@learncard/lca-api-service 1.5.0 → 1.5.2

package/dist/routes/escrow.d.ts

@@ -28,6 +28,45 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    getAuthorityState: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            nonce: string;
+        };
+        output: {
+            state: {
+                tenant: string;
+                authorityGeneration: string;
+                did: string;
+                enrollmentVersion: number;
+                enrollmentEpoch: number;
+                status: "empty" | "active" | "disabled";
+                envelope: {
+                    version: 1;
+                    algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                    keyId: string;
+                    ephemeralPublicKey: string;
+                    salt: string;
+                    iv: string;
+                    ciphertext: string;
+                } | null;
+                shareVersion: number | null;
+                hasPin: boolean;
+                pinGeneration: number;
+                attemptsUsed: number;
+            };
+            proof: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                payload: string;
+                signature: string;
+                kind: "snapshot";
+            };
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     enroll: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             authToken: string;
@@ -45,10 +84,56 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
             enclaveKeyId: string;
             pinSalt?: string | undefined;
             clearPin?: boolean | undefined;
+            signedIntent?: {
+                intent: {
+                    version: 2;
+                    tenant: string;
+                    did: string;
+                    authorityGeneration: string;
+                    expectedEnrollmentVersion: number;
+                    action: "enroll" | "replace" | "disable" | "carry";
+                    sourceBlobIdentity: string | null;
+                    targetBlobIdentity: string | null;
+                    pinAction: "set" | "change" | "clear" | "keep";
+                    shareVersion: number;
+                    enrollmentEpoch: number;
+                    requestId: string;
+                    allowRewrap: boolean;
+                    recoveryEmail: string | null;
+                    recoveryLanguage: string | null;
+                };
+                signature: string;
+            } | undefined;
+            sourceEnvelope?: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            } | null | undefined;
         };
         output: {
             success: true;
             shareVersion: number;
+            envelope?: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            } | undefined;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | undefined;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -60,6 +145,62 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         output: {
             success: true;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    disable: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            authToken: string;
+            providerType: "firebase" | "supertokens" | "keycloak" | "oidc";
+            optOut: boolean;
+            signedIntent: {
+                intent: {
+                    version: 2;
+                    tenant: string;
+                    did: string;
+                    authorityGeneration: string;
+                    expectedEnrollmentVersion: number;
+                    action: "enroll" | "replace" | "disable" | "carry";
+                    sourceBlobIdentity: string | null;
+                    targetBlobIdentity: string | null;
+                    pinAction: "set" | "change" | "clear" | "keep";
+                    shareVersion: number;
+                    enrollmentEpoch: number;
+                    requestId: string;
+                    allowRewrap: boolean;
+                    recoveryEmail: string | null;
+                    recoveryLanguage: string | null;
+                };
+                signature: string;
+            };
+            sourceEnvelope?: {
+                version: 1;
+                algorithm: "P-256-HKDF-SHA256-AES-256-GCM";
+                keyId: string;
+                ephemeralPublicKey: string;
+                salt: string;
+                iv: string;
+                ciphertext: string;
+            } | undefined;
+        };
+        output: {
+            success: true;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | undefined;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -89,10 +230,66 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
             releaseAfter: string;
             status: "pending";
             resumeToken: string | null;
+            holdRecord?: {
+                [x: string]: unknown;
+                hold: {
+                    [x: string]: unknown;
+                    holdId: string;
+                    did: string;
+                    shareVersion: number;
+                    blobHash: string;
+                    enrollmentEpoch: number;
+                    releasePolicy: "pin" | "hold";
+                    clientEphemeralPublicKey: string;
+                    createdLo: number;
+                    createdHi: number;
+                    policyVersion: number;
+                    signature: string;
+                };
+                holdDurationMs: number;
+                ledgerSeq: number;
+            } | undefined;
+            requiresConfirmation?: boolean | undefined;
             pinSalt?: string | undefined;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
+    confirmRecovery: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            resumeToken: string;
+            code: string;
+        };
+        output: {
+            success: true;
+            receipt?: {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                signature: string;
+                kind: "commit";
+                payload: string;
+            } | {
+                version: 1;
+                keyId: string;
+                measurement: number[];
+                payload: string;
+                signature: string;
+                kind: "snapshot";
+            } | undefined;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
+    resendRecoveryCode: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            holdId: string;
+            resumeToken: string;
+        };
+        output: {
+            success: true;
+        };
+        meta: import("trpc-to-openapi").OpenApiMeta;
+    }>;
     getStatus: import("@trpc/server").TRPCQueryProcedure<{
         input: {
             holdId?: string | undefined;
@@ -109,6 +306,27 @@ export declare const escrowRouter: import("@trpc/server").TRPCBuiltRouter<{
                 releasePolicy: "pin" | "hold";
                 cancelledAt?: string | undefined;
                 completedAt?: string | undefined;
+                requiresConfirmation?: boolean | undefined;
+                confirmed?: boolean | undefined;
+                holdRecord?: {
+                    [x: string]: unknown;
+                    hold: {
+                        [x: string]: unknown;
+                        holdId: string;
+                        did: string;
+                        shareVersion: number;
+                        blobHash: string;
+                        enrollmentEpoch: number;
+                        releasePolicy: "pin" | "hold";
+                        clientEphemeralPublicKey: string;
+                        createdLo: number;
+                        createdHi: number;
+                        policyVersion: number;
+                        signature: string;
+                    };
+                    holdDurationMs: number;
+                    ledgerSeq: number;
+                } | undefined;
             } | null;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;

