@atproto/pds 0.5.25 → 0.5.26

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @atproto/pds
 
+## 0.5.26
+
+### Patch Changes
+
+- [#5305](https://github.com/bluesky-social/atproto/pull/5305) [`fca9bd8`](https://github.com/bluesky-social/atproto/commit/fca9bd8fd3384a1f45f9540654edac8db774aecb) Thanks [@bigmoves](https://github.com/bigmoves)! - Add an optional per-scheme background image to the authorization screens via `branding.background`. The provider paints the configured light and dark image behind the auth card (`cover` / `center` over the neutral base), chosen by `prefers-color-scheme`. On the PDS, configure it with `PDS_BACKGROUND_LIGHT_URL` and `PDS_BACKGROUND_DARK_URL`.
+
+- [#5344](https://github.com/bluesky-social/atproto/pull/5344) [`c2c31c7`](https://github.com/bluesky-social/atproto/commit/c2c31c7cffcacd37149e5ace02cf1cdfffb1472c) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add `xrpc.proxy` span attribute to OTEL traces
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add static `PDS.run()` function to create, start and destroy the PDS server
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Always default `version` to the value from `package.json`
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Handle SIGINT signals
+
+- [#5305](https://github.com/bluesky-social/atproto/pull/5305) [`fca9bd8`](https://github.com/bluesky-social/atproto/commit/fca9bd8fd3384a1f45f9540654edac8db774aecb) Thanks [@bigmoves](https://github.com/bigmoves)! - Simplify branding color customization to match the redesigned OAuth UI. Each color is a single RGB value (`primary`, `error`, `warning`, `info`, `success`). Only `primary` gets a foreground (`--primary-foreground`), now computed automatically as black or white — whichever has the higher WCAG 2.1 contrast against `primary`. It can no longer be overridden or tuned.
+
+  BREAKING (`@atproto/oauth-provider`): The `light`, `dark`, `contrastSaturation`, and all `{name}Contrast` / `{name}Hue` options are removed from `branding.colors` (only the flat `{name}` colors remain). `buildCustomizationCss` now emits `--branding-color-{name}` for each configured color plus a computed `--branding-color-primary-contrast`; it no longer emits any `--branding-color-{name}-hue`, the non-primary `--branding-color-{name}-contrast`, or the global `--contrast-sat`. Deployments that previously set an explicit primary foreground should instead choose a `primary` color that yields the desired foreground under the WCAG contrast computation.
+
+  BREAKING (`@atproto/pds`): The `PDS_LIGHT_COLOR`, `PDS_DARK_COLOR`, `PDS_CONTRAST_SATURATION`, `PDS_{PRIMARY,ERROR,WARNING,INFO,SUCCESS}_COLOR_CONTRAST`, and `PDS_{PRIMARY,ERROR,WARNING,INFO,SUCCESS}_COLOR_HUE` environment variables are removed.
+
+- [#5343](https://github.com/bluesky-social/atproto/pull/5343) [`1bde0b0`](https://github.com/bluesky-social/atproto/commit/1bde0b0e1205abb49d254d5deba28e29e42a93e2) Thanks [@dreyfus92](https://github.com/dreyfus92)! - Remove the `glob` dependency. It was only used by the mailer template build script, which now uses the `globSync` built into `node:fs`.
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Improve shutdown logic
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Properly destroy context services when the PDS start method fails
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove references to unused `entrywayAdminAgent`
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Handle SIGTERM signals sent during PDS initialization
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add logging for sign-in, sign-up, and token refresh events.
+
+- [#4805](https://github.com/bluesky-social/atproto/pull/4805) [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add telemetry script
+
+- Updated dependencies [[`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86), [`fca9bd8`](https://github.com/bluesky-social/atproto/commit/fca9bd8fd3384a1f45f9540654edac8db774aecb), [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86), [`fca9bd8`](https://github.com/bluesky-social/atproto/commit/fca9bd8fd3384a1f45f9540654edac8db774aecb), [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86), [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86), [`b66870d`](https://github.com/bluesky-social/atproto/commit/b66870d5a1efbcfa0cc07498c7cfcf3f0f243e86)]:
+  - @atproto/common@0.7.6
+  - @atproto/oauth-provider@0.22.0
+  - @atproto/aws@0.3.12
+  - @atproto/repo@0.10.10
+  - @atproto/xrpc-server@0.12.2
+  - @atproto/lex@0.3.5
+  - @atproto-labs/xrpc-utils@0.1.15
+
 ## 0.5.25
 
 ### Patch Changes

package/dist/account-manager/account-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager.d.ts","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,cAAc,CAAA;AAIvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAM5C,OAAO,EAAE,iBAAiB,EAAuB,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAQvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EAGvB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKvE,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAKjD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,iBAAiB;aAEvC,GAAG,EAAE,SAAS;IADhC,YACkB,GAAG,EAAE,SAAS,EAC9B,YAAY,SAAmC,EAGhD;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,qBAAa,cAAc;IAIvB,QAAQ,CAAC,GAAG,EAAE,YAAY;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO;IAVlC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IAEtB,YACW,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EAGjC;IAED,IAAI,UAAU,IAAI,SAAS,CAE1B;IAED,IAAI,oBAAoB,IAAI,MAAM,EAAE,CAEnC;IAEK,cAAc,kBAGnB;IAED,KAAK,SAEJ;IAKK,UAAU,CACd,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,WAAW,CACf,IAAI,EAAE,SAAS,EAAE,EACjB,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAEpC;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAIzD;IAEK,cAAc,CAClB,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3B;IAEK,gBAAgB,CAAC,WAAW,EAAE,kBAAkB;gBAUtC,aAAa,CAAC,OAAO;iBAAW,IAAI;;gBACpC,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAC1D;IAEK,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,EACE,GAAG,EACH,aAAqB,GACtB,GAAE;QACD,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,OAAO,CAAA;KACnB,GACL,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GACX,EAAE;QACD,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,iBAwCA;IAEK,uBAAuB,CAAC,IAAI,EAAE;QAClC,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB;;;OAWA;IAED;;;;;;;;OAQG;IACG,YAAY,CAChB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAwBlD;IAEK,oBAAoB,CACxB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QACT,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QAEpB,OAAO,EAAE,YAAY,CAAA;KACtB,CAAC,CAyBD;IAED;;;OAGG;IACG,mBAAmB,CACvB,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf;IAEK,aAAa,CAAC,GAAG,EAAE,SAAS,iBAEjC;IAEK,eAAe,CACnB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,iBAS5C;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS;;;cAEzC;IAEK,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,iBAEzD;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B;gBA1Qa,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAsS1D;IAEK,eAAe,CAAC,GAAG,EAAE,SAAS;gBA1SpB,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAyU1D;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS,iBAGzC;IAKK,aAAa,CACjB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,EAC5C,aAAa,UAAQ;;;OActB;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,OAsDlC;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,oBAElC;IAKK,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,GACT,EAAE;QACD,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC;QACV,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAA;QAC5C,aAAa,EAAE,OAAO,CAAA;KACvB,CAAC,CA2CD;IAKK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,6DAExE;IAEK,gBAAgB,CAAC,GAAG,EAAE,SAAS;;;;SAEpC;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,CAE1C;IAEK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,iBAOnD;IAKK,uBAAuB,CAAC,IAAI,EAAE,MAAM,iBAEzC;IAEK,iBAAiB,CACrB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,EAChD,QAAQ,EAAE,MAAM,iBAGjB;IAEK,wBAAwB,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,CAAC,GAAG,CAAC,iDAShB;IAEK,sBAAsB,CAAC,GAAG,EAAE,SAAS,iDAG1C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,8DAE9C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,+DAE9C;IAEK,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,oEAEvC;IAEK,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,iBAEhE;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,iBAErE;IAKK,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,mBAEhE;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAGd;IAEK,+BAA+B,CACnC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAId;IAEK,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,iBAkBxE;IAEK,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,yBAwB9D;IAEK,kBAAkB,CACtB,GAAG,EAAE,SAAS,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CA0BrC;IAED;;OAEG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1D,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,iBAM/D;IAEK,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,sCAS5D;IAEK,qBAAqB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,iBAUrE;CACF"}
+{"version":3,"file":"account-manager.d.ts","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,cAAc,CAAA;AAIvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAM5C,OAAO,EAAE,iBAAiB,EAAuB,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAQvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EAGvB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKvE,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAKjD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,iBAAiB;aAEvC,GAAG,EAAE,SAAS;IADhC,YACkB,GAAG,EAAE,SAAS,EAC9B,YAAY,SAAmC,EAGhD;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,qBAAa,cAAc;IAIvB,QAAQ,CAAC,GAAG,EAAE,YAAY;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO;IAVlC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IAEtB,YACW,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EAGjC;IAED,IAAI,UAAU,IAAI,SAAS,CAE1B;IAED,IAAI,oBAAoB,IAAI,MAAM,EAAE,CAEnC;IAEK,cAAc,kBAGnB;IAED,KAAK,SAEJ;IAKK,UAAU,CACd,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,WAAW,CACf,IAAI,EAAE,SAAS,EAAE,EACjB,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAEpC;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAIzD;IAEK,cAAc,CAClB,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3B;IAEK,gBAAgB,CAAC,WAAW,EAAE,kBAAkB;gBAUtC,aAAa,CAAC,OAAO;iBAAW,IAAI;;gBACpC,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAC1D;IAEK,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,EACE,GAAG,EACH,aAAqB,GACtB,GAAE;QACD,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,OAAO,CAAA;KACnB,GACL,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GACX,EAAE;QACD,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,iBAwCA;IAEK,uBAAuB,CAAC,IAAI,EAAE;QAClC,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB;;;OAWA;IAED;;;;;;;;OAQG;IACG,YAAY,CAChB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAwBlD;IAEK,oBAAoB,CACxB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QACT,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QAEpB,OAAO,EAAE,YAAY,CAAA;KACtB,CAAC,CAyBD;IAED;;;OAGG;IACG,mBAAmB,CACvB,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf;IAEK,aAAa,CAAC,GAAG,EAAE,SAAS,iBAEjC;IAEK,eAAe,CACnB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,iBAS5C;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS;;;cAEzC;IAEK,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,iBAEzD;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B;gBA1Qa,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAsS1D;IAEK,eAAe,CAAC,GAAG,EAAE,SAAS;gBA1SpB,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAyU1D;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS,iBAGzC;IAKK,aAAa,CACjB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,EAC5C,aAAa,UAAQ;;;OActB;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,OAsDlC;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,oBAElC;IAKK,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,GACT,EAAE;QACD,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC;QAEV,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAA;QAC5C,aAAa,EAAE,OAAO,CAAA;KACvB,CAAC,CA2CD;IAKK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,6DAExE;IAEK,gBAAgB,CAAC,GAAG,EAAE,SAAS;;;;SAEpC;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,CAE1C;IAEK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,iBAOnD;IAKK,uBAAuB,CAAC,IAAI,EAAE,MAAM,iBAEzC;IAEK,iBAAiB,CACrB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,EAChD,QAAQ,EAAE,MAAM,iBAGjB;IAEK,wBAAwB,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,CAAC,GAAG,CAAC,iDAShB;IAEK,sBAAsB,CAAC,GAAG,EAAE,SAAS,iDAG1C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,8DAE9C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,+DAE9C;IAEK,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,oEAEvC;IAEK,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,iBAEhE;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,iBAErE;IAKK,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,mBAEhE;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAGd;IAEK,+BAA+B,CACnC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAId;IAEK,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,iBAkBxE;IAEK,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,yBAwB9D;IAEK,kBAAkB,CACtB,GAAG,EAAE,SAAS,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CA0BrC;IAED;;OAEG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1D,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,iBAM/D;IAEK,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,sCAS5D;IAEK,qBAAqB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,iBAUrE;CACF"}

