@peers-app/peers-sdk 0.25.14 → 0.25.15

package/dist/device-pairing/types.d.ts

@@ -1141,16 +1141,16 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
         deviceName: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1163,16 +1163,16 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
         deviceName: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1187,17 +1187,17 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     nameplate: number;
     sourceIdentity: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
     destinationIdentity: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1211,17 +1211,17 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     nameplate: number;
     sourceIdentity: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
     destinationIdentity: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1261,16 +1261,16 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
         deviceName: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1292,9 +1292,9 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     version: 3;
     device: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1309,9 +1309,9 @@ export declare const pairingConfirmationContentsSchema: z.ZodObject<{
     version: 3;
     device: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1341,16 +1341,16 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
         deviceName: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1374,9 +1374,9 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     version: 3;
     device: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1392,9 +1392,9 @@ export declare const pairingConfirmationSchema: z.ZodObject<{
     version: 3;
     device: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1459,16 +1459,16 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
         deviceName: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     }>;
@@ -1478,9 +1478,9 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     transcriptHash: string;
     initializedDevice: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1490,9 +1490,9 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     transcriptHash: string;
     initializedDevice: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
         deviceId: string;
+        publicBoxKey: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };
@@ -1514,16 +1514,16 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
             deviceName: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
             deviceId: string;
+            publicBoxKey: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         }, {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
             deviceId: string;
+            publicBoxKey: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         }>;
@@ -1533,9 +1533,9 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
             deviceId: string;
+            publicBoxKey: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1545,9 +1545,9 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
             deviceId: string;
+            publicBoxKey: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1563,9 +1563,9 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
             deviceId: string;
+            publicBoxKey: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };
@@ -1579,9 +1579,9 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
             deviceId: string;
+            publicBoxKey: string;
             userName?: string | undefined;
             deviceName?: string | undefined;
         };

package/dist/host-credentials.d.ts

@@ -0,0 +1,78 @@
+/** Why a signing key on this host was replaced. */
+export declare const KEY_ROTATION_REASONS: readonly ["rotation", "compromised", "lost"];
+/** One of {@link KEY_ROTATION_REASONS}. */
+export type KeyRotationReason = (typeof KEY_ROTATION_REASONS)[number];
+/**
+ * The credential record every host keeps for the signed-in user.
+ *
+ * Electron stores it in the OS keychain, headless in `credentials.json`, the PWA in its
+ * IndexedDB vault. Besides the identity it carries `dbSecret`, the SQLCipher key for this
+ * host's database files, which is deliberately *not* derived from `secretKey` any more: that
+ * is what lets a user rotate their signing key without re-encrypting every database
+ * (`PRAGMA rekey` is unusable under WAL). Existing installs keep working because a missing
+ * `dbSecret` means "the legacy derived value", so migration changes no file on disk.
+ */
+/** A key this host's user retired, kept for display and for `getKeyInfo`. */
+export interface IPreviousPublicKey {
+    publicKey: string;
+    /** ISO 8601 */
+    replacedAt: string;
+    reason?: KeyRotationReason;
+}
+/**
+ * The key a rotation retired, kept only until every secret in the personal database has been
+ * re-wrapped under the new one. Secrets are rewritten one at a time after the new key is
+ * stored; without this slot a crash in between would leave values nothing can open.
+ */
+export interface IRewrapSource {
+    publicKey: string;
+    secretKey: string;
+}
+/** Stored credentials; see the module description. */
+export interface IHostCredentialRecord {
+    userId: string;
+    /** Current Ed25519 secret key, base64url (64-byte encoding). */
+    secretKey: string;
+    /** SQLCipher key for this host's databases. Never changes on key rotation. */
+    dbSecret: string;
+    /** Keys this user retired on this host, newest last. */
+    previousPublicKeys?: IPreviousPublicKey[];
+    /** Present while a rotation's re-wrap is unfinished; see {@link IRewrapSource}. */
+    rewrapFrom?: IRewrapSource;
+}
+/** The SQLCipher key hosts used before `dbSecret` existed: a hash of the user secret. */
+export declare function legacyDbSecret(secretKey: string): string;
+/** A fresh random SQLCipher key for a brand-new identity on this host. */
+export declare function newDbSecret(): string;
+/**
+ * Fills in `dbSecret` for a record that predates it (or was copied by pairing, which transfers
+ * only `userId` and `secretKey`).
