@happyvertical/smrt-profiles 0.51.32 → 0.51.34

package/dist/auth/resolveIdentity.d.ts

@@ -0,0 +1,188 @@
+/**
+ * resolveIdentity - Resolves authentication context to a Profile
+ *
+ * Used by apps (blindmanpress.com) to resolve incoming auth to a Profile.
+ * Modules (aedile, praeco) should receive the resolved profile from the app.
+ *
+ * Resolution order:
+ * 1. API key header → ApiKey → Profile
+ * 2. OIDC session → OidcIdentity → Profile
+ * 3. Nostr auth → NostrIdentity → Profile
+ * 4. Actor header (CI pass-through) → Profile lookup
+ */
+import { type SmrtObjectOptions } from '@happyvertical/smrt-core';
+import { ApiKey } from '../models/ApiKey';
+import { NostrIdentity } from '../models/NostrIdentity';
+import { OidcIdentity } from '../models/OidcIdentity';
+import type { Profile } from '../models/Profile';
+import { type NostrEvent } from './nostrCrypto';
+/**
+ * Context provided to resolveIdentity
+ */
+export interface AuthContext {
+    /**
+     * API key from X-API-Key header or similar
+     */
+    apiKey?: string | null;
+    /**
+     * OIDC session data (from @auth/sveltekit or similar)
+     */
+    oidcSession?: {
+        sub?: string;
+        iss?: string;
+        email?: string;
+        name?: string;
+    } | null;
+    /**
+     * Actor identifier for CI pass-through identity
+     * Usually the GitHub actor (username) who triggered the workflow
+     */
+    actor?: string | null;
+    /**
+     * Nostr authentication data (NIP-42 style)
+     */
+    nostrAuth?: {
+        /** Signed Nostr event for authentication */
+        event: NostrEvent;
+        /** Expected challenge (to prevent replay attacks) */
+        challenge: string;
+    } | null;
+    /**
+     * Database/persistence options
+     */
+    db?: SmrtObjectOptions['db'];
+}
+/**
+ * Result of identity resolution
+ */
+export interface ResolveIdentityResult {
+    /**
+     * The resolved profile, or null if not authenticated
+     */
+    profile: Profile | null;
+    /**
+     * How the identity was resolved
+     */
+    source: 'api_key' | 'oidc' | 'nostr' | 'actor' | 'none';
+    /**
+     * The API key record if authenticated via API key
+     */
+    apiKey?: ApiKey;
+    /**
+     * The OIDC identity record if authenticated via OIDC
+     */
+    oidcIdentity?: OidcIdentity;
+    /**
+     * The Nostr identity record if authenticated via Nostr
+     */
+    nostrIdentity?: NostrIdentity;
+}
+/**
+ * Resolve authentication context to a Profile
+ *
+ * @param context - The authentication context from the request
+ * @returns The resolved profile and metadata
+ *
+ * @example
+ * ```typescript
+ * // In SvelteKit hooks.server.ts
+ * import { resolveIdentity } from '@happyvertical/smrt-profiles';
+ *
+ * const identityMiddleware: Handle = async ({ event, resolve }) => {
+ *   const session = await event.locals.auth();
+ *
+ *   const { profile, source } = await resolveIdentity({
+ *     oidcSession: session,
+ *     apiKey: event.request.headers.get('X-API-Key'),
+ *     actor: event.request.headers.get('X-Actor'),
+ *     db: { type: 'postgres', url: DATABASE_URL },
+ *   });
+ *
+ *   event.locals.profile = profile;
+ *   event.locals.authSource = source;
