@atproto/bsky 0.0.251 → 0.0.253

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @atproto/bsky
 
+## 0.0.253
+
+### Patch Changes
+
+- [#5179](https://github.com/bluesky-social/atproto/pull/5179) [`f6409db`](https://github.com/bluesky-social/atproto/commit/f6409dbcefdd5565b1ba23c52dc71ec7e791e2e9) Thanks [@estrattonbailey](https://github.com/estrattonbailey)! - Support the new timestamp field, along with transactionId and errorCode, on KWS age verification status payloads. Add additionalVerificationMethods to Age Assurance config.
+
+- Updated dependencies [[`f6409db`](https://github.com/bluesky-social/atproto/commit/f6409dbcefdd5565b1ba23c52dc71ec7e791e2e9)]:
+  - @atproto/api@0.20.25
+
+## 0.0.252
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add missing `@types` dependencies
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- [#5173](https://github.com/bluesky-social/atproto/pull/5173) [`85baa2d`](https://github.com/bluesky-social/atproto/commit/85baa2dac9819288f8a4af12c8831a24c80669d5) Thanks [@estrattonbailey](https://github.com/estrattonbailey)! - Revert [#5166](https://github.com/bluesky-social/atproto/issues/5166) and [#5164](https://github.com/bluesky-social/atproto/issues/5164)
+
+- Updated dependencies [[`28a0b58`](https://github.com/bluesky-social/atproto/commit/28a0b588147863eaef948cd2bb8fc0f19d08cda9), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto/syntax@0.6.4
+  - @atproto/identity@0.5.3
+  - @atproto-labs/fetch-node@0.3.4
+  - @atproto-labs/xrpc-utils@0.1.5
+  - @atproto/xrpc-server@0.11.6
+  - @atproto/lex@0.1.7
+  - @atproto/common@0.6.5
+  - @atproto/crypto@0.5.3
+  - @atproto/repo@0.10.3
+  - @atproto/sync@0.3.7
+  - @atproto/api@0.20.24
+  - @atproto/did@0.5.3
+
 ## 0.0.251
 
 ### Patch Changes

package/dist/api/age-assurance/const.js

@@ -157,25 +157,25 @@ export const AGE_ASSURANCE_CONFIG = app.bsky.ageassurance.defs.config.$build({
                 }),
             ],
         },
-        {
-            countryCode: 'US',
-            regionCode: 'TX',
-            minAccessAge: 18,
-            // On-device age verification is permitted here in addition to the
-            // third-party (KWS) flow, which is always supported and remains as a
-            // fallback for platforms without the native age API (e.g. web) or
-            // insufficient device results.
-            additionalVerificationMethods: ['device'],
-            rules: [
-                app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({
-                    age: 18,
-                    access: 'full',
-                }),
-                app.bsky.ageassurance.defs.configRegionRuleDefault.$build({
-                    access: 'none',
-                }),
-            ],
-        },
+        // {
+        //   countryCode: 'US',
+        //   regionCode: 'TX',
+        //   minAccessAge: 18,
+        //   // On-device age verification is permitted here in addition to the
+        //   // third-party (KWS) flow, which is always supported and remains as a
+        //   // fallback for platforms without the native age API (e.g. web) or
+        //   // insufficient device results.
+        //   additionalVerificationMethods: ['device'],
+        //   rules: [
+        //     app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({
+        //       age: 18,
+        //       access: 'full',
+        //     }),
+        //     app.bsky.ageassurance.defs.configRegionRuleDefault.$build({
+        //       access: 'none',
+        //     }),
+        //   ],
+        // },
         {
             countryCode: 'BR',
             regionCode: undefined,