package/dist/routes/index.d.ts

@@ -35,6 +35,7 @@ export declare const t: import("@trpc/server").TRPCRootObject<Context, OpenApiMe
 export declare const createContext: (options: CreateAWSLambdaContextOptions<APIGatewayProxyEventV2> | CreateFastifyContextOptions | NodeHTTPCreateContextFnOptions<IncomingMessage, ServerResponse>) => Promise<Context>;
 export declare const redactSecretFields: (value: unknown, depth?: number, seen?: Set<object>) => unknown;
 export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -42,11 +43,11 @@ export declare const openRoute: import("@trpc/server").TRPCProcedureBuilder<Cont
         authorizedDid?: boolean;
     } | undefined;
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -54,11 +55,11 @@ export declare const didRoute: import("@trpc/server").TRPCProcedureBuilder<Conte
         authorizedDid?: boolean;
     };
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -66,11 +67,11 @@ export declare const authorizedDidRoute: import("@trpc/server").TRPCProcedureBui
         authorizedDid?: boolean;
     };
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
 export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureBuilder<Context, OpenApiMeta, {
+    tenant: ResolvedTenant;
     debug: boolean | undefined;
     user: {
         did: string;
@@ -78,7 +79,6 @@ export declare const didAndChallengeRoute: import("@trpc/server").TRPCProcedureB
         authorizedDid?: boolean;
     };
     domain: string;
-    tenant: ResolvedTenant;
     clientIp: string | undefined;
     providerToken: string | undefined;
 }, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;

package/dist/routes/keys.d.ts

@@ -67,6 +67,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
                 attemptsRemaining: number;
                 salt?: string | undefined;
             };
+            primaryDid: string | null;
         };
         meta: import("trpc-to-openapi").OpenApiMeta;
     }>;
@@ -152,7 +153,7 @@ export declare const keysRouter: import("@trpc/server").TRPCBuiltRouter<{
                 attemptsRemaining: number;
                 salt?: string | undefined;
             };
-            sssActivationState: "provisional" | "active";
+            sssActivationState: "active" | "provisional";
             escrowStale?: "mode-mismatch" | "key-rotated" | undefined;
         } | null;
         meta: import("trpc-to-openapi").OpenApiMeta;

