@happyvertical/smrt-profiles 0.51.13 → 0.51.14

package/dist/chunks/{ApiKey-DIqCzx-g.js → ApiKey-BZmbOTnL.js}

@@ -1,4 +1,4 @@
-import { y as __exportAll } from "./NostrIdentity-CbnAJgg9.js";
+import { y as __exportAll } from "./NostrIdentity-n70E0vck.js";
 import { SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/models/ApiKey.ts
@@ -122,7 +122,7 @@ var ApiKey = class extends SmrtObject {
 	*/
 	static async verify(key, options = {}) {
 		const keyHash = ApiKey.hashKey(key);
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-CNFptBxU.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81.js").then((n) => n.n);
 		const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
 		if (!apiKey) return null;
 		if (!apiKey.isValid()) return null;
@@ -151,4 +151,4 @@ ApiKey = __decorateClass([smrt({
 //#endregion
 export { ApiKey_exports as n, ApiKey as t };
 
-//# sourceMappingURL=ApiKey-DIqCzx-g.js.map
+//# sourceMappingURL=ApiKey-BZmbOTnL.js.map

package/dist/chunks/{ApiKey-DIqCzx-g.js.map → ApiKey-BZmbOTnL.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ApiKey-DIqCzx-g.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n  profileId?: string;\n  name?: string;\n  scopes?: string[];\n  expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n  key: string;\n  apiKey: ApiKey;\n}\n\n@smrt({\n  tableName: 'api_keys',\n  // The API-key store. Never in the change feed (#2937).\n  sensitive: true,\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  // create/revoke are admin operations invoked in-process via the CLI; only\n  // read-only list/get are exposed over HTTP.\n  cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * SHA-256 hash of the API key.\n   *\n   * Indexed: `verify()` looks keys up by this hash on every authenticated\n   * request (#2364, epic #2382 finding A3).\n   */\n  @field({ indexed: true })\n  keyHash: string = '';\n\n  /**\n   * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n   */\n  keyPrefix: string = '';\n\n  /**\n   * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n   */\n  name: string = '';\n\n  /**\n   * Scopes/permissions for this key\n   */\n  scopes: string[] = [];\n\n  /**\n   * Last time this key was used\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this key expires (null = never)\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * When this key was revoked (null = active)\n   */\n  revokedAt: Date | null = null;\n\n  constructor(options: ApiKeyOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.name) this.name = options.name;\n    if (options.scopes) this.scopes = options.scopes;\n    if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Check if this key is valid (not expired, not revoked)\n   */\n  isValid(): boolean {\n    if (this.revokedAt) return false;\n    if (this.expiresAt && this.expiresAt < new Date()) return false;\n    return true;\n  }\n\n  /**\n   * Check if this key has a specific scope\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope) || this.scopes.includes('*');\n  }\n\n  /**\n   * Revoke this key\n   */\n  async revoke(): Promise<void> {\n    this.revokedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Record usage of this key\n   */\n  async recordUsage(): Promise<void> {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      if (this.isPersisted) await this.loadFromId();\n      if (!this.isValid()) return;\n      this.lastUsedAt = new Date();\n      try {\n        await this.save();\n        return;\n      } catch (error) {\n        if (\n          attempt === 3 ||\n          !(\n            error instanceof Error &&\n            'code' in error &&\n            error.code === 'RUNTIME_REVISION_CONFLICT'\n          )\n        ) {\n          throw error;\n        }\n      }\n    }\n  }\n\n  /**\n   * Hash an API key\n   */\n  static hashKey(key: string): string {\n    return createHash('sha256').update(key).digest('hex');\n  }\n\n  /**\n   * Generate a new API key for a profile\n   */\n  static async generate(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n      db?: SmrtObjectOptions['db'];\n    },\n  ): Promise<GenerateKeyResult> {\n    // Generate a random key: sk_live_<32 random bytes as hex>\n    const randomPart = randomBytes(32).toString('hex');\n    const key = `sk_live_${randomPart}`;\n    const keyPrefix = key.substring(0, 16);\n    const keyHash = ApiKey.hashKey(key);\n\n    const apiKey = new ApiKey({\n      db: options.db || profile.options?.db,\n      profileId: profile.id as string,\n      name: options.name,\n      scopes: options.scopes || ['*'],\n      expiresAt: options.expiresAt ?? null,\n    });\n    apiKey.keyHash = keyHash;\n    apiKey.keyPrefix = keyPrefix;\n\n    await apiKey.initialize();\n    await apiKey.save();\n\n    return { key, apiKey };\n  }\n\n  /**\n   * Verify an API key and return the ApiKey record if valid\n   */\n  static async verify(\n    key: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n\n    const { ApiKeyCollection } = await import(\n      '../collections/ApiKeyCollection'\n    );\n    const collection = await ApiKeyCollection.create(options);\n\n    const apiKey = await collection.findOne({\n      where: { keyHash },\n    });\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // A concurrent revocation may have been observed while recordUsage()\n    // rehydrated after a revision conflict. Never authenticate that key.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAuCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;CASA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAA,IAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;GAC/C,IAAI,KAAK,aAAa,MAAM,KAAK,WAAW;GAC5C,IAAI,CAAC,KAAK,QAAQ,GAAG;GACrB,KAAK,6BAAa,IAAI,KAAK;GAC3B,IAAI;IACF,MAAM,KAAK,KAAK;IAChB;GACF,SAAS,OAAO;IACd,IACE,YAAY,KACZ,EACE,iBAAiB,SACjB,UAAU,SACV,MAAM,SAAS,8BAGjB,MAAM;GAEV;EACF;CACF;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;AACF;AAjLE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AASA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAbb,OAcX,WAAA,WAAA,CAAA;AAdW,SAAN,gBAAA,CAVN,KAAK;CACJ,WAAW;CAEX,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}