package/dist/api/age-assurance/const.js.map

@@ -1 +1 @@
-{"version":3,"file":"const.js","sourceRoot":"","sources":["../../../src/api/age-assurance/const.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3E,OAAO,EAAE;QACP;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC;oBACnE,IAAI,EAAE,sBAAsB;oBAC5B,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,kEAAkE;YAClE,qEAAqE;YACrE,kEAAkE;YAClE,+BAA+B;YAC/B,6BAA6B,EAAE,CAAC,QAAQ,CAAC;YACzC,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;KACF;CACF,CAAC,CAAA","sourcesContent":["import { app } from '../../lexicons/index.js'\n\n/**\n * Age assurance configuration defining rules for various regions.\n *\n * NOTE: These rules are matched in order, and the first matching rule\n * determines the access level granted.\n *\n * NOTE: all regions MUST have a default rule as the last rule.\n */\nexport const AGE_ASSURANCE_CONFIG = app.bsky.ageassurance.defs.config.$build({\n  regions: [\n    {\n      countryCode: 'GB',\n      regionCode: undefined,\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'AU',\n      regionCode: undefined,\n      minAccessAge: 16,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAccountNewerThan.$build({\n          date: '2025-12-10T00:00:00Z',\n          access: 'none',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 16,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 16,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'SD',\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'WY',\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'OH',\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'MS',\n      minAccessAge: 18,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'VA',\n      minAccessAge: 16,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 16,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 16,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'TN',\n      minAccessAge: 18,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'TX',\n      minAccessAge: 18,\n      // On-device age verification is permitted here in addition to the\n      // third-party (KWS) flow, which is always supported and remains as a\n      // fallback for platforms without the native age API (e.g. web) or\n      // insufficient device results.\n      additionalVerificationMethods: ['device'],\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'BR',\n      regionCode: undefined,\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n  ],\n})\n"]}
+{"version":3,"file":"const.js","sourceRoot":"","sources":["../../../src/api/age-assurance/const.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3E,OAAO,EAAE;QACP;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC;oBACnE,IAAI,EAAE,sBAAsB;oBAC5B,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;QACD,IAAI;QACJ,uBAAuB;QACvB,sBAAsB;QACtB,sBAAsB;QACtB,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,oCAAoC;QACpC,+CAA+C;QAC/C,aAAa;QACb,2EAA2E;QAC3E,iBAAiB;QACjB,wBAAwB;QACxB,UAAU;QACV,kEAAkE;QAClE,wBAAwB;QACxB,UAAU;QACV,OAAO;QACP,KAAK;QACL;YACE,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,EAAE;YAChB,KAAK,EAAE;gBACL,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC;oBACjE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC;oBAClE,GAAG,EAAE,EAAE;oBACP,MAAM,EAAE,MAAM;iBACf,CAAC;gBACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC;oBACxD,MAAM,EAAE,MAAM;iBACf,CAAC;aACH;SACF;KACF;CACF,CAAC,CAAA","sourcesContent":["import { app } from '../../lexicons/index.js'\n\n/**\n * Age assurance configuration defining rules for various regions.\n *\n * NOTE: These rules are matched in order, and the first matching rule\n * determines the access level granted.\n *\n * NOTE: all regions MUST have a default rule as the last rule.\n */\nexport const AGE_ASSURANCE_CONFIG = app.bsky.ageassurance.defs.config.$build({\n  regions: [\n    {\n      countryCode: 'GB',\n      regionCode: undefined,\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'AU',\n      regionCode: undefined,\n      minAccessAge: 16,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAccountNewerThan.$build({\n          date: '2025-12-10T00:00:00Z',\n          access: 'none',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 16,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 16,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'SD',\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'WY',\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'OH',\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'MS',\n      minAccessAge: 18,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'VA',\n      minAccessAge: 16,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 16,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 16,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    {\n      countryCode: 'US',\n      regionCode: 'TN',\n      minAccessAge: 18,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n    // {\n    //   countryCode: 'US',\n    //   regionCode: 'TX',\n    //   minAccessAge: 18,\n    //   // On-device age verification is permitted here in addition to the\n    //   // third-party (KWS) flow, which is always supported and remains as a\n    //   // fallback for platforms without the native age API (e.g. web) or\n    //   // insufficient device results.\n    //   additionalVerificationMethods: ['device'],\n    //   rules: [\n    //     app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n    //       age: 18,\n    //       access: 'full',\n    //     }),\n    //     app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n    //       access: 'none',\n    //     }),\n    //   ],\n    // },\n    {\n      countryCode: 'BR',\n      regionCode: undefined,\n      minAccessAge: 13,\n      rules: [\n        app.bsky.ageassurance.defs.configRegionRuleIfAssuredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 18,\n          access: 'full',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleIfDeclaredOverAge.$build({\n          age: 13,\n          access: 'safe',\n        }),\n        app.bsky.ageassurance.defs.configRegionRuleDefault.$build({\n          access: 'none',\n        }),\n      ],\n    },\n  ],\n})\n"]}

package/dist/kws.d.ts

@@ -23,8 +23,16 @@ export type KWSSendEmailRequest = (KWSSendEmailRequestCommon & {
 });
 export declare class KwsClient {
     cfg: KwsConfig;
+    private cachedToken?;
+    private pendingAuth?;
     constructor(cfg: KwsConfig);
+    /**
+     * Returns a valid access token, reusing the cached one until it nears
+     * expiry. Pass `force` to bypass the cache and mint a fresh token, e.g.
+     * after a 401 from the API indicates the current token was rejected.
+     */
     private auth;
+    private fetchToken;
     private fetchWithAuth;
     /**
      * @deprecated Use `sendAdultVerifiedFlowEmail` or `sendAgeVerifiedFlowEmail` instead.

