@portaidentity/server 1.7.2 → 1.8.0

package/dist/clients/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/clients/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAS9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,OAAO,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA+CtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,EAAE,OAAO,EACrB,GAAG,GAAE,MAAkC,GACtC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBzC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,GAC/B,MAAM,EAAE,CAQV;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/clients/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAiB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAElF,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,aAA6B,CAAC;AAE3D,mEAAmE;AACnE,eAAO,MAAM,gBAAgB;;;EAAqC,CAAC;AAEnE,mEAAmE;AACnE,eAAO,MAAM,2BAA2B;;;;EAAmC,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,kBAAkB;;;EAAiC,CAAC;AAEjE,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB;;;IAAmD,CAAC;AAEzF,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B;;;;EAIxC,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,yBAAoC,CAAC;AAE1E,oDAAoD;AACpD,eAAO,MAAM,sBAAsB;;;;GAE1B,CAAC;AAEV,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,kCAAuC,CAAC;AAE9E,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;AAE5F,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,gEAAgE;IAChE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gDAAgD;IAChD,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,wDAAwD;IACxD,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,+DAA+D;AAC/D,MAAM,WAAW,8BAA8B;IAC7C,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,OAAO,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,EAAE,OAAO,EACrB,GAAG,GAAE,MAAkC,GACtC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBzC;AAkCD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,aAAa,EAAE,2BAA2B,GACzC,8BAA8B,CAiDhC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,GAC/B,MAAM,EAAE,CAQV;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/dist/clients/validators.js

@@ -10,6 +10,36 @@
  * Default grant types and auth methods are determined by the combination
  * of client type (confidential/public) and application type (web/spa/native).
  */
+import { z } from 'zod';
+import { LOGIN_METHODS } from './types.js';
+/** Client display names are required and fit the database column. */
+export const clientNameSchema = z.string().min(1).max(255);
+/** Client confidentiality modes supported by the OIDC provider. */
+export const clientTypeSchema = z.enum(['confidential', 'public']);
+/** Deployment application types supported by the OIDC provider. */
+export const clientApplicationTypeSchema = z.enum(['web', 'native', 'spa']);
+/** Client lifecycle states persisted by the domain. */
+export const clientStatusSchema = z.enum(['active', 'inactive']);
+/** Per-client login methods may inherit from the organization through null. */
+export const clientLoginMethodsSchema = z.array(z.enum(LOGIN_METHODS)).min(1).nullable();
+/** Token endpoint authentication methods accepted by the OIDC provider. */
+export const tokenEndpointAuthMethodSchema = z.enum([
+    'client_secret_basic',
+    'client_secret_post',
+    'none',
+]);
+/** Redirect URI collections use the domain's bounded absolute-URL boundary. */
+export const redirectUrisSchema = z.array(z.string().url()).min(1).max(10);
+/** Optional redirect and origin collections share the domain's maximum count. */
+export const optionalClientUrisSchema = z.array(z.string().url()).max(10);
+/** OAuth grant types supported by Porta clients. */
+export const clientGrantTypesSchema = z
+    .array(z.enum(['authorization_code', 'refresh_token', 'client_credentials']))
+    .min(1);
+/** OIDC response types currently supported by Porta. */
+export const clientResponseTypesSchema = z.array(z.literal('code')).length(1);
+/** Client scopes retain the existing free-text wire contract. */
+export const clientScopeSchema = z.string();
 // ===========================================================================
 // Redirect URI Validation
 // ===========================================================================
@@ -104,6 +134,86 @@ export function validateRedirectUris(uris, isProduction, max = DEFAULT_MAX_REDIR
     }
     return { isValid: true };
 }
+/** Return whether a value contains ASCII control characters. */
+function containsControlCharacters(value) {
+    return [...value].some((character) => {
+        const codePoint = character.codePointAt(0);
+        return codePoint !== undefined && (codePoint < 32 || codePoint === 127);
+    });
+}
+/** Validate that a CORS entry is an exact HTTP(S) origin. */
+function validateAllowedOrigin(origin) {
+    if (containsControlCharacters(origin) || origin.includes('*'))
+        return false;
+    try {
+        const parsed = new URL(origin);
+        return ((parsed.protocol === 'https:' || parsed.protocol === 'http:') &&
+            parsed.username === '' &&
+            parsed.password === '' &&
+            parsed.pathname === '/' &&
+            parsed.search === '' &&
+            parsed.hash === '' &&
+            parsed.origin === origin);
+    }
+    catch {
+        return false;
+    }
+}
+/** Return whether every value occurs exactly once in one protocol collection. */
+function containsOnlyUniqueValues(values) {
+    return new Set(values).size === values.length;
+}
+/**
+ * Validate the complete protocol relationship for an OIDC client.
+ *
+ * This validator is deliberately transport-neutral so Admin requests, imports, and service calls
+ * enforce the same public/confidential rules and URI restrictions.
+ *
+ * @param configuration - Complete client protocol configuration after defaults are applied
+ * @returns A finite list of compatibility errors
+ */
+export function validateClientProtocolCompatibility(configuration) {
+    const errors = [];
+    const supportedGrants = new Set(['authorization_code', 'refresh_token', 'client_credentials']);
+    if (configuration.redirectUris.length < 1 ||
+        configuration.redirectUris.length > DEFAULT_MAX_REDIRECT_URIS ||
+        !validateRedirectUris([...configuration.redirectUris], false).isValid ||
+        configuration.redirectUris.some(containsControlCharacters) ||
+        !containsOnlyUniqueValues(configuration.redirectUris)) {
+        errors.push('redirectUris must contain 1 to 10 safe redirect URIs');
+    }
+    if ((configuration.postLogoutRedirectUris?.length ?? 0) > DEFAULT_MAX_REDIRECT_URIS ||
+        configuration.postLogoutRedirectUris?.some((uri) => containsControlCharacters(uri) || !validateRedirectUris([uri], false).isValid) ||
+        !containsOnlyUniqueValues(configuration.postLogoutRedirectUris ?? [])) {
+        errors.push('postLogoutRedirectUris must contain safe redirect URIs');
+    }
+    if (configuration.allowedOrigins.length > DEFAULT_MAX_REDIRECT_URIS ||
+        configuration.allowedOrigins.some((origin) => !validateAllowedOrigin(origin)) ||
+        !containsOnlyUniqueValues(configuration.allowedOrigins)) {
+        errors.push('allowedOrigins must contain exact HTTP or HTTPS origins');
+    }
+    if (configuration.grantTypes.length < 1 ||
+        configuration.grantTypes.some((grant) => !supportedGrants.has(grant))) {
+        errors.push('grantTypes contains an unsupported value');
+    }
+    if (configuration.responseTypes.length !== 1 || configuration.responseTypes[0] !== 'code') {
+        errors.push('responseTypes must contain only code');
+    }
+    if (configuration.clientType === 'public') {
+        if (configuration.tokenEndpointAuthMethod !== 'none') {
+            errors.push('public clients cannot authenticate with a secret');
+        }
+        if (!configuration.requirePkce)
+            errors.push('public clients require PKCE');
+        if (configuration.grantTypes.includes('client_credentials')) {
+            errors.push('public clients cannot use client_credentials');
+        }
+    }
+    else if (configuration.tokenEndpointAuthMethod === 'none') {
+        errors.push('confidential clients require token endpoint authentication');
+    }
+    return { isValid: errors.length === 0, errors };
+}
 // ===========================================================================
 // Default Grant Types
 // ===========================================================================

