@learncard/lca-api-service 1.5.0 → 1.5.2

package/.env.example

@@ -111,8 +111,8 @@ ESCROW_HOLD_RESTART_MIN_AGE_MS=
 
 # ESCROW_ENCLAVE_MODE=remote: HTTP client to the enclave-host parent (P3.3).
 # URL must be https:// unless NODE_ENV=test or the host is localhost. Token
-# is a bearer credential, minimum 32 characters. Timeout defaults to 10000ms
-# (max 30000ms). Missing/invalid config fails escrow closed at request time
+# is a bearer credential, minimum 32 characters. Timeout defaults to 15000ms
+# (max 30000ms). Keep it above the host's 12s, which is above the enclave's 10s. Missing/invalid config fails escrow closed at request time
 # rather than crashing the whole service at boot.
 ESCROW_ENCLAVE_REMOTE_URL=
 ESCROW_ENCLAVE_REMOTE_TOKEN=

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @welibraryos/lca-api-service
 
+## 1.5.2
+
+### Patch Changes
+
+- Updated dependencies [[`9018e3173393f2ec9645286edd99bb80aa3b2c6c`](https://github.com/learningeconomy/LearnCard/commit/9018e3173393f2ec9645286edd99bb80aa3b2c6c)]:
+    - @learncard/types@5.23.1
+    - @learncard/core@9.4.39
+    - @learncard/helpers@1.6.3
+    - @learncard/init@2.5.4
+    - @learncard/did-web-plugin@1.1.39
+    - @learncard/didkit-plugin@1.10.4
+    - @learncard/didkit-plugin-node@0.3.4
+    - @learncard/sss-key-manager@0.2.2
+
+## 1.5.1
+
+### Patch Changes
+
+- [#1711](https://github.com/learningeconomy/LearnCard/pull/1711) [`63ded61d2b1b81ce1c8ad7b9415510da5e4c24ae`](https://github.com/learningeconomy/LearnCard/commit/63ded61d2b1b81ce1c8ad7b9415510da5e4c24ae) Thanks [@goblincore](https://github.com/goblincore)! - Exclude bundled service configuration from published service dependencies so public packages do not require the private service-config workspace package during installation. Keep runtime workspace dependencies for source-based service deployments.
+
+- Updated dependencies []:
+    - @learncard/init@2.5.3
+
 ## 1.5.0
 
 ### Minor Changes

package/bundle.mjs

@@ -1,3 +1,5 @@
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { build } from 'esbuild';
 import plugins from './esbuildPlugins.cjs';
 
@@ -9,6 +11,7 @@ const finalBuildObj = {
     entryPoints: ['src/index.ts'],
     platform: 'node',
     bundle: true,
+    metafile: true,
     format: 'cjs',
     outdir: 'dist',
     target: 'node20',
@@ -22,6 +25,11 @@ if (process.env.NODE_ENV !== 'production') {
     finalBuildObj.minify = false;
 }
 
-build(finalBuildObj).then(() => {
+build(finalBuildObj).then(result => {
+    // Publish preparation verifies private helpers are not external runtime imports.
+    writeFileSync(
+        join(finalBuildObj.outdir, 'publish-metafile.json'),
+        JSON.stringify(result.metafile)
+    );
     console.log(`🎁 Done building main bundle! (${Date.now() - startTime}ms)`);
 });

package/config/config.dev.json

@@ -2,7 +2,7 @@
     "APPLE_OAUTH_CLIENT_IDS": "com.learncard.app,app.learncard.www",
     "DOMAIN_NAME": "staging.api.learncard.app",
     "ESCROW_ENCLAVE_ACTIVE_KEY_ID": "escrow-staging-v1",
-    "ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS": "10000",
+    "ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS": "15000",
     "ESCROW_HOLD_DURATION_MS": "600000",
     "ESCROW_HOLD_RESTART_MIN_AGE_MS": "300000",
     "GOOGLE_OAUTH_CLIENT_IDS": "776298253175-74or0s6rg2k2mmdks6d45ro0i4te1bvf.apps.googleusercontent.com,776298253175-kkf562eofl541vu0oedfdvrk40bpkbh7.apps.googleusercontent.com",

