@happyvertical/smrt-cli 0.57.13 → 0.57.15

package/dist/{oidcProvisioningPrimitives-DNP9EZlU-PfUi61zh.js → oidcProvisioningPrimitives-DNP9EZlU-CCunrdnL.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as __exportAll$1 } from "./NostrIdentity-AC8fAdxe-DKxKyu_a.js";
-import { t as OidcIdentity } from "./OidcIdentity-BUblgQLs-C75_f06o.js";
-import { a as ProfileCollection, f as saveOidcRaceArbiter, i as Profile } from "./ProfileCollection-C4INKh7Y-CU227vYB.js";
-import { t as ProfileTypeCollection } from "./ProfileTypeCollection-B7kwi1mU-D0bZODrI.js";
+import { n as __exportAll$1 } from "./NostrIdentity-AC8fAdxe-Crl0np5c.js";
+import { t as OidcIdentity } from "./OidcIdentity-BUblgQLs-DGHZ4M7i.js";
+import { c as saveOidcRaceArbiter, n as ProfileCollection, t as Profile } from "./ProfileCollection-C4INKh7Y-Df7XNoF9.js";
+import { t as ProfileTypeCollection } from "./ProfileTypeCollection-B7kwi1mU-BqrZPPoy.js";
 import { smrt } from "@happyvertical/smrt-core";
 //#region ../profiles/dist/chunks/oidcProvisioningPrimitives-DNP9EZlU.js
 var oidcProvisioningPrimitives_DNP9EZlU_exports = /* @__PURE__ */ __exportAll({
@@ -90,4 +90,4 @@ function requireProvisioningId(value, label) {
 	return value;
 }
 //#endregion
-export { insertOidcProvisioningIdentity as a, createOidcProvisioningPerson as i, Organization as n, oidcProvisioningPrimitives_DNP9EZlU_exports as o, Person as r, Bot as t };
+export { insertOidcProvisioningIdentity as n, oidcProvisioningPrimitives_DNP9EZlU_exports as r, createOidcProvisioningPerson as t };

package/dist/operator-A1enN804.js

@@ -0,0 +1,111 @@
+import { m as withSystemContext } from "./dist-D2z9PH4N.js";
+import { E as PasswordCredentialService, Et as UserStatus, K as UserCollection, N as RoleCollection, Q as UsersPasswordCredentialCollection, Tt as TenantStatus, V as TenantCollection, ct as isValidEmail, ft as normalizeUsername, g as MembershipCollection, gt as verifySecretHash, j as PermissionResolver, ut as normalizeEmail, xt as MembershipStatus } from "./PasswordCredentialService-CyB9FmYp-Bsni8t37.js";
+import { isPostgresDatabase, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+//#region ../users/dist/operator.js
+var OperatorProvisioningError = class extends Error {
+	constructor() {
+		super("Owner provisioning refused. Verify the identities, password policy, and database state.");
+		this.name = "OperatorProvisioningError";
+	}
+};
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+async function provisionPasswordOwner(db, input, passwordPolicy = {}) {
+	try {
+		if (!isPostgresDatabase(db) || !UUID.test(input.tenantId) || !UUID.test(input.userId) || typeof input.tenantName !== "string" || !input.tenantName.trim() || input.tenantName.length > 200 || input.email !== void 0 && !isValidEmail(input.email) || input.username !== void 0 && !normalizeUsername(input.username)) throw new OperatorProvisioningError();
+		const email = normalizeEmail(input.email ?? "");
+		const username = normalizeUsername(input.username);
+		if (!email && !username) throw new OperatorProvisioningError();
+		const tenantId = input.tenantId.toLowerCase();
+		const userId = input.userId.toLowerCase();
+		const tenantName = input.tenantName.trim();
+		const passwordHash = await PasswordCredentialService.preparePasswordHash(input.password, {
+			id: userId,
+			email,
+			emailKey: email || null,
+			username: username || null,
+			usernameKey: username || null
+		}, passwordPolicy);
+		return await withSystemContext(() => withEmbeddedWriteTransaction(db, false, async (tx) => {
+			await tx.query("SELECT pg_advisory_xact_lock(4158, 1)");
+			const options = { db: tx };
+			const users = await UserCollection.create(options);
+			const tenants = await TenantCollection.create(options);
+			const memberships = await MembershipCollection.create(options);
+			const roles = await RoleCollection.create(options);
+			const permissions = await PermissionResolver.create(options);
+			const requireEffectivePermissions = async () => {
