@happyvertical/smrt-profiles 0.55.1 → 0.55.2

package/dist/chunks/oidcProvisioningPrimitives-CYood-2M.js

@@ -1,166 +0,0 @@
-import { y as __exportAll } from "./NostrIdentity-AC8fAdxe.js";
-import { a as Profile, f as saveOidcRaceArbiter, m as ProfileType, n as ProfileCollection } from "./ProfileCollection-Bt6IJK49.js";
-import { t as OidcIdentity } from "./OidcIdentity-BjRu3n1g.js";
-import { SmrtCollection, smrt } from "@happyvertical/smrt-core";
-import { isSystemContext } from "@happyvertical/smrt-tenancy";
-//#region src/collections/ProfileTypeCollection.ts
-var ProfileTypeCollection_exports = /* @__PURE__ */ __exportAll({ ProfileTypeCollection: () => ProfileTypeCollection });
-function isPostgresUrl(url) {
-	return /^postgres(?:ql)?:/iu.test(url ?? "");
-}
-var ProfileTypeCollection = class extends SmrtCollection {
-	static _itemClass = ProfileType;
-	/**
-	* Get profile type by slug
-	*
-	* @param slug - The slug to search for
-	* @returns ProfileType instance or null
-	*/
-	async getBySlug(slug) {
-		return await this.get({ slug });
-	}
-	/**
-	* Get or create a profile type by slug
-	*
-	* @param slug - The slug to search for
-	* @param defaults - Default values if creating
-	* @returns ProfileType instance
-	*/
-	async getOrCreateBySlug(slug, defaults) {
-		const existing = await this.getBySlug(slug);
-		if (existing) return existing;
-		const profileType = await this.create({
-			slug,
-			...defaults
-		});
-		await profileType.save();
-		return profileType;
-	}
-	/**
-	* Atomically create or load a global ProfileType from trusted system code.
-	*
-	* This intentionally bypasses tenant auto-population and therefore refuses
-	* to run outside an explicit `withSystemContext()` boundary.
-	*/
-	async getOrCreateGlobalBySlug(slug, defaults) {
-		if (!isSystemContext()) throw new Error("Global ProfileType creation requires an explicit system context.");
-		const existing = await this.loadGlobalBySlug(slug);
-		if (existing) return existing;
-		const insertIfAbsent = async (db) => {
-			if (isPostgresUrl(db.url)) await db.query("SELECT pg_advisory_xact_lock(hashtext(?), hashtext(?))", "@happyvertical/smrt-profiles:profile_types:global", slug);
-			await db.query(`INSERT INTO profile_types
-          (id, slug, context, _meta_type, tenant_id, name, description)
-         SELECT ?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?
-         WHERE NOT EXISTS (
-           SELECT 1 FROM profile_types
-           WHERE slug = ?
-             AND context = ''
-             AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'
-             AND tenant_id IS NULL
-         )`, crypto.randomUUID(), slug, defaults.name, defaults.description ?? null, slug);
-		};
-		const isTransactionBound = typeof this.db.commit === "function";
-		if (isPostgresUrl(this.db.url) && !isTransactionBound && typeof this.db.transaction === "function") await this.db.transaction((tx) => insertIfAbsent(tx));
-		else await insertIfAbsent(this.db);
-		const profileType = await this.loadGlobalBySlug(slug);
-		if (!profileType) throw new Error(`Global ProfileType '${slug}' could not be created or loaded.`);
-		return profileType;
-	}
-	async loadGlobalBySlug(slug) {
-		const id = (await this.db.query(`SELECT CAST(id AS VARCHAR) AS id
-       FROM profile_types
-       WHERE slug = ?
