@learncard/lca-api-service 1.3.2 → 1.5.0

package/dist/models/UserKey.d.ts

@@ -33,8 +33,14 @@ export declare const RecoveryMethodValidator: z.ZodObject<{
         passkey: "passkey";
         backup: "backup";
         phrase: "phrase";
+        escrow: "escrow";
     }>;
     createdAt: z.ZodDate;
+    confirmationStatus: z.ZodOptional<z.ZodEnum<{
+        pending: "pending";
+        confirmed: "confirmed";
+    }>>;
+    confirmedAt: z.ZodOptional<z.ZodDate>;
     credentialId: z.ZodOptional<z.ZodString>;
     encryptedShare: z.ZodOptional<z.ZodObject<{
         encryptedData: z.ZodString;
@@ -42,6 +48,10 @@ export declare const RecoveryMethodValidator: z.ZodObject<{
         salt: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     shareVersion: z.ZodOptional<z.ZodNumber>;
+    confirmationCodeHash: z.ZodOptional<z.ZodString>;
+    confirmationCodeExpiresAt: z.ZodOptional<z.ZodDate>;
+    confirmationAttempts: z.ZodOptional<z.ZodNumber>;
+    confirmationEmail: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const PreviousAuthShareValidator: z.ZodObject<{
     authShare: z.ZodObject<{
@@ -52,7 +62,99 @@ export declare const PreviousAuthShareValidator: z.ZodObject<{
     shareVersion: z.ZodNumber;
     createdAt: z.ZodDate;
 }, z.core.$strip>;
-export declare const MongoUserKeyValidator: z.ZodObject<{
+export declare const EscrowEnvelopeValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    iv: z.ZodString;
+    ciphertext: z.ZodString;
+}, z.core.$strict>;
+export declare const EscrowBlobValidator: z.ZodObject<{
+    enrollmentEpoch: z.ZodNumber;
+    blobHash: z.ZodString;
+    envelope: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>;
+    enclaveKeyId: z.ZodString;
+    enclaveMode: z.ZodEnum<{
+        software: "software";
+        nitro: "nitro";
+    }>;
+    measurements: z.ZodObject<{
+        imageSha384: z.ZodOptional<z.ZodString>;
+        pcr0: z.ZodOptional<z.ZodString>;
+        pcr1: z.ZodOptional<z.ZodString>;
+        pcr2: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    shareVersion: z.ZodNumber;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type EscrowBlob = z.infer<typeof EscrowBlobValidator>;
+export declare const EscrowPinSaltValidator: z.ZodString;
+export declare const EscrowPinValidator: z.ZodObject<{
+    salt: z.ZodString;
+    failedAttempts: z.ZodNumber;
+    verifiedFailedAttempts: z.ZodOptional<z.ZodNumber>;
+    enabledAt: z.ZodDate;
+    disabledAt: z.ZodOptional<z.ZodDate>;
+    shareVersion: z.ZodNumber;
+}, z.core.$strip>;
+export declare const EscrowPinStatusValidator: z.ZodObject<{
+    state: z.ZodEnum<{
+        none: "none";
+        enabled: "enabled";
+        locked: "locked";
+        stale: "stale";
+    }>;
+    enabled: z.ZodBoolean;
+    attemptsRemaining: z.ZodNumber;
+    salt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const getEscrowPinStatus: (userKey: MongoUserKeyType) => z.infer<typeof EscrowPinStatusValidator>;
+declare const MongoUserKeyBaseValidator: z.ZodObject<{
+    escrowBlob: z.ZodOptional<z.ZodObject<{
+        enrollmentEpoch: z.ZodNumber;
+        blobHash: z.ZodString;
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            iv: z.ZodString;
+            ciphertext: z.ZodString;
+        }, z.core.$strict>;
+        enclaveKeyId: z.ZodString;
+        enclaveMode: z.ZodEnum<{
+            software: "software";
+            nitro: "nitro";
+        }>;
+        measurements: z.ZodObject<{
+            imageSha384: z.ZodOptional<z.ZodString>;
+            pcr0: z.ZodOptional<z.ZodString>;
+            pcr1: z.ZodOptional<z.ZodString>;
+            pcr2: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        shareVersion: z.ZodNumber;
+        createdAt: z.ZodDate;
+    }, z.core.$strip>>;