+ *
+ *   return resolve(event);
+ * };
+ * ```
+ */
+export declare function resolveIdentity(context: AuthContext): Promise<ResolveIdentityResult>;
+/**
+ * Create a profile from OIDC claims if it doesn't exist
+ *
+ * Resolution order:
+ * 1. If OIDC identity (iss + sub) already exists → return linked profile
+ * 2. If the email matches an existing Profile, fail closed because this
+ *    package cannot prove whether a User owns it
+ * 3. Otherwise, create new profile + identity
+ *
+ * Security considerations:
+ * - Existing issuer/subject links always keep their already-linked Profile,
+ *   including legacy tenant-scoped or non-Person Profiles, and refresh the
+ *   cached identity email. This exact-link compatibility does not perform
+ *   email-based canonical reuse.
+ * - New identities never attach to an existing email match through this
+ *   Profile-only helper because Profile ownership belongs to the users package.
+ *   Use `UserCollection.getOrCreateFromOidc()` for owner-aware verified-email
+ *   reuse and its supported pre-provision resolver hook.
+ * - This function trusts the OIDC provider to assert correct email_verified status.
+ *   Only use with trusted providers.
+ *
+ * @param claims - OIDC token claims
+ * @param provider - Provider name (e.g., 'keycloak', 'google', 'github')
+ * @param options - Database options
+ * @returns The created or existing profile with linked OIDC identity
+ */
+export declare function createProfileFromOidc(claims: {
+    sub: string;
+    iss: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    preferred_username?: string;
+}, provider: string, options: SmrtObjectOptions): Promise<{
+    profile: Profile;
+    oidcIdentity: OidcIdentity;
+    created: boolean;
+}>;
+/**
+ * @internal Transactionally reuse one exact legacy issuer/subject link.
+ *
+ * This path cannot create or rebind authority. It intentionally preserves
+ * existing tenant-scoped and non-Person Profile links; canonical global Person
+ * validation remains mandatory for every path that creates a User/session.
+ */
+export declare function reuseExistingOidcIdentityForProfile(profileId: string, claims: {
+    sub: string;
+    iss: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    preferred_username?: string;
+}, provider: string, options: SmrtObjectOptions): Promise<{
+    profile: Profile;
+    oidcIdentity: OidcIdentity;
+    created: false;
+}>;
+/**
+ * Create a profile from Nostr identity (used by magic link service)
+ *
+ * This is typically called internally by the magic link service,
+ * but can be used directly if needed.
+ *
+ * @param email - Email address for the profile
+ * @param nostrData - Encrypted Nostr keypair data
+ * @param options - Database options
+ * @returns The created profile with linked Nostr identity
+ */
+export declare function createProfileFromNostr(email: string, nostrData: {
+    pubkey: string;
+    encryptedPrivkey: string;
+    encryptionIv: string;
+    encryptionTag: string;
+    nip05Username?: string;
+}, options: SmrtObjectOptions): Promise<{
+    profile: Profile;
+    nostrIdentity: NostrIdentity;
+    created: boolean;
+}>;
+//# sourceMappingURL=resolveIdentity.d.ts.map

