@happyvertical/smrt-profiles 0.54.2 → 0.54.4

package/AGENTS.md

@@ -10,7 +10,7 @@ Central identity system with multi-auth, relationships, controlled metadata, and
 - **Profile.isPublic**: optional public-figure flag (boolean, default false). Records the fact only; consumers decide visibility.
 - **ProfileRelationship**: bidirectional — creating one auto-creates reciprocal inverse. `contextProfileId` for tertiary relationships. `ProfileRelationshipTerm` tracks start/end dates.
 - **ProfileMetafield**: controlled vocabulary with `validationSchema`. **ProfileMetadata**: per-profile values linked to metafields. `addMetadata()` stamps new rows with the profile's `tenantId` (never rely on auto-population, which super-admin/system context skips, #3235) and resolves the metafield as profile-tenant first, then global, never another tenant's.
-- **AuditLog**: action, resourceType/Id, `source` (web/cli/ci/webhook/mcp), `onBehalfOfId` for CI pass-through identity. `allowSuperAdminBypass: true`.
+- **AuditLog**: sensitive audit persistence with actor, action, reason, before/after `changes`, indexed `occurredAt`, resourceType/Id, source, and delegated identity. No generated read routes. `createAuditWriter`, consumer-authorized `readAuditTrail`, and bounded `pruneAuditTrail` live in `src/audit-trail.ts`; see [audit contract](../../docs/content/audit-trail.md).
 
 ## Auth Methods
 

package/dist/agent-profile.d.ts

@@ -22,8 +22,8 @@
  *
  * @module
  */
-import type { ProfileCollection } from './collections/ProfileCollection';
-import type { Profile } from './models/Profile';
+import type { ProfileCollection } from "./collections/ProfileCollection.js";
+import type { Profile } from "./models/Profile.js";
 /**
  * Reserved slug context for agent-owned profiles.
  *

package/dist/agent-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-profile.d.ts","sourceRoot":"","sources":["../src/agent-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,MAAM,CAAC,CASjB"}
+{"version":3,"file":"agent-profile.d.ts","sourceRoot":"","sources":["../src/agent-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAiC,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAkB,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/audit-trail.d.ts

@@ -0,0 +1,24 @@
+import type { AuditWriter } from '@happyvertical/smrt-core';
+import type { AuditLogCollection } from './collections/AuditLogCollection.js';
+import { AuditLog } from './models/AuditLog.js';
+/** Profiles owns audit persistence; core only owns the mutation contract. */
+export declare function createAuditWriter(): AuditWriter;
+export interface AuditFilter {
+    profileId?: string;
+    resourceType?: string;
+    resourceId?: string;
+    from?: Date;
+    to?: Date;
+    limit?: number;
+}
+/** Consumer checks both audit permission and access to the referenced resource. */
+export type AuthorizeAuditRead = (entry: AuditLog) => boolean | Promise<boolean>;
+/** No generated read routes: consumers expose this fail-closed permission seam. */
+export declare function readAuditTrail(logs: AuditLogCollection, authorize: AuthorizeAuditRead, filter?: AuditFilter): Promise<AuditLog[]>;
+/** Explicit maintenance API. Scheduling and retention window belong to the consumer. */
+export declare function pruneAuditTrail(logs: AuditLogCollection, options: {
+    maxAgeDays: number;
+    now?: Date;
+    batchSize?: number;
+}): Promise<number>;
+//# sourceMappingURL=audit-trail.d.ts.map

package/dist/audit-trail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail.d.ts","sourceRoot":"","sources":["../src/audit-trail.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,6EAA6E;AAC7E,wBAAgB,iBAAiB,IAAI,WAAW,CAiB/C;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,EAAE,CAAC,EAAE,IAAI,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,KAAK,EAAE,QAAQ,KACZ,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,mFAAmF;AACnF,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,kBAAkB,EAC7B,MAAM,GAAE,WAAgB,GACvB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAsCrB;AAED,wFAAwF;AACxF,wBAAsB,eAAe,CACnC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/auth/index.d.ts

@@ -4,9 +4,9 @@
  * Provides identity resolution and authentication primitives.
  * Apps configure auth (OIDC providers, Nostr), modules receive resolved profiles.
  */
-export { createMagicLinkService, type InitiateResult, type MagicLinkConfig, type MagicLinkService, type VerifyResult, } from './magicLinkService';
-export { createNip05Handler, isValidNip05Identifier, type Nip05HandlerConfig, type Nip05HandlerResult, type Nip05Request, parseNip05Identifier, } from './nip05Handler';
-export { normalizeIdentityEmail } from './normalizeIdentityEmail';
-export { computeEventId, createAuthEvent, decryptPrivkey, deriveEncryptionKey, type EncryptedKey, encryptPrivkey, generateNostrKeypair, getPublicKey, isValidPrivkey, isValidPubkey, type NostrEvent, type NostrKeypair, npubToPubkey, nsecToPrivkey, privkeyToNsec, pubkeyToNpub, signEvent, verifyAuthEvent, verifyNostrSignature, } from './nostrCrypto';
-export { type AuthContext, createProfileFromNostr, createProfileFromOidc, type ResolveIdentityResult, resolveIdentity, } from './resolveIdentity';
+export { createMagicLinkService, type InitiateResult, type MagicLinkConfig, type MagicLinkService, type VerifyResult, } from "./magicLinkService.js";
+export { createNip05Handler, isValidNip05Identifier, type Nip05HandlerConfig, type Nip05HandlerResult, type Nip05Request, parseNip05Identifier, } from "./nip05Handler.js";
+export { normalizeIdentityEmail } from "./normalizeIdentityEmail.js";
+export { computeEventId, createAuthEvent, decryptPrivkey, deriveEncryptionKey, type EncryptedKey, encryptPrivkey, generateNostrKeypair, getPublicKey, isValidPrivkey, isValidPubkey, type NostrEvent, type NostrKeypair, npubToPubkey, nsecToPrivkey, privkeyToNsec, pubkeyToNpub, signEvent, verifyAuthEvent, verifyNostrSignature, } from "./nostrCrypto.js";
+export { type AuthContext, createProfileFromNostr, createProfileFromOidc, type ResolveIdentityResult, resolveIdentity, } from "./resolveIdentity.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,KAAK,YAAY,EACjB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,KAAK,WAAW,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,eAAe,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,uBAAoB,CAAC;AAE5B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,oBAAoB,GACrB,MAAM,mBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA0B,CAAC;AAElE,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,KAAK,YAAY,EACjB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,oBAAoB,GACrB,MAAM,kBAAe,CAAC;AAEvB,OAAO,EACL,KAAK,WAAW,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,eAAe,GAChB,MAAM,sBAAmB,CAAC"}

