@atproto/oauth-provider 0.22.8 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @atproto/oauth-provider
 
+## 0.23.0
+
+### Minor Changes
+
+- [#5207](https://github.com/bluesky-social/atproto/pull/5207) [`f5f0aab`](https://github.com/bluesky-social/atproto/commit/f5f0aab4cf3046de3dddd9251a07003d29e3c0be) Thanks [@ThisIsMissEm](https://github.com/ThisIsMissEm)! - Add email-based authentication factor (2FA) for account sign-in
+
+### Patch Changes
+
+- Updated dependencies [[`5019f55`](https://github.com/bluesky-social/atproto/commit/5019f5537317ee75ad4527db212bc27c3085fe67), [`3988a49`](https://github.com/bluesky-social/atproto/commit/3988a49b4b67c35c1f5e4f07f7753244031d78e5), [`f5f0aab`](https://github.com/bluesky-social/atproto/commit/f5f0aab4cf3046de3dddd9251a07003d29e3c0be)]:
+  - @atproto/did@0.5.6
+  - @atproto/oauth-provider-ui@0.10.5
+  - @atproto/oauth-provider-api@0.9.0
+  - @atproto/common@0.8.4
+  - @atproto/lex-resolver@0.3.1
+  - @atproto/oauth-scopes@0.5.13
+  - @atproto/oauth-types@0.7.7
+
+## 0.22.9
+
+### Patch Changes
+
+- [#5547](https://github.com/bluesky-social/atproto/pull/5547) [`80bcda7`](https://github.com/bluesky-social/atproto/commit/80bcda748b435ecfecc18158921f4a84de2b4247) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Narrow the CSP `img-src` directive for customization images: the `data:` scheme source is now emitted only when a customization image is actually configured as a `data:` uri, and http(s) customization images contribute their own origin.
+
+- [#5536](https://github.com/bluesky-social/atproto/pull/5536) [`7f6785b`](https://github.com/bluesky-social/atproto/commit/7f6785bd4c48438e621c9b96265a52f14d64ce3c) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove unused dev dependency `@types/send`
+
+- [#5499](https://github.com/bluesky-social/atproto/pull/5499) [`210907c`](https://github.com/bluesky-social/atproto/commit/210907c801d281c6b83c92bf94c888b2dc3d531f) Thanks [@fatfingers23](https://github.com/fatfingers23)! - Resolve permission set lexicons hosted on the PDS itself from the local actor store instead of fetching them over the network. Re-export `LexResolverError` from `@atproto/oauth-provider`.
+
+- [#5547](https://github.com/bluesky-social/atproto/pull/5547) [`80bcda7`](https://github.com/bluesky-social/atproto/commit/80bcda748b435ecfecc18158921f4a84de2b4247) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add support for http: customization assets in development
+- Updated dependencies [[`210907c`](https://github.com/bluesky-social/atproto/commit/210907c801d281c6b83c92bf94c888b2dc3d531f), [`210907c`](https://github.com/bluesky-social/atproto/commit/210907c801d281c6b83c92bf94c888b2dc3d531f), [`1f639d9`](https://github.com/bluesky-social/atproto/commit/1f639d97498981eea3553b9a20a8538437af9658), [`210907c`](https://github.com/bluesky-social/atproto/commit/210907c801d281c6b83c92bf94c888b2dc3d531f), [`210907c`](https://github.com/bluesky-social/atproto/commit/210907c801d281c6b83c92bf94c888b2dc3d531f), [`210907c`](https://github.com/bluesky-social/atproto/commit/210907c801d281c6b83c92bf94c888b2dc3d531f)]:
+  - @atproto/lex-resolver@0.3.0
+  - @atproto/oauth-provider-ui@0.10.4
+  - @atproto/lex-document@0.1.12
+
 ## 0.22.8
 
 ### Patch Changes

package/dist/account/account-manager.d.ts

@@ -6,7 +6,7 @@ import type { DeviceId } from '../device/device-id.js';
 import { HCaptchaClient, type HcaptchaVerifyResult } from '../lib/hcaptcha.js';
 import type { OAuthHooks, RequestMetadata } from '../oauth-hooks.js';
 import type { Customization } from '../oauth-provider.js';
-import type { Account, AccountStore, AuthorizedClientData, DeleteAccountConfirmInput, DeleteAccountRequestInput, DeviceAccount, HandleString, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateHandleData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from './account-store.js';
+import type { Account, AccountStore, AuthorizedClientData, DeleteAccountConfirmInput, DeleteAccountRequestInput, DeviceAccount, DisableEmailAuthFactorInput, EnableEmailAuthFactorInput, HandleString, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateHandleData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from './account-store.js';
 import type { SignInData } from './sign-in-data.js';
 import type { SignUpInput } from './sign-up-input.js';
 export declare class AccountManager {
@@ -39,6 +39,8 @@ export declare class AccountManager {
     updateEmailConfirm(deviceId: DeviceId, deviceMetadata: RequestMetadata, input: UpdateEmailConfirmInput, account: Account): Promise<Account>;
     verifyEmailRequest(deviceId: DeviceId, deviceMetadata: RequestMetadata, input: VerifyEmailRequestInput, account: Account): Promise<void>;
     verifyEmailConfirm(deviceId: DeviceId, deviceMetadata: RequestMetadata, input: VerifyEmailConfirmInput, account: Account): Promise<Account>;
+    enableEmailAuthFactor(deviceId: DeviceId, deviceMetadata: RequestMetadata, input: EnableEmailAuthFactorInput, account: Account): Promise<Account>;
+    disableEmailAuthFactor(deviceId: DeviceId, deviceMetadata: RequestMetadata, input: DisableEmailAuthFactorInput, account: Account): Promise<Account>;
     updateHandle(deviceId: DeviceId, deviceMetadata: RequestMetadata, input: UpdateHandleData, account: Account): Promise<Account>;
     deactivateAccount(deviceId: DeviceId, deviceMetadata: RequestMetadata, account: Account): Promise<Account>;
     reactivateAccount(deviceId: DeviceId, deviceMetadata: RequestMetadata, account: Account): Promise<Account>;

package/dist/account/account-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager.d.ts","sourceRoot":"","sources":["../../src/account/account-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAGtD,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG9E,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAOrD,qBAAa,cAAc;IAMvB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY;IACtC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IANtC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IAC9C,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IAElD,YACE,MAAM,EAAE,qBAAqB,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,UAAU,EACpC,aAAa,EAAE,aAAa,EAM7B;IAED,UAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAoC3C;IAED,UAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EACnB,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;IAED,UAAgB,eAAe,CAC7B,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,UAAU,CAAC,CAOrB;IAEY,aAAa,CACxB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,WAAW,EAClB,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAoClB;IAEY,mBAAmB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,IAAI,EAAE,UAAU,EAChB,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAgElB;IAEY,mBAAmB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAEf;IAEY,gBAAgB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,aAAa,CAAC,CAKxB;IAEY,mBAAmB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAKf;IAEY,UAAU,CAAC,GAAG,EAAE,GAAG;;;OAE/B;IAEY,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,iBAE5D;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAO1B;IAEY,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAOlE;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,iBAoBjC;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,oBAwBjC;IAEY,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAkBrC;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAuBlB;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB;IAEY,YAAY,CACvB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAkBlB;IAEY,iBAAiB,CAC5B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEY,iBAAiB,CAC5B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAoBlB;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAcf;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAqBf;CACF"}
+{"version":3,"file":"account-manager.d.ts","sourceRoot":"","sources":["../../src/account/account-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAGtD,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG9E,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,EACb,2BAA2B,EAC3B,0BAA0B,EAC1B,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAOrD,qBAAa,cAAc;IAMvB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY;IACtC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IANtC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IAC9C,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IAElD,YACE,MAAM,EAAE,qBAAqB,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,UAAU,EACpC,aAAa,EAAE,aAAa,EAM7B;IAED,UAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAoC3C;IAED,UAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,QAAQ,EACnB,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;IAED,UAAgB,eAAe,CAC7B,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,UAAU,CAAC,CAOrB;IAEY,aAAa,CACxB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,WAAW,EAClB,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAoClB;IAEY,mBAAmB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,IAAI,EAAE,UAAU,EAChB,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAsElB;IAEY,mBAAmB,CAC9B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAEf;IAEY,gBAAgB,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,aAAa,CAAC,CAKxB;IAEY,mBAAmB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAKf;IAEY,UAAU,CAAC,GAAG,EAAE,GAAG;;;OAE/B;IAEY,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,iBAE5D;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,aAAa,EAAE,CAAC,CAO1B;IAEY,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAOlE;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,iBAoBjC;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,oBAwBjC;IAEY,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAkBrC;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAuBlB;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;IAEY,kBAAkB,CAC7B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB;IAEY,qBAAqB,CAChC,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAuBlB;IAEY,sBAAsB,CACjC,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAuBlB;IAEY,YAAY,CACvB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAkBlB;IAEY,iBAAiB,CAC5B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAwBlB;IAEY,iBAAiB,CAC5B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAoBlB;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAcf;IAEY,oBAAoB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAqBf;CACF"}

package/dist/account/account-manager.js

@@ -99,8 +99,14 @@ export class AccountManager {
             const account = await callAsync(() => this.store.authenticateAccount(data)).catch(async (err) => {
                 // Only notify for credential failures (e.g. unknown identifier, wrong
                 // password). Server errors and flows that require an additional factor
-                // (e.g. SecondAuthenticationFactorRequiredError) are not "failed
-                // sign-ins" and do not trigger the hook.
+                // are not "failed sign-ins" and do not trigger the hook.
+                //
+                // @NOTE That exclusion rests on the error hierarchy rather than an
+                // explicit guard: `SecondAuthenticationFactorRequiredError` extends
+                // `OAuthError` directly, so it misses this branch and falls through to
+                // the rethrow below. Re-parenting it under `InvalidRequestError` would
+                // silently start reporting second-factor challenges as failed
+                // sign-ins.
                 if (err instanceof InvalidRequestError) {
                     // Stores that throw the more specific `InvalidCredentialsError`
                     // can attach the matched subject identifier to distinguish
@@ -290,6 +296,48 @@ export class AccountManager {
         });
         return updatedAccount;
     }
+    async enableEmailAuthFactor(deviceId, deviceMetadata, input, account) {
+        // Already enabled
+        if (account.emailAuthFactor)
+            return account;
+        await this.hooks.onEnableEmailAuthFactor?.call(null, {
+            deviceId,
+            deviceMetadata,
+            input,
+            account,
+        });
+        const updatedAccount = await this.store.enableEmailAuthFactor(input);
+        if (updatedAccount.emailAuthFactor !== account.emailAuthFactor) {
+            await this.hooks.onEnabledEmailAuthFactor?.call(null, {
+                deviceId,
+                deviceMetadata,
+                input,
+                account: updatedAccount,
+            });
+        }
+        return updatedAccount;
+    }
+    async disableEmailAuthFactor(deviceId, deviceMetadata, input, account) {
+        // Already disabled
+        if (!account.emailAuthFactor)
+            return account;
+        await this.hooks.onDisableEmailAuthFactor?.call(null, {
+            deviceId,
+            deviceMetadata,
+            input,
+            account,
+        });
+        const updatedAccount = await this.store.disableEmailAuthFactor(input);
+        if (updatedAccount.emailAuthFactor !== account.emailAuthFactor) {
+            await this.hooks.onDisabledEmailAuthFactor?.call(null, {
+                deviceId,
+                deviceMetadata,
+                input,
+                account: updatedAccount,
+            });
+        }
+        return updatedAccount;
+    }
     async updateHandle(deviceId, deviceMetadata, input, account) {
         await this.hooks.onUpdateHandle?.call(null, {
             deviceId,

