@happyvertical/smrt-profiles 0.40.69 → 0.41.0

package/dist/chunks/{ProfileRelationshipCollection-CzQKfvMy.js → ProfileRelationshipCollection-DuPcpzp1.js}

@@ -1,4 +1,4 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
 import { SmrtCollection, SmrtObject, foreignKey, oneToMany, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 //#region src/models/ProfileRelationship.ts
@@ -41,7 +41,7 @@ var ProfileRelationship = class extends SmrtObject {
 	async addTerm(startedAt, endedAt) {
 		if (!this.id) throw new Error("ProfileRelationship.addTerm requires a persisted relationship (missing id)");
 		const relationshipId = this.id;
-		const { ProfileRelationshipTermCollection } = await import("./ProfileRelationshipTermCollection-DzmU48P6.js").then((n) => n.n);
+		const { ProfileRelationshipTermCollection } = await import("./ProfileRelationshipTermCollection-Bw32vYB8.js").then((n) => n.n);
 		await (await (await ProfileRelationshipTermCollection.create(this.options)).create({
 			relationshipId,
 			startedAt,
@@ -63,7 +63,7 @@ var ProfileRelationship = class extends SmrtObject {
 	* @returns Array of ProfileRelationshipTerm instances
 	*/
 	async getTerms() {
-		const { ProfileRelationshipTermCollection } = await import("./ProfileRelationshipTermCollection-DzmU48P6.js").then((n) => n.n);
+		const { ProfileRelationshipTermCollection } = await import("./ProfileRelationshipTermCollection-Bw32vYB8.js").then((n) => n.n);
 		return await (await ProfileRelationshipTermCollection.create(this.options)).getByRelationship(this.id);
 	}
 	/**
@@ -72,7 +72,7 @@ var ProfileRelationship = class extends SmrtObject {
 	* @returns Current term or null if none active
 	*/
 	async getActiveTerm() {
-		const { ProfileRelationshipTermCollection } = await import("./ProfileRelationshipTermCollection-DzmU48P6.js").then((n) => n.n);
+		const { ProfileRelationshipTermCollection } = await import("./ProfileRelationshipTermCollection-Bw32vYB8.js").then((n) => n.n);
 		return await (await ProfileRelationshipTermCollection.create(this.options)).getActiveTerm(this.id);
 	}
 };
@@ -156,4 +156,4 @@ var ProfileRelationshipCollection = class extends SmrtCollection {
 //#endregion
 export { ProfileRelationshipCollection_exports as n, ProfileRelationship as r, ProfileRelationshipCollection as t };
 
-//# sourceMappingURL=ProfileRelationshipCollection-CzQKfvMy.js.map
+//# sourceMappingURL=ProfileRelationshipCollection-DuPcpzp1.js.map

package/dist/chunks/{ProfileRelationshipCollection-CzQKfvMy.js.map → ProfileRelationshipCollection-DuPcpzp1.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ProfileRelationshipCollection-CzQKfvMy.js","names":[],"sources":["../../src/models/ProfileRelationship.ts","../../src/collections/ProfileRelationshipCollection.ts"],"sourcesContent":["/**\n * ProfileRelationship model - Connects two profiles with a relationship type\n *\n * Represents directional or reciprocal relationships between profiles.\n * Uses UUID primary key with foreign keys to profiles and relationship type.\n */\n\nimport {\n  foreignKey,\n  oneToMany,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { ProfileRelationshipTerm } from './ProfileRelationshipTerm';\n\nexport interface ProfileRelationshipOptions extends SmrtObjectOptions {\n  fromProfileId?: string;\n  toProfileId?: string;\n  typeId?: string;\n  contextProfileId?: string;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional' })\n@smrt({\n  tableStrategy: 'sti',\n  api: { include: ['list', 'get', 'create', 'delete'] },\n  mcp: { include: ['list', 'get'] },\n  cli: true,\n})\nexport class ProfileRelationship extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  // id: UUID (auto-generated by SmrtObject)\n  @foreignKey('Profile', { required: true })\n  fromProfileId?: string; // Origin profile\n\n  @foreignKey('Profile', { required: true })\n  toProfileId?: string; // Target profile\n\n  @foreignKey('ProfileRelationshipType', { required: true })\n  typeId?: string; // Relationship type\n\n  @foreignKey('Profile')\n  contextProfileId?: string; // Optional tertiary context\n\n  // Relationships\n  @oneToMany('ProfileRelationshipTerm')\n  terms: ProfileRelationshipTerm[] = [];\n\n  constructor(options: ProfileRelationshipOptions = {}) {\n    super(options);\n    if (options.fromProfileId !== undefined)\n      this.fromProfileId = options.fromProfileId;\n    if (options.toProfileId !== undefined)\n      this.toProfileId = options.toProfileId;\n    if (options.typeId !== undefined) this.typeId = options.typeId;\n    if (options.contextProfileId !== undefined)\n      this.contextProfileId = options.contextProfileId;\n  }\n\n  /**\n   * Get the relationship type slug\n   *\n   * @returns The slug of the relationship type\n   */\n  async getTypeSlug(): Promise<string> {\n    const type = await this.loadRelated('typeId');\n    return type?.slug || '';\n  }\n\n  /**\n   * Add a term (time period) to this relationship\n   *\n   * @param startedAt - Start date of the term\n   * @param endedAt - Optional end date of the term\n   */\n  async addTerm(startedAt: Date, endedAt?: Date): Promise<void> {\n    if (!this.id) {\n      throw new Error(\n        'ProfileRelationship.addTerm requires a persisted relationship (missing id)',\n      );\n    }\n    const relationshipId = this.id;\n\n    const { ProfileRelationshipTermCollection } = await import(\n      '../collections/ProfileRelationshipTermCollection'\n    );\n\n    const termCollection = await ProfileRelationshipTermCollection.create(\n      this.options,\n    );\n\n    const term = await termCollection.create({\n      relationshipId,\n      startedAt,\n      endedAt,\n    });\n\n    await term.save();\n  }\n\n  /**\n   * End the current active term\n   *\n   * @param endedAt - End date for the term\n   */\n  async endCurrentTerm(endedAt: Date): Promise<void> {\n    const activeTerm = await this.getActiveTerm();\n    if (activeTerm) {\n      await activeTerm.end(endedAt);\n    }\n  }\n\n  /**\n   * Get all terms for this relationship\n   *\n   * @returns Array of ProfileRelationshipTerm instances\n   */\n  async getTerms(): Promise<ProfileRelationshipTerm[]> {\n    const { ProfileRelationshipTermCollection } = await import(\n      '../collections/ProfileRelationshipTermCollection'\n    );\n\n    const termCollection = await ProfileRelationshipTermCollection.create(\n      this.options,\n    );\n\n    return await termCollection.getByRelationship(this.id as string);\n  }\n\n  /**\n   * Get the active term (no end date)\n   *\n   * @returns Current term or null if none active\n   */\n  async getActiveTerm(): Promise<ProfileRelationshipTerm | null> {\n    const { ProfileRelationshipTermCollection } = await import(\n      '../collections/ProfileRelationshipTermCollection'\n    );\n\n    const termCollection = await ProfileRelationshipTermCollection.create(\n      this.options,\n    );\n\n    return await termCollection.getActiveTerm(this.id as string);\n  }\n}\n","/**\n * ProfileRelationshipCollection - Collection manager for ProfileRelationship objects\n *\n * Provides querying for relationships between profiles.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ProfileRelationship } from '../models/ProfileRelationship';\n\nexport class ProfileRelationshipCollection extends SmrtCollection<ProfileRelationship> {\n  static readonly _itemClass = ProfileRelationship;\n\n  /**\n   * Get all relationships from a profile\n   *\n   * @param fromProfileId - The origin profile UUID\n   * @param typeId - Optional filter by relationship type UUID\n   * @returns Array of ProfileRelationship instances\n   */\n  async getFromProfile(\n    fromProfileId: string,\n    typeId?: string,\n  ): Promise<ProfileRelationship[]> {\n    const where: Record<string, unknown> = { fromProfileId };\n    if (typeId) where.typeId = typeId;\n\n    return await this.list({ where });\n  }\n\n  /**\n   * Get all relationships to a profile\n   *\n   * @param toProfileId - The target profile UUID\n   * @param typeId - Optional filter by relationship type UUID\n   * @returns Array of ProfileRelationship instances\n   */\n  async getToProfile(\n    toProfileId: string,\n    typeId?: string,\n  ): Promise<ProfileRelationship[]> {\n    const where: Record<string, unknown> = { toProfileId };\n    if (typeId) where.typeId = typeId;\n\n    return await this.list({ where });\n  }\n\n  /**\n   * Get all relationships for a profile (both directions)\n   *\n   * @param profileId - The profile UUID\n   * @param typeId - Optional filter by relationship type UUID\n   * @returns Array of ProfileRelationship instances\n   */\n  async getForProfile(\n    profileId: string,\n    typeId?: string,\n  ): Promise<ProfileRelationship[]> {\n    const fromRelationships = await this.getFromProfile(profileId, typeId);\n    const toRelationships = await this.getToProfile(profileId, typeId);\n\n    return [...fromRelationships, ...toRelationships];\n  }\n\n  /**\n   * Check if a relationship exists between two profiles\n   *\n   * @param fromProfileId - The origin profile UUID\n   * @param toProfileId - The target profile UUID\n   * @param typeId - The relationship type UUID\n   * @returns True if relationship exists\n   */\n  async exists(\n    fromProfileId: string,\n    toProfileId: string,\n    typeId: string,\n  ): Promise<boolean> {\n    const matches = await this.list({\n      where: { fromProfileId, toProfileId, typeId },\n      limit: 1,\n    });\n\n    return matches.length > 0;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgCO,IAAM,sBAAN,cAAkC,WAAW;CAElD,WAA0B;CAI1B;CAGA;CAGA;CAGA;CAIA,QAAmC,CAAC;CAEpC,YAAY,UAAsC,CAAC,GAAG;EACpD,MAAM,OAAO;EACb,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,KAAK,gBAAgB,QAAQ;EAC/B,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,KAAK,mBAAmB,QAAQ;CACpC;;;;;;CAOA,MAAM,cAA+B;EAEnC,QAAO,MADY,KAAK,YAAY,QAAQ,EAAA,EAC/B,QAAQ;CACvB;;;;;;;CAQA,MAAM,QAAQ,WAAiB,SAA+B;EAC5D,IAAI,CAAC,KAAK,IACR,MAAM,IAAI,MACR,4EACF;EAEF,MAAM,iBAAiB,KAAK;EAE5B,MAAM,EAAE,sCAAsC,MAAM,OAClD,kDAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAaF,OAAM,OANa,MAJU,kCAAkC,OAC7D,KAAK,OACP,EAAA,CAEkC,OAAO;GACvC;GACA;GACA;EACF,CAAC,EAAA,CAEU,KAAK;CAClB;;;;;;CAOA,MAAM,eAAe,SAA8B;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YACF,MAAM,WAAW,IAAI,OAAO;CAEhC;;;;;;CAOA,MAAM,WAA+C;EACnD,MAAM,EAAE,sCAAsC,MAAM,OAClD,kDAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAOF,OAAO,OAAM,MAJgB,kCAAkC,OAC7D,KAAK,OACP,EAAA,CAE4B,kBAAkB,KAAK,EAAY;CACjE;;;;;;CAOA,MAAM,gBAAyD;EAC7D,MAAM,EAAE,sCAAsC,MAAM,OAClD,kDAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAOF,OAAO,OAAM,MAJgB,kCAAkC,OAC7D,KAAK,OACP,EAAA,CAE4B,cAAc,KAAK,EAAY;CAC7D;AACF;AApHE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,oBAEX,WAAA,YAAA,CAAA;AAIA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAL9B,oBAMX,WAAA,iBAAA,CAAA;AAGA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAR9B,oBASX,WAAA,eAAA,CAAA;AAGA,gBAAA,CADC,WAAW,2BAA2B,EAAE,UAAU,KAAK,CAAC,CAAA,GAX9C,oBAYX,WAAA,UAAA,CAAA;AAGA,gBAAA,CADC,WAAW,SAAS,CAAA,GAdV,oBAeX,WAAA,oBAAA,CAAA;AAIA,gBAAA,CADC,UAAU,yBAAyB,CAAA,GAlBzB,oBAmBX,WAAA,SAAA,CAAA;AAnBW,sBAAN,gBAAA,CAPN,aAAa,EAAE,MAAM,WAAW,CAAC,GACjC,KAAK;CACJ,eAAe;CACf,KAAK,EAAE,SAAS;EAAC;EAAQ;EAAO;EAAU;CAAQ,EAAE;CACpD,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK;AACP,CAAC,CAAA,GACY,mBAAA;;;;ACvBN,IAAM,gCAAN,cAA4C,eAAoC;CACrF,OAAgB,aAAa;;;;;;;;CAS7B,MAAM,eACJ,eACA,QACgC;EAChC,MAAM,QAAiC,EAAE,cAAc;EACvD,IAAI,QAAQ,MAAM,SAAS;EAE3B,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,CAAC;CAClC;;;;;;;;CASA,MAAM,aACJ,aACA,QACgC;EAChC,MAAM,QAAiC,EAAE,YAAY;EACrD,IAAI,QAAQ,MAAM,SAAS;EAE3B,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,CAAC;CAClC;;;;;;;;CASA,MAAM,cACJ,WACA,QACgC;EAChC,MAAM,oBAAoB,MAAM,KAAK,eAAe,WAAW,MAAM;EACrE,MAAM,kBAAkB,MAAM,KAAK,aAAa,WAAW,MAAM;EAEjE,OAAO,CAAC,GAAG,mBAAmB,GAAG,eAAe;CAClD;;;;;;;;;CAUA,MAAM,OACJ,eACA,aACA,QACkB;EAMlB,QAAO,MALe,KAAK,KAAK;GAC9B,OAAO;IAAE;IAAe;IAAa;GAAO;GAC5C,OAAO;EACT,CAAC,EAAA,CAEc,SAAS;CAC1B;AACF"}
+{"version":3,"file":"ProfileRelationshipCollection-DuPcpzp1.js","names":[],"sources":["../../src/models/ProfileRelationship.ts","../../src/collections/ProfileRelationshipCollection.ts"],"sourcesContent":["/**\n * ProfileRelationship model - Connects two profiles with a relationship type\n *\n * Represents directional or reciprocal relationships between profiles.\n * Uses UUID primary key with foreign keys to profiles and relationship type.\n */\n\nimport {\n  foreignKey,\n  oneToMany,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { ProfileRelationshipTerm } from './ProfileRelationshipTerm';\n\nexport interface ProfileRelationshipOptions extends SmrtObjectOptions {\n  fromProfileId?: string;\n  toProfileId?: string;\n  typeId?: string;\n  contextProfileId?: string;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional' })\n@smrt({\n  tableStrategy: 'sti',\n  api: { include: ['list', 'get', 'create', 'delete'] },\n  mcp: { include: ['list', 'get'] },\n  cli: true,\n})\nexport class ProfileRelationship extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  // id: UUID (auto-generated by SmrtObject)\n  @foreignKey('Profile', { required: true })\n  fromProfileId?: string; // Origin profile\n\n  @foreignKey('Profile', { required: true })\n  toProfileId?: string; // Target profile\n\n  @foreignKey('ProfileRelationshipType', { required: true })\n  typeId?: string; // Relationship type\n\n  @foreignKey('Profile')\n  contextProfileId?: string; // Optional tertiary context\n\n  // Relationships\n  @oneToMany('ProfileRelationshipTerm')\n  terms: ProfileRelationshipTerm[] = [];\n\n  constructor(options: ProfileRelationshipOptions = {}) {\n    super(options);\n    if (options.fromProfileId !== undefined)\n      this.fromProfileId = options.fromProfileId;\n    if (options.toProfileId !== undefined)\n      this.toProfileId = options.toProfileId;\n    if (options.typeId !== undefined) this.typeId = options.typeId;\n    if (options.contextProfileId !== undefined)\n      this.contextProfileId = options.contextProfileId;\n  }\n\n  /**\n   * Get the relationship type slug\n   *\n   * @returns The slug of the relationship type\n   */\n  async getTypeSlug(): Promise<string> {\n    const type = await this.loadRelated('typeId');\n    return type?.slug || '';\n  }\n\n  /**\n   * Add a term (time period) to this relationship\n   *\n   * @param startedAt - Start date of the term\n   * @param endedAt - Optional end date of the term\n   */\n  async addTerm(startedAt: Date, endedAt?: Date): Promise<void> {\n    if (!this.id) {\n      throw new Error(\n        'ProfileRelationship.addTerm requires a persisted relationship (missing id)',\n      );\n    }\n    const relationshipId = this.id;\n\n    const { ProfileRelationshipTermCollection } = await import(\n      '../collections/ProfileRelationshipTermCollection'\n    );\n\n    const termCollection = await ProfileRelationshipTermCollection.create(\n      this.options,\n    );\n\n    const term = await termCollection.create({\n      relationshipId,\n      startedAt,\n      endedAt,\n    });\n\n    await term.save();\n  }\n\n  /**\n   * End the current active term\n   *\n   * @param endedAt - End date for the term\n   */\n  async endCurrentTerm(endedAt: Date): Promise<void> {\n    const activeTerm = await this.getActiveTerm();\n    if (activeTerm) {\n      await activeTerm.end(endedAt);\n    }\n  }\n\n  /**\n   * Get all terms for this relationship\n   *\n   * @returns Array of ProfileRelationshipTerm instances\n   */\n  async getTerms(): Promise<ProfileRelationshipTerm[]> {\n    const { ProfileRelationshipTermCollection } = await import(\n      '../collections/ProfileRelationshipTermCollection'\n    );\n\n    const termCollection = await ProfileRelationshipTermCollection.create(\n      this.options,\n    );\n\n    return await termCollection.getByRelationship(this.id as string);\n  }\n\n  /**\n   * Get the active term (no end date)\n   *\n   * @returns Current term or null if none active\n   */\n  async getActiveTerm(): Promise<ProfileRelationshipTerm | null> {\n    const { ProfileRelationshipTermCollection } = await import(\n      '../collections/ProfileRelationshipTermCollection'\n    );\n\n    const termCollection = await ProfileRelationshipTermCollection.create(\n      this.options,\n    );\n\n    return await termCollection.getActiveTerm(this.id as string);\n  }\n}\n","/**\n * ProfileRelationshipCollection - Collection manager for ProfileRelationship objects\n *\n * Provides querying for relationships between profiles.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ProfileRelationship } from '../models/ProfileRelationship';\n\nexport class ProfileRelationshipCollection extends SmrtCollection<ProfileRelationship> {\n  static readonly _itemClass = ProfileRelationship;\n\n  /**\n   * Get all relationships from a profile\n   *\n   * @param fromProfileId - The origin profile UUID\n   * @param typeId - Optional filter by relationship type UUID\n   * @returns Array of ProfileRelationship instances\n   */\n  async getFromProfile(\n    fromProfileId: string,\n    typeId?: string,\n  ): Promise<ProfileRelationship[]> {\n    const where: Record<string, unknown> = { fromProfileId };\n    if (typeId) where.typeId = typeId;\n\n    return await this.list({ where });\n  }\n\n  /**\n   * Get all relationships to a profile\n   *\n   * @param toProfileId - The target profile UUID\n   * @param typeId - Optional filter by relationship type UUID\n   * @returns Array of ProfileRelationship instances\n   */\n  async getToProfile(\n    toProfileId: string,\n    typeId?: string,\n  ): Promise<ProfileRelationship[]> {\n    const where: Record<string, unknown> = { toProfileId };\n    if (typeId) where.typeId = typeId;\n\n    return await this.list({ where });\n  }\n\n  /**\n   * Get all relationships for a profile (both directions)\n   *\n   * @param profileId - The profile UUID\n   * @param typeId - Optional filter by relationship type UUID\n   * @returns Array of ProfileRelationship instances\n   */\n  async getForProfile(\n    profileId: string,\n    typeId?: string,\n  ): Promise<ProfileRelationship[]> {\n    const fromRelationships = await this.getFromProfile(profileId, typeId);\n    const toRelationships = await this.getToProfile(profileId, typeId);\n\n    return [...fromRelationships, ...toRelationships];\n  }\n\n  /**\n   * Check if a relationship exists between two profiles\n   *\n   * @param fromProfileId - The origin profile UUID\n   * @param toProfileId - The target profile UUID\n   * @param typeId - The relationship type UUID\n   * @returns True if relationship exists\n   */\n  async exists(\n    fromProfileId: string,\n    toProfileId: string,\n    typeId: string,\n  ): Promise<boolean> {\n    const matches = await this.list({\n      where: { fromProfileId, toProfileId, typeId },\n      limit: 1,\n    });\n\n    return matches.length > 0;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgCO,IAAM,sBAAN,cAAkC,WAAW;CAElD,WAA0B;CAI1B;CAGA;CAGA;CAGA;CAIA,QAAmC,CAAC;CAEpC,YAAY,UAAsC,CAAC,GAAG;EACpD,MAAM,OAAO;EACb,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,KAAK,gBAAgB,QAAQ;EAC/B,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,KAAK,cAAc,QAAQ;EAC7B,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,KAAK,mBAAmB,QAAQ;CACpC;;;;;;CAOA,MAAM,cAA+B;EAEnC,QAAO,MADY,KAAK,YAAY,QAAQ,EAAA,EAC/B,QAAQ;CACvB;;;;;;;CAQA,MAAM,QAAQ,WAAiB,SAA+B;EAC5D,IAAI,CAAC,KAAK,IACR,MAAM,IAAI,MACR,4EACF;EAEF,MAAM,iBAAiB,KAAK;EAE5B,MAAM,EAAE,sCAAsC,MAAM,OAClD,kDAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAaF,OAAM,OANa,MAJU,kCAAkC,OAC7D,KAAK,OACP,EAAA,CAEkC,OAAO;GACvC;GACA;GACA;EACF,CAAC,EAAA,CAEU,KAAK;CAClB;;;;;;CAOA,MAAM,eAAe,SAA8B;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YACF,MAAM,WAAW,IAAI,OAAO;CAEhC;;;;;;CAOA,MAAM,WAA+C;EACnD,MAAM,EAAE,sCAAsC,MAAM,OAClD,kDAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAOF,OAAO,OAAM,MAJgB,kCAAkC,OAC7D,KAAK,OACP,EAAA,CAE4B,kBAAkB,KAAK,EAAY;CACjE;;;;;;CAOA,MAAM,gBAAyD;EAC7D,MAAM,EAAE,sCAAsC,MAAM,OAClD,kDAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAOF,OAAO,OAAM,MAJgB,kCAAkC,OAC7D,KAAK,OACP,EAAA,CAE4B,cAAc,KAAK,EAAY;CAC7D;AACF;AApHE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,oBAEX,WAAA,YAAA,CAAA;AAIA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAL9B,oBAMX,WAAA,iBAAA,CAAA;AAGA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAR9B,oBASX,WAAA,eAAA,CAAA;AAGA,gBAAA,CADC,WAAW,2BAA2B,EAAE,UAAU,KAAK,CAAC,CAAA,GAX9C,oBAYX,WAAA,UAAA,CAAA;AAGA,gBAAA,CADC,WAAW,SAAS,CAAA,GAdV,oBAeX,WAAA,oBAAA,CAAA;AAIA,gBAAA,CADC,UAAU,yBAAyB,CAAA,GAlBzB,oBAmBX,WAAA,SAAA,CAAA;AAnBW,sBAAN,gBAAA,CAPN,aAAa,EAAE,MAAM,WAAW,CAAC,GACjC,KAAK;CACJ,eAAe;CACf,KAAK,EAAE,SAAS;EAAC;EAAQ;EAAO;EAAU;CAAQ,EAAE;CACpD,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK;AACP,CAAC,CAAA,GACY,mBAAA;;;;ACvBN,IAAM,gCAAN,cAA4C,eAAoC;CACrF,OAAgB,aAAa;;;;;;;;CAS7B,MAAM,eACJ,eACA,QACgC;EAChC,MAAM,QAAiC,EAAE,cAAc;EACvD,IAAI,QAAQ,MAAM,SAAS;EAE3B,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,CAAC;CAClC;;;;;;;;CASA,MAAM,aACJ,aACA,QACgC;EAChC,MAAM,QAAiC,EAAE,YAAY;EACrD,IAAI,QAAQ,MAAM,SAAS;EAE3B,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,CAAC;CAClC;;;;;;;;CASA,MAAM,cACJ,WACA,QACgC;EAChC,MAAM,oBAAoB,MAAM,KAAK,eAAe,WAAW,MAAM;EACrE,MAAM,kBAAkB,MAAM,KAAK,aAAa,WAAW,MAAM;EAEjE,OAAO,CAAC,GAAG,mBAAmB,GAAG,eAAe;CAClD;;;;;;;;;CAUA,MAAM,OACJ,eACA,aACA,QACkB;EAMlB,QAAO,MALe,KAAK,KAAK;GAC9B,OAAO;IAAE;IAAe;IAAa;GAAO;GAC5C,OAAO;EACT,CAAC,EAAA,CAEc,SAAS;CAC1B;AACF"}

