@learncard/lca-api-service 1.3.1 → 1.4.0

package/dist/app.d.ts

@@ -994,6 +994,88 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
         errorShape: import("@trpc/server").TRPCDefaultErrorShape;
         transformer: false;
     }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+        startRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                email: string;
+            };
+            output: {
+                success: true;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        verifyRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                email: string;
+                code: string;
+            };
+            output: {
+                recoverySessionToken: string;
+                recoveryMethods: {
+                    type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                    createdAt: string;
+                    credentialId?: string | undefined;
+                    shareVersion?: number | undefined;
+                }[];
+                escrowPin: {
+                    state: "enabled" | "none" | "locked" | "stale";
+                    enabled: boolean;
+                    attemptsRemaining: number;
+                    salt?: string | undefined;
+                };
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        useRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                recoverySessionToken: string;
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                credentialId?: string | undefined;
+            };
+            output: {
+                authShare: {
+                    encryptedData: string;
+                    encryptedDek: string;
+                    iv: string;
+                };
+                primaryDid: string;
+                shareVersion: number;
+                rebindSessionToken: string;
+                encryptedShare?: {
+                    encryptedData: string;
+                    iv: string;
+                    salt?: string | undefined;
+                } | undefined;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        completeRecoveryRebind: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                recoverySessionToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                primaryDid: string;
+                authShare: {
+                    encryptedData: string;
+                    encryptedDek: string;
+                    iv: string;
+                };
+                newAuthToken?: string | undefined;
+            };
+            output: {
+                success: true;
+                shareVersion: number;
+                recoveryMethodsRequireConfirmation: ("email" | "passkey" | "backup" | "phrase" | "escrow")[];
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        issueDidChallenge: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                did: string;
+            };
+            output: {
+                challenge: string;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
         getAuthShare: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 authToken: string;
@@ -1009,14 +1091,23 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                 primaryDid: string | null;
                 securityLevel: "basic" | "enhanced" | "advanced";
                 recoveryMethods: {
-                    type: "email" | "passkey" | "backup" | "phrase";
+                    type: "email" | "passkey" | "backup" | "phrase" | "escrow";
                     createdAt: string;
                     credentialId?: string | undefined;
                     shareVersion?: number | undefined;
+                    confirmedAt?: string | undefined;
                 }[];
                 keyProvider: "web3auth" | "sss";
                 shareVersion: number;
                 maskedRecoveryEmail: string | null;
+                escrowOptedOut: boolean;
+                escrowPin: {
+                    state: "enabled" | "none" | "locked" | "stale";
+                    enabled: boolean;
+                    attemptsRemaining: number;
+                    salt?: string | undefined;
+                };
+                sssActivationState: "provisional" | "active";
             } | null;
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
@@ -1032,10 +1123,13 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                 primaryDid: string;
                 securityLevel?: "basic" | "enhanced" | "advanced" | undefined;
                 keyProvider?: "web3auth" | "sss" | undefined;
+                sssActivationState?: "provisional" | undefined;
+                expectedShareVersion?: number | undefined;
             };
             output: {
                 success: boolean;
                 shareVersion: number;
+                expectedShareVersionChecked: boolean;
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
@@ -1043,7 +1137,7 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             input: {
                 authToken: string;
                 providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-                type: "email" | "passkey" | "backup" | "phrase";
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
                 encryptedShare?: {
                     encryptedData: string;
                     iv: string;
@@ -1057,11 +1151,36 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
-        getRecoveryShare: import("@trpc/server").TRPCQueryProcedure<{
+        confirmRecoveryMethod: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 authToken: string;
                 providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-                type: "email" | "passkey" | "backup" | "phrase";
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                credentialId?: string | undefined;
+                code?: string | undefined;
+            };
+            output: {
+                success: boolean;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        deleteRecoveryMethod: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                credentialId?: string | undefined;
+            };
+            output: {
+                success: boolean;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        getRecoveryShare: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                authToken?: string | undefined;
                 credentialId?: string | undefined;
             };