package/dist/app.d.ts

@@ -1041,6 +1041,7 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                     attemptsRemaining: number;
                     salt?: string | undefined;
                 };
+                primaryDid: string | null;
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
@@ -1126,7 +1127,7 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                     attemptsRemaining: number;
                     salt?: string | undefined;
                 };
-                sssActivationState: "provisional" | "active";
+                sssActivationState: "active" | "provisional";
                 escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
             } | null;
             meta: import("trpc-to-openapi").OpenApiMeta;
@@ -1344,6 +1345,45 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
+        getAuthorityState: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                nonce: string;
+            };
+            output: {
+                state: {
+                    tenant: string;
+                    authorityGeneration: string;
+                    did: string;
+                    enrollmentVersion: number;
+                    enrollmentEpoch: number;
+                    status: "empty" | "active" | "disabled";
+                    envelope: {
+                        version: 1;
+                        algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                        keyId: string;
+                        ephemeralPublicKey: string;
+                        salt: string;
+                        iv: string;
+                        ciphertext: string;
+                    } | null;
+                    shareVersion: number | null;
+                    hasPin: boolean;
+                    pinGeneration: number;
+                    attemptsUsed: number;
+                };
+                proof: {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    payload: string;
+                    signature: string;
+                    kind: "snapshot";
+                };
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
         enroll: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 authToken: string;
@@ -1361,10 +1401,56 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                 enclaveKeyId: string;
                 pinSalt?: string | undefined;
                 clearPin?: boolean | undefined;
+                signedIntent?: {
+                    intent: {
+                        version: 2;
+                        tenant: string;
+                        did: string;
+                        authorityGeneration: string;
+                        expectedEnrollmentVersion: number;
+                        action: "enroll" | "replace" | "disable" | "carry";
+                        sourceBlobIdentity: string | null;
+                        targetBlobIdentity: string | null;
+                        pinAction: "set" | "change" | "clear" | "keep";
+                        shareVersion: number;
+                        enrollmentEpoch: number;
+                        requestId: string;
+                        allowRewrap: boolean;
+                        recoveryEmail: string | null;
+                        recoveryLanguage: string | null;
+                    };
+                    signature: string;
+                } | undefined;
+                sourceEnvelope?: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                } | null | undefined;
             };
             output: {
                 success: true;
                 shareVersion: number;
+                envelope?: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                } | undefined;
+                receipt?: {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    signature: string;
+                    kind: "commit";
+                    payload: string;
+                } | undefined;
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
@@ -1376,6 +1462,62 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             output: {
                 success: true;
+                receipt?: {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    signature: string;
+                    kind: "commit";
+                    payload: string;
+                } | undefined;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        disable: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                authToken: string;
+                providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+                optOut: boolean;
+                signedIntent: {
+                    intent: {
+                        version: 2;
+                        tenant: string;
+                        did: string;
+                        authorityGeneration: string;
+                        expectedEnrollmentVersion: number;