package/dist/account-manager/account-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager.js","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAGhC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAG5C,OAAO,EAIL,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,GACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE7E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAGzC,OAAO,EAGL,KAAK,EACL,WAAW,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,UAAU,MAAM,0BAA0B,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AACjD,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAqB,SAAQ,iBAAiB;IACzD,YACkB,GAAc,EAC9B,YAAY,GAAG,gCAAgC;QAE/C,KAAK,CAAC,YAAY,CAAC,CAAA;mBAHH,GAAG;IAIrB,CAAC;CACF;AAOD,MAAM,OAAO,cAAc;IAGzB,YACW,GAAiB,EACjB,UAAsB,EACtB,UAAsB,EACtB,MAAiB,EACjB,MAAoB,EACpB,SAAoB,EACpB,SAAoB,EACpB,cAAuB;mBAPvB,GAAG;0BACH,UAAU;0BACV,UAAU;sBACV,MAAM;sBACN,MAAM;yBACN,SAAS;yBACT,SAAS;8BACT,cAAc;QAEvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAA;IAC7B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;QACzB,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,sBAAsB,EAAE,CAAA;IACrD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,UAAU,CACd,WAA+B,EAC/B,KAAwC;QAExC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC/D,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAiB,EACjB,KAAwC;QAExC,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAwC;QAExC,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAc;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAA+B,EAC/B,KAAwC;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrD,OAAO,GAAG,EAAE,GAAG,IAAI,IAAI,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAA+B;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,GAClE,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAI8B,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,MAAc,EACd,EACE,GAAG,EACH,aAAa,GAAG,KAAK,GACtB,GAGG,EAAE;QAEN,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAEnD,iBAAiB;QACjB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,EACrC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,aAAa;QACb,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,mBAAmB,CAC3B,kCAAkC,EAClC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3D,yCAAyC;YACzC,8BAA8B,CAC5B,UAAU,EACV,IAAI,CAAC,oBAAoB,EACzB,aAAa,CACd,CAAA;QACH,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,mBAAmB,CACpB,CAAA;YACH,CAAC;YAED,4CAA4C;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACpE,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,8CAA8C;gBAC9C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GAWX;QACC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACjE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,cAAc,GAClB,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YAEvE,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,EAAE;oBAC1C,GAAG;oBACH,KAAK;oBACL,cAAc;iBACf,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE;gBAClC,GAAG;gBACH,UAAU;gBACV,GAAG;aACJ,CAAC,CAAA;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,iBAAiB,CAC1B,KAAK,EACL,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EACnC,IAAI,CACL,CAAA;YACH,CAAC;YAED,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAS7B;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,MAAM;SACxB,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAEjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAErC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACzD,GAAG,EACH,SAAS,EACT,OAAO,CACR,CAAA;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,iEAAiE;YACjE,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,CAC5C,CAAA;YACH,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAE3C,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAOrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC9D,aAAa,EAAE,OAAO,EAAE,aAAa;YACrC,GAAG;SACJ,CAAC,CAAA;QAEF,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,MAAM,EAAE,EACjC,oBAAoB,CACrB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAc,EACd,MAAoB;QAEpB,MAAM,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAc;QAChC,OAAO,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,GAAc,EACd,QAA2C;QAE3C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YACtE,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC/C,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,OAAO,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAc,EAAE,GAAQ,EAAE,GAAW;QACxD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,OAGC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnC,MAAM,sBAAsB,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnE,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAClD,CAAC;YAED,OAAO,cAAc,CAAC,iBAAiB,CACrC,KAAK,EACL,GAAG,EACH,OAAO,EAAE,WAAW,IAAI,IAAI,CAC7B,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,6CAA6C;QAC7C,IAAI,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QAE/D,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAc;QAClC,MAAM,gCAAgC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC/D,yCAAyC;YACzC,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAA;QAEzC,IAAI,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACrC,6CAA6C;YAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACzD,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAC5C,GAAG,EACH,OAAO,CAAC,MAAM,IAAI,cAAc,EAChC,MAAM,EACN,QAAQ,CACT,CAAA;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAED,OAAO;IACP,aAAa;IAEb,KAAK,CAAC,aAAa,CACjB,GAAc,EACd,WAA4C,EAC5C,aAAa,GAAG,KAAK;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG;YACH,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC;SACpD,CAAC,CAAA;QACF,mFAAmF;QACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAC1D,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,yDAAyD;QACzD,mEAAmE;QACnE,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAE5E,mDAAmD;QACnD,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAA;QACjC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC,CAAA;QAEjE,MAAM,SAAS,GACb,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAA;QAEjE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,0DAA0D;QAC1D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAEvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,CAAC;gBACV,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE;oBAChC,EAAE;oBACF,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,MAAM;iBACP,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC;aACjE,CAAC,CACH,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACpC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,QAAQ;IACR,aAAa;IAEb,KAAK,CAAC,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,GAIT;QAKC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YAErD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE;oBACjD,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI;iBACvB,CAAC;gBACJ,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;oBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE;wBAC1C,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,IAAI;qBACvB,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAA;YAEV,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAEvC,IAAI,WAAW,GAAoC,IAAI,CAAA;YACvD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACvD,IAAI,CAAC,GAAG,EACR,QAAQ,CACT,CAAA;YACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,8DAA8D;gBAC9D,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;gBACD,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACzB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QAC7C,CAAC;gBAAS,CAAC;YACT,0BAA0B;YAC1B,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,aAAa;IAEb,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY,EAAE,UAAmB;QACvE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAc;QACnC,OAAO,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,WAAmB;QAEnB,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACxD,yEAAyE;YACzE,0BAA0B;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,WAAmB;QAEnB,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;YAC5C,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD,CAAC,CACH,CAAA;IACH,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgD,EAChD,QAAgB;QAEhB,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,UAAkB,EAClB,KAAe,EACf,aAAqB,EACrB,QAAe;QAEf,OAAO,MAAM,CAAC,wBAAwB,CACpC,IAAI,CAAC,EAAE,EACP,UAAU,EACV,KAAK,EACL,aAAa,EACb,QAAQ,CACT,CAAA;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,GAAc;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAe;QACtC,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,GAAc,EAAE,QAAiB;QAC/D,OAAO,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAA6C;QACpE,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACjD,CAAC;IAED,eAAe;IACf,aAAa;IAEb,KAAK,CAAC,gBAAgB,CAAC,GAAc,EAAE,OAA0B;QAC/D,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,+BAA+B,CACnC,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/D,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,GAAc,EAAE,IAA0B;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;QAE/D,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAc,EAAE,KAAa,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YAC9D,MAAM,cAAc,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAA;QAE3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,IAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC;YAClD,CAAC,CAAC,IAAI,CAAA;QAER,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/B,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAC/B,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAa,EACb,KAAc,EACd,IAA2D;QAE3D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;QAEhD,gDAAgD;QAChD,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;QACH,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAE7C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;QACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAA;QAE/B,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAuC;QAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAC3B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;YACnD,MAAM,UAAU,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAyC;QAC3D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,0BAA0B,CACrD,IAAI,CAAC,EAAE,EACP,gBAAgB,EAChB,IAAI,CAAC,KAAK,CACX,CAAA;QACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAElE,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAA0C;QACpE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACpB,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YAC3D,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,CAAC;YACzD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC;SAC1C,CAAC,CACH,CAAA;IACH,CAAC;CACF","sourcesContent":["import assert from 'node:assert'\nimport type { KeyObject } from 'node:crypto'\nimport type { Client as PlcClient } from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { HOUR, wait } from '@atproto/common'\nimport type { Keypair } from '@atproto/crypto'\nimport type { IdResolver } from '@atproto/identity'\nimport {\n  type AtIdentifierString,\n  type DidString,\n  type HandleString,\n  isAtIdentifierString,\n} from '@atproto/lex'\nimport type { Cid } from '@atproto/lex-data'\nimport {\n  INVALID_HANDLE,\n  currentDatetimeString,\n  isValidTld,\n} from '@atproto/syntax'\nimport { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'\nimport type { ActorStore } from '../actor-store/actor-store.js'\nimport { assertValidDidDocumentForService } from '../api/com/atproto/server/util.js'\nimport { AuthScope } from '../auth-scope.js'\nimport type { ServerConfig } from '../config/config.js'\nimport { softDeleted } from '../db/index.js'\nimport { hasExplicitSlur } from '../handle/explicit-slurs.js'\nimport {\n  baseNormalizeAndValidate,\n  ensureHandleServiceConstraints,\n  isServiceDomain,\n} from '../handle/index.js'\nimport type { com } from '../lexicons/index.js'\nimport { httpLogger } from '../logger.js'\nimport type { ServerMailer } from '../mailer/index.js'\nimport type { Sequencer } from '../sequencer/index.js'\nimport {\n  type AccountDb,\n  type EmailTokenPurpose,\n  getDb,\n  getMigrator,\n} from './db/index.js'\nimport * as accountHelpers from './helpers/account.js'\nimport { AccountStatus, type ActorAccount } from './helpers/account.js'\nimport * as auth from './helpers/auth.js'\nimport * as authorizedClientHelper from './helpers/authorized-client.js'\nimport * as emailToken from './helpers/email-token.js'\nimport * as invite from './helpers/invite.js'\nimport * as password from './helpers/password.js'\nimport * as repo from './helpers/repo.js'\nimport * as scrypt from './helpers/scrypt.js'\nimport * as token from './helpers/token.js'\n\nexport { AccountStatus, formatAccountStatus } from './helpers/account.js'\n\n/**\n * Thrown by {@link AccountManager.login} when the identifier resolved to a\n * known account but the supplied credentials (account password / app\n * password) did not match. The matched `did` is attached so downstream\n * callers can distinguish \"identifier known, credentials wrong\" from\n * \"identifier unknown\" (which continues to throw a plain\n * {@link AuthRequiredError}).