@atproto/pds 0.4.225 → 0.5.0

package/dist/api/com/atproto/server/requestEmailConfirmation.js

@@ -1,46 +1,51 @@
 import { DAY, HOUR } from '@atproto/common';
-import { InvalidRequestError } from '@atproto/xrpc-server';
 import { com } from '../../../../lexicons/index.js';
+// Exposed as a utility to ensure auth in confirmEmail and requestEmailConfirmation
+export function requestEmailConfirmationAuth(ctx) {
+    return ctx.authVerifier.authorization({
+        checkTakedown: true,
+        authorize: (permissions) => {
+            permissions.assertAccount({ attr: 'email', action: 'manage' });
+        },
+    });
+}
+const rateLimit = [
+    {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+    {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+];
 export default function (server, ctx) {
-    server.add(com.atproto.server.requestEmailConfirmation, {
-        rateLimit: [
-            {
-                durationMs: DAY,
-                points: 15,
-                calcKey: ({ auth }) => auth.credentials.did,
-            },
-            {
-                durationMs: HOUR,
-                points: 5,
-                calcKey: ({ auth }) => auth.credentials.did,
+    const { entrywayClient } = ctx;
+    const auth = requestEmailConfirmationAuth(ctx);
+    if (entrywayClient) {
+        server.add(com.atproto.server.requestEmailConfirmation, {
+            auth,
+            rateLimit,
+            handler: async ({ auth, req }) => {
+                const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.requestEmailConfirmation.$lxm);
+                await entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, {
+                    headers,
+                });
             },
-        ],
-        auth: ctx.authVerifier.authorization({
-            checkTakedown: true,
-            authorize: (permissions) => {
-                permissions.assertAccount({ attr: 'email', action: 'manage' });
+        });
+    }
+    else {
+        server.add(com.atproto.server.requestEmailConfirmation, {
+            auth,
+            rateLimit,
+            handler: async ({ auth }) => {
+                const did = auth.credentials.did;
+                const locale = undefined; // @TODO get the locale somehow
+                await ctx.accountManager.requestEmailConfirmation(did, { locale });
             },
-        }),
-        handler: async ({ auth, req }) => {
-            const did = auth.credentials.did;
-            const account = await ctx.accountManager.getAccount(did, {
-                includeDeactivated: true,
-                includeTakenDown: true,
-            });
-            if (!account) {
-                throw new InvalidRequestError('account not found');
-            }
-            if (ctx.entrywayClient) {
-                const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.requestEmailConfirmation.$lxm);
-                await ctx.entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, { headers });
-                return;
-            }
-            if (!account.email) {
-                throw new InvalidRequestError('account does not have an email address');
-            }
-            const token = await ctx.accountManager.createEmailToken(did, 'confirm_email');
-            await ctx.mailer.sendConfirmEmail({ token }, { to: account.email });
-        },
-    });
+        });
+    }
 }
 //# sourceMappingURL=requestEmailConfirmation.js.map

package/dist/api/com/atproto/server/requestEmailConfirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailConfirmation.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAU,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;QACtD,SAAS,EAAE;YACT;gBACE,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;YACD;gBACE,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;SACF;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChE,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CACjD,CAAA;gBAED,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAC3C,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAM;YACR,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,gBAAgB,CACrD,GAAG,EACH,eAAe,CAChB,CAAA;YACD,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACrE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport { InvalidRequestError, Server } from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.requestEmailConfirmation, {\n    rateLimit: [\n      {\n        durationMs: DAY,\n        points: 15,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n      {\n        durationMs: HOUR,\n        points: 5,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n    ],\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      authorize: (permissions) => {\n        permissions.assertAccount({ attr: 'email', action: 'manage' })\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      const did = auth.credentials.did\n      const account = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError('account not found')\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailConfirmation.$lxm,\n        )\n\n        await ctx.entrywayClient.xrpc(\n          com.atproto.server.requestEmailConfirmation,\n          { headers },\n        )\n\n        return\n      }\n\n      if (!account.email) {\n        throw new InvalidRequestError('account does not have an email address')\n      }\n      const token = await ctx.accountManager.createEmailToken(\n        did,\n        'confirm_email',\n      )\n      await ctx.mailer.sendConfirmEmail({ token }, { to: account.email })\n    },\n  })\n}\n"]}
+{"version":3,"file":"requestEmailConfirmation.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAQ3C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAC1C,GAAe;IAEf,OAAO,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;QACpC,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;YACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,SAAS,GAAgD;IAC7D;QACE,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;IACD;QACE,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;CACF,CAAA;AAED,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,IAAI,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;IAE9C,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;YACtD,IAAI;YACJ,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CACjD,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;oBACrE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;YACtD,IAAI;YACJ,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAChC,MAAM,MAAM,GAAG,SAAS,CAAA,CAAC,+BAA+B;gBACxD,MAAM,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACpE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport {\n  MethodAuthVerifier,\n  MethodRateLimit,\n  Server,\n} from '@atproto/xrpc-server'\nimport { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\n// Exposed as a utility to ensure auth in confirmEmail and requestEmailConfirmation\nexport function requestEmailConfirmationAuth(\n  ctx: AppContext,\n): MethodAuthVerifier<AccessOutput | OAuthOutput> {\n  return ctx.authVerifier.authorization({\n    checkTakedown: true,\n    authorize: (permissions) => {\n      permissions.assertAccount({ attr: 'email', action: 'manage' })\n    },\n  })\n}\n\nconst rateLimit: MethodRateLimit<AccessOutput | OAuthOutput> = [\n  {\n    durationMs: DAY,\n    points: 15,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n  {\n    durationMs: HOUR,\n    points: 5,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n]\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const auth = requestEmailConfirmationAuth(ctx)\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.requestEmailConfirmation, {\n      auth,\n      rateLimit,\n      handler: async ({ auth, req }) => {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailConfirmation.$lxm,\n        )\n\n        await entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, {\n          headers,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.requestEmailConfirmation, {\n      auth,\n      rateLimit,\n      handler: async ({ auth }) => {\n        const did = auth.credentials.did\n        const locale = undefined // @TODO get the locale somehow\n        await ctx.accountManager.requestEmailConfirmation(did, { locale })\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/requestEmailUpdate.d.ts

@@ -1,4 +1,6 @@
-import { Server } from '@atproto/xrpc-server';
+import { MethodAuthVerifier, Server } from '@atproto/xrpc-server';
+import { AccessOutput, OAuthOutput } from '../../../../auth-output.js';
 import { AppContext } from '../../../../context.js';
+export declare function requestEmailUpdateAuth(ctx: AppContext): MethodAuthVerifier<AccessOutput | OAuthOutput>;
 export default function (server: Server, ctx: AppContext): void;
 //# sourceMappingURL=requestEmailUpdate.d.ts.map

package/dist/api/com/atproto/server/requestEmailUpdate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailUpdate.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGnD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgEvD"}
+{"version":3,"file":"requestEmailUpdate.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,kBAAkB,EAElB,MAAM,EACP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKnD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,GACd,kBAAkB,CAAC,YAAY,GAAG,WAAW,CAAC,CAUhD;AAeD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA4CvD"}

package/dist/api/com/atproto/server/requestEmailUpdate.js

@@ -1,57 +1,61 @@
 import { DAY, HOUR } from '@atproto/common';
-import { InvalidRequestError } from '@atproto/xrpc-server';
+import { ForbiddenError, } from '@atproto/xrpc-server';
+import { ACCESS_FULL } from '../../../../auth-scope.js';
 import { com } from '../../../../lexicons/index.js';
+// Exposed as a utility to ensure auth in updateEmail and requestEmailUpdate
+// stay consistent.
+export function requestEmailUpdateAuth(ctx) {
+    return ctx.authVerifier.authorization({
+        checkTakedown: true,
+        scopes: ACCESS_FULL,
+        authorize: () => {
+            throw new ForbiddenError('Use the account manager interface to update email address associated with an account');
+        },
+    });
+}
+const rateLimit = [
+    {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+    {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+];
 export default function (server, ctx) {
     const { entrywayClient } = ctx;
-    server.add(com.atproto.server.requestEmailUpdate, {
-        rateLimit: [
-            {
-                durationMs: DAY,
-                points: 15,
-                calcKey: ({ auth }) => auth.credentials.did,
-            },
-            {
-                durationMs: HOUR,
-                points: 5,
-                calcKey: ({ auth }) => auth.credentials.did,
-            },
-        ],
-        auth: ctx.authVerifier.authorization({
-            checkTakedown: true,
-            authorize: (permissions) => {
-                permissions.assertAccount({ attr: 'email', action: 'manage' });
-            },
-        }),
-        handler: async ({ auth, req }) => {
-            const did = auth.credentials.did;
-            const account = await ctx.accountManager.getAccount(did, {
-                includeDeactivated: true,
-                includeTakenDown: true,
-            });
-            if (!account) {
-                throw new InvalidRequestError('account not found');
-            }
-            if (entrywayClient) {
+    const auth = requestEmailUpdateAuth(ctx);
+    if (entrywayClient) {
+        server.add(com.atproto.server.requestEmailUpdate, {
+            rateLimit,
+            auth,
+            handler: async ({ auth, req }) => {
                 const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.requestEmailUpdate.$lxm);
                 return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {
                     headers,
                 });
-            }
-            if (!account.email) {
-                throw new InvalidRequestError('account does not have an email address');
-            }
-            const tokenRequired = !!account.emailConfirmedAt;
-            if (tokenRequired) {
-                const token = await ctx.accountManager.createEmailToken(did, 'update_email');
-                await ctx.mailer.sendUpdateEmail({ token }, { to: account.email });
-            }
-            return {
-                encoding: 'application/json',
-                body: {
-                    tokenRequired,
-                },
-            };
-        },
-    });
+            },
+        });
+    }
+    else {
+        server.add(com.atproto.server.requestEmailUpdate, {
+            rateLimit,
+            auth,
+            handler: async ({ auth }) => {
+                const did = auth.credentials.did;
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                const { tokenRequired } = await ctx.accountManager.requestEmailUpdate(did, { locale });
+                return {
+                    encoding: 'application/json',
+                    body: { tokenRequired },
+                };
+            },
+        });
+    }
 }
 //# sourceMappingURL=requestEmailUpdate.js.map