             output: {
@@ -1084,6 +1203,16 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
+        activate: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            };
+            output: {
+                success: boolean;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
         addRecoveryEmail: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 authToken: string;
@@ -1121,9 +1250,18 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             input: {
                 authToken: string;
                 providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-                emailShare: string;
-                email?: string | undefined;
-                useRecoveryEmail?: boolean | undefined;
+                relayPayload: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                };
+                confirmationCode: string;
+                email: string;
+                shareVersion?: number | undefined;
             };
             output: {
                 success: boolean;
@@ -1149,6 +1287,7 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             input: {
                 authToken: string;
                 providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                challenge: string;
             };
             output: {
                 success: boolean;
@@ -1156,6 +1295,156 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
     }>>;
+    escrow: import("@trpc/server").TRPCBuiltRouter<{
+        ctx: import("@routes").Context;
+        meta: import("trpc-to-openapi").OpenApiMeta;
+        errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+        transformer: false;
+    }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+        getAttestation: import("@trpc/server").TRPCQueryProcedure<{
+            input: Record<string, never>;
+            output: {
+                attestation: {
+                    mode: "software" | "nitro";
+                    keyId: string;
+                    publicKey: string;
+                    measurements: {
+                        imageSha384?: string | undefined;
+                        pcr0?: string | undefined;
+                        pcr1?: string | undefined;
+                        pcr2?: string | undefined;
+                    };
+                    document: string;
+                    issuedAt: string;
+                };
+                holdDurationMs: number;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        enroll: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                envelope: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                };
+                shareVersion: number;
+                enclaveKeyId: string;
+                pinSalt?: string | undefined;
+                clearPin?: boolean | undefined;
+            };
+            output: {
+                success: true;
+                shareVersion: number;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        remove: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                optOut: boolean;
+            };
+            output: {
+                success: true;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        optIn: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            };
+            output: {
+                success: true;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        startRecovery: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                clientEphemeralPublicKey: string;
+                releasePolicy?: "pin" | "hold" | undefined;
+                restart?: boolean | undefined;
+                authToken?: string | undefined;
+                providerType?: "firebase" | "supertokens" | "keycloak" | "oidc" | undefined;
+                recoverySessionToken?: string | undefined;
+            };
+            output: {
+                requestedAt: string;
+                releaseAfter: string;
+                releasePolicy: "pin" | "hold";
+                holdId: string;
+                status: "pending";
+                resumeToken: string | null;
+                pinSalt?: string | undefined;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        getStatus: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                holdId?: string | undefined;
+                resumeToken?: string | undefined;
+                authToken?: string | undefined;
+                providerType?: "firebase" | "supertokens" | "keycloak" | "oidc" | undefined;
+            };
+            output: {
+                hold: {
+                    holdId: string;
+                    status: "pending" | "cancelled" | "completed" | "expired";
+                    requestedAt: string;
+                    releaseAfter: string;
+                    releasePolicy: "pin" | "hold";
+                    cancelledAt?: string | undefined;
+                    completedAt?: string | undefined;
+                } | null;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        cancelRecovery: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            };
+            output: {
+                success: true;
+                cancelled: boolean;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        completeRecovery: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                holdId: string;
+                resumeToken: string;
+                pinProof?: string | undefined;
+            };
+            output: {
+                sealedShare: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                };
+                authShare: {
+                    encryptedData: string;
+                    encryptedDek: string;
+                    iv: string;
+                };
+                primaryDid: string;
+                shareVersion: number;
+                rebindSessionToken: string;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+    }>>;
     qrLogin: import("@trpc/server").TRPCBuiltRouter<{
         ctx: import("@routes").Context;
         meta: import("trpc-to-openapi").OpenApiMeta;
@@ -1180,7 +1469,7 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: {
                 sessionId: string;
                 publicKey: string;
-                status: "approved" | "pending";
+                status: "pending" | "approved";
                 encryptedPayload?: string | undefined;
                 approverDid?: string | undefined;
             };

