@happyvertical/smrt-profiles 0.37.2 → 0.37.3

package/dist/chunks/ApiKey-3DlNEc91.js

@@ -0,0 +1,145 @@
+import { x as __exportAll } from "./NostrIdentityCollection-CG6HGf6c.js";
+import { SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/models/ApiKey.ts
+var ApiKey_exports = /* @__PURE__ */ __exportAll({ ApiKey: () => ApiKey });
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var ApiKey = class extends SmrtObject {
+	profileId;
+	/**
+	* SHA-256 hash of the API key
+	*/
+	keyHash = "";
+	/**
+	* First 8 characters of the key for identification (e.g., "sk_live_a1b2...")
+	*/
+	keyPrefix = "";
+	/**
+	* Human-readable name for the key (e.g., "CI Bot", "Local CLI")
+	*/
+	name = "";
+	/**
+	* Scopes/permissions for this key
+	*/
+	scopes = [];
+	/**
+	* Last time this key was used
+	*/
+	lastUsedAt = null;
+	/**
+	* When this key expires (null = never)
+	*/
+	expiresAt = null;
+	/**
+	* When this key was revoked (null = active)
+	*/
+	revokedAt = null;
+	constructor(options = {}) {
+		super(options);
+		if (options.profileId) this.profileId = options.profileId;
+		if (options.name) this.name = options.name;
+		if (options.scopes) this.scopes = options.scopes;
+		if (options.expiresAt !== void 0) this.expiresAt = options.expiresAt;
+	}
+	/**
+	* Get the linked Profile
+	*/
+	async getProfile() {
+		return await this.getRelated("profileId");
+	}
+	/**
+	* Check if this key is valid (not expired, not revoked)
+	*/
+	isValid() {
+		if (this.revokedAt) return false;
+		if (this.expiresAt && this.expiresAt < /* @__PURE__ */ new Date()) return false;
+		return true;
+	}
+	/**
+	* Check if this key has a specific scope
+	*/
+	hasScope(scope) {
+		return this.scopes.includes(scope) || this.scopes.includes("*");
+	}
+	/**
+	* Revoke this key
+	*/
+	async revoke() {
+		this.revokedAt = /* @__PURE__ */ new Date();
+		await this.save();
+	}
+	/**
+	* Record usage of this key
+	*/
+	async recordUsage() {
+		this.lastUsedAt = /* @__PURE__ */ new Date();
+		await this.save();
+	}
+	/**
+	* Hash an API key
+	*/
+	static hashKey(key) {
+		return createHash("sha256").update(key).digest("hex");
+	}
+	/**
+	* Generate a new API key for a profile
+	*/
+	static async generate(profile, options) {
+		const key = `sk_live_${randomBytes(32).toString("hex")}`;
+		const keyPrefix = key.substring(0, 16);
+		const keyHash = ApiKey.hashKey(key);
+		const apiKey = new ApiKey({
+			db: options.db || profile.options?.db,
+			profileId: profile.id,
+			name: options.name,
+			scopes: options.scopes || ["*"],
+			expiresAt: options.expiresAt ?? null
+		});
+		apiKey.keyHash = keyHash;
+		apiKey.keyPrefix = keyPrefix;
+		await apiKey.initialize();
+		await apiKey.save();
+		return {
+			key,
+			apiKey
+		};
+	}
+	/**
+	* Verify an API key and return the ApiKey record if valid
+	*/
+	static async verify(key, options = {}) {
+		const keyHash = ApiKey.hashKey(key);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-PwVs0qDb.js").then((n) => n.n);
+		const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
+		if (!apiKey) return null;
+		if (!apiKey.isValid()) return null;
+		await apiKey.recordUsage();
+		return apiKey;
+	}
+};
+__decorateClass([foreignKey("Profile", { required: true })], ApiKey.prototype, "profileId", 2);
+ApiKey = __decorateClass([smrt({
+	tableName: "api_keys",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: {
+		include: [
+			"list",
+			"get",
+			"create",
+			"revoke"
+		],
+		skipApiCheck: true
+	}
+})], ApiKey);
+//#endregion
+export { ApiKey_exports as n, ApiKey as t };
+
+//# sourceMappingURL=ApiKey-3DlNEc91.js.map

