@learncard/lca-api-service 1.4.0 → 1.5.0

package/dist/models/EscrowHold.d.ts

@@ -4,7 +4,48 @@ import { type AuthProviderMapping } from './UserKey';
 export declare const ESCROW_HOLDS_COLLECTION = "escrowholds";
 export declare const ESCROW_HOLD_STALE_WINDOW_MS: number;
 export declare const ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+export declare const ESCROW_HOLD_REMINDER_WINDOW_MS: number;
+export declare const EscrowHoldRecordValidator: z.ZodObject<{
+    hold: z.ZodObject<{
+        holdId: z.ZodString;
+        did: z.ZodString;
+        shareVersion: z.ZodNumber;
+        blobHash: z.ZodString;
+        enrollmentEpoch: z.ZodNumber;
+        releasePolicy: z.ZodEnum<{
+            pin: "pin";
+            hold: "hold";
+        }>;
+        clientEphemeralPublicKey: z.ZodString;
+        createdLo: z.ZodNumber;
+        createdHi: z.ZodNumber;
+        policyVersion: z.ZodNumber;
+        signature: z.ZodString;
+    }, z.core.$loose>;
+    holdDurationMs: z.ZodNumber;
+    ledgerSeq: z.ZodNumber;
+}, z.core.$loose>;
 export declare const EscrowHoldValidator: z.ZodObject<{
+    holdRecord: z.ZodObject<{
+        hold: z.ZodObject<{
+            holdId: z.ZodString;
+            did: z.ZodString;
+            shareVersion: z.ZodNumber;
+            blobHash: z.ZodString;
+            enrollmentEpoch: z.ZodNumber;
+            releasePolicy: z.ZodEnum<{
+                pin: "pin";
+                hold: "hold";
+            }>;
+            clientEphemeralPublicKey: z.ZodString;
+            createdLo: z.ZodNumber;
+            createdHi: z.ZodNumber;
+            policyVersion: z.ZodNumber;
+            signature: z.ZodString;
+        }, z.core.$loose>;
+        holdDurationMs: z.ZodNumber;
+        ledgerSeq: z.ZodNumber;
+    }, z.core.$loose>;
     _id: z.ZodString;
     authProvider: z.ZodObject<{
         type: z.ZodEnum<{
@@ -40,36 +81,73 @@ export declare const EscrowHoldValidator: z.ZodObject<{
         "release-failed": "release-failed";
     }>>;
     cancelledAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelPendingAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelConfirmedAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelAttempts: z.ZodOptional<z.ZodNumber>;
+    enclaveEnvelope: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
     cancelledBy: z.ZodOptional<z.ZodEnum<{
         did: "did";
+        link: "link";
         system: "system";
     }>>;
     completedAt: z.ZodOptional<z.ZodDate>;
     clientEphemeralPublicKey: z.ZodString;
     resumeTokenHash: z.ZodString;
+    cancelTokenHash: z.ZodOptional<z.ZodString>;
+    cancelTokenUsedAt: z.ZodOptional<z.ZodDate>;
+    cancelTokenHashes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    startedNotificationPending: z.ZodOptional<z.ZodBoolean>;
+    reminderClaimedUntil: z.ZodOptional<z.ZodDate>;
+    startedNotificationAttemptedAt: z.ZodOptional<z.ZodDate>;
+    reminderAttemptedAt: z.ZodOptional<z.ZodDate>;
     notifications: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             cancelled: "cancelled";
             completed: "completed";
+            "pin-locked": "pin-locked";
             started: "started";
+            reminder: "reminder";
         }>;
         sentAt: z.ZodDate;
     }, z.core.$strip>>>;
