@happyvertical/smrt-profiles 0.42.7 → 0.43.0

package/dist/chunks/{OidcIdentity-DANnAbfU.js → OidcIdentity-B9rltBDe.js}

@@ -35,7 +35,7 @@ var OidcIdentity = class extends SmrtObject {
 	* Find identity by issuer and subject
 	*/
 	static async findBySubject(issuer, subject, options = {}) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-D2JuUZZL.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(options)).findBySubject(issuer, subject);
 	}
 	/** Build the collision-free natural key for one OIDC issuer subject. */
@@ -58,7 +58,7 @@ var OidcIdentity = class extends SmrtObject {
 	static async findOrCreate(profile, oidcData, options = {}) {
 		const profileId = profile.id;
 		if (typeof profileId !== "string" || !profileId) throw new Error("OidcIdentity.findOrCreate() requires a saved Profile.");
-		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-DusCiNZo.js").then((n) => n.i);
+		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-B2ro8ggX.js").then((n) => n.i);
 		const profileOptions = profile.options ?? {};
 		return (await reuseExistingOidcIdentityForProfile(profileId, {
 			email: oidcData.email,
@@ -108,4 +108,4 @@ OidcIdentity = __decorateClass([smrt({
 //#endregion
 export { OidcIdentity as t };
 
-//# sourceMappingURL=OidcIdentity-DANnAbfU.js.map
+//# sourceMappingURL=OidcIdentity-B9rltBDe.js.map