package/dist/auth/magicLinkService.d.ts

@@ -8,8 +8,8 @@
  * - Rate limiting checks
  */
 import type { SmrtObjectOptions } from '@happyvertical/smrt-core';
-import type { NostrIdentity } from '../models/NostrIdentity';
-import type { Profile } from '../models/Profile';
+import type { NostrIdentity } from "../models/NostrIdentity.js";
+import type { Profile } from "../models/Profile.js";
 export interface MagicLinkConfig {
     /** Base URL for magic links (e.g., "https://example.com") */
     baseUrl: string;

package/dist/auth/magicLinkService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinkService.d.ts","sourceRoot":"","sources":["../../src/auth/magicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,uBAAuB;IACvB,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yBAAyB;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,eAAe,GAAG,eAAe,GAAG,YAAY,GAAG,WAAW,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,CACN,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,GACtB,gBAAgB,CAuOlB"}
+{"version":3,"file":"magicLinkService.d.ts","sourceRoot":"","sources":["../../src/auth/magicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAmB,CAAC;AAGjD,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,mDAAmD;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,uBAAuB;IACvB,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;CAC5E;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yBAAyB;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,eAAe,GAAG,eAAe,GAAG,YAAY,GAAG,WAAW,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,CACN,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,GACtB,gBAAgB,CAuOlB"}

package/dist/auth/nip05Handler.d.ts

@@ -7,7 +7,7 @@
  * @see https://github.com/nostr-protocol/nips/blob/master/05.md
  */
 import type { SmrtObjectOptions } from '@happyvertical/smrt-core';
-import { type Nip05Response } from '../collections/NostrIdentityCollection';
+import { type Nip05Response } from "../collections/NostrIdentityCollection.js";
 export interface Nip05HandlerConfig {
     /** Database options */
     db: SmrtObjectOptions['db'];

package/dist/auth/nip05Handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nip05Handler.d.ts","sourceRoot":"","sources":["../../src/auth/nip05Handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,IAIzD,SAAS,YAAY,KACpB,OAAO,CAAC,kBAAkB,CAAC,CAqC/B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAoBlE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAOP"}
+{"version":3,"file":"nip05Handler.d.ts","sourceRoot":"","sources":["../../src/auth/nip05Handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,2CAAwC,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,IAIzD,SAAS,YAAY,KACpB,OAAO,CAAC,kBAAkB,CAAC,CAqC/B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAoBlE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAOP"}

package/dist/auth/oidcProvisioningPrimitives.d.ts

@@ -1,6 +1,6 @@
 import type { getDatabase } from '@happyvertical/sql';
-import { OidcIdentity } from '../models/OidcIdentity';
-import type { Profile } from '../models/Profile';
+import { OidcIdentity } from "../models/OidcIdentity.js";
+import type { Profile } from "../models/Profile.js";
 type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
 export interface OidcProvisioningPersonInput {
     email?: string;

package/dist/auth/oidcProvisioningPrimitives.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidcProvisioningPrimitives.d.ts","sourceRoot":"","sources":["../../src/auth/oidcProvisioningPrimitives.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAIjD,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gFAAgF;AAChF,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CA4BlB;AAED,qEAAqE;AACrE,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,YAAY,CAAC,CAYvB"}
+{"version":3,"file":"oidcProvisioningPrimitives.d.ts","sourceRoot":"","sources":["../../src/auth/oidcProvisioningPrimitives.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAmB,CAAC;AAIjD,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gFAAgF;AAChF,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CA4BlB;AAED,qEAAqE;AACrE,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,YAAY,CAAC,CAYvB"}

package/dist/auth/resolveIdentity.d.ts

@@ -11,11 +11,11 @@
  * 4. Actor header (CI pass-through) → Profile lookup
  */
 import { type SmrtObjectOptions } from '@happyvertical/smrt-core';
-import { ApiKey } from '../models/ApiKey';
-import { NostrIdentity } from '../models/NostrIdentity';
-import { OidcIdentity } from '../models/OidcIdentity';
-import type { Profile } from '../models/Profile';
-import { type NostrEvent } from './nostrCrypto';
+import { ApiKey } from "../models/ApiKey.js";
+import { NostrIdentity } from "../models/NostrIdentity.js";
+import { OidcIdentity } from "../models/OidcIdentity.js";
+import type { Profile } from "../models/Profile.js";
+import { type NostrEvent } from "./nostrCrypto.js";
 /**
  * Context provided to resolveIdentity
  */