+    escrowPin: z.ZodOptional<z.ZodObject<{
+        salt: z.ZodString;
+        failedAttempts: z.ZodNumber;
+        verifiedFailedAttempts: z.ZodOptional<z.ZodNumber>;
+        enabledAt: z.ZodDate;
+        disabledAt: z.ZodOptional<z.ZodDate>;
+        shareVersion: z.ZodNumber;
+    }, z.core.$strip>>;
+    escrowOptedOutAt: z.ZodOptional<z.ZodDate>;
     _id: z.ZodOptional<z.ZodString>;
     contactMethod: z.ZodObject<{
         type: z.ZodEnum<{
@@ -103,8 +205,14 @@ export declare const MongoUserKeyValidator: z.ZodObject<{
             passkey: "passkey";
             backup: "backup";
             phrase: "phrase";
+            escrow: "escrow";
         }>;
         createdAt: z.ZodDate;
+        confirmationStatus: z.ZodOptional<z.ZodEnum<{
+            pending: "pending";
+            confirmed: "confirmed";
+        }>>;
+        confirmedAt: z.ZodOptional<z.ZodDate>;
         credentialId: z.ZodOptional<z.ZodString>;
         encryptedShare: z.ZodOptional<z.ZodObject<{
             encryptedData: z.ZodString;
@@ -112,15 +220,142 @@ export declare const MongoUserKeyValidator: z.ZodObject<{
             salt: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         shareVersion: z.ZodOptional<z.ZodNumber>;
+        confirmationCodeHash: z.ZodOptional<z.ZodString>;
+        confirmationCodeExpiresAt: z.ZodOptional<z.ZodDate>;
+        confirmationAttempts: z.ZodOptional<z.ZodNumber>;
+        confirmationEmail: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
     recoveryEmail: z.ZodOptional<z.ZodString>;
     recoveryEmailVerifiedAt: z.ZodOptional<z.ZodDate>;
     migratedFromWeb3Auth: z.ZodDefault<z.ZodBoolean>;
     migratedAt: z.ZodOptional<z.ZodDate>;
+    sssActivationState: z.ZodOptional<z.ZodEnum<{
+        provisional: "provisional";
+        active: "active";
+    }>>;
+    provisionalCreatedAt: z.ZodOptional<z.ZodDate>;
     createdAt: z.ZodDate;
     updatedAt: z.ZodDate;
 }, z.core.$strip>;
-export type MongoUserKeyType = z.infer<typeof MongoUserKeyValidator>;
+export declare const MongoUserKeyValidator: z.ZodObject<{
+    escrowBlob: z.ZodOptional<z.ZodObject<{
+        enrollmentEpoch: z.ZodNumber;
+        blobHash: z.ZodString;
+        envelope: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            iv: z.ZodString;
+            ciphertext: z.ZodString;
+        }, z.core.$strict>;
+        enclaveKeyId: z.ZodString;
+        enclaveMode: z.ZodEnum<{
+            software: "software";
+            nitro: "nitro";
+        }>;
+        measurements: z.ZodObject<{
+            imageSha384: z.ZodOptional<z.ZodString>;
+            pcr0: z.ZodOptional<z.ZodString>;
+            pcr1: z.ZodOptional<z.ZodString>;
+            pcr2: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        shareVersion: z.ZodNumber;
+        createdAt: z.ZodDate;
+    }, z.core.$strip>>;
+    escrowPin: z.ZodOptional<z.ZodObject<{
+        salt: z.ZodString;
+        failedAttempts: z.ZodNumber;
+        verifiedFailedAttempts: z.ZodOptional<z.ZodNumber>;
+        enabledAt: z.ZodDate;
+        disabledAt: z.ZodOptional<z.ZodDate>;
+        shareVersion: z.ZodNumber;
+    }, z.core.$strip>>;
+    escrowOptedOutAt: z.ZodOptional<z.ZodDate>;
+    _id: z.ZodOptional<z.ZodString>;
+    contactMethod: z.ZodObject<{
+        type: z.ZodEnum<{
+            email: "email";
+            phone: "phone";
+        }>;
+        value: z.ZodString;
+    }, z.core.$strip>;
+    authProviders: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            firebase: "firebase";
+            supertokens: "supertokens";
+            keycloak: "keycloak";
+            oidc: "oidc";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>>>;
+    primaryDid: z.ZodString;
+    linkedDids: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    keyProvider: z.ZodDefault<z.ZodEnum<{
