@happyvertical/smrt-profiles 0.39.13 → 0.39.15

package/AGENTS.md

@@ -4,7 +4,7 @@ Central identity system with multi-auth, relationships, controlled metadata, and
 
 ## Models
 
-- **Profile** (STI base → Bot, Organization, Person): email (globally unique), `typeId` FK to ProfileType, plus a `metadata` `@oneToMany('ProfileMetadata')` relationship for controlled per-profile values.
+- **Profile** (STI base → Bot, Organization, Person): email (globally unique exact value), readonly indexed `emailKey` derived with `normalizeIdentityEmail()` for adapter-independent identity lookup, `typeId` FK to ProfileType, plus a `metadata` `@oneToMany('ProfileMetadata')` relationship for controlled per-profile values.
 - **ProfileAsset**: dedicated owned-asset join in `profile_assets` with `relationship` and `sortOrder`.
 - **ProfileRelationship**: bidirectional — creating one auto-creates reciprocal inverse. `contextProfileId` for tertiary relationships. `ProfileRelationshipTerm` tracks start/end dates.
 - **ProfileMetafield**: controlled vocabulary with `validationSchema`. **ProfileMetadata**: per-profile values linked to metafields.
@@ -15,7 +15,7 @@ Central identity system with multi-auth, relationships, controlled metadata, and
 | Model | Pattern |
 |-------|---------|
 | NostrIdentity | Encrypted keypair (AES-256-GCM). Requires `SERVER_MASTER_SECRET` env var for decryption. NIP-05 address generation. |
-| OidcIdentity | Multiple issuers (Keycloak/Google/GitHub). Lookup by `issuer + subject` pair. `findOrCreate()` for first login. |
+| OidcIdentity | Multiple issuers (Keycloak/Google/GitHub). Lookup by `issuer + subject` pair. Transactional provisioning derives the readonly nullable unique `identityKey` and backfills legacy rows. |
 | ApiKey | SHA-256 hashed. **Plaintext returned once only** on `generate()`. `keyPrefix` for identification. Scope-based with expiry. |
 | MagicLinkToken | One-time token with expiry for passwordless auth. |
 
@@ -24,7 +24,19 @@ Central identity system with multi-auth, relationships, controlled metadata, and
 Auth helpers in `src/auth/` build profiles from external identity claims:
 
 - `resolveIdentity()` — top-level dispatcher that returns/creates a Profile from Nostr signatures, OIDC claims, magic link tokens, or API keys.
-- `createProfileFromOidc(claims, provider)` — creates `Profile` + `OidcIdentity` for first-time OIDC sign-in.
+- `createProfileFromOidc(claims, provider, options)` — creates `Profile` + `OidcIdentity` for first-time OIDC sign-in using a transaction-capable root database in `options.db`.
+- `ProfileCollection.findUniqueGlobalPersonByEmail(email)` — supported
+  verified-identity lookup; fails closed on tenant-scoped, non-Person, or
+  duplicate case-insensitive matches.
+- `ProfileCollection.requireCanonicalGlobalPerson(profileId, email?)` —
+  validates an application-selected Profile against the same canonical global
+  Person invariant.
+- `ProfileCollection.reserveCanonicalIdentityEmail(profileId, email?)` —
+  validates and synchronizes the private unique
+  `oidc_profile_email_reservations.email_key` used as the database arbiter for
+  concurrent external-identity provisioning. Omitting `email` uses the
+  Profile's stored address, moving or removing an existing reservation as the
+  canonical Profile changes.
 - `createProfileFromNostr(email, nostrData)` — creates `Profile` + `NostrIdentity` for Nostr-authenticated users.
 
 ## Key Methods
@@ -48,6 +60,58 @@ import { smrtProfilesGenerateBioPrompt } from '@happyvertical/smrt-profiles';
 
 - **SERVER_MASTER_SECRET required** for Nostr private key decryption — centralized key management
 - **API key never returned again**: `ApiKey.generate()` returns plaintext once; only `keyPrefix` visible later
-- **OIDC unique per issuer+subject**: same subject from different issuers = different identities
-- **Email unique across all profiles**: DB-level unique constraint, not per-tenant
+- **OIDC unique per issuer+subject**: same subject from different issuers =
+  different identities. Both claims are opaque and case-sensitive; preserve
+  exact whitespace after using trim only to reject blank values.
+- **OIDC identity mutations are trusted-only**: generated REST, MCP, and CLI
+  surfaces are read-only. Link or update identities through transactional
+  provisioning APIs so callers cannot rebind issuer/subject authority to an
+  arbitrary Profile. Deprecated `OidcIdentity.findOrCreate()` preserves only
+  transaction-safe exact-link reuse and refuses to create new links;
+  `OidcIdentityCollection.linkToProfile()` and `Profile.linkOidcIdentity()`
+  delegate to that same non-creating compatibility path.
+- **Apply schema migrations for identity race keys**: run `smrt db:status`,
+  `smrt db:migrate`, then `smrt db:status` before deploying. Transactional OIDC
+  provisioning populates `OidcIdentity.identityKey` and
+  `oidc_profile_email_reservations`; legacy rows reserve an address only after
+  safe validation. Stop/upgrade old Profile writers, then run the public,
+  transactional and idempotent `backfillProfileEmailKeys(db)` from one deploy
+  process. Verified-email provisioning and public email-key lookup require the
+  standard `_smrt_backfills` readiness marker and fail closed immediately when
+  it is absent. This keeps table scans in the explicit deploy step; runtime
+  reads use the indexed key and validate only returned candidates.