package/dist/auth/resolveIdentity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveIdentity.d.ts","sourceRoot":"","sources":["../../src/auth/resolveIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,eAAe,CAAC;AAUjE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;IAET;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,4CAA4C;QAC5C,KAAK,EAAE,UAAU,CAAC;QAClB,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IAExD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CA0FhC;AA0DD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IACN,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,EACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAE7E;AAED;;;;;;GAMG;AACH,wBAAsB,mCAAmC,CACvD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IACN,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,EACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAiD3E;AA0MD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,SAAS,EAAE;IACT,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAuED"}
+{"version":3,"file":"resolveIdentity.d.ts","sourceRoot":"","sources":["../../src/auth/resolveIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAmB,CAAC;AAEjD,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,kBAAe,CAAC;AAUjE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;IAET;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,4CAA4C;QAC5C,KAAK,EAAE,UAAU,CAAC;QAClB,qDAAqD;QACrD,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,IAAI,CAAC;IAET;;OAEG;IACH,EAAE,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IAExD;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CA0FhC;AA0DD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IACN,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,EACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAE7E;AAED;;;;;;GAMG;AACH,wBAAsB,mCAAmC,CACvD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IACN,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,EACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAiD3E;AA0MD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,SAAS,EAAE;IACT,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CAuED"}

package/dist/chunks/{ApiKey-BZmbOTnL.js → ApiKey-CVmlf3V6.js}

@@ -1,16 +1,23 @@
-import { y as __exportAll } from "./NostrIdentity-n70E0vck.js";
+import { y as __exportAll } from "./NostrIdentity-AC8fAdxe.js";
 import { SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/models/ApiKey.ts
 var ApiKey_exports = /* @__PURE__ */ __exportAll({ ApiKey: () => ApiKey });
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp(target, key, result);
 	return result;
 };
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 var ApiKey = class extends SmrtObject {
 	profileId;
 	keyHash = "";
@@ -122,7 +129,7 @@ var ApiKey = class extends SmrtObject {
 	*/
 	static async verify(key, options = {}) {
 		const keyHash = ApiKey.hashKey(key);
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-CiiDNFdD.js").then((n) => n.n);
 		const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
 		if (!apiKey) return null;
 		if (!apiKey.isValid()) return null;
@@ -131,6 +138,7 @@ var ApiKey = class extends SmrtObject {
 		return apiKey;
 	}
 };
+__publicField(ApiKey, "__smrtPackage__", "@happyvertical/smrt-profiles");
 __decorateClass([foreignKey("Profile", { required: true })], ApiKey.prototype, "profileId", 2);
 __decorateClass([field({ indexed: true })], ApiKey.prototype, "keyHash", 2);
 ApiKey = __decorateClass([smrt({
@@ -151,4 +159,4 @@ ApiKey = __decorateClass([smrt({
 //#endregion
 export { ApiKey_exports as n, ApiKey as t };
 
-//# sourceMappingURL=ApiKey-BZmbOTnL.js.map
+//# sourceMappingURL=ApiKey-CVmlf3V6.js.map