+        web3auth: "web3auth";
+        sss: "sss";
+    }>>;
+    authShare: z.ZodOptional<z.ZodObject<{
+        encryptedData: z.ZodString;
+        encryptedDek: z.ZodString;
+        iv: z.ZodString;
+    }, z.core.$strip>>;
+    shareVersion: z.ZodDefault<z.ZodNumber>;
+    shareUpdatedAt: z.ZodOptional<z.ZodDate>;
+    previousAuthShares: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        authShare: z.ZodObject<{
+            encryptedData: z.ZodString;
+            encryptedDek: z.ZodString;
+            iv: z.ZodString;
+        }, z.core.$strip>;
+        shareVersion: z.ZodNumber;
+        createdAt: z.ZodDate;
+    }, z.core.$strip>>>;
+    securityLevel: z.ZodDefault<z.ZodEnum<{
+        basic: "basic";
+        enhanced: "enhanced";
+        advanced: "advanced";
+    }>>;
+    recoveryMethods: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            email: "email";
+            passkey: "passkey";
+            backup: "backup";
+            phrase: "phrase";
+            escrow: "escrow";
+        }>;
+        createdAt: z.ZodDate;
+        confirmationStatus: z.ZodOptional<z.ZodEnum<{
+            pending: "pending";
+            confirmed: "confirmed";
+        }>>;
+        confirmedAt: z.ZodOptional<z.ZodDate>;
+        credentialId: z.ZodOptional<z.ZodString>;
+        encryptedShare: z.ZodOptional<z.ZodObject<{
+            encryptedData: z.ZodString;
+            iv: z.ZodString;
+            salt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        shareVersion: z.ZodOptional<z.ZodNumber>;
+        confirmationCodeHash: z.ZodOptional<z.ZodString>;
+        confirmationCodeExpiresAt: z.ZodOptional<z.ZodDate>;
+        confirmationAttempts: z.ZodOptional<z.ZodNumber>;
+        confirmationEmail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    recoveryEmail: z.ZodOptional<z.ZodString>;
+    recoveryEmailVerifiedAt: z.ZodOptional<z.ZodDate>;
+    migratedFromWeb3Auth: z.ZodDefault<z.ZodBoolean>;
+    migratedAt: z.ZodOptional<z.ZodDate>;
+    sssActivationState: z.ZodOptional<z.ZodEnum<{
+        provisional: "provisional";
+        active: "active";
+    }>>;
+    provisionalCreatedAt: z.ZodOptional<z.ZodDate>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$loose>;
+export type MongoUserKeyType = z.infer<typeof MongoUserKeyBaseValidator>;
 export type ContactMethod = z.infer<typeof ContactMethodValidator>;
 export type AuthProviderMapping = z.infer<typeof AuthProviderMappingValidator>;
 export type ServerEncryptedShare = z.infer<typeof ServerEncryptedShareValidator>;
@@ -128,6 +363,13 @@ export type EncryptedShare = z.infer<typeof EncryptedShareValidator>;
 export type RecoveryMethod = z.infer<typeof RecoveryMethodValidator>;
 export type PreviousAuthShare = z.infer<typeof PreviousAuthShareValidator>;
 export declare const MAX_PREVIOUS_AUTH_SHARES = 5;
+export declare const PROVISIONAL_MIGRATION_TTL_MS: number;
+export declare class UserKeyVersionConflictError extends Error {
+    constructor();
+}
+export declare const getSssActivationState: (userKey: MongoUserKeyType) => "provisional" | "active";
+export declare const isRecoveryMethodConfirmed: (userKey: MongoUserKeyType, method: RecoveryMethod) => boolean;
+export declare const hasActivatableRecoveryMethod: (userKey: MongoUserKeyType) => boolean;
 export { pruneOrphanedRecoveryMethods };
 export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     contactMethod: {
@@ -153,8 +395,10 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     }[];
     securityLevel: "basic" | "enhanced" | "advanced";
     recoveryMethods: {
-        type: "email" | "passkey" | "backup" | "phrase";
+        type: "email" | "passkey" | "backup" | "phrase" | "escrow";
         createdAt: Date;
