@igstack/app-catalog-backend-core 2.0.1-alpha-20260228221600 → 2.0.1-alpha-20260915180957

package/dist/db/client.d.mts

@@ -0,0 +1,79 @@
+import { PrismaClient } from "../generated/prisma/client.mjs";
+import pg from "pg";
+
+//#region src/db/client.d.ts
+type PrismaLogOption = NonNullable<ConstructorParameters<typeof PrismaClient>[0]>['log'];
+/**
+ * The schema a deployment should be reading and writing.
+ *
+ * DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
+ * config - otherwise a config that names `public` would pin a preview env back
+ * to the shared tables it was meant to be isolated from.
+ */
+declare function resolveDbSchema(configuredSchema?: string): string | undefined;
+/**
+ * `search_path` startup options for a schema-isolated deployment.
+ *
+ * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's
+ * schema has to be injected as a connection option instead. This half covers
+ * raw SQL and the migrations; Prisma's own queries need the adapter half too,
+ * which is why every core connection goes through createCorePrismaClient.
+ */
+declare function buildPgSchemaOptions(configuredSchema?: string): {
+  options?: string;
+};
+/**
+ * The one way to open a connection to the core database.
+ *
+ * Schema isolation takes two halves and both live here:
+ * - the pool's `search_path`, which raw SQL and the migrations follow;
+ * - the adapter's `schema`, which is what Prisma qualifies its table names
+ *   with. A client built without it emits `"public"."DbResource"` however
+ *   correct the pool's `current_schema()` is, so a preview env silently reads
+ *   and overwrites the shared canonical tables.
+ *
+ * A pool built outside this factory gets neither half, so don't build one.
+ */
+declare function createCorePrismaClient(params: {
+  connectionString: string;
+  configuredSchema?: string;
+  log?: PrismaLogOption;
+}): {
+  client: PrismaClient;
+  pool: pg.Pool;
+  schema: string | undefined;
+};
+/**
+ * Fails a deployment that believes it is schema-isolated but is not.
+ *
+ * Speaks up whenever a schema was resolved at all - the same resolution feeds the
+ * pool's `search_path`, so the expectation and the connection can never disagree
+ * by construction, and a deployment that configures isolation without setting
+ * DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres
+ * silently skips a `search_path` entry that does not exist and falls through to
+ * `public`, which is the shared-catalog corruption this is here to prevent.
+ */
+declare function verifyDbSchema(poolToCheck: pg.Pool, configuredSchema?: string): Promise<void>;
+/**
+ * Gets the internal Prisma client instance.
+ * Creates one if it doesn't exist.
+ */
+declare function getDbClient(): PrismaClient;
+/**
+ * Sets the internal Prisma client instance.
+ * Used by middleware to bridge with existing getDbClient() usage.
+ */
+declare function setDbClient(client: PrismaClient): void;
+/**
+ * Connects to the database.
+ * Call this before performing database operations.
+ */
+declare function connectDb(): Promise<void>;
+/**
+ * Disconnects from the database.
+ * Call this when done with database operations (e.g., in scripts).
+ */
+declare function disconnectDb(): Promise<void>;
+//#endregion
+export { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema };
+//# sourceMappingURL=client.d.mts.map

package/dist/db/client.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/db/client.ts"],"mappings":";;;;KAQK,eAAA,GAAkB,WAAA,CACrB,qBAAA,QAA6B,YAAA;;AAPZ;;;;;;iBAiBH,eAAA,CAAgB,gBAAA;;;;;;;AAAhC;;iBAYgB,oBAAA,CAAqB,gBAAA;EACnC,OAAA;AAAA;AADF;;;;;AAmBA;;;;;;;AAnBA,iBAmBgB,sBAAA,CAAuB,MAAA;EACrC,gBAAA;EACA,gBAAA;EACA,GAAA,GAAM,eAAA;AAAA;EACF,MAAA,EAAQ,YAAA;EAAc,IAAA,EAAM,EAAA,CAAG,IAAA;EAAM,MAAA;AAAA;;;;;;AA8C3C;;;;;iBAAsB,cAAA,CACpB,WAAA,EAAa,EAAA,CAAG,IAAA,EAChB,gBAAA,YACC,OAAA;;;;;iBAuBa,WAAA,CAAA,GAAe,YAAA;AAA/B;;;;AAAA,iBAqBgB,WAAA,CAAY,MAAA,EAAQ,YAAA;AAApC;;;;AAAA,iBAQsB,SAAA,CAAA,GAAa,OAAA;AAAnC;;;;AAAA,iBAUsB,YAAA,CAAA,GAAgB,OAAA"}