package/dist/chunks/ApiKey-CVmlf3V6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKey-CVmlf3V6.js","names":[],"sources":["../../src/models/ApiKey.ts"],"sourcesContent":["/**\n * ApiKey - API keys for CLI and CI authentication\n *\n * Provides secure API key management with hashing, scopes, and expiration.\n * Keys are stored as hashes - the plaintext is only returned on creation.\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface ApiKeyOptions extends SmrtObjectOptions {\n  profileId?: string;\n  name?: string;\n  scopes?: string[];\n  expiresAt?: Date | null;\n}\n\nexport interface GenerateKeyResult {\n  key: string;\n  apiKey: ApiKey;\n}\n\n@smrt({\n  tableName: 'api_keys',\n  // The API-key store. Never in the change feed (#2937).\n  sensitive: true,\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  // create/revoke are admin operations invoked in-process via the CLI; only\n  // read-only list/get are exposed over HTTP.\n  cli: { include: ['list', 'get', 'create', 'revoke'], skipApiCheck: true },\n})\nexport class ApiKey extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-profiles\";\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * SHA-256 hash of the API key.\n   *\n   * Indexed: `verify()` looks keys up by this hash on every authenticated\n   * request (#2364, epic #2382 finding A3).\n   */\n  @field({ indexed: true })\n  keyHash: string = '';\n\n  /**\n   * First 8 characters of the key for identification (e.g., \"sk_live_a1b2...\")\n   */\n  keyPrefix: string = '';\n\n  /**\n   * Human-readable name for the key (e.g., \"CI Bot\", \"Local CLI\")\n   */\n  name: string = '';\n\n  /**\n   * Scopes/permissions for this key\n   */\n  scopes: string[] = [];\n\n  /**\n   * Last time this key was used\n   */\n  lastUsedAt: Date | null = null;\n\n  /**\n   * When this key expires (null = never)\n   */\n  expiresAt: Date | null = null;\n\n  /**\n   * When this key was revoked (null = active)\n   */\n  revokedAt: Date | null = null;\n\n  constructor(options: ApiKeyOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.name) this.name = options.name;\n    if (options.scopes) this.scopes = options.scopes;\n    if (options.expiresAt !== undefined) this.expiresAt = options.expiresAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Check if this key is valid (not expired, not revoked)\n   */\n  isValid(): boolean {\n    if (this.revokedAt) return false;\n    if (this.expiresAt && this.expiresAt < new Date()) return false;\n    return true;\n  }\n\n  /**\n   * Check if this key has a specific scope\n   */\n  hasScope(scope: string): boolean {\n    return this.scopes.includes(scope) || this.scopes.includes('*');\n  }\n\n  /**\n   * Revoke this key\n   */\n  async revoke(): Promise<void> {\n    this.revokedAt = new Date();\n    await this.save();\n  }\n\n  /**\n   * Record usage of this key\n   */\n  async recordUsage(): Promise<void> {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      if (this.isPersisted) await this.loadFromId();\n      if (!this.isValid()) return;\n      this.lastUsedAt = new Date();\n      try {\n        await this.save();\n        return;\n      } catch (error) {\n        if (\n          attempt === 3 ||\n          !(\n            error instanceof Error &&\n            'code' in error &&\n            error.code === 'RUNTIME_REVISION_CONFLICT'\n          )\n        ) {\n          throw error;\n        }\n      }\n    }\n  }\n\n  /**\n   * Hash an API key\n   */\n  static hashKey(key: string): string {\n    return createHash('sha256').update(key).digest('hex');\n  }\n\n  /**\n   * Generate a new API key for a profile\n   */\n  static async generate(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n      db?: SmrtObjectOptions['db'];\n    },\n  ): Promise<GenerateKeyResult> {\n    // Generate a random key: sk_live_<32 random bytes as hex>\n    const randomPart = randomBytes(32).toString('hex');\n    const key = `sk_live_${randomPart}`;\n    const keyPrefix = key.substring(0, 16);\n    const keyHash = ApiKey.hashKey(key);\n\n    const apiKey = new ApiKey({\n      db: options.db || profile.options?.db,\n      profileId: profile.id as string,\n      name: options.name,\n      scopes: options.scopes || ['*'],\n      expiresAt: options.expiresAt ?? null,\n    });\n    apiKey.keyHash = keyHash;\n    apiKey.keyPrefix = keyPrefix;\n\n    await apiKey.initialize();\n    await apiKey.save();\n\n    return { key, apiKey };\n  }\n\n  /**\n   * Verify an API key and return the ApiKey record if valid\n   */\n  static async verify(\n    key: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n\n    const { ApiKeyCollection } = await import(\n      '../collections/ApiKeyCollection'\n    );\n    const collection = await ApiKeyCollection.create(options);\n\n    const apiKey = await collection.findOne({\n      where: { keyHash },\n    });\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // A concurrent revocation may have been observed while recordUsage()\n    // rehydrated after a revision conflict. Never authenticate that key.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCO,IAAM,SAAN,cAAqB,WAAW;CAKrC;CASA,UAAkB;;;;CAKlB,YAAoB;;;;CAKpB,OAAe;;;;CAKf,SAAmB,CAAC;;;;CAKpB,aAA0B;;;;CAK1B,YAAyB;;;;CAKzB,YAAyB;CAEzB,YAAY,UAAyB,CAAC,GAAG;EACvC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,MAAM,KAAK,OAAO,QAAQ;EACtC,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;CAChE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,UAAmB;EACjB,IAAI,KAAK,WAAW,OAAO;EAC3B,IAAI,KAAK,aAAa,KAAK,4BAAY,IAAI,KAAK,GAAG,OAAO;EAC1D,OAAO;CACT;;;;CAKA,SAAS,OAAwB;EAC/B,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,OAAO,SAAS,GAAG;CAChE;;;;CAKA,MAAM,SAAwB;EAC5B,KAAK,4BAAY,IAAI,KAAK;EAC1B,MAAM,KAAK,KAAK;CAClB;;;;CAKA,MAAM,cAA6B;EACjC,KAAA,IAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;GAC/C,IAAI,KAAK,aAAa,MAAM,KAAK,WAAW;GAC5C,IAAI,CAAC,KAAK,QAAQ,GAAG;GACrB,KAAK,6BAAa,IAAI,KAAK;GAC3B,IAAI;IACF,MAAM,KAAK,KAAK;IAChB;GACF,SAAS,OAAO;IACd,IACE,YAAY,KACZ,EACE,iBAAiB,SACjB,UAAU,SACV,MAAM,SAAS,8BAGjB,MAAM;GAEV;EACF;CACF;;;;CAKA,OAAO,QAAQ,KAAqB;EAClC,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,GAAG,CAAA,CAAE,OAAO,KAAK;CACtD;;;;CAKA,aAAa,SACX,SACA,SAM4B;EAG5B,MAAM,MAAM,WADO,YAAY,EAAE,CAAA,CAAE,SAAS,KACrB;EACvB,MAAM,YAAY,IAAI,UAAU,GAAG,EAAE;EACrC,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,SAAS,IAAI,OAAO;GACxB,IAAI,QAAQ,MAAM,QAAQ,SAAS;GACnC,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,QAAQ,QAAQ,UAAU,CAAC,GAAG;GAC9B,WAAW,QAAQ,aAAa;EAClC,CAAC;EACD,OAAO,UAAU;EACjB,OAAO,YAAY;EAEnB,MAAM,OAAO,WAAW;EACxB,MAAM,OAAO,KAAK;EAElB,OAAO;GAAE;GAAK;EAAO;CACvB;;;;CAKA,aAAa,OACX,KACA,UAA6B,CAAC,GACN;EACxB,MAAM,UAAU,OAAO,QAAQ,GAAG;EAElC,MAAM,EAAE,qBAAqB,MAAM,OACjC,iCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAIF,MAAM,SAAS,OAAM,MAFI,iBAAiB,OAAO,OAAO,EAAA,CAExB,QAAQ,EACtC,OAAO,EAAE,QAAQ,EACnB,CAAC;EAED,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;AACF;AAtLyC,cAA5B,QAAmC,mBAAkB,8BAAA;AAKhE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,OAKX,WAAA,aAAA,CAAA;AASA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAbb,OAcX,WAAA,WAAA,CAAA;AAdW,SAAN,gBAAA,CAVN,KAAK;CACJ,WAAW;CAEX,WAAW;CACX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAGhC,KAAK;EAAE,SAAS;GAAC;GAAQ;GAAO;GAAU;EAAQ;EAAG,cAAc;CAAK;AAC1E,CAAC,CAAA,GACY,MAAA"}

package/dist/chunks/{ApiKeyCollection-Bfb_nw81.js → ApiKeyCollection-CiiDNFdD.js}