package/dist/account/account-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager.js","sourceRoot":"","sources":["../../src/account/account-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,cAAc,EAA6B,MAAM,oBAAoB,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAuBlD,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAC1C,MAAM,4BAA4B,GAAG,GAAG,CAAA;AAExC,gDAAgD;AAEhD,MAAM,OAAO,cAAc;IAIzB,YACE,MAA6B,EACV,KAAmB,EACnB,KAAiB,EACpC,aAA4B;qBAFT,KAAK;qBACL,KAAK;QAGxB,IAAI,CAAC,kBAAkB,GAAG,aAAa,CAAC,kBAAkB,KAAK,KAAK,CAAA;QACpE,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ;YAC1C,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;YACtE,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,KAAkB,EAClB,QAAkB,EAClB,cAA+B;QAE/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAClD,cAAc,CAAC,SAAS,EACxB,KAAK,CAAC,MAAM,EACZ,cAAc,CAAC,SAAS,CACzB,CAAA;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc;aACrC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC;aACvE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;QACrE,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC5C,KAAK;YACL,QAAQ;YACR,cAAc;YACd,MAAM;YACN,MAAM;SACP,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,KAAkB,EAClB,SAAmB,EACnB,eAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAA;QAC1D,CAAC;QAED,OAAO,KAAK,CAAC,UAAU,CAAA;IACzB,CAAC;IAES,KAAK,CAAC,eAAe,CAC7B,KAAkB,EAClB,QAAkB,EAClB,cAA+B;QAE/B,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC;YAC1D,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC;SACxD,CAAC,CAAA;QAEF,OAAO,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;IACjD,CAAC;IAEM,KAAK,CAAC,aAAa,CACxB,QAAkB,EAClB,cAA+B,EAC/B,KAAkB,EAClB,QAAmB;QAEnB,OAAO,YAAY,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC3C,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,QAAQ;aACT,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;YAExE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAC/B,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACd,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;YAChE,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE;oBACtC,IAAI;oBACJ,OAAO;oBACP,QAAQ;oBACR,cAAc;oBACd,QAAQ;iBACT,CAAC,CAAA;gBAEF,OAAO,OAAO,CAAA;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;gBAErD,MAAM,mBAAmB,CAAC,IAAI,CAC5B,GAAG,EACH,gFAAgF,CACjF,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,QAAkB,EAClB,cAA+B,EAC/B,IAAgB,EAChB,QAAmB;QAEnB,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC3C,IAAI;gBACJ,QAAQ;gBACR,cAAc;gBACd,QAAQ;aACT,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CACrC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,sEAAsE;gBACtE,uEAAuE;gBACvE,iEAAiE;gBACjE,yCAAyC;gBACzC,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,gEAAgE;oBAChE,2DAA2D;oBAC3D,gEAAgE;oBAChE,4DAA4D;oBAC5D,0BAA0B;oBAC1B,MAAM,kBAAkB,GAAG,GAAG,YAAY,uBAAuB,CAAA;oBACjE,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;oBAEzD,kEAAkE;oBAClE,wDAAwD;oBACxD,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE;4BAC1C,IAAI;4BACJ,KAAK,EAAE,GAAG;4BACV,GAAG;4BACH,QAAQ;4BACR,cAAc;4BACd,QAAQ;yBACT,CAAC,CAAA;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO;oBACT,CAAC;oBAED,IAAI,kBAAkB,EAAE,CAAC;wBACvB,uDAAuD;wBACvD,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;oBACtD,CAAC;gBACH,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE;gBACtC,IAAI;gBACJ,OAAO;gBACP,QAAQ;gBACR,cAAc;gBACd,QAAQ;aACT,CAAC,CAAA;YAEF,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,mBAAmB,CAAC,IAAI,CAC5B,GAAG,EACH,qDAAqD,CACtD,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,QAAkB,EAClB,GAAQ;QAER,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACrD,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAkB,EAClB,GAAQ;QAER,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACtE,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QAEtE,OAAO,aAAa,CAAA;IACtB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,OAAgB,EAChB,MAAc,EACd,IAA0B;QAE1B,+DAA+D;QAC/D,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAM;QAE9C,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,GAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAQ;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACtD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB;QAElB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACzD,QAAQ;SACT,CAAC,CAAA;QAEF,OAAO,cAAc,CAAC,aAAa;aAChC,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;IACnE,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,GAAQ;QACtC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACzD,GAAG;SACJ,CAAC,CAAA;QAEF,OAAO,cAAc,CAAC,aAAa;aAChC,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IACjE,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC;QAEhC,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,KAAK;gBACL,QAAQ;gBACR,cAAc;aACf,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YAE5D,uDAAuD;YAEvD,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,OAAO;aACR,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC;QAEhC,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,KAAK;gBACL,QAAQ;gBACR,cAAc;aACf,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;YAChD,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,OAAO;aACR,CAAC,CAAA;YAEF,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,wBAAwB,CAAC,MAAoB;QACxD,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAEpE,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,OAAO,EAAE,aAAa,EAAE,aAAa,KAAK,IAAI,EAAE,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAE1C,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,OAAO,EAAE,cAAc;YACvB,KAAK;SACN,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,QAAkB,EAClB,cAA+B,EAC/B,KAAuB,EACvB,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE;YAC1C,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QAE3D,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3C,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,QAAkB,EAClB,cAA+B,EAC/B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC/C,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAC1C,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,6CAA6C;YAC7C,WAAW,EAAE,SAAS;SACvB,CAAC,CACH,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,QAAkB,EAClB,cAA+B,EAC/B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC/C,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAC1C,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CACnD,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC,EAChC,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAE5C,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;YACpD,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC,EAChC,OAAgB;QAEhB,OAAO,YAAY,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,QAAQ;gBACR,cAAc;gBACd,OAAO;aACR,CAAC,CAAA;YAEF,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CACjE,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;YAChE,CAAC,CACF,CAAA;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,QAAQ;gBACR,cAAc;gBACd,OAAO;gBACP,KAAK;aACN,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import type { Did } from '@atproto/did'\nimport {\n  type OAuthIssuerIdentifier,\n  isOAuthClientIdLoopback,\n} from '@atproto/oauth-types'\nimport type { ClientId } from '../client/client-id.js'\nimport type { Client } from '../client/client.js'\nimport type { DeviceId } from '../device/device-id.js'\nimport { InvalidCredentialsError } from '../errors/invalid-credentials-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { HCaptchaClient, type HcaptchaVerifyResult } from '../lib/hcaptcha.js'\nimport { callAsync } from '../lib/util/function.js'\nimport { constantTime } from '../lib/util/time.js'\nimport type { OAuthHooks, RequestMetadata } from '../oauth-hooks.js'\nimport type { Customization } from '../oauth-provider.js'\nimport type {\n  Account,\n  AccountStore,\n  AuthorizedClientData,\n  DeleteAccountConfirmInput,\n  DeleteAccountRequestInput,\n  DeviceAccount,\n  HandleString,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateHandleData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from './account-store.js'\nimport type { SignInData } from './sign-in-data.js'\nimport type { SignUpInput } from './sign-up-input.js'\n\nconst TIMING_ATTACK_MITIGATION_DELAY = 400\nconst BRUTE_FORCE_MITIGATION_DELAY = 300\n\n// @TODO Add rate limit to all the OAuth routes.\n\nexport class AccountManager {\n  protected readonly inviteCodeRequired: boolean\n  protected readonly hcaptchaClient?: HCaptchaClient\n\n  constructor(\n    issuer: OAuthIssuerIdentifier,\n    protected readonly store: AccountStore,\n    protected readonly hooks: OAuthHooks,\n    customization: Customization,\n  ) {\n    this.inviteCodeRequired = customization.inviteCodeRequired !== false\n    this.hcaptchaClient = customization.hcaptcha\n      ? new HCaptchaClient(new URL(issuer).hostname, customization.hcaptcha)\n      : undefined\n  }\n\n  protected async processHcaptchaToken(\n    input: SignUpInput,\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n  ): Promise<HcaptchaVerifyResult | undefined> {\n    if (!this.hcaptchaClient) {\n      return undefined\n    }\n\n    if (!input.hcaptchaToken) {\n      throw new InvalidRequestError('hCaptcha token is required')\n    }\n\n    const tokens = this.hcaptchaClient.buildClientTokens(\n      deviceMetadata.ipAddress,\n      input.handle,\n      deviceMetadata.userAgent,\n    )\n\n    const result = await this.hcaptchaClient\n      .verify('signup', input.hcaptchaToken, deviceMetadata.ipAddress, tokens)\n      .catch((err) => {\n        throw InvalidRequestError.from(err, 'hCaptcha verification failed')\n      })\n\n    await this.hooks.onHcaptchaResult?.call(null, {\n      input,\n      deviceId,\n      deviceMetadata,\n      tokens,\n      result,\n    })\n\n    try {\n      this.hcaptchaClient.checkVerifyResult(result, tokens)\n    } catch (err) {\n      throw InvalidRequestError.from(err, 'hCaptcha verification failed')\n    }\n\n    return result\n  }\n\n  protected async enforceInviteCode(\n    input: SignUpInput,\n    _deviceId: DeviceId,\n    _deviceMetadata: RequestMetadata,\n  ): Promise<string | undefined> {\n    if (!this.inviteCodeRequired) {\n      return undefined\n    }\n\n    if (!input.inviteCode) {\n      throw new InvalidRequestError('Invite code is required')\n    }\n\n    return input.inviteCode\n  }\n\n  protected async buildSignupData(\n    input: SignUpInput,\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n  ): Promise<SignUpData> {\n    const [hcaptchaResult, inviteCode] = await Promise.all([\n      this.processHcaptchaToken(input, deviceId, deviceMetadata),\n      this.enforceInviteCode(input, deviceId, deviceMetadata),\n    ])\n\n    return { ...input, hcaptchaResult, inviteCode }\n  }\n\n  public async createAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: SignUpInput,\n    clientId?: ClientId,\n  ): Promise<Account> {\n    return constantTime(BRUTE_FORCE_MITIGATION_DELAY, async () => {\n      await this.hooks.onSignUpAttempt?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n        clientId,\n      })\n\n      const data = await this.buildSignupData(input, deviceId, deviceMetadata)\n\n      const account = await callAsync(() =>\n        this.store.createAccount(data),\n      ).catch((err) => {\n        throw InvalidRequestError.from(err, 'Account creation failed')\n      })\n\n      try {\n        await this.hooks.onSignedUp?.call(null, {\n          data,\n          account,\n          deviceId,\n          deviceMetadata,\n          clientId,\n        })\n\n        return account\n      } catch (err) {\n        await this.removeDeviceAccount(deviceId, account.did)\n\n        throw InvalidRequestError.from(\n          err,\n          'The account was successfully created but something went wrong, try signing-in.',\n        )\n      }\n    })\n  }\n\n  public async authenticateAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    data: SignInData,\n    clientId?: ClientId,\n  ): Promise<Account> {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      await this.hooks.onSignInAttempt?.call(null, {\n        data,\n        deviceId,\n        deviceMetadata,\n        clientId,\n      })\n\n      const account = await callAsync(() =>\n        this.store.authenticateAccount(data),\n      ).catch(async (err) => {\n        // Only notify for credential failures (e.g. unknown identifier, wrong\n        // password). Server errors and flows that require an additional factor\n        // (e.g. SecondAuthenticationFactorRequiredError) are not \"failed\n        // sign-ins\" and do not trigger the hook.\n        if (err instanceof InvalidRequestError) {\n          // Stores that throw the more specific `InvalidCredentialsError`\n          // can attach the matched subject identifier to distinguish\n          // \"identifier known, password wrong\" from \"identifier unknown\".\n          // This information is only exposed to the hook and is never\n          // surfaced to the client.\n          const isCredentialsError = err instanceof InvalidCredentialsError\n          const did = isCredentialsError ? (err.did ?? null) : null\n\n          // Swallow any error from the hook itself so that it does not mask\n          // the underlying authentication failure being reported.\n          try {\n            await this.hooks.onSignInFailed?.call(null, {\n              data,\n              error: err,\n              did,\n              deviceId,\n              deviceMetadata,\n              clientId,\n            })\n          } catch {\n            // noop\n          }\n\n          if (isCredentialsError) {\n            // Defensively downgrade to a plain InvalidRequestError\n            throw new InvalidRequestError(err.error_description)\n          }\n        }\n\n        throw err\n      })\n\n      await this.hooks.onSignedIn?.call(null, {\n        data,\n        account,\n        deviceId,\n        deviceMetadata,\n        clientId,\n      })\n\n      return account\n    }).catch((err) => {\n      throw InvalidRequestError.from(\n        err,\n        'Unable to sign-in due to an unexpected server error',\n      )\n    })\n  }\n\n  public async upsertDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Promise<void> {\n    await this.store.upsertDeviceAccount(deviceId, did)\n  }\n\n  public async getDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Promise<DeviceAccount> {\n    const deviceAccount = await this.store.getDeviceAccount(deviceId, did)\n    if (!deviceAccount) throw new InvalidRequestError(`Account not found`)\n\n    return deviceAccount\n  }\n\n  public async setAuthorizedClient(\n    account: Account,\n    client: Client,\n    data: AuthorizedClientData,\n  ): Promise<void> {\n    // \"Loopback\" clients are not distinguishable from one another.\n    if (isOAuthClientIdLoopback(client.id)) return\n\n    await this.store.setAuthorizedClient(account.did, client.id, data)\n  }\n\n  public async getAccount(did: Did) {\n    return this.store.getAccount(did)\n  }\n\n  public async removeDeviceAccount(deviceId: DeviceId, did: Did) {\n    return this.store.removeDeviceAccount(deviceId, did)\n  }\n\n  public async listDeviceAccounts(\n    deviceId: DeviceId,\n  ): Promise<DeviceAccount[]> {\n    const deviceAccounts = await this.store.listDeviceAccounts({\n      deviceId,\n    })\n\n    return deviceAccounts // Fool proof\n      .filter((deviceAccount) => deviceAccount.deviceId === deviceId)\n  }\n\n  public async listAccountDevices(did: Did): Promise<DeviceAccount[]> {\n    const deviceAccounts = await this.store.listDeviceAccounts({\n      did,\n    })\n\n    return deviceAccounts // Fool proof\n      .filter((deviceAccount) => deviceAccount.account.did === did)\n  }\n\n  public async resetPasswordRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: ResetPasswordRequestInput,\n  ) {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      await this.hooks.onResetPasswordRequest?