+ *
+ * @param input Partial record with at least `userId` and `secretKey`
+ * @param opts.freshDbSecret When true a missing `dbSecret` is minted at random (new identity on
+ *   this host, no database file exists yet). Default: the legacy derived value, so an existing
+ *   database still opens.
+ */
+export declare function normalizeCredentialRecord(input: Partial<IHostCredentialRecord> & Pick<IHostCredentialRecord, "userId" | "secretKey">, opts?: {
+    freshDbSecret?: boolean;
+}): IHostCredentialRecord;
+/**
+ * Parses a stored credential string: the JSON form written by current hosts, or the legacy
+ * `userId::secretKey` form. Returns `null` when the value is neither.
+ */
+export declare function parseCredentialRecord(value: string | null | undefined): IHostCredentialRecord | null;
+/** Serializes a record for storage (JSON, one line). */
+export declare function serializeCredentialRecord(record: IHostCredentialRecord): string;
+/**
+ * The record after a key rotation on this host: new secret, same `dbSecret`, old public key
+ * appended to `previousPublicKeys`, and the old secret kept in `rewrapFrom` until
+ * {@link completeCredentialRewrap} says every secret is readable under the new key.
+ */
+export declare function rotateCredentialRecord(current: IHostCredentialRecord, next: {
+    secretKey: string;
+    oldPublicKey: string;
+    reason?: KeyRotationReason;
+    at?: Date;
+}): IHostCredentialRecord;
+/** The record once the re-wrap after a rotation has finished: the retired secret is dropped. */
+export declare function completeCredentialRewrap(record: IHostCredentialRecord): IHostCredentialRecord;

package/dist/host-credentials.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_ROTATION_REASONS = void 0;
+exports.legacyDbSecret = legacyDbSecret;
+exports.newDbSecret = newDbSecret;
+exports.normalizeCredentialRecord = normalizeCredentialRecord;
+exports.parseCredentialRecord = parseCredentialRecord;
+exports.serializeCredentialRecord = serializeCredentialRecord;
+exports.rotateCredentialRecord = rotateCredentialRecord;
+exports.completeCredentialRewrap = completeCredentialRewrap;
+const keys_1 = require("./keys");
+const utils_1 = require("./utils");
+/** Why a signing key on this host was replaced. */
+exports.KEY_ROTATION_REASONS = ["rotation", "compromised", "lost"];
+/** The SQLCipher key hosts used before `dbSecret` existed: a hash of the user secret. */
+function legacyDbSecret(secretKey) {
+    return (0, keys_1.hashValue)(secretKey);
+}
+/** A fresh random SQLCipher key for a brand-new identity on this host. */
+function newDbSecret() {
+    return (0, keys_1.newToken)(32);
+}
+/**
+ * Fills in `dbSecret` for a record that predates it (or was copied by pairing, which transfers
+ * only `userId` and `secretKey`).
+ *
+ * @param input Partial record with at least `userId` and `secretKey`
+ * @param opts.freshDbSecret When true a missing `dbSecret` is minted at random (new identity on
+ *   this host, no database file exists yet). Default: the legacy derived value, so an existing
+ *   database still opens.
+ */
+function normalizeCredentialRecord(input, opts = {}) {
+    const dbSecret = input.dbSecret || (opts.freshDbSecret ? newDbSecret() : legacyDbSecret(input.secretKey));
+    return {
+        userId: input.userId,
+        secretKey: input.secretKey,
+        dbSecret,
+        ...(input.previousPublicKeys?.length ? { previousPublicKeys: input.previousPublicKeys } : {}),
+        ...(input.rewrapFrom?.publicKey && input.rewrapFrom.secretKey
+            ? {
+                rewrapFrom: {
+                    publicKey: input.rewrapFrom.publicKey,
+                    secretKey: input.rewrapFrom.secretKey,
+                },
+            }
+            : {}),
+    };
+}
+/**
+ * Parses a stored credential string: the JSON form written by current hosts, or the legacy
+ * `userId::secretKey` form. Returns `null` when the value is neither.