@@ -1,5 +1,5 @@
-import { y as __exportAll } from "./NostrIdentity-n70E0vck.js";
-import { t as ApiKey } from "./ApiKey-BZmbOTnL.js";
+import { y as __exportAll } from "./NostrIdentity-AC8fAdxe.js";
+import { t as ApiKey } from "./ApiKey-CVmlf3V6.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/ApiKeyCollection.ts
 var ApiKeyCollection_exports = /* @__PURE__ */ __exportAll({ ApiKeyCollection: () => ApiKeyCollection });
@@ -81,4 +81,4 @@ var ApiKeyCollection = class extends SmrtCollection {
 //#endregion
 export { ApiKeyCollection_exports as n, ApiKeyCollection as t };
 
-//# sourceMappingURL=ApiKeyCollection-Bfb_nw81.js.map
+//# sourceMappingURL=ApiKeyCollection-CiiDNFdD.js.map

package/dist/chunks/{ApiKeyCollection-Bfb_nw81.js.map → ApiKeyCollection-CiiDNFdD.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyCollection-Bfb_nw81.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // recordUsage() reloads after a concurrent-write conflict. A revocation\n    // observed by that reload must fail this authentication attempt closed.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key?.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}
+{"version":3,"file":"ApiKeyCollection-CiiDNFdD.js","names":[],"sources":["../../src/collections/ApiKeyCollection.ts"],"sourcesContent":["/**\n * ApiKeyCollection - Collection for managing API keys\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { ApiKey, type GenerateKeyResult } from '../models/ApiKey';\nimport type { Profile } from '../models/Profile';\n\nexport class ApiKeyCollection extends SmrtCollection<ApiKey> {\n  static readonly _itemClass = ApiKey;\n\n  /**\n   * Find all keys for a profile\n   */\n  async findByProfile(profileId: string): Promise<ApiKey[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find active (non-revoked, non-expired) keys for a profile\n   */\n  async findActiveByProfile(profileId: string): Promise<ApiKey[]> {\n    const keys = await this.findByProfile(profileId);\n    return keys.filter((key) => key.isValid());\n  }\n\n  /**\n   * Find key by hash\n   */\n  async findByHash(keyHash: string): Promise<ApiKey | null> {\n    return await this.findOne({\n      where: { keyHash },\n    });\n  }\n\n  /**\n   * Verify an API key string and return the record if valid\n   */\n  async verify(key: string): Promise<ApiKey | null> {\n    const keyHash = ApiKey.hashKey(key);\n    const apiKey = await this.findByHash(keyHash);\n\n    if (!apiKey) return null;\n    if (!apiKey.isValid()) return null;\n\n    // Record usage\n    await apiKey.recordUsage();\n\n    // recordUsage() reloads after a concurrent-write conflict. A revocation\n    // observed by that reload must fail this authentication attempt closed.\n    if (!apiKey.isValid()) return null;\n\n    return apiKey;\n  }\n\n  /**\n   * Generate a new key for a profile\n   */\n  async generateForProfile(\n    profile: Profile,\n    options: {\n      name: string;\n      scopes?: string[];\n      expiresAt?: Date | null;\n    },\n  ): Promise<GenerateKeyResult> {\n    return await ApiKey.generate(profile, {\n      ...options,\n      db: this.options.db,\n    });\n  }\n\n  /**\n   * Revoke all keys for a profile\n   */\n  async revokeAllForProfile(profileId: string): Promise<number> {\n    const keys = await this.findActiveByProfile(profileId);\n    for (const key of keys) {\n      await key.revoke();\n    }\n    return keys.length;\n  }\n\n  /**\n   * Revoke a specific key by prefix\n   */\n  async revokeByPrefix(keyPrefix: string): Promise<boolean> {\n    const key = await this.findOne({\n      where: { keyPrefix },\n    });\n\n    if (key?.isValid()) {\n      await key.revoke();\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Clean up expired keys (soft delete by setting revokedAt)\n   */\n  async cleanupExpired(): Promise<number> {\n    const now = new Date();\n    const allKeys = await this.list({});\n    let cleaned = 0;\n\n    for (const key of allKeys) {\n      if (key.expiresAt && key.expiresAt < now && !key.revokedAt) {\n        key.revokedAt = now;\n        await key.save();\n        cleaned++;\n      }\n    }\n\n    return cleaned;\n  }\n}\n"],"mappings":";;;;;AAQO,IAAM,mBAAN,cAA+B,eAAuB;CAC3D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAsC;EACxD,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAsC;EAE9D,QAAO,MADY,KAAK,cAAc,SAAS,EAAA,CACnC,QAAQ,QAAQ,IAAI,QAAQ,CAAC;CAC3C;;;;CAKA,MAAM,WAAW,SAAyC;EACxD,OAAO,MAAM,KAAK,QAAQ,EACxB,OAAO,EAAE,QAAQ,EACnB,CAAC;CACH;;;;CAKA,MAAM,OAAO,KAAqC;EAChD,MAAM,UAAU,OAAO,QAAQ,GAAG;EAClC,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO;EAE5C,IAAI,CAAC,QAAQ,OAAO;EACpB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAG9B,MAAM,OAAO,YAAY;EAIzB,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO;EAE9B,OAAO;CACT;;;;CAKA,MAAM,mBACJ,SACA,SAK4B;EAC5B,OAAO,MAAM,OAAO,SAAS,SAAS;GACpC,GAAG;GACH,IAAI,KAAK,QAAQ;EACnB,CAAC;CACH;;;;CAKA,MAAM,oBAAoB,WAAoC;EAC5D,MAAM,OAAO,MAAM,KAAK,oBAAoB,SAAS;EACrD,KAAA,MAAW,OAAO,MAChB,MAAM,IAAI,OAAO;EAEnB,OAAO,KAAK;CACd;;;;CAKA,MAAM,eAAe,WAAqC;EACxD,MAAM,MAAM,MAAM,KAAK,QAAQ,EAC7B,OAAO,EAAE,UAAU,EACrB,CAAC;EAED,IAAI,KAAK,QAAQ,GAAG;GAClB,MAAM,IAAI,OAAO;GACjB,OAAO;EACT;EACA,OAAO;CACT;;;;CAKA,MAAM,iBAAkC;EACtC,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,UAAU,MAAM,KAAK,KAAK,CAAC,CAAC;EAClC,IAAI,UAAU;EAEd,KAAA,MAAW,OAAO,SAChB,IAAI,IAAI,aAAa,IAAI,YAAY,OAAO,CAAC,IAAI,WAAW;GAC1D,IAAI,YAAY;GAChB,MAAM,IAAI,KAAK;GACf;EACF;EAGF,OAAO;CACT;AACF"}