     requestIp: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodDate;
     updatedAt: z.ZodDate;
 }, z.core.$strip>;
 export type EscrowHold = z.infer<typeof EscrowHoldValidator>;
-export type CreateEscrowHoldInput = Omit<z.input<typeof EscrowHoldValidator>, '_id' | 'status' | 'createdAt' | 'updatedAt' | 'notifications' | 'cancelledAt' | 'cancelledBy' | 'completedAt' | 'cancelReason'>;
+export type CreateEscrowHoldInput = Omit<z.input<typeof EscrowHoldValidator>, '_id' | 'status' | 'createdAt' | 'updatedAt' | 'notifications' | 'cancelledAt' | 'cancelledBy' | 'completedAt' | 'cancelReason' | 'cancelTokenUsedAt' | 'enclaveCancelPendingAt' | 'enclaveCancelConfirmedAt' | 'enclaveCancelAttempts'>;
 export declare const getEscrowHoldsCollection: () => Collection<EscrowHold>;
 export declare const createEscrowHoldsIndexes: () => Promise<void>;
 export declare const createEscrowHold: (input: CreateEscrowHoldInput) => Promise<EscrowHold>;
 export declare const findPendingEscrowHoldByAuthProvider: (authProvider: AuthProviderMapping, releasePolicy?: EscrowHold["releasePolicy"]) => Promise<EscrowHold | null>;
 export declare const findEscrowHoldById: (id: string) => Promise<EscrowHold | null>;
+export declare const hasUnconfirmedEscrowCancellation: (primaryDid: string) => Promise<boolean>;
+export declare const findEscrowHoldsPendingEnclaveCancellation: (limit: number) => Promise<EscrowHold[]>;
+export declare const countEscrowCancellationsNearRelease: (now: Date) => Promise<number>;
+export declare const recordEscrowEnclaveCancelAttempt: (id: string) => Promise<boolean>;
+export declare const confirmEscrowEnclaveCancellation: (id: string) => Promise<void>;
 export declare const cancelEscrowHold: (id: string, cancelledBy: "did" | "system", cancelReason?: EscrowHold["cancelReason"]) => Promise<EscrowHold | null>;
+export declare const cancelEscrowHoldByCancelToken: (id: string, cancelTokenHash: string) => Promise<EscrowHold | null>;
 export declare const completeEscrowHold: (id: string) => Promise<EscrowHold | null>;
 export declare const hasCompletedEscrowHoldForVersion: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
 export declare const expireStaleEscrowHolds: (now: Date) => Promise<number>;
 export declare const markClaimedEscrowHoldFailed: (id: string, reason: "pin-mismatch" | "pin-locked" | "release-failed", completedAt: Date) => Promise<void>;
+export declare const retryClaimedEscrowHold: (id: string, completedAt: Date) => Promise<void>;
+export declare const findEscrowHoldsPendingStartNotification: (limit: number) => Promise<EscrowHold[]>;
+export declare const recordEscrowStartNotificationAttempt: (id: string, now: Date) => Promise<void>;
+export declare const findEscrowHoldsDueForReminder: (now: Date, limit: number) => Promise<EscrowHold[]>;
+export declare const claimEscrowHoldForReminder: (id: string, now: Date) => Promise<EscrowHold | null>;
+export declare const releaseEscrowReminderClaim: (hold: EscrowHold) => Promise<void>;
 export declare const hashEscrowResumeToken: (token: string) => string;
 export declare const generateEscrowResumeToken: () => string;
+export declare const recordEscrowHoldNotification: (holdId: string, kind: EscrowHold["notifications"][number]["kind"]) => Promise<void>;
+export declare const rotateEscrowCancelToken: (holdId: string) => Promise<string | null>;