package/dist/cache/challenges.d.ts

@@ -1,6 +1,8 @@
 export declare const getChallengeCacheKey: (did: string, challenge: string) => string;
 export declare const VALID = "valid";
+export declare const DID_CHALLENGE_TTL_SECS: number;
 export declare const isChallengeValidForDid: (did: string, challenge: string) => Promise<typeof VALID | null | undefined>;
+export declare const consumeChallengeForDid: (did: string, challenge: string) => Promise<boolean>;
 export declare const setValidChallengeForDid: (did: string, challenge: string) => Promise<"OK" | undefined>;
 export declare const setValidChallengesForDid: (did: string, challenges: string[]) => Promise<"OK" | undefined>;
 export declare const invalidateChallengeForDid: (did: string, challenge: string) => Promise<number | undefined>;

package/dist/cache/recoverySessions.d.ts

@@ -0,0 +1,42 @@
+import type { AuthProviderType } from '@helpers/auth.helpers';
+export declare const RECOVERY_SESSION_TTL_SECS: number;
+export declare const RECOVERY_OTP_TTL_SECS: number;
+export declare const RECOVERY_OTP_SEND_COOLDOWN_SECS = 60;
+export declare const MAX_RECOVERY_OTP_ATTEMPTS = 5;
+export type RecoverySessionScope = 'recover' | 'rebind';
+export interface RecoverySessionRecord {
+    scope: RecoverySessionScope;
+    authProvider: {
+        type: AuthProviderType;
+        id: string;
+    };
+}
+export interface RecoveryOtpRecord {
+    codeHash: string;
+    authProvider: {
+        type: AuthProviderType;
+        id: string;
+    };
+}
+export type RecoveryOtpVerificationResult = {
+    status: 'ok';
+    record: RecoveryOtpRecord;
+} | {
+    status: 'mismatch';
+    attempts: number;
+} | {
+    status: 'locked';
+} | {
+    status: 'none';
+};
+export declare const getRecoveryEmailDigest: (email: string) => string;
+export declare const getRecoveryOtpCacheKey: (email: string) => string;
+export declare const getRecoveryOtpAttemptsCacheKey: (email: string) => string;
+export declare const getRecoveryOtpLockCacheKey: (email: string) => string;
+export declare const getRecoveryOtpSendCacheKey: (email: string) => string;
+export declare const getRecoverySessionCacheKey: (token: string) => string;
+export declare const createRecoverySession: (record: RecoverySessionRecord, ttl?: number) => Promise<string>;
+export declare const consumeRecoverySession: (token: string, expectedScope: RecoverySessionScope) => Promise<RecoverySessionRecord | null>;
+export declare const storeRecoveryOtp: (email: string, record: RecoveryOtpRecord) => Promise<void>;
+export declare const verifyRecoveryOtp: (email: string, submittedCodeHash: string) => Promise<RecoveryOtpVerificationResult>;
+export declare const claimRecoveryOtpSendWindow: (email: string) => Promise<boolean>;

