
 | `scripts/smrt-app.mjs <op>` | `smrt app install\|setup\|recover\|start\|stop\|doctor\|open\|backup\|export\|import` |
 | `scripts/smrt-prepare-migration.mjs` | `smrt app migrate` |
 | `scripts/smrt-worker.mjs [task\|schedule]` | `smrt app worker [task\|schedule]` |
-| `node --env-file-if-exists=.env scripts/smrt-vite.mjs <args>` | `smrt app vite <args>` (`smrt app dev …` = `vite dev …`) |
+| `node --env-file-if-exists=.env scripts/smrt-vite.mjs <args>` | `smrt app vite <args>` (`smrt app dev …` = `vite dev …` plus `--host 127.0.0.1` / `--port $PORT` unless given: `devServerArguments`) |
 | `smrt-mcp-apps.mjs validate-if-present && …smrt-vite.mjs build` | `smrt app build [vite args]` |
 | `scripts/smrt-web.mjs` | `bin/smrt-web.mjs` (spawned by `start`) |
+| — (new, #3413) | `smrt app token [create] --scopes … [--expires 30d] [--label …]`, `token list`, `token revoke <id>` |
 | helper modules | `@happyvertical/smrt-cli/app` (side-effect-free subpath) |
 
 ## Source
@@ -30,6 +31,12 @@ config loading; `bin/smrt.js` imports `dist/` in-process so SIGTERM reaches
 
 ## Contracts that must not drift
 
+- **Profile**: `resolveConfiguredRuntime` and app-runtime's SvelteKit entry
+  both call smrt-config's `resolveEffectiveApplicationRuntime(loaded)` (#3446),
+  so operator and web process agree: no `runtime` block (or no config) is
+  `local`; any present value other than `undefined` (including
+  `null`/`false`/`0`/`''`) is validated and fails closed when it is not a
+  valid block.
 - **State root** `<XDG_STATE_HOME|~/.local/state|~/Library/Application Support|%LOCALAPPDATA%>/.<appId>-<sha256(dataRoot)[:12]>-state`,
   mode 0700, every ancestor user/root-owned and not group/world-writable,
   app-bound empty 0600 marker `.smrt-state-<appId>`. Shared with the running
@@ -53,9 +60,27 @@ config loading; `bin/smrt.js` imports `dist/` in-process so SIGTERM reaches
   `{schemaVersion:1,status:'error',code:'operation-failed',message,recovery,secretValuesIncluded:false}`
   plus `runtimeCode` when a `LocalRuntimeError` carries one
   (`migration_failed` + `MIGRATION_FAILED_MESSAGE`). Messages pass through
-  `redactSecrets()` (secret-named env values, URL userinfo, `token=`, Bearer).
+  `redactSecrets()` (secret-named env values, URL userinfo, `token=`, Bearer;
+  every span is found on the raw text and the union masked at once, so a
+  literal value never splits a structural match; existing `[redacted]`
+  markers are opaque, so a second pass neither corrupts nor grows text).
+  `start` sends the detached web process's stdout/stderr to a fresh 0600
+  `<state>/app.log` per start (removed, then created `wx`; a pipe would EPIPE
+  once the CLI exits); a start that never proves readiness adds `output` (the
+  last ≤ 8 KiB, redacted against the child env before the cut with
+  `{ strict: true }`: no 8-character floor for env values or Bearer tokens) and `logFile`
+  (`ApplicationStartError`).
   The bootstrap token is written only to mode-0600 `onboarding.json` /
-  `onboarding-launch.html`; `open` passes the launch file URL, never the token.
+  `onboarding-launch.html`; `open` passes the launch file URL, never the token. `setup`/`recover` print the one-time
+  `/setup?token=` URL only to an interactive terminal (`io.operatorTerminal`,
+  stderr when both stdio are TTYs), never to stdout/stderr logs or pipes. The
+  web runtime deletes the files after a successful owner claim.
+- **`token`** (`tokens.ts`, local only): parses every argument before touching
+  state, opens `openLocalMcpTokenStore` (validated custody, uncached
+  connection, no writer lease, so it runs beside `app:start`), and serializes
+  create/revoke under `operation.lock`. Only the `issued` document carries
+  the token (`secretValuesIncluded: true`); list/revoke/error output never
+  does.
 - **Artifacts**: backup/export/import paths go through
   `assertExternalArtifactPath` (real path of nearest existing ancestor, never
   in or over the checkout). Backup refuses an existing destination; export

