@learncard/lca-api-service 1.3.1 → 1.4.0

package/dist/routes/escrow.d.ts

@@ -0,0 +1,150 @@
+export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("@routes").Context;
+    meta: import("trpc-to-openapi").OpenApiMeta;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    getAttestation: import("@trpc/server").TRPCQueryProcedure<{
+        input: Record<string, never>;
+        output: {
+            attestation: {
+                mode: "software" | "nitro";
+                keyId: string;
+                publicKey: string;
+                measurements: {
+                    imageSha384?: string | undefined;
+                    pcr0?: string | undefined;
+                    pcr1?: string | undefined;
+                    pcr2?: string | undefined;
+                };
+                document: string;
+                issuedAt: string;
+            };
+            holdDurationMs: number;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    enroll: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            envelope: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            };
+            shareVersion: number;
+            enclaveKeyId: string;
+            pinSalt?: string | undefined;
+            clearPin?: boolean | undefined;
+        };
+        output: {
+            success: true;
+            shareVersion: number;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    remove: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            optOut: boolean;
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    optIn: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    startRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            clientEphemeralPublicKey: string;
+            releasePolicy?: "pin" | "hold" | undefined;
+            restart?: boolean | undefined;
+            authToken?: string | undefined;
+            providerType?: "firebase" | "supertokens" | "keycloak" | "oidc" | undefined;
+            recoverySessionToken?: string | undefined;
+        };
+        output: {
+            requestedAt: string;
+            releaseAfter: string;
+            releasePolicy: "pin" | "hold";
+            holdId: string;
+            status: "pending";
+            resumeToken: string | null;
+            pinSalt?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    getStatus: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            holdId?: string | undefined;
+            resumeToken?: string | undefined;
+            authToken?: string | undefined;
+            providerType?: "firebase" | "supertokens" | "keycloak" | "oidc" | undefined;
+        };
+        output: {
+            hold: {
+                holdId: string;
+                status: "pending" | "cancelled" | "completed" | "expired";
+                requestedAt: string;
+                releaseAfter: string;
+                releasePolicy: "pin" | "hold";
+                cancelledAt?: string | undefined;
+                completedAt?: string | undefined;
+            } | null;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    cancelRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+        };
+        output: {
+            success: true;
+            cancelled: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    completeRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            resumeToken: string;
+            pinProof?: string | undefined;
+        };
+        output: {
+            sealedShare: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            };
+            authShare: {
+                encryptedData: string;
+                encryptedDek: string;
+                iv: string;
+            };
+            primaryDid: string;
+            shareVersion: number;
+            rebindSessionToken: string;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+}>>;

package/dist/routes/firebase.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/routes/index.d.ts

@@ -24,6 +24,7 @@ export type Context = {
     tenant: ResolvedTenant;
     debug?: boolean;
     clientIp?: string;
+    providerToken?: string;
 };
 export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMeta, import("@trpc/server").TRPCRuntimeConfigOptions<Context, OpenApiMeta>, {
     ctx: Context;
@@ -32,6 +33,7 @@ export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMe
     transformer: false;
 }>;
 export declare const createContext: (options: CreateAWSLambdaContextOptions<APIGatewayProxyEventV2> | CreateFastifyContextOptions | NodeHTTPCreateContextFnOptions<IncomingMessage, ServerResponse>) => Promise<Context>;
+export declare const redactSecretFields: (value: unknown, depth?: number, seen?: Set<object>) => unknown;
 export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
     user: {
@@ -42,6 +44,7 @@ export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Cont
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
@@ -53,6 +56,7 @@ export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Conte
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
@@ -64,6 +68,7 @@ export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBui
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
@@ -75,4 +80,5 @@ export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureB
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;