package/dist/models/Notification.d.ts

@@ -167,6 +167,11 @@ export declare const MongoNotificationValidator: z.ZodObject<{
                 approvedAt: z.ZodString;
                 contractUpdatedAt: z.ZodString;
             }, z.core.$strip>>;
+            referral: z.ZodOptional<z.ZodObject<{
+                requestId: z.ZodString;
+                requestedBy: z.ZodString;
+                externalReferenceId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
             id: z.ZodString;
             action: z.ZodEnum<{
                 write: "write";

package/dist/models/UserKey.d.ts

@@ -72,6 +72,8 @@ export declare const EscrowEnvelopeValidator: z.ZodObject<{
     ciphertext: z.ZodString;
 }, z.core.$strict>;
 export declare const EscrowBlobValidator: z.ZodObject<{
+    enrollmentEpoch: z.ZodNumber;
+    blobHash: z.ZodString;
     envelope: z.ZodObject<{
         version: z.ZodLiteral<1>;
         algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
@@ -119,6 +121,8 @@ export declare const EscrowPinStatusValidator: z.ZodObject<{
 export declare const getEscrowPinStatus: (userKey: MongoUserKeyType) => z.infer<typeof EscrowPinStatusValidator>;
 declare const MongoUserKeyBaseValidator: z.ZodObject<{
     escrowBlob: z.ZodOptional<z.ZodObject<{
+        enrollmentEpoch: z.ZodNumber;
+        blobHash: z.ZodString;
         envelope: z.ZodObject<{
             version: z.ZodLiteral<1>;
             algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
@@ -235,6 +239,8 @@ declare const MongoUserKeyBaseValidator: z.ZodObject<{
 }, z.core.$strip>;
 export declare const MongoUserKeyValidator: z.ZodObject<{
     escrowBlob: z.ZodOptional<z.ZodObject<{
+        enrollmentEpoch: z.ZodNumber;
+        blobHash: z.ZodString;
         envelope: z.ZodObject<{
             version: z.ZodLiteral<1>;
             algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
@@ -409,6 +415,8 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     createdAt: Date;
     updatedAt: Date;
     escrowBlob?: {
+        enrollmentEpoch: number;
+        blobHash: string;
         envelope: {
             version: 1;
             algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
@@ -462,12 +470,14 @@ export declare const upsertUserKey: (contactMethod: ContactMethod, data: Partial
 export declare const upsertUserKeyByAuthProvider: (contactMethod: ContactMethod, authProvider: AuthProviderMapping, data: Partial<Omit<MongoUserKeyType, "_id" | "contactMethod" | "createdAt" | "authProviders">>, expectedVersion?: number) => Promise<MongoUserKeyType>;
 export declare const addAuthProviderToUserKey: (contactMethod: ContactMethod, authProvider: AuthProviderMapping) => Promise<void>;
 export declare const addRecoveryMethodToUserKey: (contactMethod: ContactMethod, recoveryMethod: RecoveryMethod) => Promise<void>;
-export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, blob: EscrowBlob, expectedShareVersion: number, pin?: {
+export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, blob: Omit<EscrowBlob, "enrollmentEpoch" | "blobHash">, expectedShareVersion: number, pin?: {
     salt: string;
 }, carryFrom?: {
     blob: EscrowBlob;
     pin: NonNullable<MongoUserKeyType["escrowPin"]>;
 }) => Promise<MongoUserKeyType | null>;
+export declare const rewrapEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, oldBlob: EscrowBlob, oldPin: MongoUserKeyType["escrowPin"], newEnvelope: EscrowBlob["envelope"], identity: Pick<EscrowBlob, "enclaveKeyId" | "enclaveMode" | "measurements">) => Promise<MongoUserKeyType | null>;
+export declare const findUserKeysWithEscrowBlobKeyId: (keyIds: string[], limit: number) => Promise<MongoUserKeyType[]>;
 export declare const clearEscrowByAuthProvider: (authProvider: AuthProviderMapping, { optOut }: {
     optOut: boolean;
 }) => Promise<MongoUserKeyType | null>;

package/dist/models/index.d.ts

@@ -6,3 +6,4 @@ export * from './Pins';
 export * from './Preferences';
 export * from './UserKey';
 export * from './EscrowHold';
+export * from './AuthSubject';

package/dist/oidc.d.ts

@@ -0,0 +1,5 @@
+import { type FastifyPluginAsync } from 'fastify';
+export declare const oidcFastifyPlugin: FastifyPluginAsync;
+export declare const app: import("fastify").FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault> & PromiseLike<import("fastify").FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>> & {
+    __linterBrands: "SafePromiseLike";
+};

package/dist/routes/auth.d.ts

@@ -0,0 +1,31 @@
+export declare const authRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("@routes").Context;
+    meta: import("trpc-to-openapi").OpenApiMeta;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    requestLoginTicket: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            email: string;
+            code: string;
+        };
+        output: {
+            success: boolean;
+            ticket?: string | undefined;
+            error?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    requestSocialLoginTicket: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            provider: "google" | "apple";
+            idToken: string;
+        };
+        output: {
+            success: boolean;
+            ticket?: string | undefined;
+            error?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+}>>;

package/dist/routes/escrow.d.ts

@@ -1,11 +1,14 @@
+import { type Context } from '@routes';
 export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
-    ctx: import("@routes").Context;
+    ctx: Context;
     meta: import("trpc-to-openapi").OpenApiMeta;
     errorShape: import("@trpc/server").TRPCDefaultErrorShape;
     transformer: false;
 }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
     getAttestation: import("@trpc/server").TRPCQueryProcedure<{
-        input: Record<string, never>;
+        input: {
+            nonce?: string | undefined;
+        };
         output: {
             attestation: {
                 mode: "software" | "nitro";
@@ -19,6 +22,7 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
                 };
                 document: string;
                 issuedAt: string;
+                previousKeyIds?: string[] | undefined;
             };
             holdDurationMs: number;
         };
@@ -79,10 +83,10 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
             recoverySessionToken?: string | undefined;
         };
         output: {
+            holdId: string;
+            releasePolicy: "pin" | "hold";
             requestedAt: string;
             releaseAfter: string;
-            releasePolicy: "pin" | "hold";
-            holdId: string;
             status: "pending";
             resumeToken: string | null;
             pinSalt?: string | undefined;
@@ -120,6 +124,16 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    cancelRecoveryByLink: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            token: string;
+        };
+        output: {
+            cancelled: boolean;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     completeRecovery: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             holdId: string;

