@portaidentity/server 1.7.3 → 1.8.0

package/dist/lib/logger.js

@@ -1,24 +1,39 @@
 import { pino, stdSerializers } from 'pino';
+import { resolveJsonLogFormat } from './log-format.js';
 const operationalLogObservers = new Set();
+let levelBeforeOperationalObservation = null;
 /**
  * Observe arguments delivered to the production logger boundary.
  *
  * This is intended for owner-controlled diagnostics and executable privacy validation. Observers
  * are process-local, receive no replay buffer, and must detach immediately after their bounded
- * operation. They cannot alter, suppress, or replace the actual log write.
+ * operation. While at least one observer is attached, the logger accepts every level so the
+ * observer can validate calls hidden by a quiet test configuration. The original level is restored
+ * after the final observer detaches. Observers cannot alter, suppress, or replace a log write.
  *
  * @param observer - Callback receiving one JSON representation per logger call.
  * @returns A function which removes exactly this observer.
  */
 export function observeOperationalLogOutput(observer) {
+    if (operationalLogObservers.size === 0) {
+        levelBeforeOperationalObservation = logger.level;
+        logger.level = 'trace';
+    }
     operationalLogObservers.add(observer);
-    return () => operationalLogObservers.delete(observer);
+    return () => {
+        operationalLogObservers.delete(observer);
+        if (operationalLogObservers.size === 0 && levelBeforeOperationalObservation !== null) {
+            logger.level = levelBeforeOperationalObservation;
+            levelBeforeOperationalObservation = null;
+        }
+    };
 }
-const isProduction = process.env.NODE_ENV === 'production';
 const isTest = process.env.NODE_ENV === 'test';
 export const logger = pino({
     level: process.env.LOG_LEVEL || (isTest ? 'silent' : 'info'),
-    transport: !isProduction ? { target: 'pino-pretty', options: { colorize: true } } : undefined,
+    transport: resolveJsonLogFormat()
+        ? undefined
+        : { target: 'pino-pretty', options: { colorize: true } },
     serializers: {
         err: stdSerializers.err,
         req: stdSerializers.req,
@@ -46,12 +61,14 @@ export const logger = pino({
             'cookie',
             'refresh_token',
             'client_secret',
+            'urn:porta:internal_application_id',
             'req.headers.authorization',
             'req.headers.cookie',
             '*.password',
             '*.token',
             '*.refresh_token',
             '*.client_secret',
+            '*.urn:porta:internal_application_id',
             '*.authorization',
             'email',
             'userId',

package/dist/lib/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAK5C,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC;IAC1E,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAE/C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAC7F,WAAW,EAAE;QACX,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;KACxB;IACD,KAAK,EAAE;QACL,SAAS,CAAC,UAAU,EAAE,MAAM;YAC1B,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;gBAChE,KAAK,MAAM,QAAQ,IAAI,uBAAuB;oBAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;KACF;IACD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,EAAE;QACN,KAAK,EAAE;YACL,UAAU;YACV,OAAO;YACP,eAAe;YACf,QAAQ;YACR,eAAe;YACf,eAAe;YACf,2BAA2B;YAC3B,oBAAoB;YACpB,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,iBAAiB;YACjB,iBAAiB;YACjB,OAAO;YACP,QAAQ;YACR,gBAAgB;YAChB,KAAK;YACL,gBAAgB;YAChB,SAAS;YACT,UAAU;YACV,kBAAkB;YAClB,OAAO;YACP,kBAAkB;SACnB;QACD,MAAM,EAAE,YAAY;KACrB;CACF,CAAC,CAAC;AAEH,oGAAoG;AACpG,SAAS,gCAAgC,CAAC,UAAqB;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;YACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,CAAC;IAC5C,CAAC;AACH,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAKvD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAClE,IAAI,iCAAiC,GAAkB,IAAI,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC;IAC1E,IAAI,uBAAuB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,iCAAiC,GAAG,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;IACzB,CAAC;IACD,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,EAAE;QACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,uBAAuB,CAAC,IAAI,KAAK,CAAC,IAAI,iCAAiC,KAAK,IAAI,EAAE,CAAC;YACrF,MAAM,CAAC,KAAK,GAAG,iCAAiC,CAAC;YACjD,iCAAiC,GAAG,IAAI,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAE/C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,oBAAoB,EAAE;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IAC1D,WAAW,EAAE;QACX,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;KACxB;IACD,KAAK,EAAE;QACL,SAAS,CAAC,UAAU,EAAE,MAAM;YAC1B,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;gBAChE,KAAK,MAAM,QAAQ,IAAI,uBAAuB;oBAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;KACF;IACD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,EAAE;QACN,KAAK,EAAE;YACL,UAAU;YACV,OAAO;YACP,eAAe;YACf,QAAQ;YACR,eAAe;YACf,eAAe;YACf,mCAAmC;YACnC,2BAA2B;YAC3B,oBAAoB;YACpB,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,iBAAiB;YACjB,qCAAqC;YACrC,iBAAiB;YACjB,OAAO;YACP,QAAQ;YACR,gBAAgB;YAChB,KAAK;YACL,gBAAgB;YAChB,SAAS;YACT,UAAU;YACV,kBAAkB;YAClB,OAAO;YACP,kBAAkB;SACnB;QACD,MAAM,EAAE,YAAY;KACrB;CACF,CAAC,CAAC;AAEH,oGAAoG;AACpG,SAAS,gCAAgC,CAAC,UAAqB;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;YACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/lib/redis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAMhC,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAcnD;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAGhC;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAShC,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAenD;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAGhC;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/lib/redis.js