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n      })\n\n      const account = await this.store.resetPasswordRequest(input)\n\n      // @NOTE Do not throw here, to prevent user enumeration\n\n      await this.hooks.onResetPasswordRequested?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n        account,\n      })\n    })\n  }\n\n  public async resetPasswordConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: ResetPasswordConfirmInput,\n  ) {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      await this.hooks.onResetPasswordConfirm?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n      })\n\n      const account = await this.store.resetPasswordConfirm(input)\n\n      if (!account) {\n        throw new InvalidRequestError('Invalid token')\n      }\n\n      await this.hooks.onResetPasswordConfirmed?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n        account,\n      })\n\n      return account\n    })\n  }\n\n  public async verifyHandleAvailability(handle: HandleString): Promise<void> {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      return this.store.verifyHandleAvailability(handle)\n    })\n  }\n\n  public async updateEmailRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: UpdateEmailRequestInput,\n    account: Account,\n  ): Promise<{ tokenRequired: boolean }> {\n    await this.hooks.onChangeEmailRequest?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const { tokenRequired } = await this.store.updateEmailRequest(input)\n\n    await this.hooks.onChangeEmailRequested?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    return { tokenRequired: tokenRequired === true }\n  }\n\n  public async updateEmailConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: UpdateEmailConfirmInput,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onUpdateEmailConfirm?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const updatedAccount = await this.store.updateEmailConfirm(input)\n\n    if (!updatedAccount) {\n      throw new InvalidRequestError('Invalid token')\n    }\n\n    await this.hooks.onUpdateEmailConfirmed?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account: updatedAccount,\n      prevAccount: account,\n    })\n\n    return updatedAccount\n  }\n\n  public async verifyEmailRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: VerifyEmailRequestInput,\n    account: Account,\n  ): Promise<void> {\n    await this.hooks.onVerifyEmailRequest?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n      input,\n    })\n\n    await this.store.verifyEmailRequest(input)\n\n    await this.hooks.onVerifyEmailRequested?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n      input,\n    })\n  }\n\n  public async verifyEmailConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: VerifyEmailConfirmInput,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onVerifyEmailConfirm?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n      input,\n    })\n\n    const updatedAccount = await this.store.verifyEmailConfirm(input)\n\n    if (!updatedAccount) {\n      throw new InvalidRequestError('Invalid token')\n    }\n\n    await this.hooks.onVerifyEmailConfirmed?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account: updatedAccount,\n      input,\n    })\n\n    return updatedAccount\n  }\n\n  public async updateHandle(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: UpdateHandleData,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onUpdateHandle?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const updatedAccount = await this.store.updateHandle(input)\n\n    await this.hooks.onUpdatedHandle?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account: updatedAccount,\n    })\n\n    return updatedAccount\n  }\n\n  public async deactivateAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onDeactivateAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n\n    const updatedAccount = await callAsync(() =>\n      this.store.deactivateAccount({\n        did: account.did,\n        // @TODO support setting this from the UI/API\n        deleteAfter: undefined,\n      }),\n    ).catch((err) => {\n      throw InvalidRequestError.from(err, 'Account deactivation failed')\n    })\n\n    await this.hooks.onDeactivatedAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account: updatedAccount,\n    })\n\n    return updatedAccount\n  }\n\n  public async reactivateAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onReactivateAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n\n    const updatedAccount = await callAsync(() =>\n      this.store.reactivateAccount({ did: account.did }),\n    ).catch((err) => {\n      throw InvalidRequestError.from(err, 'Account reactivation failed')\n    })\n\n    await this.hooks.onReactivatedAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account: updatedAccount,\n    })\n\n    return updatedAccount\n  }\n\n  public async deleteAccountRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: DeleteAccountRequestInput,\n    account: Account,\n  ): Promise<void> {\n    await this.hooks.onDeleteAccountRequest?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n\n    await this.store.deleteAccountRequest(input)\n\n    await this.hooks.onDeleteAccountRequested?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n  }\n\n  public async deleteAccountConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: DeleteAccountConfirmInput,\n    account: Account,\n  ): Promise<void> {\n    return constantTime(BRUTE_FORCE_MITIGATION_DELAY, async () => {\n      await this.hooks.onDeleteAccountConfirm?.call(null, {\n        deviceId,\n        deviceMetadata,\n        account,\n      })\n\n      await callAsync(() => this.store.deleteAccountConfirm(input)).catch(\n        (err) => {\n          throw InvalidRequestError.from(err, 'Account deletion failed')\n        },\n      )\n\n      await this.hooks.onDeleteAccountConfirmed?.call(null, {\n        deviceId,\n        deviceMetadata,\n        account,\n        input,\n      })\n    })\n  }\n}\n"]}
+{"version":3,"file":"account-manager.js","sourceRoot":"","sources":["../../src/account/account-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,cAAc,EAA6B,MAAM,oBAAoB,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAyBlD,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAC1C,MAAM,4BAA4B,GAAG,GAAG,CAAA;AAExC,gDAAgD;AAEhD,MAAM,OAAO,cAAc;IAIzB,YACE,MAA6B,EACV,KAAmB,EACnB,KAAiB,EACpC,aAA4B;qBAFT,KAAK;qBACL,KAAK;QAGxB,IAAI,CAAC,kBAAkB,GAAG,aAAa,CAAC,kBAAkB,KAAK,KAAK,CAAA;QACpE,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ;YAC1C,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;YACtE,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAES,KAAK,CAAC,oBAAoB,CAClC,KAAkB,EAClB,QAAkB,EAClB,cAA+B;QAE/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAClD,cAAc,CAAC,SAAS,EACxB,KAAK,CAAC,MAAM,EACZ,cAAc,CAAC,SAAS,CACzB,CAAA;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc;aACrC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC;aACvE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;QACrE,CAAC,CAAC,CAAA;QAEJ,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC5C,KAAK;YACL,QAAQ;YACR,cAAc;YACd,MAAM;YACN,MAAM;SACP,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,KAAkB,EAClB,SAAmB,EACnB,eAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAA;QAC1D,CAAC;QAED,OAAO,KAAK,CAAC,UAAU,CAAA;IACzB,CAAC;IAES,KAAK,CAAC,eAAe,CAC7B,KAAkB,EAClB,QAAkB,EAClB,cAA+B;QAE/B,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC;YAC1D,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC;SACxD,CAAC,CAAA;QAEF,OAAO,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;IACjD,CAAC;IAEM,KAAK,CAAC,aAAa,CACxB,QAAkB,EAClB,cAA+B,EAC/B,KAAkB,EAClB,QAAmB;QAEnB,OAAO,YAAY,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC3C,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,QAAQ;aACT,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;YAExE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAC/B,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACd,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;YAChE,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE;oBACtC,IAAI;oBACJ,OAAO;oBACP,QAAQ;oBACR,cAAc;oBACd,QAAQ;iBACT,CAAC,CAAA;gBAEF,OAAO,OAAO,CAAA;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;gBAErD,MAAM,mBAAmB,CAAC,IAAI,CAC5B,GAAG,EACH,gFAAgF,CACjF,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,QAAkB,EAClB,cAA+B,EAC/B,IAAgB,EAChB,QAAmB;QAEnB,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC3C,IAAI;gBACJ,QAAQ;gBACR,cAAc;gBACd,QAAQ;aACT,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CACrC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,sEAAsE;gBACtE,uEAAuE;gBACvE,yDAAyD;gBACzD,EAAE;gBACF,mEAAmE;gBACnE,oEAAoE;gBACpE,uEAAuE;gBACvE,uEAAuE;gBACvE,8DAA8D;gBAC9D,YAAY;gBACZ,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;oBACvC,gEAAgE;oBAChE,2DAA2D;oBAC3D,gEAAgE;oBAChE,4DAA4D;oBAC5D,0BAA0B;oBAC1B,MAAM,kBAAkB,GAAG,GAAG,YAAY,uBAAuB,CAAA;oBACjE,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;oBAEzD,kEAAkE;oBAClE,wDAAwD;oBACxD,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE;4BAC1C,IAAI;4BACJ,KAAK,EAAE,GAAG;4BACV,GAAG;4BACH,QAAQ;4BACR,cAAc;4BACd,QAAQ;yBACT,CAAC,CAAA;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO;oBACT,CAAC;oBAED,IAAI,kBAAkB,EAAE,CAAC;wBACvB,uDAAuD;wBACvD,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;oBACtD,CAAC;gBACH,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE;gBACtC,IAAI;gBACJ,OAAO;gBACP,QAAQ;gBACR,cAAc;gBACd,QAAQ;aACT,CAAC,CAAA;YAEF,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,mBAAmB,CAAC,IAAI,CAC5B,GAAG,EACH,qDAAqD,CACtD,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,QAAkB,EAClB,GAAQ;QAER,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACrD,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAkB,EAClB,GAAQ;QAER,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QACtE,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QAEtE,OAAO,aAAa,CAAA;IACtB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,OAAgB,EAChB,MAAc,EACd,IAA0B;QAE1B,+DAA+D;QAC/D,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAM;QAE9C,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACpE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,GAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAQ;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACtD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB;QAElB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACzD,QAAQ;SACT,CAAC,CAAA;QAEF,OAAO,cAAc,CAAC,aAAa;aAChC,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;IACnE,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,GAAQ;QACtC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACzD,GAAG;SACJ,CAAC,CAAA;QAEF,OAAO,cAAc,CAAC,aAAa;aAChC,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IACjE,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC;QAEhC,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,KAAK;gBACL,QAAQ;gBACR,cAAc;aACf,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YAE5D,uDAAuD;YAEvD,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,OAAO;aACR,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC;QAEhC,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,KAAK;gBACL,QAAQ;gBACR,cAAc;aACf,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;YAChD,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,OAAO;aACR,CAAC,CAAA;YAEF,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,wBAAwB,CAAC,MAAoB;QACxD,OAAO,YAAY,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAEpE,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,OAAO,EAAE,aAAa,EAAE,aAAa,KAAK,IAAI,EAAE,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO,EAAE,cAAc;YACvB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAE1C,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,cAA+B,EAC/B,KAA8B,EAC9B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK;SACN,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,OAAO,EAAE,cAAc;YACvB,KAAK;SACN,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAChC,QAAkB,EAClB,cAA+B,EAC/B,KAAiC,EACjC,OAAgB;QAEhB,kBAAkB;QAClB,IAAI,OAAO,CAAC,eAAe;YAAE,OAAO,OAAO,CAAA;QAE3C,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAI,CAAC,IAAI,EAAE;YACnD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAEpE,IAAI,cAAc,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,QAAQ;gBACR,cAAc;gBACd,KAAK;gBACL,OAAO,EAAE,cAAc;aACxB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,sBAAsB,CACjC,QAAkB,EAClB,cAA+B,EAC/B,KAAkC,EAClC,OAAgB;QAEhB,mBAAmB;QACnB,IAAI,CAAC,OAAO,CAAC,eAAe;YAAE,OAAO,OAAO,CAAA;QAE5C,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;YACpD,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAA;QAErE,IAAI,cAAc,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACrD,QAAQ;gBACR,cAAc;gBACd,KAAK;gBACL,OAAO,EAAE,cAAc;aACxB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,QAAkB,EAClB,cAA+B,EAC/B,KAAuB,EACvB,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE;YAC1C,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QAE3D,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3C,QAAQ;YACR,cAAc;YACd,KAAK;YACL,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,QAAkB,EAClB,cAA+B,EAC/B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC/C,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAC1C,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,6CAA6C;YAC7C,WAAW,EAAE,SAAS;SACvB,CAAC,CACH,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAC5B,QAAkB,EAClB,cAA+B,EAC/B,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE;YAC/C,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAC1C,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CACnD,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE;YAChD,QAAQ;YACR,cAAc;YACd,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,OAAO,cAAc,CAAA;IACvB,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC,EAChC,OAAgB;QAEhB,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;YAClD,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAE5C,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;YACpD,QAAQ;YACR,cAAc;YACd,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,QAAkB,EAClB,cAA+B,EAC/B,KAAgC,EAChC,OAAgB;QAEhB,OAAO,YAAY,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,QAAQ;gBACR,cAAc;gBACd,OAAO;aACR,CAAC,CAAA;YAEF,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CACjE,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;YAChE,CAAC,CACF,CAAA;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,IAAI,EAAE;gBACpD,QAAQ;gBACR,cAAc;gBACd,OAAO;gBACP,KAAK;aACN,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import type { Did } from '@atproto/did'\nimport {\n  type OAuthIssuerIdentifier,\n  isOAuthClientIdLoopback,\n} from '@atproto/oauth-types'\nimport type { ClientId } from '../client/client-id.js'\nimport type { Client } from '../client/client.js'\nimport type { DeviceId } from '../device/device-id.js'\nimport { InvalidCredentialsError } from '../errors/invalid-credentials-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { HCaptchaClient, type HcaptchaVerifyResult } from '../lib/hcaptcha.js'\nimport { callAsync } from '../lib/util/function.js'\nimport { constantTime } from '../lib/util/time.js'\nimport type { OAuthHooks, RequestMetadata } from '../oauth-hooks.js'\nimport type { Customization } from '../oauth-provider.js'\nimport type {\n  Account,\n  AccountStore,\n  AuthorizedClientData,\n  DeleteAccountConfirmInput,\n  DeleteAccountRequestInput,\n  DeviceAccount,\n  DisableEmailAuthFactorInput,\n  EnableEmailAuthFactorInput,\n  HandleString,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateHandleData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from './account-store.js'\nimport type { SignInData } from './sign-in-data.js'\nimport type { SignUpInput } from './sign-up-input.js'\n\nconst TIMING_ATTACK_MITIGATION_DELAY = 400\nconst BRUTE_FORCE_MITIGATION_DELAY = 300\n\n// @TODO Add rate limit to all the OAuth routes.