@atproto/pds 0.5.35 → 0.5.36

package/dist/account-manager/oauth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../../src/account-manager/oauth-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAe,QAAQ,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAEnE,OAAO,EAAgB,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAGL,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,gCAAgC,CAAA;AA0CvC,OAAO,EACL,iBAAiB,IAAI,qBAAqB,EAC1C,mBAAmB,IAAI,uBAAuB,GAC/C,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAGvC,OAAO,EAAuB,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAEhF,OAAO,KAAK,mBAAmB,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,KAAK,iBAAiB,MAAM,oCAAoC,CAAA;AACvE,OAAO,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,YAAY,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,WAAW,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,sBAAsB,MAAM,iCAAiC,CAAA;AAEzE;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IAGrB,YACmB,cAA8B,EAC9B,UAAsB,EACtB,eAAgC,EAChC,eAAgC,EAChC,MAAoB,EACpB,SAAoB,EACpB,SAAiB,EACjB,cAAuB,EACvB,SAAiB,EACjB,cAA6B;8BAT7B,cAAc;0BACd,UAAU;+BACV,eAAe;+BACf,eAAe;sBACf,MAAM;yBACN,SAAS;yBACT,SAAS;8BACT,cAAc;yBACd,SAAS;8BACT,cAAc;IAC9B,CAAC;IAEJ,IAAY,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,cAAc,CAAA;QAClC,IAAI,EAAE,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAClE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACjD,4EAA4E;QAE5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE;YACjE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;YAClE,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/D,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAED,eAAe;IAEf,KAAK,CAAC,aAAa,CAAC,EAClB,MAAM,EAAE,OAAO,EACf,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,GACG;QACX,uGAAuG;QACvG,yEAAyE;QAEzE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YACnC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;YACrC,CAAC,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;SACjD,CAAC,CAAA;QAEF,4EAA4E;QAC5E,gEAAgE;QAEhE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QACtE,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAA;QAEtC,MAAM,YAAY;QAChB,wEAAwE;QACxE,0EAA0E;QAC1E,uCAAuC;QACvC,IAAI,CAAA;QAEN,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;YAC5B,UAAU,EAAE,aAAa;YACzB,YAAY,EAAE,IAAI,CAAC,cAAc;gBAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;gBAClD,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM;YACN,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,MAAM,EAAE,IAAI,CAAC,cAAc;SAC5B,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAgB,CAAA;QAEhC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;gBAE/C,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;wBACtC,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,UAAU;wBACV,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;qBACpB,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAEjE,IAAI,CAAC;4BACH,MAAM,IAAI,CAAC,UAAU;iCAClB,oBAAoB,CAAC,aAAa,EAAE,GAAG,CAAC;iCACxC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,yDAAyD;gCACzD,qDAAqD;gCACrD,QAAQ,CAAC,KAAK,CACZ,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,EAC3B,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;4BACzD,MAAM,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAA;4BAEnD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;wBACzC,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjD,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC5C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;oBAC1D,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAClC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0BAA0B;YAC1B,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EACxB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,UAAU,EACpB,QAAQ;IACR,kCAAkC;IAClC,QAAQ,GAAG,SAAS,GACI;QACxB,0EAA0E;QAC1E,IAAI,CAAC;YACH,sBAAsB;YACtB,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,GACxC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;YAE3D,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAA;YACzD,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;YAChE,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9D,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,GAAQ,EACR,QAAkB,EAClB,IAA0B;QAE1B,MAAM,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAQ;QAIvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;YAC3D,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,oBAAoB,CACzE,IAAI,CAAC,EAAE,EACP,GAAG,CACJ,CAAA;QAED,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAW;QACvD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CACrD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAkB,EAClB,GAAQ;QAER,MAAM,GAAG,GAAG,MAAM,mBAAmB;aAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;aACpC,gBAAgB,EAAE,CAAA;QAErB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAErB,OAAO;YACL,QAAQ;YACR,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC;YAC7C,OAAO,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACrC,iBAAiB,EAAE,MAAM,sBAAsB,CAAC,oBAAoB,CAClE,IAAI,CAAC,EAAE,EACP,GAAG,CACJ;YACD,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;SACxC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAQ;QACpD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CACrD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAA6C;QAE7C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAA;QAE1E,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAE3D,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAA2B,EAAE;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAE,CAAA;YAC5C,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,CACH,CACF,CAAA;QAED,MAAM,oBAAoB,GACxB,MAAM,sBAAsB,CAAC,yBAAyB,CACpD,IAAI,CAAC,EAAE,EACP,UAAU,CACX,CAAA;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC;YAC7C,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE;YAC/B,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE;YACrD,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;SACxC,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EACzB,KAAK,EACL,MAAM,GACoB;QAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE;YACjE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO,IAAI,CAAA;QAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CACtD,OAAO,CAAC,GAAG,EACX,gBAAgB,CACjB,CAAA;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACjC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EACzB,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAA+B;QAE/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACxD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAAoB;QACjD,8EAA8E;QAC9E,IAAI,CAAC;YACH,MAAM,UAAU,GACd,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAA;YAE9D,uEAAuE;YACvE,sEAAsE;YACtE,WAAW;YACX,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;YAC9D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE;gBAC/D,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,eAAe;IAEf,KAAK,CAAC,aAAa,CAAC,EAAa,EAAE,IAAiB;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAC9C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAa;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAA;YAC1E,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,OAAO,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;gBAAS,CAAC;YACT,0EAA0E;YAC1E,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9C,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAa,EAAE,IAAuB;QACxD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAC9C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAa;QAC/B,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAU;QACjC,MAAM,GAAG,GAAG,MAAM,iBAAiB;aAChC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;aAC9B,gBAAgB,EAAE,CAAA;QACrB,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAED,cAAc;IAEd,KAAK,CAAC,YAAY,CAAC,QAAkB,EAAE,IAAgB;QACrD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC/C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAkB;QACjC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,QAAkB,EAClB,IAAyB;QAEzB,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC/C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAkB;QACnC,+DAA+D;QAC/D,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,eAAe;IAEf,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,IAAiB;QAChD,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC;IAED,aAAa;IAEb,KAAK,CAAC,WAAW,CACf,EAAW,EACX,IAAe,EACf,YAA2B;QAE3B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB;qBAC3C,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC;qBAC5B,uBAAuB,EAAE,CAAA;gBAE5B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;gBACjD,CAAC;YACH,CAAC;YAED,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,CAAA;QACtE,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAQ;QAC9B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACnE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,MAAM,WAAW;aAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;aAC9B,gBAAgB,EAAE,CAAA;QACrB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,6DAA6D;QAC7D,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,UAAmB,EACnB,eAA6B,EAC7B,OAAqB;QAErB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpD,MAAM,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,MAAM,WAAW;iBAClD,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC;iBAC3B,uBAAuB,EAAE,CAAA;YAE5B,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,sBAAsB;qBACzB,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,mBAAmB,CAAC;qBACxC,OAAO,EAAE,CAAA;YACd,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB;iBAC3C,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC;iBAC/B,uBAAuB,EAAE,CAAA;YAE5B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,iEAAiE;gBACjE,OAAO,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACtD,CAAC;YAED,MAAM,WAAW;iBACd,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,CAAC;iBACzD,OAAO,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,IAAI,GAAG;YAAE,MAAM,GAAG,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,YAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,sBAAsB;aACtC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;aACpC,gBAAgB,EAAE,CAAA;QAErB,MAAM,MAAM,GAAG,IAAI;YACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;YACtB,CAAC,CAAC,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAA;QAEzC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC5E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACkB;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,GACmB;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;YAEzE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACkB;QACxB,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,EACL,MAAM,GACkB;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;gBACvE,qBAAqB,EAAE,IAAI;gBAC3B,MAAM;aACP,CAAC,CAAA;YAEF,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAoB;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAEnE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EACtB,GAAG,EACH,WAAW,GACW;QACtB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACnE,iBAAiB,EAAE,IAAI;YACvB,WAAW;SACZ,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAyB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAElE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EACzB,GAAG,EACH,MAAM,GACoB;QAC1B,iEAAiE;QACjE,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;YACxD,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CACtD,GAAG,EACH,gBAAgB,CACjB,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EACzB,GAAG,EACH,KAAK,EACL,QAAQ,GACkB;QAC1B,uEAAuE;QACvE,qEAAqE;QACrE,gEAAgE;QAChE,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;YACxD,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC/D,GAAG,EACH,QAAQ,CACT,CAAA;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC7C,GAAG,EACH,gBAAgB,EAChB,KAAK,CACN,CAAA;QAED,sEAAsE;QACtE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,GAA6C;QAE7C,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,OAAO;YACf,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;YAClC,OAAO,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACrC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;SAC7C,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAiB;QAC1C,MAAM,OAAO,GAAY;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;YAC7B,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;YACnE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;YAC/B,WAAW,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;SACvC,CAAA;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YAEvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;iBAClC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAA;YACxC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;gBACvD,OAAO,IAAI,CAAA,CAAC,uBAAuB;YACrC,CAAC,CAAC,CAAA;YAEJ,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;gBAEvC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAA;gBAC5B,OAAO,CAAC,OAAO,KAAK,MAAM;oBACxB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACrE,CAAC,CAAC,SAAS,CAAA;YACf,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM;YAAE,MAAM,IAAI,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAEtE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,GAA4B;IAE5B,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,oBAAoB,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,OAAO,KAAK,iBAAiB;gBAAE,OAAO,UAAU,CAAA;YACxD,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,mBAAmB,EAAE,CAAC;YACzB,OAAO,aAAa,CAAA;QACtB,CAAC;QAED,KAAK,eAAe,EAAE,CAAC;YACrB,IAAI,GAAG,CAAC,OAAO,KAAK,kCAAkC;gBAAE,OAAO,MAAM,CAAA;YACrE,IAAI,GAAG,CAAC,OAAO,KAAK,qCAAqC;gBAAE,OAAO,QAAQ,CAAA;YAC1E,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,gBAAgB,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,OAAO,KAAK,wCAAwC,EAAE,CAAC;gBAC7D,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import assert from 