package/dist/db/client.mjs

@@ -0,0 +1,138 @@
+import { PrismaClient } from "../generated/prisma/client.mjs";
+import { buildPgSslConfig } from "./sslConfig.mjs";
+import { PrismaPg } from "@prisma/adapter-pg";
+import pg from "pg";
+
+//#region src/db/client.ts
+let prismaClient = null;
+let pool = null;
+/**
+* The schema a deployment should be reading and writing.
+*
+* DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
+* config - otherwise a config that names `public` would pin a preview env back
+* to the shared tables it was meant to be isolated from.
+*/
+function resolveDbSchema(configuredSchema) {
+	return process.env.DB_SCHEMA || configuredSchema || void 0;
+}
+/**
+* `search_path` startup options for a schema-isolated deployment.
+*
+* node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's
+* schema has to be injected as a connection option instead. This half covers
+* raw SQL and the migrations; Prisma's own queries need the adapter half too,
+* which is why every core connection goes through createCorePrismaClient.
+*/
+function buildPgSchemaOptions(configuredSchema) {
+	const schema = resolveDbSchema(configuredSchema);
+	return schema ? { options: `-c search_path=${schema}` } : {};
+}
+/**
+* The one way to open a connection to the core database.
+*
+* Schema isolation takes two halves and both live here:
+* - the pool's `search_path`, which raw SQL and the migrations follow;
+* - the adapter's `schema`, which is what Prisma qualifies its table names
+*   with. A client built without it emits `"public"."DbResource"` however
+*   correct the pool's `current_schema()` is, so a preview env silently reads
+*   and overwrites the shared canonical tables.
+*
+* A pool built outside this factory gets neither half, so don't build one.
+*/
+function createCorePrismaClient(params) {
+	const schema = resolveDbSchema(params.configuredSchema);
+	const ssl = buildPgSslConfig();
+	const newPool = new pg.Pool({
+		connectionString: params.connectionString,
+		...ssl === void 0 ? {} : { ssl },
+		...buildPgSchemaOptions(params.configuredSchema)
+	});
+	return {
+		client: new PrismaClient({
+			adapter: new PrismaPg(newPool, { schema }),
+			...params.log === void 0 ? {} : { log: params.log }
+		}),
+		pool: newPool,
+		schema
+	};
+}
+/** Postgres NAMEDATALEN - 1: identifiers are truncated to this many bytes. */
+const PG_MAX_IDENTIFIER_BYTES = 63;
+/**
+* How Postgres will have stored an identifier this long.
+*
+* A schema name over the limit is truncated identically wherever it appears - at
+* CREATE SCHEMA and in `search_path` alike - so the isolation still holds and
+* current_schema() merely reports the shortened name. Comparing raw strings would
+* fail a correctly isolated deployment, so compare what Postgres kept.
+*/
+function truncateIdentifier(name) {
+	const bytes = Buffer.from(name, "utf8");
+	if (bytes.length <= PG_MAX_IDENTIFIER_BYTES) return name;
+	return bytes.subarray(0, PG_MAX_IDENTIFIER_BYTES).toString("utf8");
+}
+/**
+* Fails a deployment that believes it is schema-isolated but is not.
+*
+* Speaks up whenever a schema was resolved at all - the same resolution feeds the
+* pool's `search_path`, so the expectation and the connection can never disagree
+* by construction, and a deployment that configures isolation without setting
+* DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres
+* silently skips a `search_path` entry that does not exist and falls through to
+* `public`, which is the shared-catalog corruption this is here to prevent.
+*/
+async function verifyDbSchema(poolToCheck, configuredSchema) {
+	const resolved = resolveDbSchema(configuredSchema);
+	const actual = (await poolToCheck.query("SELECT current_schema() AS schema")).rows[0]?.schema ?? null;
+	console.log(`[db] core schema: resolved=${resolved ?? "(none)"} current_schema=${actual ?? "(none)"}`);
+	if (!resolved) return;
+	if (actual !== truncateIdentifier(resolved)) throw new Error(`The configured schema is "${resolved}" but the database resolved current_schema() to "${actual}". The schema is most likely missing, so every query would fall through to the shared catalog tables. Migrate this schema before starting the app.`);
+}
+/**
+* Gets the internal Prisma client instance.
+* Creates one if it doesn't exist.
+*/
+function getDbClient() {
+	if (!prismaClient) {
+		const databaseUrl = process.env.AC_CORE_DATABASE_URL;
+		if (!databaseUrl) throw new Error("PrismaClient not initialized. You must call createAcMiddleware() before using database functions, or set AC_CORE_DATABASE_URL environment variable for standalone usage.");
+		const created = createCorePrismaClient({ connectionString: databaseUrl });
+		pool = created.pool;
+		prismaClient = created.client;
+	}
+	return prismaClient;
+}
+/**
+* Sets the internal Prisma client instance.
+* Used by middleware to bridge with existing getDbClient() usage.
+*/
+function setDbClient(client) {
+	prismaClient = client;
+}
+/**
+* Connects to the database.
+* Call this before performing database operations.
+*/
+async function connectDb() {
+	await getDbClient().$connect();
+	if (pool) await verifyDbSchema(pool);
+}
+/**
+* Disconnects from the database.
+* Call this when done with database operations (e.g., in scripts).
+*/
+async function disconnectDb() {
+	if (prismaClient) {
+		await prismaClient.$disconnect();
+		prismaClient = null;
+	}
+	if (pool) {
+		await pool.end();
+		pool = null;
+	}
+}
+
+//#endregion
+export { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema };
+//# sourceMappingURL=client.mjs.map

