@happyvertical/smrt-profiles 0.40.69 → 0.41.0

package/dist/chunks/{NostrIdentityCollection-BRYUgt47.js → NostrIdentityCollection-BnHZOsUI.js}

@@ -1,4 +1,4 @@
-import { c as generateNostrKeypair, s as encryptPrivkey, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { c as generateNostrKeypair, s as encryptPrivkey, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/NostrIdentityCollection.ts
 var NostrIdentityCollection_exports = /* @__PURE__ */ __exportAll({ NostrIdentityCollection: () => NostrIdentityCollection });
@@ -121,4 +121,4 @@ var NostrIdentityCollection = class extends SmrtCollection {
 //#endregion
 export { NostrIdentityCollection_exports as n, NostrIdentityCollection as t };
 
-//# sourceMappingURL=NostrIdentityCollection-BRYUgt47.js.map
+//# sourceMappingURL=NostrIdentityCollection-BnHZOsUI.js.map

package/dist/chunks/{NostrIdentityCollection-BRYUgt47.js.map → NostrIdentityCollection-BnHZOsUI.js.map}

@@ -1 +1 @@
-{"version":3,"file":"NostrIdentityCollection-BRYUgt47.js","names":[],"sources":["../../src/collections/NostrIdentityCollection.ts"],"sourcesContent":["/**\n * NostrIdentityCollection - Collection for managing Nostr identity records\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { encryptPrivkey, generateNostrKeypair } from '../auth/nostrCrypto';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport type { Profile } from '../models/Profile';\n\nexport interface Nip05Response {\n  names: Record<string, string>;\n  relays?: Record<string, string[]>;\n}\n\nexport class NostrIdentityCollection extends SmrtCollection<NostrIdentity> {\n  static readonly _itemClass = NostrIdentity;\n\n  /**\n   * Find identities for a profile\n   */\n  async findByProfile(profileId: string): Promise<NostrIdentity[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find identity by public key\n   */\n  async findByPubkey(pubkey: string): Promise<NostrIdentity | null> {\n    return await this.findOne({\n      where: { pubkey },\n    });\n  }\n\n  /**\n   * Find identity by email\n   */\n  async findByEmail(email: string): Promise<NostrIdentity | null> {\n    return await this.findOne({\n      where: { email: email.toLowerCase() },\n    });\n  }\n\n  /**\n   * Find identity by NIP-05 username\n   */\n  async findByNip05(username: string): Promise<NostrIdentity | null> {\n    return await this.findOne({\n      where: { nip05Username: username.toLowerCase() },\n    });\n  }\n\n  /**\n   * Link a new Nostr identity to a profile with a new keypair\n   * @param profile - The profile to link to\n   * @param email - Email address for this identity\n   * @param masterSecret - Server master secret for encryption\n   * @param nip05Username - Optional NIP-05 username (defaults to email local part)\n   */\n  async createForProfile(\n    profile: Profile,\n    email: string,\n    masterSecret: string,\n    nip05Username?: string,\n  ): Promise<NostrIdentity> {\n    const normalizedEmail = email.toLowerCase();\n\n    // Check if already exists for this email\n    const existing = await this.findByEmail(normalizedEmail);\n    if (existing) {\n      throw new Error(`Nostr identity already exists for email: ${email}`);\n    }\n\n    // Generate new keypair\n    const keypair = generateNostrKeypair();\n\n    // Encrypt private key\n    const encrypted = encryptPrivkey(keypair.privkey, masterSecret);\n\n    // Derive NIP-05 username from email if not provided\n    const username =\n      nip05Username?.toLowerCase() || normalizedEmail.split('@')[0];\n\n    // Create identity\n    const identity = new NostrIdentity({\n      ...this.options,\n      profileId: profile.id as string,\n      pubkey: keypair.pubkey,\n      encryptedPrivkey: encrypted.ciphertext,\n      encryptionIv: encrypted.iv,\n      encryptionTag: encrypted.tag,\n      email: normalizedEmail,\n      nip05Username: username,\n    });\n\n    await identity.initialize();\n    await identity.save();\n\n    return identity;\n  }\n\n  /**\n   * Link an existing Nostr identity (with encrypted keypair) to a profile\n   */\n  async linkToProfile(\n    profile: Profile,\n    nostrData: {\n      pubkey: string;\n      encryptedPrivkey: string;\n      encryptionIv: string;\n      encryptionTag: string;\n      email: string;\n      nip05Username?: string;\n    },\n  ): Promise<NostrIdentity> {\n    // Check if pubkey already exists\n    const existingPubkey = await this.findByPubkey(nostrData.pubkey);\n    if (existingPubkey) {\n      throw new Error('Nostr identity with this public key already exists');\n    }\n\n    // Check if email already exists\n    const existingEmail = await this.findByEmail(nostrData.email);\n    if (existingEmail) {\n      throw new Error('Nostr identity with this email already exists');\n    }\n\n    const identity = new NostrIdentity({\n      ...this.options,\n      profileId: profile.id as string,\n      pubkey: nostrData.pubkey,\n      encryptedPrivkey: nostrData.encryptedPrivkey,\n      encryptionIv: nostrData.encryptionIv,\n      encryptionTag: nostrData.encryptionTag,\n      email: nostrData.email.toLowerCase(),\n      nip05Username:\n        nostrData.nip05Username?.toLowerCase() ||\n        nostrData.email.toLowerCase().split('@')[0],\n    });\n\n    await identity.initialize();\n    await identity.save();\n\n    return identity;\n  }\n\n  /**\n   * Unlink a Nostr identity from a profile\n   */\n  async unlinkFromProfile(profileId: string, pubkey: string): Promise<boolean> {\n    const identity = await this.findOne({\n      where: { profileId, pubkey },\n    });\n\n    if (identity) {\n      await identity.delete();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Get NIP-05 response data for the /.well-known/nostr.json endpoint\n   * @param username - Optional username filter, returns all if not provided\n   */\n  async getNip05Response(username?: string): Promise<Nip05Response> {\n    const where = username ? { nip05Username: username.toLowerCase() } : {};\n\n    const identities = await this.list({\n      where,\n      // Only return verified identities for NIP-05\n      // Uncomment if you want to require verification:\n      // where: { ...where, 'verifiedAt IS NOT': null },\n    });\n\n    const names: Record<string, string> = {};\n    for (const identity of identities) {\n      if (identity.nip05Username && identity.pubkey) {\n        names[identity.nip05Username] = identity.pubkey;\n      }\n    }\n\n    return { names };\n  }\n\n  /**\n   * Check if a NIP-05 username is available\n   */\n  async isNip05Available(username: string): Promise<boolean> {\n    const existing = await this.findByNip05(username);\n    return existing === null;\n  }\n\n  /**\n   * Update NIP-05 username for an identity\n   */\n  async updateNip05Username(\n    identity: NostrIdentity,\n    newUsername: string,\n  ): Promise<NostrIdentity> {\n    const normalizedUsername = newUsername.toLowerCase();\n\n    // Check if username is available\n    const existing = await this.findByNip05(normalizedUsername);\n    if (existing && existing.id !== identity.id) {\n      throw new Error(`NIP-05 username \"${newUsername}\" is already taken`);\n    }\n\n    identity.nip05Username = normalizedUsername;\n    await identity.save();\n\n    return identity;\n  }\n}\n"],"mappings":";;;;AAcO,IAAM,0BAAN,cAAsC,eAA8B;CACzE,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAA6C;EAC/D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA+C;EAChE,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,OAAO,EAClB,CAAC;CACH;;;;CAKA,MAAM,YAAY,OAA8C;EAC9D,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,EACtC,CAAC;CACH;;;;CAKA,MAAM,YAAY,UAAiD;EACjE,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,eAAe,SAAS,YAAY,EAAE,EACjD,CAAC;CACH;;;;;;;;CASA,MAAM,iBACJ,SACA,OACA,cACA,eACwB;EACxB,MAAM,kBAAkB,MAAM,YAAY;EAI1C,IAAI,MADmB,KAAK,YAAY,eAAe,GAErD,MAAM,IAAI,MAAM,4CAA4C,OAAO;EAIrE,MAAM,UAAU,qBAAqB;EAGrC,MAAM,YAAY,eAAe,QAAQ,SAAS,YAAY;EAG9D,MAAM,WACJ,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;EAG7D,MAAM,WAAW,IAAI,cAAc;GACjC,GAAG,KAAK;GACR,WAAW,QAAQ;GACnB,QAAQ,QAAQ;GAChB,kBAAkB,UAAU;GAC5B,cAAc,UAAU;GACxB,eAAe,UAAU;GACzB,OAAO;GACP,eAAe;EACjB,CAAC;EAED,MAAM,SAAS,WAAW;EAC1B,MAAM,SAAS,KAAK;EAEpB,OAAO;CACT;;;;CAKA,MAAM,cACJ,SACA,WAQwB;EAGxB,IAAI,MADyB,KAAK,aAAa,UAAU,MAAM,GAE7D,MAAM,IAAI,MAAM,oDAAoD;EAKtE,IAAI,MADwB,KAAK,YAAY,UAAU,KAAK,GAE1D,MAAM,IAAI,MAAM,+CAA+C;EAGjE,MAAM,WAAW,IAAI,cAAc;GACjC,GAAG,KAAK;GACR,WAAW,QAAQ;GACnB,QAAQ,UAAU;GAClB,kBAAkB,UAAU;GAC5B,cAAc,UAAU;GACxB,eAAe,UAAU;GACzB,OAAO,UAAU,MAAM,YAAY;GACnC,eACE,UAAU,eAAe,YAAY,KACrC,UAAU,MAAM,YAAY,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE;EAC7C,CAAC;EAED,MAAM,SAAS,WAAW;EAC1B,MAAM,SAAS,KAAK;EAEpB,OAAO;CACT;;;;CAKA,MAAM,kBAAkB,WAAmB,QAAkC;EAC3E,MAAM,WAAW,MAAM,KAAK,QAAQ,EAClC,OAAO;GAAE;GAAW;EAAO,EAC7B,CAAC;EAED,IAAI,UAAU;GACZ,MAAM,SAAS,OAAO;GACtB,OAAO;EACT;EACA,OAAO;CACT;;;;;CAMA,MAAM,iBAAiB,UAA2C;EAChE,MAAM,QAAQ,WAAW,EAAE,eAAe,SAAS,YAAY,EAAE,IAAI,CAAC;EAEtE,MAAM,aAAa,MAAM,KAAK,KAAK,EACjC,MAIF,CAAC;EAED,MAAM,QAAgC,CAAC;EACvC,KAAA,MAAW,YAAY,YACrB,IAAI,SAAS,iBAAiB,SAAS,QACrC,MAAM,SAAS,iBAAiB,SAAS;EAI7C,OAAO,EAAE,MAAM;CACjB;;;;CAKA,MAAM,iBAAiB,UAAoC;EAEzD,OAAO,MADgB,KAAK,YAAY,QAAQ,MAC5B;CACtB;;;;CAKA,MAAM,oBACJ,UACA,aACwB;EACxB,MAAM,qBAAqB,YAAY,YAAY;EAGnD,MAAM,WAAW,MAAM,KAAK,YAAY,kBAAkB;EAC1D,IAAI,YAAY,SAAS,OAAO,SAAS,IACvC,MAAM,IAAI,MAAM,oBAAoB,YAAW,mBAAoB;EAGrE,SAAS,gBAAgB;EACzB,MAAM,SAAS,KAAK;EAEpB,OAAO;CACT;AACF"}
