@portaidentity/server 1.7.0

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.7.0] - 2026-08-26
+
+### Changed
+- Version bump to 1.7.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-present TrueSoftware B.V.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,33 @@
+# @portaidentity/server
+
+Porta's multi-tenant OpenID Connect server and infrastructure command-line interface.
+
+The package contains the compiled server, the `porta-server` executable, database migrations,
+authentication templates, and translations. Runtime assets resolve from the installed package, so
+the server and its CLI can be started from any working directory.
+
+## Repository commands
+
+Run these commands from the monorepo root:
+
+```bash
+yarn workspace @portaidentity/server build
+yarn workspace @portaidentity/server test
+yarn workspace @portaidentity/server verify
+yarn start
+yarn porta --help
+```
+
+The root commands preserve the repository-root `.env` behavior used by existing development and
+operations documentation.
+
+## Package entry points
+
+- `node dist/index.js` starts the compiled OIDC server from the package directory.
+- `porta-server` invokes the compiled infrastructure CLI at `dist/cli/index.js`.
+
+The public administration CLI remains a separate package: `@portaidentity/cli`.
+
+## License
+
+MIT © TrueSoftware B.V.

package/dist/applications/cache.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Application cache — Redis-backed fast lookup layer.
+ *
+ * Provides get/set/invalidate operations for Application objects
+ * stored in Redis. Each application is cached under two keys:
+ *   - `app:slug:{slug}` — for lookups by slug (e.g., client service)
+ *   - `app:id:{id}`     — for lookups by UUID
+ *
+ * Both keys store the same JSON-serialized Application object
+ * with a 5-minute TTL. Date fields (createdAt, updatedAt) are
+ * serialized as ISO 8601 strings and deserialized back to Date
+ * objects on read.
+ *
+ * Module data is NOT cached separately — modules are small enough
+ * to always load from the database. Application-level caching is
+ * sufficient since apps are looked up frequently by the client service.
+ *
+ * All Redis errors are caught and logged — cache failures never
+ * propagate to callers. The system gracefully degrades to direct
+ * database lookups when Redis is unavailable.
+ */
+import type { Application } from './types.js';
+/**
+ * Get an application from cache by slug.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param slug - Application slug
+ * @returns Cached application or null
+ */
+export declare function getCachedApplicationBySlug(slug: string): Promise<Application | null>;
+/**
+ * Get an application from cache by ID.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param id - Application UUID
+ * @returns Cached application or null
+ */
+export declare function getCachedApplicationById(id: string): Promise<Application | null>;
+/**
+ * Store an application in cache under both slug and ID keys.
+ *
+ * Both keys get the same TTL so they expire together.
+ * Date fields are serialized to ISO 8601 strings automatically
+ * by JSON.stringify().
+ *
+ * @param app - Application to cache
+ */
+export declare function cacheApplication(app: Application): Promise<void>;
+/**
+ * Invalidate all cache entries for an application.
+ *
+ * Deletes both the slug-keyed and ID-keyed cache entries.
+ * Should be called after any write operation (create, update,
+ * status change) to ensure stale data is not served.
+ *
+ * @param slug - Application slug
+ * @param id - Application UUID
+ */
+export declare function invalidateApplicationCache(slug: string, id: string): Promise<void>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/applications/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/applications/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAmB9C;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAW1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAWtF;AAMD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CActE;AAMD;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxF"}

