@portaidentity/server 1.7.3 → 1.9.0

package/dist/lib/session-tracking.d.ts

@@ -1,70 +1,130 @@
 /**
  * Session tracking repository.
  *
- * PostgreSQL mirror of Redis OIDC sessions for admin listing, filtering,
- * and revocation. All operations are fire-and-forget — tracking failures
- * must NEVER break the OIDC flow.
+ * PostgreSQL authority record for Redis-backed OIDC sessions. Session
+ * publication waits for this record so a Redis payload cannot outlive the
+ * database state used to revoke it.
  *
  * The Redis adapter calls these hooks when modelName === 'Session'.
  *
  * @module session-tracking
- * @see 05-dashboard-sessions-history.md
  */
-/** Input for creating/upserting a session tracking record */
+/** Input for creating or updating a session tracking record. */
 export interface SessionTrackingInput {
+    /** OIDC Session identifier, shared with the Redis payload key. */
     sessionId: string;
+    /** User that authenticated the Session, when authentication has completed. */
     userId?: string;
+    /** Internal client UUID when a single client can be identified. */
     clientId?: string;
+    /** Organization that owns the authenticated user. */
     organizationId?: string;
+    /** Current grant identifier when one is available at publication time. */
     grantId?: string;
+    /** Source IP address retained for administrative session inspection. */
     ipAddress?: string;
+    /** Source user agent retained for administrative session inspection. */
     userAgent?: string;
+    /** Absolute time after which the Session no longer has authority. */
     expiresAt: Date;
 }
-/** A tracked session record */
+/** A tracked session record returned from PostgreSQL. */
 export interface TrackedSession {
+    /** OIDC Session identifier. */
     sessionId: string;
+    /** Authenticated user UUID, or null before authentication completes. */
     userId: string | null;
+    /** Internal client UUID when the Session has one tracked client. */
     clientId: string | null;
+    /** Organization UUID associated with the Session. */
     organizationId: string | null;
+    /** Grant identifier captured for administrative inspection. */
     grantId: string | null;
+    /** Source IP address, when captured. */
     ipAddress: string | null;
+    /** Source user agent, when captured. */
     userAgent: string | null;
+    /** Time the tracking row was first created. */
     createdAt: Date;
+    /** Absolute authority expiry. */
     expiresAt: Date;
+    /** Time the tracking row was last refreshed. */
     lastActivityAt: Date;
+    /** Revocation time, or null while the Session remains live. */
     revokedAt: Date | null;
 }
-/** Options for listing sessions */
+/** Filters and pagination controls for session listing. */
 export interface ListSessionsOptions {
+    /** Limit results to one user UUID. */
     userId?: string;
+    /** Limit results to one organization UUID. */
     organizationId?: string;
+    /** Limit results to one internal client UUID. */
     clientId?: string;
+    /** Include revoked and expired rows when false. Defaults to true. */
     activeOnly?: boolean;
+    /** One-based result page. */
     page?: number;
+    /** Number of rows per page, clamped to 1 through 100. */
     pageSize?: number;
 }
 /**
- * Upsert a session tracking record (called on session create/update).
- * Fire-and-forget — errors are logged but never thrown.
+ * Create or update the authority record for an OIDC Session.
+ *
+ * The caller must await this operation before publishing the corresponding
+ * Redis payload. Database errors intentionally propagate because an
+ * untracked Session could otherwise continue after administrative revocation.
+ *
+ * @param input - Session identifiers and absolute expiry.
+ * @throws The PostgreSQL error when the authority record cannot be persisted.
  */
 export declare function upsertSession(input: SessionTrackingInput): Promise<void>;
 /**
- * Mark a session as revoked (called on session destroy).
- * Fire-and-forget — errors are logged but never thrown.
+ * Mark a session as revoked before its Redis payload is deleted.
+ *
+ * Database errors propagate so callers cannot report a completed logout while
+ * the durable authority record remains live.