package/dist/chunks/{ProfileRelationshipTermCollection-DzmU48P6.js → ProfileRelationshipTermCollection-Bw32vYB8.js}

@@ -1,4 +1,4 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
 import { SmrtCollection, SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 //#region src/models/ProfileRelationshipTerm.ts
 var __defProp = Object.defineProperty;
@@ -102,4 +102,4 @@ var ProfileRelationshipTermCollection = class extends SmrtCollection {
 //#endregion
 export { ProfileRelationshipTermCollection_exports as n, ProfileRelationshipTerm as r, ProfileRelationshipTermCollection as t };
 
-//# sourceMappingURL=ProfileRelationshipTermCollection-DzmU48P6.js.map
+//# sourceMappingURL=ProfileRelationshipTermCollection-Bw32vYB8.js.map

package/dist/chunks/{ProfileRelationshipTermCollection-DzmU48P6.js.map → ProfileRelationshipTermCollection-Bw32vYB8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ProfileRelationshipTermCollection-DzmU48P6.js","names":[],"sources":["../../src/models/ProfileRelationshipTerm.ts","../../src/collections/ProfileRelationshipTermCollection.ts"],"sourcesContent":["/**\n * ProfileRelationshipTerm model - Temporal data for relationships\n *\n * Defines the duration or terms of a specific relationship.\n * Uses UUID primary key with foreign key to ProfileRelationship.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\n\nexport interface ProfileRelationshipTermOptions extends SmrtObjectOptions {\n  relationshipId?: string;\n  startedAt?: Date;\n  endedAt?: Date;\n}\n\n@smrt({\n  tableStrategy: 'sti',\n  api: { include: ['list', 'get', 'create', 'update', 'delete'] },\n  mcp: { include: ['list', 'get'] },\n  cli: true,\n})\nexport class ProfileRelationshipTerm extends SmrtObject {\n  // id: UUID (auto-generated by SmrtObject)\n  @foreignKey('ProfileRelationship', { required: true })\n  relationshipId?: string; // References ProfileRelationship.id\n\n  @field({ required: true })\n  startedAt: Date = new Date(); // Start date of the term\n\n  endedAt?: Date; // Optional end date\n\n  constructor(options: ProfileRelationshipTermOptions = {}) {\n    super(options);\n    if (options.relationshipId !== undefined)\n      this.relationshipId = options.relationshipId;\n    if (options.startedAt) this.startedAt = options.startedAt;\n    if (options.endedAt !== undefined) this.endedAt = options.endedAt;\n  }\n\n  /**\n   * Check if this term is currently active\n   *\n   * @returns True if active (no end date or end date in future)\n   */\n  isActive(): boolean {\n    if (!this.endedAt) return true;\n    return this.endedAt > new Date();\n  }\n\n  /**\n   * End this term\n   *\n   * @param endedAt - End date for the term (defaults to now)\n   */\n  async end(endedAt: Date = new Date()): Promise<void> {\n    this.endedAt = endedAt;\n    await this.save();\n  }\n\n  /**\n   * Get the duration of this term in days\n   *\n   * @returns Duration in days\n   */\n  getDurationDays(): number {\n    const endValue = this.endedAt || new Date();\n    const diffMs = endValue.getTime() - this.startedAt.getTime();\n    return Math.floor(diffMs / (1000 * 60 * 60 * 24));\n  }\n}\n","/**\n * ProfileRelationshipTermCollection - Collection manager for ProfileRelationshipTerm objects\n *\n * Provides querying for relationship terms (temporal data).\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ProfileRelationshipTerm } from '../models/ProfileRelationshipTerm';\n\nexport class ProfileRelationshipTermCollection extends SmrtCollection<ProfileRelationshipTerm> {\n  static readonly _itemClass = ProfileRelationshipTerm;\n\n  /**\n   * Get all terms for a relationship\n   *\n   * @param relationshipId - The relationship UUID\n   * @returns Array of ProfileRelationshipTerm instances\n   */\n  async getByRelationship(\n    relationshipId: string,\n  ): Promise<ProfileRelationshipTerm[]> {\n    return await this.list({\n      where: { relationshipId },\n      orderBy: ['startedAt DESC'],\n    });\n  }\n\n  /**\n   * Get the active term for a relationship (no end date or future end date)\n   *\n   * @param relationshipId - The relationship UUID\n   * @returns Active term or null\n   */\n  async getActiveTerm(\n    relationshipId: string,\n  ): Promise<ProfileRelationshipTerm | null> {\n    const terms = await this.getByRelationship(relationshipId);\n\n    for (const term of terms) {\n      if (term.isActive()) {\n        return term;\n      }\n    }\n\n    return null;\n  }\n\n  /**\n   * Get all historical (ended) terms for a relationship\n   *\n   * @param relationshipId - The relationship UUID\n   * @returns Array of ended ProfileRelationshipTerm instances\n   */\n  async getHistoricalTerms(\n    relationshipId: string,\n  ): Promise<ProfileRelationshipTerm[]> {\n    const terms = await this.getByRelationship(relationshipId);\n    return terms.filter((term) => !term.isActive());\n  }\n}\n"],"mappings":";;;;;;;;;;;AA2BO,IAAM,0BAAN,cAAsC,WAAW;CAGtD;CAGA,4BAAkB,IAAI,KAAK;CAE3B;CAEA,YAAY,UAA0C,CAAC,GAAG;EACxD,MAAM,OAAO;EACb,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBAAiB,QAAQ;EAChC,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC5D;;;;;;CAOA,WAAoB;EAClB,IAAI,CAAC,KAAK,SAAS,OAAO;EAC1B,OAAO,KAAK,0BAAU,IAAI,KAAK;CACjC;;;;;;CAOA,MAAM,IAAI,0BAAgB,IAAI,KAAK,GAAkB;EACnD,KAAK,UAAU;EACf,MAAM,KAAK,KAAK;CAClB;;;;;;CAOA,kBAA0B;EAExB,MAAM,UADW,KAAK,2BAAW,IAAI,KAAK,EAAA,CAClB,QAAQ,IAAI,KAAK,UAAU,QAAQ;EAC3D,OAAO,KAAK,MAAM,UAAU,MAAO,KAAK,KAAK,GAAG;CAClD;AACF;AA7CE,gBAAA,CADC,WAAW,uBAAuB,EAAE,UAAU,KAAK,CAAC,CAAA,GAF1C,wBAGX,WAAA,kBAAA,CAAA;AAGA,gBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GALd,wBAMX,WAAA,aAAA,CAAA;AANW,0BAAN,gBAAA,CANN,KAAK;CACJ,eAAe;CACf,KAAK,EAAE,SAAS;EAAC;EAAQ;EAAO;EAAU;EAAU;CAAQ,EAAE;CAC9D,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK;AACP,CAAC,CAAA,GACY,uBAAA;;;;AClBN,IAAM,oCAAN,cAAgD,eAAwC;CAC7F,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,kBACJ,gBACoC;EACpC,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,eAAe;GACxB,SAAS,CAAC,gBAAgB;EAC5B,CAAC;CACH;;;;;;;CAQA,MAAM,cACJ,gBACyC;EACzC,MAAM,QAAQ,MAAM,KAAK,kBAAkB,cAAc;EAEzD,KAAA,MAAW,QAAQ,OACjB,IAAI,KAAK,SAAS,GAChB,OAAO;EAIX,OAAO;CACT;;;;;;;CAQA,MAAM,mBACJ,gBACoC;EAEpC,QAAO,MADa,KAAK,kBAAkB,cAAc,EAAA,CAC5C,QAAQ,SAAS,CAAC,KAAK,SAAS,CAAC;CAChD;AACF"}
+{"version":3,"file":"ProfileRelationshipTermCollection-Bw32vYB8.js","names":[],"sources":["../../src/models/ProfileRelationshipTerm.ts","../../src/collections/ProfileRelationshipTermCollection.ts"],"sourcesContent":["/**\n * ProfileRelationshipTerm model - Temporal data for relationships\n *\n * Defines the duration or terms of a specific relationship.\n * Uses UUID primary key with foreign key to ProfileRelationship.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\n\nexport interface ProfileRelationshipTermOptions extends SmrtObjectOptions {\n  relationshipId?: string;\n  startedAt?: Date;\n  endedAt?: Date;\n}\n\n@smrt({\n  tableStrategy: 'sti',\n  api: { include: ['list', 'get', 'create', 'update', 'delete'] },\n  mcp: { include: ['list', 'get'] },\n  cli: true,\n})\nexport class ProfileRelationshipTerm extends SmrtObject {\n  // id: UUID (auto-generated by SmrtObject)\n  @foreignKey('ProfileRelationship', { required: true })\n  relationshipId?: string; // References ProfileRelationship.id\n\n  @field({ required: true })\n  startedAt: Date = new Date(); // Start date of the term\n\n  endedAt?: Date; // Optional end date\n\n  constructor(options: ProfileRelationshipTermOptions = {}) {\n    super(options);\n    if (options.relationshipId !== undefined)\n      this.relationshipId = options.relationshipId;\n    if (options.startedAt) this.startedAt = options.startedAt;\n    if (options.endedAt !== undefined) this.endedAt = options.endedAt;\n  }\n\n  /**\n   * Check if this term is currently active\n   *\n   * @returns True if active (no end date or end date in future)\n   */\n  isActive(): boolean {\n    if (!this.endedAt) return true;\n    return this.endedAt > new Date();\n  }\n\n  /**\n   * End this term\n   *\n   * @param endedAt - End date for the term (defaults to now)\n   */\n  async end(endedAt: Date = new Date()): Promise<void> {\n    this.endedAt = endedAt;\n    await this.save();\n  }\n\n  /**\n   * Get the duration of this term in days\n   *\n   * @returns Duration in days\n   */\n  getDurationDays(): number {\n    const endValue = this.endedAt || new Date();\n    const diffMs = endValue.getTime() - this.startedAt.getTime();\n    return Math.floor(diffMs / (1000 * 60 * 60 * 24));\n  }\n}\n","/**\n * ProfileRelationshipTermCollection - Collection manager for ProfileRelationshipTerm objects\n *\n * Provides querying for relationship terms (temporal data).\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ProfileRelationshipTerm } from '../models/ProfileRelationshipTerm';\n\nexport class ProfileRelationshipTermCollection extends SmrtCollection<ProfileRelationshipTerm> {\n  static readonly _itemClass = ProfileRelationshipTerm;\n\n  /**\n   * Get all terms for a relationship\n   *\n   * @param relationshipId - The relationship UUID\n   * @returns Array of ProfileRelationshipTerm instances\n   */\n  async getByRelationship(\n    relationshipId: string,\n  ): Promise<ProfileRelationshipTerm[]> {\n    return await this.list({\n      where: { relationshipId },\n      orderBy: ['startedAt DESC'],\n    });\n  }\n\n  /**\n   * Get the active term for a relationship (no end date or future end date)\n   *\n   * @param relationshipId - The relationship UUID\n   * @returns Active term or null\n   */\n  async getActiveTerm(\n    relationshipId: string,\n  ): Promise<ProfileRelationshipTerm | null> {\n    const terms = await this.getByRelationship(relationshipId);\n\n    for (const term of terms) {\n      if (term.isActive()) {\n        return term;\n      }\n    }\n\n    return null;\n  }\n\n  /**\n   * Get all historical (ended) terms for a relationship\n   *\n   * @param relationshipId - The relationship UUID\n   * @returns Array of ended ProfileRelationshipTerm instances\n   */\n  async getHistoricalTerms(\n    relationshipId: string,\n  ): Promise<ProfileRelationshipTerm[]> {\n    const terms = await this.getByRelationship(relationshipId);\n    return terms.filter((term) => !term.isActive());\n  }\n}\n"],"mappings":";;;;;;;;;;;AA2BO,IAAM,0BAAN,cAAsC,WAAW;CAGtD;CAGA,4BAAkB,IAAI,KAAK;CAE3B;CAEA,YAAY,UAA0C,CAAC,GAAG;EACxD,MAAM,OAAO;EACb,IAAI,QAAQ,mBAAmB,KAAA,GAC7B,KAAK,iBAAiB,QAAQ;EAChC,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;CAC5D;;;;;;CAOA,WAAoB;EAClB,IAAI,CAAC,KAAK,SAAS,OAAO;EAC1B,OAAO,KAAK,0BAAU,IAAI,KAAK;CACjC;;;;;;CAOA,MAAM,IAAI,0BAAgB,IAAI,KAAK,GAAkB;EACnD,KAAK,UAAU;EACf,MAAM,KAAK,KAAK;CAClB;;;;;;CAOA,kBAA0B;EAExB,MAAM,UADW,KAAK,2BAAW,IAAI,KAAK,EAAA,CAClB,QAAQ,IAAI,KAAK,UAAU,QAAQ;EAC3D,OAAO,KAAK,MAAM,UAAU,MAAO,KAAK,KAAK,GAAG;CAClD;AACF;AA7CE,gBAAA,CADC,WAAW,uBAAuB,EAAE,UAAU,KAAK,CAAC,CAAA,GAF1C,wBAGX,WAAA,kBAAA,CAAA;AAGA,gBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GALd,wBAMX,WAAA,aAAA,CAAA;AANW,0BAAN,gBAAA,CANN,KAAK;CACJ,eAAe;CACf,KAAK,EAAE,SAAS;EAAC;EAAQ;EAAO;EAAU;EAAU;CAAQ,EAAE;CAC9D,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK;AACP,CAAC,CAAA,GACY,uBAAA;;;;AClBN,IAAM,oCAAN,cAAgD,eAAwC;CAC7F,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,kBACJ,gBACoC;EACpC,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,eAAe;GACxB,SAAS,CAAC,gBAAgB;EAC5B,CAAC;CACH;;;;;;;CAQA,MAAM,cACJ,gBACyC;EACzC,MAAM,QAAQ,MAAM,KAAK,kBAAkB,cAAc;EAEzD,KAAA,MAAW,QAAQ,OACjB,IAAI,KAAK,SAAS,GAChB,OAAO;EAIX,OAAO;CACT;;;;;;;CAQA,MAAM,mBACJ,gBACoC;EAEpC,QAAO,MADa,KAAK,kBAAkB,cAAc,EAAA,CAC5C,QAAQ,SAAS,CAAC,KAAK,SAAS,CAAC;CAChD;AACF"}