+				if (!(await permissions.resolvePermissions(userId, tenantId)).permissions.size) throw new OperatorProvisioningError();
+			};
+			const credentials = await UsersPasswordCredentialCollection.create(options);
+			const tenant = await tenants.get({ id: tenantId });
+			const user = await users.get({ id: userId });
+			const emailMatches = email ? await users.list({
+				where: { emailKey: email },
+				limit: 2
+			}) : [];
+			const usernameMatches = username ? await users.list({
+				where: { usernameKey: username },
+				limit: 2
+			}) : [];
+			if (emailMatches.some((match) => match.id !== userId) || usernameMatches.some((match) => match.id !== userId)) throw new OperatorProvisioningError();
+			if (user) {
+				const role2 = await roles.findBySlug("owner");
+				const membership = await memberships.findByUserAndTenant(userId, tenantId);
+				const credential = await credentials.findByUserId(userId);
+				if (!tenant || tenant.name !== tenantName || tenant.status !== TenantStatus.ACTIVE || tenant.parentTenantId || user.status !== UserStatus.ACTIVE || (user.emailKey ?? "") !== email || (user.usernameKey ?? "") !== username || !role2?.isSystem || role2.tenantId || !membership || membership.status !== MembershipStatus.ACTIVE || membership.roleId !== role2.id || !credential || credential.mustChange || !await verifySecretHash(input.password.normalize("NFKC"), passwordPolicy.pepper ?? "", credential.passwordHash)) throw new OperatorProvisioningError();
+				await requireEffectivePermissions();
+				return {
+					status: "unchanged",
+					tenantId,
+					userId
+				};
+			}
+			if (tenant && (tenant.name !== tenantName || tenant.status !== TenantStatus.ACTIVE || tenant.parentTenantId || (await memberships.list({
+				where: { tenantId },
+				limit: 1
+			})).length > 0)) throw new OperatorProvisioningError();
+			let role = await roles.findBySlug("owner");
+			if (!role) {
+				if ((await roles.list({ limit: 1 })).length > 0) throw new OperatorProvisioningError();
+				await roles.seedSystemRoles({ seedPermissions: true });
+				role = await roles.findBySlug("owner");
+			}
+			if (!role?.id || !role.isSystem || role.tenantId) throw new OperatorProvisioningError();
+			if (!tenant) await tenants.create({
+				id: tenantId,
+				slug: `operator-${tenantId}`,
+				name: tenantName,
+				_insertOnly: true
+			});
+			await users.create({
+				id: userId,
+				slug: `operator-${userId}`,
+				email,
+				username: username || null,
+				_insertOnly: true
+			});
+			await memberships.create({
+				userId,
+				tenantId,
+				roleId: role.id,
+				_insertOnly: true
+			});
+			await requireEffectivePermissions();
+			if (!await credentials.insertIfAbsent(userId, {
+				passwordHash,
+				mustChange: false,
+				rotatedAt: /* @__PURE__ */ new Date(),
+				rotatedBy: "operator"
+			})) throw new OperatorProvisioningError();
+			return {
+				status: "created",
+				tenantId,
+				userId
+			};
+		}));
+	} catch {
+		throw new OperatorProvisioningError();
+	}
+}
+//#endregion
+export { provisionPasswordOwner };

package/dist/{resolveIdentity-CkyqvctR-CxRDO4Kf.js → resolveIdentity-CkyqvctR-y1y-hnjF.js}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { m as withSystemContext } from "./dist-CJsW8uvQ.js";
-import { n as __exportAll$1, t as NostrIdentity, u as verifyAuthEvent } from "./NostrIdentity-AC8fAdxe-DKxKyu_a.js";
-import { t as ApiKey } from "./ApiKey-CVmlf3V6-BAeHuH48.js";
-import { t as OidcIdentity } from "./OidcIdentity-BUblgQLs-C75_f06o.js";
-import { c as coordinateOidcProvisioning, l as isOidcProvisioningRaceConflict, u as normalizeIdentityEmail } from "./ProfileCollection-C4INKh7Y-CU227vYB.js";
-import { a as insertOidcProvisioningIdentity, i as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-DNP9EZlU-PfUi61zh.js";
+import { m as withSystemContext } from "./dist-D2z9PH4N.js";
+import { a as verifyAuthEvent, n as __exportAll$1, t as NostrIdentity } from "./NostrIdentity-AC8fAdxe-Crl0np5c.js";
+import { t as ApiKey } from "./ApiKey-CVmlf3V6-CpkKlftW.js";