+- **Public OIDC provisioning requires transactions**:
+  `createProfileFromOidc()` owns a root transaction or uses a savepoint on an
+  already-bound handle. Root adapters must expose `beginTransaction`;
+  transaction-only handles are ambiguous and fail closed. Pass the root
+  database for adapters without nested savepoints, including DuckDB;
+  provisioning fails before durable writes if neither path is safe. Trusted
+  framework packages use the private
+  `@happyvertical/smrt-profiles/internal/oidc-provisioning` subpath instead of
+  duplicating adapter probing, locking, or retry policy, and supply both exact
+  issuer/subject and normalized-email lock keys in deterministic order. The
+  coordinator additionally serializes all SQLite/DuckDB provisioning
+  transactions per database URL because those adapters cannot overlap
+  unrelated root transactions safely and retries bounded PostgreSQL
+  deadlock/serialization failures. New OIDC Profiles use per-profile,
+  non-semantic slugs so duplicate display names never invoke natural-key upsert.
+  Caller-owned transactions never execute `_smrt_backfills` DDL; paths that
+  perform canonical email lookup or reservation require the table to already
+  exist or the caller must retry with the root database. Exact issuer/subject
+  reuse skips the email-key readiness-marker lookup, but root coordination still
+  initializes the shared tracker table. Caller-owned exact reuse does not
+  consult the tracker and therefore does not require that table.
+- **Profile-only OIDC linking fails closed on existing email matches**:
+  `createProfileFromOidc()` preserves exact issuer/subject reuse, including
+  legacy tenant-scoped and non-Person links, but profiles cannot prove whether a
+  User owns a same-email Profile. New identities therefore never attach to an
+  existing email match through this helper; User/session provisioning still
+  rejects unsafe linked Profiles before creating authentication state. Use
+  `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email reuse and
+  its supported transaction-bound resolver hook.
+- **Email storage and identity matching differ**: `Profile.email` has an
+  exact-value DB constraint. Identity boundaries query readonly indexed
+  `Profile.emailKey`, derived by the shared TypeScript
+  `normalizeIdentityEmail()` helper rather than adapter-specific SQL casing or
+  trimming, and deliberately fail closed on duplicate normalized keys.
 - **Optional tenancy** on Profile; AuditLog allows super-admin bypass

package/README.md

@@ -5,69 +5,46 @@ Central identity system with multi-auth (Nostr/OIDC/API keys/magic links), relat
 ## Installation
 
 ```bash
-pnpm add @happyvertical/smrt-profiles
+pnpm add @happyvertical/smrt-profiles @happyvertical/sql
 ```
 
 ## Usage
 
 ```typescript
 import {
-  Profile,
-  ProfileCollection,
-  OidcIdentity,
-  OidcIdentityCollection,
-  ApiKey,
-  ApiKeyCollection,
-  NostrIdentity,
-  generateNostrKeypair,
+  backfillProfileEmailKeys,
   createProfileFromOidc,
 } from '@happyvertical/smrt-profiles';
-
-// Create a profile
-const profile = new Profile({
-  name: 'Alice Johnson',
-  email: 'alice@example.com',
-});
-await profile.save();
-
-// OIDC identity (Keycloak/Google/GitHub)
-const oidcProfile = await createProfileFromOidc({
-  issuer: 'https://accounts.google.com',
-  subject: 'abc123',
-  email: 'alice@example.com',
-  name: 'Alice Johnson',
-});
-
-// Nostr identity (encrypted keypair, requires SERVER_MASTER_SECRET)
-const keypair = generateNostrKeypair();
-const nostr = new NostrIdentity({
-  profileId: profile.id,
-  pubkey: keypair.pubkey,
-});
-await nostr.save();
-
-// API key (plaintext returned once only)
-const { key, apiKey } = await ApiKey.generate({
-  profileId: profile.id,
-  scope: 'read:profiles',
-  expiresAt: new Date('2025-12-31'),
-});
-// key = plaintext (store now), apiKey.keyPrefix = visible identifier
-
-// Relationships (auto-creates reciprocal inverse)
-const bob = new Profile({ name: 'Bob Smith', email: 'bob@example.com' });
-await bob.save();
-await profile.addRelationship(bob, 'friend');
-const friends = await profile.getRelationships({ direction: 'from' });
+import { getDatabase } from '@happyvertical/sql';
+
+// Connect after applying schema migrations.
+const persistence = { type: 'sqlite' as const, url: 'file:profiles.db' };
+// Mark migrated Profile email keys ready before enabling OIDC provisioning.
+const db = await getDatabase(persistence);
+await backfillProfileEmailKeys(db);
+
+// Provision a new OIDC Profile or reuse its exact issuer/subject link.
