@portaidentity/server 1.7.0

package/dist/clients/crypto.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Cryptographic utilities for client management.
+ *
+ * Provides secure generation of client IDs and secrets, plus Argon2id
+ * hashing and verification for secret storage.
+ *
+ * - Client IDs: 32 random bytes, base64url (~43 chars) — public identifier
+ * - Secrets: 48 random bytes, base64url (~64 chars) — shown once, then hashed
+ * - Hashing: Argon2id with library defaults (follows OWASP recommendations)
+ *
+ * All async operations (hash, verify) are non-blocking — Argon2id runs
+ * in a separate thread via the native binding.
+ */
+/**
+ * Generate a cryptographically random OIDC client_id.
+ *
+ * Format: 32 random bytes, base64url-encoded (~43 characters).
+ * This is the public identifier used in authorization requests.
+ *
+ * @returns Base64url-encoded client ID string
+ */
+export declare function generateClientId(): string;
+/**
+ * Generate a cryptographically random client secret.
+ *
+ * Format: 48 random bytes, base64url-encoded (~64 characters).
+ * This plaintext is shown to the user exactly ONCE and never stored.
+ *
+ * @returns Base64url-encoded secret string
+ */
+export declare function generateSecret(): string;
+/**
+ * Hash a secret using Argon2id.
+ *
+ * Argon2id combines Argon2d (GPU-resistant) and Argon2i (side-channel
+ * resistant). The argon2 library's default parameters follow OWASP
+ * recommendations for password hashing.
+ *
+ * The returned hash string includes the algorithm, salt, and parameters
+ * in PHC format — everything needed for verification.
+ *
+ * @param plaintext - The secret to hash
+ * @returns Argon2id hash string (PHC format)
+ */
+export declare function hashSecret(plaintext: string): Promise<string>;
+/**
+ * Verify a plaintext secret against a stored Argon2id hash.
+ *
+ * Returns true if the plaintext matches, false otherwise.
+ * This operation is async and non-blocking (runs in native thread).
+ *
+ * @param hash - Stored Argon2id hash (PHC format)
+ * @param plaintext - Secret to verify
+ * @returns true if the secret matches the hash
+ */
+export declare function verifySecretHash(hash: string, plaintext: string): Promise<boolean>;
+/**
+ * Compute SHA-256 hash of a client secret.
+ *
+ * Used for oidc-provider integration where the secret hash is stored
+ * in the database and compared against the hashed presented secret.
+ * SHA-256 is appropriate for machine-generated, high-entropy secrets
+ * (48 bytes / 384 bits of randomness — preimage attacks infeasible).
+ *
+ * @param plaintext - The secret to hash
+ * @returns Hex-encoded SHA-256 hash (64 characters)
+ */
+export declare function sha256Secret(plaintext: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/clients/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/clients/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAInE;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAExF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/clients/crypto.js

@@ -0,0 +1,83 @@
+/**
+ * Cryptographic utilities for client management.
+ *
+ * Provides secure generation of client IDs and secrets, plus Argon2id
+ * hashing and verification for secret storage.
+ *
+ * - Client IDs: 32 random bytes, base64url (~43 chars) — public identifier
+ * - Secrets: 48 random bytes, base64url (~64 chars) — shown once, then hashed
+ * - Hashing: Argon2id with library defaults (follows OWASP recommendations)
+ *
+ * All async operations (hash, verify) are non-blocking — Argon2id runs
+ * in a separate thread via the native binding.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import * as argon2 from 'argon2';
+/**
+ * Generate a cryptographically random OIDC client_id.
+ *
+ * Format: 32 random bytes, base64url-encoded (~43 characters).
+ * This is the public identifier used in authorization requests.
+ *
+ * @returns Base64url-encoded client ID string
+ */
+export function generateClientId() {
+    return randomBytes(32).toString('base64url');
+}
+/**
+ * Generate a cryptographically random client secret.
+ *
+ * Format: 48 random bytes, base64url-encoded (~64 characters).
+ * This plaintext is shown to the user exactly ONCE and never stored.
+ *
+ * @returns Base64url-encoded secret string
+ */
+export function generateSecret() {
+    return randomBytes(48).toString('base64url');
+}
+/**
+ * Hash a secret using Argon2id.