package/dist/auth/resolveIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveIdentity.d.ts","sourceRoot":"","sources":["../../src/auth/resolveIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,eAAe,CAAC;AAUjE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;IAET;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,4CAA4C;QAC5C,KAAK,EAAE,UAAU,CAAC;QAClB,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IAExD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CA0FhC;AA0DD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IACN,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,EACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAE7E;AAED;;;;;;GAMG;AACH,wBAAsB,mCAAmC,CACvD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IACN,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,EACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAiD3E;AA0MD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,SAAS,EAAE;IACT,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAuED"}

package/dist/collections/ApiKeyCollection.d.ts

@@ -0,0 +1,46 @@
+/**
+ * ApiKeyCollection - Collection for managing API keys
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { ApiKey, type GenerateKeyResult } from '../models/ApiKey';
+import type { Profile } from '../models/Profile';
+export declare class ApiKeyCollection extends SmrtCollection<ApiKey> {
+    static readonly _itemClass: typeof ApiKey;
+    /**
+     * Find all keys for a profile
+     */
+    findByProfile(profileId: string): Promise<ApiKey[]>;
+    /**
+     * Find active (non-revoked, non-expired) keys for a profile
+     */
+    findActiveByProfile(profileId: string): Promise<ApiKey[]>;
+    /**
+     * Find key by hash
+     */
+    findByHash(keyHash: string): Promise<ApiKey | null>;
+    /**
+     * Verify an API key string and return the record if valid
+     */
+    verify(key: string): Promise<ApiKey | null>;
+    /**
+     * Generate a new key for a profile
+     */
+    generateForProfile(profile: Profile, options: {
+        name: string;
+        scopes?: string[];
+        expiresAt?: Date | null;
+    }): Promise<GenerateKeyResult>;
+    /**
+     * Revoke all keys for a profile
+     */
+    revokeAllForProfile(profileId: string): Promise<number>;
+    /**
+     * Revoke a specific key by prefix
+     */
+    revokeByPrefix(keyPrefix: string): Promise<boolean>;
+    /**
+     * Clean up expired keys (soft delete by setting revokedAt)
+     */
+    cleanupExpired(): Promise<number>;
+}
+//# sourceMappingURL=ApiKeyCollection.d.ts.map

package/dist/collections/ApiKeyCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyCollection.d.ts","sourceRoot":"","sources":["../../src/collections/ApiKeyCollection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,MAAM,CAAC;IAC1D,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAU;IAEpC;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAMzD;;OAEG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/D;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAMzD;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiBjD;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;KACzB,GACA,OAAO,CAAC,iBAAiB,CAAC;IAO7B;;OAEG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYzD;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAexC"}

package/dist/collections/AuditLogCollection.d.ts

@@ -0,0 +1,50 @@
+/**
+ * AuditLogCollection - Collection for querying audit logs
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { AuditLog, type AuditSource } from '../models/AuditLog';
+import type { Profile } from '../models/Profile';
+export declare class AuditLogCollection extends SmrtCollection<AuditLog> {
+    static readonly _itemClass: typeof AuditLog;
+    /**
+     * Find logs for a profile (actions they performed)
+     */
+    findByProfile(profileId: string): Promise<AuditLog[]>;
+    /**
+     * Find logs for a resource
+     */
+    findByResource(resourceType: string, resourceId: string): Promise<AuditLog[]>;
+    /**
+     * Find logs by action type
+     */
+    findByAction(action: string): Promise<AuditLog[]>;
+    /**
+     * Find logs by source
+     */
+    findBySource(source: AuditSource): Promise<AuditLog[]>;
+    /**
+     * Find logs where actions were performed on behalf of someone
+     */
+    findOnBehalfOf(profileId: string): Promise<AuditLog[]>;
+    /**
+     * Record a new audit log entry
+     */
+    record(options: {
+        profile: Profile;
+        action: string;
+        resourceType: string;
+        resourceId: string;
+        source?: AuditSource;
+        metadata?: Record<string, unknown>;
+        onBehalfOf?: Profile | null;
+    }): Promise<AuditLog>;
+    /**
+     * Get recent activity for a profile
+     */
+    getRecentActivity(profileId: string, limit?: number): Promise<AuditLog[]>;
+    /**
+     * Get activity timeline for a resource
+     */
+    getResourceTimeline(resourceType: string, resourceId: string): Promise<AuditLog[]>;
+}
+//# sourceMappingURL=AuditLogCollection.d.ts.map

package/dist/collections/AuditLogCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogCollection.d.ts","sourceRoot":"","sources":["../../src/collections/AuditLogCollection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,qBAAa,kBAAmB,SAAQ,cAAc,CAAC,QAAQ,CAAC;IAC9D,MAAM,CAAC,QAAQ,CAAC,UAAU,kBAAY;IAEtC;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAO3D;;OAEG;IACG,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC;IAOtB;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAOvD;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAO5D;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAO5D;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;KAC7B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgBrB;;OAEG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC;IAQtB;;OAEG;IACG,mBAAmB,CACvB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC;CAMvB"}