package/dist/applications/cache.js

@@ -0,0 +1,161 @@
+/**
+ * Application cache — Redis-backed fast lookup layer.
+ *
+ * Provides get/set/invalidate operations for Application objects
+ * stored in Redis. Each application is cached under two keys:
+ *   - `app:slug:{slug}` — for lookups by slug (e.g., client service)
+ *   - `app:id:{id}`     — for lookups by UUID
+ *
+ * Both keys store the same JSON-serialized Application object
+ * with a 5-minute TTL. Date fields (createdAt, updatedAt) are
+ * serialized as ISO 8601 strings and deserialized back to Date
+ * objects on read.
+ *
+ * Module data is NOT cached separately — modules are small enough
+ * to always load from the database. Application-level caching is
+ * sufficient since apps are looked up frequently by the client service.
+ *
+ * All Redis errors are caught and logged — cache failures never
+ * propagate to callers. The system gracefully degrades to direct
+ * database lookups when Redis is unavailable.
+ */
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+import { afterDatabaseCommit } from '../lib/database.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Cache TTL in seconds (5 minutes) */
+const CACHE_TTL = 300;
+/** Key prefix for slug-based lookups */
+const SLUG_PREFIX = 'app:slug:';
+/** Key prefix for ID-based lookups */
+const ID_PREFIX = 'app:id:';
+// ---------------------------------------------------------------------------
+// Cache retrieval
+// ---------------------------------------------------------------------------
+/**
+ * Get an application from cache by slug.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param slug - Application slug
+ * @returns Cached application or null
+ */
+export async function getCachedApplicationBySlug(slug) {
+    try {
+        const redis = getRedis();
+        const data = await redis.get(`${SLUG_PREFIX}${slug}`);
+        if (!data)
+            return null;
+        return deserializeApplication(data);
+    }
+    catch {
+        // Graceful degradation — log and return null so caller falls back to DB
+        logger.warn({ event: 'application-cache-read-failed' }, 'Application cache read failed');
+        return null;
+    }
+}
+/**
+ * Get an application from cache by ID.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param id - Application UUID
+ * @returns Cached application or null
+ */
+export async function getCachedApplicationById(id) {
+    try {
+        const redis = getRedis();
+        const data = await redis.get(`${ID_PREFIX}${id}`);
+        if (!data)
+            return null;
+        return deserializeApplication(data);
+    }
+    catch {
+        // Graceful degradation — log and return null so caller falls back to DB
+        logger.warn({ event: 'application-cache-read-failed' }, 'Application cache read failed');
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Cache storage
+// ---------------------------------------------------------------------------
+/**
+ * Store an application in cache under both slug and ID keys.
+ *
+ * Both keys get the same TTL so they expire together.
+ * Date fields are serialized to ISO 8601 strings automatically
+ * by JSON.stringify().
+ *
+ * @param app - Application to cache
+ */
+export async function cacheApplication(app) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            const data = JSON.stringify(app);
+            // Store under both keys with the same TTL
+            await redis.set(`${SLUG_PREFIX}${app.slug}`, data, 'EX', CACHE_TTL);
+            await redis.set(`${ID_PREFIX}${app.id}`, data, 'EX', CACHE_TTL);
+        }
+        catch {
+            // Graceful degradation — cache write failure is non-fatal
+            logger.warn({ event: 'application-cache-write-failed' }, 'Application cache write failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Cache invalidation
+// ---------------------------------------------------------------------------
+/**
+ * Invalidate all cache entries for an application.
+ *
+ * Deletes both the slug-keyed and ID-keyed cache entries.
+ * Should be called after any write operation (create, update,
+ * status change) to ensure stale data is not served.
+ *
+ * @param slug - Application slug
+ * @param id - Application UUID
+ */
+export async function invalidateApplicationCache(slug, id) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            await redis.del(`${SLUG_PREFIX}${slug}`, `${ID_PREFIX}${id}`);
+        }
+        catch {
+            // Graceful degradation — cache invalidation failure is non-fatal
+            logger.warn({ event: 'application-cache-invalidation-failed' }, 'Application cache invalidation failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Serialization helpers
+// ---------------------------------------------------------------------------
+/**
+ * Deserialize a JSON string from Redis into an Application object.
+ *
+ * Converts ISO 8601 date strings back to Date objects for the
+ * createdAt and updatedAt fields, which JSON.stringify() serializes
+ * as strings rather than Date instances.
+ *
+ * @param data - JSON string from Redis
+ * @returns Application object with proper Date instances, or null if parse fails
+ */
+function deserializeApplication(data) {
+    try {
+        const parsed = JSON.parse(data);
+        // Restore Date objects from ISO string serialization
+        parsed.createdAt = new Date(parsed.createdAt);
+        parsed.updatedAt = new Date(parsed.updatedAt);
+        return parsed;
+    }
+    catch {
+        logger.warn('Failed to parse cached application JSON');
+        return null;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/applications/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/applications/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,uCAAuC;AACvC,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,wCAAwC;AACxC,MAAM,WAAW,GAAG,WAAW,CAAC;AAEhC,sCAAsC;AACtC,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAU;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAgB;IACrD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAEjC,0CAA0C;YAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY,EAAE,EAAU;IACvE,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE,GAAG,SAAS,GAAG,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,uCAAuC,CACxC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QAE/C,qDAAqD;QACrD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/applications/errors.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Application domain error types.
+ *
+ * Custom error classes for application-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - ApplicationNotFoundError → 404
+ *   - ApplicationValidationError → 400
+ */
+/**
+ * Thrown when an application cannot be found by ID or slug.
+ * Maps to HTTP 404 in route handlers.
+ */
+export declare class ApplicationNotFoundError extends Error {
+    constructor(identifier: string);
+}
+/**
+ * Thrown when an operation violates application business rules.
+ * Examples: invalid slug, slug already taken, invalid status transition,
+ * module slug collision within application.
+ * Maps to HTTP 400 in route handlers.
+ */
+export declare class ApplicationValidationError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/applications/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/applications/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,UAAU,EAAE,MAAM,EAG7B;CACF;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/applications/errors.js