package/dist/api/com/atproto/server/requestEmailUpdate.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailUpdate.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAU,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;QAChD,SAAS,EAAE;YACT;gBACE,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;YACD;gBACE,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;SACF;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChE,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAA;gBACD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;YAChD,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,gBAAgB,CACrD,GAAG,EACH,cAAc,CACf,CAAA;gBACD,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,aAAa;iBACd;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport { InvalidRequestError, Server } from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  server.add(com.atproto.server.requestEmailUpdate, {\n    rateLimit: [\n      {\n        durationMs: DAY,\n        points: 15,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n      {\n        durationMs: HOUR,\n        points: 5,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n    ],\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      authorize: (permissions) => {\n        permissions.assertAccount({ attr: 'email', action: 'manage' })\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      const did = auth.credentials.did\n      const account = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError('account not found')\n      }\n\n      if (entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailUpdate.$lxm,\n        )\n        return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {\n          headers,\n        })\n      }\n\n      if (!account.email) {\n        throw new InvalidRequestError('account does not have an email address')\n      }\n\n      const tokenRequired = !!account.emailConfirmedAt\n      if (tokenRequired) {\n        const token = await ctx.accountManager.createEmailToken(\n          did,\n          'update_email',\n        )\n        await ctx.mailer.sendUpdateEmail({ token }, { to: account.email })\n      }\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          tokenRequired,\n        },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"requestEmailUpdate.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,cAAc,GAIf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,4EAA4E;AAC5E,mBAAmB;AACnB,MAAM,UAAU,sBAAsB,CACpC,GAAe;IAEf,OAAO,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;QACpC,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,IAAI,cAAc,CACtB,sFAAsF,CACvF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,SAAS,GAAgD;IAC7D;QACE,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;IACD;QACE,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;CACF,CAAA;AAED,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;YAChD,SAAS;YACT,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAA;gBAED,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;YAChD,SAAS;YACT,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAEhC,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CACnE,GAAG,EACH,EAAE,MAAM,EAAE,CACX,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,EAAE,aAAa,EAAE;iBACxB,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport {\n  ForbiddenError,\n  MethodAuthVerifier,\n  MethodRateLimit,\n  Server,\n} from '@atproto/xrpc-server'\nimport { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { ACCESS_FULL } from '../../../../auth-scope.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\n// Exposed as a utility to ensure auth in updateEmail and requestEmailUpdate\n// stay consistent.\nexport function requestEmailUpdateAuth(\n  ctx: AppContext,\n): MethodAuthVerifier<AccessOutput | OAuthOutput> {\n  return ctx.authVerifier.authorization({\n    checkTakedown: true,\n    scopes: ACCESS_FULL,\n    authorize: () => {\n      throw new ForbiddenError(\n        'Use the account manager interface to update email address associated with an account',\n      )\n    },\n  })\n}\n\nconst rateLimit: MethodRateLimit<AccessOutput | OAuthOutput> = [\n  {\n    durationMs: DAY,\n    points: 15,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n  {\n    durationMs: HOUR,\n    points: 5,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n]\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const auth = requestEmailUpdateAuth(ctx)\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.requestEmailUpdate, {\n      rateLimit,\n      auth,\n      handler: async ({ auth, req }) => {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailUpdate.$lxm,\n        )\n\n        return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {\n          headers,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.requestEmailUpdate, {\n      rateLimit,\n      auth,\n      handler: async ({ auth }) => {\n        const did = auth.credentials.did\n\n        // @TODO get the locale somehow (either by adding a field in the request\n        // body, or by using the `Accept-Language` header).\n        const locale = undefined\n\n        const { tokenRequired } = await ctx.accountManager.requestEmailUpdate(\n          did,\n          { locale },\n        )\n\n        return {\n          encoding: 'application/json' as const,\n          body: { tokenRequired },\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/updateEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,MAAM,EACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGnD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAqEvD"}
+{"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAInD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA6CvD"}

package/dist/api/com/atproto/server/updateEmail.js

@@ -1,57 +1,43 @@
-import { isEmailValid } from '@hapi/address';
-import { isDisposableEmail } from 'disposable-email-domains-js';
-import { ForbiddenError, InvalidRequestError, } from '@atproto/xrpc-server';
+import { InvalidRequestError } from '@atproto/xrpc-server';
 import { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js';
-import { ACCESS_FULL } from '../../../../auth-scope.js';
 import { com } from '../../../../lexicons/index.js';
+import { requestEmailUpdateAuth } from './requestEmailUpdate.js';
 export default function (server, ctx) {
-    server.add(com.atproto.server.updateEmail, {
-        auth: ctx.authVerifier.authorization({
-            checkTakedown: true,
-            scopes: ACCESS_FULL,
-            authorize: () => {
-                throw new ForbiddenError('OAuth credentials are not supported for this endpoint');
-            },
-        }),
-        handler: async ({ auth, input: { body }, req }) => {
-            const did = auth.credentials.did;
-            const { token, email } = body;
-            if (!isEmailValid(email) || isDisposableEmail(email)) {
-                throw new InvalidRequestError('This email address is not supported, please use a different email.');
-            }
-            const account = await ctx.accountManager.getAccount(did, {
-                includeDeactivated: true,
-            });
-            if (!account) {
-                throw new InvalidRequestError('account not found');
-            }
-            if (ctx.entrywayClient) {
+    const { entrywayClient } = ctx;
+    // @NOTE Ensure that both endpoints use the same authentication logic
+    const auth = requestEmailUpdateAuth(ctx);
+    if (entrywayClient) {
+        server.add(com.atproto.server.updateEmail, {
+            auth,
+            handler: async ({ auth, input: { body }, req }) => {
                 const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.updateEmail.$lxm);
-                await ctx.entrywayClient.xrpc(com.atproto.server.updateEmail, {
+                await entrywayClient.xrpc(com.atproto.server.updateEmail, {
                     headers,
                     body,
                 });
-                return;
-            }
-            // require valid token if account email is confirmed
-            if (account.emailConfirmedAt) {
-                if (!token) {
-                    throw new InvalidRequestError('confirmation token required', 'TokenRequired');
-                }
-                await ctx.accountManager.assertValidEmailToken(did, 'update_email', token);
-            }
-            try {
-                await ctx.accountManager.updateEmail({ did, email });
-            }
-            catch (err) {
-                if (err instanceof UserAlreadyExistsError) {
-                    throw new InvalidRequestError('This email address is already in use, please use a different email.');
+            },
+        });
+    }
+    else {
+        server.add(com.atproto.server.updateEmail, {
+            auth,
+            handler: async ({ auth, input: { body } }) => {
+                const did = auth.credentials.did;
+                const { token, email } = body;
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                try {
+                    await ctx.accountManager.updateEmail(did, email, token, { locale });
                 }
-                else {
-                    throw err;
+                catch (cause) {
+                    if (cause instanceof UserAlreadyExistsError) {
+                        throw new InvalidRequestError(cause.message, undefined, { cause });
+                    }
+                    throw cause;
                 }
-            }
-        },
-    });
+            },
+        });
+    }
 }
 //# sourceMappingURL=updateEmail.js.map

