@learncard/lca-api-service 1.4.0 → 1.5.0

package/dist/config/environment.d.ts

@@ -6,6 +6,9 @@ export declare const lcaApiEnvironmentShape: {
         test: "test";
         production: "production";
     }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    CONFIG_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    RUNTIME_SECRETS_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED: z.ZodString;
     SA_SEED_KMS_KEY_ARN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -32,6 +35,17 @@ export declare const lcaApiEnvironmentShape: {
     OPENAI_API_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     METABASE_SECRET_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     SCOUTS_SSO_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_JWKS_URL_OVERRIDES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    GOOGLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    APPLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_SERVER_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_FROM_EMAIL: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_BRAND_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -47,6 +61,15 @@ export declare const lcaApiEnvironmentShape: {
     }>>>;
     ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     ESCROW_ENCLAVE_ACTIVE_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_REMOTE_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_ENCLAVE_REMOTE_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELEASE_KILL_SWITCH: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ESCROW_HOLD_DURATION_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ESCROW_HOLD_RESTART_MIN_AGE_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ANDROID_PUSH_ICON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -94,6 +117,9 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
         test: "test";
         production: "production";
     }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    CONFIG_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    RUNTIME_SECRETS_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     SEED: z.ZodString;
     SA_SEED_KMS_KEY_ARN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -120,6 +146,17 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     OPENAI_API_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     METABASE_SECRET_KEY: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     SCOUTS_SSO_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_JWKS_URL_OVERRIDES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    GOOGLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    APPLE_OAUTH_CLIENT_IDS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_SERVER_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_FROM_EMAIL: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     POSTMARK_BRAND_NAME: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -135,6 +172,15 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     }>>>;
     ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
     ESCROW_ENCLAVE_ACTIVE_KEY_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_ENCLAVE_REMOTE_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    ESCROW_ENCLAVE_REMOTE_TOKEN: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    ESCROW_RELEASE_KILL_SWITCH: z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ESCROW_HOLD_DURATION_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ESCROW_HOLD_RESTART_MIN_AGE_MS: z.ZodPipe<z.ZodPipe<z.ZodPreprocess<z.ZodOptional<z.ZodString>>, z.ZodTransform<number, string | undefined>>, z.ZodNumber>;
     ANDROID_PUSH_ICON: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -183,6 +229,7 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     SEED: string;
     MONGO_URI: string;
     MONGO_DB_NAME: string;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: number;
     ESCROW_HOLD_DURATION_MS: number;
     ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
     IS_OFFLINE: boolean;
@@ -190,6 +237,9 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     IS_E2E_TEST: boolean;
     SKIP_DIDKIT_NAPI: boolean;
     CI: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    CONFIG_STAGE?: string | undefined;
+    RUNTIME_SECRETS_ID?: string | undefined;
     SA_SEED_KMS_KEY_ARN?: string | undefined;
     SA_SEED_LOCAL_KEK?: string | undefined;
     DOMAIN_NAME?: string | undefined;
@@ -200,6 +250,17 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     OPENAI_API_KEY?: string | undefined;
     METABASE_SECRET_KEY?: string | undefined;
     SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    KEYCLOAK_JWKS_URL_OVERRIDES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+    GOOGLE_OAUTH_CLIENT_IDS?: string | undefined;
