@portaidentity/server 1.7.3 → 1.8.0

package/dist/portability/import-repository.js

@@ -0,0 +1,347 @@
+/** Explicit PostgreSQL reads used to plan selective portability imports. */
+import { randomUUID } from 'node:crypto';
+import { getPool } from '../lib/database.js';
+/**
+ * Restrict organization-owned reads to the requested portability scope.
+ *
+ * @param column - Qualified organization slug column
+ * @param manifest - Normalized import manifest
+ * @returns Parameterized organization predicate
+ */
+function organizationFilter(column, manifest) {
+    if (manifest.scope.kind === 'organization') {
+        return {
+            sql: `WHERE LOWER(BTRIM(${column})) = $1`,
+            values: [manifest.scope.organization_slug.trim().toLowerCase()],
+        };
+    }
+    return { sql: 'WHERE NOT o.is_super_admin', values: [] };
+}
+/**
+ * Restrict application-owned reads to the declared application selection.
+ *
+ * @param column - Qualified application slug column
+ * @param manifest - Normalized import manifest
+ * @param parameterIndex - First PostgreSQL placeholder available to this predicate
+ * @returns Parameterized application predicate
+ */
+function applicationFilter(column, manifest, parameterIndex = 1) {
+    if (manifest.application_selection.all_applications) {
+        return { sql: `WHERE LOWER(BTRIM(${column})) <> 'porta-admin'`, values: [] };
+    }
+    return {
+        sql: `WHERE LOWER(BTRIM(${column})) = ANY($${parameterIndex}::text[])`,
+        values: [
+            manifest.application_selection.application_slugs.map((slug) => slug.trim().toLowerCase()),
+        ],
+    };
+}
+/**
+ * Read the small destination catalog used to plan an import.
+ *
+ * The product is configured by an administrator and does not need large-data streaming here.
+ * Explicit columns keep credentials, lock state, audit data, and other non-portable fields out of
+ * planner memory. The surrounding request transaction provides the consistent snapshot.
+ *
+ * @param manifest - Normalized scope, category, application selection, and imported client IDs
+ * @returns Destination records with internal identifiers retained only for relationship matching
+ */
+export async function readPortabilityImportSnapshot(manifest) {
+    const pool = getPool();
+    const organizationScope = organizationFilter(manifest.scope.kind === 'organization' ? 'slug' : 'o.slug', manifest);
+    const ownedOrganizationScope = organizationFilter('o.slug', manifest);
+    const selectedApplications = applicationFilter('a.slug', manifest);
+    const applicationTableSelection = applicationFilter('slug', manifest);
+    const selectedApplicationsAfterOrganization = applicationFilter('a.slug', manifest, ownedOrganizationScope.values.length + 1);
+    const includesOrganizations = manifest.categories.includes('organizations');
+    const includesAuthorization = manifest.categories.includes('applications_authorization');
+    const includesUsers = manifest.categories.includes('users_assignments');
+    const includesClients = manifest.categories.includes('oidc_clients');
+    const includesApplicationData = includesAuthorization || includesUsers || includesClients;
+    const organizations = await pool.query(`SELECT o.id, o.slug, o.name, o.status, o.is_super_admin, o.default_locale,
+            o.default_login_methods,
+            two_factor_policy, branding_logo_url, branding_favicon_url,
+            branding_primary_color, branding_company_name, branding_custom_css
+       FROM organizations o
+       ${organizationScope.sql}`, [...organizationScope.values]);
+    const applications = includesApplicationData
+        ? await pool.query(`SELECT id, slug, name, description, status
+           FROM applications
+           ${applicationTableSelection.sql}`, [...applicationTableSelection.values])
+        : { rows: [] };
+    const brandingAssets = includesOrganizations
+        ? await pool.query(`SELECT o.slug AS organization_slug, b.asset_type, b.content_type, b.data
+       FROM branding_assets b
+       JOIN organizations o ON o.id = b.organization_id
+       ${ownedOrganizationScope.sql}`, [...ownedOrganizationScope.values])
+        : { rows: [] };
+    const modules = includesAuthorization
+        ? await pool.query(`SELECT m.id, m.application_id, a.slug AS application_slug, m.slug, m.name,
+            m.description, m.status
+       FROM application_modules m
+       JOIN applications a ON a.id = m.application_id
+       ${selectedApplications.sql}`, [...selectedApplications.values])
+        : { rows: [] };
+    const roles = includesAuthorization || includesUsers
+        ? await pool.query(`SELECT r.id, r.application_id, a.slug AS application_slug, r.slug, r.name, r.description
+       FROM roles r
+       JOIN applications a ON a.id = r.application_id
+       ${selectedApplications.sql}`, [...selectedApplications.values])
+        : { rows: [] };
+    const permissions = includesAuthorization
+        ? await pool.query(`SELECT p.id, p.application_id, p.module_id, a.slug AS application_slug, p.slug,
