@portaidentity/server 1.7.0

package/dist/cli/bootstrap.js

@@ -0,0 +1,90 @@
+/**
+ * CLI bootstrap — direct-DB execution mode for infrastructure commands.
+ *
+ * Provides `withBootstrap()` for commands that need direct database/Redis
+ * access (init, migrate, seed, health --direct, user 2fa --direct).
+ *
+ * These commands run before or without the HTTP server, so they connect
+ * directly to PostgreSQL + Redis. The HTTP-based admin commands have been
+ * extracted to the standalone `@portaidentity/cli` package.
+ *
+ * Uses dynamic imports so that the config module (which validates env vars
+ * at load time) isn't triggered until bootstrap() is called. This allows
+ * CLI flag overrides (--database-url, --redis-url) to set process.env
+ * BEFORE config parses, making the overrides effective.
+ *
+ * @module cli/bootstrap
+ */
+import 'dotenv/config';
+/**
+ * Bootstrap the CLI environment: load dotenv, connect DB + Redis.
+ *
+ * CLI flags (--database-url, --redis-url) override env vars if provided.
+ * The overrides are applied to process.env BEFORE the config module loads,
+ * so they propagate through to connectDatabase() and connectRedis().
+ *
+ * @param argv - Parsed CLI global options from yargs
+ */
+export async function bootstrap(argv) {
+    // CLI is a run-and-exit tool — suppress infrastructure logs (Database connected,
+    // Redis connected, etc.) that clutter both table and JSON output.
+    // Use --verbose to opt in to full diagnostic logging for debugging.
+    // Uses 'fatal' (quietest valid level) since the config schema doesn't allow 'silent'.
+    if (!argv.verbose) {
+        process.env.LOG_LEVEL = 'fatal';
+    }
+    // Override env vars BEFORE config module loads (via dynamic imports below).
+    // This ensures the config schema parses the CLI-provided URLs instead of .env values.
+    if (argv['database-url']) {
+        process.env.DATABASE_URL = argv['database-url'];
+    }
+    if (argv['redis-url']) {
+        process.env.REDIS_URL = argv['redis-url'];
+    }
+    // Dynamic imports ensure config/index.ts loads AFTER env var overrides are set.
+    // Static imports would trigger config validation at module-load time, before
+    // yargs has parsed argv, making CLI flag overrides ineffective.
+    const { connectDatabase } = await import('../lib/database.js');
+    const { connectRedis } = await import('../lib/redis.js');
+    await connectDatabase();
+    await connectRedis();
+}
+/**
+ * Clean shutdown: disconnect Redis then DB.
+ *
+ * Redis is disconnected first because some operations may flush
+ * cache entries to the database during shutdown.
+ */
+export async function shutdown() {
+    const { disconnectRedis } = await import('../lib/redis.js');
+    const { disconnectDatabase } = await import('../lib/database.js');
+    await disconnectRedis();
+    await disconnectDatabase();
+}
+/**
+ * Convenience wrapper: bootstrap → run command → shutdown.
+ *
+ * Ensures cleanup happens even if the command throws an error.
+ * This is the recommended way for command handlers to use bootstrap:
+ *
+ * ```typescript
+ * await withBootstrap(argv, async () => {
+ *   const orgs = await listOrganizations(pool);
+ *   printTable(headers, rows);
+ * });
+ * ```
+ *
+ * @param argv - Parsed CLI global options from yargs
+ * @param fn - The command handler function to execute
+ * @returns The return value of the command handler
+ */
+export async function withBootstrap(argv, fn) {
+    await bootstrap(argv);
+    try {
+        return await fn();
+    }
+    finally {
+        await shutdown();
+    }
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/cli/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/cli/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,eAAe,CAAC;AAGvB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,iFAAiF;IACjF,kEAAkE;IAClE,oEAAoE;IACpE,sFAAsF;IACtF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,sFAAsF;IACtF,IAAI,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAEzD,MAAM,eAAe,EAAE,CAAC;IACxB,MAAM,YAAY,EAAE,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAElE,MAAM,eAAe,EAAE,CAAC;IACxB,MAAM,kBAAkB,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB,EACnB,EAAoB;IAEpB,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/cli/commands/health.d.ts

@@ -0,0 +1,20 @@
+/**
+ * CLI health check command — direct-DB mode only.