package/dist/api/com/atproto/server/updateEmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QACzC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,GAAG,EAAE;gBACd,MAAM,IAAI,cAAc,CACtB,uDAAuD,CACxD,CAAA;YACH,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;YAC7B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvD,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpC,CAAA;gBAED,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAC5D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;gBAEF,OAAM;YACR,CAAC;YAED,oDAAoD;YACpD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;gBACH,CAAC;gBACD,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAC5C,GAAG,EACH,cAAc,EACd,KAAK,CACN,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;oBAC1C,MAAM,IAAI,mBAAmB,CAC3B,qEAAqE,CACtE,CAAA;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport {\n  ForbiddenError,\n  InvalidRequestError,\n  Server,\n} from '@atproto/xrpc-server'\nimport { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'\nimport { ACCESS_FULL } from '../../../../auth-scope.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.updateEmail, {\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      scopes: ACCESS_FULL,\n      authorize: () => {\n        throw new ForbiddenError(\n          'OAuth credentials are not supported for this endpoint',\n        )\n      },\n    }),\n    handler: async ({ auth, input: { body }, req }) => {\n      const did = auth.credentials.did\n      const { token, email } = body\n      if (!isEmailValid(email) || isDisposableEmail(email)) {\n        throw new InvalidRequestError(\n          'This email address is not supported, please use a different email.',\n        )\n      }\n      const account = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError('account not found')\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.updateEmail.$lxm,\n        )\n\n        await ctx.entrywayClient.xrpc(com.atproto.server.updateEmail, {\n          headers,\n          body,\n        })\n\n        return\n      }\n\n      // require valid token if account email is confirmed\n      if (account.emailConfirmedAt) {\n        if (!token) {\n          throw new InvalidRequestError(\n            'confirmation token required',\n            'TokenRequired',\n          )\n        }\n        await ctx.accountManager.assertValidEmailToken(\n          did,\n          'update_email',\n          token,\n        )\n      }\n\n      try {\n        await ctx.accountManager.updateEmail({ did, email })\n      } catch (err) {\n        if (err instanceof UserAlreadyExistsError) {\n          throw new InvalidRequestError(\n            'This email address is already in use, please use a different email.',\n          )\n        } else {\n          throw err\n        }\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"updateEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAU,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AAEvF,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,qEAAqE;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpC,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACxD,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;gBAE7B,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;wBAC5C,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;oBACpE,CAAC;oBAED,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { InvalidRequestError, Server } from '@atproto/xrpc-server'\nimport { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { requestEmailUpdateAuth } from './requestEmailUpdate.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  // @NOTE Ensure that both endpoints use the same authentication logic\n  const auth = requestEmailUpdateAuth(ctx)\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.updateEmail, {\n      auth,\n      handler: async ({ auth, input: { body }, req }) => {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.updateEmail.$lxm,\n        )\n\n        await entrywayClient.xrpc(com.atproto.server.updateEmail, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.updateEmail, {\n      auth,\n      handler: async ({ auth, input: { body } }) => {\n        const did = auth.credentials.did\n        const { token, email } = body\n\n        // @TODO get the locale somehow (either by adding a field in the request\n        // body, or by using the `Accept-Language` header).\n        const locale = undefined\n\n        try {\n          await ctx.accountManager.updateEmail(did, email, token, { locale })\n        } catch (cause) {\n          if (cause instanceof UserAlreadyExistsError) {\n            throw new InvalidRequestError(cause.message, undefined, { cause })\n          }\n\n          throw cause\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAG/B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAEhC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAIL,aAAa,EAEd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAKzC,OAAO,EACL,KAAK,EAIN,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAGrE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAEzD,OAAO,EACL,YAAY,EAGb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAe,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,YAAY,EAAE,YAAY,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;CAClB,CAAA;AAED,qBAAa,UAAU;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,YAAY,EAAE,YAAY,CAAA;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;gBAEZ,IAAI,EAAE,iBAAiB;WA2BtB,UAAU,CACrB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC;IA+WhB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;;IAK3C,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;IAUxE,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO;;;IAItC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;;IAUxD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAS3D;AAUD,eAAe,UAAU,CAAA"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAG/B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAEhC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAIL,aAAa,EAEd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAKzC,OAAO,EACL,KAAK,EAIN,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAGrE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAEzD,OAAO,EACL,YAAY,EAGb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAIrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAe,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,YAAY,EAAE,YAAY,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;CAClB,CAAA;AAED,qBAAa,UAAU;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,YAAY,EAAE,YAAY,CAAA;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;gBAEZ,IAAI,EAAE,iBAAiB;WA2BtB,UAAU,CACrB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC;IAgXhB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;;IAK3C,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;IAUxE,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO;;;IAItC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;;IAUxD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAS3D;AAUD,eAAe,UAAU,CAAA"}

package/dist/context.js

@@ -135,7 +135,7 @@ export class AppContext {
             blobstore,
             backgroundQueue,
         });
-        const accountManager = new AccountManager(idResolver, jwtSecretKey, cfg.service.did, cfg.identity.serviceHandleDomains, cfg.db);
+        const accountManager = new AccountManager(idResolver, jwtSecretKey, mailer, cfg.service.did, cfg.identity.serviceHandleDomains, cfg.db);
         await accountManager.migrateOrThrow();
         const plcRotationKey = secrets.plcRotationKey.provider === 'kms'
             ? await KmsKeypair.load({