+ *
+ * @param sessionId - OIDC Session identifier.
  */
 export declare function revokeSession(sessionId: string): Promise<void>;
+/**
+ * Revoke a session by its non-secret administrative identifier.
+ *
+ * The Redis key is returned only to the trusted route so it can remove the
+ * corresponding live session after the database update commits.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The private Redis session key, or null when no active row matched.
+ */
+export declare function revokeSessionByPublicId(publicId: string): Promise<string | null>;
 /**
  * Revoke all active sessions for a user.
+ *
+ * @param userId - User UUID whose active tracking rows are revoked.
  * Returns the number of sessions revoked.
+ * @returns Number of rows changed by PostgreSQL.
  */
 export declare function revokeUserSessions(userId: string): Promise<number>;
 /**
  * Get a single tracked session by ID.
+ *
+ * @param sessionId - OIDC Session identifier.
+ * @returns The tracking record, or null when no record exists.
  */
 export declare function getSession(sessionId: string): Promise<TrackedSession | null>;
+/**
+ * Read a tracked session through its non-secret administrative identifier.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The public tracking record, or null when no row exists.
+ */
+export declare function getSessionByPublicId(publicId: string): Promise<TrackedSession | null>;
 /**
  * List tracked sessions with filtering and pagination.
+ *
+ * @param options - Optional filters and bounded pagination controls.
+ * @returns Matching tracking rows and pagination metadata.
  */
 export declare function listSessions(options?: ListSessionsOptions): Promise<{
     data: TrackedSession[];
@@ -76,6 +136,8 @@ export declare function listSessions(options?: ListSessionsOptions): Promise<{
  * Clean up expired session tracking records older than 7 days.
  * Keeps revoked sessions for audit purposes for 7 days.
  * Fire-and-forget — designed to be called periodically.
+ *
+ * @returns Number of expired rows removed, or zero when cleanup fails.
  */
 export declare function purgeExpiredSessions(): Promise<number>;
 //# sourceMappingURL=session-tracking.d.ts.map

package/dist/lib/session-tracking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-tracking.d.ts","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B9E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUpE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAmDD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAW5D"}
+{"version":3,"file":"session-tracking.d.ts","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qDAAqD;IACrD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+CAA+C;IAC/C,SAAS,EAAE,IAAI,CAAC;IAChB,iCAAiC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,gDAAgD;IAChD,cAAc,EAAE,IAAI,CAAC;IACrB,+DAA+D;IAC/D,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUtF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAYlF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAY3F;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC,CAsDD;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAW5D"}

package/dist/lib/session-tracking.js

@@ -1,14 +1,13 @@
 /**
  * Session tracking repository.
  *
- * PostgreSQL mirror of Redis OIDC sessions for admin listing, filtering,
- * and revocation. All operations are fire-and-forget — tracking failures
- * must NEVER break the OIDC flow.
+ * PostgreSQL authority record for Redis-backed OIDC sessions. Session
+ * publication waits for this record so a Redis payload cannot outlive the
+ * database state used to revoke it.
  *
  * The Redis adapter calls these hooks when modelName === 'Session'.
  *
  * @module session-tracking
- * @see 05-dashboard-sessions-history.md
  */
 import { getPool } from './database.js';
 import { logger } from './logger.js';
@@ -16,50 +15,71 @@ import { logger } from './logger.js';
 // Repository functions
 // ============================================================================
 /**
- * Upsert a session tracking record (called on session create/update).
- * Fire-and-forget — errors are logged but never thrown.
+ * Create or update the authority record for an OIDC Session.
+ *
+ * The caller must await this operation before publishing the corresponding
+ * Redis payload. Database errors intentionally propagate because an
+ * untracked Session could otherwise continue after administrative revocation.
+ *
+ * @param input - Session identifiers and absolute expiry.
+ * @throws The PostgreSQL error when the authority record cannot be persisted.