@@ -2,8 +2,11 @@ import { Redis } from 'ioredis';
 import { config } from '../config/index.js';
 import { logger } from './logger.js';
 let redis = null;
+/** Maximum time one Redis command may hold a public request while Redis is unavailable. */
+const REDIS_COMMAND_TIMEOUT_MS = 1000;
 export async function connectRedis() {
     redis = new Redis(config.redisUrl, {
+        commandTimeout: REDIS_COMMAND_TIMEOUT_MS,
         maxRetriesPerRequest: 3,
         lazyConnect: true,
     });

package/dist/lib/redis.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,KAAK,GAAiB,IAAI,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,KAAK,GAAiB,IAAI,CAAC;AAE/B,2FAA2F;AAC3F,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjC,cAAc,EAAE,wBAAwB;QACxC,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/lib/session-tracking.d.ts

@@ -1,70 +1,130 @@
 /**
  * Session tracking repository.
  *
- * PostgreSQL mirror of Redis OIDC sessions for admin listing, filtering,
- * and revocation. All operations are fire-and-forget — tracking failures
- * must NEVER break the OIDC flow.
+ * PostgreSQL authority record for Redis-backed OIDC sessions. Session
+ * publication waits for this record so a Redis payload cannot outlive the
+ * database state used to revoke it.
  *
  * The Redis adapter calls these hooks when modelName === 'Session'.
  *
  * @module session-tracking
- * @see 05-dashboard-sessions-history.md
  */
-/** Input for creating/upserting a session tracking record */
+/** Input for creating or updating a session tracking record. */
 export interface SessionTrackingInput {
+    /** OIDC Session identifier, shared with the Redis payload key. */
     sessionId: string;
+    /** User that authenticated the Session, when authentication has completed. */
     userId?: string;
+    /** Internal client UUID when a single client can be identified. */
     clientId?: string;
+    /** Organization that owns the authenticated user. */
     organizationId?: string;
+    /** Current grant identifier when one is available at publication time. */
     grantId?: string;
+    /** Source IP address retained for administrative session inspection. */
     ipAddress?: string;
+    /** Source user agent retained for administrative session inspection. */
     userAgent?: string;
+    /** Absolute time after which the Session no longer has authority. */
     expiresAt: Date;
 }
-/** A tracked session record */
+/** A tracked session record returned from PostgreSQL. */
 export interface TrackedSession {
+    /** OIDC Session identifier. */
     sessionId: string;
+    /** Authenticated user UUID, or null before authentication completes. */
     userId: string | null;
+    /** Internal client UUID when the Session has one tracked client. */
     clientId: string | null;
+    /** Organization UUID associated with the Session. */
     organizationId: string | null;
+    /** Grant identifier captured for administrative inspection. */
     grantId: string | null;
+    /** Source IP address, when captured. */
     ipAddress: string | null;
+    /** Source user agent, when captured. */
     userAgent: string | null;
+    /** Time the tracking row was first created. */
     createdAt: Date;
+    /** Absolute authority expiry. */
     expiresAt: Date;
+    /** Time the tracking row was last refreshed. */
     lastActivityAt: Date;
+    /** Revocation time, or null while the Session remains live. */
     revokedAt: Date | null;
 }
-/** Options for listing sessions */
+/** Filters and pagination controls for session listing. */
 export interface ListSessionsOptions {
+    /** Limit results to one user UUID. */
     userId?: string;
+    /** Limit results to one organization UUID. */
     organizationId?: string;
+    /** Limit results to one internal client UUID. */
     clientId?: string;
+    /** Include revoked and expired rows when false. Defaults to true. */
     activeOnly?: boolean;
+    /** One-based result page. */
     page?: number;
+    /** Number of rows per page, clamped to 1 through 100. */
     pageSize?: number;
 }
 /**
- * Upsert a session tracking record (called on session create/update).
- * Fire-and-forget — errors are logged but never thrown.
+ * Create or update the authority record for an OIDC Session.
+ *
+ * The caller must await this operation before publishing the corresponding
+ * Redis payload. Database errors intentionally propagate because an
+ * untracked Session could otherwise continue after administrative revocation.
+ *
+ * @param input - Session identifiers and absolute expiry.
+ * @throws The PostgreSQL error when the authority record cannot be persisted.
  */
 export declare function upsertSession(input: SessionTrackingInput): Promise<void>;
 /**
- * Mark a session as revoked (called on session destroy).
- * Fire-and-forget — errors are logged but never thrown.
+ * Mark a session as revoked before its Redis payload is deleted.
+ *
+ * Database errors propagate so callers cannot report a completed logout while
+ * the durable authority record remains live.
+ *
+ * @param sessionId - OIDC Session identifier.
  */
 export declare function revokeSession(sessionId: string): Promise<void>;
+/**
+ * Revoke a session by its non-secret administrative identifier.
+ *
+ * The Redis key is returned only to the trusted route so it can remove the
+ * corresponding live session after the database update commits.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The private Redis session key, or null when no active row matched.
+ */
+export declare function revokeSessionByPublicId(publicId: string): Promise<string | null>;
 /**
  * Revoke all active sessions for a user.
+ *
+ * @param userId - User UUID whose active tracking rows are revoked.
  * Returns the number of sessions revoked.
+ * @returns Number of rows changed by PostgreSQL.
  */
 export declare function revokeUserSessions(userId: string): Promise<number>;
 /**
  * Get a single tracked session by ID.
+ *
+ * @param sessionId - OIDC Session identifier.
+ * @returns The tracking record, or null when no record exists.
  */
 export declare function getSession(sessionId: string): Promise<TrackedSession | null>;
+/**
+ * Read a tracked session through its non-secret administrative identifier.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The public tracking record, or null when no row exists.
+ */
+export declare function getSessionByPublicId(publicId: string): Promise<TrackedSession | null>;
 /**
  * List tracked sessions with filtering and pagination.
+ *
+ * @param options - Optional filters and bounded pagination controls.
+ * @returns Matching tracking rows and pagination metadata.
  */
 export declare function listSessions(options?: ListSessionsOptions): Promise<{
     data: TrackedSession[];
@@ -76,6 +136,8 @@ export declare function listSessions(options?: ListSessionsOptions): Promise<{
  * Clean up expired session tracking records older than 7 days.
  * Keeps revoked sessions for audit purposes for 7 days.
  * Fire-and-forget — designed to be called periodically.
+ *
+ * @returns Number of expired rows removed, or zero when cleanup fails.
  */
 export declare function purgeExpiredSessions(): Promise<number>;
 //# sourceMappingURL=session-tracking.d.ts.map