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAGnC,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAA;AAClC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EACL,eAAe,EACf,OAAO,EACP,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAsB,MAAM,8BAA8B,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AA6BhD,MAAM,OAAO,UAAU;IA0BrB,YAAY,IAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,GAAiB,EACjB,OAAsB,EACtB,SAAsC;QAEtC,MAAM,SAAS,GACb,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC7B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;gBAC5B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;gBAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;gBAChC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;gBAC5C,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW;gBACtC,eAAe,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe;aAC/C,CAAC;YACJ,CAAC,CAAC,aAAa,CAAC,OAAO,CACnB,GAAG,CAAC,SAAS,CAAC,QAAQ,EACtB,GAAG,CAAC,SAAS,CAAC,YAAY,CAC3B,CAAA;QAEP,MAAM,aAAa,GACjB,GAAG,CAAC,KAAK,KAAK,IAAI;YAChB,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;QAEnD,MAAM,gBAAgB,GACpB,GAAG,CAAC,eAAe,KAAK,IAAI;YAC1B,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QAEpE,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,GAAG,CAAC,EAAE,CAAC,aAAa,EACpB,GAAG,CAAC,QAAQ,CAAC,aAAa,EAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,EACxB,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;QAE/B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;YAChC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YAC3B,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe;YACrC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,uBAAuB;SACxD,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAErD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;QAC7C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,eAAe,EACf,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,GAAG,CAAC,QAAQ,CACb,CAAA;QACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAC7B,GAAG,CAAC,EAAE,CAAC,cAAc,EACrB,QAAQ,EACR,SAAS,EACT,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK;YAC5B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW;YACjC,CAAC,CAAC,IAAI,WAAW,CAAC;gBACd,GAAG,GAAG,CAAC,WAAW;gBAClB,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU;YACrC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAC/B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa;YACvC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,EAClC;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ;YACjC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAC7B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,mBAAmB,GACvB,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB;YACxC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAC7B;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,eAAe,CAC5B,OAAO,EACP,OAAO,CAAC,kBAAkB,CAC3B;iBACF;gBACD,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ;YAC/B,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,WAAW,CACZ,CAAA;QAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YAChD,SAAS;YACT,eAAe;SAChB,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,UAAU,EACV,YAAY,EACZ,GAAG,CAAC,OAAO,CAAC,GAAG,EACf,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EACjC,GAAG,CAAC,EAAE,CACP,CAAA;QACD,MAAM,cAAc,CAAC,cAAc,EAAE,CAAA;QAErC,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,CAAC,QAAQ,KAAK,KAAK;YACvC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK;aACpC,CAAC;YACJ,CAAC,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAClC,OAAO,CAAC,cAAc,CAAC,aAAa,CACrC,CAAA;QAEP,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CACrC,cAAc,EACd,eAAe,EACf,WAAW,CACZ,CAAA;QAED,qEAAqE;QACrE,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,uBAAuB;YACtD,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc;YACxC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW;YAClC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,qBAAqB;gBACtC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;oBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAC1B,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;oBAClD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;oBACrD,CAAC;oBACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;wBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;oBAC7D,CAAC;oBACD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACtC,CAAC;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;aACpE;SACF,CAAC,CAAA;QACF,MAAM,UAAU,GACd,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;YACtB,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE;gBACpC,WAAW,EAAE,EAAE,EAAE,8BAA8B;gBAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACxB,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU;aACjC,CAAC;YACJ,CAAC,CAAC,cAAc,CAAA;QAEpB;;;;;;;;WAQG;QACH,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,WAAW,EAAE,KAAK;YAClB,qBAAqB,EAAE,KAAK;YAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB;YAEhD,KAAK,EAAE,UAAU,KAAK,EAAE,IAAI;gBAC1B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACnE,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAEhE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;gBAE1C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ;YACtC,CAAC,CAAC,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACrE,KAAK,EAAE,IAAI,UAAU,CACnB,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAC5B;gBACD,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;gBACxC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,oBAAoB;gBACvD,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,SAAS;gBACT,WAAW,EAAE,IAAI,WAAW,CAAC;oBAC3B,KAAK,EAAE,SAAS;oBAChB,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;oBACpC,KAAK,EAAE;wBACL,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;4BAC/B,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EACzB,iCAAiC,CAClC,CAAA;4BACD,+DAA+D;4BAC/D,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAA;wBACjC,CAAC;wBACD,wBAAwB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;4BACpC,qBAAqB,CAAC,IAAI,CACxB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC9B,sBAAsB,CACvB,CAAA;wBACH,CAAC;wBACD,uBAAuB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;4BACnC,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC9B,8BAA8B,CAC/B,CAAA;wBACH,CAAC;wBACD,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;4BACxB,qBAAqB,CAAC,IAAI,CACxB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAC5C,iBAAiB,CAClB,CAAA;wBACH,CAAC;wBACD,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;4BACvB,qBAAqB,CAAC,KAAK,CACzB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC5B,qBAAqB,CACtB,CAAA;wBACH,CAAC;qBACF;iBACF,CAAC;gBACF,QAAQ,EAAE;oBACR,mBAAmB,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;iBACxD;gBACD,mEAAmE;gBACnE,gEAAgE;gBAChE,kEAAkE;gBAClE,oEAAoE;gBACpE,0DAA0D;gBAC1D,eAAe,EAAE,eAAe,CAAC,QAAQ;gBAEzC,aAAa,CAAC,QAAQ;oBACpB,OAAO;wBACL,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC;qBAClE,CAAA;gBACH,CAAC;aACF,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,aAAa,GACjB,aAAa,IAAI,sCAAsC;YACvD,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACvE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;oBAC9C,wEAAwE;oBACxE,oCAAoC;oBACpC,IAAI,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjC,WAAW,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EACpD,6CAA6C,CAC9C,CAAA;oBACH,CAAC;oBAED,IAAI,cAAc,EAAE,CAAC;wBACnB,OAAO,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;oBACjE,CAAC;oBAED,OAAO,OAAO,CAAA;gBAChB,CAAC;aACF,CAAC,CAAA;QAEJ,MAAM,YAAY,GAAG,IAAI,YAAY,CACnC,cAAc,EACd,UAAU,EACV,aAAa,EACb;YACE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,YAAY,IAAI,YAAY;YACpC,SAAS,EAAE,OAAO,CAAC,aAAa;YAChC,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG;gBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG;aAChC;SACF,CACF,CAAA;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,UAAU;YACV,SAAS;YACT,WAAW;YACX,MAAM;YACN,gBAAgB;YAChB,QAAQ;YACR,UAAU;YACV,SAAS;YACT,cAAc;YACd,SAAS;YACT,eAAe;YACf,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,eAAe;YACf,cAAc;YACd,mBAAmB;YACnB,UAAU;YACV,SAAS;YACT,YAAY;YACZ,aAAa;YACb,cAAc;YACd,GAAG;YACH,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW;QAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAoB,EAAE,GAAW,EAAE,GAAW;QACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC3C,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CACJ,CAAA;QACD,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,uBAAuB,CAAC,GAAoB;QAC1C,OAAO,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,wBAAwB,CAAC;YAC9B,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAC1B,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,EACjD,WAAW,CACZ,CAAA;IACD,OAAO,SAAS,OAAO,EAAE,CAAA;AAC3B,CAAC,CAAA;AAED,eAAe,UAAU,CAAA","sourcesContent":["import assert from 'node:assert'\nimport * as plc from '@did-plc/lib'\nimport express from 'express'\nimport { Redis } from 'ioredis'\nimport * as nodemailer from 'nodemailer'\nimport * as ui8 from 'uint8arrays'\nimport * as undici from 'undici'\nimport { KmsKeypair, S3BlobStore } from '@atproto/aws'\nimport * as crypto from '@atproto/crypto'\nimport { IdResolver } from '@atproto/identity'\nimport { Client } from '@atproto/lex'\nimport {\n  AccessTokenMode,\n  JoseKey,\n  LexResolver,\n  OAuthProvider,\n  OAuthVerifier,\n} from '@atproto/oauth-provider'\nimport { BlobStore } from '@atproto/repo'\nimport {\n  createServiceAuthHeaders,\n  createServiceJwt,\n} from '@atproto/xrpc-server'\nimport {\n  Fetch,\n  isUnicastIp,\n  safeFetchWrap,\n  unicastLookup,\n} from '@atproto-labs/fetch-node'\nimport { AccountManager } from './account-manager/account-manager.js'\nimport { OAuthStore } from './account-manager/oauth-store.js'\nimport { ScopeReferenceGetter } from './account-manager/scope-reference-getter.js'\nimport { ActorStore } from './actor-store/actor-store.js'\nimport { authPassthru, forwardedFor } from './api/proxy.js'\nimport {\n  AuthVerifier,\n  createPublicKeyObject,\n  createSecretKeyObject,\n} from './auth-verifier.js'\nimport { BackgroundQueue } from './background.js'\nimport { BskyAppView } from './bsky-app-view.js'\nimport { ServerConfig, ServerSecrets } from './config/index.js'\nimport { Crawlers } from './crawlers.js'\nimport { DidSqliteCache } from './did-cache/index.js'\nimport { DiskBlobStore } from './disk-blobstore.js'\nimport { ImageUrlBuilder } from './image/image-url-builder.js'\nimport { fetchLogger, lexiconResolverLogger, oauthLogger } from './logger.js'\nimport { ServerMailer } from './mailer/index.js'\nimport { ModerationMailer } from './mailer/moderation.js'\nimport { LocalViewer, LocalViewerCreator } from './read-after-write/viewer.js'\nimport { getRedisClient } from './redis.js'\nimport { Sequencer } from './sequencer/index.js'\n\nexport type AppContextOptions = {\n  actorStore: ActorStore\n  blobstore: (did: string) => BlobStore\n  localViewer: LocalViewerCreator\n  mailer: ServerMailer\n  moderationMailer: ModerationMailer\n  didCache: DidSqliteCache\n  idResolver: IdResolver\n  plcClient: plc.Client\n  accountManager: AccountManager\n  sequencer: Sequencer\n  backgroundQueue: BackgroundQueue\n  redisScratch?: Redis\n  crawlers: Crawlers\n  bskyAppView?: BskyAppView\n  moderationClient?: Client\n  reportingClient?: Client\n  entrywayClient?: Client\n  entrywayAdminClient?: Client\n  proxyAgent: undici.Dispatcher\n  safeFetch: Fetch\n  oauthProvider?: OAuthProvider\n  authVerifier: AuthVerifier\n  plcRotationKey: crypto.Keypair\n  cfg: ServerConfig\n}\n\nexport class AppContext {\n  public actorStore: ActorStore\n  public blobstore: (did: string) => BlobStore\n  public localViewer: LocalViewerCreator\n  public mailer: ServerMailer\n  public moderationMailer: ModerationMailer\n  public didCache: DidSqliteCache\n  public idResolver: IdResolver\n  public plcClient: plc.Client\n  public accountManager: AccountManager\n  public sequencer: Sequencer\n  public backgroundQueue: BackgroundQueue\n  public redisScratch?: Redis\n  public crawlers: Crawlers\n  public bskyAppView?: BskyAppView\n  public moderationClient: Client | undefined\n  public reportingClient: Client | undefined\n  public entrywayClient: Client | undefined\n  public entrywayAdminClient: Client | undefined\n  public proxyAgent: undici.Dispatcher\n  public safeFetch: Fetch\n  public authVerifier: AuthVerifier\n  public oauthProvider?: OAuthProvider\n  public plcRotationKey: crypto.Keypair\n  public cfg: ServerConfig\n\n  constructor(opts: AppContextOptions) {\n    this.actorStore = opts.actorStore\n    this.blobstore = opts.blobstore\n    this.localViewer = opts.localViewer\n    this.mailer = opts.mailer\n    this.moderationMailer = opts.moderationMailer\n    this.didCache = opts.didCache\n    this.idResolver = opts.idResolver\n    this.plcClient = opts.plcClient\n    this.accountManager = opts.accountManager\n    this.sequencer = opts.sequencer\n    this.backgroundQueue = opts.backgroundQueue\n    this.redisScratch = opts.redisScratch\n    this.crawlers = opts.crawlers\n    this.bskyAppView = opts.bskyAppView\n    this.moderationClient = opts.moderationClient\n    this.reportingClient = opts.reportingClient\n    this.entrywayClient = opts.entrywayClient\n    this.entrywayAdminClient = opts.entrywayAdminClient\n    this.proxyAgent = opts.proxyAgent\n    this.safeFetch = opts.safeFetch\n    this.authVerifier = opts.authVerifier\n    this.oauthProvider = opts.oauthProvider\n    this.plcRotationKey = opts.plcRotationKey\n    this.cfg = opts.cfg\n  }\n\n  static async fromConfig(\n    cfg: ServerConfig,\n    secrets: ServerSecrets,\n    overrides?: Partial<AppContextOptions>,\n  ): Promise<AppContext> {\n    const blobstore =\n      cfg.blobstore.provider === 's3'\n        ? S3BlobStore.creator({\n            bucket: cfg.blobstore.bucket,\n            region: cfg.blobstore.region,\n            endpoint: cfg.blobstore.endpoint,\n            forcePathStyle: cfg.blobstore.forcePathStyle,\n            credentials: cfg.blobstore.credentials,\n            uploadTimeoutMs: cfg.blobstore.uploadTimeoutMs,\n          })\n        : DiskBlobStore.creator(\n            cfg.blobstore.location,\n            cfg.blobstore.tempLocation,\n          )\n\n    const mailTransport =\n      cfg.email !== null\n        ? nodemailer.createTransport(cfg.email.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const mailer = new ServerMailer(mailTransport, cfg)\n\n    const modMailTransport =\n      cfg.moderationEmail !== null\n        ? nodemailer.createTransport(cfg.moderationEmail.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const moderationMailer = new ModerationMailer(modMailTransport, cfg)\n\n    const didCache = new DidSqliteCache(\n      cfg.db.didCacheDbLoc,\n      cfg.identity.cacheStaleTTL,\n      cfg.identity.cacheMaxTTL,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    await didCache.migrateOrThrow()\n\n    const idResolver = new IdResolver({\n      plcUrl: cfg.identity.plcUrl,\n      didCache,\n      timeout: cfg.identity.resolverTimeout,\n      backupNameservers: cfg.identity.handleBackupNameservers,\n    })\n    const plcClient = new plc.Client(cfg.identity.plcUrl)\n\n    const backgroundQueue = new BackgroundQueue()\n    const crawlers = new Crawlers(\n      backgroundQueue,\n      cfg.service.hostname,\n      cfg.crawlers,\n    )\n    const sequencer = new Sequencer(\n      cfg.db.sequencerDbLoc,\n      crawlers,\n      undefined,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    const redisScratch = cfg.redis\n      ? getRedisClient(cfg.redis.address, cfg.redis.password)\n      : undefined\n\n    const bskyAppView = cfg.bskyAppView\n      ? new BskyAppView({\n          ...cfg.bskyAppView,\n          validateResponse: cfg.service.devMode,\n        })\n      : undefined\n\n    const moderationClient = cfg.modService\n      ? new Client(\n          { service: cfg.modService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const reportingClient = cfg.reportService\n      ? new Client(\n          { service: cfg.reportService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayClient = cfg.entryway\n      ? new Client(\n          { service: cfg.entryway.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayAdminClient =\n      cfg.entryway && secrets.entrywayAdminToken\n        ? new Client(\n            { service: cfg.entryway.url },\n            {\n              headers: {\n                authorization: basicAuthHeader(\n                  'admin',\n                  secrets.entrywayAdminToken,\n                ),\n              },\n              // Trust internal services to send us well-formed responses\n              strictResponseProcessing: false,\n              validateResponse: cfg.service.devMode,\n            },\n          )\n        : undefined\n\n    const jwtSecretKey = createSecretKeyObject(secrets.jwtSecret)\n    const jwtPublicKey = cfg.entryway\n      ? createPublicKeyObject(cfg.entryway.jwtPublicKeyHex)\n      : null\n\n    const imageUrlBuilder = new ImageUrlBuilder(\n      cfg.service.hostname,\n      bskyAppView,\n    )\n\n    const actorStore = new ActorStore(cfg.actorStore, {\n      blobstore,\n      backgroundQueue,\n    })\n\n    const accountManager = new AccountManager(\n      idResolver,\n      jwtSecretKey,\n      cfg.service.did,\n      cfg.identity.serviceHandleDomains,\n      cfg.db,\n    )\n    await accountManager.migrateOrThrow()\n\n    const plcRotationKey =\n      secrets.plcRotationKey.provider === 'kms'\n        ? await KmsKeypair.load({\n            keyId: secrets.plcRotationKey.keyId,\n          })\n        : await crypto.Secp256k1Keypair.import(\n            secrets.plcRotationKey.privateKeyHex,\n          )\n\n    const localViewer = LocalViewer.creator(\n      accountManager,\n      imageUrlBuilder,\n      bskyAppView,\n    )\n\n    // An agent for performing HTTP requests based on user provided URLs.\n    const proxyAgentBase = new undici.Agent({\n      allowH2: cfg.proxy.allowHTTP2, // This is experimental\n      headersTimeout: cfg.proxy.headersTimeout,\n      maxResponseSize: cfg.proxy.maxResponseSize,\n      bodyTimeout: cfg.proxy.bodyTimeout,\n      factory: cfg.proxy.disableSsrfProtection\n        ? undefined\n        : (origin, opts) => {\n            const { protocol, hostname } =\n              origin instanceof URL ? origin : new URL(origin)\n            if (protocol !== 'https:') {\n              throw new Error(`Forbidden protocol \"${protocol}\"`)\n            }\n            if (isUnicastIp(hostname) === false) {\n              throw new Error('Hostname resolved to non-unicast address')\n            }\n            return new undici.Pool(origin, opts)\n          },\n      connect: {\n        lookup: cfg.proxy.disableSsrfProtection ? undefined : unicastLookup,\n      },\n    })\n    const proxyAgent =\n      cfg.proxy.maxRetries > 0\n        ? new undici.RetryAgent(proxyAgentBase, {\n            statusCodes: [], // Only retry on socket errors\n            methods: ['GET', 'HEAD'],\n            maxRetries: cfg.proxy.maxRetries,\n          })\n        : proxyAgentBase\n\n    /**\n     * A fetch() function that protects against SSRF attacks, large responses &\n     * known bad domains. This function can safely be used to fetch user\n     * provided URLs (unless \"disableSsrfProtection\" is true, of course).\n     *\n     * @note **DO NOT** wrap `safeFetch` with any logging or other transforms as\n     * this might prevent the use of explicit `redirect: \"follow\"` init from\n     * working. See {@link safeFetchWrap}.\n     */\n    const safeFetch = safeFetchWrap({\n      allowIpHost: false,\n      allowImplicitRedirect: false,\n      responseMaxSize: cfg.fetch.maxResponseSize,\n      ssrfProtection: !cfg.fetch.disableSsrfProtection,\n\n      fetch: function (input, init) {\n        const method =\n          init?.method ?? (input instanceof Request ? input.method : 'GET')\n        const uri = input instanceof Request ? input.url : String(input)\n\n        fetchLogger.info({ method, uri }, 'fetch')\n\n        return globalThis.fetch.call(this, input, init)\n      },\n    })\n\n    const oauthProvider = cfg.oauth.provider\n      ? new OAuthProvider({\n          issuer: cfg.oauth.issuer,\n          keyset: [await JoseKey.fromKeyLike(jwtSecretKey, undefined, 'HS256')],\n          store: new OAuthStore(\n            accountManager,\n            actorStore,\n            imageUrlBuilder,\n            backgroundQueue,\n            mailer,\n            sequencer,\n            plcClient,\n            plcRotationKey,\n            cfg.service.publicUrl,\n            cfg.identity.recoveryDidKey,\n          ),\n          redis: redisScratch,\n          dpopSecret: secrets.dpopSecret,\n          inviteCodeRequired: cfg.invites.required,\n          availableUserDomains: cfg.identity.serviceHandleDomains,\n          hcaptcha: cfg.oauth.provider.hcaptcha,\n          branding: cfg.oauth.provider.branding,\n          safeFetch,\n          lexResolver: new LexResolver({\n            fetch: safeFetch,\n            plcDirectoryUrl: cfg.identity.plcUrl,\n            hooks: {\n              onResolveAuthority: ({ nsid }) => {\n                lexiconResolverLogger.debug(\n                  { nsid: nsid.toString() },\n                  'Resolving lexicon DID authority',\n                )\n                // Override the lexicon did resolution to point to a custom PDS\n                return cfg.lexicon.didAuthority\n              },\n              onResolveAuthorityResult({ nsid, did }) {\n                lexiconResolverLogger.info(\n                  { nsid: nsid.toString(), did },\n                  'Resolved lexicon DID',\n                )\n              },\n              onResolveAuthorityError({ nsid, err }) {\n                lexiconResolverLogger.error(\n                  { nsid: nsid.toString(), err },\n                  'Lexicon DID resolution error',\n                )\n              },\n              onFetchResult({ uri, cid }) {\n                lexiconResolverLogger.info(\n                  { uri: uri.toString(), cid: cid.toString() },\n                  'Fetched lexicon',\n                )\n              },\n              onFetchError({ err, uri }) {\n                lexiconResolverLogger.error(\n                  { uri: uri.toString(), err },\n                  'Lexicon fetch error',\n                )\n              },\n            },\n          }),\n          metadata: {\n            protected_resources: [new URL(cfg.oauth.issuer).origin],\n          },\n          // If the PDS is both an authorization server & resource server (no\n          // entryway), we can afford to check the token validity on every\n          // request. This allows revoked tokens to be rejected immediately.