+{"version":3,"file":"NostrIdentityCollection-BnHZOsUI.js","names":[],"sources":["../../src/collections/NostrIdentityCollection.ts"],"sourcesContent":["/**\n * NostrIdentityCollection - Collection for managing Nostr identity records\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { encryptPrivkey, generateNostrKeypair } from '../auth/nostrCrypto';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport type { Profile } from '../models/Profile';\n\nexport interface Nip05Response {\n  names: Record<string, string>;\n  relays?: Record<string, string[]>;\n}\n\nexport class NostrIdentityCollection extends SmrtCollection<NostrIdentity> {\n  static readonly _itemClass = NostrIdentity;\n\n  /**\n   * Find identities for a profile\n   */\n  async findByProfile(profileId: string): Promise<NostrIdentity[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find identity by public key\n   */\n  async findByPubkey(pubkey: string): Promise<NostrIdentity | null> {\n    return await this.findOne({\n      where: { pubkey },\n    });\n  }\n\n  /**\n   * Find identity by email\n   */\n  async findByEmail(email: string): Promise<NostrIdentity | null> {\n    return await this.findOne({\n      where: { email: email.toLowerCase() },\n    });\n  }\n\n  /**\n   * Find identity by NIP-05 username\n   */\n  async findByNip05(username: string): Promise<NostrIdentity | null> {\n    return await this.findOne({\n      where: { nip05Username: username.toLowerCase() },\n    });\n  }\n\n  /**\n   * Link a new Nostr identity to a profile with a new keypair\n   * @param profile - The profile to link to\n   * @param email - Email address for this identity\n   * @param masterSecret - Server master secret for encryption\n   * @param nip05Username - Optional NIP-05 username (defaults to email local part)\n   */\n  async createForProfile(\n    profile: Profile,\n    email: string,\n    masterSecret: string,\n    nip05Username?: string,\n  ): Promise<NostrIdentity> {\n    const normalizedEmail = email.toLowerCase();\n\n    // Check if already exists for this email\n    const existing = await this.findByEmail(normalizedEmail);\n    if (existing) {\n      throw new Error(`Nostr identity already exists for email: ${email}`);\n    }\n\n    // Generate new keypair\n    const keypair = generateNostrKeypair();\n\n    // Encrypt private key\n    const encrypted = encryptPrivkey(keypair.privkey, masterSecret);\n\n    // Derive NIP-05 username from email if not provided\n    const username =\n      nip05Username?.toLowerCase() || normalizedEmail.split('@')[0];\n\n    // Create identity\n    const identity = new NostrIdentity({\n      ...this.options,\n      profileId: profile.id as string,\n      pubkey: keypair.pubkey,\n      encryptedPrivkey: encrypted.ciphertext,\n      encryptionIv: encrypted.iv,\n      encryptionTag: encrypted.tag,\n      email: normalizedEmail,\n      nip05Username: username,\n    });\n\n    await identity.initialize();\n    await identity.save();\n\n    return identity;\n  }\n\n  /**\n   * Link an existing Nostr identity (with encrypted keypair) to a profile\n   */\n  async linkToProfile(\n    profile: Profile,\n    nostrData: {\n      pubkey: string;\n      encryptedPrivkey: string;\n      encryptionIv: string;\n      encryptionTag: string;\n      email: string;\n      nip05Username?: string;\n    },\n  ): Promise<NostrIdentity> {\n    // Check if pubkey already exists\n    const existingPubkey = await this.findByPubkey(nostrData.pubkey);\n    if (existingPubkey) {\n      throw new Error('Nostr identity with this public key already exists');\n    }\n\n    // Check if email already exists\n    const existingEmail = await this.findByEmail(nostrData.email);\n    if (existingEmail) {\n      throw new Error('Nostr identity with this email already exists');\n    }\n\n    const identity = new NostrIdentity({\n      ...this.options,\n      profileId: profile.id as string,\n      pubkey: nostrData.pubkey,\n      encryptedPrivkey: nostrData.encryptedPrivkey,\n      encryptionIv: nostrData.encryptionIv,\n      encryptionTag: nostrData.encryptionTag,\n      email: nostrData.email.toLowerCase(),\n      nip05Username:\n        nostrData.nip05Username?.toLowerCase() ||\n        nostrData.email.toLowerCase().split('@')[0],\n    });\n\n    await identity.initialize();\n    await identity.save();\n\n    return identity;\n  }\n\n  /**\n   * Unlink a Nostr identity from a profile\n   */\n  async unlinkFromProfile(profileId: string, pubkey: string): Promise<boolean> {\n    const identity = await this.findOne({\n      where: { profileId, pubkey },\n    });\n\n    if (identity) {\n      await identity.delete();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Get NIP-05 response data for the /.well-known/nostr.json endpoint\n   * @param username - Optional username filter, returns all if not provided\n   */\n  async getNip05Response(username?: string): Promise<Nip05Response> {\n    const where = username ? { nip05Username: username.toLowerCase() } : {};\n\n    const identities = await this.list({\n      where,\n      // Only return verified identities for NIP-05\n      // Uncomment if you want to require verification:\n      // where: { ...where, 'verifiedAt IS NOT': null },\n    });\n\n    const names: Record<string, string> = {};\n    for (const identity of identities) {\n      if (identity.nip05Username && identity.pubkey) {\n        names[identity.nip05Username] = identity.pubkey;\n      }\n    }\n\n    return { names };\n  }\n\n  /**\n   * Check if a NIP-05 username is available\n   */\n  async isNip05Available(username: string): Promise<boolean> {\n    const existing = await this.findByNip05(username);\n    return existing === null;\n  }\n\n  /**\n   * Update NIP-05 username for an identity\n   */\n  async updateNip05Username(\n    identity: NostrIdentity,\n    newUsername: string,\n  ): Promise<NostrIdentity> {\n    const normalizedUsername = newUsername.toLowerCase();\n\n    // Check if username is available\n    const existing = await this.findByNip05(normalizedUsername);\n    if (existing && existing.id !== identity.id) {\n      throw new Error(`NIP-05 username \"${newUsername}\" is already taken`);\n    }\n\n    identity.nip05Username = normalizedUsername;\n    await identity.save();\n\n    return identity;\n  }\n}\n"],"mappings":";;;;AAcO,IAAM,0BAAN,cAAsC,eAA8B;CACzE,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAA6C;EAC/D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA+C;EAChE,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,OAAO,EAClB,CAAC;CACH;;;;CAKA,MAAM,YAAY,OAA8C;EAC9D,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE,EACtC,CAAC;CACH;;;;CAKA,MAAM,YAAY,UAAiD;EACjE,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,eAAe,SAAS,YAAY,EAAE,EACjD,CAAC;CACH;;;;;;;;CASA,MAAM,iBACJ,SACA,OACA,cACA,eACwB;EACxB,MAAM,kBAAkB,MAAM,YAAY;EAI1C,IAAI,MADmB,KAAK,YAAY,eAAe,GAErD,MAAM,IAAI,MAAM,4CAA4C,OAAO;EAIrE,MAAM,UAAU,qBAAqB;EAGrC,MAAM,YAAY,eAAe,QAAQ,SAAS,YAAY;EAG9D,MAAM,WACJ,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;EAG7D,MAAM,WAAW,IAAI,cAAc;GACjC,GAAG,KAAK;GACR,WAAW,QAAQ;GACnB,QAAQ,QAAQ;GAChB,kBAAkB,UAAU;GAC5B,cAAc,UAAU;GACxB,eAAe,UAAU;GACzB,OAAO;GACP,eAAe;EACjB,CAAC;EAED,MAAM,SAAS,WAAW;EAC1B,MAAM,SAAS,KAAK;EAEpB,OAAO;CACT;;;;CAKA,MAAM,cACJ,SACA,WAQwB;EAGxB,IAAI,MADyB,KAAK,aAAa,UAAU,MAAM,GAE7D,MAAM,IAAI,MAAM,oDAAoD;EAKtE,IAAI,MADwB,KAAK,YAAY,UAAU,KAAK,GAE1D,MAAM,IAAI,MAAM,+CAA+C;EAGjE,MAAM,WAAW,IAAI,cAAc;GACjC,GAAG,KAAK;GACR,WAAW,QAAQ;GACnB,QAAQ,UAAU;GAClB,kBAAkB,UAAU;GAC5B,cAAc,UAAU;GACxB,eAAe,UAAU;GACzB,OAAO,UAAU,MAAM,YAAY;GACnC,eACE,UAAU,eAAe,YAAY,KACrC,UAAU,MAAM,YAAY,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE;EAC7C,CAAC;EAED,MAAM,SAAS,WAAW;EAC1B,MAAM,SAAS,KAAK;EAEpB,OAAO;CACT;;;;CAKA,MAAM,kBAAkB,WAAmB,QAAkC;EAC3E,MAAM,WAAW,MAAM,KAAK,QAAQ,EAClC,OAAO;GAAE;GAAW;EAAO,EAC7B,CAAC;EAED,IAAI,UAAU;GACZ,MAAM,SAAS,OAAO;GACtB,OAAO;EACT;EACA,OAAO;CACT;;;;;CAMA,MAAM,iBAAiB,UAA2C;EAChE,MAAM,QAAQ,WAAW,EAAE,eAAe,SAAS,YAAY,EAAE,IAAI,CAAC;EAEtE,MAAM,aAAa,MAAM,KAAK,KAAK,EACjC,MAIF,CAAC;EAED,MAAM,QAAgC,CAAC;EACvC,KAAA,MAAW,YAAY,YACrB,IAAI,SAAS,iBAAiB,SAAS,QACrC,MAAM,SAAS,iBAAiB,SAAS;EAI7C,OAAO,EAAE,MAAM;CACjB;;;;CAKA,MAAM,iBAAiB,UAAoC;EAEzD,OAAO,MADgB,KAAK,YAAY,QAAQ,MAC5B;CACtB;;;;CAKA,MAAM,oBACJ,UACA,aACwB;EACxB,MAAM,qBAAqB,YAAY,YAAY;EAGnD,MAAM,WAAW,MAAM,KAAK,YAAY,kBAAkB;EAC1D,IAAI,YAAY,SAAS,OAAO,SAAS,IACvC,MAAM,IAAI,MAAM,oBAAoB,YAAW,mBAAoB;EAGrE,SAAS,gBAAgB;EACzB,MAAM,SAAS,KAAK;EAEpB,OAAO;CACT;AACF"}