+            m.slug AS module_slug, p.name, p.description
+       FROM permissions p
+       JOIN applications a ON a.id = p.application_id
+       LEFT JOIN application_modules m ON m.id = p.module_id
+       ${selectedApplications.sql}`, [...selectedApplications.values])
+        : { rows: [] };
+    const includeClaimDefinitions = includesAuthorization || manifest.user_claim_values.length > 0;
+    const claims = includeClaimDefinitions
+        ? await pool.query(`SELECT c.id, c.application_id, a.slug AS application_slug, c.claim_name, c.claim_type,
+            c.description, c.include_in_id_token, c.include_in_access_token,
+            c.include_in_userinfo
+       FROM custom_claim_definitions c
+       JOIN applications a ON a.id = c.application_id
+       ${selectedApplications.sql}`, [...selectedApplications.values])
+        : { rows: [] };
+    const rolePermissions = includesAuthorization
+        ? await pool.query(`SELECT a.slug AS application_slug, r.slug AS role_slug,
+            ARRAY_AGG(p.slug ORDER BY BTRIM(p.slug) COLLATE "C") AS permission_slugs
+       FROM role_permissions rp
+       JOIN roles r ON r.id = rp.role_id
+       JOIN permissions p ON p.id = rp.permission_id
+       JOIN applications a ON a.id = r.application_id
+      ${selectedApplications.sql} AND p.application_id = r.application_id
+      GROUP BY a.slug, r.slug`, [...selectedApplications.values])
+        : { rows: [] };
+    const users = includesUsers
+        ? await pool.query(`SELECT u.id, u.organization_id, o.slug AS organization_slug, u.email::text AS email,
+            u.email_verified, u.given_name, u.family_name, u.middle_name, u.nickname,
+            u.preferred_username, u.profile_url, u.picture_url, u.website_url, u.gender,
+            u.birthdate::text AS birthdate, u.zoneinfo, u.locale, u.phone_number,
+            u.phone_number_verified, u.address_street, u.address_locality, u.address_region,
+            u.address_postal_code, u.address_country,
+            CASE WHEN u.status = 'inactive' THEN 'inactive' ELSE 'active' END AS status
+       FROM users u
+       JOIN organizations o ON o.id = u.organization_id
+       ${ownedOrganizationScope.sql}`, [...ownedOrganizationScope.values])
+        : { rows: [] };
+    const userRoles = includesUsers
+        ? await pool.query(`SELECT o.slug AS organization_slug, u.email::text AS email, a.slug AS application_slug,
+            r.slug AS role_slug
+       FROM user_roles ur
+       JOIN users u ON u.id = ur.user_id
+       JOIN organizations o ON o.id = u.organization_id
+       JOIN roles r ON r.id = ur.role_id
+       JOIN applications a ON a.id = r.application_id
+       ${ownedOrganizationScope.sql} AND ${selectedApplicationsAfterOrganization.sql.slice('WHERE '.length)}`, [...ownedOrganizationScope.values, ...selectedApplicationsAfterOrganization.values])
+        : { rows: [] };
+    const userClaimValues = includesUsers
+        ? await pool.query(`SELECT o.slug AS organization_slug, u.email::text AS email, a.slug AS application_slug,
+            c.claim_name, v.value
+       FROM custom_claim_values v
+       JOIN users u ON u.id = v.user_id
+       JOIN organizations o ON o.id = u.organization_id
+       JOIN custom_claim_definitions c ON c.id = v.claim_id
+       JOIN applications a ON a.id = c.application_id
+       ${ownedOrganizationScope.sql} AND ${selectedApplicationsAfterOrganization.sql.slice('WHERE '.length)}`, [...ownedOrganizationScope.values, ...selectedApplicationsAfterOrganization.values])
+        : { rows: [] };
+    const clients = includesClients
+        ? await pool.query(`SELECT c.id, c.organization_id, c.application_id, c.client_id,
+            o.slug AS organization_slug, a.slug AS application_slug,
+            c.client_name AS name, c.client_type, c.application_type, c.status,
+            c.grant_types, c.response_types, c.scope, c.login_methods,
+            c.token_endpoint_auth_method, c.redirect_uris,
+            COALESCE(c.post_logout_redirect_uris, '{}') AS post_logout_redirect_uris,
+            COALESCE(c.allowed_origins, '{}') AS allowed_origins, c.require_pkce
+       FROM clients c
+       JOIN organizations o ON o.id = c.organization_id
+       JOIN applications a ON a.id = c.application_id
+      WHERE c.client_id = ANY($1::text[])`, [manifest.clients.map((client) => client.client_id)])
+        : { rows: [] };
+    return {
+        organizations: organizations.rows,
+        brandingAssets: brandingAssets.rows,
+        applications: applications.rows,
+        applicationModules: modules.rows,
+        roles: roles.rows,
+        permissions: permissions.rows,
+        claimDefinitions: claims.rows,
+        rolePermissions: rolePermissions.rows,
+        users: users.rows.map((row) => ({
+            ...row,
+            status: row.status === 'inactive' ? 'inactive' : 'active',
+        })),
+        userRoles: userRoles.rows,
+        userClaimValues: userClaimValues.rows,
+        clients: clients.rows,
+    };
+}
+/**
+ * Insert or update one organization and its optional branding assets.