package/dist/kws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kws.d.ts","sourceRoot":"","sources":["../src/kws.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAGvD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAGvC,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,SAEhD,CAAA;AAQD;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AAErD,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC3B,CAAC,yBAAyB,GAAG;IAC3B,WAAW,EAAE,OAAO,CAAA;CACrB,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC3B,WAAW,EAAE,KAAK,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEN,qBAAa,SAAS;IACD,GAAG,EAAE,SAAS;IAAjC,YAAmB,GAAG,EAAE,SAAS,EAAI;YAEvB,IAAI;YAiCJ,aAAa;IAe3B;;OAEG;IACG,SAAS,CAAC,EACd,WAAW,EACX,KAAK,EACL,eAAe,EACf,QAAQ,GACT,EAAE;QACD,WAAW,EAAE,MAAM,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,EAAE,kBAAkB,CAAA;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,oBAkCA;IAED;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,mBAAmB,oBA4BrC;IAED;;;OAGG;IACG,0BAA0B,CAAC,KAAK,EAAE,yBAAyB,oBAKhE;IAED;;;OAGG;IACG,wBAAwB,CAAC,KAAK,EAAE,yBAAyB,oBAM9D;CACF"}
+{"version":3,"file":"kws.d.ts","sourceRoot":"","sources":["../src/kws.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAGvD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAGvC,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,SAEhD,CAAA;AAkBD;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;CAAG;AAErD,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC3B,CAAC,yBAAyB,GAAG;IAC3B,WAAW,EAAE,OAAO,CAAA;CACrB,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC3B,WAAW,EAAE,KAAK,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAC,CAAA;AAEN,qBAAa,SAAS;IAMD,GAAG,EAAE,SAAS;IALjC,OAAO,CAAC,WAAW,CAAC,CAAa;IAGjC,OAAO,CAAC,WAAW,CAAC,CAAiB;IAErC,YAAmB,GAAG,EAAE,SAAS,EAAI;IAErC;;;;OAIG;YACW,IAAI;YAaJ,UAAU;YAgDV,aAAa;IA2B3B;;OAEG;IACG,SAAS,CAAC,EACd,WAAW,EACX,KAAK,EACL,eAAe,EACf,QAAQ,GACT,EAAE;QACD,WAAW,EAAE,MAAM,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,EAAE,kBAAkB,CAAA;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,oBAkCA;IAED;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,mBAAmB,oBA4BrC;IAED;;;OAGG;IACG,0BAA0B,CAAC,KAAK,EAAE,yBAAyB,oBAKhE;IAED;;;OAGG;IACG,wBAAwB,CAAC,KAAK,EAAE,yBAAyB,oBAM9D;CACF"}

package/dist/kws.js

@@ -8,7 +8,14 @@ export const createKwsClient = (cfg) => {
 // Not `.strict()` to avoid breaking if KWS adds fields.
 const authResponseSchema = z.object({
     access_token: z.string(),
+    // Seconds the token remains valid. KWS notes this varies with usage, and
+    // it's optional here: if absent we can't anticipate expiry, so we skip
+    // caching and lean on the reactive re-auth-on-401 path instead.
+    expires_in: z.number().optional(),
 });
+// Re-authenticate once the token has burned through this fraction of its
+// advertised lifetime, so we never send a token that's on the edge of expiry.
+const TOKEN_LIFETIME_REFRESH_RATIO = 0.9;
 const EXTERNAL_PAYLOAD_CHAR_LIMIT = 200;
 /**
  * Thrown when the provided external payload exceeds KWS's character limit.
@@ -22,7 +29,24 @@ export class KwsClient {
     constructor(cfg) {
         this.cfg = cfg;
     }
-    async auth() {
+    /**
+     * Returns a valid access token, reusing the cached one until it nears
+     * expiry. Pass `force` to bypass the cache and mint a fresh token, e.g.
+     * after a 401 from the API indicates the current token was rejected.
+     */
+    async auth(force = false) {
+        if (!force && this.cachedToken && Date.now() < this.cachedToken.expiresAt) {
+            return this.cachedToken.accessToken;
+        }
+        // Coalesce concurrent (re-)auth attempts onto one request.
+        if (!this.pendingAuth) {
+            this.pendingAuth = this.fetchToken().finally(() => {
+                this.pendingAuth = undefined;
+            });
+        }
+        return this.pendingAuth;
+    }
+    async fetchToken() {
         try {
             const res = await fetch(`${this.cfg.authOrigin}/auth/realms/kws/protocol/openid-connect/token`, {
                 method: 'POST',
@@ -42,22 +66,47 @@ export class KwsClient {
             }
             const auth = await res.json();
             const authResponse = authResponseSchema.parse(auth);
+            if (authResponse.expires_in == null) {
+                // Without a lifetime we can't proactively refresh, but we still cache
+                // the token and reuse it until a 401 triggers the re-auth-on-401 path.
+                log.error('KWS auth response missing expires_in; caching without a TTL');
+            }
+            this.cachedToken = {
+                accessToken: authResponse.access_token,
+                expiresAt: authResponse.expires_in == null
+                    ? Infinity
+                    : Date.now() +
+                        authResponse.expires_in * 1000 * TOKEN_LIFETIME_REFRESH_RATIO,
+            };
             return authResponse.access_token;
         }
         catch (err) {
+            // Drop any stale cache so the next call retries the token fetch.
+            this.cachedToken = undefined;
             log.error({ err }, 'Failed to authenticate with KWS');
             throw err;
         }
     }
     async fetchWithAuth(url, init) {
-        const accessToken = await this.auth();
-        return fetch(url, {
+        const res = await fetch(url, {
             ...init,
             headers: {
                 ...(init.headers ?? {}),
-                Authorization: `Bearer ${accessToken}`,
+                Authorization: `Bearer ${await this.auth()}`,
             },
         });
+        // A 401 means the token expired (KWS token TTL is variable). Re-auth once
+        // with a fresh token and retry, per the KWS integration docs.
+        if (res.status === 401) {
+            return fetch(url, {
+                ...init,
+                headers: {
+                    ...(init.headers ?? {}),
+                    Authorization: `Bearer ${await this.auth(true)}`,
+                },
+            });
+        }
+        return res;
     }
     /**
      * @deprecated Use `sendAdultVerifiedFlowEmail` or `sendAgeVerifiedFlowEmail` instead.