package/dist/routes/keys.d.ts

@@ -1,9 +1,126 @@
+import { z } from 'zod';
+import { AuthProviderType } from '@helpers/auth.helpers';
+import { type ContactMethod, type AuthProviderMapping, type MongoUserKeyType } from '@models';
+export declare const AuthProviderTypeValidator: z.ZodEnum<{
+    firebase: "firebase";
+    supertokens: "supertokens";
+    keycloak: "keycloak";
+    oidc: "oidc";
+}>;
+export declare const AuthInputValidator: z.ZodObject<{
+    authToken: z.ZodString;
+    providerType: z.ZodEnum<{
+        firebase: "firebase";
+        supertokens: "supertokens";
+        keycloak: "keycloak";
+        oidc: "oidc";
+    }>;
+}, z.core.$strip>;
+export declare const RecoverySessionTokenValidator: z.ZodString;
+export declare function verifyAndGetContactMethod(input: {
+    authToken: string;
+    providerType: AuthProviderType;
+}): Promise<{
+    user: {
+        id: string;
+        email?: string;
+        phone?: string;
+        providerType: string;
+    };
+    contactMethod: ContactMethod;
+    authProvider: AuthProviderMapping;
+}>;
+export declare const requireUserKey: (authProvider: AuthProviderMapping, message?: string) => Promise<MongoUserKeyType>;
+export declare const assertDidOwner: (userKey: MongoUserKeyType, authenticatedDid: string) => void;
+export declare const requireRecoverySession: (token: string, scope: "recover" | "rebind") => Promise<AuthProviderMapping>;
 export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
     ctx: import("@routes").Context;
     meta: import("trpc-to-openapi").OpenApiMeta;
     errorShape: import("@trpc/server").TRPCDefaultErrorShape;
     transformer: false;
 }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    startRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            email: string;
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    verifyRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            email: string;
+            code: string;
+        };
+        output: {
+            recoverySessionToken: string;
+            recoveryMethods: {
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                createdAt: string;
+                credentialId?: string | undefined;
+                shareVersion?: number | undefined;
+            }[];
+            escrowPin: {
+                state: "enabled" | "none" | "locked" | "stale";
+                enabled: boolean;
+                attemptsRemaining: number;
+                salt?: string | undefined;
+            };
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    useRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            recoverySessionToken: string;
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            credentialId?: string | undefined;
+        };
+        output: {
+            authShare: {
+                encryptedData: string;
+                encryptedDek: string;
+                iv: string;
+            };
+            primaryDid: string;
+            shareVersion: number;
+            rebindSessionToken: string;
+            encryptedShare?: {
+                encryptedData: string;
+                iv: string;
+                salt?: string | undefined;
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    completeRecoveryRebind: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            recoverySessionToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            primaryDid: string;
+            authShare: {
+                encryptedData: string;
+                encryptedDek: string;
+                iv: string;
+            };
+            newAuthToken?: string | undefined;
+        };
+        output: {
+            success: true;
+            shareVersion: number;
+            recoveryMethodsRequireConfirmation: ("email" | "passkey" | "backup" | "phrase" | "escrow")[];
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    issueDidChallenge: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            did: string;
+        };
+        output: {
+            challenge: string;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     getAuthShare: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
@@ -19,14 +136,23 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
             primaryDid: string | null;
             securityLevel: "basic" | "enhanced" | "advanced";
             recoveryMethods: {
-                type: "email" | "passkey" | "backup" | "phrase";
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
                 createdAt: string;
                 credentialId?: string | undefined;
                 shareVersion?: number | undefined;
+                confirmedAt?: string | undefined;
             }[];
             keyProvider: "web3auth" | "sss";
             shareVersion: number;
             maskedRecoveryEmail: string | null;
+            escrowOptedOut: boolean;
+            escrowPin: {
+                state: "enabled" | "none" | "locked" | "stale";
+                enabled: boolean;
+                attemptsRemaining: number;
+                salt?: string | undefined;
+            };
+            sssActivationState: "provisional" | "active";
         } | null;
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -42,10 +168,13 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
             primaryDid: string;
             securityLevel?: "basic" | "enhanced" | "advanced" | undefined;
             keyProvider?: "web3auth" | "sss" | undefined;
+            sssActivationState?: "provisional" | undefined;
+            expectedShareVersion?: number | undefined;
         };
         output: {
             success: boolean;
             shareVersion: number;
+            expectedShareVersionChecked: boolean;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -53,7 +182,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-            type: "email" | "passkey" | "backup" | "phrase";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
             encryptedShare?: {
                 encryptedData: string;
                 iv: string;
@@ -67,11 +196,36 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
-    getRecoveryShare: import("@trpc/server").TRPCQueryProcedure<{
+    confirmRecoveryMethod: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-            type: "email" | "passkey" | "backup" | "phrase";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            credentialId?: string | undefined;
+            code?: string | undefined;
+        };
+        output: {
+            success: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    deleteRecoveryMethod: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            credentialId?: string | undefined;
+        };
+        output: {
+            success: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    getRecoveryShare: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            authToken?: string | undefined;
             credentialId?: string | undefined;
         };
         output: {
@@ -94,6 +248,16 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    activate: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+        };
+        output: {
+            success: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     addRecoveryEmail: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
@@ -131,9 +295,18 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-            emailShare: string;
-            email?: string | undefined;
-            useRecoveryEmail?: boolean | undefined;
+            relayPayload: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            };
+            confirmationCode: string;
+            email: string;
+            shareVersion?: number | undefined;
         };
         output: {
             success: boolean;
@@ -159,6 +332,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            challenge: string;
         };
         output: {
             success: boolean;