+{"version":3,"file":"ApiKey-BZmbOTnL.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n  profileId?: string;\n  name?: string;\n  scopes?: string[];\n  expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n  key: string;\n  apiKey: ApiKey;\n}\n\n@smrt({\n  tableName: 'api_keys',\n  // The API-key store. Never in the change feed (#2937).\n  sensitive: true,\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  // create/revoke are admin operations invoked in-process via the CLI; only\n  // read-only list/get are exposed over HTTP.\n  cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * SHA-256 hash of the API key.\n   *\n   * Indexed: `verify()` looks keys up by this hash on every authenticated\n   * request (#2364, epic #2382 finding A3).\n   */\n  @field({ indexed: true })\n  keyHash: string = '';\n\n  /**\n   * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n   */\n  keyPrefix: string = '';\n\n  /**\n   * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n   */\n  name: string = '';\n\n  /**\n   * Scopes/permissions for this key\n   */\n  scopes: string[] = [];\n\n  /**\n   * Last time this key was used\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this key expires (null = never)\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * When this key was revoked (null = active)\n   */\n  revokedAt: Date | null = null;\n\n  constructor(options: ApiKeyOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.name) this.name = options.name;\n    if (options.scopes) this.scopes = options.scopes;\n    if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Check if this key is valid (not expired, not revoked)\n   */\n  isValid(): boolean {\n    if (this.revokedAt) return false;\n    if (this.expiresAt && this.expiresAt < new Date()) return false;\n    return true;\n  }\n\n  /**\n   * Check if this key has a specific scope\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope) || this.scopes.includes('*');\n  }\n\n  /**\n   * Revoke this key\n   */\n  async revoke(): Promise<void> {\n    this.revokedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Record usage of this key\n   */\n  async recordUsage(): Promise<void> {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      if (this.isPersisted) await this.loadFromId();\n      if (!this.isValid()) return;\n      this.lastUsedAt = new Date();\n      try {\n        await this.save();\n        return;\n      } catch (error) {\n        if (\n          attempt === 3 ||\n          !(\n            error instanceof Error &&\n            'code' in error &&\n            error.code === 'RUNTIME_REVISION_CONFLICT'\n          )\n        ) {\n          throw error;\n        }\n      }\n    }\n  }\n\n  /**\n   * Hash an API key\n   */\n  static hashKey(key: string): string {\n    return createHash('sha256').update(key).digest('hex');\n  }\n\n  /**\n   * Generate a new API key for a profile\n   */\n  static async generate(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n      db?: SmrtObjectOptions['db'];\n    },\n  ): Promise<GenerateKeyResult> {\n    // Generate a random key: sk_live_<32 random bytes as hex>\n    const randomPart = randomBytes(32).toString('hex');\n    const key = `sk_live_${randomPart}`;\n    const keyPrefix = key.substring(0, 16);\n    const keyHash = ApiKey.hashKey(key);\n\n    const apiKey = new ApiKey({\n      db: options.db || profile.options?.db,\n      profileId: profile.id as string,\n      name: options.name,\n      scopes: options.scopes || ['*'],\n      expiresAt: options.expiresAt ?? null,\n    });\n    apiKey.keyHash = keyHash;\n    apiKey.keyPrefix = keyPrefix;\n\n    await apiKey.initialize();\n    await apiKey.save();\n\n    return { key, apiKey };\n  }\n\n  /**\n   * Verify an API key and return the ApiKey record if valid\n   */\n  static async verify(\n    key: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n\n    const { ApiKeyCollection } = await import(\n      '../collections/ApiKeyCollection'\n    );\n    const collection = await ApiKeyCollection.create(options);\n\n    const apiKey = await collection.findOne({\n      where: { keyHash },\n    });\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // A concurrent revocation may have been observed while recordUsage()\n    // rehydrated after a revision conflict. Never authenticate that key.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAuCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;CASA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAA,IAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;GAC/C,IAAI,KAAK,aAAa,MAAM,KAAK,WAAW;GAC5C,IAAI,CAAC,KAAK,QAAQ,GAAG;GACrB,KAAK,6BAAa,IAAI,KAAK;GAC3B,IAAI;IACF,MAAM,KAAK,KAAK;IAChB;GACF,SAAS,OAAO;IACd,IACE,YAAY,KACZ,EACE,iBAAiB,SACjB,UAAU,SACV,MAAM,SAAS,8BAGjB,MAAM;GAEV;EACF;CACF;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;AACF;AAjLE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AASA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAbb,OAcX,WAAA,WAAA,CAAA;AAdW,SAAN,gBAAA,CAVN,KAAK;CACJ,WAAW;CAEX,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}

