@learncard/lca-api-service 1.3.1 → 1.4.0

package/src/models/index.ts

@@ -5,3 +5,4 @@ export * from './SigningAuthority';
 export * from './Pins';
 export * from './Preferences';
 export * from './UserKey';
+export * from './EscrowHold';

package/src/models/pruneOrphanedRecoveryMethods.ts

@@ -15,11 +15,13 @@ interface RecoveryMethodLike {
  * - Methods whose shareVersion matches `currentShareVersion` are kept.
  * - Methods whose shareVersion matches any entry in `previousVersions` are kept.
  * - Everything else is pruned — the auth share it depends on has been evicted.
+ * This pure helper cannot update blobs. Both persistence callers in UserKey.ts
+ * unset escrowBlob in the same write whenever no escrow method survives.
  */
 export const pruneOrphanedRecoveryMethods = <T extends RecoveryMethodLike>(
     recoveryMethods: T[],
     currentShareVersion: number,
-    previousVersions: number[],
+    previousVersions: number[]
 ): T[] => {
     const validVersions = new Set([currentShareVersion, ...previousVersions]);
 

package/src/routes/credentials.ts

@@ -8,6 +8,7 @@ import { getDeliveryService, getFrom } from '../services/delivery';
 import { IssueEndpointValidator } from 'types/credentials';
 import { t, authorizedDidRoute, openRoute } from '@routes';
 import { getSigningAuthorityLearnCard } from '@helpers/learnCard.helpers';
+import { SeedEncryptionError } from '@helpers/seedEncryption.helpers';
 import {
     encryptCredentialForRecipients,
     resolveRecipientEncrypters,
@@ -142,6 +143,13 @@ export const credentialsRouter = t.router({
                 return issuedCredential;
             } catch (error) {
                 if (error instanceof TRPCError) throw error;
+                if (error instanceof SeedEncryptionError) {
+                    // The helper has already logged sanitized metadata. Do not expose KMS details.
+                    throw new TRPCError({
+                        code: 'INTERNAL_SERVER_ERROR',
+                        message: 'Signing authority key is unavailable. Please try again.',
+                    });
+                }
                 const errMsg = error instanceof Error ? error.message : String(error);
                 const errStack = error instanceof Error ? error.stack : undefined;
                 console.error('[LCA /credentials/issue] Failed:', {