package/dist/lib/session-tracking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-tracking.d.ts","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUpE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAmDD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAW5D"}
+{"version":3,"file":"session-tracking.d.ts","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qDAAqD;IACrD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+CAA+C;IAC/C,SAAS,EAAE,IAAI,CAAC;IAChB,iCAAiC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,gDAAgD;IAChD,cAAc,EAAE,IAAI,CAAC;IACrB,+DAA+D;IAC/D,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAYlF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAY3F;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAsDD;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAW5D"}

package/dist/lib/session-tracking.js

@@ -1,14 +1,13 @@
 /**
  * Session tracking repository.
  *
- * PostgreSQL mirror of Redis OIDC sessions for admin listing, filtering,
- * and revocation. All operations are fire-and-forget — tracking failures
- * must NEVER break the OIDC flow.
+ * PostgreSQL authority record for Redis-backed OIDC sessions. Session
+ * publication waits for this record so a Redis payload cannot outlive the
+ * database state used to revoke it.
  *
  * The Redis adapter calls these hooks when modelName === 'Session'.
  *
  * @module session-tracking
- * @see 05-dashboard-sessions-history.md
  */
 import { getPool } from './database.js';
 import { logger } from './logger.js';
@@ -16,50 +15,71 @@ import { logger } from './logger.js';
 // Repository functions
 // ============================================================================
 /**
- * Upsert a session tracking record (called on session create/update).
- * Fire-and-forget — errors are logged but never thrown.
+ * Create or update the authority record for an OIDC Session.
+ *
+ * The caller must await this operation before publishing the corresponding
+ * Redis payload. Database errors intentionally propagate because an
+ * untracked Session could otherwise continue after administrative revocation.
+ *
+ * @param input - Session identifiers and absolute expiry.
+ * @throws The PostgreSQL error when the authority record cannot be persisted.
  */
 export async function upsertSession(input) {
-    try {
-        const pool = getPool();
-        await pool.query(`INSERT INTO admin_sessions (session_id, user_id, client_id, organization_id, grant_id, ip_address, user_agent, expires_at, last_activity_at)
+    const pool = getPool();
+    await pool.query(`INSERT INTO admin_sessions (session_id, user_id, client_id, organization_id, grant_id, ip_address, user_agent, expires_at, last_activity_at)
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW())
        ON CONFLICT (session_id) DO UPDATE SET
          user_id = COALESCE(EXCLUDED.user_id, admin_sessions.user_id),
          client_id = COALESCE(EXCLUDED.client_id, admin_sessions.client_id),
          organization_id = COALESCE(EXCLUDED.organization_id, admin_sessions.organization_id),
          grant_id = COALESCE(EXCLUDED.grant_id, admin_sessions.grant_id),
+         expires_at = EXCLUDED.expires_at,
          last_activity_at = NOW()`, [
-            input.sessionId,
-            input.userId ?? null,
-            input.clientId ?? null,
-            input.organizationId ?? null,
-            input.grantId ?? null,
-            input.ipAddress ?? null,
-            input.userAgent ?? null,
-            input.expiresAt,
-        ]);
-    }
-    catch (err) {
-        logger.warn({ err, sessionId: input.sessionId }, 'Failed to upsert session tracking record');
-    }
+        input.sessionId,
+        input.userId ?? null,
+        input.clientId ?? null,
+        input.organizationId ?? null,
+        input.grantId ?? null,
+        input.ipAddress ?? null,
+        input.userAgent ?? null,
+        input.expiresAt,
+    ]);
 }
 /**
- * Mark a session as revoked (called on session destroy).
- * Fire-and-forget — errors are logged but never thrown.
+ * Mark a session as revoked before its Redis payload is deleted.
+ *