+ *
+ * @param record - Strict portable organization fields
+ * @param destinationId - Existing identifier for update, or null for create
+ * @param destinationAssetTypes - Branding slots which currently contain stored bytes
+ * @returns Authoritative destination identifier
+ */
+export async function writePortabilityOrganization(record, destinationId, destinationAssetTypes) {
+    const pool = getPool();
+    const authoritativeId = destinationId ?? randomUUID();
+    const values = [
+        record.name,
+        record.status,
+        record.default_locale,
+        record.default_login_methods,
+        record.two_factor_policy,
+        record.branding.logo_url,
+        record.branding.favicon_url,
+        record.branding.primary_color,
+        record.branding.company_name,
+        record.branding.custom_css,
+    ];
+    const result = destinationId === null
+        ? await pool.query(`INSERT INTO organizations
+           (id, name, status, default_locale, default_login_methods, two_factor_policy,
+            branding_logo_url, branding_favicon_url, branding_primary_color,
+            branding_company_name, branding_custom_css, slug)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) RETURNING id`, [authoritativeId, ...values, record.slug])
+        : await pool.query(`UPDATE organizations SET name = $1, status = $2, default_locale = $3,
+                default_login_methods = $4, two_factor_policy = $5, branding_logo_url = $6,
+                branding_favicon_url = $7, branding_primary_color = $8,
+                branding_company_name = $9, branding_custom_css = $10, updated_at = NOW()
+          WHERE id = $11 RETURNING id`, [...values, destinationId]);
+    const organizationId = result.rows[0]?.id ?? authoritativeId;
+    for (const assetType of ['logo', 'favicon']) {
+        const asset = assetType === 'logo' ? record.branding.logo_asset : record.branding.favicon_asset;
+        if (asset === null) {
+            if (!destinationAssetTypes.has(assetType))
+                continue;
+            await pool.query('DELETE FROM branding_assets WHERE organization_id = $1 AND asset_type = $2', [organizationId, assetType]);
+        }
+        else {
+            const data = Buffer.from(asset.content_base64, 'base64');
+            await pool.query(`INSERT INTO branding_assets
+           (organization_id, asset_type, file_name, content_type, file_size, data)
+         VALUES ($1, $2, $3, $4, $5, $6)
+         ON CONFLICT (organization_id, asset_type) DO UPDATE
+         SET file_name = EXCLUDED.file_name, content_type = EXCLUDED.content_type,
+             file_size = EXCLUDED.file_size, data = EXCLUDED.data, updated_at = NOW()`, [organizationId, assetType, `imported-${assetType}`, asset.media_type, data.length, data]);
+        }
+    }
+    return organizationId;
+}
+/**
+ * @param record - Strict portable application fields
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export async function writePortabilityApplication(record, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const result = destinationId === null
+        ? await getPool().query(`INSERT INTO applications (id, slug, name, description, status)
+         VALUES ($1, $2, $3, $4, $5) RETURNING id`, [authoritativeId, record.slug, record.name, record.description, record.status])
+        : await getPool().query(`UPDATE applications SET name = $1, description = $2, status = $3, updated_at = NOW()
+          WHERE id = $4 RETURNING id`, [record.name, record.description, record.status, destinationId]);
+    return result.rows[0]?.id ?? authoritativeId;
+}
+/**
+ * @param record - Strict portable module fields
+ * @param applicationId - Resolved parent application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export async function writePortabilityModule(record, applicationId, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const result = destinationId === null
+        ? await getPool().query(`INSERT INTO application_modules (id, application_id, slug, name, description, status)
+         VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`, [
+            authoritativeId,
+            applicationId,
+            record.slug,
+            record.name,
+            record.description,
+            record.status,
+        ])
+        : await getPool().query(`UPDATE application_modules SET name = $1, description = $2, status = $3,
+                updated_at = NOW() WHERE id = $4 RETURNING id`, [record.name, record.description, record.status, destinationId]);
+    return result.rows[0]?.id ?? authoritativeId;
+}
+/**
+ * @param record - Strict portable role fields
+ * @param applicationId - Resolved parent application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export async function writePortabilityRole(record, applicationId, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const result = destinationId === null
+        ? await getPool().query(`INSERT INTO roles (id, application_id, slug, name, description)
+         VALUES ($1, $2, $3, $4, $5) RETURNING id`, [authoritativeId, applicationId, record.slug, record.name, record.description])
+        : await getPool().query(`UPDATE roles SET name = $1, description = $2, updated_at = NOW()
+          WHERE id = $3 RETURNING id`, [record.name, record.description, destinationId]);
+    return result.rows[0]?.id ?? authoritativeId;
+}
+/**