package/dist/services/escrow-enclave/authorityContract.d.ts

@@ -0,0 +1,170 @@
+import { z } from 'zod';
+export declare const safeInteger: z.ZodNumber;
+export declare const AuthorityEnvelopeValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+    keyId: z.ZodString;
+    ephemeralPublicKey: z.ZodString;
+    salt: z.ZodString;
+    iv: z.ZodString;
+    ciphertext: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityRecordValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodEnum<{
+        proposal: "proposal";
+        commit: "commit";
+        snapshot: "snapshot";
+    }>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    payload: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityCommitValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"commit">;
+    payload: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityHoldSnapshotValidator: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    payload: z.ZodString;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>;
+export declare const AuthorityHoldReceiptValidator: z.ZodUnion<readonly [z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"commit">;
+    payload: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    keyId: z.ZodString;
+    measurement: z.ZodArray<z.ZodNumber>;
+    payload: z.ZodString;
+    signature: z.ZodString;
+    kind: z.ZodLiteral<"snapshot">;
+}, z.core.$strict>]>;
+export declare const SignedEnrollmentIntentValidator: z.ZodObject<{
+    intent: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        tenant: z.ZodString;
+        did: z.ZodString;
+        authorityGeneration: z.ZodString;
+        expectedEnrollmentVersion: z.ZodNumber;
+        action: z.ZodEnum<{
+            enroll: "enroll";
+            replace: "replace";
+            disable: "disable";
+            carry: "carry";
+        }>;
+        sourceBlobIdentity: z.ZodNullable<z.ZodString>;
+        targetBlobIdentity: z.ZodNullable<z.ZodString>;
+        pinAction: z.ZodEnum<{
+            set: "set";
+            change: "change";
+            clear: "clear";
+            keep: "keep";
+        }>;
+        shareVersion: z.ZodNumber;
+        enrollmentEpoch: z.ZodNumber;
+        requestId: z.ZodString;
+        allowRewrap: z.ZodBoolean;
+        recoveryEmail: z.ZodNullable<z.ZodString>;
+        recoveryLanguage: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+export declare const AuthorityStateValidator: z.ZodObject<{
+    tenant: z.ZodString;
+    authorityGeneration: z.ZodString;
+    did: z.ZodString;
+    enrollmentVersion: z.ZodNumber;
+    enrollmentEpoch: z.ZodNumber;
+    status: z.ZodEnum<{
+        empty: "empty";
+        active: "active";
+        disabled: "disabled";
+    }>;
+    envelope: z.ZodNullable<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
+    shareVersion: z.ZodNullable<z.ZodNumber>;
+    hasPin: z.ZodBoolean;
+    pinGeneration: z.ZodNumber;
+    attemptsUsed: z.ZodNumber;
+}, z.core.$strict>;
+export declare const AuthorityStateResponseValidator: z.ZodObject<{
+    state: z.ZodObject<{
+        tenant: z.ZodString;
+        authorityGeneration: z.ZodString;
+        did: z.ZodString;
+        enrollmentVersion: z.ZodNumber;
+        enrollmentEpoch: z.ZodNumber;
+        status: z.ZodEnum<{
+            empty: "empty";
+            active: "active";
+            disabled: "disabled";
+        }>;
+        envelope: z.ZodNullable<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+            keyId: z.ZodString;
+            ephemeralPublicKey: z.ZodString;
+            salt: z.ZodString;
+            iv: z.ZodString;
+            ciphertext: z.ZodString;
+        }, z.core.$strict>>;
+        shareVersion: z.ZodNullable<z.ZodNumber>;
+        hasPin: z.ZodBoolean;
+        pinGeneration: z.ZodNumber;
+        attemptsUsed: z.ZodNumber;
+    }, z.core.$strict>;
+    proof: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        payload: z.ZodString;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"snapshot">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const AuthorityMutationValidator: z.ZodObject<{
+    envelope: z.ZodNullable<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        algorithm: z.ZodLiteral<"P-256-HKDF-SHA256-AES-256-GCM">;
+        keyId: z.ZodString;
+        ephemeralPublicKey: z.ZodString;
+        salt: z.ZodString;
+        iv: z.ZodString;
+        ciphertext: z.ZodString;
+    }, z.core.$strict>>;
+    receipt: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        keyId: z.ZodString;
+        measurement: z.ZodArray<z.ZodNumber>;
+        signature: z.ZodString;
+        kind: z.ZodLiteral<"commit">;
+        payload: z.ZodString;
+    }, z.core.$strict>;
+    authorityGeneration: z.ZodString;
+    enrollmentVersion: z.ZodNumber;
+    enrollmentEpoch: z.ZodNumber;
+}, z.core.$strict>;
+export type AuthorityRecord = z.infer<typeof AuthorityRecordValidator>;
+export type AuthorityHoldReceipt = z.infer<typeof AuthorityHoldReceiptValidator>;
+export type AuthorityMutationResult = z.infer<typeof AuthorityMutationValidator>;
+export type AuthorityStateResponse = z.infer<typeof AuthorityStateResponseValidator>;