+ * Database errors propagate so callers cannot report a completed logout while
+ * the durable authority record remains live.
+ *
+ * @param sessionId - OIDC Session identifier.
  */
 export async function revokeSession(sessionId) {
-    try {
-        const pool = getPool();
-        await pool.query(`UPDATE admin_sessions SET revoked_at = NOW() WHERE session_id = $1 AND revoked_at IS NULL`, [sessionId]);
-    }
-    catch (err) {
-        logger.warn({ err, sessionId }, 'Failed to revoke session tracking record');
-    }
+    const pool = getPool();
+    await pool.query(`UPDATE admin_sessions SET revoked_at = NOW() WHERE session_id = $1 AND revoked_at IS NULL`, [sessionId]);
+}
+/**
+ * Revoke a session by its non-secret administrative identifier.
+ *
+ * The Redis key is returned only to the trusted route so it can remove the
+ * corresponding live session after the database update commits.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The private Redis session key, or null when no active row matched.
+ */
+export async function revokeSessionByPublicId(publicId) {
+    const pool = getPool();
+    const { rows } = await pool.query(`UPDATE admin_sessions
+     SET revoked_at = NOW()
+     WHERE public_id = $1 AND revoked_at IS NULL
+     RETURNING session_id AS "sessionId"`, [publicId]);
+    return rows[0]?.sessionId ?? null;
 }
 /**
  * Revoke all active sessions for a user.
+ *
+ * @param userId - User UUID whose active tracking rows are revoked.
  * Returns the number of sessions revoked.
+ * @returns Number of rows changed by PostgreSQL.
  */
 export async function revokeUserSessions(userId) {
     const pool = getPool();
@@ -68,6 +88,9 @@ export async function revokeUserSessions(userId) {
 }
 /**
  * Get a single tracked session by ID.
+ *
+ * @param sessionId - OIDC Session identifier.
+ * @returns The tracking record, or null when no record exists.
  */
 export async function getSession(sessionId) {
     const pool = getPool();
@@ -79,8 +102,27 @@ export async function getSession(sessionId) {
      FROM admin_sessions WHERE session_id = $1`, [sessionId]);
     return rows[0] ?? null;
 }
+/**
+ * Read a tracked session through its non-secret administrative identifier.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The public tracking record, or null when no row exists.
+ */
+export async function getSessionByPublicId(publicId) {
+    const pool = getPool();
+    const { rows } = await pool.query(`SELECT public_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
+            organization_id AS "organizationId", grant_id AS "grantId",
+            ip_address AS "ipAddress", user_agent AS "userAgent",
+            created_at AS "createdAt", expires_at AS "expiresAt",
+            last_activity_at AS "lastActivityAt", revoked_at AS "revokedAt"
+     FROM admin_sessions WHERE public_id = $1`, [publicId]);
+    return rows[0] ?? null;
+}
 /**
  * List tracked sessions with filtering and pagination.
+ *
+ * @param options - Optional filters and bounded pagination controls.
+ * @returns Matching tracking rows and pagination metadata.
  */
 export async function listSessions(options = {}) {
     const pool = getPool();
@@ -110,7 +152,7 @@ export async function listSessions(options = {}) {
     const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(*)::text AS count FROM admin_sessions ${where}`, params),
-        pool.query(`SELECT session_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
+        pool.query(`SELECT public_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
               organization_id AS "organizationId", grant_id AS "grantId",
               ip_address AS "ipAddress", user_agent AS "userAgent",
               created_at AS "createdAt", expires_at AS "expiresAt",
@@ -130,6 +172,8 @@ export async function listSessions(options = {}) {
  * Clean up expired session tracking records older than 7 days.
  * Keeps revoked sessions for audit purposes for 7 days.
  * Fire-and-forget — designed to be called periodically.
+ *
+ * @returns Number of expired rows removed, or zero when cleanup fails.
  */
 export async function purgeExpiredSessions() {
     try {