+ * @param record - Strict portable permission fields
+ * @param applicationId - Resolved parent application identifier
+ * @param moduleId - Resolved optional module identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export async function writePortabilityPermission(record, applicationId, moduleId, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const result = destinationId === null
+        ? await getPool().query(`INSERT INTO permissions (id, application_id, module_id, slug, name, description)
+         VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`, [authoritativeId, applicationId, moduleId, record.slug, record.name, record.description])
+        : await getPool().query(`UPDATE permissions SET name = $1, description = $2
+          WHERE id = $3 RETURNING id`, [record.name, record.description, destinationId]);
+    return result.rows[0]?.id ?? authoritativeId;
+}
+/**
+ * @param record - Strict portable claim-definition fields
+ * @param applicationId - Resolved parent application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export async function writePortabilityClaimDefinition(record, applicationId, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const result = destinationId === null
+        ? await getPool().query(`INSERT INTO custom_claim_definitions
+           (id, application_id, claim_name, claim_type, description, include_in_id_token,
+            include_in_access_token, include_in_userinfo)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING id`, [
+            authoritativeId,
+            applicationId,
+            record.claim_name,
+            record.claim_type,
+            record.description,
+            record.include_in_id_token,
+            record.include_in_access_token,
+            record.include_in_userinfo,
+        ])
+        : await getPool().query(`UPDATE custom_claim_definitions SET description = $1, include_in_id_token = $2,
+                include_in_access_token = $3, include_in_userinfo = $4, updated_at = NOW()
+          WHERE id = $5 RETURNING id`, [
+            record.description,
+            record.include_in_id_token,
+            record.include_in_access_token,
+            record.include_in_userinfo,
+            destinationId,
+        ]);
+    return result.rows[0]?.id ?? authoritativeId;
+}
+/**
+ * Add listed role-permission edges without removing destination-only edges.
+ *
+ * @param roleId - Resolved role identifier
+ * @param permissionIds - Resolved permission identifiers listed by the manifest
+ */
+export async function writePortabilityRolePermissions(roleId, permissionIds) {
+    for (const permissionId of permissionIds) {
+        await getPool().query(`INSERT INTO role_permissions (role_id, permission_id)
+       VALUES ($1, $2) ON CONFLICT (role_id, permission_id) DO NOTHING`, [roleId, permissionId]);
+    }
+}
+//# sourceMappingURL=import-repository.js.map

package/dist/portability/import-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-repository.js","sourceRoot":"","sources":["../../src/portability/import-repository.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AA8K7C;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,QAA6B;IACvE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3C,OAAO;YACL,GAAG,EAAE,qBAAqB,MAAM,SAAS;YACzC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,MAAc,EACd,QAA6B,EAC7B,cAAc,GAAG,CAAC;IAElB,IAAI,QAAQ,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,qBAAqB,MAAM,qBAAqB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,GAAG,EAAE,qBAAqB,MAAM,aAAa,cAAc,WAAW;QACtE,MAAM,EAAE;YACN,QAAQ,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1F;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAC1D,QAAQ,CACT,CAAC;IACF,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,qCAAqC,GAAG,iBAAiB,CAC7D,QAAQ,EACR,QAAQ,EACR,sBAAsB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CACzC,CAAC;IACF,MAAM,qBAAqB,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,uBAAuB,GAAG,qBAAqB,IAAI,aAAa,IAAI,eAAe,CAAC;IAC1F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CACpC;;;;;SAKK,iBAAiB,CAAC,GAAG,EAAE,EAC5B,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,YAAY,GAAuD,uBAAuB;QAC9F,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;aAEK,yBAAyB,CAAC,GAAG,EAAE,EACpC,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,CACtC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,cAAc,GAAyD,qBAAqB;QAChG,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;SAGC,sBAAsB,CAAC,GAAG,EAAE,EAC7B,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CACnC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,OAAO,GAAkD,qBAAqB;QAClF,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;SAIC,oBAAoB,CAAC,GAAG,EAAE,EAC3B,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,CACjC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,KAAK,GACT,qBAAqB,IAAI,aAAa;QACpC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;SAGD,oBAAoB,CAAC,GAAG,EAAE,EACzB,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,CACjC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnB,MAAM,WAAW,GAAsD,qBAAqB;QAC1F,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;SAKC,oBAAoB,CAAC,GAAG,EAAE,EAC3B,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,CACjC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,uBAAuB,GAAG,qBAAqB,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/F,MAAM,MAAM,GAA2D