@happyvertical/smrt-profiles 0.37.2 → 0.37.4

package/dist/index.js

@@ -1,70 +1,691 @@
-import { B, M, a, O, b, c, P, d, e, f, g, h, i, p, r } from "./chunks/index-B9lXQy7N.js";
-import { a as a2, b as b2, P as P2, p as p2, s } from "./chunks/ProfileCollection-M2PK8bp-.js";
-import { a as a3, N, c as c2, b as b3, d as d2, f as f2, e as e2, g as g2, h as h2, i as i2, j, n, k, p as p3, l, s as s2, v, m } from "./chunks/NostrIdentityCollection-DadQBHWy.js";
-import { ApiKeyCollection } from "./chunks/ApiKeyCollection-B6Op817e.js";
-import { A, a as a4 } from "./chunks/AuditLogCollection-BYqCj0uE.js";
-import { P as P3, a as a5 } from "./chunks/ProfileAssetCollection-CUM5QfuJ.js";
-import { P as P4, a as a6 } from "./chunks/ProfileMetadataCollection-DEhmljMY.js";
-import { P as P5, a as a7 } from "./chunks/ProfileMetafieldCollection-DMKhSHXX.js";
-import { P as P6, a as a8 } from "./chunks/ProfileRelationshipCollection-_TsY7MHL.js";
-import { P as P7, a as a9 } from "./chunks/ProfileRelationshipTermCollection-CXem_qT-.js";
-import { ProfileRelationshipTypeCollection } from "./chunks/ProfileRelationshipTypeCollection-CF8YvLTV.js";
-import { ApiKey } from "./chunks/ApiKey-B2LKEaP8.js";
-import { ProfileRelationshipType } from "./chunks/ProfileRelationshipType-BXBLldea.js";
-export {
-  ApiKey,
-  ApiKeyCollection,
-  A as AuditLog,
-  a4 as AuditLogCollection,
-  B as Bot,
-  M as MagicLinkToken,
-  a as MagicLinkTokenCollection,
-  a3 as NostrIdentity,
-  N as NostrIdentityCollection,
-  O as OidcIdentity,
-  b as OidcIdentityCollection,
-  c as Organization,
-  P as Person,
-  a2 as Profile,
-  P3 as ProfileAsset,
-  a5 as ProfileAssetCollection,
-  b2 as ProfileCollection,
-  P4 as ProfileMetadata,
-  a6 as ProfileMetadataCollection,
-  P5 as ProfileMetafield,
-  a7 as ProfileMetafieldCollection,
-  P6 as ProfileRelationship,
-  a8 as ProfileRelationshipCollection,
-  P7 as ProfileRelationshipTerm,
-  a9 as ProfileRelationshipTermCollection,
-  ProfileRelationshipType,
-  ProfileRelationshipTypeCollection,
-  P2 as ProfileType,
-  d as ProfileTypeCollection,
-  c2 as computeEventId,
-  b3 as createAuthEvent,
-  e as createMagicLinkService,
-  f as createNip05Handler,
-  g as createProfileFromNostr,
-  h as createProfileFromOidc,
-  d2 as decryptPrivkey,
-  f2 as deriveEncryptionKey,
-  e2 as encryptPrivkey,
-  g2 as generateNostrKeypair,
-  h2 as getPublicKey,
-  i as isValidNip05Identifier,
-  i2 as isValidPrivkey,
-  j as isValidPubkey,
-  n as npubToPubkey,
-  k as nsecToPrivkey,
-  p as parseNip05Identifier,
-  p3 as privkeyToNsec,
-  p2 as promptMessageOptions,
-  l as pubkeyToNpub,
-  r as resolveIdentity,
-  s2 as signEvent,
-  s as smrtProfilesGenerateBioPrompt,
-  v as verifyAuthEvent,
-  m as verifyNostrSignature
+import { _ as pubkeyToNpub, a as computeEventId, b as verifyNostrSignature, c as deriveEncryptionKey, d as getPublicKey, f as isValidPrivkey, g as privkeyToNsec, h as nsecToPrivkey, l as encryptPrivkey, m as npubToPubkey, o as createAuthEvent, p as isValidPubkey, r as NostrIdentity, s as decryptPrivkey, t as NostrIdentityCollection, u as generateNostrKeypair, v as signEvent, x as __exportAll, y as verifyAuthEvent } from "./chunks/NostrIdentityCollection-CG6HGf6c.js";
+import { i as ProfileType, o as promptMessageOptions, r as Profile, s as smrtProfilesGenerateBioPrompt, t as ProfileCollection } from "./chunks/ProfileCollection-DlhdOnDr.js";
+import { t as ApiKey } from "./chunks/ApiKey-3DlNEc91.js";