\n *\n * Callers should take care that remote clients *cannot* distinguish the above,\n * to prevent enumeration attacks. (Tested for in\n * packages/pds/tests/auth.test.ts)\n */\nexport class InvalidPasswordError extends AuthRequiredError {\n  constructor(\n    public readonly did: DidString,\n    errorMessage = 'Invalid identifier or password',\n  ) {\n    super(errorMessage)\n  }\n}\n\nexport type AccountManagerDbConfig = {\n  accountDbLoc: string\n  disableWalAutoCheckpoint: boolean\n}\n\nexport class AccountManager {\n  readonly db: AccountDb\n\n  constructor(\n    readonly cfg: ServerConfig,\n    readonly actorStore: ActorStore,\n    readonly idResolver: IdResolver,\n    readonly jwtKey: KeyObject,\n    readonly mailer: ServerMailer,\n    readonly sequencer: Sequencer,\n    readonly plcClient: PlcClient,\n    readonly plcRotationKey: Keypair,\n  ) {\n    this.db = getDb(cfg.db.accountDbLoc, cfg.db.disableWalAutoCheckpoint)\n  }\n\n  get serviceDid(): DidString {\n    return this.cfg.service.did\n  }\n\n  get serviceHandleDomains(): string[] {\n    return this.cfg.identity.serviceHandleDomains\n  }\n\n  async migrateOrThrow() {\n    await this.db.ensureWal()\n    await getMigrator(this.db).migrateToLatestOrThrow()\n  }\n\n  close() {\n    this.db.close()\n  }\n\n  // Account\n  // ----------\n\n  async getAccount(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccount(this.db, handleOrDid, flags)\n  }\n\n  async getAccounts(\n    dids: DidString[],\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<Map<string, ActorAccount>> {\n    return accountHelpers.getAccounts(this.db, dids, flags)\n  }\n\n  async getAccountByEmail(\n    email: string,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccountByEmail(this.db, email, flags)\n  }\n\n  async isAccountActivated(did: DidString): Promise<boolean> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) return false\n    return !account.deactivatedAt\n  }\n\n  async getDidForActor(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<DidString | null> {\n    const got = await this.getAccount(handleOrDid, flags)\n    return got?.did ?? null\n  }\n\n  async getAccountStatus(handleOrDid: AtIdentifierString) {\n    const got = await this.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    const { active, status = active ? AccountStatus.Active : undefined } =\n      accountHelpers.formatAccountStatus(got)\n    assert(status != null)\n    return { status, account: got } as\n      | { status: AccountStatus.Deleted; account: null }\n      | { status: AccountStatus.Takendown; account: ActorAccount }\n      | { status: AccountStatus.Deactivated; account: ActorAccount }\n      | { status: AccountStatus.Active; account: ActorAccount }\n  }\n\n  async normalizeAndValidateHandle(\n    handle: string,\n    {\n      did,\n      allowAnyValid = false,\n    }: {\n      did?: string\n      allowAnyValid?: boolean\n    } = {},\n  ): Promise<HandleString> {\n    const normalized = baseNormalizeAndValidate(handle)\n\n    // tld validation\n    if (!isValidTld(normalized)) {\n      throw new InvalidRequestError(\n        'Handle TLD is invalid or disallowed',\n        'InvalidHandle',\n      )\n    }\n    // slur check\n    if (!allowAnyValid && hasExplicitSlur(normalized)) {\n      throw new InvalidRequestError(\n        'Inappropriate language in handle',\n        'InvalidHandle',\n      )\n    }\n    if (isServiceDomain(normalized, this.serviceHandleDomains)) {\n      // verify constraints on a service domain\n      ensureHandleServiceConstraints(\n        normalized,\n        this.serviceHandleDomains,\n        allowAnyValid,\n      )\n    } else {\n      // When creating an account (no did yet), we require the handle to be a\n      // local service domain. Updating to a custom handle will be possible once\n      // the account was created.\n      if (did == null) {\n        throw new InvalidRequestError(\n          'Not a supported handle domain',\n          'UnsupportedDomain',\n        )\n      }\n\n      // verify resolution of a non-service domain\n      const resolvedDid = await this.idResolver.handle.resolve(normalized)\n      if (resolvedDid !== did) {\n        // @TODO This should use a distinct error code\n        throw new InvalidRequestError('External handle did not resolve to DID')\n      }\n    }\n\n    return normalized\n  }\n\n  async createAccount({\n    did,\n    handle,\n    email,\n    password,\n    repoCid,\n    repoRev,\n    inviteCode,\n    deactivated,\n    refreshJwt,\n  }: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n    refreshJwt?: string\n  }) {\n    if (password && password.length > scrypt.NEW_PASSWORD_MAX_LENGTH) {\n      throw new InvalidRequestError('Password too long')\n    }\n\n    const passwordScrypt =\n      email && password ? await scrypt.genSaltAndHash(password) : undefined\n\n    const now = currentDatetimeString()\n    return this.db.transaction(async (dbTxn) => {\n      if (inviteCode) {\n        await invite.ensureInviteIsAvailable(dbTxn, inviteCode)\n      }\n\n      await accountHelpers.registerActor(dbTxn, { did, handle, deactivated })\n\n      if (email && passwordScrypt) {\n        await accountHelpers.registerAccount(dbTxn, {\n          did,\n          email,\n          passwordScrypt,\n        })\n      }\n\n      await invite.recordInviteUse(dbTxn, {\n        did,\n        inviteCode,\n        now,\n      })\n\n      if (refreshJwt) {\n        await auth.storeRefreshToken(\n          dbTxn,\n          auth.decodeRefreshToken(refreshJwt),\n          null,\n        )\n      }\n\n      await repo.updateRoot(dbTxn, did, repoCid, repoRev)\n    })\n  }\n\n  async createAccountAndSession(opts: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n  }) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: opts.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: AuthScope.Access,\n    })\n\n    await this.createAccount({ ...opts, refreshJwt })\n\n    return { accessJwt, refreshJwt }\n  }\n\n  /**\n   * Validates the requested handle, updates the PLC document if needed, persists\n   * the new handle locally, and emits an identity event.\n   *\n   * @throws {InvalidRequestError} when the handle is invalid, taken by another\n   * account, or cannot be resolved for non-service domains.\n   *\n   * @see {@link AccountManager.updateAccountHandle} for behavior when the PLC update fails.\n   */\n  async updateHandle(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<ActorAccount & { handle: HandleString }> {\n    const { account, handle } = await this.validateHandleUpdate(\n      did,\n      newHandle,\n      options,\n    )\n\n    if (did.startsWith('did:plc:')) {\n      // @TODO We should verify the status before issuing a PLC update.\n      await this.plcClient.updateHandle(did, this.plcRotationKey, handle)\n    } else {\n      const resolved = await this.idResolver.did.resolveAtprotoData(did, true)\n      if (resolved.handle !== handle) {\n        throw new InvalidRequestError(\n          'DID is not properly configured for handle',\n        )\n      }\n    }\n\n    // @NOTE If the next line fails (for any reason), we don't \"rollback\" the\n    // PLC update above. The caller can just call this method again.\n    await this.updateAccountHandle(did, handle)\n\n    return { ...account, handle }\n  }\n\n  async validateHandleUpdate(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<{\n    did: DidString\n    handle: HandleString\n    // Returned for convenience\n    account: ActorAccount\n  }> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const handle = await this.normalizeAndValidateHandle(newHandle, {\n      allowAnyValid: options?.allowAnyValid,\n      did,\n    })\n\n    // Pessimistic check to handle spam: also enforced by updateAccountHandle() and the db.\n    const existing = await this.getAccount(handle, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (existing && existing.did !== did) {\n      throw new InvalidRequestError(\n        `Handle already taken: ${handle}`,\n        'HandleNotAvailable',\n      )\n    }\n\n    return { did, handle, account }\n  }\n\n  /**\n   * @note Failure to emit the identity event will silently be ignored. Users\n   * can emit the event again by updating their handle to the same value.\n   */\n  async updateAccountHandle(\n    did: DidString,\n    handle: HandleString,\n  ): Promise<void> {\n    await accountHelpers.updateHandle(this.db, did, handle)\n\n    try {\n      await this.sequencer.sequenceIdentity(did, handle)\n    } catch (err) {\n      httpLogger.error({ err, did, handle }, 'failed to sequence handle update')\n    }\n  }\n\n  async deleteAccount(did: DidString) {\n    return accountHelpers.deleteAccount(this.db, did)\n  }\n\n  async takedownAccount(\n    did: DidString,\n    takedown: com.atproto.admin.defs.StatusAttr,\n  ) {\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateAccountTakedownStatus(dbTxn, did, takedown)\n      await auth.revokeRefreshTokensByDid(dbTxn, did)\n      await token.removeByDid(dbTxn, did)\n    })\n\n    await this.sequenceAccountStatus(did)\n  }\n\n  async getAccountAdminStatus(did: DidString) {\n    return accountHelpers.getAccountAdminStatus(this.db, did)\n  }\n\n  async updateRepoRoot(did: DidString, cid: Cid, rev: string) {\n    return repo.updateRoot(this.db, did, cid, rev)\n  }\n\n  async deactivateAccount(\n    did: DidString,\n    options?: {\n      deleteCredentials?: boolean\n      deleteAfter?: string | null\n    },\n  ) {\n    const wasUpdated = await this.db.transaction(async (dbTxn) => {\n      if (options?.deleteCredentials) {\n        await token.removeByDid(dbTxn, did)\n        await authorizedClientHelper.deleteAllAuthorizedClients(dbTxn, did)\n        await password.deleteAllAppPasswords(dbTxn, did)\n      }\n\n      return accountHelpers.deactivateAccount(\n        dbTxn,\n        did,\n        options?.deleteAfter ?? null,\n      )\n    })\n\n    if (!wasUpdated) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    // Account is likely soft-deleted (takendown)\n    if (accountStatus.status === AccountStatus.Deleted) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    await this.sequencer.sequenceAccount(did, accountStatus.status)\n\n    return accountStatus\n  }\n\n  async activateAccount(did: DidString) {\n    await assertValidDidDocumentForService(this, did)\n\n    const found = await accountHelpers.activateAccount(this.db, did, {\n      // We cannot activate a takendown account\n      includeTakenDown: false,\n      includeDeactivated: true,\n    })\n    if (!found) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    const { account, status } = accountStatus\n\n    if (status === AccountStatus.Deleted) {\n      // A concurrent operation deleted the account\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const syncData = await this.actorStore.read(did, (store) => {\n      return store.repo.getSyncEventData()\n    })\n\n    await this.sequencer.sequenceAccountActivation(\n      did,\n      account.handle ?? INVALID_HANDLE,\n      status,\n      syncData,\n    )\n\n    return accountStatus\n  }\n\n  async sequenceAccountStatus(did: DidString) {\n    const { status } = await this.getAccountStatus(did)\n    await this.sequencer.sequenceAccount(did, status)\n  }\n\n  // Auth\n  // ----------\n\n  async createSession(\n    did: DidString,\n    appPassword: password.AppPassDescript | null,\n    isSoftDeleted = false,\n  ) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(appPassword, isSoftDeleted),\n    })\n    // For soft deleted accounts don't store refresh token so that it can't be rotated.