@learncard/lca-api-service 1.3.2 → 1.5.0

package/dist/config/environment.d.ts

@@ -6,8 +6,25 @@ export declare const lcaApiEnvironmentShape: {
         test: "test";
         production: "production";
     }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    CONFIG_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    RUNTIME_SECRETS_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED: z.ZodString;
+    SA_SEED_KMS_KEY_ARN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_LOCAL_KEK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_ENCRYPT_WRITES: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    SA_SEED_ALLOW_LEGACY_READ: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
     MONGO_URI: z.ZodString;
     MONGO_DB_NAME: z.ZodString;
     DOMAIN_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -18,6 +35,17 @@ export declare const lcaApiEnvironmentShape: {
     OPENAI_API_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     METABASE_SECRET_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     SCOUTS_SSO_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_JWKS_URL_OVERRIDES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    GOOGLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    APPLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_SERVER_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_FROM_EMAIL: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_BRAND_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -25,6 +53,25 @@ export declare const lcaApiEnvironmentShape: {
     POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELAY_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_RELAY_AUTH_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_MODE: z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodOptional<z.ZodEnum<{
+        software: "software";
+        remote: "remote";
+    }>>>;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_REMOTE_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_ENCLAVE_REMOTE_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELEASE_KILL_SWITCH: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
+    ESCROW_HOLD_DURATION_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ANDROID_PUSH_ICON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_HOST: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_PORT: z.ZodPreprocess<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
@@ -64,14 +111,31 @@ export declare const lcaApiEnvironmentShape: {
         false: "false";
     }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
 };
-export declare const lcaApiEnvironmentSchema: z.ZodObject<{
+export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     NODE_ENV: z.ZodDefault<z.ZodEnum<{
         development: "development";
         test: "test";
         production: "production";
     }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    CONFIG_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    RUNTIME_SECRETS_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED: z.ZodString;
+    SA_SEED_KMS_KEY_ARN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_LOCAL_KEK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    SA_SEED_ENCRYPT_WRITES: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    SA_SEED_ALLOW_LEGACY_READ: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
     MONGO_URI: z.ZodString;
     MONGO_DB_NAME: z.ZodString;
     DOMAIN_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -82,6 +146,17 @@ export declare const lcaApiEnvironmentSchema: z.ZodObject<{
     OPENAI_API_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     METABASE_SECRET_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     SCOUTS_SSO_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_JWKS_URL_OVERRIDES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    GOOGLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    APPLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_SERVER_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_FROM_EMAIL: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_BRAND_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -89,6 +164,25 @@ export declare const lcaApiEnvironmentSchema: z.ZodObject<{
     POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELAY_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_RELAY_AUTH_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_MODE: z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodOptional<z.ZodEnum<{
+        software: "software";
+        remote: "remote";
+    }>>>;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_REMOTE_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_ENCLAVE_REMOTE_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELEASE_KILL_SWITCH: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
+    ESCROW_HOLD_DURATION_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ANDROID_PUSH_ICON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_HOST: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     REDIS_PORT: z.ZodPreprocess<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
@@ -127,20 +221,158 @@ export declare const lcaApiEnvironmentSchema: z.ZodObject<{
         true: "true";
         false: "false";
     }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<{
+    SA_SEED_ENCRYPT_WRITES: boolean;
+    SA_SEED_ALLOW_LEGACY_READ: boolean;
+    NODE_ENV: "development" | "test" | "production";
+    PORT: number;
+    SEED: string;
+    MONGO_URI: string;
+    MONGO_DB_NAME: string;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: number;
+    ESCROW_HOLD_DURATION_MS: number;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+    IS_OFFLINE: boolean;
+    IS_CI: boolean;
+    IS_E2E_TEST: boolean;
+    SKIP_DIDKIT_NAPI: boolean;
+    CI: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    CONFIG_STAGE?: string | undefined;
+    RUNTIME_SECRETS_ID?: string | undefined;
+    SA_SEED_KMS_KEY_ARN?: string | undefined;
+    SA_SEED_LOCAL_KEK?: string | undefined;
+    DOMAIN_NAME?: string | undefined;
+    AUTHORIZED_DIDS?: string | undefined;
+    LEARN_CLOUD_URL?: string | undefined;
+    NETWORK_BRAIN_SERVICE_URL?: string | undefined;
+    GOOGLE_APPLICATION_CREDENTIAL?: string | undefined;
+    OPENAI_API_KEY?: string | undefined;
+    METABASE_SECRET_KEY?: string | undefined;
+    SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    KEYCLOAK_JWKS_URL_OVERRIDES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+    GOOGLE_OAUTH_CLIENT_IDS?: string | undefined;
+    APPLE_OAUTH_CLIENT_IDS?: string | undefined;
+    POSTMARK_SERVER_TOKEN?: string | undefined;
+    POSTMARK_FROM_EMAIL?: string | undefined;
+    POSTMARK_BRAND_NAME?: string | undefined;
+    POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS?: string | undefined;
+    ESCROW_RELAY_URL?: string | undefined;
+    ESCROW_RELAY_AUTH_TOKEN?: string | undefined;
+    ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_URL?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_TOKEN?: string | undefined;
+    ESCROW_RELEASE_KILL_SWITCH?: boolean | undefined;
+    ANDROID_PUSH_ICON?: string | undefined;
+    REDIS_HOST?: string | undefined;
+    REDIS_PORT?: number | undefined;
+    NSO_DASHBOARD_ID?: number | undefined;
+    GLOBAL_DASHBOARD_ID?: number | undefined;
+    TROOP_DASHBOARD_ID?: number | undefined;
+    SENTRY_DSN?: string | undefined;
+    SENTRY_ENV?: string | undefined;
+}, {
+    NODE_ENV: "development" | "test" | "production";
+    PORT: number;
+    SEED: string;
+    MONGO_URI: string;
+    MONGO_DB_NAME: string;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: number;
+    ESCROW_HOLD_DURATION_MS: number;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+    IS_OFFLINE: boolean;
+    IS_CI: boolean;
+    IS_E2E_TEST: boolean;
+    SKIP_DIDKIT_NAPI: boolean;
+    CI: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    CONFIG_STAGE?: string | undefined;
+    RUNTIME_SECRETS_ID?: string | undefined;
+    SA_SEED_KMS_KEY_ARN?: string | undefined;
+    SA_SEED_LOCAL_KEK?: string | undefined;
+    SA_SEED_ENCRYPT_WRITES?: boolean | undefined;
+    SA_SEED_ALLOW_LEGACY_READ?: boolean | undefined;
+    DOMAIN_NAME?: string | undefined;