,uBAAuB;QAC5F,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;SAKC,oBAAoB,CAAC,GAAG,EAAE,EAC3B,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,CACjC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,eAAe,GACnB,qBAAqB;QACnB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;QAMF,oBAAoB,CAAC,GAAG;8BACF,EACpB,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,CACjC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnB,MAAM,KAAK,GAAgD,aAAa;QACtE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;;SASC,sBAAsB,CAAC,GAAG,EAAE,EAC7B,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CACnC;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,SAAS,GAAoD,aAAa;QAC9E,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;SAOC,sBAAsB,CAAC,GAAG,QAAQ,qCAAqC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EACrG,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,qCAAqC,CAAC,MAAM,CAAC,CACpF;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,eAAe,GAA0D,aAAa;QAC1F,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;SAOC,sBAAsB,CAAC,GAAG,QAAQ,qCAAqC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EACrG,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,qCAAqC,CAAC,MAAM,CAAC,CACpF;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjB,MAAM,OAAO,GAAkD,eAAe;QAC5E,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;;;0CAUkC,EAClC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CACrD;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAEjB,OAAO;QACL,aAAa,EAAE,aAAa,CAAC,IAAI;QACjC,cAAc,EAAE,cAAc,CAAC,IAAI;QACnC,YAAY,EAAE,YAAY,CAAC,IAAI;QAC/B,kBAAkB,EAAE,OAAO,CAAC,IAAI;QAChC,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,gBAAgB,EAAE,MAAM,CAAC,IAAI;QAC7B,eAAe,EAAE,eAAe,CAAC,IAAI;QACrC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,GAAG;YACN,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;SAC1D,CAAC,CAAC;QACH,SAAS,EAAE,SAAS,CAAC,IAAI;QACzB,eAAe,EAAE,eAAe,CAAC,IAAI;QACrC,OAAO,EAAE,OAAO,CAAC,IAAI;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAA+B,EAC/B,aAA4B,EAC5B,qBAAsD;IAEtD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG;QACb,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,iBAAiB;QACxB,MAAM,CAAC,QAAQ,CAAC,QAAQ;QACxB,MAAM,CAAC,QAAQ,CAAC,WAAW;QAC3B,MAAM,CAAC,QAAQ,CAAC,aAAa;QAC7B,MAAM,CAAC,QAAQ,CAAC,YAAY;QAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU;KAC3B,CAAC;IACF,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;iFAIuE,EACvE,CAAC,eAAe,EAAE,GAAG,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAC1C;QACH,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;;;;sCAI4B,EAC5B,CAAC,GAAG,MAAM,EAAE,aAAa,CAAC,CAC3B,CAAC;IACR,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;IAE7D,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAChG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpD,MAAM,IAAI,CAAC,KAAK,CACd,4EAA4E,EAC5E,CAAC,cAAc,EAAE,SAAS,CAAC,CAC5B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,KAAK,CACd;;;;;sFAK8E,EAC9E,CAAC,cAAc,EAAE,SAAS,EAAE,YAAY,SAAS,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA8B,EAC9B,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;kDACwC,EACxC,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAC/E;QACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;qCAC2B,EAC3B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAChE,CAAC;IACR,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoC,EACpC,aAAqB,EACrB,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;sDAC4C,EAC5C;YACE,eAAe;YACf,aAAa;YACb,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,MAAM;SACd,CACF;QACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;8DACoD,EACpD,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAChE,CAAC;IACR,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,aAAqB,EACrB,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;kDACwC,EACxC,CAAC,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAC/E;QACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;qCAC2B,EAC3B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CACjD,CAAC;IACR,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA6B,EAC7B,aAAqB,EACrB,QAAuB,EACvB,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;sDAC4C,EAC5C,CAAC,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CACzF;QACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;qCAC2B,EAC3B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CACjD,CAAC;IACR,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAAkC,EAClC,aAAqB,EACrB,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;;8DAGoD,EACpD;YACE,eAAe;YACf,aAAa;YACb,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,uBAAuB;YAC9B,MAAM,CAAC,mBAAmB;SAC3B,CACF;QACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;qCAE2B,EAC3B;YACE,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,uBAAuB;YAC9B,MAAM,CAAC,mBAAmB;YAC1B,aAAa;SACd,CACF,CAAC;IACR,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAAc,EACd,aAAgC;IAEhC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;uEACiE,EACjE,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/portability/import-user-client-writers.d.ts

@@ -0,0 +1,40 @@
+/** Transaction-bound user, relationship, client, and credential import writes. */
+import type { PortabilityClient, PortabilityCredential, PortabilityJsonValue, PortabilityUser } from './types.js';
+/**
+ * Insert or update one portable user without touching credentials or automatic lock fields.