package/dist/chunks/{OidcIdentity-CFbUlB_Z.js → OidcIdentity-DANnAbfU.js}

@@ -35,7 +35,7 @@ var OidcIdentity = class extends SmrtObject {
 	* Find identity by issuer and subject
 	*/
 	static async findBySubject(issuer, subject, options = {}) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(options)).findBySubject(issuer, subject);
 	}
 	/** Build the collision-free natural key for one OIDC issuer subject. */
@@ -58,7 +58,7 @@ var OidcIdentity = class extends SmrtObject {
 	static async findOrCreate(profile, oidcData, options = {}) {
 		const profileId = profile.id;
 		if (typeof profileId !== "string" || !profileId) throw new Error("OidcIdentity.findOrCreate() requires a saved Profile.");
-		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-BpkxPkz7.js").then((n) => n.i);
+		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-DusCiNZo.js").then((n) => n.i);
 		const profileOptions = profile.options ?? {};
 		return (await reuseExistingOidcIdentityForProfile(profileId, {
 			email: oidcData.email,
@@ -108,4 +108,4 @@ OidcIdentity = __decorateClass([smrt({
 //#endregion
 export { OidcIdentity as t };
 
-//# sourceMappingURL=OidcIdentity-CFbUlB_Z.js.map
+//# sourceMappingURL=OidcIdentity-DANnAbfU.js.map

package/dist/chunks/{OidcIdentity-CFbUlB_Z.js.map → OidcIdentity-DANnAbfU.js.map}