+    AUTHORIZED_DIDS?: string | undefined;
+    LEARN_CLOUD_URL?: string | undefined;
+    NETWORK_BRAIN_SERVICE_URL?: string | undefined;
+    GOOGLE_APPLICATION_CREDENTIAL?: string | undefined;
+    OPENAI_API_KEY?: string | undefined;
+    METABASE_SECRET_KEY?: string | undefined;
+    SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    KEYCLOAK_JWKS_URL_OVERRIDES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+    GOOGLE_OAUTH_CLIENT_IDS?: string | undefined;
+    APPLE_OAUTH_CLIENT_IDS?: string | undefined;
+    POSTMARK_SERVER_TOKEN?: string | undefined;
+    POSTMARK_FROM_EMAIL?: string | undefined;
+    POSTMARK_BRAND_NAME?: string | undefined;
+    POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS?: string | undefined;
+    POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS?: string | undefined;
+    ESCROW_RELAY_URL?: string | undefined;
+    ESCROW_RELAY_AUTH_TOKEN?: string | undefined;
+    ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_URL?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_TOKEN?: string | undefined;
+    ESCROW_RELEASE_KILL_SWITCH?: boolean | undefined;
+    ANDROID_PUSH_ICON?: string | undefined;
+    REDIS_HOST?: string | undefined;
+    REDIS_PORT?: number | undefined;
+    NSO_DASHBOARD_ID?: number | undefined;
+    GLOBAL_DASHBOARD_ID?: number | undefined;
+    TROOP_DASHBOARD_ID?: number | undefined;
+    SENTRY_DSN?: string | undefined;
+    SENTRY_ENV?: string | undefined;
+}>>;
 export type LcaApiEnvironment = z.output<typeof lcaApiEnvironmentSchema>;
 export declare const parseLcaApiEnvironment: (raw: Record<string, unknown>, source?: string) => LcaApiEnvironment;
+export declare const isEscrowReleaseKillSwitchEnabled: () => boolean;
+export declare const parseEscrowPrivateKeys: (serialized: string) => Record<string, string>;
 export declare const environment: {
+    SA_SEED_ENCRYPT_WRITES: boolean;
+    SA_SEED_ALLOW_LEGACY_READ: boolean;
     NODE_ENV: "development" | "test" | "production";
     PORT: number;
     SEED: string;
     MONGO_URI: string;
     MONGO_DB_NAME: string;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: number;
+    ESCROW_HOLD_DURATION_MS: number;
+    ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
     IS_OFFLINE: boolean;
     IS_CI: boolean;
     IS_E2E_TEST: boolean;
     SKIP_DIDKIT_NAPI: boolean;
     CI: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    CONFIG_STAGE?: string | undefined;
+    RUNTIME_SECRETS_ID?: string | undefined;
+    SA_SEED_KMS_KEY_ARN?: string | undefined;
+    SA_SEED_LOCAL_KEK?: string | undefined;
     DOMAIN_NAME?: string | undefined;
     AUTHORIZED_DIDS?: string | undefined;
     LEARN_CLOUD_URL?: string | undefined;
@@ -149,6 +381,17 @@ export declare const environment: {
     OPENAI_API_KEY?: string | undefined;
     METABASE_SECRET_KEY?: string | undefined;
     SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    KEYCLOAK_JWKS_URL_OVERRIDES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+    GOOGLE_OAUTH_CLIENT_IDS?: string | undefined;
+    APPLE_OAUTH_CLIENT_IDS?: string | undefined;
     POSTMARK_SERVER_TOKEN?: string | undefined;
     POSTMARK_FROM_EMAIL?: string | undefined;
     POSTMARK_BRAND_NAME?: string | undefined;
@@ -156,6 +399,14 @@ export declare const environment: {
     POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS?: string | undefined;
     POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS?: string | undefined;
     POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS?: string | undefined;
+    ESCROW_RELAY_URL?: string | undefined;
+    ESCROW_RELAY_AUTH_TOKEN?: string | undefined;
+    ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
+    ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
+    ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_URL?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_TOKEN?: string | undefined;
+    ESCROW_RELEASE_KILL_SWITCH?: boolean | undefined;
     ANDROID_PUSH_ICON?: string | undefined;
     REDIS_HOST?: string | undefined;
     REDIS_PORT?: number | undefined;