package/dist/routes/qr-login.d.ts

@@ -22,7 +22,7 @@ export declare const qrLoginRouter: import("@trpc/server").TRPCBuiltRouter<{
         output: {
             sessionId: string;
             publicKey: string;
-            status: "approved" | "pending";
+            status: "pending" | "approved";
             encryptedPayload?: string | undefined;
             approverDid?: string | undefined;
         };

package/dist/services/escrow-enclave/index.d.ts

@@ -0,0 +1,9 @@
+import { type EscrowEnclave } from './types';
+export * from './types';
+export * from './softwareEnclave';
+export * from './notifications';
+export declare const isEscrowEnabled: () => boolean;
+export declare const getEscrowHoldDurationMs: () => number;
+export declare const getEscrowHoldRestartMinAgeMs: () => number;
+export declare const getEscrowEnclave: () => EscrowEnclave;
+export declare const __setEscrowEnclaveForTests: (replacement: EscrowEnclave | undefined) => void;

package/dist/services/escrow-enclave/notifications.d.ts

@@ -0,0 +1,9 @@
+import type { EscrowHold } from '../../models/EscrowHold';
+import type { MongoUserKeyType } from '../../models/UserKey';
+export interface EscrowHoldEvent {
+    kind: 'started' | 'cancelled' | 'completed';
+    hold: EscrowHold;
+    userKey: MongoUserKeyType;
+    reason?: 'superseded';
+}
+export declare const notifyEscrowHoldEvent: (event: EscrowHoldEvent) => Promise<void>;

package/dist/services/escrow-enclave/softwareEnclave.d.ts

@@ -0,0 +1,17 @@
+import { type EscrowEnclave, type EnclaveAttestation, type VerifyEscrowBlobInput, type VerifyEscrowBlobResult, type ReleaseRequest, type ReleaseResult, type CarryPinVerifierInput } from './types';
+export interface SoftwareEnclaveConfig {
+    privateKeys: Record<string, string>;
+    activeKeyId: string;
+}
+export declare class SoftwareEnclave implements EscrowEnclave {
+    private readonly privateKeys;
+    private readonly activeKeyId;
+    constructor(config: SoftwareEnclaveConfig);
+    getAttestation(): Promise<EnclaveAttestation>;
+    private decrypt;
+    verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
+    carryPinVerifier(input: CarryPinVerifierInput): Promise<{
+        envelope: import("@learncard/sss-key-manager").EscrowEnvelope;
+    }>;
+    releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
+}

package/dist/services/escrow-enclave/softwareEnclave.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/types.d.ts