+const { profile, oidcIdentity, created } = await createProfileFromOidc(
+  {
+    iss: 'https://accounts.google.com',
+    sub: 'abc123',
+    email: 'olivia@example.com',
+    email_verified: true,
+    name: 'Olivia Smith',
+  },
+  'google',
+  { db },
+);
 ```
 
 ### Owned assets
 
 ```typescript
 import { AssetCollection } from '@happyvertical/smrt-assets';
+import { ProfileCollection } from '@happyvertical/smrt-profiles';
 
-const profiles = await ProfileCollection.create();
-const assets = await AssetCollection.create();
+const profiles = await ProfileCollection.create({ db });
+const assets = await AssetCollection.create({ db });
 
 const headshot = await assets.create({
   name: 'alice-headshot.jpg',
@@ -128,6 +105,77 @@ const galleryAssets = await profiles.getAssets(profile.id!, 'gallery');
 | `NostrIdentityCollection` | Nostr identity lookup (includes NIP-05) |
 | `OidcIdentityCollection` | OIDC identity lookup |
 
+`ProfileCollection.findUniqueGlobalPersonByEmail(email)` is the supported
+verified-identity lookup. It reads across tenant scopes and returns a Profile
+only when the case-insensitive email has exactly one match and that row is a
+global `Person`; tenant-scoped, non-Person, and duplicate matches throw a
+`CanonicalPersonProfileError`. Matching uses readonly, indexed
+`Profile.emailKey`, derived with the exported TypeScript
+`normalizeIdentityEmail()` helper so Unicode casing and whitespace behave the
+same on every database adapter. Use
+`requireCanonicalGlobalPerson(profileId, email?)` to validate an
+application-selected Profile against the same invariant. When `email` is
+omitted, the helper validates uniqueness using the Profile's current stored
+email. `reserveCanonicalIdentityEmail(profileId, email)` additionally claims
+the normalized address in the private
+`oidc_profile_email_reservations` table. Omit `email` to synchronize the
+reservation from the Profile's current stored email; changing the address moves
+the reservation, and clearing it removes the reservation. Legacy simple
+`Person` STI discriminators remain valid and are handled by core's normal
+upgrade path.
+
+`OidcIdentity.identityKey` stores a nullable, unique issuer/subject natural key
+for transaction-safe first-login races. The model derives it from issuer and
+subject on every save, so callers cannot desynchronize it. New links populate
+it and legacy rows backfill it when reused. Issuer and subject are opaque,
+case-sensitive OIDC identifiers: surrounding whitespace is preserved and is
+part of the key; trimming is used only to reject an all-whitespace claim. The
+generated REST, MCP, and CLI surfaces are read-only because identity mutation
+is an authentication authority change; trusted callers link identities through
+the transactional provisioning APIs. The legacy
+`OidcIdentity.findOrCreate()` method is deprecated: it transactionally reuses
+one exact safe issuer/subject link for compatibility but refuses to create a
+new authentication link. Use `createProfileFromOidc()` or the users package's
+owner-aware provisioning API for creation. The deprecated
+`OidcIdentityCollection.linkToProfile()` and `Profile.linkOidcIdentity()`
+helpers delegate to the same exact-reuse-only path and cannot plant or rebind a
+link.
+Existing installations must stop or upgrade legacy Profile writers, run
+`smrt db:status`, `smrt db:migrate`, and then `smrt db:status` before deploying
+this version to add the identity keys and private email-reservation table. Then
+run `backfillProfileEmailKeys(db)` once from a single deploy process before
+enabling verified-email provisioning. The transaction-safe backfill is
+idempotent; canonical email lookup and reservation fail closed with
+`email_key_backfill_required` while the standard `_smrt_backfills` readiness
+marker is absent. Exact issuer/subject reuse does not depend on email-key
+readiness because it does not perform email-based linking.
+The identity-boundary helpers use the readiness guard and indexed key. The
+general-purpose `ProfileCollection.findByEmail()` retains its compatible legacy
+lookup behavior and is not suitable for identity linking. Only the explicit
+deploy-time backfill scans the Profile table and records readiness; guarded
+runtime identity lookups use the indexed key and validate returned candidates.
+`createProfileFromOidc()` requires a transaction-capable database. Pass the
+root database, which must expose `beginTransaction`, and SMRT owns the
+transaction; an already transaction-bound handle is supported through a
+savepoint. Paths that perform canonical email lookup or reservation require
+`_smrt_backfills` to exist first. Provisioning never attempts tracker DDL on
+a caller-owned transaction; for those paths, if the table is absent, pass the
+root database so SMRT can initialize it outside the transaction. Exact
+issuer/subject reuse skips the email-key readiness-marker lookup, but root
+coordination still initializes the shared tracker table. Caller-owned exact
+reuse does not consult the tracker and therefore does not require that table.
+A handle exposing only `transaction()` is ambiguous and fails closed. For
+adapters without nested savepoint support, including DuckDB, pass
+the root database rather than calling the helper inside an outer transaction.
+Provisioning fails before durable writes when neither safe path is available.
+The Profile-only helper preserves exact issuer/subject reuse, including legacy
+links to tenant-scoped or non-Person Profiles, but never attaches a new identity
+to an existing email match because this package cannot prove whether a User owns
+that Profile. User/session provisioning still rejects those unsafe linked
+Profiles before creating authentication state. Use
+`UserCollection.getOrCreateFromOidc()` from `@happyvertical/smrt-users` for
+owner-aware verified-email reuse and the supported pre-provision resolver hook.
+
 `Profile` and `ProfileCollection` both expose `getAssets()`, `addAsset()`, and
 `removeAsset()` helpers backed by `profile_assets`. Typical relationships are
 `avatar`, `gallery`, and `attachment`.