'node:assert'\nimport { type Client, createOp as createPlcOp } from '@did-plc/lib'\nimport type { Selectable } from 'kysely'\nimport { type Keypair, Secp256k1Keypair } from '@atproto/crypto'\nimport {\n  type DidString,\n  type HandleString,\n  getBlobCidString,\n} from '@atproto/lex'\nimport {\n  HandleUnavailableError,\n  InvalidCredentialsError,\n  InvalidRequestError,\n} from '@atproto/oauth-provider/errors'\nimport type {\n  Account,\n  AccountStore,\n  AuthenticateAccountData,\n  AuthorizedClientData,\n  AuthorizedClients,\n  ClientId,\n  Code,\n  DeactivateAccountData,\n  DeleteAccountConfirmInput,\n  DeleteAccountRequestInput,\n  DeviceAccount,\n  DeviceData,\n  DeviceId,\n  DeviceStore,\n  Did,\n  FoundRequestResult,\n  HandleUnavailableReason,\n  LexiconData,\n  LexiconStore,\n  NewTokenData,\n  ReactivateAccountData,\n  RefreshToken,\n  RequestData,\n  RequestId,\n  RequestStore,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  TokenData,\n  TokenId,\n  TokenInfo,\n  TokenStore,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateEmailRequestOutput,\n  UpdateHandleData,\n  UpdateRequestData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from '@atproto/oauth-provider/store'\nimport {\n  AuthRequiredError as XrpcAuthRequiredError,\n  InvalidRequestError as XrpcInvalidRequestError,\n} from '@atproto/xrpc-server'\nimport type { ActorStore } from '../actor-store/actor-store.js'\nimport type { BackgroundQueue } from '../background.js'\nimport { fromDateISO } from '../db/index.js'\nimport type { ImageUrlBuilder } from '../image/image-url-builder.js'\nimport { dbLogger } from '../logger.js'\nimport type { ServerMailer } from '../mailer/index.js'\nimport type { Sequencer } from '../sequencer/index.js'\nimport { type AccountManager, InvalidPasswordError } from './account-manager.js'\nimport type * as schemas from './db/schema/index.js'\nimport * as accountDeviceHelper from './helpers/account-device.js'\nimport { type ActorAccount, UserAlreadyExistsError } from './helpers/account.js'\nimport * as authRequestHelper from './helpers/authorization-request.js'\nimport * as authorizedClientHelper from './helpers/authorized-client.js'\nimport * as deviceHelper from './helpers/device.js'\nimport * as lexiconHelper from './helpers/lexicon.js'\nimport * as tokenHelper from './helpers/token.js'\nimport * as usedRefreshTokenHelper from './helpers/used-refresh-token.js'\n\n/**\n * This class' purpose is to implement the interface needed by the OAuthProvider\n * to interact with the account database (through the {@link AccountManager}).\n *\n * @note The use of this class assumes that there is no entryway.\n */\nexport class OAuthStore\n  implements AccountStore, RequestStore, DeviceStore, LexiconStore, TokenStore\n{\n  constructor(\n    private readonly accountManager: AccountManager,\n    private readonly actorStore: ActorStore,\n    private readonly imageUrlBuilder: ImageUrlBuilder,\n    private readonly backgroundQueue: BackgroundQueue,\n    private readonly mailer: ServerMailer,\n    private readonly sequencer: Sequencer,\n    private readonly plcClient: Client,\n    private readonly plcRotationKey: Keypair,\n    private readonly publicUrl: string,\n    private readonly recoveryDidKey: string | null,\n  ) {}\n\n  private get db() {\n    const { db } = this.accountManager\n    if (db.destroyed) throw new Error('Database connection is closed')\n    return db\n  }\n\n  private get serviceDid() {\n    return this.accountManager.serviceDid\n  }\n\n  private async verifyEmailAvailability(email: string): Promise<void> {\n    // @NOTE Email validity & disposability check performed by the OAuthProvider\n\n    const account = await this.accountManager.getAccountByEmail(email, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (account) {\n      throw new InvalidRequestError(`Email already taken`)\n    }\n  }\n\n  private async verifyInviteCode(code: string) {\n    try {\n      await this.accountManager.ensureInviteIsAvailable(code)\n    } catch (err) {\n      const message =\n        err instanceof XrpcInvalidRequestError ? err.message : undefined\n      throw new InvalidRequestError(\n        'This invite code is invalid.' + (message ? ` ${message}` : ''),\n        err,\n      )\n    }\n  }\n\n  // AccountStore\n\n  async createAccount({\n    locale: _locale,\n    inviteCode,\n    handle,\n    email,\n    password,\n  }: SignUpData): Promise<Account> {\n    // @TODO Send an account creation confirmation email (+verification link) to the user (in their locale)\n    // @NOTE Password strength & length already enforced by the OAuthProvider\n\n    await Promise.all([\n      this.verifyEmailAvailability(email),\n      this.verifyHandleAvailability(handle),\n      !inviteCode || this.verifyInviteCode(inviteCode),\n    ])\n\n    // @TODO The code bellow should probably be refactored to be common with the\n    // code of the `com.atproto.server.createAccount` XRPC endpoint.\n\n    const signingKey = await Secp256k1Keypair.create({ exportable: true })\n    const signingKeyDid = signingKey.did()\n\n    const canTombstone =\n      // @NOTE IMPORTANT We don't support \"bring your own DID\" here (yet?). If\n      // we ever do, make sure to update the computation of canTombstone so that\n      // the user's did don't get tombstoned.\n      true\n\n    const plc = await createPlcOp({\n      signingKey: signingKeyDid,\n      rotationKeys: this.recoveryDidKey\n        ? [this.recoveryDidKey, this.plcRotationKey.did()]\n        : [this.plcRotationKey.did()],\n      handle,\n      pds: this.publicUrl,\n      signer: this.plcRotationKey,\n    })\n\n    const did = plc.did as DidString\n\n    try {\n      await this.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await this.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        await this.plcClient.sendOperation(did, plc.op)\n\n        try {\n          await this.accountManager.createAccount({\n            did,\n            handle,\n            email,\n            password,\n            inviteCode,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n          })\n\n          try {\n            await this.sequencer.sequenceAccountCreation(did, handle, commit)\n\n            try {\n              await this.actorStore\n                .clearReservedKeypair(signingKeyDid, did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the\n                  // whole flow if it fails, but we log it just in case\n                  dbLogger.error(\n                    { did, signingKeyDid, err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              const account = await this.accountManager.getAccount(did)\n              assert(account, 'Account not found after creation')\n\n              return await this.buildAccount(account)\n            } catch (err) {\n              await this.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await this.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await this.plcClient.tombstone(did, this.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await this.actorStore.destroy(did)\n        throw err\n      }\n    } catch (err) {\n      // XrpcError => OAuthError\n      if (err instanceof XrpcInvalidRequestError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n      throw err\n    }\n  }\n\n  async authenticateAccount({\n    locale: _locale,\n    username: identifier,\n    password,\n    // Not supported by the PDS (yet?)\n    emailOtp = undefined,\n  }: AuthenticateAccountData): Promise<Account> {\n    // @TODO (?) Send an email to the user to notify them of the login attempt\n    try {\n      // Should never happen\n      if (emailOtp != null) {\n        throw new Error('Email OTP is not supported')\n      }\n\n      const { user, appPassword, isSoftDeleted } =\n        await this.accountManager.login({ identifier, password })\n\n      if (isSoftDeleted) {\n        throw new InvalidRequestError('Account was taken down')\n      }\n\n      if (appPassword) {\n        throw new InvalidRequestError('App passwords are not allowed')\n      }\n\n      return this.buildAccount(user)\n    } catch (err) {\n      // `InvalidPasswordError` is a subclass of `XrpcAuthRequiredError`,\n      // so it must be checked first. Surfacing the matched `did` as the\n      // `sub` lets the oauth-provider's `onSignInFailed` hook distinguish\n      // \"identifier known, credentials wrong\" from \"identifier unknown\".\n      if (err instanceof InvalidPasswordError) {\n        throw new InvalidCredentialsError(err.message, err.did, err)\n      }\n      if (err instanceof XrpcAuthRequiredError) {\n        throw new InvalidCredentialsError(err.message, undefined, err)\n      }\n      throw err\n    }\n  }\n\n  async setAuthorizedClient(\n    did: Did,\n    clientId: ClientId,\n    data: AuthorizedClientData,\n  ): Promise<void> {\n    await authorizedClientHelper.upsert(this.db, did, clientId, data)\n  }\n\n  async getAccount(did: Did): Promise<{\n    account: Account\n    authorizedClients: AuthorizedClients\n  }> {\n    const accountRow = await this.accountManager.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: false,\n    })\n\n    assert(accountRow, 'Account not found')\n\n    const account = await this.buildAccount(accountRow)\n    const authorizedClients = await authorizedClientHelper.getAuthorizedClients(\n      this.db,\n      did,\n    )\n\n    return { account, authorizedClients }\n  }\n\n  async upsertDeviceAccount(deviceId: DeviceId, sub: string): Promise<void> {\n    await this.db.executeWithRetry(\n      accountDeviceHelper.upsertQB(this.db, deviceId, sub),\n    )\n  }\n\n  async getDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Promise<DeviceAccount | null> {\n    const row = await accountDeviceHelper\n      .selectQB(this.db, { deviceId, did })\n      .executeTakeFirst()\n\n    if (!row) return null\n\n    return {\n      deviceId,\n      deviceData: deviceHelper.rowToDeviceData(row),\n      account: await this.buildAccount(row),\n      authorizedClients: await authorizedClientHelper.getAuthorizedClients(\n        this.db,\n        did,\n      ),\n      createdAt: fromDateISO(row.adCreatedAt),\n      updatedAt: fromDateISO(row.adUpdatedAt),\n    }\n  }\n\n  async removeDeviceAccount(deviceId: DeviceId, did: Did): Promise<void> {\n    await this.db.executeWithRetry(\n      accountDeviceHelper.removeQB(this.db, deviceId, did),\n    )\n  }\n\n  async listDeviceAccounts(\n    filter: { did: Did } | { deviceId: DeviceId },\n  ): Promise<DeviceAccount[]> {\n    const rows = await accountDeviceHelper.selectQB(this.db, filter).execute()\n\n    const uniqueDids = [...new Set(rows.map((row) => row.did))]\n\n    // Enrich all distinct account with their profile data\n    const accounts = new Map(\n      await Promise.all(\n        Array.from(uniqueDids, async (did): Promise<[Did, Account]> => {\n          const row = rows.find((r) => r.did === did)!\n          return [did, await this.buildAccount(row)]\n        }),\n      ),\n    )\n\n    const authorizedClientsMap =\n      await authorizedClientHelper.getAuthorizedClientsMulti(\n        this.db,\n        uniqueDids,\n      )\n\n    return rows.map((row) => ({\n      deviceId: row.deviceId,\n      deviceData: deviceHelper.rowToDeviceData(row),\n      account: accounts.get(row.did)!,\n      authorizedClients: authorizedClientsMap.get(row.did)!,\n      createdAt: fromDateISO(row.adCreatedAt),\n      updatedAt: fromDateISO(row.adUpdatedAt),\n    }))\n  }\n\n  async resetPasswordRequest({\n    email,\n    locale,\n  }: ResetPasswordRequestInput): Promise<Account | null> {\n    const account = await this.accountManager.getAccountByEmail(email, {\n      includeDeactivated: true,\n      includeTakenDown: false,\n    })\n\n    if (!account?.email || !account?.handle) return null\n\n    const { handle } = account\n    const token = await this.accountManager.createEmailToken(\n      account.did,\n      'reset_password',\n    )\n\n    await this.mailer.sendResetPassword(\n      { handle, token, locale },\n      { to: account.email },\n    )\n\n    return this.buildAccount(account)\n  }\n\n  async resetPasswordConfirm(\n    data: ResetPasswordConfirmInput,\n  ): Promise<Account | null> {\n    try {\n      const did = await this.accountManager.resetPassword(data)\n      const account = await this.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: false,\n      })\n\n      return account ? this.buildAccount(account) : null\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        return null\n      }\n\n      throw err\n    }\n  }\n\n  async verifyHandleAvailability(handle: HandleString): Promise<void> {\n    // @NOTE Handle validity & normalization already enforced by the OAuthProvider\n    try {\n      const normalized =\n        await this.accountManager.normalizeAndValidateHandle(handle)\n\n      // Should never happen (OAuthProvider should have already validated the\n      // handle) This check is just a safeguard against future normalization\n      // changes.\n      if (normalized !== handle) {\n        throw new HandleUnavailableError('syntax', 'Invalid handle')\n      }\n\n      const account = await this.accountManager.getAccount(normalized, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n\n      if (account) {\n        throw new HandleUnavailableError('taken')\n      }\n    } catch (err) {\n      throw toHandleUnavailableError(err)\n    }\n  }\n\n  // RequestStore\n\n  async createRequest(id: RequestId, data: RequestData): Promise<void> {\n    await this.db.executeWithRetry(\n      authRequestHelper.createQB(this.db, id, data),\n    )\n  }\n\n  async readRequest(id: RequestId): Promise<RequestData | null> {\n    try {\n      const row = await authRequestHelper.readQB(this.db, id).executeTakeFirst()\n      if (!row) return null\n      return authRequestHelper.rowToRequestData(row)\n    } finally {\n      // Take the opportunity to clean up expired requests. Do this after we got\n      // the current (potentially expired) request data to allow the provider to\n      // handle expired requests.