package/dist/{ApiKey-BZmbOTnL-DPPF6Swn.js → ApiKey-BZmbOTnL-BbZupUZ3.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-D60BSg6H.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-Di3_eNCq.js";
 import { SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { createHash, randomBytes } from "node:crypto";
 //#region ../profiles/dist/chunks/ApiKey-BZmbOTnL.js
@@ -127,7 +127,7 @@ var ApiKey = class extends SmrtObject {
 	*/
 	static async verify(key, options = {}) {
 		const keyHash = ApiKey.hashKey(key);
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-B1-2YKj8.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-DYAZwx0O.js").then((n) => n.n).then((n) => n.n);
 		const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
 		if (!apiKey) return null;
 		if (!apiKey.isValid()) return null;

package/dist/ApiKeyCollection-Bfb_nw81-DYAZwx0O.js

@@ -0,0 +1,87 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-Di3_eNCq.js";
+import { t as ApiKey } from "./ApiKey-BZmbOTnL-BbZupUZ3.js";
+import { SmrtCollection } from "@happyvertical/smrt-core";
+//#region ../profiles/dist/chunks/ApiKeyCollection-Bfb_nw81.js
+var ApiKeyCollection_Bfb_nw81_exports = /* @__PURE__ */ __exportAll({
+	n: () => ApiKeyCollection_exports,
+	t: () => ApiKeyCollection
+});
+var ApiKeyCollection_exports = /* @__PURE__ */ __exportAll$1({ ApiKeyCollection: () => ApiKeyCollection });
+var ApiKeyCollection = class extends SmrtCollection {
+	static _itemClass = ApiKey;
+	/**
+	* Find all keys for a profile
+	*/
+	async findByProfile(profileId) {
+		return await this.list({ where: { profileId } });
+	}
+	/**
+	* Find active (non-revoked, non-expired) keys for a profile
+	*/
+	async findActiveByProfile(profileId) {
+		return (await this.findByProfile(profileId)).filter((key) => key.isValid());
+	}
+	/**
+	* Find key by hash
+	*/
+	async findByHash(keyHash) {
+		return await this.findOne({ where: { keyHash } });
+	}
+	/**
+	* Verify an API key string and return the record if valid
+	*/
+	async verify(key) {
+		const keyHash = ApiKey.hashKey(key);
+		const apiKey = await this.findByHash(keyHash);
+		if (!apiKey) return null;
+		if (!apiKey.isValid()) return null;
+		await apiKey.recordUsage();
+		if (!apiKey.isValid()) return null;
+		return apiKey;
+	}
+	/**
+	* Generate a new key for a profile
+	*/
+	async generateForProfile(profile, options) {
+		return await ApiKey.generate(profile, {
+			...options,
+			db: this.options.db
+		});
+	}
+	/**
+	* Revoke all keys for a profile
+	*/
+	async revokeAllForProfile(profileId) {
+		const keys = await this.findActiveByProfile(profileId);
+		for (const key of keys) await key.revoke();
+		return keys.length;
+	}
+	/**
+	* Revoke a specific key by prefix
+	*/
+	async revokeByPrefix(keyPrefix) {
+		const key = await this.findOne({ where: { keyPrefix } });
+		if (key?.isValid()) {
+			await key.revoke();
+			return true;
+		}
+		return false;
+	}
+	/**
+	* Clean up expired keys (soft delete by setting revokedAt)
+	*/
+	async cleanupExpired() {
+		const now = /* @__PURE__ */ new Date();
+		const allKeys = await this.list({});
+		let cleaned = 0;
+		for (const key of allKeys) if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {
+			key.revokedAt = now;
+			await key.save();
+			cleaned++;
+		}
+		return cleaned;
+	}
+};
+//#endregion
+export { ApiKeyCollection_Bfb_nw81_exports as n, ApiKeyCollection as t };

