@learncard/sss-key-manager 0.2.2 → 0.2.3

package/dist/sss-key-manager.esm.js

@@ -199,6 +199,7 @@ var require_types_cjs_development = __commonJS({
       FlatAuthGrantValidator: /* @__PURE__ */ __name(() => FlatAuthGrantValidator, "FlatAuthGrantValidator"),
       FrameworkWithSkillsValidator: /* @__PURE__ */ __name(() => FrameworkWithSkillsValidator, "FrameworkWithSkillsValidator"),
       FullClaimHookValidator: /* @__PURE__ */ __name(() => FullClaimHookValidator, "FullClaimHookValidator"),
+      GenerateSkillIconsInputValidator: /* @__PURE__ */ __name(() => GenerateSkillIconsInputValidator, "GenerateSkillIconsInputValidator"),
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
       GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
@@ -359,6 +360,8 @@ var require_types_cjs_development = __commonJS({
       SHARE_RECOVERY_PROTOCOL: /* @__PURE__ */ __name(() => SHARE_RECOVERY_PROTOCOL, "SHARE_RECOVERY_PROTOCOL"),
       SHARE_TAG_BYTES: /* @__PURE__ */ __name(() => SHARE_TAG_BYTES, "SHARE_TAG_BYTES"),
       SHARE_VIEW_RECEIPT_TTL_SECONDS: /* @__PURE__ */ __name(() => SHARE_VIEW_RECEIPT_TTL_SECONDS, "SHARE_VIEW_RECEIPT_TTL_SECONDS"),
+      SKILL_ICON_MAX_CHARACTERS_PER_REQUEST: /* @__PURE__ */ __name(() => SKILL_ICON_MAX_CHARACTERS_PER_REQUEST, "SKILL_ICON_MAX_CHARACTERS_PER_REQUEST"),
+      SKILL_ICON_MAX_NAMES_PER_REQUEST: /* @__PURE__ */ __name(() => SKILL_ICON_MAX_NAMES_PER_REQUEST, "SKILL_ICON_MAX_NAMES_PER_REQUEST"),
       SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name(() => SendAiSessionCredentialEventValidator, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name(() => SendBoostInputValidator, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
@@ -411,6 +414,7 @@ var require_types_cjs_development = __commonJS({
       SkillFrameworkQueryValidator: /* @__PURE__ */ __name(() => SkillFrameworkQueryValidator, "SkillFrameworkQueryValidator"),
       SkillFrameworkStatusEnum: /* @__PURE__ */ __name(() => SkillFrameworkStatusEnum, "SkillFrameworkStatusEnum"),
       SkillFrameworkValidator: /* @__PURE__ */ __name(() => SkillFrameworkValidator, "SkillFrameworkValidator"),
+      SkillIconNamesValidator: /* @__PURE__ */ __name(() => SkillIconNamesValidator, "SkillIconNamesValidator"),
       SkillQueryValidator: /* @__PURE__ */ __name(() => SkillQueryValidator, "SkillQueryValidator"),
       SkillSemanticSearchInputValidator: /* @__PURE__ */ __name(() => SkillSemanticSearchInputValidator, "SkillSemanticSearchInputValidator"),
       SkillSemanticSearchResultItemValidator: /* @__PURE__ */ __name(() => SkillSemanticSearchResultItemValidator, "SkillSemanticSearchResultItemValidator"),
@@ -16148,6 +16152,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       term: external_exports.string().optional()
     }).catchall(external_exports.any());
     var UnsignedAchievementCredentialValidator = UnsignedVCValidator.extend({
+      awardedDate: external_exports.string().optional(),
       name: external_exports.string().optional(),
       description: external_exports.string().optional(),
       image: ImageValidator.optional(),
@@ -19004,6 +19009,17 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentUrl: external_exports.string(),
       receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
     }).strict();
+    var SKILL_ICON_MAX_NAMES_PER_REQUEST = 100;
+    var SKILL_ICON_MAX_CHARACTERS_PER_REQUEST = 2500;
+    var SkillIconNamesValidator = external_exports.array(external_exports.string().nonempty()).min(1).max(SKILL_ICON_MAX_NAMES_PER_REQUEST, {
+      message: `A maximum of ${SKILL_ICON_MAX_NAMES_PER_REQUEST} skill names can be sent per request`
+    }).refine(
+      (names) => names.reduce((total, name) => total + name.length, 0) <= SKILL_ICON_MAX_CHARACTERS_PER_REQUEST,
+      {
+        message: `Skill names may total at most ${SKILL_ICON_MAX_CHARACTERS_PER_REQUEST} characters per request`
+      }
+    );
+    var GenerateSkillIconsInputValidator = external_exports.object({ names: SkillIconNamesValidator });
   }
 });
 