package/dist/chunks/{OidcIdentity-DANnAbfU.js.map → OidcIdentity-B9rltBDe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"OidcIdentity-DANnAbfU.js","names":[],"sources":["../../src/models/OidcIdentity.ts"],"sourcesContent":["/**\n * OidcIdentity - Links OIDC provider identities to Profile\n *\n * Stores the mapping between external OIDC providers (Keycloak, Google, GitHub)\n * and internal Profile records. Multiple identities can link to a single profile.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface OidcIdentityOptions extends SmrtObjectOptions {\n  profileId?: string;\n  provider?: string;\n  issuer?: string;\n  subject?: string;\n  email?: string;\n  lastUsedAt?: Date | null;\n}\n\n@smrt({\n  tableName: 'oidc_identities',\n  // Identity linking is an authentication authority change. Generated routes\n  // authenticate callers but do not authorize Profile ownership, so mutations\n  // must stay behind the trusted provisioning APIs below.\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list', 'get'] },\n})\nexport class OidcIdentity extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Provider name (e.g., 'keycloak', 'google', 'github')\n   */\n  @field({ type: 'text' })\n  provider: string = '';\n\n  /**\n   * OIDC issuer URL (e.g., https://keycloak.example.com/realms/bmp)\n   */\n  @field({ type: 'text', indexed: true })\n  issuer: string = '';\n\n  /**\n   * OIDC subject claim - unique identifier from the provider\n   */\n  @field({ type: 'text', indexed: true })\n  subject: string = '';\n\n  /**\n   * Stable issuer+subject key used as the database race arbiter.\n   *\n   * Nullable for legacy rows; every newly linked or reused identity backfills\n   * it. A separate unique constraint makes concurrent first login fail with a\n   * retryable conflict instead of creating two identities.\n   */\n  @field({ type: 'text', nullable: true, unique: true, readonly: true })\n  identityKey: string | null = null;\n\n  /**\n   * Cached email from the IdP (for display/lookup)\n   */\n  @field({ type: 'text' })\n  email: string = '';\n\n  /**\n   * Last time this identity was used for authentication\n   */\n  @field({ type: 'datetime', nullable: true })\n  lastUsedAt: Date | null = null;\n\n  constructor(options: OidcIdentityOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.provider) this.provider = options.provider;\n    if (options.issuer) this.issuer = options.issuer;\n    if (options.subject) this.subject = options.subject;\n    if (options.email) this.email = options.email;\n    if (options.lastUsedAt !== undefined) this.lastUsedAt = options.lastUsedAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  static async findBySubject(\n    issuer: string,\n    subject: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity | null> {\n    const { OidcIdentityCollection } = await import(\n      '../collections/OidcIdentityCollection'\n    );\n    const collection = await OidcIdentityCollection.create(options);\n    return await collection.findBySubject(issuer, subject);\n  }\n\n  /** Build the collision-free natural key for one OIDC issuer subject. */\n  static buildIdentityKey(issuer: string, subject: string): string {\n    return JSON.stringify([issuer, subject]);\n  }\n\n  /** Keep the durable key derived from its natural-key source fields. */\n  override async save(): Promise<this> {\n    this.identityKey =\n      this.issuer.trim() && this.subject.trim()\n        ? OidcIdentity.buildIdentityKey(this.issuer, this.subject)\n        : null;\n    return super.save();\n  }\n\n  /**\n   * Reuse an existing exact identity for its unchanged Profile.\n   *\n   * @deprecated Authentication links must be created through transactional\n   * provisioning. This compatibility method only refreshes a unique mapping\n   * that already belongs to the supplied Profile, including legacy Profile\n   * types, and deliberately refuses to create or rebind authority.\n   */\n  static async findOrCreate(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity> {\n    const profileId = profile.id;\n    if (typeof profileId !== 'string' || !profileId) {\n      throw new Error('OidcIdentity.findOrCreate() requires a saved Profile.');\n    }\n    const { reuseExistingOidcIdentityForProfile } = await import(\n      '../auth/resolveIdentity'\n    );\n    const profileOptions = profile.options ?? {};\n    const result = await reuseExistingOidcIdentityForProfile(\n      profileId,\n      {\n        email: oidcData.email,\n        iss: oidcData.issuer,\n        sub: oidcData.subject,\n      },\n      oidcData.provider,\n      {\n        ...profileOptions,\n        ...options,\n        db: options.db ?? profileOptions.db,\n      },\n    );\n    return result.oidcIdentity;\n  }\n\n  /**\n   * Record usage of this identity\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n}\n"],"mappings":";;;;;;;;;;AAkCO,IAAM,eAAN,cAA2B,WAAW;CAK3C;CAMA,WAAmB;CAMnB,SAAiB;CAMjB,UAAkB;CAUlB,cAA6B;CAM7B,QAAgB;CAMhB,aAA0B;CAE1B,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,OAAO,KAAK,QAAQ,QAAQ;EACxC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,aAAa,cACX,QACA,SACA,UAA6B,CAAC,GACA;EAC9B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,uBAAuB,OAAO,OAAO,EAAA,CACtC,cAAc,QAAQ,OAAO;CACvD;;CAGA,OAAO,iBAAiB,QAAgB,SAAyB;EAC/D,OAAO,KAAK,UAAU,CAAC,QAAQ,OAAO,CAAC;CACzC;;CAGA,MAAe,OAAsB;EACnC,KAAK,cACH,KAAK,OAAO,KAAK,KAAK,KAAK,QAAQ,KAAK,IACpC,aAAa,iBAAiB,KAAK,QAAQ,KAAK,OAAO,IACvD;EACN,OAAO,MAAM,KAAK;CACpB;;;;;;;;;CAUA,aAAa,aACX,SACA,UAMA,UAA6B,CAAC,GACP;EACvB,MAAM,YAAY,QAAQ;EAC1B,IAAI,OAAO,cAAc,YAAY,CAAC,WACpC,MAAM,IAAI,MAAM,uDAAuD;EAEzE,MAAM,EAAE,wCAAwC,MAAM,OACpD,gCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAEF,MAAM,iBAAiB,QAAQ,WAAW,CAAC;EAe3C,QAAO,MAdc,oCACnB,WACA;GACE,OAAO,SAAS;GAChB,KAAK,SAAS;GACd,KAAK,SAAS;EAChB,GACA,SAAS,UACT;GACE,GAAG;GACH,GAAG;GACH,IAAI,QAAQ,MAAM,eAAe;EACnC,CACF,EAAA,CACc;CAChB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;AACF;AA1IE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAVZ,aAWX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAhB3B,aAiBX,WAAA,UAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAtB3B,aAuBX,WAAA,WAAA,CAAA;AAUA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,UAAU;CAAM,QAAQ;CAAM,UAAU;AAAK,CAAC,CAAA,GAhC1D,aAiCX,WAAA,eAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAtCZ,aAuCX,WAAA,SAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAY,UAAU;AAAK,CAAC,CAAA,GA5ChC,aA6CX,WAAA,cAAA,CAAA;AA7CW,eAAN,gBAAA,CATN,KAAK;CACJ,WAAW;CAIX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;AAClC,CAAC,CAAA,GACY,YAAA"}
