@learncard/sss-key-manager 0.2.6 → 0.2.7

package/dist/index.d.ts

@@ -24,7 +24,7 @@ export type { EscrowEnrollmentActionInput } from './escrow-authority';
 export type { VerifiedEnclaveIdentity, EscrowAuthorityRecord, EscrowAuthorityState, VerifiedEscrowMutation, } from './escrow-authority.types';
 export { verifyNitroAttestationDocument, NitroAttestationError } from './escrow-nitro-attestation';
 export type { NitroAttestationReason } from './escrow-nitro-attestation';
-export type { EscrowAttestationPolicy, EscrowHoldStatus, EscrowRecoveryStart } from './types';
+export type { EscrowAttestationPolicy, EscrowHoldStatus, EscrowPinAttemptContext, EscrowRecoveryStart, } from './types';
 export type { EscrowEnrollmentOptions, EscrowEnrollmentState, EscrowBlobStaleReason, EscrowPinStatus, } from './types';
 export { EscrowPinMismatchError, EscrowPinLockedError, EscrowPinThrottledError, EscrowHoldRestartThrottledError, EscrowPinUnavailableError, PinSignInStaleError, } from './types';
 export { PIN_MIN_LENGTH, PIN_MAX_LENGTH, ESCROW_PIN_MAX_ATTEMPTS, normalizePin, validatePin, generatePinSalt, derivePinProof, constantTimeEqualHex, } from './escrow-pin';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnG,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9F,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,EACzB,mBAAmB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,6BAA6B,EAC7B,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACR,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnG,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EACR,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,EACzB,mBAAmB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,6BAA6B,EAC7B,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACR,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}