package/dist/db/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/db/client.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport { buildPgSslConfig } from './sslConfig'\n\nlet prismaClient: PrismaClient | null = null\nlet pool: pg.Pool | null = null\n\ntype PrismaLogOption = NonNullable<\n  ConstructorParameters<typeof PrismaClient>[0]\n>['log']\n\n/**\n * The schema a deployment should be reading and writing.\n *\n * DB_SCHEMA is set per deployment, so it outranks a schema baked into the app\n * config - otherwise a config that names `public` would pin a preview env back\n * to the shared tables it was meant to be isolated from.\n */\nexport function resolveDbSchema(configuredSchema?: string): string | undefined {\n  return process.env.DB_SCHEMA || configuredSchema || undefined\n}\n\n/**\n * `search_path` startup options for a schema-isolated deployment.\n *\n * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's\n * schema has to be injected as a connection option instead. This half covers\n * raw SQL and the migrations; Prisma's own queries need the adapter half too,\n * which is why every core connection goes through createCorePrismaClient.\n */\nexport function buildPgSchemaOptions(configuredSchema?: string): {\n  options?: string\n} {\n  const schema = resolveDbSchema(configuredSchema)\n  return schema ? { options: `-c search_path=${schema}` } : {}\n}\n\n/**\n * The one way to open a connection to the core database.\n *\n * Schema isolation takes two halves and both live here:\n * - the pool's `search_path`, which raw SQL and the migrations follow;\n * - the adapter's `schema`, which is what Prisma qualifies its table names\n *   with. A client built without it emits `\"public\".\"DbResource\"` however\n *   correct the pool's `current_schema()` is, so a preview env silently reads\n *   and overwrites the shared canonical tables.\n *\n * A pool built outside this factory gets neither half, so don't build one.\n */\nexport function createCorePrismaClient(params: {\n  connectionString: string\n  configuredSchema?: string\n  log?: PrismaLogOption\n}): { client: PrismaClient; pool: pg.Pool; schema: string | undefined } {\n  const schema = resolveDbSchema(params.configuredSchema)\n  // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres\n  // doesn't honor those correctly for a connection-string pool - see\n  // buildPgSslConfig).\n  const ssl = buildPgSslConfig()\n  const newPool = new pg.Pool({\n    connectionString: params.connectionString,\n    ...(ssl === undefined ? {} : { ssl }),\n    ...buildPgSchemaOptions(params.configuredSchema),\n  })\n  const adapter = new PrismaPg(newPool, { schema })\n  const client = new PrismaClient({\n    adapter,\n    ...(params.log === undefined ? {} : { log: params.log }),\n  })\n  return { client, pool: newPool, schema }\n}\n\n/** Postgres NAMEDATALEN - 1: identifiers are truncated to this many bytes. */\nconst PG_MAX_IDENTIFIER_BYTES = 63\n\n/**\n * How Postgres will have stored an identifier this long.\n *\n * A schema name over the limit is truncated identically wherever it appears - at\n * CREATE SCHEMA and in `search_path` alike - so the isolation still holds and\n * current_schema() merely reports the shortened name. Comparing raw strings would\n * fail a correctly isolated deployment, so compare what Postgres kept.\n */\nfunction truncateIdentifier(name: string): string {\n  const bytes = Buffer.from(name, 'utf8')\n  if (bytes.length <= PG_MAX_IDENTIFIER_BYTES) return name\n  return bytes.subarray(0, PG_MAX_IDENTIFIER_BYTES).toString('utf8')\n}\n\n/**\n * Fails a deployment that believes it is schema-isolated but is not.\n *\n * Speaks up whenever a schema was resolved at all - the same resolution feeds the\n * pool's `search_path`, so the expectation and the connection can never disagree\n * by construction, and a deployment that configures isolation without setting\n * DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres\n * silently skips a `search_path` entry that does not exist and falls through to\n * `public`, which is the shared-catalog corruption this is here to prevent.