@@ -1 +1 @@
-{"version":3,"file":"OidcIdentity-CFbUlB_Z.js","names":[],"sources":["../../src/models/OidcIdentity.ts"],"sourcesContent":["/**\n * OidcIdentity - Links OIDC provider identities to Profile\n *\n * Stores the mapping between external OIDC providers (Keycloak, Google, GitHub)\n * and internal Profile records. Multiple identities can link to a single profile.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface OidcIdentityOptions extends SmrtObjectOptions {\n  profileId?: string;\n  provider?: string;\n  issuer?: string;\n  subject?: string;\n  email?: string;\n  lastUsedAt?: Date | null;\n}\n\n@smrt({\n  tableName: 'oidc_identities',\n  // Identity linking is an authentication authority change. Generated routes\n  // authenticate callers but do not authorize Profile ownership, so mutations\n  // must stay behind the trusted provisioning APIs below.\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list', 'get'] },\n})\nexport class OidcIdentity extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Provider name (e.g., 'keycloak', 'google', 'github')\n   */\n  @field({ type: 'text' })\n  provider: string = '';\n\n  /**\n   * OIDC issuer URL (e.g., https://keycloak.example.com/realms/bmp)\n   */\n  @field({ type: 'text', indexed: true })\n  issuer: string = '';\n\n  /**\n   * OIDC subject claim - unique identifier from the provider\n   */\n  @field({ type: 'text', indexed: true })\n  subject: string = '';\n\n  /**\n   * Stable issuer+subject key used as the database race arbiter.\n   *\n   * Nullable for legacy rows; every newly linked or reused identity backfills\n   * it. A separate unique constraint makes concurrent first login fail with a\n   * retryable conflict instead of creating two identities.\n   */\n  @field({ type: 'text', nullable: true, unique: true, readonly: true })\n  identityKey: string | null = null;\n\n  /**\n   * Cached email from the IdP (for display/lookup)\n   */\n  @field({ type: 'text' })\n  email: string = '';\n\n  /**\n   * Last time this identity was used for authentication\n   */\n  @field({ type: 'datetime', nullable: true })\n  lastUsedAt: Date | null = null;\n\n  constructor(options: OidcIdentityOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.provider) this.provider = options.provider;\n    if (options.issuer) this.issuer = options.issuer;\n    if (options.subject) this.subject = options.subject;\n    if (options.email) this.email = options.email;\n    if (options.lastUsedAt !== undefined) this.lastUsedAt = options.lastUsedAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  static async findBySubject(\n    issuer: string,\n    subject: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity | null> {\n    const { OidcIdentityCollection } = await import(\n      '../collections/OidcIdentityCollection'\n    );\n    const collection = await OidcIdentityCollection.create(options);\n    return await collection.findBySubject(issuer, subject);\n  }\n\n  /** Build the collision-free natural key for one OIDC issuer subject. */\n  static buildIdentityKey(issuer: string, subject: string): string {\n    return JSON.stringify([issuer, subject]);\n  }\n\n  /** Keep the durable key derived from its natural-key source fields. */\n  override async save(): Promise<this> {\n    this.identityKey =\n      this.issuer.trim() && this.subject.trim()\n        ? OidcIdentity.buildIdentityKey(this.issuer, this.subject)\n        : null;\n    return super.save();\n  }\n\n  /**\n   * Reuse an existing exact identity for its unchanged Profile.\n   *\n   * @deprecated Authentication links must be created through transactional\n   * provisioning. This compatibility method only refreshes a unique mapping\n   * that already belongs to the supplied Profile, including legacy Profile\n   * types, and deliberately refuses to create or rebind authority.\n   */\n  static async findOrCreate(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity> {\n    const profileId = profile.id;\n    if (typeof profileId !== 'string' || !profileId) {\n      throw new Error('OidcIdentity.findOrCreate() requires a saved Profile.');\n    }\n    const { reuseExistingOidcIdentityForProfile } = await import(\n      '../auth/resolveIdentity'\n    );\n    const profileOptions = profile.options ?? {};\n    const result = await reuseExistingOidcIdentityForProfile(\n      profileId,\n      {\n        email: oidcData.email,\n        iss: oidcData.issuer,\n        sub: oidcData.subject,\n      },\n      oidcData.provider,\n      {\n        ...profileOptions,\n        ...options,\n        db: options.db ?? profileOptions.db,\n      },\n    );\n    return result.oidcIdentity;\n  }\n\n  /**\n   * Record usage of this identity\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n}\n"],"mappings":";;;;;;;;;;AAkCO,IAAM,eAAN,cAA2B,WAAW;CAK3C;CAMA,WAAmB;CAMnB,SAAiB;CAMjB,UAAkB;CAUlB,cAA6B;CAM7B,QAAgB;CAMhB,aAA0B;CAE1B,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,OAAO,KAAK,QAAQ,QAAQ;EACxC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,aAAa,cACX,QACA,SACA,UAA6B,CAAC,GACA;EAC9B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,uBAAuB,OAAO,OAAO,EAAA,CACtC,cAAc,QAAQ,OAAO;CACvD;;CAGA,OAAO,iBAAiB,QAAgB,SAAyB;EAC/D,OAAO,KAAK,UAAU,CAAC,QAAQ,OAAO,CAAC;CACzC;;CAGA,MAAe,OAAsB;EACnC,KAAK,cACH,KAAK,OAAO,KAAK,KAAK,KAAK,QAAQ,KAAK,IACpC,aAAa,iBAAiB,KAAK,QAAQ,KAAK,OAAO,IACvD;EACN,OAAO,MAAM,KAAK;CACpB;;;;;;;;;CAUA,aAAa,aACX,SACA,UAMA,UAA6B,CAAC,GACP;EACvB,MAAM,YAAY,QAAQ;EAC1B,IAAI,OAAO,cAAc,YAAY,CAAC,WACpC,MAAM,IAAI,MAAM,uDAAuD;EAEzE,MAAM,EAAE,wCAAwC,MAAM,OACpD,gCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAEF,MAAM,iBAAiB,QAAQ,WAAW,CAAC;EAe3C,QAAO,MAdc,oCACnB,WACA;GACE,OAAO,SAAS;GAChB,KAAK,SAAS;GACd,KAAK,SAAS;EAChB,GACA,SAAS,UACT;GACE,GAAG;GACH,GAAG;GACH,IAAI,QAAQ,MAAM,eAAe;EACnC,CACF,EAAA,CACc;CAChB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;AACF;AA1IE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAVZ,aAWX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAhB3B,aAiBX,WAAA,UAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAtB3B,aAuBX,WAAA,WAAA,CAAA;AAUA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,UAAU;CAAM,QAAQ;CAAM,UAAU;AAAK,CAAC,CAAA,GAhC1D,aAiCX,WAAA,eAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAtCZ,aAuCX,WAAA,SAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAY,UAAU;AAAK,CAAC,CAAA,GA5ChC,aA6CX,WAAA,cAAA,CAAA;AA7CW,eAAN,gBAAA,CATN,KAAK;CACJ,WAAW;CAIX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;AAClC,CAAC,CAAA,GACY,YAAA"}
+{"version":3,"file":"OidcIdentity-DANnAbfU.js","names":[],"sources":["../../src/models/OidcIdentity.ts"],"sourcesContent":["/**\n * OidcIdentity - Links OIDC provider identities to Profile\n *\n * Stores the mapping between external OIDC providers (Keycloak, Google, GitHub)\n * and internal Profile records. Multiple identities can link to a single profile.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface OidcIdentityOptions extends SmrtObjectOptions {\n  profileId?: string;\n  provider?: string;\n  issuer?: string;\n  subject?: string;\n  email?: string;\n  lastUsedAt?: Date | null;\n}\n\n@smrt({\n  tableName: 'oidc_identities',\n  // Identity linking is an authentication authority change. Generated routes\n  // authenticate callers but do not authorize Profile ownership, so mutations\n  // must stay behind the trusted provisioning APIs below.\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list', 'get'] },\n})\nexport class OidcIdentity extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Provider name (e.g., 'keycloak', 'google', 'github')\n   */\n  @field({ type: 'text' })\n  provider: string = '';\n\n  /**\n   * OIDC issuer URL (e.g., https://keycloak.example.com/realms/bmp)\n   */\n  @field({ type: 'text', indexed: true })\n  issuer: string = '';\n\n  /**\n   * OIDC subject claim - unique identifier from the provider\n   */\n  @field({ type: 'text', indexed: true })\n  subject: string = '';\n\n  /**\n   * Stable issuer+subject key used as the database race arbiter.\n   *\n   * Nullable for legacy rows; every newly linked or reused identity backfills\n   * it. A separate unique constraint makes concurrent first login fail with a\n   * retryable conflict instead of creating two identities.\n   */\n  @field({ type: 'text', nullable: true, unique: true, readonly: true })\n  identityKey: string | null = null;\n\n  /**\n   * Cached email from the IdP (for display/lookup)\n   */\n  @field({ type: 'text' })\n  email: string = '';\n\n  /**\n   * Last time this identity was used for authentication\n   */\n  @field({ type: 'datetime', nullable: true })\n  lastUsedAt: Date | null = null;\n\n  constructor(options: OidcIdentityOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.provider) this.provider = options.provider;\n    if (options.issuer) this.issuer = options.issuer;\n    if (options.subject) this.subject = options.subject;\n    if (options.email) this.email = options.email;\n    if (options.lastUsedAt !== undefined) this.lastUsedAt = options.lastUsedAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  static async findBySubject(\n    issuer: string,\n    subject: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity | null> {\n    const { OidcIdentityCollection } = await import(\n      '../collections/OidcIdentityCollection'\n    );\n    const collection = await OidcIdentityCollection.create(options);\n    return await collection.findBySubject(issuer, subject);\n  }\n\n  /** Build the collision-free natural key for one OIDC issuer subject. */\n  static buildIdentityKey(issuer: string, subject: string): string {\n    return JSON.stringify([issuer, subject]);\n  }\n\n  /** Keep the durable key derived from its natural-key source fields. */\n  override async save(): Promise<this> {\n    this.identityKey =\n      this.issuer.trim() && this.subject.trim()\n        ? OidcIdentity.buildIdentityKey(this.issuer, this.subject)\n        : null;\n    return super.save();\n  }\n\n  /**\n   * Reuse an existing exact identity for its unchanged Profile.\n   *\n   * @deprecated Authentication links must be created through transactional\n   * provisioning. This compatibility method only refreshes a unique mapping\n   * that already belongs to the supplied Profile, including legacy Profile\n   * types, and deliberately refuses to create or rebind authority.\n   */\n  static async findOrCreate(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity> {\n    const profileId = profile.id;\n    if (typeof profileId !== 'string' || !profileId) {\n      throw new Error('OidcIdentity.findOrCreate() requires a saved Profile.');\n    }\n    const { reuseExistingOidcIdentityForProfile } = await import(\n      '../auth/resolveIdentity'\n    );\n    const profileOptions = profile.options ?? {};\n    const result = await reuseExistingOidcIdentityForProfile(\n      profileId,\n      {\n        email: oidcData.email,\n        iss: oidcData.issuer,\n        sub: oidcData.subject,\n      },\n      oidcData.provider,\n      {\n        ...profileOptions,\n        ...options,\n        db: options.db ?? profileOptions.db,\n      },\n    );\n    return result.oidcIdentity;\n  }\n\n  /**\n   * Record usage of this identity\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n}\n"],"mappings":";;;;;;;;;;AAkCO,IAAM,eAAN,cAA2B,WAAW;CAK3C;CAMA,WAAmB;CAMnB,SAAiB;CAMjB,UAAkB;CAUlB,cAA6B;CAM7B,QAAgB;CAMhB,aAA0B;CAE1B,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,OAAO,KAAK,QAAQ,QAAQ;EACxC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,aAAa,cACX,QACA,SACA,UAA6B,CAAC,GACA;EAC9B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,uBAAuB,OAAO,OAAO,EAAA,CACtC,cAAc,QAAQ,OAAO;CACvD;;CAGA,OAAO,iBAAiB,QAAgB,SAAyB;EAC/D,OAAO,KAAK,UAAU,CAAC,QAAQ,OAAO,CAAC;CACzC;;CAGA,MAAe,OAAsB;EACnC,KAAK,cACH,KAAK,OAAO,KAAK,KAAK,KAAK,QAAQ,KAAK,IACpC,aAAa,iBAAiB,KAAK,QAAQ,KAAK,OAAO,IACvD;EACN,OAAO,MAAM,KAAK;CACpB;;;;;;;;;CAUA,aAAa,aACX,SACA,UAMA,UAA6B,CAAC,GACP;EACvB,MAAM,YAAY,QAAQ;EAC1B,IAAI,OAAO,cAAc,YAAY,CAAC,WACpC,MAAM,IAAI,MAAM,uDAAuD;EAEzE,MAAM,EAAE,wCAAwC,MAAM,OACpD,gCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAEF,MAAM,iBAAiB,QAAQ,WAAW,CAAC;EAe3C,QAAO,MAdc,oCACnB,WACA;GACE,OAAO,SAAS;GAChB,KAAK,SAAS;GACd,KAAK,SAAS;EAChB,GACA,SAAS,UACT;GACE,GAAG;GACH,GAAG;GACH,IAAI,QAAQ,MAAM,eAAe;EACnC,CACF,EAAA,CACc;CAChB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;AACF;AA1IE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAVZ,aAWX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAhB3B,aAiBX,WAAA,UAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAtB3B,aAuBX,WAAA,WAAA,CAAA;AAUA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,UAAU;CAAM,QAAQ;CAAM,UAAU;AAAK,CAAC,CAAA,GAhC1D,aAiCX,WAAA,eAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAtCZ,aAuCX,WAAA,SAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAY,UAAU;AAAK,CAAC,CAAA,GA5ChC,aA6CX,WAAA,cAAA,CAAA;AA7CW,eAAN,gBAAA,CATN,KAAK;CACJ,WAAW;CAIX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;AAClC,CAAC,CAAA,GACY,YAAA"}