package/dist/lib/session-tracking.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-tracking.js","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA2CrC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAA2B;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;kCAO4B,EAC5B;YACE,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,MAAM,IAAI,IAAI;YACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;YACtB,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5B,KAAK,CAAC,OAAO,IAAI,IAAI;YACrB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,SAAS;SAChB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CACd,2FAA2F,EAC3F,CAAC,SAAS,CAAC,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,wFAAwF,EACxF,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,QAAQ,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;+CAK2C,EAC3C,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO,GAAwB,EAAE;IAMlE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,cAAc,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,gCAAgC;QAChC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,IAAI,CAAC,KAAK,CAAoB,sDAAsD,KAAK,EAAE,EAAE,MAAM,CAAC;QACpG,IAAI,CAAC,KAAK,CACR;;;;;6BAKuB,KAAK;;gBAElB,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EAChD,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,yEAAyE,CAC1E,CAAC;QACF,OAAO,QAAQ,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"session-tracking.js","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAoErC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAA2B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;kCAQ8B,EAC9B;QACE,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,MAAM,IAAI,IAAI;QACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS;KAChB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,KAAK,CACd,2FAA2F,EAC3F,CAAC,SAAS,CAAC,CACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;yCAGqC,EACrC,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,wFAAwF,EACxF,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,QAAQ,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;+CAK2C,EAC3C,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;8CAK0C,EAC1C,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO,GAAwB,EAAE;IAMlE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,cAAc,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,gCAAgC;QAChC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,IAAI,CAAC,KAAK,CACR,sDAAsD,KAAK,EAAE,EAC7D,MAAM,CACP;QACD,IAAI,CAAC,KAAK,CACR;;;;;6BAKuB,KAAK;;gBAElB,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EAChD,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,yEAAyE,CAC1E,CAAC;QACF,OAAO,QAAQ,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/lib/signing-key-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing-key-crypto.d.ts","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAyBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,MAAM,CA0BR"}
+{"version":3,"file":"signing-key-crypto.d.ts","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAyBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,MAAM,CAyBR"}