+import { r as OidcIdentity, t as OidcIdentityCollection } from "./chunks/OidcIdentityCollection-DiLneB7J.js";
+import { t as ApiKeyCollection } from "./chunks/ApiKeyCollection-PwVs0qDb.js";
+import { r as AuditLog, t as AuditLogCollection } from "./chunks/AuditLogCollection-CnIYU0aK.js";
+import { r as ProfileAsset, t as ProfileAssetCollection } from "./chunks/ProfileAssetCollection-BY2Wbem3.js";
+import { r as ProfileMetadata, t as ProfileMetadataCollection } from "./chunks/ProfileMetadataCollection-CGcO4Iw_.js";
+import { r as ProfileMetafield, t as ProfileMetafieldCollection } from "./chunks/ProfileMetafieldCollection-C8TX9HvN.js";
+import { r as ProfileRelationship, t as ProfileRelationshipCollection } from "./chunks/ProfileRelationshipCollection-JnskbZTd.js";
+import { r as ProfileRelationshipTerm, t as ProfileRelationshipTermCollection } from "./chunks/ProfileRelationshipTermCollection-UopP7sja.js";
+import { t as ProfileRelationshipType } from "./chunks/ProfileRelationshipType-OMBn5cWR.js";
+import { t as ProfileRelationshipTypeCollection } from "./chunks/ProfileRelationshipTypeCollection-CQu08kxF.js";
+import { ObjectRegistry, SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/__smrt-register__.ts
+ObjectRegistry.registerPackageManifest(new URL("./manifest.json", "" + import.meta.url));
+//#endregion
+//#region src/models/MagicLinkToken.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$1(target, key, result);
+	return result;
 };
-//# sourceMappingURL=index.js.map
+var DEFAULT_EXPIRATION_MINUTES = 15;
+var MagicLinkToken = class extends SmrtObject {
+	nostrIdentityId;
+	/**
+	* SHA-256 hash of the token (never store plaintext)
+	*/
+	tokenHash = "";
+	/**
+	* Email this token was sent to
+	*/
+	email = "";
+	/**
+	* When this token expires
+	*/
+	expiresAt = new Date(Date.now() + DEFAULT_EXPIRATION_MINUTES * 60 * 1e3);
+	/**
+	* When this token was used (null = unused)
+	*/
+	usedAt = null;
+	/**
+	* IP address that requested the token (for rate limiting)
+	*/
+	requestedFromIp = "";
+	/**
+	* When this token was created (for rate limiting)
+	*/
+	createdAt = /* @__PURE__ */ new Date();
+	constructor(options = {}) {
+		super(options);
+		if (options.nostrIdentityId) this.nostrIdentityId = options.nostrIdentityId;
+		if (options.tokenHash) this.tokenHash = options.tokenHash;
+		if (options.email) this.email = options.email;
+		if (options.expiresAt) this.expiresAt = options.expiresAt;
+		if (options.usedAt !== void 0) this.usedAt = options.usedAt;
+		if (options.requestedFromIp) this.requestedFromIp = options.requestedFromIp;
+		if (options.createdAt) this.createdAt = options.createdAt;
+	}
+	/**
+	* Hash a token using SHA-256
+	*/
+	static hashToken(token) {
+		return createHash("sha256").update(token).digest("hex");
+	}
+	/**
+	* Generate a new magic link token
+	* @param nostrIdentity - The identity this token is for
+	* @param email - The email address to send to
+	* @param options - Additional options
+	*/
+	static async generate(nostrIdentity, email, options = {}) {
+		const token = randomBytes(32).toString("base64url");
+		const tokenHash = MagicLinkToken.hashToken(token);
+		const expiresInMinutes = options.expiresInMinutes ?? DEFAULT_EXPIRATION_MINUTES;
+		const expiresAt = new Date(Date.now() + expiresInMinutes * 60 * 1e3);
+		const magicLinkToken = new MagicLinkToken({
+			db: options.db ?? nostrIdentity.options?.db,
