@learncard/lca-api-service 1.3.1 → 1.4.0

package/dist/helpers/seedEncryption.helpers.d.ts

@@ -0,0 +1,23 @@
+import { KMSClient } from '@aws-sdk/client-kms';
+import type { EncryptedSigningAuthoritySeed, SeedEncryptionConfig, SeedEncryption, SeedEncryptionFailure, SigningAuthoritySeedIdentity, SigningAuthoritySeedRecord } from 'types/seed-encryption';
+export declare const SA_SEED_ENCRYPTION_PURPOSE = "lca-signing-authority-seed";
+export declare class SeedEncryptionError extends Error {
+    readonly category: SeedEncryptionFailure;
+    readonly awsRequestId?: string | undefined;
+    constructor(category: SeedEncryptionFailure, awsRequestId?: string | undefined);
+}
+export declare const logSeedEncryptionFailure: (error: unknown, operation: string, record?: {
+    _id?: unknown;
+    keyVersion?: unknown;
+}) => void;
+export declare const getSeedIdentity: (record: {
+    _id?: unknown;
+    ownerDid: string;
+    name: string;
+    did?: string;
+}) => SigningAuthoritySeedIdentity;
+export declare const parseSeedEnvelope: (record: object) => EncryptedSigningAuthoritySeed | undefined;
+export declare const createSeedEncryption: (config: SeedEncryptionConfig, kms?: KMSClient) => SeedEncryption;
+export declare const seedEncryption: SeedEncryption;
+export declare const decryptSigningAuthoritySeed: (record: SigningAuthoritySeedRecord) => Promise<string>;
+export declare const getSeedCacheFingerprint: (record: SigningAuthoritySeedRecord) => string;

package/dist/helpers/seedEncryption.helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 119986604 bytes
-sha256: c5d3d194d7bde48502ddfc43d0513c741a79d171dce75b507c5479e20ca22585
+size: 130294880 bytes
+sha256: a1011a859d7a6b8f2f80b736401ec8e590ef34af0167e08e979d2a8ad252801a

package/dist/migrations/signingAuthoritySeeds.d.ts

@@ -0,0 +1,13 @@
+import type { Db } from 'mongodb';
+import type { SeedMigrationCounts, SeedMigrationRequest, SeedMigrationResult } from 'types/seed-migration';
+export declare const SEED_MIGRATION_STATE_COLLECTION = "signingauthorityseedmigration";
+export declare const SEED_MIGRATION_RECEIPTS_COLLECTION = "signingauthorityseedverification";
+export declare class SeedMigrationError extends Error {
+    readonly category: string;
+    constructor(category: string);
+}
+export declare const countSeedMigrationDocuments: (db: Db) => Promise<SeedMigrationCounts>;
+export declare const runSeedMigrationBatch: (db: Db, request: SeedMigrationRequest, options: {
+    encryptedWritesEnabled: boolean;
+    remainingTime?: () => number;
+}) => Promise<SeedMigrationResult>;

package/dist/migrations/signingAuthoritySeedsCli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/models/EscrowHold.d.ts

@@ -0,0 +1,75 @@
+import { z } from 'zod';
+import type { Collection } from 'mongodb';
+import { type AuthProviderMapping } from './UserKey';
+export declare const ESCROW_HOLDS_COLLECTION = "escrowholds";
+export declare const ESCROW_HOLD_STALE_WINDOW_MS: number;
+export declare const ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+export declare const EscrowHoldValidator: z.ZodObject<{
+    _id: z.ZodString;
+    authProvider: z.ZodObject<{
+        type: z.ZodEnum<{
+            firebase: "firebase";
+            supertokens: "supertokens";
+            keycloak: "keycloak";
+            oidc: "oidc";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>;
+    primaryDid: z.ZodString;
+    shareVersion: z.ZodNumber;
+    status: z.ZodEnum<{
+        pending: "pending";
+        cancelled: "cancelled";
+        completed: "completed";
+        expired: "expired";
+    }>;