+ *
+ * Tests database and Redis connectivity directly by connecting
+ * to PostgreSQL and Redis via the bootstrap module.
+ *
+ * HTTP-based health checks are available in the standalone
+ * `@portaidentity/cli` package.
+ *
+ * Usage:
+ *   porta health check          # Table output with ✅/❌ per service
+ *   porta health check --json   # JSON output: { database: "ok"|"error", redis: "ok"|"error" }
+ *
+ * @module cli/commands/health
+ */
+import type { CommandModule } from 'yargs';
+import type { GlobalOptions } from '../index.js';
+/** The health command module — registered at the top level of the CLI */
+export declare const healthCommand: CommandModule<GlobalOptions, GlobalOptions>;
+//# sourceMappingURL=health.d.ts.map

package/dist/cli/commands/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAwCjD,yEAAyE;AACzE,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CA0CrE,CAAC"}

package/dist/cli/commands/health.js

@@ -0,0 +1,80 @@
+/**
+ * CLI health check command — direct-DB mode only.
+ *
+ * Tests database and Redis connectivity directly by connecting
+ * to PostgreSQL and Redis via the bootstrap module.
+ *
+ * HTTP-based health checks are available in the standalone
+ * `@portaidentity/cli` package.
+ *
+ * Usage:
+ *   porta health check          # Table output with ✅/❌ per service
+ *   porta health check --json   # JSON output: { database: "ok"|"error", redis: "ok"|"error" }
+ *
+ * @module cli/commands/health
+ */
+import { withBootstrap } from '../bootstrap.js';
+import { withErrorHandling } from '../error-handler.js';
+import { printTable, success, error as errorMsg, outputResult } from '../output.js';
+/**
+ * Check database connectivity directly.
+ */
+async function checkDatabase() {
+    try {
+        const { getPool } = await import('../../lib/database.js');
+        await getPool().query('SELECT 1');
+        return { service: 'database', status: 'ok' };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        return { service: 'database', status: 'error', message };
+    }
+}
+/**
+ * Check Redis connectivity directly.
+ */
+async function checkRedis() {
+    try {
+        const { getRedis } = await import('../../lib/redis.js');
+        await getRedis().ping();
+        return { service: 'redis', status: 'ok' };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        return { service: 'redis', status: 'error', message };
+    }
+}
+/** The health command module — registered at the top level of the CLI */
+export const healthCommand = {
+    command: 'health',
+    describe: 'Check system health (direct DB + Redis)',
+    builder: (yargs) => {
+        return yargs.command('check', 'Test database and Redis connectivity', (y) => y, async (argv) => {
+            const args = argv;
+            await withErrorHandling(async () => {
+                let results = [];
+                await withBootstrap(args, async () => {
+                    results = await Promise.all([checkDatabase(), checkRedis()]);
+                });
+                outputResult(args.json, () => {
+                    const rows = results.map((r) => [
+                        r.service,
+                        r.status === 'ok' ? '✅ ok' : `❌ ${r.message ?? 'error'}`,
+                    ]);
+                    printTable(['Service', 'Status'], rows);
+                    const allOk = results.every((r) => r.status === 'ok');
+                    if (allOk) {
+                        success('All services healthy');
+                    }
+                    else {
+                        errorMsg('Some services are unhealthy');
+                    }
+                }, Object.fromEntries(results.map((r) => [r.service, r.status])));
+            }, args.verbose);
+        }).demandCommand(1, 'Specify a health subcommand: check');
+    },
+    handler: () => {
+        // No-op — subcommands handle execution
+    },
+};
+//# sourceMappingURL=health.js.map

package/dist/cli/commands/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/cli/commands/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AASpF;;GAEG;AACH,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC1D,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,aAAa,GAAgD;IACxE,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,yCAAyC;IACnD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjB,OAAO,KAAK,CAAC,OAAO,CAClB,OAAO,EACP,sCAAsC,EACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EACR,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,IAAgC,CAAC;YAC9C,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;gBACjC,IAAI,OAAO,GAAoB,EAAE,CAAC;gBAElC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;oBACnC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC/D,CAAC,CAAC,CAAC;gBAEH,YAAY,CACV,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;oBACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;wBAC9B,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,OAAO,EAAE;qBACzD,CAAC,CAAC;oBACH,UAAU,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;oBAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;oBACtD,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,CAAC,sBAAsB,CAAC,CAAC;oBAClC,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,6BAA6B,CAAC,CAAC;oBAC1C,CAAC;gBACH,CAAC,EACD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAC9D,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC,CACF,CAAC,aAAa,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,uCAAuC;IACzC,CAAC;CACF,CAAC"}

package/dist/cli/commands/init.d.ts

@@ -0,0 +1,48 @@
+/**
+ * CLI init command — bootstrap Porta admin infrastructure.