+{"version":3,"file":"OidcIdentity-B9rltBDe.js","names":[],"sources":["../../src/models/OidcIdentity.ts"],"sourcesContent":["/**\n * OidcIdentity - Links OIDC provider identities to Profile\n *\n * Stores the mapping between external OIDC providers (Keycloak, Google, GitHub)\n * and internal Profile records. Multiple identities can link to a single profile.\n */\n\nimport {\n  field,\n  foreignKey,\n  SmrtObject,\n  type SmrtObjectOptions,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport type { Profile } from './Profile';\n\nexport interface OidcIdentityOptions extends SmrtObjectOptions {\n  profileId?: string;\n  provider?: string;\n  issuer?: string;\n  subject?: string;\n  email?: string;\n  lastUsedAt?: Date | null;\n}\n\n@smrt({\n  tableName: 'oidc_identities',\n  // Identity linking is an authentication authority change. Generated routes\n  // authenticate callers but do not authorize Profile ownership, so mutations\n  // must stay behind the trusted provisioning APIs below.\n  api: { include: ['list', 'get'] },\n  mcp: { include: ['list', 'get'] },\n  cli: { include: ['list', 'get'] },\n})\nexport class OidcIdentity extends SmrtObject {\n  /**\n   * Link to the Profile (Person, Organization, Bot)\n   */\n  @foreignKey('Profile', { required: true })\n  profileId?: string;\n\n  /**\n   * Provider name (e.g., 'keycloak', 'google', 'github')\n   */\n  @field({ type: 'text' })\n  provider: string = '';\n\n  /**\n   * OIDC issuer URL (e.g., https://keycloak.example.com/realms/bmp)\n   */\n  @field({ type: 'text', indexed: true })\n  issuer: string = '';\n\n  /**\n   * OIDC subject claim - unique identifier from the provider\n   */\n  @field({ type: 'text', indexed: true })\n  subject: string = '';\n\n  /**\n   * Stable issuer+subject key used as the database race arbiter.\n   *\n   * Nullable for legacy rows; every newly linked or reused identity backfills\n   * it. A separate unique constraint makes concurrent first login fail with a\n   * retryable conflict instead of creating two identities.\n   */\n  @field({ type: 'text', nullable: true, unique: true, readonly: true })\n  identityKey: string | null = null;\n\n  /**\n   * Cached email from the IdP (for display/lookup)\n   */\n  @field({ type: 'text' })\n  email: string = '';\n\n  /**\n   * Last time this identity was used for authentication\n   */\n  @field({ type: 'datetime', nullable: true })\n  lastUsedAt: Date | null = null;\n\n  constructor(options: OidcIdentityOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.provider) this.provider = options.provider;\n    if (options.issuer) this.issuer = options.issuer;\n    if (options.subject) this.subject = options.subject;\n    if (options.email) this.email = options.email;\n    if (options.lastUsedAt !== undefined) this.lastUsedAt = options.lastUsedAt;\n  }\n\n  /**\n   * Get the linked Profile\n   */\n  async getProfile(): Promise<Profile | null> {\n    return (await this.getRelated('profileId')) as Profile | null;\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  static async findBySubject(\n    issuer: string,\n    subject: string,\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity | null> {\n    const { OidcIdentityCollection } = await import(\n      '../collections/OidcIdentityCollection'\n    );\n    const collection = await OidcIdentityCollection.create(options);\n    return await collection.findBySubject(issuer, subject);\n  }\n\n  /** Build the collision-free natural key for one OIDC issuer subject. */\n  static buildIdentityKey(issuer: string, subject: string): string {\n    return JSON.stringify([issuer, subject]);\n  }\n\n  /** Keep the durable key derived from its natural-key source fields. */\n  override async save(): Promise<this> {\n    this.identityKey =\n      this.issuer.trim() && this.subject.trim()\n        ? OidcIdentity.buildIdentityKey(this.issuer, this.subject)\n        : null;\n    return super.save();\n  }\n\n  /**\n   * Reuse an existing exact identity for its unchanged Profile.\n   *\n   * @deprecated Authentication links must be created through transactional\n   * provisioning. This compatibility method only refreshes a unique mapping\n   * that already belongs to the supplied Profile, including legacy Profile\n   * types, and deliberately refuses to create or rebind authority.\n   */\n  static async findOrCreate(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n    options: SmrtObjectOptions = {},\n  ): Promise<OidcIdentity> {\n    const profileId = profile.id;\n    if (typeof profileId !== 'string' || !profileId) {\n      throw new Error('OidcIdentity.findOrCreate() requires a saved Profile.');\n    }\n    const { reuseExistingOidcIdentityForProfile } = await import(\n      '../auth/resolveIdentity'\n    );\n    const profileOptions = profile.options ?? {};\n    const result = await reuseExistingOidcIdentityForProfile(\n      profileId,\n      {\n        email: oidcData.email,\n        iss: oidcData.issuer,\n        sub: oidcData.subject,\n      },\n      oidcData.provider,\n      {\n        ...profileOptions,\n        ...options,\n        db: options.db ?? profileOptions.db,\n      },\n    );\n    return result.oidcIdentity;\n  }\n\n  /**\n   * Record usage of this identity\n   */\n  async recordUsage(): Promise<void> {\n    this.lastUsedAt = new Date();\n    await this.save();\n  }\n}\n"],"mappings":";;;;;;;;;;AAkCO,IAAM,eAAN,cAA2B,WAAW;CAK3C;CAMA,WAAmB;CAMnB,SAAiB;CAMjB,UAAkB;CAUlB,cAA6B;CAM7B,QAAgB;CAMhB,aAA0B;CAE1B,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,UAAU,KAAK,WAAW,QAAQ;EAC9C,IAAI,QAAQ,QAAQ,KAAK,SAAS,QAAQ;EAC1C,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,OAAO,KAAK,QAAQ,QAAQ;EACxC,IAAI,QAAQ,eAAe,KAAA,GAAW,KAAK,aAAa,QAAQ;CAClE;;;;CAKA,MAAM,aAAsC;EAC1C,OAAQ,MAAM,KAAK,WAAW,WAAW;CAC3C;;;;CAKA,aAAa,cACX,QACA,SACA,UAA6B,CAAC,GACA;EAC9B,MAAM,EAAE,2BAA2B,MAAM,OACvC,uCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAGF,OAAO,OAAM,MADY,uBAAuB,OAAO,OAAO,EAAA,CACtC,cAAc,QAAQ,OAAO;CACvD;;CAGA,OAAO,iBAAiB,QAAgB,SAAyB;EAC/D,OAAO,KAAK,UAAU,CAAC,QAAQ,OAAO,CAAC;CACzC;;CAGA,MAAe,OAAsB;EACnC,KAAK,cACH,KAAK,OAAO,KAAK,KAAK,KAAK,QAAQ,KAAK,IACpC,aAAa,iBAAiB,KAAK,QAAQ,KAAK,OAAO,IACvD;EACN,OAAO,MAAM,KAAK;CACpB;;;;;;;;;CAUA,aAAa,aACX,SACA,UAMA,UAA6B,CAAC,GACP;EACvB,MAAM,YAAY,QAAQ;EAC1B,IAAI,OAAO,cAAc,YAAY,CAAC,WACpC,MAAM,IAAI,MAAM,uDAAuD;EAEzE,MAAM,EAAE,wCAAwC,MAAM,OACpD,gCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAEF,MAAM,iBAAiB,QAAQ,WAAW,CAAC;EAe3C,QAAO,MAdc,oCACnB,WACA;GACE,OAAO,SAAS;GAChB,KAAK,SAAS;GACd,KAAK,SAAS;EAChB,GACA,SAAS,UACT;GACE,GAAG;GACH,GAAG;GACH,IAAI,QAAQ,MAAM,eAAe;EACnC,CACF,EAAA,CACc;CAChB;;;;CAKA,MAAM,cAA6B;EACjC,KAAK,6BAAa,IAAI,KAAK;EAC3B,MAAM,KAAK,KAAK;CAClB;AACF;AA1IE,gBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAVZ,aAWX,WAAA,YAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAhB3B,aAiBX,WAAA,UAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAK,CAAC,CAAA,GAtB3B,aAuBX,WAAA,WAAA,CAAA;AAUA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAQ,UAAU;CAAM,QAAQ;CAAM,UAAU;AAAK,CAAC,CAAA,GAhC1D,aAiCX,WAAA,eAAA,CAAA;AAMA,gBAAA,CADC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAtCZ,aAuCX,WAAA,SAAA,CAAA;AAMA,gBAAA,CADC,MAAM;CAAE,MAAM;CAAY,UAAU;AAAK,CAAC,CAAA,GA5ChC,aA6CX,WAAA,cAAA,CAAA;AA7CW,eAAN,gBAAA,CATN,KAAK;CACJ,WAAW;CAIX,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;CAChC,KAAK,EAAE,SAAS,CAAC,QAAQ,KAAK,EAAE;AAClC,CAAC,CAAA,GACY,YAAA"}