+			nostrIdentityId: nostrIdentity.id,
+			tokenHash,
+			email: email.toLowerCase(),
+			expiresAt,
+			requestedFromIp: options.requestedFromIp || ""
+		});
+		await magicLinkToken.initialize();
+		await magicLinkToken.save();
+		return {
+			token,
+			magicLinkToken
+		};
+	}
+	/**
+	* Verify a token and return the MagicLinkToken if valid
+	* @param token - The plaintext token to verify
+	* @param options - Database options
+	* @returns The MagicLinkToken if valid, null otherwise
+	*/
+	static async verify(token, options = {}) {
+		const tokenHash = MagicLinkToken.hashToken(token);
+		const { MagicLinkTokenCollection } = await Promise.resolve().then(() => MagicLinkTokenCollection_exports);
+		const magicLinkToken = await (await MagicLinkTokenCollection.create(options)).findOne({ where: { tokenHash } });
+		if (!magicLinkToken) return null;
+		if (!magicLinkToken.isValid()) return null;
+		return magicLinkToken;
+	}
+	/**
+	* Check if this token is valid (not expired and not used)
+	*/
+	isValid() {
+		if (this.usedAt !== null) return false;
+		if (/* @__PURE__ */ new Date() > this.expiresAt) return false;
+		return true;
+	}
+	/**
+	* Check if this token has expired
+	*/
+	isExpired() {
+		return /* @__PURE__ */ new Date() > this.expiresAt;
+	}
+	/**
+	* Check if this token has been used
+	*/
+	isUsed() {
+		return this.usedAt !== null;
+	}
+	/**
+	* Mark this token as used
+	*/
+	async markUsed() {
+		this.usedAt = /* @__PURE__ */ new Date();
+		await this.save();
+	}
+	/**
+	* Get the NostrIdentity this token is for
+	*/
+	async getNostrIdentity() {
+		return await this.getRelated("nostrIdentityId");
+	}
+	/**
+	* Get time remaining until expiration in seconds
+	*/
+	getTimeRemainingSeconds() {
+		const now = /* @__PURE__ */ new Date();
+		const diff = this.expiresAt.getTime() - now.getTime();
+		return Math.max(0, Math.floor(diff / 1e3));
+	}
+};
+__decorateClass$1([foreignKey("NostrIdentity", { required: true })], MagicLinkToken.prototype, "nostrIdentityId", 2);
+MagicLinkToken = __decorateClass$1([smrt({
+	tableName: "magic_link_tokens",
+	api: { exclude: ["*"] },
+	mcp: { exclude: ["*"] },
+	cli: { include: ["list"] }
+})], MagicLinkToken);
+//#endregion
+//#region src/collections/MagicLinkTokenCollection.ts
+var MagicLinkTokenCollection_exports = /* @__PURE__ */ __exportAll({ MagicLinkTokenCollection: () => MagicLinkTokenCollection });
+var MagicLinkTokenCollection = class extends SmrtCollection {
+	static _itemClass = MagicLinkToken;
+	/**
+	* Find token by hash
+	*/
+	async findByTokenHash(tokenHash) {
+		return await this.findOne({ where: { tokenHash } });
+	}
+	/**
+	* Find active (non-expired, non-used) tokens for an email
+	*/
+	async findActiveForEmail(email) {
+		return (await this.list({ where: { email: email.toLowerCase() } })).filter((token) => token.isValid());
+	}
+	/**
+	* Find tokens for a NostrIdentity
+	*/
+	async findByIdentity(nostrIdentityId) {
+		return await this.list({ where: { nostrIdentityId } });
+	}
+	/**
+	* Count tokens created for an email within a time window (for rate limiting)
+	* @param email - Email address
+	* @param withinMinutes - Time window in minutes
+	*/
+	async countRecentByEmail(email, withinMinutes) {
+		const cutoff = /* @__PURE__ */ new Date(Date.now() - withinMinutes * 60 * 1e3);
+		return (await this.list({ where: { email: email.toLowerCase() } })).filter((token) => {
+			const createdAt = token.createdAt;
+			return createdAt && new Date(createdAt) > cutoff;