package/dist/AuditLogCollection-B1YonCAP-Bkj2Ezon.js

@@ -0,0 +1,193 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { i as tenantId, r as TenantScoped } from "./dist-C87Ib9Vx.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-Di3_eNCq.js";
+import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
+//#region ../profiles/dist/chunks/AuditLogCollection-B1YonCAP.js
+var AuditLogCollection_B1YonCAP_exports = /* @__PURE__ */ __exportAll({
+	n: () => AuditLogCollection_exports,
+	r: () => AuditLog,
+	t: () => AuditLogCollection
+});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var AuditLog = class extends SmrtObject {
+	tenantId = null;
+	profileId;
+	/**
+	* Action performed (e.g., 'issue.update', 'feedback.incorporate')
+	*/
+	action = "";
+	/**
+	* Type of resource affected (e.g., 'Issue', 'Repository')
+	*/
+	resourceType = "";
+	/**
+	* ID of the affected resource
+	*/
+	resourceId = "";
+	/**
+	* Source of the action
+	*/
+	source = "web";
+	/**
+	* Additional context (CI run ID, request ID, etc.)
+	*/
+	metadata = {};
+	onBehalfOfId;
+	constructor(options = {}) {
+		super(options);
+		if (options.profileId) this.profileId = options.profileId;
+		if (options.action) this.action = options.action;
+		if (options.resourceType) this.resourceType = options.resourceType;
+		if (options.resourceId) this.resourceId = options.resourceId;
+		if (options.source) this.source = options.source;
+		if (options.metadata) this.metadata = options.metadata;
+		if (options.onBehalfOfId !== void 0) this.onBehalfOfId = options.onBehalfOfId;
+	}
+	/**
+	* Get the profile who performed the action
+	*/
+	async getProfile() {
+		return await this.getRelated("profileId");
+	}
+	/**
+	* Get the profile on whose behalf the action was performed (if any)
+	*/
+	async getOnBehalfOf() {
+		if (!this.onBehalfOfId) return null;
+		return await this.getRelated("onBehalfOfId");
+	}
+	/**
+	* Get the effective actor (onBehalfOf if set, otherwise profile)
+	*/
+	async getEffectiveActor() {
+		const onBehalfOf = await this.getOnBehalfOf();
+		if (onBehalfOf) return onBehalfOf;
+		return await this.getProfile();
+	}
+	/**
+	* Create an audit log entry
+	*/
+	static async record(options) {
+		const log = new AuditLog({
+			...options,
+			profileId: options.profile.id,
+			onBehalfOfId: options.onBehalfOf?.id
+		});
+		await log.initialize();
+		await log.save();
+		return log;
+	}
+};
+__decorateClass([tenantId({ nullable: true })], AuditLog.prototype, "tenantId", 2);
+__decorateClass([foreignKey("Profile", { required: true })], AuditLog.prototype, "profileId", 2);
+__decorateClass([foreignKey("Profile", { nullable: true })], AuditLog.prototype, "onBehalfOfId", 2);
+AuditLog = __decorateClass([TenantScoped({
+	mode: "optional",
+	allowSuperAdminBypass: true
+}), smrt({
+	tableName: "audit_logs",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: { include: ["list"] }
+})], AuditLog);
+var AuditLogCollection_exports = /* @__PURE__ */ __exportAll$1({ AuditLogCollection: () => AuditLogCollection });
+var AuditLogCollection = class extends SmrtCollection {
+	static _itemClass = AuditLog;
+	/**
+	* Find logs for a profile (actions they performed)
+	*/
+	async findByProfile(profileId) {
+		return await this.list({
+			where: { profileId },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs for a resource
+	*/
+	async findByResource(resourceType, resourceId) {
+		return await this.list({
+			where: {
+				resourceType,
+				resourceId
+			},
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs by action type
+	*/
+	async findByAction(action) {
+		return await this.list({
+			where: { action },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs by source
+	*/
+	async findBySource(source) {
+		return await this.list({
+			where: { source },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs where actions were performed on behalf of someone
+	*/
+	async findOnBehalfOf(profileId) {
+		return await this.list({
+			where: { onBehalfOfId: profileId },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Record a new audit log entry
+	*/
+	async record(options) {
+		const log = new AuditLog({
+			...this.options,
+			profileId: options.profile.id,
+			action: options.action,
+			resourceType: options.resourceType,
+			resourceId: options.resourceId,
+			source: options.source || "web",
+			metadata: options.metadata || {},
+			onBehalfOfId: options.onBehalfOf?.id
+		});
+		await log.initialize();
+		await log.save();
+		return log;
+	}
+	/**
+	* Get recent activity for a profile
+	*/
+	async getRecentActivity(profileId, limit = 50) {
+		return await this.list({
+			where: { profileId },
+			orderBy: "createdAt DESC",
+			limit
+		});
+	}
+	/**
+	* Get activity timeline for a resource
+	*/
+	async getResourceTimeline(resourceType, resourceId) {
+		return await this.list({
+			where: {
+				resourceType,
+				resourceId
+			},
+			orderBy: "createdAt ASC"
+		});
+	}
+};
+//#endregion
+export { AuditLogCollection as n, AuditLogCollection_B1YonCAP_exports as r, AuditLog as t };

