@happyvertical/smrt-users 0.45.2 → 0.46.0

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
+export { type BackfillLegacyUserProfilesResult, backfillLegacyUserProfiles, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, type LegacyUserProfileBackfillErrorCode, } from './migrations/backfillLegacyUserProfiles.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
 export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
 export { CLI_AUTH_RETENTION_TASK, MAGIC_LINK_RETENTION_TASK, registerUserRetentionTasks, SESSIONS_RETENTION_TASK, USER_RETENTION_TASKS, unregisterUserRetentionTasks, } from './retention.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,7 +1,9 @@
-import { $ as MembershipCollection, A as UserEmailKeyBackfillError, B as PermissionCatalogService, C as decodeOidcTransaction, Ct as SessionStatus, Dt as UsersCliAuthRequest, E as resolveOidcProviderConfig, Et as UserStatus, F as TenantHierarchyError, G as syncPermissionCatalog, H as deriveOperationPermissionSlug, I as MAX_TENANT_HIERARCHY_DEPTH, J as Role, K as RolePermission, L as Tenant, M as TenantPermissionOverrideCollection, N as TenantPermissionOverride, O as OidcProvisioningError, P as TenantCollection, Q as MembershipOverride, R as DEFAULT_ROLE_PERMISSION_PATTERNS, S as OidcLoginService, St as OverrideEffect, T as getUsersOidcConfig, Tt as TenantStatus, U as normalizeOperationPermissionAction, V as deriveOperationPermissionCollectionName, W as registerPermissionDefinitions, X as Permission, Y as PermissionCollection, Z as MembershipOverrideCollection, _ as readMobileBearerToken, _t as AccessRequestStatus, a as TerminalAuthRateLimitError, at as GroupCollection, b as PermissionResolver, bt as DEFAULT_TENANT_POLICY, c as assertOperationPermission, ct as UsersCliAuthApproveLimit, d as getCurrentSessionPermissionContext, dt as normalizeEmail, et as Membership, f as getRequestScopedDatabase, ft as UsersCliAuthRequestCollection, g as MobileAuthService, gt as generateSessionId, h as MobileAuthError, ht as Session, i as TerminalAuthError, it as GroupMember, j as backfillUserEmailKeys, k as UserCollection, l as checkOperationPermission, lt as User, m as withSessionPermissionContext, mt as DEFAULT_SESSION_TTL, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as GroupRole, o as TerminalAuthService, ot as Group, p as withPrincipalPermissionContext, pt as SessionCollection, q as RoleCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as GroupMemberCollection, s as OperationPermissionError, st as UsersCliAuthApproveLimitCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as GroupRoleCollection, u as hasOperationPermission, ut as isValidEmail, v as validateMobileRedirectUri, vt as DEFAULT_ROLES, w as encodeOidcTransaction, wt as TenantPermissionEffect, x as OidcLoginError, xt as MembershipStatus, y as SessionService, yt as DEFAULT_ROLE_SLUGS, z as RolePermissionCollection } from "./chunks/TerminalAuthService-Buu2oc6x.js";
+import { $ as MembershipOverride, B as RolePermissionCollection, C as decodeOidcTransaction, Ct as OverrideEffect, Dt as UserStatus, E as resolveOidcProviderConfig, Et as TenantStatus, F as TenantCollection, G as registerPermissionDefinitions, H as deriveOperationPermissionCollectionName, I as TenantHierarchyError, J as RoleCollection, K as syncPermissionCatalog, L as MAX_TENANT_HIERARCHY_DEPTH, M as backfillUserEmailKeys, N as TenantPermissionOverrideCollection, O as OidcProvisioningError, Ot as UsersCliAuthRequest, P as TenantPermissionOverride, Q as MembershipOverrideCollection, R as Tenant, S as OidcLoginService, St as MembershipStatus, T as getUsersOidcConfig, Tt as TenantPermissionEffect, U as deriveOperationPermissionSlug, V as PermissionCatalogService, W as normalizeOperationPermissionAction, X as PermissionCollection, Y as Role, Z as Permission, _ as readMobileBearerToken, _t as generateSessionId, a as TerminalAuthRateLimitError, at as GroupMember, b as PermissionResolver, bt as DEFAULT_ROLE_SLUGS, c as assertOperationPermission, ct as UsersCliAuthApproveLimitCollection, d as getCurrentSessionPermissionContext, dt as isValidEmail, et as MembershipCollection, f as getRequestScopedDatabase, ft as normalizeEmail, g as MobileAuthService, gt as Session, h as MobileAuthError, ht as DEFAULT_SESSION_TTL, i as TerminalAuthError, it as GroupMemberCollection, j as UserEmailKeyBackfillError, k as UserCollection, l as checkOperationPermission, lt as UsersCliAuthApproveLimit, m as withSessionPermissionContext, mt