@portaidentity/server 1.7.3 → 1.9.0

package/dist/clients/secret-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-repository.d.ts","sourceRoot":"","sources":["../../src/clients/secret-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAOhE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAWhF;AAMD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAa9C;AAMD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU3E;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;AAMD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAWvF;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBpF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1E"}
+{"version":3,"file":"secret-repository.d.ts","sourceRoot":"","sources":["../../src/clients/secret-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAOhE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uEAAuE;IACvE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CA6BhF;AAMD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CASnF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAa9C;AAMD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAY7F;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;AAMD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAWvF;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBpF;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAY9C;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1E"}

package/dist/clients/secret-repository.js

@@ -10,26 +10,45 @@
  * - Insert hashed secret
  * - List secrets (metadata only, no hashes)
  * - Find active secrets with hashes (for verification only)
- * - Revoke secrets
+ * - Permanently delete secrets
  * - Update last_used_at timestamp
  * - Cleanup expired secrets
  */
-import { getPool } from '../lib/database.js';
+import { getPool, runDatabaseTransaction } from '../lib/database.js';
+import { ClientNotFoundError, ClientValidationError } from './errors.js';
 import { mapRowToClientSecret } from './types.js';
 /**
  * Insert a new client secret.
  *
- * Stores the Argon2id hash — never the plaintext.
+ * Stores the Argon2id hash — never the plaintext. The client row is locked while
+ * counting and inserting so concurrent callers cannot exceed ten active,
+ * unexpired secrets.
  *
  * @param data - Secret data including the hash
  * @returns The created secret metadata (without hash)
+ * @throws ClientNotFoundError when the client is absent or public
+ * @throws ClientValidationError when the client already has ten active secrets
  */
 export async function insertSecret(data) {
-    const pool = getPool();
-    const result = await pool.query(`INSERT INTO client_secrets (client_id, secret_hash, secret_sha256, label, expires_at)
-     VALUES ($1, $2, $3, $4, $5)
-     RETURNING *`, [data.clientId, data.secretHash, data.secretSha256, data.label, data.expiresAt]);
-    return mapRowToClientSecret(result.rows[0]);
+    return runDatabaseTransaction(async () => {
+        const db = getPool();
+        const parent = await db.query('SELECT id, client_type, status FROM clients WHERE id = $1 FOR UPDATE', [data.clientId]);
+        const eligible = parent.rows[0];
+        if (eligible === undefined || eligible.client_type !== 'confidential') {
+            throw new ClientNotFoundError(data.clientId);
+        }
+        const active = await db.query(`SELECT COUNT(*)::text AS count FROM client_secrets
+       WHERE client_id = $1
+         AND status = 'active'
+         AND (expires_at IS NULL OR expires_at > NOW())`, [data.clientId]);
+        if (Number(active.rows[0]?.count ?? '0') >= 10) {
+            throw new ClientValidationError('Client secret active limit reached');
+        }
+        const result = await db.query(`INSERT INTO client_secrets (client_id, secret_hash, secret_sha256, label, expires_at)
+       VALUES ($1, $2, $3, $4, $5)
+       RETURNING *`, [data.clientId, data.secretHash, data.secretSha256, data.label, data.expiresAt]);
+        return mapRowToClientSecret(result.rows[0]);
+    });
 }
 // ===========================================================================
 // Find / List
@@ -48,12 +67,13 @@ export async function listSecretsByClient(clientId) {
 /**
  * Find a specific secret by ID.
  *
+ * @param clientId - Authoritative parent client UUID
  * @param id - Secret UUID
  * @returns Secret metadata or null
  */
-export async function findSecretById(id) {
+export async function findSecretById(clientId, id) {
     const pool = getPool();
-    const result = await pool.query('SELECT * FROM client_secrets WHERE id = $1', [id]);
+    const result = await pool.query('SELECT * FROM client_secrets WHERE client_id = $1 AND id = $2', [clientId, id]);
     if (result.rows.length === 0)
         return null;
     return mapRowToClientSecret(result.rows[0]);
@@ -81,16 +101,17 @@ export async function getActiveSecretHashes(clientId) {
 // Update
 // ===========================================================================
 /**
- * Revoke a secret (set status = 'revoked').