package/dist/chunks/{ApiKeyCollection-CNFptBxU.js → ApiKeyCollection-Bfb_nw81.js}

@@ -1,5 +1,5 @@
-import { y as __exportAll } from "./NostrIdentity-CbnAJgg9.js";
-import { t as ApiKey } from "./ApiKey-DIqCzx-g.js";
+import { y as __exportAll } from "./NostrIdentity-n70E0vck.js";
+import { t as ApiKey } from "./ApiKey-BZmbOTnL.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/ApiKeyCollection.ts
 var ApiKeyCollection_exports = /* @__PURE__ */ __exportAll({ ApiKeyCollection: () => ApiKeyCollection });
@@ -81,4 +81,4 @@ var ApiKeyCollection = class extends SmrtCollection {
 //#endregion
 export { ApiKeyCollection_exports as n, ApiKeyCollection as t };
 
-//# sourceMappingURL=ApiKeyCollection-CNFptBxU.js.map
+//# sourceMappingURL=ApiKeyCollection-Bfb_nw81.js.map

package/dist/chunks/{ApiKeyCollection-CNFptBxU.js.map → ApiKeyCollection-Bfb_nw81.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyCollection-CNFptBxU.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // recordUsage() reloads after a concurrent-write conflict. A revocation\n    // observed by that reload must fail this authentication attempt closed.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key?.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}
+{"version":3,"file":"ApiKeyCollection-Bfb_nw81.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // recordUsage() reloads after a concurrent-write conflict. A revocation\n    // observed by that reload must fail this authentication attempt closed.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key?.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}

package/dist/chunks/{AuditLogCollection-DxR3ZG6_.js → AuditLogCollection-B1YonCAP.js}

@@ -1,4 +1,4 @@
-import { y as __exportAll } from "./NostrIdentity-CbnAJgg9.js";
+import { y as __exportAll } from "./NostrIdentity-n70E0vck.js";
 import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 //#region src/models/AuditLog.ts
@@ -188,4 +188,4 @@ var AuditLogCollection = class extends SmrtCollection {
 //#endregion
 export { AuditLogCollection_exports as n, AuditLog as r, AuditLogCollection as t };
 