+ *
+ * Solves the chicken-and-egg problem: you need an OIDC client to authenticate
+ * the CLI, but you need the CLI to create clients. `porta init` is a one-time,
+ * direct-DB bootstrap command that creates everything needed for subsequent
+ * OIDC-based authentication.
+ *
+ * Created entities:
+ *   1. "Porta Admin" application (slug: porta-admin)
+ *   2. Granular admin permissions (42 resource:action permissions)
+ *   3. Five admin roles with permission sets (super-admin, org-admin, etc.)
+ *   4. "Porta Admin CLI" public client (Auth Code + PKCE)
+ *   5. First admin user (interactive prompts or flags)
+ *   7. Super-admin role assigned to the user
+ *   8. Super-admin user ID stored in system_config
+ *
+ * Prerequisites:
+ *   - Database migrations have been run (`porta migrate up`)
+ *   - Super-admin organization exists (created by migration 011_seed.sql)
+ *
+ * Usage:
+ *   porta init                            # Interactive — prompts for user details
+ *   porta init --email admin@example.com  # Non-interactive with flags
+ *     --given-name Admin --family-name User --password 'Secret123!'
+ *   porta init --force                    # Skip "already initialized" check
+ *
+ * @module cli/commands/init
+ */
+import type { CommandModule } from 'yargs';
+import type { GlobalOptions } from '../index.js';
+/** Options specific to the init command (extends global CLI options) */
+interface InitOptions extends GlobalOptions {
+    email?: string;
+    'given-name'?: string;
+    'family-name'?: string;
+    password?: string;
+}
+/**
+ * The init command module — registered at the top level of the CLI.
+ *
+ * Bootstraps all admin infrastructure entities in a single direct-DB
+ * operation. This is the only way to create the initial admin setup
+ * since the admin API requires authentication that doesn't exist yet.
+ */
+export declare const initCommand: CommandModule<GlobalOptions, InitOptions>;
+export {};
+//# sourceMappingURL=init.d.ts.map

package/dist/cli/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgBjD,wEAAwE;AACxE,UAAU,WAAY,SAAQ,aAAa;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA8JD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,WAAW,CA4QjE,CAAC"}

package/dist/cli/commands/init.js

@@ -0,0 +1,349 @@
+/**
+ * CLI init command — bootstrap Porta admin infrastructure.
+ *
+ * Solves the chicken-and-egg problem: you need an OIDC client to authenticate
+ * the CLI, but you need the CLI to create clients. `porta init` is a one-time,
+ * direct-DB bootstrap command that creates everything needed for subsequent
+ * OIDC-based authentication.
+ *
+ * Created entities:
+ *   1. "Porta Admin" application (slug: porta-admin)
+ *   2. Granular admin permissions (42 resource:action permissions)
+ *   3. Five admin roles with permission sets (super-admin, org-admin, etc.)
+ *   4. "Porta Admin CLI" public client (Auth Code + PKCE)
+ *   5. First admin user (interactive prompts or flags)
+ *   7. Super-admin role assigned to the user
+ *   8. Super-admin user ID stored in system_config
+ *
+ * Prerequisites:
+ *   - Database migrations have been run (`porta migrate up`)
+ *   - Super-admin organization exists (created by migration 011_seed.sql)
+ *
+ * Usage:
+ *   porta init                            # Interactive — prompts for user details
+ *   porta init --email admin@example.com  # Non-interactive with flags
+ *     --given-name Admin --family-name User --password 'Secret123!'
+ *   porta init --force                    # Skip "already initialized" check
+ *
+ * @module cli/commands/init
+ */
+import { withBootstrap } from '../bootstrap.js';
+import { withErrorHandling } from '../error-handler.js';
+import { success, warn } from '../output.js';
+import { confirm, promptInput, promptPassword } from '../prompt.js';
+import { ALL_ADMIN_PERMISSIONS, ADMIN_ROLE_DEFINITIONS, ALL_ADMIN_ROLES, } from '../../lib/admin-permissions.js';
+import { SUPER_ADMIN_USER_ID_KEY } from '../../lib/super-admin-protection.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build a human-readable permission name from a resource:action slug.