- *
- * This is a permanent operation — revoked secrets cannot be reactivated.
+ * Permanently delete a secret.
  *
+ * @param clientId - Authoritative parent client UUID
  * @param id - Secret UUID
- * @returns Updated secret metadata, or null if not found
+ * @returns Deleted secret metadata, or null if absent or owned by another client
  */
-export async function revokeSecret(id) {
+export async function revokeSecret(clientId, id) {
     const pool = getPool();
-    const result = await pool.query(`UPDATE client_secrets SET status = 'revoked' WHERE id = $1 RETURNING *`, [id]);
+    const result = await pool.query(`DELETE FROM client_secrets
+     WHERE client_id = $1 AND id = $2
+     RETURNING *`, [clientId, id]);
     if (result.rows.length === 0)
         return null;
     return mapRowToClientSecret(result.rows[0]);
@@ -149,6 +170,38 @@ export async function getLatestActiveSha256(clientId) {
         return null;
     return result.rows[0].secret_sha256;
 }
+/**
+ * Find an active modern secret by its indexed SHA-256 value.
+ *
+ * @param clientId - Parent client UUID
+ * @param secretSha256 - SHA-256 digest of the presented credential
+ * @returns Matching secret ID, or null when no active credential matches
+ */
+export async function findActiveSecretIdBySha256(clientId, secretSha256) {
+    const result = await getPool().query(`SELECT id FROM client_secrets
+     WHERE client_id = $1
+       AND secret_sha256 = $2
+       AND status = 'active'
+       AND (expires_at IS NULL OR expires_at > NOW())
+     LIMIT 1`, [clientId, secretSha256]);
+    return result.rows[0]?.id ?? null;
+}
+/**
+ * Load at most eleven active Argon2-only credentials so callers can reject over-limit data.
+ *
+ * @param clientId - Parent client UUID
+ * @returns Active legacy secret identifiers and hashes, newest first
+ */
+export async function getActiveLegacySecretHashes(clientId) {
+    const result = await getPool().query(`SELECT id, secret_hash FROM client_secrets
+     WHERE client_id = $1
+       AND secret_sha256 IS NULL
+       AND status = 'active'
+       AND (expires_at IS NULL OR expires_at > NOW())
+     ORDER BY created_at DESC
+     LIMIT 11`, [clientId]);
+    return result.rows.map((row) => ({ id: row.id, hash: row.secret_hash }));
+}
 /**
  * Count active secrets for a client.
  *

package/dist/clients/secret-repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-repository.js","sourceRoot":"","sources":["../../src/clients/secret-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAelD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;iBAEa,EACb,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAChF,CAAC;IAEF,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4EAA4E,EAC5E,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4CAA4C,EAC5C,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;8BAI0B,EAC1B,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,wEAAwE,EACxE,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,IAAI,CAAC,KAAK,CACd,8DAA8D,EAC9D,CAAC,EAAE,CAAC,CACL,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAa,GAAW,EAAE;IACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;kFAE8E,EAC9E,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IAC1D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;aAMS,EACT,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;sDAGkD,EAClD,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"secret-repository.js","sourceRoot":"","sources":["../../src/clients/secret-repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAoBlD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,sEAAsE,EACtE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;YACtE,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;;;wDAGkD,EAClD,CAAC,IAAI,CAAC,QAAQ,CAAC,CAChB,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B;;mBAEa,EACb,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAChF,CAAC;QACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4EAA4E,EAC5E,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,EAAU;IAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,+DAA+D,EAC/D,CAAC,QAAQ,EAAE,EAAE,CAAC,CACf,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;8BAI0B,EAC1B,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,EAAU;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;iBAEa,EACb,CAAC,QAAQ,EAAE,EAAE,CAAC,CACf,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,IAAI,CAAC,KAAK,CAAC,8DAA8D,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAa,GAAW,EAAE;IACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;kFAE8E,EAC9E,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,OAAO,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IAC1D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;aAMS,EACT,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,YAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;;;;aAKS,EACT,CAAC,QAAQ,EAAE,YAAY,CAAC,CACzB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;;;;;cAMU,EACV,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;sDAGkD,EAClD,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/clients/secret-service.d.ts