package/dist/chunks/{AuditLogCollection-B1YonCAP.js → AuditLogCollection-WDHL-_AF.js}

@@ -1,15 +1,22 @@
-import { y as __exportAll } from "./NostrIdentity-n70E0vck.js";
-import { SmrtCollection, SmrtObject, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { y as __exportAll } from "./NostrIdentity-AC8fAdxe.js";
+import { SmrtCollection, SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 //#region src/models/AuditLog.ts
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp(target, key, result);
 	return result;
 };
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 var AuditLog = class extends SmrtObject {
 	tenantId = null;
 	profileId;
@@ -17,14 +24,13 @@ var AuditLog = class extends SmrtObject {
 	* Action performed (e.g., 'issue.update', 'feedback.incorporate')
 	*/
 	action = "";
-	/**
-	* Type of resource affected (e.g., 'Issue', 'Repository')
-	*/
+	/** Optional explanation supplied by the caller. */
+	reason = "";
+	/** Public field changes only; sensitive values must never be supplied. */
+	changes = {};
 	resourceType = "";
-	/**
-	* ID of the affected resource
-	*/
 	resourceId = "";
+	occurredAt = /* @__PURE__ */ new Date();
 	/**
 	* Source of the action
 	*/
@@ -38,6 +44,8 @@ var AuditLog = class extends SmrtObject {
 		super(options);
 		if (options.profileId) this.profileId = options.profileId;
 		if (options.action) this.action = options.action;
+		if (options.reason !== void 0) this.reason = options.reason;
+		if (options.changes !== void 0) this.changes = options.changes;
 		if (options.resourceType) this.resourceType = options.resourceType;
 		if (options.resourceId) this.resourceId = options.resourceId;
 		if (options.source) this.source = options.source;
@@ -79,17 +87,25 @@ var AuditLog = class extends SmrtObject {
 		return log;
 	}
 };
+__publicField(AuditLog, "__smrtPackage__", "@happyvertical/smrt-profiles");
 __decorateClass([tenantId({ nullable: true })], AuditLog.prototype, "tenantId", 2);
 __decorateClass([foreignKey("Profile", { required: true })], AuditLog.prototype, "profileId", 2);
+__decorateClass([field({ indexed: true })], AuditLog.prototype, "resourceType", 2);
+__decorateClass([field({ indexed: true })], AuditLog.prototype, "resourceId", 2);
+__decorateClass([field({
+	indexed: true,
+	default: "current_timestamp"
+})], AuditLog.prototype, "occurredAt", 2);
 __decorateClass([foreignKey("Profile", { nullable: true })], AuditLog.prototype, "onBehalfOfId", 2);
 AuditLog = __decorateClass([TenantScoped({
 	mode: "optional",
 	allowSuperAdminBypass: true
 }), smrt({
 	tableName: "audit_logs",
-	api: { include: ["list", "get"] },
-	mcp: { include: ["list", "get"] },
-	cli: { include: ["list"] }
+	sensitive: true,
+	api: false,
+	mcp: false,
+	cli: false
 })], AuditLog);
 //#endregion
 //#region src/collections/AuditLogCollection.ts
@@ -152,6 +168,8 @@ var AuditLogCollection = class extends SmrtCollection {
 			...this.options,
 			profileId: options.profile.id,
 			action: options.action,
+			reason: options.reason,
+			changes: options.changes,
 			resourceType: options.resourceType,
 			resourceId: options.resourceId,
 			source: options.source || "web",
@@ -188,4 +206,4 @@ var AuditLogCollection = class extends SmrtCollection {
 //#endregion
 export { AuditLogCollection_exports as n, AuditLog as r, AuditLogCollection as t };
 
-//# sourceMappingURL=AuditLogCollection-B1YonCAP.js.map
+//# sourceMappingURL=AuditLogCollection-WDHL-_AF.js.map