+ *
+ * @param record - Strict portable user fields
+ * @param organizationId - Resolved parent organization identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination user identifier
+ */
+export declare function writePortabilityUser(record: PortabilityUser, organizationId: string, destinationId: string | null): Promise<string>;
+/**
+ * Add one listed user-role assignment without changing destination-only assignments.
+ *
+ * @param userId - Resolved destination user identifier
+ * @param roleId - Resolved destination role identifier
+ */
+export declare function writePortabilityUserRole(userId: string, roleId: string): Promise<void>;
+/**
+ * Insert or update one listed custom-claim value.
+ *
+ * @param userId - Resolved destination user identifier
+ * @param claimId - Resolved destination claim-definition identifier
+ * @param value - Portable JSON claim value
+ */
+export declare function writePortabilityUserClaimValue(userId: string, claimId: string, value: PortabilityJsonValue): Promise<void>;
+/**
+ * Insert or update one OIDC client and create one credential only for a new confidential client.
+ *
+ * @param record - Strict portable client fields
+ * @param organizationId - Resolved owner organization identifier
+ * @param applicationId - Resolved owner application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Destination identifier and optional one-time credential
+ */
+export declare function writePortabilityClient(record: PortabilityClient, organizationId: string, applicationId: string, destinationId: string | null): Promise<{
+    readonly id: string;
+    readonly credential?: PortabilityCredential;
+}>;
+//# sourceMappingURL=import-user-client-writers.d.ts.map

package/dist/portability/import-user-client-writers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-user-client-writers.d.ts","sourceRoot":"","sources":["../../src/portability/import-user-client-writers.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAKlF,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EAChB,MAAM,YAAY,CAAC;AA0BpB;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,eAAe,EACvB,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,CAiDjB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM5F;AAED;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,iBAAiB,EACzB,cAAc,EAAE,MAAM,EACtB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAC,CA4E/E"}

package/dist/portability/import-user-client-writers.js

@@ -0,0 +1,168 @@
+/** Transaction-bound user, relationship, client, and credential import writes. */
+import { createHash, randomUUID } from 'node:crypto';
+import { generateSecret, hashSecret } from '../clients/crypto.js';
+import { getPool } from '../lib/database.js';
+/**
+ * Add six UTC calendar months while clamping month-end to the target month's last day.
+ *
+ * @param now - Credential creation time
+ * @returns Exact UTC credential expiry time
+ */
+function importedSecretExpiry(now) {
+    const targetMonth = now.getUTCMonth() + 6;
+    const targetYear = now.getUTCFullYear() + Math.floor(targetMonth / 12);
+    const normalizedMonth = targetMonth % 12;
+    const lastDay = new Date(Date.UTC(targetYear, normalizedMonth + 1, 0)).getUTCDate();
+    return new Date(Date.UTC(targetYear, normalizedMonth, Math.min(now.getUTCDate(), lastDay), now.getUTCHours(), now.getUTCMinutes(), now.getUTCSeconds(), now.getUTCMilliseconds()));
+}
+/**
+ * Insert or update one portable user without touching credentials or automatic lock fields.
+ *
+ * @param record - Strict portable user fields
+ * @param organizationId - Resolved parent organization identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination user identifier
+ */
+export async function writePortabilityUser(record, organizationId, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const profileValues = [
+        record.email_verified,
+        record.given_name,
+        record.family_name,
+        record.middle_name,
+        record.nickname,
+        record.preferred_username,
+        record.profile_url,
+        record.picture_url,
+        record.website_url,
+        record.gender,
+        record.birthdate,
+        record.zoneinfo,
+        record.locale,
+        record.phone_number,
+        record.phone_number_verified,
+        record.address_street,
+        record.address_locality,
+        record.address_region,
+        record.address_postal_code,
+        record.address_country,
+        record.status,
+    ];
+    const result = destinationId === null
+        ? await getPool().query(`INSERT INTO users
+           (id, organization_id, email, email_verified, given_name, family_name, middle_name,
+            nickname, preferred_username, profile_url, picture_url, website_url, gender,
+            birthdate, zoneinfo, locale, phone_number, phone_number_verified, address_street,
+            address_locality, address_region, address_postal_code, address_country, status)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14,
+                 $15, $16, $17, $18, $19, $20, $21, $22, $23, $24) RETURNING id`, [authoritativeId, organizationId, record.email, ...profileValues])
+        : await getPool().query(`UPDATE users SET email_verified = $1, given_name = $2, family_name = $3,
+                middle_name = $4, nickname = $5, preferred_username = $6, profile_url = $7,
+                picture_url = $8, website_url = $9, gender = $10, birthdate = $11,
+                zoneinfo = $12, locale = $13, phone_number = $14,
+                phone_number_verified = $15, address_street = $16, address_locality = $17,
+                address_region = $18, address_postal_code = $19, address_country = $20,
+                status = CASE WHEN status = 'locked' AND $21 = 'active' THEN status ELSE $21 END,
+                updated_at = NOW() WHERE id = $22 RETURNING id`, [...profileValues, destinationId]);
+    return result.rows[0]?.id ?? authoritativeId;
+}
+/**
+ * Add one listed user-role assignment without changing destination-only assignments.