package/dist/clients/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/clients/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,+CAA+C;AAC/C,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,YAAqB;IAErB,kBAAkB;IAClB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACnE,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,uDAAuD;YACvD,4BAA4B;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IACnF,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,WAAW,GACf,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8DAA8D;aACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,YAAqB,EACrB,GAAG,GAAW,yBAAyB;IAEvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC,WAAW,GAAG,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAsB,EACtB,eAAgC;IAEhC,2EAA2E;IAC3E,IAAI,UAAU,KAAK,cAAc,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC/D,OAAO,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACvE,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,UAAsB;IACtE,OAAO,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,sBAAsB,CAAC;AAChC,CAAC"}
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/clients/validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAyC,MAAM,YAAY,CAAC;AAElF,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3D,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,mEAAmE;AACnE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAE5E,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEzF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,qBAAqB;IACrB,oBAAoB;IACpB,MAAM;CACP,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAE3E,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAE1E,oDAAoD;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;KAC5E,GAAG,CAAC,CAAC,CAAC,CAAC;AAEV,wDAAwD;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAE9E,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAiC5C,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,+CAA+C;AAC/C,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,YAAqB;IAErB,kBAAkB;IAClB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IACnE,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,uDAAuD;YACvD,4BAA4B;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;IACnF,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;QACvF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,8DAA8D;aACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,YAAqB,EACrB,GAAG,GAAW,yBAAyB;IAEvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,uCAAuC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC,WAAW,GAAG,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,GAAG,EAAE,IAAI,SAAS,KAAK,GAAG,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,yBAAyB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC7D,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,GAAG;YACvB,MAAM,CAAC,MAAM,KAAK,EAAE;YACpB,MAAM,CAAC,IAAI,KAAK,EAAE;YAClB,MAAM,CAAC,MAAM,KAAK,MAAM,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,wBAAwB,CAAC,MAAyB;IACzD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAA0C;IAE1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC/F,IACE,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QACrC,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,yBAAyB;QAC7D,CAAC,oBAAoB,CAAC,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;QACrE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC;QAC1D,CAAC,wBAAwB,CAAC,aAAa,CAAC,YAAY,CAAC,EACrD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;IACD,IACE,CAAC,aAAa,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,yBAAyB;QAC/E,aAAa,CAAC,sBAAsB,EAAE,IAAI,CACxC,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CACvF;QACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,sBAAsB,IAAI,EAAE,CAAC,EACrE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IACD,IACE,aAAa,CAAC,cAAc,CAAC,MAAM,GAAG,yBAAyB;QAC/D,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC7E,CAAC,wBAAwB,CAAC,aAAa,CAAC,cAAc,CAAC,EACvD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,aAAa,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACnC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EACrE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,aAAa,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,aAAa,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1C,IAAI,aAAa,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW;YAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC3E,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,aAAa,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAsB,EACtB,eAAgC;IAEhC,2EAA2E;IAC3E,IAAI,UAAU,KAAK,cAAc,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC/D,OAAO,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACvE,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,UAAsB;IACtE,OAAO,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,sBAAsB,CAAC;AAChC,CAAC"}