\n      this.backgroundQueue.add(async () => {\n        await this.db.executeWithRetry(\n          authRequestHelper.removeOldExpiredQB(this.db),\n        )\n      })\n    }\n  }\n\n  async updateRequest(id: RequestId, data: UpdateRequestData): Promise<void> {\n    await this.db.executeWithRetry(\n      authRequestHelper.updateQB(this.db, id, data),\n    )\n  }\n\n  async deleteRequest(id: RequestId): Promise<void> {\n    await this.db.executeWithRetry(authRequestHelper.removeByIdQB(this.db, id))\n  }\n\n  async consumeRequestCode(code: Code): Promise<FoundRequestResult | null> {\n    const row = await authRequestHelper\n      .consumeByCodeQB(this.db, code)\n      .executeTakeFirst()\n    return row ? authRequestHelper.rowToFoundRequestResult(row) : null\n  }\n\n  // DeviceStore\n\n  async createDevice(deviceId: DeviceId, data: DeviceData): Promise<void> {\n    await this.db.executeWithRetry(\n      deviceHelper.createQB(this.db, deviceId, data),\n    )\n  }\n\n  async readDevice(deviceId: DeviceId): Promise<null | DeviceData> {\n    const row = await deviceHelper.readQB(this.db, deviceId).executeTakeFirst()\n    return row ? deviceHelper.rowToDeviceData(row) : null\n  }\n\n  async updateDevice(\n    deviceId: DeviceId,\n    data: Partial<DeviceData>,\n  ): Promise<void> {\n    await this.db.executeWithRetry(\n      deviceHelper.updateQB(this.db, deviceId, data),\n    )\n  }\n\n  async deleteDevice(deviceId: DeviceId): Promise<void> {\n    // Will cascade to device_account (device_account_device_id_fk)\n    await this.db.executeWithRetry(deviceHelper.removeQB(this.db, deviceId))\n  }\n\n  // LexiconStore\n\n  async findLexicon(nsid: string): Promise<LexiconData | null> {\n    return lexiconHelper.find(this.db, nsid)\n  }\n\n  async storeLexicon(nsid: string, data: LexiconData): Promise<void> {\n    return lexiconHelper.upsert(this.db, nsid, data)\n  }\n\n  async deleteLexicon(nsid: string): Promise<void> {\n    return lexiconHelper.remove(this.db, nsid)\n  }\n\n  // TokenStore\n\n  async createToken(\n    id: TokenId,\n    data: TokenData,\n    refreshToken?: RefreshToken,\n  ): Promise<void> {\n    await this.db.transaction(async (dbTxn) => {\n      if (refreshToken) {\n        const { count } = await usedRefreshTokenHelper\n          .countQB(dbTxn, refreshToken)\n          .executeTakeFirstOrThrow()\n\n        if (count > 0) {\n          throw new Error('Refresh token already in use')\n        }\n      }\n\n      return tokenHelper.createQB(dbTxn, id, data, refreshToken).execute()\n    })\n  }\n\n  async listAccountTokens(did: Did): Promise<TokenInfo[]> {\n    const rows = await tokenHelper.findByQB(this.db, { did }).execute()\n    return Promise.all(rows.map((row) => this.toTokenInfo(row)))\n  }\n\n  async readToken(tokenId: TokenId): Promise<TokenInfo | null> {\n    const row = await tokenHelper\n      .findByQB(this.db, { tokenId })\n      .executeTakeFirst()\n    return row ? this.toTokenInfo(row) : null\n  }\n\n  async deleteToken(tokenId: TokenId): Promise<void> {\n    // Will cascade to used_refresh_token (used_refresh_token_fk)\n    await this.db.executeWithRetry(tokenHelper.removeQB(this.db, tokenId))\n  }\n\n  async rotateToken(\n    tokenId: TokenId,\n    newTokenId: TokenId,\n    newRefreshToken: RefreshToken,\n    newData: NewTokenData,\n  ): Promise<void> {\n    const err = await this.db.transaction(async (dbTxn) => {\n      const { id, currentRefreshToken } = await tokenHelper\n        .forRotateQB(dbTxn, tokenId)\n        .executeTakeFirstOrThrow()\n\n      if (currentRefreshToken) {\n        await usedRefreshTokenHelper\n          .insertQB(dbTxn, id, currentRefreshToken)\n          .execute()\n      }\n\n      const { count } = await usedRefreshTokenHelper\n        .countQB(dbTxn, newRefreshToken)\n        .executeTakeFirstOrThrow()\n\n      if (count > 0) {\n        // Do NOT throw (we don't want the transaction to be rolled back)\n        return new Error('New refresh token already in use')\n      }\n\n      await tokenHelper\n        .rotateQB(dbTxn, id, newTokenId, newRefreshToken, newData)\n        .execute()\n    })\n\n    if (err) throw err\n  }\n\n  async findTokenByRefreshToken(\n    refreshToken: RefreshToken,\n  ): Promise<TokenInfo | null> {\n    const used = await usedRefreshTokenHelper\n      .findByTokenQB(this.db, refreshToken)\n      .executeTakeFirst()\n\n    const search = used\n      ? { id: used.tokenId }\n      : { currentRefreshToken: refreshToken }\n\n    const row = await tokenHelper.findByQB(this.db, search).executeTakeFirst()\n    return row ? this.toTokenInfo(row) : null\n  }\n\n  async findTokenByCode(code: Code): Promise<TokenInfo | null> {\n    const row = await tokenHelper.findByQB(this.db, { code }).executeTakeFirst()\n    return row ? this.toTokenInfo(row) : null\n  }\n\n  async verifyEmailRequest({\n    did,\n    locale,\n  }: VerifyEmailRequestInput): Promise<void> {\n    try {\n      await this.accountManager.requestEmailConfirmation(did, { locale })\n    } catch (err) {\n      if (err instanceof XrpcAuthRequiredError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n\n      throw err\n    }\n  }\n\n  async verifyEmailConfirm({\n    did,\n    email,\n    token,\n  }: VerifyEmailConfirmInput): Promise<Account | null> {\n    try {\n      const account = await this.accountManager.confirmEmail(did, email, token)\n\n      return this.buildAccount(account)\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        return null\n      }\n\n      throw err\n    }\n  }\n\n  async updateEmailRequest({\n    did,\n    locale,\n  }: UpdateEmailRequestInput): Promise<UpdateEmailRequestOutput> {\n    return this.accountManager.requestEmailUpdate(did, { locale })\n  }\n\n  async updateEmailConfirm({\n    did,\n    token,\n    email,\n    locale,\n  }: UpdateEmailConfirmInput): Promise<Account | null> {\n    try {\n      const account = await this.accountManager.updateEmail(did, email, token, {\n        sendConfirmationEmail: true,\n        locale,\n      })\n\n      return this.buildAccount(account)\n    } catch (cause) {\n      if (cause instanceof UserAlreadyExistsError) {\n        throw new InvalidRequestError(cause.message, cause)\n      }\n\n      throw cause\n    }\n  }\n\n  async updateHandle({ did, handle }: UpdateHandleData): Promise<Account> {\n    try {\n      const account = await this.accountManager.updateHandle(did, handle)\n\n      return this.buildAccount(account)\n    } catch (err) {\n      throw toHandleUnavailableError(err)\n    }\n  }\n\n  async deactivateAccount({\n    did,\n    deleteAfter,\n  }: DeactivateAccountData): Promise<Account> {\n    const { account } = await this.accountManager.deactivateAccount(did, {\n      deleteCredentials: true,\n      deleteAfter,\n    })\n\n    return this.buildAccount(account)\n  }\n\n  async reactivateAccount({ did }: ReactivateAccountData): Promise<Account> {\n    try {\n      const { account } = await this.accountManager.activateAccount(did)\n\n      return this.buildAccount(account)\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n\n      throw err\n    }\n  }\n\n  async deleteAccountRequest({\n    did,\n    locale,\n  }: DeleteAccountRequestInput): Promise<void> {\n    // Mirror the XRPC `com.atproto.server.requestAccountDelete` flow\n    // (no-entryway path): generate an email confirmation token and dispatch\n    // it to the account's email address.\n    const account = await this.accountManager.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n    if (!account.email) {\n      throw new InvalidRequestError('Account does not have an email address')\n    }\n\n    const token = await this.accountManager.createEmailToken(\n      did,\n      'delete_account',\n    )\n    await this.mailer.sendAccountDelete(\n      { token, locale },\n      { to: account.email },\n    )\n  }\n\n  async deleteAccountConfirm({\n    did,\n    token,\n    password,\n  }: DeleteAccountConfirmInput): Promise<void> {\n    // Mirror the XRPC `com.atproto.server.deleteAccount` flow (no-entryway\n    // path): verify the password, validate the email confirmation token,\n    // destroy the actor store, delete the account row, and emit the\n    // tombstone account event.\n    const account = await this.accountManager.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const validPass = await this.accountManager.verifyAccountPassword(\n      did,\n      password,\n    )\n    if (!validPass) {\n      throw new InvalidCredentialsError('Invalid did or password', did)\n    }\n\n    await this.accountManager.assertValidEmailToken(\n      did,\n      'delete_account',\n      token,\n    )\n\n    // @NOTE Order matters here: first \"unlink\" the account by removing it\n    // from the account manager database (\"source of truth\"), then notify the\n    // sequencer, and finally cleanup files from the file system.\n    await this.accountManager.deleteAccount(did)\n    try {\n      await this.sequencer.sequenceAccountDeletion(did)\n    } finally {\n      await this.actorStore.destroy(did)\n    }\n  }\n\n  private async toTokenInfo(\n    row: ActorAccount & Selectable<schemas.Token>,\n  ): Promise<TokenInfo> {\n    return {\n      id: row.tokenId,\n      data: tokenHelper.toTokenData(row),\n      account: await this.buildAccount(row),\n      currentRefreshToken: row.currentRefreshToken,\n    }\n  }\n\n  private async buildAccount(row: ActorAccount): Promise<Account> {\n    const account: Account = {\n      did: row.did,\n      pds: this.serviceDid,\n      email: row.email || undefined,\n      emailVerified: row.email ? row.emailConfirmedAt != null : undefined,\n      handle: row.handle || undefined,\n      deactivated: row.deactivatedAt != null,\n    }\n\n    if (!account.name || !account.picture) {\n      const { did } = account\n\n      const profile = await this.actorStore\n        .read(did, async (store) => {\n          return store.record.getProfileRecord()\n        })\n        .catch((err) => {\n          dbLogger.error({ err }, 'Failed to get profile record')\n          return null // No need to propagate\n        })\n\n      if (profile) {\n        const { avatar, displayName } = profile\n\n        account.name ||= displayName\n        account.picture ||= avatar\n          ? this.imageUrlBuilder.build('avatar', did, getBlobCidString(avatar))\n          : undefined\n      }\n    }\n\n    return account\n  }\n}\n\nfunction toHandleUnavailableError(err: unknown): unknown {\n  if (err instanceof XrpcInvalidRequestError) {\n    const reason = toHandleUnavailableReason(err)\n    if (reason) throw new HandleUnavailableError(reason, err.message, err)\n\n    return new InvalidRequestError(err.message, err)\n  }\n\n  return err\n}\n\n/**\n * This function maps specific `XrpcInvalidRequestError`, thrown by the\n * `AccountManager` when validating a handle, to a more specific\n * `HandleUnavailableError` with a reason. This allows the OAuthProvider to\n * provide properly localized and specific error messages to the user when a\n * handle is not available.\n */\nfunction toHandleUnavailableReason(\n  err: XrpcInvalidRequestError,\n): HandleUnavailableReason | undefined {\n  switch (err.error) {\n    case 'HandleNotAvailable': {\n      if (err.message === 'Reserved handle') return 'reserved'\n      return 'taken'\n    }\n\n    case 'UnsupportedDomain': {\n      return 'unsupported'\n    }\n\n    case 'InvalidHandle': {\n      if (err.message === 'Inappropriate language in handle') return 'slur'\n      if (err.message === 'Handle TLD is invalid or disallowed') return 'domain'\n      return 'syntax'\n    }\n\n    case 'InvalidRequest': {\n      if (err.message === 'External handle did not resolve to DID') {\n        return 'resolution'\n      }\n      return undefined\n    }\n  }\n}\n"]}
