@learncard/lca-api-service 1.4.0 → 1.5.1

package/dist/models/EscrowHold.d.ts

@@ -4,7 +4,48 @@ import { type AuthProviderMapping } from './UserKey';
 export declare const ESCROW_HOLDS_COLLECTION = "escrowholds";
 export declare const ESCROW_HOLD_STALE_WINDOW_MS: number;
 export declare const ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
+export declare const ESCROW_HOLD_REMINDER_WINDOW_MS: number;
+export declare const EscrowHoldRecordValidator: z.ZodObject<{
+    hold: z.ZodObject<{
+        holdId: z.ZodString;
+        did: z.ZodString;
+        shareVersion: z.ZodNumber;
+        blobHash: z.ZodString;
+        enrollmentEpoch: z.ZodNumber;
+        releasePolicy: z.ZodEnum<{
+            pin: "pin";
+            hold: "hold";
+        }>;
+        clientEphemeralPublicKey: z.ZodString;
+        createdLo: z.ZodNumber;
+        createdHi: z.ZodNumber;
+        policyVersion: z.ZodNumber;
+        signature: z.ZodString;
+    }, z.core.$loose>;
+    holdDurationMs: z.ZodNumber;
+    ledgerSeq: z.ZodNumber;
+}, z.core.$loose>;
 export declare const EscrowHoldValidator: z.ZodObject<{
+    holdRecord: z.ZodObject<{
+        hold: z.ZodObject<{
+            holdId: z.ZodString;
+            did: z.ZodString;
+            shareVersion: z.ZodNumber;
+            blobHash: z.ZodString;
+            enrollmentEpoch: z.ZodNumber;
+            releasePolicy: z.ZodEnum<{
+                pin: "pin";
+                hold: "hold";
+            }>;
+            clientEphemeralPublicKey: z.ZodString;
+            createdLo: z.ZodNumber;
+            createdHi: z.ZodNumber;
+            policyVersion: z.ZodNumber;
+            signature: z.ZodString;
+        }, z.core.$loose>;
+        holdDurationMs: z.ZodNumber;
+        ledgerSeq: z.ZodNumber;
+    }, z.core.$loose>;
     _id: z.ZodString;
     authProvider: z.ZodObject<{
         type: z.ZodEnum<{
@@ -40,36 +81,73 @@ export declare const EscrowHoldValidator: z.ZodObject<{
         "release-failed": "release-failed";
     }>>;
     cancelledAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelPendingAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelConfirmedAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelAttempts: z.ZodOptional<z.ZodNumber>;
+    enclaveEnvelope: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
     cancelledBy: z.ZodOptional<z.ZodEnum<{
         did: "did";
+        link: "link";
         system: "system";
     }>>;
     completedAt: z.ZodOptional<z.ZodDate>;
     clientEphemeralPublicKey: z.ZodString;
     resumeTokenHash: z.ZodString;
+    cancelTokenHash: z.ZodOptional<z.ZodString>;
+    cancelTokenUsedAt: z.ZodOptional<z.ZodDate>;
+    cancelTokenHashes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    startedNotificationPending: z.ZodOptional<z.ZodBoolean>;
+    reminderClaimedUntil: z.ZodOptional<z.ZodDate>;
+    startedNotificationAttemptedAt: z.ZodOptional<z.ZodDate>;
+    reminderAttemptedAt: z.ZodOptional<z.ZodDate>;
     notifications: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             cancelled: "cancelled";
             completed: "completed";
+            "pin-locked": "pin-locked";
             started: "started";
+            reminder: "reminder";
         }>;
         sentAt: z.ZodDate;
     }, z.core.$strip>>>;