package/dist/chunks/{OidcIdentityCollection-eSM4gzHL.js → OidcIdentityCollection-D2JuUZZL.js}

@@ -1,5 +1,5 @@
 import { y as __exportAll } from "./NostrIdentity-CgdM4ng0.js";
-import { t as OidcIdentity } from "./OidcIdentity-DANnAbfU.js";
+import { t as OidcIdentity } from "./OidcIdentity-B9rltBDe.js";
 import { SmrtCollection } from "@happyvertical/smrt-core";
 //#region src/collections/OidcIdentityCollection.ts
 var OidcIdentityCollection_exports = /* @__PURE__ */ __exportAll({
@@ -28,15 +28,21 @@ var OidcIdentityCollection = class extends SmrtCollection {
 	* Find identity by issuer and subject
 	*/
 	async findBySubject(issuer, subject) {
-		const matches = await this.list({
-			where: {
-				issuer,
-				subject
-			},
-			limit: 2
-		});
-		if (matches.length > 1) throw new AmbiguousOidcIdentityError(issuer, subject);
-		return matches[0] ?? null;
+		const result = await this.db.query(`SELECT CAST(id AS VARCHAR) AS id,
+              CAST(profile_id AS VARCHAR) AS profile_id
+         FROM oidc_identities
+        WHERE issuer = ? AND subject = ?
+        LIMIT 2`, issuer, subject);
+		if (result.rows.length > 1) throw new AmbiguousOidcIdentityError(issuer, subject);
+		const row = result.rows[0];
+		const id = row?.id;
+		const profileId = row?.profile_id;
+		if (typeof id !== "string" || typeof profileId !== "string") return null;
+		const identity = await this.get({ id });
+		if (!identity) return null;
+		identity.id = id;
+		identity.profileId = profileId;
+		return identity;
 	}
 	/**
 	* Find identities by provider
@@ -73,4 +79,4 @@ var OidcIdentityCollection = class extends SmrtCollection {
 //#endregion
 export { OidcIdentityCollection as n, OidcIdentityCollection_exports as r, AmbiguousOidcIdentityError as t };
 
-//# sourceMappingURL=OidcIdentityCollection-eSM4gzHL.js.map
+//# sourceMappingURL=OidcIdentityCollection-D2JuUZZL.js.map