package/dist/chunks/ApiKey-3DlNEc91.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey-3DlNEc91.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n  profileId?: string;\n  name?: string;\n  scopes?: string[];\n  expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n  key: string;\n  apiKey: ApiKey;\n}\n\n@smrt({\n  tableName: 'api_keys',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  // create/revoke are admin operations invoked in-process via the CLI; only\n  // read-only list/get are exposed over HTTP.\n  cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * SHA-256 hash of the API key\n   */\n  keyHash: string = '';\n\n  /**\n   * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n   */\n  keyPrefix: string = '';\n\n  /**\n   * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n   */\n  name: string = '';\n\n  /**\n   * Scopes/permissions for this key\n   */\n  scopes: string[] = [];\n\n  /**\n   * Last time this key was used\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this key expires (null = never)\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * When this key was revoked (null = active)\n   */\n  revokedAt: Date | null = null;\n\n  constructor(options: ApiKeyOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.name) this.name = options.name;\n    if (options.scopes) this.scopes = options.scopes;\n    if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Check if this key is valid (not expired, not revoked)\n   */\n  isValid(): boolean {\n    if (this.revokedAt) return false;\n    if (this.expiresAt && this.expiresAt < new Date()) return false;\n    return true;\n  }\n\n  /**\n   * Check if this key has a specific scope\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope) || this.scopes.includes('*');\n  }\n\n  /**\n   * Revoke this key\n   */\n  async revoke(): Promise<void> {\n    this.revokedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Record usage of this key\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Hash an API key\n   */\n  static hashKey(key: string): string {\n    return createHash('sha256').update(key).digest('hex');\n  }\n\n  /**\n   * Generate a new API key for a profile\n   */\n  static async generate(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n      db?: SmrtObjectOptions['db'];\n    },\n  ): Promise<GenerateKeyResult> {\n    // Generate a random key: sk_live_<32 random bytes as hex>\n    const randomPart = randomBytes(32).toString('hex');\n    const key = `sk_live_${randomPart}`;\n    const keyPrefix = key.substring(0, 16);\n    const keyHash = ApiKey.hashKey(key);\n\n    const apiKey = new ApiKey({\n      db: options.db || profile.options?.db,\n      profileId: profile.id as string,\n      name: options.name,\n      scopes: options.scopes || ['*'],\n      expiresAt: options.expiresAt ?? null,\n    });\n    apiKey.keyHash = keyHash;\n    apiKey.keyPrefix = keyPrefix;\n\n    await apiKey.initialize();\n    await apiKey.save();\n\n    return { key, apiKey };\n  }\n\n  /**\n   * Verify an API key and return the ApiKey record if valid\n   */\n  static async verify(\n    key: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n\n    const { ApiKeyCollection } = await import(\n      '../collections/ApiKeyCollection'\n    );\n    const collection = await ApiKeyCollection.create(options);\n\n    const apiKey = await collection.findOne({\n      where: { keyHash },\n    });\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    return apiKey;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAoCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;;;;CAKA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAEzB,OAAO;CACT;AACF;AAvJE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AALW,SAAN,gBAAA,CARN,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}

