@portaidentity/server 1.7.3 → 1.9.0

package/dist/lib/deletion-cleanup.js

@@ -0,0 +1,207 @@
+import { afterDatabaseCommit } from './database.js';
+import { logger } from './logger.js';
+import { getRedis } from './redis.js';
+/** OIDC models currently stored beneath the Redis adapter namespace. */
+const REDIS_OIDC_MODELS = [
+    'Session',
+    'Interaction',
+    'AuthorizationCode',
+    'ReplayDetection',
+    'ClientCredentials',
+    'PushedAuthorizationRequest',
+];
+const REDIS_OIDC_MODEL_SET = new Set(REDIS_OIDC_MODELS);
+/** Atomically remove a reusable slug key only while it still names the deleted record. */
+const DELETE_MATCHING_SLUG = `
+local value = redis.call('GET', KEYS[1])
+if not value then return 0 end
+local ok, decoded = pcall(cjson.decode, value)
+if ok and decoded['id'] == ARGV[1] then
+  return redis.call('DEL', KEYS[1])
+end
+return 0
+`;
+/** Return true when a decoded payload is safe to inspect by field name. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Test one optional string field against a captured identifier set. */
+function hasReference(values, value) {
+    return typeof value === 'string' && values.has(value);
+}
+/** Determine whether an OIDC payload references authority removed by the deletion. */
+function referencesDeletedAuthority(payload, clientIds, grantIds, userIds) {
+    if (hasReference(clientIds, payload.clientId) ||
+        hasReference(grantIds, payload.grantId) ||
+        hasReference(userIds, payload.accountId)) {
+        return true;
+    }
+    if (!isRecord(payload.authorizations))
+        return false;
+    return Object.entries(payload.authorizations).some(([clientId, authorization]) => clientIds.has(clientId) ||
+        (isRecord(authorization) && hasReference(grantIds, authorization.grantId)));
+}
+/** Build the exact cache and grant-index keys represented by a deletion descriptor. */
+function exactKeys(descriptor) {
+    const keys = new Set(exactAuthorityKeys(descriptor));
+    if (descriptor.resource === 'organization')
+        keys.add(`org:id:${descriptor.targetId}`);
+    if (descriptor.resource === 'application') {
+        keys.add(`app:id:${descriptor.targetId}`);
+        keys.add(`claims:defs:${descriptor.targetId}`);
+    }
+    if (descriptor.resource === 'claim') {
+        for (const applicationId of descriptor.applicationIds) {
+            keys.add(`claims:defs:${applicationId}`);
+        }
+    }
+    for (const id of descriptor.clientIds)
+        keys.add(`client:id:${id}`);
+    for (const id of descriptor.publicClientIds)
+        keys.add(`client:cid:${id}`);
+    for (const id of descriptor.userIds) {
+        keys.add(`user:id:${id}`);
+    }
+    return [...keys];
+}
+/** Build exact RBAC cache keys for an authority change. */
+function exactAuthorityKeys(descriptor) {
+    const keys = new Set();
+    for (const id of descriptor.roleIds)
+        keys.add(`rbac:role:${id}`);
+    for (const id of descriptor.userIds) {
+        keys.add(`rbac:user-roles:${id}`);
+        keys.add(`rbac:user-perms:${id}`);
+    }
+    for (const model of REDIS_OIDC_MODELS) {
+        for (const grantId of descriptor.grantIds) {
+            keys.add(`oidc:${model}:grant:${grantId}`);
+        }
+    }
+    return [...keys];
+}
+/** Read one JSON payload without allowing malformed Redis data to stop cleanup. */
+function parsePayload(value) {
+    if (value === null)
+        return null;
+    try {
+        const parsed = JSON.parse(value);
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Remove matching OIDC main payloads and the indexes derivable from those payloads. */
+async function scanOidcPayloads(descriptor) {
+    const redis = getRedis();
+    const clientIds = new Set(descriptor.publicClientIds);
+    const grantIds = new Set(descriptor.grantIds);
+    const userIds = new Set(descriptor.userIds);
+    let cursor = '0';
+    do {
+        const [nextCursor, candidates] = await redis.scan(cursor, 'MATCH', 'oidc:*', 'COUNT', 100);
+        cursor = nextCursor;
+        const mainKeys = candidates.filter((key) => {
+            const parts = key.split(':');
+            return parts.length === 3 && parts[0] === 'oidc' && REDIS_OIDC_MODEL_SET.has(parts[1]);
+        });
+        if (mainKeys.length === 0)
+            continue;