+    APPLE_OAUTH_CLIENT_IDS?: string | undefined;
     POSTMARK_SERVER_TOKEN?: string | undefined;
     POSTMARK_FROM_EMAIL?: string | undefined;
     POSTMARK_BRAND_NAME?: string | undefined;
@@ -212,6 +273,9 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
     ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
     ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_URL?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_TOKEN?: string | undefined;
+    ESCROW_RELEASE_KILL_SWITCH?: boolean | undefined;
     ANDROID_PUSH_ICON?: string | undefined;
     REDIS_HOST?: string | undefined;
     REDIS_PORT?: number | undefined;
@@ -226,6 +290,7 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     SEED: string;
     MONGO_URI: string;
     MONGO_DB_NAME: string;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: number;
     ESCROW_HOLD_DURATION_MS: number;
     ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
     IS_OFFLINE: boolean;
@@ -233,6 +298,9 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     IS_E2E_TEST: boolean;
     SKIP_DIDKIT_NAPI: boolean;
     CI: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    CONFIG_STAGE?: string | undefined;
+    RUNTIME_SECRETS_ID?: string | undefined;
     SA_SEED_KMS_KEY_ARN?: string | undefined;
     SA_SEED_LOCAL_KEK?: string | undefined;
     SA_SEED_ENCRYPT_WRITES?: boolean | undefined;
@@ -245,6 +313,17 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     OPENAI_API_KEY?: string | undefined;
     METABASE_SECRET_KEY?: string | undefined;
     SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    KEYCLOAK_JWKS_URL_OVERRIDES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+    GOOGLE_OAUTH_CLIENT_IDS?: string | undefined;
+    APPLE_OAUTH_CLIENT_IDS?: string | undefined;
     POSTMARK_SERVER_TOKEN?: string | undefined;
     POSTMARK_FROM_EMAIL?: string | undefined;
     POSTMARK_BRAND_NAME?: string | undefined;
@@ -257,6 +336,9 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
     ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
     ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
     ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_URL?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_TOKEN?: string | undefined;
+    ESCROW_RELEASE_KILL_SWITCH?: boolean | undefined;
     ANDROID_PUSH_ICON?: string | undefined;
     REDIS_HOST?: string | undefined;
     REDIS_PORT?: number | undefined;
@@ -268,6 +350,7 @@ export declare const lcaApiEnvironmentSchema: z.ZodPipe<z.ZodObject<{
 }>>;
 export type LcaApiEnvironment = z.output<typeof lcaApiEnvironmentSchema>;
 export declare const parseLcaApiEnvironment: (raw: Record<string, unknown>, source?: string) => LcaApiEnvironment;
+export declare const isEscrowReleaseKillSwitchEnabled: () => boolean;
 export declare const parseEscrowPrivateKeys: (serialized: string) => Record<string, string>;
 export declare const environment: {
     SA_SEED_ENCRYPT_WRITES: boolean;
@@ -277,6 +360,7 @@ export declare const environment: {
     SEED: string;
     MONGO_URI: string;
     MONGO_DB_NAME: string;
+    ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: number;
     ESCROW_HOLD_DURATION_MS: number;
     ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
     IS_OFFLINE: boolean;
@@ -284,6 +368,9 @@ export declare const environment: {
     IS_E2E_TEST: boolean;
     SKIP_DIDKIT_NAPI: boolean;
     CI: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    CONFIG_STAGE?: string | undefined;
+    RUNTIME_SECRETS_ID?: string | undefined;
     SA_SEED_KMS_KEY_ARN?: string | undefined;
     SA_SEED_LOCAL_KEK?: string | undefined;
     DOMAIN_NAME?: string | undefined;
@@ -294,6 +381,17 @@ export declare const environment: {
     OPENAI_API_KEY?: string | undefined;
     METABASE_SECRET_KEY?: string | undefined;
     SCOUTS_SSO_CLIENT_SECRET?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    KEYCLOAK_JWKS_URL_OVERRIDES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+    GOOGLE_OAUTH_CLIENT_IDS?: string | undefined;
+    APPLE_OAUTH_CLIENT_IDS?: string | undefined;
     POSTMARK_SERVER_TOKEN?: string | undefined;
     POSTMARK_FROM_EMAIL?: string | undefined;
     POSTMARK_BRAND_NAME?: string | undefined;
@@ -306,6 +404,9 @@ export declare const environment: {
     ESCROW_ENCLAVE_MODE?: "software" | "remote" | undefined;
     ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON?: string | undefined;
     ESCROW_ENCLAVE_ACTIVE_KEY_ID?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_URL?: string | undefined;
+    ESCROW_ENCLAVE_REMOTE_TOKEN?: string | undefined;
+    ESCROW_RELEASE_KILL_SWITCH?: boolean | undefined;
     ANDROID_PUSH_ICON?: string | undefined;
     REDIS_HOST?: string | undefined;
     REDIS_PORT?: number | undefined;

