@learncard/lca-api-service 1.3.2 → 1.5.0

package/dist/routes/keys.d.ts

@@ -1,9 +1,126 @@
+import { z } from 'zod';
+import { AuthProviderType } from '@helpers/auth.helpers';
+import { type ContactMethod, type AuthProviderMapping, type MongoUserKeyType } from '@models';
+export declare const AuthProviderTypeValidator: z.ZodEnum<{
+    firebase: "firebase";
+    supertokens: "supertokens";
+    keycloak: "keycloak";
+    oidc: "oidc";
+}>;
+export declare const AuthInputValidator: z.ZodObject<{
+    authToken: z.ZodString;
+    providerType: z.ZodEnum<{
+        firebase: "firebase";
+        supertokens: "supertokens";
+        keycloak: "keycloak";
+        oidc: "oidc";
+    }>;
+}, z.core.$strip>;
+export declare const RecoverySessionTokenValidator: z.ZodString;
+export declare function verifyAndGetContactMethod(input: {
+    authToken: string;
+    providerType: AuthProviderType;
+}): Promise<{
+    user: {
+        id: string;
+        email?: string;
+        phone?: string;
+        providerType: string;
+    };
+    contactMethod: ContactMethod;
+    authProvider: AuthProviderMapping;
+}>;
+export declare const requireUserKey: (authProvider: AuthProviderMapping, message?: string) => Promise<MongoUserKeyType>;
+export declare const assertDidOwner: (userKey: MongoUserKeyType, authenticatedDid: string) => void;
+export declare const requireRecoverySession: (token: string, scope: "recover" | "rebind") => Promise<AuthProviderMapping>;
 export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
     ctx: import("@routes").Context;
     meta: import("trpc-to-openapi").OpenApiMeta;
     errorShape: import("@trpc/server").TRPCDefaultErrorShape;
     transformer: false;
 }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    startRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            email: string;
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    verifyRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            email: string;
+            code: string;
+        };
+        output: {
+            recoverySessionToken: string;
+            recoveryMethods: {
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+                createdAt: string;
+                credentialId?: string | undefined;
+                shareVersion?: number | undefined;
+            }[];
+            escrowPin: {
+                state: "enabled" | "none" | "locked" | "stale";
+                enabled: boolean;
+                attemptsRemaining: number;
+                salt?: string | undefined;
+            };
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    useRecoverySession: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            recoverySessionToken: string;
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            credentialId?: string | undefined;
+        };
+        output: {
+            authShare: {
+                encryptedData: string;
+                encryptedDek: string;
+                iv: string;
+            };
+            primaryDid: string;
+            shareVersion: number;
+            rebindSessionToken: string;
+            encryptedShare?: {
+                encryptedData: string;
+                iv: string;
+                salt?: string | undefined;
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    completeRecoveryRebind: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            recoverySessionToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            primaryDid: string;
+            authShare: {
+                encryptedData: string;
+                encryptedDek: string;
+                iv: string;
+            };
+            newAuthToken?: string | undefined;
+        };
+        output: {
+            success: true;
+            shareVersion: number;
+            recoveryMethodsRequireConfirmation: ("email" | "passkey" | "backup" | "phrase" | "escrow")[];
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    issueDidChallenge: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            did: string;
+        };
+        output: {
+            challenge: string;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     getAuthShare: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
@@ -19,14 +136,24 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
             primaryDid: string | null;
             securityLevel: "basic" | "enhanced" | "advanced";
             recoveryMethods: {
-                type: "email" | "passkey" | "backup" | "phrase";
+                type: "email" | "passkey" | "backup" | "phrase" | "escrow";
                 createdAt: string;
                 credentialId?: string | undefined;
                 shareVersion?: number | undefined;
+                confirmedAt?: string | undefined;
             }[];
             keyProvider: "web3auth" | "sss";
             shareVersion: number;
             maskedRecoveryEmail: string | null;
+            escrowOptedOut: boolean;
+            escrowPin: {
+                state: "enabled" | "none" | "locked" | "stale";
+                enabled: boolean;
+                attemptsRemaining: number;
+                salt?: string | undefined;
+            };
+            sssActivationState: "provisional" | "active";
+            escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
         } | null;
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -42,10 +169,13 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
             primaryDid: string;
             securityLevel?: "basic" | "enhanced" | "advanced" | undefined;
             keyProvider?: "web3auth" | "sss" | undefined;
+            sssActivationState?: "provisional" | undefined;
+            expectedShareVersion?: number | undefined;
         };
         output: {
             success: boolean;
             shareVersion: number;
+            expectedShareVersionChecked: boolean;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -53,7 +183,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-            type: "email" | "passkey" | "backup" | "phrase";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
             encryptedShare?: {
                 encryptedData: string;
                 iv: string;
@@ -67,11 +197,36 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
-    getRecoveryShare: import("@trpc/server").TRPCQueryProcedure<{
+    confirmRecoveryMethod: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-            type: "email" | "passkey" | "backup" | "phrase";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            credentialId?: string | undefined;
+            code?: string | undefined;
+        };
+        output: {
+            success: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    deleteRecoveryMethod: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            credentialId?: string | undefined;
+        };
+        output: {
+            success: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    getRecoveryShare: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            type: "email" | "passkey" | "backup" | "phrase" | "escrow";
+            authToken?: string | undefined;
             credentialId?: string | undefined;
         };
         output: {
@@ -94,6 +249,16 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    activate: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+        };
+        output: {
+            success: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     addRecoveryEmail: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
@@ -131,9 +296,18 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
-            emailShare: string;
-            email?: string | undefined;
-            useRecoveryEmail?: boolean | undefined;
+            relayPayload: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            };
+            confirmationCode: string;
+            email: string;
+            shareVersion?: number | undefined;
         };
         output: {
             success: boolean;
@@ -159,6 +333,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
         input: {
             authToken: string;
             providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            challenge: string;
         };
         output: {
             success: boolean;