+{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../../src/account-manager/oauth-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAe,QAAQ,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAEnE,OAAO,EAAgB,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAGL,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,uCAAuC,GACxC,MAAM,gCAAgC,CAAA;AA4CvC,OAAO,EACL,iBAAiB,IAAI,qBAAqB,EAC1C,mBAAmB,IAAI,uBAAuB,GAC/C,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAGvC,OAAO,EAEL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,mBAAmB,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAqB,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,KAAK,iBAAiB,MAAM,oCAAoC,CAAA;AACvE,OAAO,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,YAAY,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAA;AACrD,OAAO,KAAK,WAAW,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,sBAAsB,MAAM,iCAAiC,CAAA;AAEzE;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IAGrB,YACmB,cAA8B,EAC9B,UAAsB,EACtB,eAAgC,EAChC,eAAgC,EAChC,MAAoB,EACpB,SAAoB,EACpB,SAAiB,EACjB,cAAuB,EACvB,SAAiB,EACjB,cAA6B;8BAT7B,cAAc;0BACd,UAAU;+BACV,eAAe;+BACf,eAAe;sBACf,MAAM;yBACN,SAAS;yBACT,SAAS;8BACT,cAAc;yBACd,SAAS;8BACT,cAAc;IAC9B,CAAC;IAEJ,IAAY,EAAE;QACZ,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,cAAc,CAAA;QAClC,IAAI,EAAE,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAClE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACjD,4EAA4E;QAE5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE;YACjE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;YAClE,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/D,GAAG,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAED,eAAe;IAEf,KAAK,CAAC,aAAa,CAAC,EAClB,MAAM,EAAE,OAAO,EACf,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,GACG;QACX,uGAAuG;QACvG,yEAAyE;QAEzE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YACnC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;YACrC,CAAC,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;SACjD,CAAC,CAAA;QAEF,4EAA4E;QAC5E,gEAAgE;QAEhE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QACtE,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAA;QAEtC,MAAM,YAAY;QAChB,wEAAwE;QACxE,0EAA0E;QAC1E,uCAAuC;QACvC,IAAI,CAAA;QAEN,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;YAC5B,UAAU,EAAE,aAAa;YACzB,YAAY,EAAE,IAAI,CAAC,cAAc;gBAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;gBAClD,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM;YACN,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,MAAM,EAAE,IAAI,CAAC,cAAc;SAC5B,CAAC,CAAA;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAgB,CAAA;QAEhC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;gBAE/C,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;wBACtC,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,UAAU;wBACV,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;qBACpB,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAEjE,IAAI,CAAC;4BACH,MAAM,IAAI,CAAC,UAAU;iCAClB,oBAAoB,CAAC,aAAa,EAAE,GAAG,CAAC;iCACxC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,yDAAyD;gCACzD,qDAAqD;gCACrD,QAAQ,CAAC,KAAK,CACZ,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,EAC3B,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;4BACzD,MAAM,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAA;4BAEnD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;wBACzC,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjD,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC5C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;oBAC1D,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAClC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0BAA0B;YAC1B,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,EACxB,MAAM,EACN,QAAQ,EAAE,UAAU,EACpB,QAAQ,EACR,QAAQ,GACgB;QACxB,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,GACxC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAC9B,UAAU;gBACV,QAAQ;gBACR,eAAe,EAAE,QAAQ;gBACzB,MAAM;aACP,CAAC,CAAA;YAEJ,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAA;YACzD,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;YAChE,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gEAAgE;YAChE,wEAAwE;YACxE,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,qEAAqE;gBACrE,0EAA0E;gBAC1E,6BAA6B;gBAC7B,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9D,CAAC;YACD,oEAAoE;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,uCAAuC,CAC/C,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,IAAI,EACR,GAAG,CACJ,CAAA;YACH,CAAC;YACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,GAAQ,EACR,QAAkB,EAClB,IAA0B;QAE1B,MAAM,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAQ;QAIvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;YAC3D,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,oBAAoB,CACzE,IAAI,CAAC,EAAE,EACP,GAAG,CACJ,CAAA;QAED,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAW;QACvD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CACrD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAkB,EAClB,GAAQ;QAER,MAAM,GAAG,GAAG,MAAM,mBAAmB;aAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;aACpC,gBAAgB,EAAE,CAAA;QAErB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAErB,OAAO;YACL,QAAQ;YACR,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC;YAC7C,OAAO,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACrC,iBAAiB,EAAE,MAAM,sBAAsB,CAAC,oBAAoB,CAClE,IAAI,CAAC,EAAE,EACP,GAAG,CACJ;YACD,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;SACxC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAkB,EAAE,GAAQ;QACpD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CACrD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,MAA6C;QAE7C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAA;QAE1E,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAE3D,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAA2B,EAAE;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAE,CAAA;YAC5C,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC,CAAC,CACH,CACF,CAAA;QAED,MAAM,oBAAoB,GACxB,MAAM,sBAAsB,CAAC,yBAAyB,CACpD,IAAI,CAAC,EAAE,EACP,UAAU,CACX,CAAA;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC;YAC7C,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE;YAC/B,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE;YACrD,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;YACvC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;SACxC,CAAC,CAAC,CAAA;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EACzB,KAAK,EACL,MAAM,GACoB;QAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE;YACjE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO,IAAI,CAAA;QAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CACtD,OAAO,CAAC,GAAG,EACX,gBAAgB,CACjB,CAAA;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACjC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EACzB,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAA+B;QAE/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACxD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAAoB;QACjD,8EAA8E;QAC9E,IAAI,CAAC;YACH,MAAM,UAAU,GACd,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAA;YAE9D,uEAAuE;YACvE,sEAAsE;YACtE,WAAW;YACX,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;YAC9D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE;gBAC/D,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,eAAe;IAEf,KAAK,CAAC,aAAa,CAAC,EAAa,EAAE,IAAiB;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAC9C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAa;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAA;YAC1E,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,OAAO,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;gBAAS,CAAC;YACT,0EAA0E;YAC1E,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,iBAAiB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9C,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAa,EAAE,IAAuB;QACxD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAC9C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAa;QAC/B,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAU;QACjC,MAAM,GAAG,GAAG,MAAM,iBAAiB;aAChC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;aAC9B,gBAAgB,EAAE,CAAA;QACrB,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAED,cAAc;IAEd,KAAK,CAAC,YAAY,CAAC,QAAkB,EAAE,IAAgB;QACrD,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC/C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAkB;QACjC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,QAAkB,EAClB,IAAyB;QAEzB,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC/C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAkB;QACnC,+DAA+D;QAC/D,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,eAAe;IAEf,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,IAAiB;QAChD,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC5C,CAAC;IAED,aAAa;IAEb,KAAK,CAAC,WAAW,CACf,EAAW,EACX,IAAe,EACf,YAA2B;QAE3B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB;qBAC3C,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC;qBAC5B,uBAAuB,EAAE,CAAA;gBAE5B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;gBACjD,CAAC;YACH,CAAC;YAED,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,OAAO,EAAE,CAAA;QACtE,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAQ;QAC9B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACnE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,MAAM,WAAW;aAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;aAC9B,gBAAgB,EAAE,CAAA;QACrB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,6DAA6D;QAC7D,MAAM,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAgB,EAChB,UAAmB,EACnB,eAA6B,EAC7B,OAAqB;QAErB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpD,MAAM,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,MAAM,WAAW;iBAClD,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC;iBAC3B,uBAAuB,EAAE,CAAA;YAE5B,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,sBAAsB;qBACzB,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,mBAAmB,CAAC;qBACxC,OAAO,EAAE,CAAA;YACd,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB;iBAC3C,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC;iBAC/B,uBAAuB,EAAE,CAAA;YAE5B,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,iEAAiE;gBACjE,OAAO,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACtD,CAAC;YAED,MAAM,WAAW;iBACd,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,CAAC;iBACzD,OAAO,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;QAEF,IAAI,GAAG;YAAE,MAAM,GAAG,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,YAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,sBAAsB;aACtC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC;aACpC,gBAAgB,EAAE,CAAA;QAErB,MAAM,MAAM,GAAG,IAAI;YACjB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;YACtB,CAAC,CAAC,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAA;QAEzC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAA;QAC5E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACkB;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,GACmB;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;YAEzE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACkB;QACxB,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,EACL,MAAM,GACkB;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;gBACvE,qBAAqB,EAAE,IAAI;gBAC3B,MAAM;aACP,CAAC,CAAA;YAEF,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,EAC1B,GAAG,GACwB;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YAExE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,EAC3B,GAAG,EACH,KAAK,EACL,MAAM,GACsB;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc;aACtC,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;aAC9C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBAClC,MAAM,IAAI,uCAAuC,CAC/C,UAAU,EACV,KAAK,EACL,GAAG,CAAC,OAAO,CACZ,CAAA;gBACH,CAAC;gBAED,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,uCAAuC;YACvC,MAAM,GAAG,CAAA;QACX,CAAC,CAAC,CAAA;QAEJ,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAoB;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAEnE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EACtB,GAAG,EACH,WAAW,GACW;QACtB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACnE,iBAAiB,EAAE,IAAI;YACvB,WAAW;SACZ,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAyB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAElE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EACzB,GAAG,EACH,MAAM,GACoB;QAC1B,iEAAiE;QACjE,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;YACxD,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CACtD,GAAG,EACH,gBAAgB,CACjB,CAAA;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EACzB,GAAG,EACH,KAAK,EACL,QAAQ,GACkB;QAC1B,uEAAuE;QACvE,qEAAqE;QACrE,gEAAgE;QAChE,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;YACxD,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC/D,GAAG,EACH,QAAQ,CACT,CAAA;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC7C,GAAG,EACH,gBAAgB,EAChB,KAAK,CACN,CAAA;QAED,sEAAsE;QACtE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACnD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,GAA6C;QAE7C,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,OAAO;YACf,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;YAClC,OAAO,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YACrC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;SAC7C,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAiB;QAC1C,MAAM,OAAO,GAAY;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI,CAAC,UAAU;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;YAC7B,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;YACnE,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;YACtE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;YAC/B,WAAW,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;SACvC,CAAA;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;YAEvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;iBAClC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,OAAO,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAA;YACxC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;gBACvD,OAAO,IAAI,CAAA,CAAC,uBAAuB;YACrC,CAAC,CAAC,CAAA;YAEJ,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;gBAEvC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAA;gBAC5B,OAAO,CAAC,OAAO,KAAK,MAAM;oBACxB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACrE,CAAC,CAAC,SAAS,CAAA;YACf,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM;YAAE,MAAM,IAAI,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAEtE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,GAA4B;IAE5B,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,oBAAoB,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,OAAO,KAAK,iBAAiB;gBAAE,OAAO,UAAU,CAAA;YACxD,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,mBAAmB,EAAE,CAAC;YACzB,OAAO,aAAa,CAAA;QACtB,CAAC;QAED,KAAK,eAAe,EAAE,CAAC;YACrB,IAAI,GAAG,CAAC,OAAO,KAAK,kCAAkC;gBAAE,OAAO,MAAM,CAAA;YACrE,IAAI,GAAG,CAAC,OAAO,KAAK,qCAAqC;gBAAE,OAAO,QAAQ,CAAA;YAC1E,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,gBAAgB,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,OAAO,KAAK,wCAAwC,EAAE,CAAC;gBAC7D,OAAO,YAAY,CAAA;YACrB,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import assert from 'node:assert'\nimport { type Client, createOp as createPlcOp } from '@did-plc/lib'\nimport type { Selectable } from 'kysely'\nimport { type Keypair, Secp256k1Keypair } from '@atproto/crypto'\nimport {\n  type DidString,\n  type HandleString,\n  getBlobCidString,\n} from '@atproto/lex'\nimport {\n  HandleUnavailableError,\n  InvalidCredentialsError,\n  InvalidRequestError,\n  SecondAuthenticationFactorRequiredError,\n} from '@atproto/oauth-provider/errors'\nimport type {\n  Account,\n  AccountStore,\n  AuthenticateAccountData,\n  AuthorizedClientData,\n  AuthorizedClients,\n  ClientId,\n  Code,\n  DeactivateAccountData,\n  DeleteAccountConfirmInput,\n  DeleteAccountRequestInput,\n  DeviceAccount,\n  DeviceData,\n  DeviceId,\n  DeviceStore,\n  Did,\n  DisableEmailAuthFactorInput,\n  EnableEmailAuthFactorInput,\n  FoundRequestResult,\n  HandleUnavailableReason,\n  LexiconData,\n  LexiconStore,\n  NewTokenData,\n  ReactivateAccountData,\n  RefreshToken,\n  RequestData,\n  RequestId,\n  RequestStore,\n  ResetPasswordConfirmInput,\n  ResetPasswordRequestInput,\n  SignUpData,\n  TokenData,\n  TokenId,\n  TokenInfo,\n  TokenStore,\n  UpdateEmailConfirmInput,\n  UpdateEmailRequestInput,\n  UpdateEmailRequestOutput,\n  UpdateHandleData,\n  UpdateRequestData,\n  VerifyEmailConfirmInput,\n  VerifyEmailRequestInput,\n} from '@atproto/oauth-provider/store'\nimport {\n  AuthRequiredError as XrpcAuthRequiredError,\n  InvalidRequestError as XrpcInvalidRequestError,\n} from '@atproto/xrpc-server'\nimport type { ActorStore } from '../actor-store/actor-store.js'\nimport type { BackgroundQueue } from '../background.js'\nimport { fromDateISO } from '../db/index.js'\nimport type { ImageUrlBuilder } from '../image/image-url-builder.js'\nimport { dbLogger } from '../logger.js'\nimport type { ServerMailer } from '../mailer/index.js'\nimport type { Sequencer } from '../sequencer/index.js'\nimport {\n  type AccountManager,\n  AuthFactorRequiredError,\n  InvalidPasswordError,\n} from './account-manager.js'\nimport type * as schemas from './db/schema/index.js'\nimport * as accountDeviceHelper from './helpers/account-device.js'\nimport { type ActorAccount, UserAlreadyExistsError } from './helpers/account.js'\nimport * as authRequestHelper from './helpers/authorization-request.js'\nimport * as authorizedClientHelper from './helpers/authorized-client.js'\nimport * as deviceHelper from './helpers/device.js'\nimport * as lexiconHelper from './helpers/lexicon.js'\nimport * as tokenHelper from './helpers/token.js'\nimport * as usedRefreshTokenHelper from './helpers/used-refresh-token.js'\n\n/**\n * This class' purpose is to implement the interface needed by the OAuthProvider\n * to interact with the account database (through the {@link AccountManager}).\n *\n * @note The use of this class assumes that there is no entryway.\n */\nexport class OAuthStore\n  implements AccountStore, RequestStore, DeviceStore, LexiconStore, TokenStore\n{\n  constructor(\n    private readonly accountManager: AccountManager,\n    private readonly actorStore: ActorStore,\n    private readonly imageUrlBuilder: ImageUrlBuilder,\n    private readonly backgroundQueue: BackgroundQueue,\n    private readonly mailer: ServerMailer,\n    private readonly sequencer: Sequencer,\n    private readonly plcClient: Client,\n    private readonly plcRotationKey: Keypair,\n    private readonly publicUrl: string,\n    private readonly recoveryDidKey: string | null,\n  ) {}\n\n  private get db() {\n    const { db } = this.accountManager\n    if (db.destroyed) throw new Error('Database connection is closed')\n    return db\n  }\n\n  private get serviceDid() {\n    return this.accountManager.serviceDid\n  }\n\n  private async verifyEmailAvailability(email: string): Promise<void> {\n    // @NOTE Email validity & disposability check performed by the OAuthProvider\n\n    const account = await this.accountManager.getAccountByEmail(email, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (account) {\n      throw new InvalidRequestError(`Email already taken`)\n    }\n  }\n\n  private async verifyInviteCode(code: string) {\n    try {\n      await this.accountManager.ensureInviteIsAvailable(code)\n    } catch (err) {\n      const message =\n        err instanceof XrpcInvalidRequestError ? err.message : undefined\n      throw new InvalidRequestError(\n        'This invite code is invalid.' + (message ? ` ${message}` : ''),\n        err,\n      )\n    }\n  }\n\n  // AccountStore\n\n  async createAccount({\n    locale: _locale,\n    inviteCode,\n    handle,\n    email,\n    password,\n  }: SignUpData): Promise<Account> {\n    // @TODO Send an account creation confirmation email (+verification link) to the user (in their locale)\n    // @NOTE Password strength & length already enforced by the OAuthProvider\n\n    await Promise.all([\n      this.verifyEmailAvailability(email),\n      this.verifyHandleAvailability(handle),\n      !inviteCode || this.verifyInviteCode(inviteCode),\n    ])\n\n    // @TODO The code bellow should probably be refactored to be common with the\n    // code of the `com.atproto.server.createAccount` XRPC endpoint.\n\n    const signingKey = await Secp256k1Keypair.create({ exportable: true })\n    const signingKeyDid = signingKey.did()\n\n    const canTombstone =\n      // @NOTE IMPORTANT We don't support \"bring your own DID\" here (yet?). If\n      // we ever do, make sure to update the computation of canTombstone so that\n      // the user's did don't get tombstoned.\n      true\n\n    const plc = await createPlcOp({\n      signingKey: signingKeyDid,\n      rotationKeys: this.recoveryDidKey\n        ? [this.recoveryDidKey, this.plcRotationKey.did()]\n        : [this.plcRotationKey.did()],\n      handle,\n      pds: this.publicUrl,\n      signer: this.plcRotationKey,\n    })\n\n    const did = plc.did as DidString\n\n    try {\n      await this.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await this.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        await this.plcClient.sendOperation(did, plc.op)\n\n        try {\n          await this.accountManager.createAccount({\n            did,\n            handle,\n            email,\n            password,\n            inviteCode,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n          })\n\n          try {\n            await this.sequencer.sequenceAccountCreation(did, handle, commit)\n\n            try {\n              await this.actorStore\n                .clearReservedKeypair(signingKeyDid, did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the\n                  // whole flow if it fails, but we log it just in case\n                  dbLogger.error(\n                    { did, signingKeyDid, err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              const account = await this.accountManager.getAccount(did)\n              assert(account, 'Account not found after creation')\n\n              return await this.buildAccount(account)\n            } catch (err) {\n              await this.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await this.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await this.plcClient.tombstone(did, this.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await this.actorStore.destroy(did)\n        throw err\n      }\n    } catch (err) {\n      // XrpcError => OAuthError\n      if (err instanceof XrpcInvalidRequestError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n      throw err\n    }\n  }\n\n  async authenticateAccount({\n    locale,\n    username: identifier,\n    password,\n    emailOtp,\n  }: AuthenticateAccountData): Promise<Account> {\n    // @TODO (?) Send an email to the user to notify them of the login attempt\n    try {\n      const { user, appPassword, isSoftDeleted } =\n        await this.accountManager.login({\n          identifier,\n          password,\n          authFactorToken: emailOtp,\n          locale,\n        })\n\n      if (isSoftDeleted) {\n        throw new InvalidRequestError('Account was taken down')\n      }\n\n      if (appPassword) {\n        throw new InvalidRequestError('App passwords are not allowed')\n      }\n\n      return this.buildAccount(user)\n    } catch (err) {\n      // `InvalidPasswordError` and `AuthFactorRequiredError` are both\n      // subclasses of `XrpcAuthRequiredError`, so both must be checked first.\n      if (err instanceof InvalidPasswordError) {\n        // Surfacing the matched `did` as the `sub` lets the oauth-provider's\n        // `onSignInFailed` hook distinguish \"identifier known, credentials wrong\"\n        // from \"identifier unknown\".\n        throw new InvalidCredentialsError(err.message, err.did, err)\n      }\n      // @NOTE The credentials were valid here — the account simply owes a\n      // second factor, and `login()` has already sent the code. This is the\n      // XRPC → OAuth translation that keeps `AccountManager` OAuth-free.\n      if (err instanceof AuthFactorRequiredError) {\n        throw new SecondAuthenticationFactorRequiredError(\n          err.factor,\n          err.hint,\n          err,\n        )\n      }\n      if (err instanceof XrpcAuthRequiredError) {\n        throw new InvalidCredentialsError(err.message, undefined, err)\n      }\n      throw err\n    }\n  }\n\n  async setAuthorizedClient(\n    did: Did,\n    clientId: ClientId,\n    data: AuthorizedClientData,\n  ): Promise<void> {\n    await authorizedClientHelper.upsert(this.db, did, clientId, data)\n  }\n\n  async getAccount(did: Did): Promise<{\n    account: Account\n    authorizedClients: AuthorizedClients\n  }> {\n    const accountRow = await this.accountManager.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: false,\n    })\n\n    assert(accountRow, 'Account not found')\n\n    const account = await this.buildAccount(accountRow)\n    const authorizedClients = await authorizedClientHelper.getAuthorizedClients(\n      this.db,\n      did,\n    )\n\n    return { account, authorizedClients }\n  }\n\n  async upsertDeviceAccount(deviceId: DeviceId, sub: string): Promise<void> {\n    await this.db.executeWithRetry(\n      accountDeviceHelper.upsertQB(this.db, deviceId, sub),\n    )\n  }\n\n  async getDeviceAccount(\n    deviceId: DeviceId,\n    did: Did,\n  ): Promise<DeviceAccount | null> {\n    const row = await accountDeviceHelper\n      .selectQB(this.db, { deviceId, did })\n      .executeTakeFirst()\n\n    if (!row) return null\n\n    return {\n      deviceId,\n      deviceData: deviceHelper.rowToDeviceData(row),\n      account: await this.buildAccount(row),\n      authorizedClients: await authorizedClientHelper.getAuthorizedClients(\n        this.db,\n        did,\n      ),\n      createdAt: fromDateISO(row.adCreatedAt),\n      updatedAt: fromDateISO(row.adUpdatedAt),\n    }\n  }\n\n  async removeDeviceAccount(deviceId: DeviceId, did: Did): Promise<void> {\n    await this.db.executeWithRetry(\n      accountDeviceHelper.removeQB(this.db, deviceId, did),\n    )\n  }\n\n  async listDeviceAccounts(\n    filter: { did: Did } | { deviceId: DeviceId },\n  ): Promise<DeviceAccount[]> {\n    const rows = await accountDeviceHelper.selectQB(this.db, filter).execute()\n\n    const uniqueDids = [...new Set(rows.map((row) => row.did))]\n\n    // Enrich all distinct account with their profile data\n    const accounts = new Map(\n      await Promise.all(\n        Array.from(uniqueDids, async (did): Promise<[Did, Account]> => {\n          const row = rows.find((r) => r.did === did)!\n          return [did, await this.buildAccount(row)]\n        }),\n      ),\n    )\n\n    const authorizedClientsMap =\n      await authorizedClientHelper.getAuthorizedClientsMulti(\n        this.db,\n        uniqueDids,\n      )\n\n    return rows.map((row) => ({\n      deviceId: row.deviceId,\n      deviceData: deviceHelper.rowToDeviceData(row),\n      account: accounts.get(row.did)!,\n      authorizedClients: authorizedClientsMap.get(row.did)!,\n      createdAt: fromDateISO(row.adCreatedAt),\n      updatedAt: fromDateISO(row.adUpdatedAt),\n    }))\n  }\n\n  async resetPasswordRequest({\n    email,\n    locale,\n  }: ResetPasswordRequestInput): Promise<Account | null> {\n    const account = await this.accountManager.getAccountByEmail(email, {\n      includeDeactivated: true,\n      includeTakenDown: false,\n    })\n\n    if (!account?.email || !account?.handle) return null\n\n    const { handle } = account\n    const token = await this.accountManager.createEmailToken(\n      account.did,\n      'reset_password',\n    )\n\n    await this.mailer.sendResetPassword(\n      { handle, token, locale },\n      { to: account.email },\n    )\n\n    return this.buildAccount(account)\n  }\n\n  async resetPasswordConfirm(\n    data: ResetPasswordConfirmInput,\n  ): Promise<Account | null> {\n    try {\n      const did = await this.accountManager.resetPassword(data)\n      const account = await this.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: false,\n      })\n\n      return account ? this.buildAccount(account) : null\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        return null\n      }\n\n      throw err\n    }\n  }\n\n  async verifyHandleAvailability(handle: HandleString): Promise<void> {\n    // @NOTE Handle validity & normalization already enforced by the OAuthProvider\n    try {\n      const normalized =\n        await this.accountManager.normalizeAndValidateHandle(handle)\n\n      // Should never happen (OAuthProvider should have already validated the\n      // handle) This check is just a safeguard against future normalization\n      // changes.\n      if (normalized !