+    identityProofType: z.ZodEnum<{
+        "auth-token": "auth-token";
+        "recovery-session": "recovery-session";
+    }>;
+    requestedAt: z.ZodDate;
+    releaseAfter: z.ZodDate;
+    releasePolicy: z.ZodDefault<z.ZodEnum<{
+        pin: "pin";
+        hold: "hold";
+    }>>;
+    cancelReason: z.ZodOptional<z.ZodEnum<{
+        "pin-mismatch": "pin-mismatch";
+        "pin-locked": "pin-locked";
+        superseded: "superseded";
+        "release-failed": "release-failed";
+    }>>;
+    cancelledAt: z.ZodOptional<z.ZodDate>;
+    cancelledBy: z.ZodOptional<z.ZodEnum<{
+        did: "did";
+        system: "system";
+    }>>;
+    completedAt: z.ZodOptional<z.ZodDate>;
+    clientEphemeralPublicKey: z.ZodString;
+    resumeTokenHash: z.ZodString;
+    notifications: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            cancelled: "cancelled";
+            completed: "completed";
+            started: "started";
+        }>;
+        sentAt: z.ZodDate;
+    }, z.core.$strip>>>;
+    requestIp: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export type EscrowHold = z.infer<typeof EscrowHoldValidator>;
+export type CreateEscrowHoldInput = Omit<z.input<typeof EscrowHoldValidator>, '_id' | 'status' | 'createdAt' | 'updatedAt' | 'notifications' | 'cancelledAt' | 'cancelledBy' | 'completedAt' | 'cancelReason'>;
+export declare const getEscrowHoldsCollection: () => Collection<EscrowHold>;
+export declare const createEscrowHoldsIndexes: () => Promise<void>;
+export declare const createEscrowHold: (input: CreateEscrowHoldInput) => Promise<EscrowHold>;
+export declare const findPendingEscrowHoldByAuthProvider: (authProvider: AuthProviderMapping, releasePolicy?: EscrowHold["releasePolicy"]) => Promise<EscrowHold | null>;
+export declare const findEscrowHoldById: (id: string) => Promise<EscrowHold | null>;
+export declare const cancelEscrowHold: (id: string, cancelledBy: "did" | "system", cancelReason?: EscrowHold["cancelReason"]) => Promise<EscrowHold | null>;
+export declare const completeEscrowHold: (id: string) => Promise<EscrowHold | null>;
+export declare const hasCompletedEscrowHoldForVersion: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
+export declare const expireStaleEscrowHolds: (now: Date) => Promise<number>;
+export declare const markClaimedEscrowHoldFailed: (id: string, reason: "pin-mismatch" | "pin-locked" | "release-failed", completedAt: Date) => Promise<void>;
+export declare const hashEscrowResumeToken: (token: string) => string;
+export declare const generateEscrowResumeToken: () => string;

package/dist/models/SigningAuthority.d.ts

@@ -4,7 +4,13 @@ export declare const MongoSigningAuthorityValidator: z.ZodObject<{
     _id: z.ZodOptional<z.ZodString>;
     ownerDid: z.ZodString;
     name: z.ZodString;
-    seed: z.ZodString;
+    seed: z.ZodOptional<z.ZodString>;
+    encryptedSeed: z.ZodOptional<z.ZodString>;
+    encryptedDek: z.ZodOptional<z.ZodString>;
+    keyVersion: z.ZodOptional<z.ZodEnum<{
+        "kms-v1": "kms-v1";
+        "local-v1": "local-v1";
+    }>>;
     did: z.ZodOptional<z.ZodString>;
     endpoint: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/models/UserKey.d.ts

@@ -33,8 +33,14 @@ export declare const RecoveryMethodValidator: z.ZodObject<{
         passkey: "passkey";
         backup: "backup";
         phrase: "phrase";
+        escrow: "escrow";
     }>;
     createdAt: z.ZodDate;
+    confirmationStatus: z.ZodOptional<z.ZodEnum<{
+        pending: "pending";
+        confirmed: "confirmed";
+    }>>;
+    confirmedAt: z.ZodOptional<z.ZodDate>;