+ *
+ * Argon2id combines Argon2d (GPU-resistant) and Argon2i (side-channel
+ * resistant). The argon2 library's default parameters follow OWASP
+ * recommendations for password hashing.
+ *
+ * The returned hash string includes the algorithm, salt, and parameters
+ * in PHC format — everything needed for verification.
+ *
+ * @param plaintext - The secret to hash
+ * @returns Argon2id hash string (PHC format)
+ */
+export async function hashSecret(plaintext) {
+    return argon2.hash(plaintext, {
+        type: argon2.argon2id,
+    });
+}
+/**
+ * Verify a plaintext secret against a stored Argon2id hash.
+ *
+ * Returns true if the plaintext matches, false otherwise.
+ * This operation is async and non-blocking (runs in native thread).
+ *
+ * @param hash - Stored Argon2id hash (PHC format)
+ * @param plaintext - Secret to verify
+ * @returns true if the secret matches the hash
+ */
+export async function verifySecretHash(hash, plaintext) {
+    return argon2.verify(hash, plaintext);
+}
+/**
+ * Compute SHA-256 hash of a client secret.
+ *
+ * Used for oidc-provider integration where the secret hash is stored
+ * in the database and compared against the hashed presented secret.
+ * SHA-256 is appropriate for machine-generated, high-entropy secrets
+ * (48 bytes / 384 bits of randomness — preimage attacks infeasible).
+ *
+ * @param plaintext - The secret to hash
+ * @returns Hex-encoded SHA-256 hash (64 characters)
+ */
+export function sha256Secret(plaintext) {
+    return createHash('sha256').update(plaintext).digest('hex');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/clients/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/clients/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;QAC5B,IAAI,EAAE,MAAM,CAAC,QAAQ;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC"}

package/dist/clients/errors.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Client domain error classes.
+ *
+ * Used by the service layer to signal business rule violations.
+ * The API route layer maps these to appropriate HTTP status codes:
+ *   - ClientNotFoundError → 404
+ *   - ClientValidationError → 400
+ */
+/**
+ * Thrown when a client or secret cannot be found by the given identifier.
+ */
+export declare class ClientNotFoundError extends Error {
+    constructor(identifier: string);
+}
+/**
+ * Thrown when a client operation violates business rules.
+ *
+ * Examples:
+ * - Invalid redirect URI
+ * - Organization/application not active
+ * - Invalid status transition
+ * - Secret already revoked
+ */
+export declare class ClientValidationError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/clients/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/clients/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,UAAU,EAAE,MAAM,EAG7B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/clients/errors.js

@@ -0,0 +1,33 @@
+/**
+ * Client domain error classes.
+ *
+ * Used by the service layer to signal business rule violations.
+ * The API route layer maps these to appropriate HTTP status codes:
+ *   - ClientNotFoundError → 404
+ *   - ClientValidationError → 400
+ */
+/**
+ * Thrown when a client or secret cannot be found by the given identifier.
+ */
+export class ClientNotFoundError extends Error {
+    constructor(identifier) {
+        super(`Client not found: ${identifier}`);
+        this.name = 'ClientNotFoundError';
+    }
+}
+/**
+ * Thrown when a client operation violates business rules.
+ *
+ * Examples:
+ * - Invalid redirect URI
+ * - Organization/application not active
+ * - Invalid status transition
+ * - Secret already revoked
+ */
+export class ClientValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ClientValidationError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/clients/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/clients/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,UAAkB;QAC5B,KAAK,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/clients/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Clients module — public API barrel export.
+ *
+ * Re-exports the types, service functions, secret service functions,
+ * and error classes that other modules need. Internal implementation
+ * details (repository, cache, crypto, validators) are NOT exported —
+ * they are consumed only by the service layer.