package/dist/kws.js.map

@@ -1 +1 @@
-{"version":3,"file":"kws.js","sourceRoot":"","sources":["../src/kws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,OAAO,EAAE,UAAU,IAAI,GAAG,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAa,EAAE;IAC3D,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAA;AAEF,MAAM,2BAA2B,GAAG,GAAG,CAAA;AACvC;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAkBrD,MAAM,OAAO,SAAS;IACpB,YAAmB,GAAc;mBAAd,GAAG;IAAc,CAAC;IAE7B,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,gDAAgD,EACtE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;iBAClE;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,KAAK,EAAE,cAAc;iBACtB,CAAC;aACH,CACF,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAClC,MAAM,IAAI,KAAK,CACb,uDAAuD,GAAG,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,gBAAgB,SAAS,EAAE,CAC5H,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACnD,OAAO,YAAY,CAAC,YAAY,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAA;YACrD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,GAAW,EACX,IAAiB;QAEjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QAErC,OAAO,KAAK,CAAC,GAAG,EAAE;YAChB,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvB,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,EACd,WAAW,EACX,KAAK,EACL,eAAe,EACf,QAAQ,GAMT;QACC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAA;QAC3E,IAAI,yBAAyB,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YACnE,MAAM,IAAI,uBAAuB,EAAE,CAAA;QACrC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,8BAA8B,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,eAAe,EAAE,yBAAyB;gBAC1C,QAAQ;gBACR,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,OAAO;aACrB,CAAC;SACH,CACF,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAClC,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,EAC7D,oCAAoC,CACrC,CAAA;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAA0B;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,8BAA8B,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CACF,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAClC,GAAG,CAAC,KAAK,CACP;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,WAAW;aACxB,EACD,0BAA0B,CAC3B,CAAA;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAAC,KAAgC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,GAAG,KAAK;YACR,WAAW,EAAE,OAAO;SACrB,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAAgC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,GAAG,KAAK;YACR,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,EAAE,EAAE,qBAAqB;SACtC,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import { z } from 'zod'\nimport { KwsExternalPayload } from './api/kws/types.js'\nimport { serializeExternalPayload } from './api/kws/util.js'\nimport { buildBasicAuth } from './auth-verifier.js'\nimport { KwsConfig } from './config.js'\nimport { httpLogger as log } from './logger.js'\n\nexport const createKwsClient = (cfg: KwsConfig): KwsClient => {\n  return new KwsClient(cfg)\n}\n\n// Not `.strict()` to avoid breaking if KWS adds fields.\nconst authResponseSchema = z.object({\n  access_token: z.string(),\n})\n\nconst EXTERNAL_PAYLOAD_CHAR_LIMIT = 200\n/**\n * Thrown when the provided external payload exceeds KWS's character limit.\n * This is most commonly caused by DIDs that are too long, such as for\n * `did:web` DIDs. But it's very rare, and the client has special handling for\n * this case.\n */\nexport class KwsExternalPayloadError extends Error {}\n\nexport type KWSSendEmailRequestCommon = {\n  email: string\n  location: string\n  language: string\n  externalPayload: string\n}\n\nexport type KWSSendEmailRequest =\n  | (KWSSendEmailRequestCommon & {\n      userContext: 'adult'\n    })\n  | (KWSSendEmailRequestCommon & {\n      userContext: 'age'\n      minimumAge: number\n    })\n\nexport class KwsClient {\n  constructor(public cfg: KwsConfig) {}\n\n  private async auth() {\n    try {\n      const res = await fetch(\n        `${this.cfg.authOrigin}/auth/realms/kws/protocol/openid-connect/token`,\n        {\n          method: 'POST',\n          headers: {\n            Accept: 'application/json',\n            'Content-Type': 'application/x-www-form-urlencoded',\n            Authorization: buildBasicAuth(this.cfg.clientId, this.cfg.apiKey),\n          },\n          body: new URLSearchParams({\n            grant_type: 'client_credentials',\n            scope: 'verification',\n          }),\n        },\n      )\n      if (!res.ok) {\n        const errorText = await res.text()\n        throw new Error(\n          `Failed to fetch age assurance access token: status: ${res.status}, statusText: ${res.statusText}, errorText: ${errorText}`,\n        )\n      }\n\n      const auth = await res.json()\n      const authResponse = authResponseSchema.parse(auth)\n      return authResponse.access_token\n    } catch (err) {\n      log.error({ err }, 'Failed to authenticate with KWS')\n      throw err\n    }\n  }\n\n  private async fetchWithAuth(\n    url: string,\n    init: RequestInit,\n  ): Promise<Response> {\n    const accessToken = await this.auth()\n\n    return fetch(url, {\n      ...init,\n      headers: {\n        ...(init.headers ?? {}),\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n  }\n\n  /**\n   * @deprecated Use `sendAdultVerifiedFlowEmail` or `sendAgeVerifiedFlowEmail` instead.