-         AND context = ''
-         AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'
-         AND tenant_id IS NULL
-       LIMIT 1`, slug)).rows[0]?.id;
-		if (typeof id !== "string") return null;
-		const profileType = await this.get({ id });
-		if (profileType) profileType.id = id;
-		return profileType;
-	}
-};
-//#endregion
-//#region src/models/ProfileTypes.ts
-var ProfileTypes_exports = /* @__PURE__ */ __exportAll({
-	Bot: () => Bot,
-	Organization: () => Organization,
-	Person: () => Person
-});
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
-	enumerable: true,
-	configurable: true,
-	writable: true,
-	value
-}) : obj[key] = value;
-var __decorateClass = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp(target, key, result);
-	return result;
-};
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-var Person = class extends Profile {
-	constructor(options = {}) {
-		super(options);
-	}
-};
-__publicField(Person, "__smrtPackage__", "@happyvertical/smrt-profiles");
-Person = __decorateClass([smrt({ tableStrategy: "sti" })], Person);
-var Organization = class extends Profile {
-	constructor(options = {}) {
-		super(options);
-	}
-};
-__publicField(Organization, "__smrtPackage__", "@happyvertical/smrt-profiles");
-Organization = __decorateClass([smrt({ tableStrategy: "sti" })], Organization);
-var Bot = class extends Profile {
-	constructor(options = {}) {
-		super(options);
-	}
-};
-__publicField(Bot, "__smrtPackage__", "@happyvertical/smrt-profiles");
-Bot = __decorateClass([smrt({ tableStrategy: "sti" })], Bot);
-//#endregion
-//#region src/auth/oidcProvisioningPrimitives.ts
-async function createOidcProvisioningPerson(db, input) {
-	const typeId = requireProvisioningId((await (await ProfileTypeCollection.create({ db })).getOrCreateGlobalBySlug("person", {
-		name: "Person",
-		description: "Individual person profile"
-	})).id, "Person ProfileType");
-	let profile = new Person({
-		db,
-		slug: `oidc-${crypto.randomUUID()}`,
-		tenantId: null,
-		typeId,
-		email: input.email ?? "",
-		name: input.name || input.preferredUsername || input.subject
-	});
-	await profile.initialize();
-	await saveOidcRaceArbiter(() => profile.save());
-	if (input.email) profile = await (await ProfileCollection.create({ db })).reserveCanonicalIdentityEmail(requireProvisioningId(profile.id, "Created Profile"), input.email);
-	return profile;
-}
-async function insertOidcProvisioningIdentity(db, input) {
-	const identity = new OidcIdentity({
-		db,
-		email: input.email ?? "",
-		issuer: input.issuer,
-		profileId: input.profileId,
-		provider: input.provider,
-		subject: input.subject
-	});
-	await identity.initialize();
-	await saveOidcRaceArbiter(() => identity.save());
-	return identity;
-}
-function requireProvisioningId(value, label) {
-	if (typeof value !== "string" || !value) throw new Error(`${label} did not produce an id.`);
-	return value;
-}
-//#endregion
-export { Person as a, ProfileTypeCollection_exports as c, Organization as i, insertOidcProvisioningIdentity as n, ProfileTypes_exports as o, Bot as r, ProfileTypeCollection as s, createOidcProvisioningPerson as t };
-
-//# sourceMappingURL=oidcProvisioningPrimitives-CYood-2M.js.map

package/dist/chunks/oidcProvisioningPrimitives-CYood-2M.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidcProvisioningPrimitives-CYood-2M.js","names":[],"sources":["../../src/collections/ProfileTypeCollection.ts","../../src/models/ProfileTypes.ts","../../src/auth/oidcProvisioningPrimitives.ts"],"sourcesContent":["/**\n * ProfileTypeCollection - Collection manager for ProfileType objects\n *\n * Provides querying for profile type lookup table.