package/dist/chunks/OidcIdentityCollection-D2JuUZZL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcIdentityCollection-D2JuUZZL.js","names":[],"sources":["../../src/collections/OidcIdentityCollection.ts"],"sourcesContent":["/**\n * OidcIdentityCollection - Collection for managing OIDC identity records\n */\n\nimport { SmrtCollection } from '@happyvertical/smrt-core';\nimport { OidcIdentity } from '../models/OidcIdentity';\nimport type { Profile } from '../models/Profile';\n\n/** More than one legacy row maps the same opaque OIDC issuer and subject. */\nexport class AmbiguousOidcIdentityError extends Error {\n  constructor(\n    readonly issuer: string,\n    readonly subject: string,\n  ) {\n    super('Multiple OIDC identities match the same issuer and subject.');\n    this.name = 'AmbiguousOidcIdentityError';\n  }\n}\n\nexport class OidcIdentityCollection extends SmrtCollection<OidcIdentity> {\n  static readonly _itemClass = OidcIdentity;\n\n  /**\n   * Find identities for a profile\n   */\n  async findByProfile(profileId: string): Promise<OidcIdentity[]> {\n    return await this.list({\n      where: { profileId },\n    });\n  }\n\n  /**\n   * Find identity by issuer and subject\n   */\n  async findBySubject(\n    issuer: string,\n    subject: string,\n  ): Promise<OidcIdentity | null> {\n    const result = await this.db.query(\n      `SELECT CAST(id AS VARCHAR) AS id,\n              CAST(profile_id AS VARCHAR) AS profile_id\n         FROM oidc_identities\n        WHERE issuer = ? AND subject = ?\n        LIMIT 2`,\n      issuer,\n      subject,\n    );\n    if (result.rows.length > 1) {\n      throw new AmbiguousOidcIdentityError(issuer, subject);\n    }\n    const row = result.rows[0];\n    const id = row?.id;\n    const profileId = row?.profile_id;\n    if (typeof id !== 'string' || typeof profileId !== 'string') return null;\n    const identity = await this.get({ id });\n    if (!identity) return null;\n    // Preserve portable identities at this authentication boundary when\n    // native DuckDB exposes UUID results through internal objects.\n    identity.id = id;\n    identity.profileId = profileId;\n    return identity;\n  }\n\n  /**\n   * Find identities by provider\n   */\n  async findByProvider(provider: string): Promise<OidcIdentity[]> {\n    return await this.list({\n      where: { provider },\n    });\n  }\n\n  /**\n   * Reuse an existing exact OIDC identity for its unchanged Profile.\n   *\n   * @deprecated New authentication links require the owner-aware,\n   * transactional provisioning APIs. This compatibility helper may refresh a\n   * legacy Profile type, but refuses to create or rebind authority.\n   */\n  async linkToProfile(\n    profile: Profile,\n    oidcData: {\n      provider: string;\n      issuer: string;\n      subject: string;\n      email?: string;\n    },\n  ): Promise<OidcIdentity> {\n    return OidcIdentity.findOrCreate(profile, oidcData, this.options);\n  }\n\n  /**\n   * Unlink an OIDC identity from a profile\n   */\n  async unlinkFromProfile(\n    profileId: string,\n    issuer: string,\n    subject: string,\n  ): Promise<boolean> {\n    const identity = await this.findOne({\n      where: { profileId, issuer, subject },\n    });\n\n    if (identity) {\n      await identity.delete();\n      return true;\n    }\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;AASO,IAAM,6BAAN,cAAyC,MAAM;CACpD,YACW,QACA,SACT;EACA,MAAM,6DAA6D;EAH1D,KAAA,SAAA;EACA,KAAA,UAAA;EAGT,KAAK,OAAO;CACd;CALW;CACA;AAKb;AAEO,IAAM,yBAAN,cAAqC,eAA6B;CACvE,OAAgB,aAAa;;;;CAK7B,MAAM,cAAc,WAA4C;EAC9D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,UAAU,EACrB,CAAC;CACH;;;;CAKA,MAAM,cACJ,QACA,SAC8B;EAC9B,MAAM,SAAS,MAAM,KAAK,GAAG,MAC3B;;;;kBAKA,QACA,OACF;EACA,IAAI,OAAO,KAAK,SAAS,GACvB,MAAM,IAAI,2BAA2B,QAAQ,OAAO;EAEtD,MAAM,MAAM,OAAO,KAAK;EACxB,MAAM,KAAK,KAAK;EAChB,MAAM,YAAY,KAAK;EACvB,IAAI,OAAO,OAAO,YAAY,OAAO,cAAc,UAAU,OAAO;EACpE,MAAM,WAAW,MAAM,KAAK,IAAI,EAAE,GAAG,CAAC;EACtC,IAAI,CAAC,UAAU,OAAO;EAGtB,SAAS,KAAK;EACd,SAAS,YAAY;EACrB,OAAO;CACT;;;;CAKA,MAAM,eAAe,UAA2C;EAC9D,OAAO,MAAM,KAAK,KAAK,EACrB,OAAO,EAAE,SAAS,EACpB,CAAC;CACH;;;;;;;;CASA,MAAM,cACJ,SACA,UAMuB;EACvB,OAAO,aAAa,aAAa,SAAS,UAAU,KAAK,OAAO;CAClE;;;;CAKA,MAAM,kBACJ,WACA,QACA,SACkB;EAClB,MAAM,WAAW,MAAM,KAAK,QAAQ,EAClC,OAAO;GAAE;GAAW;GAAQ;EAAQ,EACtC,CAAC;EAED,IAAI,UAAU;GACZ,MAAM,SAAS,OAAO;GACtB,OAAO;EACT;EACA,OAAO;CACT;AACF"}

package/dist/chunks/{ProfileAssetCollection-A_PpEaDq.js → ProfileAssetCollection-BzB55xtX.js}

@@ -66,7 +66,7 @@ var ProfileAssetCollection = class extends SmrtJunction {
 	profileCollectionPromise = null;
 	async getProfileCollection() {
 		if (!this.profileCollectionPromise) {
-			const { ProfileCollection } = await import("./ProfileCollection-BsKhR5Dp.js").then((n) => n.r);
+			const { ProfileCollection } = await import("./ProfileCollection-WlRQ7bj3.js").then((n) => n.r);
 			this.profileCollectionPromise = ProfileCollection.create({ db: this.db });
 		}
 		return this.profileCollectionPromise;
@@ -90,4 +90,4 @@ ProfileAssetCollection = __decorateClass([smrt({
 //#endregion
 export { ProfileAssetCollection_exports as n, ProfileAsset as r, ProfileAssetCollection as t };
 