package/dist/routes/notifications.d.ts

@@ -207,6 +207,11 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                         approvedAt: string;
                         contractUpdatedAt: string;
                     } | undefined;
+                    referral?: {
+                        requestId: string;
+                        requestedBy: string;
+                        externalReferenceId?: string | undefined;
+                    } | undefined;
                     uris?: string[] | undefined;
                 } | undefined;
                 inbox?: {

package/dist/routes/qr-login.d.ts

@@ -22,7 +22,7 @@ export declare const qrLoginRouter: import("@trpc/server").TRPCBuiltRouter<{
         output: {
             sessionId: string;
             publicKey: string;
-            status: "approved" | "pending";
+            status: "pending" | "approved";
             encryptedPayload?: string | undefined;
             approverDid?: string | undefined;
         };

package/dist/routes/signing-authority.d.ts

@@ -18,6 +18,20 @@ export declare const signingAuthorityRouter: import("@trpc/server").TRPCBuiltRou
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    ensureManagedSigningAuthority: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            name: string;
+            ownerDid: string;
+        };
+        output: {
+            ownerDid: string;
+            name: string;
+            did: string;
+            endpoint: string;
+            _id?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     signingAuthorities: import("@trpc/server").TRPCQueryProcedure<{
         input: void;
         output: {

package/dist/services/escrow-enclave/blobIdentity.d.ts

@@ -0,0 +1,10 @@
+export interface EscrowEnvelopeFields {
+    version: number;
+    algorithm: string;
+    keyId: string;
+    ephemeralPublicKey: string;
+    salt: string;
+    iv: string;
+    ciphertext: string;
+}
+export declare const escrowBlobIdentity: (envelope: EscrowEnvelopeFields) => string;

package/dist/services/escrow-enclave/blobIdentity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/cancellation.d.ts

@@ -0,0 +1,3 @@
+import { type EscrowHold, type MongoUserKeyType } from '@models';
+export declare const logEscrowCancellationPending: (urgent: boolean) => void;
+export declare const cancelHoldInEnclave: (hold: EscrowHold, userKey?: MongoUserKeyType | null, now?: Date) => Promise<boolean>;

package/dist/services/escrow-enclave/enclaveTrustAnchors.d.ts

@@ -0,0 +1 @@
+export declare const pinnedEnclaveCa: (baseUrl: string) => string | undefined;