\n */\nexport async function verifyDbSchema(\n  poolToCheck: pg.Pool,\n  configuredSchema?: string,\n): Promise<void> {\n  const resolved = resolveDbSchema(configuredSchema)\n  const result = await poolToCheck.query<{ schema: string | null }>(\n    'SELECT current_schema() AS schema',\n  )\n  const actual = result.rows[0]?.schema ?? null\n  console.log(\n    `[db] core schema: resolved=${resolved ?? '(none)'} current_schema=${actual ?? '(none)'}`,\n  )\n  if (!resolved) return\n  if (actual !== truncateIdentifier(resolved)) {\n    throw new Error(\n      `The configured schema is \"${resolved}\" but the database resolved current_schema() to ` +\n        `\"${actual}\". The schema is most likely missing, so every query would fall through to ` +\n        `the shared catalog tables. Migrate this schema before starting the app.`,\n    )\n  }\n}\n\n/**\n * Gets the internal Prisma client instance.\n * Creates one if it doesn't exist.\n */\nexport function getDbClient(): PrismaClient {\n  if (!prismaClient) {\n    const databaseUrl = process.env.AC_CORE_DATABASE_URL\n    if (!databaseUrl) {\n      throw new Error(\n        'PrismaClient not initialized. You must call createAcMiddleware() before using database functions, ' +\n          'or set AC_CORE_DATABASE_URL environment variable for standalone usage.',\n      )\n    }\n\n    const created = createCorePrismaClient({ connectionString: databaseUrl })\n    pool = created.pool\n    prismaClient = created.client\n  }\n  return prismaClient\n}\n\n/**\n * Sets the internal Prisma client instance.\n * Used by middleware to bridge with existing getDbClient() usage.\n */\nexport function setDbClient(client: PrismaClient): void {\n  prismaClient = client\n}\n\n/**\n * Connects to the database.\n * Call this before performing database operations.\n */\nexport async function connectDb(): Promise<void> {\n  const client = getDbClient()\n  await client.$connect()\n  if (pool) await verifyDbSchema(pool)\n}\n\n/**\n * Disconnects from the database.\n * Call this when done with database operations (e.g., in scripts).\n */\nexport async function disconnectDb(): Promise<void> {\n  if (prismaClient) {\n    await prismaClient.$disconnect()\n    prismaClient = null\n  }\n  if (pool) {\n    await pool.end()\n    pool = null\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAI,eAAoC;AACxC,IAAI,OAAuB;;;;;;;;AAa3B,SAAgB,gBAAgB,kBAA+C;AAC7E,QAAO,QAAQ,IAAI,aAAa,oBAAoB;;;;;;;;;;AAWtD,SAAgB,qBAAqB,kBAEnC;CACA,MAAM,SAAS,gBAAgB,iBAAiB;AAChD,QAAO,SAAS,EAAE,SAAS,kBAAkB,UAAU,GAAG,EAAE;;;;;;;;;;;;;;AAe9D,SAAgB,uBAAuB,QAIiC;CACtE,MAAM,SAAS,gBAAgB,OAAO,iBAAiB;CAIvD,MAAM,MAAM,kBAAkB;CAC9B,MAAM,UAAU,IAAI,GAAG,KAAK;EAC1B,kBAAkB,OAAO;EACzB,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;EACpC,GAAG,qBAAqB,OAAO,iBAAiB;EACjD,CAAC;AAMF,QAAO;EAAE,QAJM,IAAI,aAAa;GAC9B,SAFc,IAAI,SAAS,SAAS,EAAE,QAAQ,CAAC;GAG/C,GAAI,OAAO,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK,OAAO,KAAK;GACxD,CAAC;EACe,MAAM;EAAS;EAAQ;;;AAI1C,MAAM,0BAA0B;;;;;;;;;AAUhC,SAAS,mBAAmB,MAAsB;CAChD,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;AACvC,KAAI,MAAM,UAAU,wBAAyB,QAAO;AACpD,QAAO,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,OAAO;;;;;;;;;;;;AAapE,eAAsB,eACpB,aACA,kBACe;CACf,MAAM,WAAW,gBAAgB,iBAAiB;CAIlD,MAAM,UAHS,MAAM,YAAY,MAC/B,oCACD,EACqB,KAAK,IAAI,UAAU;AACzC,SAAQ,IACN,8BAA8B,YAAY,SAAS,kBAAkB,UAAU,WAChF;AACD,KAAI,CAAC,SAAU;AACf,KAAI,WAAW,mBAAmB,SAAS,CACzC,OAAM,IAAI,MACR,6BAA6B,SAAS,mDAChC,OAAO,oJAEd;;;;;;AAQL,SAAgB,cAA4B;AAC1C,KAAI,CAAC,cAAc;EACjB,MAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,YACH,OAAM,IAAI,MACR,2KAED;EAGH,MAAM,UAAU,uBAAuB,EAAE,kBAAkB,aAAa,CAAC;AACzE,SAAO,QAAQ;AACf,iBAAe,QAAQ;;AAEzB,QAAO;;;;;;AAOT,SAAgB,YAAY,QAA4B;AACtD,gBAAe;;;;;;AAOjB,eAAsB,YAA2B;AAE/C,OADe,aAAa,CACf,UAAU;AACvB,KAAI,KAAM,OAAM,eAAe,KAAK;;;;;;AAOtC,eAAsB,eAA8B;AAClD,KAAI,cAAc;AAChB,QAAM,aAAa,aAAa;AAChC,iBAAe;;AAEjB,KAAI,MAAM;AACR,QAAM,KAAK,KAAK;AAChB,SAAO"}