+ * Capitalizes the resource and action parts for display.
+ *
+ * @example
+ * buildPermissionName('org:create') → 'Organization Create'
+ * buildPermissionName('session:revoke') → 'Session Revoke'
+ *
+ * @param slug - Permission slug in resource:action format
+ * @returns Human-readable permission name
+ */
+function buildPermissionName(slug) {
+    const [resource, action] = slug.split(':');
+    const capitalize = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+    return `${capitalize(resource)} ${capitalize(action)}`;
+}
+/**
+ * Build a description for a permission from its slug.
+ *
+ * @param slug - Permission slug in resource:action format
+ * @returns Permission description
+ */
+function buildPermissionDescription(slug) {
+    const [resource, action] = slug.split(':');
+    return `Permission to ${action} ${resource} resources`;
+}
+/**
+ * Pad a string to a fixed width for aligned box output.
+ * Truncates with ellipsis if the string exceeds the target length.
+ *
+ * @param str - The string to pad
+ * @param length - Target width in characters
+ * @returns Padded or truncated string
+ */
+function padRight(str, length) {
+    if (str.length > length) {
+        return str.substring(0, length - 1) + '…';
+    }
+    return str + ' '.repeat(length - str.length);
+}
+/**
+ * Collect admin user details from interactive prompts or CLI flags.
+ *
+ * When all four flags (--email, --given-name, --family-name, --password)
+ * are provided, prompts are skipped entirely (non-interactive mode).
+ * Otherwise, missing fields are collected via interactive prompts.
+ * Password input uses hidden echo for security.
+ *
+ * @param argv - Parsed CLI options
+ * @returns Object with email, givenName, familyName, password
+ * @throws Error if required fields are empty or passwords don't match
+ */
+async function collectAdminUserDetails(argv) {
+    // Collect each field from flags or prompts
+    const email = argv.email ?? (await promptInput('Admin email: '));
+    const givenName = argv['given-name'] ?? (await promptInput('First name: '));
+    const familyName = argv['family-name'] ?? (await promptInput('Last name: '));
+    let password;
+    if (argv.password) {
+        // Password provided via flag — use directly (non-interactive mode)
+        password = argv.password;
+    }
+    else {
+        // Interactive password entry with confirmation
+        password = await promptPassword('Password: ');
+        const confirmPw = await promptPassword('Confirm password: ');
+        if (password !== confirmPw) {
+            throw new Error('Passwords do not match');
+        }
+    }
+    // Validate all required fields are present
+    if (!email || !givenName || !familyName || !password) {
+        throw new Error('All fields are required: email, given-name, family-name, password');
+    }
+    return { email, givenName, familyName, password };
+}
+/**
+ * Print the success summary box after initialization completes.
+ *
+ * Displays all created entities and next-step instructions in an
+ * aligned bordered box format.
+ */
+function printSuccessBox(orgName, orgSlug, appSlug, cliClientId, adminEmail, roleSlug, roleCount, permissionCount) {
+    const w = 43; // Content width inside the box
+    console.log('');
+    console.log('╔══════════════════════════════════════════════════════════════╗');
+    console.log('║                    Porta Initialized                        ║');
+    console.log('╠══════════════════════════════════════════════════════════════╣');
+    console.log(`║  Organization:  ${padRight(`${orgName} (${orgSlug})`, w)}║`);
+    console.log(`║  Application:   ${padRight(`Porta Admin (${appSlug})`, w)}║`);
+    console.log(`║  Client ID:     ${padRight(cliClientId, w)}║`);
+    console.log(`║  Admin User:    ${padRight(adminEmail, w)}║`);
+    console.log(`║  Admin Role:    ${padRight(`${roleSlug} (${permissionCount} permissions)`, w)}║`);
+    console.log(`║  Admin Roles:   ${padRight(`${roleCount} roles seeded`, w)}║`);
+    console.log('╠══════════════════════════════════════════════════════════════╣');
+    console.log('║  Next steps:                                                ║');
+    console.log('║  1. Start the server:  yarn dev                             ║');
+    console.log('║  2. Authenticate:      porta login                          ║');
+    console.log('║  3. Launch admin GUI:  porta gui                            ║');
+    console.log('╚══════════════════════════════════════════════════════════════╝');
+}
+// ---------------------------------------------------------------------------
+// Command definition
+// ---------------------------------------------------------------------------
+/**
+ * The init command module — registered at the top level of the CLI.