@@ -137,7 +185,10 @@ const galleryAssets = await profiles.getAssets(profile.id!, 'gallery');
 | Export | Description |
 |--------|------------|
 | `resolveIdentity` | Resolve profile from any auth method |
-| `createProfileFromOidc` | Create profile + OIDC identity in one call |
+| `createProfileFromOidc` | Create a Profile + OIDC identity or reuse an exact issuer/subject link; existing email matches fail closed |
+| `normalizeIdentityEmail` | Adapter-independent Unicode/whitespace email canonicalizer used by identity keys |
+| `backfillProfileEmailKeys` | Transactionally populate normalized keys for migrated Profiles |
+| `PROFILE_EMAIL_KEY_BACKFILL_NAME` | Durable readiness-marker name recorded by the Profile email-key backfill |
 | `createProfileFromNostr` | Create profile + Nostr identity in one call |
 | `createAuthEvent` | Create a Nostr auth event |
 | `verifyAuthEvent` | Verify a Nostr auth event signature |
@@ -161,7 +212,7 @@ const galleryAssets = await profiles.getAssets(profile.id!, 'gallery');
 
 ### Key Types
 
-`ProfileOptions`, `ProfileTypeOptions`, `ProfileMetadataOptions`, `ProfileMetafieldOptions`, `ProfileRelationshipOptions`, `ProfileRelationshipTypeOptions`, `ProfileRelationshipTermOptions`, `OidcIdentityOptions`, `NostrIdentityOptions`, `ApiKeyOptions`, `GenerateKeyResult`, `MagicLinkTokenOptions`, `GenerateTokenResult`, `AuditLogOptions`, `AuditSource`, `AuthContext`, `ResolveIdentityResult`, `InitiateResult`, `VerifyResult`, `MagicLinkConfig`, `MagicLinkService`, `Nip05HandlerConfig`, `Nip05HandlerResult`, `Nip05Request`, `Nip05Response`, `NostrEvent`, `NostrKeypair`, `EncryptedKey`, `ValidationSchema`, `ValidatorFunction`, `ReciprocalHandler`
+`ProfileOptions`, `ProfileTypeOptions`, `ProfileMetadataOptions`, `ProfileMetafieldOptions`, `ProfileRelationshipOptions`, `ProfileRelationshipTypeOptions`, `ProfileRelationshipTermOptions`, `OidcIdentityOptions`, `CanonicalPersonProfileErrorCode`, `NostrIdentityOptions`, `ApiKeyOptions`, `GenerateKeyResult`, `MagicLinkTokenOptions`, `GenerateTokenResult`, `AuditLogOptions`, `AuditSource`, `AuthContext`, `ResolveIdentityResult`, `InitiateResult`, `VerifyResult`, `MagicLinkConfig`, `MagicLinkService`, `Nip05HandlerConfig`, `Nip05HandlerResult`, `Nip05Request`, `Nip05Response`, `NostrEvent`, `NostrKeypair`, `EncryptedKey`, `ValidationSchema`, `ValidatorFunction`, `ReciprocalHandler`
 
 ## Dependencies
 

package/dist/chunks/{ApiKey-BrNyaaZN.js → ApiKey-Br9NGBnr.js}

@@ -1,4 +1,4 @@
-import { x as __exportAll } from "./NostrIdentityCollection-CG6HGf6c.js";
+import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
 import { SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/models/ApiKey.ts
@@ -116,7 +116,7 @@ var ApiKey = class extends SmrtObject {
 	*/
 	static async verify(key, options = {}) {
 		const keyHash = ApiKey.hashKey(key);
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-DNhDkS7O.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-CrTjdMz8.js").then((n) => n.n);
 		const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
 		if (!apiKey) return null;
 		if (!apiKey.isValid()) return null;
@@ -142,4 +142,4 @@ ApiKey = __decorateClass([smrt({
 //#endregion
 export { ApiKey_exports as n, ApiKey as t };
 
-//# sourceMappingURL=ApiKey-BrNyaaZN.js.map
+//# sourceMappingURL=ApiKey-Br9NGBnr.js.map

package/dist/chunks/{ApiKey-BrNyaaZN.js.map → ApiKey-Br9NGBnr.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ApiKey-BrNyaaZN.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n  profileId?: string;\n  name?: string;\n  scopes?: string[];\n  expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n  key: string;\n  apiKey: ApiKey;\n}\n\n@smrt({\n  tableName: 'api_keys',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  // create/revoke are admin operations invoked in-process via the CLI; only\n  // read-only list/get are exposed over HTTP.\n  cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * SHA-256 hash of the API key\n   */\n  keyHash: string = '';\n\n  /**\n   * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n   */\n  keyPrefix: string = '';\n\n  /**\n   * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n   */\n  name: string = '';\n\n  /**\n   * Scopes/permissions for this key\n   */\n  scopes: string[] = [];\n\n  /**\n   * Last time this key was used\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this key expires (null = never)\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * When this key was revoked (null = active)\n   */\n  revokedAt: Date | null = null;\n\n  constructor(options: ApiKeyOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.name) this.name = options.name;\n    if (options.scopes) this.scopes = options.scopes;\n    if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Check if this key is valid (not expired, not revoked)\n   */\n  isValid(): boolean {\n    if (this.revokedAt) return false;\n    if (this.expiresAt && this.expiresAt < new Date()) return false;\n    return true;\n  }\n\n  /**\n   * Check if this key has a specific scope\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope) || this.scopes.includes('*');\n  }\n\n  /**\n   * Revoke this key\n   */\n  async revoke(): Promise<void> {\n    this.revokedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Record usage of this key\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Hash an API key\n   */\n  static hashKey(key: string): string {\n    return createHash('sha256').update(key).digest('hex');\n  }\n\n  /**\n   * Generate a new API key for a profile\n   */\n  static async generate(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n      db?: SmrtObjectOptions['db'];\n    },\n  ): Promise<GenerateKeyResult> {\n    // Generate a random key: sk_live_<32 random bytes as hex>\n    const randomPart = randomBytes(32).toString('hex');\n    const key = `sk_live_${randomPart}`;\n    const keyPrefix = key.substring(0, 16);\n    const keyHash = ApiKey.hashKey(key);\n\n    