\n          // This also allows JWT to be shorter since some claims (notably the\n          // \"scope\" claim) do not need to be included in the token.\n          accessTokenMode: AccessTokenMode.stateful,\n\n          getClientInfo(clientId) {\n            return {\n              isTrusted: cfg.oauth.provider?.trustedClients?.includes(clientId),\n            }\n          },\n        })\n      : undefined\n\n    const scopeRefGetter = entrywayClient\n      ? new ScopeReferenceGetter(entrywayClient, redisScratch)\n      : undefined\n\n    const oauthVerifier: OAuthVerifier =\n      oauthProvider ?? // OAuthProvider extends OAuthVerifier\n      new OAuthVerifier({\n        issuer: cfg.oauth.issuer,\n        keyset: [await JoseKey.fromKeyLike(jwtPublicKey!, undefined, 'ES256K')],\n        dpopSecret: secrets.dpopSecret,\n        redis: redisScratch,\n        onDecodeToken: async ({ payload, dpopProof }) => {\n          // @TODO drop this once oauth provider no longer accepts DPoP proof with\n          // query or fragment in \"htu\" claim.\n          if (dpopProof?.htu.match(/[?#]/)) {\n            oauthLogger.info(\n              { htu: dpopProof.htu, client_id: payload.client_id },\n              'DPoP proof \"htu\" contains query or fragment',\n            )\n          }\n\n          if (scopeRefGetter) {\n            payload.scope = await scopeRefGetter.dereference(payload.scope)\n          }\n\n          return payload\n        },\n      })\n\n    const authVerifier = new AuthVerifier(\n      accountManager,\n      idResolver,\n      oauthVerifier,\n      {\n        publicUrl: cfg.service.publicUrl,\n        jwtKey: jwtPublicKey ?? jwtSecretKey,\n        adminPass: secrets.adminPassword,\n        dids: {\n          pds: cfg.service.did,\n          entryway: cfg.entryway?.did,\n          modService: cfg.modService?.did,\n        },\n      },\n    )\n\n    return new AppContext({\n      actorStore,\n      blobstore,\n      localViewer,\n      mailer,\n      moderationMailer,\n      didCache,\n      idResolver,\n      plcClient,\n      accountManager,\n      sequencer,\n      backgroundQueue,\n      redisScratch,\n      crawlers,\n      bskyAppView,\n      moderationClient,\n      reportingClient,\n      entrywayClient,\n      entrywayAdminClient,\n      proxyAgent,\n      safeFetch,\n      authVerifier,\n      oauthProvider,\n      plcRotationKey,\n      cfg,\n      ...(overrides ?? {}),\n    })\n  }\n\n  async appviewAuthHeaders(did: string, lxm: string) {\n    assert(this.bskyAppView)\n    return this.serviceAuthHeaders(did, this.bskyAppView.did, lxm)\n  }\n\n  async entrywayAuthHeaders(req: express.Request, did: string, lxm: string) {\n    assert(this.cfg.entryway)\n    const headers = await this.serviceAuthHeaders(\n      did,\n      this.cfg.entryway.did,\n      lxm,\n    )\n    return forwardedFor(req, headers)\n  }\n\n  entrywayPassthruHeaders(req: express.Request) {\n    return forwardedFor(req, authPassthru(req))\n  }\n\n  async serviceAuthHeaders(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceAuthHeaders({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n\n  async serviceAuthJwt(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceJwt({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n}\n\nconst basicAuthHeader = (username: string, password: string) => {\n  const encoded = ui8.toString(\n    ui8.fromString(`${username}:${password}`, 'utf8'),\n    'base64pad',\n  )\n  return `Basic ${encoded}`\n}\n\nexport default AppContext\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAGnC,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAA;AAClC,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EACL,eAAe,EACf,OAAO,EACP,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,WAAW,EAAsB,MAAM,8BAA8B,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AA6BhD,MAAM,OAAO,UAAU;IA0BrB,YAAY,IAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,GAAiB,EACjB,OAAsB,EACtB,SAAsC;QAEtC,MAAM,SAAS,GACb,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC7B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;gBAC5B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;gBAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;gBAChC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;gBAC5C,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW;gBACtC,eAAe,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe;aAC/C,CAAC;YACJ,CAAC,CAAC,aAAa,CAAC,OAAO,CACnB,GAAG,CAAC,SAAS,CAAC,QAAQ,EACtB,GAAG,CAAC,SAAS,CAAC,YAAY,CAC3B,CAAA;QAEP,MAAM,aAAa,GACjB,GAAG,CAAC,KAAK,KAAK,IAAI;YAChB,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;QAEnD,MAAM,gBAAgB,GACpB,GAAG,CAAC,eAAe,KAAK,IAAI;YAC1B,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QAEpE,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,GAAG,CAAC,EAAE,CAAC,aAAa,EACpB,GAAG,CAAC,QAAQ,CAAC,aAAa,EAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,EACxB,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;QAE/B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;YAChC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YAC3B,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe;YACrC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,uBAAuB;SACxD,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAErD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;QAC7C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,eAAe,EACf,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,GAAG,CAAC,QAAQ,CACb,CAAA;QACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAC7B,GAAG,CAAC,EAAE,CAAC,cAAc,EACrB,QAAQ,EACR,SAAS,EACT,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK;YAC5B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW;YACjC,CAAC,CAAC,IAAI,WAAW,CAAC;gBACd,GAAG,GAAG,CAAC,WAAW;gBAClB,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU;YACrC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAC/B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa;YACvC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,EAClC;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ;YACjC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAC7B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,mBAAmB,GACvB,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB;YACxC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAC7B;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,eAAe,CAC5B,OAAO,EACP,OAAO,CAAC,kBAAkB,CAC3B;iBACF;gBACD,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ;YAC/B,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,WAAW,CACZ,CAAA;QAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YAChD,SAAS;YACT,eAAe;SAChB,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,UAAU,EACV,YAAY,EACZ,MAAM,EACN,GAAG,CAAC,OAAO,CAAC,GAAG,EACf,GAAG,CAAC,QAAQ,CAAC,oBAAoB,EACjC,GAAG,CAAC,EAAE,CACP,CAAA;QACD,MAAM,cAAc,CAAC,cAAc,EAAE,CAAA;QAErC,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,CAAC,QAAQ,KAAK,KAAK;YACvC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK;aACpC,CAAC;YACJ,CAAC,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAClC,OAAO,CAAC,cAAc,CAAC,aAAa,CACrC,CAAA;QAEP,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CACrC,cAAc,EACd,eAAe,EACf,WAAW,CACZ,CAAA;QAED,qEAAqE;QACrE,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,uBAAuB;YACtD,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc;YACxC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW;YAClC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,qBAAqB;gBACtC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;oBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAC1B,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;oBAClD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;oBACrD,CAAC;oBACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;wBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;oBAC7D,CAAC;oBACD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBACtC,CAAC;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;aACpE;SACF,CAAC,CAAA;QACF,MAAM,UAAU,GACd,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;YACtB,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE;gBACpC,WAAW,EAAE,EAAE,EAAE,8BAA8B;gBAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;gBACxB,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU;aACjC,CAAC;YACJ,CAAC,CAAC,cAAc,CAAA;QAEpB;;;;;;;;WAQG;QACH,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,WAAW,EAAE,KAAK;YAClB,qBAAqB,EAAE,KAAK;YAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB;YAEhD,KAAK,EAAE,UAAU,KAAK,EAAE,IAAI;gBAC1B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACnE,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAEhE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;gBAE1C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ;YACtC,CAAC,CAAC,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACrE,KAAK,EAAE,IAAI,UAAU,CACnB,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAC5B;gBACD,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;gBACxC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,oBAAoB;gBACvD,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,SAAS;gBACT,WAAW,EAAE,IAAI,WAAW,CAAC;oBAC3B,KAAK,EAAE,SAAS;oBAChB,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;oBACpC,KAAK,EAAE;wBACL,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;4BAC/B,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EACzB,iCAAiC,CAClC,CAAA;4BACD,+DAA+D;4BAC/D,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAA;wBACjC,CAAC;wBACD,wBAAwB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;4BACpC,qBAAqB,CAAC,IAAI,CACxB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC9B,sBAAsB,CACvB,CAAA;wBACH,CAAC;wBACD,uBAAuB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;4BACnC,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC9B,8BAA8B,CAC/B,CAAA;wBACH,CAAC;wBACD,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;4BACxB,qBAAqB,CAAC,IAAI,CACxB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAC5C,iBAAiB,CAClB,CAAA;wBACH,CAAC;wBACD,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;4BACvB,qBAAqB,CAAC,KAAK,CACzB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC5B,qBAAqB,CACtB,CAAA;wBACH,CAAC;qBACF;iBACF,CAAC;gBACF,QAAQ,EAAE;oBACR,mBAAmB,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;iBACxD;gBACD,mEAAmE;gBACnE,gEAAgE;gBAChE,kEAAkE;gBAClE,oEAAoE;gBACpE,0DAA0D;gBAC1D,eAAe,EAAE,eAAe,CAAC,QAAQ;gBAEzC,aAAa,CAAC,QAAQ;oBACpB,OAAO;wBACL,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC;qBAClE,CAAA;gBACH,CAAC;aACF,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,aAAa,GACjB,aAAa,IAAI,sCAAsC;YACvD,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACvE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;oBAC9C,wEAAwE;oBACxE,oCAAoC;oBACpC,IAAI,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjC,WAAW,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EACpD,6CAA6C,CAC9C,CAAA;oBACH,CAAC;oBAED,IAAI,cAAc,EAAE,CAAC;wBACnB,OAAO,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;oBACjE,CAAC;oBAED,OAAO,OAAO,CAAA;gBAChB,CAAC;aACF,CAAC,CAAA;QAEJ,MAAM,YAAY,GAAG,IAAI,YAAY,CACnC,cAAc,EACd,UAAU,EACV,aAAa,EACb;YACE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,YAAY,IAAI,YAAY;YACpC,SAAS,EAAE,OAAO,CAAC,aAAa;YAChC,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG;gBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG;aAChC;SACF,CACF,CAAA;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,UAAU;YACV,SAAS;YACT,WAAW;YACX,MAAM;YACN,gBAAgB;YAChB,QAAQ;YACR,UAAU;YACV,SAAS;YACT,cAAc;YACd,SAAS;YACT,eAAe;YACf,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,eAAe;YACf,cAAc;YACd,mBAAmB;YACnB,UAAU;YACV,SAAS;YACT,YAAY;YACZ,aAAa;YACb,cAAc;YACd,GAAG;YACH,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW;QAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAoB,EAAE,GAAW,EAAE,GAAW;QACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC3C,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CACJ,CAAA;QACD,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,uBAAuB,CAAC,GAAoB;QAC1C,OAAO,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,wBAAwB,CAAC;YAC9B,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAC1B,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,EACjD,WAAW,CACZ,CAAA;IACD,OAAO,SAAS,OAAO,EAAE,CAAA;AAC3B,CAAC,CAAA;AAED,eAAe,UAAU,CAAA","sourcesContent":["import assert from 'node:assert'\nimport * as plc from '@did-plc/lib'\nimport express from 'express'\nimport { Redis } from 'ioredis'\nimport * as nodemailer from 'nodemailer'\nimport * as ui8 from 'uint8arrays'\nimport * as undici from 'undici'\nimport { KmsKeypair, S3BlobStore } from '@atproto/aws'\nimport * as crypto from '@atproto/crypto'\nimport { IdResolver } from '@atproto/identity'\nimport { Client } from '@atproto/lex'\nimport {\n  AccessTokenMode,\n  JoseKey,\n  LexResolver,\n  OAuthProvider,\n  OAuthVerifier,\n} from '@atproto/oauth-provider'\nimport { BlobStore } from '@atproto/repo'\nimport {\n  createServiceAuthHeaders,\n  createServiceJwt,\n} from '@atproto/xrpc-server'\nimport {\n  Fetch,\n  isUnicastIp,\n  safeFetchWrap,\n  unicastLookup,\n} from '@atproto-labs/fetch-node'\nimport { AccountManager } from './account-manager/account-manager.js'\nimport { OAuthStore } from './account-manager/oauth-store.js'\nimport { ScopeReferenceGetter } from './account-manager/scope-reference-getter.js'\nimport { ActorStore } from './actor-store/actor-store.js'\nimport { authPassthru, forwardedFor } from './api/proxy.js'\nimport {\n  AuthVerifier,\n  createPublicKeyObject,\n  createSecretKeyObject,\n} from './auth-verifier.js'\nimport { BackgroundQueue } from './background.js'\nimport { BskyAppView } from './bsky-app-view.js'\nimport { ServerConfig, ServerSecrets } from './config/index.js'\nimport { Crawlers } from './crawlers.js'\nimport { DidSqliteCache } from './did-cache/index.js'\nimport { DiskBlobStore } from './disk-blobstore.js'\nimport { ImageUrlBuilder } from './image/image-url-builder.js'\nimport { fetchLogger, lexiconResolverLogger, oauthLogger } from './logger.js'\nimport { ServerMailer } from './mailer/index.js'\nimport { ModerationMailer } from './mailer/moderation.js'\nimport { LocalViewer, LocalViewerCreator } from './read-after-write/viewer.js'\nimport { getRedisClient } from './redis.js'\nimport { Sequencer } from './sequencer/index.js'\n\nexport type AppContextOptions = {\n  actorStore: ActorStore\n  blobstore: (did: string) => BlobStore\n  localViewer: LocalViewerCreator\n  mailer: ServerMailer\n  moderationMailer: ModerationMailer\n  didCache: DidSqliteCache\n  idResolver: IdResolver\n  plcClient: plc.Client\n  accountManager: AccountManager\n  sequencer: Sequencer\n  backgroundQueue: BackgroundQueue\n  redisScratch?: Redis\n  crawlers: Crawlers\n  bskyAppView?: BskyAppView\n  moderationClient?: Client\n  reportingClient?: Client\n  entrywayClient?: Client\n  entrywayAdminClient?: Client\n  proxyAgent: undici.Dispatcher\n  safeFetch: Fetch\n  oauthProvider?: OAuthProvider\n  authVerifier: AuthVerifier\n  plcRotationKey: crypto.Keypair\n  cfg: ServerConfig\n}\n\nexport class AppContext {\n  public actorStore: ActorStore\n  public blobstore: (did: string) => BlobStore\n  public localViewer: LocalViewerCreator\n  public mailer: ServerMailer\n  public moderationMailer: ModerationMailer\n  public didCache: DidSqliteCache\n  public idResolver: IdResolver\n  public plcClient: plc.Client\n  public accountManager: AccountManager\n  public sequencer: Sequencer\n  public backgroundQueue: BackgroundQueue\n  public redisScratch?: Redis\n  public crawlers: Crawlers\n  public bskyAppView?: BskyAppView\n  public moderationClient: Client | undefined\n  public reportingClient: Client | undefined\n  public entrywayClient: Client | undefined\n  public entrywayAdminClient: Client | undefined\n  public proxyAgent: undici.Dispatcher\n  public safeFetch: Fetch\n  public authVerifier: AuthVerifier\n  public oauthProvider?: OAuthProvider\n  public plcRotationKey: crypto.Keypair\n  public cfg: ServerConfig\n\n  constructor(opts: AppContextOptions) {\n    this.actorStore = opts.actorStore\n    this.blobstore = opts.blobstore\n    this.localViewer = opts.localViewer\n    this.mailer = opts.mailer\n    this.moderationMailer = opts.moderationMailer\n    this.didCache = opts.didCache\n    this.idResolver = opts.idResolver\n    this.plcClient = opts.plcClient\n    this.accountManager = opts.accountManager\n    this.sequencer = opts.sequencer\n    this.backgroundQueue = opts.backgroundQueue\n    this.redisScratch = opts.redisScratch\n    this.crawlers = opts.crawlers\n    this.bskyAppView = opts.bskyAppView\n    this.moderationClient = opts.moderationClient\n    this.reportingClient = opts.reportingClient\n    this.entrywayClient = opts.entrywayClient\n    this.entrywayAdminClient = opts.entrywayAdminClient\n    this.proxyAgent = opts.proxyAgent\n    this.safeFetch = opts.safeFetch\n    this.authVerifier = opts.authVerifier\n    this.oauthProvider = opts.oauthProvider\n    this.plcRotationKey = opts.plcRotationKey\n    this.cfg = opts.cfg\n  }\n\n  static async fromConfig(\n    cfg: ServerConfig,\n    secrets: ServerSecrets,\n    overrides?: Partial<AppContextOptions>,\n  ): Promise<AppContext> {\n    const blobstore =\n      cfg.blobstore.provider === 's3'\n        ? S3BlobStore.creator({\n            bucket: cfg.blobstore.bucket,\n            region: cfg.blobstore.region,\n            endpoint: cfg.blobstore.endpoint,\n            forcePathStyle: cfg.blobstore.forcePathStyle,\n            credentials: cfg.blobstore.credentials,\n            uploadTimeoutMs: cfg.blobstore.uploadTimeoutMs,\n          })\n        : DiskBlobStore.creator(\n            cfg.blobstore.location,\n            cfg.blobstore.tempLocation,\n          )\n\n    const mailTransport =\n      cfg.email !== null\n        ? nodemailer.createTransport(cfg.email.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const mailer = new ServerMailer(mailTransport, cfg)\n\n    const modMailTransport =\n      cfg.moderationEmail !== null\n        ? nodemailer.createTransport(cfg.moderationEmail.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const moderationMailer = new ModerationMailer(modMailTransport, cfg)\n\n    const didCache = new DidSqliteCache(\n      cfg.db.didCacheDbLoc,\n      cfg.identity.cacheStaleTTL,\n      cfg.identity.cacheMaxTTL,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    await didCache.migrateOrThrow()\n\n    const idResolver = new IdResolver({\n      plcUrl: cfg.identity.plcUrl,\n      didCache,\n      timeout: cfg.identity.resolverTimeout,\n      backupNameservers: cfg.identity.handleBackupNameservers,\n    })\n    const plcClient = new plc.Client(cfg.identity.plcUrl)\n\n    const backgroundQueue = new BackgroundQueue()\n    const crawlers = new Crawlers(\n      backgroundQueue,\n      cfg.service.hostname,\n      cfg.crawlers,\n    )\n    const sequencer = new Sequencer(\n      cfg.db.sequencerDbLoc,\n      crawlers,\n      undefined,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    const redisScratch = cfg.redis\n      ? getRedisClient(cfg.redis.address, cfg.redis.password)\n      : undefined\n\n    const bskyAppView = cfg.bskyAppView\n      ? new BskyAppView({\n          ...cfg.bskyAppView,\n          validateResponse: cfg.service.devMode,\n        })\n      : undefined\n\n    const moderationClient = cfg.modService\n      ? new Client(\n          { service: cfg.modService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const reportingClient = cfg.reportService\n      ? new Client(\n          { service: cfg.reportService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayClient = cfg.entryway\n      ? new Client(\n          { service: cfg.entryway.