+ *
+ * @param userId - Resolved destination user identifier
+ * @param roleId - Resolved destination role identifier
+ */
+export async function writePortabilityUserRole(userId, roleId) {
+    await getPool().query(`INSERT INTO user_roles (user_id, role_id, assigned_by)
+     VALUES ($1, $2, NULL) ON CONFLICT (user_id, role_id) DO NOTHING`, [userId, roleId]);
+}
+/**
+ * Insert or update one listed custom-claim value.
+ *
+ * @param userId - Resolved destination user identifier
+ * @param claimId - Resolved destination claim-definition identifier
+ * @param value - Portable JSON claim value
+ */
+export async function writePortabilityUserClaimValue(userId, claimId, value) {
+    await getPool().query(`INSERT INTO custom_claim_values (user_id, claim_id, value)
+     VALUES ($1, $2, $3::jsonb)
+     ON CONFLICT (user_id, claim_id) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()`, [userId, claimId, JSON.stringify(value)]);
+}
+/**
+ * Insert or update one OIDC client and create one credential only for a new confidential client.
+ *
+ * @param record - Strict portable client fields
+ * @param organizationId - Resolved owner organization identifier
+ * @param applicationId - Resolved owner application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Destination identifier and optional one-time credential
+ */
+export async function writePortabilityClient(record, organizationId, applicationId, destinationId) {
+    const authoritativeId = destinationId ?? randomUUID();
+    const mutableValues = [
+        record.name,
+        record.status,
+        record.grant_types,
+        record.response_types,
+        record.scope,
+        record.login_methods,
+        record.token_endpoint_auth_method,
+        record.redirect_uris,
+        record.post_logout_redirect_uris,
+        record.allowed_origins,
+        record.require_pkce,
+    ];
+    if (destinationId === null) {
+        await getPool().query(`INSERT INTO clients
+         (id, client_id, organization_id, application_id, client_name, client_type,
+          application_type, status, grant_types, response_types, scope, login_methods,
+          token_endpoint_auth_method, redirect_uris, post_logout_redirect_uris,
+          allowed_origins, require_pkce)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17)`, [
+            authoritativeId,
+            record.client_id,
+            organizationId,
+            applicationId,
+            record.name,
+            record.client_type,
+            record.application_type,
+            record.status,
+            record.grant_types,
+            record.response_types,
+            record.scope,
+            record.login_methods,
+            record.token_endpoint_auth_method,
+            record.redirect_uris,
+            record.post_logout_redirect_uris,
+            record.allowed_origins,
+            record.require_pkce,
+        ]);
+    }
+    else {
+        await getPool().query(`UPDATE clients SET client_name = $1, status = $2, grant_types = $3,
+              response_types = $4, scope = $5, login_methods = $6,
+              token_endpoint_auth_method = $7, redirect_uris = $8,
+              post_logout_redirect_uris = $9, allowed_origins = $10, require_pkce = $11,
+              updated_at = NOW() WHERE id = $12`, [...mutableValues, destinationId]);
+    }
+    if (destinationId !== null || record.client_type !== 'confidential') {
+        return { id: authoritativeId };
+    }
+    const secret = generateSecret();
+    const secretHash = await hashSecret(secret);
+    const secretSha256 = createHash('sha256').update(secret).digest('hex');
+    const expiresAt = importedSecretExpiry(new Date());
+    await getPool().query(`INSERT INTO client_secrets
+       (client_id, secret_hash, secret_sha256, label, expires_at)
+     VALUES ($1, $2, $3, 'Imported', $4)`, [authoritativeId, secretHash, secretSha256, expiresAt]);
+    return {
+        id: authoritativeId,
+        credential: {
+            client_id: record.client_id,
+            label: 'Imported',
+            secret,
+            expires_at: expiresAt.toISOString(),
+        },
+    };
+}
+//# sourceMappingURL=import-user-client-writers.js.map

package/dist/portability/import-user-client-writers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-user-client-writers.js","sourceRoot":"","sources":["../../src/portability/import-user-client-writers.