+ */
+function parseCredentialRecord(value) {
+    if (!value)
+        return null;
+    const trimmed = value.trim();
+    if (trimmed.startsWith("{")) {
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch {
+            return null;
+        }
+        if (!parsed ||
+            typeof parsed !== "object" ||
+            typeof parsed.userId !== "string" ||
+            typeof parsed.secretKey !== "string" ||
+            !parsed.userId ||
+            !parsed.secretKey) {
+            return null;
+        }
+        return normalizeCredentialRecord({
+            userId: parsed.userId,
+            secretKey: parsed.secretKey,
+            dbSecret: typeof parsed.dbSecret === "string" ? parsed.dbSecret : undefined,
+            previousPublicKeys: Array.isArray(parsed.previousPublicKeys)
+                ? parsed.previousPublicKeys.filter((p) => p && typeof p.publicKey === "string" && typeof p.replacedAt === "string")
+                : undefined,
+            rewrapFrom: parsed.rewrapFrom &&
+                typeof parsed.rewrapFrom.publicKey === "string" &&
+                typeof parsed.rewrapFrom.secretKey === "string"
+                ? { publicKey: parsed.rewrapFrom.publicKey, secretKey: parsed.rewrapFrom.secretKey }
+                : undefined,
+        });
+    }
+    const separator = trimmed.indexOf("::");
+    if (separator <= 0)
+        return null;
+    const userId = trimmed.slice(0, separator);
+    const secretKey = trimmed.slice(separator + 2);
+    if (!userId || !secretKey)
+        return null;
+    return normalizeCredentialRecord({ userId, secretKey });
+}
+/** Serializes a record for storage (JSON, one line). */
+function serializeCredentialRecord(record) {
+    return JSON.stringify(normalizeCredentialRecord(record));
+}
+/**
+ * The record after a key rotation on this host: new secret, same `dbSecret`, old public key
+ * appended to `previousPublicKeys`, and the old secret kept in `rewrapFrom` until
+ * {@link completeCredentialRewrap} says every secret is readable under the new key.
+ */
+function rotateCredentialRecord(current, next) {
+    if (!(0, utils_1.isid)(current.userId)) {
+        throw new Error(`Credential record has an invalid userId: ${current.userId}`);
+    }
+    return normalizeCredentialRecord({
+        userId: current.userId,
+        secretKey: next.secretKey,
+        dbSecret: current.dbSecret,
+        previousPublicKeys: [
+            ...(current.previousPublicKeys ?? []),
+            {
+                publicKey: next.oldPublicKey,
+                replacedAt: (next.at ?? new Date()).toISOString(),
+                ...(next.reason ? { reason: next.reason } : {}),
+            },
+        ],
+        rewrapFrom: { publicKey: next.oldPublicKey, secretKey: current.secretKey },
+    });
+}
+/** The record once the re-wrap after a rotation has finished: the retired secret is dropped. */
+function completeCredentialRewrap(record) {
+    const { rewrapFrom: _finished, ...rest } = record;
+    return normalizeCredentialRecord(rest);
+}

package/dist/host-credentials.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host-credentials.test.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const host_credentials_1 = require("./host-credentials");
+const keys_1 = require("./keys");
+const utils_1 = require("./utils");
+describe("host credential record", () => {
+    const userId = (0, utils_1.newid)();
+    const k1 = (0, keys_1.newKeys)();
+    const k2 = (0, keys_1.newKeys)();