  */
 export async function upsertSession(input) {
-    try {
-        const pool = getPool();
-        await pool.query(`INSERT INTO admin_sessions (session_id, user_id, client_id, organization_id, grant_id, ip_address, user_agent, expires_at, last_activity_at)
+    const pool = getPool();
+    await pool.query(`INSERT INTO admin_sessions (session_id, user_id, client_id, organization_id, grant_id, ip_address, user_agent, expires_at, last_activity_at)
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW())
        ON CONFLICT (session_id) DO UPDATE SET
          user_id = COALESCE(EXCLUDED.user_id, admin_sessions.user_id),
          client_id = COALESCE(EXCLUDED.client_id, admin_sessions.client_id),
          organization_id = COALESCE(EXCLUDED.organization_id, admin_sessions.organization_id),
          grant_id = COALESCE(EXCLUDED.grant_id, admin_sessions.grant_id),
+         expires_at = EXCLUDED.expires_at,
          last_activity_at = NOW()`, [
-            input.sessionId,
-            input.userId ?? null,
-            input.clientId ?? null,
-            input.organizationId ?? null,
-            input.grantId ?? null,
-            input.ipAddress ?? null,
-            input.userAgent ?? null,
-            input.expiresAt,
-        ]);
-    }
-    catch (err) {
-        logger.warn({ err, sessionId: input.sessionId }, 'Failed to upsert session tracking record');
-    }
+        input.sessionId,
+        input.userId ?? null,
+        input.clientId ?? null,
+        input.organizationId ?? null,
+        input.grantId ?? null,
+        input.ipAddress ?? null,
+        input.userAgent ?? null,
+        input.expiresAt,
+    ]);
 }
 /**
- * Mark a session as revoked (called on session destroy).
- * Fire-and-forget — errors are logged but never thrown.
+ * Mark a session as revoked before its Redis payload is deleted.
+ *
+ * Database errors propagate so callers cannot report a completed logout while
+ * the durable authority record remains live.
+ *
+ * @param sessionId - OIDC Session identifier.
  */
 export async function revokeSession(sessionId) {
-    try {
-        const pool = getPool();
-        await pool.query(`UPDATE admin_sessions SET revoked_at = NOW() WHERE session_id = $1 AND revoked_at IS NULL`, [sessionId]);
-    }
-    catch (err) {
-        logger.warn({ err, sessionId }, 'Failed to revoke session tracking record');
-    }
+    const pool = getPool();
+    await pool.query(`UPDATE admin_sessions SET revoked_at = NOW() WHERE session_id = $1 AND revoked_at IS NULL`, [sessionId]);
+}
+/**
+ * Revoke a session by its non-secret administrative identifier.
+ *
+ * The Redis key is returned only to the trusted route so it can remove the
+ * corresponding live session after the database update commits.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The private Redis session key, or null when no active row matched.
+ */
+export async function revokeSessionByPublicId(publicId) {
+    const pool = getPool();
+    const { rows } = await pool.query(`UPDATE admin_sessions
+     SET revoked_at = NOW()
+     WHERE public_id = $1 AND revoked_at IS NULL
+     RETURNING session_id AS "sessionId"`, [publicId]);
+    return rows[0]?.sessionId ?? null;
 }
 /**
  * Revoke all active sessions for a user.
+ *
+ * @param userId - User UUID whose active tracking rows are revoked.
  * Returns the number of sessions revoked.
+ * @returns Number of rows changed by PostgreSQL.
  */
 export async function revokeUserSessions(userId) {
     const pool = getPool();
@@ -68,6 +88,9 @@ export async function revokeUserSessions(userId) {
 }
 /**
  * Get a single tracked session by ID.
+ *
+ * @param sessionId - OIDC Session identifier.
+ * @returns The tracking record, or null when no record exists.
  */
 export async function getSession(sessionId) {
     const pool = getPool();
@@ -79,8 +102,27 @@ export async function getSession(sessionId) {
      FROM admin_sessions WHERE session_id = $1`, [sessionId]);
     return rows[0] ?? null;
 }
+/**
+ * Read a tracked session through its non-secret administrative identifier.