package/dist/{NostrIdentity-n70E0vck-D60BSg6H.js → NostrIdentity-n70E0vck-Di3_eNCq.js}

@@ -4097,21 +4097,21 @@ var NostrIdentity = class extends SmrtObject {
 	* Find identity by public key
 	*/
 	static async findByPubkey(pubkey, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-DvjOg9Xy.js").then((n) => n.n).then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { pubkey } });
 	}
 	/**
 	* Find identity by email
 	*/
 	static async findByEmail(email, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-DvjOg9Xy.js").then((n) => n.n).then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { email: email.toLowerCase() } });
 	}
 	/**
 	* Find identity by NIP-05 username
 	*/
 	static async findByNip05(username, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-DvjOg9Xy.js").then((n) => n.n).then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { nip05Username: username.toLowerCase() } });
 	}
 	/**
@@ -4186,4 +4186,4 @@ NostrIdentity = __decorateClass([smrt({
 	cli: { include: ["list", "get"] }
 })], NostrIdentity);
 //#endregion
-export { verifyAuthEvent as a, generateNostrKeypair as i, __exportAll as n, encryptPrivkey as r, NostrIdentity as t };
+export { deriveEncryptionKey as a, privkeyToNsec as c, verifyNostrSignature as d, decryptPrivkey as i, pubkeyToNpub as l, __exportAll as n, encryptPrivkey as o, computeEventId as r, generateNostrKeypair as s, NostrIdentity as t, verifyAuthEvent as u };

