@portaidentity/server 1.7.0

package/dist/organizations/cache.js

@@ -0,0 +1,157 @@
+/**
+ * Organization cache — Redis-backed fast lookup layer.
+ *
+ * Provides get/set/invalidate operations for Organization objects
+ * stored in Redis. Each organization is cached under two keys:
+ *   - `org:slug:{slug}` — for tenant resolver lookups by URL path
+ *   - `org:id:{id}`     — for service layer lookups by UUID
+ *
+ * Both keys store the same JSON-serialized Organization object
+ * with a 5-minute TTL. Date fields (createdAt, updatedAt) are
+ * serialized as ISO 8601 strings and deserialized back to Date
+ * objects on read.
+ *
+ * All Redis errors are caught and logged — cache failures never
+ * propagate to callers. The system gracefully degrades to direct
+ * database lookups when Redis is unavailable.
+ */
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+import { afterDatabaseCommit } from '../lib/database.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Cache TTL in seconds (5 minutes) */
+const CACHE_TTL = 300;
+/** Key prefix for slug-based lookups */
+const SLUG_PREFIX = 'org:slug:';
+/** Key prefix for ID-based lookups */
+const ID_PREFIX = 'org:id:';
+// ---------------------------------------------------------------------------
+// Cache retrieval
+// ---------------------------------------------------------------------------
+/**
+ * Get an organization from cache by slug.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param slug - Organization slug
+ * @returns Cached organization or null
+ */
+export async function getCachedOrganizationBySlug(slug) {
+    try {
+        const redis = getRedis();
+        const data = await redis.get(`${SLUG_PREFIX}${slug}`);
+        if (!data)
+            return null;
+        return deserializeOrganization(data);
+    }
+    catch {
+        // Graceful degradation — log and return null so caller falls back to DB
+        logger.warn({ event: 'organization-cache-read-failed' }, 'Organization cache read failed');
+        return null;
+    }
+}
+/**
+ * Get an organization from cache by ID.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param id - Organization UUID
+ * @returns Cached organization or null
+ */
+export async function getCachedOrganizationById(id) {
+    try {
+        const redis = getRedis();
+        const data = await redis.get(`${ID_PREFIX}${id}`);
+        if (!data)
+            return null;
+        return deserializeOrganization(data);
+    }
+    catch {
+        // Graceful degradation — log and return null so caller falls back to DB
+        logger.warn({ event: 'organization-cache-read-failed' }, 'Organization cache read failed');
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Cache storage
+// ---------------------------------------------------------------------------
+/**
+ * Store an organization in cache under both slug and ID keys.
+ *
+ * Both keys get the same TTL so they expire together.
+ * Date fields are serialized to ISO 8601 strings automatically
+ * by JSON.stringify().
+ *
+ * @param org - Organization to cache
+ */
+export async function cacheOrganization(org) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            const data = JSON.stringify(org);
+            // Store under both keys with the same TTL
+            await redis.set(`${SLUG_PREFIX}${org.slug}`, data, 'EX', CACHE_TTL);
+            await redis.set(`${ID_PREFIX}${org.id}`, data, 'EX', CACHE_TTL);
+        }
+        catch {
+            // Graceful degradation — cache write failure is non-fatal
+            logger.warn({ event: 'organization-cache-write-failed' }, 'Organization cache write failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Cache invalidation
+// ---------------------------------------------------------------------------
+/**
+ * Invalidate all cache entries for an organization.
+ *
+ * Deletes both the slug-keyed and ID-keyed cache entries.
+ * Should be called after any write operation (create, update,
+ * status change) to ensure stale data is not served.
+ *
+ * @param slug - Organization slug
+ * @param id - Organization UUID
+ */
+export async function invalidateOrganizationCache(slug, id) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            await redis.del(`${SLUG_PREFIX}${slug}`, `${ID_PREFIX}${id}`);
+        }
+        catch {
+            // Graceful degradation — cache invalidation failure is non-fatal
+            logger.warn({ event: 'organization-cache-invalidation-failed' }, 'Organization cache invalidation failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Serialization helpers
+// ---------------------------------------------------------------------------
+/**
+ * Deserialize a JSON string from Redis into an Organization object.
