SigningKeyRepository

Create the signing-key store and its mutation dependencies.

Get the stored keys, newest first, from the writer.

Project keys for server settings without decrypting retired private keys.

Provision the first key without replacing an existing key set.

Publish a replacement, retaining any key already waiting to activate.

Rotate an overdue signing key and prune keys whose retention has passed.

Queue a supplied private key after every key already published for activation.

Import file keys while retaining every token already signed by them.

Remove a compromised key, replacing it immediately if it is signing.

Convert a lifetime to a conservative retention bound, including long months and leap years.

Prune replaced keys after their retention deadlines.

Recompute retention under the set lock and compare before deleting.

Get the newest private key already waiting to activate.

Leave a full publication interval after the newest waiting key.

Get the newest active private key from a newest-first key set.

Find a stored key by its public JWK thumbprint.

Store key material and fail if an observer cancels the mutation.

Delete a key through its model so key-set observers run atomically.

Name the key set whose mutations share a lock.

Prevent a caller's transaction from outliving the key-set lock.

Serialize a key-set mutation and commit it before releasing the lock.