package/dist/chunks/{ProfileRelationshipType-BjoaCt-u.js → ProfileRelationshipType-CZm2X1qY.js}

@@ -1,4 +1,4 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
 import { SmrtObject, field, smrt } from "@happyvertical/smrt-core";
 //#region src/models/ProfileRelationshipType.ts
 var ProfileRelationshipType_exports = /* @__PURE__ */ __exportAll({ ProfileRelationshipType: () => ProfileRelationshipType });
@@ -95,4 +95,4 @@ ProfileRelationshipType = __decorateClass([smrt({
 //#endregion
 export { ProfileRelationshipType_exports as n, ProfileRelationshipType as t };
 
-//# sourceMappingURL=ProfileRelationshipType-BjoaCt-u.js.map
+//# sourceMappingURL=ProfileRelationshipType-CZm2X1qY.js.map

package/dist/chunks/{ProfileRelationshipType-BjoaCt-u.js.map → ProfileRelationshipType-CZm2X1qY.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ProfileRelationshipType-BjoaCt-u.js","names":[],"sources":["../../src/models/ProfileRelationshipType.ts"],"sourcesContent":["/**\n * ProfileRelationshipType model - Lookup table for relationship types\n *\n * Defines the kinds of relationships that can exist between profiles.\n * Uses UUID primary key with unique slug for human-readable lookups.\n */\n\nimport {\n  field,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { ReciprocalHandler } from '../types';\n\nexport interface ProfileRelationshipTypeOptions extends SmrtObjectOptions {\n  slug?: string;\n  name?: string;\n  reciprocal?: boolean;\n}\n\n/**\n * Extend globalThis to include reciprocal handlers registry.\n * Using globalThis ensures all module instances share the same handlers,\n * which is critical in monorepos where the same package can be loaded\n * from different paths (e.g., pnpm store vs workspace symlink).\n *\n * @see https://github.com/happyvertical/smrt/issues/543\n */\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __smrtProfileRelationshipHandlers:\n    | Map<string, ReciprocalHandler>\n    | undefined;\n  // eslint-disable-next-line no-var\n  var __smrtProfileRelationshipHandlersInitialized: boolean | undefined;\n}\n\n/**\n * Get the reciprocal handlers Map from globalThis\n */\nfunction getReciprocalHandlers(): Map<string, ReciprocalHandler> {\n  if (!globalThis.__smrtProfileRelationshipHandlers) {\n    globalThis.__smrtProfileRelationshipHandlers = new Map<\n      string,\n      ReciprocalHandler\n    >();\n  }\n  return globalThis.__smrtProfileRelationshipHandlers;\n}\n\n/**\n * Default handlers for common reciprocal relationship patterns\n */\nconst DEFAULT_HANDLERS: Record<string, ReciprocalHandler> = {\n  // Symmetric relationships (same type in both directions)\n  friend: async (from, to, context) => {\n    await to.addRelationship(from, 'friend', context);\n  },\n\n  spouse: async (from, to) => {\n    await to.addRelationship(from, 'spouse');\n  },\n\n  partner: async (from, to, context) => {\n    await to.addRelationship(from, 'partner', context);\n  },\n\n  colleague: async (from, to, context) => {\n    await to.addRelationship(from, 'colleague', context);\n  },\n\n  sibling: async (from, to) => {\n    await to.addRelationship(from, 'sibling');\n  },\n};\n\n// Register default handlers (only once across all module instances)\nif (!globalThis.__smrtProfileRelationshipHandlersInitialized) {\n  globalThis.__smrtProfileRelationshipHandlersInitialized = true;\n  for (const [slug, handler] of Object.entries(DEFAULT_HANDLERS)) {\n    getReciprocalHandlers().set(slug, handler);\n  }\n}\n\n@smrt({\n  tableStrategy: 'sti',\n  api: { include: ['list', 'get', 'create', 'update'] },\n  mcp: { include: ['list', 'get'] },\n  cli: true,\n})\nexport class ProfileRelationshipType extends SmrtObject {\n  // id: UUID (auto-generated by SmrtObject)\n  // slug is inherited from SmrtObject (auto-generated from name)\n  @field({ required: true })\n  name: string = '';\n\n  reciprocal: boolean = true; // True for two-way relationships\n\n  constructor(options: ProfileRelationshipTypeOptions = {}) {\n    super(options);\n    if (options.name) this.name = options.name;\n    if (options.reciprocal !== undefined) this.reciprocal = options.reciprocal;\n  }\n\n  /**\n   * Convenience method for slug-based lookup\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileRelationshipType instance or null if not found\n   */\n  static async getBySlug(\n    _slug: string,\n  ): Promise<ProfileRelationshipType | null> {\n    // Will be auto-implemented by SMRT\n    return null;\n  }\n\n  /**\n   * Register a custom reciprocal handler for a relationship type\n   *\n   * @param slug - The relationship type slug\n   * @param handler - The handler function to execute when creating reciprocal relationship\n   */\n  static registerReciprocalHandler(\n    slug: string,\n    handler: ReciprocalHandler,\n  ): void {\n    getReciprocalHandlers().set(slug, handler);\n  }\n\n  /**\n   * Get the reciprocal handler for a relationship type\n   *\n   * @param slug - The relationship type slug\n   * @returns The handler function or undefined\n   */\n  static getReciprocalHandler(slug: string): ReciprocalHandler | undefined {\n    return getReciprocalHandlers().get(slug);\n  }\n\n  /**\n   * Check if a relationship type is reciprocal\n   *\n   * @param slug - The relationship type slug\n   * @returns True if reciprocal, false otherwise\n   */\n  static async isReciprocal(slug: string): Promise<boolean> {\n    const type = await ProfileRelationshipType.getBySlug(slug);\n    return type?.reciprocal || false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAyCA,SAAS,wBAAwD;CAC/D,IAAI,CAAC,WAAW,mCACd,WAAW,oDAAoC,IAAI,IAGjD;CAEJ,OAAO,WAAW;AACpB;AAKA,IAAM,mBAAsD;CAE1D,QAAQ,OAAO,MAAM,IAAI,YAAY;EACnC,MAAM,GAAG,gBAAgB,MAAM,UAAU,OAAO;CAClD;CAEA,QAAQ,OAAO,MAAM,OAAO;EAC1B,MAAM,GAAG,gBAAgB,MAAM,QAAQ;CACzC;CAEA,SAAS,OAAO,MAAM,IAAI,YAAY;EACpC,MAAM,GAAG,gBAAgB,MAAM,WAAW,OAAO;CACnD;CAEA,WAAW,OAAO,MAAM,IAAI,YAAY;EACtC,MAAM,GAAG,gBAAgB,MAAM,aAAa,OAAO;CACrD;CAEA,SAAS,OAAO,MAAM,OAAO;EAC3B,MAAM,GAAG,gBAAgB,MAAM,SAAS;CAC1C;AACF;AAGA,IAAI,CAAC,WAAW,8CAA8C;CAC5D,WAAW,+CAA+C;CAC1D,KAAA,MAAW,CAAC,MAAM,YAAY,OAAO,QAAQ,gBAAgB,GAC3D,sBAAsB,CAAA,CAAE,IAAI,MAAM,OAAO;AAE7C;AAQO,IAAM,0BAAN,cAAsC,WAAW;CAItD,OAAe;CAEf,aAAsB;CAEtB,YAAY,UAA0C,CAAC,GAAG;EACxD,MAAM,OAAO;EACb,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;;;;CAQA,aAAa,UACX,OACyC;EAEzC,OAAO;CACT;;;;;;;CAQA,OAAO,0BACL,MACA,SACM;EACN,sBAAsB,CAAA,CAAE,IAAI,MAAM,OAAO;CAC3C;;;;;;;CAQA,OAAO,qBAAqB,MAA6C;EACvE,OAAO,sBAAsB,CAAA,CAAE,IAAI,IAAI;CACzC;;;;;;;CAQA,aAAa,aAAa,MAAgC;EAExD,QAAO,MADY,wBAAwB,UAAU,IAAI,EAAA,EAC5C,cAAc;CAC7B;AACF;AAxDE,gBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GAHd,wBAIX,WAAA,QAAA,CAAA;AAJW,0BAAN,gBAAA,CANN,KAAK;CACJ,eAAe;CACf,KAAK,EAAE,SAAS;EAAC;EAAQ;EAAO;EAAU;CAAQ,EAAE;CACpD,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK;AACP,CAAC,CAAA,GACY,uBAAA"}
+{"version":3,"file":"ProfileRelationshipType-CZm2X1qY.js","names":[],"sources":["../../src/models/ProfileRelationshipType.ts"],"sourcesContent":["/**\n * ProfileRelationshipType model - Lookup table for relationship types\n *\n * Defines the kinds of relationships that can exist between profiles.\n * Uses UUID primary key with unique slug for human-readable lookups.\n */\n\nimport {\n  field,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { ReciprocalHandler } from '../types';\n\nexport interface ProfileRelationshipTypeOptions extends SmrtObjectOptions {\n  slug?: string;\n  name?: string;\n  reciprocal?: boolean;\n}\n\n/**\n * Extend globalThis to include reciprocal handlers registry.\n * Using globalThis ensures all module instances share the same handlers,\n * which is critical in monorepos where the same package can be loaded\n * from different paths (e.g., pnpm store vs workspace symlink).\n *\n * @see https://github.com/happyvertical/smrt/issues/543\n */\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __smrtProfileRelationshipHandlers:\n    | Map<string, ReciprocalHandler>\n    | undefined;\n  // eslint-disable-next-line no-var\n  var __smrtProfileRelationshipHandlersInitialized: boolean | undefined;\n}\n\n/**\n * Get the reciprocal handlers Map from globalThis\n */\nfunction getReciprocalHandlers(): Map<string, ReciprocalHandler> {\n  if (!globalThis.__smrtProfileRelationshipHandlers) {\n    globalThis.__smrtProfileRelationshipHandlers = new Map<\n      string,\n      ReciprocalHandler\n    >();\n  }\n  return globalThis.__smrtProfileRelationshipHandlers;\n}\n\n/**\n * Default handlers for common reciprocal relationship patterns\n */\nconst DEFAULT_HANDLERS: Record<string, ReciprocalHandler> = {\n  // Symmetric relationships (same type in both directions)\n  friend: async (from, to, context) => {\n    await to.addRelationship(from, 'friend', context);\n  },\n\n  spouse: async (from, to) => {\n    await to.addRelationship(from, 'spouse');\n  },\n\n  partner: async (from, to, context) => {\n    await to.addRelationship(from, 'partner', context);\n  },\n\n  colleague: async (from, to, context) => {\n    await to.addRelationship(from, 'colleague', context);\n  },\n\n  sibling: async (from, to) => {\n    await to.addRelationship(from, 'sibling');\n  },\n};\n\n// Register default handlers (only once across all module instances)\nif (!globalThis.__smrtProfileRelationshipHandlersInitialized) {\n  globalThis.__smrtProfileRelationshipHandlersInitialized = true;\n  for (const [slug, handler] of Object.entries(DEFAULT_HANDLERS)) {\n    getReciprocalHandlers().set(slug, handler);\n  }\n}\n\n@smrt({\n  tableStrategy: 'sti',\n  api: { include: ['list', 'get', 'create', 'update'] },\n  mcp: { include: ['list', 'get'] },\n  cli: true,\n})\nexport class ProfileRelationshipType extends SmrtObject {\n  // id: UUID (auto-generated by SmrtObject)\n  // slug is inherited from SmrtObject (auto-generated from name)\n  @field({ required: true })\n  name: string = '';\n\n  reciprocal: boolean = true; // True for two-way relationships\n\n  constructor(options: ProfileRelationshipTypeOptions = {}) {\n    super(options);\n    if (options.name) this.name = options.name;\n    if (options.reciprocal !== undefined) this.reciprocal = options.reciprocal;\n  }\n\n  /**\n   * Convenience method for slug-based lookup\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileRelationshipType instance or null if not found\n   */\n  static async getBySlug(\n    _slug: string,\n  ): Promise<ProfileRelationshipType | null> {\n    // Will be auto-implemented by SMRT\n    return null;\n  }\n\n  /**\n   * Register a custom reciprocal handler for a relationship type\n   *\n   * @param slug - The relationship type slug\n   * @param handler - The handler function to execute when creating reciprocal relationship\n   */\n  static registerReciprocalHandler(\n    slug: string,\n    handler: ReciprocalHandler,\n  ): void {\n    getReciprocalHandlers().set(slug, handler);\n  }\n\n  /**\n   * Get the reciprocal handler for a relationship type\n   *\n   * @param slug - The relationship type slug\n   * @returns The handler function or undefined\n   */\n  static getReciprocalHandler(slug: string): ReciprocalHandler | undefined {\n    return getReciprocalHandlers().get(slug);\n  }\n\n  /**\n   * Check if a relationship type is reciprocal\n   *\n   * @param slug - The relationship type slug\n   * @returns True if reciprocal, false otherwise\n   */\n  static async isReciprocal(slug: string): Promise<boolean> {\n    const type = await ProfileRelationshipType.getBySlug(slug);\n    return type?.reciprocal || false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAyCA,SAAS,wBAAwD;CAC/D,IAAI,CAAC,WAAW,mCACd,WAAW,oDAAoC,IAAI,IAGjD;CAEJ,OAAO,WAAW;AACpB;AAKA,IAAM,mBAAsD;CAE1D,QAAQ,OAAO,MAAM,IAAI,YAAY;EACnC,MAAM,GAAG,gBAAgB,MAAM,UAAU,OAAO;CAClD;CAEA,QAAQ,OAAO,MAAM,OAAO;EAC1B,MAAM,GAAG,gBAAgB,MAAM,QAAQ;CACzC;CAEA,SAAS,OAAO,MAAM,IAAI,YAAY;EACpC,MAAM,GAAG,gBAAgB,MAAM,WAAW,OAAO;CACnD;CAEA,WAAW,OAAO,MAAM,IAAI,YAAY;EACtC,MAAM,GAAG,gBAAgB,MAAM,aAAa,OAAO;CACrD;CAEA,SAAS,OAAO,MAAM,OAAO;EAC3B,MAAM,GAAG,gBAAgB,MAAM,SAAS;CAC1C;AACF;AAGA,IAAI,CAAC,WAAW,8CAA8C;CAC5D,WAAW,+CAA+C;CAC1D,KAAA,MAAW,CAAC,MAAM,YAAY,OAAO,QAAQ,gBAAgB,GAC3D,sBAAsB,CAAA,CAAE,IAAI,MAAM,OAAO;AAE7C;AAQO,IAAM,0BAAN,cAAsC,WAAW;CAItD,OAAe;CAEf,aAAsB;CAEtB,YAAY,UAA0C,CAAC,GAAG;EACxD,MAAM,OAAO;EACb,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;;;;CAQA,aAAa,UACX,OACyC;EAEzC,OAAO;CACT;;;;;;;CAQA,OAAO,0BACL,MACA,SACM;EACN,sBAAsB,CAAA,CAAE,IAAI,MAAM,OAAO;CAC3C;;;;;;;CAQA,OAAO,qBAAqB,MAA6C;EACvE,OAAO,sBAAsB,CAAA,CAAE,IAAI,IAAI;CACzC;;;;;;;CAQA,aAAa,aAAa,MAAgC;EAExD,QAAO,MADY,wBAAwB,UAAU,IAAI,EAAA,EAC5C,cAAc;CAC7B;AACF;AAxDE,gBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GAHd,wBAIX,WAAA,QAAA,CAAA;AAJW,0BAAN,gBAAA,CANN,KAAK;CACJ,eAAe;CACf,KAAK,EAAE,SAAS;EAAC;EAAQ;EAAO;EAAU;CAAQ,EAAE;CACpD,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK;AACP,CAAC,CAAA,GACY,uBAAA"}