+        const payloads = await redis.mget(...mainKeys);
+        const keysToDelete = new Set();
+        for (let index = 0; index < mainKeys.length; index += 1) {
+            const payload = parsePayload(payloads[index] ?? null);
+            if (!payload || !referencesDeletedAuthority(payload, clientIds, grantIds, userIds))
+                continue;
+            const mainKey = mainKeys[index];
+            const model = mainKey.split(':')[1];
+            keysToDelete.add(mainKey);
+            if (typeof payload.uid === 'string')
+                keysToDelete.add(`oidc:${model}:uid:${payload.uid}`);
+            if (typeof payload.userCode === 'string') {
+                keysToDelete.add(`oidc:${model}:user_code:${payload.userCode}`);
+            }
+        }
+        if (keysToDelete.size > 0)
+            await redis.del(...keysToDelete);
+    } while (cursor !== '0');
+}
+/** Remove exact RBAC keys and user-linked OIDC state after an authority change. */
+async function cleanupAuthorityRedis(descriptor) {
+    const redis = getRedis();
+    const keys = exactAuthorityKeys(descriptor);
+    if (keys.length > 0)
+        await redis.del(...keys);
+    if (descriptor.revokeOidcState) {
+        await scanOidcPayloads({
+            userIds: descriptor.userIds,
+            publicClientIds: [],
+            grantIds: descriptor.grantIds,
+        });
+    }
+}
+/** Execute the single best-effort Redis cleanup pass for a committed deletion. */
+async function cleanupDeletionRedis(descriptor) {
+    const redis = getRedis();
+    const keys = exactKeys(descriptor);
+    if (keys.length > 0)
+        await redis.del(...keys);
+    if (descriptor.targetSlug && descriptor.resource === 'organization') {
+        await redis.eval(DELETE_MATCHING_SLUG, 1, `org:slug:${descriptor.targetSlug}`, descriptor.targetId);
+    }
+    if (descriptor.targetSlug && descriptor.resource === 'application') {
+        await redis.eval(DELETE_MATCHING_SLUG, 1, `app:slug:${descriptor.targetSlug}`, descriptor.targetId);
+    }
+    await scanOidcPayloads(descriptor);
+}
+/**
+ * Register immutable cleanup input on the current transaction's post-commit boundary.
+ * The hook schedules one detached Redis pass and returns without waiting for cache I/O.
+ *
+ * @param descriptor - Identifiers captured before the database cascade.
+ */
+export async function registerDeletionCleanup(descriptor) {
+    const immutable = Object.freeze({
+        ...descriptor,
+        userIds: Object.freeze([...descriptor.userIds]),
+        clientIds: Object.freeze([...descriptor.clientIds]),
+        publicClientIds: Object.freeze([...descriptor.publicClientIds]),
+        grantIds: Object.freeze([...descriptor.grantIds]),
+        roleIds: Object.freeze([...descriptor.roleIds]),
+        permissionIds: Object.freeze([...descriptor.permissionIds]),
+        claimIds: Object.freeze([...descriptor.claimIds]),
+        applicationIds: Object.freeze([...descriptor.applicationIds]),
+    });
+    await afterDatabaseCommit(async () => {
+        setImmediate(() => {
+            void cleanupDeletionRedis(immutable).catch(() => {
+                logger.warn({ event: 'deletion-redis-cleanup-failed' }, 'Deletion Redis cleanup failed');
+            });
+        });
+    });
+}
+/**
+ * Register targeted RBAC cleanup after the current transaction commits.
+ *
+ * The hook schedules one best-effort Redis pass and does not hold the request
+ * open for cache I/O. Failures emit one fixed warning without identifiers.
+ *
+ * @param descriptor - Authority identifiers captured inside the transaction
+ */
+export async function registerAuthorityCleanup(descriptor) {
+    const immutable = Object.freeze({
+        userIds: Object.freeze([...descriptor.userIds]),
+        grantIds: Object.freeze([...descriptor.grantIds]),
+        roleIds: Object.freeze([...descriptor.roleIds]),
+        revokeOidcState: descriptor.revokeOidcState,
+    });
+    await afterDatabaseCommit(async () => {
+        setImmediate(() => {
+            void cleanupAuthorityRedis(immutable).catch(() => {
+                logger.warn({ event: 'authority-redis-cleanup-failed' }, 'Authority Redis cleanup failed');
+            });
+        });
+    });
+}
+//# sourceMappingURL=deletion-cleanup.js.map