@@ -4,7 +4,7 @@
  * Handles the full lifecycle of OIDC client secrets:
  *   - Generate and store new secrets (Argon2id hashed)
  *   - Verify secrets during token endpoint authentication
- *   - Revoke secrets permanently
+ *   - Delete secrets permanently
  *   - List secrets (metadata only, never hashes)
  *   - Cleanup expired secrets
  *
@@ -17,7 +17,7 @@
  *
  * This service is consumed by:
  *   - The client service (initial secret on confidential client creation)
- *   - The API routes (secret rotation, revocation)
+ *   - The API routes (secret creation and deletion)
  *   - The OIDC token endpoint (secret verification via admin API)
  */
 import type { ClientSecret, SecretWithPlaintext, CreateSecretInput } from './types.js';
@@ -55,18 +55,14 @@ export declare function generateAndStore(clientDbId: string, input?: CreateSecre
  */
 export declare function verify(clientDbId: string, plaintext: string): Promise<boolean>;
 /**
- * Revoke a client secret permanently.
- *
- * Revocation is irreversible — once revoked, a secret cannot be
- * reactivated. The revoked secret remains in the database for
- * audit trail purposes until cleanup removes it.
+ * Permanently delete a client secret.
  *
+ * @param clientDbId - Authoritative parent client UUID
  * @param secretId - Secret UUID
  * @param actorId - UUID of the user performing the action
  * @throws ClientNotFoundError if secret not found
- * @throws ClientValidationError if secret already revoked
  */
-export declare function revoke(secretId: string, actorId?: string): Promise<void>;
+export declare function revoke(clientDbId: string, secretId: string, actorId?: string): Promise<void>;
 /**
  * List all secrets for a client (metadata only, never hashes).
  *

package/dist/clients/secret-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-service.d.ts","sourceRoot":"","sources":["../../src/clients/secret-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmBvF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,iBAAsB,EAC7B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAyC9B;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAyClB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAE9E;AAMD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E"}
+{"version":3,"file":"secret-service.d.ts","sourceRoot":"","sources":["../../src/clients/secret-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmBvF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,iBAAsB,EAC7B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAyC9B;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyCpF;AAMD;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAE9E;AAMD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E"}

package/dist/clients/secret-service.js

@@ -4,7 +4,7 @@
  * Handles the full lifecycle of OIDC client secrets:
  *   - Generate and store new secrets (Argon2id hashed)
  *   - Verify secrets during token endpoint authentication
- *   - Revoke secrets permanently
+ *   - Delete secrets permanently
  *   - List secrets (metadata only, never hashes)
  *   - Cleanup expired secrets
  *
@@ -17,14 +17,14 @@
  *
  * This service is consumed by:
  *   - The client service (initial secret on confidential client creation)
- *   - The API routes (secret rotation, revocation)
+ *   - The API routes (secret creation and deletion)
  *   - The OIDC token endpoint (secret verification via admin API)
  */
 import { insertSecret, listSecretsByClient, findSecretById, getActiveSecretHashes, revokeSecret as repoRevokeSecret, updateLastUsedAt, cleanupExpiredSecrets, } from './secret-repository.js';
 import { generateSecret, hashSecret, sha256Secret, verifySecretHash } from './crypto.js';
 import { writeAuditLog } from '../lib/audit-log.js';
 import { logger } from '../lib/logger.js';
-import { ClientNotFoundError, ClientValidationError } from './errors.js';
+import { ClientNotFoundError } from './errors.js';
 // ===========================================================================
 // Secret generation
 // ===========================================================================
@@ -136,35 +136,26 @@ export async function verify(clientDbId, plaintext) {
     }
 }
 // ===========================================================================
-// Secret revocation
+// Secret deletion
 // ===========================================================================
 /**
- * Revoke a client secret permanently.