package/dist/config/escrowBundleMode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/escrowDeployment.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/oidcEnvironment.d.ts

@@ -0,0 +1,74 @@
+import 'dotenv/config';
+import { z } from 'zod';
+export declare const oidcEnvironmentShape: {
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        test: "test";
+        production: "production";
+    }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    IS_OFFLINE: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    IS_E2E_TEST: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+};
+export declare const oidcEnvironmentSchema: z.ZodObject<{
+    NODE_ENV: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        test: "test";
+        production: "production";
+    }>>;
+    LAMBDA_STAGE: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    IS_OFFLINE: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    IS_E2E_TEST: z.ZodDefault<z.ZodPreprocess<z.ZodOptional<z.ZodPipe<z.ZodEnum<{
+        0: "0";
+        1: "1";
+        true: "true";
+        false: "false";
+    }>, z.ZodTransform<boolean, "0" | "1" | "true" | "false">>>>>;
+    KEYCLOAK_ISSUERS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    KEYCLOAK_AUDIENCES: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_ISSUER: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_JWK: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_SIGNING_KEY_SECRET_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_ID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_CLIENT_SECRET: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    OIDC_REDIRECT_URIS: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+export type OidcEnvironment = z.output<typeof oidcEnvironmentSchema>;
+export declare const parseOidcEnvironment: (raw: Record<string, unknown>, source?: string) => OidcEnvironment;
+export declare const environment: {
+    NODE_ENV: "development" | "test" | "production";
+    IS_OFFLINE: boolean;
+    IS_E2E_TEST: boolean;
+    LAMBDA_STAGE?: string | undefined;
+    KEYCLOAK_ISSUERS?: string | undefined;
+    KEYCLOAK_AUDIENCES?: string | undefined;
+    OIDC_ISSUER?: string | undefined;
+    OIDC_SIGNING_KEY_JWK?: string | undefined;
+    OIDC_SIGNING_KEY_SECRET_ID?: string | undefined;
+    OIDC_CLIENT_ID?: string | undefined;
+    OIDC_CLIENT_SECRET?: string | undefined;
+    OIDC_REDIRECT_URIS?: string | undefined;
+};

package/dist/config/serverlessFunctionEnv.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config/stageConfig.d.ts

@@ -0,0 +1,62 @@
+import 'dotenv/config';
+export declare const base: Record<string, string>;
+export declare const stages: {
+    dev: {
+        APPLE_OAUTH_CLIENT_IDS: string;
+        DOMAIN_NAME: string;
+        ESCROW_ENCLAVE_ACTIVE_KEY_ID: string;
+        ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: string;
+        ESCROW_HOLD_DURATION_MS: string;
+        ESCROW_HOLD_RESTART_MIN_AGE_MS: string;
+        GOOGLE_OAUTH_CLIENT_IDS: string;
+        KEYCLOAK_AUDIENCES: string;
+        KEYCLOAK_ISSUERS: string;
+        OIDC_CLIENT_ID: string;
+        OIDC_ISSUER: string;
+        OIDC_SIGNING_KEY_SECRET_ID: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+    production: {
+        DOMAIN_NAME: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+    'scouts.dev': {
+        DOMAIN_NAME: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+    'scouts.production': {
+        DOMAIN_NAME: string;
+        POSTMARK_BRAND_NAME: string;
+        POSTMARK_FROM_EMAIL: string;
+        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: string;
+        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: string;
+        SA_SEED_ALLOW_LEGACY_READ: string;
+        SA_SEED_ENCRYPT_WRITES: string;
+        SENTRY_ENV: string;
+    };
+};
+export declare const applyLcaApiStageConfig: (stage: string | undefined) => void;

package/dist/config/stageConfig.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/docker-entry.d.ts

@@ -1 +1 @@
-export {};
+import './config/applyDockerStageConfig';

package/dist/helpers/auth.helpers.d.ts

@@ -7,7 +7,7 @@ export interface VerifiedUser {
 export type AuthProviderType = 'firebase' | 'supertokens' | 'keycloak' | 'oidc';
 export declare function verifyFirebaseToken(token: string): Promise<VerifiedUser>;
 export declare function verifySuperTokensToken(_token: string): Promise<VerifiedUser>;
-export declare function verifyKeycloakToken(_token: string): Promise<VerifiedUser>;
+export declare function verifyKeycloakToken(token: string): Promise<VerifiedUser>;
 export declare function verifyOidcToken(_token: string): Promise<VerifiedUser>;
 export declare function verifyAuthToken(token: string, providerType: AuthProviderType): Promise<VerifiedUser>;
 export declare function getContactMethodFromUser(user: VerifiedUser): {

package/dist/helpers/escrowCancelLink.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@routes';
+export declare const resolveEscrowAppBaseUrl: (ctx: Pick<Context, "tenant">) => string;
+export declare const buildEscrowCancelUrl: ({ baseUrl, holdId, token, }: {
+    baseUrl: string;
+    holdId: string;
+    token: string;
+}) => string;

package/dist/helpers/escrowCancelLink.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/escrowCancelToken.d.ts