+ *
+ * @param publicId - UUID exposed by the administrative API.
+ * @returns The public tracking record, or null when no row exists.
+ */
+export async function getSessionByPublicId(publicId) {
+    const pool = getPool();
+    const { rows } = await pool.query(`SELECT public_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
+            organization_id AS "organizationId", grant_id AS "grantId",
+            ip_address AS "ipAddress", user_agent AS "userAgent",
+            created_at AS "createdAt", expires_at AS "expiresAt",
+            last_activity_at AS "lastActivityAt", revoked_at AS "revokedAt"
+     FROM admin_sessions WHERE public_id = $1`, [publicId]);
+    return rows[0] ?? null;
+}
 /**
  * List tracked sessions with filtering and pagination.
+ *
+ * @param options - Optional filters and bounded pagination controls.
+ * @returns Matching tracking rows and pagination metadata.
  */
 export async function listSessions(options = {}) {
     const pool = getPool();
@@ -110,7 +152,7 @@ export async function listSessions(options = {}) {
     const where = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
     const [countResult, dataResult] = await Promise.all([
         pool.query(`SELECT COUNT(*)::text AS count FROM admin_sessions ${where}`, params),
-        pool.query(`SELECT session_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
+        pool.query(`SELECT public_id AS "sessionId", user_id AS "userId", client_id AS "clientId",
               organization_id AS "organizationId", grant_id AS "grantId",
               ip_address AS "ipAddress", user_agent AS "userAgent",
               created_at AS "createdAt", expires_at AS "expiresAt",
@@ -130,6 +172,8 @@ export async function listSessions(options = {}) {
  * Clean up expired session tracking records older than 7 days.
  * Keeps revoked sessions for audit purposes for 7 days.
  * Fire-and-forget — designed to be called periodically.
+ *
+ * @returns Number of expired rows removed, or zero when cleanup fails.
  */
 export async function purgeExpiredSessions() {
     try {

package/dist/lib/session-tracking.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-tracking.js","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA2CrC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAA2B;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;kCAO4B,EAC5B;YACE,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,MAAM,IAAI,IAAI;YACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;YACtB,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5B,KAAK,CAAC,OAAO,IAAI,IAAI;YACrB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,SAAS;SAChB,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CACd,2FAA2F,EAC3F,CAAC,SAAS,CAAC,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,wFAAwF,EACxF,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,QAAQ,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;+CAK2C,EAC3C,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO,GAAwB,EAAE;IAMlE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,cAAc,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,gCAAgC;QAChC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,IAAI,CAAC,KAAK,CAAoB,sDAAsD,KAAK,EAAE,EAAE,MAAM,CAAC;QACpG,IAAI,CAAC,KAAK,CACR;;;;;6BAKuB,KAAK;;gBAElB,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EAChD,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,yEAAyE,CAC1E,CAAC;QACF,OAAO,QAAQ,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"session-tracking.js","sourceRoot":"","sources":["../../src/lib/session-tracking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAoErC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAA2B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;;;kCAQ8B,EAC9B;QACE,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,MAAM,IAAI,IAAI;QACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,OAAO,IAAI,IAAI;QACrB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS;KAChB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,CAAC,KAAK,CACd,2FAA2F,EAC3F,CAAC,SAAS,CAAC,CACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;yCAGqC,EACrC,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,wFAAwF,EACxF,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,QAAQ,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;+CAK2C,EAC3C,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;;;;8CAK0C,EAC1C,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAO,GAAwB,EAAE;IAMlE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IAErC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,cAAc,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,UAAU,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,gCAAgC;QAChC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,IAAI,CAAC,KAAK,CACR,sDAAsD,KAAK,EAAE,EAC7D,MAAM,CACP;QACD,IAAI,CAAC,KAAK,CACR;;;;;6BAKuB,KAAK;;gBAElB,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EAChD,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACnC,yEAAyE,CAC1E,CAAC;QACF,OAAO,QAAQ,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/lib/signing-key-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing-key-crypto.d.ts","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAyBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,MAAM,CA0BR"}
+{"version":3,"file":"signing-key-crypto.d.ts","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAyBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,MAAM,CAyBR"}

package/dist/lib/signing-key-crypto.js

@@ -85,11 +85,10 @@ export function decryptPrivateKey(encrypted, iv, tag, encryptionKey) {
         ]);
         return decrypted.toString('utf8');
     }
-    catch (error) {
-        // Re-throw as a domain error — the underlying error may be
-        // "Unsupported state or unable to authenticate data" (wrong key/tag)
-        const message = error instanceof Error ? error.message : 'Unknown decryption error';
-        throw new SigningKeyCryptoError(`Decryption failed: ${message}`);
+    catch {
+        // Cryptographic library errors can contain operational details. Callers receive one stable
+        // domain message so neither logs nor CLI output accidentally disclose those details.