package/dist/config/environment.d.ts

@@ -8,6 +8,20 @@ export declare const lcaApiEnvironmentShape: {
     }>>;
     PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED: z.ZodString;
+    SA_SEED_KMS_KEY_ARN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_LOCAL_KEK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_ENCRYPT_WRITES: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    SA_SEED_ALLOW_LEGACY_READ: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
     MONGO_URI: z.ZodString;
     MONGO_DB_NAME: z.ZodString;
     DOMAIN_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -25,6 +39,16 @@ export declare const lcaApiEnvironmentShape: {
     POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELAY_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_RELAY_AUTH_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_MODE: z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodOptional<z.ZodEnum<{
+        software: "software";
+        remote: "remote";
+    }>>>;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_HOLD_DURATION_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ANDROID_PUSH_ICON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_HOST: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_PORT: z.ZodPreprocess<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
@@ -64,7 +88,7 @@ export declare const lcaApiEnvironmentShape: {
         false: "false";
     }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
 };
-export declare const lcaApiEnvironmentSchema: z.ZodObject<{
+export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     NODE_ENV: z.ZodDefault<z.ZodEnum<{
         development: "development";
         test: "test";
@@ -72,6 +96,20 @@ export declare const lcaApiEnvironmentSchema: z.ZodObject<{
     }>>;
     PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED: z.ZodString;
+    SA_SEED_KMS_KEY_ARN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_LOCAL_KEK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_ENCRYPT_WRITES: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    SA_SEED_ALLOW_LEGACY_READ: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
     MONGO_URI: z.ZodString;
     MONGO_DB_NAME: z.ZodString;
     DOMAIN_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -89,6 +127,16 @@ export declare const lcaApiEnvironmentSchema: z.ZodObject<{
     POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELAY_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_RELAY_AUTH_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_MODE: z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodOptional<z.ZodEnum<{
+        software: "software";
+        remote: "remote";
+    }>>>;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_HOLD_DURATION_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ANDROID_PUSH_ICON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_HOST: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_PORT: z.ZodPreprocess<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
@@ -127,20 +175,117 @@ export declare const lcaApiEnvironmentSchema: z.ZodObject<{
         true: "true";
         false: "false";
     }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<{
+    SA_SEED_ENCRYPT_WRITES: boolean;
+    SA_SEED_ALLOW_LEGACY_READ: boolean;
+    NODE_ENV: "development" | "test" | "production";
+    PORT: number;
+    SEED: string;
+    MONGO_URI: string;
+    MONGO_DB_NAME: string;
+    ESCROW_HOLD_DURATION_MS: number;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+    IS_OFFLINE: boolean;
+    IS_CI: boolean;
+    IS_E2E_TEST: boolean;
+    SKIP_DIDKIT_NAPI: boolean;
+    CI: boolean;
+    SA_SEED_KMS_KEY_ARN?: string | undefined;
+    SA_SEED_LOCAL_KEK?: string | undefined;
+    DOMAIN_NAME?: string | undefined;
+    AUTHORIZED_DIDS?: string | undefined;
+    LEARN_CLOUD_URL?: string | undefined;
+    NETWORK_BRAIN_SERVICE_URL?: string | undefined;
+    GOOGLE_APPLICATION_CREDENTIAL?: string | undefined;
+    OPENAI_API_KEY?: string | undefined;
+    METABASE_SECRET_KEY?: string | undefined;
+    SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    POSTMARK_SERVER_TOKEN?: string | undefined;
+    POSTMARK_FROM_EMAIL?: string | undefined;
+    POSTMARK_BRAND_NAME?: string | undefined;
+    POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS?: string | undefined;