package/dist/collections/MagicLinkTokenCollection.d.ts

@@ -0,0 +1,58 @@
+/**
+ * MagicLinkTokenCollection - Collection for managing magic link tokens
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { MagicLinkToken } from '../models/MagicLinkToken';
+export declare class MagicLinkTokenCollection extends SmrtCollection<MagicLinkToken> {
+    static readonly _itemClass: typeof MagicLinkToken;
+    /**
+     * Find token by hash
+     */
+    findByTokenHash(tokenHash: string): Promise<MagicLinkToken | null>;
+    /**
+     * Find active (non-expired, non-used) tokens for an email
+     */
+    findActiveForEmail(email: string): Promise<MagicLinkToken[]>;
+    /**
+     * Find tokens for a NostrIdentity
+     */
+    findByIdentity(nostrIdentityId: string): Promise<MagicLinkToken[]>;
+    /**
+     * Count tokens created for an email within a time window (for rate limiting)
+     * @param email - Email address
+     * @param withinMinutes - Time window in minutes
+     */
+    countRecentByEmail(email: string, withinMinutes: number): Promise<number>;
+    /**
+     * Count tokens created from an IP within a time window (for rate limiting)
+     * @param ip - IP address
+     * @param withinMinutes - Time window in minutes
+     */
+    countRecentByIp(ip: string, withinMinutes: number): Promise<number>;
+    /**
+     * Verify a token and return it if valid
+     */
+    verify(token: string): Promise<MagicLinkToken | null>;
+    /**
+     * Clean up expired tokens by deleting them
+     * @returns Number of tokens deleted
+     */
+    cleanupExpired(): Promise<number>;
+    /**
+     * Revoke all tokens for a NostrIdentity (e.g., when identity is deleted)
+     */
+    revokeForIdentity(nostrIdentityId: string): Promise<number>;
+    /**
+     * Check if rate limit is exceeded for email
+     * @param email - Email address
+     * @param maxPerHour - Maximum tokens allowed per hour (default: 5)
+     */
+    isRateLimitedByEmail(email: string, maxPerHour?: number): Promise<boolean>;
+    /**
+     * Check if rate limit is exceeded for IP
+     * @param ip - IP address
+     * @param maxPerHour - Maximum tokens allowed per hour (default: 10)
+     */
+    isRateLimitedByIp(ip: string, maxPerHour?: number): Promise<boolean>;
+}
+//# sourceMappingURL=MagicLinkTokenCollection.d.ts.map

package/dist/collections/MagicLinkTokenCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MagicLinkTokenCollection.d.ts","sourceRoot":"","sources":["../../src/collections/MagicLinkTokenCollection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,cAAc,CAAC;IAC1E,MAAM,CAAC,QAAQ,CAAC,UAAU,wBAAkB;IAE5C;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAMxE;;OAEG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAOlE;;OAEG;IACG,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMxE;;;;OAIG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAclB;;;;OAIG;IACG,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAazE;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAe3D;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAevC;;OAEG;IACG,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAcjE;;;;OAIG;IACG,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,MAAU,GACrB,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;OAIG;IACG,iBAAiB,CACrB,EAAE,EAAE,MAAM,EACV,UAAU,GAAE,MAAW,GACtB,OAAO,CAAC,OAAO,CAAC;CAIpB"}