package/dist/chunks/{OidcIdentityCollection-BLxSaqJT.js → OidcIdentityCollection-eSM4gzHL.js}

@@ -1,5 +1,5 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { t as OidcIdentity } from "./OidcIdentity-CFbUlB_Z.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { t as OidcIdentity } from "./OidcIdentity-DANnAbfU.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/OidcIdentityCollection.ts
 var OidcIdentityCollection_exports = /* @__PURE__ */ __exportAll({
@@ -73,4 +73,4 @@ var OidcIdentityCollection = class extends SmrtCollection {
 //#endregion
 export { OidcIdentityCollection as n, OidcIdentityCollection_exports as r, AmbiguousOidcIdentityError as t };
 
-//# sourceMappingURL=OidcIdentityCollection-BLxSaqJT.js.map
+//# sourceMappingURL=OidcIdentityCollection-eSM4gzHL.js.map

package/dist/chunks/{OidcIdentityCollection-BLxSaqJT.js.map → OidcIdentityCollection-eSM4gzHL.js.map}

@@ -1 +1 @@
-{"version":3,"file":"OidcIdentityCollection-BLxSaqJT.js","names":[],"sources":["../../src/collections/OidcIdentityCollection.ts"],"sourcesContent":["/**\n * OidcIdentityCollection - Collection for managing OIDC identity records\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\n\n/** More than one legacy row maps the same opaque OIDC issuer and subject. */\nexport class AmbiguousOidcIdentityError extends Error {\n  constructor(\n    readonly issuer: string,\n    readonly subject: string,\n  ) {\n    super('Multiple OIDC identities match the same issuer and subject.');\n    this.name = 'AmbiguousOidcIdentityError';\n  }\n}\n\nexport class OidcIdentityCollection extends SmrtCollection<OidcIdentity> {\n  static readonly _itemClass = OidcIdentity;\n\n  /**\n   * Find identities for a profile\n   */\n  async findByProfile(profileId: string): Promise<OidcIdentity[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  async findBySubject(\n    issuer: string,\n    subject: string,\n  ): Promise<OidcIdentity | null> {\n    const matches = await this.list({\n      where: { issuer, subject },\n      limit: 2,\n    });\n    if (matches.length > 1) {\n      throw new AmbiguousOidcIdentityError(issuer, subject);\n    }\n    return matches[0] ?? null;\n  }\n\n  /**\n   * Find identities by provider\n   */\n  async findByProvider(provider: string): Promise<OidcIdentity[]> {\n    return await this.list({\n      where: { provider },\n    });\n  }\n\n  /**\n   * Reuse an existing exact OIDC identity for its unchanged Profile.\n   *\n   * @deprecated New authentication links require the owner-aware,\n   * transactional provisioning APIs. This compatibility helper may refresh a\n   * legacy Profile type, but refuses to create or rebind authority.\n   */\n  async linkToProfile(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n  ): Promise<OidcIdentity> {\n    return OidcIdentity.findOrCreate(profile, oidcData, this.options);\n  }\n\n  /**\n   * Unlink an OIDC identity from a profile\n   */\n  async unlinkFromProfile(\n    profileId: string,\n    issuer: string,\n    subject: string,\n  ): Promise<boolean> {\n    const identity = await this.findOne({\n      where: { profileId, issuer, subject },\n    });\n\n    if (identity) {\n      await identity.delete();\n      return true;\n    }\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;AASO,IAAM,6BAAN,cAAyC,MAAM;CACpD,YACW,QACA,SACT;EACA,MAAM,6DAA6D;EAH1D,KAAA,SAAA;EACA,KAAA,UAAA;EAGT,KAAK,OAAO;CACd;CALW;CACA;AAKb;AAEO,IAAM,yBAAN,cAAqC,eAA6B;CACvE,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAA4C;EAC9D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,cACJ,QACA,SAC8B;EAC9B,MAAM,UAAU,MAAM,KAAK,KAAK;GAC9B,OAAO;IAAE;IAAQ;GAAQ;GACzB,OAAO;EACT,CAAC;EACD,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,2BAA2B,QAAQ,OAAO;EAEtD,OAAO,QAAQ,MAAM;CACvB;;;;CAKA,MAAM,eAAe,UAA2C;EAC9D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,SAAS,EACpB,CAAC;CACH;;;;;;;;CASA,MAAM,cACJ,SACA,UAMuB;EACvB,OAAO,aAAa,aAAa,SAAS,UAAU,KAAK,OAAO;CAClE;;;;CAKA,MAAM,kBACJ,WACA,QACA,SACkB;EAClB,MAAM,WAAW,MAAM,KAAK,QAAQ,EAClC,OAAO;GAAE;GAAW;GAAQ;EAAQ,EACtC,CAAC;EAED,IAAI,UAAU;GACZ,MAAM,SAAS,OAAO;GACtB,OAAO;EACT;EACA,OAAO;CACT;AACF"}
+{"version":3,"file":"OidcIdentityCollection-eSM4gzHL.js","names":[],"sources":["../../src/collections/OidcIdentityCollection.ts"],"sourcesContent":["/**\n * OidcIdentityCollection - Collection for managing OIDC identity records\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\n\n/** More than one legacy row maps the same opaque OIDC issuer and subject. */\nexport class AmbiguousOidcIdentityError extends Error {\n  constructor(\n    readonly issuer: string,\n    readonly subject: string,\n  ) {\n    super('Multiple OIDC identities match the same issuer and subject.');\n    this.name = 'AmbiguousOidcIdentityError';\n  }\n}\n\nexport class OidcIdentityCollection extends SmrtCollection<OidcIdentity> {\n  static readonly _itemClass = OidcIdentity;\n\n  /**\n   * Find identities for a profile\n   */\n  async findByProfile(profileId: string): Promise<OidcIdentity[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  async findBySubject(\n    issuer: string,\n    subject: string,\n  ): Promise<OidcIdentity | null> {\n    const matches = await this.list({\n      where: { issuer, subject },\n      limit: 2,\n    });\n    if (matches.length > 1) {\n      throw new AmbiguousOidcIdentityError(issuer, subject);\n    }\n    return matches[0] ?? null;\n  }\n\n  /**\n   * Find identities by provider\n   */\n  async findByProvider(provider: string): Promise<OidcIdentity[]> {\n    return await this.list({\n      where: { provider },\n    });\n  }\n\n  /**\n   * Reuse an existing exact OIDC identity for its unchanged Profile.\n   *\n   * @deprecated New authentication links require the owner-aware,\n   * transactional provisioning APIs. This compatibility helper may refresh a\n   * legacy Profile type, but refuses to create or rebind authority.\n   */\n  async linkToProfile(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n  ): Promise<OidcIdentity> {\n    return OidcIdentity.findOrCreate(profile, oidcData, this.options);\n  }\n\n  /**\n   * Unlink an OIDC identity from a profile\n   */\n  async unlinkFromProfile(\n    profileId: string,\n    issuer: string,\n    subject: string,\n  ): Promise<boolean> {\n    const identity = await this.findOne({\n      where: { profileId, issuer, subject },\n    });\n\n    if (identity) {\n      await identity.delete();\n      return true;\n    }\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;AASO,IAAM,6BAAN,cAAyC,MAAM;CACpD,YACW,QACA,SACT;EACA,MAAM,6DAA6D;EAH1D,KAAA,SAAA;EACA,KAAA,UAAA;EAGT,KAAK,OAAO;CACd;CALW;CACA;AAKb;AAEO,IAAM,yBAAN,cAAqC,eAA6B;CACvE,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAA4C;EAC9D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,cACJ,QACA,SAC8B;EAC9B,MAAM,UAAU,MAAM,KAAK,KAAK;GAC9B,OAAO;IAAE;IAAQ;GAAQ;GACzB,OAAO;EACT,CAAC;EACD,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,2BAA2B,QAAQ,OAAO;EAEtD,OAAO,QAAQ,MAAM;CACvB;;;;CAKA,MAAM,eAAe,UAA2C;EAC9D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,SAAS,EACpB,CAAC;CACH;;;;;;;;CASA,MAAM,cACJ,SACA,UAMuB;EACvB,OAAO,aAAa,aAAa,SAAS,UAAU,KAAK,OAAO;CAClE;;;;CAKA,MAAM,kBACJ,WACA,QACA,SACkB;EAClB,MAAM,WAAW,MAAM,KAAK,QAAQ,EAClC,OAAO;GAAE;GAAW;GAAQ;EAAQ,EACtC,CAAC;EAED,IAAI,UAAU;GACZ,MAAM,SAAS,OAAO;GACtB,OAAO;EACT;EACA,OAAO;CACT;AACF"}