@@ -0,0 +1,67 @@
+import type { EscrowEnvelope } from '@learncard/sss-key-manager';
+import type { EscrowHold } from '../../models/EscrowHold';
+export interface EnclaveAttestation {
+    mode: 'software' | 'nitro';
+    keyId: string;
+    publicKey: string;
+    measurements: {
+        imageSha384?: string;
+        pcr0?: string;
+        pcr1?: string;
+        pcr2?: string;
+    };
+    document: string;
+    issuedAt: string;
+}
+export type EscrowHoldForEnclave = Pick<EscrowHold, '_id' | 'status' | 'releaseAfter' | 'releasePolicy' | 'primaryDid' | 'shareVersion' | 'clientEphemeralPublicKey'>;
+export interface VerifyEscrowBlobInput {
+    envelope: EscrowEnvelope;
+    expectedDid: string;
+    expectedShareVersion: number;
+}
+export type VerifyEscrowBlobResult = {
+    ok: true;
+    hasPin: boolean;
+} | {
+    ok: false;
+    hasPin: boolean;
+    reason: string;
+};
+export interface ReleaseRequest {
+    envelope: EscrowEnvelope;
+    hold: EscrowHoldForEnclave;
+    clientEphemeralPublicKey: string;
+    expectedDid: string;
+    now?: Date;
+    pinProof?: string;
+}
+export interface ReleaseResult {
+    sealed: EscrowEnvelope;
+}
+export interface CarryPinVerifierInput {
+    sourceEnvelope: EscrowEnvelope;
+    targetEnvelope: EscrowEnvelope;
+    expectedDid: string;
+    sourceShareVersion: number;
+    targetShareVersion: number;
+}
+export interface EscrowEnclave {
+    getAttestation(): Promise<EnclaveAttestation>;
+    verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
+    carryPinVerifier(input: CarryPinVerifierInput): Promise<{
+        envelope: EscrowEnvelope;
+    }>;
+    releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
+}
+export declare class EscrowPolicyError extends Error {
+    constructor();
+}
+export declare class EscrowPinMismatchError extends Error {
+    constructor();
+}
+export declare class EscrowBlobError extends Error {
+    constructor();
+}
+export declare class EscrowUnavailableError extends Error {
+    constructor();
+}

package/dist/types/seed-encryption.d.ts

@@ -0,0 +1,31 @@
+export interface SigningAuthoritySeedIdentity {
+    _id: string;
+    ownerDid: string;
+    name: string;
+    did?: string;
+}
+export interface EncryptedSigningAuthoritySeed {
+    encryptedSeed: string;
+    encryptedDek: string;
+    keyVersion: 'kms-v1' | 'local-v1';
+}
+export interface SigningAuthoritySeedRecord {
+    _id?: unknown;
+    ownerDid: string;
+    name: string;
+    did?: string;
+    seed?: string;
+    encryptedSeed?: unknown;
+    encryptedDek?: unknown;
+    keyVersion?: unknown;
+}
+export interface SeedEncryptionConfig {
+    kmsKeyArn?: string;
+    localKek?: string;
+    allowLocal: boolean;
+}
+export interface SeedEncryption {
+    encrypt: (seed: string, identity: SigningAuthoritySeedIdentity) => Promise<EncryptedSigningAuthoritySeed>;
+    decrypt: (envelope: EncryptedSigningAuthoritySeed, identity: SigningAuthoritySeedIdentity) => Promise<string>;
+}
+export type SeedEncryptionFailure = 'invalid_record' | 'invalid_envelope' | 'configuration' | 'legacy_disabled' | 'authentication_failed' | 'kms_access_denied' | 'kms_unavailable' | 'kms_failed';

package/dist/types/seed-migration.d.ts

@@ -0,0 +1,49 @@
+import type { Document, ObjectId } from 'mongodb';
+import type { EncryptedSigningAuthoritySeed } from './seed-encryption';
+export type SeedMigrationPhase = 'dry-run' | 'prepare' | 'verify' | 'purge';
+export interface SeedMigrationRequest {
+    phase: SeedMigrationPhase;
+    batchSize?: number;
+}
+export interface SeedMigrationCounts {
+    total: number;
+    encrypted: number;
+    legacyOnly: number;
+    malformed: number;
+    plaintextRemaining: number;
+}
+export interface SeedMigrationResult {
+    phase: SeedMigrationPhase;
+    done: boolean;
+    processed: number;
+    counts: SeedMigrationCounts;
+    countsReconciled: boolean;
+    rescanRequired?: boolean;
+}
+export interface MigrationSigningAuthority extends Document {
+    _id: string | ObjectId;
+    ownerDid: string;
+    name: string;
+    did?: string;
+    seed?: string;
+}
+export interface SeedMigrationState {
+    _id: string;
+    leaseOwner?: string;
+    leaseExpiresAt?: Date;
+    phase?: SeedMigrationPhase;
+    epoch?: string;
+    verifiedEpoch?: string;
+    status?: 'running' | 'complete' | 'failed';
+    processed?: number;
+    counts?: SeedMigrationCounts;
+    updatedAt?: Date;
+    cursor?: string | ObjectId;
+}
+export interface SeedMigrationReceipt extends EncryptedSigningAuthoritySeed {
+    _id: string | ObjectId;
+    epoch: string;
+    ownerDid: string;
+    name: string;
+    did: string | null;
+}