+                        action: "enroll" | "replace" | "disable" | "carry";
+                        sourceBlobIdentity: string | null;
+                        targetBlobIdentity: string | null;
+                        pinAction: "set" | "change" | "clear" | "keep";
+                        shareVersion: number;
+                        enrollmentEpoch: number;
+                        requestId: string;
+                        allowRewrap: boolean;
+                        recoveryEmail: string | null;
+                        recoveryLanguage: string | null;
+                    };
+                    signature: string;
+                };
+                sourceEnvelope?: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                } | undefined;
+            };
+            output: {
+                success: true;
+                receipt?: {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    signature: string;
+                    kind: "commit";
+                    payload: string;
+                } | undefined;
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
@@ -1405,10 +1547,66 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                 releaseAfter: string;
                 status: "pending";
                 resumeToken: string | null;
+                holdRecord?: {
+                    [x: string]: unknown;
+                    hold: {
+                        [x: string]: unknown;
+                        holdId: string;
+                        did: string;
+                        shareVersion: number;
+                        blobHash: string;
+                        enrollmentEpoch: number;
+                        releasePolicy: "pin" | "hold";
+                        clientEphemeralPublicKey: string;
+                        createdLo: number;
+                        createdHi: number;
+                        policyVersion: number;
+                        signature: string;
+                    };
+                    holdDurationMs: number;
+                    ledgerSeq: number;
+                } | undefined;
+                requiresConfirmation?: boolean | undefined;
                 pinSalt?: string | undefined;
             };
             meta: import("trpc-to-openapi").OpenApiMeta;
         }>;
+        confirmRecovery: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                holdId: string;
+                resumeToken: string;
+                code: string;
+            };
+            output: {
+                success: true;
+                receipt?: {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    signature: string;
+                    kind: "commit";
+                    payload: string;
+                } | {
+                    version: 1;
+                    keyId: string;
+                    measurement: number[];
+                    payload: string;
+                    signature: string;
+                    kind: "snapshot";
+                } | undefined;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
+        resendRecoveryCode: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                holdId: string;
+                resumeToken: string;
+            };
+            output: {
+                success: true;
+            };
+            meta: import("trpc-to-openapi").OpenApiMeta;
+        }>;
         getStatus: import("@trpc/server").TRPCQueryProcedure<{
             input: {
                 holdId?: string | undefined;
@@ -1425,6 +1623,27 @@ export declare const appRouter: import("@trpc/server").TRPCBuiltRouter<{
                     releasePolicy: "pin" | "hold";
                     cancelledAt?: string | undefined;
                     completedAt?: string | undefined;
+                    requiresConfirmation?: boolean | undefined;
+                    confirmed?: boolean | undefined;
+                    holdRecord?: {
+                        [x: string]: unknown;
+                        hold: {
+                            [x: string]: unknown;
+                            holdId: string;
+                            did: string;
+                            shareVersion: number;
+                            blobHash: string;
+                            enrollmentEpoch: number;
+                            releasePolicy: "pin" | "hold";
+                            clientEphemeralPublicKey: string;
+                            createdLo: number;
+                            createdHi: number;
+                            policyVersion: number;
+                            signature: string;
+                        };
+                        holdDurationMs: number;
+                        ledgerSeq: number;
+                    } | undefined;
                 } | null;
             };
             meta: import("trpc-to-openapi").OpenApiMeta;