+		}).length;
+	}
+	/**
+	* Count tokens created from an IP within a time window (for rate limiting)
+	* @param ip - IP address
+	* @param withinMinutes - Time window in minutes
+	*/
+	async countRecentByIp(ip, withinMinutes) {
+		const cutoff = /* @__PURE__ */ new Date(Date.now() - withinMinutes * 60 * 1e3);
+		return (await this.list({ where: { requestedFromIp: ip } })).filter((token) => {
+			const createdAt = token.createdAt;
+			return createdAt && new Date(createdAt) > cutoff;
+		}).length;
+	}
+	/**
+	* Verify a token and return it if valid
+	*/
+	async verify(token) {
+		const tokenHash = MagicLinkToken.hashToken(token);
+		const magicLinkToken = await this.findByTokenHash(tokenHash);
+		if (!magicLinkToken) return null;
+		if (!magicLinkToken.isValid()) return null;
+		return magicLinkToken;
+	}
+	/**
+	* Clean up expired tokens by deleting them
+	* @returns Number of tokens deleted
+	*/
+	async cleanupExpired() {
+		const allTokens = await this.list({});
+		let deleted = 0;
+		for (const token of allTokens) if (token.isExpired() || token.isUsed()) {
+			await token.delete();
+			deleted++;
+		}
+		return deleted;
+	}
+	/**
+	* Revoke all tokens for a NostrIdentity (e.g., when identity is deleted)
+	*/
+	async revokeForIdentity(nostrIdentityId) {
+		const tokens = await this.findByIdentity(nostrIdentityId);
+		let revoked = 0;
+		for (const token of tokens) if (!token.isUsed()) {
+			await token.markUsed();
+			revoked++;
+		}
+		return revoked;
+	}
+	/**
+	* Check if rate limit is exceeded for email
+	* @param email - Email address
+	* @param maxPerHour - Maximum tokens allowed per hour (default: 5)
+	*/
+	async isRateLimitedByEmail(email, maxPerHour = 5) {
+		return await this.countRecentByEmail(email, 60) >= maxPerHour;
+	}
+	/**
+	* Check if rate limit is exceeded for IP
+	* @param ip - IP address
+	* @param maxPerHour - Maximum tokens allowed per hour (default: 10)
+	*/
+	async isRateLimitedByIp(ip, maxPerHour = 10) {
+		return await this.countRecentByIp(ip, 60) >= maxPerHour;
+	}
+};
+//#endregion
+//#region src/auth/magicLinkService.ts
+function createMagicLinkService(config) {
+	const { baseUrl, verifyPath = "/auth/verify", expiresInMinutes = 15, maxTokensPerEmailPerHour = 5, maxTokensPerIpPerHour = 10, masterSecret, sendEmail, db } = config;
+	return {
+		async initiate(email, options = {}) {
+			const normalizedEmail = email.toLowerCase().trim();
+			const { requestedFromIp, nip05Username } = options;
+			const identityCollection = await NostrIdentityCollection.create({ db });
+			const tokenCollection = await MagicLinkTokenCollection.create({ db });
+			if (await tokenCollection.isRateLimitedByEmail(normalizedEmail, maxTokensPerEmailPerHour)) return {
+				success: false,
+				created: false,
+				error: "Too many requests for this email. Please try again later.",
+				errorCode: "RATE_LIMITED_EMAIL"
+			};
+			if (requestedFromIp && await tokenCollection.isRateLimitedByIp(requestedFromIp, maxTokensPerIpPerHour)) return {
+				success: false,
+				created: false,
+				error: "Too many requests from this IP. Please try again later.",
+				errorCode: "RATE_LIMITED_IP"
+			};
+			let nostrIdentity = await identityCollection.findByEmail(normalizedEmail);
+			let profile = null;
+			let created = false;
+			if (!nostrIdentity) {
+				const { Person } = await Promise.resolve().then(() => ProfileTypes_exports);