+        confirmationStatus?: "pending" | "confirmed" | undefined;
+        confirmedAt?: Date | undefined;
         credentialId?: string | undefined;
         encryptedShare?: {
             encryptedData: string;
@@ -162,10 +406,46 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
             salt?: string | undefined;
         } | undefined;
         shareVersion?: number | undefined;
+        confirmationCodeHash?: string | undefined;
+        confirmationCodeExpiresAt?: Date | undefined;
+        confirmationAttempts?: number | undefined;
+        confirmationEmail?: string | undefined;
     }[];
     migratedFromWeb3Auth: boolean;
     createdAt: Date;
     updatedAt: Date;
+    escrowBlob?: {
+        enrollmentEpoch: number;
+        blobHash: string;
+        envelope: {
+            version: 1;
+            algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+            keyId: string;
+            ephemeralPublicKey: string;
+            salt: string;
+            iv: string;
+            ciphertext: string;
+        };
+        enclaveKeyId: string;
+        enclaveMode: "software" | "nitro";
+        measurements: {
+            imageSha384?: string | undefined;
+            pcr0?: string | undefined;
+            pcr1?: string | undefined;
+            pcr2?: string | undefined;
+        };
+        shareVersion: number;
+        createdAt: Date;
+    } | undefined;
+    escrowPin?: {
+        salt: string;
+        failedAttempts: number;
+        enabledAt: Date;
+        shareVersion: number;
+        verifiedFailedAttempts?: number | undefined;
+        disabledAt?: Date | undefined;
+    } | undefined;
+    escrowOptedOutAt?: Date | undefined;
     _id?: string | undefined;
     authShare?: {
         encryptedData: string;
@@ -176,16 +456,59 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     recoveryEmail?: string | undefined;
     recoveryEmailVerifiedAt?: Date | undefined;
     migratedAt?: Date | undefined;
+    sssActivationState?: "provisional" | "active" | undefined;
+    provisionalCreatedAt?: Date | undefined;
 }>;
 export declare const createUserKeysIndexes: () => Promise<void>;
+export declare const ensureUserKeysIndexes: () => Promise<void>;
 export declare const findUserKeyByContactMethod: (contactMethod: ContactMethod) => Promise<MongoUserKeyType | null>;
 export declare const findUserKeyByAuthProvider: (providerType: string, providerId: string) => Promise<MongoUserKeyType | null>;
 export declare const findUserKeyByDid: (did: string) => Promise<MongoUserKeyType | null>;
+export declare const findUniqueUserKeyByVerifiedRecoveryEmail: (email: string) => Promise<MongoUserKeyType | null>;
 export declare const findAuthShareByVersion: (userKey: MongoUserKeyType, version: number) => ServerEncryptedShare | null;
 export declare const upsertUserKey: (contactMethod: ContactMethod, data: Partial<Omit<MongoUserKeyType, "_id" | "contactMethod" | "createdAt">>) => Promise<MongoUserKeyType>;
+export declare const upsertUserKeyByAuthProvider: (contactMethod: ContactMethod, authProvider: AuthProviderMapping, data: Partial<Omit<MongoUserKeyType, "_id" | "contactMethod" | "createdAt" | "authProviders">>, expectedVersion?: number) => Promise<MongoUserKeyType>;
 export declare const addAuthProviderToUserKey: (contactMethod: ContactMethod, authProvider: AuthProviderMapping) => Promise<void>;
 export declare const addRecoveryMethodToUserKey: (contactMethod: ContactMethod, recoveryMethod: RecoveryMethod) => Promise<void>;
+export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, blob: Omit<EscrowBlob, "enrollmentEpoch" | "blobHash">, expectedShareVersion: number, pin?: {
+    salt: string;
+}, carryFrom?: {
+    blob: EscrowBlob;
+    pin: NonNullable<MongoUserKeyType["escrowPin"]>;