package/dist/routes/keys.d.ts

@@ -153,6 +153,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
                 salt?: string | undefined;
             };
             sssActivationState: "provisional" | "active";
+            escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
         } | null;
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;

package/dist/routes/notifications.d.ts

@@ -207,6 +207,11 @@ export declare const notificationsRouter: import("@trpc/server").TRPCBuiltRouter
                         approvedAt: string;
                         contractUpdatedAt: string;
                     } | undefined;
+                    referral?: {
+                        requestId: string;
+                        requestedBy: string;
+                        externalReferenceId?: string | undefined;
+                    } | undefined;
                     uris?: string[] | undefined;
                 } | undefined;
                 inbox?: {

package/dist/routes/signing-authority.d.ts

@@ -18,6 +18,20 @@ export declare const signingAuthorityRouter: import("@trpc/server").TRPCBuiltRou
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    ensureManagedSigningAuthority: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            name: string;
+            ownerDid: string;
+        };
+        output: {
+            ownerDid: string;
+            name: string;
+            did: string;
+            endpoint: string;
+            _id?: string | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     signingAuthorities: import("@trpc/server").TRPCQueryProcedure<{
         input: void;
         output: {

package/dist/services/escrow-enclave/blobIdentity.d.ts

@@ -0,0 +1,10 @@
+export interface EscrowEnvelopeFields {
+    version: number;
+    algorithm: string;
+    keyId: string;
+    ephemeralPublicKey: string;
+    salt: string;
+    iv: string;
+    ciphertext: string;
+}
+export declare const escrowBlobIdentity: (envelope: EscrowEnvelopeFields) => string;

package/dist/services/escrow-enclave/blobIdentity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/cancellation.d.ts

@@ -0,0 +1,3 @@
+import { type EscrowHold, type MongoUserKeyType } from '@models';
+export declare const logEscrowCancellationPending: (urgent: boolean) => void;
+export declare const cancelHoldInEnclave: (hold: EscrowHold, userKey?: MongoUserKeyType | null, now?: Date) => Promise<boolean>;

package/dist/services/escrow-enclave/enclaveTrustAnchors.d.ts

@@ -0,0 +1 @@
+export declare const pinnedEnclaveCa: (baseUrl: string) => string | undefined;

package/dist/services/escrow-enclave/index.d.ts

@@ -1,9 +1,25 @@
+import type { EscrowBlobStaleReason } from '@learncard/types';
 import { type EscrowEnclave } from './types';
 export * from './types';
 export * from './softwareEnclave';
+export * from './remoteEnclave';
 export * from './notifications';
 export declare const isEscrowEnabled: () => boolean;
+export declare const isEscrowRemoteMode: () => boolean;
+export declare const activeEscrowClientMode: () => "software" | "nitro";
 export declare const getEscrowHoldDurationMs: () => number;
 export declare const getEscrowHoldRestartMinAgeMs: () => number;
 export declare const getEscrowEnclave: () => EscrowEnclave;
+export type { EscrowBlobStaleReason };
+interface EscrowAttestationIdentity {
+    keyId: string;
+    previousKeyIds: string[];
+    mode: 'software' | 'nitro';
+}
+export declare const getEnclaveAttestationIdentity: () => Promise<EscrowAttestationIdentity>;
+export declare const getEscrowBlobStaleReason: (blob: {
+    enclaveMode: "software" | "nitro";
+    enclaveKeyId: string;
+}) => Promise<EscrowBlobStaleReason | undefined>;
 export declare const __setEscrowEnclaveForTests: (replacement: EscrowEnclave | undefined) => void;
+export declare const __resetEscrowAttestationCacheForTests: () => void;