+				const { ProfileTypeCollection } = await Promise.resolve().then(() => ProfileTypeCollection_exports);
+				let personType = await (await ProfileTypeCollection.create({ db })).getBySlug("person");
+				if (!personType) {
+					const { ProfileType } = await import("./chunks/ProfileCollection-DlhdOnDr.js").then((n) => n.a);
+					personType = new ProfileType({
+						db,
+						slug: "person",
+						name: "Person",
+						description: "Individual person profile"
+					});
+					await personType.initialize();
+					await personType.save();
+				}
+				profile = new Person({
+					db,
+					typeId: personType.id,
+					email: normalizedEmail,
+					name: normalizedEmail.split("@")[0]
+				});
+				await profile.initialize();
+				await profile.save();
+				const keypair = generateNostrKeypair();
+				const encrypted = encryptPrivkey(keypair.privkey, masterSecret);
+				const { NostrIdentity: NostrIdentityClass } = await import("./chunks/NostrIdentityCollection-CG6HGf6c.js").then((n) => n.i);
+				nostrIdentity = new NostrIdentityClass({
+					db,
+					profileId: profile.id,
+					pubkey: keypair.pubkey,
+					encryptedPrivkey: encrypted.ciphertext,
+					encryptionIv: encrypted.iv,
+					encryptionTag: encrypted.tag,
+					email: normalizedEmail,
+					nip05Username: nip05Username?.toLowerCase() || normalizedEmail.split("@")[0]
+				});
+				await nostrIdentity.initialize();
+				await nostrIdentity.save();
+				created = true;
+			} else profile = await nostrIdentity.getProfile();
+			const { token } = await MagicLinkToken.generate(nostrIdentity, normalizedEmail, {
+				expiresInMinutes,
+				requestedFromIp,
+				db
+			});
+			const magicLink = `${baseUrl}${verifyPath}?token=${encodeURIComponent(token)}`;
+			try {
+				await sendEmail(normalizedEmail, magicLink);
+			} catch (emailError) {
+				return {
+					success: false,
+					created,
+					nostrIdentity,
+					profile: profile || void 0,
+					error: "Failed to send email. Please try again.",
+					errorCode: "EMAIL_SEND_FAILED"
+				};
+			}
+			return {
+				success: true,
+				created,
+				nostrIdentity,
+				profile: profile || void 0
+			};
+		},
+		async verify(token) {
+			const magicLinkToken = await MagicLinkToken.verify(token, { db });
+			if (!magicLinkToken) {
+				const tokenHash = MagicLinkToken.hashToken(token);
+				const existingToken = await (await MagicLinkTokenCollection.create({ db })).findByTokenHash(tokenHash);
+				if (!existingToken) return {
+					success: false,
+					error: "Invalid or expired token.",
+					errorCode: "NOT_FOUND"
+				};
+				if (existingToken.isUsed()) return {
+					success: false,
+					error: "This link has already been used.",
+					errorCode: "USED_TOKEN"
+				};
+				if (existingToken.isExpired()) return {
+					success: false,
+					error: "This link has expired. Please request a new one.",
+					errorCode: "EXPIRED_TOKEN"
+				};
+				return {
+					success: false,
+					error: "Invalid token.",
+					errorCode: "INVALID_TOKEN"
+				};
+			}
+			await magicLinkToken.markUsed();
+			const nostrIdentity = await magicLinkToken.getNostrIdentity();
+			if (!nostrIdentity) return {
+				success: false,
+				error: "Identity not found.",
+				errorCode: "NOT_FOUND"
+			};
+			await nostrIdentity.markVerified();
+			const profile = await nostrIdentity.getProfile();
+			const keypair = nostrIdentity.getKeypair(masterSecret);
+			return {
+				success: true,
+				profile: profile || void 0,
+				nostrIdentity,
+				keypair
+			};