package/dist/chunks/{ProfileRelationshipTypeCollection-Bh4xJ4-I.js → ProfileRelationshipTypeCollection-CtoeCpp_.js}

@@ -1,5 +1,5 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { t as ProfileRelationshipType } from "./ProfileRelationshipType-BjoaCt-u.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { t as ProfileRelationshipType } from "./ProfileRelationshipType-CZm2X1qY.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/ProfileRelationshipTypeCollection.ts
 var ProfileRelationshipTypeCollection_exports = /* @__PURE__ */ __exportAll({ ProfileRelationshipTypeCollection: () => ProfileRelationshipTypeCollection });
@@ -51,4 +51,4 @@ var ProfileRelationshipTypeCollection = class extends SmrtCollection {
 //#endregion
 export { ProfileRelationshipTypeCollection_exports as n, ProfileRelationshipTypeCollection as t };
 
-//# sourceMappingURL=ProfileRelationshipTypeCollection-Bh4xJ4-I.js.map
+//# sourceMappingURL=ProfileRelationshipTypeCollection-CtoeCpp_.js.map

package/dist/chunks/{ProfileRelationshipTypeCollection-Bh4xJ4-I.js.map → ProfileRelationshipTypeCollection-CtoeCpp_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ProfileRelationshipTypeCollection-Bh4xJ4-I.js","names":[],"sources":["../../src/collections/ProfileRelationshipTypeCollection.ts"],"sourcesContent":["/**\n * ProfileRelationshipTypeCollection - Collection manager for ProfileRelationshipType objects\n *\n * Provides querying for relationship type lookup table.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ProfileRelationshipType } from '../models/ProfileRelationshipType';\n\nexport class ProfileRelationshipTypeCollection extends SmrtCollection<ProfileRelationshipType> {\n  static readonly _itemClass = ProfileRelationshipType;\n\n  /**\n   * Get relationship type by slug\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileRelationshipType instance or null\n   */\n  async getBySlug(slug: string): Promise<ProfileRelationshipType | null> {\n    return await this.get({ slug });\n  }\n\n  /**\n   * Get or create a relationship type by slug\n   *\n   * @param slug - The slug to search for\n   * @param defaults - Default values if creating\n   * @returns ProfileRelationshipType instance\n   */\n  async getOrCreateBySlug(\n    slug: string,\n    defaults: { name: string; reciprocal?: boolean },\n  ): Promise<ProfileRelationshipType> {\n    const existing = await this.getBySlug(slug);\n    if (existing) return existing;\n\n    const relationshipType = await this.create({ slug, ...defaults });\n    await relationshipType.save();\n    return relationshipType;\n  }\n\n  /**\n   * Get all reciprocal relationship types\n   *\n   * @returns Array of reciprocal ProfileRelationshipType instances\n   */\n  async getReciprocal(): Promise<ProfileRelationshipType[]> {\n    return await this.list({ where: { reciprocal: true } });\n  }\n\n  /**\n   * Get all directional (non-reciprocal) relationship types\n   *\n   * @returns Array of directional ProfileRelationshipType instances\n   */\n  async getDirectional(): Promise<ProfileRelationshipType[]> {\n    return await this.list({ where: { reciprocal: false } });\n  }\n}\n"],"mappings":";;;;;AASO,IAAM,oCAAN,cAAgD,eAAwC;CAC7F,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,UAAU,MAAuD;EACrE,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC;CAChC;;;;;;;;CASA,MAAM,kBACJ,MACA,UACkC;EAClC,MAAM,WAAW,MAAM,KAAK,UAAU,IAAI;EAC1C,IAAI,UAAU,OAAO;EAErB,MAAM,mBAAmB,MAAM,KAAK,OAAO;GAAE;GAAM,GAAG;EAAS,CAAC;EAChE,MAAM,iBAAiB,KAAK;EAC5B,OAAO;CACT;;;;;;CAOA,MAAM,gBAAoD;EACxD,OAAO,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,EAAE,CAAC;CACxD;;;;;;CAOA,MAAM,iBAAqD;EACzD,OAAO,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,YAAY,MAAM,EAAE,CAAC;CACzD;AACF"}
+{"version":3,"file":"ProfileRelationshipTypeCollection-CtoeCpp_.js","names":[],"sources":["../../src/collections/ProfileRelationshipTypeCollection.ts"],"sourcesContent":["/**\n * ProfileRelationshipTypeCollection - Collection manager for ProfileRelationshipType objects\n *\n * Provides querying for relationship type lookup table.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ProfileRelationshipType } from '../models/ProfileRelationshipType';\n\nexport class ProfileRelationshipTypeCollection extends SmrtCollection<ProfileRelationshipType> {\n  static readonly _itemClass = ProfileRelationshipType;\n\n  /**\n   * Get relationship type by slug\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileRelationshipType instance or null\n   */\n  async getBySlug(slug: string): Promise<ProfileRelationshipType | null> {\n    return await this.get({ slug });\n  }\n\n  /**\n   * Get or create a relationship type by slug\n   *\n   * @param slug - The slug to search for\n   * @param defaults - Default values if creating\n   * @returns ProfileRelationshipType instance\n   */\n  async getOrCreateBySlug(\n    slug: string,\n    defaults: { name: string; reciprocal?: boolean },\n  ): Promise<ProfileRelationshipType> {\n    const existing = await this.getBySlug(slug);\n    if (existing) return existing;\n\n    const relationshipType = await this.create({ slug, ...defaults });\n    await relationshipType.save();\n    return relationshipType;\n  }\n\n  /**\n   * Get all reciprocal relationship types\n   *\n   * @returns Array of reciprocal ProfileRelationshipType instances\n   */\n  async getReciprocal(): Promise<ProfileRelationshipType[]> {\n    return await this.list({ where: { reciprocal: true } });\n  }\n\n  /**\n   * Get all directional (non-reciprocal) relationship types\n   *\n   * @returns Array of directional ProfileRelationshipType instances\n   */\n  async getDirectional(): Promise<ProfileRelationshipType[]> {\n    return await this.list({ where: { reciprocal: false } });\n  }\n}\n"],"mappings":";;;;;AASO,IAAM,oCAAN,cAAgD,eAAwC;CAC7F,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,UAAU,MAAuD;EACrE,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC;CAChC;;;;;;;;CASA,MAAM,kBACJ,MACA,UACkC;EAClC,MAAM,WAAW,MAAM,KAAK,UAAU,IAAI;EAC1C,IAAI,UAAU,OAAO;EAErB,MAAM,mBAAmB,MAAM,KAAK,OAAO;GAAE;GAAM,GAAG;EAAS,CAAC;EAChE,MAAM,iBAAiB,KAAK;EAC5B,OAAO;CACT;;;;;;CAOA,MAAM,gBAAoD;EACxD,OAAO,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,YAAY,KAAK,EAAE,CAAC;CACxD;;;;;;CAOA,MAAM,iBAAqD;EACzD,OAAO,MAAM,KAAK,KAAK,EAAE,OAAO,EAAE,YAAY,MAAM,EAAE,CAAC;CACzD;AACF"}

package/dist/chunks/{oidcProvisioningPrimitives-C9XSQNZj.js → oidcProvisioningPrimitives-Bzv4VTcn.js}

@@ -1,10 +1,13 @@
-import { y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { a as Profile, m as saveOidcRaceArbiter, n as ProfileCollection, o as ProfileType } from "./ProfileCollection-DdJ3W4GG.js";
-import { t as OidcIdentity } from "./OidcIdentity-CFbUlB_Z.js";
+import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { a as Profile, m as saveOidcRaceArbiter, n as ProfileCollection, o as ProfileType } from "./ProfileCollection-BsKhR5Dp.js";
+import { t as OidcIdentity } from "./OidcIdentity-DANnAbfU.js";
 import { SmrtCollection, smrt } from "@happyvertical/smrt-core";
 import { isSystemContext } from "@happyvertical/smrt-tenancy";
 //#region src/collections/ProfileTypeCollection.ts
 var ProfileTypeCollection_exports = /* @__PURE__ */ __exportAll({ ProfileTypeCollection: () => ProfileTypeCollection });
+function isPostgresUrl(url) {
+	return /^postgres(?:ql)?:/iu.test(url ?? "");
+}
 var ProfileTypeCollection = class extends SmrtCollection {
 	static _itemClass = ProfileType;
 	/**
@@ -43,10 +46,22 @@ var ProfileTypeCollection = class extends SmrtCollection {
 		if (!isSystemContext()) throw new Error("Global ProfileType creation requires an explicit system context.");
 		const existing = await this.loadGlobalBySlug(slug);
 		if (existing) return existing;
-		await this.db.query(`INSERT INTO profile_types
-        (id, slug, context, _meta_type, tenant_id, name, description)
-       VALUES (?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?)
-       ON CONFLICT (slug, context, _meta_type) DO NOTHING`, crypto.randomUUID(), slug, defaults.name, defaults.description ?? null);
+		const insertIfAbsent = async (db) => {
+			if (isPostgresUrl(db.url)) await db.query("SELECT pg_advisory_xact_lock(hashtext(?), hashtext(?))", "@happyvertical/smrt-profiles:profile_types:global", slug);
+			await db.query(`INSERT INTO profile_types
+          (id, slug, context, _meta_type, tenant_id, name, description)
+         SELECT ?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?
+         WHERE NOT EXISTS (
+           SELECT 1 FROM profile_types
+           WHERE slug = ?
+             AND context = ''
+             AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'
+             AND tenant_id IS NULL
+         )`, crypto.randomUUID(), slug, defaults.name, defaults.description ?? null, slug);
+		};
+		const isTransactionBound = typeof this.db.commit === "function";
+		if (isPostgresUrl(this.db.url) && !isTransactionBound && typeof this.db.transaction === "function") await this.db.transaction((tx) => insertIfAbsent(tx));
+		else await insertIfAbsent(this.db);
 		const profileType = await this.loadGlobalBySlug(slug);
 		if (!profileType) throw new Error(`Global ProfileType '${slug}' could not be created or loaded.`);
 		return profileType;
@@ -135,4 +150,4 @@ function requireProvisioningId(value, label) {
 //#endregion
 export { Person as a, ProfileTypeCollection_exports as c, Organization as i, insertOidcProvisioningIdentity as n, ProfileTypes_exports as o, Bot as r, ProfileTypeCollection as s, createOidcProvisioningPerson as t };
 
-//# sourceMappingURL=oidcProvisioningPrimitives-C9XSQNZj.js.map
+//# sourceMappingURL=oidcProvisioningPrimitives-Bzv4VTcn.js.map