package/dist/collections/NostrIdentityCollection.d.ts

@@ -0,0 +1,66 @@
+/**
+ * NostrIdentityCollection - Collection for managing Nostr identity records
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { NostrIdentity } from '../models/NostrIdentity';
+import type { Profile } from '../models/Profile';
+export interface Nip05Response {
+    names: Record<string, string>;
+    relays?: Record<string, string[]>;
+}
+export declare class NostrIdentityCollection extends SmrtCollection<NostrIdentity> {
+    static readonly _itemClass: typeof NostrIdentity;
+    /**
+     * Find identities for a profile
+     */
+    findByProfile(profileId: string): Promise<NostrIdentity[]>;
+    /**
+     * Find identity by public key
+     */
+    findByPubkey(pubkey: string): Promise<NostrIdentity | null>;
+    /**
+     * Find identity by email
+     */
+    findByEmail(email: string): Promise<NostrIdentity | null>;
+    /**
+     * Find identity by NIP-05 username
+     */
+    findByNip05(username: string): Promise<NostrIdentity | null>;
+    /**
+     * Link a new Nostr identity to a profile with a new keypair
+     * @param profile - The profile to link to
+     * @param email - Email address for this identity
+     * @param masterSecret - Server master secret for encryption
+     * @param nip05Username - Optional NIP-05 username (defaults to email local part)
+     */
+    createForProfile(profile: Profile, email: string, masterSecret: string, nip05Username?: string): Promise<NostrIdentity>;
+    /**
+     * Link an existing Nostr identity (with encrypted keypair) to a profile
+     */
+    linkToProfile(profile: Profile, nostrData: {
+        pubkey: string;
+        encryptedPrivkey: string;
+        encryptionIv: string;
+        encryptionTag: string;
+        email: string;
+        nip05Username?: string;
+    }): Promise<NostrIdentity>;
+    /**
+     * Unlink a Nostr identity from a profile
+     */
+    unlinkFromProfile(profileId: string, pubkey: string): Promise<boolean>;
+    /**
+     * Get NIP-05 response data for the /.well-known/nostr.json endpoint
+     * @param username - Optional username filter, returns all if not provided
+     */
+    getNip05Response(username?: string): Promise<Nip05Response>;
+    /**
+     * Check if a NIP-05 username is available
+     */
+    isNip05Available(username: string): Promise<boolean>;
+    /**
+     * Update NIP-05 username for an identity
+     */
+    updateNip05Username(identity: NostrIdentity, newUsername: string): Promise<NostrIdentity>;
+}
+//# sourceMappingURL=NostrIdentityCollection.d.ts.map

package/dist/collections/NostrIdentityCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NostrIdentityCollection.d.ts","sourceRoot":"","sources":["../../src/collections/NostrIdentityCollection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACnC;AAED,qBAAa,uBAAwB,SAAQ,cAAc,CAAC,aAAa,CAAC;IACxE,MAAM,CAAC,QAAQ,CAAC,UAAU,uBAAiB;IAE3C;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAMhE;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAMjE;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAM/D;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAMlE;;;;;;OAMG;IACG,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC;IAqCzB;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC,aAAa,CAAC;IAgCzB;;OAEG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAY5E;;;OAGG;IACG,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAoBjE;;OAEG;IACG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1D;;OAEG;IACG,mBAAmB,CACvB,QAAQ,EAAE,aAAa,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;CAc1B"}

package/dist/collections/OidcIdentityCollection.d.ts

@@ -0,0 +1,45 @@
+/**
+ * OidcIdentityCollection - Collection for managing OIDC identity records
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { OidcIdentity } from '../models/OidcIdentity';
+import type { Profile } from '../models/Profile';
+/** More than one legacy row maps the same opaque OIDC issuer and subject. */
+export declare class AmbiguousOidcIdentityError extends Error {
+    readonly issuer: string;
+    readonly subject: string;
+    constructor(issuer: string, subject: string);
+}
+export declare class OidcIdentityCollection extends SmrtCollection<OidcIdentity> {
+    static readonly _itemClass: typeof OidcIdentity;
+    /**
+     * Find identities for a profile
+     */
+    findByProfile(profileId: string): Promise<OidcIdentity[]>;
+    /**
+     * Find identity by issuer and subject
+     */
+    findBySubject(issuer: string, subject: string): Promise<OidcIdentity | null>;
+    /**
+     * Find identities by provider
+     */
+    findByProvider(provider: string): Promise<OidcIdentity[]>;
+    /**
+     * Reuse an existing exact OIDC identity for its unchanged Profile.
+     *
+     * @deprecated New authentication links require the owner-aware,
+     * transactional provisioning APIs. This compatibility helper may refresh a
+     * legacy Profile type, but refuses to create or rebind authority.
+     */
+    linkToProfile(profile: Profile, oidcData: {
+        provider: string;
+        issuer: string;
+        subject: string;
+        email?: string;
+    }): Promise<OidcIdentity>;
+    /**
+     * Unlink an OIDC identity from a profile
+     */
+    unlinkFromProfile(profileId: string, issuer: string, subject: string): Promise<boolean>;
+}
+//# sourceMappingURL=OidcIdentityCollection.d.ts.map