     requestIp: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodDate;
     updatedAt: z.ZodDate;
 }, z.core.$strip>;
 export type EscrowHold = z.infer<typeof EscrowHoldValidator>;
-export type CreateEscrowHoldInput = Omit<z.input<typeof EscrowHoldValidator>, '_id' | 'status' | 'createdAt' | 'updatedAt' | 'notifications' | 'cancelledAt' | 'cancelledBy' | 'completedAt' | 'cancelReason'>;
+export type CreateEscrowHoldInput = Omit<z.input<typeof EscrowHoldValidator>, '_id' | 'status' | 'createdAt' | 'updatedAt' | 'notifications' | 'cancelledAt' | 'cancelledBy' | 'completedAt' | 'cancelReason' | 'cancelTokenUsedAt' | 'enclaveCancelPendingAt' | 'enclaveCancelConfirmedAt' | 'enclaveCancelAttempts'>;
 export declare const getEscrowHoldsCollection: () => Collection<EscrowHold>;
 export declare const createEscrowHoldsIndexes: () => Promise<void>;
 export declare const createEscrowHold: (input: CreateEscrowHoldInput) => Promise<EscrowHold>;
 export declare const findPendingEscrowHoldByAuthProvider: (authProvider: AuthProviderMapping, releasePolicy?: EscrowHold["releasePolicy"]) => Promise<EscrowHold | null>;
 export declare const findEscrowHoldById: (id: string) => Promise<EscrowHold | null>;
+export declare const hasUnconfirmedEscrowCancellation: (primaryDid: string) => Promise<boolean>;
+export declare const findEscrowHoldsPendingEnclaveCancellation: (limit: number) => Promise<EscrowHold[]>;
+export declare const countEscrowCancellationsNearRelease: (now: Date) => Promise<number>;
+export declare const recordEscrowEnclaveCancelAttempt: (id: string) => Promise<boolean>;
+export declare const confirmEscrowEnclaveCancellation: (id: string) => Promise<void>;
 export declare const cancelEscrowHold: (id: string, cancelledBy: "did" | "system", cancelReason?: EscrowHold["cancelReason"]) => Promise<EscrowHold | null>;
+export declare const cancelEscrowHoldByCancelToken: (id: string, cancelTokenHash: string) => Promise<EscrowHold | null>;
 export declare const completeEscrowHold: (id: string) => Promise<EscrowHold | null>;
 export declare const hasCompletedEscrowHoldForVersion: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
 export declare const expireStaleEscrowHolds: (now: Date) => Promise<number>;
 export declare const markClaimedEscrowHoldFailed: (id: string, reason: "pin-mismatch" | "pin-locked" | "release-failed", completedAt: Date) => Promise<void>;
+export declare const retryClaimedEscrowHold: (id: string, completedAt: Date) => Promise<void>;
+export declare const findEscrowHoldsPendingStartNotification: (limit: number) => Promise<EscrowHold[]>;
+export declare const recordEscrowStartNotificationAttempt: (id: string, now: Date) => Promise<void>;
+export declare const findEscrowHoldsDueForReminder: (now: Date, limit: number) => Promise<EscrowHold[]>;
+export declare const claimEscrowHoldForReminder: (id: string, now: Date) => Promise<EscrowHold | null>;
+export declare const releaseEscrowReminderClaim: (hold: EscrowHold) => Promise<void>;
 export declare const hashEscrowResumeToken: (token: string) => string;
 export declare const generateEscrowResumeToken: () => string;
+export declare const recordEscrowHoldNotification: (holdId: string, kind: EscrowHold["notifications"][number]["kind"]) => Promise<void>;
+export declare const rotateEscrowCancelToken: (holdId: string) => Promise<string | null>;