- *
- * Revocation is irreversible — once revoked, a secret cannot be
- * reactivated. The revoked secret remains in the database for
- * audit trail purposes until cleanup removes it.
+ * Permanently delete a client secret.
  *
+ * @param clientDbId - Authoritative parent client UUID
  * @param secretId - Secret UUID
  * @param actorId - UUID of the user performing the action
  * @throws ClientNotFoundError if secret not found
- * @throws ClientValidationError if secret already revoked
  */
-export async function revoke(secretId, actorId) {
-    // Validate secret exists
-    const secret = await findSecretById(secretId);
-    if (!secret) {
+export async function revoke(clientDbId, secretId, actorId) {
+    const existing = await findSecretById(clientDbId, secretId);
+    if (!existing || existing.clientId !== clientDbId)
+        throw new ClientNotFoundError(secretId);
+    const secret = await repoRevokeSecret(clientDbId, secretId);
+    if (!secret)
         throw new ClientNotFoundError(secretId);
-    }
-    // Validate secret is not already revoked
-    if (secret.status === 'revoked') {
-        throw new ClientValidationError('Secret is already revoked');
-    }
-    // Revoke in database
-    await repoRevokeSecret(secretId);
     // Audit log (fire-and-forget)
     await writeAuditLog({
-        eventType: 'client.secret.revoked',
+        eventType: 'client.secret.deleted',
         eventCategory: 'admin',
         actorId,
         metadata: {

package/dist/clients/secret-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-service.js","sourceRoot":"","sources":["../../src/clients/secret-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,YAAY,IAAI,gBAAgB,EAChC,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzE,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAK,GAAsB,EAAE,EAC7B,OAAgB;IAEhB,4BAA4B;IAC5B,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IAEnC,+CAA+C;IAC/C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAE/C,0DAA0D;IAC1D,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7C,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,QAAQ,EAAE,UAAU;QACpB,UAAU;QACV,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,SAAS,EAAE,yBAAyB;QACpC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;SACnD;KACF,CAAC,CAAC;IAEH,+DAA+D;IAC/D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,UAAkB,EAClB,SAAiB;IAEjB,IAAI,CAAC;QACH,6CAA6C;QAC7C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAE9D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAE/D,IAAI,OAAO,EAAE,CAAC;gBACZ,kDAAkD;gBAClD,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAElC,qCAAqC;gBACrC,MAAM,aAAa,CAAC;oBAClB,SAAS,EAAE,wBAAwB;oBACnC,aAAa,EAAE,gBAAgB;oBAC/B,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;iBACxD,CAAC,CAAC;gBAEH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,aAAa,CAAC;YAClB,SAAS,EAAE,sBAAsB;YACjC,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAC,MAAM,EAAE;SAC5E,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAgB,EAChB,OAAgB;IAEhB,yBAAyB;IACzB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,qBAAqB;IACrB,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEjC,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAsB;IACzD,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"secret-service.js","sourceRoot":"","sources":["../../src/clients/secret-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,YAAY,IAAI,gBAAgB,EAChC,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAK,GAAsB,EAAE,EAC7B,OAAgB;IAEhB,4BAA4B;IAC5B,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IAEnC,+CAA+C;IAC/C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAE/C,0DAA0D;IAC1D,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7C,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,QAAQ,EAAE,UAAU;QACpB,UAAU;QACV,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,SAAS,EAAE,yBAAyB;QACpC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;SACnD;KACF,CAAC,CAAC;IAEH,+DAA+D;IAC/D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,UAAkB,EAAE,SAAiB;IAChE,IAAI,CAAC;QACH,6CAA6C;QAC7C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAE9D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAE/D,IAAI,OAAO,EAAE,CAAC;gBACZ,kDAAkD;gBAClD,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAElC,qCAAqC;gBACrC,MAAM,aAAa,CAAC;oBAClB,SAAS,EAAE,wBAAwB;oBACnC,aAAa,EAAE,gBAAgB;oBAC/B,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;iBACxD,CAAC,CAAC;gBAEH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,aAAa,CAAC;YAClB,SAAS,EAAE,sBAAsB;YACjC,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,CAAC,MAAM,EAAE;SAC5E,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,UAAkB,EAClB,QAAgB,EAChB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU;QAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAErD,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAsB;IACzD,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAC;AAC9C,CAAC"}

package/dist/clients/service.d.ts

@@ -19,7 +19,7 @@
  * metadata format, used by the adapter factory during OIDC operations.