const apiKey = new ApiKey({\n      db: options.db || profile.options?.db,\n      profileId: profile.id as string,\n      name: options.name,\n      scopes: options.scopes || ['*'],\n      expiresAt: options.expiresAt ?? null,\n    });\n    apiKey.keyHash = keyHash;\n    apiKey.keyPrefix = keyPrefix;\n\n    await apiKey.initialize();\n    await apiKey.save();\n\n    return { key, apiKey };\n  }\n\n  /**\n   * Verify an API key and return the ApiKey record if valid\n   */\n  static async verify(\n    key: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n\n    const { ApiKeyCollection } = await import(\n      '../collections/ApiKeyCollection'\n    );\n    const collection = await ApiKeyCollection.create(options);\n\n    const apiKey = await collection.findOne({\n      where: { keyHash },\n    });\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    return apiKey;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAoCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;;;;CAKA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAEzB,OAAO;CACT;AACF;AAvJE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AALW,SAAN,gBAAA,CARN,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}
+{"version":3,"file":"ApiKey-Br9NGBnr.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n  profileId?: string;\n  name?: string;\n  scopes?: string[];\n  expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n  key: string;\n  apiKey: ApiKey;\n}\n\n@smrt({\n  tableName: 'api_keys',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  // create/revoke are admin operations invoked in-process via the CLI; only\n  // read-only list/get are exposed over HTTP.\n  cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * SHA-256 hash of the API key\n   */\n  keyHash: string = '';\n\n  /**\n   * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n   */\n  keyPrefix: string = '';\n\n  /**\n   * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n   */\n  name: string = '';\n\n  /**\n   * Scopes/permissions for this key\n   */\n  scopes: string[] = [];\n\n  /**\n   * Last time this key was used\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this key expires (null = never)\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * When this key was revoked (null = active)\n   */\n  revokedAt: Date | null = null;\n\n  constructor(options: ApiKeyOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.name) this.name = options.name;\n    if (options.scopes) this.scopes = options.scopes;\n    if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Check if this key is valid (not expired, not revoked)\n   */\n  isValid(): boolean {\n    if (this.revokedAt) return false;\n    if (this.expiresAt && this.expiresAt < new Date()) return false;\n    return true;\n  }\n\n  /**\n   * Check if this key has a specific scope\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope) || this.scopes.includes('*');\n  }\n\n  /**\n   * Revoke this key\n   */\n  async revoke(): Promise<void> {\n    this.revokedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Record usage of this key\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Hash an API key\n   */\n  static hashKey(key: string): string {\n    return createHash('sha256').update(key).digest('hex');\n  }\n\n  /**\n   * Generate a new API key for a profile\n   */\n  static async generate(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n      db?: SmrtObjectOptions['db'];\n    },\n  ): Promise<GenerateKeyResult> {\n    // Generate a random key: sk_live_<32 random bytes as hex>\n    const randomPart = randomBytes(32).toString('hex');\n    const key = `sk_live_${randomPart}`;\n    const keyPrefix = key.substring(0, 16);\n    const keyHash = ApiKey.hashKey(key);\n\n    const apiKey = new ApiKey({\n      db: options.db || profile.options?.db,\n      profileId: profile.id as string,\n      name: options.name,\n      scopes: options.scopes || ['*'],\n      expiresAt: options.expiresAt ?? null,\n    });\n    apiKey.keyHash = keyHash;\n    apiKey.keyPrefix = keyPrefix;\n\n    await apiKey.initialize();\n    await apiKey.save();\n\n    return { key, apiKey };\n  }\n\n  /**\n   * Verify an API key and return the ApiKey record if valid\n   */\n  static async verify(\n    key: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n\n    const { ApiKeyCollection } = await import(\n      '../collections/ApiKeyCollection'\n    );\n    const collection = await ApiKeyCollection.create(options);\n\n    const apiKey = await collection.findOne({\n      where: { keyHash },\n    });\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    return apiKey;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAoCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;;;;CAKA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAEzB,OAAO;CACT;AACF;AAvJE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AALW,SAAN,gBAAA,CARN,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}

package/dist/chunks/{ApiKeyCollection-DNhDkS7O.js → ApiKeyCollection-CrTjdMz8.js}

@@ -1,5 +1,5 @@
-import { x as __exportAll } from "./NostrIdentityCollection-CG6HGf6c.js";
-import { t as ApiKey } from "./ApiKey-BrNyaaZN.js";
+import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { t as ApiKey } from "./ApiKey-Br9NGBnr.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/ApiKeyCollection.ts
 var ApiKeyCollection_exports = /* @__PURE__ */ __exportAll({ ApiKeyCollection: () => ApiKeyCollection });
@@ -80,4 +80,4 @@ var ApiKeyCollection = class extends SmrtCollection {
 //#endregion
 export { ApiKeyCollection_exports as n, ApiKeyCollection as t };
 
-//# sourceMappingURL=ApiKeyCollection-DNhDkS7O.js.map
+//# sourceMappingURL=ApiKeyCollection-CrTjdMz8.js.map

package/dist/chunks/{ApiKeyCollection-DNhDkS7O.js.map → ApiKeyCollection-CrTjdMz8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyCollection-DNhDkS7O.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key?.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAEzB,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}