\n\nexport class AccountManager {\n  protected readonly inviteCodeRequired: boolean\n  protected readonly hcaptchaClient?: HCaptchaClient\n\n  constructor(\n    issuer: OAuthIssuerIdentifier,\n    protected readonly store: AccountStore,\n    protected readonly hooks: OAuthHooks,\n    customization: Customization,\n  ) {\n    this.inviteCodeRequired = customization.inviteCodeRequired !== false\n    this.hcaptchaClient = customization.hcaptcha\n      ? new HCaptchaClient(new URL(issuer).hostname, customization.hcaptcha)\n      : undefined\n  }\n\n  protected async processHcaptchaToken(\n    input: SignUpInput,\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n  ): Promise<HcaptchaVerifyResult | undefined> {\n    if (!this.hcaptchaClient) {\n      return undefined\n    }\n\n    if (!input.hcaptchaToken) {\n      throw new InvalidRequestError('hCaptcha token is required')\n    }\n\n    const tokens = this.hcaptchaClient.buildClientTokens(\n      deviceMetadata.ipAddress,\n      input.handle,\n      deviceMetadata.userAgent,\n    )\n\n    const result = await this.hcaptchaClient\n      .verify('signup', input.hcaptchaToken, deviceMetadata.ipAddress, tokens)\n      .catch((err) => {\n        throw InvalidRequestError.from(err, 'hCaptcha verification failed')\n      })\n\n    await this.hooks.onHcaptchaResult?.call(null, {\n      input,\n      deviceId,\n      deviceMetadata,\n      tokens,\n      result,\n    })\n\n    try {\n      this.hcaptchaClient.checkVerifyResult(result, tokens)\n    } catch (err) {\n      throw InvalidRequestError.from(err, 'hCaptcha verification failed')\n    }\n\n    return result\n  }\n\n  protected async enforceInviteCode(\n    input: SignUpInput,\n    _deviceId: DeviceId,\n    _deviceMetadata: RequestMetadata,\n  ): Promise<string | undefined> {\n    if (!this.inviteCodeRequired) {\n      return undefined\n    }\n\n    if (!input.inviteCode) {\n      throw new InvalidRequestError('Invite code is required')\n    }\n\n    return input.inviteCode\n  }\n\n  protected async buildSignupData(\n    input: SignUpInput,\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n  ): Promise<SignUpData> {\n    const [hcaptchaResult, inviteCode] = await Promise.all([\n      this.processHcaptchaToken(input, deviceId, deviceMetadata),\n      this.enforceInviteCode(input, deviceId, deviceMetadata),\n    ])\n\n    return { ...input, hcaptchaResult, inviteCode }\n  }\n\n  public async createAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: SignUpInput,\n    clientId?: ClientId,\n  ): Promise<Account> {\n    return constantTime(BRUTE_FORCE_MITIGATION_DELAY, async () => {\n      await this.hooks.onSignUpAttempt?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n        clientId,\n      })\n\n      const data = await this.buildSignupData(input, deviceId, deviceMetadata)\n\n      const account = await callAsync(() =>\n        this.store.createAccount(data),\n      ).catch((err) => {\n        throw InvalidRequestError.from(err, 'Account creation failed')\n      })\n\n      try {\n        await this.hooks.onSignedUp?.call(null, {\n          data,\n          account,\n          deviceId,\n          deviceMetadata,\n          clientId,\n        })\n\n        return account\n      } catch (err) {\n        await this.removeDeviceAccount(deviceId, account.did)\n\n        throw InvalidRequestError.from(\n          err,\n          'The account was successfully created but something went wrong, try signing-in.',\n        )\n      }\n    })\n  }\n\n  public async authenticateAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    data: SignInData,\n    clientId?: ClientId,\n  ): Promise<Account> {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      await this.hooks.onSignInAttempt?.call(null, {\n        data,\n        deviceId,\n        deviceMetadata,\n        clientId,\n      })\n\n      const account = await callAsync(() =>\n        this.store.authenticateAccount(data),\n      ).catch(async (err) => {\n        // Only notify for credential failures (e.g. unknown identifier, wrong\n        // password). Server errors and flows that require an additional factor\n        // are not \"failed sign-ins\" and do not trigger the hook.\n        //\n        // @NOTE That exclusion rests on the error hierarchy rather than an\n        // explicit guard: `SecondAuthenticationFactorRequiredError` extends\n        // `OAuthError` directly, so it misses this branch and falls through to\n        // the rethrow below. Re-parenting it under `InvalidRequestError` would\n        // silently start reporting second-factor challenges as failed\n        // sign-ins.\n        if (err instanceof InvalidRequestError) {\n          // Stores that throw the more specific `InvalidCredentialsError`\n          // can attach the matched subject identifier to distinguish\n          // \"identifier known, password wrong\" from \"identifier unknown\".\n          // This information is only exposed to the hook and is never\n          // surfaced to the client.\n          const isCredentialsError = err instanceof InvalidCredentialsError\n          const did = isCredentialsError ? (err.did ?? null) : null\n\n          // Swallow any error from the hook itself so that it does not mask\n          // the underlying authentication failure being reported.\n          try {\n            await this.hooks.onSignInFailed?.call(null, {\n              data,\n              error: err,\n              did,\n              deviceId,\n              deviceMetadata,\n              clientId,\n            })\n          } catch {\n            // noop\n          }\n\n          if (isCredentialsError) {\n            // Defensively downgrade to a plain InvalidRequestError\n            throw new InvalidRequestError(err.error_description)\n          }\n        }\n\n        throw err\n      })\n\n      await this.hooks.onSignedIn?.call(null, {\n        data,\n        account,\n        deviceId,\n        deviceMetadata,\n        clientId,\n      })\n\n      return account\n    }).catch((err) => {\n      throw InvalidRequestError.from(\n        err,\n        'Unable to sign-in due to an unexpected server error',\n      )\n    })\n  }\n\n  public async upsertDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Promise<void> {\n    await this.store.upsertDeviceAccount(deviceId, did)\n  }\n\n  public async getDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Promise<DeviceAccount> {\n    const deviceAccount = await this.store.getDeviceAccount(deviceId, did)\n    if (!deviceAccount) throw new InvalidRequestError(`Account not found`)\n\n    return deviceAccount\n  }\n\n  public async setAuthorizedClient(\n    account: Account,\n    client: Client,\n    data: AuthorizedClientData,\n  ): Promise<void> {\n    // \"Loopback\" clients are not distinguishable from one another.\n    if (isOAuthClientIdLoopback(client.id)) return\n\n    await this.store.setAuthorizedClient(account.did, client.id, data)\n  }\n\n  public async getAccount(did: Did) {\n    return this.store.getAccount(did)\n  }\n\n  public async removeDeviceAccount(deviceId: DeviceId, did: Did) {\n    return this.store.removeDeviceAccount(deviceId, did)\n  }\n\n  public async listDeviceAccounts(\n    deviceId: DeviceId,\n  ): Promise<DeviceAccount[]> {\n    const deviceAccounts = await this.store.listDeviceAccounts({\n      deviceId,\n    })\n\n    return deviceAccounts // Fool proof\n      .filter((deviceAccount) => deviceAccount.deviceId === deviceId)\n  }\n\n  public async listAccountDevices(did: Did): Promise<DeviceAccount[]> {\n    const deviceAccounts = await this.store.listDeviceAccounts({\n      did,\n    })\n\n    return deviceAccounts // Fool proof\n      .filter((deviceAccount) => deviceAccount.account.did === did)\n  }\n\n  public async resetPasswordRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: ResetPasswordRequestInput,\n  ) {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      await this.hooks.onResetPasswordRequest?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n      })\n\n      const account = await this.store.resetPasswordRequest(input)\n\n      // @NOTE Do not throw here, to prevent user enumeration\n\n      await this.hooks.onResetPasswordRequested?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n        account,\n      })\n    })\n  }\n\n  public async resetPasswordConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: ResetPasswordConfirmInput,\n  ) {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      await this.hooks.onResetPasswordConfirm?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n      })\n\n      const account = await this.store.resetPasswordConfirm(input)\n\n      if (!account) {\n        throw new InvalidRequestError('Invalid token')\n      }\n\n      await this.hooks.onResetPasswordConfirmed?.call(null, {\n        input,\n        deviceId,\n        deviceMetadata,\n        account,\n      })\n\n      return account\n    })\n  }\n\n  public async verifyHandleAvailability(handle: HandleString): Promise<void> {\n    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {\n      return this.store.verifyHandleAvailability(handle)\n    })\n  }\n\n  public async updateEmailRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: UpdateEmailRequestInput,\n    account: Account,\n  ): Promise<{ tokenRequired: boolean }> {\n    await this.hooks.onChangeEmailRequest?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const { tokenRequired } = await this.store.updateEmailRequest(input)\n\n    await this.hooks.onChangeEmailRequested?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    return { tokenRequired: tokenRequired === true }\n  }\n\n  public async updateEmailConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: UpdateEmailConfirmInput,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onUpdateEmailConfirm?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const updatedAccount = await this.store.updateEmailConfirm(input)\n\n    if (!updatedAccount) {\n      throw new InvalidRequestError('Invalid token')\n    }\n\n    await this.hooks.onUpdateEmailConfirmed?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account: updatedAccount,\n      prevAccount: account,\n    })\n\n    return updatedAccount\n  }\n\n  public async verifyEmailRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: VerifyEmailRequestInput,\n    account: Account,\n  ): Promise<void> {\n    await this.hooks.onVerifyEmailRequest?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n      input,\n    })\n\n    await this.store.verifyEmailRequest(input)\n\n    await this.hooks.onVerifyEmailRequested?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n      input,\n    })\n  }\n\n  public async verifyEmailConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: VerifyEmailConfirmInput,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onVerifyEmailConfirm?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n      input,\n    })\n\n    const updatedAccount = await this.store.verifyEmailConfirm(input)\n\n    if (!updatedAccount) {\n      throw new InvalidRequestError('Invalid token')\n    }\n\n    await this.hooks.onVerifyEmailConfirmed?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account: updatedAccount,\n      input,\n    })\n\n    return updatedAccount\n  }\n\n  public async enableEmailAuthFactor(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: EnableEmailAuthFactorInput,\n    account: Account,\n  ): Promise<Account> {\n    // Already enabled\n    if (account.emailAuthFactor) return account\n\n    await this.hooks.onEnableEmailAuthFactor?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const updatedAccount = await this.store.enableEmailAuthFactor(input)\n\n    if (updatedAccount.emailAuthFactor !== account.emailAuthFactor) {\n      await this.hooks.onEnabledEmailAuthFactor?.call(null, {\n        deviceId,\n        deviceMetadata,\n        input,\n        account: updatedAccount,\n      })\n    }\n\n    return updatedAccount\n  }\n\n  public async disableEmailAuthFactor(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: DisableEmailAuthFactorInput,\n    account: Account,\n  ): Promise<Account> {\n    // Already disabled\n    if (!account.emailAuthFactor) return account\n\n    await this.hooks.onDisableEmailAuthFactor?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const updatedAccount = await this.store.disableEmailAuthFactor(input)\n\n    if (updatedAccount.emailAuthFactor !== account.emailAuthFactor) {\n      await this.hooks.onDisabledEmailAuthFactor?.call(null, {\n        deviceId,\n        deviceMetadata,\n        input,\n        account: updatedAccount,\n      })\n    }\n\n    return updatedAccount\n  }\n\n  public async updateHandle(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: UpdateHandleData,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onUpdateHandle?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account,\n    })\n\n    const updatedAccount = await this.store.updateHandle(input)\n\n    await this.hooks.onUpdatedHandle?.call(null, {\n      deviceId,\n      deviceMetadata,\n      input,\n      account: updatedAccount,\n    })\n\n    return updatedAccount\n  }\n\n  public async deactivateAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onDeactivateAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n\n    const updatedAccount = await callAsync(() =>\n      this.store.deactivateAccount({\n        did: account.did,\n        // @TODO support setting this from the UI/API\n        deleteAfter: undefined,\n      }),\n    ).catch((err) => {\n      throw InvalidRequestError.from(err, 'Account deactivation failed')\n    })\n\n    await this.hooks.onDeactivatedAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account: updatedAccount,\n    })\n\n    return updatedAccount\n  }\n\n  public async reactivateAccount(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    account: Account,\n  ): Promise<Account> {\n    await this.hooks.onReactivateAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n\n    const updatedAccount = await callAsync(() =>\n      this.store.reactivateAccount({ did: account.did }),\n    ).catch((err) => {\n      throw InvalidRequestError.from(err, 'Account reactivation failed')\n    })\n\n    await this.hooks.onReactivatedAccount?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account: updatedAccount,\n    })\n\n    return updatedAccount\n  }\n\n  public async deleteAccountRequest(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: DeleteAccountRequestInput,\n    account: Account,\n  ): Promise<void> {\n    await this.hooks.onDeleteAccountRequest?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n\n    await this.store.deleteAccountRequest(input)\n\n    await this.hooks.onDeleteAccountRequested?.call(null, {\n      deviceId,\n      deviceMetadata,\n      account,\n    })\n  }\n\n  public async deleteAccountConfirm(\n    deviceId: DeviceId,\n    deviceMetadata: RequestMetadata,\n    input: DeleteAccountConfirmInput,\n    account: Account,\n  ): Promise<void> {\n    return constantTime(BRUTE_FORCE_MITIGATION_DELAY, async () => {\n      await this.hooks.onDeleteAccountConfirm?.call(null, {\n        deviceId,\n        deviceMetadata,\n        account,\n      })\n\n      await callAsync(() => this.store.deleteAccountConfirm(input)).catch(\n        (err) => {\n          throw InvalidRequestError.from(err, 'Account deletion failed')\n        },\n      )\n\n      await this.hooks.onDeleteAccountConfirmed?.call(null, {\n        deviceId,\n        deviceMetadata,\n        account,\n        input,\n      })\n    })\n  }\n}\n"]}