as SessionCollection, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as GroupRoleCollection, o as TerminalAuthService, ot as GroupCollection, p as withPrincipalPermissionContext, pt as UsersCliAuthRequestCollection, q as RolePermission, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as GroupRole, s as OperationPermissionError, st as Group, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as Membership, u as hasOperationPermission, ut as User, v as validateMobileRedirectUri, vt as AccessRequestStatus, w as encodeOidcTransaction, wt as SessionStatus, x as OidcLoginError, xt as DEFAULT_TENANT_POLICY, y as SessionService, yt as DEFAULT_ROLES, z as DEFAULT_ROLE_PERMISSION_PATTERNS } from "./chunks/TerminalAuthService-C7z3uZ4w.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask } from "@happyvertical/smrt-core";
+import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
 import { createHash } from "node:crypto";
-import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
+import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
+import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 import { createLogger } from "@happyvertical/logger";
 //#region src/models/MagicLinkToken.ts
 var __defProp$2 = Object.defineProperty;
@@ -463,6 +465,126 @@ function isDuplicateKeyError(err) {
 	return isUniqueViolationError(err);
 }
 //#endregion
+//#region src/migrations/backfillLegacyUserProfiles.ts
+var LEGACY_USER_PROFILE_BACKFILL_NAME = "@happyvertical/smrt-users:legacy-user-profiles:v1";
+var LegacyUserProfileBackfillError = class extends Error {
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+		this.name = "LegacyUserProfileBackfillError";
+	}
+	code;
+};
+async function backfillLegacyUserProfiles(db) {
+	if (!db.transaction) throw new LegacyUserProfileBackfillError("transaction_required", "Legacy User/Profile backfill requires a root database with transaction().");
+	const transaction = db.transaction;
+	return withSystemContext(() => transaction(async (tx) => {
+		BackfillTracker.requireExistingTable(tx);
+		const tracker = new BackfillTracker({ db: tx });
+		if (!await tracker.isApplied(PROFILE_EMAIL_KEY_BACKFILL_NAME)) throw new LegacyUserProfileBackfillError("profile_email_backfill_required", "Run backfillProfileEmailKeys() before the legacy User/Profile backfill.");
+		if (!await tracker.isApplied("@happyvertical/smrt-users:user-email-keys:v1")) throw new LegacyUserProfileBackfillError("user_email_backfill_required", "Run backfillUserEmailKeys() before the legacy User/Profile backfill.");
+		const lockClause = /^postgres(?:ql)?:/iu.test(tx.url ?? "") ? " FOR UPDATE" : "";
+		const userResult = await tx.query(`SELECT CAST(id AS VARCHAR) AS id, email, email_key,
+                CAST(profile_id AS VARCHAR) AS profile_id
+         FROM users
+         ORDER BY id${lockClause}`);
+		const candidates = [];
+		const userEmailOwners = /* @__PURE__ */ new Map();
+		for (const row of userResult.rows) {
+			const id = readRequiredString(row.id, "User id");
+			const email = readString(row.email) ?? "";
+			const emailKey = email.trim() ? normalizeIdentityEmail(email) : null;
+			if (readString(row.email_key) !== emailKey) throw new LegacyUserProfileBackfillError("stale_user_email_key", `User ${id} has a missing or stale email key; rerun backfillUserEmailKeys().`);
+			if (emailKey) {
+				const owners = userEmailOwners.get(emailKey) ?? [];
+				owners.push(id);
+				userEmailOwners.set(emailKey, owners);
+			}
+			if (readString(row.profile_id)?.trim()) continue;
+			if (!emailKey) throw new LegacyUserProfileBackfillError("missing_email", `User ${id} cannot receive a canonical Profile without a nonblank email.`);
+			candidates.push({
+				email,
+				emailKey,
+				id
+			});
+		}
+		const duplicate = [...userEmailOwners.entries()].find(([, owners]) => owners.length > 1);
+		if (duplicate) throw new LegacyUserProfileBackfillError("duplicate_user_email", `Multiple Users share normalized email ${duplicate[0]}; reconcile them before backfill.`);
+		const candidateEmails = new Set(candidates.map((candidate) => candidate.emailKey));
+		const profileResult = await tx.query("SELECT CAST(id AS VARCHAR) AS id, slug, email, email_key FROM profiles ORDER BY id");
+		for (const row of profileResult.rows) {
+			const id = readRequiredString(row.id, "Profile id");
+			const slug = readString(row.slug);
+			const email = readString(row.email) ?? "";
+			const expectedEmailKey = email.trim() ? normalizeIdentityEmail(email) : null;