\n    if (!isSoftDeleted) {\n      const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n      await auth.storeRefreshToken(this.db, refreshPayload, appPassword)\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async rotateRefreshToken(id: string) {\n    const token = await auth.getRefreshToken(this.db, id)\n    if (!token) return null\n\n    const now = new Date()\n\n    // take the chance to tidy all of a user's expired tokens\n    // does not need to be transactional since this is just best-effort\n    await auth.deleteExpiredRefreshTokens(this.db, token.did, now.toISOString())\n\n    // Shorten the refresh token lifespan down from its\n    // original expiration time to its revocation grace period.\n    const prevExpiresAt = new Date(token.expiresAt)\n    const REFRESH_GRACE_MS = 2 * HOUR\n    const graceExpiresAt = new Date(now.getTime() + REFRESH_GRACE_MS)\n\n    const expiresAt =\n      graceExpiresAt < prevExpiresAt ? graceExpiresAt : prevExpiresAt\n\n    if (expiresAt <= now) {\n      return null\n    }\n\n    // Determine the next refresh token id: upon refresh token\n    // reuse you always receive a refresh token with the same id.\n    const nextId = token.nextId ?? auth.getRefreshTokenId()\n\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: token.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(token.appPassword),\n      jti: nextId,\n    })\n\n    const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n    try {\n      await this.db.transaction((dbTxn) =>\n        Promise.all([\n          auth.addRefreshGracePeriod(dbTxn, {\n            id,\n            expiresAt: expiresAt.toISOString(),\n            nextId,\n          }),\n          auth.storeRefreshToken(dbTxn, refreshPayload, token.appPassword),\n        ]),\n      )\n    } catch (err) {\n      if (err instanceof auth.ConcurrentRefreshError) {\n        return this.rotateRefreshToken(id)\n      }\n      throw err\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async revokeRefreshToken(id: string) {\n    return auth.revokeRefreshToken(this.db, id)\n  }\n\n  // Login\n  // ----------\n\n  async login({\n    identifier,\n    password,\n  }: {\n    identifier: string\n    password: string\n  }): Promise<{\n    user: ActorAccount\n    appPassword: password.AppPassDescript | null\n    isSoftDeleted: boolean\n  }> {\n    const start = Date.now()\n    try {\n      const identifierNormalized = identifier.toLowerCase()\n\n      const user = identifierNormalized.includes('@')\n        ? await this.getAccountByEmail(identifierNormalized, {\n            includeDeactivated: true,\n            includeTakenDown: true,\n          })\n        : isAtIdentifierString(identifierNormalized)\n          ? await this.getAccount(identifierNormalized, {\n              includeDeactivated: true,\n              includeTakenDown: true,\n            })\n          : null\n\n      if (!user) {\n        throw new AuthRequiredError('Invalid identifier or password')\n      }\n      const isSoftDeleted = softDeleted(user)\n\n      let appPassword: password.AppPassDescript | null = null\n      const validAccountPass = await this.verifyAccountPassword(\n        user.did,\n        password,\n      )\n      if (!validAccountPass) {\n        // takendown/suspended accounts cannot login with app password\n        if (isSoftDeleted) {\n          throw new InvalidPasswordError(user.did)\n        }\n        appPassword = await this.verifyAppPassword(user.did, password)\n        if (appPassword === null) {\n          throw new InvalidPasswordError(user.did)\n        }\n      }\n\n      return { user, appPassword, isSoftDeleted }\n    } finally {\n      // Mitigate timing attacks\n      await wait(350 - (Date.now() - start))\n    }\n  }\n\n  // Passwords\n  // ----------\n\n  async createAppPassword(did: DidString, name: string, privileged: boolean) {\n    return password.createAppPassword(this.db, did, name, privileged)\n  }\n\n  async listAppPasswords(did: DidString) {\n    return password.listAppPasswords(this.db, did)\n  }\n\n  async verifyAccountPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<boolean> {\n    if (passwordStr.length > scrypt.OLD_PASSWORD_MAX_LENGTH) {\n      // @NOTE Avoid throwing from here to avoid leaking account email validity\n      // through error messages.\n      return false\n    }\n\n    return password.verifyAccountPassword(this.db, did, passwordStr)\n  }\n\n  async verifyAppPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<password.AppPassDescript | null> {\n    return password.verifyAppPassword(this.db, did, passwordStr)\n  }\n\n  async revokeAppPassword(did: DidString, name: string) {\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.deleteAppPassword(dbTxn, did, name),\n        auth.revokeAppPasswordRefreshToken(dbTxn, did, name),\n      ]),\n    )\n  }\n\n  // Invites\n  // ----------\n\n  async ensureInviteIsAvailable(code: string) {\n    return invite.ensureInviteIsAvailable(this.db, code)\n  }\n\n  async createInviteCodes(\n    toCreate: { account: string; codes: string[] }[],\n    useCount: number,\n  ) {\n    return invite.createInviteCodes(this.db, toCreate, useCount)\n  }\n\n  async createAccountInviteCodes(\n    forAccount: string,\n    codes: string[],\n    expectedTotal: number,\n    disabled: 0 | 1,\n  ) {\n    return invite.createAccountInviteCodes(\n      this.db,\n      forAccount,\n      codes,\n      expectedTotal,\n      disabled,\n    )\n  }\n\n  async getAccountInvitesCodes(did: DidString) {\n    const inviteCodes = await invite.getAccountsInviteCodes(this.db, [did])\n    return inviteCodes.get(did) ?? []\n  }\n\n  async getAccountsInvitesCodes(dids: DidString[]) {\n    return invite.getAccountsInviteCodes(this.db, dids)\n  }\n\n  async getInvitedByForAccounts(dids: DidString[]) {\n    return invite.getInvitedByForAccounts(this.db, dids)\n  }\n\n  async getInviteCodesUses(codes: string[]) {\n    return invite.getInviteCodesUses(this.db, codes)\n  }\n\n  async setAccountInvitesDisabled(did: DidString, disabled: boolean) {\n    return invite.setAccountInvitesDisabled(this.db, did, disabled)\n  }\n\n  async disableInviteCodes(opts: { codes: string[]; accounts: string[] }) {\n    return invite.disableInviteCodes(this.db, opts)\n  }\n\n  // Email Tokens\n  // ----------\n\n  async createEmailToken(did: DidString, purpose: EmailTokenPurpose) {\n    return emailToken.createEmailToken(this.db, did, purpose)\n  }\n\n  async assertValidEmailToken(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    return emailToken.assertValidToken(this.db, did, purpose, token)\n  }\n\n  async assertValidEmailTokenAndCleanup(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    await emailToken.assertValidToken(this.db, did, purpose, token)\n    await emailToken.deleteEmailToken(this.db, did, purpose)\n  }\n\n  async requestEmailConfirmation(did: DidString, opts?: { locale?: string }) {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const locale = opts?.locale\n    const token = await this.createEmailToken(did, 'confirm_email')\n\n    await this.mailer.sendConfirmEmail({ token, locale }, { to: account.email })\n  }\n\n  async confirmEmail(did: DidString, email: string, token: string) {\n    const user = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!user) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    if (user.email !== email.toLowerCase()) {\n      throw new InvalidRequestError('invalid email', 'InvalidEmail')\n    }\n\n    await emailToken.assertValidToken(this.db, did, 'confirm_email', token)\n    const now = currentDatetimeString()\n    await this.db.transaction(async (dbTxn) => {\n      await emailToken.deleteEmailToken(dbTxn, did, 'confirm_email')\n      await accountHelpers.setEmailConfirmedAt(dbTxn, did, now)\n    })\n\n    user.emailConfirmedAt = now\n\n    return user\n  }\n\n  async requestEmailUpdate(\n    did: DidString,\n    opts?: { locale?: string },\n  ): Promise<{ tokenRequired: boolean }> {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const token = account.emailConfirmedAt\n      ? await this.createEmailToken(did, 'update_email')\n      : null\n\n    if (token) {\n      await this.mailer.sendUpdateEmail(\n        { token, locale: opts?.locale },\n        { to: account.email },\n      )\n    }\n\n    return { tokenRequired: !!token }\n  }\n\n  /**\n   * @throws UserAlreadyExistsError if the new email is already in use by another account\n   */\n  async updateEmail(\n    did: DidString,\n    email: string,\n    token?: string,\n    opts?: { locale?: string; sendConfirmationEmail?: boolean },\n  ): Promise<ActorAccount> {\n    if (!isEmailValid(email) || isDisposableEmail(email)) {\n      throw new InvalidRequestError(\n        'This email address is not supported, please use a different email.',\n      )\n    }\n\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    const tokenRequired = !!account.emailConfirmedAt\n\n    // require a token if account email is confirmed\n    if (!token && tokenRequired) {\n      throw new InvalidRequestError(\n        'confirmation token required',\n        'TokenRequired',\n      )\n    }\n\n    if (token) {\n      await this.assertValidEmailToken(did, 'update_email', token)\n    }\n\n    await this.updateAccountEmail({ did, email })\n\n    account.email = email\n    account.emailConfirmedAt = null\n\n    // Proactively send a confirmation email so that the user can confirm the\n    // new email immediately.\n    if (opts?.sendConfirmationEmail) {\n      const token = await this.createEmailToken(did, 'confirm_email')\n      const locale = opts.locale\n      await this.mailer.sendConfirmEmail({ token, locale }, { to: email })\n    }\n\n    return account\n  }\n\n  async updateAccountEmail(opts: { did: DidString; email: string }) {\n    const { did, email } = opts\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateEmail(dbTxn, did, email)\n      await emailToken.deleteAllEmailTokens(dbTxn, did)\n    })\n  }\n\n  async resetPassword(opts: { password: string; token: string }) {\n    const did = await emailToken.assertValidTokenAndFindDid(\n      this.db,\n      'reset_password',\n      opts.token,\n    )\n    await this.updateAccountPassword({ did, password: opts.password })\n\n    return did\n  }\n\n  async updateAccountPassword(opts: { did: DidString; password: string }) {\n    const { did } = opts\n    const passwordScrypt = await scrypt.genSaltAndHash(opts.password)\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.updateUserPassword(dbTxn, { did, passwordScrypt }),\n        emailToken.deleteEmailToken(dbTxn, did, 'reset_password'),\n        auth.revokeRefreshTokensByDid(dbTxn, did),\n      ]),\n    )\n  }\n}\n"]}