\n   */\n  async sendEmail({\n    countryCode,\n    email,\n    externalPayload,\n    language,\n  }: {\n    countryCode: string\n    email: string\n    externalPayload: KwsExternalPayload\n    language: string\n  }) {\n    const serializedExternalPayload = serializeExternalPayload(externalPayload)\n    if (serializedExternalPayload.length > EXTERNAL_PAYLOAD_CHAR_LIMIT) {\n      throw new KwsExternalPayloadError()\n    }\n\n    const res = await this.fetchWithAuth(\n      `${this.cfg.apiOrigin}/v1/verifications/send-email`,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'User-Agent': this.cfg.userAgent,\n        },\n        body: JSON.stringify({\n          email,\n          externalPayload: serializedExternalPayload,\n          language,\n          location: countryCode,\n          userContext: 'adult',\n        }),\n      },\n    )\n\n    if (!res.ok) {\n      const errorText = await res.text()\n      log.error(\n        { status: res.status, statusText: res.statusText, errorText },\n        'Failed to send age assurance email',\n      )\n      throw new Error('Failed to send age assurance email')\n    }\n\n    return res.json()\n  }\n\n  /**\n   * Sends a KWS verification email with the given properties.\n   */\n  async email(props: KWSSendEmailRequest) {\n    const res = await this.fetchWithAuth(\n      `${this.cfg.apiOrigin}/v1/verifications/send-email`,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'User-Agent': this.cfg.userAgent,\n        },\n        body: JSON.stringify(props),\n      },\n    )\n\n    if (!res.ok) {\n      const errorText = await res.text()\n      log.error(\n        {\n          status: res.status,\n          statusText: res.statusText,\n          errorText,\n          flow: props.userContext,\n        },\n        'Failed to send KWS email',\n      )\n      throw new Error('Failed to send KWS email')\n    }\n\n    return res.json()\n  }\n\n  /**\n   * Sends an email to the user initiating an `adult` verification flow, which\n   * results in `adult-verified` events/webhooks.\n   */\n  async sendAdultVerifiedFlowEmail(props: KWSSendEmailRequestCommon) {\n    return this.email({\n      ...props,\n      userContext: 'adult',\n    })\n  }\n\n  /**\n   * Sends an email to the user initiating an `age` verification flow, which\n   * results in `age-verified` events/webhooks.\n   */\n  async sendAgeVerifiedFlowEmail(props: KWSSendEmailRequestCommon) {\n    return this.email({\n      ...props,\n      userContext: 'age',\n      minimumAge: 16, // KWS required value\n    })\n  }\n}\n"]}
+{"version":3,"file":"kws.js","sourceRoot":"","sources":["../src/kws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEnD,OAAO,EAAE,UAAU,IAAI,GAAG,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAa,EAAE;IAC3D,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,wDAAwD;AACxD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,yEAAyE;IACzE,uEAAuE;IACvE,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA;AAEF,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,4BAA4B,GAAG,GAAG,CAAA;AAIxC,MAAM,2BAA2B,GAAG,GAAG,CAAA;AACvC;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAkBrD,MAAM,OAAO,SAAS;IAMpB,YAAmB,GAAc;mBAAd,GAAG;IAAc,CAAC;IAErC;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAA;QACrC,CAAC;QACD,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChD,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;YAC9B,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,gDAAgD,EACtE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;iBAClE;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,KAAK,EAAE,cAAc;iBACtB,CAAC;aACH,CACF,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;gBAClC,MAAM,IAAI,KAAK,CACb,uDAAuD,GAAG,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,gBAAgB,SAAS,EAAE,CAC5H,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAC7B,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACnD,IAAI,YAAY,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,sEAAsE;gBACtE,uEAAuE;gBACvE,GAAG,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAC1E,CAAC;YACD,IAAI,CAAC,WAAW,GAAG;gBACjB,WAAW,EAAE,YAAY,CAAC,YAAY;gBACtC,SAAS,EACP,YAAY,CAAC,UAAU,IAAI,IAAI;oBAC7B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;wBACV,YAAY,CAAC,UAAU,GAAG,IAAI,GAAG,4BAA4B;aACpE,CAAA;YACD,OAAO,YAAY,CAAC,YAAY,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;YAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAA;YACrD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,GAAW,EACX,IAAiB;QAEjB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvB,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE;aAC7C;SACF,CAAC,CAAA;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,GAAG,EAAE;gBAChB,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;oBACvB,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACjD;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,EACd,WAAW,EACX,KAAK,EACL,eAAe,EACf,QAAQ,GAMT;QACC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC,eAAe,CAAC,CAAA;QAC3E,IAAI,yBAAyB,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YACnE,MAAM,IAAI,uBAAuB,EAAE,CAAA;QACrC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,8BAA8B,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,eAAe,EAAE,yBAAyB;gBAC1C,QAAQ;gBACR,QAAQ,EAAE,WAAW;gBACrB,WAAW,EAAE,OAAO;aACrB,CAAC;SACH,CACF,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAClC,GAAG,CAAC,KAAK,CACP,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,EAC7D,oCAAoC,CACrC,CAAA;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAA0B;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,8BAA8B,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CACF,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAClC,GAAG,CAAC,KAAK,CACP;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,WAAW;aACxB,EACD,0BAA0B,CAC3B,CAAA;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC7C,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAAC,KAAgC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,GAAG,KAAK;YACR,WAAW,EAAE,OAAO;SACrB,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAAgC;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC;YAChB,GAAG,KAAK;YACR,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,EAAE,EAAE,qBAAqB;SACtC,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import { z } from 'zod'\nimport { KwsExternalPayload } from './api/kws/types.js'\nimport { serializeExternalPayload } from './api/kws/util.js'\nimport { buildBasicAuth } from './auth-verifier.js'\nimport { KwsConfig } from './config.js'\nimport { httpLogger as log } from './logger.js'\n\nexport const createKwsClient = (cfg: KwsConfig): KwsClient => {\n  return new KwsClient(cfg)\n}\n\n// Not `.strict()` to avoid breaking if KWS adds fields.\nconst authResponseSchema = z.object({\n  access_token: z.string(),\n  // Seconds the token remains valid. KWS notes this varies with usage, and\n  // it's optional here: if absent we can't anticipate expiry, so we skip\n  // caching and lean on the reactive re-auth-on-401 path instead.\n  expires_in: z.number().optional(),\n})\n\n// Re-authenticate once the token has burned through this fraction of its\n// advertised lifetime, so we never send a token that's on the edge of expiry.\nconst TOKEN_LIFETIME_REFRESH_RATIO = 0.9\n\ntype CachedToken = { accessToken: string; expiresAt: number }\n\nconst EXTERNAL_PAYLOAD_CHAR_LIMIT = 200\n/**\n * Thrown when the provided external payload exceeds KWS's character limit.\n * This is most commonly caused by DIDs that are too long, such as for\n * `did:web` DIDs. But it's very rare, and the client has special handling for\n * this case.\n */\nexport class KwsExternalPayloadError extends Error {}\n\nexport type KWSSendEmailRequestCommon = {\n  email: string\n  location: string\n  language: string\n  externalPayload: string\n}\n\nexport type KWSSendEmailRequest =\n  | (KWSSendEmailRequestCommon & {\n      userContext: 'adult'\n    })\n  | (KWSSendEmailRequestCommon & {\n      userContext: 'age'\n      minimumAge: number\n    })\n\nexport class KwsClient {\n  private cachedToken?: CachedToken\n  // In-flight auth request, so concurrent callers share a single token fetch\n  // rather than each hitting the token endpoint (which the WAF rate-limits).\n  private pendingAuth?: Promise<string>\n\n  constructor(public cfg: KwsConfig) {}\n\n  /**\n   * Returns a valid access token, reusing the cached one until it nears\n   * expiry. Pass `force` to bypass the cache and mint a fresh token, e.g.\n   * after a 401 from the API indicates the current token was rejected.\n   */\n  private async auth(force = false): Promise<string> {\n    if (!force && this.cachedToken && Date.now() < this.cachedToken.expiresAt) {\n      return this.cachedToken.accessToken\n    }\n    // Coalesce concurrent (re-)auth attempts onto one request.\n    if (!this.pendingAuth) {\n      this.pendingAuth = this.fetchToken().finally(() => {\n        this.pendingAuth = undefined\n      })\n    }\n    return this.pendingAuth\n  }\n\n  private async fetchToken(): Promise<string> {\n    try {\n      const res = await fetch(\n        `${this.cfg.authOrigin}/auth/realms/kws/protocol/openid-connect/token`,\n        {\n          method: 'POST',\n          headers: {\n            Accept: 'application/json',\n            'Content-Type': 'application/x-www-form-urlencoded',\n            Authorization: buildBasicAuth(this.cfg.clientId, this.cfg.apiKey),\n          },\n          body: new URLSearchParams({\n            grant_type: 'client_credentials',\n            scope: 'verification',\n          }),\n        },\n      )\n      if (!res.ok) {\n        const errorText = await res.text()\n        throw new Error(\n          `Failed to fetch age assurance access token: status: ${res.status}, statusText: ${res.statusText}, errorText: ${errorText}`,\n        )\n      }\n\n      const auth = await res.json()\n      const authResponse = authResponseSchema.parse(auth)\n      if (authResponse.expires_in == null) {\n        // Without a lifetime we can't proactively refresh, but we still cache\n        // the token and reuse it until a 401 triggers the re-auth-on-401 path.\n        log.error('KWS auth response missing expires_in; caching without a TTL')\n      }\n      this.cachedToken = {\n        accessToken: authResponse.access_token,\n        expiresAt:\n          authResponse.expires_in == null\n            ? Infinity\n            : Date.now() +\n              authResponse.expires_in * 1000 * TOKEN_LIFETIME_REFRESH_RATIO,\n      }\n      return authResponse.access_token\n    } catch (err) {\n      // Drop any stale cache so the next call retries the token fetch.\n      this.cachedToken = undefined\n      log.error({ err }, 'Failed to authenticate with KWS')\n      throw err\n    }\n  }\n\n  private async fetchWithAuth(\n    url: string,\n    init: RequestInit,\n  ): Promise<Response> {\n    const res = await fetch(url, {\n      ...init,\n      headers: {\n        ...(init.headers ?? {}),\n        Authorization: `Bearer ${await this.auth()}`,\n      },\n    })\n\n    // A 401 means the token expired (KWS token TTL is variable). Re-auth once\n    // with a fresh token and retry, per the KWS integration docs.