== handle) {\n        throw new HandleUnavailableError('syntax', 'Invalid handle')\n      }\n\n      const account = await this.accountManager.getAccount(normalized, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n\n      if (account) {\n        throw new HandleUnavailableError('taken')\n      }\n    } catch (err) {\n      throw toHandleUnavailableError(err)\n    }\n  }\n\n  // RequestStore\n\n  async createRequest(id: RequestId, data: RequestData): Promise<void> {\n    await this.db.executeWithRetry(\n      authRequestHelper.createQB(this.db, id, data),\n    )\n  }\n\n  async readRequest(id: RequestId): Promise<RequestData | null> {\n    try {\n      const row = await authRequestHelper.readQB(this.db, id).executeTakeFirst()\n      if (!row) return null\n      return authRequestHelper.rowToRequestData(row)\n    } finally {\n      // Take the opportunity to clean up expired requests. Do this after we got\n      // the current (potentially expired) request data to allow the provider to\n      // handle expired requests.\n      this.backgroundQueue.add(async () => {\n        await this.db.executeWithRetry(\n          authRequestHelper.removeOldExpiredQB(this.db),\n        )\n      })\n    }\n  }\n\n  async updateRequest(id: RequestId, data: UpdateRequestData): Promise<void> {\n    await this.db.executeWithRetry(\n      authRequestHelper.updateQB(this.db, id, data),\n    )\n  }\n\n  async deleteRequest(id: RequestId): Promise<void> {\n    await this.db.executeWithRetry(authRequestHelper.removeByIdQB(this.db, id))\n  }\n\n  async consumeRequestCode(code: Code): Promise<FoundRequestResult | null> {\n    const row = await authRequestHelper\n      .consumeByCodeQB(this.db, code)\n      .executeTakeFirst()\n    return row ? authRequestHelper.rowToFoundRequestResult(row) : null\n  }\n\n  // DeviceStore\n\n  async createDevice(deviceId: DeviceId, data: DeviceData): Promise<void> {\n    await this.db.executeWithRetry(\n      deviceHelper.createQB(this.db, deviceId, data),\n    )\n  }\n\n  async readDevice(deviceId: DeviceId): Promise<null | DeviceData> {\n    const row = await deviceHelper.readQB(this.db, deviceId).executeTakeFirst()\n    return row ? deviceHelper.rowToDeviceData(row) : null\n  }\n\n  async updateDevice(\n    deviceId: DeviceId,\n    data: Partial<DeviceData>,\n  ): Promise<void> {\n    await this.db.executeWithRetry(\n      deviceHelper.updateQB(this.db, deviceId, data),\n    )\n  }\n\n  async deleteDevice(deviceId: DeviceId): Promise<void> {\n    // Will cascade to device_account (device_account_device_id_fk)\n    await this.db.executeWithRetry(deviceHelper.removeQB(this.db, deviceId))\n  }\n\n  // LexiconStore\n\n  async findLexicon(nsid: string): Promise<LexiconData | null> {\n    return lexiconHelper.find(this.db, nsid)\n  }\n\n  async storeLexicon(nsid: string, data: LexiconData): Promise<void> {\n    return lexiconHelper.upsert(this.db, nsid, data)\n  }\n\n  async deleteLexicon(nsid: string): Promise<void> {\n    return lexiconHelper.remove(this.db, nsid)\n  }\n\n  // TokenStore\n\n  async createToken(\n    id: TokenId,\n    data: TokenData,\n    refreshToken?: RefreshToken,\n  ): Promise<void> {\n    await this.db.transaction(async (dbTxn) => {\n      if (refreshToken) {\n        const { count } = await usedRefreshTokenHelper\n          .countQB(dbTxn, refreshToken)\n          .executeTakeFirstOrThrow()\n\n        if (count > 0) {\n          throw new Error('Refresh token already in use')\n        }\n      }\n\n      return tokenHelper.createQB(dbTxn, id, data, refreshToken).execute()\n    })\n  }\n\n  async listAccountTokens(did: Did): Promise<TokenInfo[]> {\n    const rows = await tokenHelper.findByQB(this.db, { did }).execute()\n    return Promise.all(rows.map((row) => this.toTokenInfo(row)))\n  }\n\n  async readToken(tokenId: TokenId): Promise<TokenInfo | null> {\n    const row = await tokenHelper\n      .findByQB(this.db, { tokenId })\n      .executeTakeFirst()\n    return row ? this.toTokenInfo(row) : null\n  }\n\n  async deleteToken(tokenId: TokenId): Promise<void> {\n    // Will cascade to used_refresh_token (used_refresh_token_fk)\n    await this.db.executeWithRetry(tokenHelper.removeQB(this.db, tokenId))\n  }\n\n  async rotateToken(\n    tokenId: TokenId,\n    newTokenId: TokenId,\n    newRefreshToken: RefreshToken,\n    newData: NewTokenData,\n  ): Promise<void> {\n    const err = await this.db.transaction(async (dbTxn) => {\n      const { id, currentRefreshToken } = await tokenHelper\n        .forRotateQB(dbTxn, tokenId)\n        .executeTakeFirstOrThrow()\n\n      if (currentRefreshToken) {\n        await usedRefreshTokenHelper\n          .insertQB(dbTxn, id, currentRefreshToken)\n          .execute()\n      }\n\n      const { count } = await usedRefreshTokenHelper\n        .countQB(dbTxn, newRefreshToken)\n        .executeTakeFirstOrThrow()\n\n      if (count > 0) {\n        // Do NOT throw (we don't want the transaction to be rolled back)\n        return new Error('New refresh token already in use')\n      }\n\n      await tokenHelper\n        .rotateQB(dbTxn, id, newTokenId, newRefreshToken, newData)\n        .execute()\n    })\n\n    if (err) throw err\n  }\n\n  async findTokenByRefreshToken(\n    refreshToken: RefreshToken,\n  ): Promise<TokenInfo | null> {\n    const used = await usedRefreshTokenHelper\n      .findByTokenQB(this.db, refreshToken)\n      .executeTakeFirst()\n\n    const search = used\n      ? { id: used.tokenId }\n      : { currentRefreshToken: refreshToken }\n\n    const row = await tokenHelper.findByQB(this.db, search).executeTakeFirst()\n    return row ? this.toTokenInfo(row) : null\n  }\n\n  async findTokenByCode(code: Code): Promise<TokenInfo | null> {\n    const row = await tokenHelper.findByQB(this.db, { code }).executeTakeFirst()\n    return row ? this.toTokenInfo(row) : null\n  }\n\n  async verifyEmailRequest({\n    did,\n    locale,\n  }: VerifyEmailRequestInput): Promise<void> {\n    try {\n      await this.accountManager.requestEmailConfirmation(did, { locale })\n    } catch (err) {\n      if (err instanceof XrpcAuthRequiredError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n\n      throw err\n    }\n  }\n\n  async verifyEmailConfirm({\n    did,\n    email,\n    token,\n  }: VerifyEmailConfirmInput): Promise<Account | null> {\n    try {\n      const account = await this.accountManager.confirmEmail(did, email, token)\n\n      return this.buildAccount(account)\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        return null\n      }\n\n      throw err\n    }\n  }\n\n  async updateEmailRequest({\n    did,\n    locale,\n  }: UpdateEmailRequestInput): Promise<UpdateEmailRequestOutput> {\n    return this.accountManager.requestEmailUpdate(did, { locale })\n  }\n\n  async updateEmailConfirm({\n    did,\n    token,\n    email,\n    locale,\n  }: UpdateEmailConfirmInput): Promise<Account | null> {\n    try {\n      const account = await this.accountManager.updateEmail(did, email, token, {\n        sendConfirmationEmail: true,\n        locale,\n      })\n\n      return this.buildAccount(account)\n    } catch (cause) {\n      if (cause instanceof UserAlreadyExistsError) {\n        throw new InvalidRequestError(cause.message, cause)\n      }\n\n      throw cause\n    }\n  }\n\n  async enableEmailAuthFactor({\n    did,\n  }: EnableEmailAuthFactorInput): Promise<Account> {\n    try {\n      const account = await this.accountManager.enableEmailAuthFactor({ did })\n\n      return this.buildAccount(account)\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n\n      throw err\n    }\n  }\n\n  async disableEmailAuthFactor({\n    did,\n    token,\n    locale,\n  }: DisableEmailAuthFactorInput): Promise<Account> {\n    const account = await this.accountManager\n      .disableEmailAuthFactor({ did, token, locale })\n      .catch((err) => {\n        if (err instanceof XrpcInvalidRequestError) {\n          if (err.error === 'TokenRequired') {\n            throw new SecondAuthenticationFactorRequiredError(\n              'emailOtp',\n              '***',\n              err.message,\n            )\n          }\n\n          throw new InvalidRequestError(err.message, err)\n        }\n\n        // Unexpected error (should not happen)\n        throw err\n      })\n\n    return this.buildAccount(account)\n  }\n\n  async updateHandle({ did, handle }: UpdateHandleData): Promise<Account> {\n    try {\n      const account = await this.accountManager.updateHandle(did, handle)\n\n      return this.buildAccount(account)\n    } catch (err) {\n      throw toHandleUnavailableError(err)\n    }\n  }\n\n  async deactivateAccount({\n    did,\n    deleteAfter,\n  }: DeactivateAccountData): Promise<Account> {\n    const { account } = await this.accountManager.deactivateAccount(did, {\n      deleteCredentials: true,\n      deleteAfter,\n    })\n\n    return this.buildAccount(account)\n  }\n\n  async reactivateAccount({ did }: ReactivateAccountData): Promise<Account> {\n    try {\n      const { account } = await this.accountManager.activateAccount(did)\n\n      return this.buildAccount(account)\n    } catch (err) {\n      if (err instanceof XrpcInvalidRequestError) {\n        throw new InvalidRequestError(err.message, err)\n      }\n\n      throw err\n    }\n  }\n\n  async deleteAccountRequest({\n    did,\n    locale,\n  }: DeleteAccountRequestInput): Promise<void> {\n    // Mirror the XRPC `com.atproto.server.requestAccountDelete` flow\n    // (no-entryway path): generate an email confirmation token and dispatch\n    // it to the account's email address.\n    const account = await this.accountManager.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n    if (!account.email) {\n      throw new InvalidRequestError('Account does not have an email address')\n    }\n\n    const token = await this.accountManager.createEmailToken(\n      did,\n      'delete_account',\n    )\n    await this.mailer.sendAccountDelete(\n      { token, locale },\n      { to: account.email },\n    )\n  }\n\n  async deleteAccountConfirm({\n    did,\n    token,\n    password,\n  }: DeleteAccountConfirmInput): Promise<void> {\n    // Mirror the XRPC `com.atproto.server.deleteAccount` flow (no-entryway\n    // path): verify the password, validate the email confirmation token,\n    // destroy the actor store, delete the account row, and emit the\n    // tombstone account event.\n    const account = await this.accountManager.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const validPass = await this.accountManager.verifyAccountPassword(\n      did,\n      password,\n    )\n    if (!validPass) {\n      throw new InvalidCredentialsError('Invalid did or password', did)\n    }\n\n    await this.accountManager.assertValidEmailToken(\n      did,\n      'delete_account',\n      token,\n    )\n\n    // @NOTE Order matters here: first \"unlink\" the account by removing it\n    // from the account manager database (\"source of truth\"), then notify the\n    // sequencer, and finally cleanup files from the file system.\n    await this.accountManager.deleteAccount(did)\n    try {\n      await this.sequencer.sequenceAccountDeletion(did)\n    } finally {\n      await this.actorStore.destroy(did)\n    }\n  }\n\n  private async toTokenInfo(\n    row: ActorAccount & Selectable<schemas.Token>,\n  ): Promise<TokenInfo> {\n    return {\n      id: row.tokenId,\n      data: tokenHelper.toTokenData(row),\n      account: await this.buildAccount(row),\n      currentRefreshToken: row.currentRefreshToken,\n    }\n  }\n\n  private async buildAccount(row: ActorAccount): Promise<Account> {\n    const account: Account = {\n      did: row.did,\n      pds: this.serviceDid,\n      email: row.email || undefined,\n      emailVerified: row.email ? row.emailConfirmedAt != null : undefined,\n      emailAuthFactor: row.email ? row.emailAuthFactorAt != null : undefined,\n      handle: row.handle || undefined,\n      deactivated: row.deactivatedAt != null,\n    }\n\n    if (!account.name || !account.picture) {\n      const { did } = account\n\n      const profile = await this.actorStore\n        .read(did, async (store) => {\n          return store.record.getProfileRecord()\n        })\n        .catch((err) => {\n          dbLogger.error({ err }, 'Failed to get profile record')\n          return null // No need to propagate\n        })\n\n      if (profile) {\n        const { avatar, displayName } = profile\n\n        account.name ||= displayName\n        account.picture ||= avatar\n          ? this.imageUrlBuilder.build('avatar', did, getBlobCidString(avatar))\n          : undefined\n      }\n    }\n\n    return account\n  }\n}\n\nfunction toHandleUnavailableError(err: unknown): unknown {\n  if (err instanceof XrpcInvalidRequestError) {\n    const reason = toHandleUnavailableReason(err)\n    if (reason) throw new HandleUnavailableError(reason, err.message, err)\n\n    return new InvalidRequestError(err.message, err)\n  }\n\n  return err\n}\n\n/**\n * This function maps specific `XrpcInvalidRequestError`, thrown by the\n * `AccountManager` when validating a handle, to a more specific\n * `HandleUnavailableError` with a reason. This allows the OAuthProvider to\n * provide properly localized and specific error messages to the user when a\n * handle is not available.\n */\nfunction toHandleUnavailableReason(\n  err: XrpcInvalidRequestError,\n): HandleUnavailableReason | undefined {\n  switch (err.error) {\n    case 'HandleNotAvailable': {\n      if (err.message === 'Reserved handle') return 'reserved'\n      return 'taken'\n    }\n\n    case 'UnsupportedDomain': {\n      return 'unsupported'\n    }\n\n    case 'InvalidHandle': {\n      if (err.message === 'Inappropriate language in handle') return 'slur'\n      if (err.message === 'Handle TLD is invalid or disallowed') return 'domain'\n      return 'syntax'\n    }\n\n    case 'InvalidRequest': {\n      if (err.message === 'External handle did not resolve to DID') {\n        return 'resolution'\n      }\n      return undefined\n    }\n  }\n}\n"]}