+ *
+ * Bootstraps all admin infrastructure entities in a single direct-DB
+ * operation. This is the only way to create the initial admin setup
+ * since the admin API requires authentication that doesn't exist yet.
+ */
+export const initCommand = {
+    command: 'init',
+    describe: 'Initialize Porta — create admin application, client, and first admin user',
+    builder: (yargs) => yargs
+        .option('email', {
+        type: 'string',
+        describe: 'Admin user email address',
+    })
+        .option('given-name', {
+        type: 'string',
+        describe: 'Admin user first name',
+    })
+        .option('family-name', {
+        type: 'string',
+        describe: 'Admin user last name',
+    })
+        .option('password', {
+        type: 'string',
+        describe: 'Admin user password (must meet NIST SP 800-63B requirements)',
+    }),
+    handler: async (argv) => {
+        await withErrorHandling(async () => {
+            await withBootstrap(argv, async () => {
+                // Dynamic imports — loaded after bootstrap connects DB + Redis.
+                // This ensures config is parsed with any CLI flag overrides.
+                const { findSuperAdminOrganization } = await import('../../organizations/repository.js');
+                const { getApplicationBySlug, createApplication } = await import('../../applications/index.js');
+                const { createClient } = await import('../../clients/index.js');
+                const { createUser, reactivateUser, markEmailVerified, } = await import('../../users/index.js');
+                const { createRole, createPermission, assignPermissionsToRole, assignRolesToUser, } = await import('../../rbac/index.js');
+                const { ensureSigningKeys } = await import('../../lib/signing-keys.js');
+                const { getPool } = await import('../../lib/database.js');
+                console.log('Initializing Porta...\n');
+                // -----------------------------------------------------------------
+                // Step 1: Verify super-admin org exists (created by migration seed)
+                // -----------------------------------------------------------------
+                const superAdminOrg = await findSuperAdminOrganization();
+                if (!superAdminOrg) {
+                    throw new Error('Super-admin organization not found. Run "porta migrate up" first.');
+                }
+                // -----------------------------------------------------------------
+                // Step 2: Safety guard — refuse if already initialized
+                // -----------------------------------------------------------------
+                const existingApp = await getApplicationBySlug('porta-admin');
+                if (existingApp && !argv.force) {
+                    throw new Error('System already initialized. Use --force to re-initialize.');
+                }
+                if (existingApp && argv.force) {
+                    // Re-initialization with --force: confirm the destructive action.
+                    // Full re-init (drop + recreate) is not yet supported — advise
+                    // the user to reset the database instead.
+                    const confirmed = await confirm('Re-initialization is not yet supported. Reset the database and re-run migrations instead. Cancel?', false);
+                    if (confirmed) {
+                        warn('Init cancelled — reset the database first.');
+                    }
+                    else {
+                        warn('Init cancelled.');
+                    }
+                    return;
+                }
+                // -----------------------------------------------------------------
+                // Step 3: Ensure signing keys exist in the database
+                // -----------------------------------------------------------------
+                await ensureSigningKeys();
+                console.log('  ✅ Signing keys verified');
+                // -----------------------------------------------------------------
+                // Step 4: Create the admin application
+                // -----------------------------------------------------------------
+                const adminApp = await createApplication({
+                    name: 'Porta Admin',
+                    slug: 'porta-admin',
+                    description: 'Porta administration application — manages the admin API and CLI authentication',
+                });
+                console.log(`  ✅ Application created: ${adminApp.name} (${adminApp.slug})`);
+                // -----------------------------------------------------------------
+                // Step 5: Create granular admin permissions (resource:action format)
+                // -----------------------------------------------------------------
+                // Each permission maps to a specific admin API operation.
+                // Permission slugs come from the centralized admin-permissions module.