package/dist/db/index.d.mts

@@ -0,0 +1,5 @@
+import { buildPgSchemaOptions, connectDb, createCorePrismaClient, disconnectDb, getDbClient, resolveDbSchema, setDbClient, verifyDbSchema } from "./client.mjs";
+import { buildPgSslConfig } from "./sslConfig.mjs";
+import { MakeTFromPrismaModel, ObjectKeys, ScalarFilter, ScalarKeys, TableSyncParamsPrisma, tableSyncPrisma } from "./tableSyncPrismaAdapter.mjs";
+import { TABLE_SYNC_MAGAZINE, TableSyncMagazine, TableSyncMagazineModelNameKey } from "./tableSyncMagazine.mjs";
+import { SyncAppCatalogResult, syncAppCatalog } from "./syncAppCatalog.mjs";

package/dist/db/sslConfig.d.mts

@@ -0,0 +1,28 @@
+import { ConnectionOptions } from "node:tls";
+
+//#region src/db/sslConfig.d.ts
+/**
+ * Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,
+ * because node-postgres does NOT do this correctly on its own for a
+ * connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`
+ * to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`
+ * — so an RDS server cert signed by the Amazon RDS CA would fail to verify.
+ *
+ * We therefore construct the `ssl` object explicitly and pass it to `new
+ * pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:
+ *   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)
+ *   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)
+ *   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)
+ *   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)
+ *   - disable / unset → no TLS
+ *
+ * `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS
+ * global-bundle.pem baked into the image).
+ *
+ * @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`
+ *          to leave SSL unset (let node-postgres fall back to its defaults).
+ */
+declare function buildPgSslConfig(env?: NodeJS.ProcessEnv): ConnectionOptions | boolean | undefined;
+//#endregion
+export { buildPgSslConfig };
+//# sourceMappingURL=sslConfig.d.mts.map

package/dist/db/sslConfig.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sslConfig.d.mts","names":[],"sources":["../../src/db/sslConfig.ts"],"mappings":";;;;;AAwBA;;;;;;;;;;;;;;;;;;;iBAAgB,gBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,iBAAA"}

package/dist/db/sslConfig.mjs

@@ -0,0 +1,71 @@
+import { readFileSync } from "node:fs";
+
+//#region src/db/sslConfig.ts
+/**
+* Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,
+* because node-postgres does NOT do this correctly on its own for a
+* connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`
+* to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`
+* — so an RDS server cert signed by the Amazon RDS CA would fail to verify.
+*
+* We therefore construct the `ssl` object explicitly and pass it to `new
+* pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:
+*   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)
+*   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)
+*   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)
+*   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)
+*   - disable / unset → no TLS
+*
+* `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS
+* global-bundle.pem baked into the image).
+*
+* @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`
+*          to leave SSL unset (let node-postgres fall back to its defaults).
+*/
+function buildPgSslConfig(env = process.env) {
+	const mode = env.PGSSLMODE;
+	const rootCertPath = env.PGSSLROOTCERT;
+	const readCa = () => {
+		if (!rootCertPath) return void 0;
+		try {
+			return readFileSync(rootCertPath, "utf8");
+		} catch (err) {
+			throw new Error(`PGSSLROOTCERT is set to "${rootCertPath}" but the CA bundle could not be read: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	};
+	switch (mode) {
+		case "disable": return false;
+		case "verify-full": {
+			const ca = readCa();
+			if (!ca) throw new Error("PGSSLMODE=verify-full requires PGSSLROOTCERT to point at a CA bundle (node-postgres would otherwise use the system trust store, which does not include the Amazon RDS CA). Set PGSSLROOTCERT.");
+			return {
+				ca,
+				rejectUnauthorized: true
+			};
+		}
+		case "verify-ca": {
+			const ca = readCa();
+			if (!ca) throw new Error("PGSSLMODE=verify-ca requires PGSSLROOTCERT to point at a CA bundle.");
+			return {
+				ca,
+				rejectUnauthorized: true,
+				checkServerIdentity: () => void 0
+			};
+		}
+		case "require":
+		case "prefer": {
+			const ca = readCa();
+			return ca ? {
+				ca,
+				rejectUnauthorized: true,
+				checkServerIdentity: () => void 0
+			} : { rejectUnauthorized: false };
+		}
+		case "no-verify": return { rejectUnauthorized: false };
+		default: return;
+	}
+}
+
+//#endregion
+export { buildPgSslConfig };
+//# sourceMappingURL=sslConfig.mjs.map