package/dist/collections/OidcIdentityCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcIdentityCollection.d.ts","sourceRoot":"","sources":["../../src/collections/OidcIdentityCollection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM;gBADf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM;CAK3B;AAED,qBAAa,sBAAuB,SAAQ,cAAc,CAAC,YAAY,CAAC;IACtE,MAAM,CAAC,QAAQ,CAAC,UAAU,sBAAgB;IAE1C;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAM/D;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0B/B;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAM/D;;;;;;OAMG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GACA,OAAO,CAAC,YAAY,CAAC;IAIxB;;OAEG;IACG,iBAAiB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;CAWpB"}

package/dist/collections/OidcProfileEmailReservationCollection.d.ts

@@ -0,0 +1,7 @@
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { OidcProfileEmailReservation } from '../models/OidcProfileEmailReservation';
+/** Internal collection for canonical OIDC email reservations. */
+export declare class OidcProfileEmailReservationCollection extends SmrtCollection<OidcProfileEmailReservation> {
+    static readonly _itemClass: typeof OidcProfileEmailReservation;
+}
+//# sourceMappingURL=OidcProfileEmailReservationCollection.d.ts.map

package/dist/collections/OidcProfileEmailReservationCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcProfileEmailReservationCollection.d.ts","sourceRoot":"","sources":["../../src/collections/OidcProfileEmailReservationCollection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAEpF,iEAAiE;AACjE,qBAAa,qCAAsC,SAAQ,cAAc,CAAC,2BAA2B,CAAC;IACpG,MAAM,CAAC,QAAQ,CAAC,UAAU,qCAA+B;CAC1D"}

package/dist/collections/ProfileAssetCollection.d.ts

@@ -0,0 +1,17 @@
+import type { Asset } from '@happyvertical/smrt-assets';
+import type { SmrtCollectionOptions } from '@happyvertical/smrt-core';
+import { SmrtJunction } from '@happyvertical/smrt-core';
+import { ProfileAsset } from '../models/ProfileAsset';
+export interface ProfileAssetCollectionOptions extends SmrtCollectionOptions {
+}
+export declare class ProfileAssetCollection extends SmrtJunction<ProfileAsset> {
+    static readonly _itemClass: typeof ProfileAsset;
+    protected leftField: string;
+    protected rightField: string;
+    private profileCollectionPromise;
+    private getProfileCollection;
+    getAssets(profileId: string, relationship?: string): Promise<Asset[]>;
+    addAsset(profileId: string, asset: Asset, relationship?: string, sortOrder?: number): Promise<void>;
+    removeAsset(profileId: string, assetId: string, relationship?: string): Promise<void>;
+}
+//# sourceMappingURL=ProfileAssetCollection.d.ts.map

package/dist/collections/ProfileAssetCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProfileAssetCollection.d.ts","sourceRoot":"","sources":["../../src/collections/ProfileAssetCollection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAMxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAQ,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,WAAW,6BAA8B,SAAQ,qBAAqB;CAAG;AAE/E,qBAKa,sBAAuB,SAAQ,YAAY,CAAC,YAAY,CAAC;IACpE,MAAM,CAAC,QAAQ,CAAC,UAAU,sBAAgB;IAC1C,SAAS,CAAC,SAAS,SAAe;IAClC,SAAS,CAAC,UAAU,SAAa;IAEjC,OAAO,CAAC,wBAAwB,CAA2C;YAE7D,oBAAoB;IAS5B,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAQrE,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,EACZ,YAAY,SAAe,EAC3B,SAAS,SAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IAWV,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;CASjB"}