+ *
+ * Converts ISO 8601 date strings back to Date objects for the
+ * createdAt and updatedAt fields, which JSON.stringify() serializes
+ * as strings rather than Date instances.
+ *
+ * @param data - JSON string from Redis
+ * @returns Organization object with proper Date instances, or null if parse fails
+ */
+function deserializeOrganization(data) {
+    try {
+        const parsed = JSON.parse(data);
+        // Restore Date objects from ISO string serialization
+        parsed.createdAt = new Date(parsed.createdAt);
+        parsed.updatedAt = new Date(parsed.updatedAt);
+        return parsed;
+    }
+    catch {
+        logger.warn('Failed to parse cached organization JSON');
+        return null;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/organizations/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/organizations/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,uCAAuC;AACvC,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,wCAAwC;AACxC,MAAM,WAAW,GAAG,WAAW,CAAC;AAEhC,sCAAsC;AACtC,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAAU;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAiB;IACvD,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAEjC,0CAA0C;YAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY,EAAE,EAAU;IACxE,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,EAAE,GAAG,SAAS,GAAG,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,wCAAwC,EAAE,EACnD,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAEhD,qDAAqD;QACrD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/organizations/errors.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Organization domain error types.
+ *
+ * Custom error classes for organization-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - OrganizationNotFoundError → 404
+ *   - OrganizationValidationError → 400
+ */
+/**
+ * Thrown when an organization cannot be found by ID or slug.
+ * Maps to HTTP 404 in route handlers.
+ */
+export declare class OrganizationNotFoundError extends Error {
+    constructor(identifier: string);
+}
+/**
+ * Thrown when an operation violates organization business rules.
+ * Examples: invalid slug, slug already taken, invalid status transition,
+ * super-admin protection violation.
+ * Maps to HTTP 400 in route handlers.
+ */
+export declare class OrganizationValidationError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/organizations/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/organizations/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,UAAU,EAAE,MAAM,EAG7B;CACF;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/organizations/errors.js

@@ -0,0 +1,31 @@
+/**
+ * Organization domain error types.
+ *
+ * Custom error classes for organization-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - OrganizationNotFoundError → 404
+ *   - OrganizationValidationError → 400
+ */
+/**
+ * Thrown when an organization cannot be found by ID or slug.
+ * Maps to HTTP 404 in route handlers.
+ */
+export class OrganizationNotFoundError extends Error {
+    constructor(identifier) {
+        super(`Organization not found: ${identifier}`);
+        this.name = 'OrganizationNotFoundError';
+    }
+}
+/**
+ * Thrown when an operation violates organization business rules.
+ * Examples: invalid slug, slug already taken, invalid status transition,
+ * super-admin protection violation.
+ * Maps to HTTP 400 in route handlers.
+ */
+export class OrganizationValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OrganizationValidationError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/organizations/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/organizations/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,UAAkB;QAC5B,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF"}

package/dist/organizations/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Organizations module — public API barrel export.
+ *
+ * Re-exports the types, service functions, error classes, and slug
+ * utilities that other modules need. Internal implementation details
+ * (repository, cache) are NOT exported — they are consumed only by
+ * the service layer and tenant resolver.
+ */
+export type { Organization, OrganizationRow, OrganizationStatus, CreateOrganizationInput, UpdateOrganizationInput, BrandingInput, ListOrganizationsOptions, PaginatedResult, CascadeCounts, DestroyResult, } from './types.js';
+export { createOrganization, getOrganizationById, getOrganizationBySlug, updateOrganization, updateOrganizationBranding, suspendOrganization, activateOrganization, archiveOrganization, restoreOrganization, listOrganizations, listOrganizationsCursor, validateSlugAvailability, getCascadeCounts, destroyOrganization, } from './service.js';
+export type { ListOrganizationsCursorOptions } from './repository.js';
+export type { CursorPaginatedResult } from '../lib/cursor.js';
+export { OrganizationNotFoundError, OrganizationValidationError, } from './errors.js';
+export { generateSlug, validateSlug, } from './slugs.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/organizations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/organizations/index.js

@@ -0,0 +1,15 @@
+/**
+ * Organizations module — public API barrel export.