+        throw new SigningKeyCryptoError('Signing key record is invalid');
     }
 }
 /**

package/dist/lib/signing-key-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing-key-crypto.js","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,oCAAoC;AACpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gCAAgC;AACtD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,aAAqB;IAErB,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACtD,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,EAAU,EACV,GAAW,EACX,aAAqB;IAErB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EACtB,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;QAEF,8DAA8D;QAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2DAA2D;QAC3D,qEAAqE;QACrE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACpF,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"signing-key-crypto.js","sourceRoot":"","sources":["../../src/lib/signing-key-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,oCAAoC;AACpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,gCAAgC;AACtD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAEpD;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,aAAqB;IAErB,4DAA4D;IAC5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,iEAAiE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACtD,aAAa,EAAE,UAAU;KAC1B,CAAC,CAAC;IAEH,sCAAsC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,EAAU,EACV,GAAW,EACX,aAAqB;IAErB,MAAM,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,SAAS,EACT,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EACtB,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;QAEF,8DAA8D;QAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/lib/signing-keys.d.ts

@@ -125,10 +125,9 @@ export declare function loadSigningKeysFromDb(): Promise<SigningKeyRecord[]>;
 /**
  * Ensure at least one active signing key exists in the database.
  *
- * Called at application startup. If no active keys are found:
- * 1. Generate a new ES256 key pair
- * 2. Insert it into the signing_keys table with status='active'
- * 3. Log a warning that a key was auto-generated
+ * Called at application startup. A transaction-scoped table lock serializes the active-key
+ * recheck and optional encrypted insert, so simultaneous new processes cannot each create a
+ * bootstrap key. Every caller reloads the committed rows after releasing the lock.
  *
  * This guarantees the OIDC provider can always start, even on a fresh database
  * that has no signing keys yet (e.g., first run after migrations).

package/dist/lib/signing-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing-keys.d.ts","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH;;;;;;;;GAQG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAUrE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,IAAI,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAoBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAapE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAcrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuDzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAgCzE"}
+{"version":3,"file":"signing-keys.d.ts","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0BH;;;;;;;;GAQG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAkBrE;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAIrC;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,iCAAiC;IACjC,WAAW,EAAE,IAAI,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,kDAAkD;IAClD,CAAC,EAAE,MAAM,CAAC;IACV,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,CAoBA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAapE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAYrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyDzE;AAgBD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CAiCzE"}

package/dist/lib/signing-keys.js

@@ -17,15 +17,18 @@
  */
 import { createPrivateKey, generateKeyPairSync, createHash } from 'node:crypto';
 import { config } from '../config/index.js';
-import { getPool } from './database.js';
+import { getPool, runDatabaseTransaction } from './database.js';
 import { logger } from './logger.js';
-import { encryptPrivateKey, decryptPrivateKey } from './signing-key-crypto.js';
+import { encryptPrivateKey, decryptPrivateKey, SigningKeyCryptoError, } from './signing-key-crypto.js';
 // ---------------------------------------------------------------------------
 // Cached JWKS for JWT verification (admin auth middleware, etc.)