package/dist/config/environment.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/escrowBundleMode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/escrowDeployment.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/oidcEnvironment.d.ts

@@ -0,0 +1,74 @@
+import 'dotenv/config';
+import { z } from 'zod';
+export declare const oidcEnvironmentShape: {
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        test: "test";
+        production: "production";
+    }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    IS_OFFLINE: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    IS_E2E_TEST: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+};
+export declare const oidcEnvironmentSchema: z.ZodObject<{
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        test: "test";
+        production: "production";
+    }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    IS_OFFLINE: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    IS_E2E_TEST: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+export type OidcEnvironment = z.output<typeof oidcEnvironmentSchema>;
+export declare const parseOidcEnvironment: (raw: Record<string, unknown>, source?: string) => OidcEnvironment;
+export declare const environment: {
+    NODE_ENV: "development" | "test" | "production";
+    IS_OFFLINE: boolean;
+    IS_E2E_TEST: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+};

package/dist/config/serverlessFunctionEnv.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/stageConfig.d.ts

@@ -0,0 +1,62 @@
+import 'dotenv/config';
+export declare const base: Record<string, string>;
+export declare const stages: {
+    dev: {
+        APPLE_OAUTH_CLIENT_IDS: string;
+        DOMAIN_NAME: string;
+        ESCROW_ENCLAVE_ACTIVE_KEY_ID: string;
+        ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: string;
+        ESCROW_HOLD_DURATION_MS: string;
+        ESCROW_HOLD_RESTART_MIN_AGE_MS: string;
+        GOOGLE_OAUTH_CLIENT_IDS: string;
+        KEYCLOAK_AUDIENCES: string;
+        KEYCLOAK_ISSUERS: string;
+        OIDC_CLIENT_ID: string;
+        OIDC_ISSUER: string;
+        OIDC_SIGNING_KEY_SECRET_ID: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+    production: {
+        DOMAIN_NAME: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+    'scouts.dev': {
+        DOMAIN_NAME: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+    'scouts.production': {
+        DOMAIN_NAME: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+};
+export declare const applyLcaApiStageConfig: (stage: string | undefined) => void;

package/dist/config/stageConfig.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/docker-entry.d.ts

@@ -1 +1 @@
-export {};
+import './config/applyDockerStageConfig';

package/dist/helpers/auth.helpers.d.ts

@@ -7,7 +7,7 @@ export interface VerifiedUser {
 export type AuthProviderType = 'firebase' | 'supertokens' | 'keycloak' | 'oidc';
 export declare function verifyFirebaseToken(token: string): Promise<VerifiedUser>;
 export declare function verifySuperTokensToken(_token: string): Promise<VerifiedUser>;
-export declare function verifyKeycloakToken(_token: string): Promise<VerifiedUser>;
+export declare function verifyKeycloakToken(token: string): Promise<VerifiedUser>;
 export declare function verifyOidcToken(_token: string): Promise<VerifiedUser>;
 export declare function verifyAuthToken(token: string, providerType: AuthProviderType): Promise<VerifiedUser>;
 export declare function getContactMethodFromUser(user: VerifiedUser): {

package/dist/helpers/escrowCancelLink.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@routes';
+export declare const resolveEscrowAppBaseUrl: (ctx: Pick<Context, "tenant">) => string;
+export declare const buildEscrowCancelUrl: ({ baseUrl, holdId, token, }: {
+    baseUrl: string;
+    holdId: string;
+    token: string;
+}) => string;

package/dist/helpers/escrowCancelLink.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/escrowCancelToken.d.ts

@@ -0,0 +1,4 @@
+import type { EscrowHold } from '@models';
+export declare const generateEscrowCancelToken: () => string;
+export declare const hashEscrowCancelToken: (token: string) => string;
+export declare const escrowCancelTokenMatches: (hold: EscrowHold, token: string) => boolean;

package/dist/helpers/escrowCancelToken.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/keycloak.helpers.d.ts

@@ -0,0 +1,23 @@
+import type { JWTVerifyGetKey } from 'jose';
+export interface KeycloakVerifyOptions {
+    issuers: string[];
+    audiences: string[];
+}
+export interface KeycloakClaims {
+    sub: string;
+    iss: string;
+    typ?: string;
+    azp?: string;
+    aud?: string | string[];
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export declare const setKeycloakJwksResolverForTests: (resolver: ((issuer: string) => JWTVerifyGetKey) | undefined) => void;
+export declare const getKeycloakIssuerJwksUrl: (issuer: string) => string;
+export declare const getKeycloakJwks: (issuer: string) => JWTVerifyGetKey;
+export declare const verifyKeycloakJwt: (token: string, opts: KeycloakVerifyOptions) => Promise<KeycloakClaims>;
+export declare const getKeycloakVerifyOptionsFromEnv: () => KeycloakVerifyOptions | null;

package/dist/helpers/learnCard.signingAuthority.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/login-ticket.helpers.d.ts