package/dist/models/Notification.d.ts

@@ -167,6 +167,11 @@ export declare const MongoNotificationValidator: z.ZodObject<{
                 approvedAt: z.ZodString;
                 contractUpdatedAt: z.ZodString;
             }, z.core.$strip>>;
+            referral: z.ZodOptional<z.ZodObject<{
+                requestId: z.ZodString;
+                requestedBy: z.ZodString;
+                externalReferenceId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
             id: z.ZodString;
             action: z.ZodEnum<{
                 write: "write";

package/dist/models/UserKey.d.ts

@@ -72,6 +72,8 @@ export declare const EscrowEnvelopeValidator: z.ZodObject<{
     ciphertext: z.ZodString;
 }, z.core.$strict>;
 export declare const EscrowBlobValidator: z.ZodObject<{
+    enrollmentEpoch: z.ZodNumber;
+    blobHash: z.ZodString;
     envelope: z.ZodObject<{
         version: z.ZodLiteral<1>;
         algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
@@ -119,6 +121,8 @@ export declare const EscrowPinStatusValidator: z.ZodObject<{
 export declare const getEscrowPinStatus: (userKey: MongoUserKeyType) => z.infer<typeof EscrowPinStatusValidator>;
 declare const MongoUserKeyBaseValidator: z.ZodObject<{
     escrowBlob: z.ZodOptional<z.ZodObject<{
+        enrollmentEpoch: z.ZodNumber;
+        blobHash: z.ZodString;
         envelope: z.ZodObject<{
             version: z.ZodLiteral<1>;
             algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
@@ -235,6 +239,8 @@ declare const MongoUserKeyBaseValidator: z.ZodObject<{
 }, z.core.$strip>;
 export declare const MongoUserKeyValidator: z.ZodObject<{
     escrowBlob: z.ZodOptional<z.ZodObject<{
+        enrollmentEpoch: z.ZodNumber;
+        blobHash: z.ZodString;
         envelope: z.ZodObject<{
             version: z.ZodLiteral<1>;
             algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
@@ -409,6 +415,8 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     createdAt: Date;
     updatedAt: Date;
     escrowBlob?: {
+        enrollmentEpoch: number;
+        blobHash: string;
         envelope: {
             version: 1;
             algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
@@ -462,12 +470,14 @@ export declare const upsertUserKey: (contactMethod: ContactMethod, data: Partial
 export declare const upsertUserKeyByAuthProvider: (contactMethod: ContactMethod, authProvider: AuthProviderMapping, data: Partial<Omit<MongoUserKeyType, "_id" | "contactMethod" | "createdAt" | "authProviders">>, expectedVersion?: number) => Promise<MongoUserKeyType>;
 export declare const addAuthProviderToUserKey: (contactMethod: ContactMethod, authProvider: AuthProviderMapping) => Promise<void>;
 export declare const addRecoveryMethodToUserKey: (contactMethod: ContactMethod, recoveryMethod: RecoveryMethod) => Promise<void>;
-export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, blob: EscrowBlob, expectedShareVersion: number, pin?: {
+export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, blob: Omit<EscrowBlob, "enrollmentEpoch" | "blobHash">, expectedShareVersion: number, pin?: {
     salt: string;
 }, carryFrom?: {
     blob: EscrowBlob;
     pin: NonNullable<MongoUserKeyType["escrowPin"]>;
 }) => Promise<MongoUserKeyType | null>;
+export declare const rewrapEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, oldBlob: EscrowBlob, oldPin: MongoUserKeyType["escrowPin"], newEnvelope: EscrowBlob["envelope"], identity: Pick<EscrowBlob, "enclaveKeyId" | "enclaveMode" | "measurements">) => Promise<MongoUserKeyType | null>;
+export declare const findUserKeysWithEscrowBlobKeyId: (keyIds: string[], limit: number) => Promise<MongoUserKeyType[]>;
 export declare const clearEscrowByAuthProvider: (authProvider: AuthProviderMapping, { optOut }: {
     optOut: boolean;
 }) => Promise<MongoUserKeyType | null>;

package/dist/models/index.d.ts

@@ -6,3 +6,4 @@ export * from './Pins';
 export * from './Preferences';
 export * from './UserKey';
 export * from './EscrowHold';
+export * from './AuthSubject';

package/dist/oidc.d.ts

@@ -0,0 +1,5 @@
+import { type FastifyPluginAsync } from 'fastify';
+export declare const oidcFastifyPlugin: FastifyPluginAsync;
+export declare const app: import("fastify").FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault> & PromiseLike<import("fastify").FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, import("fastify").FastifyBaseLogger, import("fastify").FastifyTypeProviderDefault>> & {
+    __linterBrands: "SafePromiseLike";
+};