+{"version":3,"file":"account-manager.js","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAGhC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAG5C,OAAO,EAIL,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,GACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE7E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAGzC,OAAO,EAGL,KAAK,EACL,WAAW,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,UAAU,MAAM,0BAA0B,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AACjD,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAqB,SAAQ,iBAAiB;IACzD,YACkB,GAAc,EAC9B,YAAY,GAAG,gCAAgC;QAE/C,KAAK,CAAC,YAAY,CAAC,CAAA;mBAHH,GAAG;IAIrB,CAAC;CACF;AAOD,MAAM,OAAO,cAAc;IAGzB,YACW,GAAiB,EACjB,UAAsB,EACtB,UAAsB,EACtB,MAAiB,EACjB,MAAoB,EACpB,SAAoB,EACpB,SAAoB,EACpB,cAAuB;mBAPvB,GAAG;0BACH,UAAU;0BACV,UAAU;sBACV,MAAM;sBACN,MAAM;yBACN,SAAS;yBACT,SAAS;8BACT,cAAc;QAEvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAA;IAC7B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;QACzB,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,sBAAsB,EAAE,CAAA;IACrD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,UAAU,CACd,WAA+B,EAC/B,KAAwC;QAExC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC/D,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAiB,EACjB,KAAwC;QAExC,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAwC;QAExC,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAc;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAA+B,EAC/B,KAAwC;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrD,OAAO,GAAG,EAAE,GAAG,IAAI,IAAI,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAA+B;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,GAClE,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAI8B,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,MAAc,EACd,EACE,GAAG,EACH,aAAa,GAAG,KAAK,GACtB,GAGG,EAAE;QAEN,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAEnD,iBAAiB;QACjB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,EACrC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,aAAa;QACb,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,mBAAmB,CAC3B,kCAAkC,EAClC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3D,yCAAyC;YACzC,8BAA8B,CAC5B,UAAU,EACV,IAAI,CAAC,oBAAoB,EACzB,aAAa,CACd,CAAA;QACH,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,mBAAmB,CACpB,CAAA;YACH,CAAC;YAED,4CAA4C;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACpE,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,8CAA8C;gBAC9C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GAWX;QACC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACjE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,cAAc,GAClB,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YAEvE,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,EAAE;oBAC1C,GAAG;oBACH,KAAK;oBACL,cAAc;iBACf,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE;gBAClC,GAAG;gBACH,UAAU;gBACV,GAAG;aACJ,CAAC,CAAA;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,iBAAiB,CAC1B,KAAK,EACL,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EACnC,IAAI,CACL,CAAA;YACH,CAAC;YAED,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAS7B;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,MAAM;SACxB,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAEjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAErC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACzD,GAAG,EACH,SAAS,EACT,OAAO,CACR,CAAA;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,iEAAiE;YACjE,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,CAC5C,CAAA;YACH,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAE3C,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAOrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC9D,aAAa,EAAE,OAAO,EAAE,aAAa;YACrC,GAAG;SACJ,CAAC,CAAA;QAEF,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,MAAM,EAAE,EACjC,oBAAoB,CACrB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAc,EACd,MAAoB;QAEpB,MAAM,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAc;QAChC,OAAO,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,GAAc,EACd,QAA2C;QAE3C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YACtE,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC/C,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,OAAO,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAc,EAAE,GAAQ,EAAE,GAAW;QACxD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,OAGC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnC,MAAM,sBAAsB,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnE,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAClD,CAAC;YAED,OAAO,cAAc,CAAC,iBAAiB,CACrC,KAAK,EACL,GAAG,EACH,OAAO,EAAE,WAAW,IAAI,IAAI,CAC7B,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,6CAA6C;QAC7C,IAAI,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QAE/D,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAc;QAClC,MAAM,gCAAgC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC/D,yCAAyC;YACzC,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAA;QAEzC,IAAI,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACrC,6CAA6C;YAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACzD,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAC5C,GAAG,EACH,OAAO,CAAC,MAAM,IAAI,cAAc,EAChC,MAAM,EACN,QAAQ,CACT,CAAA;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAED,OAAO;IACP,aAAa;IAEb,KAAK,CAAC,aAAa,CACjB,GAAc,EACd,WAA4C,EAC5C,aAAa,GAAG,KAAK;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG;YACH,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC;SACpD,CAAC,CAAA;QACF,mFAAmF;QACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAC1D,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,yDAAyD;QACzD,mEAAmE;QACnE,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAE5E,mDAAmD;QACnD,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAA;QACjC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC,CAAA;QAEjE,MAAM,SAAS,GACb,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAA;QAEjE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,0DAA0D;QAC1D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAEvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,CAAC;gBACV,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE;oBAChC,EAAE;oBACF,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,MAAM;iBACP,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC;aACjE,CAAC,CACH,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACpC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,QAAQ;IACR,aAAa;IAEb,KAAK,CAAC,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,GAIT;QAMC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YAErD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE;oBACjD,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI;iBACvB,CAAC;gBACJ,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;oBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE;wBAC1C,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,IAAI;qBACvB,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAA;YAEV,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAEvC,IAAI,WAAW,GAAoC,IAAI,CAAA;YACvD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACvD,IAAI,CAAC,GAAG,EACR,QAAQ,CACT,CAAA;YACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,8DAA8D;gBAC9D,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;gBACD,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACzB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QAC7C,CAAC;gBAAS,CAAC;YACT,0BAA0B;YAC1B,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,aAAa;IAEb,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY,EAAE,UAAmB;QACvE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAc;QACnC,OAAO,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,WAAmB;QAEnB,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACxD,yEAAyE;YACzE,0BAA0B;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,WAAmB;QAEnB,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;YAC5C,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD,CAAC,CACH,CAAA;IACH,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgD,EAChD,QAAgB;QAEhB,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,UAAkB,EAClB,KAAe,EACf,aAAqB,EACrB,QAAe;QAEf,OAAO,MAAM,CAAC,wBAAwB,CACpC,IAAI,CAAC,EAAE,EACP,UAAU,EACV,KAAK,EACL,aAAa,EACb,QAAQ,CACT,CAAA;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,GAAc;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAe;QACtC,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,GAAc,EAAE,QAAiB;QAC/D,OAAO,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAA6C;QACpE,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACjD,CAAC;IAED,eAAe;IACf,aAAa;IAEb,KAAK,CAAC,gBAAgB,CAAC,GAAc,EAAE,OAA0B;QAC/D,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,+BAA+B,CACnC,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/D,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,GAAc,EAAE,IAA0B;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;QAE/D,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAc,EAAE,KAAa,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YAC9D,MAAM,cAAc,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAA;QAE3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,IAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC;YAClD,CAAC,CAAC,IAAI,CAAA;QAER,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/B,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAC/B,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAa,EACb,KAAc,EACd,IAA2D;QAE3D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;QAEhD,gDAAgD;QAChD,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;QACH,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAE7C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;QACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAA;QAE/B,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAuC;QAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAC3B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;YACnD,MAAM,UAAU,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAyC;QAC3D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,0BAA0B,CACrD,IAAI,CAAC,EAAE,EACP,gBAAgB,EAChB,IAAI,CAAC,KAAK,CACX,CAAA;QACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAElE,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAA0C;QACpE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACpB,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YAC3D,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,CAAC;YACzD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC;SAC1C,CAAC,CACH,CAAA;IACH,CAAC;CACF","sourcesContent":["import assert from 'node:assert'\nimport type { KeyObject } from 'node:crypto'\nimport type { Client as PlcClient } from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { HOUR, wait } from '@atproto/common'\nimport type { Keypair } from '@atproto/crypto'\nimport type { IdResolver } from '@atproto/identity'\nimport {\n  type AtIdentifierString,\n  type DidString,\n  type HandleString,\n  isAtIdentifierString,\n} from '@atproto/lex'\nimport type { Cid } from '@atproto/lex-data'\nimport {\n  INVALID_HANDLE,\n  currentDatetimeString,\n  isValidTld,\n} from '@atproto/syntax'\nimport { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'\nimport type { ActorStore } from '../actor-store/actor-store.js'\nimport { assertValidDidDocumentForService } from '../api/com/atproto/server/util.js'\nimport { AuthScope } from '../auth-scope.js'\nimport type { ServerConfig } from '../config/config.js'\nimport { softDeleted } from '../db/index.js'\nimport { hasExplicitSlur } from '../handle/explicit-slurs.js'\nimport {\n  baseNormalizeAndValidate,\n  ensureHandleServiceConstraints,\n  isServiceDomain,\n} from '../handle/index.js'\nimport type { com } from '../lexicons/index.js'\nimport { httpLogger } from '../logger.js'\nimport type { ServerMailer } from '../mailer/index.js'\nimport type { Sequencer } from '../sequencer/index.js'\nimport {\n  type AccountDb,\n  type EmailTokenPurpose,\n  getDb,\n  getMigrator,\n} from './db/index.js'\nimport * as accountHelpers from './helpers/account.js'\nimport { AccountStatus, type ActorAccount } from './helpers/account.js'\nimport * as auth from './helpers/auth.js'\nimport * as authorizedClientHelper from './helpers/authorized-client.js'\nimport * as emailToken from './helpers/email-token.js'\nimport * as invite from './helpers/invite.js'\nimport * as password from './helpers/password.js'\nimport * as repo from './helpers/repo.js'\nimport * as scrypt from './helpers/scrypt.js'\nimport * as token from './helpers/token.js'\n\nexport { AccountStatus, formatAccountStatus } from './helpers/account.js'\n\n/**\n * Thrown by {@link AccountManager.login} when the identifier resolved to a\n * known account but the supplied credentials (account password / app\n * password) did not match. The matched `did` is attached so downstream\n * callers can distinguish \"identifier known, credentials wrong\" from\n * \"identifier unknown\" (which continues to throw a plain\n * {@link AuthRequiredError}).