package/dist/config/index.d.ts

@@ -15,6 +15,7 @@ export declare const config: {
     };
     logLevel: "debug" | "error" | "fatal" | "info" | "warn";
     trustProxy: boolean;
+    trustProxyHops: number;
     twoFactorEncryptionKey?: string | undefined;
     signingKeyEncryptionKey: string;
     adminCorsOrigins: string[];

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;CAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AA8DA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;CAAe,CAAC"}

package/dist/config/index.js

@@ -29,6 +29,7 @@ function loadConfig() {
         },
         logLevel: process.env.LOG_LEVEL,
         trustProxy: process.env.TRUST_PROXY,
+        trustProxyHops: process.env.TRUST_PROXY_HOPS,
         twoFactorEncryptionKey: process.env.TWO_FACTOR_ENCRYPTION_KEY,
         signingKeyEncryptionKey: process.env.SIGNING_KEY_ENCRYPTION_KEY,
         // ADMIN_CORS_ORIGINS is a comma-separated list of allowed origins for the admin API.

package/dist/config/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAE3D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,UAAU;IACjB,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,IACE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAC7C,CAAC;QACD,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAC/B,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC1C,4EAA4E;QAC5E,8EAA8E;QAC9E,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QACrD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;SAC5B;QACD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAC/B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACnC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC7D,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAC/D,qFAAqF;QACrF,oEAAoE;QACpE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAChF,CAAC,CAAC,EAAE;QACN,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAE3D,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,SAAS,UAAU;IACjB,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,IACE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,EAC7C,CAAC;QACD,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;QAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACrC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAC/B,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC1C,4EAA4E;QAC5E,8EAA8E;QAC9E,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QACrD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;SAC5B;QACD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;QAC/B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACnC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAC7D,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAC/D,qFAAqF;QACrF,oEAAoE;QACpE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAChF,CAAC,CAAC,EAAE;QACN,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC"}

package/dist/config/schema.d.ts

@@ -26,6 +26,7 @@ export declare const configSchema: z.ZodObject<{
         warn: "warn";
     }>>;
     trustProxy: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
+    trustProxyHops: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
     twoFactorEncryptionKey: z.ZodOptional<z.ZodString>;
     signingKeyEncryptionKey: z.ZodString;
     adminCorsOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgFxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkGvB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+FxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8GvB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/config/schema.js

@@ -31,6 +31,18 @@ const baseSchema = z.object({
         .union([z.boolean(), z.string()])
         .default(true)
         .transform((val) => (typeof val === 'string' ? val === 'true' || val === '1' : val)),
+    // Number of trusted reverse-proxy hops in front of the server. When the server
+    // trusts proxy headers, Koa uses this to read the client IP from the right side
+    // of X-Forwarded-For: a directly connected client can otherwise supply the
+    // leftmost value and rotate its rate-limit identity on every request. Set this
+    // to the exact number of trusted proxies that append to X-Forwarded-For. The
+    // default of 1 matches the standard single TLS-terminating proxy deployment.
+    // A value that is too low collapses the rate-limit budget and audit address of
+    // every client behind the nearest proxy; a value that is too high lets a client
+    // control the resolved IP again. 0 trusts the entire header. The mitigation
+    // assumes a trusted proxy always appends and that the server itself is not
+    // directly reachable. Blank or whitespace input falls back to the default.
+    trustProxyHops: z.preprocess((value) => (typeof value === 'string' && value.trim() === '' ? undefined : value), z.coerce.number().int().min(0).max(10).default(1)),
     twoFactorEncryptionKey: z
         .string()
         .length(64, 'TWO_FACTOR_ENCRYPTION_KEY must be 64 hex characters (32 bytes)')
@@ -74,6 +86,17 @@ export const configSchema = baseSchema.superRefine((data, ctx) => {
     // Only enforce in production
     if (data.nodeEnv !== 'production')
         return;
+    // These keys protect different classes of encrypted data. The emergency
+    // escape hatch may relax operational checks, but it must not merge the two
+    // cryptographic domains.
+    const tfe = data.twoFactorEncryptionKey;
+    if (tfe && data.signingKeyEncryptionKey.toLowerCase() === tfe.toLowerCase()) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['twoFactorEncryptionKey'],
+            message: 'SIGNING_KEY_ENCRYPTION_KEY and TWO_FACTOR_ENCRYPTION_KEY must use different values',
+        });
+    }
     // Escape hatch for incident response — caller logs a loud error
     if (process.env.PORTA_SKIP_PROD_SAFETY === 'true')
         return;
@@ -98,7 +121,6 @@ export const configSchema = baseSchema.superRefine((data, ctx) => {
     // ── R3 + R4: 2FA encryption key ──────────────────────────────────
     // Any org that ever enables 2FA needs this key to decrypt existing
     // TOTP secrets, so it is unconditionally required in production.
-    const tfe = data.twoFactorEncryptionKey;
     if (!tfe) {
         ctx.addIssue({
             code: 'custom',