package/dist/chunks/{ProfileAssetCollection-FhW8q7_1.js → ProfileAssetCollection-A_PpEaDq.js}

@@ -1,4 +1,4 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
 import { SmrtJunction, SmrtObject, crossPackageRef, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 import { addOwnedAssetFromCollection, getOwnedAssetsFromCollection, removeOwnedAssetFromCollection } from "@happyvertical/smrt-assets";
@@ -66,7 +66,7 @@ var ProfileAssetCollection = class extends SmrtJunction {
 	profileCollectionPromise = null;
 	async getProfileCollection() {
 		if (!this.profileCollectionPromise) {
-			const { ProfileCollection } = await import("./ProfileCollection-DdJ3W4GG.js").then((n) => n.r);
+			const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 			this.profileCollectionPromise = ProfileCollection.create({ db: this.db });
 		}
 		return this.profileCollectionPromise;
@@ -90,4 +90,4 @@ ProfileAssetCollection = __decorateClass([smrt({
 //#endregion
 export { ProfileAssetCollection_exports as n, ProfileAsset as r, ProfileAssetCollection as t };
 
-//# sourceMappingURL=ProfileAssetCollection-FhW8q7_1.js.map
+//# sourceMappingURL=ProfileAssetCollection-A_PpEaDq.js.map