+			if (readString(row.email_key) !== expectedEmailKey) throw new LegacyUserProfileBackfillError("profile_email_backfill_required", `Profile ${id} has a missing or stale email key; rerun backfillProfileEmailKeys().`);
+			if (expectedEmailKey && candidateEmails.has(expectedEmailKey)) throw new LegacyUserProfileBackfillError("profile_conflict", `A Profile already uses the email required by legacy User ${findCandidateId(candidates, expectedEmailKey)}; reconcile ownership explicitly.`);
+			const slugOwner = candidates.find((candidate) => `legacy-user-${candidate.id}` === slug);
+			if (slugOwner) throw new LegacyUserProfileBackfillError("profile_conflict", `Profile slug ${slug} is already in use; reconcile legacy User ${slugOwner.id} explicitly.`);
+		}
+		if (candidateEmails.size > 0) {
+			const conflict = (await tx.query("SELECT email_key FROM oidc_profile_email_reservations ORDER BY email_key")).rows.find((row) => {
+				const emailKey = readString(row.email_key);
+				return emailKey ? candidateEmails.has(emailKey) : false;
+			});
+			if (conflict) throw new LegacyUserProfileBackfillError("reservation_conflict", `A canonical identity reservation already uses the email required by legacy User ${findCandidateId(candidates, readRequiredString(conflict.email_key, "Reservation email key"))}.`);
+		}
+		if ((await tx.query(`SELECT CAST(id AS VARCHAR) AS id
+         FROM profile_types
+         WHERE slug = 'person'
+           AND context = ''
+           AND _meta_type = '@happyvertical/smrt-profiles:ProfileType'
+           AND tenant_id IS NULL
+         ORDER BY id`)).rows.length > 1) throw new LegacyUserProfileBackfillError("profile_type_conflict", "Multiple global Person ProfileTypes exist; reconcile them before backfill.");
+		const profileTypes = await ProfileTypeCollection.create({ db: tx });
+		const profiles = await ProfileCollection.create({ db: tx });
+		let created = 0;
+		let linked = 0;
+		for (const candidate of candidates) {
+			const typeId = readRequiredString((await profileTypes.getOrCreateGlobalBySlug("person", {
+				name: "Person",
+				description: "Individual person profile"
+			})).id, "Person ProfileType id");
+			let profile = new Person({
+				db: tx,
+				email: candidate.email,
+				name: candidate.email,
+				slug: `legacy-user-${candidate.id}`,
+				tenantId: null,
+				typeId
+			});
+			await profile.initialize();
+			await profile.save();
+			profile = await profiles.reserveCanonicalIdentityEmail(readRequiredString(profile.id, "Created Profile id"), candidate.email);
+			if ((await tx.query(`UPDATE users
+           SET profile_id = ?, updated_at = current_timestamp
+           WHERE id = ?
+             AND (profile_id IS NULL OR TRIM(CAST(profile_id AS VARCHAR)) = '')`, readRequiredString(profile.id, "Reserved Profile id"), candidate.id)).rowCount !== 1) throw new Error(`Legacy User ${candidate.id} changed during Profile backfill.`);
+			created += 1;
+			linked += 1;
+		}
+		await tracker.recordApplied(LEGACY_USER_PROFILE_BACKFILL_NAME, {
+			description: "Legacy Users have canonical global Person Profiles.",
+			packageName: "@happyvertical/smrt-users"
+		});
+		return {
+			created,
+			linked
+		};
+	}));
+}
+function findCandidateId(candidates, emailKey) {
+	return candidates.find((candidate) => candidate.emailKey === emailKey)?.id ?? "<unknown>";
+}
+function readString(value) {
+	return typeof value === "string" ? value : value == null ? null : String(value);
+}
+function readRequiredString(value, label) {
+	const stringValue = readString(value);
+	if (!stringValue) throw new Error(`${label} is missing.`);
+	return stringValue;
+}
+//#endregion
 //#region src/services/AccessRequestService.ts
 var logger = createLogger({ level: "info" });
 var ACCESS_REQUEST_CAPABILITIES = {
@@ -953,7 +1075,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-Buu2oc6x.js").then((n) => n.D);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-C7z3uZ4w.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -982,7 +1104,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-Buu2oc6x.js").then((n) => n.D);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-C7z3uZ4w.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1458,6 +1580,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAGIC_LINK_RETENTION_TASK, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillUserEmailKeys, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map