package/dist/chunks/ApiKeyCollection-PwVs0qDb.js

@@ -0,0 +1,83 @@
+import { x as __exportAll } from "./NostrIdentityCollection-CG6HGf6c.js";
+import { t as ApiKey } from "./ApiKey-3DlNEc91.js";
+import { SmrtCollection } from "@happyvertical/smrt-core";
+//#region src/collections/ApiKeyCollection.ts
+var ApiKeyCollection_exports = /* @__PURE__ */ __exportAll({ ApiKeyCollection: () => ApiKeyCollection });
+var ApiKeyCollection = class extends SmrtCollection {
+	static _itemClass = ApiKey;
+	/**
+	* Find all keys for a profile
+	*/
+	async findByProfile(profileId) {
+		return await this.list({ where: { profileId } });
+	}
+	/**
+	* Find active (non-revoked, non-expired) keys for a profile
+	*/
+	async findActiveByProfile(profileId) {
+		return (await this.findByProfile(profileId)).filter((key) => key.isValid());
+	}
+	/**
+	* Find key by hash
+	*/
+	async findByHash(keyHash) {
+		return await this.findOne({ where: { keyHash } });
+	}
+	/**
+	* Verify an API key string and return the record if valid
+	*/
+	async verify(key) {
+		const keyHash = ApiKey.hashKey(key);
+		const apiKey = await this.findByHash(keyHash);
+		if (!apiKey) return null;
+		if (!apiKey.isValid()) return null;
+		await apiKey.recordUsage();
+		return apiKey;
+	}
+	/**
+	* Generate a new key for a profile
+	*/
+	async generateForProfile(profile, options) {
+		return await ApiKey.generate(profile, {
+			...options,
+			db: this.options.db
+		});
+	}
+	/**
+	* Revoke all keys for a profile
+	*/
+	async revokeAllForProfile(profileId) {
+		const keys = await this.findActiveByProfile(profileId);
+		for (const key of keys) await key.revoke();
+		return keys.length;
+	}
+	/**
+	* Revoke a specific key by prefix
+	*/
+	async revokeByPrefix(keyPrefix) {
+		const key = await this.findOne({ where: { keyPrefix } });
+		if (key && key.isValid()) {
+			await key.revoke();
+			return true;
+		}
+		return false;
+	}
+	/**
+	* Clean up expired keys (soft delete by setting revokedAt)
+	*/
+	async cleanupExpired() {
+		const now = /* @__PURE__ */ new Date();
+		const allKeys = await this.list({});
+		let cleaned = 0;
+		for (const key of allKeys) if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {
+			key.revokedAt = now;
+			await key.save();
+			cleaned++;
+		}
+		return cleaned;
+	}
+};
+//#endregion
+export { ApiKeyCollection_exports as n, ApiKeyCollection as t };
+
+//# sourceMappingURL=ApiKeyCollection-PwVs0qDb.js.map

package/dist/chunks/ApiKeyCollection-PwVs0qDb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyCollection-PwVs0qDb.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key && key.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAEzB,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,OAAO,IAAI,QAAQ,GAAG;GACxB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}