     credentialId: z.ZodOptional<z.ZodString>;
     encryptedShare: z.ZodOptional<z.ZodObject<{
         encryptedData: z.ZodString;
@@ -42,6 +48,10 @@ export declare const RecoveryMethodValidator: z.ZodObject<{
         salt: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     shareVersion: z.ZodOptional<z.ZodNumber>;
+    confirmationCodeHash: z.ZodOptional<z.ZodString>;
+    confirmationCodeExpiresAt: z.ZodOptional<z.ZodDate>;
+    confirmationAttempts: z.ZodOptional<z.ZodNumber>;
+    confirmationEmail: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const PreviousAuthShareValidator: z.ZodObject<{
     authShare: z.ZodObject<{
@@ -52,7 +62,95 @@ export declare const PreviousAuthShareValidator: z.ZodObject<{
     shareVersion: z.ZodNumber;
     createdAt: z.ZodDate;
 }, z.core.$strip>;
-export declare const MongoUserKeyValidator: z.ZodObject<{
+export declare const EscrowEnvelopeValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    iv: z.ZodString;
+    ciphertext: z.ZodString;
+}, z.core.$strict>;
+export declare const EscrowBlobValidator: z.ZodObject<{
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>;
+    enclaveKeyId: z.ZodString;
+    enclaveMode: z.ZodEnum<{
+        software: "software";
+        nitro: "nitro";
+    }>;
+    measurements: z.ZodObject<{
+        imageSha384: z.ZodOptional<z.ZodString>;
+        pcr0: z.ZodOptional<z.ZodString>;
+        pcr1: z.ZodOptional<z.ZodString>;
+        pcr2: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    shareVersion: z.ZodNumber;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type EscrowBlob = z.infer<typeof EscrowBlobValidator>;
+export declare const EscrowPinSaltValidator: z.ZodString;
+export declare const EscrowPinValidator: z.ZodObject<{
+    salt: z.ZodString;
+    failedAttempts: z.ZodNumber;
+    verifiedFailedAttempts: z.ZodOptional<z.ZodNumber>;
+    enabledAt: z.ZodDate;
+    disabledAt: z.ZodOptional<z.ZodDate>;
+    shareVersion: z.ZodNumber;
+}, z.core.$strip>;
+export declare const EscrowPinStatusValidator: z.ZodObject<{
+    state: z.ZodEnum<{
+        none: "none";
+        enabled: "enabled";
+        locked: "locked";
+        stale: "stale";
+    }>;
+    enabled: z.ZodBoolean;
+    attemptsRemaining: z.ZodNumber;
+    salt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const getEscrowPinStatus: (userKey: MongoUserKeyType) => z.infer<typeof EscrowPinStatusValidator>;
+declare const MongoUserKeyBaseValidator: z.ZodObject<{
+    escrowBlob: z.ZodOptional<z.ZodObject<{
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            iv: z.ZodString;
+            ciphertext: z.ZodString;
+        }, z.core.$strict>;
+        enclaveKeyId: z.ZodString;
+        enclaveMode: z.ZodEnum<{
+            software: "software";
+            nitro: "nitro";
+        }>;
+        measurements: z.ZodObject<{
+            imageSha384: z.ZodOptional<z.ZodString>;
+            pcr0: z.ZodOptional<z.ZodString>;
+            pcr1: z.ZodOptional<z.ZodString>;
+            pcr2: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        shareVersion: z.ZodNumber;
+        createdAt: z.ZodDate;
+    }, z.core.$strip>>;
+    escrowPin: z.ZodOptional<z.ZodObject<{
+        salt: z.ZodString;
+        failedAttempts: z.ZodNumber;
+        verifiedFailedAttempts: z.ZodOptional<z.ZodNumber>;
+        enabledAt: z.ZodDate;
+        disabledAt: z.ZodOptional<z.ZodDate>;
+        shareVersion: z.ZodNumber;
+    }, z.core.$strip>>;
+    escrowOptedOutAt: z.ZodOptional<z.ZodDate>;
     _id: z.ZodOptional<z.ZodString>;
     contactMethod: z.ZodObject<{