\n    if (res.status === 401) {\n      return fetch(url, {\n        ...init,\n        headers: {\n          ...(init.headers ?? {}),\n          Authorization: `Bearer ${await this.auth(true)}`,\n        },\n      })\n    }\n\n    return res\n  }\n\n  /**\n   * @deprecated Use `sendAdultVerifiedFlowEmail` or `sendAgeVerifiedFlowEmail` instead.\n   */\n  async sendEmail({\n    countryCode,\n    email,\n    externalPayload,\n    language,\n  }: {\n    countryCode: string\n    email: string\n    externalPayload: KwsExternalPayload\n    language: string\n  }) {\n    const serializedExternalPayload = serializeExternalPayload(externalPayload)\n    if (serializedExternalPayload.length > EXTERNAL_PAYLOAD_CHAR_LIMIT) {\n      throw new KwsExternalPayloadError()\n    }\n\n    const res = await this.fetchWithAuth(\n      `${this.cfg.apiOrigin}/v1/verifications/send-email`,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'User-Agent': this.cfg.userAgent,\n        },\n        body: JSON.stringify({\n          email,\n          externalPayload: serializedExternalPayload,\n          language,\n          location: countryCode,\n          userContext: 'adult',\n        }),\n      },\n    )\n\n    if (!res.ok) {\n      const errorText = await res.text()\n      log.error(\n        { status: res.status, statusText: res.statusText, errorText },\n        'Failed to send age assurance email',\n      )\n      throw new Error('Failed to send age assurance email')\n    }\n\n    return res.json()\n  }\n\n  /**\n   * Sends a KWS verification email with the given properties.\n   */\n  async email(props: KWSSendEmailRequest) {\n    const res = await this.fetchWithAuth(\n      `${this.cfg.apiOrigin}/v1/verifications/send-email`,\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'User-Agent': this.cfg.userAgent,\n        },\n        body: JSON.stringify(props),\n      },\n    )\n\n    if (!res.ok) {\n      const errorText = await res.text()\n      log.error(\n        {\n          status: res.status,\n          statusText: res.statusText,\n          errorText,\n          flow: props.userContext,\n        },\n        'Failed to send KWS email',\n      )\n      throw new Error('Failed to send KWS email')\n    }\n\n    return res.json()\n  }\n\n  /**\n   * Sends an email to the user initiating an `adult` verification flow, which\n   * results in `adult-verified` events/webhooks.\n   */\n  async sendAdultVerifiedFlowEmail(props: KWSSendEmailRequestCommon) {\n    return this.email({\n      ...props,\n      userContext: 'adult',\n    })\n  }\n\n  /**\n   * Sends an email to the user initiating an `age` verification flow, which\n   * results in `age-verified` events/webhooks.\n   */\n  async sendAgeVerifiedFlowEmail(props: KWSSendEmailRequestCommon) {\n    return this.email({\n      ...props,\n      userContext: 'age',\n      minimumAge: 16, // KWS required value\n    })\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/bsky",
-  "version": "0.0.251",
+  "version": "0.0.253",
   "license": "MIT",
   "description": "Reference implementation of app.bsky App View (Bluesky API)",
   "keywords": [
@@ -13,6 +13,18 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/bsky"
   },
+  "files": [
+    "./dist",
+    "./README.md",
+    "./CHANGELOG.md"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
   "engines": {
     "node": ">=22"
   },
@@ -48,18 +60,18 @@
     "uint8arrays": "^5.0.0",
     "undici": "^8.5.0",
     "zod": "3.23.8",
-    "@atproto-labs/fetch-node": "^0.3.3",
-    "@atproto-labs/xrpc-utils": "^0.1.4",
-    "@atproto/api": "^0.20.23",
-    "@atproto/common": "^0.6.4",
-    "@atproto/identity": "^0.5.2",
-    "@atproto/did": "^0.5.2",
-    "@atproto/lex": "^0.1.6",
-    "@atproto/crypto": "^0.5.2",
-    "@atproto/repo": "^0.10.2",
-    "@atproto/sync": "^0.3.6",
-    "@atproto/syntax": "^0.6.3",
-    "@atproto/xrpc-server": "^0.11.5"
+    "@atproto-labs/xrpc-utils": "^0.1.5",
+    "@atproto/api": "^0.20.25",
+    "@atproto/did": "^0.5.3",
+    "@atproto-labs/fetch-node": "^0.3.4",
+    "@atproto/crypto": "^0.5.3",
+    "@atproto/lex": "^0.1.7",
+    "@atproto/common": "^0.6.5",
+    "@atproto/repo": "^0.10.3",
+    "@atproto/sync": "^0.3.7",
+    "@atproto/identity": "^0.5.3",
+    "@atproto/syntax": "^0.6.4",
+    "@atproto/xrpc-server": "^0.11.6"
   },
   "devDependencies": {
     "@bufbuild/buf": "^1.28.1",
@@ -67,20 +79,13 @@
     "@connectrpc/protoc-gen-connect-es": "^1.1.4",
     "@did-plc/server": "^0.0.1",
     "@types/cors": "^2.8.12",
+    "@types/compression": "^1.8.1",
     "@types/express": "^4.17.13",
     "@types/express-serve-static-core": "^4.17.36",
     "@types/pg": "^8.15.5",
     "@types/qs": "^6.9.7",
-    "ts-node": "^10.8.2",
     "vitest": "^4.0.16",
-    "@atproto/pds": "^0.5.12"
-  },
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
+    "@atproto/pds": "^0.5.14"
   },
   "scripts": {
     "codegen:buf": "buf generate ../bsync/proto && buf generate ./proto",
@@ -91,7 +96,7 @@
     "test": "../dev-infra/with-test-redis-and-db.sh vitest run",
     "test:log": "tail -50 test.log | pino-pretty",
     "test:updateSnapshot": "../dev-infra/with-test-redis-and-db.sh vitest run --update",
-    "migration:create": "ts-node ./bin/migration-create.ts",
+    "migration:create": "node ./bin/migration-create.ts",
     "buf:gen": ">&2 echo 'DEPRECATED: run `pnpm run codegen:buf` instead ' && pnpm run codegen:buf"
   }
 }