\n *\n * Callers should take care that remote clients *cannot* distinguish the above,\n * to prevent enumeration attacks. (Tested for in\n * packages/pds/tests/auth.test.ts)\n */\nexport class InvalidPasswordError extends AuthRequiredError {\n  constructor(\n    public readonly did: DidString,\n    errorMessage = 'Invalid identifier or password',\n  ) {\n    super(errorMessage)\n  }\n}\n\nexport type AccountManagerDbConfig = {\n  accountDbLoc: string\n  disableWalAutoCheckpoint: boolean\n}\n\nexport class AccountManager {\n  readonly db: AccountDb\n\n  constructor(\n    readonly cfg: ServerConfig,\n    readonly actorStore: ActorStore,\n    readonly idResolver: IdResolver,\n    readonly jwtKey: KeyObject,\n    readonly mailer: ServerMailer,\n    readonly sequencer: Sequencer,\n    readonly plcClient: PlcClient,\n    readonly plcRotationKey: Keypair,\n  ) {\n    this.db = getDb(cfg.db.accountDbLoc, cfg.db.disableWalAutoCheckpoint)\n  }\n\n  get serviceDid(): DidString {\n    return this.cfg.service.did\n  }\n\n  get serviceHandleDomains(): string[] {\n    return this.cfg.identity.serviceHandleDomains\n  }\n\n  async migrateOrThrow() {\n    await this.db.ensureWal()\n    await getMigrator(this.db).migrateToLatestOrThrow()\n  }\n\n  close() {\n    this.db.close()\n  }\n\n  // Account\n  // ----------\n\n  async getAccount(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccount(this.db, handleOrDid, flags)\n  }\n\n  async getAccounts(\n    dids: DidString[],\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<Map<string, ActorAccount>> {\n    return accountHelpers.getAccounts(this.db, dids, flags)\n  }\n\n  async getAccountByEmail(\n    email: string,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccountByEmail(this.db, email, flags)\n  }\n\n  async isAccountActivated(did: DidString): Promise<boolean> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) return false\n    return !account.deactivatedAt\n  }\n\n  async getDidForActor(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<DidString | null> {\n    const got = await this.getAccount(handleOrDid, flags)\n    return got?.did ?? null\n  }\n\n  async getAccountStatus(handleOrDid: AtIdentifierString) {\n    const got = await this.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    const { active, status = active ? AccountStatus.Active : undefined } =\n      accountHelpers.formatAccountStatus(got)\n    assert(status != null)\n    return { status, account: got } as\n      | { status: AccountStatus.Deleted; account: null }\n      | { status: AccountStatus.Takendown; account: ActorAccount }\n      | { status: AccountStatus.Deactivated; account: ActorAccount }\n      | { status: AccountStatus.Active; account: ActorAccount }\n  }\n\n  async normalizeAndValidateHandle(\n    handle: string,\n    {\n      did,\n      allowAnyValid = false,\n    }: {\n      did?: string\n      allowAnyValid?: boolean\n    } = {},\n  ): Promise<HandleString> {\n    const normalized = baseNormalizeAndValidate(handle)\n\n    // tld validation\n    if (!isValidTld(normalized)) {\n      throw new InvalidRequestError(\n        'Handle TLD is invalid or disallowed',\n        'InvalidHandle',\n      )\n    }\n    // slur check\n    if (!allowAnyValid && hasExplicitSlur(normalized)) {\n      throw new InvalidRequestError(\n        'Inappropriate language in handle',\n        'InvalidHandle',\n      )\n    }\n    if (isServiceDomain(normalized, this.serviceHandleDomains)) {\n      // verify constraints on a service domain\n      ensureHandleServiceConstraints(\n        normalized,\n        this.serviceHandleDomains,\n        allowAnyValid,\n      )\n    } else {\n      // When creating an account (no did yet), we require the handle to be a\n      // local service domain. Updating to a custom handle will be possible once\n      // the account was created.\n      if (did == null) {\n        throw new InvalidRequestError(\n          'Not a supported handle domain',\n          'UnsupportedDomain',\n        )\n      }\n\n      // verify resolution of a non-service domain\n      const resolvedDid = await this.idResolver.handle.resolve(normalized)\n      if (resolvedDid !== did) {\n        // @TODO This should use a distinct error code\n        throw new InvalidRequestError('External handle did not resolve to DID')\n      }\n    }\n\n    return normalized\n  }\n\n  async createAccount({\n    did,\n    handle,\n    email,\n    password,\n    repoCid,\n    repoRev,\n    inviteCode,\n    deactivated,\n    refreshJwt,\n  }: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n    refreshJwt?: string\n  }) {\n    if (password && password.length > scrypt.NEW_PASSWORD_MAX_LENGTH) {\n      throw new InvalidRequestError('Password too long')\n    }\n\n    const passwordScrypt =\n      email && password ? await scrypt.genSaltAndHash(password) : undefined\n\n    const now = currentDatetimeString()\n    return this.db.transaction(async (dbTxn) => {\n      if (inviteCode) {\n        await invite.ensureInviteIsAvailable(dbTxn, inviteCode)\n      }\n\n      await accountHelpers.registerActor(dbTxn, { did, handle, deactivated })\n\n      if (email && passwordScrypt) {\n        await accountHelpers.registerAccount(dbTxn, {\n          did,\n          email,\n          passwordScrypt,\n        })\n      }\n\n      await invite.recordInviteUse(dbTxn, {\n        did,\n        inviteCode,\n        now,\n      })\n\n      if (refreshJwt) {\n        await auth.storeRefreshToken(\n          dbTxn,\n          auth.decodeRefreshToken(refreshJwt),\n          null,\n        )\n      }\n\n      await repo.updateRoot(dbTxn, did, repoCid, repoRev)\n    })\n  }\n\n  async createAccountAndSession(opts: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n  }) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: opts.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: AuthScope.Access,\n    })\n\n    await this.createAccount({ ...opts, refreshJwt })\n\n    return { accessJwt, refreshJwt }\n  }\n\n  /**\n   * Validates the requested handle, updates the PLC document if needed, persists\n   * the new handle locally, and emits an identity event.\n   *\n   * @throws {InvalidRequestError} when the handle is invalid, taken by another\n   * account, or cannot be resolved for non-service domains.\n   *\n   * @see {@link AccountManager.updateAccountHandle} for behavior when the PLC update fails.\n   */\n  async updateHandle(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<ActorAccount & { handle: HandleString }> {\n    const { account, handle } = await this.validateHandleUpdate(\n      did,\n      newHandle,\n      options,\n    )\n\n    if (did.startsWith('did:plc:')) {\n      // @TODO We should verify the status before issuing a PLC update.\n      await this.plcClient.updateHandle(did, this.plcRotationKey, handle)\n    } else {\n      const resolved = await this.idResolver.did.resolveAtprotoData(did, true)\n      if (resolved.handle !== handle) {\n        throw new InvalidRequestError(\n          'DID is not properly configured for handle',\n        )\n      }\n    }\n\n    // @NOTE If the next line fails (for any reason), we don't \"rollback\" the\n    // PLC update above. The caller can just call this method again.\n    await this.updateAccountHandle(did, handle)\n\n    return { ...account, handle }\n  }\n\n  async validateHandleUpdate(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<{\n    did: DidString\n    handle: HandleString\n    // Returned for convenience\n    account: ActorAccount\n  }> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const handle = await this.normalizeAndValidateHandle(newHandle, {\n      allowAnyValid: options?.allowAnyValid,\n      did,\n    })\n\n    // Pessimistic check to handle spam: also enforced by updateAccountHandle() and the db.\n    const existing = await this.getAccount(handle, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (existing && existing.did !== did) {\n      throw new InvalidRequestError(\n        `Handle already taken: ${handle}`,\n        'HandleNotAvailable',\n      )\n    }\n\n    return { did, handle, account }\n  }\n\n  /**\n   * @note Failure to emit the identity event will silently be ignored. Users\n   * can emit the event again by updating their handle to the same value.\n   */\n  async updateAccountHandle(\n    did: DidString,\n    handle: HandleString,\n  ): Promise<void> {\n    await accountHelpers.updateHandle(this.db, did, handle)\n\n    try {\n      await this.sequencer.sequenceIdentity(did, handle)\n    } catch (err) {\n      httpLogger.error({ err, did, handle }, 'failed to sequence handle update')\n    }\n  }\n\n  async deleteAccount(did: DidString) {\n    return accountHelpers.deleteAccount(this.db, did)\n  }\n\n  async takedownAccount(\n    did: DidString,\n    takedown: com.atproto.admin.defs.StatusAttr,\n  ) {\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateAccountTakedownStatus(dbTxn, did, takedown)\n      await auth.revokeRefreshTokensByDid(dbTxn, did)\n      await token.removeByDid(dbTxn, did)\n    })\n\n    await this.sequenceAccountStatus(did)\n  }\n\n  async getAccountAdminStatus(did: DidString) {\n    return accountHelpers.getAccountAdminStatus(this.db, did)\n  }\n\n  async updateRepoRoot(did: DidString, cid: Cid, rev: string) {\n    return repo.updateRoot(this.db, did, cid, rev)\n  }\n\n  async deactivateAccount(\n    did: DidString,\n    options?: {\n      deleteCredentials?: boolean\n      deleteAfter?: string | null\n    },\n  ) {\n    const wasUpdated = await this.db.transaction(async (dbTxn) => {\n      if (options?.deleteCredentials) {\n        await token.removeByDid(dbTxn, did)\n        await authorizedClientHelper.deleteAllAuthorizedClients(dbTxn, did)\n        await password.deleteAllAppPasswords(dbTxn, did)\n      }\n\n      return accountHelpers.deactivateAccount(\n        dbTxn,\n        did,\n        options?.deleteAfter ?? null,\n      )\n    })\n\n    if (!wasUpdated) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    // Account is likely soft-deleted (takendown)\n    if (accountStatus.status === AccountStatus.Deleted) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    await this.sequencer.sequenceAccount(did, accountStatus.status)\n\n    return accountStatus\n  }\n\n  async activateAccount(did: DidString) {\n    await assertValidDidDocumentForService(this, did)\n\n    const found = await accountHelpers.activateAccount(this.db, did, {\n      // We cannot activate a takendown account\n      includeTakenDown: false,\n      includeDeactivated: true,\n    })\n    if (!found) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    const { account, status } = accountStatus\n\n    if (status === AccountStatus.Deleted) {\n      // A concurrent operation deleted the account\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const syncData = await this.actorStore.read(did, (store) => {\n      return store.repo.getSyncEventData()\n    })\n\n    await this.sequencer.sequenceAccountActivation(\n      did,\n      account.handle ?? INVALID_HANDLE,\n      status,\n      syncData,\n    )\n\n    return accountStatus\n  }\n\n  async sequenceAccountStatus(did: DidString) {\n    const { status } = await this.getAccountStatus(did)\n    await this.sequencer.sequenceAccount(did, status)\n  }\n\n  // Auth\n  // ----------\n\n  async createSession(\n    did: DidString,\n    appPassword: password.AppPassDescript | null,\n    isSoftDeleted = false,\n  ) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(appPassword, isSoftDeleted),\n    })\n    // For soft deleted accounts don't store refresh token so that it can't be rotated.