+                const permissionIdMap = new Map(); // slug → permission ID
+                for (const permSlug of ALL_ADMIN_PERMISSIONS) {
+                    const permission = await createPermission({
+                        applicationId: adminApp.id,
+                        slug: permSlug,
+                        name: buildPermissionName(permSlug),
+                        description: buildPermissionDescription(permSlug),
+                    });
+                    permissionIdMap.set(permSlug, permission.id);
+                }
+                console.log(`  ✅ ${permissionIdMap.size} granular permissions created`);
+                // -----------------------------------------------------------------
+                // Step 6: Create all 5 admin roles and assign permissions
+                // -----------------------------------------------------------------
+                // Each role gets a specific set of permissions as defined in
+                // ADMIN_ROLE_DEFINITIONS. The super-admin role gets all permissions.
+                const createdRoles = new Map(); // slug → role ID
+                for (const roleDef of ALL_ADMIN_ROLES) {
+                    const role = await createRole({
+                        applicationId: adminApp.id,
+                        name: roleDef.name,
+                        slug: roleDef.slug,
+                        description: roleDef.description,
+                    });
+                    createdRoles.set(roleDef.slug, role.id);
+                    // Resolve permission IDs for this role's permission set
+                    const rolePermissionIds = roleDef.permissions
+                        .map((permSlug) => permissionIdMap.get(permSlug))
+                        .filter((id) => id !== undefined);
+                    if (rolePermissionIds.length > 0) {
+                        await assignPermissionsToRole(role.id, rolePermissionIds);
+                    }
+                    console.log(`  ✅ Role: ${role.name} (${role.slug}) — ${rolePermissionIds.length} permissions`);
+                }
+                // -----------------------------------------------------------------
+                // Step 7: Create the admin CLI client (public, Auth Code + PKCE)
+                // -----------------------------------------------------------------
+                // The client is public (no secret) because CLI tools cannot safely
+                // store secrets. PKCE provides security for the authorization code
+                // exchange. The redirect URIs use loopback addresses — per RFC 8252
+                // §7.3, node-oidc-provider allows flexible port matching for native
+                // app clients using loopback redirect URIs.
+                const { client: adminClient } = await createClient({
+                    organizationId: superAdminOrg.id,
+                    applicationId: adminApp.id,
+                    clientName: 'Porta Admin CLI',
+                    clientType: 'public',
+                    applicationType: 'native',
+                    redirectUris: [
+                        'http://127.0.0.1/callback',
+                        'http://localhost/callback',
+                        'http://127.0.0.1/auth/callback',
+                    ],
+                    postLogoutRedirectUris: [
+                        'http://127.0.0.1',
+                    ],
+                    grantTypes: ['authorization_code', 'refresh_token'],
+                    scope: 'openid profile email offline_access',
+                    requirePkce: true,
+                });
+                console.log(`  ✅ Client created: ${adminClient.clientName} (${adminClient.clientId})`);
+                // -----------------------------------------------------------------
+                // Step 8: Collect admin user details (interactive or from flags)
+                // -----------------------------------------------------------------
+                const userDetails = await collectAdminUserDetails(argv);
+                // -----------------------------------------------------------------
+                // Step 9: Create the admin user in the super-admin organization
+                // -----------------------------------------------------------------
+                const adminUser = await createUser({
+                    organizationId: superAdminOrg.id,
+                    email: userDetails.email,
+                    givenName: userDetails.givenName,
+                    familyName: userDetails.familyName,
+                    password: userDetails.password,
+                });
+                console.log(`  ✅ User created: ${adminUser.email}`);
+                // -----------------------------------------------------------------
+                // Step 10: Activate user (if not already active)
+                // -----------------------------------------------------------------
+                if (adminUser.status !== 'active') {
+                    await reactivateUser(adminUser.id);
+                }
+                console.log('  ✅ User activated');
+                // -----------------------------------------------------------------
+                // Step 11: Mark email as verified (admin doesn't need email flow)
+                // -----------------------------------------------------------------
+                await markEmailVerified(adminUser.id);
+                console.log('  ✅ Email marked as verified');
+                // -----------------------------------------------------------------
+                // Step 12: Assign super-admin role to the new user
+                // -----------------------------------------------------------------
+                const superAdminRoleId = createdRoles.get(ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug);
+                if (!superAdminRoleId) {
+                    throw new Error('Super-admin role was not created — init is broken');
+                }
+                await assignRolesToUser(adminUser.id, [superAdminRoleId]);
+                console.log(`  ✅ Role "${ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug}" assigned to user`);
+                // -----------------------------------------------------------------
+                // Step 13: Store super-admin user ID in system_config
+                // -----------------------------------------------------------------
+                // This enables the super-admin protection module to identify
+                // the bootstrap user and prevent destructive operations on them.