package/dist/collections/ProfileCollection.d.ts

@@ -0,0 +1,130 @@
+/**
+ * ProfileCollection - Collection manager for Profile objects
+ *
+ * Provides advanced querying and batch operations for Profile entities.
+ */
+import type { Asset } from '@happyvertical/smrt-assets';
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { Profile } from '../models/Profile';
+export type CanonicalPersonProfileErrorCode = 'ambiguous_email' | 'email_key_backfill_required' | 'email_mismatch' | 'missing_profile' | 'non_person' | 'reservation_conflict' | 'tenant_scoped';
+/** A Profile cannot safely represent one global human identity. */
+export declare class CanonicalPersonProfileError extends Error {
+    readonly code: CanonicalPersonProfileErrorCode;
+    constructor(code: CanonicalPersonProfileErrorCode, message: string);
+}
+export declare class ProfileCollection extends SmrtCollection<Profile> {
+    static readonly _itemClass: typeof Profile;
+    private emailKeysReadyPromise;
+    /**
+     * Find a profile by email address
+     *
+     * @param email - The email address to search for
+     * @returns The matching profile or null
+     */
+    findByEmail(email: string): Promise<Profile | null>;
+    /**
+     * Resolve one unambiguous global Person by normalized email.
+     *
+     * Unlike `findByEmail()`, this identity-boundary helper deliberately reads
+     * across tenant scopes and fails closed when any matching row is
+     * tenant-scoped, is not a Person STI row, or when more than one row matches
+     * case-insensitively. It is intended for verified external identities.
+     */
+    findUniqueGlobalPersonByEmail(email: string): Promise<Profile | null>;
+    /**
+     * Validate and hydrate a supplied canonical Profile.
+     *
+     * The Profile must be the sole case-insensitive match for its stored email.
+     * When `email` is provided, that address must also match the stored email.
+     */
+    requireCanonicalGlobalPerson(profileId: string, email?: string): Promise<Profile>;
+    /**
+     * Reserve the normalized email for a previously validated canonical Person.
+     *
+     * The unique stored key turns a concurrent OIDC first-login race into a
+     * retryable database conflict. Legacy Profiles remain unaffected until an
+     * identity boundary safely claims them.
+     */
+    reserveCanonicalIdentityEmail(profileId: string, email?: string): Promise<Profile>;
+    /**
+     * Find profiles by type slug
+     *
+     * @param typeSlug - The profile type slug to filter by
+     * @returns Array of matching profiles
+     */
+    findByType(typeSlug: string): Promise<Profile[]>;
+    private requireDatabase;
+    private loadCanonicalEmailRows;
+    /** Require the deploy-time backfill marker before indexed identity reads. */
+    private ensureEmailKeysReady;
+    private checkEmailKeysReady;
+    private isStaleEmailReservation;
+    private assertRowEmailKeyCurrent;
+    private assertCanonicalRows;
+    private requireHydratedProfile;
+    /**
+     * Batch get metadata for multiple profiles
+     *
+     * @param profileIds - Array of profile UUIDs
+     * @returns Map of profile ID to metadata object
+     */
+    batchGetMetadata(profileIds: string[]): Promise<Map<string, Record<string, string>>>;
+    /**
+     * Batch update metadata for multiple profiles
+     *
+     * @param updates - Array of { profileId, data } objects
+     */
+    batchUpdateMetadata(updates: Array<{
+        profileId: string;
+        data: Record<string, unknown>;
+    }>): Promise<void>;
+    /**
+     * Find related profiles for a given profile
+     *
+     * @param profileId - The profile UUID
+     * @param relationshipSlug - Optional filter by relationship type
+     * @returns Array of related profiles
+     */
+    findRelated(profileId: string, relationshipSlug?: string): Promise<Profile[]>;
+    getAssets(profileId: string, relationship?: string): Promise<Asset[]>;
+    addAsset(profileId: string, asset: Asset, relationship?: string, sortOrder?: number): Promise<void>;
+    removeAsset(profileId: string, assetId: string, relationship?: string): Promise<void>;
+    /**
+     * Get the relationship network for a profile up to a maximum depth
+     *
+     * @param profileId - The starting profile UUID
+     * @param options - Configuration options
+     * @returns Map of profile ID to depth level
+     */
+    getRelationshipNetwork(profileId: string, options?: {
+        maxDepth?: number;
+    }): Promise<Map<string, number>>;
+    /**
+     * Find all profiles belonging to a specific tenant
+     *
+     * @param tenantId - The tenant UUID to filter by
+     * @returns Array of profiles for this tenant
+     */
+    findByTenant(tenantId: string): Promise<Profile[]>;
+    /**
+     * Find all global profiles (no tenant association).
+     *
+     * Routes through the shared tenant-global helper so it does not throw under
+     * an active tenant context (an explicit `tenant_id IS NULL` filter would be
+     * flagged as an isolation violation). (#1600)
+     *
+     * @returns Array of profiles with null tenantId
+     */
+    findGlobal(): Promise<Profile[]>;
+    /**
+     * Find profiles belonging to a tenant plus all global profiles.
+     *
+     * Fails closed if an active tenant context requests a different tenant's
+     * rows; the admin/system path keeps the cross-tenant capability. (#1600)
+     *
+     * @param tenantId - The tenant UUID to include
+     * @returns Array of tenant-specific and global profiles
+     */
+    findWithGlobals(tenantId: string): Promise<Profile[]>;
+}
+//# sourceMappingURL=ProfileCollection.d.ts.map