package/dist/services/escrow-enclave/types.d.ts

@@ -1,4 +1,10 @@
-import type { EscrowEnvelope } from '@learncard/sss-key-manager';
+import type { EscrowEnvelope, SignedEscrowEnrollmentIntent } from '@learncard/sss-key-manager';
+import type { AuthorityRecord, AuthorityHoldReceipt, AuthorityMutationResult, AuthorityStateResponse } from './authorityContract';
+export interface ApplyEnrollmentInput {
+    signedIntent: SignedEscrowEnrollmentIntent;
+    sourceEnvelope: EscrowEnvelope | null;
+    targetEnvelope: EscrowEnvelope | null;
+}
 export interface EnclaveAttestation {
     mode: 'software' | 'nitro';
     keyId: string;
@@ -42,11 +48,21 @@ export interface EnclaveCreateHoldInput {
     clientEphemeralPublicKey: string;
 }
 export interface CancelHoldRequest {
+    requestId?: string;
     envelope: EscrowEnvelope;
     hold: EscrowHoldRecord;
     clientEphemeralPublicKey: string;
     expectedDid: string;
 }
+export interface ConfirmHoldRequest extends CancelHoldRequest {
+    code: string;
+}
+export type ResendCodeRequest = CancelHoldRequest;
+export interface SendReleaseWarningRequest {
+    requestId?: string;
+    holdId: string;
+    expectedDid: string;
+}
 export interface VerifyEscrowBlobInput {
     envelope: EscrowEnvelope;
     expectedDid: string;
@@ -66,6 +82,7 @@ export interface ReleaseRequest extends CancelHoldRequest {
 }
 export interface ReleaseResult {
     sealed: EscrowEnvelope;
+    receipt?: AuthorityRecord;
 }
 export interface CarryPinVerifierInput {
     sourceEnvelope: EscrowEnvelope;
@@ -83,6 +100,11 @@ export interface RewrapEscrowBlobInput {
     sourceEnrollmentEpoch: number;
 }
 export interface EscrowEnclave {
+    getEnrollmentState?(input: {
+        expectedDid: string;
+        nonce: string;
+    }): Promise<AuthorityStateResponse>;
+    applyEnrollmentIntent?(input: ApplyEnrollmentInput): Promise<AuthorityMutationResult>;
     getAttestation(nonce?: Uint8Array): Promise<EnclaveAttestation>;
     verifyEscrowBlob(input: VerifyEscrowBlobInput): Promise<VerifyEscrowBlobResult>;
     carryPinVerifier(input: CarryPinVerifierInput): Promise<{
@@ -90,12 +112,26 @@ export interface EscrowEnclave {
     }>;
     rewrapEscrowBlob(input: RewrapEscrowBlobInput): Promise<{
         envelope: EscrowEnvelope;
+        authority?: AuthorityMutationResult;
     }>;
     releaseEscrow(input: ReleaseRequest): Promise<ReleaseResult>;
     createHold(input: EnclaveCreateHoldInput): Promise<{
         holdRecord: EscrowHoldRecord;
     }>;
-    cancelHold(input: CancelHoldRequest): Promise<void>;
+    cancelHold(input: CancelHoldRequest): Promise<void | {
+        receipt: AuthorityRecord;
+    }>;
+    confirmHold?(input: ConfirmHoldRequest): Promise<{
+        receipt: AuthorityHoldReceipt;
+        confirmedAtMs: number;
+    }>;
+    resendCode?(input: ResendCodeRequest): Promise<{
+        receipt: AuthorityRecord;
+    }>;
+    sendReleaseWarning?(input: SendReleaseWarningRequest): Promise<{
+        receipt: AuthorityHoldReceipt;
+        releaseWarningSentAtMs: number;
+    }>;
 }
 export declare class EscrowPolicyError extends Error {
     constructor();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/lca-api-service",
-    "version": "1.5.0",
+    "version": "1.5.2",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -63,16 +63,15 @@
         "@fastify/formbody": "^8.0.2",
         "@fastify/rate-limit": "^10.2.0",
         "@fastify/static": "^10.1.1",
-        "@learncard/core": "9.4.38",
-        "@learncard/did-web-plugin": "1.1.38",
-        "@learncard/didkit-plugin": "1.10.3",
-        "@learncard/didkit-plugin-node": "0.3.3",
+        "@learncard/core": "9.4.39",
+        "@learncard/did-web-plugin": "1.1.39",
+        "@learncard/didkit-plugin": "1.10.4",
+        "@learncard/didkit-plugin-node": "0.3.4",
         "@learncard/email-templates": "1.2.1",
-        "@learncard/helpers": "1.6.2",
-        "@learncard/init": "2.5.2",
-        "@learncard/service-config": "0.1.1",
-        "@learncard/types": "5.23.0",
-        "@learncard/sss-key-manager": "0.2.1",
+        "@learncard/helpers": "1.6.3",
+        "@learncard/init": "2.5.4",
+        "@learncard/types": "5.23.1",
+        "@learncard/sss-key-manager": "0.2.2",
         "@sentry/serverless": "^7.61.0",
         "@trpc/server": "11.8.0",
         "@types/jsonwebtoken": "^9.0.8",