package/dist/account/account-store.d.ts

@@ -1,5 +1,5 @@
 import type { Did } from '@atproto/did';
-import type { Account, ConfirmAccountDeletionInput, ConfirmEmailUpdateInput, ConfirmEmailVerificationInput, ConfirmResetPasswordInput, DeactivateAccountInput, InitiateAccountDeletionInput, InitiateEmailUpdateInput, InitiateEmailUpdateOutput, InitiateEmailVerificationInput, InitiatePasswordResetInput, ReactivateAccountInput, UpdateHandleInput } from '@atproto/oauth-provider-api';
+import type { Account, ConfirmAccountDeletionInput, ConfirmEmailUpdateInput, ConfirmEmailVerificationInput, ConfirmResetPasswordInput, DeactivateAccountInput, DisableEmailAuthFactorInput, EnableEmailAuthFactorInput, InitiateAccountDeletionInput, InitiateEmailUpdateInput, InitiateEmailUpdateOutput, InitiateEmailVerificationInput, InitiatePasswordResetInput, ReactivateAccountInput, UpdateHandleInput } from '@atproto/oauth-provider-api';
 import type { OAuthScope } from '@atproto/oauth-types';
 import type { DatetimeString, HandleString } from '@atproto/syntax';
 import type { ClientId } from '../client/client-id.js';
@@ -11,7 +11,7 @@ import type { HcaptchaVerifyResult } from '../lib/hcaptcha.js';
 import type { Awaitable } from '../lib/util/type.js';
 import type { InviteCode } from '../types/invite-code.js';
 import type { SignUpInput } from './sign-up-input.js';
-export type { Account, ClientId, DeviceData, DeviceId, Did, HandleString, HandleUnavailableReason, HcaptchaVerifyResult, InviteCode, OAuthScope, SessionId, SignUpInput, };
+export type { Account, ClientId, DeviceData, DeviceId, Did, DisableEmailAuthFactorInput, EnableEmailAuthFactorInput, HandleString, HandleUnavailableReason, HcaptchaVerifyResult, InviteCode, OAuthScope, SessionId, SignUpInput, };
 export type ResetPasswordRequestInput = InitiatePasswordResetInput;
 export type ResetPasswordConfirmInput = ConfirmResetPasswordInput;
 export type UpdateEmailRequestInput = InitiateEmailUpdateInput;
@@ -154,6 +154,39 @@ export interface AccountStore {
     updateEmailConfirm(data: UpdateEmailConfirmInput): Awaitable<Account | null>;
     verifyEmailRequest(data: VerifyEmailRequestInput): Awaitable<void>;
     verifyEmailConfirm(data: VerifyEmailConfirmInput): Awaitable<Account | null>;
+    /**
+     * Enables the email auth factor on the account.
+     *
+     * @returns the updated account, or `null` when the factor was already enabled
+     * (no-op).
+     *
+     * @note when `null` is returned (no-op), the "confirmed" hook is skipped, so
+     *  a repeat request is not counted as a fresh opt-in.
+     *
+     * @throws {InvalidRequestError} - To indicate enabling cannot take place due
+     * to mismatch of email or email not being verified.
+     */
+    enableEmailAuthFactor(data: EnableEmailAuthFactorInput): Awaitable<Account>;
+    /**
+     * Two-phase disable flow. When `token` is undefined and the factor is still
+     * enabled, an email-based OTP isÒ dispatched and `{ tokenRequired: true }` is
+     * returned (the account is unchanged, nothing has been disabled yet). Calling
+     * again with a valid `token` disables the factor and returns
+     * `{ tokenRequired: false }`. Disabling an already-disabled factor is an
+     * idempotent no-op that returns `{ tokenRequired: false }` without
+     * dispatching an email.
+     *
+     * `updatedAccount` is `null` in both cases where nothing changed — the
+     * OTP-dispatch phase and the already-disabled no-op — and an `Account` only
+     * once the factor has actually been turned off. Callers pair it with
+     * `tokenRequired` to decide whether to fire the "confirmed" hook.
+     *
+     * @throws {InvalidRequestError} - To indicate disabling cannot take place due
+     * to mismatch of email or email not being verified.
+     * @throws {SecondAuthenticationFactorRequiredError} - To indicate that a
+     * second authentication factor is required to complete the action.
+     */
+    disableEmailAuthFactor(data: DisableEmailAuthFactorInput): Awaitable<Account>;
     /**
      * @throws {HandleUnavailableError} - To indicate that the handle is already taken
      */