+    ESCROW_RELAY_URL?: string | undefined;
+    ESCROW_RELAY_AUTH_TOKEN?: string | undefined;
+    ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ANDROID_PUSH_ICON?: string | undefined;
+    REDIS_HOST?: string | undefined;
+    REDIS_PORT?: number | undefined;
+    NSO_DASHBOARD_ID?: number | undefined;
+    GLOBAL_DASHBOARD_ID?: number | undefined;
+    TROOP_DASHBOARD_ID?: number | undefined;
+    SENTRY_DSN?: string | undefined;
+    SENTRY_ENV?: string | undefined;
+}, {
+    NODE_ENV: "development" | "test" | "production";
+    PORT: number;
+    SEED: string;
+    MONGO_URI: string;
+    MONGO_DB_NAME: string;
+    ESCROW_HOLD_DURATION_MS: number;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+    IS_OFFLINE: boolean;
+    IS_CI: boolean;
+    IS_E2E_TEST: boolean;
+    SKIP_DIDKIT_NAPI: boolean;
+    CI: boolean;
+    SA_SEED_KMS_KEY_ARN?: string | undefined;
+    SA_SEED_LOCAL_KEK?: string | undefined;
+    SA_SEED_ENCRYPT_WRITES?: boolean | undefined;
+    SA_SEED_ALLOW_LEGACY_READ?: boolean | undefined;
+    DOMAIN_NAME?: string | undefined;
+    AUTHORIZED_DIDS?: string | undefined;
+    LEARN_CLOUD_URL?: string | undefined;
+    NETWORK_BRAIN_SERVICE_URL?: string | undefined;
+    GOOGLE_APPLICATION_CREDENTIAL?: string | undefined;
+    OPENAI_API_KEY?: string | undefined;
+    METABASE_SECRET_KEY?: string | undefined;
+    SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    POSTMARK_SERVER_TOKEN?: string | undefined;
+    POSTMARK_FROM_EMAIL?: string | undefined;
+    POSTMARK_BRAND_NAME?: string | undefined;
+    POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS?: string | undefined;
+    ESCROW_RELAY_URL?: string | undefined;
+    ESCROW_RELAY_AUTH_TOKEN?: string | undefined;
+    ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ANDROID_PUSH_ICON?: string | undefined;
+    REDIS_HOST?: string | undefined;
+    REDIS_PORT?: number | undefined;
+    NSO_DASHBOARD_ID?: number | undefined;
+    GLOBAL_DASHBOARD_ID?: number | undefined;
+    TROOP_DASHBOARD_ID?: number | undefined;
+    SENTRY_DSN?: string | undefined;
+    SENTRY_ENV?: string | undefined;
+}>>;
 export type LcaApiEnvironment = z.output<typeof lcaApiEnvironmentSchema>;
 export declare const parseLcaApiEnvironment: (raw: Record<string, unknown>, source?: string) => LcaApiEnvironment;
+export declare const parseEscrowPrivateKeys: (serialized: string) => Record<string, string>;
 export declare const environment: {
+    SA_SEED_ENCRYPT_WRITES: boolean;
+    SA_SEED_ALLOW_LEGACY_READ: boolean;
     NODE_ENV: "development" | "test" | "production";
     PORT: number;
     SEED: string;
     MONGO_URI: string;
     MONGO_DB_NAME: string;
+    ESCROW_HOLD_DURATION_MS: number;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
     IS_OFFLINE: boolean;
     IS_CI: boolean;
     IS_E2E_TEST: boolean;
     SKIP_DIDKIT_NAPI: boolean;
     CI: boolean;
+    SA_SEED_KMS_KEY_ARN?: string | undefined;
+    SA_SEED_LOCAL_KEK?: string | undefined;
     DOMAIN_NAME?: string | undefined;
     AUTHORIZED_DIDS?: string | undefined;
     LEARN_CLOUD_URL?: string | undefined;
@@ -156,6 +301,11 @@ export declare const environment: {
     POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS?: string | undefined;
     POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS?: string | undefined;
     POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS?: string | undefined;
+    ESCROW_RELAY_URL?: string | undefined;
+    ESCROW_RELAY_AUTH_TOKEN?: string | undefined;
+    ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
     ANDROID_PUSH_ICON?: string | undefined;
     REDIS_HOST?: string | undefined;
     REDIS_PORT?: number | undefined;

package/dist/config/environment.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/learnCard.signingAuthority.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/rateLimit.helpers.d.ts

@@ -0,0 +1,4 @@
+export declare const checkRateLimit: (key: string, maxAttempts: number, windowSeconds: number, prefix?: string) => Promise<boolean>;
+export declare const getRateLimitCount: (key: string, prefix?: string) => Promise<number>;
+export declare const clearRateLimit: (key: string, prefix?: string) => Promise<void>;
+export declare const decrementRateLimit: (key: string, prefix?: string) => Promise<void>;