+    it("parses the legacy userId::secretKey form and derives the legacy db secret", () => {
+        const record = (0, host_credentials_1.parseCredentialRecord)(`${userId}::${k1.secretKey}`);
+        expect(record).toEqual({
+            userId,
+            secretKey: k1.secretKey,
+            dbSecret: (0, keys_1.hashValue)(k1.secretKey),
+        });
+        expect((0, host_credentials_1.legacyDbSecret)(k1.secretKey)).toBe((0, keys_1.hashValue)(k1.secretKey));
+    });
+    it("parses the JSON form, filling a missing dbSecret with the legacy value", () => {
+        expect((0, host_credentials_1.parseCredentialRecord)(JSON.stringify({ userId, secretKey: k1.secretKey }))).toEqual({
+            userId,
+            secretKey: k1.secretKey,
+            dbSecret: (0, keys_1.hashValue)(k1.secretKey),
+        });
+        const full = {
+            userId,
+            secretKey: k2.secretKey,
+            dbSecret: "db",
+            previousPublicKeys: [{ publicKey: k1.publicKey, replacedAt: "2026-10-02T00:00:00.000Z" }],
+        };
+        expect((0, host_credentials_1.parseCredentialRecord)((0, host_credentials_1.serializeCredentialRecord)(full))).toEqual(full);
+    });
+    it("returns null for garbage", () => {
+        expect((0, host_credentials_1.parseCredentialRecord)(null)).toBeNull();
+        expect((0, host_credentials_1.parseCredentialRecord)("")).toBeNull();
+        expect((0, host_credentials_1.parseCredentialRecord)("{not json")).toBeNull();
+        expect((0, host_credentials_1.parseCredentialRecord)(JSON.stringify({ userId }))).toBeNull();
+        expect((0, host_credentials_1.parseCredentialRecord)("::")).toBeNull();
+        expect((0, host_credentials_1.parseCredentialRecord)("nosep")).toBeNull();
+    });
+    it("mints a random dbSecret only when asked", () => {
+        const fresh = (0, host_credentials_1.normalizeCredentialRecord)({ userId, secretKey: k1.secretKey }, { freshDbSecret: true });
+        expect(fresh.dbSecret).not.toBe((0, keys_1.hashValue)(k1.secretKey));
+        expect(fresh.dbSecret.length).toBeGreaterThan(30);
+        const kept = (0, host_credentials_1.normalizeCredentialRecord)({ userId, secretKey: k1.secretKey, dbSecret: "keep" }, {
+            freshDbSecret: true,
+        });
+        expect(kept.dbSecret).toBe("keep");
+    });
+    it("rotates the secret while keeping dbSecret and remembering the old key", () => {
+        const current = (0, host_credentials_1.normalizeCredentialRecord)({ userId, secretKey: k1.secretKey });
+        const at = new Date("2026-10-03T00:00:00.000Z");
+        const rotated = (0, host_credentials_1.rotateCredentialRecord)(current, {
+            secretKey: k2.secretKey,
+            oldPublicKey: k1.publicKey,
+            reason: "compromised",
+            at,
+        });
+        expect(rotated).toEqual({
+            userId,
+            secretKey: k2.secretKey,
+            dbSecret: (0, keys_1.hashValue)(k1.secretKey),
+            previousPublicKeys: [
+                { publicKey: k1.publicKey, replacedAt: at.toISOString(), reason: "compromised" },
+            ],
+            rewrapFrom: { publicKey: k1.publicKey, secretKey: k1.secretKey },
+        });
+    });
+    it("keeps the retired secret through storage until the re-wrap is finished", () => {
+        // Secrets in the personal database are re-wrapped one by one after the new key is stored.
+        // A crash in between must not lose the only key that can still open the rest.