+		}
+	};
+}
+//#endregion
+//#region src/auth/nip05Handler.ts
+function createNip05Handler(config) {
+	const { db, defaultRelays = [], cacheTtlSeconds = 300 } = config;
+	return async function handleNip05Request(request) {
+		const { name } = request;
+		const response = await (await NostrIdentityCollection.create({ db })).getNip05Response(name || void 0);
+		if (defaultRelays.length > 0 && Object.keys(response.names).length > 0) {
+			response.relays = {};
+			for (const pubkey of Object.values(response.names)) response.relays[pubkey] = defaultRelays;
+		}
+		if (name && Object.keys(response.names).length === 0) return {
+			body: { names: {} },
+			headers: {
+				"Content-Type": "application/json",
+				"Access-Control-Allow-Origin": "*",
+				"Cache-Control": `public, max-age=${cacheTtlSeconds}`
+			},
+			status: 200
+		};
+		return {
+			body: response,
+			headers: {
+				"Content-Type": "application/json",
+				"Access-Control-Allow-Origin": "*",
+				"Cache-Control": `public, max-age=${cacheTtlSeconds}`
+			},
+			status: 200
+		};
+	};
+}
+function isValidNip05Identifier(identifier) {
+	const parts = identifier.split("@");
+	if (parts.length !== 2) return false;
+	const [localPart, domain] = parts;
+	if (!/^[a-z0-9_-]+$/i.test(localPart)) return false;
+	if (!/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(domain)) return false;
+	return true;
+}
+function parseNip05Identifier(identifier) {
+	if (!isValidNip05Identifier(identifier)) return null;
+	const [localPart, domain] = identifier.split("@");
+	return {
+		localPart,
+		domain
+	};
+}
+//#endregion
+//#region src/auth/resolveIdentity.ts
+async function resolveIdentity(context) {
+	const options = { db: context.db };
+	if (context.apiKey) {
+		const apiKey = await ApiKey.verify(context.apiKey, options);
+		if (apiKey) {
+			const profile = await apiKey.getProfile();
+			if (profile) return {
+				profile,
+				source: "api_key",
+				apiKey
+			};
+		}
+	}
+	if (context.oidcSession?.sub && context.oidcSession?.iss) {
+		const oidcIdentity = await OidcIdentity.findBySubject(context.oidcSession.iss, context.oidcSession.sub, options);
+		if (oidcIdentity) {
+			await oidcIdentity.recordUsage();
+			const profile = await oidcIdentity.getProfile();
+			if (profile) return {
+				profile,
+				source: "oidc",
+				oidcIdentity
+			};
+		}
+	}
+	if (context.nostrAuth?.event && context.nostrAuth?.challenge) {
+		const { event, challenge } = context.nostrAuth;
+		if (verifyAuthEvent(event, challenge).valid) {
+			const nostrIdentity = await NostrIdentity.findByPubkey(event.pubkey, options);
+			if (nostrIdentity) {
+				await nostrIdentity.recordUsage();
+				const profile = await nostrIdentity.getProfile();
+				if (profile) return {
+					profile,
+					source: "nostr",
+					nostrIdentity
+				};
+			}
+		}
+	}
+	if (context.actor) {
+		const profile = await findProfileByExternalId("github", context.actor, options);
+		if (profile) return {
+			profile,
+			source: "actor"
+		};
+	}
+	return {
+		profile: null,
+		source: "none"
+	};
+}
+async function findProfileByExternalId(provider, externalId, options) {
+	const { OidcIdentityCollection } = await import("./chunks/OidcIdentityCollection-DiLneB7J.js").then((n) => n.n);
+	const identities = await (await OidcIdentityCollection.create(options)).findByProvider(provider);
+	for (const identity of identities) if (identity.subject === externalId || identity.email?.includes(externalId)) {