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,kEAAkE;AAClE,gEAAgE;AAChE,8EAA8E;AAC9E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACpE,6EAA6E;IAC7E,iFAAiF;IACjF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;KACjD,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7E,yFAAyF;IACzF,iFAAiF;IACjF,kEAAkE;IAClE,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,sBAAsB,EAAE,CAAC;SACtB,MAAM,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,gEAAgE,CAAC;SAC5E,KAAK,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACtE,QAAQ,EAAE;IACb,mEAAmE;IACnE,kEAAkE;IAClE,mCAAmC;IACnC,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,iEAAiE,CAAC;SAC7E,KAAK,CAAC,cAAc,EAAE,gDAAgD,CAAC;IAC1E,iDAAiD;IACjD,0DAA0D;IAC1D,qEAAqE;IACrE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,6CAA6C;IAC7C,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,OAAO,CAAC,KAAK,CAAC;SACd,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;CACvF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uEAAuE;AACvE,oEAAoE;AACpE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,uEAAuE;AACvE,MAAM,0BAA0B,GAC9B,kEAAkE,CAAC;AAErE,0EAA0E;AAC1E,MAAM,2BAA2B,GAC/B,kEAAkE,CAAC;AAErE,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC/D,6BAA6B;IAC7B,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO;IAE1C,gEAAgE;IAChE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;QAAE,OAAO;IAE1D,qEAAqE;IACrE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvB,OAAO,EACL,gEAAgE;oBAChE,yCAAyC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,eAAe,CAAC,wEAAwE;aAClG,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,uBAAuB,KAAK,2BAA2B,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,yBAAyB,CAAC;YACjC,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,CAAC;oBACvB,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,0DAA0D;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YACtB,OAAO,EAAE,uFAAuF;SACjG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,kEAAkE;AAClE,gEAAgE;AAChE,8EAA8E;AAC9E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACpE,6EAA6E;IAC7E,iFAAiF;IACjF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;KACjD,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7E,yFAAyF;IACzF,iFAAiF;IACjF,kEAAkE;IAClE,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,cAAc,EAAE,CAAC,CAAC,UAAU,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EACjF,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAClD;IACD,sBAAsB,EAAE,CAAC;SACtB,MAAM,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,gEAAgE,CAAC;SAC5E,KAAK,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACtE,QAAQ,EAAE;IACb,mEAAmE;IACnE,kEAAkE;IAClE,mCAAmC;IACnC,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,iEAAiE,CAAC;SAC7E,KAAK,CAAC,cAAc,EAAE,gDAAgD,CAAC;IAC1E,iDAAiD;IACjD,0DAA0D;IAC1D,qEAAqE;IACrE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,6CAA6C;IAC7C,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,OAAO,CAAC,KAAK,CAAC;SACd,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;CACvF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uEAAuE;AACvE,oEAAoE;AACpE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,uEAAuE;AACvE,MAAM,0BAA0B,GAC9B,kEAAkE,CAAC;AAErE,0EAA0E;AAC1E,MAAM,2BAA2B,GAC/B,kEAAkE,CAAC;AAErE,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC/D,6BAA6B;IAC7B,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO;IAE1C,wEAAwE;IACxE,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC;IACxC,IAAI,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,oFAAoF;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;QAAE,OAAO;IAE1D,qEAAqE;IACrE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvB,OAAO,EACL,gEAAgE;oBAChE,yCAAyC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,eAAe,CAAC,wEAAwE;aAClG,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,uBAAuB,KAAK,2BAA2B,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,yBAAyB,CAAC;YACjC,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,CAAC;oBACvB,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,0DAA0D;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YACtB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/custom-claims/repository.d.ts

@@ -62,15 +62,20 @@ export declare function findDefinitionByName(applicationId: string, claimName: s
  * @throws Error if definition not found or no fields provided
  */
 export declare function updateDefinition(id: string, input: UpdateClaimDefinitionInput): Promise<CustomClaimDefinition>;
-/**
- * Delete a claim definition by ID.
- *
- * CASCADE constraint automatically removes all associated claim values.
- *
- * @param id - Definition UUID
- * @returns true if deleted, false if not found
- */
-export declare function deleteDefinition(id: string): Promise<boolean>;
+/** Lock, capture, and delete a claim definition through its application parent. */
+export declare function deleteDefinition(applicationId: string, id: string): Promise<{
+    definition: CustomClaimDefinition;
+    userIds: string[];
+    grantIds: string[];
+} | null>;
+/** Lock and capture a claim definition without deleting it. */
+export declare function captureDefinitionForDeletion(applicationId: string, id: string): Promise<{
+    definition: CustomClaimDefinition;
+    userIds: string[];
+    grantIds: string[];
+} | null>;
+/** Physically delete a claim definition previously locked through its parent. */
+export declare function deleteCapturedDefinition(applicationId: string, id: string): Promise<void>;
 /**
  * List all claim definitions for an application, ordered by claim name.
  *