         type: z.ZodEnum<{
@@ -103,8 +201,14 @@ export declare const MongoUserKeyValidator: z.ZodObject<{
             passkey: "passkey";
             backup: "backup";
             phrase: "phrase";
+            escrow: "escrow";
         }>;
         createdAt: z.ZodDate;
+        confirmationStatus: z.ZodOptional<z.ZodEnum<{
+            pending: "pending";
+            confirmed: "confirmed";
+        }>>;
+        confirmedAt: z.ZodOptional<z.ZodDate>;
         credentialId: z.ZodOptional<z.ZodString>;
         encryptedShare: z.ZodOptional<z.ZodObject<{
             encryptedData: z.ZodString;
@@ -112,15 +216,140 @@ export declare const MongoUserKeyValidator: z.ZodObject<{
             salt: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         shareVersion: z.ZodOptional<z.ZodNumber>;
+        confirmationCodeHash: z.ZodOptional<z.ZodString>;
+        confirmationCodeExpiresAt: z.ZodOptional<z.ZodDate>;
+        confirmationAttempts: z.ZodOptional<z.ZodNumber>;
+        confirmationEmail: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
     recoveryEmail: z.ZodOptional<z.ZodString>;
     recoveryEmailVerifiedAt: z.ZodOptional<z.ZodDate>;
     migratedFromWeb3Auth: z.ZodDefault<z.ZodBoolean>;
     migratedAt: z.ZodOptional<z.ZodDate>;
+    sssActivationState: z.ZodOptional<z.ZodEnum<{
+        provisional: "provisional";
+        active: "active";
+    }>>;
+    provisionalCreatedAt: z.ZodOptional<z.ZodDate>;
     createdAt: z.ZodDate;
     updatedAt: z.ZodDate;
 }, z.core.$strip>;
-export type MongoUserKeyType = z.infer<typeof MongoUserKeyValidator>;
+export declare const MongoUserKeyValidator: z.ZodObject<{
+    escrowBlob: z.ZodOptional<z.ZodObject<{
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            iv: z.ZodString;
+            ciphertext: z.ZodString;
+        }, z.core.$strict>;
+        enclaveKeyId: z.ZodString;
+        enclaveMode: z.ZodEnum<{
+            software: "software";
+            nitro: "nitro";
+        }>;
+        measurements: z.ZodObject<{
+            imageSha384: z.ZodOptional<z.ZodString>;
+            pcr0: z.ZodOptional<z.ZodString>;
+            pcr1: z.ZodOptional<z.ZodString>;
+            pcr2: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        shareVersion: z.ZodNumber;
+        createdAt: z.ZodDate;
+    }, z.core.$strip>>;
+    escrowPin: z.ZodOptional<z.ZodObject<{
+        salt: z.ZodString;
+        failedAttempts: z.ZodNumber;
+        verifiedFailedAttempts: z.ZodOptional<z.ZodNumber>;
+        enabledAt: z.ZodDate;
+        disabledAt: z.ZodOptional<z.ZodDate>;
+        shareVersion: z.ZodNumber;
+    }, z.core.$strip>>;
+    escrowOptedOutAt: z.ZodOptional<z.ZodDate>;
+    _id: z.ZodOptional<z.ZodString>;
+    contactMethod: z.ZodObject<{
+        type: z.ZodEnum<{
+            email: "email";
+            phone: "phone";
+        }>;
+        value: z.ZodString;
+    }, z.core.$strip>;
+    authProviders: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            firebase: "firebase";
+            supertokens: "supertokens";
+            keycloak: "keycloak";
+            oidc: "oidc";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>>>;
+    primaryDid: z.ZodString;
+    linkedDids: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    keyProvider: z.ZodDefault<z.ZodEnum<{
+        web3auth: "web3auth";
+        sss: "sss";
+    }>>;
+    authShare: z.ZodOptional<z.ZodObject<{
+        encryptedData: z.ZodString;
+        encryptedDek: z.ZodString;
+        iv: z.ZodString;
+    }, z.core.$strip>>;
+    shareVersion: z.ZodDefault<z.ZodNumber>;