package/dist/collections/ProfileCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProfileCollection.d.ts","sourceRoot":"","sources":["../../src/collections/ProfileCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAMxD,OAAO,EAEL,cAAc,EAEf,MAAM,0BAA0B,CAAC;AAYlC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAU5C,MAAM,MAAM,+BAA+B,GACvC,iBAAiB,GACjB,6BAA6B,GAC7B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,sBAAsB,GACtB,eAAe,CAAC;AAEpB,mEAAmE;AACnE,qBAAa,2BAA4B,SAAQ,KAAK;IAElD,QAAQ,CAAC,IAAI,EAAE,+BAA+B;gBAArC,IAAI,EAAE,+BAA+B,EAC9C,OAAO,EAAE,MAAM;CAKlB;AAUD,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;IACrC,OAAO,CAAC,qBAAqB,CAA8B;IAE3D;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASzD;;;;;;;OAOG;IACG,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS3E;;;;;OAKG;IACG,4BAA4B,CAChC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAiDnB;;;;;;OAMG;IACG,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IA8EnB;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAetD,OAAO,CAAC,eAAe;YAUT,sBAAsB;IAqBpC,6EAA6E;YAC/D,oBAAoB;YAUpB,mBAAmB;YAcnB,uBAAuB;IAgBrC,OAAO,CAAC,wBAAwB;IAkBhC,OAAO,CAAC,mBAAmB;YA8Bb,sBAAsB;IAcpC;;;;;OAKG;IACG,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAAE,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAc/C;;;;OAIG;IACG,mBAAmB,CACvB,OAAO,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GACnE,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;OAMG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,EAAE,CAAC;IAOf,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAIrE,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,EACZ,YAAY,SAAe,EAC3B,SAAS,SAAI,GACZ,OAAO,CAAC,IAAI,CAAC;IAWV,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;OAMG;IACG,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAsC/B;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAIxD;;;;;;;;OAQG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAItC;;;;;;;;OAQG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAG5D"}