+}) => Promise<MongoUserKeyType | null>;
+export declare const rewrapEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, oldBlob: EscrowBlob, oldPin: MongoUserKeyType["escrowPin"], newEnvelope: EscrowBlob["envelope"], identity: Pick<EscrowBlob, "enclaveKeyId" | "enclaveMode" | "measurements">) => Promise<MongoUserKeyType | null>;
+export declare const findUserKeysWithEscrowBlobKeyId: (keyIds: string[], limit: number) => Promise<MongoUserKeyType[]>;
+export declare const clearEscrowByAuthProvider: (authProvider: AuthProviderMapping, { optOut }: {
+    optOut: boolean;
+}) => Promise<MongoUserKeyType | null>;
+export declare const setEscrowOptInByAuthProvider: (authProvider: AuthProviderMapping) => Promise<MongoUserKeyType | null>;
+export declare const reserveEscrowPinAttempt: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext?: string) => Promise<MongoUserKeyType | null>;
+export declare const refundEscrowPinAttempt: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext: string) => Promise<void>;
+export declare const recordEscrowPinFailure: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext: string) => Promise<MongoUserKeyType | null>;
+export declare const disableEscrowPin: (authProvider: AuthProviderMapping, shareVersion?: number, expectedCiphertext?: string) => Promise<boolean>;
+export declare const addRecoveryMethodToUserKeyByAuthProvider: (authProvider: AuthProviderMapping, recoveryMethod: RecoveryMethod) => Promise<void>;
+export declare const removeRecoveryMethodFromUserKeyByAuthProvider: (authProvider: AuthProviderMapping, type: RecoveryMethod["type"], credentialId?: string) => Promise<void>;
+export declare const incrementRecoveryConfirmationAttemptsByAuthProvider: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
+export declare const confirmRecoveryMethodByAuthProvider: (authProvider: AuthProviderMapping, type: RecoveryMethod["type"], shareVersion: number, credentialId?: string) => Promise<boolean>;
 export declare const markUserKeyMigrated: (contactMethod: ContactMethod) => Promise<void>;
+export declare const markUserKeyMigratedByAuthProvider: (authProvider: AuthProviderMapping) => Promise<void>;
+export declare const markUserKeyMigrationProvisionalByAuthProvider: (authProvider: AuthProviderMapping, provisionalCreatedAt: Date) => Promise<boolean>;
+export declare const activateUserKeyByAuthProvider: (authProvider: AuthProviderMapping, shareVersion: number, isMigration: boolean) => Promise<boolean>;
+export declare const purgeExpiredProvisionalMigrationByAuthProvider: (authProvider: AuthProviderMapping, now?: Date) => Promise<boolean>;
 export declare const setRecoveryEmail: (contactMethod: ContactMethod, email: string) => Promise<void>;
+export declare const setRecoveryEmailByAuthProvider: (authProvider: AuthProviderMapping, email: string) => Promise<void>;
 export declare const upgradeContactMethod: (oldContactMethod: ContactMethod, newContactMethod: ContactMethod) => Promise<boolean>;
+export declare const upgradeContactMethodByAuthProvider: (authProvider: AuthProviderMapping, expectedOldContactMethod: ContactMethod, newContactMethod: ContactMethod) => Promise<boolean>;
 export declare const deleteUserKey: (contactMethod: ContactMethod) => Promise<void>;
+export declare const deleteUserKeyByAuthProvider: (authProvider: AuthProviderMapping) => Promise<void>;
+export interface CompleteIdentityRebindInput {
+    oldAuthProvider: AuthProviderMapping;
+    newAuthProvider: AuthProviderMapping;
+    newContactMethod: ContactMethod;
+    primaryDid: string;
+    authShare: ServerEncryptedShare;
+}
+export declare const completeIdentityRebind: (input: CompleteIdentityRebindInput) => Promise<{
+    shareVersion: number;
+    methodsRequiringConfirmation: RecoveryMethod["type"][];
+} | null>;