package/dist/services/escrow-enclave/notifications.d.ts

@@ -1,9 +1,24 @@
-import type { EscrowHold } from '../../models/EscrowHold';
-import type { MongoUserKeyType } from '../../models/UserKey';
+import type { ResolvedTenant } from '@learncard/email-templates';
+import type { EscrowHold, MongoUserKeyType } from '@models';
+import { type DeliveryService } from '../delivery';
+export type EscrowHoldEventKind = 'started' | 'reminder' | 'completed' | 'cancelled' | 'pin-locked';
 export interface EscrowHoldEvent {
-    kind: 'started' | 'cancelled' | 'completed';
+    kind: EscrowHoldEventKind;
     hold: EscrowHold;
     userKey: MongoUserKeyType;
     reason?: 'superseded';
+    cancelToken?: string;
+    tenant?: ResolvedTenant;
+    activeHold?: EscrowHold;
 }
-export declare const notifyEscrowHoldEvent: (event: EscrowHoldEvent) => Promise<void>;
+type SendPushNotification = typeof import('@helpers/pushNotifications.helpers').sendPushNotification;
+export interface EscrowHoldNotifierDeps {
+    send: DeliveryService['send'];
+    sendPush: SendPushNotification;
+    now: () => Date;
+    rotateCancelToken: (holdId: string) => Promise<string | null>;
+    recordNotification: (holdId: string, kind: EscrowHoldEventKind) => Promise<void>;
+}
+export declare const ESCROW_NOTIFICATION_TIMEOUT_MS = 3000;
+export declare const notifyEscrowHoldEvent: (event: EscrowHoldEvent, overrides?: Partial<EscrowHoldNotifierDeps>) => Promise<boolean>;
+export {};

package/dist/services/escrow-enclave/notifications.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/production.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/remoteEnclave.contract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/remoteEnclave.d.ts

@@ -0,0 +1,20 @@
+import { type EscrowEnclave } from './types';
+export interface RemoteEnclaveTransportResponse {
+    status: number;
+    data: unknown;
+}
+export interface RemoteEnclaveTransport {
+    post(url: string, body: unknown, config: {
+        headers: Record<string, string>;
+        timeout: number;
+    }): Promise<RemoteEnclaveTransportResponse>;
+}
+export declare const createHttpTransport: (caPem?: string) => RemoteEnclaveTransport;
+export interface RemoteEnclaveConfig {
+    baseUrl: string;
+    token: string;
+    timeoutMs: number;
+    caPem?: string;
+    transport?: RemoteEnclaveTransport;
+}
+export declare const createRemoteEnclave: (config: RemoteEnclaveConfig) => EscrowEnclave;

package/dist/services/escrow-enclave/remoteEnclave.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/remoteEnclave.tls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/escrow-enclave/softwareEnclave.d.ts

@@ -1,17 +1,27 @@
-import { type EscrowEnclave, type EnclaveAttestation, type VerifyEscrowBlobInput, type VerifyEscrowBlobResult, type ReleaseRequest, type ReleaseResult, type CarryPinVerifierInput } from './types';
+import type { EnclaveCreateHoldInput, EscrowHoldRecord, CancelHoldRequest } from './types';
+import { type EscrowEnclave, type EnclaveAttestation, type VerifyEscrowBlobInput, type VerifyEscrowBlobResult, type ReleaseRequest, type ReleaseResult, type CarryPinVerifierInput, type RewrapEscrowBlobInput } from './types';
 export interface SoftwareEnclaveConfig {
     privateKeys: Record<string, string>;
     activeKeyId: string;
+    holdDurationMs?: number;
 }
 export declare class SoftwareEnclave implements EscrowEnclave {
     private readonly privateKeys;
     private readonly activeKeyId;
+    private readonly holdDurationMs;
     constructor(config: SoftwareEnclaveConfig);
-    getAttestation(): Promise<EnclaveAttestation>;
+    createHold(input: EnclaveCreateHoldInput): Promise<{
+        holdRecord: EscrowHoldRecord;
+    }>;
+    cancelHold(input: CancelHoldRequest): Promise<void>;
+    getAttestation(_nonce?: Uint8Array): Promise<EnclaveAttestation>;
     private decrypt;
     verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
     carryPinVerifier(input: CarryPinVerifierInput): Promise<{
         envelope: import("@learncard/sss-key-manager").EscrowEnvelope;
     }>;
+    rewrapEscrowBlob(input: RewrapEscrowBlobInput): Promise<{
+        envelope: import("@learncard/sss-key-manager").EscrowEnvelope;
+    }>;
     releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
 }