package/dist/custom-claims/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/custom-claims/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAEV,qBAAqB,EAErB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAqBhC;AAMD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAU1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUvC;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AAMD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnE;AAMD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CASlC;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAa3B;AAMD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAUlC;AAMD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CASlB;AA8ED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAStF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CASjC"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/custom-claims/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAEV,qBAAqB,EAErB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAqBhC;AAMD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAU1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAUvC;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AAMD,mFAAmF;AACnF,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAK9F;AAED,+DAA+D;AAC/D,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CA+B9F;AAED,iFAAiF;AACjF,wBAAsB,wBAAwB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/F;AAMD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CASlC;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAa3B;AAMD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAUlC;AAMD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CASlB;AA8ED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAStF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,EAAE,CAAC,CASjC"}

package/dist/custom-claims/repository.js

@@ -140,18 +140,45 @@ export async function updateDefinition(id, input) {
 // ---------------------------------------------------------------------------
 // Delete
 // ---------------------------------------------------------------------------
-/**
- * Delete a claim definition by ID.
- *
- * CASCADE constraint automatically removes all associated claim values.
- *
- * @param id - Definition UUID
- * @returns true if deleted, false if not found
- */
-export async function deleteDefinition(id) {
+/** Lock, capture, and delete a claim definition through its application parent. */
+export async function deleteDefinition(applicationId, id) {
+    const capture = await captureDefinitionForDeletion(applicationId, id);
+    if (!capture)
+        return null;
+    await deleteCapturedDefinition(applicationId, id);
+    return capture;
+}
+/** Lock and capture a claim definition without deleting it. */
+export async function captureDefinitionForDeletion(applicationId, id) {
     const pool = getPool();
-    const result = await pool.query('DELETE FROM custom_claim_definitions WHERE id = $1', [id]);
-    return (result.rowCount ?? 0) > 0;
+    const target = await pool.query(`SELECT * FROM custom_claim_definitions
+     WHERE application_id = $1 AND id = $2
+     FOR UPDATE`, [applicationId, id]);
+    if (!target.rows[0])
+        return null;
+    const graph = await pool.query(`WITH affected_users AS (
+       SELECT DISTINCT user_id FROM custom_claim_values WHERE claim_id = $1
+     )
+     SELECT
+       ARRAY(SELECT user_id FROM affected_users ORDER BY user_id) AS user_ids,
+       ARRAY(
+         SELECT payload.id FROM oidc_payloads payload
+         WHERE payload.type = 'Grant'
+           AND payload.payload->>'accountId' = ANY(ARRAY(SELECT user_id::text FROM affected_users))
+           AND payload.payload->>'clientId' = ANY(ARRAY(
+             SELECT client_id FROM clients WHERE application_id = $2
+           ))
+         ORDER BY payload.id
+       ) AS grant_ids`, [id, applicationId]);
+    return {
+        definition: mapRowToDefinition(target.rows[0]),
+        userIds: graph.rows[0].user_ids,
+        grantIds: graph.rows[0].grant_ids,
+    };
+}
+/** Physically delete a claim definition previously locked through its parent. */
+export async function deleteCapturedDefinition(applicationId, id) {
+    await getPool().query('DELETE FROM custom_claim_definitions WHERE application_id = $1 AND id = $2', [applicationId, id]);
 }
 // ---------------------------------------------------------------------------
 // List