package/dist/chunks/oidcProvisioningPrimitives-Bzv4VTcn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcProvisioningPrimitives-Bzv4VTcn.js","names":[],"sources":["../../src/collections/ProfileTypeCollection.ts","../../src/models/ProfileTypes.ts","../../src/auth/oidcProvisioningPrimitives.ts"],"sourcesContent":["/**\n * ProfileTypeCollection - Collection manager for ProfileType objects\n *\n * Provides querying for profile type lookup table.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { isSystemContext } from '@happyvertical/smrt-tenancy';\nimport { ProfileType } from '../models/ProfileType';\n\nfunction isPostgresUrl(url: string | undefined): boolean {\n  return /^postgres(?:ql)?:/iu.test(url ?? '');\n}\n\nexport class ProfileTypeCollection extends SmrtCollection<ProfileType> {\n  static readonly _itemClass = ProfileType;\n\n  /**\n   * Get profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileType instance or null\n   */\n  async getBySlug(slug: string): Promise<ProfileType | null> {\n    return await this.get({ slug });\n  }\n\n  /**\n   * Get or create a profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @param defaults - Default values if creating\n   * @returns ProfileType instance\n   */\n  async getOrCreateBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    const existing = await this.getBySlug(slug);\n    if (existing) return existing;\n\n    const profileType = await this.create({ slug, ...defaults });\n    await profileType.save();\n    return profileType;\n  }\n\n  /**\n   * Atomically create or load a global ProfileType from trusted system code.\n   *\n   * This intentionally bypasses tenant auto-population and therefore refuses\n   * to run outside an explicit `withSystemContext()` boundary.\n   */\n  async getOrCreateGlobalBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    if (!isSystemContext()) {\n      throw new Error(\n        'Global ProfileType creation requires an explicit system context.',\n      );\n    }\n\n    const existing = await this.loadGlobalBySlug(slug);\n    if (existing) return existing;\n\n    // A plain SMRT create is an upsert and may replace the winning row's id\n    // when two first-login transactions race. Keep the canonical id stable by\n    // using a cross-adapter insert-if-absent and then hydrating the winner.\n    //\n    // The table's unique key is `(tenant_id, slug, context, _meta_type)` since\n    // smrt#2360, and a global row's NULL tenant never conflicts at the\n    // database level (NULLs are distinct in a unique index), so a raw\n    // `ON CONFLICT (…) DO NOTHING` can no longer arbitrate this race. Serialize\n    // the global create per slug instead: PostgreSQL through a\n    // transaction-scoped advisory lock (the arbiter the SDK's null-aware\n    // upsert uses too); the embedded engines through the provisioning\n    // coordinator's in-process lock plus their single-writer transactions.\n    const insertIfAbsent = async (db: typeof this.db): Promise<void> => {\n      if (isPostgresUrl(db.url)) {\n        await db.query(\n          'SELECT pg_advisory_xact_lock(hashtext(?), hashtext(?))',\n          '@happyvertical/smrt-profiles:profile_types:global',\n          slug,\n        );\n      }\n      await db.query(\n        `INSERT INTO profile_types\n          (id, slug, context, _meta_type, tenant_id, name, description)\n         SELECT ?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?\n         WHERE NOT EXISTS (\n           SELECT 1 FROM profile_types\n           WHERE slug = ?\n             AND context = ''\n             AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n             AND tenant_id IS NULL\n         )`,\n        crypto.randomUUID(),\n        slug,\n        defaults.name,\n        defaults.description ?? null,\n        slug,\n      );\n    };\n\n    // A transaction-scoped advisory lock only spans both statements when they\n    // run on one transaction. On PostgreSQL, any handle that is NOT already\n    // transaction-bound may route each query to a different pooled connection\n    // — a root adapter (`beginTransaction` present) and equally a view\n    // wrapper (only `transaction()` present) — so open a transaction for the\n    // pair on every such handle. A transaction-bound handle (fingerprint: it\n    // carries `commit`) already keeps both statements on one client and must\n    // not nest. Embedded engines run directly: a nested root transaction\n    // would deadlock their single-writer adapters, and the provisioning\n    // coordinator's in-process lock already serializes them.\n    const isTransactionBound =\n      typeof (this.db as { commit?: unknown }).commit === 'function';\n    if (\n      isPostgresUrl(this.db.url) &&\n      !isTransactionBound &&\n      typeof this.db.transaction === 'function'\n    ) {\n      await this.db.transaction((tx) => insertIfAbsent(tx));\n    } else {\n      await insertIfAbsent(this.db);\n    }\n    const profileType = await this.loadGlobalBySlug(slug);\n    if (!profileType) {\n      throw new Error(\n        `Global ProfileType '${slug}' could not be created or loaded.`,\n      );\n    }\n    return profileType;\n  }\n\n  private async loadGlobalBySlug(slug: string): Promise<ProfileType | null> {\n    const result = await this.db.query(\n      `SELECT id\n       FROM profile_types\n       WHERE slug = ?\n         AND context = ''\n         AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n         AND tenant_id IS NULL\n       LIMIT 1`,\n      slug,\n    );\n    const id = result.rows[0]?.id;\n    return typeof id === 'string' ? this.get({ id }) : null;\n  }\n}\n","/**\n * Profile subclasses for STI (Single Table Inheritance)\n *\n * These classes inherit from Profile and automatically use the shared\n * profiles table with _meta_type discriminator.\n */\n\nimport { smrt } from '@happyvertical/smrt-core';\nimport { Profile, type ProfileOptions } from './Profile';\n\n/**\n * Person profile type\n *\n * Represents individual people/users.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Person extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Person-specific initialization can go here\n  }\n}\n\n/**\n * Organization profile type\n *\n * Represents companies, groups, institutions, and other organizational entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Organization extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Organization-specific initialization can go here\n  }\n}\n\n/**\n * Bot profile type\n *\n * Represents automated agents, bots, and AI entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Bot extends Profile {\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Bot-specific initialization can go here\n  }\n}\n","import type { getDatabase } from '@happyvertical/sql';\nimport { ProfileCollection } from '../collections/ProfileCollection';\nimport { ProfileTypeCollection } from '../collections/ProfileTypeCollection';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { Person } from '../models/ProfileTypes';\nimport { saveOidcRaceArbiter } from './oidcProvisioningCoordinator';\n\ntype DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;\n\nexport interface OidcProvisioningPersonInput {\n  email?: string;\n  name?: string;\n  preferredUsername?: string;\n  subject: string;\n}\n\nexport interface OidcProvisioningIdentityInput {\n  email?: string;\n  issuer: string;\n  profileId: string;\n  provider: string;\n  subject: string;\n}\n\n/** Create and reserve a fresh global Person inside the caller's transaction. */\nexport async function createOidcProvisioningPerson(\n  db: DatabaseInterface,\n  input: OidcProvisioningPersonInput,\n): Promise<Profile> {\n  const typeCollection = await ProfileTypeCollection.create({ db });\n  const personType = await typeCollection.getOrCreateGlobalBySlug('person', {\n    name: 'Person',\n    description: 'Individual person profile',\n  });\n  const typeId = requireProvisioningId(personType.id, 'Person ProfileType');\n  let profile: Profile = new Person({\n    db,\n    // OIDC display names are not identity keys. A per-profile slug keeps\n    // SMRT's natural-key upsert from replacing an unrelated Person.\n    slug: `oidc-${crypto.randomUUID()}`,\n    tenantId: null,\n    typeId,\n    email: input.email ?? '',\n    name: input.name || input.preferredUsername || input.subject,\n  });\n  await profile.initialize();\n  await saveOidcRaceArbiter(() => profile.save());\n\n  if (input.email) {\n    const profiles = await ProfileCollection.create({ db });\n    profile = await profiles.reserveCanonicalIdentityEmail(\n      requireProvisioningId(profile.id, 'Created Profile'),\n      input.email,\n    );\n  }\n  return profile;\n}\n\n/** Insert the identity after the caller proves Profile ownership. */\nexport async function insertOidcProvisioningIdentity(\n  db: DatabaseInterface,\n  input: OidcProvisioningIdentityInput,\n): Promise<OidcIdentity> {\n  const identity = new OidcIdentity({\n    db,\n    email: input.email ?? '',\n    issuer: input.issuer,\n    profileId: input.profileId,\n    provider: input.provider,\n    subject: input.subject,\n  });\n  await identity.initialize();\n  await saveOidcRaceArbiter(() => identity.save());\n  return identity;\n}\n\nfunction requireProvisioningId(value: unknown, label: string): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`${label} did not produce an id.`);\n  }\n  return value;\n}\n"],"mappings":";;;;;;;AAUA,SAAS,cAAc,KAAkC;CACvD,OAAO,sBAAsB,KAAK,OAAO,EAAE;AAC7C;AAEO,IAAM,wBAAN,cAAoC,eAA4B;CACrE,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,UAAU,MAA2C;EACzD,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC;CAChC;;;;;;;;CASA,MAAM,kBACJ,MACA,UACsB;EACtB,MAAM,WAAW,MAAM,KAAK,UAAU,IAAI;EAC1C,IAAI,UAAU,OAAO;EAErB,MAAM,cAAc,MAAM,KAAK,OAAO;GAAE;GAAM,GAAG;EAAS,CAAC;EAC3D,MAAM,YAAY,KAAK;EACvB,OAAO;CACT;;;;;;;CAQA,MAAM,wBACJ,MACA,UACsB;EACtB,IAAI,CAAC,gBAAgB,GACnB,MAAM,IAAI,MACR,kEACF;EAGF,MAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;EACjD,IAAI,UAAU,OAAO;EAcrB,MAAM,iBAAiB,OAAO,OAAsC;GAClE,IAAI,cAAc,GAAG,GAAG,GACtB,MAAM,GAAG,MACP,0DACA,qDACA,IACF;GAEF,MAAM,GAAG,MACP;;;;;;;;;aAUA,OAAO,WAAW,GAClB,MACA,SAAS,MACT,SAAS,eAAe,MACxB,IACF;EACF;EAYA,MAAM,qBACJ,OAAQ,KAAK,GAA4B,WAAW;EACtD,IACE,cAAc,KAAK,GAAG,GAAG,KACzB,CAAC,sBACD,OAAO,KAAK,GAAG,gBAAgB,YAE/B,MAAM,KAAK,GAAG,aAAa,OAAO,eAAe,EAAE,CAAC;OAEpD,MAAM,eAAe,KAAK,EAAE;EAE9B,MAAM,cAAc,MAAM,KAAK,iBAAiB,IAAI;EACpD,IAAI,CAAC,aACH,MAAM,IAAI,MACR,uBAAuB,KAAI,kCAC7B;EAEF,OAAO;CACT;CAEA,MAAc,iBAAiB,MAA2C;EAWxE,MAAM,MAAK,MAVU,KAAK,GAAG,MAC3B;;;;;;iBAOA,IACF,EAAA,CACkB,KAAK,EAAC,EAAG;EAC3B,OAAO,OAAO,OAAO,WAAW,KAAK,IAAI,EAAE,GAAG,CAAC,IAAI;CACrD;AACF;;;;;;;;;;;;;;;;AClIO,IAAM,SAAN,cAAqB,QAAQ;CAClC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,SAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,MAAA;AAeN,IAAM,eAAN,cAA2B,QAAQ;CACxC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,eAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,YAAA;AAeN,IAAM,MAAN,cAAkB,QAAQ;CAC/B,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALa,MAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,GAAA;;;ACtBb,eAAsB,6BACpB,IACA,OACkB;CAMlB,MAAM,SAAS,uBAAsB,OAJZ,MADI,sBAAsB,OAAO,EAAE,GAAG,CAAC,EAAA,CACxB,wBAAwB,UAAU;EACxE,MAAM;EACN,aAAa;CACf,CAAC,EAAA,CAC+C,IAAI,oBAAoB;CACxE,IAAI,UAAmB,IAAI,OAAO;EAChC;EAGA,MAAM,QAAQ,OAAO,WAAW;EAChC,UAAU;EACV;EACA,OAAO,MAAM,SAAS;EACtB,MAAM,MAAM,QAAQ,MAAM,qBAAqB,MAAM;CACvD,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,0BAA0B,QAAQ,KAAK,CAAC;CAE9C,IAAI,MAAM,OAER,UAAU,OAAM,MADO,kBAAkB,OAAO,EAAE,GAAG,CAAC,EAAA,CAC7B,8BACvB,sBAAsB,QAAQ,IAAI,iBAAiB,GACnD,MAAM,KACR;CAEF,OAAO;AACT;AAGA,eAAsB,+BACpB,IACA,OACuB;CACvB,MAAM,WAAW,IAAI,aAAa;EAChC;EACA,OAAO,MAAM,SAAS;EACtB,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,SAAS,WAAW;CAC1B,MAAM,0BAA0B,SAAS,KAAK,CAAC;CAC/C,OAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,GAAG,MAAK,wBAAyB;CAEnD,OAAO;AACT"}

package/dist/chunks/{resolveIdentity-BpkxPkz7.js → resolveIdentity-DusCiNZo.js}

@@ -1,8 +1,8 @@
-import { _ as verifyAuthEvent, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-DF_a_WZk.js";
-import { d as coordinateOidcProvisioning, h as normalizeIdentityEmail, p as isOidcProvisioningRaceConflict } from "./ProfileCollection-DdJ3W4GG.js";
-import { t as ApiKey } from "./ApiKey-Br9NGBnr.js";
-import { t as OidcIdentity } from "./OidcIdentity-CFbUlB_Z.js";
-import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-C9XSQNZj.js";
+import { _ as verifyAuthEvent, t as NostrIdentity, y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
+import { d as coordinateOidcProvisioning, h as normalizeIdentityEmail, p as isOidcProvisioningRaceConflict } from "./ProfileCollection-BsKhR5Dp.js";
+import { t as ApiKey } from "./ApiKey-CMm509C4.js";
+import { t as OidcIdentity } from "./OidcIdentity-DANnAbfU.js";
+import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-Bzv4VTcn.js";
 import { resolveDatabase } from "@happyvertical/smrt-core";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
 //#region src/auth/resolveIdentity.ts
@@ -65,13 +65,13 @@ async function resolveIdentity(context) {
 	};
 }
 async function findProfileByExternalId(provider, externalId, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 	const identities = await (await OidcIdentityCollection.create(options)).findByProvider(provider);
 	for (const identity of identities) if (identity.subject === externalId || identity.email?.includes(externalId)) {
 		const profile = await identity.getProfile();
 		if (profile) return profile;
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-DdJ3W4GG.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 	const profiles = await (await ProfileCollection.create(options)).list({
 		where: { email: `${externalId}@users.noreply.github.com` },
 		limit: 1
@@ -92,7 +92,7 @@ async function reuseExistingOidcIdentityForProfile(profileId, claims, provider,
 		createConcurrencyError: (cause) => new Error("Concurrent exact OIDC identity reuse did not converge.", cause === void 0 ? void 0 : { cause }),
 		rebindRootResult: rebindOidcProfileResult,
 		provision: (tx) => withSystemContext(async () => {
-			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
+			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 			const identity = await (await OidcIdentityCollection.create({ db: tx })).findBySubject(normalizedClaims.iss, normalizedClaims.sub);
 			if (!identity) throw new Error("OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().");
 			if (identity.profileId !== profileId) throw new Error(`OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`);
@@ -126,7 +126,7 @@ async function coordinateProfileOidcProvisioning(claims, provider, options) {
 	});
 }
 async function provisionOidcProfile(claims, provider, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
 	const existingIdentity = await (await OidcIdentityCollection.create(options)).findBySubject(claims.iss, claims.sub);
 	if (existingIdentity) {
 		const profile2 = await existingIdentity.getProfile();
@@ -140,7 +140,7 @@ async function provisionOidcProfile(claims, provider, options) {
 			created: false
 		};
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-DdJ3W4GG.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 	const profileCollection = await ProfileCollection.create(options);
 	if (claims.email) {
 		if (await profileCollection.findUniqueGlobalPersonByEmail(claims.email)) {
@@ -167,14 +167,14 @@ async function provisionOidcProfile(claims, provider, options) {
 	};
 }
 async function rebindOidcProfileResult(result, rootDb) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-BLxSaqJT.js").then((n) => n.r);
-	const { ProfileCollection } = await import("./ProfileCollection-DdJ3W4GG.js").then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
 	const profileId = requireOidcProfileId(result.profile.id);
 	const identityId = requireOidcProfileId(result.oidcIdentity.id);
 	const [profile, oidcIdentity] = await withSystemContext(async () => {
 		const profiles = await ProfileCollection.create({ db: rootDb });
 		const identities = await OidcIdentityCollection.create({ db: rootDb });
-		return Promise.all([profiles.get({ id: profileId }), identities.get({ id: identityId })]);
+		return [await profiles.get({ id: profileId }), await identities.get({ id: identityId })];
 	});
 	if (!profile || !oidcIdentity) throw new Error("Committed OIDC Profile provisioning result was not found.");
 	return {
@@ -214,11 +214,11 @@ async function createProfileFromNostr(email, nostrData, options) {
 			created: false
 		};
 	}
-	const { Person } = await import("./oidcProvisioningPrimitives-C9XSQNZj.js").then((n) => n.o);
-	const { ProfileTypeCollection } = await import("./oidcProvisioningPrimitives-C9XSQNZj.js").then((n) => n.c);
+	const { Person } = await import("./oidcProvisioningPrimitives-Bzv4VTcn.js").then((n) => n.o);
+	const { ProfileTypeCollection } = await import("./oidcProvisioningPrimitives-Bzv4VTcn.js").then((n) => n.c);
 	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
 	if (!personType) {
-		const { ProfileType } = await import("./ProfileCollection-DdJ3W4GG.js").then((n) => n.s);
+		const { ProfileType } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.s);
 		personType = new ProfileType({
 			...options,
 			slug: "person",
@@ -257,4 +257,4 @@ async function createProfileFromNostr(email, nostrData, options) {
 //#endregion
 export { resolveIdentity_exports as i, createProfileFromOidc as n, resolveIdentity as r, createProfileFromNostr as t };
 
-//# sourceMappingURL=resolveIdentity-BpkxPkz7.js.map
+//# sourceMappingURL=resolveIdentity-DusCiNZo.js.map

package/dist/chunks/{resolveIdentity-BpkxPkz7.js.map → resolveIdentity-DusCiNZo.js.map}