package/dist/lib/deletion-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deletion-cleanup.js","sourceRoot":"","sources":["../../src/lib/deletion-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,wEAAwE;AACxE,MAAM,iBAAiB,GAAG;IACxB,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CACpB,CAAC;AAEX,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,CAAC;AAEhE,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG;;;;;;;;CAQ5B,CAAC;AA+BF,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,MAA2B,EAAE,KAAc;IAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,sFAAsF;AACtF,SAAS,0BAA0B,CACjC,OAAgC,EAChC,SAA8B,EAC9B,QAA6B,EAC7B,OAA4B;IAE5B,IACE,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;QACvC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,CAC5B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,UAAqC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAE7D,IAAI,UAAU,CAAC,QAAQ,KAAK,cAAc;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,eAAe,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpC,KAAK,MAAM,aAAa,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,eAAe;QAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,2DAA2D;AAC3D,SAAS,kBAAkB,CACzB,UAAgF;IAEhF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAoB;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,gBAAgB,CAC7B,UAAuF;IAEvF,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,GAAG,CAAC;IAEjB,GAAG,CAAC;QACF,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3F,MAAM,GAAG,UAAU,CAAC;QAEpB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,SAAS;YAE7F,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1F,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACzC,YAAY,CAAC,GAAG,CAAC,QAAQ,KAAK,cAAc,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IAC9D,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE;AAC3B,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,qBAAqB,CAAC,UAAsC;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;QAC/B,MAAM,gBAAgB,CAAC;YACrB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,oBAAoB,CAAC,UAAqC;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CACd,oBAAoB,EACpB,CAAC,EACD,YAAY,UAAU,CAAC,UAAU,EAAE,EACnC,UAAU,CAAC,QAAQ,CACpB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,KAAK,CAAC,IAAI,CACd,oBAAoB,EACpB,CAAC,EACD,YAAY,UAAU,CAAC,UAAU,EAAE,EACnC,UAAU,CAAC,QAAQ,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAqC;IAErC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,GAAG,UAAU;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACnD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAC/D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,YAAY,CAAC,GAAG,EAAE;YAChB,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,+BAA+B,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAsC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,eAAe,EAAE,UAAU,CAAC,eAAe;KAC5C,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,YAAY,CAAC,GAAG,EAAE;YAChB,KAAK,qBAAqB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAC7F,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/image-validator.d.ts

@@ -8,12 +8,14 @@
  * - SVG-based XSS via embedded scripts or event handlers
  *
  * @module image-validator
- * @see 06-bulk-operations-branding.md
  */
+/** Branding image slot whose size limit should be enforced. */
 export type AssetType = 'logo' | 'favicon';
 /** Result of image validation — either valid or contains an error message */
 export interface ImageValidationResult {
+    /** Whether the supplied bytes satisfy every validation rule. */
     valid: boolean;
+    /** Human-readable validation failure for trusted internal callers. */
     error?: string;
     /** The detected content type from magic bytes (may differ from declared) */
     detectedType?: string;

package/dist/lib/image-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-validator.d.ts","sourceRoot":"","sources":["../../src/lib/image-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,GACnB,qBAAqB,CA8BvB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAEzD"}
+{"version":3,"file":"image-validator.d.ts","sourceRoot":"","sources":["../../src/lib/image-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,+DAA+D;AAC/D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AA0ED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,GACnB,qBAAqB,CA8BvB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAEzD"}