package/dist/services/escrow-enclave/index.d.ts

@@ -0,0 +1,25 @@
+import type { EscrowBlobStaleReason } from '@learncard/types';
+import { type EscrowEnclave } from './types';
+export * from './types';
+export * from './softwareEnclave';
+export * from './remoteEnclave';
+export * from './notifications';
+export declare const isEscrowEnabled: () => boolean;
+export declare const isEscrowRemoteMode: () => boolean;
+export declare const activeEscrowClientMode: () => "software" | "nitro";
+export declare const getEscrowHoldDurationMs: () => number;
+export declare const getEscrowHoldRestartMinAgeMs: () => number;
+export declare const getEscrowEnclave: () => EscrowEnclave;
+export type { EscrowBlobStaleReason };
+interface EscrowAttestationIdentity {
+    keyId: string;
+    previousKeyIds: string[];
+    mode: 'software' | 'nitro';
+}
+export declare const getEnclaveAttestationIdentity: () => Promise<EscrowAttestationIdentity>;
+export declare const getEscrowBlobStaleReason: (blob: {
+    enclaveMode: "software" | "nitro";
+    enclaveKeyId: string;
+}) => Promise<EscrowBlobStaleReason | undefined>;
+export declare const __setEscrowEnclaveForTests: (replacement: EscrowEnclave | undefined) => void;
+export declare const __resetEscrowAttestationCacheForTests: () => void;

package/dist/services/escrow-enclave/notifications.d.ts

@@ -0,0 +1,24 @@
+import type { ResolvedTenant } from '@learncard/email-templates';
+import type { EscrowHold, MongoUserKeyType } from '@models';
+import { type DeliveryService } from '../delivery';
+export type EscrowHoldEventKind = 'started' | 'reminder' | 'completed' | 'cancelled' | 'pin-locked';
+export interface EscrowHoldEvent {
+    kind: EscrowHoldEventKind;
+    hold: EscrowHold;
+    userKey: MongoUserKeyType;
+    reason?: 'superseded';
+    cancelToken?: string;
+    tenant?: ResolvedTenant;
+    activeHold?: EscrowHold;
+}
+type SendPushNotification = typeof import('@helpers/pushNotifications.helpers').sendPushNotification;
+export interface EscrowHoldNotifierDeps {
+    send: DeliveryService['send'];
+    sendPush: SendPushNotification;
+    now: () => Date;
+    rotateCancelToken: (holdId: string) => Promise<string | null>;
+    recordNotification: (holdId: string, kind: EscrowHoldEventKind) => Promise<void>;
+}
+export declare const ESCROW_NOTIFICATION_TIMEOUT_MS = 3000;
+export declare const notifyEscrowHoldEvent: (event: EscrowHoldEvent, overrides?: Partial<EscrowHoldNotifierDeps>) => Promise<boolean>;
+export {};

package/dist/services/escrow-enclave/notifications.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/production.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/remoteEnclave.contract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/remoteEnclave.d.ts

@@ -0,0 +1,20 @@
+import { type EscrowEnclave } from './types';
+export interface RemoteEnclaveTransportResponse {
+    status: number;
+    data: unknown;
+}
+export interface RemoteEnclaveTransport {
+    post(url: string, body: unknown, config: {
+        headers: Record<string, string>;
+        timeout: number;
+    }): Promise<RemoteEnclaveTransportResponse>;
+}
+export declare const createHttpTransport: (caPem?: string) => RemoteEnclaveTransport;
+export interface RemoteEnclaveConfig {
+    baseUrl: string;
+    token: string;
+    timeoutMs: number;
+    caPem?: string;
+    transport?: RemoteEnclaveTransport;
+}
+export declare const createRemoteEnclave: (config: RemoteEnclaveConfig) => EscrowEnclave;

package/dist/services/escrow-enclave/remoteEnclave.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/remoteEnclave.tls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/softwareEnclave.d.ts