+ */
+export type { Client, ClientSecret, SecretWithPlaintext, ClientWithSecret, ClientType, ApplicationType, ClientStatus, SecretStatus, LoginMethod, ClientRow, ClientSecretRow, CreateClientInput, UpdateClientInput, CreateSecretInput, ListClientsOptions, PaginatedResult, } from './types.js';
+export { LOGIN_METHODS } from './types.js';
+export { resolveLoginMethods, normalizeLoginMethods, } from './resolve-login-methods.js';
+export { createClient, getClientById, getClientByClientId, updateClient, listClientsByOrganization, listClientsByApplication, listClientsCursor, } from './service.js';
+export type { ListClientsCursorOptions } from './repository.js';
+export type { CursorPaginatedResult } from '../lib/cursor.js';
+export { deactivateClient, activateClient, revokeClient, } from './service.js';
+export { findForOidc, verifyClientSecret } from './service.js';
+export { generateAndStore as generateSecret, verify as verifySecret, revoke as revokeSecret, listByClient as listSecretsByClient, cleanupExpired as cleanupExpiredSecrets, } from './secret-service.js';
+export { ClientNotFoundError, ClientValidationError, } from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/clients/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,MAAM,EACN,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EACL,gBAAgB,IAAI,cAAc,EAClC,MAAM,IAAI,YAAY,EACtB,MAAM,IAAI,YAAY,EACtB,YAAY,IAAI,mBAAmB,EACnC,cAAc,IAAI,qBAAqB,GACxC,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/clients/index.js

@@ -0,0 +1,23 @@
+/**
+ * Clients module — public API barrel export.
+ *
+ * Re-exports the types, service functions, secret service functions,
+ * and error classes that other modules need. Internal implementation
+ * details (repository, cache, crypto, validators) are NOT exported —
+ * they are consumed only by the service layer.
+ */
+// Runtime constants
+export { LOGIN_METHODS } from './types.js';
+// Login-method resolution helpers
+export { resolveLoginMethods, normalizeLoginMethods, } from './resolve-login-methods.js';
+// Service functions — Client CRUD
+export { createClient, getClientById, getClientByClientId, updateClient, listClientsByOrganization, listClientsByApplication, listClientsCursor, } from './service.js';
+// Service functions — Status lifecycle
+export { deactivateClient, activateClient, revokeClient, } from './service.js';
+// Service functions — OIDC integration
+export { findForOidc, verifyClientSecret } from './service.js';
+// Secret service functions
+export { generateAndStore as generateSecret, verify as verifySecret, revoke as revokeSecret, listByClient as listSecretsByClient, cleanupExpired as cleanupExpiredSecrets, } from './secret-service.js';
+// Error types
+export { ClientNotFoundError, ClientValidationError, } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/clients/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsBH,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,kCAAkC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAEpC,kCAAkC;AAClC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAMtB,uCAAuC;AACvC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,uCAAuC;AACvC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE/D,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,IAAI,cAAc,EAClC,MAAM,IAAI,YAAY,EACtB,MAAM,IAAI,YAAY,EACtB,YAAY,IAAI,mBAAmB,EACnC,cAAc,IAAI,qBAAqB,GACxC,MAAM,qBAAqB,CAAC;AAE7B,cAAc;AACd,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/clients/repository.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Client repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `clients` table using parameterized
+ * queries. Each function acquires the pool via `getPool()` and returns
+ * mapped Client objects.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates
+ * - Paginated listing with org/app/status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToClient()`
+ * - Array columns (TEXT[]) handled natively by pg driver
+ */
+import type { Client, ListClientsOptions, LoginMethod, PaginatedResult } from './types.js';
+import type { CursorPaginatedResult } from '../lib/cursor.js';
+/** Input data for inserting a new client row */
+export interface InsertClientData {
+    organizationId: string;
+    applicationId: string;
+    clientId: string;
+    clientName: string;
+    clientType: string;
+    applicationType: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    grantTypes: string[];
+    responseTypes: string[];
+    scope: string;
+    tokenEndpointAuthMethod: string;
+    allowedOrigins: string[];
+    requirePkce: boolean;
+    /**
+     * Optional per-client login-method override.
+     *   - omitted → column is persisted as `NULL` via the `DEFAULT NULL` clause
+     *     (caller inherits org defaults at resolve time)
+     *   - explicit `null` → same as omitted
+     *   - non-empty array → stored as-is
+     *
+     * The service layer is responsible for validation + normalization.
+     */
+    loginMethods?: LoginMethod[] | null;
+}
+/**
+ * Insert a new client into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The client_id (OIDC identifier) must be unique (enforced by DB constraint).