package/dist/lib/signing-key-crypto.js

@@ -85,11 +85,10 @@ export function decryptPrivateKey(encrypted, iv, tag, encryptionKey) {
         ]);
         return decrypted.toString('utf8');
     }
-    catch (error) {
-        // Re-throw as a domain error — the underlying error may be
-        // "Unsupported state or unable to authenticate data" (wrong key/tag)
-        const message = error instanceof Error ? error.message : 'Unknown decryption error';
-        throw new SigningKeyCryptoError(`Decryption failed: ${message}`);
+    catch {
+        // Cryptographic library errors can contain operational details. Callers receive one stable
+        // domain message so neither logs nor CLI output accidentally disclose those details.
+        throw new SigningKeyCryptoError('Signing key record is invalid');
     }
 }
 /**

package/dist/lib/signing-key-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing-key-crypto.js","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,oCAAoC;AACpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gCAAgC;AACtD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,aAAqB;IAErB,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACtD,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,EAAU,EACV,GAAW,EACX,aAAqB;IAErB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EACtB,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;QAEF,8DAA8D;QAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2DAA2D;QAC3D,qEAAqE;QACrE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACpF,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"signing-key-crypto.js","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,oCAAoC;AACpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gCAAgC;AACtD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,aAAqB;IAErB,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACtD,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,EAAU,EACV,GAAW,EACX,aAAqB;IAErB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EACtB,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;QAEF,8DAA8D;QAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/lib/signing-keys.d.ts

@@ -125,10 +125,9 @@ export declare function loadSigningKeysFromDb(): Promise<SigningKeyRecord[]>;
 /**
  * Ensure at least one active signing key exists in the database.
  *
- * Called at application startup. If no active keys are found:
- * 1. Generate a new ES256 key pair
- * 2. Insert it into the signing_keys table with status='active'
- * 3. Log a warning that a key was auto-generated
+ * Called at application startup. A transaction-scoped table lock serializes the active-key
+ * recheck and optional encrypted insert, so simultaneous new processes cannot each create a
+ * bootstrap key. Every caller reloads the committed rows after releasing the lock.
  *
  * This guarantees the OIDC provider can always start, even on a fresh database
  * that has no signing keys yet (e.g., first run after migrations).

package/dist/lib/signing-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing-keys.d.ts","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH;;;;;;;;GAQG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAUrE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,IAAI,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAoBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAapE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAcrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuDzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAgCzE"}
+{"version":3,"file":"signing-keys.d.ts","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0BH;;;;;;;;GAQG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAkBrE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAIrC;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,IAAI,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAoBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAapE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAYrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyDzE;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAiCzE"}