 // ---------------------------------------------------------------------------
 /** In-memory cache for the active JWK set — avoids a DB round-trip per request */
 let cachedJwks = null;
+/** Millisecond timestamp of the currently installed cache entry. */
 let jwksCacheTimestamp = 0;
+/** Monotonic invalidation marker used to reject stale in-flight cache installations. */
+let jwksCacheGeneration = 0;
 /** Cache TTL for the active JWK set — 60 seconds matches system-config cache */
 const JWKS_CACHE_TTL_MS = 60_000;
 /**
@@ -42,15 +45,22 @@ export async function getActiveJwks() {
     if (cachedJwks && now - jwksCacheTimestamp < JWKS_CACHE_TTL_MS) {
         return cachedJwks;
     }
+    const loadGeneration = jwksCacheGeneration;
     const records = await loadSigningKeysFromDb();
-    cachedJwks = signingKeysToJwks(records);
-    jwksCacheTimestamp = now;
-    return cachedJwks;
+    const loadedJwks = signingKeysToJwks(records);
+    // A mutation may invalidate the cache while this database read is pending. The caller may use
+    // its completed snapshot, but installing it would make later callers observe stale key state.
+    if (loadGeneration === jwksCacheGeneration) {
+        cachedJwks = loadedJwks;
+        jwksCacheTimestamp = now;
+    }
+    return loadedJwks;
 }
 /**
  * Clear the cached JWK set — useful for testing and after key rotation.
  */
 export function clearJwksCache() {
+    jwksCacheGeneration += 1;
     cachedJwks = null;
     jwksCacheTimestamp = 0;
 }
@@ -120,10 +130,8 @@ export function signingKeysToJwks(records) {
         try {
             keys.push(pemToJwk(record.privateKey, record.kid));
         }
-        catch (error) {
-            // Skip invalid PEM keys rather than crashing — log error and continue
-            // with remaining keys so the provider can still start
-            logger.error({ kid: record.kid, error }, 'Failed to convert signing key PEM to JWK, skipping');
+        catch {
+            throw invalidSigningKeyRecord(record.kid);
         }
     }
     return { keys };
@@ -146,38 +154,51 @@ export async function loadSigningKeysFromDb() {
      WHERE status IN ('active', 'retired')
        AND (expires_at IS NULL OR expires_at > NOW())
      ORDER BY activated_at DESC`);
-    // Map snake_case DB columns to camelCase TypeScript interface.
-    // Decrypt private keys that are stored encrypted; pass through plaintext legacy keys.
+    // Map snake_case DB columns to camelCase TypeScript interface. Every private key must use the
+    // authenticated encrypted representation; accepting a partial or plaintext row would weaken
+    // the storage guarantee and could expose key material through later error handling.
     return result.rows.map((row) => {
-        let privateKey;
-        if (row.encrypted && row.private_key_iv && row.private_key_tag) {
-            // Encrypted key — decrypt with AES-256-GCM
-            privateKey = decryptPrivateKey(row.private_key, row.private_key_iv, row.private_key_tag, config.signingKeyEncryptionKey);
+        if (!row.encrypted || !row.private_key_iv || !row.private_key_tag) {
+            throw invalidSigningKeyRecord(row.kid);
+        }
+        try {
+            const privateKey = decryptPrivateKey(row.private_key, row.private_key_iv, row.private_key_tag, config.signingKeyEncryptionKey);
+            return {
+                id: row.id,
+                kid: row.kid,
+                algorithm: row.algorithm,
+                publicKey: row.public_key,
+                privateKey,
+                status: row.status,
+                activatedAt: row.activated_at,
+                retiredAt: row.retired_at,
+                expiresAt: row.expires_at,
+            };
         }
-        else {
-            // Legacy plaintext key — use as-is
-            privateKey = row.private_key;
+        catch {
+            throw invalidSigningKeyRecord(row.kid);
         }
-        return {
-            id: row.id,
-            kid: row.kid,
-            algorithm: row.algorithm,
-            publicKey: row.public_key,
-            privateKey,
-            status: row.status,
-            activatedAt: row.activated_at,
-            retiredAt: row.retired_at,
-            expiresAt: row.expires_at,
-        };
     });
 }
+/**
+ * Creates and records the fixed failure used for any unusable stored signing key.