package/dist/api/com/atproto/admin/updateAccountEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateAccountEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA2BvD"}
+{"version":3,"file":"updateAccountEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwBvD"}

package/dist/api/com/atproto/admin/updateAccountEmail.js

@@ -19,10 +19,7 @@ export default function (server, ctx) {
                 });
                 return;
             }
-            await ctx.accountManager.updateAccountEmail({
-                did: account.did,
-                email: body.email,
-            });
+            await ctx.accountManager.updateAccountEmail(account.did, body.email);
         },
     });
 }

package/dist/api/com/atproto/admin/updateAccountEmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateAccountEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChE,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAC1E,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBAClE,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC;gBAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.updateAccountEmail, {\n    auth: ctx.authVerifier.adminToken,\n    handler: async ({ input: { body }, req }) => {\n      const account = await ctx.accountManager.getAccount(body.account, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError(`Account does not exist: ${body.account}`)\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        await ctx.entrywayClient.xrpc(com.atproto.admin.updateAccountEmail, {\n          headers,\n          body,\n        })\n        return\n      }\n\n      await ctx.accountManager.updateAccountEmail({\n        did: account.did,\n        email: body.email,\n      })\n    },\n  })\n}\n"]}
+{"version":3,"file":"updateAccountEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChE,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAC1E,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBAClE,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.updateAccountEmail, {\n    auth: ctx.authVerifier.adminToken,\n    handler: async ({ input: { body }, req }) => {\n      const account = await ctx.accountManager.getAccount(body.account, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError(`Account does not exist: ${body.account}`)\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        await ctx.entrywayClient.xrpc(com.atproto.admin.updateAccountEmail, {\n          headers,\n          body,\n        })\n        return\n      }\n\n      await ctx.accountManager.updateAccountEmail(account.did, body.email)\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/server/createAccount.js

@@ -182,9 +182,14 @@ const validateInputsForLocalPds = async (ctx, input, requester) => {
         await ctx.accountManager.ensureInviteIsAvailable(inviteCode);
     }
     // check that the handle and email are available
+    //
+    // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and
+    // email uniqueness across taken down and deactivated accounts as well, so we
+    // must check for them when surfacing handle availability.
+    const availability = { includeTakenDown: true, includeDeactivated: true };
     const [handleAccnt, emailAcct] = await Promise.all([
-        ctx.accountManager.getAccount(handle),
-        ctx.accountManager.getAccountByEmail(email),
+        ctx.accountManager.getAccount(handle, availability),
+        ctx.accountManager.getAccountByEmail(email, availability),
     ]);
     if (handleAccnt) {
         throw new InvalidRequestError(`Handle already taken: ${handle}`);

package/dist/api/com/atproto/server/createAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle),\n    ctx.accountManager.getAccountByEmail(email),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}
+{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  //\n  // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n  // email uniqueness across taken down and deactivated accounts as well, so we\n  // must check for them when surfacing handle availability.\n  const availability = { includeTakenDown: true, includeDeactivated: true }\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle, availability),\n    ctx.accountManager.getAccountByEmail(email, availability),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}

package/dist/api/com/atproto/server/createSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwFvD"}
+{"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgGvD"}

package/dist/api/com/atproto/server/createSession.js

@@ -39,7 +39,13 @@ export default function (server, ctx) {
                 if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {
                     throw new AuthRequiredError('Password too long. Consider resetting your password.');
                 }
-                const { user, isSoftDeleted, appPassword } = await ctx.accountManager.login(body);
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                // @NOTE No translation needed for the second-factor challenge: `login()`
+                // throws `AuthFactorRequiredError`, already an `AuthRequiredError`
+                // carrying this method's declared `AuthFactorTokenRequired` error name.
+                const { user, isSoftDeleted, appPassword } = await ctx.accountManager.login({ ...body, locale });
                 if (!body.allowTakendown && isSoftDeleted) {
                     throw new AuthRequiredError('Account has been taken down', 'AccountTakedown');
                 }
@@ -63,6 +69,7 @@ export default function (server, ctx) {
                         handle: (user.handle ?? INVALID_HANDLE),
                         email: user.email ?? undefined,
                         emailConfirmed: !!user.emailConfirmedAt,
+                        emailAuthFactor: !!user.emailAuthFactorAt,
                         active,
                         status,
                     },