package/dist/services/escrow-enclave/types.d.ts

@@ -1,8 +1,8 @@
 import type { EscrowEnvelope } from '@learncard/sss-key-manager';
-import type { EscrowHold } from '../../models/EscrowHold';
 export interface EnclaveAttestation {
     mode: 'software' | 'nitro';
     keyId: string;
+    previousKeyIds?: string[];
     publicKey: string;
     measurements: {
         imageSha384?: string;
@@ -13,7 +13,40 @@ export interface EnclaveAttestation {
     document: string;
     issuedAt: string;
 }
-export type EscrowHoldForEnclave = Pick<EscrowHold, '_id' | 'status' | 'releaseAfter' | 'releasePolicy' | 'primaryDid' | 'shareVersion' | 'clientEphemeralPublicKey'>;
+export interface EscrowHoldRecord {
+    [key: string]: unknown;
+    hold: {
+        [key: string]: unknown;
+        holdId: string;
+        did: string;
+        shareVersion: number;
+        blobHash: string;
+        enrollmentEpoch: number;
+        releasePolicy: 'hold' | 'pin';
+        clientEphemeralPublicKey: string;
+        createdLo: number;
+        createdHi: number;
+        policyVersion: number;
+        signature: string;
+    };
+    holdDurationMs: number;
+    ledgerSeq: number;
+}
+export interface EnclaveCreateHoldInput {
+    envelope: EscrowEnvelope;
+    holdId: string;
+    expectedDid: string;
+    expectedShareVersion: number;
+    enrollmentEpoch: number;
+    releasePolicy: 'hold' | 'pin';
+    clientEphemeralPublicKey: string;
+}
+export interface CancelHoldRequest {
+    envelope: EscrowEnvelope;
+    hold: EscrowHoldRecord;
+    clientEphemeralPublicKey: string;
+    expectedDid: string;
+}
 export interface VerifyEscrowBlobInput {
     envelope: EscrowEnvelope;
     expectedDid: string;
@@ -27,11 +60,7 @@ export type VerifyEscrowBlobResult = {
     hasPin: boolean;
     reason: string;
 };
-export interface ReleaseRequest {
-    envelope: EscrowEnvelope;
-    hold: EscrowHoldForEnclave;
-    clientEphemeralPublicKey: string;
-    expectedDid: string;
+export interface ReleaseRequest extends CancelHoldRequest {
     now?: Date;
     pinProof?: string;
 }
@@ -44,14 +73,29 @@ export interface CarryPinVerifierInput {
     expectedDid: string;
     sourceShareVersion: number;
     targetShareVersion: number;
+    sourceEnrollmentEpoch: number;
+    targetEnrollmentEpoch: number;
+}
+export interface RewrapEscrowBlobInput {
+    envelope: EscrowEnvelope;
+    expectedDid: string;
+    expectedShareVersion: number;
+    sourceEnrollmentEpoch: number;
 }
 export interface EscrowEnclave {
-    getAttestation(): Promise<EnclaveAttestation>;
+    getAttestation(nonce?: Uint8Array): Promise<EnclaveAttestation>;
     verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
     carryPinVerifier(input: CarryPinVerifierInput): Promise<{
         envelope: EscrowEnvelope;
     }>;
+    rewrapEscrowBlob(input: RewrapEscrowBlobInput): Promise<{
+        envelope: EscrowEnvelope;
+    }>;
     releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
+    createHold(input: EnclaveCreateHoldInput): Promise<{
+        holdRecord: EscrowHoldRecord;
+    }>;
+    cancelHold(input: CancelHoldRequest): Promise<void>;
 }
 export declare class EscrowPolicyError extends Error {
     constructor();

package/dist/types/notifications.d.ts

@@ -237,6 +237,11 @@ export declare const PaginatedNotificationsValidator: z.ZodObject<{
                     approvedAt: z.ZodString;
                     contractUpdatedAt: z.ZodString;
                 }, z.core.$strip>>;
+                referral: z.ZodOptional<z.ZodObject<{
+                    requestId: z.ZodString;
+                    requestedBy: z.ZodString;
+                    externalReferenceId: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
                 id: z.ZodString;
                 action: z.ZodEnum<{
                     write: "write";

package/esbuildPlugins.cjs

@@ -41,6 +41,7 @@ module.exports = [
     forceCjsSodiumWrapperPlugin,
     copyDidkitWasmPlugin,
     sentryEsbuildPlugin({
+        telemetry: process.env.SENTRY_BUILD_TELEMETRY !== 'false',
         authToken: process.env.SENTRY_AUTH_TOKEN,
         org: process.env.SENTRY_ORG,
         project: process.env.SENTRY_PROJECT,