+{"version":3,"file":"ApiKeyCollection-CrTjdMz8.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key?.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAEzB,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}

package/dist/chunks/{AuditLogCollection-CnIYU0aK.js → AuditLogCollection-BBIEI6BD.js}

@@ -1,4 +1,4 @@
-import { x as __exportAll } from "./NostrIdentityCollection-CG6HGf6c.js";
+import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
 import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 //#region src/models/AuditLog.ts
@@ -188,4 +188,4 @@ var AuditLogCollection = class extends SmrtCollection {
 //#endregion
 export { AuditLogCollection_exports as n, AuditLog as r, AuditLogCollection as t };
 
-//# sourceMappingURL=AuditLogCollection-CnIYU0aK.js.map
+//# sourceMappingURL=AuditLogCollection-BBIEI6BD.js.map

package/dist/chunks/{AuditLogCollection-CnIYU0aK.js.map → AuditLogCollection-BBIEI6BD.js.map}

@@ -1 +1 @@
-{"version":3,"file":"AuditLogCollection-CnIYU0aK.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n  profileId?: string;\n  action?: string;\n  resourceType?: string;\n  resourceId?: string;\n  source?: AuditSource;\n  metadata?: Record<string, unknown>;\n  onBehalfOfId?: string | null;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n  tableName: 'audit_logs',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list'] },\n})\nexport class AuditLog extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  /**\n   * The profile who performed the action\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n   */\n  action: string = '';\n\n  /**\n   * Type of resource affected (e.g., 'Issue', 'Repository')\n   */\n  resourceType: string = '';\n\n  /**\n   * ID of the affected resource\n   */\n  resourceId: string = '';\n\n  /**\n   * Source of the action\n   */\n  source: AuditSource = 'web';\n\n  /**\n   * Additional context (CI run ID, request ID, etc.)\n   */\n  metadata: Record<string, unknown> = {};\n\n  /**\n   * For pass-through identity in CI - the actual person who triggered\n   */\n  @foreignKey('Profile', { nullable: true })\n  onBehalfOfId?: string | null;\n\n  constructor(options: AuditLogOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.action) this.action = options.action;\n    if (options.resourceType) this.resourceType = options.resourceType;\n    if (options.resourceId) this.resourceId = options.resourceId;\n    if (options.source) this.source = options.source;\n    if (options.metadata) this.metadata = options.metadata;\n    if (options.onBehalfOfId !== undefined)\n      this.onBehalfOfId = options.onBehalfOfId;\n  }\n\n  /**\n   * Get the profile who performed the action\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Get the profile on whose behalf the action was performed (if any)\n   */\n  async getOnBehalfOf(): Promise<Profile | null> {\n    if (!this.onBehalfOfId) return null;\n    return (await this.getRelated('onBehalfOfId')) as Profile | null;\n  }\n\n  /**\n   * Get the effective actor (onBehalfOf if set, otherwise profile)\n   */\n  async getEffectiveActor(): Promise<Profile | null> {\n    const onBehalfOf = await this.getOnBehalfOf();\n    if (onBehalfOf) return onBehalfOf;\n    return await this.getProfile();\n  }\n\n  /**\n   * Create an audit log entry\n   */\n  static async record(\n    options: AuditLogOptions & {\n      profile: Profile;\n      onBehalfOf?: Profile | null;\n    },\n  ): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...options,\n      profileId: options.profile.id as string,\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n  static readonly _itemClass = AuditLog;\n\n  /**\n   * Find logs for a profile (actions they performed)\n   */\n  async findByProfile(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs for a resource\n   */\n  async findByResource(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by action type\n   */\n  async findByAction(action: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { action },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by source\n   */\n  async findBySource(source: AuditSource): Promise<AuditLog[]> {\n    return await this.list({\n      where: { source },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs where actions were performed on behalf of someone\n   */\n  async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { onBehalfOfId: profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Record a new audit log entry\n   */\n  async record(options: {\n    profile: Profile;\n    action: string;\n    resourceType: string;\n    resourceId: string;\n    source?: AuditSource;\n    metadata?: Record<string, unknown>;\n    onBehalfOf?: Profile | null;\n  }): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...this.options,\n      profileId: options.profile.id as string,\n      action: options.action,\n      resourceType: options.resourceType,\n      resourceId: options.resourceId,\n      source: options.source || 'web',\n      metadata: options.metadata || {},\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n\n  /**\n   * Get recent activity for a profile\n   */\n  async getRecentActivity(\n    profileId: string,\n    limit: number = 50,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n      limit,\n    });\n  }\n\n  /**\n   * Get activity timeline for a resource\n   */\n  async getResourceTimeline(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt ASC',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAoCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;;;CAKjB,eAAuB;;;;CAKvB,aAAqB;;;;CAKrB,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7FE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AA+BA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAtC9B,SAuCX,WAAA,gBAAA,CAAA;AAvCW,WAAN,gBAAA,CAPN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;AAC3B,CAAC,CAAA,GACY,QAAA;;;;AC5BN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAQS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}