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAQ7C;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAS;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,WAAW,GAAG,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpF,OAAO,IAAI,IAAI,CACb,IAAI,CAAC,GAAG,CACN,UAAU,EACV,eAAe,EACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,EACnC,GAAG,CAAC,WAAW,EAAE,EACjB,GAAG,CAAC,aAAa,EAAE,EACnB,GAAG,CAAC,aAAa,EAAE,EACnB,GAAG,CAAC,kBAAkB,EAAE,CACzB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,cAAsB,EACtB,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG;QACpB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,kBAAkB;QACzB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,mBAAmB;QAC1B,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,MAAM;KACd,CAAC;IACF,MAAM,MAAM,GACV,aAAa,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;;;;;gFAMsE,EACtE,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,aAAa,CAAC,CAClE;QACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;;;;;;+DAOqD,EACrD,CAAC,GAAG,aAAa,EAAE,aAAa,CAAC,CAClC,CAAC;IACR,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,eAAe,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAc;IAC3E,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;qEACiE,EACjE,CAAC,MAAM,EAAE,MAAM,CAAC,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAc,EACd,OAAe,EACf,KAA2B;IAE3B,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;8FAE0F,EAC1F,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAyB,EACzB,cAAsB,EACtB,aAAqB,EACrB,aAA4B;IAE5B,MAAM,eAAe,GAAG,aAAa,IAAI,UAAU,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG;QACpB,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,0BAA0B;QACjC,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,yBAAyB;QAChC,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,YAAY;KACpB,CAAC;IACF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;;;;2FAKqF,EACrF;YACE,eAAe;YACf,MAAM,CAAC,SAAS;YAChB,cAAc;YACd,aAAa;YACb,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,gBAAgB;YACvB,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,KAAK;YACZ,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,0BAA0B;YACjC,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,yBAAyB;YAChC,MAAM,CAAC,eAAe;YACtB,MAAM,CAAC,YAAY;SACpB,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;;;gDAI0C,EAC1C,CAAC,GAAG,aAAa,EAAE,aAAa,CAAC,CAClC,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB;;yCAEqC,EACrC,CAAC,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CACvD,CAAC;IACF,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,UAAU,EAAE;YACV,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,UAAU;YACjB,MAAM;YACN,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;SACpC;KACF,CAAC;AACJ,CAAC"}

package/dist/portability/index.d.ts

@@ -0,0 +1,8 @@
+/** Public server contract for selective environment portability. */
+export { exportManifestRequestSchema, importManifestRequestSchema, portabilityApplicationSelectionSchema, portabilityCategorySchema, portabilityEntityTypeSchema, portabilityManifestSchema, portabilityResultSchema, portabilityScopeSchema, } from './schema.js';
+export { requiredPortabilityPermissions, requirePortabilityAuthorization, } from './authorization.js';
+export { exportPortabilityManifest, type PortabilityExport } from './export.js';
+export { buildPortabilityPlan } from './plan.js';
+export { applyPortabilityManifest } from './apply.js';
+export { PortabilityError, type ExportManifestRequest, type ImportManifestRequest, type PortabilityAction, type PortabilityActionCounts, type PortabilityActor, type PortabilityApplication, type PortabilityApplicationModule, type PortabilityApplicationSelection, type PortabilityBranding, type PortabilityBrandingAsset, type PortabilityCategory, type PortabilityClaimDefinition, type PortabilityClient, type PortabilityCredential, type PortabilityEntityType, type PortabilityErrorCode, type PortabilityImportMode, type PortabilityJsonValue, type PortabilityManifest, type PortabilityNaturalKey, type PortabilityOrganization, type PortabilityPermission, type PortabilityResult, type PortabilityResultError, type PortabilityResultErrorCode, type PortabilityResultItem, type PortabilityRole, type PortabilityRolePermissionMapping, type PortabilityScope, type PortabilityUser, type PortabilityUserClaimValue, type PortabilityUserRoleAssignment, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/portability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/portability/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,qCAAqC,EACrC,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACrC,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,GACnC,MAAM,YAAY,CAAC"}

package/dist/portability/index.js

@@ -0,0 +1,8 @@
+/** Public server contract for selective environment portability. */
+export { exportManifestRequestSchema, importManifestRequestSchema, portabilityApplicationSelectionSchema, portabilityCategorySchema, portabilityEntityTypeSchema, portabilityManifestSchema, portabilityResultSchema, portabilityScopeSchema, } from './schema.js';
+export { requiredPortabilityPermissions, requirePortabilityAuthorization, } from './authorization.js';
+export { exportPortabilityManifest } from './export.js';
+export { buildPortabilityPlan } from './plan.js';
+export { applyPortabilityManifest } from './apply.js';
+export { PortabilityError, } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/portability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/portability/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,qCAAqC,EACrC,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAA0B,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EACL,gBAAgB,GAiCjB,MAAM,YAAY,CAAC"}