package/dist/db/sslConfig.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sslConfig.mjs","names":[],"sources":["../../src/db/sslConfig.ts"],"sourcesContent":["import { readFileSync } from 'node:fs'\nimport type { ConnectionOptions } from 'node:tls'\n\n/**\n * Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,\n * because node-postgres does NOT do this correctly on its own for a\n * connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`\n * to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`\n * — so an RDS server cert signed by the Amazon RDS CA would fail to verify.\n *\n * We therefore construct the `ssl` object explicitly and pass it to `new\n * pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:\n *   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)\n *   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)\n *   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)\n *   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)\n *   - disable / unset → no TLS\n *\n * `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS\n * global-bundle.pem baked into the image).\n *\n * @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`\n *          to leave SSL unset (let node-postgres fall back to its defaults).\n */\nexport function buildPgSslConfig(\n  env: NodeJS.ProcessEnv = process.env,\n): ConnectionOptions | boolean | undefined {\n  const mode = env.PGSSLMODE\n  const rootCertPath = env.PGSSLROOTCERT\n\n  const readCa = (): string | undefined => {\n    if (!rootCertPath) return undefined\n    try {\n      return readFileSync(rootCertPath, 'utf8')\n    } catch (err) {\n      throw new Error(\n        `PGSSLROOTCERT is set to \"${rootCertPath}\" but the CA bundle could not be read: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      )\n    }\n  }\n\n  switch (mode) {\n    case 'disable':\n      return false\n\n    case 'verify-full': {\n      const ca = readCa()\n      if (!ca) {\n        throw new Error(\n          'PGSSLMODE=verify-full requires PGSSLROOTCERT to point at a CA bundle ' +\n            '(node-postgres would otherwise use the system trust store, which does ' +\n            'not include the Amazon RDS CA). Set PGSSLROOTCERT.',\n        )\n      }\n      // Node defaults: rejectUnauthorized=true (CA chain) + checkServerIdentity\n      // (hostname). That IS verify-full.\n      return { ca, rejectUnauthorized: true }\n    }\n\n    case 'verify-ca': {\n      const ca = readCa()\n      if (!ca) {\n        throw new Error(\n          'PGSSLMODE=verify-ca requires PGSSLROOTCERT to point at a CA bundle.',\n        )\n      }\n      // Validate the CA chain but skip hostname matching.\n      return {\n        ca,\n        rejectUnauthorized: true,\n        checkServerIdentity: () => undefined,\n      }\n    }\n\n    case 'require':\n    case 'prefer': {\n      const ca = readCa()\n      // With a CA, behave like verify-ca (validate chain, skip hostname);\n      // without one, encrypt but don't validate.\n      return ca\n        ? { ca, rejectUnauthorized: true, checkServerIdentity: () => undefined }\n        : { rejectUnauthorized: false }\n    }\n\n    case 'no-verify':\n      return { rejectUnauthorized: false }\n\n    default:\n      // Unset / unknown: leave SSL unset so callers/pg keep prior behavior.\n      return undefined\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,iBACd,MAAyB,QAAQ,KACQ;CACzC,MAAM,OAAO,IAAI;CACjB,MAAM,eAAe,IAAI;CAEzB,MAAM,eAAmC;AACvC,MAAI,CAAC,aAAc,QAAO;AAC1B,MAAI;AACF,UAAO,aAAa,cAAc,OAAO;WAClC,KAAK;AACZ,SAAM,IAAI,MACR,4BAA4B,aAAa,yCACvC,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;;;AAIL,SAAQ,MAAR;EACE,KAAK,UACH,QAAO;EAET,KAAK,eAAe;GAClB,MAAM,KAAK,QAAQ;AACnB,OAAI,CAAC,GACH,OAAM,IAAI,MACR,gMAGD;AAIH,UAAO;IAAE;IAAI,oBAAoB;IAAM;;EAGzC,KAAK,aAAa;GAChB,MAAM,KAAK,QAAQ;AACnB,OAAI,CAAC,GACH,OAAM,IAAI,MACR,sEACD;AAGH,UAAO;IACL;IACA,oBAAoB;IACpB,2BAA2B;IAC5B;;EAGH,KAAK;EACL,KAAK,UAAU;GACb,MAAM,KAAK,QAAQ;AAGnB,UAAO,KACH;IAAE;IAAI,oBAAoB;IAAM,2BAA2B;IAAW,GACtE,EAAE,oBAAoB,OAAO;;EAGnC,KAAK,YACH,QAAO,EAAE,oBAAoB,OAAO;EAEtC,QAEE"}

package/dist/db/syncAppCatalog.d.mts

@@ -0,0 +1,28 @@
+import { ApprovalMethod } from "../types/common/approvalMethodTypes.mjs";
+import { Group, Person } from "../types/common/personGroupTypes.mjs";
+import { GroupingTagDefinition, Resource } from "../types/common/appCatalogTypes.mjs";
+
+//#region src/db/syncAppCatalog.d.ts
+interface SyncAppCatalogResult {
+  created: number;
+  updated: number;
+  deleted: number;
+  total: number;
+}
+/**
+ * Optional data to sync alongside the core app catalog.
+ */
+interface SyncAppCatalogOptions {
+  persons?: Person[];
+  groups?: Group[];
+}
+/**
+ * Syncs app catalog data to the database using table sync.
+ * This will create new resources, update existing ones, and delete any that are no longer in the input.
+ *
+ * Note: Call connectDb() before and disconnectDb() after if running in a script.
+ */
+declare function syncAppCatalog(resources: Resource[], tagsDefinitions: GroupingTagDefinition[], approvalMethods: ApprovalMethod[], screenshotsPath?: string, options?: SyncAppCatalogOptions): Promise<SyncAppCatalogResult>;
+//#endregion
+export { SyncAppCatalogResult, syncAppCatalog };
+//# sourceMappingURL=syncAppCatalog.d.mts.map

package/dist/db/syncAppCatalog.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncAppCatalog.d.mts","names":[],"sources":["../../src/db/syncAppCatalog.ts"],"mappings":";;;;;UAeiB,oBAAA;EACf,OAAA;EACA,OAAA;EACA,OAAA;EACA,KAAA;AAAA;;;;UAuJe,qBAAA;EACf,OAAA,GAAU,MAAA;EACV,MAAA,GAAS,KAAA;AAAA;AAFX;;;;;;AAAA,iBAWsB,cAAA,CACpB,SAAA,EAAW,QAAA,IACX,eAAA,EAAiB,qBAAA,IACjB,eAAA,EAAiB,cAAA,IACjB,eAAA,WACA,OAAA,GAAU,qBAAA,GACT,OAAA,CAAQ,oBAAA"}