@@ -0,0 +1,27 @@
+import type { EnclaveCreateHoldInput, EscrowHoldRecord, CancelHoldRequest } from './types';
+import { type EscrowEnclave, type EnclaveAttestation, type VerifyEscrowBlobInput, type VerifyEscrowBlobResult, type ReleaseRequest, type ReleaseResult, type CarryPinVerifierInput, type RewrapEscrowBlobInput } from './types';
+export interface SoftwareEnclaveConfig {
+    privateKeys: Record<string, string>;
+    activeKeyId: string;
+    holdDurationMs?: number;
+}
+export declare class SoftwareEnclave implements EscrowEnclave {
+    private readonly privateKeys;
+    private readonly activeKeyId;
+    private readonly holdDurationMs;
+    constructor(config: SoftwareEnclaveConfig);
+    createHold(input: EnclaveCreateHoldInput): Promise<{
+        holdRecord: EscrowHoldRecord;
+    }>;
+    cancelHold(input: CancelHoldRequest): Promise<void>;
+    getAttestation(_nonce?: Uint8Array): Promise<EnclaveAttestation>;
+    private decrypt;
+    verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
+    carryPinVerifier(input: CarryPinVerifierInput): Promise<{
+        envelope: import("@learncard/sss-key-manager").EscrowEnvelope;
+    }>;
+    rewrapEscrowBlob(input: RewrapEscrowBlobInput): Promise<{
+        envelope: import("@learncard/sss-key-manager").EscrowEnvelope;
+    }>;
+    releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
+}

package/dist/services/escrow-enclave/softwareEnclave.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/types.d.ts

@@ -0,0 +1,111 @@
+import type { EscrowEnvelope } from '@learncard/sss-key-manager';
+export interface EnclaveAttestation {
+    mode: 'software' | 'nitro';
+    keyId: string;
+    previousKeyIds?: string[];
+    publicKey: string;
+    measurements: {
+        imageSha384?: string;
+        pcr0?: string;
+        pcr1?: string;
+        pcr2?: string;
+    };
+    document: string;
+    issuedAt: string;
+}
+export interface EscrowHoldRecord {
+    [key: string]: unknown;
+    hold: {
+        [key: string]: unknown;
+        holdId: string;
+        did: string;
+        shareVersion: number;
+        blobHash: string;
+        enrollmentEpoch: number;
+        releasePolicy: 'hold' | 'pin';
+        clientEphemeralPublicKey: string;
+        createdLo: number;
+        createdHi: number;
+        policyVersion: number;
+        signature: string;
+    };
+    holdDurationMs: number;
+    ledgerSeq: number;
+}
+export interface EnclaveCreateHoldInput {
+    envelope: EscrowEnvelope;
+    holdId: string;
+    expectedDid: string;
+    expectedShareVersion: number;
+    enrollmentEpoch: number;
+    releasePolicy: 'hold' | 'pin';
+    clientEphemeralPublicKey: string;
+}
+export interface CancelHoldRequest {
+    envelope: EscrowEnvelope;
+    hold: EscrowHoldRecord;
+    clientEphemeralPublicKey: string;
+    expectedDid: string;
+}
+export interface VerifyEscrowBlobInput {
+    envelope: EscrowEnvelope;
+    expectedDid: string;
+    expectedShareVersion: number;
+}
+export type VerifyEscrowBlobResult = {
+    ok: true;
+    hasPin: boolean;
+} | {
+    ok: false;
+    hasPin: boolean;
+    reason: string;
+};
+export interface ReleaseRequest extends CancelHoldRequest {
+    now?: Date;
+    pinProof?: string;
+}
+export interface ReleaseResult {
+    sealed: EscrowEnvelope;
+}
+export interface CarryPinVerifierInput {
+    sourceEnvelope: EscrowEnvelope;
+    targetEnvelope: EscrowEnvelope;
+    expectedDid: string;
+    sourceShareVersion: number;
+    targetShareVersion: number;
+    sourceEnrollmentEpoch: number;
+    targetEnrollmentEpoch: number;
+}
+export interface RewrapEscrowBlobInput {
+    envelope: EscrowEnvelope;
+    expectedDid: string;
+    expectedShareVersion: number;
+    sourceEnrollmentEpoch: number;
+}
+export interface EscrowEnclave {
+    getAttestation(nonce?: Uint8Array): Promise<EnclaveAttestation>;
+    verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
+    carryPinVerifier(input: CarryPinVerifierInput): Promise<{
+        envelope: EscrowEnvelope;
+    }>;
+    rewrapEscrowBlob(input: RewrapEscrowBlobInput): Promise<{
+        envelope: EscrowEnvelope;
+    }>;
+    releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
+    createHold(input: EnclaveCreateHoldInput): Promise<{
+        holdRecord: EscrowHoldRecord;
+    }>;
+    cancelHold(input: CancelHoldRequest): Promise<void>;
+}
+export declare class EscrowPolicyError extends Error {
+    constructor();
+}
+export declare class EscrowPinMismatchError extends Error {
+    constructor();
+}
+export declare class EscrowBlobError extends Error {
+    constructor();
+}
+export declare class EscrowUnavailableError extends Error {
+    constructor();
+}