+    shareUpdatedAt: z.ZodOptional<z.ZodDate>;
+    previousAuthShares: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        authShare: z.ZodObject<{
+            encryptedData: z.ZodString;
+            encryptedDek: z.ZodString;
+            iv: z.ZodString;
+        }, z.core.$strip>;
+        shareVersion: z.ZodNumber;
+        createdAt: z.ZodDate;
+    }, z.core.$strip>>>;
+    securityLevel: z.ZodDefault<z.ZodEnum<{
+        basic: "basic";
+        enhanced: "enhanced";
+        advanced: "advanced";
+    }>>;
+    recoveryMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            email: "email";
+            passkey: "passkey";
+            backup: "backup";
+            phrase: "phrase";
+            escrow: "escrow";
+        }>;
+        createdAt: z.ZodDate;
+        confirmationStatus: z.ZodOptional<z.ZodEnum<{
+            pending: "pending";
+            confirmed: "confirmed";
+        }>>;
+        confirmedAt: z.ZodOptional<z.ZodDate>;
+        credentialId: z.ZodOptional<z.ZodString>;
+        encryptedShare: z.ZodOptional<z.ZodObject<{
+            encryptedData: z.ZodString;
+            iv: z.ZodString;
+            salt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        shareVersion: z.ZodOptional<z.ZodNumber>;
+        confirmationCodeHash: z.ZodOptional<z.ZodString>;
+        confirmationCodeExpiresAt: z.ZodOptional<z.ZodDate>;
+        confirmationAttempts: z.ZodOptional<z.ZodNumber>;
+        confirmationEmail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    recoveryEmail: z.ZodOptional<z.ZodString>;
+    recoveryEmailVerifiedAt: z.ZodOptional<z.ZodDate>;
+    migratedFromWeb3Auth: z.ZodDefault<z.ZodBoolean>;
+    migratedAt: z.ZodOptional<z.ZodDate>;
+    sssActivationState: z.ZodOptional<z.ZodEnum<{
+        provisional: "provisional";
+        active: "active";
+    }>>;
+    provisionalCreatedAt: z.ZodOptional<z.ZodDate>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$loose>;
+export type MongoUserKeyType = z.infer<typeof MongoUserKeyBaseValidator>;
 export type ContactMethod = z.infer<typeof ContactMethodValidator>;
 export type AuthProviderMapping = z.infer<typeof AuthProviderMappingValidator>;
 export type ServerEncryptedShare = z.infer<typeof ServerEncryptedShareValidator>;
@@ -128,6 +357,13 @@ export type EncryptedShare = z.infer<typeof EncryptedShareValidator>;
 export type RecoveryMethod = z.infer<typeof RecoveryMethodValidator>;
 export type PreviousAuthShare = z.infer<typeof PreviousAuthShareValidator>;
 export declare const MAX_PREVIOUS_AUTH_SHARES = 5;
+export declare const PROVISIONAL_MIGRATION_TTL_MS: number;
+export declare class UserKeyVersionConflictError extends Error {
+    constructor();
+}
+export declare const getSssActivationState: (userKey: MongoUserKeyType) => "provisional" | "active";
+export declare const isRecoveryMethodConfirmed: (userKey: MongoUserKeyType, method: RecoveryMethod) => boolean;
+export declare const hasActivatableRecoveryMethod: (userKey: MongoUserKeyType) => boolean;
 export { pruneOrphanedRecoveryMethods };
 export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     contactMethod: {
@@ -153,8 +389,10 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     }[];
     securityLevel: "basic" | "enhanced" | "advanced";
     recoveryMethods: {
-        type: "email" | "passkey" | "backup" | "phrase";
+        type: "email" | "passkey" | "backup" | "phrase" | "escrow";
         createdAt: Date;
+        confirmationStatus?: "pending" | "confirmed" | undefined;
+        confirmedAt?: Date | undefined;
         credentialId?: string | undefined;