-//# sourceMappingURL=ProfileAssetCollection-A_PpEaDq.js.map
+//# sourceMappingURL=ProfileAssetCollection-BzB55xtX.js.map

package/dist/chunks/{ProfileAssetCollection-A_PpEaDq.js.map → ProfileAssetCollection-BzB55xtX.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ProfileAssetCollection-A_PpEaDq.js","names":[],"sources":["../../src/models/ProfileAsset.ts","../../src/collections/ProfileAssetCollection.ts"],"sourcesContent":["import type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  field,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\n\nexport interface ProfileAssetOptions extends SmrtObjectOptions {\n  profileId?: string;\n  assetId?: string;\n  relationship?: string;\n  sortOrder?: number;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional' })\n@smrt({\n  tableName: 'profile_assets',\n  conflictColumns: ['profile_id', 'asset_id', 'relationship'],\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAsset extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  @foreignKey('Profile', { required: true })\n  profileId = '';\n\n  @crossPackageRef('@happyvertical/smrt-assets:Asset', { required: true })\n  assetId = '';\n\n  @field({ required: true })\n  relationship = 'attachment';\n\n  @field()\n  sortOrder = 0;\n\n  constructor(options: ProfileAssetOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.assetId) this.assetId = options.assetId;\n    if (options.relationship) this.relationship = options.relationship;\n    if (options.sortOrder !== undefined) this.sortOrder = options.sortOrder;\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n  }\n}\n","import type { Asset } from '@happyvertical/smrt-assets';\nimport {\n  addOwnedAssetFromCollection,\n  getOwnedAssetsFromCollection,\n  removeOwnedAssetFromCollection,\n} from '@happyvertical/smrt-assets';\nimport type { SmrtCollectionOptions } from '@happyvertical/smrt-core';\nimport { SmrtJunction, smrt } from '@happyvertical/smrt-core';\nimport { ProfileAsset } from '../models/ProfileAsset';\nimport type { ProfileCollection } from './ProfileCollection';\n\nexport interface ProfileAssetCollectionOptions extends SmrtCollectionOptions {}\n\n@smrt({\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAssetCollection extends SmrtJunction<ProfileAsset> {\n  static readonly _itemClass = ProfileAsset;\n  protected leftField = 'profileId';\n  protected rightField = 'assetId';\n\n  private profileCollectionPromise: Promise<ProfileCollection> | null = null;\n\n  private async getProfileCollection(): Promise<ProfileCollection> {\n    if (!this.profileCollectionPromise) {\n      const { ProfileCollection } = await import('./ProfileCollection');\n      this.profileCollectionPromise = ProfileCollection.create({ db: this.db });\n    }\n\n    return this.profileCollectionPromise;\n  }\n\n  async getAssets(profileId: string, relationship?: string): Promise<Asset[]> {\n    return getOwnedAssetsFromCollection(\n      await this.getProfileCollection(),\n      profileId,\n      relationship,\n    );\n  }\n\n  async addAsset(\n    profileId: string,\n    asset: Asset,\n    relationship = 'attachment',\n    sortOrder = 0,\n  ): Promise<void> {\n    await addOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      asset,\n      relationship,\n      sortOrder,\n    );\n  }\n\n  async removeAsset(\n    profileId: string,\n    assetId: string,\n    relationship?: string,\n  ): Promise<void> {\n    await removeOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      assetId,\n      relationship,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BO,IAAM,eAAN,cAA2B,WAAW;CAE3C,WAA0B;CAG1B,YAAY;CAGZ,UAAU;CAGV,eAAe;CAGf,YAAY;CAEZ,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;AACF;AAtBE,kBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,aAEX,WAAA,YAAA,CAAA;AAGA,kBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAGA,kBAAA,CADC,gBAAgB,oCAAoC,EAAE,UAAU,KAAK,CAAC,CAAA,GAP5D,aAQX,WAAA,WAAA,CAAA;AAGA,kBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GAVd,aAWX,WAAA,gBAAA,CAAA;AAGA,kBAAA,CADC,MAAM,CAAA,GAbI,aAcX,WAAA,aAAA,CAAA;AAdW,eAAN,kBAAA,CARN,aAAa,EAAE,MAAM,WAAW,CAAC,GACjC,KAAK;CACJ,WAAW;CACX,iBAAiB;EAAC;EAAc;EAAY;CAAc;CAC1D,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,YAAA;;;;;;;;;;;;;;;;;;;ACRN,IAAM,yBAAN,cAAqC,aAA2B;CAE3D,YAAY;CACZ,aAAa;CAEf,2BAA8D;CAEtE,MAAc,uBAAmD;EAC/D,IAAI,CAAC,KAAK,0BAA0B;GAClC,MAAM,EAAE,sBAAsB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAC3C,KAAK,2BAA2B,kBAAkB,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC;EAC1E;EAEA,OAAO,KAAK;CACd;CAEA,MAAM,UAAU,WAAmB,cAAyC;EAC1E,OAAO,6BACL,MAAM,KAAK,qBAAqB,GAChC,WACA,YACF;CACF;CAEA,MAAM,SACJ,WACA,OACA,eAAe,cACf,YAAY,GACG;EACf,MAAM,4BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,OACA,cACA,SACF;CACF;CAEA,MAAM,YACJ,WACA,SACA,cACe;EACf,MAAM,+BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,SACA,YACF;CACF;AACF;AApDE,cADW,wBACK,cAAa,YAAA;AADlB,yBAAN,gBAAA,CALN,KAAK;CACJ,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,sBAAA"}