+		const profile = await identity.getProfile();
+		if (profile) return profile;
+	}
+	const { ProfileCollection } = await import("./chunks/ProfileCollection-DlhdOnDr.js").then((n) => n.n);
+	const profiles = await (await ProfileCollection.create(options)).list({
+		where: { email: `${externalId}@users.noreply.github.com` },
+		limit: 1
+	});
+	if (profiles.length > 0) return profiles[0];
+	return null;
+}
+async function createProfileFromOidc(claims, provider, options) {
+	const existingIdentity = await OidcIdentity.findBySubject(claims.iss, claims.sub, options);
+	if (existingIdentity) {
+		const profile2 = await existingIdentity.getProfile();
+		if (profile2) {
+			if (claims.email) existingIdentity.email = claims.email;
+			existingIdentity.lastUsedAt = /* @__PURE__ */ new Date();
+			await existingIdentity.save();
+			return {
+				profile: profile2,
+				oidcIdentity: existingIdentity,
+				created: false
+			};
+		}
+	}
+	if (claims.email && claims.email_verified) {
+		const { ProfileCollection } = await import("./chunks/ProfileCollection-DlhdOnDr.js").then((n) => n.n);
+		const existingProfile = await (await ProfileCollection.create(options)).findByEmail(claims.email);
+		if (existingProfile) return {
+			profile: existingProfile,
+			oidcIdentity: await OidcIdentity.findOrCreate(existingProfile, {
+				provider,
+				issuer: claims.iss,
+				subject: claims.sub,
+				email: claims.email
+			}, options),
+			created: false
+		};
+	}
+	const { Person } = await Promise.resolve().then(() => ProfileTypes_exports);
+	const { ProfileTypeCollection } = await Promise.resolve().then(() => ProfileTypeCollection_exports);
+	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
+	if (!personType) {
+		const { ProfileType } = await import("./chunks/ProfileCollection-DlhdOnDr.js").then((n) => n.a);
+		personType = new ProfileType({
+			...options,
+			slug: "person",
+			name: "Person",
+			description: "Individual person profile"
+		});
+		await personType.initialize();
+		await personType.save();
+	}
+	const profile = new Person({
+		...options,
+		typeId: personType.id,
+		email: claims.email || "",
+		name: claims.name || claims.preferred_username || claims.sub
+	});
+	await profile.initialize();
+	await profile.save();
+	return {
+		profile,
+		oidcIdentity: await OidcIdentity.findOrCreate(profile, {
+			provider,
+			issuer: claims.iss,
+			subject: claims.sub,
+			email: claims.email
+		}, options),
+		created: true
+	};
+}
+async function createProfileFromNostr(email, nostrData, options) {
+	const normalizedEmail = email.toLowerCase();
+	const existingIdentity = await NostrIdentity.findByEmail(normalizedEmail, options);
+	if (existingIdentity) {
+		const profile2 = await existingIdentity.getProfile();
+		if (profile2) return {
+			profile: profile2,
+			nostrIdentity: existingIdentity,
+			created: false
+		};
+	}
+	const { Person } = await Promise.resolve().then(() => ProfileTypes_exports);
+	const { ProfileTypeCollection } = await Promise.resolve().then(() => ProfileTypeCollection_exports);
+	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
+	if (!personType) {
+		const { ProfileType } = await import("./chunks/ProfileCollection-DlhdOnDr.js").then((n) => n.a);
+		personType = new ProfileType({
+			...options,
+			slug: "person",
+			name: "Person",
+			description: "Individual person profile"
+		});
+		await personType.initialize();
+		await personType.save();
+	}