package/dist/index.js

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/dist/index.js
-size: 137933050 bytes
-sha256: 5d64b82c788a32e703cbe115ccb7dead043201ff159475b76d09fab29fade6ac
+size: 138248277 bytes
+sha256: 35649149351a54bc7898af2974a1ad44edaafc82a95d3e8e650a3e5e13ceb012

package/dist/models/EscrowHold.d.ts

@@ -1,10 +1,18 @@
 import { z } from 'zod';
+import { type AuthorityRecord } from '../services/escrow-enclave/authorityContract';
 import type { Collection } from 'mongodb';
 import { type AuthProviderMapping } from './UserKey';
 export declare const ESCROW_HOLDS_COLLECTION = "escrowholds";
 export declare const ESCROW_HOLD_STALE_WINDOW_MS: number;
 export declare const ESCROW_HOLD_RESTART_MIN_AGE_MS: number;
 export declare const ESCROW_HOLD_REMINDER_WINDOW_MS: number;
+export declare const ESCROW_RELEASE_TIME_MARGIN_MS = 60000;
+export declare const ESCROW_RELEASE_WARNING_GAP_MS: number;
+export declare const computeEffectiveReleaseAfter: (params: {
+    confirmedAtMs: number;
+    holdDurationMs: number;
+    releaseWarningSentAtMs?: number;
+}) => Date;
 export declare const EscrowHoldRecordValidator: z.ZodObject<{
     hold: z.ZodObject<{
         holdId: z.ZodString;
@@ -82,6 +90,22 @@ export declare const EscrowHoldValidator: z.ZodObject<{
     }>>;
     cancelledAt: z.ZodOptional<z.ZodDate>;
     enclaveCancelPendingAt: z.ZodOptional<z.ZodDate>;
+    enclaveCancelReceipt: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"commit">;
+        payload: z.ZodString;
+    }, z.core.$strict>>;
+    enclaveReleaseReceipt: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"commit">;
+        payload: z.ZodString;
+    }, z.core.$strict>>;
     enclaveCancelConfirmedAt: z.ZodOptional<z.ZodDate>;
     enclaveCancelAttempts: z.ZodOptional<z.ZodNumber>;
     enclaveEnvelope: z.ZodOptional<z.ZodObject<{
@@ -105,6 +129,8 @@ export declare const EscrowHoldValidator: z.ZodObject<{
     cancelTokenUsedAt: z.ZodOptional<z.ZodDate>;
     cancelTokenHashes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     startedNotificationPending: z.ZodOptional<z.ZodBoolean>;
+    requiresConfirmation: z.ZodOptional<z.ZodBoolean>;
+    confirmedAt: z.ZodOptional<z.ZodDate>;
     reminderClaimedUntil: z.ZodOptional<z.ZodDate>;
     startedNotificationAttemptedAt: z.ZodOptional<z.ZodDate>;
     reminderAttemptedAt: z.ZodOptional<z.ZodDate>;
@@ -134,9 +160,11 @@ export declare const hasUnconfirmedEscrowCancellation: (primaryDid: string) => P
 export declare const findEscrowHoldsPendingEnclaveCancellation: (limit: number) => Promise<EscrowHold[]>;
 export declare const countEscrowCancellationsNearRelease: (now: Date) => Promise<number>;
 export declare const recordEscrowEnclaveCancelAttempt: (id: string) => Promise<boolean>;
-export declare const confirmEscrowEnclaveCancellation: (id: string) => Promise<void>;
+export declare const confirmEscrowEnclaveCancellation: (id: string, receipt?: AuthorityRecord) => Promise<void>;
+export declare const recordEscrowReleaseReceipt: (id: string, receipt: AuthorityRecord) => Promise<void>;
 export declare const cancelEscrowHold: (id: string, cancelledBy: "did" | "system", cancelReason?: EscrowHold["cancelReason"]) => Promise<EscrowHold | null>;
 export declare const cancelEscrowHoldByCancelToken: (id: string, cancelTokenHash: string) => Promise<EscrowHold | null>;
+export declare const recordEscrowHoldConfirmation: (id: string, confirmedAt: Date, releaseAfter: Date) => Promise<EscrowHold | null>;
 export declare const completeEscrowHold: (id: string) => Promise<EscrowHold | null>;
 export declare const hasCompletedEscrowHoldForVersion: (authProvider: AuthProviderMapping, shareVersion: number) => Promise<boolean>;
 export declare const expireStaleEscrowHolds: (now: Date) => Promise<number>;
@@ -149,5 +177,5 @@ export declare const claimEscrowHoldForReminder: (id: string, now: Date) => Prom
 export declare const releaseEscrowReminderClaim: (hold: EscrowHold) => Promise<void>;
 export declare const hashEscrowResumeToken: (token: string) => string;
 export declare const generateEscrowResumeToken: () => string;
-export declare const recordEscrowHoldNotification: (holdId: string, kind: EscrowHold["notifications"][number]["kind"]) => Promise<void>;
+export declare const recordEscrowHoldNotification: (holdId: string, kind: EscrowHold["notifications"][number]["kind"], releaseAfter?: Date) => Promise<void>;
 export declare const rotateEscrowCancelToken: (holdId: string) => Promise<string | null>;