+{"version":3,"file":"ProfileAssetCollection-BzB55xtX.js","names":[],"sources":["../../src/models/ProfileAsset.ts","../../src/collections/ProfileAssetCollection.ts"],"sourcesContent":["import type { SmrtObjectOptions } from '@happyvertical/smrt-core';\nimport {\n  crossPackageRef,\n  field,\n  foreignKey,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\n\nexport interface ProfileAssetOptions extends SmrtObjectOptions {\n  profileId?: string;\n  assetId?: string;\n  relationship?: string;\n  sortOrder?: number;\n  tenantId?: string | null;\n}\n\n@TenantScoped({ mode: 'optional' })\n@smrt({\n  tableName: 'profile_assets',\n  conflictColumns: ['profile_id', 'asset_id', 'relationship'],\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAsset extends SmrtObject {\n  @tenantId({ nullable: true })\n  tenantId: string | null = null;\n\n  @foreignKey('Profile', { required: true })\n  profileId = '';\n\n  @crossPackageRef('@happyvertical/smrt-assets:Asset', { required: true })\n  assetId = '';\n\n  @field({ required: true })\n  relationship = 'attachment';\n\n  @field()\n  sortOrder = 0;\n\n  constructor(options: ProfileAssetOptions = {}) {\n    super(options);\n    if (options.profileId) this.profileId = options.profileId;\n    if (options.assetId) this.assetId = options.assetId;\n    if (options.relationship) this.relationship = options.relationship;\n    if (options.sortOrder !== undefined) this.sortOrder = options.sortOrder;\n    if (options.tenantId !== undefined) this.tenantId = options.tenantId;\n  }\n}\n","import type { Asset } from '@happyvertical/smrt-assets';\nimport {\n  addOwnedAssetFromCollection,\n  getOwnedAssetsFromCollection,\n  removeOwnedAssetFromCollection,\n} from '@happyvertical/smrt-assets';\nimport type { SmrtCollectionOptions } from '@happyvertical/smrt-core';\nimport { SmrtJunction, smrt } from '@happyvertical/smrt-core';\nimport { ProfileAsset } from '../models/ProfileAsset';\nimport type { ProfileCollection } from './ProfileCollection';\n\nexport interface ProfileAssetCollectionOptions extends SmrtCollectionOptions {}\n\n@smrt({\n  api: false,\n  mcp: false,\n  cli: false,\n})\nexport class ProfileAssetCollection extends SmrtJunction<ProfileAsset> {\n  static readonly _itemClass = ProfileAsset;\n  protected leftField = 'profileId';\n  protected rightField = 'assetId';\n\n  private profileCollectionPromise: Promise<ProfileCollection> | null = null;\n\n  private async getProfileCollection(): Promise<ProfileCollection> {\n    if (!this.profileCollectionPromise) {\n      const { ProfileCollection } = await import('./ProfileCollection');\n      this.profileCollectionPromise = ProfileCollection.create({ db: this.db });\n    }\n\n    return this.profileCollectionPromise;\n  }\n\n  async getAssets(profileId: string, relationship?: string): Promise<Asset[]> {\n    return getOwnedAssetsFromCollection(\n      await this.getProfileCollection(),\n      profileId,\n      relationship,\n    );\n  }\n\n  async addAsset(\n    profileId: string,\n    asset: Asset,\n    relationship = 'attachment',\n    sortOrder = 0,\n  ): Promise<void> {\n    await addOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      asset,\n      relationship,\n      sortOrder,\n    );\n  }\n\n  async removeAsset(\n    profileId: string,\n    assetId: string,\n    relationship?: string,\n  ): Promise<void> {\n    await removeOwnedAssetFromCollection(\n      await this.getProfileCollection(),\n      'Profile',\n      profileId,\n      assetId,\n      relationship,\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA0BO,IAAM,eAAN,cAA2B,WAAW;CAE3C,WAA0B;CAG1B,YAAY;CAGZ,UAAU;CAGV,eAAe;CAGf,YAAY;CAEZ,YAAY,UAA+B,CAAC,GAAG;EAC7C,MAAM,OAAO;EACb,IAAI,QAAQ,WAAW,KAAK,YAAY,QAAQ;EAChD,IAAI,QAAQ,SAAS,KAAK,UAAU,QAAQ;EAC5C,IAAI,QAAQ,cAAc,KAAK,eAAe,QAAQ;EACtD,IAAI,QAAQ,cAAc,KAAA,GAAW,KAAK,YAAY,QAAQ;EAC9D,IAAI,QAAQ,aAAa,KAAA,GAAW,KAAK,WAAW,QAAQ;CAC9D;AACF;AAtBE,kBAAA,CADC,SAAS,EAAE,UAAU,KAAK,CAAC,CAAA,GADjB,aAEX,WAAA,YAAA,CAAA;AAGA,kBAAA,CADC,WAAW,WAAW,EAAE,UAAU,KAAK,CAAC,CAAA,GAJ9B,aAKX,WAAA,aAAA,CAAA;AAGA,kBAAA,CADC,gBAAgB,oCAAoC,EAAE,UAAU,KAAK,CAAC,CAAA,GAP5D,aAQX,WAAA,WAAA,CAAA;AAGA,kBAAA,CADC,MAAM,EAAE,UAAU,KAAK,CAAC,CAAA,GAVd,aAWX,WAAA,gBAAA,CAAA;AAGA,kBAAA,CADC,MAAM,CAAA,GAbI,aAcX,WAAA,aAAA,CAAA;AAdW,eAAN,kBAAA,CARN,aAAa,EAAE,MAAM,WAAW,CAAC,GACjC,KAAK;CACJ,WAAW;CACX,iBAAiB;EAAC;EAAc;EAAY;CAAc;CAC1D,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,YAAA;;;;;;;;;;;;;;;;;;;ACRN,IAAM,yBAAN,cAAqC,aAA2B;CAE3D,YAAY;CACZ,aAAa;CAEf,2BAA8D;CAEtE,MAAc,uBAAmD;EAC/D,IAAI,CAAC,KAAK,0BAA0B;GAClC,MAAM,EAAE,sBAAsB,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;GAC3C,KAAK,2BAA2B,kBAAkB,OAAO,EAAE,IAAI,KAAK,GAAG,CAAC;EAC1E;EAEA,OAAO,KAAK;CACd;CAEA,MAAM,UAAU,WAAmB,cAAyC;EAC1E,OAAO,6BACL,MAAM,KAAK,qBAAqB,GAChC,WACA,YACF;CACF;CAEA,MAAM,SACJ,WACA,OACA,eAAe,cACf,YAAY,GACG;EACf,MAAM,4BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,OACA,cACA,SACF;CACF;CAEA,MAAM,YACJ,WACA,SACA,cACe;EACf,MAAM,+BACJ,MAAM,KAAK,qBAAqB,GAChC,WACA,WACA,SACA,YACF;CACF;AACF;AApDE,cADW,wBACK,cAAa,YAAA;AADlB,yBAAN,gBAAA,CALN,KAAK;CACJ,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,sBAAA"}