\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { isSystemContext } from '@happyvertical/smrt-tenancy';\nimport { ProfileType } from '../models/ProfileType';\n\nfunction isPostgresUrl(url: string | undefined): boolean {\n  return /^postgres(?:ql)?:/iu.test(url ?? '');\n}\n\nexport class ProfileTypeCollection extends SmrtCollection<ProfileType> {\n  static readonly _itemClass = ProfileType;\n\n  /**\n   * Get profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @returns ProfileType instance or null\n   */\n  async getBySlug(slug: string): Promise<ProfileType | null> {\n    return await this.get({ slug });\n  }\n\n  /**\n   * Get or create a profile type by slug\n   *\n   * @param slug - The slug to search for\n   * @param defaults - Default values if creating\n   * @returns ProfileType instance\n   */\n  async getOrCreateBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    const existing = await this.getBySlug(slug);\n    if (existing) return existing;\n\n    const profileType = await this.create({ slug, ...defaults });\n    await profileType.save();\n    return profileType;\n  }\n\n  /**\n   * Atomically create or load a global ProfileType from trusted system code.\n   *\n   * This intentionally bypasses tenant auto-population and therefore refuses\n   * to run outside an explicit `withSystemContext()` boundary.\n   */\n  async getOrCreateGlobalBySlug(\n    slug: string,\n    defaults: { name: string; description?: string },\n  ): Promise<ProfileType> {\n    if (!isSystemContext()) {\n      throw new Error(\n        'Global ProfileType creation requires an explicit system context.',\n      );\n    }\n\n    const existing = await this.loadGlobalBySlug(slug);\n    if (existing) return existing;\n\n    // A plain SMRT create is an upsert and may replace the winning row's id\n    // when two first-login transactions race. Keep the canonical id stable by\n    // using a cross-adapter insert-if-absent and then hydrating the winner.\n    //\n    // The table's unique key is `(tenant_id, slug, context, _meta_type)` since\n    // smrt#2360, and a global row's NULL tenant never conflicts at the\n    // database level (NULLs are distinct in a unique index), so a raw\n    // `ON CONFLICT (…) DO NOTHING` can no longer arbitrate this race. Serialize\n    // the global create per slug instead: PostgreSQL through a\n    // transaction-scoped advisory lock (the arbiter the SDK's null-aware\n    // upsert uses too); the embedded engines through the provisioning\n    // coordinator's in-process lock plus their single-writer transactions.\n    const insertIfAbsent = async (db: typeof this.db): Promise<void> => {\n      if (isPostgresUrl(db.url)) {\n        await db.query(\n          'SELECT pg_advisory_xact_lock(hashtext(?), hashtext(?))',\n          '@happyvertical/smrt-profiles:profile_types:global',\n          slug,\n        );\n      }\n      await db.query(\n        `INSERT INTO profile_types\n          (id, slug, context, _meta_type, tenant_id, name, description)\n         SELECT ?, ?, '', '@happyvertical/smrt-profiles:ProfileType', NULL, ?, ?\n         WHERE NOT EXISTS (\n           SELECT 1 FROM profile_types\n           WHERE slug = ?\n             AND context = ''\n             AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n             AND tenant_id IS NULL\n         )`,\n        crypto.randomUUID(),\n        slug,\n        defaults.name,\n        defaults.description ?? null,\n        slug,\n      );\n    };\n\n    // A transaction-scoped advisory lock only spans both statements when they\n    // run on one transaction. On PostgreSQL, any handle that is NOT already\n    // transaction-bound may route each query to a different pooled connection\n    // — a root adapter (`beginTransaction` present) and equally a view\n    // wrapper (only `transaction()` present) — so open a transaction for the\n    // pair on every such handle. A transaction-bound handle (fingerprint: it\n    // carries `commit`) already keeps both statements on one client and must\n    // not nest. Embedded engines run directly: a nested root transaction\n    // would deadlock their single-writer adapters, and the provisioning\n    // coordinator's in-process lock already serializes them.