+                const pool = getPool();
+                await pool.query(`INSERT INTO system_config (key, value, value_type, description, is_sensitive)
+           VALUES ($1, to_jsonb($2::text), 'string', $3, FALSE)
+           ON CONFLICT (key) DO UPDATE SET value = to_jsonb($2::text), updated_at = NOW()`, [
+                    SUPER_ADMIN_USER_ID_KEY,
+                    adminUser.id,
+                    'User ID of the super-admin user created during porta init',
+                ]);
+                console.log('  ✅ Super-admin user ID stored in system config');
+                // -----------------------------------------------------------------
+                // Step 14: Print the success summary
+                // -----------------------------------------------------------------
+                printSuccessBox(superAdminOrg.name, superAdminOrg.slug, adminApp.slug, adminClient.clientId, userDetails.email, ADMIN_ROLE_DEFINITIONS.SUPER_ADMIN.slug, createdRoles.size, permissionIdMap.size);
+                success('Porta initialization complete!');
+            });
+        }, argv.verbose);
+    },
+};
+//# sourceMappingURL=init.js.map

package/dist/cli/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAc9E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,iBAAiB,MAAM,IAAI,QAAQ,YAAY,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc;IAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,uBAAuB,CAAC,IAAiB;IAMtD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,mEAAmE;QACnE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,+CAA+C;QAC/C,QAAQ,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,OAAe,EACf,OAAe,EACf,WAAmB,EACnB,UAAkB,EAClB,QAAgB,EAChB,SAAiB,EACjB,eAAuB;IAEvB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CACT,qBAAqB,QAAQ,CAAC,gBAAgB,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,CAChE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CACT,qBAAqB,QAAQ,CAAC,GAAG,QAAQ,KAAK,eAAe,eAAe,EAAE,CAAC,CAAC,GAAG,CACpF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,qBAAqB,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAE,CAAC,CAAC,GAAG,CACjE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAA8C;IACpE,OAAO,EAAE,MAAM;IACf,QAAQ,EACN,2EAA2E;IAC7E,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,0BAA0B;KACrC,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,uBAAuB;KAClC,CAAC;SACD,MAAM,CAAC,aAAa,EAAE;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,sBAAsB;KACjC,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,8DAA8D;KACzE,CAAC;IAEN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,iBAAiB,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;gBACnC,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CACjD,mCAAmC,CACpC,CAAC;gBACF,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAC9D,6BAA6B,CAC9B,CAAC;gBACF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CACnC,wBAAwB,CACzB,CAAC;gBACF,MAAM,EACJ,UAAU,EACV,cAAc,EACd,iBAAiB,GAClB,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACzC,MAAM,EACJ,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACxC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CACxC,2BAA2B,CAC5B,CAAC;gBACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBAE1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBAEvC,oEAAoE;gBACpE,oEAAoE;gBACpE,oEAAoE;gBACpE,MAAM,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;gBACzD,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,uDAAuD;gBACvD,oEAAoE;gBACpE,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC9B,kEAAkE;oBAClE,+DAA+D;oBAC/D,0CAA0C;oBAC1C,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,mGAAmG,EACnG,KAAK,CACN,CAAC;oBACF,IAAI,SAAS,EAAE,CAAC;wBACd,IAAI,CAAC,4CAA4C,CAAC,CAAC;oBACrD,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC1B,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,oEAAoE;gBACpE,oDAAoD;gBACpD,oEAAoE;gBACpE,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;gBAEzC,oEAAoE;gBACpE,uCAAuC;gBACvC,oEAAoE;gBACpE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;oBACvC,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,aAAa;oBACnB,WAAW,EACT,iFAAiF;iBACpF,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CACT,4BAA4B,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,GAAG,CAC/D,CAAC;gBAEF,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