package/dist/NostrIdentityCollection-Ca74dkaL-DvjOg9Xy.js

@@ -0,0 +1,127 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { n as __exportAll$1, o as encryptPrivkey, s as generateNostrKeypair, t as NostrIdentity } from "./NostrIdentity-n70E0vck-Di3_eNCq.js";
+import { SmrtCollection } from "@happyvertical/smrt-core";
+//#region ../profiles/dist/chunks/NostrIdentityCollection-Ca74dkaL.js
+var NostrIdentityCollection_Ca74dkaL_exports = /* @__PURE__ */ __exportAll({
+	n: () => NostrIdentityCollection_exports,
+	t: () => NostrIdentityCollection
+});
+var NostrIdentityCollection_exports = /* @__PURE__ */ __exportAll$1({ NostrIdentityCollection: () => NostrIdentityCollection });
+var NostrIdentityCollection = class extends SmrtCollection {
+	static _itemClass = NostrIdentity;
+	/**
+	* Find identities for a profile
+	*/
+	async findByProfile(profileId) {
+		return await this.list({ where: { profileId } });
+	}
+	/**
+	* Find identity by public key
+	*/
+	async findByPubkey(pubkey) {
+		return await this.findOne({ where: { pubkey } });
+	}
+	/**
+	* Find identity by email
+	*/
+	async findByEmail(email) {
+		return await this.findOne({ where: { email: email.toLowerCase() } });
+	}
+	/**
+	* Find identity by NIP-05 username
+	*/
+	async findByNip05(username) {
+		return await this.findOne({ where: { nip05Username: username.toLowerCase() } });
+	}
+	/**
+	* Link a new Nostr identity to a profile with a new keypair
+	* @param profile - The profile to link to
+	* @param email - Email address for this identity
+	* @param masterSecret - Server master secret for encryption
+	* @param nip05Username - Optional NIP-05 username (defaults to email local part)
+	*/
+	async createForProfile(profile, email, masterSecret, nip05Username) {
+		const normalizedEmail = email.toLowerCase();
+		if (await this.findByEmail(normalizedEmail)) throw new Error(`Nostr identity already exists for email: ${email}`);
+		const keypair = generateNostrKeypair();
+		const encrypted = encryptPrivkey(keypair.privkey, masterSecret);
+		const username = nip05Username?.toLowerCase() || normalizedEmail.split("@")[0];
+		const identity = new NostrIdentity({
+			...this.options,
+			profileId: profile.id,
+			pubkey: keypair.pubkey,
+			encryptedPrivkey: encrypted.ciphertext,
+			encryptionIv: encrypted.iv,
+			encryptionTag: encrypted.tag,
+			email: normalizedEmail,
+			nip05Username: username
+		});
+		await identity.initialize();
+		await identity.save();
+		return identity;
+	}
+	/**
+	* Link an existing Nostr identity (with encrypted keypair) to a profile
+	*/
+	async linkToProfile(profile, nostrData) {
+		if (await this.findByPubkey(nostrData.pubkey)) throw new Error("Nostr identity with this public key already exists");
+		if (await this.findByEmail(nostrData.email)) throw new Error("Nostr identity with this email already exists");
+		const identity = new NostrIdentity({
+			...this.options,
+			profileId: profile.id,
+			pubkey: nostrData.pubkey,
+			encryptedPrivkey: nostrData.encryptedPrivkey,
+			encryptionIv: nostrData.encryptionIv,
+			encryptionTag: nostrData.encryptionTag,
+			email: nostrData.email.toLowerCase(),
+			nip05Username: nostrData.nip05Username?.toLowerCase() || nostrData.email.toLowerCase().split("@")[0]
+		});
+		await identity.initialize();
+		await identity.save();
+		return identity;
+	}
+	/**
+	* Unlink a Nostr identity from a profile
+	*/
+	async unlinkFromProfile(profileId, pubkey) {
+		const identity = await this.findOne({ where: {
+			profileId,
+			pubkey
+		} });
+		if (identity) {
+			await identity.delete();
+			return true;
+		}
+		return false;
+	}
+	/**
+	* Get NIP-05 response data for the /.well-known/nostr.json endpoint
+	* @param username - Optional username filter, returns all if not provided
+	*/
+	async getNip05Response(username) {
+		const where = username ? { nip05Username: username.toLowerCase() } : {};
+		const identities = await this.list({ where });
+		const names = {};
+		for (const identity of identities) if (identity.nip05Username && identity.pubkey) names[identity.nip05Username] = identity.pubkey;
+		return { names };
+	}
+	/**
+	* Check if a NIP-05 username is available
+	*/
+	async isNip05Available(username) {
+		return await this.findByNip05(username) === null;
+	}
+	/**
+	* Update NIP-05 username for an identity
+	*/
+	async updateNip05Username(identity, newUsername) {
+		const normalizedUsername = newUsername.toLowerCase();
+		const existing = await this.findByNip05(normalizedUsername);
+		if (existing && existing.id !== identity.id) throw new Error(`NIP-05 username "${newUsername}" is already taken`);
+		identity.nip05Username = normalizedUsername;
+		await identity.save();
+		return identity;
+	}
+};
+//#endregion
+export { NostrIdentityCollection_Ca74dkaL_exports as n, NostrIdentityCollection as t };

package/dist/{OidcIdentity-Cb1bxreM-B2eV2ahq.js → OidcIdentity-Cb1bxreM-LXmC7uAf.js}