         encryptedShare?: {
             encryptedData: string;
@@ -162,10 +400,44 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
             salt?: string | undefined;
         } | undefined;
         shareVersion?: number | undefined;
+        confirmationCodeHash?: string | undefined;
+        confirmationCodeExpiresAt?: Date | undefined;
+        confirmationAttempts?: number | undefined;
+        confirmationEmail?: string | undefined;
     }[];
     migratedFromWeb3Auth: boolean;
     createdAt: Date;
     updatedAt: Date;
+    escrowBlob?: {
+        envelope: {
+            version: 1;
+            algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+            keyId: string;
+            ephemeralPublicKey: string;
+            salt: string;
+            iv: string;
+            ciphertext: string;
+        };
+        enclaveKeyId: string;
+        enclaveMode: "software" | "nitro";
+        measurements: {
+            imageSha384?: string | undefined;
+            pcr0?: string | undefined;
+            pcr1?: string | undefined;
+            pcr2?: string | undefined;
+        };
+        shareVersion: number;
+        createdAt: Date;
+    } | undefined;
+    escrowPin?: {
+        salt: string;
+        failedAttempts: number;
+        enabledAt: Date;
+        shareVersion: number;
+        verifiedFailedAttempts?: number | undefined;
+        disabledAt?: Date | undefined;
+    } | undefined;
+    escrowOptedOutAt?: Date | undefined;
     _id?: string | undefined;
     authShare?: {
         encryptedData: string;
@@ -176,16 +448,57 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     recoveryEmail?: string | undefined;
     recoveryEmailVerifiedAt?: Date | undefined;
     migratedAt?: Date | undefined;
+    sssActivationState?: "provisional" | "active" | undefined;
+    provisionalCreatedAt?: Date | undefined;
 }>;
 export declare const createUserKeysIndexes: () => Promise<void>;
+export declare const ensureUserKeysIndexes: () => Promise<void>;
 export declare const findUserKeyByContactMethod: (contactMethod: ContactMethod) => Promise<MongoUserKeyType | null>;
 export declare const findUserKeyByAuthProvider: (providerType: string, providerId: string) => Promise<MongoUserKeyType | null>;
 export declare const findUserKeyByDid: (did: string) => Promise<MongoUserKeyType | null>;
+export declare const findUniqueUserKeyByVerifiedRecoveryEmail: (email: string) => Promise<MongoUserKeyType | null>;
 export declare const findAuthShareByVersion: (userKey: MongoUserKeyType, version: number) => ServerEncryptedShare | null;
 export declare const upsertUserKey: (contactMethod: ContactMethod, data: Partial<Omit<MongoUserKeyType, "_id" | "contactMethod" | "createdAt">>) => Promise<MongoUserKeyType>;
+export declare const upsertUserKeyByAuthProvider: (contactMethod: ContactMethod, authProvider: AuthProviderMapping, data: Partial<Omit<MongoUserKeyType, "_id" | "contactMethod" | "createdAt" | "authProviders">>, expectedVersion?: number) => Promise<MongoUserKeyType>;
 export declare const addAuthProviderToUserKey: (contactMethod: ContactMethod, authProvider: AuthProviderMapping) => Promise<void>;
 export declare const addRecoveryMethodToUserKey: (contactMethod: ContactMethod, recoveryMethod: RecoveryMethod) => Promise<void>;
+export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, blob: EscrowBlob, expectedShareVersion: number, pin?: {
+    salt: string;
+}, carryFrom?: {
+    blob: EscrowBlob;
+    pin: NonNullable<MongoUserKeyType["escrowPin"]>;
+}) => Promise<MongoUserKeyType | null>;