package/dist/chunks/{ProfileCollection-BsKhR5Dp.js → ProfileCollection-WlRQ7bj3.js}

@@ -511,7 +511,7 @@ var Profile = class extends SmrtObject {
 		if (existing.length > 0) await existing[0].delete();
 	}
 	async getProfileAssetCollection() {
-		const { ProfileAssetCollection } = await import("./ProfileAssetCollection-A_PpEaDq.js").then((n) => n.n);
+		const { ProfileAssetCollection } = await import("./ProfileAssetCollection-BzB55xtX.js").then((n) => n.n);
 		return ProfileAssetCollection.create({ db: this.db });
 	}
 	async getAssets(relationship) {
@@ -736,7 +736,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of OIDC identity records
 	*/
 	async getOidcIdentities() {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-D2JuUZZL.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -749,7 +749,7 @@ var Profile = class extends SmrtObject {
 	* type, but refuses to create or rebind authority.
 	*/
 	async linkOidcIdentity(oidcData) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-eSM4gzHL.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-D2JuUZZL.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(this.options)).linkToProfile(this, oidcData);
 	}
 	/**
@@ -884,7 +884,8 @@ var ProfileCollection = class extends SmrtCollection {
 	async requireCanonicalGlobalPerson(profileId, email) {
 		const db = this.requireDatabase();
 		await this.ensureEmailKeysReady();
-		const row = (await withSystemContext(() => db.query(`SELECT id, tenant_id, _meta_type, email, email_key
+		const row = (await withSystemContext(() => db.query(`SELECT CAST(id AS VARCHAR) AS id,
+                tenant_id, _meta_type, email, email_key
          FROM profiles
          WHERE id = ?
          LIMIT 1`, profileId))).rows[0];
@@ -970,7 +971,8 @@ var ProfileCollection = class extends SmrtCollection {
 		const db = this.requireDatabase();
 		await this.ensureEmailKeysReady();
 		const rows = (await withSystemContext(async () => {
-			return db.query(`SELECT id, tenant_id, _meta_type, email, email_key
+			return db.query(`SELECT CAST(id AS VARCHAR) AS id,
+                tenant_id, _meta_type, email, email_key
          FROM profiles
          WHERE email_key = ?
          ORDER BY created_at ASC, id ASC
@@ -1014,6 +1016,7 @@ var ProfileCollection = class extends SmrtCollection {
 	async requireHydratedProfile(profileId) {
 		const profile = await withSystemContext(() => this.get({ id: profileId }));
 		if (!profile) throw new CanonicalPersonProfileError("missing_profile", `Profile ${profileId} could not be hydrated.`);
+		profile.id = profileId;
 		return profile;
 	}
 	/**
@@ -1150,4 +1153,4 @@ function readRequiredString(row, key) {
 //#endregion
 export { smrtProfilesGenerateBioPrompt as _, Profile as a, OidcProfileEmailReservation as c, coordinateOidcProvisioning as d, isOidcAbortedTransactionError as f, promptMessageOptions as g, normalizeIdentityEmail as h, OidcProfileEmailReservationCollection as i, PROFILE_EMAIL_KEY_BACKFILL_NAME as l, saveOidcRaceArbiter as m, ProfileCollection as n, ProfileType as o, isOidcProvisioningRaceConflict as p, ProfileCollection_exports as r, ProfileType_exports as s, CanonicalPersonProfileError as t, backfillProfileEmailKeys as u };
 
-//# sourceMappingURL=ProfileCollection-BsKhR5Dp.js.map
+//# sourceMappingURL=ProfileCollection-WlRQ7bj3.js.map