@@ -21034,6 +21050,37 @@ var EscrowEvidenceError = class extends Error {
 var fail2 = /* @__PURE__ */ __name(() => {
   throw new EscrowEvidenceError();
 }, "fail");
+var verifyEscrowHoldState = /* @__PURE__ */ __name(async (response, nonce, expected, identity) => {
+  requireEvidence(/^[0-9a-f]{64}$/.test(nonce));
+  const { payload } = await verifyRecord(response.proof, "snapshot", identity);
+  requireEvidence(Array.isArray(payload) && payload.length === 12);
+  const p = payload;
+  requireEvidence(
+    p[0] === "learncard-authority-hold-state-v3" && p[1] === nonce && p[2] === expected.tenant && p[3] === expected.authorityGeneration && p[4] === expected.did && p[5] === expected.holdId && p[6] === expected.holdDigest
+  );
+  const status = p[7];
+  if (status !== "awaitingConfirmation" && status !== "pending" && status !== "released" && status !== "cancelled")
+    return fail2();
+  const confirmedHiMs = p[8] === null ? null : integer2(p[8]);
+  const releaseWarningSentHiMs = p[9] === null ? null : integer2(p[9]);
+  const attemptsRemaining = integer2(p[10], 0, 5);
+  const codeSendStatus = p[11];
+  if (codeSendStatus !== "unknown" && codeSendStatus !== "notRequired") return fail2();
+  requireEvidence(
+    status !== "awaitingConfirmation" || confirmedHiMs === null && releaseWarningSentHiMs === null
+  );
+  requireEvidence(status !== "pending" && status !== "released" || confirmedHiMs !== null);
+  return { status, confirmedHiMs, releaseWarningSentHiMs, attemptsRemaining, codeSendStatus };
+}, "verifyEscrowHoldState");
+var verifyEscrowCodeDelivery = /* @__PURE__ */ __name(async (delivery, expected, identity) => {
+  const { payload } = await verifyRecord(delivery.proof, "snapshot", identity);
+  requireEvidence(Array.isArray(payload) && payload.length === 5);
+  const values = payload;
+  requireEvidence(
+    values[0] === "learncard-authority-code-delivery-v1" && values[1] === expected.tenant && values[2] === expected.authorityGeneration && values[3] === expected.holdDigest && typeof values[4] === "boolean" && values[4] === delivery.codeSent
+  );
+  return delivery.codeSent;
+}, "verifyEscrowCodeDelivery");
 var requireEvidence = /* @__PURE__ */ __name((condition) => {
   if (!condition) fail2();
 }, "requireEvidence");
@@ -21702,9 +21749,10 @@ var SERVER_REQUEST_TIMEOUT_MS = 3e4;
 var requestTimeoutSignal = /* @__PURE__ */ __name((ms = SERVER_REQUEST_TIMEOUT_MS) => typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(ms) : void 0, "requestTimeoutSignal");
 var describeHttpStatus = /* @__PURE__ */ __name((response) => response.statusText ? `${response.status} ${response.statusText}` : `${response.status}`, "describeHttpStatus");
 var EscrowRequestError = class extends Error {
-  constructor(status) {
+  constructor(status, reason) {
     super("Escrow request failed");
     this.status = status;
+    this.reason = reason;
     this.name = "EscrowRequestError";
   }
   static {
@@ -22190,6 +22238,14 @@ function createSSSStrategy(config) {
       ...init
     });
     if (!response.ok) {
+      if (path === "/confirm" && response.status === 403) {
+        const body = await response.json().catch(() => void 0);
+        const reason = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : void 0;
+        throw new EscrowRequestError(
+          response.status,
+          reason === "codeMismatch" || reason === "codeExpired" || reason === "codeLocked" ? reason : void 0
+        );
+      }
       if (!pinAttempt && path === "/recover" && response.status === 429) {
         const body = await response.json().catch(() => void 0);
         const message = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : "";
@@ -23093,6 +23149,7 @@ function createSSSStrategy(config) {
           ledgerPublicKey: identity.authority.ledgerPublicKey,
           keyId: verified.receipt.keyId
         };
+        result.codeSent = result.delivery ? await verifyEscrowCodeDelivery(result.delivery, expectations, identity) : void 0;
       }
       return { ...result, clientEphemeralPrivateKey: pair.privateKey, expectations };
     },
@@ -24357,7 +24414,9 @@ export {
   validateRecoveryPhrase,
   verifyEnclaveAttestation,
   verifyEscrowAuthorityState,
+  verifyEscrowCodeDelivery,
   verifyEscrowEnrollmentCommit,
+  verifyEscrowHoldState,
   verifyNitroAttestationDocument,
   verifyStoredShares,
   violatesCarryContactRule