package/dist/chunks/AuditLogCollection-CnIYU0aK.js

@@ -0,0 +1,191 @@
+import { x as __exportAll } from "./NostrIdentityCollection-CG6HGf6c.js";
+import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
+//#region src/models/AuditLog.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var AuditLog = class extends SmrtObject {
+	tenantId = null;
+	profileId;
+	/**
+	* Action performed (e.g., 'issue.update', 'feedback.incorporate')
+	*/
+	action = "";
+	/**
+	* Type of resource affected (e.g., 'Issue', 'Repository')
+	*/
+	resourceType = "";
+	/**
+	* ID of the affected resource
+	*/
+	resourceId = "";
+	/**
+	* Source of the action
+	*/
+	source = "web";
+	/**
+	* Additional context (CI run ID, request ID, etc.)
+	*/
+	metadata = {};
+	onBehalfOfId;
+	constructor(options = {}) {
+		super(options);
+		if (options.profileId) this.profileId = options.profileId;
+		if (options.action) this.action = options.action;
+		if (options.resourceType) this.resourceType = options.resourceType;
+		if (options.resourceId) this.resourceId = options.resourceId;
+		if (options.source) this.source = options.source;
+		if (options.metadata) this.metadata = options.metadata;
+		if (options.onBehalfOfId !== void 0) this.onBehalfOfId = options.onBehalfOfId;
+	}
+	/**
+	* Get the profile who performed the action
+	*/
+	async getProfile() {
+		return await this.getRelated("profileId");
+	}
+	/**
+	* Get the profile on whose behalf the action was performed (if any)
+	*/
+	async getOnBehalfOf() {
+		if (!this.onBehalfOfId) return null;
+		return await this.getRelated("onBehalfOfId");
+	}
+	/**
+	* Get the effective actor (onBehalfOf if set, otherwise profile)
+	*/
+	async getEffectiveActor() {
+		const onBehalfOf = await this.getOnBehalfOf();
+		if (onBehalfOf) return onBehalfOf;
+		return await this.getProfile();
+	}
+	/**
+	* Create an audit log entry
+	*/
+	static async record(options) {
+		const log = new AuditLog({
+			...options,
+			profileId: options.profile.id,
+			onBehalfOfId: options.onBehalfOf?.id
+		});
+		await log.initialize();
+		await log.save();
+		return log;
+	}
+};
+__decorateClass([tenantId({ nullable: true })], AuditLog.prototype, "tenantId", 2);
+__decorateClass([foreignKey("Profile", { required: true })], AuditLog.prototype, "profileId", 2);
+__decorateClass([foreignKey("Profile", { nullable: true })], AuditLog.prototype, "onBehalfOfId", 2);
+AuditLog = __decorateClass([TenantScoped({
+	mode: "optional",
+	allowSuperAdminBypass: true
+}), smrt({
+	tableName: "audit_logs",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: { include: ["list"] }
+})], AuditLog);
+//#endregion
+//#region src/collections/AuditLogCollection.ts
+var AuditLogCollection_exports = /* @__PURE__ */ __exportAll({ AuditLogCollection: () => AuditLogCollection });
+var AuditLogCollection = class extends SmrtCollection {
+	static _itemClass = AuditLog;
+	/**
+	* Find logs for a profile (actions they performed)
+	*/
+	async findByProfile(profileId) {
+		return await this.list({
+			where: { profileId },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs for a resource
+	*/
+	async findByResource(resourceType, resourceId) {
+		return await this.list({
+			where: {
+				resourceType,
+				resourceId
+			},
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs by action type
+	*/
+	async findByAction(action) {
+		return await this.list({
+			where: { action },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs by source
+	*/
+	async findBySource(source) {
+		return await this.list({
+			where: { source },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Find logs where actions were performed on behalf of someone
+	*/
+	async findOnBehalfOf(profileId) {
+		return await this.list({
+			where: { onBehalfOfId: profileId },
+			orderBy: "createdAt DESC"
+		});
+	}
+	/**
+	* Record a new audit log entry
+	*/
+	async record(options) {
+		const log = new AuditLog({
+			...this.options,
+			profileId: options.profile.id,
+			action: options.action,
+			resourceType: options.resourceType,
+			resourceId: options.resourceId,
+			source: options.source || "web",
+			metadata: options.metadata || {},
+			onBehalfOfId: options.onBehalfOf?.id
+		});
+		await log.initialize();
+		await log.save();
+		return log;
+	}
+	/**
+	* Get recent activity for a profile
+	*/
+	async getRecentActivity(profileId, limit = 50) {
+		return await this.list({
+			where: { profileId },
+			orderBy: "createdAt DESC",
+			limit
+		});
+	}
+	/**
+	* Get activity timeline for a resource
+	*/
+	async getResourceTimeline(resourceType, resourceId) {
+		return await this.list({
+			where: {
+				resourceType,
+				resourceId
+			},
+			orderBy: "createdAt ASC"
+		});
+	}
+};
+//#endregion
+export { AuditLogCollection_exports as n, AuditLog as r, AuditLogCollection as t };
+
+//# sourceMappingURL=AuditLogCollection-CnIYU0aK.js.map