  */
 import type { Client, ClientWithSecret, CreateClientInput, UpdateClientInput, ListClientsOptions, PaginatedResult } from './types.js';
-import type { ListClientsCursorOptions } from './repository.js';
+import type { ClientDeletionCapture, ListClientsCursorOptions } from './repository.js';
 import type { CursorPaginatedResult } from '../lib/cursor.js';
 /**
  * Create a new OIDC client.
@@ -114,18 +114,6 @@ export declare function deactivateClient(id: string, actorId?: string): Promise<
  * @throws ClientValidationError if not currently inactive
  */
 export declare function activateClient(id: string, actorId?: string): Promise<void>;
-/**
- * Revoke a client (active or inactive → revoked).
- *
- * Revocation is permanent — revoked clients cannot be reactivated.
- * This effectively disables the client for all OIDC operations.
- *
- * @param id - Client internal UUID
- * @param actorId - UUID of the user performing the action
- * @throws ClientNotFoundError if not found
- * @throws ClientValidationError if already revoked
- */
-export declare function revokeClient(id: string, actorId?: string): Promise<void>;
 /**
  * Find a client by OIDC client_id and return oidc-provider metadata format.
  *
@@ -155,4 +143,13 @@ export declare function findForOidc(clientId: string): Promise<Record<string, un
  * @returns true if secret matches any active hash, false otherwise
  */
 export declare function verifyClientSecret(clientId: string, plaintext: string): Promise<boolean>;
+/**
+ * Physically delete an OIDC client after capturing its protocol authority.
+ *
+ * @param id - Internal client UUID.
+ * @param actorId - Actor identifier available for audit attribution.
+ * @returns The graph captured before PostgreSQL applied its cascade.
+ * @throws ClientNotFoundError when the client does not exist.
+ */
+export declare function deleteClient(id: string, actorId?: string): Promise<ClientDeletionCapture>;
 //# sourceMappingURL=service.d.ts.map

package/dist/clients/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/clients/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,MAAM,EACN,gBAAgB,EAChB,iBAAiB,EAEjB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAUpB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AA4E9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CA2F3B;AAOD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWtE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWlF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,iBAAiB,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CA6EjB;AAOD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAClD,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GACjD,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAExC;AAgBD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAqBf;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAoD9C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/clients/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,MAAM,EACN,gBAAgB,EAChB,iBAAiB,EAEjB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EAChB,MAAM,YAAY,CAAC;AAYpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAsG9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC,CAsG3B;AAMD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWtE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWlF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,iBAAiB,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAsGjB;AAMD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,GAClD,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GACjD,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAElC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAExC;AAgBD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBlF;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CA6DhG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW9F;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsC/F"}

package/dist/clients/service.js

@@ -19,17 +19,20 @@
  * metadata format, used by the adapter factory during OIDC operations.