package/bin/migration-create.ts

@@ -1,46 +0,0 @@
-#!/usr/bin/env ts-node
-
-import * as fs from 'node:fs/promises'
-import * as path from 'node:path'
-
-export async function main() {
-  const now = new Date()
-  const prefix = now.toISOString().replace(/[^a-z0-9]/gi, '') // Order of migrations matches alphabetical order of their names
-  const name = process.argv[2]
-  if (!name || !name.match(/^[a-z0-9-]+$/)) {
-    process.exitCode = 1
-    return console.error(
-      'Must pass a migration name consisting of lowercase digits, numbers, and dashes.',
-    )
-  }
-  const filename = `${prefix}-${name}`
-  const dir = path.join(
-    __dirname,
-    '..',
-    'src',
-    'data-plane',
-    'server',
-    'db',
-    'migrations',
-  )
-
-  await fs.writeFile(path.join(dir, `${filename}.ts`), template, { flag: 'wx' })
-  await fs.writeFile(
-    path.join(dir, 'index.ts'),
-    `export * as _${prefix} from './${filename}.js'\n`,
-    { flag: 'a' },
-  )
-}
-
-const template = `import { Kysely } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  // Migration code
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  // Migration code
-}
-`
-
-main()

package/buf.gen.yaml

@@ -1,12 +0,0 @@
-version: v1
-plugins:
-  - plugin: es
-    opt:
-      - target=ts
-      - import_extension=
-    out: src/proto
-  - plugin: connect-es
-    opt:
-      - target=ts
-      - import_extension=.js
-    out: src/proto