+export declare const clearEscrowByAuthProvider: (authProvider: AuthProviderMapping, { optOut }: {
+    optOut: boolean;
+}) => Promise<MongoUserKeyType | null>;
+export declare const setEscrowOptInByAuthProvider: (authProvider: AuthProviderMapping) => Promise<MongoUserKeyType | null>;
+export declare const reserveEscrowPinAttempt: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext?: string) => Promise<MongoUserKeyType | null>;
+export declare const refundEscrowPinAttempt: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext: string) => Promise<void>;
+export declare const recordEscrowPinFailure: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext: string) => Promise<MongoUserKeyType | null>;
+export declare const disableEscrowPin: (authProvider: AuthProviderMapping, shareVersion?: number, expectedCiphertext?: string) => Promise<boolean>;
+export declare const addRecoveryMethodToUserKeyByAuthProvider: (authProvider: AuthProviderMapping, recoveryMethod: RecoveryMethod) => Promise<void>;
+export declare const removeRecoveryMethodFromUserKeyByAuthProvider: (authProvider: AuthProviderMapping, type: RecoveryMethod["type"], credentialId?: string) => Promise<void>;
+export declare const incrementRecoveryConfirmationAttemptsByAuthProvider: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
+export declare const confirmRecoveryMethodByAuthProvider: (authProvider: AuthProviderMapping, type: RecoveryMethod["type"], shareVersion: number, credentialId?: string) => Promise<boolean>;
 export declare const markUserKeyMigrated: (contactMethod: ContactMethod) => Promise<void>;
+export declare const markUserKeyMigratedByAuthProvider: (authProvider: AuthProviderMapping) => Promise<void>;
+export declare const markUserKeyMigrationProvisionalByAuthProvider: (authProvider: AuthProviderMapping, provisionalCreatedAt: Date) => Promise<boolean>;
+export declare const activateUserKeyByAuthProvider: (authProvider: AuthProviderMapping, shareVersion: number, isMigration: boolean) => Promise<boolean>;
+export declare const purgeExpiredProvisionalMigrationByAuthProvider: (authProvider: AuthProviderMapping, now?: Date) => Promise<boolean>;
 export declare const setRecoveryEmail: (contactMethod: ContactMethod, email: string) => Promise<void>;
+export declare const setRecoveryEmailByAuthProvider: (authProvider: AuthProviderMapping, email: string) => Promise<void>;
 export declare const upgradeContactMethod: (oldContactMethod: ContactMethod, newContactMethod: ContactMethod) => Promise<boolean>;
+export declare const upgradeContactMethodByAuthProvider: (authProvider: AuthProviderMapping, expectedOldContactMethod: ContactMethod, newContactMethod: ContactMethod) => Promise<boolean>;
 export declare const deleteUserKey: (contactMethod: ContactMethod) => Promise<void>;
+export declare const deleteUserKeyByAuthProvider: (authProvider: AuthProviderMapping) => Promise<void>;
+export interface CompleteIdentityRebindInput {
+    oldAuthProvider: AuthProviderMapping;
+    newAuthProvider: AuthProviderMapping;
+    newContactMethod: ContactMethod;
+    primaryDid: string;
+    authShare: ServerEncryptedShare;
+}
+export declare const completeIdentityRebind: (input: CompleteIdentityRebindInput) => Promise<{
+    shareVersion: number;
+    methodsRequiringConfirmation: RecoveryMethod["type"][];
+} | null>;

package/dist/models/UserKey.escrowPin.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/models/index.d.ts

@@ -5,3 +5,4 @@ export * from './SigningAuthority';
 export * from './Pins';
 export * from './Preferences';
 export * from './UserKey';
+export * from './EscrowHold';