package/dist/custom-claims/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/custom-claims/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAW7C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iBAIa,EACb;QACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,gBAAgB,IAAI,KAAK;QAC/B,KAAK,CAAC,oBAAoB,IAAI,IAAI;QAClC,KAAK,CAAC,iBAAiB,IAAI,IAAI;KAChC,CACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sDAAsD,EACtD,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sFAAsF,EACtF,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,WAAW,EAAE,aAAa;IAC1B,gBAAgB,EAAE,qBAAqB;IACvC,oBAAoB,EAAE,yBAAyB;IAC/C,iBAAiB,EAAE,qBAAqB;CACzC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAyC,CAAC,CAAC;QAC/D,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAA2B,GAAG,EAAE,MAAM,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,oDAAoD,EACpD,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,0FAA0F,EAC1F,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,SAAiB,EACjB,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;kBAGY,EACZ,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CACtC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;gBAGY,EACZ,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,KAAc;IAEd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iBAIa,EACb,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;IAEF,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,wEAAwE,EACxE,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sEAAsE,EACtE,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AA6BD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAc;IAClC,OAAO;QACL,UAAU,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAuB;YACtC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,gBAAgB,EAAE,GAAG,CAAC,mBAAmB;YACzC,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;YACjD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,SAAS,EAAE,GAAG,CAAC,cAAc;SAC9B;QACD,KAAK,EAAE;YACL,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,SAAS,EAAE,GAAG,CAAC,cAAc;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;CAUrB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,GAAG,aAAa,iDAAiD,EACjE,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,GAAG,aAAa,2EAA2E,EAC3F,CAAC,MAAM,EAAE,aAAa,CAAC,CACxB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/custom-claims/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAW7C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iBAIa,EACb;QACE,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,WAAW,IAAI,IAAI;QACzB,KAAK,CAAC,gBAAgB,IAAI,KAAK;QAC/B,KAAK,CAAC,oBAAoB,IAAI,IAAI;QAClC,KAAK,CAAC,iBAAiB,IAAI,IAAI;KAChC,CACF,CAAC;IAEF,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sDAAsD,EACtD,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sFAAsF,EACtF,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,WAAW,EAAE,aAAa;IAC1B,gBAAgB,EAAE,qBAAqB;IACvC,oBAAoB,EAAE,yBAAyB;IAC/C,iBAAiB,EAAE,qBAAqB;CACzC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAyC,CAAC,CAAC;QAC/D,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAA2B,GAAG,EAAE,MAAM,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,EAAU;IAEV,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,wBAAwB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,EAAU;IAEV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;gBAEY,EACZ,CAAC,aAAa,EAAE,EAAE,CAAC,CACpB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAC5B;;;;;;;;;;;;;sBAakB,EAClB,CAAC,EAAE,EAAE,aAAa,CAAC,CACpB,CAAC;IACF,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ;QAChC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,aAAqB,EAAE,EAAU;IAC9E,MAAM,OAAO,EAAE,CAAC,KAAK,CACnB,4EAA4E,EAC5E,CAAC,aAAa,EAAE,EAAE,CAAC,CACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,0FAA0F,EAC1F,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,SAAiB,EACjB,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;kBAGY,EACZ,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CACtC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;gBAGY,EACZ,CAAC,aAAa,EAAE,SAAS,CAAC,CAC3B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,KAAc;IAEd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;iBAIa,EACb,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;IAEF,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,wEAAwE,EACxE,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sEAAsE,EACtE,CAAC,MAAM,EAAE,OAAO,CAAC,CAClB,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AA6BD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAc;IAClC,OAAO;QACL,UAAU,EAAE;YACV,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAuB;YACtC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,gBAAgB,EAAE,GAAG,CAAC,mBAAmB;YACzC,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;YACjD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,SAAS,EAAE,GAAG,CAAC,cAAc;SAC9B;QACD,KAAK,EAAE;YACL,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,cAAc;YAC7B,SAAS,EAAE,GAAG,CAAC,cAAc;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG;;;;;;;;;;CAUrB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,GAAG,aAAa,iDAAiD,EACjE,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,aAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,GAAG,aAAa,2EAA2E,EAC3F,CAAC,MAAM,EAAE,aAAa,CAAC,CACxB,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC"}

package/dist/custom-claims/service.d.ts

@@ -44,14 +44,19 @@ export declare function createDefinition(input: CreateClaimDefinitionInput): Pro
  */
 export declare function updateDefinition(id: string, input: UpdateClaimDefinitionInput): Promise<CustomClaimDefinition>;
 /**
- * Delete a claim definition (cascades to all associated values).
+ * Delete a claim definition through its authoritative application parent.
  *
- * Invalidates the definitions cache after deletion.
- *
- * @param id - Definition UUID
- * @throws ClaimNotFoundError if definition not found
+ * @param applicationId - Parent application UUID.
+ * @param id - Child definition UUID.
+ * @param actorId - Actor identifier available for audit attribution.
+ * @returns The captured authority identifiers.
+ * @throws ClaimNotFoundError when the definition is absent from the requested boundary.
  */
-export declare function deleteDefinition(id: string): Promise<void>;
+export declare function deleteDefinition(applicationId: string, id: string, actorId?: string): Promise<{
+    definition: CustomClaimDefinition;
+    userIds: string[];
+    grantIds: string[];
+}>;
 /**
  * Find a claim definition by ID.
  *

package/dist/custom-claims/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/custom-claims/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAuBH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,SAAS,EACV,MAAM,YAAY,CAAC;AAMpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAkChC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CA0BhC;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAE1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAc7F;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahF;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAEtF;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBlC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/custom-claims/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwBH,OAAO,KAAK,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,SAAS,EACV,MAAM,YAAY,CAAC;AAWpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAkChC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,CAAC,CA0BhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA0CvF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAE1F;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAc7F;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahF;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAEtF;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBlC"}

