@learncard/sss-key-manager 0.2.6 → 0.2.7

package/dist/sss-key-manager.esm.js

@@ -27805,6 +27805,7 @@ var EscrowRequestError = class extends Error {
     __name(this, "EscrowRequestError");
   }
 };
+var isConflictRefusal = /* @__PURE__ */ __name((error) => error instanceof EscrowRequestError && error.status === 409, "isConflictRefusal");
 var DuplicateShareCoordinateError = class extends Error {
   static {
     __name(this, "DuplicateShareCoordinateError");
@@ -28701,21 +28702,34 @@ function createSSSStrategy(config) {
       }
     };
   }, "captureActiveUserGuard");
-  const pinHasRecordedWrongAttempts = /* @__PURE__ */ __name((escrowPin) => {
+  const recordedWrongPinAttempts = /* @__PURE__ */ __name((escrowPin) => {
     const status = escrowPin;
-    if (status?.state === "none") return false;
-    return typeof status?.wrongAttempts !== "number" || status.wrongAttempts > 0;
-  }, "pinHasRecordedWrongAttempts");
-  const refreshablePinCharges = /* @__PURE__ */ __name((before, after) => {
+    if (status?.state === "none") return 0;
+    const count = status?.wrongAttempts;
+    return typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
+  }, "recordedWrongPinAttempts");
+  const attemptCount = /* @__PURE__ */ __name((value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0, "attemptCount");
+  const pinSignInClean = /* @__PURE__ */ __name((observed, flowAttempts) => {
+    const flowSalt = flowAttempts?.pinSalt;
+    const sameGeneration = typeof flowSalt !== "string" || observed.every((status) => {
+      const salt = status?.salt;
+      return typeof salt !== "string" || salt === flowSalt;
+    });
+    const attempts = sameGeneration ? flowAttempts : void 0;
+    const own = attempts ? attemptCount(attempts.ownWrongAttempts) : 0;
+    if (own === void 0) return { clean: false, ownWrongAttempts: 0 };
+    const prior = attempts ? attemptCount(attempts.priorWrongAttempts) : recordedWrongPinAttempts(observed[0]);
+    const clean = prior === 0 && observed.length > 0 && observed.every((status) => recordedWrongPinAttempts(status) === own);
+    return { clean, ownWrongAttempts: own };
+  }, "pinSignInClean");
+  const refreshablePinCharges = /* @__PURE__ */ __name((before, after, ownWrongAttempts) => {
     const pre = before;
     const post = after;
-    if (pinHasRecordedWrongAttempts(before) || pinHasRecordedWrongAttempts(after))
-      return void 0;
     if (pre?.state !== "enabled" || post?.state !== "enabled") return void 0;
     if (typeof pre.attemptsRemaining !== "number" || typeof post.attemptsRemaining !== "number")
       return void 0;
     if (post.attemptsRemaining !== pre.attemptsRemaining - 1) return void 0;
-    return { attemptsRemaining: post.attemptsRemaining, wrongAttempts: 0 };
+    return { attemptsRemaining: post.attemptsRemaining, wrongAttempts: ownWrongAttempts };
   }, "refreshablePinCharges");
   const freshPinMaterial = /* @__PURE__ */ __name(async (pin) => {
     if (!validatePin(pin).ok) return void 0;
@@ -28738,7 +28752,7 @@ function createSSSStrategy(config) {
       primaryDid: released.primaryDid
     };
   }, "adoptReleasedShare");
-  const completePinSignInKeep = /* @__PURE__ */ __name(async (params, released, pin, pinBefore) => {
+  const completePinSignInKeep = /* @__PURE__ */ __name(async (params, released, pin, pinBefore, pinAttempts) => {
     const storage2 = guardedStorage();
     const generation = storageGeneration;
     const storageId = activeStorageId;
@@ -28747,7 +28761,11 @@ function createSSSStrategy(config) {
         throw new Error("This recovery request was cancelled.");
       }
     }, "assertActive");
-    const { mode, newPinRequired, refreshCharges } = await withShareUpdateLock(
+    const {
+      mode,
+      newPinRequired: newPinRequiredAtRelease,
+      refreshCharges
+    } = await withShareUpdateLock(
       storage2,
       storageId,
       () => withRotationLock(async () => {
@@ -28791,18 +28809,23 @@ function createSSSStrategy(config) {
           current.shareVersion
         );
         pendingIdentityRecovery = void 0;
+        const { clean, ownWrongAttempts } = pinSignInClean(
+          [pinBefore, current.escrowPin],
+          pinAttempts
+        );
         return {
           mode: mode2,
-          newPinRequired: pinHasRecordedWrongAttempts(pinBefore) || pinHasRecordedWrongAttempts(current.escrowPin),
-          refreshCharges: refreshablePinCharges(pinBefore, current.escrowPin)
+          newPinRequired: !clean,
+          refreshCharges: clean ? refreshablePinCharges(pinBefore, current.escrowPin, ownWrongAttempts) : void 0
         };
       })
     );
     let pinRefreshed = false;
     let pinRefreshFailed = false;
+    let newPinRequired = newPinRequiredAtRelease;
     if (mode === "kept" && !newPinRequired && refreshCharges && params.signDidAuthVp) {
       const pinMaterial = await freshPinMaterial(pin);
-      pinRefreshed = pinMaterial !== void 0 && await tryEnrollEscrow(
+      const refresh = pinMaterial === void 0 ? void 0 : await attemptEnrollEscrow(
         params.token,
         params.providerType,
         released.privateKey,
@@ -28818,7 +28841,18 @@ function createSSSStrategy(config) {
         params.options?.recoveryLanguage,
         refreshCharges
       );
+      pinRefreshed = refresh?.enrolled === true;
       pinRefreshFailed = pinMaterial !== void 0 && !pinRefreshed;
+      if (pinRefreshFailed) {
+        const latest = await fetchAuthShareRaw(
+          serverUrl,
+          params.token,
+          params.providerType,
+          void 0,
+          tenantId
+        ).catch(() => void 0);
+        newPinRequired = latest ? !pinSignInClean([pinBefore, latest.escrowPin], pinAttempts).clean : isConflictRefusal(refresh && !refresh.enrolled ? refresh.error : void 0);
+      }
     }
     assertActive();
     return {
@@ -28906,7 +28940,7 @@ function createSSSStrategy(config) {
       pinSignIn: {
         mode: "relinked",
         pinRefreshed: false,
-        newPinRequired: pinHasRecordedWrongAttempts(status?.escrowPin)
+        newPinRequired: !pinSignInClean([status?.escrowPin], pending.pinKeep?.pinAttempts).clean
       }
     };
   }, "completePinSignInRelink");
@@ -29826,7 +29860,8 @@ function createSSSStrategy(config) {
               shareVersion: material.shareVersion
             },
             input.pin,
-            pinBefore
+            pinBefore,
+            input.pinAttempts
           );
         }
         pendingIdentityRecovery = {
@@ -29837,7 +29872,12 @@ function createSSSStrategy(config) {
           rebindSessionToken: material.rebindSessionToken,
           fromEscrow: true,
           // The PIN itself is not kept across the new-login step.
-          ...input.method === "escrow-pin" ? { pinKeep: { shareVersion: material.shareVersion } } : {}
+          ...input.method === "escrow-pin" ? {
+            pinKeep: {
+              shareVersion: material.shareVersion,
+              ...input.pinAttempts ? { pinAttempts: { ...input.pinAttempts } } : {}
+            }
+          } : {}
         };
         if (!token) return { privateKey: privateKey2, did: material.primaryDid };
         return completeIdentityRecoveryWith({