package/dist/account/account-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-store.d.ts","sourceRoot":"","sources":["../../src/account/account-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EACV,OAAO,EACP,2BAA2B,EAC3B,uBAAuB,EACvB,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGrD,YAAY,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,GACZ,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AAClE,MAAM,MAAM,yBAAyB,GAAG,yBAAyB,CAAA;AAEjE,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,yBAAyB,CAAA;AAChE,MAAM,MAAM,uBAAuB,GAAG,uBAAuB,CAAA;AAC7D,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,6BAA6B,CAAA;AACnE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG;IAC3D,WAAW,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CACzC,CAAA;AACD,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,CAAA;AAC1D,MAAM,MAAM,yBAAyB,GAAG,4BAA4B,CAAA;AACpE,MAAM,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AAEnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAC1E,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAA;AAEnE,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAElB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAA;IAEtB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;;OAGG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IAEpC;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAA;IAEf;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG;IACrC,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE1D;;;;;;;;;OASG;IACH,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAEtE;;OAEG;IACH,mBAAmB,CACjB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,oBAAoB,GACzB,SAAS,CAAC,IAAI,CAAC,CAAA;IAElB;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAA;QAChB,iBAAiB,EAAE,iBAAiB,CAAA;KACrC,CAAC,CAAA;IAEF;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAElE;;;;;;OAMG;IACH,gBAAgB,CACd,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAElC;;;;;OAKG;IACH,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAElE;;OAEG;IACH,kBAAkB,CAChB,MAAM,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAC5C,SAAS,CAAC,aAAa,EAAE,CAAC,CAAA;IAE7B,oBAAoB,CAClB,IAAI,EAAE,yBAAyB,GAC9B,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,CAAA;IAE5B,oBAAoB,CAClB,IAAI,EAAE,yBAAyB,GAC9B,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,CAAA;IAE5B,kBAAkB,CAChB,IAAI,EAAE,uBAAuB,GAC5B,SAAS,CAAC,wBAAwB,CAAC,CAAA;IACtC;;;;;OAKG;IACH,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE5E,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAClE,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE5E;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE/D;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAExD;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAElE;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAElE;;;;;OAKG;IACH,oBAAoB,CAAC,IAAI,EAAE,yBAAyB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAEtE;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAI,EAAE,yBAAyB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;CACvE;AAED,eAAO,MAAM,cAAc,yHAqBzB,CAAA;AAEF,wBAAgB,cAAc,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,GAAG,YAAY,CAKrE"}
+{"version":3,"file":"account-store.d.ts","sourceRoot":"","sources":["../../src/account/account-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,EACV,OAAO,EACP,2BAA2B,EAC3B,uBAAuB,EACvB,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,0BAA0B,EAC1B,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGrD,YAAY,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,GAAG,EACH,2BAA2B,EAC3B,0BAA0B,EAC1B,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,GACZ,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AAClE,MAAM,MAAM,yBAAyB,GAAG,yBAAyB,CAAA;AAEjE,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAA;AAC9D,MAAM,MAAM,wBAAwB,GAAG,yBAAyB,CAAA;AAChE,MAAM,MAAM,uBAAuB,GAAG,uBAAuB,CAAA;AAC7D,MAAM,MAAM,uBAAuB,GAAG,8BAA8B,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,6BAA6B,CAAA;AACnE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG;IAC3D,WAAW,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CACzC,CAAA;AACD,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,CAAA;AAC1D,MAAM,MAAM,yBAAyB,GAAG,4BAA4B,CAAA;AACpE,MAAM,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AAEnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAC1E,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAA;AAEnE,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAElB;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAA;IAEtB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;;OAGG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IAEpC;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAA;IAEf;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG;IACrC,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE1D;;;;;;;;;OASG;IACH,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAEtE;;OAEG;IACH,mBAAmB,CACjB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,oBAAoB,GACzB,SAAS,CAAC,IAAI,CAAC,CAAA;IAElB;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAA;QAChB,iBAAiB,EAAE,iBAAiB,CAAA;KACrC,CAAC,CAAA;IAEF;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAElE;;;;;;OAMG;IACH,gBAAgB,CACd,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAElC;;;;;OAKG;IACH,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAElE;;OAEG;IACH,kBAAkB,CAChB,MAAM,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAC5C,SAAS,CAAC,aAAa,EAAE,CAAC,CAAA;IAE7B,oBAAoB,CAClB,IAAI,EAAE,yBAAyB,GAC9B,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,CAAA;IAE5B,oBAAoB,CAClB,IAAI,EAAE,yBAAyB,GAC9B,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,CAAA;IAE5B,kBAAkB,CAChB,IAAI,EAAE,uBAAuB,GAC5B,SAAS,CAAC,wBAAwB,CAAC,CAAA;IACtC;;;;;OAKG;IACH,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE5E,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAClE,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE5E;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE3E;;;;;;;;;;;;;;;;;;OAkBG;IACH,sBAAsB,CAAC,IAAI,EAAE,2BAA2B,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAE7E;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE/D;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAExD;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAElE;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAElE;;;;;OAKG;IACH,oBAAoB,CAAC,IAAI,EAAE,yBAAyB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAEtE;;;;;;OAMG;IACH,oBAAoB,CAAC,IAAI,EAAE,yBAAyB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;CACvE;AAED,eAAO,MAAM,cAAc,yHAuBzB,CAAA;AAEF,wBAAgB,cAAc,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,GAAG,YAAY,CAKrE"}

package/dist/account/account-store.js

@@ -5,6 +5,8 @@ export const isAccountStore = buildInterfaceChecker([
     'deactivateAccount',
     'deleteAccountConfirm',
     'deleteAccountRequest',
+    'disableEmailAuthFactor',
+    'enableEmailAuthFactor',
     'getAccount',
     'getDeviceAccount',
     'listDeviceAccounts',