package/dist/chunks/{ProfileAssetCollection-FhW8q7_1.js.map → ProfileAssetCollection-A_PpEaDq.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ProfileAssetCollection-FhW8q7_1.js","names":[],"sources":["../../src/models/ProfileAsset.ts","../../src/collections/ProfileAssetCollection.ts"],"sourcesContent":["import type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  field,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\n\nexport interface ProfileAssetOptions extends SmrtObjectOptions {\n  profileId?: string;\n  assetId?: string;\n  relationship?: string;\n  sortOrder?: number;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional' })\n@smrt({\n  tableName: 'profile_assets',\n  conflictColumns: ['profile_id', 'asset_id', 'relationship'],\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAsset extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  @foreignKey('Profile', { required: true })\n  profileId = '';\n\n  @crossPackageRef('@happyvertical/smrt-assets:Asset', { required: true })\n  assetId = '';\n\n  @field({ required: true })\n  relationship = 'attachment';\n\n  @field()\n  sortOrder = 0;\n\n  constructor(options: ProfileAssetOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.assetId) this.assetId = options.assetId;\n    if (options.relationship) this.relationship = options.relationship;\n    if (options.sortOrder !== undefined) this.sortOrder = options.sortOrder;\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n  }\n}\n","import type { Asset } from '@happyvertical/smrt-assets';\nimport {\n  addOwnedAssetFromCollection,\n  getOwnedAssetsFromCollection,\n  removeOwnedAssetFromCollection,\n} from '@happyvertical/smrt-assets';\nimport type { SmrtCollectionOptions } from '@happyvertical/smrt-core';\nimport { SmrtJunction, smrt } from '@happyvertical/smrt-core';\nimport { ProfileAsset } from '../models/ProfileAsset';\nimport type { ProfileCollection } from './ProfileCollection';\n\nexport interface ProfileAssetCollectionOptions extends SmrtCollectionOptions {}\n\n@smrt({\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAssetCollection extends SmrtJunction<ProfileAsset> {\n  static readonly _itemClass = ProfileAsset;\n  protected leftField = 'profileId';\n  protected rightField = 'assetId';\n\n  private profileCollectionPromise: Promise<ProfileCollection> | null = null;\n\n  private async getProfileCollection(): Promise<ProfileCollection> {\n    if (!this.profileCollectionPromise) {\n      const { ProfileCollection } = await import('./ProfileCollection');\n      this.profileCollectionPromise = ProfileCollection.create({ db: this.db });\n    }\n\n    return this.profileCollectionPromise;\n  }\n\n  async getAssets(profileId: string, relationship?: string): Promise<Asset[]> {\n    return getOwnedAssetsFromCollection(\n      await this.getProfileCollection(),\n      profileId,\n      relationship,\n    );\n  }\n\n  async addAsset(\n    profileId: string,\n    asset: Asset,\n    relationship = 'attachment',\n    sortOrder = 0,\n  ): Promise<void> {\n    await addOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      asset,\n      relationship,\n      sortOrder,\n    );\n  }\n\n  async removeAsset(\n    profileId: string,\n    assetId: string,\n    relationship?: string,\n  ): Promise<void> {\n    await removeOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      assetId,\n      relationship,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BO,IAAM,eAAN,cAA2B,WAAW;CAE3C,WAA0B;CAG1B,YAAY;CAGZ,UAAU;CAGV,eAAe;CAGf,YAAY;CAEZ,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;AACF;AAtBE,kBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,aAEX,WAAA,YAAA,CAAA;AAGA,kBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAGA,kBAAA,CADC,gBAAgB,oCAAoC,EAAE,UAAU,KAAK,CAAC,CAAA,GAP5D,aAQX,WAAA,WAAA,CAAA;AAGA,kBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GAVd,aAWX,WAAA,gBAAA,CAAA;AAGA,kBAAA,CADC,MAAM,CAAA,GAbI,aAcX,WAAA,aAAA,CAAA;AAdW,eAAN,kBAAA,CARN,aAAa,EAAE,MAAM,WAAW,CAAC,GACjC,KAAK;CACJ,WAAW;CACX,iBAAiB;EAAC;EAAc;EAAY;CAAc;CAC1D,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,YAAA;;;;;;;;;;;;;;;;;;;ACRN,IAAM,yBAAN,cAAqC,aAA2B;CAE3D,YAAY;CACZ,aAAa;CAEf,2BAA8D;CAEtE,MAAc,uBAAmD;EAC/D,IAAI,CAAC,KAAK,0BAA0B;GAClC,MAAM,EAAE,sBAAsB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAC3C,KAAK,2BAA2B,kBAAkB,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC;EAC1E;EAEA,OAAO,KAAK;CACd;CAEA,MAAM,UAAU,WAAmB,cAAyC;EAC1E,OAAO,6BACL,MAAM,KAAK,qBAAqB,GAChC,WACA,YACF;CACF;CAEA,MAAM,SACJ,WACA,OACA,eAAe,cACf,YAAY,GACG;EACf,MAAM,4BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,OACA,cACA,SACF;CACF;CAEA,MAAM,YACJ,WACA,SACA,cACe;EACf,MAAM,+BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,SACA,YACF;CACF;AACF;AApDE,cADW,wBACK,cAAa,YAAA;AADlB,yBAAN,gBAAA,CALN,KAAK;CACJ,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,sBAAA"}
+{"version":3,"file":"ProfileAssetCollection-A_PpEaDq.js","names":[],"sources":["../../src/models/ProfileAsset.ts","../../src/collections/ProfileAssetCollection.ts"],"sourcesContent":["import type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  field,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\n\nexport interface ProfileAssetOptions extends SmrtObjectOptions {\n  profileId?: string;\n  assetId?: string;\n  relationship?: string;\n  sortOrder?: number;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional' })\n@smrt({\n  tableName: 'profile_assets',\n  conflictColumns: ['profile_id', 'asset_id', 'relationship'],\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAsset extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  @foreignKey('Profile', { required: true })\n  profileId = '';\n\n  @crossPackageRef('@happyvertical/smrt-assets:Asset', { required: true })\n  assetId = '';\n\n  @field({ required: true })\n  relationship = 'attachment';\n\n  @field()\n  sortOrder = 0;\n\n  constructor(options: ProfileAssetOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.assetId) this.assetId = options.assetId;\n    if (options.relationship) this.relationship = options.relationship;\n    if (options.sortOrder !== undefined) this.sortOrder = options.sortOrder;\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n  }\n}\n","import type { Asset } from '@happyvertical/smrt-assets';\nimport {\n  addOwnedAssetFromCollection,\n  getOwnedAssetsFromCollection,\n  removeOwnedAssetFromCollection,\n} from '@happyvertical/smrt-assets';\nimport type { SmrtCollectionOptions } from '@happyvertical/smrt-core';\nimport { SmrtJunction, smrt } from '@happyvertical/smrt-core';\nimport { ProfileAsset } from '../models/ProfileAsset';\nimport type { ProfileCollection } from './ProfileCollection';\n\nexport interface ProfileAssetCollectionOptions extends SmrtCollectionOptions {}\n\n@smrt({\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAssetCollection extends SmrtJunction<ProfileAsset> {\n  static readonly _itemClass = ProfileAsset;\n  protected leftField = 'profileId';\n  protected rightField = 'assetId';\n\n  private profileCollectionPromise: Promise<ProfileCollection> | null = null;\n\n  private async getProfileCollection(): Promise<ProfileCollection> {\n    if (!this.profileCollectionPromise) {\n      const { ProfileCollection } = await import('./ProfileCollection');\n      this.profileCollectionPromise = ProfileCollection.create({ db: this.db });\n    }\n\n    return this.profileCollectionPromise;\n  }\n\n  async getAssets(profileId: string, relationship?: string): Promise<Asset[]> {\n    return getOwnedAssetsFromCollection(\n      await this.getProfileCollection(),\n      profileId,\n      relationship,\n    );\n  }\n\n  async addAsset(\n    profileId: string,\n    asset: Asset,\n    relationship = 'attachment',\n    sortOrder = 0,\n  ): Promise<void> {\n    await addOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      asset,\n      relationship,\n      sortOrder,\n    );\n  }\n\n  async removeAsset(\n    profileId: string,\n    assetId: string,\n    relationship?: string,\n  ): Promise<void> {\n    await removeOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      assetId,\n      relationship,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BO,IAAM,eAAN,cAA2B,WAAW;CAE3C,WAA0B;CAG1B,YAAY;CAGZ,UAAU;CAGV,eAAe;CAGf,YAAY;CAEZ,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;AACF;AAtBE,kBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,aAEX,WAAA,YAAA,CAAA;AAGA,kBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAGA,kBAAA,CADC,gBAAgB,oCAAoC,EAAE,UAAU,KAAK,CAAC,CAAA,GAP5D,aAQX,WAAA,WAAA,CAAA;AAGA,kBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GAVd,aAWX,WAAA,gBAAA,CAAA;AAGA,kBAAA,CADC,MAAM,CAAA,GAbI,aAcX,WAAA,aAAA,CAAA;AAdW,eAAN,kBAAA,CARN,aAAa,EAAE,MAAM,WAAW,CAAC,GACjC,KAAK;CACJ,WAAW;CACX,iBAAiB;EAAC;EAAc;EAAY;CAAc;CAC1D,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,YAAA;;;;;;;;;;;;;;;;;;;ACRN,IAAM,yBAAN,cAAqC,aAA2B;CAE3D,YAAY;CACZ,aAAa;CAEf,2BAA8D;CAEtE,MAAc,uBAAmD;EAC/D,IAAI,CAAC,KAAK,0BAA0B;GAClC,MAAM,EAAE,sBAAsB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAC3C,KAAK,2BAA2B,kBAAkB,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC;EAC1E;EAEA,OAAO,KAAK;CACd;CAEA,MAAM,UAAU,WAAmB,cAAyC;EAC1E,OAAO,6BACL,MAAM,KAAK,qBAAqB,GAChC,WACA,YACF;CACF;CAEA,MAAM,SACJ,WACA,OACA,eAAe,cACf,YAAY,GACG;EACf,MAAM,4BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,OACA,cACA,SACF;CACF;CAEA,MAAM,YACJ,WACA,SACA,cACe;EACf,MAAM,+BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,SACA,YACF;CACF;AACF;AApDE,cADW,wBACK,cAAa,YAAA;AADlB,yBAAN,gBAAA,CALN,KAAK;CACJ,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,sBAAA"}

package/dist/chunks/{ProfileCollection-DdJ3W4GG.js → ProfileCollection-BsKhR5Dp.js}