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayAdminClient =\n      cfg.entryway && secrets.entrywayAdminToken\n        ? new Client(\n            { service: cfg.entryway.url },\n            {\n              headers: {\n                authorization: basicAuthHeader(\n                  'admin',\n                  secrets.entrywayAdminToken,\n                ),\n              },\n              // Trust internal services to send us well-formed responses\n              strictResponseProcessing: false,\n              validateResponse: cfg.service.devMode,\n            },\n          )\n        : undefined\n\n    const jwtSecretKey = createSecretKeyObject(secrets.jwtSecret)\n    const jwtPublicKey = cfg.entryway\n      ? createPublicKeyObject(cfg.entryway.jwtPublicKeyHex)\n      : null\n\n    const imageUrlBuilder = new ImageUrlBuilder(\n      cfg.service.hostname,\n      bskyAppView,\n    )\n\n    const actorStore = new ActorStore(cfg.actorStore, {\n      blobstore,\n      backgroundQueue,\n    })\n\n    const accountManager = new AccountManager(\n      idResolver,\n      jwtSecretKey,\n      mailer,\n      cfg.service.did,\n      cfg.identity.serviceHandleDomains,\n      cfg.db,\n    )\n    await accountManager.migrateOrThrow()\n\n    const plcRotationKey =\n      secrets.plcRotationKey.provider === 'kms'\n        ? await KmsKeypair.load({\n            keyId: secrets.plcRotationKey.keyId,\n          })\n        : await crypto.Secp256k1Keypair.import(\n            secrets.plcRotationKey.privateKeyHex,\n          )\n\n    const localViewer = LocalViewer.creator(\n      accountManager,\n      imageUrlBuilder,\n      bskyAppView,\n    )\n\n    // An agent for performing HTTP requests based on user provided URLs.\n    const proxyAgentBase = new undici.Agent({\n      allowH2: cfg.proxy.allowHTTP2, // This is experimental\n      headersTimeout: cfg.proxy.headersTimeout,\n      maxResponseSize: cfg.proxy.maxResponseSize,\n      bodyTimeout: cfg.proxy.bodyTimeout,\n      factory: cfg.proxy.disableSsrfProtection\n        ? undefined\n        : (origin, opts) => {\n            const { protocol, hostname } =\n              origin instanceof URL ? origin : new URL(origin)\n            if (protocol !== 'https:') {\n              throw new Error(`Forbidden protocol \"${protocol}\"`)\n            }\n            if (isUnicastIp(hostname) === false) {\n              throw new Error('Hostname resolved to non-unicast address')\n            }\n            return new undici.Pool(origin, opts)\n          },\n      connect: {\n        lookup: cfg.proxy.disableSsrfProtection ? undefined : unicastLookup,\n      },\n    })\n    const proxyAgent =\n      cfg.proxy.maxRetries > 0\n        ? new undici.RetryAgent(proxyAgentBase, {\n            statusCodes: [], // Only retry on socket errors\n            methods: ['GET', 'HEAD'],\n            maxRetries: cfg.proxy.maxRetries,\n          })\n        : proxyAgentBase\n\n    /**\n     * A fetch() function that protects against SSRF attacks, large responses &\n     * known bad domains. This function can safely be used to fetch user\n     * provided URLs (unless \"disableSsrfProtection\" is true, of course).\n     *\n     * @note **DO NOT** wrap `safeFetch` with any logging or other transforms as\n     * this might prevent the use of explicit `redirect: \"follow\"` init from\n     * working. See {@link safeFetchWrap}.\n     */\n    const safeFetch = safeFetchWrap({\n      allowIpHost: false,\n      allowImplicitRedirect: false,\n      responseMaxSize: cfg.fetch.maxResponseSize,\n      ssrfProtection: !cfg.fetch.disableSsrfProtection,\n\n      fetch: function (input, init) {\n        const method =\n          init?.method ?? (input instanceof Request ? input.method : 'GET')\n        const uri = input instanceof Request ? input.url : String(input)\n\n        fetchLogger.info({ method, uri }, 'fetch')\n\n        return globalThis.fetch.call(this, input, init)\n      },\n    })\n\n    const oauthProvider = cfg.oauth.provider\n      ? new OAuthProvider({\n          issuer: cfg.oauth.issuer,\n          keyset: [await JoseKey.fromKeyLike(jwtSecretKey, undefined, 'HS256')],\n          store: new OAuthStore(\n            accountManager,\n            actorStore,\n            imageUrlBuilder,\n            backgroundQueue,\n            mailer,\n            sequencer,\n            plcClient,\n            plcRotationKey,\n            cfg.service.publicUrl,\n            cfg.identity.recoveryDidKey,\n          ),\n          redis: redisScratch,\n          dpopSecret: secrets.dpopSecret,\n          inviteCodeRequired: cfg.invites.required,\n          availableUserDomains: cfg.identity.serviceHandleDomains,\n          hcaptcha: cfg.oauth.provider.hcaptcha,\n          branding: cfg.oauth.provider.branding,\n          safeFetch,\n          lexResolver: new LexResolver({\n            fetch: safeFetch,\n            plcDirectoryUrl: cfg.identity.plcUrl,\n            hooks: {\n              onResolveAuthority: ({ nsid }) => {\n                lexiconResolverLogger.debug(\n                  { nsid: nsid.toString() },\n                  'Resolving lexicon DID authority',\n                )\n                // Override the lexicon did resolution to point to a custom PDS\n                return cfg.lexicon.didAuthority\n              },\n              onResolveAuthorityResult({ nsid, did }) {\n                lexiconResolverLogger.info(\n                  { nsid: nsid.toString(), did },\n                  'Resolved lexicon DID',\n                )\n              },\n              onResolveAuthorityError({ nsid, err }) {\n                lexiconResolverLogger.error(\n                  { nsid: nsid.toString(), err },\n                  'Lexicon DID resolution error',\n                )\n              },\n              onFetchResult({ uri, cid }) {\n                lexiconResolverLogger.info(\n                  { uri: uri.toString(), cid: cid.toString() },\n                  'Fetched lexicon',\n                )\n              },\n              onFetchError({ err, uri }) {\n                lexiconResolverLogger.error(\n                  { uri: uri.toString(), err },\n                  'Lexicon fetch error',\n                )\n              },\n            },\n          }),\n          metadata: {\n            protected_resources: [new URL(cfg.oauth.issuer).origin],\n          },\n          // If the PDS is both an authorization server & resource server (no\n          // entryway), we can afford to check the token validity on every\n          // request. This allows revoked tokens to be rejected immediately.\n          // This also allows JWT to be shorter since some claims (notably the\n          // \"scope\" claim) do not need to be included in the token.\n          accessTokenMode: AccessTokenMode.stateful,\n\n          getClientInfo(clientId) {\n            return {\n              isTrusted: cfg.oauth.provider?.trustedClients?.includes(clientId),\n            }\n          },\n        })\n      : undefined\n\n    const scopeRefGetter = entrywayClient\n      ? new ScopeReferenceGetter(entrywayClient, redisScratch)\n      : undefined\n\n    const oauthVerifier: OAuthVerifier =\n      oauthProvider ?? // OAuthProvider extends OAuthVerifier\n      new OAuthVerifier({\n        issuer: cfg.oauth.issuer,\n        keyset: [await JoseKey.fromKeyLike(jwtPublicKey!, undefined, 'ES256K')],\n        dpopSecret: secrets.dpopSecret,\n        redis: redisScratch,\n        onDecodeToken: async ({ payload, dpopProof }) => {\n          // @TODO drop this once oauth provider no longer accepts DPoP proof with\n          // query or fragment in \"htu\" claim.\n          if (dpopProof?.htu.match(/[?#]/)) {\n            oauthLogger.info(\n              { htu: dpopProof.htu, client_id: payload.client_id },\n              'DPoP proof \"htu\" contains query or fragment',\n            )\n          }\n\n          if (scopeRefGetter) {\n            payload.scope = await scopeRefGetter.dereference(payload.scope)\n          }\n\n          return payload\n        },\n      })\n\n    const authVerifier = new AuthVerifier(\n      accountManager,\n      idResolver,\n      oauthVerifier,\n      {\n        publicUrl: cfg.service.publicUrl,\n        jwtKey: jwtPublicKey ?? jwtSecretKey,\n        adminPass: secrets.adminPassword,\n        dids: {\n          pds: cfg.service.did,\n          entryway: cfg.entryway?.did,\n          modService: cfg.modService?.did,\n        },\n      },\n    )\n\n    return new AppContext({\n      actorStore,\n      blobstore,\n      localViewer,\n      mailer,\n      moderationMailer,\n      didCache,\n      idResolver,\n      plcClient,\n      accountManager,\n      sequencer,\n      backgroundQueue,\n      redisScratch,\n      crawlers,\n      bskyAppView,\n      moderationClient,\n      reportingClient,\n      entrywayClient,\n      entrywayAdminClient,\n      proxyAgent,\n      safeFetch,\n      authVerifier,\n      oauthProvider,\n      plcRotationKey,\n      cfg,\n      ...(overrides ?? {}),\n    })\n  }\n\n  async appviewAuthHeaders(did: string, lxm: string) {\n    assert(this.bskyAppView)\n    return this.serviceAuthHeaders(did, this.bskyAppView.did, lxm)\n  }\n\n  async entrywayAuthHeaders(req: express.Request, did: string, lxm: string) {\n    assert(this.cfg.entryway)\n    const headers = await this.serviceAuthHeaders(\n      did,\n      this.cfg.entryway.did,\n      lxm,\n    )\n    return forwardedFor(req, headers)\n  }\n\n  entrywayPassthruHeaders(req: express.Request) {\n    return forwardedFor(req, authPassthru(req))\n  }\n\n  async serviceAuthHeaders(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceAuthHeaders({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n\n  async serviceAuthJwt(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceJwt({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n}\n\nconst basicAuthHeader = (username: string, password: string) => {\n  const encoded = ui8.toString(\n    ui8.fromString(`${username}:${password}`, 'utf8'),\n    'base64pad',\n  )\n  return `Basic ${encoded}`\n}\n\nexport default AppContext\n"]}

package/dist/lexicons/app/bsky/actor/defs.d.ts

@@ -1,3 +1,2 @@
 export * from './defs.defs.js';
-export * as $defs from './defs.defs.js';
 //# sourceMappingURL=defs.d.ts.map

package/dist/lexicons/app/bsky/actor/defs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defs.d.ts","sourceRoot":"","sources":["../../../../../src/lexicons/app/bsky/actor/defs.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"defs.d.ts","sourceRoot":"","sources":["../../../../../src/lexicons/app/bsky/actor/defs.ts"],"names":[],"mappings":"AAIA,cAAc,gBAAgB,CAAA"}