package/dist/sss-key-manager.cjs.development.js

@@ -30428,6 +30428,7 @@ var EscrowRequestError = class extends Error {
     __name(this, "EscrowRequestError");
   }
 };
+var isConflictRefusal = /* @__PURE__ */ __name((error) => error instanceof EscrowRequestError && error.status === 409, "isConflictRefusal");
 var DuplicateShareCoordinateError = class extends Error {
   static {
     __name(this, "DuplicateShareCoordinateError");
@@ -31324,21 +31325,34 @@ function createSSSStrategy(config) {
       }
     };
   }, "captureActiveUserGuard");
-  const pinHasRecordedWrongAttempts = /* @__PURE__ */ __name((escrowPin) => {
+  const recordedWrongPinAttempts = /* @__PURE__ */ __name((escrowPin) => {
     const status = escrowPin;
-    if (status?.state === "none") return false;
-    return typeof status?.wrongAttempts !== "number" || status.wrongAttempts > 0;
-  }, "pinHasRecordedWrongAttempts");
-  const refreshablePinCharges = /* @__PURE__ */ __name((before, after) => {
+    if (status?.state === "none") return 0;
+    const count = status?.wrongAttempts;
+    return typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
+  }, "recordedWrongPinAttempts");
+  const attemptCount = /* @__PURE__ */ __name((value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0, "attemptCount");
+  const pinSignInClean = /* @__PURE__ */ __name((observed, flowAttempts) => {
+    const flowSalt = flowAttempts?.pinSalt;
+    const sameGeneration = typeof flowSalt !== "string" || observed.every((status) => {
+      const salt = status?.salt;
+      return typeof salt !== "string" || salt === flowSalt;
+    });
+    const attempts = sameGeneration ? flowAttempts : void 0;
+    const own = attempts ? attemptCount(attempts.ownWrongAttempts) : 0;
+    if (own === void 0) return { clean: false, ownWrongAttempts: 0 };
+    const prior = attempts ? attemptCount(attempts.priorWrongAttempts) : recordedWrongPinAttempts(observed[0]);
+    const clean = prior === 0 && observed.length > 0 && observed.every((status) => recordedWrongPinAttempts(status) === own);
+    return { clean, ownWrongAttempts: own };
+  }, "pinSignInClean");
+  const refreshablePinCharges = /* @__PURE__ */ __name((before, after, ownWrongAttempts) => {
     const pre = before;
     const post = after;
-    if (pinHasRecordedWrongAttempts(before) || pinHasRecordedWrongAttempts(after))
-      return void 0;
     if (pre?.state !== "enabled" || post?.state !== "enabled") return void 0;
     if (typeof pre.attemptsRemaining !== "number" || typeof post.attemptsRemaining !== "number")
       return void 0;
     if (post.attemptsRemaining !== pre.attemptsRemaining - 1) return void 0;
-    return { attemptsRemaining: post.attemptsRemaining, wrongAttempts: 0 };
+    return { attemptsRemaining: post.attemptsRemaining, wrongAttempts: ownWrongAttempts };
   }, "refreshablePinCharges");
   const freshPinMaterial = /* @__PURE__ */ __name(async (pin) => {
     if (!validatePin(pin).ok) return void 0;
@@ -31361,7 +31375,7 @@ function createSSSStrategy(config) {
       primaryDid: released.primaryDid
     };
   }, "adoptReleasedShare");
-  const completePinSignInKeep = /* @__PURE__ */ __name(async (params, released, pin, pinBefore) => {
+  const completePinSignInKeep = /* @__PURE__ */ __name(async (params, released, pin, pinBefore, pinAttempts) => {
     const storage2 = guardedStorage();
     const generation = storageGeneration;
     const storageId = activeStorageId;
@@ -31370,7 +31384,11 @@ function createSSSStrategy(config) {
         throw new Error("This recovery request was cancelled.");
       }
     }, "assertActive");
-    const { mode, newPinRequired, refreshCharges } = await withShareUpdateLock(
+    const {
+      mode,
+      newPinRequired: newPinRequiredAtRelease,
+      refreshCharges
+    } = await withShareUpdateLock(
       storage2,
       storageId,
       () => withRotationLock(async () => {
@@ -31414,18 +31432,23 @@ function createSSSStrategy(config) {
           current.shareVersion
         );
         pendingIdentityRecovery = void 0;
+        const { clean, ownWrongAttempts } = pinSignInClean(
+          [pinBefore, current.escrowPin],
+          pinAttempts
+        );
         return {
           mode: mode2,
-          newPinRequired: pinHasRecordedWrongAttempts(pinBefore) || pinHasRecordedWrongAttempts(current.escrowPin),
-          refreshCharges: refreshablePinCharges(pinBefore, current.escrowPin)
+          newPinRequired: !clean,
+          refreshCharges: clean ? refreshablePinCharges(pinBefore, current.escrowPin, ownWrongAttempts) : void 0
         };
       })
     );
     let pinRefreshed = false;
     let pinRefreshFailed = false;
+    let newPinRequired = newPinRequiredAtRelease;
     if (mode === "kept" && !newPinRequired && refreshCharges && params.signDidAuthVp) {
       const pinMaterial = await freshPinMaterial(pin);
-      pinRefreshed = pinMaterial !== void 0 && await tryEnrollEscrow(
+      const refresh = pinMaterial === void 0 ? void 0 : await attemptEnrollEscrow(
         params.token,
         params.providerType,
         released.privateKey,
@@ -31441,7 +31464,18 @@ function createSSSStrategy(config) {
         params.options?.recoveryLanguage,
         refreshCharges
       );
+      pinRefreshed = refresh?.enrolled === true;
       pinRefreshFailed = pinMaterial !== void 0 && !pinRefreshed;
+      if (pinRefreshFailed) {
+        const latest = await fetchAuthShareRaw(
+          serverUrl,
+          params.token,
+          params.providerType,
+          void 0,
+          tenantId
+        ).catch(() => void 0);
+        newPinRequired = latest ? !pinSignInClean([pinBefore, latest.escrowPin], pinAttempts).clean : isConflictRefusal(refresh && !refresh.enrolled ? refresh.error : void 0);
+      }
     }
     assertActive();
     return {
@@ -31529,7 +31563,7 @@ function createSSSStrategy(config) {
       pinSignIn: {
         mode: "relinked",
         pinRefreshed: false,
-        newPinRequired: pinHasRecordedWrongAttempts(status?.escrowPin)
+        newPinRequired: !pinSignInClean([status?.escrowPin], pending.pinKeep?.pinAttempts).clean
       }
     };
   }, "completePinSignInRelink");
@@ -32449,7 +32483,8 @@ function createSSSStrategy(config) {
               shareVersion: material.shareVersion
             },
             input.pin,
-            pinBefore
+            pinBefore,
+            input.pinAttempts
           );
         }
         pendingIdentityRecovery = {
@@ -32460,7 +32495,12 @@ function createSSSStrategy(config) {
           rebindSessionToken: material.rebindSessionToken,
           fromEscrow: true,
           // The PIN itself is not kept across the new-login step.
-          ...input.method === "escrow-pin" ? { pinKeep: { shareVersion: material.shareVersion } } : {}
+          ...input.method === "escrow-pin" ? {
+            pinKeep: {
+              shareVersion: material.shareVersion,
+              ...input.pinAttempts ? { pinAttempts: { ...input.pinAttempts } } : {}
+            }
+          } : {}
         };
         if (!token) return { privateKey: privateKey2, did: material.primaryDid };
         return completeIdentityRecoveryWith({