package/dist/db/syncAppCatalog.mjs

@@ -0,0 +1,242 @@
+import { getDbClient } from "./client.mjs";
+import { parseSourceSlug } from "../utils/parseSourceSlug.mjs";
+import { tableSyncPrisma } from "./tableSyncPrismaAdapter.mjs";
+import { TABLE_SYNC_MAGAZINE } from "./tableSyncMagazine.mjs";
+import { upsertAsset } from "../modules/assets/upsertAsset.mjs";
+import { naturalSort } from "../utils/naturalSort.mjs";
+import { group } from "radashi";
+import { readFile, readdir, stat } from "node:fs/promises";
+
+//#region src/db/syncAppCatalog.ts
+function isFileNotFoundError(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function processAssetDirectory(dirPath, appSlug, assetType, prisma) {
+	try {
+		const sortedFiles = naturalSort(await readdir(dirPath));
+		const assetIds = [];
+		for (let i = 0; i < sortedFiles.length; i++) {
+			const fileName = sortedFiles[i];
+			if (!fileName) continue;
+			const assetName = assetType === "screenshot" ? `${appSlug}-screenshot-${i + 1}` : `${appSlug}-icon`;
+			const id = await upsertAsset({
+				prisma,
+				buffer: await readFile(`${dirPath}/${fileName}`),
+				originalFilename: fileName,
+				name: assetName,
+				assetType
+			});
+			assetIds.push(id);
+			if (assetType === "icon") break;
+		}
+		return assetIds;
+	} catch (error) {
+		if (isFileNotFoundError(error)) return [];
+		throw error;
+	}
+}
+async function syncAppAssets(appSlug, appPath, prisma) {
+	return {
+		screenshotIds: await processAssetDirectory(`${appPath}/screenshots`, appSlug, "screenshot", prisma),
+		iconName: (await processAssetDirectory(`${appPath}/icons`, appSlug, "icon", prisma)).length > 0 ? `${appSlug}-icon` : null
+	};
+}
+async function syncAssetsFromFileSystem(resources, allAppsAssetsPath) {
+	const appDirectories = await readdir(allAppsAssetsPath);
+	const prisma = getDbClient();
+	const bySlug = group(resources, (a) => a.slug);
+	for (const appDirName of appDirectories) {
+		try {
+			if (!(await stat(`${allAppsAssetsPath}/${appDirName}`)).isDirectory()) continue;
+		} catch (error) {
+			if (isFileNotFoundError(error)) continue;
+			throw error;
+		}
+		const appSlug = appDirName;
+		if (!bySlug[appSlug]) throw new Error(`App '${appSlug}' does not exist in the app catalog. Existing apps: ${Object.keys(bySlug).join(", ")}`);
+		try {
+			const { screenshotIds, iconName } = await syncAppAssets(appSlug, `${allAppsAssetsPath}/${appDirName}`, prisma);
+			const updateData = {};
+			if (screenshotIds.length > 0) updateData.screenshotIds = screenshotIds;
+			if (iconName !== null) updateData.iconName = iconName;
+			if (Object.keys(updateData).length > 0) await prisma.dbResource.update({
+				where: { slug: appSlug },
+				data: updateData
+			});
+		} catch (error) {
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			throw new Error(`Error while upserting assets for app '${appSlug}': ${errorMessage}`);
+		}
+	}
+}
+/**
+* Syncs app catalog data to the database using table sync.
+* This will create new resources, update existing ones, and delete any that are no longer in the input.
+*
+* Note: Call connectDb() before and disconnectDb() after if running in a script.
+*/
+async function syncAppCatalog(resources, tagsDefinitions, approvalMethods, screenshotsPath, options) {
+	try {
+		const prisma = getDbClient();
+		if (options?.persons) {
+			const dbPersons = options.persons.map((p) => ({
+				slug: p.slug,
+				firstName: p.firstName,
+				lastName: p.lastName,
+				email: p.email ?? null
+			}));
+			await tableSyncPrisma({
+				prisma,
+				...TABLE_SYNC_MAGAZINE.DbPerson
+			}).sync(dbPersons);
+		}
+		if (options?.groups) {
+			const dbGroups = options.groups.map((g) => ({
+				slug: g.slug,
+				displayName: g.displayName ?? null,
+				email: g.email ?? null
+			}));
+			await tableSyncPrisma({
+				prisma,
+				...TABLE_SYNC_MAGAZINE.DbGroup
+			}).sync(dbGroups);
+			const allMemberships = options.groups.flatMap((g) => g.memberSlugs.map((personSlug) => ({
+				groupSlug: g.slug,
+				personSlug
+			})));
+			await tableSyncPrisma({
+				prisma,
+				...TABLE_SYNC_MAGAZINE.DbGroupMembership
+			}).sync(allMemberships);
+		}
+		await tableSyncPrisma({
+			prisma,
+			...TABLE_SYNC_MAGAZINE.DbApprovalMethod
+		}).sync(approvalMethods);
+		const sync = tableSyncPrisma({
+			prisma,
+			...TABLE_SYNC_MAGAZINE.DbResource
+		});
+		await tableSyncPrisma({
+			prisma,
+			...TABLE_SYNC_MAGAZINE.DbAppTagDefinition
+		}).sync(tagsDefinitions);
+		const uniqueSourceSlugs = /* @__PURE__ */ new Set();
+		for (const resource of resources) for (const source of resource.sources ?? []) {