\n    const isTransactionBound =\n      typeof (this.db as { commit?: unknown }).commit === 'function';\n    if (\n      isPostgresUrl(this.db.url) &&\n      !isTransactionBound &&\n      typeof this.db.transaction === 'function'\n    ) {\n      await this.db.transaction((tx) => insertIfAbsent(tx));\n    } else {\n      await insertIfAbsent(this.db);\n    }\n    const profileType = await this.loadGlobalBySlug(slug);\n    if (!profileType) {\n      throw new Error(\n        `Global ProfileType '${slug}' could not be created or loaded.`,\n      );\n    }\n    return profileType;\n  }\n\n  private async loadGlobalBySlug(slug: string): Promise<ProfileType | null> {\n    const result = await this.db.query(\n      `SELECT CAST(id AS VARCHAR) AS id\n       FROM profile_types\n       WHERE slug = ?\n         AND context = ''\n         AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'\n         AND tenant_id IS NULL\n       LIMIT 1`,\n      slug,\n    );\n    const id = result.rows[0]?.id;\n    if (typeof id !== 'string') return null;\n    const profileType = await this.get({ id });\n    // @happyvertical/sql 0.88 exposes native DuckDB UUID result values as an\n    // internal object. The cast above is the portable identity boundary for\n    // this lookup; retain it on the hydrated object used by provisioning.\n    if (profileType) profileType.id = id;\n    return profileType;\n  }\n}\n","/**\n * Profile subclasses for STI (Single Table Inheritance)\n *\n * These classes inherit from Profile and automatically use the shared\n * profiles table with _meta_type discriminator.\n */\n\nimport { smrt } from '@happyvertical/smrt-core';\nimport { Profile, type ProfileOptions } from './Profile';\n\n/**\n * Person profile type\n *\n * Represents individual people/users.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Person extends Profile { static __smrtPackage__ = \"@happyvertical/smrt-profiles\";\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Person-specific initialization can go here\n  }\n}\n\n/**\n * Organization profile type\n *\n * Represents companies, groups, institutions, and other organizational entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Organization extends Profile { static __smrtPackage__ = \"@happyvertical/smrt-profiles\";\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Organization-specific initialization can go here\n  }\n}\n\n/**\n * Bot profile type\n *\n * Represents automated agents, bots, and AI entities.\n */\n@smrt({\n  tableStrategy: 'sti',\n})\nexport class Bot extends Profile { static __smrtPackage__ = \"@happyvertical/smrt-profiles\";\n  constructor(options: ProfileOptions = {}) {\n    super(options);\n    // Bot-specific initialization can go here\n  }\n}\n","import type { getDatabase } from '@happyvertical/sql';\nimport { ProfileCollection } from '../collections/ProfileCollection';\nimport { ProfileTypeCollection } from '../collections/ProfileTypeCollection';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\nimport { Person } from '../models/ProfileTypes';\nimport { saveOidcRaceArbiter } from './oidcProvisioningCoordinator';\n\ntype DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;\n\nexport interface OidcProvisioningPersonInput {\n  email?: string;\n  name?: string;\n  preferredUsername?: string;\n  subject: string;\n}\n\nexport interface OidcProvisioningIdentityInput {\n  email?: string;\n  issuer: string;\n  profileId: string;\n  provider: string;\n  subject: string;\n}\n\n/** Create and reserve a fresh global Person inside the caller's transaction. */\nexport async function createOidcProvisioningPerson(\n  db: DatabaseInterface,\n  input: OidcProvisioningPersonInput,\n): Promise<Profile> {\n  const typeCollection = await ProfileTypeCollection.create({ db });\n  const personType = await typeCollection.getOrCreateGlobalBySlug('person', {\n    name: 'Person',\n    description: 'Individual person profile',\n  });\n  const typeId = requireProvisioningId(personType.id, 'Person ProfileType');\n  let profile: Profile = new Person({\n    db,\n    // OIDC display names are not identity keys. A per-profile slug keeps\n    // SMRT's natural-key upsert from replacing an unrelated Person.