  */
 import { LOGIN_METHODS } from './types.js';
-import { insertClient, findClientById, findClientByClientId, updateClient as repoUpdateClient, listClients as repoListClients, listClientsCursor as repoListClientsCursor, } from './repository.js';
+import { insertClient, findClientById, findClientByClientId, updateClient as repoUpdateClient, listClients as repoListClients, listClientsCursor as repoListClientsCursor, captureClientForDeletion, deleteCapturedClient, } from './repository.js';
 import { getLatestActiveSha256 } from './secret-repository.js';
 import { getCachedClientByClientId, getCachedClientById, cacheClient, invalidateClientCache, } from './cache.js';
 import { generateClientId } from './crypto.js';
-import { validateRedirectUris, getDefaultGrantTypes, getDefaultTokenEndpointAuthMethod, getDefaultResponseTypes, getDefaultScope, } from './validators.js';
+import { validateRedirectUris, getDefaultGrantTypes, getDefaultTokenEndpointAuthMethod, getDefaultResponseTypes, getDefaultScope, validateClientProtocolCompatibility, } from './validators.js';
 import { normalizeLoginMethods } from './resolve-login-methods.js';
 import { verify } from './secret-service.js';
 import { writeAuditLog } from '../lib/audit-log.js';
 import { ClientNotFoundError, ClientValidationError } from './errors.js';
 import { getApplicationById } from '../applications/service.js';
 import { getOrganizationById } from '../organizations/service.js';
+import { getDatabaseTransactionClient } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { registerDeletionCleanup } from '../lib/deletion-cleanup.js';
 // ===========================================================================
 // Validation helpers (private)
 // ===========================================================================
@@ -67,6 +70,21 @@ function validateClientLoginMethods(methods) {
     }
     return normalizeLoginMethods(methods);
 }
+/** Validate a complete protocol configuration and map failures to the client domain error. */
+function requireCompatibleProtocol(configuration) {
+    if (configuration.tokenEndpointAuthMethod !== 'client_secret_basic' &&
+        configuration.tokenEndpointAuthMethod !== 'client_secret_post' &&
+        configuration.tokenEndpointAuthMethod !== 'none') {
+        throw new ClientValidationError('Unsupported token endpoint authentication method');
+    }
+    const result = validateClientProtocolCompatibility({
+        ...configuration,
+        tokenEndpointAuthMethod: configuration.tokenEndpointAuthMethod,
+    });
+    if (!result.isValid) {
+        throw new ClientValidationError(result.errors.join('; '));
+    }
+}
 // ===========================================================================
 // Client CRUD
 // ===========================================================================
@@ -119,13 +137,22 @@ export async function createClient(input, actorId) {
         throw new ClientValidationError(`Invalid redirect URIs: ${uriValidation.errors.join('; ')}`);
     }
     // Apply defaults for optional fields
-    const grantTypes = input.grantTypes ??
-        getDefaultGrantTypes(input.clientType, input.applicationType);
+    const grantTypes = input.grantTypes ?? getDefaultGrantTypes(input.clientType, input.applicationType);
     const responseTypes = input.responseTypes ?? getDefaultResponseTypes();
     const scope = input.scope ?? getDefaultScope();
-    const tokenEndpointAuthMethod = input.tokenEndpointAuthMethod ??
-        getDefaultTokenEndpointAuthMethod(input.clientType);
+    const tokenEndpointAuthMethod = input.tokenEndpointAuthMethod ?? getDefaultTokenEndpointAuthMethod(input.clientType);
     const requirePkce = input.requirePkce ?? true;
+    const requireConsent = input.requireConsent ?? false;
+    requireCompatibleProtocol({
+        clientType: input.clientType,
+        redirectUris: input.redirectUris,
+        postLogoutRedirectUris: input.postLogoutRedirectUris ?? [],
+        grantTypes,
+        responseTypes,
+        tokenEndpointAuthMethod,
+        requirePkce,
+        allowedOrigins: input.allowedOrigins ?? [],
+    });
     // Validate + normalize the login-method override (may throw). Three-state
     // input: undefined → column omitted → DB DEFAULT NULL → inherit.
     // null → inherit explicitly. Array → override with validated methods.
@@ -148,6 +175,7 @@ export async function createClient(input, actorId) {
         tokenEndpointAuthMethod,
         allowedOrigins: input.allowedOrigins ?? [],
         requirePkce,
+        requireConsent,
         // Pass through validated value as-is: `undefined` triggers column
         // omission (DB default), `null` inserts NULL explicitly, array inserts
         // the validated methods. The repo honors all three states.