@@ -35,7 +35,7 @@ var OidcIdentity = class extends SmrtObject {
 	* Find identity by issuer and subject
 	*/
 	static async findBySubject(issuer, subject, options = {}) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-BodvOtPJ.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-Cv1ZTeuk.js").then((n) => n.r).then((n) => n.r);
 		return await (await OidcIdentityCollection.create(options)).findBySubject(issuer, subject);
 	}
 	/** Build the collision-free natural key for one OIDC issuer subject. */
@@ -58,7 +58,7 @@ var OidcIdentity = class extends SmrtObject {
 	static async findOrCreate(profile, oidcData, options = {}) {
 		const profileId = profile.id;
 		if (typeof profileId !== "string" || !profileId) throw new Error("OidcIdentity.findOrCreate() requires a saved Profile.");
-		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-B-PK6RwU-BmAU1Kse.js").then((n) => n.i);
+		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-B-PK6RwU-C9ogf8YG.js").then((n) => n.i).then((n) => n.i);
 		const profileOptions = profile.options ?? {};
 		return (await reuseExistingOidcIdentityForProfile(profileId, {
 			email: oidcData.email,

package/dist/OidcIdentityCollection-TV8VdK69-Cv1ZTeuk.js

@@ -0,0 +1,86 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-Di3_eNCq.js";
+import { t as OidcIdentity } from "./OidcIdentity-Cb1bxreM-LXmC7uAf.js";
+import { SmrtCollection } from "@happyvertical/smrt-core";
+//#region ../profiles/dist/chunks/OidcIdentityCollection-TV8VdK69.js
+var OidcIdentityCollection_TV8VdK69_exports = /* @__PURE__ */ __exportAll({
+	n: () => OidcIdentityCollection,
+	r: () => OidcIdentityCollection_exports,
+	t: () => AmbiguousOidcIdentityError
+});
+var OidcIdentityCollection_exports = /* @__PURE__ */ __exportAll$1({
+	AmbiguousOidcIdentityError: () => AmbiguousOidcIdentityError,
+	OidcIdentityCollection: () => OidcIdentityCollection
+});
+var AmbiguousOidcIdentityError = class extends Error {
+	constructor(issuer, subject) {
+		super("Multiple OIDC identities match the same issuer and subject.");
+		this.issuer = issuer;
+		this.subject = subject;
+		this.name = "AmbiguousOidcIdentityError";
+	}
+	issuer;
+	subject;
+};
+var OidcIdentityCollection = class extends SmrtCollection {
+	static _itemClass = OidcIdentity;
+	/**
+	* Find identities for a profile
+	*/
+	async findByProfile(profileId) {
+		return await this.list({ where: { profileId } });
+	}
+	/**
+	* Find identity by issuer and subject
+	*/
+	async findBySubject(issuer, subject) {
+		const result = await this.db.query(`SELECT CAST(id AS VARCHAR) AS id,
+              CAST(profile_id AS VARCHAR) AS profile_id
+         FROM oidc_identities
+        WHERE issuer = ? AND subject = ?
+        LIMIT 2`, issuer, subject);
+		if (result.rows.length > 1) throw new AmbiguousOidcIdentityError(issuer, subject);
+		const row = result.rows[0];
+		const id = row?.id;
+		const profileId = row?.profile_id;
+		if (typeof id !== "string" || typeof profileId !== "string") return null;
+		const identity = await this.get({ id });
+		if (!identity) return null;
+		identity.id = id;
+		identity.profileId = profileId;
+		return identity;
+	}
+	/**
+	* Find identities by provider
+	*/
+	async findByProvider(provider) {
+		return await this.list({ where: { provider } });
+	}
+	/**
+	* Reuse an existing exact OIDC identity for its unchanged Profile.
+	*
+	* @deprecated New authentication links require the owner-aware,
+	* transactional provisioning APIs. This compatibility helper may refresh a
+	* legacy Profile type, but refuses to create or rebind authority.
+	*/
+	async linkToProfile(profile, oidcData) {
+		return OidcIdentity.findOrCreate(profile, oidcData, this.options);
+	}
+	/**
+	* Unlink an OIDC identity from a profile
+	*/
+	async unlinkFromProfile(profileId, issuer, subject) {
+		const identity = await this.findOne({ where: {
+			profileId,
+			issuer,
+			subject
+		} });
+		if (identity) {
+			await identity.delete();
+			return true;
+		}
+		return false;
+	}
+};
+//#endregion
+export { OidcIdentityCollection as n, OidcIdentityCollection_TV8VdK69_exports as r, AmbiguousOidcIdentityError as t };