+import { t as OidcIdentity } from "./OidcIdentity-BUblgQLs-DGHZ4M7i.js";
+import { a as coordinateOidcProvisioning, o as isOidcProvisioningRaceConflict, s as normalizeIdentityEmail } from "./ProfileCollection-C4INKh7Y-Df7XNoF9.js";
+import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-DNP9EZlU-CCunrdnL.js";
 import { resolveDatabase } from "@happyvertical/smrt-core";
 //#region ../profiles/dist/chunks/resolveIdentity-CkyqvctR.js
 var resolveIdentity_CkyqvctR_exports = /* @__PURE__ */ __exportAll({
@@ -72,13 +72,13 @@ async function resolveIdentity(context) {
 	};
 }
 async function findProfileByExternalId(provider, externalId, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-CiymEMsR.js").then((n) => n.r).then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-B-hGW2Wl.js").then((n) => n.r).then((n) => n.r);
 	const identities = await (await OidcIdentityCollection.create(options)).findByProvider(provider);
 	for (const identity of identities) if (identity.subject === externalId || identity.email?.includes(externalId)) {
 		const profile = await identity.getProfile();
 		if (profile) return profile;
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-C4INKh7Y-CU227vYB.js").then((n) => n.o).then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-C4INKh7Y-Df7XNoF9.js").then((n) => n.r).then((n) => n.r);
 	const profiles = await (await ProfileCollection.create(options)).list({
 		where: { email: `${externalId}@users.noreply.github.com` },
 		limit: 1
@@ -99,7 +99,7 @@ async function reuseExistingOidcIdentityForProfile(profileId, claims, provider,
 		createConcurrencyError: (cause) => new Error("Concurrent exact OIDC identity reuse did not converge.", cause === void 0 ? void 0 : { cause }),
 		rebindRootResult: rebindOidcProfileResult,
 		provision: (tx) => withSystemContext(async () => {
-			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-CiymEMsR.js").then((n) => n.r).then((n) => n.r);
+			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-B-hGW2Wl.js").then((n) => n.r).then((n) => n.r);
 			const identity = await (await OidcIdentityCollection.create({ db: tx })).findBySubject(normalizedClaims.iss, normalizedClaims.sub);
 			if (!identity) throw new Error("OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().");
 			if (identity.profileId !== profileId) throw new Error(`OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`);
@@ -133,7 +133,7 @@ async function coordinateProfileOidcProvisioning(claims, provider, options) {
 	});
 }
 async function provisionOidcProfile(claims, provider, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-CiymEMsR.js").then((n) => n.r).then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-B-hGW2Wl.js").then((n) => n.r).then((n) => n.r);
 	const existingIdentity = await (await OidcIdentityCollection.create(options)).findBySubject(claims.iss, claims.sub);
 	if (existingIdentity) {
 		const profile2 = await existingIdentity.getProfile();
@@ -148,7 +148,7 @@ async function provisionOidcProfile(claims, provider, options) {
 			created: false
 		};
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-C4INKh7Y-CU227vYB.js").then((n) => n.o).then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-C4INKh7Y-Df7XNoF9.js").then((n) => n.r).then((n) => n.r);
 	const profileCollection = await ProfileCollection.create(options);
 	if (claims.email) {
 		if (await profileCollection.findUniqueGlobalPersonByEmail(claims.email)) {
@@ -175,8 +175,8 @@ async function provisionOidcProfile(claims, provider, options) {
 	};
 }
 async function rebindOidcProfileResult(result, rootDb) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-CiymEMsR.js").then((n) => n.r).then((n) => n.r);
-	const { ProfileCollection } = await import("./ProfileCollection-C4INKh7Y-CU227vYB.js").then((n) => n.o).then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-ClOyaHeF-B-hGW2Wl.js").then((n) => n.r).then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-C4INKh7Y-Df7XNoF9.js").then((n) => n.r).then((n) => n.r);
 	const profileId = requireOidcProfileId(result.profile.id);