package/dist/models/UserKey.escrowPin.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/models/index.d.ts

@@ -5,3 +5,5 @@ export * from './SigningAuthority';
 export * from './Pins';
 export * from './Preferences';
 export * from './UserKey';
+export * from './EscrowHold';
+export * from './AuthSubject';

package/dist/oidc.d.ts

@@ -0,0 +1,5 @@
+import { type FastifyPluginAsync } from 'fastify';
+export declare const oidcFastifyPlugin: FastifyPluginAsync;
+export declare const app: import("fastify").FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault> & PromiseLike<import("fastify").FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>> & {
+    __linterBrands: "SafePromiseLike";
+};

package/dist/routes/auth.d.ts

@@ -0,0 +1,31 @@
+export declare const authRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("@routes").Context;
+    meta: import("trpc-to-openapi").OpenApiMeta;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    requestLoginTicket: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            email: string;
+            code: string;
+        };
+        output: {
+            success: boolean;
+            ticket?: string | undefined;
+            error?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    requestSocialLoginTicket: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            provider: "google" | "apple";
+            idToken: string;
+        };
+        output: {
+            success: boolean;
+            ticket?: string | undefined;
+            error?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+}>>;

package/dist/routes/escrow.d.ts

@@ -0,0 +1,164 @@
+import { type Context } from '@routes';
+export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: Context;
+    meta: import("trpc-to-openapi").OpenApiMeta;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    getAttestation: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            nonce?: string | undefined;
+        };
+        output: {
+            attestation: {
+                mode: "software" | "nitro";
+                keyId: string;
+                publicKey: string;
+                measurements: {
+                    imageSha384?: string | undefined;
+                    pcr0?: string | undefined;
+                    pcr1?: string | undefined;
+                    pcr2?: string | undefined;
+                };
+                document: string;
+                issuedAt: string;
+                previousKeyIds?: string[] | undefined;
+            };
+            holdDurationMs: number;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    enroll: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            envelope: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            };
+            shareVersion: number;
+            enclaveKeyId: string;
+            pinSalt?: string | undefined;
+            clearPin?: boolean | undefined;
+        };
+        output: {
+            success: true;
+            shareVersion: number;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    remove: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            optOut: boolean;
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    optIn: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    startRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            clientEphemeralPublicKey: string;
+            releasePolicy?: "pin" | "hold" | undefined;
+            restart?: boolean | undefined;
+            authToken?: string | undefined;
+            providerType?: "firebase" | "supertokens" | "keycloak" | "oidc" | undefined;
+            recoverySessionToken?: string | undefined;
+        };
+        output: {
+            holdId: string;
+            releasePolicy: "pin" | "hold";
+            requestedAt: string;
+            releaseAfter: string;
+            status: "pending";
+            resumeToken: string | null;
+            pinSalt?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    getStatus: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            holdId?: string | undefined;
+            resumeToken?: string | undefined;
+            authToken?: string | undefined;
+            providerType?: "firebase" | "supertokens" | "keycloak" | "oidc" | undefined;
+        };
+        output: {
+            hold: {
+                holdId: string;
+                status: "pending" | "cancelled" | "completed" | "expired";
+                requestedAt: string;
+                releaseAfter: string;
+                releasePolicy: "pin" | "hold";
+                cancelledAt?: string | undefined;
+                completedAt?: string | undefined;
+            } | null;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    cancelRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+        };
+        output: {
+            success: true;
+            cancelled: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    cancelRecoveryByLink: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            token: string;
+        };
+        output: {
+            cancelled: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    completeRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            resumeToken: string;
+            pinProof?: string | undefined;
+        };
+        output: {
+            sealedShare: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            };
+            authShare: {
+                encryptedData: string;
+                encryptedDek: string;
+                iv: string;
+            };
+            primaryDid: string;
+            shareVersion: number;
+            rebindSessionToken: string;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+}>>;

package/dist/routes/index.d.ts

@@ -24,6 +24,7 @@ export type Context = {
     tenant: ResolvedTenant;
     debug?: boolean;
     clientIp?: string;
+    providerToken?: string;
 };
 export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMeta, import("@trpc/server").TRPCRuntimeConfigOptions<Context, OpenApiMeta>, {
     ctx: Context;
@@ -32,6 +33,7 @@ export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMe
     transformer: false;
 }>;
 export declare const createContext: (options: CreateAWSLambdaContextOptions<APIGatewayProxyEventV2> | CreateFastifyContextOptions | NodeHTTPCreateContextFnOptions<IncomingMessage, ServerResponse>) => Promise<Context>;
+export declare const redactSecretFields: (value: unknown, depth?: number, seen?: Set<object>) => unknown;
 export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
     user: {
@@ -42,6 +44,7 @@ export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Cont
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
@@ -53,6 +56,7 @@ export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Conte
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
@@ -64,6 +68,7 @@ export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBui
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
     debug: boolean | undefined;
@@ -75,4 +80,5 @@ export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureB
     domain: string;
     tenant: ResolvedTenant;
     clientIp: string | undefined;
+    providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;