package/project.json

@@ -14,7 +14,14 @@
     "targets": {
         "build": {
             "executor": "nx:run-script",
-            "inputs": ["source"],
+            "inputs": [
+                "source",
+                "{projectRoot}/bundle.mjs",
+                "{projectRoot}/esbuildPlugins.cjs",
+                "{projectRoot}/package.json",
+                "{projectRoot}/tsconfig*.json",
+                "{workspaceRoot}/packages/service-config/src/**/*"
+            ],
             "options": {
                 "script": "build"
             }

package/serverless.yml

@@ -24,6 +24,8 @@ custom:
         packager: pnpm
         plugins: esbuildPlugins.cjs
         bundle: true
+        # Deployment builds run once; avoid leaking rebuild contexts when plugins fail.
+        skipRebuild: true
         minify: true
         # @learncard/init's default (node.import) entry uses createRequire('./index.cjs'),
         # which esbuild cannot bundle — the emitted Lambda bundle is left with a runtime

package/src/config/environment.ts

@@ -64,7 +64,7 @@ export const lcaApiEnvironmentShape = {
      *  silently DoS recovery. See services/escrow-ledger-monitor/README.md. */
     ESCROW_RELEASE_KILL_SWITCH: optionalEnvironmentBoolean,
     ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS: optionalEnvironmentString
-        .transform(value => (value === undefined ? 10_000 : Number(value)))
+        .transform(value => (value === undefined ? 15_000 : Number(value)))
         .pipe(z.number().int().positive().max(30_000)),
     ESCROW_HOLD_DURATION_MS: optionalEnvironmentString
         .transform(value => (value === undefined ? 604_800_000 : Number(value)))

package/src/config/escrowDeployment.test.ts

@@ -101,6 +101,14 @@ describe('escrow deployment wiring', () => {
         );
     });
 
+    it('keeps every checked-in enclave timeout above the host forwarding deadline', () => {
+        // enclave 10s < host 12s < lca-api; an equal or shorter value races the response.
+        for (const [stage, config] of Object.entries(stages)) {
+            const value = (config as Record<string, string>).ESCROW_ENCLAVE_REMOTE_TIMEOUT_MS;
+            if (value !== undefined) expect(Number(value), stage).toBeGreaterThan(12_000);
+        }
+    });
+
     it('never checks in escrow credentials', () => {
         for (const [stage, config] of Object.entries(stages)) {
             for (const name of [...SOURCES.bundle, ...SOURCES.toggle]) {