package/dist/api/com/atproto/server/createSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAEtC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  type MethodRateLimit,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const rateLimit: MethodRateLimit<\n    void,\n    com.atproto.server.createSession.$Params,\n    com.atproto.server.createSession.$Input\n  > = [\n    {\n      durationMs: DAY,\n      points: 300,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n    {\n      durationMs: 5 * MINUTE,\n      points: 30,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n  ]\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({ input: { body }, req }) => {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return entrywayClient.xrpc(com.atproto.server.createSession, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({\n        input: { body },\n      }): Promise<com.atproto.server.createSession.$Output> => {\n        if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n          throw new AuthRequiredError(\n            'Password too long. Consider resetting your password.',\n          )\n        }\n\n        const { user, isSoftDeleted, appPassword } =\n          await ctx.accountManager.login(body)\n\n        if (!body.allowTakendown && isSoftDeleted) {\n          throw new AuthRequiredError(\n            'Account has been taken down',\n            'AccountTakedown',\n          )\n        }\n\n        const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n          ctx.accountManager.createSession(\n            user.did,\n            appPassword,\n            isSoftDeleted,\n          ),\n          didDocForSession(ctx, user.did),\n        ])\n\n        const { status, active } = formatAccountStatus(user)\n\n        events.sessionCreated({\n          source: com.atproto.server.createSession.$lxm,\n          did: user.did,\n        })\n\n        return {\n          encoding: 'application/json',\n          body: {\n            accessJwt,\n            refreshJwt,\n\n            did: user.did as DidString,\n            // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n            didDoc,\n            handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n            email: user.email ?? undefined,\n            emailConfirmed: !!user.emailConfirmedAt,\n            active,\n            status,\n          },\n        }\n      },\n    })\n  }\n}\n"]}
+{"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;gBAErD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;wBACzC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  type MethodRateLimit,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const rateLimit: MethodRateLimit<\n    void,\n    com.atproto.server.createSession.$Params,\n    com.atproto.server.createSession.$Input\n  > = [\n    {\n      durationMs: DAY,\n      points: 300,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n    {\n      durationMs: 5 * MINUTE,\n      points: 30,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n  ]\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({ input: { body }, req }) => {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return entrywayClient.xrpc(com.atproto.server.createSession, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({\n        input: { body },\n      }): Promise<com.atproto.server.createSession.$Output> => {\n        if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n          throw new AuthRequiredError(\n            'Password too long. Consider resetting your password.',\n          )\n        }\n\n        // @TODO get the locale somehow (either by adding a field in the request\n        // body, or by using the `Accept-Language` header).\n        const locale = undefined\n\n        // @NOTE No translation needed for the second-factor challenge: `login()`\n        // throws `AuthFactorRequiredError`, already an `AuthRequiredError`\n        // carrying this method's declared `AuthFactorTokenRequired` error name.\n        const { user, isSoftDeleted, appPassword } =\n          await ctx.accountManager.login({ ...body, locale })\n\n        if (!body.allowTakendown && isSoftDeleted) {\n          throw new AuthRequiredError(\n            'Account has been taken down',\n            'AccountTakedown',\n          )\n        }\n\n        const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n          ctx.accountManager.createSession(\n            user.did,\n            appPassword,\n            isSoftDeleted,\n          ),\n          didDocForSession(ctx, user.did),\n        ])\n\n        const { status, active } = formatAccountStatus(user)\n\n        events.sessionCreated({\n          source: com.atproto.server.createSession.$lxm,\n          did: user.did,\n        })\n\n        return {\n          encoding: 'application/json',\n          body: {\n            accessJwt,\n            refreshJwt,\n\n            did: user.did as DidString,\n            // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n            didDoc,\n            handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n            email: user.email ?? undefined,\n            emailConfirmed: !!user.emailConfirmedAt,\n            emailAuthFactor: !!user.emailAuthFactorAt,\n            active,\n            status,\n          },\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/getSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAIvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAuDvD"}
+{"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAIvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwDvD"}

package/dist/api/com/atproto/server/getSession.js

@@ -39,6 +39,7 @@ export default function (server, ctx) {
                     handle: (user.handle ?? INVALID_HANDLE),
                     email: user.email ?? undefined,
                     emailConfirmed: !!user.emailConfirmedAt,
+                    emailAuthFactor: !!user.emailAuthFactorAt,
                     active,
                     status,
                 }),

package/dist/api/com/atproto/server/getSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,GAAG,EAAE;gBACd,4DAA4D;YAC9D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,+BAA+B,CAChC,CAAA;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;gBAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,EAAE,WAAW,EAA8B,EAC3C,IAA+C;IAE/C,IACE,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.getSession, {\n    auth: ctx.authVerifier.authorization({\n      additional: [AuthScope.SignupQueued],\n      authorize: () => {\n        // Always allowed. \"email\" access is checked in the handler.\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          'com.atproto.server.getSession',\n        )\n\n        const { body } = await ctx.entrywayClient.xrpc(\n          com.atproto.server.getSession,\n          { headers },\n        )\n\n        return {\n          encoding: 'application/json' as const,\n          body: output(auth, body),\n        }\n      }\n\n      const did = auth.credentials.did\n      const [user, didDoc] = await Promise.all([\n        ctx.accountManager.getAccount(did, { includeDeactivated: true }),\n        didDocForSession(ctx, did),\n      ])\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      return {\n        encoding: 'application/json' as const,\n        body: output(auth, {\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          active,\n          status,\n        }),\n      }\n    },\n  })\n}\n\nfunction output(\n  { credentials }: OAuthOutput | AccessOutput,\n  data: com.atproto.server.getSession.$OutputBody,\n): com.atproto.server.getSession.$OutputBody {\n  if (\n    credentials.type === 'oauth' &&\n    !credentials.permissions.allowsAccount({ attr: 'email', action: 'read' })\n  ) {\n    const { email, emailAuthFactor, emailConfirmed, ...rest } = data\n    return rest\n  }\n\n  return data\n}\n"]}
+{"version":3,"file":"getSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,GAAG,EAAE;gBACd,4DAA4D;YAC9D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,+BAA+B,CAChC,CAAA;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;gBAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;oBACzC,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,EAAE,WAAW,EAA8B,EAC3C,IAA+C;IAE/C,IACE,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.getSession, {\n    auth: ctx.authVerifier.authorization({\n      additional: [AuthScope.SignupQueued],\n      authorize: () => {\n        // Always allowed. \"email\" access is checked in the handler.\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          'com.atproto.server.getSession',\n        )\n\n        const { body } = await ctx.entrywayClient.xrpc(\n          com.atproto.server.getSession,\n          { headers },\n        )\n\n        return {\n          encoding: 'application/json' as const,\n          body: output(auth, body),\n        }\n      }\n\n      const did = auth.credentials.did\n      const [user, didDoc] = await Promise.all([\n        ctx.accountManager.getAccount(did, { includeDeactivated: true }),\n        didDocForSession(ctx, did),\n      ])\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      return {\n        encoding: 'application/json' as const,\n        body: output(auth, {\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          emailAuthFactor: !!user.emailAuthFactorAt,\n          active,\n          status,\n        }),\n      }\n    },\n  })\n}\n\nfunction output(\n  { credentials }: OAuthOutput | AccessOutput,\n  data: com.atproto.server.getSession.$OutputBody,\n): com.atproto.server.getSession.$OutputBody {\n  if (\n    credentials.type === 'oauth' &&\n    !credentials.permissions.allowsAccount({ attr: 'email', action: 'read' })\n  ) {\n    const { email, emailAuthFactor, emailConfirmed, ...rest } = data\n    return rest\n  }\n\n  return data\n}\n"]}

package/dist/api/com/atproto/server/refreshSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgEvD"}
+{"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAiEvD"}

package/dist/api/com/atproto/server/refreshSession.js

@@ -49,6 +49,7 @@ export default function (server, ctx) {
                     handle: (user.handle ?? INVALID_HANDLE),
                     email: user.email ?? undefined,
                     emailConfirmed: !!user.emailConfirmedAt,
+                    emailAuthFactor: !!user.emailAuthFactorAt,
                     active,
                     status,
                 },

package/dist/api/com/atproto/server/refreshSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,MAAM,CAAC,gBAAgB,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;gBAC9C,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.refreshSession, {\n    auth: ctx.authVerifier.refresh(),\n    handler: async ({\n      auth,\n      req,\n    }): Promise<com.atproto.server.refreshSession.$Output> => {\n      const did = auth.credentials.did\n      const user = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n      if (softDeleted(user)) {\n        throw new AuthRequiredError(\n          'Account has been taken down',\n          'AccountTakedown',\n        )\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n          headers,\n        })\n      }\n\n      const [didDoc, rotated] = await Promise.all([\n        didDocForSession(ctx, user.did),\n        ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n      ])\n      if (rotated === null) {\n        throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      events.sessionRefreshed({\n        source: com.atproto.server.refreshSession.$lxm,\n        did: user.did,\n      })\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          accessJwt: rotated.accessJwt,\n          refreshJwt: rotated.refreshJwt,\n\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          active,\n          status,\n        },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,MAAM,CAAC,gBAAgB,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;gBAC9C,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;oBACzC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.refreshSession, {\n    auth: ctx.authVerifier.refresh(),\n    handler: async ({\n      auth,\n      req,\n    }): Promise<com.atproto.server.refreshSession.$Output> => {\n      const did = auth.credentials.did\n      const user = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n      if (softDeleted(user)) {\n        throw new AuthRequiredError(\n          'Account has been taken down',\n          'AccountTakedown',\n        )\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n          headers,\n        })\n      }\n\n      const [didDoc, rotated] = await Promise.all([\n        didDocForSession(ctx, user.did),\n        ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n      ])\n      if (rotated === null) {\n        throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      events.sessionRefreshed({\n        source: com.atproto.server.refreshSession.$lxm,\n        did: user.did,\n      })\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          accessJwt: rotated.accessJwt,\n          refreshJwt: rotated.refreshJwt,\n\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          emailAuthFactor: !!user.emailAuthFactorAt,\n          active,\n          status,\n        },\n      }\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/server/updateEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA6CvD"}
+{"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA6FvD"}

package/dist/api/com/atproto/server/updateEmail.js

@@ -23,10 +23,54 @@ export default function (server, ctx) {
             auth,
             handler: async ({ auth, input: { body } }) => {
                 const did = auth.credentials.did;
-                const { token, email } = body;
+                const account = await ctx.accountManager.getAccount(did, {
+                    includeDeactivated: true,
+                    includeTakenDown: true,
+                });
+                if (!account) {
+                    throw new InvalidRequestError(`Could not find user info for account: ${did}`);
+                }
+                const { token } = body;
+                const email = body.email.toLowerCase();
                 // @TODO get the locale somehow (either by adding a field in the request
                 // body, or by using the `Accept-Language` header).
                 const locale = undefined;
+                // @NOTE Handle explicit toggles even when the factor already matches:
+                // updating the email would clear its confirmation and disable 2FA.
+                if (body.emailAuthFactor != null) {
+                    if (body.emailAuthFactor) {
+                        // User is trying to enable email OTP
+                        if (account.emailConfirmedAt && account.email === email) {
+                            // Enabling only adds protection: immediate, no token required.
+                            await ctx.accountManager.enableEmailAuthFactor({ did });
+                            return; // no need to continue to email change since email is not being changed
+                        }
+                        else {
+                            // @NOTE updating the user email address has the effect of resetting the
+                            // email OTP status, reverting any action we would be performing here.
+                            // Instead of silently ignoring a request to enable email OTP while updating
+                            // the email, we provide an error message.
+                            throw new InvalidRequestError('Please change and verify your email before enabling OTP');
+                        }
+                    }
+                    else {
+                        // User is trying to disable email OTP
+                        if (account.email === email) {
+                            // Disabling removes a second factor, so it's gated by an
+                            // `update_email` OTP: the first call (no token) emails a code and
+                            // makes no change; the second (with token) verifies and disables.
+                            await ctx.accountManager.disableEmailAuthFactor({
+                                did,
+                                token,
+                                locale,
+                            });
+                            return; // no need to continue to email change since email is not being changed
+                        }
+                        else {
+                            // No-op: changing email address always disables OTP
+                        }
+                    }
+                }
                 try {
                     await ctx.accountManager.updateEmail(did, email, token, { locale });
                 }