@@ -1 +1 @@
-{"version":3,"file":"resolveIdentity-BpkxPkz7.js","names":["profile"],"sources":["../../src/auth/resolveIdentity.ts"],"sourcesContent":["/**\n * resolveIdentity - Resolves authentication context to a Profile\n *\n * Used by apps (blindmanpress.com) to resolve incoming auth to a Profile.\n * Modules (aedile, praeco) should receive the resolved profile from the app.\n *\n * Resolution order:\n * 1. API key header → ApiKey → Profile\n * 2. OIDC session → OidcIdentity → Profile\n * 3. Nostr auth → NostrIdentity → Profile\n * 4. Actor header (CI pass-through) → Profile lookup\n */\n\nimport {\n  resolveDatabase,\n  type SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport { withSystemContext } from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { ApiKey } from '../models/ApiKey';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { normalizeIdentityEmail } from './normalizeIdentityEmail';\nimport { type NostrEvent, verifyAuthEvent } from './nostrCrypto';\nimport {\n  coordinateOidcProvisioning,\n  isOidcProvisioningRaceConflict,\n} from './oidcProvisioningCoordinator';\nimport {\n  createOidcProvisioningPerson,\n  insertOidcProvisioningIdentity,\n} from './oidcProvisioningPrimitives';\n\n/**\n * Context provided to resolveIdentity\n */\nexport interface AuthContext {\n  /**\n   * API key from X-API-Key header or similar\n   */\n  apiKey?: string | null;\n\n  /**\n   * OIDC session data (from @auth/sveltekit or similar)\n   */\n  oidcSession?: {\n    sub?: string;\n    iss?: string;\n    email?: string;\n    name?: string;\n  } | null;\n\n  /**\n   * Actor identifier for CI pass-through identity\n   * Usually the GitHub actor (username) who triggered the workflow\n   */\n  actor?: string | null;\n\n  /**\n   * Nostr authentication data (NIP-42 style)\n   */\n  nostrAuth?: {\n    /** Signed Nostr event for authentication */\n    event: NostrEvent;\n    /** Expected challenge (to prevent replay attacks) */\n    challenge: string;\n  } | null;\n\n  /**\n   * Database/persistence options\n   */\n  db?: SmrtObjectOptions['db'];\n}\n\n/**\n * Result of identity resolution\n */\nexport interface ResolveIdentityResult {\n  /**\n   * The resolved profile, or null if not authenticated\n   */\n  profile: Profile | null;\n\n  /**\n   * How the identity was resolved\n   */\n  source: 'api_key' | 'oidc' | 'nostr' | 'actor' | 'none';\n\n  /**\n   * The API key record if authenticated via API key\n   */\n  apiKey?: ApiKey;\n\n  /**\n   * The OIDC identity record if authenticated via OIDC\n   */\n  oidcIdentity?: OidcIdentity;\n\n  /**\n   * The Nostr identity record if authenticated via Nostr\n   */\n  nostrIdentity?: NostrIdentity;\n}\n\n/**\n * Resolve authentication context to a Profile\n *\n * @param context - The authentication context from the request\n * @returns The resolved profile and metadata\n *\n * @example\n * ```typescript\n * // In SvelteKit hooks.server.ts\n * import { resolveIdentity } from '@happyvertical/smrt-profiles';\n *\n * const identityMiddleware: Handle = async ({ event, resolve }) => {\n *   const session = await event.locals.auth();\n *\n *   const { profile, source } = await resolveIdentity({\n *     oidcSession: session,\n *     apiKey: event.request.headers.get('X-API-Key'),\n *     actor: event.request.headers.get('X-Actor'),\n *     db: { type: 'postgres', url: DATABASE_URL },\n *   });\n *\n *   event.locals.profile = profile;\n *   event.locals.authSource = source;\n *\n *   return resolve(event);\n * };\n * ```\n */\nexport async function resolveIdentity(\n  context: AuthContext,\n): Promise<ResolveIdentityResult> {\n  const options: SmrtObjectOptions = { db: context.db };\n\n  // 1. Check API key header first (highest priority for programmatic access)\n  if (context.apiKey) {\n    const apiKey = await ApiKey.verify(context.apiKey, options);\n    if (apiKey) {\n      const profile = await apiKey.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'api_key',\n          apiKey,\n        };\n      }\n    }\n  }\n\n  // 2. Check OIDC session (web users)\n  if (context.oidcSession?.sub && context.oidcSession?.iss) {\n    const oidcIdentity = await OidcIdentity.findBySubject(\n      context.oidcSession.iss,\n      context.oidcSession.sub,\n      options,\n    );\n\n    if (oidcIdentity) {\n      // Record usage\n      await oidcIdentity.recordUsage();\n\n      const profile = await oidcIdentity.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'oidc',\n          oidcIdentity,\n        };\n      }\n    }\n  }\n\n  // 3. Check Nostr auth (NIP-42 style signed event)\n  if (context.nostrAuth?.event && context.nostrAuth?.challenge) {\n    const { event, challenge } = context.nostrAuth;\n\n    // Verify the auth event\n    const verifyResult = verifyAuthEvent(event, challenge);\n    if (verifyResult.valid) {\n      // Look up identity by public key\n      const nostrIdentity = await NostrIdentity.findByPubkey(\n        event.pubkey,\n        options,\n      );\n\n      if (nostrIdentity) {\n        // Record usage\n        await nostrIdentity.recordUsage();\n\n        const profile = await nostrIdentity.getProfile();\n        if (profile) {\n          return {\n            profile,\n            source: 'nostr',\n            nostrIdentity,\n          };\n        }\n      }\n    }\n  }\n\n  // 4. Check actor for CI pass-through (look up by metadata)\n  if (context.actor) {\n    const profile = await findProfileByExternalId(\n      'github',\n      context.actor,\n      options,\n    );\n    if (profile) {\n      return {\n        profile,\n        source: 'actor',\n      };\n    }\n  }\n\n  // No authentication found\n  return {\n    profile: null,\n    source: 'none',\n  };\n}\n\n/**\n * Find a profile by external ID (e.g., GitHub username)\n *\n * This looks up profiles by their linked external identities or metadata.\n *\n * @param provider - The external provider (e.g., 'github')\n * @param externalId - The external identifier (e.g., GitHub username)\n * @param options - Database options\n * @returns The profile or null\n */\nasync function findProfileByExternalId(\n  provider: string,\n  externalId: string,\n  options: SmrtObjectOptions,\n): Promise<Profile | null> {\n  // First check OIDC identities (if they use the provider)\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n\n  const oidcCollection = await OidcIdentityCollection.create(options);\n  const identities = await oidcCollection.findByProvider(provider);\n\n  for (const identity of identities) {\n    // Check if the subject matches the external ID\n    if (\n      identity.subject === externalId ||\n      identity.email?.includes(externalId)\n    ) {\n      const profile = await identity.getProfile();\n      if (profile) return profile;\n    }\n  }\n\n  // Could also check profile metadata for external IDs\n  // This would require a standardized metadata field like 'github_username'\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n\n  // Try to find by email that looks like a GitHub noreply\n  const profiles = await profileCollection.list({\n    where: {\n      email: `${externalId}@users.noreply.github.com`,\n    },\n    limit: 1,\n  });\n\n  if (profiles.length > 0) {\n    return profiles[0];\n  }\n\n  return null;\n}\n\n/**\n * Create a profile from OIDC claims if it doesn't exist\n *\n * Resolution order:\n * 1. If OIDC identity (iss + sub) already exists → return linked profile\n * 2. If the email matches an existing Profile, fail closed because this\n *    package cannot prove whether a User owns it\n * 3. Otherwise, create new profile + identity\n *\n * Security considerations:\n * - Existing issuer/subject links always keep their already-linked Profile,\n *   including legacy tenant-scoped or non-Person Profiles, and refresh the\n *   cached identity email. This exact-link compatibility does not perform\n *   email-based canonical reuse.\n * - New identities never attach to an existing email match through this\n *   Profile-only helper because Profile ownership belongs to the users package.\n *   Use `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email\n *   reuse and its supported pre-provision resolver hook.\n * - This function trusts the OIDC provider to assert correct email_verified status.\n *   Only use with trusted providers.\n *\n * @param claims - OIDC token claims\n * @param provider - Provider name (e.g., 'keycloak', 'google', 'github')\n * @param options - Database options\n * @returns The created or existing profile with linked OIDC identity\n */\nexport async function createProfileFromOidc(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  return coordinateProfileOidcProvisioning(claims, provider, options);\n}\n\n/**\n * @internal Transactionally reuse one exact legacy issuer/subject link.\n *\n * This path cannot create or rebind authority. It intentionally preserves\n * existing tenant-scoped and non-Person Profile links; canonical global Person\n * validation remains mandatory for every path that creates a User/session.\n */\nexport async function reuseExistingOidcIdentityForProfile(\n  profileId: string,\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: false }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent exact OIDC identity reuse did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(async () => {\n        const { OidcIdentityCollection } = await import(\n          '../collections/OidcIdentityCollection'\n        );\n        const identity = await (\n          await OidcIdentityCollection.create({ db: tx })\n        ).findBySubject(normalizedClaims.iss, normalizedClaims.sub);\n        if (!identity) {\n          throw new Error(\n            'OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().',\n          );\n        }\n        if (identity.profileId !== profileId) {\n          throw new Error(\n            `OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`,\n          );\n        }\n        const profile = await identity.getProfile();\n        if (!profile) {\n          throw new Error('The exact OIDC identity has no linked Profile.');\n        }\n        identity.provider = provider;\n        if (normalizedClaims.email) identity.email = normalizedClaims.email;\n        identity.lastUsedAt = new Date();\n        await identity.save();\n        return { profile, oidcIdentity: identity, created: false as const };\n      }),\n  });\n}\n\nasync function coordinateProfileOidcProvisioning(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n      ...(normalizedClaims.email ? [`email:${normalizedClaims.email}`] : []),\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent OIDC Profile provisioning did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(() =>\n        provisionOidcProfile(normalizedClaims, provider, {\n          ...options,\n          db: tx,\n        }),\n      ),\n  });\n}\n\nasync function provisionOidcProfile(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions & { db: DatabaseInterface },\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const identityCollection = await OidcIdentityCollection.create(options);\n  const existingIdentity = await identityCollection.findBySubject(\n    claims.iss,\n    claims.sub,\n  );\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (!profile) {\n      throw new Error('The exact OIDC identity has no linked Profile.');\n    }\n    if (claims.email) existingIdentity.email = claims.email;\n    existingIdentity.lastUsedAt = new Date();\n    await existingIdentity.save();\n    return { profile, oidcIdentity: existingIdentity, created: false };\n  }\n\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n  if (claims.email) {\n    const collision = await profileCollection.findUniqueGlobalPersonByEmail(\n      claims.email,\n    );\n    if (collision) {\n      if (claims.email_verified !== true) {\n        throw new Error(\n          `OIDC email ${claims.email} is not verified and already belongs to a Profile.`,\n        );\n      }\n      throw new Error(\n        `OIDC email ${claims.email} already belongs to a Profile; createProfileFromOidc() cannot prove that Profile is unowned. Use UserCollection.getOrCreateFromOidc() for owner-aware linking.`,\n      );\n    }\n  }\n\n  const profile = await createOidcProvisioningPerson(options.db, {\n    email: claims.email ?? '',\n    name: claims.name,\n    preferredUsername: claims.preferred_username,\n    subject: claims.sub,\n  });\n  const oidcIdentity = await insertOidcProvisioningIdentity(options.db, {\n    email: claims.email,\n    issuer: claims.iss,\n    profileId: requireOidcProfileId(profile.id),\n    provider,\n    subject: claims.sub,\n  });\n  return { profile, oidcIdentity, created: true };\n}\n\nasync function rebindOidcProfileResult<\n  T extends {\n    profile: Profile;\n    oidcIdentity: OidcIdentity;\n    created: boolean;\n  },\n>(result: T, rootDb: DatabaseInterface): Promise<T> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileId = requireOidcProfileId(result.profile.id);\n  const identityId = requireOidcProfileId(result.oidcIdentity.id);\n  const [profile, oidcIdentity] = await withSystemContext(async () => {\n    const profiles = await ProfileCollection.create({ db: rootDb });\n    const identities = await OidcIdentityCollection.create({ db: rootDb });\n    return Promise.all([\n      profiles.get({ id: profileId }),\n      identities.get({ id: identityId }),\n    ]);\n  });\n  if (!profile || !oidcIdentity) {\n    throw new Error(\n      'Committed OIDC Profile provisioning result was not found.',\n    );\n  }\n  return { ...result, profile, oidcIdentity };\n}\n\nfunction normalizeOidcProfileClaims(claims: {\n  sub: string;\n  iss: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  preferred_username?: string;\n}) {\n  const sub = claims?.sub;\n  const iss = claims?.iss;\n  if (\n    typeof sub !== 'string' ||\n    sub.trim().length === 0 ||\n    typeof iss !== 'string' ||\n    iss.trim().length === 0\n  ) {\n    throw new Error(\n      'Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.',\n    );\n  }\n  const suppliedEmail = claims.email;\n  return {\n    ...claims,\n    sub,\n    iss,\n    email:\n      typeof suppliedEmail === 'string' && suppliedEmail.trim()\n        ? normalizeIdentityEmail(suppliedEmail)\n        : undefined,\n  };\n}\n\nfunction requireOidcProfileId(value: unknown): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error('OIDC Profile provisioning did not produce an id.');\n  }\n  return value;\n}\n\nasync function resolveOidcProfileDatabase(\n  db: SmrtObjectOptions['db'],\n): Promise<DatabaseInterface> {\n  if (!db) {\n    throw new Error(\n      'OIDC Profile provisioning requires an initialized database.',\n    );\n  }\n  return resolveDatabase(db as Parameters<typeof resolveDatabase>[0]);\n}\n\n/**\n * Create a profile from Nostr identity (used by magic link service)\n *\n * This is typically called internally by the magic link service,\n * but can be used directly if needed.