+	const profile = new Person({
+		...options,
+		typeId: personType.id,
+		email: normalizedEmail,
+		name: normalizedEmail.split("@")[0]
+	});
+	await profile.initialize();
+	await profile.save();
+	const nostrIdentity = new NostrIdentity({
+		...options,
+		profileId: profile.id,
+		pubkey: nostrData.pubkey,
+		encryptedPrivkey: nostrData.encryptedPrivkey,
+		encryptionIv: nostrData.encryptionIv,
+		encryptionTag: nostrData.encryptionTag,
+		email: normalizedEmail,
+		nip05Username: nostrData.nip05Username?.toLowerCase() || normalizedEmail.split("@")[0]
+	});
+	await nostrIdentity.initialize();
+	await nostrIdentity.save();
+	return {
+		profile,
+		nostrIdentity,
+		created: true
+	};
+}
+//#endregion
+//#region src/collections/ProfileTypeCollection.ts
+var ProfileTypeCollection_exports = /* @__PURE__ */ __exportAll({ ProfileTypeCollection: () => ProfileTypeCollection });
+var ProfileTypeCollection = class extends SmrtCollection {
+	static _itemClass = ProfileType;
+	/**
+	* Get profile type by slug
+	*
+	* @param slug - The slug to search for
+	* @returns ProfileType instance or null
+	*/
+	async getBySlug(slug) {
+		return await this.get({ slug });
+	}
+	/**
+	* Get or create a profile type by slug
+	*
+	* @param slug - The slug to search for
+	* @param defaults - Default values if creating
+	* @returns ProfileType instance
+	*/
+	async getOrCreateBySlug(slug, defaults) {
+		const existing = await this.getBySlug(slug);
+		if (existing) return existing;
+		const profileType = await this.create({
+			slug,
+			...defaults
+		});
+		await profileType.save();
+		return profileType;
+	}
+};
+//#endregion
+//#region src/models/ProfileTypes.ts
+var ProfileTypes_exports = /* @__PURE__ */ __exportAll({
+	Bot: () => Bot,
+	Organization: () => Organization,
+	Person: () => Person
+});
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var Person = class extends Profile {
+	constructor(options = {}) {
+		super(options);
+	}
+};
+Person = __decorateClass([smrt({ tableStrategy: "sti" })], Person);
+var Organization = class extends Profile {
+	constructor(options = {}) {
+		super(options);
+	}
+};
+Organization = __decorateClass([smrt({ tableStrategy: "sti" })], Organization);
+var Bot = class extends Profile {
+	constructor(options = {}) {
+		super(options);
+	}
+};
+Bot = __decorateClass([smrt({ tableStrategy: "sti" })], Bot);
+//#endregion
+export { ApiKey, ApiKeyCollection, AuditLog, AuditLogCollection, Bot, MagicLinkToken, MagicLinkTokenCollection, NostrIdentity, NostrIdentityCollection, OidcIdentity, OidcIdentityCollection, Organization, Person, Profile, ProfileAsset, ProfileAssetCollection, ProfileCollection, ProfileMetadata, ProfileMetadataCollection, ProfileMetafield, ProfileMetafieldCollection, ProfileRelationship, ProfileRelationshipCollection, ProfileRelationshipTerm, ProfileRelationshipTermCollection, ProfileRelationshipType, ProfileRelationshipTypeCollection, ProfileType, ProfileTypeCollection, computeEventId, createAuthEvent, createMagicLinkService, createNip05Handler, createProfileFromNostr, createProfileFromOidc, decryptPrivkey, deriveEncryptionKey, encryptPrivkey, generateNostrKeypair, getPublicKey, isValidNip05Identifier, isValidPrivkey, isValidPubkey, npubToPubkey, nsecToPrivkey, parseNip05Identifier, privkeyToNsec, promptMessageOptions, pubkeyToNpub, resolveIdentity, signEvent, smrtProfilesGenerateBioPrompt, verifyAuthEvent, verifyNostrSignature };
+
+//# sourceMappingURL=index.js.map