+ *
+ * Builds the column list dynamically so `login_methods` can be omitted —
+ * letting the DB `DEFAULT NULL` fire for callers that don't know about the
+ * column. When explicitly set (even to `null`), the value is included.
+ *
+ * @param data - Client data to insert
+ * @returns The newly created client
+ * @throws If client_id already exists (unique constraint violation)
+ */
+export declare function insertClient(data: InsertClientData): Promise<Client>;
+/**
+ * Find a client by its internal UUID.
+ *
+ * @param id - Client internal UUID
+ * @returns Client or null if not found
+ */
+export declare function findClientById(id: string): Promise<Client | null>;
+/**
+ * Find a client by its OIDC client_id (public identifier).
+ *
+ * @param clientId - OIDC client_id
+ * @returns Client or null if not found
+ */
+export declare function findClientByClientId(clientId: string): Promise<Client | null>;
+/** Fields that can be updated on a client */
+export interface UpdateClientData {
+    clientName?: string;
+    redirectUris?: string[];
+    postLogoutRedirectUris?: string[];
+    grantTypes?: string[];
+    responseTypes?: string[];
+    scope?: string;
+    tokenEndpointAuthMethod?: string;
+    allowedOrigins?: string[];
+    requirePkce?: boolean;
+    status?: string;
+    /**
+     * Per-client login-method override. Three-state semantics distinguish
+     * "leave alone" from "clear the override":
+     *   - `undefined` → field is NOT in the SET clause (existing value preserved)
+     *   - `null` → SET login_methods = NULL (clear — revert to inheriting org default)
+     *   - non-empty array → SET login_methods = array
+     *
+     * The service layer is responsible for rejecting empty arrays and for
+     * validating array contents before delegating here.
+     */
+    loginMethods?: LoginMethod[] | null;
+}
+/**
+ * Update a client's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields are included in the UPDATE statement,
+ * enabling partial updates. The `updated_at` column is handled by the DB
+ * trigger.
+ *
+ * Null-aware logic for `loginMethods`:
+ *   - `undefined` → column omitted from SET (existing value preserved)
+ *   - `null` → SET login_methods = NULL (clears the per-client override)
+ *   - array → SET login_methods = <array>
+ *
+ * To distinguish these three cases, the iteration checks `hasOwnProperty`
+ * on the input — `undefined` keys are treated as absent, while `null` and
+ * arrays are both persisted.
+ *
+ * @param id - Client internal UUID
+ * @param data - Fields to update
+ * @returns Updated client
+ * @throws Error if client not found or no fields provided
+ */
+export declare function updateClient(id: string, data: UpdateClientData): Promise<Client>;
+/**
+ * List clients with pagination, filters, and sorting.
+ *
+ * Supports filtering by organization, application, status, and search text.
+ * Executes two queries: COUNT for total, then data with LIMIT/OFFSET.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result with clients and metadata
+ */
+export declare function listClients(options: ListClientsOptions): Promise<PaginatedResult<Client>>;
+/** Options for cursor-based client listing */
+export interface ListClientsCursorOptions {
+    cursor?: string;
+    limit?: number;
+    organizationId?: string;
+    applicationId?: string;
+    status?: string;
+    search?: string;
+    sortBy?: string;
+    sortOrder?: 'asc' | 'desc';
+}
+/**
+ * List clients with cursor-based keyset pagination.
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with clients
+ */
+export declare function listClientsCursor(options: ListClientsCursorOptions): Promise<CursorPaginatedResult<Client>>;
+/**
+ * Count clients for an organization.
+ *
+ * @param organizationId - Organization UUID
+ * @returns Number of clients
+ */
+export declare function countClientsByOrg(organizationId: string): Promise<number>;
+/**
+ * Count clients for an application.
+ *
+ * @param applicationId - Application UUID
+ * @returns Number of clients
+ */
+export declare function countClientsByApp(applicationId: string): Promise<number>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/clients/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,MAAM,EAEN,kBAAkB,EAClB,WAAW,EACX,eAAe,EAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAM9D,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiD1E;AAOD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUvE;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUnF;AAMD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;CACrC;AAoBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAeD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CA4DlC;AAMD,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CA+DxC;AAMD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E"}