+{"version":3,"file":"AuditLogCollection-BBIEI6BD.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n  profileId?: string;\n  action?: string;\n  resourceType?: string;\n  resourceId?: string;\n  source?: AuditSource;\n  metadata?: Record<string, unknown>;\n  onBehalfOfId?: string | null;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n  tableName: 'audit_logs',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list'] },\n})\nexport class AuditLog extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  /**\n   * The profile who performed the action\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n   */\n  action: string = '';\n\n  /**\n   * Type of resource affected (e.g., 'Issue', 'Repository')\n   */\n  resourceType: string = '';\n\n  /**\n   * ID of the affected resource\n   */\n  resourceId: string = '';\n\n  /**\n   * Source of the action\n   */\n  source: AuditSource = 'web';\n\n  /**\n   * Additional context (CI run ID, request ID, etc.)\n   */\n  metadata: Record<string, unknown> = {};\n\n  /**\n   * For pass-through identity in CI - the actual person who triggered\n   */\n  @foreignKey('Profile', { nullable: true })\n  onBehalfOfId?: string | null;\n\n  constructor(options: AuditLogOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.action) this.action = options.action;\n    if (options.resourceType) this.resourceType = options.resourceType;\n    if (options.resourceId) this.resourceId = options.resourceId;\n    if (options.source) this.source = options.source;\n    if (options.metadata) this.metadata = options.metadata;\n    if (options.onBehalfOfId !== undefined)\n      this.onBehalfOfId = options.onBehalfOfId;\n  }\n\n  /**\n   * Get the profile who performed the action\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Get the profile on whose behalf the action was performed (if any)\n   */\n  async getOnBehalfOf(): Promise<Profile | null> {\n    if (!this.onBehalfOfId) return null;\n    return (await this.getRelated('onBehalfOfId')) as Profile | null;\n  }\n\n  /**\n   * Get the effective actor (onBehalfOf if set, otherwise profile)\n   */\n  async getEffectiveActor(): Promise<Profile | null> {\n    const onBehalfOf = await this.getOnBehalfOf();\n    if (onBehalfOf) return onBehalfOf;\n    return await this.getProfile();\n  }\n\n  /**\n   * Create an audit log entry\n   */\n  static async record(\n    options: AuditLogOptions & {\n      profile: Profile;\n      onBehalfOf?: Profile | null;\n    },\n  ): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...options,\n      profileId: options.profile.id as string,\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n  static readonly _itemClass = AuditLog;\n\n  /**\n   * Find logs for a profile (actions they performed)\n   */\n  async findByProfile(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs for a resource\n   */\n  async findByResource(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by action type\n   */\n  async findByAction(action: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { action },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by source\n   */\n  async findBySource(source: AuditSource): Promise<AuditLog[]> {\n    return await this.list({\n      where: { source },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs where actions were performed on behalf of someone\n   */\n  async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { onBehalfOfId: profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Record a new audit log entry\n   */\n  async record(options: {\n    profile: Profile;\n    action: string;\n    resourceType: string;\n    resourceId: string;\n    source?: AuditSource;\n    metadata?: Record<string, unknown>;\n    onBehalfOf?: Profile | null;\n  }): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...this.options,\n      profileId: options.profile.id as string,\n      action: options.action,\n      resourceType: options.resourceType,\n      resourceId: options.resourceId,\n      source: options.source || 'web',\n      metadata: options.metadata || {},\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n\n  /**\n   * Get recent activity for a profile\n   */\n  async getRecentActivity(\n    profileId: string,\n    limit: number = 50,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n      limit,\n    });\n  }\n\n  /**\n   * Get activity timeline for a resource\n   */\n  async getResourceTimeline(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt ASC',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAoCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;;;CAKjB,eAAuB;;;;CAKvB,aAAqB;;;;CAKrB,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7FE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AA+BA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAtC9B,SAuCX,WAAA,gBAAA,CAAA;AAvCW,WAAN,gBAAA,CAPN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;AAC3B,CAAC,CAAA,GACY,QAAA;;;;AC5BN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAQS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}

package/dist/chunks/{NostrIdentityCollection-CG6HGf6c.js → NostrIdentity-DF_a_WZk.js}

@@ -1,4 +1,4 @@
-import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from "node:crypto";
 //#region \0rolldown/runtime.js
 var __defProp$1 = Object.defineProperty;
@@ -3064,21 +3064,21 @@ var NostrIdentity = class extends SmrtObject {
 	* Find identity by public key
 	*/
 	static async findByPubkey(pubkey, options = {}) {
-		const { NostrIdentityCollection } = await Promise.resolve().then(() => NostrIdentityCollection_exports);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BRYUgt47.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { pubkey } });
 	}
 	/**
 	* Find identity by email
 	*/
 	static async findByEmail(email, options = {}) {