+ *
+ * Re-exports the types, service functions, error classes, and slug
+ * utilities that other modules need. Internal implementation details
+ * (repository, cache) are NOT exported — they are consumed only by
+ * the service layer and tenant resolver.
+ */
+// Service functions
+export { createOrganization, getOrganizationById, getOrganizationBySlug, updateOrganization, updateOrganizationBranding, suspendOrganization, activateOrganization, archiveOrganization, restoreOrganization, listOrganizations, listOrganizationsCursor, validateSlugAvailability, getCascadeCounts, destroyOrganization, } from './service.js';
+// Error types
+export { OrganizationNotFoundError, OrganizationValidationError, } from './errors.js';
+// Slug utilities (for external consumers like CLI)
+export { generateSlug, validateSlug, } from './slugs.js';
+//# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,oBAAoB;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAMtB,cAAc;AACd,OAAO,EACL,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AAErB,mDAAmD;AACnD,OAAO,EACL,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/organizations/repository.d.ts

@@ -0,0 +1,183 @@
+/**
+ * Organization repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `organizations` table using
+ * parameterized queries. Each function acquires the pool via
+ * `getPool()` and returns mapped Organization objects.
+ *
+ * This module is the sole interface to the database for organization
+ * data. The service layer composes repository + cache + validation.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates
+ * - Paginated listing with optional status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToOrganization()`
+ */
+import type { Organization, ListOrganizationsOptions, PaginatedResult } from './types.js';
+import type { LoginMethod } from '../clients/types.js';
+import type { CursorPaginatedResult } from '../lib/cursor.js';
+/** Input data for inserting a new organization row */
+export interface InsertOrganizationData {
+    name: string;
+    slug: string;
+    defaultLocale: string;
+    brandingLogoUrl?: string | null;
+    brandingFaviconUrl?: string | null;
+    brandingPrimaryColor?: string | null;
+    brandingCompanyName?: string | null;
+    brandingCustomCss?: string | null;
+    /**
+     * Optional org-wide default login methods. When omitted, the DB
+     * `DEFAULT ARRAY['password', 'magic_link']` clause applies. The
+     * service layer is responsible for validation + normalization.
+     */
+    defaultLoginMethods?: LoginMethod[];
+}
+/**
+ * Insert a new organization into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The slug must be unique (enforced by the DB unique constraint).
+ *
+ * @param data - Organization data to insert
+ * @returns The newly created organization
+ * @throws If slug already exists (unique constraint violation)
+ */
+export declare function insertOrganization(data: InsertOrganizationData): Promise<Organization>;
+/**
+ * Find an organization by its UUID.
+ *
+ * @param id - Organization UUID
+ * @returns Organization or null if not found
+ */
+export declare function findOrganizationById(id: string): Promise<Organization | null>;
+/**
+ * Find an organization by its slug.
+ *
+ * Returns organizations of any status (active, suspended, archived).
+ * The caller (service/middleware) is responsible for status-based access control.
+ *
+ * @param slug - Organization slug
+ * @returns Organization or null if not found
+ */
+export declare function findOrganizationBySlug(slug: string): Promise<Organization | null>;
+/**
+ * Find the super-admin organization (is_super_admin = TRUE).
+ *
+ * The partial unique index ensures at most one such org exists.
+ *
+ * @returns Super-admin organization or null if not yet seeded
+ */
+export declare function findSuperAdminOrganization(): Promise<Organization | null>;
+/** Fields that can be updated on an organization */
+export interface UpdateOrganizationData {
+    name?: string;
+    status?: string;
+    defaultLocale?: string;
+    twoFactorPolicy?: string;
+    defaultLoginMethods?: LoginMethod[];
+    brandingLogoUrl?: string | null;
+    brandingFaviconUrl?: string | null;
+    brandingPrimaryColor?: string | null;
+    brandingCompanyName?: string | null;
+    brandingCustomCss?: string | null;
+}
+/**
+ * Update an organization's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified.