,0DAA0D;gBAC1D,uEAAuE;gBACvE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;gBAC1E,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;oBAC7C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;wBACxC,aAAa,EAAE,QAAQ,CAAC,EAAE;wBAC1B,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC;wBACnC,WAAW,EAAE,0BAA0B,CAAC,QAAQ,CAAC;qBAClD,CAAC,CAAC;oBACH,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,OAAO,eAAe,CAAC,IAAI,+BAA+B,CAC3D,CAAC;gBAEF,oEAAoE;gBACpE,0DAA0D;gBAC1D,oEAAoE;gBACpE,6DAA6D;gBAC7D,qEAAqE;gBACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,iBAAiB;gBACjE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;wBAC5B,aAAa,EAAE,QAAQ,CAAC,EAAE;wBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;oBACH,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;oBAExC,wDAAwD;oBACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;yBAC1C,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;yBAChD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;oBAElD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;oBAC5D,CAAC;oBAED,OAAO,CAAC,GAAG,CACT,aAAa,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,iBAAiB,CAAC,MAAM,cAAc,CAClF,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,oEAAoE;gBACpE,4CAA4C;gBAC5C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,YAAY,CAAC;oBACjD,cAAc,EAAE,aAAa,CAAC,EAAE;oBAChC,aAAa,EAAE,QAAQ,CAAC,EAAE;oBAC1B,UAAU,EAAE,iBAAiB;oBAC7B,UAAU,EAAE,QAAQ;oBACpB,eAAe,EAAE,QAAQ;oBACzB,YAAY,EAAE;wBACZ,2BAA2B;wBAC3B,2BAA2B;wBAC3B,gCAAgC;qBACjC;oBACD,sBAAsB,EAAE;wBACtB,kBAAkB;qBACnB;oBACD,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBACnD,KAAK,EAAE,qCAAqC;oBAC5C,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CACT,uBAAuB,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,QAAQ,GAAG,CAC1E,CAAC;gBAEF,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;gBAExD,oEAAoE;gBACpE,gEAAgE;gBAChE,oEAAoE;gBACpE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;oBACjC,cAAc,EAAE,aAAa,CAAC,EAAE;oBAChC,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ;iBAC/B,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;gBAEpD,oEAAoE;gBACpE,iDAAiD;gBACjD,oEAAoE;gBACpE,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAClC,MAAM,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAElC,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,MAAM,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAE5C,oEAAoE;gBACpE,mDAAmD;gBACnD,oEAAoE;gBACpE,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CACvC,sBAAsB,CAAC,WAAW,CAAC,IAAI,CACxC,CAAC;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,GAAG,CACT,aAAa,sBAAsB,CAAC,WAAW,CAAC,IAAI,oBAAoB,CACzE,CAAC;gBAEF,oEAAoE;gBACpE,sDAAsD;gBACtD,oEAAoE;gBACpE,6DAA6D;gBAC7D,iEAAiE;gBACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CACd;;0FAEgF,EAChF;oBACE,uBAAuB;oBACvB,SAAS,CAAC,EAAE;oBACZ,2DAA2D;iBAC5D,CACF,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBAE/D,oEAAoE;gBACpE,qCAAqC;gBACrC,oEAAoE;gBACpE,eAAe,CACb,aAAa,CAAC,IAAI,EAClB,aAAa,CAAC,IAAI,EAClB,QAAQ,CAAC,IAAI,EACb,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,KAAK,EACjB,sBAAsB,CAAC,WAAW,CAAC,IAAI,EACvC,YAAY,CAAC,IAAI,EACjB,eAAe,CAAC,IAAI,CACrB,CAAC;gBAEF,OAAO,CAAC,gCAAgC,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;CACF,CAAC"}

package/dist/cli/commands/migrate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CLI migration commands.
+ *
+ * Manages database schema migrations using the existing migrator module
+ * (node-pg-migrate). Provides up, down, and status subcommands.
+ *
+ * Usage:
+ *   porta migrate up              # Apply all pending migrations
+ *   porta migrate down            # Rollback last migration
+ *   porta migrate down --count 3  # Rollback last 3 migrations
+ *   porta migrate status          # Show migration status
+ *
+ * @module cli/commands/migrate
+ */
+import type { CommandModule } from 'yargs';
+import type { GlobalOptions } from '../index.js';
+/** The migrate command module — registered at the top level of the CLI */
+export declare const migrateCommand: CommandModule<GlobalOptions, GlobalOptions>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/cli/commands/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjD,0EAA0E;AAC1E,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CAkGtE,CAAC"}