\n *\n * @param email - Email address for the profile\n * @param nostrData - Encrypted Nostr keypair data\n * @param options - Database options\n * @returns The created profile with linked Nostr identity\n */\nexport async function createProfileFromNostr(\n  email: string,\n  nostrData: {\n    pubkey: string;\n    encryptedPrivkey: string;\n    encryptionIv: string;\n    encryptionTag: string;\n    nip05Username?: string;\n  },\n  options: SmrtObjectOptions,\n): Promise<{\n  profile: Profile;\n  nostrIdentity: NostrIdentity;\n  created: boolean;\n}> {\n  const normalizedEmail = normalizeIdentityEmail(email);\n\n  // Check if Nostr identity already exists\n  const existingIdentity = await NostrIdentity.findByEmail(\n    normalizedEmail,\n    options,\n  );\n\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (profile) {\n      return {\n        profile,\n        nostrIdentity: existingIdentity,\n        created: false,\n      };\n    }\n  }\n\n  // Create new profile\n  const { Person } = await import('../models/ProfileTypes');\n  const { ProfileTypeCollection } = await import(\n    '../collections/ProfileTypeCollection'\n  );\n\n  // Get or create the 'person' type\n  const typeCollection = await ProfileTypeCollection.create(options);\n  let personType = await typeCollection.getBySlug('person');\n\n  if (!personType) {\n    const { ProfileType } = await import('../models/ProfileType');\n    personType = new ProfileType({\n      ...options,\n      slug: 'person',\n      name: 'Person',\n      description: 'Individual person profile',\n    });\n    await personType.initialize();\n    await personType.save();\n  }\n\n  const profile = new Person({\n    ...options,\n    typeId: personType.id as string,\n    email: normalizedEmail,\n    name: normalizedEmail.split('@')[0], // Default name from email\n  });\n  await profile.initialize();\n  await profile.save();\n\n  // Create Nostr identity\n  const nostrIdentity = new NostrIdentity({\n    ...options,\n    profileId: profile.id as string,\n    pubkey: nostrData.pubkey,\n    encryptedPrivkey: nostrData.encryptedPrivkey,\n    encryptionIv: nostrData.encryptionIv,\n    encryptionTag: nostrData.encryptionTag,\n    email: normalizedEmail,\n    nip05Username:\n      nostrData.nip05Username?.toLowerCase() || normalizedEmail.split('@')[0],\n  });\n  await nostrIdentity.initialize();\n  await nostrIdentity.save();\n\n  return {\n    profile,\n    nostrIdentity,\n    created: true,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAqIA,eAAsB,gBACpB,SACgC;CAChC,MAAM,UAA6B,EAAE,IAAI,QAAQ,GAAG;CAGpD,IAAI,QAAQ,QAAQ;EAClB,MAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,QAAQ,OAAO;EAC1D,IAAI,QAAQ;GACV,MAAM,UAAU,MAAM,OAAO,WAAW;GACxC,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,aAAa,OAAO,QAAQ,aAAa,KAAK;EACxD,MAAM,eAAe,MAAM,aAAa,cACtC,QAAQ,YAAY,KACpB,QAAQ,YAAY,KACpB,OACF;EAEA,IAAI,cAAc;GAEhB,MAAM,aAAa,YAAY;GAE/B,MAAM,UAAU,MAAM,aAAa,WAAW;GAC9C,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,WAAW;EAC5D,MAAM,EAAE,OAAO,cAAc,QAAQ;EAIrC,IADqB,gBAAgB,OAAO,SACxC,CAAA,CAAa,OAAO;GAEtB,MAAM,gBAAgB,MAAM,cAAc,aACxC,MAAM,QACN,OACF;GAEA,IAAI,eAAe;IAEjB,MAAM,cAAc,YAAY;IAEhC,MAAM,UAAU,MAAM,cAAc,WAAW;IAC/C,IAAI,SACF,OAAO;KACL;KACA,QAAQ;KACR;IACF;GAEJ;EACF;CACF;CAGA,IAAI,QAAQ,OAAO;EACjB,MAAM,UAAU,MAAM,wBACpB,UACA,QAAQ,OACR,OACF;EACA,IAAI,SACF,OAAO;GACL;GACA,QAAQ;EACV;CAEJ;CAGA,OAAO;EACL,SAAS;EACT,QAAQ;CACV;AACF;AAYA,eAAe,wBACb,UACA,YACA,SACyB;CAEzB,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAIF,MAAM,aAAa,OAAM,MADI,uBAAuB,OAAO,OAAO,EAAA,CAC1B,eAAe,QAAQ;CAE/D,KAAA,MAAW,YAAY,YAErB,IACE,SAAS,YAAY,cACrB,SAAS,OAAO,SAAS,UAAU,GACnC;EACA,MAAM,UAAU,MAAM,SAAS,WAAW;EAC1C,IAAI,SAAS,OAAO;CACtB;CAKF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,MAAM,WAAW,OAAM,MAHS,kBAAkB,OAAO,OAAO,EAAA,CAGvB,KAAK;EAC5C,OAAO,EACL,OAAO,GAAG,WAAU,2BACtB;EACA,OAAO;CACT,CAAC;CAED,IAAI,SAAS,SAAS,GACpB,OAAO,SAAS;CAGlB,OAAO;AACT;AA4BA,eAAsB,sBACpB,QAQA,UACA,SAC6E;CAC7E,OAAO,kCAAkC,QAAQ,UAAU,OAAO;AACpE;AASA,eAAsB,oCACpB,WACA,QAQA,UACA,SAC2E;CAC3E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,GACF;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,kBAAkB,YAAY;GAC5B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAEF,MAAM,WAAW,OACf,MAAM,uBAAuB,OAAO,EAAE,IAAI,GAAG,CAAC,EAAA,CAC9C,cAAc,iBAAiB,KAAK,iBAAiB,GAAG;GAC1D,IAAI,CAAC,UACH,MAAM,IAAI,MACR,0IACF;GAEF,IAAI,SAAS,cAAc,WACzB,MAAM,IAAI,MACR,iBAAiB,iBAAiB,IAAG,WAAY,iBAAiB,IAAG,iCACvE;GAEF,MAAM,UAAU,MAAM,SAAS,WAAW;GAC1C,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,SAAS,WAAW;GACpB,IAAI,iBAAiB,OAAO,SAAS,QAAQ,iBAAiB;GAC9D,SAAS,6BAAa,IAAI,KAAK;GAC/B,MAAM,SAAS,KAAK;GACpB,OAAO;IAAE;IAAS,cAAc;IAAU,SAAS;GAAe;EACpE,CAAC;CACL,CAAC;AACH;AAEA,eAAe,kCACb,QAQA,UACA,SAC6E;CAC7E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,KACA,GAAI,iBAAiB,QAAQ,CAAC,SAAS,iBAAiB,OAAO,IAAI,CAAC,CACtE;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,wBACE,qBAAqB,kBAAkB,UAAU;GAC/C,GAAG;GACH,IAAI;EACN,CAAC,CACH;CACJ,CAAC;AACH;AAEA,eAAe,qBACb,QAQA,UACA,SAC6E;CAC7E,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAGF,MAAM,mBAAmB,OAAM,MADE,uBAAuB,OAAO,OAAO,EAAA,CACpB,cAChD,OAAO,KACP,OAAO,GACT;CACA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAI,CAACA,UACH,MAAM,IAAI,MAAM,gDAAgD;EAElE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,OAAO;EAClD,iBAAiB,6BAAa,IAAI,KAAK;EACvC,MAAM,iBAAiB,KAAK;EAC5B,OAAO;GAAE,SAAAA;GAAS,cAAc;GAAkB,SAAS;EAAM;CACnE;CAEA,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO;CAChE,IAAI,OAAO;MAIL,MAHoB,kBAAkB,8BACxC,OAAO,KACT,GACe;GACb,IAAI,OAAO,mBAAmB,MAC5B,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,mDAC5B;GAEF,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,+JAC5B;EACF;;CAGF,MAAM,UAAU,MAAM,6BAA6B,QAAQ,IAAI;EAC7D,OAAO,OAAO,SAAS;EACvB,MAAM,OAAO;EACb,mBAAmB,OAAO;EAC1B,SAAS,OAAO;CAClB,CAAC;CAQD,OAAO;EAAE;EAAS,cAAA,MAPS,+BAA+B,QAAQ,IAAI;GACpE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,WAAW,qBAAqB,QAAQ,EAAE;GAC1C;GACA,SAAS,OAAO;EAClB,CAAC;EAC+B,SAAS;CAAK;AAChD;AAEA,eAAe,wBAMb,QAAW,QAAuC;CAClD,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,YAAY,qBAAqB,OAAO,QAAQ,EAAE;CACxD,MAAM,aAAa,qBAAqB,OAAO,aAAa,EAAE;CAC9D,MAAM,CAAC,SAAS,gBAAgB,MAAM,kBAAkB,YAAY;EAClE,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE,IAAI,OAAO,CAAC;EAC9D,MAAM,aAAa,MAAM,uBAAuB,OAAO,EAAE,IAAI,OAAO,CAAC;EACrE,OAAO,QAAQ,IAAI,CACjB,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,GAC9B,WAAW,IAAI,EAAE,IAAI,WAAW,CAAC,CACnC,CAAC;CACH,CAAC;CACD,IAAI,CAAC,WAAW,CAAC,cACf,MAAM,IAAI,MACR,2DACF;CAEF,OAAO;EAAE,GAAG;EAAQ;EAAS;CAAa;AAC5C;AAEA,SAAS,2BAA2B,QAOjC;CACD,MAAM,MAAM,QAAQ;CACpB,MAAM,MAAM,QAAQ;CACpB,IACE,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,KACtB,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,GAEtB,MAAM,IAAI,MACR,0EACF;CAEF,MAAM,gBAAgB,OAAO;CAC7B,OAAO;EACL,GAAG;EACH;EACA;EACA,OACE,OAAO,kBAAkB,YAAY,cAAc,KAAK,IACpD,uBAAuB,aAAa,IACpC,KAAA;CACR;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,eAAe,2BACb,IAC4B;CAC5B,IAAI,CAAC,IACH,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,gBAAgB,EAA2C;AACpE;AAaA,eAAsB,uBACpB,OACA,WAOA,SAKC;CACD,MAAM,kBAAkB,uBAAuB,KAAK;CAGpD,MAAM,mBAAmB,MAAM,cAAc,YAC3C,iBACA,OACF;CAEA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAIA,UACF,OAAO;GACL,SAAAA;GACA,eAAe;GACf,SAAS;EACX;CAEJ;CAGA,MAAM,EAAE,WAAW,MAAM,OAAO,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAChC,MAAM,EAAE,0BAA0B,MAAM,OACtC,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,IAAI,aAAa,OAAM,MADM,sBAAsB,OAAO,OAAO,EAAA,CAC3B,UAAU,QAAQ;CAExD,IAAI,CAAC,YAAY;EACf,MAAM,EAAE,gBAAgB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EACrC,aAAa,IAAI,YAAY;GAC3B,GAAG;GACH,MAAM;GACN,MAAM;GACN,aAAa;EACf,CAAC;EACD,MAAM,WAAW,WAAW;EAC5B,MAAM,WAAW,KAAK;CACxB;CAEA,MAAM,UAAU,IAAI,OAAO;EACzB,GAAG;EACH,QAAQ,WAAW;EACnB,OAAO;EACP,MAAM,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACnC,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,QAAQ,KAAK;CAGnB,MAAM,gBAAgB,IAAI,cAAc;EACtC,GAAG;EACH,WAAW,QAAQ;EACnB,QAAQ,UAAU;EAClB,kBAAkB,UAAU;EAC5B,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,OAAO;EACP,eACE,UAAU,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACzE,CAAC;CACD,MAAM,cAAc,WAAW;CAC/B,MAAM,cAAc,KAAK;CAEzB,OAAO;EACL;EACA;EACA,SAAS;CACX;AACF"}
+{"version":3,"file":"resolveIdentity-DusCiNZo.js","names":["profile"],"sources":["../../src/auth/resolveIdentity.ts"],"sourcesContent":["/**\n * resolveIdentity - Resolves authentication context to a Profile\n *\n * Used by apps (blindmanpress.com) to resolve incoming auth to a Profile.\n * Modules (aedile, praeco) should receive the resolved profile from the app.\n *\n * Resolution order:\n * 1. API key header → ApiKey → Profile\n * 2. OIDC session → OidcIdentity → Profile\n * 3. Nostr auth → NostrIdentity → Profile\n * 4. Actor header (CI pass-through) → Profile lookup\n */\n\nimport {\n  resolveDatabase,\n  type SmrtObjectOptions,\n} from '@happyvertical/smrt-core';\nimport { withSystemContext } from '@happyvertical/smrt-tenancy';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { ApiKey } from '../models/ApiKey';\nimport { NostrIdentity } from '../models/NostrIdentity';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { normalizeIdentityEmail } from './normalizeIdentityEmail';\nimport { type NostrEvent, verifyAuthEvent } from './nostrCrypto';\nimport {\n  coordinateOidcProvisioning,\n  isOidcProvisioningRaceConflict,\n} from './oidcProvisioningCoordinator';\nimport {\n  createOidcProvisioningPerson,\n  insertOidcProvisioningIdentity,\n} from './oidcProvisioningPrimitives';\n\n/**\n * Context provided to resolveIdentity\n */\nexport interface AuthContext {\n  /**\n   * API key from X-API-Key header or similar\n   */\n  apiKey?: string | null;\n\n  /**\n   * OIDC session data (from @auth/sveltekit or similar)\n   */\n  oidcSession?: {\n    sub?: string;\n    iss?: string;\n    email?: string;\n    name?: string;\n  } | null;\n\n  /**\n   * Actor identifier for CI pass-through identity\n   * Usually the GitHub actor (username) who triggered the workflow\n   */\n  actor?: string | null;\n\n  /**\n   * Nostr authentication data (NIP-42 style)\n   */\n  nostrAuth?: {\n    /** Signed Nostr event for authentication */\n    event: NostrEvent;\n    /** Expected challenge (to prevent replay attacks) */\n    challenge: string;\n  } | null;\n\n  /**\n   * Database/persistence options\n   */\n  db?: SmrtObjectOptions['db'];\n}\n\n/**\n * Result of identity resolution\n */\nexport interface ResolveIdentityResult {\n  /**\n   * The resolved profile, or null if not authenticated\n   */\n  profile: Profile | null;\n\n  /**\n   * How the identity was resolved\n   */\n  source: 'api_key' | 'oidc' | 'nostr' | 'actor' | 'none';\n\n  /**\n   * The API key record if authenticated via API key\n   */\n  apiKey?: ApiKey;\n\n  /**\n   * The OIDC identity record if authenticated via OIDC\n   */\n  oidcIdentity?: OidcIdentity;\n\n  /**\n   * The Nostr identity record if authenticated via Nostr\n   */\n  nostrIdentity?: NostrIdentity;\n}\n\n/**\n * Resolve authentication context to a Profile\n *\n * @param context - The authentication context from the request\n * @returns The resolved profile and metadata\n *\n * @example\n * ```typescript\n * // In SvelteKit hooks.server.ts\n * import { resolveIdentity } from '@happyvertical/smrt-profiles';\n *\n * const identityMiddleware: Handle = async ({ event, resolve }) => {\n *   const session = await event.locals.auth();\n *\n *   const { profile, source } = await resolveIdentity({\n *     oidcSession: session,\n *     apiKey: event.request.headers.get('X-API-Key'),\n *     actor: event.request.headers.get('X-Actor'),\n *     db: { type: 'postgres', url: DATABASE_URL },\n *   });\n *\n *   event.locals.profile = profile;\n *   event.locals.authSource = source;\n *\n *   return resolve(event);\n * };\n * ```\n */\nexport async function resolveIdentity(\n  context: AuthContext,\n): Promise<ResolveIdentityResult> {\n  const options: SmrtObjectOptions = { db: context.db };\n\n  // 1. Check API key header first (highest priority for programmatic access)\n  if (context.apiKey) {\n    const apiKey = await ApiKey.verify(context.apiKey, options);\n    if (apiKey) {\n      const profile = await apiKey.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'api_key',\n          apiKey,\n        };\n      }\n    }\n  }\n\n  // 2. Check OIDC session (web users)\n  if (context.oidcSession?.sub && context.oidcSession?.iss) {\n    const oidcIdentity = await OidcIdentity.findBySubject(\n      context.oidcSession.iss,\n      context.oidcSession.sub,\n      options,\n    );\n\n    if (oidcIdentity) {\n      // Record usage\n      await oidcIdentity.recordUsage();\n\n      const profile = await oidcIdentity.getProfile();\n      if (profile) {\n        return {\n          profile,\n          source: 'oidc',\n          oidcIdentity,\n        };\n      }\n    }\n  }\n\n  // 3. Check Nostr auth (NIP-42 style signed event)\n  if (context.nostrAuth?.event && context.nostrAuth?.challenge) {\n    const { event, challenge } = context.nostrAuth;\n\n    // Verify the auth event\n    const verifyResult = verifyAuthEvent(event, challenge);\n    if (verifyResult.valid) {\n      // Look up identity by public key\n      const nostrIdentity = await NostrIdentity.findByPubkey(\n        event.pubkey,\n        options,\n      );\n\n      if (nostrIdentity) {\n        // Record usage\n        await nostrIdentity.recordUsage();\n\n        const profile = await nostrIdentity.getProfile();\n        if (profile) {\n          return {\n            profile,\n            source: 'nostr',\n            nostrIdentity,\n          };\n        }\n      }\n    }\n  }\n\n  // 4. Check actor for CI pass-through (look up by metadata)\n  if (context.actor) {\n    const profile = await findProfileByExternalId(\n      'github',\n      context.actor,\n      options,\n    );\n    if (profile) {\n      return {\n        profile,\n        source: 'actor',\n      };\n    }\n  }\n\n  // No authentication found\n  return {\n    profile: null,\n    source: 'none',\n  };\n}\n\n/**\n * Find a profile by external ID (e.g., GitHub username)\n *\n * This looks up profiles by their linked external identities or metadata.\n *\n * @param provider - The external provider (e.g., 'github')\n * @param externalId - The external identifier (e.g., GitHub username)\n * @param options - Database options\n * @returns The profile or null\n */\nasync function findProfileByExternalId(\n  provider: string,\n  externalId: string,\n  options: SmrtObjectOptions,\n): Promise<Profile | null> {\n  // First check OIDC identities (if they use the provider)\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n\n  const oidcCollection = await OidcIdentityCollection.create(options);\n  const identities = await oidcCollection.findByProvider(provider);\n\n  for (const identity of identities) {\n    // Check if the subject matches the external ID\n    if (\n      identity.subject === externalId ||\n      identity.email?.includes(externalId)\n    ) {\n      const profile = await identity.getProfile();\n      if (profile) return profile;\n    }\n  }\n\n  // Could also check profile metadata for external IDs\n  // This would require a standardized metadata field like 'github_username'\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n\n  // Try to find by email that looks like a GitHub noreply\n  const profiles = await profileCollection.list({\n    where: {\n      email: `${externalId}@users.noreply.github.com`,\n    },\n    limit: 1,\n  });\n\n  if (profiles.length > 0) {\n    return profiles[0];\n  }\n\n  return null;\n}\n\n/**\n * Create a profile from OIDC claims if it doesn't exist\n *\n * Resolution order:\n * 1. If OIDC identity (iss + sub) already exists → return linked profile\n * 2. If the email matches an existing Profile, fail closed because this\n *    package cannot prove whether a User owns it\n * 3. Otherwise, create new profile + identity\n *\n * Security considerations:\n * - Existing issuer/subject links always keep their already-linked Profile,\n *   including legacy tenant-scoped or non-Person Profiles, and refresh the\n *   cached identity email. This exact-link compatibility does not perform\n *   email-based canonical reuse.\n * - New identities never attach to an existing email match through this\n *   Profile-only helper because Profile ownership belongs to the users package.\n *   Use `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email\n *   reuse and its supported pre-provision resolver hook.\n * - This function trusts the OIDC provider to assert correct email_verified status.\n *   Only use with trusted providers.\n *\n * @param claims - OIDC token claims\n * @param provider - Provider name (e.g., 'keycloak', 'google', 'github')\n * @param options - Database options\n * @returns The created or existing profile with linked OIDC identity\n */\nexport async function createProfileFromOidc(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  return coordinateProfileOidcProvisioning(claims, provider, options);\n}\n\n/**\n * @internal Transactionally reuse one exact legacy issuer/subject link.\n *\n * This path cannot create or rebind authority. It intentionally preserves\n * existing tenant-scoped and non-Person Profile links; canonical global Person\n * validation remains mandatory for every path that creates a User/session.\n */\nexport async function reuseExistingOidcIdentityForProfile(\n  profileId: string,\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: false }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent exact OIDC identity reuse did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(async () => {\n        const { OidcIdentityCollection } = await import(\n          '../collections/OidcIdentityCollection'\n        );\n        const identity = await (\n          await OidcIdentityCollection.create({ db: tx })\n        ).findBySubject(normalizedClaims.iss, normalizedClaims.sub);\n        if (!identity) {\n          throw new Error(\n            'OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().',\n          );\n        }\n        if (identity.profileId !