@@ -0,0 +1,4 @@
+import type { EscrowHold } from '@models';
+export declare const generateEscrowCancelToken: () => string;
+export declare const hashEscrowCancelToken: (token: string) => string;
+export declare const escrowCancelTokenMatches: (hold: EscrowHold, token: string) => boolean;

package/dist/helpers/escrowCancelToken.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/keycloak.helpers.d.ts

@@ -0,0 +1,23 @@
+import type { JWTVerifyGetKey } from 'jose';
+export interface KeycloakVerifyOptions {
+    issuers: string[];
+    audiences: string[];
+}
+export interface KeycloakClaims {
+    sub: string;
+    iss: string;
+    typ?: string;
+    azp?: string;
+    aud?: string | string[];
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export declare const setKeycloakJwksResolverForTests: (resolver: ((issuer: string) => JWTVerifyGetKey) | undefined) => void;
+export declare const getKeycloakIssuerJwksUrl: (issuer: string) => string;
+export declare const getKeycloakJwks: (issuer: string) => JWTVerifyGetKey;
+export declare const verifyKeycloakJwt: (token: string, opts: KeycloakVerifyOptions) => Promise<KeycloakClaims>;
+export declare const getKeycloakVerifyOptionsFromEnv: () => KeycloakVerifyOptions | null;

package/dist/helpers/login-ticket.helpers.d.ts

@@ -0,0 +1,31 @@
+export declare const AUTH_CODE_PREFIX = "oidc-code:";
+export declare const ACCESS_TOKEN_PREFIX = "oidc:access:";
+export declare const AUTH_CODE_TTL_SECONDS = 60;
+export declare const ACCESS_TOKEN_TTL_SECONDS = 300;
+export interface SubjectClaims {
+    subject: string;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export interface AuthorizationCodeData extends SubjectClaims {
+    scope: string;
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    nonce?: string;
+    state?: string;
+    createdAt: number;
+}
+export interface AccessTokenData extends SubjectClaims {
+    createdAt: number;
+}
+export declare const generateAuthorizationCode: () => string;
+export declare const generateAccessToken: () => string;
+export declare const storeAuthorizationCode: (data: AuthorizationCodeData, ttl?: number) => Promise<void>;
+export declare const consumeAuthorizationCode: (code: string) => Promise<AuthorizationCodeData | null>;
+export declare const storeAccessToken: (accessToken: string, data: AccessTokenData, ttl?: number) => Promise<void>;
+export declare const getAccessToken: (accessToken: string) => Promise<AccessTokenData | null>;

package/dist/helpers/login-ticket.helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/oidc.helpers.d.ts

@@ -0,0 +1,47 @@
+import type { CryptoKey, JWK, JWTPayload } from 'jose';
+export declare const OIDC_SIGNING_ALG: "RS256";
+export declare const DEFAULT_ID_TOKEN_TTL_SECONDS = 300;
+export declare const DEFAULT_OIDC_CLIENT_ID = "keycloak-broker";
+export interface OidcIdTokenClaims extends JWTPayload {
+    sub: string;
+    iss: string;
+    aud: string | string[];
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    name?: string;
+    picture?: string;
+}
+interface OidcSigningKey {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicJwk: JWK;
+    kid: string;
+}
+export declare const getOidcSigningKey: () => Promise<OidcSigningKey>;
+export declare const resetOidcSigningKeyForTests: () => void;
+export declare const getOidcIssuer: () => string;
+export declare const getOidcClientId: () => string;
+export declare const getOidcRedirectUris: () => string[];
+export declare const verifyOidcClientCredentials: (clientId: string, clientSecret: string) => boolean;
+export declare const isAllowedRedirectUri: (redirectUri: string) => boolean;
+export declare const getOidcJwks: () => Promise<{
+    keys: JWK[];
+}>;
+export declare const getOidcDiscoveryDocument: () => Record<string, unknown>;
+export declare const mintIdToken: (params: {
+    subject: string;
+    nonce?: string;
+    ttlSeconds?: number;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    name?: string;
+    picture?: string;
+}) => Promise<{
+    token: string;
+    expiresAt: number;
+}>;
+export {};