@@ -1,5 +1,5 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { SmrtCollection, SmrtObject, ValidationError, field, foreignKey, oneToMany, smrt } from "@happyvertical/smrt-core";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { SmrtCollection, SmrtObject, ValidationError, field, foreignKey, isAbortedTransactionError, oneToMany, smrt } from "@happyvertical/smrt-core";
 import { definePrompt, resolvePrompt } from "@happyvertical/smrt-prompts";
 import { TenantScoped, queryGlobal, queryWithGlobals, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
 import { BackfillTableUnavailableError, BackfillTracker } from "@happyvertical/smrt-core/migrations";
@@ -68,8 +68,8 @@ var SavepointUnavailableError = class extends Error {
 };
 async function coordinateOidcProvisioning(options) {
 	const rootBackfillTableReady = typeof options.db.beginTransaction === "function";
-	if (rootBackfillTableReady) await new BackfillTracker({ db: options.db }).initialize();
 	return withProvisioningLocks(options.db, options.lockKeys, async () => {
+		if (rootBackfillTableReady) await new BackfillTracker({ db: options.db }).initialize();
 		const result = await retryProvisioning(options, () => withProvisioningTransaction(options.db, (tx) => {
 			if (rootBackfillTableReady) BackfillTracker.inheritInitialization(tx, options.db);
 			else BackfillTracker.requireExistingTable(tx);
@@ -84,14 +84,7 @@ async function withProvisioningLocks(db, lockKeys, callback) {
 	return acquire(0);
 }
 function isOidcAbortedTransactionError(error) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current instanceof Error && !seen.has(current)) {
-		seen.add(current);
-		if (/current transaction is aborted|transaction.*aborted/iu.test(current.message)) return true;
-		current = current.cause;
-	}
-	return false;
+	return isAbortedTransactionError(error);
 }
 function testRaceMessagePattern(pattern, message) {
 	pattern.lastIndex = 0;
@@ -455,8 +448,8 @@ var Profile = class extends SmrtObject {
 	* @param value - The value to set
 	*/
 	async addMetadata(metafieldSlug, value) {
-		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CACMY1hl.js").then((n) => n.n);
-		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-loKVv_pj.js").then((n) => n.n);
+		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CM374Dbh.js").then((n) => n.n);
+		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-Ceq-QV-1.js").then((n) => n.n);
 		const metafield = await (await ProfileMetafieldCollection.create(this.options)).getBySlug(metafieldSlug);
 		if (!metafield) throw new Error(`Metafield '${metafieldSlug}' not found`);
 		await metafield.validateValue(value);
@@ -487,7 +480,7 @@ var Profile = class extends SmrtObject {
 	* @returns Object with metafield slugs as keys
 	*/
 	async getMetadata() {
-		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-loKVv_pj.js").then((n) => n.n);
+		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-Ceq-QV-1.js").then((n) => n.n);
 		return await (await ProfileMetadataCollection.create(this.options)).getMetadataObject(this.id);
 	}
 	/**
@@ -504,8 +497,8 @@ var Profile = class extends SmrtObject {
 	* @param metafieldSlug - The slug of the metafield to remove
 	*/
 	async removeMetadata(metafieldSlug) {
-		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CACMY1hl.js").then((n) => n.n);
-		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-loKVv_pj.js").then((n) => n.n);
+		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CM374Dbh.js").then((n) => n.n);
+		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-Ceq-QV-1.js").then((n) => n.n);
 		const metafield = await (await ProfileMetafieldCollection.create(this.options)).getBySlug(metafieldSlug);
 		if (!metafield) throw new Error(`Metafield '${metafieldSlug}' not found`);
 		const existing = await (await ProfileMetadataCollection.create(this.options)).list({
@@ -518,7 +511,7 @@ var Profile = class extends SmrtObject {
 		if (existing.length > 0) await existing[0].delete();
 	}
 	async getProfileAssetCollection() {
-		const { ProfileAssetCollection } = await import("./ProfileAssetCollection-FhW8q7_1.js").then((n) => n.n);
+		const { ProfileAssetCollection } = await import("./ProfileAssetCollection-A_PpEaDq.js").then((n) => n.n);
 		return ProfileAssetCollection.create({ db: this.db });
 	}
 	async getAssets(relationship) {
@@ -548,9 +541,9 @@ var Profile = class extends SmrtObject {
 	* @param contextProfile - Optional context profile for tertiary relationships
 	*/
 	async addRelationship(toProfile, relationshipSlug, contextProfile) {
-		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-Bh4xJ4-I.js").then((n) => n.n);
-		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-CzQKfvMy.js").then((n) => n.n);
-		const { ProfileRelationshipType } = await import("./ProfileRelationshipType-BjoaCt-u.js").then((n) => n.n);
+		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-CtoeCpp_.js").then((n) => n.n);
+		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DuPcpzp1.js").then((n) => n.n);
+		const { ProfileRelationshipType } = await import("./ProfileRelationshipType-CZm2X1qY.js").then((n) => n.n);
 		const relationshipType = await (await ProfileRelationshipTypeCollection.create(this.options)).getBySlug(relationshipSlug);
 		if (!relationshipType) throw new Error(`Relationship type '${relationshipSlug}' not found`);
 		const relationshipCollection = await ProfileRelationshipCollection.create(this.options);
@@ -574,8 +567,8 @@ var Profile = class extends SmrtObject {
 	* @returns Array of ProfileRelationship instances
 	*/
 	async getRelationships(options) {
-		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-CzQKfvMy.js").then((n) => n.n);
-		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-Bh4xJ4-I.js").then((n) => n.n);
+		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DuPcpzp1.js").then((n) => n.n);
+		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-CtoeCpp_.js").then((n) => n.n);
 		const relationshipCollection = await ProfileRelationshipCollection.create(this.options);
 		const direction = options?.direction || "all";
 		let typeId;
@@ -618,8 +611,8 @@ var Profile = class extends SmrtObject {
 	* @param relationshipSlug - The type of relationship to remove
 	*/
 	async removeRelationship(toProfile, relationshipSlug) {
-		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-Bh4xJ4-I.js").then((n) => n.n);
-		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-CzQKfvMy.js").then((n) => n.n);
+		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-CtoeCpp_.js").then((n) => n.n);
+		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DuPcpzp1.js").then((n) => n.n);
 		const relationshipType = await (await ProfileRelationshipTypeCollection.create(this.options)).getBySlug(relationshipSlug);
 		if (!relationshipType) throw new Error(`Relationship type '${relationshipSlug}' not found`);
 		const relationshipCollection = await ProfileRelationshipCollection.create(this.options);
@@ -712,7 +705,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of API keys
 	*/
 	async getApiKeys() {
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-CrTjdMz8.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-C6p7XgTz.js").then((n) => n.n);
 		return await (await ApiKeyCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -721,7 +714,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of active API keys
 	*/
 	async getActiveApiKeys() {
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-CrTjdMz8.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-C6p7XgTz.js").then((n) => n.n);
 		return await (await ApiKeyCollection.create(this.options)).findActiveByProfile(this.id);
 	}
 	/**
@@ -731,7 +724,7 @@ var Profile = class extends SmrtObject {
 	* @returns The generated key (plaintext) and ApiKey record
 	*/
 	async generateApiKey(options) {
-		const { ApiKey } = await import("./ApiKey-Br9NGBnr.js").then((n) => n.n);
+		const { ApiKey } = await import("./ApiKey-CMm509C4.js").then((n) => n.n);
 		return await ApiKey.generate(this, {
 			...options,
 			db: this.options?.db
@@ -743,7 +736,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of OIDC identity records
 	*/
 	async getOidcIdentities() {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -756,7 +749,7 @@ var Profile = class extends SmrtObject {
 	* type, but refuses to create or rebind authority.
 	*/
 	async linkOidcIdentity(oidcData) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(this.options)).linkToProfile(this, oidcData);
 	}
 	/**
@@ -765,7 +758,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of Nostr identity records
 	*/
 	async getNostrIdentities() {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BRYUgt47.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BnHZOsUI.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -775,7 +768,7 @@ var Profile = class extends SmrtObject {
 	* @returns The linked Nostr identity record
 	*/
 	async linkNostrIdentity(nostrData) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BRYUgt47.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-BnHZOsUI.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(this.options)).linkToProfile(this, nostrData);
 	}
 	/**
@@ -785,7 +778,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of audit log entries
 	*/
 	async getAuditLogs(limit = 50) {
-		const { AuditLogCollection } = await import("./AuditLogCollection-BBIEI6BD.js").then((n) => n.n);
+		const { AuditLogCollection } = await import("./AuditLogCollection-lJfGFdIQ.js").then((n) => n.n);
 		return await (await AuditLogCollection.create(this.options)).getRecentActivity(this.id, limit);
 	}
 	/**
@@ -795,7 +788,7 @@ var Profile = class extends SmrtObject {
 	* @returns The created audit log entry
 	*/
 	async recordAction(options) {
-		const { AuditLogCollection } = await import("./AuditLogCollection-BBIEI6BD.js").then((n) => n.n);
+		const { AuditLogCollection } = await import("./AuditLogCollection-lJfGFdIQ.js").then((n) => n.n);
 		return await (await AuditLogCollection.create(this.options)).record({
 			profile: this,
 			...options
@@ -804,7 +797,6 @@ var Profile = class extends SmrtObject {
 };
 __decorateClass([tenantId({ nullable: true })], Profile.prototype, "tenantId", 2);
 __decorateClass([foreignKey("ProfileType", { required: true })], Profile.prototype, "typeId", 2);
-__decorateClass([field({ unique: true })], Profile.prototype, "email", 2);
 __decorateClass([field({
 	type: "text",
 	nullable: true,
@@ -1158,4 +1150,4 @@ function readRequiredString(row, key) {
 //#endregion
 export { smrtProfilesGenerateBioPrompt as _, Profile as a, OidcProfileEmailReservation as c, coordinateOidcProvisioning as d, isOidcAbortedTransactionError as f, promptMessageOptions as g, normalizeIdentityEmail as h, OidcProfileEmailReservationCollection as i, PROFILE_EMAIL_KEY_BACKFILL_NAME as l, saveOidcRaceArbiter as m, ProfileCollection as n, ProfileType as o, isOidcProvisioningRaceConflict as p, ProfileCollection_exports as r, ProfileType_exports as s, CanonicalPersonProfileError as t, backfillProfileEmailKeys as u };
 
-//# sourceMappingURL=ProfileCollection-DdJ3W4GG.js.map
+//# sourceMappingURL=ProfileCollection-BsKhR5Dp.js.map