package/dist/models/UserKey.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type AuthorityMutationResult, type AuthorityRecord } from '../services/escrow-enclave/authorityContract';
 import { pruneOrphanedRecoveryMethods } from './pruneOrphanedRecoveryMethods';
 export declare const USER_KEYS_COLLECTION = "userkeys";
 export declare const ContactMethodValidator: z.ZodObject<{
@@ -72,6 +73,24 @@ export declare const EscrowEnvelopeValidator: z.ZodObject<{
     ciphertext: z.ZodString;
 }, z.core.$strict>;
 export declare const EscrowBlobValidator: z.ZodObject<{
+    authorityGeneration: z.ZodOptional<z.ZodString>;
+    enrollmentVersion: z.ZodOptional<z.ZodNumber>;
+    commitReceipt: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"commit">;
+        payload: z.ZodString;
+    }, z.core.$strict>>;
+    authorityStateProof: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        payload: z.ZodString;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"snapshot">;
+    }, z.core.$strict>>;
     enrollmentEpoch: z.ZodNumber;
     blobHash: z.ZodString;
     envelope: z.ZodObject<{
@@ -121,6 +140,24 @@ export declare const EscrowPinStatusValidator: z.ZodObject<{
 export declare const getEscrowPinStatus: (userKey: MongoUserKeyType) => z.infer<typeof EscrowPinStatusValidator>;
 declare const MongoUserKeyBaseValidator: z.ZodObject<{
     escrowBlob: z.ZodOptional<z.ZodObject<{
+        authorityGeneration: z.ZodOptional<z.ZodString>;
+        enrollmentVersion: z.ZodOptional<z.ZodNumber>;
+        commitReceipt: z.ZodOptional<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            keyId: z.ZodString;
+            measurement: z.ZodArray<z.ZodNumber>;
+            signature: z.ZodString;
+            kind: z.ZodLiteral<"commit">;
+            payload: z.ZodString;
+        }, z.core.$strict>>;
+        authorityStateProof: z.ZodOptional<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            keyId: z.ZodString;
+            measurement: z.ZodArray<z.ZodNumber>;
+            payload: z.ZodString;
+            signature: z.ZodString;
+            kind: z.ZodLiteral<"snapshot">;
+        }, z.core.$strict>>;
         enrollmentEpoch: z.ZodNumber;
         blobHash: z.ZodString;
         envelope: z.ZodObject<{
@@ -230,8 +267,8 @@ declare const MongoUserKeyBaseValidator: z.ZodObject<{
     migratedFromWeb3Auth: z.ZodDefault<z.ZodBoolean>;
     migratedAt: z.ZodOptional<z.ZodDate>;
     sssActivationState: z.ZodOptional<z.ZodEnum<{
-        provisional: "provisional";
         active: "active";
+        provisional: "provisional";
     }>>;
     provisionalCreatedAt: z.ZodOptional<z.ZodDate>;
     createdAt: z.ZodDate;
@@ -239,6 +276,24 @@ declare const MongoUserKeyBaseValidator: z.ZodObject<{
 }, z.core.$strip>;
 export declare const MongoUserKeyValidator: z.ZodObject<{
     escrowBlob: z.ZodOptional<z.ZodObject<{
+        authorityGeneration: z.ZodOptional<z.ZodString>;
+        enrollmentVersion: z.ZodOptional<z.ZodNumber>;
+        commitReceipt: z.ZodOptional<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            keyId: z.ZodString;
+            measurement: z.ZodArray<z.ZodNumber>;
+            signature: z.ZodString;
+            kind: z.ZodLiteral<"commit">;
+            payload: z.ZodString;
+        }, z.core.$strict>>;
+        authorityStateProof: z.ZodOptional<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            keyId: z.ZodString;
+            measurement: z.ZodArray<z.ZodNumber>;
+            payload: z.ZodString;
+            signature: z.ZodString;
+            kind: z.ZodLiteral<"snapshot">;
+        }, z.core.$strict>>;