package/dist/helpers/rate-limit.helpers.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyRequest } from 'fastify';
+export declare const DEFAULT_MAX_FAILED_ATTEMPTS = 50;
+export declare const DEFAULT_RATE_LIMIT_WINDOW_SECONDS: number;
+export declare const isRateLimited: (key: string, max?: number) => Promise<boolean>;
+export declare const recordFailure: (key: string, windowSeconds?: number) => Promise<void>;
+export declare const getRequestClientIp: (request: Pick<FastifyRequest, "ip">) => string;

package/dist/helpers/rate-limit.helpers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/social-token.helpers.d.ts

@@ -0,0 +1,19 @@
+import type { JWTVerifyGetKey } from 'jose';
+export type SocialProviderId = 'google' | 'apple';
+export interface SocialProviderConfig {
+    issuers: string[];
+    audiences: string[];
+    jwksUri: string;
+}
+export interface SocialClaims {
+    sub: string;
+    iss: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export declare const getSocialProviderConfig: (provider: SocialProviderId) => SocialProviderConfig | null;
+export declare const setSocialJwksResolverForTests: (resolver: ((jwksUri: string) => JWTVerifyGetKey) | undefined) => void;
+export declare const getSocialJwks: (jwksUri: string) => JWTVerifyGetKey;
+export declare const verifySocialIdToken: (provider: SocialProviderId, token: string) => Promise<SocialClaims>;

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export type { AppRouter } from './app';
 export { appRouter as mainApp } from './app';
 export { app as didApp } from './dids';
+export { app as oidcApp } from './oidc';
 export { app as swaggerApp } from './openapi';

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 130294880 bytes
-sha256: a1011a859d7a6b8f2f80b736401ec8e590ef34af0167e08e979d2a8ad252801a
+size: 137933050 bytes
+sha256: 5d64b82c788a32e703cbe115ccb7dead043201ff159475b76d09fab29fade6ac

package/dist/jobs/escrowBlobRewrap.d.ts

@@ -0,0 +1,9 @@
+export interface EscrowBlobRewrapResult {
+    rewrapped: number;
+    skippedPendingHold: number;
+    failed: number;
+}
+export interface RunEscrowBlobRewrapOptions {
+    limit?: number;
+}
+export declare const runEscrowBlobRewrap: (options?: RunEscrowBlobRewrapOptions) => Promise<EscrowBlobRewrapResult>;

package/dist/jobs/escrowHoldReminders.d.ts

@@ -0,0 +1,12 @@
+import { notifyEscrowHoldEvent } from '../services/escrow-enclave';
+export interface EscrowHoldReminderResult {
+    reminded: number;
+    expired: number;
+    failed: number;
+}
+export interface RunEscrowHoldRemindersOptions {
+    now?: Date;
+    limit?: number;
+    notify?: typeof notifyEscrowHoldEvent;
+}
+export declare const runEscrowHoldReminders: (options?: RunEscrowHoldRemindersOptions) => Promise<EscrowHoldReminderResult>;

package/dist/models/AuthSubject.d.ts

@@ -0,0 +1,20 @@
+import type { Collection } from 'mongodb';
+export declare const AUTH_SUBJECTS_COLLECTION = "authsubjects";
+export interface AuthSubjectAttributes {
+    email?: string;
+    emailVerified: boolean;
+    displayName?: string;
+    pictureUrl?: string;
+}
+export interface MongoAuthSubjectType extends AuthSubjectAttributes {
+    subject: string;
+    identityKey: string;
+    createdAt: Date;
+    lastLoginAt: Date;
+}
+export declare const getAuthSubjectsCollection: () => Collection<MongoAuthSubjectType>;
+export declare const createAuthSubjectIndexes: () => Promise<void>;
+export declare const ensureAuthSubjectIndexes: () => Promise<void>;
+export declare const getOrCreateAuthSubject: (identityKey: string, attrs: AuthSubjectAttributes) => Promise<MongoAuthSubjectType>;
+export declare const getOrCreateAuthSubjectLinkedTo: (identityKey: string, subject: string, attrs: AuthSubjectAttributes) => Promise<MongoAuthSubjectType>;
+export declare const findAuthSubjectByIdentityKey: (identityKey: string) => Promise<MongoAuthSubjectType | null>;