== profileId) {\n          throw new Error(\n            `OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`,\n          );\n        }\n        const profile = await identity.getProfile();\n        if (!profile) {\n          throw new Error('The exact OIDC identity has no linked Profile.');\n        }\n        identity.provider = provider;\n        if (normalizedClaims.email) identity.email = normalizedClaims.email;\n        identity.lastUsedAt = new Date();\n        await identity.save();\n        return { profile, oidcIdentity: identity, created: false as const };\n      }),\n  });\n}\n\nasync function coordinateProfileOidcProvisioning(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions,\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const normalizedClaims = normalizeOidcProfileClaims(claims);\n  const db = await resolveOidcProfileDatabase(options.db);\n  return coordinateOidcProvisioning({\n    db,\n    lockKeys: [\n      `identity:${OidcIdentity.buildIdentityKey(\n        normalizedClaims.iss,\n        normalizedClaims.sub,\n      )}`,\n      ...(normalizedClaims.email ? [`email:${normalizedClaims.email}`] : []),\n    ],\n    isRaceConflict: isOidcProvisioningRaceConflict,\n    createTransactionError: (message, cause) =>\n      new Error(message, cause === undefined ? undefined : { cause }),\n    createConcurrencyError: (cause) =>\n      new Error(\n        'Concurrent OIDC Profile provisioning did not converge.',\n        cause === undefined ? undefined : { cause },\n      ),\n    rebindRootResult: rebindOidcProfileResult,\n    provision: (tx) =>\n      withSystemContext(() =>\n        provisionOidcProfile(normalizedClaims, provider, {\n          ...options,\n          db: tx,\n        }),\n      ),\n  });\n}\n\nasync function provisionOidcProfile(\n  claims: {\n    sub: string;\n    iss: string;\n    email?: string;\n    email_verified?: boolean;\n    name?: string;\n    preferred_username?: string;\n  },\n  provider: string,\n  options: SmrtObjectOptions & { db: DatabaseInterface },\n): Promise<{ profile: Profile; oidcIdentity: OidcIdentity; created: boolean }> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const identityCollection = await OidcIdentityCollection.create(options);\n  const existingIdentity = await identityCollection.findBySubject(\n    claims.iss,\n    claims.sub,\n  );\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (!profile) {\n      throw new Error('The exact OIDC identity has no linked Profile.');\n    }\n    if (claims.email) existingIdentity.email = claims.email;\n    existingIdentity.lastUsedAt = new Date();\n    await existingIdentity.save();\n    return { profile, oidcIdentity: existingIdentity, created: false };\n  }\n\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileCollection = await ProfileCollection.create(options);\n  if (claims.email) {\n    const collision = await profileCollection.findUniqueGlobalPersonByEmail(\n      claims.email,\n    );\n    if (collision) {\n      if (claims.email_verified !== true) {\n        throw new Error(\n          `OIDC email ${claims.email} is not verified and already belongs to a Profile.`,\n        );\n      }\n      throw new Error(\n        `OIDC email ${claims.email} already belongs to a Profile; createProfileFromOidc() cannot prove that Profile is unowned. Use UserCollection.getOrCreateFromOidc() for owner-aware linking.`,\n      );\n    }\n  }\n\n  const profile = await createOidcProvisioningPerson(options.db, {\n    email: claims.email ?? '',\n    name: claims.name,\n    preferredUsername: claims.preferred_username,\n    subject: claims.sub,\n  });\n  const oidcIdentity = await insertOidcProvisioningIdentity(options.db, {\n    email: claims.email,\n    issuer: claims.iss,\n    profileId: requireOidcProfileId(profile.id),\n    provider,\n    subject: claims.sub,\n  });\n  return { profile, oidcIdentity, created: true };\n}\n\nasync function rebindOidcProfileResult<\n  T extends {\n    profile: Profile;\n    oidcIdentity: OidcIdentity;\n    created: boolean;\n  },\n>(result: T, rootDb: DatabaseInterface): Promise<T> {\n  const { OidcIdentityCollection } = await import(\n    '../collections/OidcIdentityCollection'\n  );\n  const { ProfileCollection } = await import(\n    '../collections/ProfileCollection'\n  );\n  const profileId = requireOidcProfileId(result.profile.id);\n  const identityId = requireOidcProfileId(result.oidcIdentity.id);\n  const [profile, oidcIdentity] = await withSystemContext(async () => {\n    const profiles = await ProfileCollection.create({ db: rootDb });\n    const identities = await OidcIdentityCollection.create({ db: rootDb });\n    // Read one statement at a time. SQLite and DuckDB handles multiplex a\n    // single native connection, so overlapping statements on it fail the\n    // losing prepared statement or abort the process outright (#2352). These\n    // are primary-key reads, so the sequential cost is one extra round trip.\n    const rebound = await profiles.get({ id: profileId });\n    const reboundIdentity = await identities.get({ id: identityId });\n    return [rebound, reboundIdentity] as const;\n  });\n  if (!profile || !oidcIdentity) {\n    throw new Error(\n      'Committed OIDC Profile provisioning result was not found.',\n    );\n  }\n  return { ...result, profile, oidcIdentity };\n}\n\nfunction normalizeOidcProfileClaims(claims: {\n  sub: string;\n  iss: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  preferred_username?: string;\n}) {\n  const sub = claims?.sub;\n  const iss = claims?.iss;\n  if (\n    typeof sub !== 'string' ||\n    sub.trim().length === 0 ||\n    typeof iss !== 'string' ||\n    iss.trim().length === 0\n  ) {\n    throw new Error(\n      'Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.',\n    );\n  }\n  const suppliedEmail = claims.email;\n  return {\n    ...claims,\n    sub,\n    iss,\n    email:\n      typeof suppliedEmail === 'string' && suppliedEmail.trim()\n        ? normalizeIdentityEmail(suppliedEmail)\n        : undefined,\n  };\n}\n\nfunction requireOidcProfileId(value: unknown): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error('OIDC Profile provisioning did not produce an id.');\n  }\n  return value;\n}\n\nasync function resolveOidcProfileDatabase(\n  db: SmrtObjectOptions['db'],\n): Promise<DatabaseInterface> {\n  if (!db) {\n    throw new Error(\n      'OIDC Profile provisioning requires an initialized database.',\n    );\n  }\n  return resolveDatabase(db as Parameters<typeof resolveDatabase>[0]);\n}\n\n/**\n * Create a profile from Nostr identity (used by magic link service)\n *\n * This is typically called internally by the magic link service,\n * but can be used directly if needed.\n *\n * @param email - Email address for the profile\n * @param nostrData - Encrypted Nostr keypair data\n * @param options - Database options\n * @returns The created profile with linked Nostr identity\n */\nexport async function createProfileFromNostr(\n  email: string,\n  nostrData: {\n    pubkey: string;\n    encryptedPrivkey: string;\n    encryptionIv: string;\n    encryptionTag: string;\n    nip05Username?: string;\n  },\n  options: SmrtObjectOptions,\n): Promise<{\n  profile: Profile;\n  nostrIdentity: NostrIdentity;\n  created: boolean;\n}> {\n  const normalizedEmail = normalizeIdentityEmail(email);\n\n  // Check if Nostr identity already exists\n  const existingIdentity = await NostrIdentity.findByEmail(\n    normalizedEmail,\n    options,\n  );\n\n  if (existingIdentity) {\n    const profile = await existingIdentity.getProfile();\n    if (profile) {\n      return {\n        profile,\n        nostrIdentity: existingIdentity,\n        created: false,\n      };\n    }\n  }\n\n  // Create new profile\n  const { Person } = await import('../models/ProfileTypes');\n  const { ProfileTypeCollection } = await import(\n    '../collections/ProfileTypeCollection'\n  );\n\n  // Get or create the 'person' type\n  const typeCollection = await ProfileTypeCollection.create(options);\n  let personType = await typeCollection.getBySlug('person');\n\n  if (!personType) {\n    const { ProfileType } = await import('../models/ProfileType');\n    personType = new ProfileType({\n      ...options,\n      slug: 'person',\n      name: 'Person',\n      description: 'Individual person profile',\n    });\n    await personType.initialize();\n    await personType.save();\n  }\n\n  const profile = new Person({\n    ...options,\n    typeId: personType.id as string,\n    email: normalizedEmail,\n    name: normalizedEmail.split('@')[0], // Default name from email\n  });\n  await profile.initialize();\n  await profile.save();\n\n  // Create Nostr identity\n  const nostrIdentity = new NostrIdentity({\n    ...options,\n    profileId: profile.id as string,\n    pubkey: nostrData.pubkey,\n    encryptedPrivkey: nostrData.encryptedPrivkey,\n    encryptionIv: nostrData.encryptionIv,\n    encryptionTag: nostrData.encryptionTag,\n    email: normalizedEmail,\n    nip05Username:\n      nostrData.nip05Username?.toLowerCase() || normalizedEmail.split('@')[0],\n  });\n  await nostrIdentity.initialize();\n  await nostrIdentity.save();\n\n  return {\n    profile,\n    nostrIdentity,\n    created: true,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAqIA,eAAsB,gBACpB,SACgC;CAChC,MAAM,UAA6B,EAAE,IAAI,QAAQ,GAAG;CAGpD,IAAI,QAAQ,QAAQ;EAClB,MAAM,SAAS,MAAM,OAAO,OAAO,QAAQ,QAAQ,OAAO;EAC1D,IAAI,QAAQ;GACV,MAAM,UAAU,MAAM,OAAO,WAAW;GACxC,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,aAAa,OAAO,QAAQ,aAAa,KAAK;EACxD,MAAM,eAAe,MAAM,aAAa,cACtC,QAAQ,YAAY,KACpB,QAAQ,YAAY,KACpB,OACF;EAEA,IAAI,cAAc;GAEhB,MAAM,aAAa,YAAY;GAE/B,MAAM,UAAU,MAAM,aAAa,WAAW;GAC9C,IAAI,SACF,OAAO;IACL;IACA,QAAQ;IACR;GACF;EAEJ;CACF;CAGA,IAAI,QAAQ,WAAW,SAAS,QAAQ,WAAW,WAAW;EAC5D,MAAM,EAAE,OAAO,cAAc,QAAQ;EAIrC,IADqB,gBAAgB,OAAO,SACxC,CAAA,CAAa,OAAO;GAEtB,MAAM,gBAAgB,MAAM,cAAc,aACxC,MAAM,QACN,OACF;GAEA,IAAI,eAAe;IAEjB,MAAM,cAAc,YAAY;IAEhC,MAAM,UAAU,MAAM,cAAc,WAAW;IAC/C,IAAI,SACF,OAAO;KACL;KACA,QAAQ;KACR;IACF;GAEJ;EACF;CACF;CAGA,IAAI,QAAQ,OAAO;EACjB,MAAM,UAAU,MAAM,wBACpB,UACA,QAAQ,OACR,OACF;EACA,IAAI,SACF,OAAO;GACL;GACA,QAAQ;EACV;CAEJ;CAGA,OAAO;EACL,SAAS;EACT,QAAQ;CACV;AACF;AAYA,eAAe,wBACb,UACA,YACA,SACyB;CAEzB,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAIF,MAAM,aAAa,OAAM,MADI,uBAAuB,OAAO,OAAO,EAAA,CAC1B,eAAe,QAAQ;CAE/D,KAAA,MAAW,YAAY,YAErB,IACE,SAAS,YAAY,cACrB,SAAS,OAAO,SAAS,UAAU,GACnC;EACA,MAAM,UAAU,MAAM,SAAS,WAAW;EAC1C,IAAI,SAAS,OAAO;CACtB;CAKF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,MAAM,WAAW,OAAM,MAHS,kBAAkB,OAAO,OAAO,EAAA,CAGvB,KAAK;EAC5C,OAAO,EACL,OAAO,GAAG,WAAU,2BACtB;EACA,OAAO;CACT,CAAC;CAED,IAAI,SAAS,SAAS,GACpB,OAAO,SAAS;CAGlB,OAAO;AACT;AA4BA,eAAsB,sBACpB,QAQA,UACA,SAC6E;CAC7E,OAAO,kCAAkC,QAAQ,UAAU,OAAO;AACpE;AASA,eAAsB,oCACpB,WACA,QAQA,UACA,SAC2E;CAC3E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,GACF;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,kBAAkB,YAAY;GAC5B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAEF,MAAM,WAAW,OACf,MAAM,uBAAuB,OAAO,EAAE,IAAI,GAAG,CAAC,EAAA,CAC9C,cAAc,iBAAiB,KAAK,iBAAiB,GAAG;GAC1D,IAAI,CAAC,UACH,MAAM,IAAI,MACR,0IACF;GAEF,IAAI,SAAS,cAAc,WACzB,MAAM,IAAI,MACR,iBAAiB,iBAAiB,IAAG,WAAY,iBAAiB,IAAG,iCACvE;GAEF,MAAM,UAAU,MAAM,SAAS,WAAW;GAC1C,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,SAAS,WAAW;GACpB,IAAI,iBAAiB,OAAO,SAAS,QAAQ,iBAAiB;GAC9D,SAAS,6BAAa,IAAI,KAAK;GAC/B,MAAM,SAAS,KAAK;GACpB,OAAO;IAAE;IAAS,cAAc;IAAU,SAAS;GAAe;EACpE,CAAC;CACL,CAAC;AACH;AAEA,eAAe,kCACb,QAQA,UACA,SAC6E;CAC7E,MAAM,mBAAmB,2BAA2B,MAAM;CAE1D,OAAO,2BAA2B;EAChC,IAAA,MAFe,2BAA2B,QAAQ,EAAE;EAGpD,UAAU,CACR,YAAY,aAAa,iBACvB,iBAAiB,KACjB,iBAAiB,GACnB,KACA,GAAI,iBAAiB,QAAQ,CAAC,SAAS,iBAAiB,OAAO,IAAI,CAAC,CACtE;EACA,gBAAgB;EAChB,yBAAyB,SAAS,UAChC,IAAI,MAAM,SAAS,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAAC;EAChE,yBAAyB,UACvB,IAAI,MACF,0DACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC5C;EACF,kBAAkB;EAClB,YAAY,OACV,wBACE,qBAAqB,kBAAkB,UAAU;GAC/C,GAAG;GACH,IAAI;EACN,CAAC,CACH;CACJ,CAAC;AACH;AAEA,eAAe,qBACb,QAQA,UACA,SAC6E;CAC7E,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAGF,MAAM,mBAAmB,OAAM,MADE,uBAAuB,OAAO,OAAO,EAAA,CACpB,cAChD,OAAO,KACP,OAAO,GACT;CACA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAI,CAACA,UACH,MAAM,IAAI,MAAM,gDAAgD;EAElE,IAAI,OAAO,OAAO,iBAAiB,QAAQ,OAAO;EAClD,iBAAiB,6BAAa,IAAI,KAAK;EACvC,MAAM,iBAAiB,KAAK;EAC5B,OAAO;GAAE,SAAAA;GAAS,cAAc;GAAkB,SAAS;EAAM;CACnE;CAEA,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO;CAChE,IAAI,OAAO;MAIL,MAHoB,kBAAkB,8BACxC,OAAO,KACT,GACe;GACb,IAAI,OAAO,mBAAmB,MAC5B,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,mDAC5B;GAEF,MAAM,IAAI,MACR,cAAc,OAAO,MAAK,+JAC5B;EACF;;CAGF,MAAM,UAAU,MAAM,6BAA6B,QAAQ,IAAI;EAC7D,OAAO,OAAO,SAAS;EACvB,MAAM,OAAO;EACb,mBAAmB,OAAO;EAC1B,SAAS,OAAO;CAClB,CAAC;CAQD,OAAO;EAAE;EAAS,cAAA,MAPS,+BAA+B,QAAQ,IAAI;GACpE,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,WAAW,qBAAqB,QAAQ,EAAE;GAC1C;GACA,SAAS,OAAO;EAClB,CAAC;EAC+B,SAAS;CAAK;AAChD;AAEA,eAAe,wBAMb,QAAW,QAAuC;CAClD,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,EAAE,sBAAsB,MAAM,OAClC,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAEF,MAAM,YAAY,qBAAqB,OAAO,QAAQ,EAAE;CACxD,MAAM,aAAa,qBAAqB,OAAO,aAAa,EAAE;CAC9D,MAAM,CAAC,SAAS,gBAAgB,MAAM,kBAAkB,YAAY;EAClE,MAAM,WAAW,MAAM,kBAAkB,OAAO,EAAE,IAAI,OAAO,CAAC;EAC9D,MAAM,aAAa,MAAM,uBAAuB,OAAO,EAAE,IAAI,OAAO,CAAC;EAOrE,OAAO,CAAC,MAFc,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,GAEnC,MADa,WAAW,IAAI,EAAE,IAAI,WAAW,CAAC,CAC/B;CAClC,CAAC;CACD,IAAI,CAAC,WAAW,CAAC,cACf,MAAM,IAAI,MACR,2DACF;CAEF,OAAO;EAAE,GAAG;EAAQ;EAAS;CAAa;AAC5C;AAEA,SAAS,2BAA2B,QAOjC;CACD,MAAM,MAAM,QAAQ;CACpB,MAAM,MAAM,QAAQ;CACpB,IACE,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,KACtB,OAAO,QAAQ,YACf,IAAI,KAAK,CAAA,CAAE,WAAW,GAEtB,MAAM,IAAI,MACR,0EACF;CAEF,MAAM,gBAAgB,OAAO;CAC7B,OAAO;EACL,GAAG;EACH;EACA;EACA,OACE,OAAO,kBAAkB,YAAY,cAAc,KAAK,IACpD,uBAAuB,aAAa,IACpC,KAAA;CACR;AACF;AAEA,SAAS,qBAAqB,OAAwB;CACpD,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,eAAe,2BACb,IAC4B;CAC5B,IAAI,CAAC,IACH,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,gBAAgB,EAA2C;AACpE;AAaA,eAAsB,uBACpB,OACA,WAOA,SAKC;CACD,MAAM,kBAAkB,uBAAuB,KAAK;CAGpD,MAAM,mBAAmB,MAAM,cAAc,YAC3C,iBACA,OACF;CAEA,IAAI,kBAAkB;EACpB,MAAMA,WAAU,MAAM,iBAAiB,WAAW;EAClD,IAAIA,UACF,OAAO;GACL,SAAAA;GACA,eAAe;GACf,SAAS;EACX;CAEJ;CAGA,MAAM,EAAE,WAAW,MAAM,OAAO,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAChC,MAAM,EAAE,0BAA0B,MAAM,OACtC,2CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAKF,IAAI,aAAa,OAAM,MADM,sBAAsB,OAAO,OAAO,EAAA,CAC3B,UAAU,QAAQ;CAExD,IAAI,CAAC,YAAY;EACf,MAAM,EAAE,gBAAgB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EACrC,aAAa,IAAI,YAAY;GAC3B,GAAG;GACH,MAAM;GACN,MAAM;GACN,aAAa;EACf,CAAC;EACD,MAAM,WAAW,WAAW;EAC5B,MAAM,WAAW,KAAK;CACxB;CAEA,MAAM,UAAU,IAAI,OAAO;EACzB,GAAG;EACH,QAAQ,WAAW;EACnB,OAAO;EACP,MAAM,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACnC,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,QAAQ,KAAK;CAGnB,MAAM,gBAAgB,IAAI,cAAc;EACtC,GAAG;EACH,WAAW,QAAQ;EACnB,QAAQ,UAAU;EAClB,kBAAkB,UAAU;EAC5B,cAAc,UAAU;EACxB,eAAe,UAAU;EACzB,OAAO;EACP,eACE,UAAU,eAAe,YAAY,KAAK,gBAAgB,MAAM,GAAG,CAAA,CAAE;CACzE,CAAC;CACD,MAAM,cAAc,WAAW;CAC/B,MAAM,cAAc,KAAK;CAEzB,OAAO;EACL;EACA;EACA,SAAS;CACX;AACF"}

package/dist/index.d.ts

@@ -20,7 +20,10 @@ export declare class ApiKey extends SmrtObject {
      */
     profileId?: string;
     /**
-     * SHA-256 hash of the API key
+     * SHA-256 hash of the API key.
+     *
+     * Indexed: `verify()` looks keys up by this hash on every authenticated
+     * request (#2364, epic #2382 finding A3).
      */
     keyHash: string;
     /**
@@ -542,7 +545,10 @@ export declare class MagicLinkToken extends SmrtObject {
      */
     nostrIdentityId?: string;
     /**
-     * SHA-256 hash of the token (never store plaintext)
+     * SHA-256 hash of the token (never store plaintext).
+     *
+     * Indexed: `verify()` looks tokens up by this hash on every magic-link
+     * click (#2364, epic #2382 finding A3).
      */
     tokenHash: string;
     /**
@@ -729,7 +735,10 @@ export declare class NostrIdentity extends SmrtObject {
      */
     profileId?: string;
     /**
-     * Hex-encoded secp256k1 public key (64 characters)
+     * Hex-encoded secp256k1 public key (64 characters).
+     *
+     * Indexed: `findByPubkey()` looks identities up by this column (#2364,
+     * epic #2382 finding A3).
      */
     pubkey: string;
     /**