package/dist/chunks/AuditLogCollection-CnIYU0aK.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogCollection-CnIYU0aK.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n  profileId?: string;\n  action?: string;\n  resourceType?: string;\n  resourceId?: string;\n  source?: AuditSource;\n  metadata?: Record<string, unknown>;\n  onBehalfOfId?: string | null;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n  tableName: 'audit_logs',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list'] },\n})\nexport class AuditLog extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  /**\n   * The profile who performed the action\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n   */\n  action: string = '';\n\n  /**\n   * Type of resource affected (e.g., 'Issue', 'Repository')\n   */\n  resourceType: string = '';\n\n  /**\n   * ID of the affected resource\n   */\n  resourceId: string = '';\n\n  /**\n   * Source of the action\n   */\n  source: AuditSource = 'web';\n\n  /**\n   * Additional context (CI run ID, request ID, etc.)\n   */\n  metadata: Record<string, unknown> = {};\n\n  /**\n   * For pass-through identity in CI - the actual person who triggered\n   */\n  @foreignKey('Profile', { nullable: true })\n  onBehalfOfId?: string | null;\n\n  constructor(options: AuditLogOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.action) this.action = options.action;\n    if (options.resourceType) this.resourceType = options.resourceType;\n    if (options.resourceId) this.resourceId = options.resourceId;\n    if (options.source) this.source = options.source;\n    if (options.metadata) this.metadata = options.metadata;\n    if (options.onBehalfOfId !== undefined)\n      this.onBehalfOfId = options.onBehalfOfId;\n  }\n\n  /**\n   * Get the profile who performed the action\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Get the profile on whose behalf the action was performed (if any)\n   */\n  async getOnBehalfOf(): Promise<Profile | null> {\n    if (!this.onBehalfOfId) return null;\n    return (await this.getRelated('onBehalfOfId')) as Profile | null;\n  }\n\n  /**\n   * Get the effective actor (onBehalfOf if set, otherwise profile)\n   */\n  async getEffectiveActor(): Promise<Profile | null> {\n    const onBehalfOf = await this.getOnBehalfOf();\n    if (onBehalfOf) return onBehalfOf;\n    return await this.getProfile();\n  }\n\n  /**\n   * Create an audit log entry\n   */\n  static async record(\n    options: AuditLogOptions & {\n      profile: Profile;\n      onBehalfOf?: Profile | null;\n    },\n  ): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...options,\n      profileId: options.profile.id as string,\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n  static readonly _itemClass = AuditLog;\n\n  /**\n   * Find logs for a profile (actions they performed)\n   */\n  async findByProfile(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs for a resource\n   */\n  async findByResource(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by action type\n   */\n  async findByAction(action: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { action },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by source\n   */\n  async findBySource(source: AuditSource): Promise<AuditLog[]> {\n    return await this.list({\n      where: { source },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs where actions were performed on behalf of someone\n   */\n  async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { onBehalfOfId: profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Record a new audit log entry\n   */\n  async record(options: {\n    profile: Profile;\n    action: string;\n    resourceType: string;\n    resourceId: string;\n    source?: AuditSource;\n    metadata?: Record<string, unknown>;\n    onBehalfOf?: Profile | null;\n  }): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...this.options,\n      profileId: options.profile.id as string,\n      action: options.action,\n      resourceType: options.resourceType,\n      resourceId: options.resourceId,\n      source: options.source || 'web',\n      metadata: options.metadata || {},\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n\n  /**\n   * Get recent activity for a profile\n   */\n  async getRecentActivity(\n    profileId: string,\n    limit: number = 50,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n      limit,\n    });\n  }\n\n  /**\n   * Get activity timeline for a resource\n   */\n  async getResourceTimeline(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt ASC',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAoCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;;;CAKjB,eAAuB;;;;CAKvB,aAAqB;;;;CAKrB,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7FE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AA+BA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAtC9B,SAuCX,WAAA,gBAAA,CAAA;AAvCW,WAAN,gBAAA,CAPN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;AAC3B,CAAC,CAAA,GACY,QAAA;;;;AC5BN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAQS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}