+ *
+ * Only the public key identifier is logged. Ciphertext, metadata, parser errors, and stack traces
+ * are deliberately omitted because they can reveal secrets or internal deployment details.
+ *
+ * @param kid - Public identifier of the unusable database row.
+ * @returns A safe domain error suitable for propagation to startup and CLI boundaries.
+ */
+function invalidSigningKeyRecord(kid) {
+    logger.error({ event: 'signing-key-record-invalid', kid }, 'Signing key record is invalid');
+    return new SigningKeyCryptoError('Signing key record is invalid');
+}
 /**
  * Ensure at least one active signing key exists in the database.
  *
- * Called at application startup. If no active keys are found:
- * 1. Generate a new ES256 key pair
- * 2. Insert it into the signing_keys table with status='active'
- * 3. Log a warning that a key was auto-generated
+ * Called at application startup. A transaction-scoped table lock serializes the active-key
+ * recheck and optional encrypted insert, so simultaneous new processes cannot each create a
+ * bootstrap key. Every caller reloads the committed rows after releasing the lock.
  *
  * This guarantees the OIDC provider can always start, even on a fresh database
  * that has no signing keys yet (e.g., first run after migrations).
@@ -185,22 +206,26 @@ export async function loadSigningKeysFromDb() {
  * @returns The JWK key set containing all active and retired keys
  */
 export async function ensureSigningKeys() {
-    let records = await loadSigningKeysFromDb();
-    // Check if there are any active keys
-    const hasActiveKey = records.some((r) => r.status === 'active');
-    if (!hasActiveKey) {
+    await runDatabaseTransaction(async () => {
+        const pool = getPool();
+        await pool.query('LOCK TABLE signing_keys IN SHARE ROW EXCLUSIVE MODE');
+        // Recheck under the lock because another process may have inserted the first key while this
+        // process was waiting. Only the lock holder that still sees no active key may create one.
+        const lockedRecords = await loadSigningKeysFromDb();
+        if (lockedRecords.some((record) => record.status === 'active'))
+            return;
         logger.warn('No active signing keys found — auto-generating a new ES256 key pair');
         const keyPair = generateES256KeyPair();
-        const pool = getPool();
         // Encrypt the private key before storage (AES-256-GCM)
         const { encrypted, iv, tag } = encryptPrivateKey(keyPair.privateKeyPem, config.signingKeyEncryptionKey);
         // Insert the new key with encrypted private key
         await pool.query(`INSERT INTO signing_keys (kid, algorithm, public_key, private_key, private_key_iv, private_key_tag, encrypted, status, activated_at)
        VALUES ($1, $2, $3, $4, $5, $6, true, 'active', NOW())`, [keyPair.kid, keyPair.algorithm, keyPair.publicKeyPem, encrypted, iv, tag]);
         logger.info({ kid: keyPair.kid }, 'Auto-generated signing key inserted into database');
-        // Reload keys from DB to get the full record including generated UUID
-        records = await loadSigningKeysFromDb();
-    }
+    });
+    // Every caller reloads after the lock transaction commits. This gives both the inserting caller
+    // and any waiter the same authoritative winner, including its database-generated identifier.