+        const rotated = (0, host_credentials_1.rotateCredentialRecord)((0, host_credentials_1.normalizeCredentialRecord)({ userId, secretKey: k1.secretKey }), { secretKey: k2.secretKey, oldPublicKey: k1.publicKey });
+        const stored = (0, host_credentials_1.parseCredentialRecord)((0, host_credentials_1.serializeCredentialRecord)(rotated));
+        expect(stored?.rewrapFrom).toEqual({ publicKey: k1.publicKey, secretKey: k1.secretKey });
+        expect(stored?.secretKey).toBe(k2.secretKey);
+        const finished = (0, host_credentials_1.completeCredentialRewrap)(rotated);
+        expect(finished.rewrapFrom).toBeUndefined();
+        expect(finished.secretKey).toBe(k2.secretKey);
+        expect(finished.previousPublicKeys).toEqual(rotated.previousPublicKeys);
+        expect((0, host_credentials_1.parseCredentialRecord)((0, host_credentials_1.serializeCredentialRecord)(finished))?.rewrapFrom).toBeUndefined();
+        // A half-written slot is not a key to re-wrap from.
+        expect((0, host_credentials_1.parseCredentialRecord)(JSON.stringify({
+            userId,
+            secretKey: k2.secretKey,
+            rewrapFrom: { publicKey: k1.publicKey },
+        }))?.rewrapFrom).toBeUndefined();
+    });
+});

package/dist/identity/account-email.d.ts

@@ -0,0 +1,59 @@
+import { type ISignedObject } from "../keys";
+/** Purpose string the current key signs to bind a recovery email. */
+export declare const ACCOUNT_EMAIL_BIND_PURPOSE: "peers-account-email-bind";
+/** Statement the current key signs so the registry can bind a recovery email. */
+export interface IAccountEmailBindStatement {
+    purpose: typeof ACCOUNT_EMAIL_BIND_PURPOSE;
+    userId: string;
+    email: string;
+    issuedAt: string;
+}
+/**
+ * Signs a request to bind `email` to `userId` with the key on record.
+ *
+ * @param statement The user, the mailbox, and when the request was made
+ * @param secretKey Secret half of the key on record
+ */
+export declare function signEmailBind(statement: IAccountEmailBindStatement, secretKey: string): ISignedObject<IAccountEmailBindStatement>;
+/**
+ * Checks that `signed` is the record key's signature over a bind statement for this user
+ * and mailbox. A different signer, user, or email is not a bind.
+ */
+export declare function verifyEmailBind(params: {
+    signed: ISignedObject<IAccountEmailBindStatement>;
+    userId: string;
+    email: string;
+    recordPublicKey: string;
+}): boolean;
+/** Purpose string the current key signs to read whether a recovery email is bound. */
+export declare const ACCOUNT_EMAIL_STATUS_PURPOSE: "peers-account-email-status";
+/** Statement the current key signs to read the bound recovery email. */
+export interface IAccountEmailStatusStatement {
+    purpose: typeof ACCOUNT_EMAIL_STATUS_PURPOSE;
+    userId: string;
+    issuedAt: string;
+}
+/** Signs a request to read the recovery email bound to `userId`. */
+export declare function signEmailStatus(statement: IAccountEmailStatusStatement, secretKey: string): ISignedObject<IAccountEmailStatusStatement>;
+/** Checks that `signed` is the record key asking for this user's recovery email. */
+export declare function verifyEmailStatus(params: {
+    signed: ISignedObject<IAccountEmailStatusStatement>;
+    userId: string;
+    recordPublicKey: string;
+}): boolean;
+/** Purpose string the current key signs to remove a recovery email. */
+export declare const ACCOUNT_EMAIL_UNBIND_PURPOSE: "peers-account-email-unbind";
+/** Statement the current key signs to remove the recovery email. */
+export interface IAccountEmailUnbindStatement {
+    purpose: typeof ACCOUNT_EMAIL_UNBIND_PURPOSE;
+    userId: string;
+    issuedAt: string;
+}
+/** Signs a request to remove the recovery email bound to `userId`. */
+export declare function signEmailUnbind(statement: IAccountEmailUnbindStatement, secretKey: string): ISignedObject<IAccountEmailUnbindStatement>;
+/** Checks that `signed` is the record key removing this user's recovery email. */
+export declare function verifyEmailUnbind(params: {
+    signed: ISignedObject<IAccountEmailUnbindStatement>;
+    userId: string;
+    recordPublicKey: string;
+}): boolean;