@@ -0,0 +1,31 @@
+export declare const AUTH_CODE_PREFIX = "oidc-code:";
+export declare const ACCESS_TOKEN_PREFIX = "oidc:access:";
+export declare const AUTH_CODE_TTL_SECONDS = 60;
+export declare const ACCESS_TOKEN_TTL_SECONDS = 300;
+export interface SubjectClaims {
+    subject: string;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export interface AuthorizationCodeData extends SubjectClaims {
+    scope: string;
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    nonce?: string;
+    state?: string;
+    createdAt: number;
+}
+export interface AccessTokenData extends SubjectClaims {
+    createdAt: number;
+}
+export declare const generateAuthorizationCode: () => string;
+export declare const generateAccessToken: () => string;
+export declare const storeAuthorizationCode: (data: AuthorizationCodeData, ttl?: number) => Promise<void>;
+export declare const consumeAuthorizationCode: (code: string) => Promise<AuthorizationCodeData | null>;
+export declare const storeAccessToken: (accessToken: string, data: AccessTokenData, ttl?: number) => Promise<void>;
+export declare const getAccessToken: (accessToken: string) => Promise<AccessTokenData | null>;

package/dist/helpers/login-ticket.helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/oidc.helpers.d.ts

@@ -0,0 +1,47 @@
+import type { CryptoKey, JWK, JWTPayload } from 'jose';
+export declare const OIDC_SIGNING_ALG: "RS256";
+export declare const DEFAULT_ID_TOKEN_TTL_SECONDS = 300;
+export declare const DEFAULT_OIDC_CLIENT_ID = "keycloak-broker";
+export interface OidcIdTokenClaims extends JWTPayload {
+    sub: string;
+    iss: string;
+    aud: string | string[];
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    name?: string;
+    picture?: string;
+}
+interface OidcSigningKey {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicJwk: JWK;
+    kid: string;
+}
+export declare const getOidcSigningKey: () => Promise<OidcSigningKey>;
+export declare const resetOidcSigningKeyForTests: () => void;
+export declare const getOidcIssuer: () => string;
+export declare const getOidcClientId: () => string;
+export declare const getOidcRedirectUris: () => string[];
+export declare const verifyOidcClientCredentials: (clientId: string, clientSecret: string) => boolean;
+export declare const isAllowedRedirectUri: (redirectUri: string) => boolean;
+export declare const getOidcJwks: () => Promise<{
+    keys: JWK[];
+}>;
+export declare const getOidcDiscoveryDocument: () => Record<string, unknown>;
+export declare const mintIdToken: (params: {
+    subject: string;
+    nonce?: string;
+    ttlSeconds?: number;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    name?: string;
+    picture?: string;
+}) => Promise<{
+    token: string;
+    expiresAt: number;
+}>;
+export {};

package/dist/helpers/rate-limit.helpers.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyRequest } from 'fastify';
+export declare const DEFAULT_MAX_FAILED_ATTEMPTS = 50;
+export declare const DEFAULT_RATE_LIMIT_WINDOW_SECONDS: number;
+export declare const isRateLimited: (key: string, max?: number) => Promise<boolean>;
+export declare const recordFailure: (key: string, windowSeconds?: number) => Promise<void>;
+export declare const getRequestClientIp: (request: Pick<FastifyRequest, "ip">) => string;

package/dist/helpers/rate-limit.helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/rateLimit.helpers.d.ts

@@ -0,0 +1,4 @@
+export declare const checkRateLimit: (key: string, maxAttempts: number, windowSeconds: number, prefix?: string) => Promise<boolean>;
+export declare const getRateLimitCount: (key: string, prefix?: string) => Promise<number>;
+export declare const clearRateLimit: (key: string, prefix?: string) => Promise<void>;
+export declare const decrementRateLimit: (key: string, prefix?: string) => Promise<void>;