package/dist/lib/image-validator.js

@@ -8,15 +8,14 @@
  * - SVG-based XSS via embedded scripts or event handlers
  *
  * @module image-validator
- * @see 06-bulk-operations-branding.md
  */
 // ============================================================================
 // Constants
 // ============================================================================
 /** Size limits per asset type (in bytes) */
 const SIZE_LIMITS = {
-    logo: 2 * 1024 * 1024, // 2 MB — logos can be larger for hi-DPI
-    favicon: 512 * 1024, // 512 KB — favicons should be small
+    logo: 2 * 1024 * 1024,
+    favicon: 512 * 1024,
 };
 /**
  * Magic byte signatures for supported image formats.
@@ -24,11 +23,23 @@ const SIZE_LIMITS = {
  * SVG is XML-based and has no magic bytes — validated separately.
  */
 const MAGIC_SIGNATURES = [
-    { type: 'image/png', bytes: [0x89, 0x50, 0x4E, 0x47] },
-    { type: 'image/jpeg', bytes: [0xFF, 0xD8, 0xFF] },
-    { type: 'image/webp', bytes: [0x52, 0x49, 0x46, 0x46] },
-    { type: 'image/x-icon', bytes: [0x00, 0x00, 0x01, 0x00] },
-    { type: 'image/vnd.microsoft.icon', bytes: [0x00, 0x00, 0x01, 0x00] },
+    {
+        type: 'image/png',
+        segments: [{ offset: 0, bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] }],
+    },
+    { type: 'image/jpeg', segments: [{ offset: 0, bytes: [0xff, 0xd8] }] },
+    {
+        type: 'image/webp',
+        segments: [
+            { offset: 0, bytes: [0x52, 0x49, 0x46, 0x46] },
+            { offset: 8, bytes: [0x57, 0x45, 0x42, 0x50] },
+        ],
+    },
+    { type: 'image/x-icon', segments: [{ offset: 0, bytes: [0x00, 0x00, 0x01, 0x00] }] },
+    {
+        type: 'image/vnd.microsoft.icon',
+        segments: [{ offset: 0, bytes: [0x00, 0x00, 0x01, 0x00] }],
+    },
 ];
 /** Content types that are allowed for upload */
 const ALLOWED_TYPES = new Set([
@@ -110,16 +121,14 @@ function validateMagicBytes(buffer, contentType) {
         // No signature defined for this type — allow it (shouldn't happen due to ALLOWED_TYPES check)
         return { valid: true, detectedType: contentType, data: buffer };
     }
-    // Check that buffer is at least long enough for the signature
-    if (buffer.length < signature.bytes.length) {
+    const requiredLength = Math.max(...signature.segments.map((segment) => segment.offset + segment.bytes.length));
+    if (buffer.length < requiredLength) {
         return {
             valid: false,
             error: `File too small to be a valid ${contentType} image`,
         };
     }
-    // Compare magic bytes
-    const matches = signature.bytes.every((byte, i) => buffer[i] === byte);
-    if (!matches) {
+    if (!matchesSignature(buffer, signature)) {
         // Try to detect what the file actually is
         const detected = detectContentType(buffer);
         return {
@@ -145,7 +154,10 @@ function validateAndSanitizeSvg(buffer) {
     }
     // Basic SVG structure check — must contain an <svg element
     if (!/<svg[\s>]/i.test(content)) {
-        return { valid: false, error: 'File does not appear to be a valid SVG (no <svg> element found)' };
+        return {
+            valid: false,
+            error: 'File does not appear to be a valid SVG (no <svg> element found)',
+        };
     }
     // Sanitize: strip dangerous elements and attributes
     let sanitized = content;
@@ -183,14 +195,15 @@ function validateAndSanitizeSvg(buffer) {
  */
 function detectContentType(buffer) {
     for (const sig of MAGIC_SIGNATURES) {
-        if (buffer.length >= sig.bytes.length) {
-            const matches = sig.bytes.every((byte, i) => buffer[i] === byte);
-            if (matches)
-                return sig.type;
-        }
+        if (matchesSignature(buffer, sig))
+            return sig.type;
     }
     return null;
 }
+/** Return whether every required segment is present at its exact byte offset. */
+function matchesSignature(buffer, signature) {
+    return signature.segments.every((segment) => segment.bytes.every((byte, index) => buffer[segment.offset + index] === byte));
+}
 /**
  * Format bytes into a human-readable string (e.g., "512 KB", "2 MB").
  */