+ *
+ * The `updated_at` column is handled automatically by the DB trigger,
+ * but we don't rely on it here — we just build the SET clauses for
+ * the provided fields.
+ *
+ * @param id - Organization UUID
+ * @param data - Fields to update (only non-undefined fields are applied)
+ * @returns Updated organization
+ * @throws Error if organization not found or no fields provided
+ */
+export declare function updateOrganization(id: string, data: UpdateOrganizationData): Promise<Organization>;
+/**
+ * List organizations with pagination, optional status filter, search, and sorting.
+ *
+ * Executes two queries:
+ * 1. COUNT query for total matching rows
+ * 2. Data query with LIMIT/OFFSET for the current page
+ *
+ * Sort column and direction are whitelisted (not parameterized) since
+ * they're SQL identifiers/keywords, not user data values.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result with organizations and metadata
+ */
+export declare function listOrganizations(options: ListOrganizationsOptions): Promise<PaginatedResult<Organization>>;
+/** Options for cursor-based organization listing */
+export interface ListOrganizationsCursorOptions {
+    cursor?: string;
+    limit?: number;
+    status?: string;
+    search?: string;
+    sortBy?: string;
+    sortOrder?: 'asc' | 'desc';
+}
+/**
+ * List organizations with cursor-based keyset pagination.
+ *
+ * Uses `(sort_column, id) > (cursor_sort, cursor_id)` for efficient
+ * paging without COUNT queries. Queries limit+1 rows to detect hasMore.
+ *
+ * Backward compatible: when no cursor is provided, returns the first page.
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with organizations
+ */
+export declare function listOrganizationsCursor(options: ListOrganizationsCursorOptions): Promise<CursorPaginatedResult<Organization>>;
+/**
+ * Check if a slug is already taken in the database.
+ *
+ * Checks across all statuses (active, suspended, archived) because
+ * slugs must be globally unique regardless of organization status.
+ *
+ * @param slug - Slug to check
+ * @param excludeId - Optional org ID to exclude (useful for updates)
+ * @returns true if the slug already exists
+ */
+export declare function slugExists(slug: string, excludeId?: string): Promise<boolean>;
+/**
+ * Hard-delete an organization from the database.
+ *
+ * PostgreSQL CASCADE foreign keys automatically delete all child entities:
+ * applications, clients, users, roles, permissions, claim definitions,
+ * user claim values, user roles, branding assets, and admin sessions.
+ * Audit log entries have their organization_id set to NULL (ON DELETE SET NULL).
+ *
+ * The `AND is_super_admin = FALSE` clause is a database-level safety check —
+ * even if application code has a bug, the super-admin org cannot be deleted.
+ *
+ * @param id - Organization UUID
+ * @returns true if the row was deleted, false if not found or super-admin
+ */
+export declare function hardDeleteOrganization(id: string): Promise<boolean>;
+/**
+ * Count all child entities that will be cascade-deleted with an organization.
+ * Used for dry-run display and confirmation prompts.
+ *
+ * Runs all counts in a single query using scalar subqueries for efficiency.
+ * Roles, permissions, and claim definitions are counted via their parent
+ * application's organization_id join.
+ *
+ * @param orgId - Organization UUID
+ * @returns Counts of each child entity type
+ */
+export declare function getCascadeCounts(orgId: string): Promise<{
+    applications: number;
+    clients: number;
+    users: number;
+    roles: number;
+    permissions: number;
+    claim_definitions: number;
+}>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/organizations/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/organizations/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EACV,YAAY,EAEZ,wBAAwB,EACxB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAM9D,sDAAsD;AACtD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAqC5F;AAMD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAUnF;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAUvF;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS/E;AAMD,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CA8BvB;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAiDxC;AAMD,oDAAoD;AACpD,MAAM,WAAW,8BAA8B;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAuD9C;AAMD;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBnF;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC,CAmBD"}