+			const sourceSlug = parseSourceSlug(typeof source === "string" ? source : source.url);
+			uniqueSourceSlugs.add(sourceSlug);
+		}
+		const sources = Array.from(uniqueSourceSlugs).map((slug) => ({
+			slug,
+			userPrompt: null
+		}));
+		await tableSyncPrisma({
+			prisma,
+			...TABLE_SYNC_MAGAZINE.Source
+		}).sync(sources);
+		const sortedResources = [...resources].sort((a, b) => {
+			return (a.parentSlug ? 1 : 0) - (b.parentSlug ? 1 : 0);
+		});
+		const dbResources = sortedResources.map((resource) => {
+			return {
+				slug: resource.slug || resource.displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""),
+				type: resource.type ?? "application",
+				displayName: resource.displayName,
+				abbreviation: resource.abbreviation ?? null,
+				nicknames: resource.nicknames ?? [],
+				description: resource.description,
+				teams: resource.teams ?? [],
+				accessRequest: resource.accessRequest ?? null,
+				notes: resource.notes ?? null,
+				tags: resource.tags ?? [],
+				appUrl: resource.appUrl ?? null,
+				links: resource.links ?? null,
+				iconName: resource.iconName ?? null,
+				screenshotIds: resource.screenshotIds ?? [],
+				deprecated: resource.deprecated ?? null,
+				aiPrompt: resource.aiPrompt ?? null,
+				urlIssues: resource.urlIssues ?? [],
+				tiers: resource.tiers ?? null,
+				parentSlug: resource.parentSlug ?? null,
+				tier: resource.tier ?? null,
+				aliases: resource.aliases ?? [],
+				ownerPersonSlug: resource.ownerPersonSlug ?? null,
+				approverSlugs: resource.approverSlugs ?? [],
+				accessComments: resource.accessComments ?? null,
+				extra: resource.extra ?? null,
+				lastCheckedAt: resource.lastCheckedAt ? new Date(resource.lastCheckedAt) : null,
+				nextCheckAfter: resource.nextCheckAfter ? new Date(resource.nextCheckAfter) : null,
+				lastContentChangeAt: resource.lastContentChangeAt ? new Date(resource.lastContentChangeAt) : null,
+				createdAt: resource.catalogAddedAt ? new Date(resource.catalogAddedAt) : void 0
+			};
+		});
+		const result = await sync.sync(dbResources);
+		for (const resource of resources) {
+			if (!resource.catalogAddedAt) continue;
+			const addedAt = new Date(resource.catalogAddedAt);
+			const slug = resource.slug || resource.displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+			await prisma.$executeRaw`
+        UPDATE "DbResource"
+        SET "createdAt" = ${addedAt}
+        WHERE "slug" = ${slug} AND "createdAt" > ${addedAt}
+      `;
+		}
+		const slugs = dbResources.map((a) => a.slug);
+		const resourceRows = await prisma.dbResource.findMany({
+			where: { slug: { in: slugs } },
+			select: {
+				slug: true,
+				id: true
+			}
+		});
+		const slugToId = Object.fromEntries(resourceRows.map((r) => [r.slug, r.id]));
+		const allSourceRefs = sortedResources.flatMap((resource) => {
+			const resourceSlug = resource.slug || resource.displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+			const resourceId = slugToId[resourceSlug];
+			if (!resourceId) throw new Error(`Resource '${resourceSlug}' has no id after sync. Existing slugs: ${Object.keys(slugToId).join(", ")}`);
+			return (resource.sources ?? []).map((source) => {
+				const url = typeof source === "string" ? source : source.url;
+				return {
+					resourceId,
+					sourceSlug: parseSourceSlug(url),
+					url,
+					parseDate: null,
+					excerpts: [],
+					userPrompt: null
+				};
+			});
+		});
+		await tableSyncPrisma({
+			prisma,
+			...TABLE_SYNC_MAGAZINE.SourceReference
+		}).sync(allSourceRefs);
+		const resourcesWithAiMemorySeed = sortedResources.filter((r) => r.aiMemory != null && r.aiMemory.trim() !== "");
+		if (resourcesWithAiMemorySeed.length > 0) for (const resource of resourcesWithAiMemorySeed) {
+			const slug = resource.slug || resource.displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+			await prisma.dbResource.updateMany({
+				where: {
+					slug,
+					aiMemory: null
+				},
+				data: { aiMemory: resource.aiMemory }
+			});
+		}
+		const actual = result.getActual();
+		if (screenshotsPath) await syncAssetsFromFileSystem(resources, screenshotsPath);
+		else console.warn("Do not sync screenhots");
+		return {
+			created: actual.length - resources.length + (resources.length - actual.length),
+			updated: 0,
+			deleted: 0,
+			total: actual.length
+		};
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : String(error);
+		const errorStack = error instanceof Error ? error.stack : void 0;
+		throw new Error(`Error syncing app catalog: ${errorMessage}\n\nDetails:\n${errorStack || "No stack trace available"}`);
+	}
+}
+
+//#endregion
+export { syncAppCatalog };
+//# sourceMappingURL=syncAppCatalog.mjs.map