package/dist/custom-claims/service.js

@@ -18,11 +18,15 @@
  * @see cache.ts — Redis cache for definitions
  * @see validators.ts — Name and value validation
  */
-import { insertDefinition as repoInsertDefinition, findDefinitionById as repoFindDefinitionById, updateDefinition as repoUpdateDefinition, deleteDefinition as repoDeleteDefinition, listDefinitionsByApplication as repoListDefinitions, claimNameExists, upsertValue as repoUpsertValue, findValue as repoFindValue, deleteValue as repoDeleteValue, getValuesForUser as repoGetValuesForUser, getValuesForUserByApp, } from './repository.js';
+import { insertDefinition as repoInsertDefinition, findDefinitionById as repoFindDefinitionById, updateDefinition as repoUpdateDefinition, captureDefinitionForDeletion, deleteCapturedDefinition, listDefinitionsByApplication as repoListDefinitions, claimNameExists, upsertValue as repoUpsertValue, findValue as repoFindValue, deleteValue as repoDeleteValue, getValuesForUser as repoGetValuesForUser, getValuesForUserByApp, } from './repository.js';
 import { getCachedDefinitions, setCachedDefinitions, invalidateDefinitionsCache, } from './cache.js';
 import { validateClaimName, validateClaimValue } from './validators.js';
 import { ClaimNotFoundError, ClaimValidationError } from './errors.js';
 import { writeAuditLog } from '../lib/audit-log.js';
+import { getDatabaseTransactionClient } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { registerDeletionCleanup } from '../lib/deletion-cleanup.js';
+const CLAIM_DELETED_EVENT = 'claim.deleted';
 // ===========================================================================
 // Definition Management
 // ===========================================================================
@@ -100,33 +104,52 @@ export async function updateDefinition(id, input) {
     return updated;
 }
 /**
- * Delete a claim definition (cascades to all associated values).
+ * Delete a claim definition through its authoritative application parent.
  *
- * Invalidates the definitions cache after deletion.
- *
- * @param id - Definition UUID
- * @throws ClaimNotFoundError if definition not found
+ * @param applicationId - Parent application UUID.
+ * @param id - Child definition UUID.
+ * @param actorId - Actor identifier available for audit attribution.
+ * @returns The captured authority identifiers.
+ * @throws ClaimNotFoundError when the definition is absent from the requested boundary.
  */
-export async function deleteDefinition(id) {
-    // 1. Verify definition exists (needed for cache invalidation and audit)
-    const existing = await repoFindDefinitionById(id);
-    if (!existing) {
+export async function deleteDefinition(applicationId, id, actorId) {
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction)
+        throw new Error('Claim deletion requires an active database transaction');
+    const capture = await captureDefinitionForDeletion(applicationId, id);
+    if (!capture)
         throw new ClaimNotFoundError(id);
-    }
-    // 2. Delete from database (CASCADE removes values)
-    await repoDeleteDefinition(id);
-    // 3. Invalidate definitions cache for this application
-    await invalidateDefinitionsCache(existing.applicationId);
-    // 4. Audit log (fire-and-forget)
-    void writeAuditLog({
-        eventType: 'claim.deleted',
+    await transaction.query(`UPDATE admin_sessions SET revoked_at = NOW()
+     WHERE user_id = ANY($1::uuid[]) AND revoked_at IS NULL`, [capture.userIds]);
+    await transaction.query(`DELETE FROM oidc_payloads
+     WHERE id = ANY($1::varchar[]) OR grant_id = ANY($1::varchar[])
+       OR payload->>'accountId' = ANY($2::text[])`, [capture.grantIds, capture.userIds]);
+    await writeAuditLogInTransaction(transaction, {
+        actorId,
+        eventType: CLAIM_DELETED_EVENT,
         eventCategory: 'admin',
         metadata: {
+            applicationId,
             definitionId: id,
-            applicationId: existing.applicationId,
-            claimName: existing.claimName,
+            claimName: capture.definition.claimName,
+            claimType: capture.definition.claimType,
         },
     });
+    await deleteCapturedDefinition(applicationId, id);
+    await registerDeletionCleanup({
+        resource: 'claim',
+        targetId: id,
+        parentId: applicationId,
+        userIds: capture.userIds,
+        clientIds: [],
+        publicClientIds: [],
+        grantIds: capture.grantIds,
+        roleIds: [],
+        permissionIds: [],
+        claimIds: [id],
+        applicationIds: [applicationId],
+    });
+    return capture;
 }
 /**
  * Find a claim definition by ID.