package/dist/lib/image-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"image-validator.js","sourceRoot":"","sources":["../../src/lib/image-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,4CAA4C;AAC5C,MAAM,WAAW,GAA8B;IAC7C,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAK,wCAAwC;IAClE,OAAO,EAAE,GAAG,GAAG,IAAI,EAAQ,oCAAoC;CAChE,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAA6C;IACjE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACtD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACjD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACzD,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;CACtE,CAAC;AAEF,gDAAgD;AAChD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,cAAc;IACd,0BAA0B;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,sBAAsB,GAAG,4DAA4D,CAAC;AAC5F,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAC1E,MAAM,oBAAoB,GAAG,wDAAwD,CAAC;AACtF,MAAM,oBAAoB,GAAG,4DAA4D,CAAC;AAE1F,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,WAAmB,EACnB,SAAoB;IAEpB,gCAAgC;IAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6BAA6B,WAAW,cAAc,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC/D,CAAC;IAED,sCAAsC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mBAAmB,MAAM,CAAC,MAAM,uBAAuB,SAAS,KAAK,SAAS,WAAW,WAAW,CAAC,SAAS,CAAC,GAAG;SAC1H,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,6CAA6C;IAC7C,OAAO,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoB;IAC/C,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAmB;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,8FAA8F;QAC9F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,gCAAgC,WAAW,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6CAA6C,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7G,YAAY,EAAE,QAAQ,IAAI,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC7E,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC;IACpG,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1D,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,wDAAwD;IACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,iDAAiD;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,IAAI,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,OAAO,GAAG,KAAK,QAAQ,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"image-validator.js","sourceRoot":"","sources":["../../src/lib/image-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuBH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,4CAA4C;AAC5C,MAAM,WAAW,GAAwC;IACvD,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IACrB,OAAO,EAAE,GAAG,GAAG,IAAI;CACpB,CAAC;AAgBF;;;;GAIG;AACH,MAAM,gBAAgB,GAA8B;IAClD;QACE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;KACnF;IACD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;IACtE;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE;YACR,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YAC9C,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;SAC/C;KACF;IACD,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;IACpF;QACE,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;KAC3D;CACF,CAAC;AAEF,gDAAgD;AAChD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,cAAc;IACd,0BAA0B;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,sBAAsB,GAAG,4DAA4D,CAAC;AAC5F,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAC1E,MAAM,oBAAoB,GAAG,wDAAwD,CAAC;AACtF,MAAM,oBAAoB,GAAG,4DAA4D,CAAC;AAE1F,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,WAAmB,EACnB,SAAoB;IAEpB,gCAAgC;IAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6BAA6B,WAAW,cAAc,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC/D,CAAC;IAED,sCAAsC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mBAAmB,MAAM,CAAC,MAAM,uBAAuB,SAAS,KAAK,SAAS,WAAW,WAAW,CAAC,SAAS,CAAC,GAAG;SAC1H,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,6CAA6C;IAC7C,OAAO,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoB;IAC/C,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAmB;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,8FAA8F;QAC9F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAC7B,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAC9E,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,gCAAgC,WAAW,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACzC,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6CAA6C,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7G,YAAY,EAAE,QAAQ,IAAI,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC7E,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,iEAAiE;SACzE,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1D,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,wDAAwD;IACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,iDAAiD;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,MAAc,EAAE,SAAyB;IACjE,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAC9E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,IAAI,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,OAAO,GAAG,KAAK,QAAQ,CAAC;AAC1B,CAAC"}

package/dist/lib/log-format.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Log output format selection for the process logger.
+ *
+ * Production always emits structured JSON so an external collector can parse each event without
+ * guessing at human formatting. An owner-controlled non-production runtime may request the same
+ * format through the `PORTA_LOG_FORMAT` environment variable. Only the exact value `json` is
+ * recognized; any other value keeps the human-readable development default.
+ *
+ * @module lib/log-format
+ */
+/** Exact `PORTA_LOG_FORMAT` value which requests structured JSON logs outside production. */
+export declare const JSON_LOG_FORMAT_VALUE = "json";
+/**
+ * Decide whether the process logger must emit structured JSON.
+ *
+ * @param environment - Process environment to read, defaulting to the running process.
+ * @returns True when structured JSON logging is required.
+ */
+export declare function resolveJsonLogFormat(environment?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=log-format.d.ts.map

package/dist/lib/log-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-format.d.ts","sourceRoot":"","sources":["../../src/lib/log-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAI1F"}