\n    if (!isSoftDeleted) {\n      const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n      await auth.storeRefreshToken(this.db, refreshPayload, appPassword)\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async rotateRefreshToken(id: string) {\n    const token = await auth.getRefreshToken(this.db, id)\n    if (!token) return null\n\n    const now = new Date()\n\n    // take the chance to tidy all of a user's expired tokens\n    // does not need to be transactional since this is just best-effort\n    await auth.deleteExpiredRefreshTokens(this.db, token.did, now.toISOString())\n\n    // Shorten the refresh token lifespan down from its\n    // original expiration time to its revocation grace period.\n    const prevExpiresAt = new Date(token.expiresAt)\n    const REFRESH_GRACE_MS = 2 * HOUR\n    const graceExpiresAt = new Date(now.getTime() + REFRESH_GRACE_MS)\n\n    const expiresAt =\n      graceExpiresAt < prevExpiresAt ? graceExpiresAt : prevExpiresAt\n\n    if (expiresAt <= now) {\n      return null\n    }\n\n    // Determine the next refresh token id: upon refresh token\n    // reuse you always receive a refresh token with the same id.\n    const nextId = token.nextId ?? auth.getRefreshTokenId()\n\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: token.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(token.appPassword),\n      jti: nextId,\n    })\n\n    const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n    try {\n      await this.db.transaction((dbTxn) =>\n        Promise.all([\n          auth.addRefreshGracePeriod(dbTxn, {\n            id,\n            expiresAt: expiresAt.toISOString(),\n            nextId,\n          }),\n          auth.storeRefreshToken(dbTxn, refreshPayload, token.appPassword),\n        ]),\n      )\n    } catch (err) {\n      if (err instanceof auth.ConcurrentRefreshError) {\n        return this.rotateRefreshToken(id)\n      }\n      throw err\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async revokeRefreshToken(id: string) {\n    return auth.revokeRefreshToken(this.db, id)\n  }\n\n  // Login\n  // ----------\n\n  async login({\n    identifier,\n    password,\n  }: {\n    identifier: string\n    password: string\n  }): Promise<{\n    // @TODO we should rename this \"account\" for consistency\n    user: ActorAccount\n    appPassword: password.AppPassDescript | null\n    isSoftDeleted: boolean\n  }> {\n    const start = Date.now()\n    try {\n      const identifierNormalized = identifier.toLowerCase()\n\n      const user = identifierNormalized.includes('@')\n        ? await this.getAccountByEmail(identifierNormalized, {\n            includeDeactivated: true,\n            includeTakenDown: true,\n          })\n        : isAtIdentifierString(identifierNormalized)\n          ? await this.getAccount(identifierNormalized, {\n              includeDeactivated: true,\n              includeTakenDown: true,\n            })\n          : null\n\n      if (!user) {\n        throw new AuthRequiredError('Invalid identifier or password')\n      }\n      const isSoftDeleted = softDeleted(user)\n\n      let appPassword: password.AppPassDescript | null = null\n      const validAccountPass = await this.verifyAccountPassword(\n        user.did,\n        password,\n      )\n      if (!validAccountPass) {\n        // takendown/suspended accounts cannot login with app password\n        if (isSoftDeleted) {\n          throw new InvalidPasswordError(user.did)\n        }\n        appPassword = await this.verifyAppPassword(user.did, password)\n        if (appPassword === null) {\n          throw new InvalidPasswordError(user.did)\n        }\n      }\n\n      return { user, appPassword, isSoftDeleted }\n    } finally {\n      // Mitigate timing attacks\n      await wait(350 - (Date.now() - start))\n    }\n  }\n\n  // Passwords\n  // ----------\n\n  async createAppPassword(did: DidString, name: string, privileged: boolean) {\n    return password.createAppPassword(this.db, did, name, privileged)\n  }\n\n  async listAppPasswords(did: DidString) {\n    return password.listAppPasswords(this.db, did)\n  }\n\n  async verifyAccountPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<boolean> {\n    if (passwordStr.length > scrypt.OLD_PASSWORD_MAX_LENGTH) {\n      // @NOTE Avoid throwing from here to avoid leaking account email validity\n      // through error messages.\n      return false\n    }\n\n    return password.verifyAccountPassword(this.db, did, passwordStr)\n  }\n\n  async verifyAppPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<password.AppPassDescript | null> {\n    return password.verifyAppPassword(this.db, did, passwordStr)\n  }\n\n  async revokeAppPassword(did: DidString, name: string) {\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.deleteAppPassword(dbTxn, did, name),\n        auth.revokeAppPasswordRefreshToken(dbTxn, did, name),\n      ]),\n    )\n  }\n\n  // Invites\n  // ----------\n\n  async ensureInviteIsAvailable(code: string) {\n    return invite.ensureInviteIsAvailable(this.db, code)\n  }\n\n  async createInviteCodes(\n    toCreate: { account: string; codes: string[] }[],\n    useCount: number,\n  ) {\n    return invite.createInviteCodes(this.db, toCreate, useCount)\n  }\n\n  async createAccountInviteCodes(\n    forAccount: string,\n    codes: string[],\n    expectedTotal: number,\n    disabled: 0 | 1,\n  ) {\n    return invite.createAccountInviteCodes(\n      this.db,\n      forAccount,\n      codes,\n      expectedTotal,\n      disabled,\n    )\n  }\n\n  async getAccountInvitesCodes(did: DidString) {\n    const inviteCodes = await invite.getAccountsInviteCodes(this.db, [did])\n    return inviteCodes.get(did) ?? []\n  }\n\n  async getAccountsInvitesCodes(dids: DidString[]) {\n    return invite.getAccountsInviteCodes(this.db, dids)\n  }\n\n  async getInvitedByForAccounts(dids: DidString[]) {\n    return invite.getInvitedByForAccounts(this.db, dids)\n  }\n\n  async getInviteCodesUses(codes: string[]) {\n    return invite.getInviteCodesUses(this.db, codes)\n  }\n\n  async setAccountInvitesDisabled(did: DidString, disabled: boolean) {\n    return invite.setAccountInvitesDisabled(this.db, did, disabled)\n  }\n\n  async disableInviteCodes(opts: { codes: string[]; accounts: string[] }) {\n    return invite.disableInviteCodes(this.db, opts)\n  }\n\n  // Email Tokens\n  // ----------\n\n  async createEmailToken(did: DidString, purpose: EmailTokenPurpose) {\n    return emailToken.createEmailToken(this.db, did, purpose)\n  }\n\n  async assertValidEmailToken(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    return emailToken.assertValidToken(this.db, did, purpose, token)\n  }\n\n  async assertValidEmailTokenAndCleanup(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    await emailToken.assertValidToken(this.db, did, purpose, token)\n    await emailToken.deleteEmailToken(this.db, did, purpose)\n  }\n\n  async requestEmailConfirmation(did: DidString, opts?: { locale?: string }) {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const locale = opts?.locale\n    const token = await this.createEmailToken(did, 'confirm_email')\n\n    await this.mailer.sendConfirmEmail({ token, locale }, { to: account.email })\n  }\n\n  async confirmEmail(did: DidString, email: string, token: string) {\n    const user = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!user) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    if (user.email !== email.toLowerCase()) {\n      throw new InvalidRequestError('invalid email', 'InvalidEmail')\n    }\n\n    await emailToken.assertValidToken(this.db, did, 'confirm_email', token)\n    const now = currentDatetimeString()\n    await this.db.transaction(async (dbTxn) => {\n      await emailToken.deleteEmailToken(dbTxn, did, 'confirm_email')\n      await accountHelpers.setEmailConfirmedAt(dbTxn, did, now)\n    })\n\n    user.emailConfirmedAt = now\n\n    return user\n  }\n\n  async requestEmailUpdate(\n    did: DidString,\n    opts?: { locale?: string },\n  ): Promise<{ tokenRequired: boolean }> {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const token = account.emailConfirmedAt\n      ? await this.createEmailToken(did, 'update_email')\n      : null\n\n    if (token) {\n      await this.mailer.sendUpdateEmail(\n        { token, locale: opts?.locale },\n        { to: account.email },\n      )\n    }\n\n    return { tokenRequired: !!token }\n  }\n\n  /**\n   * @throws UserAlreadyExistsError if the new email is already in use by another account\n   */\n  async updateEmail(\n    did: DidString,\n    email: string,\n    token?: string,\n    opts?: { locale?: string; sendConfirmationEmail?: boolean },\n  ): Promise<ActorAccount> {\n    if (!isEmailValid(email) || isDisposableEmail(email)) {\n      throw new InvalidRequestError(\n        'This email address is not supported, please use a different email.',\n      )\n    }\n\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    const tokenRequired = !!account.emailConfirmedAt\n\n    // require a token if account email is confirmed\n    if (!token && tokenRequired) {\n      throw new InvalidRequestError(\n        'confirmation token required',\n        'TokenRequired',\n      )\n    }\n\n    if (token) {\n      await this.assertValidEmailToken(did, 'update_email', token)\n    }\n\n    await this.updateAccountEmail({ did, email })\n\n    account.email = email\n    account.emailConfirmedAt = null\n\n    // Proactively send a confirmation email so that the user can confirm the\n    // new email immediately.\n    if (opts?.sendConfirmationEmail) {\n      const token = await this.createEmailToken(did, 'confirm_email')\n      const locale = opts.locale\n      await this.mailer.sendConfirmEmail({ token, locale }, { to: email })\n    }\n\n    return account\n  }\n\n  async updateAccountEmail(opts: { did: DidString; email: string }) {\n    const { did, email } = opts\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateEmail(dbTxn, did, email)\n      await emailToken.deleteAllEmailTokens(dbTxn, did)\n    })\n  }\n\n  async resetPassword(opts: { password: string; token: string }) {\n    const did = await emailToken.assertValidTokenAndFindDid(\n      this.db,\n      'reset_password',\n      opts.token,\n    )\n    await this.updateAccountPassword({ did, password: opts.password })\n\n    return did\n  }\n\n  async updateAccountPassword(opts: { did: DidString; password: string }) {\n    const { did } = opts\n    const passwordScrypt = await scrypt.genSaltAndHash(opts.password)\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.updateUserPassword(dbTxn, { did, passwordScrypt }),\n        emailToken.deleteEmailToken(dbTxn, did, 'reset_password'),\n        auth.revokeRefreshTokensByDid(dbTxn, did),\n      ]),\n    )\n  }\n}\n"]}