-//# sourceMappingURL=AuditLogCollection-DxR3ZG6_.js.map
+//# sourceMappingURL=AuditLogCollection-B1YonCAP.js.map

package/dist/chunks/{AuditLogCollection-DxR3ZG6_.js.map → AuditLogCollection-B1YonCAP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"AuditLogCollection-DxR3ZG6_.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n  profileId?: string;\n  action?: string;\n  resourceType?: string;\n  resourceId?: string;\n  source?: AuditSource;\n  metadata?: Record<string, unknown>;\n  onBehalfOfId?: string | null;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n  tableName: 'audit_logs',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list'] },\n})\nexport class AuditLog extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  /**\n   * The profile who performed the action\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n   */\n  action: string = '';\n\n  /**\n   * Type of resource affected (e.g., 'Issue', 'Repository')\n   */\n  resourceType: string = '';\n\n  /**\n   * ID of the affected resource\n   */\n  resourceId: string = '';\n\n  /**\n   * Source of the action\n   */\n  source: AuditSource = 'web';\n\n  /**\n   * Additional context (CI run ID, request ID, etc.)\n   */\n  metadata: Record<string, unknown> = {};\n\n  /**\n   * For pass-through identity in CI - the actual person who triggered\n   */\n  @foreignKey('Profile', { nullable: true })\n  onBehalfOfId?: string | null;\n\n  constructor(options: AuditLogOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.action) this.action = options.action;\n    if (options.resourceType) this.resourceType = options.resourceType;\n    if (options.resourceId) this.resourceId = options.resourceId;\n    if (options.source) this.source = options.source;\n    if (options.metadata) this.metadata = options.metadata;\n    if (options.onBehalfOfId !== undefined)\n      this.onBehalfOfId = options.onBehalfOfId;\n  }\n\n  /**\n   * Get the profile who performed the action\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Get the profile on whose behalf the action was performed (if any)\n   */\n  async getOnBehalfOf(): Promise<Profile | null> {\n    if (!this.onBehalfOfId) return null;\n    return (await this.getRelated('onBehalfOfId')) as Profile | null;\n  }\n\n  /**\n   * Get the effective actor (onBehalfOf if set, otherwise profile)\n   */\n  async getEffectiveActor(): Promise<Profile | null> {\n    const onBehalfOf = await this.getOnBehalfOf();\n    if (onBehalfOf) return onBehalfOf;\n    return await this.getProfile();\n  }\n\n  /**\n   * Create an audit log entry\n   */\n  static async record(\n    options: AuditLogOptions & {\n      profile: Profile;\n      onBehalfOf?: Profile | null;\n    },\n  ): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...options,\n      profileId: options.profile.id as string,\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n  static readonly _itemClass = AuditLog;\n\n  /**\n   * Find logs for a profile (actions they performed)\n   */\n  async findByProfile(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs for a resource\n   */\n  async findByResource(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by action type\n   */\n  async findByAction(action: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { action },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by source\n   */\n  async findBySource(source: AuditSource): Promise<AuditLog[]> {\n    return await this.list({\n      where: { source },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs where actions were performed on behalf of someone\n   */\n  async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { onBehalfOfId: profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Record a new audit log entry\n   */\n  async record(options: {\n    profile: Profile;\n    action: string;\n    resourceType: string;\n    resourceId: string;\n    source?: AuditSource;\n    metadata?: Record<string, unknown>;\n    onBehalfOf?: Profile | null;\n  }): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...this.options,\n      profileId: options.profile.id as string,\n      action: options.action,\n      resourceType: options.resourceType,\n      resourceId: options.resourceId,\n      source: options.source || 'web',\n      metadata: options.metadata || {},\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n\n  /**\n   * Get recent activity for a profile\n   */\n  async getRecentActivity(\n    profileId: string,\n    limit: number = 50,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n      limit,\n    });\n  }\n\n  /**\n   * Get activity timeline for a resource\n   */\n  async getResourceTimeline(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt ASC',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAoCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;;;CAKjB,eAAuB;;;;CAKvB,aAAqB;;;;CAKrB,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7FE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AA+BA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAtC9B,SAuCX,WAAA,gBAAA,CAAA;AAvCW,WAAN,gBAAA,CAPN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;AAC3B,CAAC,CAAA,GACY,QAAA;;;;AC5BN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAQS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}