-		const { NostrIdentityCollection } = await Promise.resolve().then(() => NostrIdentityCollection_exports);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BRYUgt47.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { email: email.toLowerCase() } });
 	}
 	/**
 	* Find identity by NIP-05 username
 	*/
 	static async findByNip05(username, options = {}) {
-		const { NostrIdentityCollection } = await Promise.resolve().then(() => NostrIdentityCollection_exports);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BRYUgt47.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { nip05Username: username.toLowerCase() } });
 	}
 	/**
@@ -3143,125 +3143,6 @@ NostrIdentity = __decorateClass([smrt({
 	cli: { include: ["list", "get"] }
 })], NostrIdentity);
 //#endregion
-//#region src/collections/NostrIdentityCollection.ts
-var NostrIdentityCollection_exports = /* @__PURE__ */ __exportAll({ NostrIdentityCollection: () => NostrIdentityCollection });
-var NostrIdentityCollection = class extends SmrtCollection {
-	static _itemClass = NostrIdentity;
-	/**
-	* Find identities for a profile
-	*/
-	async findByProfile(profileId) {
-		return await this.list({ where: { profileId } });
-	}
-	/**
-	* Find identity by public key
-	*/
-	async findByPubkey(pubkey) {
-		return await this.findOne({ where: { pubkey } });
-	}
-	/**
-	* Find identity by email
-	*/
-	async findByEmail(email) {
-		return await this.findOne({ where: { email: email.toLowerCase() } });
-	}
-	/**
-	* Find identity by NIP-05 username
-	*/
-	async findByNip05(username) {
-		return await this.findOne({ where: { nip05Username: username.toLowerCase() } });
-	}
-	/**
-	* Link a new Nostr identity to a profile with a new keypair
-	* @param profile - The profile to link to
-	* @param email - Email address for this identity
-	* @param masterSecret - Server master secret for encryption
-	* @param nip05Username - Optional NIP-05 username (defaults to email local part)
-	*/
-	async createForProfile(profile, email, masterSecret, nip05Username) {
-		const normalizedEmail = email.toLowerCase();
-		if (await this.findByEmail(normalizedEmail)) throw new Error(`Nostr identity already exists for email: ${email}`);
-		const keypair = generateNostrKeypair();
-		const encrypted = encryptPrivkey(keypair.privkey, masterSecret);
-		const username = nip05Username?.toLowerCase() || normalizedEmail.split("@")[0];
-		const identity = new NostrIdentity({
-			...this.options,
-			profileId: profile.id,
-			pubkey: keypair.pubkey,
-			encryptedPrivkey: encrypted.ciphertext,
-			encryptionIv: encrypted.iv,
-			encryptionTag: encrypted.tag,
-			email: normalizedEmail,
-			nip05Username: username
-		});
-		await identity.initialize();
-		await identity.save();
-		return identity;
-	}
-	/**
-	* Link an existing Nostr identity (with encrypted keypair) to a profile
-	*/
-	async linkToProfile(profile, nostrData) {
-		if (await this.findByPubkey(nostrData.pubkey)) throw new Error("Nostr identity with this public key already exists");
-		if (await this.findByEmail(nostrData.email)) throw new Error("Nostr identity with this email already exists");
-		const identity = new NostrIdentity({
-			...this.options,
-			profileId: profile.id,
-			pubkey: nostrData.pubkey,
-			encryptedPrivkey: nostrData.encryptedPrivkey,
-			encryptionIv: nostrData.encryptionIv,
-			encryptionTag: nostrData.encryptionTag,
-			email: nostrData.email.toLowerCase(),
-			nip05Username: nostrData.nip05Username?.toLowerCase() || nostrData.email.toLowerCase().split("@")[0]
-		});
-		await identity.initialize();
-		await identity.save();
-		return identity;
-	}
-	/**
-	* Unlink a Nostr identity from a profile
-	*/
-	async unlinkFromProfile(profileId, pubkey) {
-		const identity = await this.findOne({ where: {
-			profileId,
-			pubkey
-		} });
-		if (identity) {
-			await identity.delete();
-			return true;
-		}
-		return false;
-	}
-	/**
-	* Get NIP-05 response data for the /.well-known/nostr.json endpoint
-	* @param username - Optional username filter, returns all if not provided
-	*/
-	async getNip05Response(username) {
-		const where = username ? { nip05Username: username.toLowerCase() } : {};
-		const identities = await this.list({ where });
-		const names = {};
-		for (const identity of identities) if (identity.nip05Username && identity.pubkey) names[identity.nip05Username] = identity.pubkey;
-		return { names };
-	}
-	/**
-	* Check if a NIP-05 username is available
-	*/
-	async isNip05Available(username) {
-		return await this.findByNip05(username) === null;
-	}
-	/**
-	* Update NIP-05 username for an identity
-	*/
-	async updateNip05Username(identity, newUsername) {
-		const normalizedUsername = newUsername.toLowerCase();
-		const existing = await this.findByNip05(normalizedUsername);
-		if (existing && existing.id !== identity.id) throw new Error(`NIP-05 username "${newUsername}" is already taken`);
-		identity.nip05Username = normalizedUsername;
-		await identity.save();
-		return identity;
-	}
-};
-//#endregion
-export { pubkeyToNpub as _, computeEventId as a, verifyNostrSignature as b, deriveEncryptionKey as c, getPublicKey as d, isValidPrivkey as f, privkeyToNsec as g, nsecToPrivkey as h, NostrIdentity_exports as i, encryptPrivkey as l, npubToPubkey as m, NostrIdentityCollection_exports as n, createAuthEvent as o, isValidPubkey as p, NostrIdentity as r, decryptPrivkey as s, NostrIdentityCollection as t, generateNostrKeypair as u, signEvent as v, __exportAll as x, verifyAuthEvent as y };
+export { verifyAuthEvent as _, decryptPrivkey as a, generateNostrKeypair as c, isValidPubkey as d, npubToPubkey as f, signEvent as g, pubkeyToNpub as h, createAuthEvent as i, getPublicKey as l, privkeyToNsec as m, NostrIdentity_exports as n, deriveEncryptionKey as o, nsecToPrivkey as p, computeEventId as r, encryptPrivkey as s, NostrIdentity as t, isValidPrivkey as u, verifyNostrSignature as v, __exportAll as y };
 
-//# sourceMappingURL=NostrIdentityCollection-CG6HGf6c.js.map
+//# sourceMappingURL=NostrIdentity-DF_a_WZk.js.map