\n    slug: `oidc-${crypto.randomUUID()}`,\n    tenantId: null,\n    typeId,\n    email: input.email ?? '',\n    name: input.name || input.preferredUsername || input.subject,\n  });\n  await profile.initialize();\n  await saveOidcRaceArbiter(() => profile.save());\n\n  if (input.email) {\n    const profiles = await ProfileCollection.create({ db });\n    profile = await profiles.reserveCanonicalIdentityEmail(\n      requireProvisioningId(profile.id, 'Created Profile'),\n      input.email,\n    );\n  }\n  return profile;\n}\n\n/** Insert the identity after the caller proves Profile ownership. */\nexport async function insertOidcProvisioningIdentity(\n  db: DatabaseInterface,\n  input: OidcProvisioningIdentityInput,\n): Promise<OidcIdentity> {\n  const identity = new OidcIdentity({\n    db,\n    email: input.email ?? '',\n    issuer: input.issuer,\n    profileId: input.profileId,\n    provider: input.provider,\n    subject: input.subject,\n  });\n  await identity.initialize();\n  await saveOidcRaceArbiter(() => identity.save());\n  return identity;\n}\n\nfunction requireProvisioningId(value: unknown, label: string): string {\n  if (typeof value !== 'string' || !value) {\n    throw new Error(`${label} did not produce an id.`);\n  }\n  return value;\n}\n"],"mappings":";;;;;;;AAUA,SAAS,cAAc,KAAkC;CACvD,OAAO,sBAAsB,KAAK,OAAO,EAAE;AAC7C;AAEO,IAAM,wBAAN,cAAoC,eAA4B;CACrE,OAAgB,aAAa;;;;;;;CAQ7B,MAAM,UAAU,MAA2C;EACzD,OAAO,MAAM,KAAK,IAAI,EAAE,KAAK,CAAC;CAChC;;;;;;;;CASA,MAAM,kBACJ,MACA,UACsB;EACtB,MAAM,WAAW,MAAM,KAAK,UAAU,IAAI;EAC1C,IAAI,UAAU,OAAO;EAErB,MAAM,cAAc,MAAM,KAAK,OAAO;GAAE;GAAM,GAAG;EAAS,CAAC;EAC3D,MAAM,YAAY,KAAK;EACvB,OAAO;CACT;;;;;;;CAQA,MAAM,wBACJ,MACA,UACsB;EACtB,IAAI,CAAC,gBAAgB,GACnB,MAAM,IAAI,MACR,kEACF;EAGF,MAAM,WAAW,MAAM,KAAK,iBAAiB,IAAI;EACjD,IAAI,UAAU,OAAO;EAcrB,MAAM,iBAAiB,OAAO,OAAsC;GAClE,IAAI,cAAc,GAAG,GAAG,GACtB,MAAM,GAAG,MACP,0DACA,qDACA,IACF;GAEF,MAAM,GAAG,MACP;;;;;;;;;aAUA,OAAO,WAAW,GAClB,MACA,SAAS,MACT,SAAS,eAAe,MACxB,IACF;EACF;EAYA,MAAM,qBACJ,OAAQ,KAAK,GAA4B,WAAW;EACtD,IACE,cAAc,KAAK,GAAG,GAAG,KACzB,CAAC,sBACD,OAAO,KAAK,GAAG,gBAAgB,YAE/B,MAAM,KAAK,GAAG,aAAa,OAAO,eAAe,EAAE,CAAC;OAEpD,MAAM,eAAe,KAAK,EAAE;EAE9B,MAAM,cAAc,MAAM,KAAK,iBAAiB,IAAI;EACpD,IAAI,CAAC,aACH,MAAM,IAAI,MACR,uBAAuB,KAAI,kCAC7B;EAEF,OAAO;CACT;CAEA,MAAc,iBAAiB,MAA2C;EAWxE,MAAM,MAAK,MAVU,KAAK,GAAG,MAC3B;;;;;;iBAOA,IACF,EAAA,CACkB,KAAK,EAAC,EAAG;EAC3B,IAAI,OAAO,OAAO,UAAU,OAAO;EACnC,MAAM,cAAc,MAAM,KAAK,IAAI,EAAE,GAAG,CAAC;EAIzC,IAAI,aAAa,YAAY,KAAK;EAClC,OAAO;CACT;AACF;;;;;;;;;;;;;;;;;;;;;;;ACxIO,IAAM,SAAN,cAAqB,QAAQ;CAClC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALsC,cAAzB,QAAgC,mBAAkB,8BAAA;AAAlD,SAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,MAAA;AAeN,IAAM,eAAN,cAA2B,QAAQ;CACxC,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AAL4C,cAA/B,cAAsC,mBAAkB,8BAAA;AAAxD,eAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,YAAA;AAeN,IAAM,MAAN,cAAkB,QAAQ;CAC/B,YAAY,UAA0B,CAAC,GAAG;EACxC,MAAM,OAAO;CAEf;AACF;AALmC,cAAtB,KAA6B,mBAAkB,8BAAA;AAA/C,MAAN,gBAAA,CAHN,KAAK,EACJ,eAAe,MACjB,CAAC,CAAA,GACY,GAAA;;;ACtBb,eAAsB,6BACpB,IACA,OACkB;CAMlB,MAAM,SAAS,uBAAsB,OAJZ,MADI,sBAAsB,OAAO,EAAE,GAAG,CAAC,EAAA,CACxB,wBAAwB,UAAU;EACxE,MAAM;EACN,aAAa;CACf,CAAC,EAAA,CAC+C,IAAI,oBAAoB;CACxE,IAAI,UAAmB,IAAI,OAAO;EAChC;EAGA,MAAM,QAAQ,OAAO,WAAW;EAChC,UAAU;EACV;EACA,OAAO,MAAM,SAAS;EACtB,MAAM,MAAM,QAAQ,MAAM,qBAAqB,MAAM;CACvD,CAAC;CACD,MAAM,QAAQ,WAAW;CACzB,MAAM,0BAA0B,QAAQ,KAAK,CAAC;CAE9C,IAAI,MAAM,OAER,UAAU,OAAM,MADO,kBAAkB,OAAO,EAAE,GAAG,CAAC,EAAA,CAC7B,8BACvB,sBAAsB,QAAQ,IAAI,iBAAiB,GACnD,MAAM,KACR;CAEF,OAAO;AACT;AAGA,eAAsB,+BACpB,IACA,OACuB;CACvB,MAAM,WAAW,IAAI,aAAa;EAChC;EACA,OAAO,MAAM,SAAS;EACtB,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,SAAS,WAAW;CAC1B,MAAM,0BAA0B,SAAS,KAAK,CAAC;CAC/C,OAAO;AACT;AAEA,SAAS,sBAAsB,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,MAAM,IAAI,MAAM,GAAG,MAAK,wBAAyB;CAEnD,OAAO;AACT"}