package/dist/lib/log-format.js

@@ -0,0 +1,22 @@
+/**
+ * Log output format selection for the process logger.
+ *
+ * Production always emits structured JSON so an external collector can parse each event without
+ * guessing at human formatting. An owner-controlled non-production runtime may request the same
+ * format through the `PORTA_LOG_FORMAT` environment variable. Only the exact value `json` is
+ * recognized; any other value keeps the human-readable development default.
+ *
+ * @module lib/log-format
+ */
+/** Exact `PORTA_LOG_FORMAT` value which requests structured JSON logs outside production. */
+export const JSON_LOG_FORMAT_VALUE = 'json';
+/**
+ * Decide whether the process logger must emit structured JSON.
+ *
+ * @param environment - Process environment to read, defaulting to the running process.
+ * @returns True when structured JSON logging is required.
+ */
+export function resolveJsonLogFormat(environment = process.env) {
+    return (environment.NODE_ENV === 'production' || environment.PORTA_LOG_FORMAT === JSON_LOG_FORMAT_VALUE);
+}
+//# sourceMappingURL=log-format.js.map

package/dist/lib/log-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-format.js","sourceRoot":"","sources":["../../src/lib/log-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAW,GAAsB,OAAO,CAAC,GAAG;IAC/E,OAAO,CACL,WAAW,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,gBAAgB,KAAK,qBAAqB,CAChG,CAAC;AACJ,CAAC"}

package/dist/lib/logger.d.ts

@@ -5,7 +5,9 @@ export type OperationalLogObserver = (serializedArguments: string) => void;
  *
  * This is intended for owner-controlled diagnostics and executable privacy validation. Observers
  * are process-local, receive no replay buffer, and must detach immediately after their bounded
- * operation. They cannot alter, suppress, or replace the actual log write.
+ * operation. While at least one observer is attached, the logger accepts every level so the
+ * observer can validate calls hidden by a quiet test configuration. The original level is restored
+ * after the final observer detaches. Observers cannot alter, suppress, or replace a log write.
  *
  * @param observer - Callback receiving one JSON representation per logger call.
  * @returns A function which removes exactly this observer.

package/dist/lib/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAEA,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,CAAC,mBAAmB,EAAE,MAAM,KAAK,IAAI,CAAC;AAI3E;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAGxF;AAKD,eAAO,MAAM,MAAM,uCAiDjB,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAIA,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,CAAC,mBAAmB,EAAE,MAAM,KAAK,IAAI,CAAC;AAK3E;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAaxF;AAID,eAAO,MAAM,MAAM,uCAqDjB,CAAC"}

package/dist/lib/logger.js

@@ -1,24 +1,39 @@
 import { pino, stdSerializers } from 'pino';
+import { resolveJsonLogFormat } from './log-format.js';
 const operationalLogObservers = new Set();
+let levelBeforeOperationalObservation = null;
 /**
  * Observe arguments delivered to the production logger boundary.
  *
  * This is intended for owner-controlled diagnostics and executable privacy validation. Observers
  * are process-local, receive no replay buffer, and must detach immediately after their bounded
- * operation. They cannot alter, suppress, or replace the actual log write.
+ * operation. While at least one observer is attached, the logger accepts every level so the
+ * observer can validate calls hidden by a quiet test configuration. The original level is restored
+ * after the final observer detaches. Observers cannot alter, suppress, or replace a log write.
  *
  * @param observer - Callback receiving one JSON representation per logger call.
  * @returns A function which removes exactly this observer.
  */
 export function observeOperationalLogOutput(observer) {
+    if (operationalLogObservers.size === 0) {
+        levelBeforeOperationalObservation = logger.level;
+        logger.level = 'trace';
+    }
     operationalLogObservers.add(observer);
-    return () => operationalLogObservers.delete(observer);
+    return () => {
+        operationalLogObservers.delete(observer);
+        if (operationalLogObservers.size === 0 && levelBeforeOperationalObservation !== null) {
+            logger.level = levelBeforeOperationalObservation;
+            levelBeforeOperationalObservation = null;
+        }
+    };
 }
-const isProduction = process.env.NODE_ENV === 'production';
 const isTest = process.env.NODE_ENV === 'test';
 export const logger = pino({
     level: process.env.LOG_LEVEL || (isTest ? 'silent' : 'info'),
-    transport: !isProduction ? { target: 'pino-pretty', options: { colorize: true } } : undefined,
+    transport: resolveJsonLogFormat()
+        ? undefined
+        : { target: 'pino-pretty', options: { colorize: true } },
     serializers: {
         err: stdSerializers.err,
         req: stdSerializers.req,
@@ -46,12 +61,14 @@ export const logger = pino({
             'cookie',
             'refresh_token',
             'client_secret',
+            'urn:porta:internal_application_id',
             'req.headers.authorization',
             'req.headers.cookie',
             '*.password',
             '*.token',
             '*.refresh_token',
             '*.client_secret',
+            '*.urn:porta:internal_application_id',
             '*.authorization',
             'email',
             'userId',