         enrollmentEpoch: z.ZodNumber;
         blobHash: z.ZodString;
         envelope: z.ZodObject<{
@@ -348,8 +403,8 @@ export declare const MongoUserKeyValidator: z.ZodObject<{
     migratedFromWeb3Auth: z.ZodDefault<z.ZodBoolean>;
     migratedAt: z.ZodOptional<z.ZodDate>;
     sssActivationState: z.ZodOptional<z.ZodEnum<{
-        provisional: "provisional";
         active: "active";
+        provisional: "provisional";
     }>>;
     provisionalCreatedAt: z.ZodOptional<z.ZodDate>;
     createdAt: z.ZodDate;
@@ -436,6 +491,24 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
         };
         shareVersion: number;
         createdAt: Date;
+        authorityGeneration?: string | undefined;
+        enrollmentVersion?: number | undefined;
+        commitReceipt?: {
+            version: 1;
+            keyId: string;
+            measurement: number[];
+            signature: string;
+            kind: "commit";
+            payload: string;
+        } | undefined;
+        authorityStateProof?: {
+            version: 1;
+            keyId: string;
+            measurement: number[];
+            payload: string;
+            signature: string;
+            kind: "snapshot";
+        } | undefined;
     } | undefined;
     escrowPin?: {
         salt: string;
@@ -456,7 +529,7 @@ export declare const getUserKeysCollection: () => import("mongodb").Collection<{
     recoveryEmail?: string | undefined;
     recoveryEmailVerifiedAt?: Date | undefined;
     migratedAt?: Date | undefined;
-    sssActivationState?: "provisional" | "active" | undefined;
+    sssActivationState?: "active" | "provisional" | undefined;
     provisionalCreatedAt?: Date | undefined;
 }>;
 export declare const createUserKeysIndexes: () => Promise<void>;
@@ -475,11 +548,22 @@ export declare const setEscrowBlobByAuthProvider: (authProvider: AuthProviderMap
 }, carryFrom?: {
     blob: EscrowBlob;
     pin: NonNullable<MongoUserKeyType["escrowPin"]>;
+}, authority?: {
+    enrollmentEpoch: number;
+    expectedBlob?: EscrowBlob;
+    expectedPin?: MongoUserKeyType["escrowPin"];
+}) => Promise<MongoUserKeyType | null>;
+export declare const rewrapEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, oldBlob: EscrowBlob, oldPin: MongoUserKeyType["escrowPin"], newEnvelope: EscrowBlob["envelope"], identity: Pick<EscrowBlob, "enclaveKeyId" | "enclaveMode" | "measurements">, authority?: Pick<AuthorityMutationResult, "authorityGeneration" | "enrollmentVersion"> & {
+    receipt?: AuthorityRecord;
+    stateProof?: AuthorityRecord;
 }) => Promise<MongoUserKeyType | null>;
-export declare const rewrapEscrowBlobByAuthProvider: (authProvider: AuthProviderMapping, oldBlob: EscrowBlob, oldPin: MongoUserKeyType["escrowPin"], newEnvelope: EscrowBlob["envelope"], identity: Pick<EscrowBlob, "enclaveKeyId" | "enclaveMode" | "measurements">) => Promise<MongoUserKeyType | null>;
 export declare const findUserKeysWithEscrowBlobKeyId: (keyIds: string[], limit: number) => Promise<MongoUserKeyType[]>;
-export declare const clearEscrowByAuthProvider: (authProvider: AuthProviderMapping, { optOut }: {
+export declare const clearEscrowByAuthProvider: (authProvider: AuthProviderMapping, { optOut, expected, }: {
     optOut: boolean;
+    expected?: {
+        blob?: EscrowBlob;
+        pin?: MongoUserKeyType["escrowPin"];
+    };
 }) => Promise<MongoUserKeyType | null>;
 export declare const setEscrowOptInByAuthProvider: (authProvider: AuthProviderMapping) => Promise<MongoUserKeyType | null>;
 export declare const reserveEscrowPinAttempt: (authProvider: AuthProviderMapping, shareVersion: number, expectedCiphertext?: string) => Promise<MongoUserKeyType | null>;