+{"version":3,"file":"AuditLogCollection-B1YonCAP.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n  profileId?: string;\n  action?: string;\n  resourceType?: string;\n  resourceId?: string;\n  source?: AuditSource;\n  metadata?: Record<string, unknown>;\n  onBehalfOfId?: string | null;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n  tableName: 'audit_logs',\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list'] },\n})\nexport class AuditLog extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  /**\n   * The profile who performed the action\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n   */\n  action: string = '';\n\n  /**\n   * Type of resource affected (e.g., 'Issue', 'Repository')\n   */\n  resourceType: string = '';\n\n  /**\n   * ID of the affected resource\n   */\n  resourceId: string = '';\n\n  /**\n   * Source of the action\n   */\n  source: AuditSource = 'web';\n\n  /**\n   * Additional context (CI run ID, request ID, etc.)\n   */\n  metadata: Record<string, unknown> = {};\n\n  /**\n   * For pass-through identity in CI - the actual person who triggered\n   */\n  @foreignKey('Profile', { nullable: true })\n  onBehalfOfId?: string | null;\n\n  constructor(options: AuditLogOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.action) this.action = options.action;\n    if (options.resourceType) this.resourceType = options.resourceType;\n    if (options.resourceId) this.resourceId = options.resourceId;\n    if (options.source) this.source = options.source;\n    if (options.metadata) this.metadata = options.metadata;\n    if (options.onBehalfOfId !== undefined)\n      this.onBehalfOfId = options.onBehalfOfId;\n  }\n\n  /**\n   * Get the profile who performed the action\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Get the profile on whose behalf the action was performed (if any)\n   */\n  async getOnBehalfOf(): Promise<Profile | null> {\n    if (!this.onBehalfOfId) return null;\n    return (await this.getRelated('onBehalfOfId')) as Profile | null;\n  }\n\n  /**\n   * Get the effective actor (onBehalfOf if set, otherwise profile)\n   */\n  async getEffectiveActor(): Promise<Profile | null> {\n    const onBehalfOf = await this.getOnBehalfOf();\n    if (onBehalfOf) return onBehalfOf;\n    return await this.getProfile();\n  }\n\n  /**\n   * Create an audit log entry\n   */\n  static async record(\n    options: AuditLogOptions & {\n      profile: Profile;\n      onBehalfOf?: Profile | null;\n    },\n  ): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...options,\n      profileId: options.profile.id as string,\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n  static readonly _itemClass = AuditLog;\n\n  /**\n   * Find logs for a profile (actions they performed)\n   */\n  async findByProfile(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs for a resource\n   */\n  async findByResource(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by action type\n   */\n  async findByAction(action: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { action },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by source\n   */\n  async findBySource(source: AuditSource): Promise<AuditLog[]> {\n    return await this.list({\n      where: { source },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs where actions were performed on behalf of someone\n   */\n  async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { onBehalfOfId: profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Record a new audit log entry\n   */\n  async record(options: {\n    profile: Profile;\n    action: string;\n    resourceType: string;\n    resourceId: string;\n    source?: AuditSource;\n    metadata?: Record<string, unknown>;\n    onBehalfOf?: Profile | null;\n  }): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...this.options,\n      profileId: options.profile.id as string,\n      action: options.action,\n      resourceType: options.resourceType,\n      resourceId: options.resourceId,\n      source: options.source || 'web',\n      metadata: options.metadata || {},\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n\n  /**\n   * Get recent activity for a profile\n   */\n  async getRecentActivity(\n    profileId: string,\n    limit: number = 50,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n      limit,\n    });\n  }\n\n  /**\n   * Get activity timeline for a resource\n   */\n  async getResourceTimeline(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt ASC',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAoCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;;;CAKjB,eAAuB;;;;CAKvB,aAAqB;;;;CAKrB,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7FE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AA+BA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAtC9B,SAuCX,WAAA,gBAAA,CAAA;AAvCW,WAAN,gBAAA,CAPN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE;AAC3B,CAAC,CAAA,GACY,QAAA;;;;AC5BN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAQS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}