package/dist/api/com/atproto/server/createAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA8GvD"}
+{"version":3,"file":"createAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAyHvD"}

package/dist/api/com/atproto/server/createAccount.js

@@ -6,6 +6,7 @@ import { Secp256k1Keypair, } from '@atproto/crypto';
 import { ensureAtpDocument } from '@atproto/identity';
 import { AuthRequiredError, InvalidRequestError, } from '@atproto/xrpc-server';
 import { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js';
+import { events } from '../../../../events.js';
 import { baseNormalizeAndValidate } from '../../../../handle/index.js';
 import { com } from '../../../../lexicons/index.js';
 import { safeResolveDidDoc } from './util.js';
@@ -62,6 +63,16 @@ export default function (server, ctx) {
                                 // flow if it fails, but we log it just in case
                                 req.log.error({ did, signingKeyDid: signingKey.did(), err }, 'Failed to clear reserved keypair');
                             });
+                            events.accountCreated({
+                                source: com.atproto.server.createAccount.$lxm,
+                                did,
+                                invited: !!inviteCode,
+                                deactivated,
+                            });
+                            events.sessionCreated({
+                                source: com.atproto.server.createAccount.$lxm,
+                                did,
+                            });
                             return {
                                 encoding: 'application/json',
                                 body: {

package/dist/api/com/atproto/server/createAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle),\n    ctx.accountManager.getAccountByEmail(email),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}
+{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle),\n    ctx.accountManager.getAccountByEmail(email),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}

package/dist/api/com/atproto/server/createSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAmFvD"}
+{"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwFvD"}

package/dist/api/com/atproto/server/createSession.js

@@ -3,6 +3,7 @@ import { INVALID_HANDLE, } from '@atproto/syntax';
 import { AuthRequiredError, } from '@atproto/xrpc-server';
 import { formatAccountStatus } from '../../../../account-manager/account-manager.js';
 import { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js';
+import { events } from '../../../../events.js';
 import { com } from '../../../../lexicons/index.js';
 import { didDocForSession } from './util.js';
 export default function (server, ctx) {
@@ -47,6 +48,10 @@ export default function (server, ctx) {
                     didDocForSession(ctx, user.did),
                 ]);
                 const { status, active } = formatAccountStatus(user);
+                events.sessionCreated({
+                    source: com.atproto.server.createSession.$lxm,
+                    did: user.did,
+                });
                 return {
                     encoding: 'application/json',
                     body: {

package/dist/api/com/atproto/server/createSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAEtC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  type MethodRateLimit,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const rateLimit: MethodRateLimit<\n    void,\n    com.atproto.server.createSession.$Params,\n    com.atproto.server.createSession.$Input\n  > = [\n    {\n      durationMs: DAY,\n      points: 300,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n    {\n      durationMs: 5 * MINUTE,\n      points: 30,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n  ]\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({ input: { body }, req }) => {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return entrywayClient.xrpc(com.atproto.server.createSession, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({\n        input: { body },\n      }): Promise<com.atproto.server.createSession.$Output> => {\n        if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n          throw new AuthRequiredError(\n            'Password too long. Consider resetting your password.',\n          )\n        }\n\n        const { user, isSoftDeleted, appPassword } =\n          await ctx.accountManager.login(body)\n\n        if (!body.allowTakendown && isSoftDeleted) {\n          throw new AuthRequiredError(\n            'Account has been taken down',\n            'AccountTakedown',\n          )\n        }\n\n        const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n          ctx.accountManager.createSession(\n            user.did,\n            appPassword,\n            isSoftDeleted,\n          ),\n          didDocForSession(ctx, user.did),\n        ])\n\n        const { status, active } = formatAccountStatus(user)\n\n        return {\n          encoding: 'application/json',\n          body: {\n            accessJwt,\n            refreshJwt,\n\n            did: user.did as DidString,\n            // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n            didDoc,\n            handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n            email: user.email ?? undefined,\n            emailConfirmed: !!user.emailConfirmedAt,\n            active,\n            status,\n          },\n        }\n      },\n    })\n  }\n}\n"]}
+{"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAEtC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  type MethodRateLimit,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const rateLimit: MethodRateLimit<\n    void,\n    com.atproto.server.createSession.$Params,\n    com.atproto.server.createSession.$Input\n  > = [\n    {\n      durationMs: DAY,\n      points: 300,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n    {\n      durationMs: 5 * MINUTE,\n      points: 30,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n  ]\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({ input: { body }, req }) => {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return entrywayClient.xrpc(com.atproto.server.createSession, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({\n        input: { body },\n      }): Promise<com.atproto.server.createSession.$Output> => {\n        if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n          throw new AuthRequiredError(\n            'Password too long. Consider resetting your password.',\n          )\n        }\n\n        const { user, isSoftDeleted, appPassword } =\n          await ctx.accountManager.login(body)\n\n        if (!body.allowTakendown && isSoftDeleted) {\n          throw new AuthRequiredError(\n            'Account has been taken down',\n            'AccountTakedown',\n          )\n        }\n\n        const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n          ctx.accountManager.createSession(\n            user.did,\n            appPassword,\n            isSoftDeleted,\n          ),\n          didDocForSession(ctx, user.did),\n        ])\n\n        const { status, active } = formatAccountStatus(user)\n\n        events.sessionCreated({\n          source: com.atproto.server.createSession.$lxm,\n          did: user.did,\n        })\n\n        return {\n          encoding: 'application/json',\n          body: {\n            accessJwt,\n            refreshJwt,\n\n            did: user.did as DidString,\n            // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n            didDoc,\n            handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n            email: user.email ?? undefined,\n            emailConfirmed: !!user.emailConfirmedAt,\n            active,\n            status,\n          },\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/refreshSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA2DvD"}
+{"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgEvD"}

package/dist/api/com/atproto/server/refreshSession.js

@@ -2,6 +2,7 @@ import { INVALID_HANDLE, } from '@atproto/syntax';
 import { AuthRequiredError, InvalidRequestError, } from '@atproto/xrpc-server';
 import { formatAccountStatus } from '../../../../account-manager/account-manager.js';
 import { softDeleted } from '../../../../db/util.js';
+import { events } from '../../../../events.js';
 import { com } from '../../../../lexicons/index.js';
 import { didDocForSession } from './util.js';
 export default function (server, ctx) {
@@ -33,6 +34,10 @@ export default function (server, ctx) {
                 throw new InvalidRequestError('Token has been revoked', 'ExpiredToken');
             }
             const { status, active } = formatAccountStatus(user);
+            events.sessionRefreshed({
+                source: com.atproto.server.refreshSession.$lxm,
+                did: user.did,
+            });
             return {
                 encoding: 'application/json',
                 body: {

package/dist/api/com/atproto/server/refreshSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.refreshSession, {\n    auth: ctx.authVerifier.refresh(),\n    handler: async ({\n      auth,\n      req,\n    }): Promise<com.atproto.server.refreshSession.$Output> => {\n      const did = auth.credentials.did\n      const user = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n      if (softDeleted(user)) {\n        throw new AuthRequiredError(\n          'Account has been taken down',\n          'AccountTakedown',\n        )\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n          headers,\n        })\n      }\n\n      const [didDoc, rotated] = await Promise.all([\n        didDocForSession(ctx, user.did),\n        ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n      ])\n      if (rotated === null) {\n        throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          accessJwt: rotated.accessJwt,\n          refreshJwt: rotated.refreshJwt,\n\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          active,\n          status,\n        },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,MAAM,CAAC,gBAAgB,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;gBAC9C,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.refreshSession, {\n    auth: ctx.authVerifier.refresh(),\n    handler: async ({\n      auth,\n      req,\n    }): Promise<com.atproto.server.refreshSession.$Output> => {\n      const did = auth.credentials.did\n      const user = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n      if (softDeleted(user)) {\n        throw new AuthRequiredError(\n          'Account has been taken down',\n          'AccountTakedown',\n        )\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n          headers,\n        })\n      }\n\n      const [didDoc, rotated] = await Promise.all([\n        didDocForSession(ctx, user.did),\n        ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n      ])\n      if (rotated === null) {\n        throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      events.sessionRefreshed({\n        source: com.atproto.server.refreshSession.$lxm,\n        did: user.did,\n      })\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          accessJwt: rotated.accessJwt,\n          refreshJwt: rotated.refreshJwt,\n\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          active,\n          status,\n        },\n      }\n    },\n  })\n}\n"]}

package/dist/auth-routes.js

@@ -2,7 +2,7 @@ import { Router } from 'express';
 import { HandleUnavailableError, InvalidRequestError, SecondAuthenticationFactorRequiredError, UseDpopNonceError, } from '@atproto/oauth-provider/errors';
 import { oauthMiddleware } from '@atproto/oauth-provider/middleware';
 import { buildProtectedResourceMetadata } from '@atproto/oauth-provider/utils';
-import { oauthLogger, reqSerializer } from './logger.js';
+import { oauthLogger } from './logger.js';
 export const createRouter = ({ oauthProvider, cfg }) => {
     const router = Router();
     const oauthProtectedResourceMetadata = buildProtectedResourceMetadata({
@@ -26,7 +26,7 @@ export const createRouter = ({ oauthProvider, cfg }) => {
         router.use(oauthMiddleware(oauthProvider, {
             onError: (req, res, err, msg) => {
                 if (!ignoreError(err)) {
-                    oauthLogger.error({ err, req: reqSerializer(req) }, msg);
+                    oauthLogger.error({ err, req }, msg);
                 }
             },
         }));