package/dist/account/account-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-store.js","sourceRoot":"","sources":["../../src/account/account-store.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAoP3D,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAe;IAChE,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;CAC3B,CAAC,CAAA;AAEF,MAAM,UAAU,cAAc,CAAI,cAAiB;IACjD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC","sourcesContent":["import type { Did } from '@atproto/did'\nimport type {\n  Account,\n  ConfirmAccountDeletionInput,\n  ConfirmEmailUpdateInput,\n  ConfirmEmailVerificationInput,\n  ConfirmResetPasswordInput,\n  DeactivateAccountInput,\n  InitiateAccountDeletionInput,\n  InitiateEmailUpdateInput,\n  InitiateEmailUpdateOutput,\n  InitiateEmailVerificationInput,\n  InitiatePasswordResetInput,\n  ReactivateAccountInput,\n  UpdateHandleInput,\n} from '@atproto/oauth-provider-api'\nimport type { OAuthScope } from '@atproto/oauth-types'\nimport type { DatetimeString, HandleString } from '@atproto/syntax'\nimport type { ClientId } from '../client/client-id.js'\nimport type { DeviceData } from '../device/device-data.js'\nimport type { DeviceId } from '../device/device-id.js'\nimport type { SessionId } from '../device/session-id.js'\nimport type { HandleUnavailableReason } from '../errors/handle-unavailable-error.js'\nimport type { HcaptchaVerifyResult } from '../lib/hcaptcha.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport { buildInterfaceChecker } from '../lib/util/type.js'\nimport type { InviteCode } from '../types/invite-code.js'\nimport type { SignUpInput } from './sign-up-input.js'\n\n// Export all types needed to implement the AccountStore interface\nexport type {\n  Account,\n  ClientId,\n  DeviceData,\n  DeviceId,\n  Did,\n  HandleString,\n  HandleUnavailableReason,\n  HcaptchaVerifyResult,\n  InviteCode,\n  OAuthScope,\n  SessionId,\n  SignUpInput,\n}\n\nexport type ResetPasswordRequestInput = InitiatePasswordResetInput\nexport type ResetPasswordConfirmInput = ConfirmResetPasswordInput\n\nexport type UpdateEmailRequestInput = InitiateEmailUpdateInput\nexport type UpdateEmailRequestOutput = InitiateEmailUpdateOutput\nexport type UpdateEmailConfirmInput = ConfirmEmailUpdateInput\nexport type VerifyEmailRequestInput = InitiateEmailVerificationInput\nexport type VerifyEmailConfirmInput = ConfirmEmailVerificationInput\nexport type UpdateHandleData = UpdateHandleInput\n\n/**\n * @NOTE `deleteAfter` is part of the store contract but is not (yet) exposed\n * over the API, hence the extension of {@link DeactivateAccountInput}.\n */\nexport type DeactivateAccountData = DeactivateAccountInput & {\n  deleteAfter?: DatetimeString | undefined\n}\nexport type ReactivateAccountData = ReactivateAccountInput\nexport type DeleteAccountRequestInput = InitiateAccountDeletionInput\nexport type DeleteAccountConfirmInput = ConfirmAccountDeletionInput\n\nexport type CreateAccountData = {\n  locale: string\n  email: string\n  password: string\n  handle: HandleString\n  inviteCode?: string | undefined\n}\n\nexport type AuthenticateAccountData = {\n  locale: string\n  password: string\n  username: string\n  emailOtp?: string | undefined\n}\n\nexport type AuthorizedClientData = { authorizedScopes: readonly string[] }\nexport type AuthorizedClients = Map<ClientId, AuthorizedClientData>\n\nexport type DeviceAccount = {\n  deviceId: DeviceId\n\n  /**\n   * The data associated with the device, created through the\n   * {@link DeviceStore}. This data is used to identify devices on which a user\n   * has logged in.\n   */\n  deviceData: DeviceData\n\n  /**\n   * The account associated with the device account.\n   */\n  account: Account\n\n  /**\n   * The list of clients that are authorized by the account, as created through\n   * the {@link AccountStore.setAuthorizedClient} method.\n   */\n  authorizedClients: AuthorizedClients\n\n  /**\n   * The date at which the device account was created. This value is currently\n   * not used.\n   */\n  createdAt: Date\n\n  /**\n   * The date at which the device account was last updated. This value is used\n   * to determine the date at which the user last authenticated on a device\n   */\n  updatedAt: Date\n}\n\nexport type SignUpData = SignUpInput & {\n  hcaptchaResult?: HcaptchaVerifyResult\n  inviteCode?: InviteCode\n}\n\nexport interface AccountStore {\n  /**\n   * @throws {HandleUnavailableError} - To indicate that the handle is already taken\n   * @throws {InvalidRequestError} - To indicate that some data is invalid\n   */\n  createAccount(data: CreateAccountData): Awaitable<Account>\n\n  /**\n   * @throws {InvalidCredentialsError} - When the credentials are not valid.\n   * Populate {@link InvalidCredentialsError.did} with the subject identifier\n   * when the identifier matched an existing account (e.g. wrong password for\n   * a known user); omit it when the identifier was not found. Throwing the\n   * generic {@link InvalidRequestError} is also accepted for backward\n   * compatibility but prevents the `onSignInFailed` hook from distinguishing\n   * the two cases.\n   * @throws {SecondAuthenticationFactorRequiredError} - To indicate that an {@link SecondAuthenticationFactorRequiredError.type} is required in the credentials\n   */\n  authenticateAccount(data: AuthenticateAccountData): Awaitable<Account>\n\n  /**\n   * Add a client & scopes to the list of authorized clients for the given account.\n   */\n  setAuthorizedClient(\n    did: Did,\n    clientId: ClientId,\n    data: AuthorizedClientData,\n  ): Awaitable<void>\n\n  /**\n   * @throws {InvalidRequestError} - When the credentials are not valid\n   */\n  getAccount(did: Did): Awaitable<{\n    account: Account\n    authorizedClients: AuthorizedClients\n  }>\n\n  /**\n   * @param data.requestId - If provided, the inserted account must be bound to\n   * that particular requestId.\n   *\n   * @note Whenever a particular device account is created, all **unbound**\n   * device accounts for the same `deviceId` & `sub` should be deleted.\n   *\n   * @note When a particular request is deleted (through\n   * {@link RequestStore.deleteRequest}), all accounts bound to that request\n   * should be deleted as well.\n   */\n  upsertDeviceAccount(deviceId: DeviceId, did: Did): Awaitable<void>\n\n  /**\n   * @param requestId - If provided, the result must either have the same\n   * requestId, or not be bound to a particular requestId. If `null`, the\n   * result must not be bound to a particular requestId.\n   * @throws {InvalidRequestError} - Instead of returning `null` in order to\n   * provide a custom error message\n   */\n  getDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Awaitable<DeviceAccount | null>\n\n  /**\n   * Removes *all* the unbound device-accounts associated with the given device\n   * & account.\n   *\n   * @note Noop if the device-account is not found.\n   */\n  removeDeviceAccount(deviceId: DeviceId, did: Did): Awaitable<void>\n\n  /**\n   * @returns **all** the device accounts matching the given `filter`.\n   */\n  listDeviceAccounts(\n    filter: { did: Did } | { deviceId: DeviceId },\n  ): Awaitable<DeviceAccount[]>\n\n  resetPasswordRequest(\n    data: ResetPasswordRequestInput,\n  ): Awaitable<null | Account>\n\n  resetPasswordConfirm(\n    data: ResetPasswordConfirmInput,\n  ): Awaitable<null | Account>\n\n  updateEmailRequest(\n    data: UpdateEmailRequestInput,\n  ): Awaitable<UpdateEmailRequestOutput>\n  /**\n   * Must trigger a verification email to be sent to the new email address, that\n   * will then be confirmed through {@link updateEmailConfirm}. The account's\n   * {@link Account['emailVerified'] emailVerified} field is expected to become\n   * `false` until the new email is confirmed.\n   */\n  updateEmailConfirm(data: UpdateEmailConfirmInput): Awaitable<Account | null>\n\n  verifyEmailRequest(data: VerifyEmailRequestInput): Awaitable<void>\n  verifyEmailConfirm(data: VerifyEmailConfirmInput): Awaitable<Account | null>\n\n  /**\n   * @throws {HandleUnavailableError} - To indicate that the handle is already taken\n   */\n  verifyHandleAvailability(handle: HandleString): Awaitable<void>\n\n  /**\n   * @throws {HandleUnavailableError} - To indicate that the handle is already taken\n   * @throws {InvalidRequestError} - To indicate that the handle is invalid or\n   * cannot be used\n   */\n  updateHandle(data: UpdateHandleData): Awaitable<Account>\n\n  /**\n   * Mark the account as deactivated. The account remains recoverable. Should\n   * be a no-op when the account is already deactivated.\n   *\n   * @throws {InvalidRequestError} - When the account cannot be deactivated\n   * (e.g. unknown account)\n   */\n  deactivateAccount(data: DeactivateAccountData): Awaitable<Account>\n\n  /**\n   * Reactivate a previously-deactivated account. Should be a no-op when the\n   * account is already active.\n   *\n   * @throws {InvalidRequestError} - When the account cannot be reactivated\n   * (e.g. unknown account)\n   */\n  reactivateAccount(data: ReactivateAccountData): Awaitable<Account>\n\n  /**\n   * Initiate account deletion: typically sends a confirmation token to the\n   * account's email address. The account is NOT deleted until\n   * {@link deleteAccountConfirm} is called with the matching token and the\n   * user's current password.\n   */\n  deleteAccountRequest(data: DeleteAccountRequestInput): Awaitable<void>\n\n  /**\n   * Finalize account deletion. Implementations MUST verify both the email\n   * confirmation `token` issued by {@link deleteAccountRequest} and the user's\n   * current `password` before deleting any data. Deletion is irreversible.\n   *\n   * @throws {InvalidRequestError} - When the token or password is invalid.\n   */\n  deleteAccountConfirm(data: DeleteAccountConfirmInput): Awaitable<void>\n}\n\nexport const isAccountStore = buildInterfaceChecker<AccountStore>([\n  'authenticateAccount',\n  'createAccount',\n  'deactivateAccount',\n  'deleteAccountConfirm',\n  'deleteAccountRequest',\n  'getAccount',\n  'getDeviceAccount',\n  'listDeviceAccounts',\n  'reactivateAccount',\n  'removeDeviceAccount',\n  'resetPasswordConfirm',\n  'resetPasswordRequest',\n  'setAuthorizedClient',\n  'updateEmailConfirm',\n  'updateEmailRequest',\n  'updateHandle',\n  'upsertDeviceAccount',\n  'verifyEmailConfirm',\n  'verifyEmailRequest',\n  'verifyHandleAvailability',\n])\n\nexport function asAccountStore<V>(implementation: V): V & AccountStore {\n  if (!implementation || !isAccountStore(implementation)) {\n    throw new Error('Invalid AccountStore implementation')\n  }\n  return implementation\n}\n"]}
+{"version":3,"file":"account-store.js","sourceRoot":"","sources":["../../src/account/account-store.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAyR3D,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAe;IAChE,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,YAAY;IACZ,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;CAC3B,CAAC,CAAA;AAEF,MAAM,UAAU,cAAc,CAAI,cAAiB;IACjD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC","sourcesContent":["import type { Did } from '@atproto/did'\nimport type {\n  Account,\n  ConfirmAccountDeletionInput,\n  ConfirmEmailUpdateInput,\n  ConfirmEmailVerificationInput,\n  ConfirmResetPasswordInput,\n  DeactivateAccountInput,\n  DisableEmailAuthFactorInput,\n  EnableEmailAuthFactorInput,\n  InitiateAccountDeletionInput,\n  InitiateEmailUpdateInput,\n  InitiateEmailUpdateOutput,\n  InitiateEmailVerificationInput,\n  InitiatePasswordResetInput,\n  ReactivateAccountInput,\n  UpdateHandleInput,\n} from '@atproto/oauth-provider-api'\nimport type { OAuthScope } from '@atproto/oauth-types'\nimport type { DatetimeString, HandleString } from '@atproto/syntax'\nimport type { ClientId } from '../client/client-id.js'\nimport type { DeviceData } from '../device/device-data.js'\nimport type { DeviceId } from '../device/device-id.js'\nimport type { SessionId } from '../device/session-id.js'\nimport type { HandleUnavailableReason } from '../errors/handle-unavailable-error.js'\nimport type { HcaptchaVerifyResult } from '../lib/hcaptcha.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport { buildInterfaceChecker } from '../lib/util/type.js'\nimport type { InviteCode } from '../types/invite-code.js'\nimport type { SignUpInput } from './sign-up-input.js'\n\n// Export all types needed to implement the AccountStore interface\nexport type {\n  Account,\n  ClientId,\n  DeviceData,\n  DeviceId,\n  Did,\n  DisableEmailAuthFactorInput,\n  EnableEmailAuthFactorInput,\n  HandleString,\n  HandleUnavailableReason,\n  HcaptchaVerifyResult,\n  InviteCode,\n  OAuthScope,\n  SessionId,\n  SignUpInput,\n}\n\nexport type ResetPasswordRequestInput = InitiatePasswordResetInput\nexport type ResetPasswordConfirmInput = ConfirmResetPasswordInput\n\nexport type UpdateEmailRequestInput = InitiateEmailUpdateInput\nexport type UpdateEmailRequestOutput = InitiateEmailUpdateOutput\nexport type UpdateEmailConfirmInput = ConfirmEmailUpdateInput\nexport type VerifyEmailRequestInput = InitiateEmailVerificationInput\nexport type VerifyEmailConfirmInput = ConfirmEmailVerificationInput\nexport type UpdateHandleData = UpdateHandleInput\n\n/**\n * @NOTE `deleteAfter` is part of the store contract but is not (yet) exposed\n * over the API, hence the extension of {@link DeactivateAccountInput}.\n */\nexport type DeactivateAccountData = DeactivateAccountInput & {\n  deleteAfter?: DatetimeString | undefined\n}\nexport type ReactivateAccountData = ReactivateAccountInput\nexport type DeleteAccountRequestInput = InitiateAccountDeletionInput\nexport type DeleteAccountConfirmInput = ConfirmAccountDeletionInput\n\nexport type CreateAccountData = {\n  locale: string\n  email: string\n  password: string\n  handle: HandleString\n  inviteCode?: string | undefined\n}\n\nexport type AuthenticateAccountData = {\n  locale: string\n  password: string\n  username: string\n  emailOtp?: string | undefined\n}\n\nexport type AuthorizedClientData = { authorizedScopes: readonly string[] }\nexport type AuthorizedClients = Map<ClientId, AuthorizedClientData>\n\nexport type DeviceAccount = {\n  deviceId: DeviceId\n\n  /**\n   * The data associated with the device, created through the\n   * {@link DeviceStore}. This data is used to identify devices on which a user\n   * has logged in.\n   */\n  deviceData: DeviceData\n\n  /**\n   * The account associated with the device account.\n   */\n  account: Account\n\n  /**\n   * The list of clients that are authorized by the account, as created through\n   * the {@link AccountStore.setAuthorizedClient} method.\n   */\n  authorizedClients: AuthorizedClients\n\n  /**\n   * The date at which the device account was created. This value is currently\n   * not used.\n   */\n  createdAt: Date\n\n  /**\n   * The date at which the device account was last updated. This value is used\n   * to determine the date at which the user last authenticated on a device\n   */\n  updatedAt: Date\n}\n\nexport type SignUpData = SignUpInput & {\n  hcaptchaResult?: HcaptchaVerifyResult\n  inviteCode?: InviteCode\n}\n\nexport interface AccountStore {\n  /**\n   * @throws {HandleUnavailableError} - To indicate that the handle is already taken\n   * @throws {InvalidRequestError} - To indicate that some data is invalid\n   */\n  createAccount(data: CreateAccountData): Awaitable<Account>\n\n  /**\n   * @throws {InvalidCredentialsError} - When the credentials are not valid.\n   * Populate {@link InvalidCredentialsError.did} with the subject identifier\n   * when the identifier matched an existing account (e.g. wrong password for\n   * a known user); omit it when the identifier was not found. Throwing the\n   * generic {@link InvalidRequestError} is also accepted for backward\n   * compatibility but prevents the `onSignInFailed` hook from distinguishing\n   * the two cases.\n   * @throws {SecondAuthenticationFactorRequiredError} - To indicate that an {@link SecondAuthenticationFactorRequiredError.type} is required in the credentials\n   */\n  authenticateAccount(data: AuthenticateAccountData): Awaitable<Account>\n\n  /**\n   * Add a client & scopes to the list of authorized clients for the given account.\n   */\n  setAuthorizedClient(\n    did: Did,\n    clientId: ClientId,\n    data: AuthorizedClientData,\n  ): Awaitable<void>\n\n  /**\n   * @throws {InvalidRequestError} - When the credentials are not valid\n   */\n  getAccount(did: Did): Awaitable<{\n    account: Account\n    authorizedClients: AuthorizedClients\n  }>\n\n  /**\n   * @param data.requestId - If provided, the inserted account must be bound to\n   * that particular requestId.\n   *\n   * @note Whenever a particular device account is created, all **unbound**\n   * device accounts for the same `deviceId` & `sub` should be deleted.\n   *\n   * @note When a particular request is deleted (through\n   * {@link RequestStore.deleteRequest}), all accounts bound to that request\n   * should be deleted as well.\n   */\n  upsertDeviceAccount(deviceId: DeviceId, did: Did): Awaitable<void>\n\n  /**\n   * @param requestId - If provided, the result must either have the same\n   * requestId, or not be bound to a particular requestId. If `null`, the\n   * result must not be bound to a particular requestId.\n   * @throws {InvalidRequestError} - Instead of returning `null` in order to\n   * provide a custom error message\n   */\n  getDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Awaitable<DeviceAccount | null>\n\n  /**\n   * Removes *all* the unbound device-accounts associated with the given device\n   * & account.\n   *\n   * @note Noop if the device-account is not found.\n   */\n  removeDeviceAccount(deviceId: DeviceId, did: Did): Awaitable<void>\n\n  /**\n   * @returns **all** the device accounts matching the given `filter`.\n   */\n  listDeviceAccounts(\n    filter: { did: Did } | { deviceId: DeviceId },\n  ): Awaitable<DeviceAccount[]>\n\n  resetPasswordRequest(\n    data: ResetPasswordRequestInput,\n  ): Awaitable<null | Account>\n\n  resetPasswordConfirm(\n    data: ResetPasswordConfirmInput,\n  ): Awaitable<null | Account>\n\n  updateEmailRequest(\n    data: UpdateEmailRequestInput,\n  ): Awaitable<UpdateEmailRequestOutput>\n  /**\n   * Must trigger a verification email to be sent to the new email address, that\n   * will then be confirmed through {@link updateEmailConfirm}. The account's\n   * {@link Account['emailVerified'] emailVerified} field is expected to become\n   * `false` until the new email is confirmed.\n   */\n  updateEmailConfirm(data: UpdateEmailConfirmInput): Awaitable<Account | null>\n\n  verifyEmailRequest(data: VerifyEmailRequestInput): Awaitable<void>\n  verifyEmailConfirm(data: VerifyEmailConfirmInput): Awaitable<Account | null>\n\n  /**\n   * Enables the email auth factor on the account.\n   *\n   * @returns the updated account, or `null` when the factor was already enabled\n   * (no-op).\n   *\n   * @note when `null` is returned (no-op), the \"confirmed\" hook is skipped, so\n   *  a repeat request is not counted as a fresh opt-in.\n   *\n   * @throws {InvalidRequestError} - To indicate enabling cannot take place due\n   * to mismatch of email or email not being verified.\n   */\n  enableEmailAuthFactor(data: EnableEmailAuthFactorInput): Awaitable<Account>\n\n  /**\n   * Two-phase disable flow. When `token` is undefined and the factor is still\n   * enabled, an email-based OTP isÒ dispatched and `{ tokenRequired: true }` is\n   * returned (the account is unchanged, nothing has been disabled yet). Calling\n   * again with a valid `token` disables the factor and returns\n   * `{ tokenRequired: false }`. Disabling an already-disabled factor is an\n   * idempotent no-op that returns `{ tokenRequired: false }` without\n   * dispatching an email.\n   *\n   * `updatedAccount` is `null` in both cases where nothing changed — the\n   * OTP-dispatch phase and the already-disabled no-op — and an `Account` only\n   * once the factor has actually been turned off. Callers pair it with\n   * `tokenRequired` to decide whether to fire the \"confirmed\" hook.\n   *\n   * @throws {InvalidRequestError} - To indicate disabling cannot take place due\n   * to mismatch of email or email not being verified.\n   * @throws {SecondAuthenticationFactorRequiredError} - To indicate that a\n   * second authentication factor is required to complete the action.\n   */\n  disableEmailAuthFactor(data: DisableEmailAuthFactorInput): Awaitable<Account>\n\n  /**\n   * @throws {HandleUnavailableError} - To indicate that the handle is already taken\n   */\n  verifyHandleAvailability(handle: HandleString): Awaitable<void>\n\n  /**\n   * @throws {HandleUnavailableError} - To indicate that the handle is already taken\n   * @throws {InvalidRequestError} - To indicate that the handle is invalid or\n   * cannot be used\n   */\n  updateHandle(data: UpdateHandleData): Awaitable<Account>\n\n  /**\n   * Mark the account as deactivated. The account remains recoverable. Should\n   * be a no-op when the account is already deactivated.\n   *\n   * @throws {InvalidRequestError} - When the account cannot be deactivated\n   * (e.g. unknown account)\n   */\n  deactivateAccount(data: DeactivateAccountData): Awaitable<Account>\n\n  /**\n   * Reactivate a previously-deactivated account. Should be a no-op when the\n   * account is already active.\n   *\n   * @throws {InvalidRequestError} - When the account cannot be reactivated\n   * (e.g. unknown account)\n   */\n  reactivateAccount(data: ReactivateAccountData): Awaitable<Account>\n\n  /**\n   * Initiate account deletion: typically sends a confirmation token to the\n   * account's email address. The account is NOT deleted until\n   * {@link deleteAccountConfirm} is called with the matching token and the\n   * user's current password.\n   */\n  deleteAccountRequest(data: DeleteAccountRequestInput): Awaitable<void>\n\n  /**\n   * Finalize account deletion. Implementations MUST verify both the email\n   * confirmation `token` issued by {@link deleteAccountRequest} and the user's\n   * current `password` before deleting any data. Deletion is irreversible.\n   *\n   * @throws {InvalidRequestError} - When the token or password is invalid.\n   */\n  deleteAccountConfirm(data: DeleteAccountConfirmInput): Awaitable<void>\n}\n\nexport const isAccountStore = buildInterfaceChecker<AccountStore>([\n  'authenticateAccount',\n  'createAccount',\n  'deactivateAccount',\n  'deleteAccountConfirm',\n  'deleteAccountRequest',\n  'disableEmailAuthFactor',\n  'enableEmailAuthFactor',\n  'getAccount',\n  'getDeviceAccount',\n  'listDeviceAccounts',\n  'reactivateAccount',\n  'removeDeviceAccount',\n  'resetPasswordConfirm',\n  'resetPasswordRequest',\n  'setAuthorizedClient',\n  'updateEmailConfirm',\n  'updateEmailRequest',\n  'updateHandle',\n  'upsertDeviceAccount',\n  'verifyEmailConfirm',\n  'verifyEmailRequest',\n  'verifyHandleAvailability',\n])\n\nexport function asAccountStore<V>(implementation: V): V & AccountStore {\n  if (!implementation || !isAccountStore(implementation)) {\n    throw new Error('Invalid AccountStore implementation')\n  }\n  return implementation\n}\n"]}