package/dist/chunks/AuditLogCollection-WDHL-_AF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogCollection-WDHL-_AF.js","names":[],"sources":["../../src/models/AuditLog.ts","../../src/collections/AuditLogCollection.ts"],"sourcesContent":["/**\n * AuditLog - Tracks all actions for full audit trail\n *\n * Records who did what, when, and how (web, CLI, CI, webhook, MCP).\n * Supports pass-through identity for CI workflows.\n */\n\nimport {\n  type AuditChange,\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport type { Profile } from './Profile';\n\nexport type AuditSource = 'web' | 'cli' | 'ci' | 'webhook' | 'mcp';\n\nexport interface AuditLogOptions extends SmrtObjectOptions {\n  profileId?: string;\n  action?: string;\n  resourceType?: string;\n  resourceId?: string;\n  source?: AuditSource;\n  metadata?: Record<string, unknown>;\n  onBehalfOfId?: string | null;\n  tenantId?: string | null;\n  reason?: string;\n  changes?: Record<string, AuditChange>;\n}\n\n@TenantScoped({ mode: 'optional', allowSuperAdminBypass: true })\n@smrt({\n  tableName: 'audit_logs',\n  sensitive: true,\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class AuditLog extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-profiles\";\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  /**\n   * The profile who performed the action\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Action performed (e.g., 'issue.update', 'feedback.incorporate')\n   */\n  action: string = '';\n\n  /** Optional explanation supplied by the caller. */\n  reason: string = '';\n\n  /** Public field changes only; sensitive values must never be supplied. */\n  changes: Record<string, AuditChange> = {};\n\n  /**\n   * Type of resource affected (e.g., 'Issue', 'Repository')\n   */\n  @field({ indexed: true })\n  resourceType: string = '';\n\n  /**\n   * ID of the affected resource\n   */\n  @field({ indexed: true })\n  resourceId: string = '';\n\n  /** Indexed retention/read timestamp independent of framework revision time. */\n  @field({ indexed: true, default: 'current_timestamp' })\n  occurredAt: Date = new Date();\n\n  /**\n   * Source of the action\n   */\n  source: AuditSource = 'web';\n\n  /**\n   * Additional context (CI run ID, request ID, etc.)\n   */\n  metadata: Record<string, unknown> = {};\n\n  /**\n   * For pass-through identity in CI - the actual person who triggered\n   */\n  @foreignKey('Profile', { nullable: true })\n  onBehalfOfId?: string | null;\n\n  constructor(options: AuditLogOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.action) this.action = options.action;\n    if (options.reason !== undefined) this.reason = options.reason;\n    if (options.changes !== undefined) this.changes = options.changes;\n    if (options.resourceType) this.resourceType = options.resourceType;\n    if (options.resourceId) this.resourceId = options.resourceId;\n    if (options.source) this.source = options.source;\n    if (options.metadata) this.metadata = options.metadata;\n    if (options.onBehalfOfId !== undefined)\n      this.onBehalfOfId = options.onBehalfOfId;\n  }\n\n  /**\n   * Get the profile who performed the action\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Get the profile on whose behalf the action was performed (if any)\n   */\n  async getOnBehalfOf(): Promise<Profile | null> {\n    if (!this.onBehalfOfId) return null;\n    return (await this.getRelated('onBehalfOfId')) as Profile | null;\n  }\n\n  /**\n   * Get the effective actor (onBehalfOf if set, otherwise profile)\n   */\n  async getEffectiveActor(): Promise<Profile | null> {\n    const onBehalfOf = await this.getOnBehalfOf();\n    if (onBehalfOf) return onBehalfOf;\n    return await this.getProfile();\n  }\n\n  /**\n   * Create an audit log entry\n   */\n  static async record(\n    options: AuditLogOptions & {\n      profile: Profile;\n      onBehalfOf?: Profile | null;\n    },\n  ): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...options,\n      profileId: options.profile.id as string,\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n}\n","/**\n * AuditLogCollection - Collection for querying audit logs\n */\n\nimport { type AuditChange, SmrtCollection } from '@happyvertical/smrt-core';\nimport { AuditLog, type AuditSource } from '../models/AuditLog';\nimport type { Profile } from '../models/Profile';\n\nexport class AuditLogCollection extends SmrtCollection<AuditLog> {\n  static readonly _itemClass = AuditLog;\n\n  /**\n   * Find logs for a profile (actions they performed)\n   */\n  async findByProfile(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs for a resource\n   */\n  async findByResource(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by action type\n   */\n  async findByAction(action: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { action },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs by source\n   */\n  async findBySource(source: AuditSource): Promise<AuditLog[]> {\n    return await this.list({\n      where: { source },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Find logs where actions were performed on behalf of someone\n   */\n  async findOnBehalfOf(profileId: string): Promise<AuditLog[]> {\n    return await this.list({\n      where: { onBehalfOfId: profileId },\n      orderBy: 'createdAt DESC',\n    });\n  }\n\n  /**\n   * Record a new audit log entry\n   */\n  async record(options: {\n    profile: Profile;\n    action: string;\n    resourceType: string;\n    resourceId: string;\n    source?: AuditSource;\n    metadata?: Record<string, unknown>;\n    onBehalfOf?: Profile | null;\n    reason?: string;\n    changes?: Record<string, AuditChange>;\n  }): Promise<AuditLog> {\n    const log = new AuditLog({\n      ...this.options,\n      profileId: options.profile.id as string,\n      action: options.action,\n      reason: options.reason,\n      changes: options.changes,\n      resourceType: options.resourceType,\n      resourceId: options.resourceId,\n      source: options.source || 'web',\n      metadata: options.metadata || {},\n      onBehalfOfId: options.onBehalfOf?.id as string | undefined,\n    });\n    await log.initialize();\n    await log.save();\n    return log;\n  }\n\n  /**\n   * Get recent activity for a profile\n   */\n  async getRecentActivity(\n    profileId: string,\n    limit: number = 50,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { profileId },\n      orderBy: 'createdAt DESC',\n      limit,\n    });\n  }\n\n  /**\n   * Get activity timeline for a resource\n   */\n  async getResourceTimeline(\n    resourceType: string,\n    resourceId: string,\n  ): Promise<AuditLog[]> {\n    return await this.list({\n      where: { resourceType, resourceId },\n      orderBy: 'createdAt ASC',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAyCO,IAAM,WAAN,cAAuB,WAAW;CAEvC,WAA0B;CAM1B;;;;CAKA,SAAiB;;CAGjB,SAAiB;;CAGjB,UAAuC,CAAC;CAMxC,eAAuB;CAMvB,aAAqB;CAIrB,6BAAmB,IAAI,KAAK;;;;CAK5B,SAAsB;;;;CAKtB,WAAoC,CAAC;CAMrC;CAEA,YAAY,UAA2B,CAAC,GAAG;EACzC,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,WAAW,KAAA,GAAW,KAAK,SAAS,QAAQ;EACxD,IAAI,QAAQ,YAAY,KAAA,GAAW,KAAK,UAAU,QAAQ;EAC1D,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,YAAY,KAAK,aAAa,QAAQ;EAClD,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,iBAAiB,KAAA,GAC3B,KAAK,eAAe,QAAQ;CAChC;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,MAAM,gBAAyC;EAC7C,IAAI,CAAC,KAAK,cAAc,OAAO;EAC/B,OAAQ,MAAM,KAAK,WAAW,cAAc;CAC9C;;;;CAKA,MAAM,oBAA6C;EACjD,MAAM,aAAa,MAAM,KAAK,cAAc;EAC5C,IAAI,YAAY,OAAO;EACvB,OAAO,MAAM,KAAK,WAAW;CAC/B;;;;CAKA,aAAa,OACX,SAImB;EACnB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG;GACH,WAAW,QAAQ,QAAQ;GAC3B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;AACF;AA7G2C,cAA9B,UAAqC,mBAAkB,8BAAA;AAElE,gBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,SAEX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAP9B,SAQX,WAAA,aAAA,CAAA;AAiBA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GAxBb,SAyBX,WAAA,gBAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,SAAS,KAAK,CAAC,CAAA,GA9Bb,SA+BX,WAAA,cAAA,CAAA;AAIA,gBAAA,CADC,MAAM;CAAE,SAAS;CAAM,SAAS;AAAoB,CAAC,CAAA,GAlC3C,SAmCX,WAAA,cAAA,CAAA;AAgBA,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAlD9B,SAmDX,WAAA,gBAAA,CAAA;AAnDW,WAAN,gBAAA,CARN,aAAa;CAAE,MAAM;CAAY,uBAAuB;AAAK,CAAC,GAC9D,KAAK;CACJ,WAAW;CACX,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,QAAA;;;;ACjCN,IAAM,qBAAN,cAAiC,eAAyB;CAC/D,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAAwC;EAC1D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAAqC;EACtD,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,aAAa,QAA0C;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,OAAO;GAChB,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,eAAe,WAAwC;EAC3D,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,cAAc,UAAU;GACjC,SAAS;EACX,CAAC;CACH;;;;CAKA,MAAM,OAAO,SAUS;EACpB,MAAM,MAAM,IAAI,SAAS;GACvB,GAAG,KAAK;GACR,WAAW,QAAQ,QAAQ;GAC3B,QAAQ,QAAQ;GAChB,QAAQ,QAAQ;GAChB,SAAS,QAAQ;GACjB,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,YAAY,CAAC;GAC/B,cAAc,QAAQ,YAAY;EACpC,CAAC;EACD,MAAM,IAAI,WAAW;EACrB,MAAM,IAAI,KAAK;EACf,OAAO;CACT;;;;CAKA,MAAM,kBACJ,WACA,QAAgB,IACK;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO,EAAE,UAAU;GACnB,SAAS;GACT;EACF,CAAC;CACH;;;;CAKA,MAAM,oBACJ,cACA,YACqB;EACrB,OAAO,MAAM,KAAK,KAAK;GACrB,OAAO;IAAE;IAAc;GAAW;GAClC,SAAS;EACX,CAAC;CACH;AACF"}