@@ -0,0 +1,31 @@
+/**
+ * Application domain error types.
+ *
+ * Custom error classes for application-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - ApplicationNotFoundError → 404
+ *   - ApplicationValidationError → 400
+ */
+/**
+ * Thrown when an application cannot be found by ID or slug.
+ * Maps to HTTP 404 in route handlers.
+ */
+export class ApplicationNotFoundError extends Error {
+    constructor(identifier) {
+        super(`Application not found: ${identifier}`);
+        this.name = 'ApplicationNotFoundError';
+    }
+}
+/**
+ * Thrown when an operation violates application business rules.
+ * Examples: invalid slug, slug already taken, invalid status transition,
+ * module slug collision within application.
+ * Maps to HTTP 400 in route handlers.
+ */
+export class ApplicationValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ApplicationValidationError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/applications/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/applications/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,UAAkB;QAC5B,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF"}

package/dist/applications/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Applications module — public API barrel export.
+ *
+ * Re-exports the types, service functions, error classes, and slug
+ * utilities that other modules need. Internal implementation details
+ * (repository, cache) are NOT exported — they are consumed only by
+ * the service layer.
+ */
+export type { Application, ApplicationModule, ApplicationStatus, ModuleStatus, ApplicationRow, ApplicationModuleRow, CreateApplicationInput, UpdateApplicationInput, CreateModuleInput, UpdateModuleInput, ListApplicationsOptions, PaginatedResult, } from './types.js';
+export { createApplication, getApplicationById, getApplicationBySlug, updateApplication, listApplications, listApplicationsCursor, } from './service.js';
+export type { ListApplicationsCursorOptions } from './repository.js';
+export type { CursorPaginatedResult } from '../lib/cursor.js';
+export { deactivateApplication, activateApplication, archiveApplication, } from './service.js';
+export { createModule, updateModule, deactivateModule, listModules, } from './service.js';
+export { ApplicationNotFoundError, ApplicationValidationError, } from './errors.js';
+export { generateSlug, validateSlug, } from './slugs.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/applications/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/applications/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/applications/index.js

@@ -0,0 +1,19 @@
+/**
+ * Applications module — public API barrel export.
+ *
+ * Re-exports the types, service functions, error classes, and slug
+ * utilities that other modules need. Internal implementation details
+ * (repository, cache) are NOT exported — they are consumed only by
+ * the service layer.
+ */
+// Service functions — Application CRUD
+export { createApplication, getApplicationById, getApplicationBySlug, updateApplication, listApplications, listApplicationsCursor, } from './service.js';
+// Service functions — Status lifecycle
+export { deactivateApplication, activateApplication, archiveApplication, } from './service.js';
+// Service functions — Module management
+export { createModule, updateModule, deactivateModule, listModules, } from './service.js';
+// Error types
+export { ApplicationNotFoundError, ApplicationValidationError, } from './errors.js';
+// Slug utilities (for external consumers like CLI or routes)
+export { generateSlug, validateSlug, } from './slugs.js';
+//# sourceMappingURL=index.js.map

package/dist/applications/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/applications/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkBH,uCAAuC;AACvC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAMtB,uCAAuC;AACvC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,wCAAwC;AACxC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,cAAc;AACd,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,6DAA6D;AAC7D,OAAO,EACL,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/applications/repository.d.ts