@@ -239,6 +267,30 @@ export async function updateClient(id, input, actorId) {
             throw new ClientValidationError(`Invalid redirect URIs: ${uriValidation.errors.join('; ')}`);
         }
     }
+    const changesProtocol = [
+        input.redirectUris,
+        input.postLogoutRedirectUris,
+        input.grantTypes,
+        input.responseTypes,
+        input.tokenEndpointAuthMethod,
+        input.allowedOrigins,
+        input.requirePkce,
+    ].some((value) => value !== undefined);
+    if (changesProtocol) {
+        const existing = await getClientById(id);
+        if (!existing)
+            throw new ClientNotFoundError(id);
+        requireCompatibleProtocol({
+            clientType: existing.clientType,
+            redirectUris: input.redirectUris ?? existing.redirectUris,
+            postLogoutRedirectUris: input.postLogoutRedirectUris ?? existing.postLogoutRedirectUris,
+            grantTypes: input.grantTypes ?? existing.grantTypes,
+            responseTypes: input.responseTypes ?? existing.responseTypes,
+            tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? existing.tokenEndpointAuthMethod,
+            requirePkce: input.requirePkce ?? existing.requirePkce,
+            allowedOrigins: input.allowedOrigins ?? existing.allowedOrigins,
+        });
+    }
     // Build update data from input
     const updateData = {};
     if (input.clientName !== undefined)
@@ -259,6 +311,8 @@ export async function updateClient(id, input, actorId) {
         updateData.allowedOrigins = input.allowedOrigins;
     if (input.requirePkce !== undefined)
         updateData.requirePkce = input.requirePkce;
+    if (input.requireConsent !== undefined)
+        updateData.requireConsent = input.requireConsent;
     // Validate + normalize the login-method override if the caller passed the
     // key (including `null` = clear). Capture the previous value first for the
     // audit log diff — we use the cache-aware accessor so stale reads don't
@@ -401,36 +455,6 @@ export async function activateClient(id, actorId) {
         metadata: { clientDbId: client.id, clientId: client.clientId },
     });
 }
-/**
- * Revoke a client (active or inactive → revoked).
- *
- * Revocation is permanent — revoked clients cannot be reactivated.
- * This effectively disables the client for all OIDC operations.
- *
- * @param id - Client internal UUID
- * @param actorId - UUID of the user performing the action
- * @throws ClientNotFoundError if not found
- * @throws ClientValidationError if already revoked
- */
-export async function revokeClient(id, actorId) {
-    const client = await loadClientForStatusChange(id);
-    if (client.status === 'revoked') {
-        throw new ClientValidationError('Client is already revoked');
-    }
-    await repoUpdateClient(id, { status: 'revoked' });
-    await invalidateClientCache(client.clientId, client.id);
-    await writeAuditLog({
-        organizationId: client.organizationId,
-        eventType: 'client.revoked',
-        eventCategory: 'admin',
-        actorId,
-        metadata: {
-            clientDbId: client.id,
-            clientId: client.clientId,
-            previousStatus: client.status,
-        },
-    });
-}
 // ===========================================================================
 // OIDC integration
 // ===========================================================================
@@ -448,7 +472,9 @@ export async function revokeClient(id, actorId) {
  * @returns OIDC client metadata object, or undefined if not found/inactive
  */
 export async function findForOidc(clientId) {
-    const client = await getClientByClientId(clientId);
+    // Protocol authority must come from PostgreSQL. Administrative cache reads
+    // remain useful elsewhere, but stale metadata cannot authorize an OIDC flow.