package/dist/types/notifications.d.ts

@@ -237,6 +237,11 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
                     approvedAt: z.ZodString;
                     contractUpdatedAt: z.ZodString;
                 }, z.core.$strip>>;
+                referral: z.ZodOptional<z.ZodObject<{
+                    requestId: z.ZodString;
+                    requestedBy: z.ZodString;
+                    externalReferenceId: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
                 id: z.ZodString;
                 action: z.ZodEnum<{
                     write: "write";

package/dist/types/seed-encryption.d.ts

@@ -0,0 +1,31 @@
+export interface SigningAuthoritySeedIdentity {
+    _id: string;
+    ownerDid: string;
+    name: string;
+    did?: string;
+}
+export interface EncryptedSigningAuthoritySeed {
+    encryptedSeed: string;
+    encryptedDek: string;
+    keyVersion: 'kms-v1' | 'local-v1';
+}
+export interface SigningAuthoritySeedRecord {
+    _id?: unknown;
+    ownerDid: string;
+    name: string;
+    did?: string;
+    seed?: string;
+    encryptedSeed?: unknown;
+    encryptedDek?: unknown;
+    keyVersion?: unknown;
+}
+export interface SeedEncryptionConfig {
+    kmsKeyArn?: string;
+    localKek?: string;
+    allowLocal: boolean;
+}
+export interface SeedEncryption {
+    encrypt: (seed: string, identity: SigningAuthoritySeedIdentity) => Promise<EncryptedSigningAuthoritySeed>;
+    decrypt: (envelope: EncryptedSigningAuthoritySeed, identity: SigningAuthoritySeedIdentity) => Promise<string>;
+}
+export type SeedEncryptionFailure = 'invalid_record' | 'invalid_envelope' | 'configuration' | 'legacy_disabled' | 'authentication_failed' | 'kms_access_denied' | 'kms_unavailable' | 'kms_failed';

package/dist/types/seed-migration.d.ts

@@ -0,0 +1,49 @@
+import type { Document, ObjectId } from 'mongodb';
+import type { EncryptedSigningAuthoritySeed } from './seed-encryption';
+export type SeedMigrationPhase = 'dry-run' | 'prepare' | 'verify' | 'purge';
+export interface SeedMigrationRequest {
+    phase: SeedMigrationPhase;
+    batchSize?: number;
+}
+export interface SeedMigrationCounts {
+    total: number;
+    encrypted: number;
+    legacyOnly: number;
+    malformed: number;
+    plaintextRemaining: number;
+}
+export interface SeedMigrationResult {
+    phase: SeedMigrationPhase;
+    done: boolean;
+    processed: number;
+    counts: SeedMigrationCounts;
+    countsReconciled: boolean;
+    rescanRequired?: boolean;
+}
+export interface MigrationSigningAuthority extends Document {
+    _id: string | ObjectId;
+    ownerDid: string;
+    name: string;
+    did?: string;
+    seed?: string;
+}
+export interface SeedMigrationState {
+    _id: string;
+    leaseOwner?: string;
+    leaseExpiresAt?: Date;
+    phase?: SeedMigrationPhase;
+    epoch?: string;
+    verifiedEpoch?: string;
+    status?: 'running' | 'complete' | 'failed';
+    processed?: number;
+    counts?: SeedMigrationCounts;
+    updatedAt?: Date;
+    cursor?: string | ObjectId;
+}
+export interface SeedMigrationReceipt extends EncryptedSigningAuthoritySeed {
+    _id: string | ObjectId;
+    epoch: string;
+    ownerDid: string;
+    name: string;
+    did: string | null;
+}

package/esbuildPlugins.cjs

@@ -41,6 +41,7 @@ module.exports = [
     forceCjsSodiumWrapperPlugin,
     copyDidkitWasmPlugin,
     sentryEsbuildPlugin({
+        telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
         authToken: process.env.SENTRY_AUTH_TOKEN,
         org: process.env.SENTRY_ORG,
         project: process.env.SENTRY_PROJECT,