@@ -0,0 +1,184 @@
+/**
+ * Application repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `applications` and `application_modules`
+ * tables using parameterized queries. Each function acquires the pool via
+ * `getPool()` and returns mapped Application/ApplicationModule objects.
+ *
+ * This module is the sole interface to the database for application
+ * data. The service layer composes repository + cache + validation.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates
+ * - Paginated listing with optional status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToApplication()` / `mapRowToModule()`
+ * - Module slug uniqueness scoped to parent application (composite key)
+ */
+import type { Application, ApplicationModule, ListApplicationsOptions, PaginatedResult } from './types.js';
+import type { CursorPaginatedResult } from '../lib/cursor.js';
+/** Input data for inserting a new application row */
+export interface InsertApplicationData {
+    name: string;
+    slug: string;
+    description?: string | null;
+}
+/**
+ * Insert a new application into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The slug must be unique (enforced by the DB unique constraint).
+ *
+ * @param data - Application data to insert
+ * @returns The newly created application
+ * @throws If slug already exists (unique constraint violation)
+ */
+export declare function insertApplication(data: InsertApplicationData): Promise<Application>;
+/**
+ * Find an application by its UUID.
+ *
+ * @param id - Application UUID
+ * @returns Application or null if not found
+ */
+export declare function findApplicationById(id: string): Promise<Application | null>;
+/**
+ * Find an application by its slug.
+ *
+ * Returns applications of any status (active, inactive, archived).
+ * The caller (service layer) is responsible for status-based access control.
+ *
+ * @param slug - Application slug
+ * @returns Application or null if not found
+ */
+export declare function findApplicationBySlug(slug: string): Promise<Application | null>;
+/** Fields that can be updated on an application */
+export interface UpdateApplicationData {
+    name?: string;
+    status?: string;
+    description?: string | null;
+}
+/**
+ * Update an application's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified.
+ *
+ * The `updated_at` column is handled automatically by the DB trigger.
+ *
+ * @param id - Application UUID
+ * @param data - Fields to update (only non-undefined fields are applied)
+ * @returns Updated application
+ * @throws Error if application not found or no fields provided
+ */
+export declare function updateApplication(id: string, data: UpdateApplicationData): Promise<Application>;
+/**
+ * List applications with pagination, optional status filter, search, and sorting.
+ *
+ * Executes two queries:
+ * 1. COUNT query for total matching rows
+ * 2. Data query with LIMIT/OFFSET for the current page
+ *
+ * Sort column and direction are whitelisted (not parameterized) since
+ * they're SQL identifiers/keywords, not user data values.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result with applications and metadata
+ */
+export declare function listApplications(options: ListApplicationsOptions): Promise<PaginatedResult<Application>>;
+/** Options for cursor-based application listing */
+export interface ListApplicationsCursorOptions {
+    cursor?: string;
+    limit?: number;
+    status?: string;
+    search?: string;
+    sortBy?: string;
+    sortOrder?: 'asc' | 'desc';
+}
+/**
+ * List applications with cursor-based keyset pagination.
+ *
+ * Uses `(sort_column, id) > (cursor_sort, cursor_id)` for efficient
+ * paging without COUNT queries. Queries limit+1 rows to detect hasMore.
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with applications
+ */
+export declare function listApplicationsCursor(options: ListApplicationsCursorOptions): Promise<CursorPaginatedResult<Application>>;
+/**
+ * Check if an application slug is already taken in the database.
+ *
+ * Checks across all statuses (active, inactive, archived) because
+ * slugs must be globally unique regardless of application status.
+ *
+ * @param slug - Slug to check
+ * @param excludeId - Optional app ID to exclude (useful for updates)
+ * @returns true if the slug already exists
+ */
+export declare function slugExists(slug: string, excludeId?: string): Promise<boolean>;
+/** Input data for inserting a new application module row */
+export interface InsertModuleData {
+    applicationId: string;
+    name: string;
+    slug: string;
+    description?: string | null;
+}
+/**
+ * Insert a new module into the database for a given application.
+ *
+ * Module slugs are unique within their parent application
+ * (enforced by the composite UNIQUE constraint on application_id + slug).
+ *
+ * @param data - Module data to insert
+ * @returns The newly created module
+ * @throws If composite slug already exists (unique constraint violation)
+ */
+export declare function insertModule(data: InsertModuleData): Promise<ApplicationModule>;
+/**
+ * Find a module by its UUID.
+ *
+ * @param id - Module UUID
+ * @returns ApplicationModule or null if not found
+ */
+export declare function findModuleById(id: string): Promise<ApplicationModule | null>;
+/** Fields that can be updated on a module */
+export interface UpdateModuleData {
+    name?: string;
+    status?: string;
+    description?: string | null;
+}
+/**
+ * Update a module's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. The `updated_at` column is handled by the DB trigger.
+ *
+ * @param id - Module UUID
+ * @param data - Fields to update (only non-undefined fields are applied)
+ * @returns Updated module
+ * @throws Error if module not found or no fields provided
+ */
+export declare function updateModule(id: string, data: UpdateModuleData): Promise<ApplicationModule>;
+/**
+ * List all modules for a given application.
+ *
+ * Returns all modules regardless of status, ordered by name ascending.
+ * No pagination — modules per application are expected to be small in number.
+ *
+ * @param applicationId - Application UUID
+ * @returns Array of modules for the application
+ */
+export declare function listModules(applicationId: string): Promise<ApplicationModule[]>;
+/**
+ * Check if a module slug is already taken within a given application.
+ *
+ * Module slugs are unique within their parent application (composite key).
+ * This check looks at all statuses (active, inactive).
+ *
+ * @param applicationId - Application UUID
+ * @param slug - Module slug to check
+ * @param excludeId - Optional module ID to exclude (useful for updates)
+ * @returns true if the slug already exists within the application
+ */
+export declare function moduleSlugExists(applicationId: string, slug: string, excludeId?: string): Promise<boolean>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/applications/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/applications/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EACV,WAAW,EAEX,iBAAiB,EAEjB,uBAAuB,EACvB,eAAe,EAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAU9D,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAWzF;AAMD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAUjF;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAUrF;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC,CA8BtB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAiDvC;AAMD,mDAAmD;AACnD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAmD7C;AAMD;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBnF;AAUD,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAWrF;AAMD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAUlF;AAMD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAYD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,iBAAiB,CAAC,CA6B5B;AAMD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CASrF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}