package/dist/custom-claims/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/custom-claims/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,gBAAgB,IAAI,oBAAoB,EACxC,kBAAkB,IAAI,sBAAsB,EAC5C,gBAAgB,IAAI,oBAAoB,EACxC,gBAAgB,IAAI,oBAAoB,EACxC,4BAA4B,IAAI,mBAAmB,EACnD,eAAe,EACf,WAAW,IAAI,eAAe,EAC9B,SAAS,IAAI,aAAa,EAC1B,WAAW,IAAI,eAAe,EAC9B,gBAAgB,IAAI,oBAAoB,EACxC,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAUpD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiC;IAEjC,mDAAmD;IACnD,MAAM,cAAc,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAAC,cAAc,CAAC,MAAO,CAAC,CAAC;IACzD,CAAC;IAED,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAC5B,eAAe,KAAK,CAAC,SAAS,uCAAuC,CACtE,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,uDAAuD;IACvD,MAAM,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEtD,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;KACF,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAAiC;IAEjC,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEtD,uDAAuD;IACvD,MAAM,0BAA0B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEzD,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,mDAAmD;IACnD,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAE/B,uDAAuD;IACvD,MAAM,0BAA0B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEzD,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAE7D,sBAAsB;IACtB,MAAM,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAEvD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,OAAe,EACf,KAAc;IAEd,+CAA+C;IAC/C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,4CAA4C;IAC5C,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,MAAO,CAAC,CAAC;IAC1D,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE7D,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,iBAAiB;QAC5B,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,QAAQ,EAAE;YACR,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,OAAe;IAEf,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IAC/D,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,MAAM,WAAW,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,aAAqB,EACrB,SAAoB;IAEpB,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE5E,0DAA0D;IAC1D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACrD,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAiC,EAAE,SAAoB;IAC9E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,gBAAgB,CAAC;QACrC,KAAK,cAAc;YACjB,OAAO,UAAU,CAAC,oBAAoB,CAAC;QACzC,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,iBAAiB,CAAC;QACtC;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/custom-claims/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,gBAAgB,IAAI,oBAAoB,EACxC,kBAAkB,IAAI,sBAAsB,EAC5C,gBAAgB,IAAI,oBAAoB,EACxC,4BAA4B,EAC5B,wBAAwB,EACxB,4BAA4B,IAAI,mBAAmB,EACnD,eAAe,EACf,WAAW,IAAI,eAAe,EAC9B,SAAS,IAAI,aAAa,EAC1B,WAAW,IAAI,eAAe,EAC9B,gBAAgB,IAAI,oBAAoB,EACxC,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAE5C,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiC;IAEjC,mDAAmD;IACnD,MAAM,cAAc,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAAC,cAAc,CAAC,MAAO,CAAC,CAAC;IACzD,CAAC;IAED,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAC5B,eAAe,KAAK,CAAC,SAAS,uCAAuC,CACtE,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,uDAAuD;IACvD,MAAM,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEtD,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;KACF,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,KAAiC;IAEjC,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAEtD,uDAAuD;IACvD,MAAM,0BAA0B,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEzD,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,EAAU,EACV,OAAgB;IAEhB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,WAAW,CAAC,KAAK,CACrB;4DACwD,EACxD,CAAC,OAAO,CAAC,OAAO,CAAC,CAClB,CAAC;IACF,MAAM,WAAW,CAAC,KAAK,CACrB;;kDAE8C,EAC9C,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CACpC,CAAC;IACF,MAAM,0BAA0B,CAAC,WAAW,EAAE;QAC5C,OAAO;QACP,SAAS,EAAE,mBAAmB;QAC9B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,aAAa;YACb,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS;YACvC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS;SACxC;KACF,CAAC,CAAC;IACH,MAAM,wBAAwB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,uBAAuB,CAAC;QAC5B,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,CAAC,EAAE,CAAC;QACd,cAAc,EAAE,CAAC,aAAa,CAAC;KAChC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU;IACjD,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,aAAqB;IACzD,iBAAiB;IACjB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAE7D,sBAAsB;IACtB,MAAM,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAEvD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,OAAe,EACf,KAAc;IAEd,+CAA+C;IAC/C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,4CAA4C;IAC5C,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,eAAe,CAAC,MAAO,CAAC,CAAC;IAC1D,CAAC;IAED,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE7D,iCAAiC;IACjC,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,iBAAiB;QAC5B,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,QAAQ,EAAE;YACR,YAAY,EAAE,OAAO;YACrB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,OAAe;IAEf,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IAC/D,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,MAAM,WAAW,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,8BAA8B;IAC9B,KAAK,aAAa,CAAC;QACjB,SAAS,EAAE,qBAAqB;QAChC,aAAa,EAAE,OAAO;QACtB,MAAM;QACN,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,aAAqB,EACrB,SAAoB;IAEpB,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE5E,0DAA0D;IAC1D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACrD,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAiC,EAAE,SAAoB;IAC9E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,gBAAgB,CAAC;QACrC,KAAK,cAAc;YACjB,OAAO,UAAU,CAAC,oBAAoB,CAAC;QACzC,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,iBAAiB,CAAC;QACtC;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -15,6 +15,7 @@ import { config } from './config/index.js';
 import { logger } from './lib/logger.js';
 import { connectDatabase, disconnectDatabase } from './lib/database.js';
 import { connectRedis, disconnectRedis } from './lib/redis.js';
+import { SigningKeyCryptoError } from './lib/signing-key-crypto.js';
 import { ensureSigningKeys } from './lib/signing-keys.js';
 import { loadOidcTtlConfig } from './lib/system-config.js';
 import { createOidcProvider } from './oidc/provider.js';
@@ -84,8 +85,13 @@ async function main() {
     process.on('SIGTERM', () => shutdown('SIGTERM'));
     process.on('SIGINT', () => shutdown('SIGINT'));
 }
-main().catch((err) => {
-    logger.fatal(err, 'Failed to start server');
+main().catch((error) => {
+    if (error instanceof SigningKeyCryptoError) {
+        logger.fatal(error.message);
+    }
+    else {
+        logger.fatal(error, 'Failed to start server');
+    }
     process.exit(1);
 });
 //# sourceMappingURL=index.js.map