package/dist/lib/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAK5C,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC;IAC1E,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAE/C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAC7F,WAAW,EAAE;QACX,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;KACxB;IACD,KAAK,EAAE;QACL,SAAS,CAAC,UAAU,EAAE,MAAM;YAC1B,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;gBAChE,KAAK,MAAM,QAAQ,IAAI,uBAAuB;oBAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;KACF;IACD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,EAAE;QACN,KAAK,EAAE;YACL,UAAU;YACV,OAAO;YACP,eAAe;YACf,QAAQ;YACR,eAAe;YACf,eAAe;YACf,2BAA2B;YAC3B,oBAAoB;YACpB,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,iBAAiB;YACjB,iBAAiB;YACjB,OAAO;YACP,QAAQ;YACR,gBAAgB;YAChB,KAAK;YACL,gBAAgB;YAChB,SAAS;YACT,UAAU;YACV,kBAAkB;YAClB,OAAO;YACP,kBAAkB;SACnB;QACD,MAAM,EAAE,YAAY;KACrB;CACF,CAAC,CAAC;AAEH,oGAAoG;AACpG,SAAS,gCAAgC,CAAC,UAAqB;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;YACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,CAAC;IAC5C,CAAC;AACH,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAKvD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAClE,IAAI,iCAAiC,GAAkB,IAAI,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC;IAC1E,IAAI,uBAAuB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,iCAAiC,GAAG,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC;IACzB,CAAC;IACD,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,EAAE;QACV,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,uBAAuB,CAAC,IAAI,KAAK,CAAC,IAAI,iCAAiC,KAAK,IAAI,EAAE,CAAC;YACrF,MAAM,CAAC,KAAK,GAAG,iCAAiC,CAAC;YACjD,iCAAiC,GAAG,IAAI,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAE/C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,oBAAoB,EAAE;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IAC1D,WAAW,EAAE;QACX,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;KACxB;IACD,KAAK,EAAE;QACL,SAAS,CAAC,UAAU,EAAE,MAAM;YAC1B,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;gBAChE,KAAK,MAAM,QAAQ,IAAI,uBAAuB;oBAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;KACF;IACD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,EAAE;QACN,KAAK,EAAE;YACL,UAAU;YACV,OAAO;YACP,eAAe;YACf,QAAQ;YACR,eAAe;YACf,eAAe;YACf,mCAAmC;YACnC,2BAA2B;YAC3B,oBAAoB;YACpB,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,iBAAiB;YACjB,qCAAqC;YACrC,iBAAiB;YACjB,OAAO;YACP,QAAQ;YACR,gBAAgB;YAChB,KAAK;YACL,gBAAgB;YAChB,SAAS;YACT,UAAU;YACV,kBAAkB;YAClB,OAAO;YACP,kBAAkB;SACnB;QACD,MAAM,EAAE,YAAY;KACrB;CACF,CAAC,CAAC;AAEH,oGAAoG;AACpG,SAAS,gCAAgC,CAAC,UAAqB;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;YACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/lib/redis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAMhC,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAcnD;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAGhC;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAShC,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAenD;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAGhC;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/lib/redis.js

@@ -2,8 +2,11 @@ import { Redis } from 'ioredis';
 import { config } from '../config/index.js';
 import { logger } from './logger.js';
 let redis = null;
+/** Maximum time one Redis command may hold a public request while Redis is unavailable. */
+const REDIS_COMMAND_TIMEOUT_MS = 1000;
 export async function connectRedis() {
     redis = new Redis(config.redisUrl, {
+        commandTimeout: REDIS_COMMAND_TIMEOUT_MS,
         maxRetriesPerRequest: 3,
         lazyConnect: true,
     });

package/dist/lib/redis.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,KAAK,GAAiB,IAAI,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,KAAK,GAAiB,IAAI,CAAC;AAE/B,2FAA2F;AAC3F,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjC,cAAc,EAAE,wBAAwB;QACxC,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}