 	const identityId = requireOidcProfileId(result.oidcIdentity.id);
 	const [profile, oidcIdentity] = await withSystemContext(async () => {
@@ -225,11 +225,11 @@ async function createProfileFromNostr(email, nostrData, options) {
 			created: false
 		};
 	}
-	const { Person } = await import("./oidcProvisioningPrimitives-DNP9EZlU-PfUi61zh.js").then((n) => n.o).then((n) => n.o);
-	const { ProfileTypeCollection } = await import("./ProfileTypeCollection-B7kwi1mU-D0bZODrI.js").then((n) => n.n).then((n) => n.n);
+	const { Person } = await import("./oidcProvisioningPrimitives-DNP9EZlU-CCunrdnL.js").then((n) => n.r).then((n) => n.o);
+	const { ProfileTypeCollection } = await import("./ProfileTypeCollection-B7kwi1mU-BqrZPPoy.js").then((n) => n.n).then((n) => n.n);
 	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
 	if (!personType) {
-		const { ProfileType } = await import("./ProfileCollection-C4INKh7Y-CU227vYB.js").then((n) => n.o).then((n) => n.h);
+		const { ProfileType } = await import("./ProfileCollection-C4INKh7Y-Df7XNoF9.js").then((n) => n.r).then((n) => n.h);
 		personType = new ProfileType({
 			...options,
 			slug: "person",
@@ -266,4 +266,4 @@ async function createProfileFromNostr(email, nostrData, options) {
 	};
 }
 //#endregion
-export { resolveIdentity_CkyqvctR_exports as i, createProfileFromOidc as n, resolveIdentity as r, createProfileFromNostr as t };
+export { resolveIdentity_CkyqvctR_exports as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-cli",
-  "version": "0.57.13",
+  "version": "0.57.15",
   "description": "Developer CLI for SMRT framework - introspection, testing, and project management",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,15 +33,15 @@
     "@happyvertical/ai": "^0.105.5",
     "@happyvertical/files": "^0.105.5",
     "@happyvertical/logger": "^0.105.5",
-    "@happyvertical/smrt-agents": "0.57.13",
-    "@happyvertical/smrt-app-runtime": "0.57.13",
-    "@happyvertical/smrt-config": "0.57.13",
-    "@happyvertical/smrt-core": "0.57.13",
-    "@happyvertical/smrt-dev-mcp": "0.57.13",
-    "@happyvertical/smrt-ledgers": "0.57.13",
-    "@happyvertical/smrt-playground": "0.57.13",
-    "@happyvertical/smrt-types": "0.57.13",
-    "@happyvertical/smrt-users": "0.57.13",
+    "@happyvertical/smrt-agents": "0.57.15",
+    "@happyvertical/smrt-app-runtime": "0.57.15",
+    "@happyvertical/smrt-config": "0.57.15",
+    "@happyvertical/smrt-core": "0.57.15",
+    "@happyvertical/smrt-dev-mcp": "0.57.15",
+    "@happyvertical/smrt-ledgers": "0.57.15",
+    "@happyvertical/smrt-playground": "0.57.15",
+    "@happyvertical/smrt-types": "0.57.15",
+    "@happyvertical/smrt-users": "0.57.15",
     "@happyvertical/sql": "^0.105.5",
     "@happyvertical/utils": "^0.105.5",
     "@modelcontextprotocol/server": "2.0.0",

package/dist/dist-DKSFNs8e.js

@@ -1,21 +0,0 @@
-import "./NostrIdentity-AC8fAdxe-DKxKyu_a.js";
-import "./ApiKey-CVmlf3V6-BAeHuH48.js";
-import "./ApiKeyCollection-CiiDNFdD-CMGF3_ul.js";
-import "./AuditLogCollection-WDHL-_AF-C8L1gl7q.js";
-import "./NostrIdentityCollection-CctlECpX-fkAPnK02.js";
-import "./OidcIdentity-BUblgQLs-C75_f06o.js";
-import "./OidcIdentityCollection-ClOyaHeF-CiymEMsR.js";
-import "./ProfileAssetCollection-CRMcjLJ--_OAFKSvo.js";
-import { a as ProfileCollection } from "./ProfileCollection-C4INKh7Y-CU227vYB.js";
-import "./ProfileLinkCollection-DFfZRsgv-De18fH8M.js";
-import "./ProfileMetadataCollection-BIYKy4Y3-B4hKF9kz.js";
-import "./ProfileMetafieldCollection-Buz7gzag-CXMtAfAB.js";
-import "./ProfileRelationshipCollection-C4g_QLI4-CLezW4sK.js";
-import "./ProfileRelationshipTermCollection-C9J7mC7P-ChIFqjCg.js";
-import "./ProfileRelationshipType-U7IwF6Wf-DNavf24e.js";
-import "./ProfileRelationshipTypeCollection-_n22WqTb-DiZUWvev.js";
-import "./ProfileTypeCollection-B7kwi1mU-D0bZODrI.js";
-import "./oidcProvisioningPrimitives-DNP9EZlU-PfUi61zh.js";
-import "./resolveIdentity-CkyqvctR-CxRDO4Kf.js";
-import "./dist-BjVKGAtb.js";
-export { ProfileCollection };