package/dist/chunks/{NostrIdentity-n70E0vck.js → NostrIdentity-AC8fAdxe.js}

@@ -4126,12 +4126,19 @@ function isValidPrivkey(privkey) {
 var NostrIdentity_exports = /* @__PURE__ */ __exportAll({ NostrIdentity: () => NostrIdentity });
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp(target, key, result);
 	return result;
 };
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 var NostrIdentity = class extends SmrtObject {
 	profileId;
 	pubkey = "";
@@ -4185,21 +4192,21 @@ var NostrIdentity = class extends SmrtObject {
 	* Find identity by public key
 	*/
 	static async findByPubkey(pubkey, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-CctlECpX.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { pubkey } });
 	}
 	/**
 	* Find identity by email
 	*/
 	static async findByEmail(email, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-CctlECpX.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { email: email.toLowerCase() } });
 	}
 	/**
 	* Find identity by NIP-05 username
 	*/
 	static async findByNip05(username, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-CctlECpX.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { nip05Username: username.toLowerCase() } });
 	}
 	/**
@@ -4264,6 +4271,7 @@ var NostrIdentity = class extends SmrtObject {
 		return `${this.nip05Username || this.email.split("@")[0]}@${domain}`;
 	}
 };
+__publicField(NostrIdentity, "__smrtPackage__", "@happyvertical/smrt-profiles");
 __decorateClass([foreignKey("Profile", { required: true })], NostrIdentity.prototype, "profileId", 2);
 __decorateClass([field({ indexed: true })], NostrIdentity.prototype, "pubkey", 2);
 NostrIdentity = __decorateClass([smrt({
@@ -4276,4 +4284,4 @@ NostrIdentity = __decorateClass([smrt({
 //#endregion
 export { verifyAuthEvent as _, decryptPrivkey as a, generateNostrKeypair as c, isValidPubkey as d, npubToPubkey as f, signEvent as g, pubkeyToNpub as h, createAuthEvent as i, getPublicKey as l, privkeyToNsec as m, NostrIdentity_exports as n, deriveEncryptionKey as o, nsecToPrivkey as p, computeEventId as r, encryptPrivkey as s, NostrIdentity as t, isValidPrivkey as u, verifyNostrSignature as v, __exportAll as y };
 
-//# sourceMappingURL=NostrIdentity-n70E0vck.js.map
+//# sourceMappingURL=NostrIdentity-AC8fAdxe.js.map