+    const client = await findClientByClientId(clientId);
     // Client must exist and be active for OIDC operations
     if (!client || client.status !== 'active') {
         return undefined;
@@ -463,9 +489,7 @@ export async function findForOidc(clientId) {
         grant_types: client.grantTypes,
         response_types: client.responseTypes,
         scope: client.scope,
-        token_endpoint_auth_method: client.clientType === 'public'
-            ? 'none'
-            : client.tokenEndpointAuthMethod,
+        token_endpoint_auth_method: client.clientType === 'public' ? 'none' : client.tokenEndpointAuthMethod,
         // Porta uses ES256 signing keys — must declare this explicitly
         // or oidc-provider defaults to RS256 and rejects the client.
         id_token_signed_response_alg: 'ES256',
@@ -473,6 +497,9 @@ export async function findForOidc(clientId) {
         'urn:porta:allowed_origins': client.allowedOrigins,
         // Client type for internal use
         'urn:porta:client_type': client.clientType,
+        // Public authorization-code clients always require PKCE. Confidential clients preserve the
+        // administrator's persisted choice and the provider reads it through registered metadata.
+        'urn:porta:require_pkce': client.requirePkce,
         // Per-client login-methods override. Null means "inherit org default";
         // a non-null array is the validated override. The OIDC configuration
         // layer registers this URN under `extraClientMetadata.properties` so
@@ -480,9 +507,15 @@ export async function findForOidc(clientId) {
         // the interaction handlers — where `resolveLoginMethodsFromOidcClient()`
         // combines it with the org default to compute the effective methods.
         'urn:porta:login_methods': client.loginMethods,
-        // Organization ID — used by auto-consent logic in showConsent() to
-        // identify first-party clients (same org → skip consent screen)
+        // Internal authority boundary consumed only while building this client's claims.
+        // Keeping the value in provider metadata avoids a database lookup on every claim request.
+        'urn:porta:internal_application_id': client.applicationId,
+        // Organization ID — the tenant that owns the client.
         organizationId: client.organizationId,
+        // Whether the client must ask the end user for consent. The consent gate
+        // in showConsent() renders the consent page when this is true and a
+        // requested scope has not already been granted.
+        requireConsent: client.requireConsent,
     };
     // For confidential clients, include the SHA-256 hash as client_secret.
     // oidc-provider will compare this against the SHA-256 of the presented
@@ -520,4 +553,50 @@ export async function verifyClientSecret(clientId, plaintext) {
     // Delegate to secret-service which checks all active, non-expired hashes
     return verify(client.id, plaintext);
 }
+/**
+ * Physically delete an OIDC client after capturing its protocol authority.
+ *
+ * @param id - Internal client UUID.
+ * @param actorId - Actor identifier available for audit attribution.
+ * @returns The graph captured before PostgreSQL applied its cascade.
+ * @throws ClientNotFoundError when the client does not exist.
+ */
+export async function deleteClient(id, actorId) {
+    const transaction = getDatabaseTransactionClient();
+    if (!transaction)
+        throw new Error('Client deletion requires an active database transaction');
+    const capture = await captureClientForDeletion(id);
+    if (!capture)
+        throw new ClientNotFoundError(id);
+    await transaction.query(`DELETE FROM oidc_payloads
+     WHERE id = ANY($1::varchar[]) OR grant_id = ANY($1::varchar[])
+       OR payload->>'clientId' = ANY($2::text[])`, [capture.grantIds, capture.publicClientIds]);
+    await writeAuditLogInTransaction(transaction, {
+        organizationId: capture.client.organizationId,
+        actorId,
+        eventType: 'client.deleted',
+        eventCategory: 'admin',
+        metadata: {
+            clientDbId: capture.client.id,
+            clientId: capture.client.clientId,
+            applicationId: capture.client.applicationId,
+            status: capture.client.status,
+        },
+    });
+    await deleteCapturedClient(id);
+    await registerDeletionCleanup({
+        resource: 'client',
+        targetId: id,
+        parentId: capture.client.applicationId,
+        userIds: [],
+        clientIds: capture.clientIds,
+        publicClientIds: capture.publicClientIds,
+        grantIds: capture.grantIds,
+        roleIds: [],
+        permissionIds: [],
+        claimIds: [],
+        applicationIds: [capture.client.applicationId],
+    });
+    return capture;
+}
 //# sourceMappingURL=service.js.map