package/dist/customization/background.d.ts

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 export declare const backgroundsSchema: z.ZodObject<{
-    light: z.ZodOptional<z.ZodString>;
-    dark: z.ZodOptional<z.ZodString>;
+    light: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
+    dark: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
 }, "strip", z.ZodTypeAny, {
-    light?: string | undefined;
-    dark?: string | undefined;
+    light?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
+    dark?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
 }, {
     light?: string | undefined;
     dark?: string | undefined;

package/dist/customization/background.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../../src/customization/background.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA"}
+{"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../../src/customization/background.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA"}

package/dist/customization/background.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
+import { imageUrlSchema } from './image-url.js';
 // Light- and dark-mode background image URLs for the authorization screens.
 export const backgroundsSchema = z.object({
-    light: z.string().url().optional(),
-    dark: z.string().url().optional(),
+    light: imageUrlSchema.optional(),
+    dark: imageUrlSchema.optional(),
 });
 //# sourceMappingURL=background.js.map

package/dist/customization/background.js.map

@@ -1 +1 @@
-{"version":3,"file":"background.js","sourceRoot":"","sources":["../../src/customization/background.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\n\n// Light- and dark-mode background image URLs for the authorization screens.\nexport const backgroundsSchema = z.object({\n  light: z.string().url().optional(),\n  dark: z.string().url().optional(),\n})\nexport type Backgrounds = z.infer<typeof backgroundsSchema>\n"]}
+{"version":3,"file":"background.js","sourceRoot":"","sources":["../../src/customization/background.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { imageUrlSchema } from './image-url.js'\n\n// Light- and dark-mode background image URLs for the authorization screens.\nexport const backgroundsSchema = z.object({\n  light: imageUrlSchema.optional(),\n  dark: imageUrlSchema.optional(),\n})\nexport type Backgrounds = z.infer<typeof backgroundsSchema>\n"]}

package/dist/customization/branding.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export declare const brandingSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
-    logo: z.ZodOptional<z.ZodString>;
+    logo: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
     colors: z.ZodOptional<z.ZodObject<Record<"error" | "info" | "primary" | "success" | "warning", z.ZodOptional<z.ZodEffects<z.ZodString, import("../lib/util/color.js").RgbColor, string>>>, "strip", z.ZodTypeAny, {
         error?: import("../lib/util/color.js").RgbColor | undefined;
         info?: import("../lib/util/color.js").RgbColor | undefined;
@@ -16,11 +16,11 @@ export declare const brandingSchema: z.ZodObject<{
         warning?: string | undefined;
     }>>;
     background: z.ZodOptional<z.ZodObject<{
-        light: z.ZodOptional<z.ZodString>;
-        dark: z.ZodOptional<z.ZodString>;
+        light: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
+        dark: z.ZodOptional<z.ZodEffects<z.ZodString, `data:${string}` | `http://${string}` | `https://${string}`, string>>;
     }, "strip", z.ZodTypeAny, {
-        light?: string | undefined;
-        dark?: string | undefined;
+        light?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
+        dark?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
     }, {
         light?: string | undefined;
         dark?: string | undefined;
@@ -40,7 +40,7 @@ export declare const brandingSchema: z.ZodObject<{
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
     name?: string | undefined;
-    logo?: string | undefined;
+    logo?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
     colors?: {
         error?: import("../lib/util/color.js").RgbColor | undefined;
         info?: import("../lib/util/color.js").RgbColor | undefined;
@@ -49,8 +49,8 @@ export declare const brandingSchema: z.ZodObject<{
         warning?: import("../lib/util/color.js").RgbColor | undefined;
     } | undefined;
     background?: {
-        light?: string | undefined;
-        dark?: string | undefined;
+        light?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
+        dark?: `data:${string}` | `http://${string}` | `https://${string}` | undefined;
     } | undefined;
     links?: {
         title: string | Record<string, string | undefined>;

package/dist/customization/branding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../../src/customization/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAC3D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}
+{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../../src/customization/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAC3D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}

package/dist/customization/branding.js

@@ -1,10 +1,11 @@
 import { z } from 'zod';
 import { backgroundsSchema } from './background.js';
 import { colorsSchema } from './colors.js';
+import { imageUrlSchema } from './image-url.js';
 import { linksSchema } from './links.js';
 export const brandingSchema = z.object({
     name: z.string().optional(),
-    logo: z.string().url().optional(),
+    logo: imageUrlSchema.optional(),
     colors: colorsSchema.optional(),
     background: backgroundsSchema.optional(),
     links: z.array(linksSchema).optional(),

package/dist/customization/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/customization/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { backgroundsSchema } from './background.js'\nimport { colorsSchema } from './colors.js'\nimport { linksSchema } from './links.js'\n\nexport const brandingSchema = z.object({\n  name: z.string().optional(),\n  logo: z.string().url().optional(),\n  colors: colorsSchema.optional(),\n  background: backgroundsSchema.optional(),\n  links: z.array(linksSchema).optional(),\n})\nexport type BrandingConfig = z.input<typeof brandingSchema>\nexport type Branding = z.infer<typeof brandingSchema>\n"]}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/customization/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { backgroundsSchema } from './background.js'\nimport { colorsSchema } from './colors.js'\nimport { imageUrlSchema } from './image-url.js'\nimport { linksSchema } from './links.js'\n\nexport const brandingSchema = z.object({\n  name: z.string().optional(),\n  logo: imageUrlSchema.optional(),\n  colors: colorsSchema.optional(),\n  background: backgroundsSchema.optional(),\n  links: z.array(linksSchema).optional(),\n})\nexport type BrandingConfig = z.input<typeof brandingSchema>\nexport type Branding = z.infer<typeof brandingSchema>\n"]}

package/dist/customization/build-customization-coep.d.ts

@@ -0,0 +1,4 @@
+import { CrossOriginEmbedderPolicy } from '../lib/http/security-headers.js';
+import type { Customization } from './customization.js';
+export declare function buildCustomizationCoep({ hcaptcha, }: Customization): CrossOriginEmbedderPolicy | undefined;
+//# sourceMappingURL=build-customization-coep.d.ts.map

package/dist/customization/build-customization-coep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-customization-coep.d.ts","sourceRoot":"","sources":["../../src/customization/build-customization-coep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAA;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,GACT,EAAE,aAAa,GAAG,yBAAyB,GAAG,SAAS,CAOvD"}

package/dist/customization/build-customization-coep.js

@@ -0,0 +1,11 @@
+import { CrossOriginEmbedderPolicy } from '../lib/http/security-headers.js';
+export function buildCustomizationCoep({ hcaptcha, }) {
+    // hCaptcha's implementation of COEP is currently broken. Let's disable it
+    // to avoid breaking the entire page.
+    //
+    // https://github.com/hCaptcha/react-hcaptcha/issues/259
+    // https://github.com/hCaptcha/react-hcaptcha/issues/380
+    if (hcaptcha)
+        return CrossOriginEmbedderPolicy.unsafeNone;
+}
+//# sourceMappingURL=build-customization-coep.js.map

package/dist/customization/build-customization-coep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-customization-coep.js","sourceRoot":"","sources":["../../src/customization/build-customization-coep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAA;AAG3E,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,GACM;IACd,0EAA0E;IAC1E,qCAAqC;IACrC,EAAE;IACF,wDAAwD;IACxD,wDAAwD;IACxD,IAAI,QAAQ;QAAE,OAAO,yBAAyB,CAAC,UAAU,CAAA;AAC3D,CAAC","sourcesContent":["import { CrossOriginEmbedderPolicy } from '../lib/http/security-headers.js'\nimport type { Customization } from './customization.js'\n\nexport function buildCustomizationCoep({\n  hcaptcha,\n}: Customization): CrossOriginEmbedderPolicy | undefined {\n  // hCaptcha's implementation of COEP is currently broken. Let's disable it\n  // to avoid breaking the entire page.\n  //\n  // https://github.com/hCaptcha/react-hcaptcha/issues/259\n  // https://github.com/hCaptcha/react-hcaptcha/issues/380\n  if (hcaptcha) return CrossOriginEmbedderPolicy.unsafeNone\n}\n"]}

package/dist/customization/build-customization-csp.d.ts

@@ -0,0 +1,9 @@
+import type { CspConfig } from '../lib/csp/index.js';
+import type { Customization } from './customization.js';
+/**
+ * Transforms the customization settings into a Content Security Policy (CSP)
+ * configuration, based on the ways customization settings are used in the
+ * @atproto/oauth-provider-ui web app.
+ */
+export declare function buildCustomizationCsp({ branding, hcaptcha, }: Customization): Generator<CspConfig, void, unknown>;
+//# sourceMappingURL=build-customization-csp.d.ts.map

package/dist/customization/build-customization-csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-customization-csp.d.ts","sourceRoot":"","sources":["../../src/customization/build-customization-csp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAYvD;;;;GAIG;AACH,wBAAiB,qBAAqB,CAAC,EACrC,QAAQ,EACR,QAAQ,GACT,EAAE,aAAa,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAgCrD"}