+    const records = await loadSigningKeysFromDb();
     return signingKeysToJwks(records);
 }
 //# sourceMappingURL=signing-keys.js.map

package/dist/lib/signing-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing-keys.js","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE/E,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,kFAAkF;AAClF,IAAI,UAAU,GAAkC,IAAI,CAAC;AACrD,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAE3B,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,UAAU,IAAI,GAAG,GAAG,kBAAkB,GAAG,iBAAiB,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,kBAAkB,GAAG,GAAG,CAAC;IACzB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,UAAU,GAAG,IAAI,CAAC;IAClB,kBAAkB,GAAG,CAAC,CAAC;AACzB,CAAC;AA6CD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAMlC,qDAAqD;IACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACjF,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAEpF,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAErF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,OAAO;QAClB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,GAAW;IACtD,qCAAqC;IACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhD,OAAO;QACL,GAAG,GAAG;QACN,GAAG;QACH,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO;KACC,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,IAAI,GAAiB,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,sDAAsD;YACtD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,oDAAoD,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAc7B;;;;;;gCAM4B,CAC7B,CAAC;IAEF,+DAA+D;IAC/D,sFAAsF;IACtF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,IAAI,UAAkB,CAAC;QACvB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YAC/D,2CAA2C;YAC3C,UAAU,GAAG,iBAAiB,CAC5B,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,cAAc,EAClB,GAAG,CAAC,eAAe,EACnB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,mCAAmC;YACnC,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;QAC/B,CAAC;QAED,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAE5C,qCAAqC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAEnF,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QAEvB,uDAAuD;QACvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAC9C,OAAO,CAAC,aAAa,EACrB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QAEF,gDAAgD;QAChD,MAAM,IAAI,CAAC,KAAK,CACd;8DACwD,EACxD,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAC3E,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAEvF,sEAAsE;QACtE,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"signing-keys.js","sourceRoot":"","sources":["../../src/lib/signing-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,kFAAkF;AAClF,IAAI,UAAU,GAAkC,IAAI,CAAC;AACrD,oEAAoE;AACpE,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAC3B,wFAAwF;AACxF,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAE5B,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,UAAU,IAAI,GAAG,GAAG,kBAAkB,GAAG,iBAAiB,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,cAAc,GAAG,mBAAmB,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE9C,8FAA8F;IAC9F,8FAA8F;IAC9F,IAAI,cAAc,KAAK,mBAAmB,EAAE,CAAC;QAC3C,UAAU,GAAG,UAAU,CAAC;QACxB,kBAAkB,GAAG,GAAG,CAAC;IAC3B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,mBAAmB,IAAI,CAAC,CAAC;IACzB,UAAU,GAAG,IAAI,CAAC;IAClB,kBAAkB,GAAG,CAAC,CAAC;AACzB,CAAC;AA6CD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAMlC,qDAAqD;IACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC1D,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACjF,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAEpF,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAErF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,OAAO;QAClB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,GAAW;IACtD,qCAAqC;IACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhD,OAAO;QACL,GAAG,GAAG;QACN,GAAG;QACH,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO;KACC,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,IAAI,GAAiB,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAc7B;;;;;;gCAM4B,CAC7B,CAAC;IAEF,8FAA8F;IAC9F,4FAA4F;IAC5F,oFAAoF;IACpF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAClE,MAAM,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,iBAAiB,CAClC,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,cAAc,EAClB,GAAG,CAAC,eAAe,EACnB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;YAEF,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,UAAU;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,+BAA+B,CAAC,CAAC;IAC5F,OAAO,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACtC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAExE,4FAA4F;QAC5F,0FAA0F;QAC1F,MAAM,aAAa,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACpD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;YAAE,OAAO;QAEvE,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QAEvC,uDAAuD;QACvD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAC9C,OAAO,CAAC,aAAa,EACrB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QAEF,gDAAgD;QAChD,MAAM,IAAI,CAAC,KAAK,CACd;8DACwD,EACxD,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAC3E,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,gGAAgG;IAChG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC9C,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}