@atproto/pds 0.5.35 → 0.5.37

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @atproto/pds
 
+## 0.5.37
+
+### Patch Changes
+
+- [#5493](https://github.com/bluesky-social/atproto/pull/5493) [`cd736b3`](https://github.com/bluesky-social/atproto/commit/cd736b3dbbec957cf4eaa7e67fa5b8be8f8ae04e) Thanks [@mozzius](https://github.com/mozzius)! - Add `since` and `startCursor` to `getTimeline` and `getListFeed`, for reading everything strictly newer than a previously returned position.
+
+- [#5576](https://github.com/bluesky-social/atproto/pull/5576) [`13b7cb0`](https://github.com/bluesky-social/atproto/commit/13b7cb000d7358a570be46854a93e441c8fa791e) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Improve resource management of actor store
+
+- [#5584](https://github.com/bluesky-social/atproto/pull/5584) [`a6561d5`](https://github.com/bluesky-social/atproto/commit/a6561d54227756876a0901e4a87675df17972d32) Thanks [@haileyok](https://github.com/haileyok)! - Reject MSTs that reference the same node more than once. Full-tree traversals and diffs now throw `VisitedCidError` instead of re-walking shared subtrees, bounding their cost by the number of unique blocks. `com.atproto.repo.importRepo` returns `InvalidRequest` for such repos.
+- Updated dependencies [[`13b7cb0`](https://github.com/bluesky-social/atproto/commit/13b7cb000d7358a570be46854a93e441c8fa791e), [`f8ed258`](https://github.com/bluesky-social/atproto/commit/f8ed25853dc91a16639decfaee2e0dcbb60808cd), [`cea6f5c`](https://github.com/bluesky-social/atproto/commit/cea6f5c4a034860c35eda03dbde207f5bdb9387f), [`13b7cb0`](https://github.com/bluesky-social/atproto/commit/13b7cb000d7358a570be46854a93e441c8fa791e), [`0593d81`](https://github.com/bluesky-social/atproto/commit/0593d818bc2b7f8a40c9d0fe036bf39c7a4eecda), [`e8b89ff`](https://github.com/bluesky-social/atproto/commit/e8b89ff4c211a10519b54bd83eb64950035942c3), [`a6561d5`](https://github.com/bluesky-social/atproto/commit/a6561d54227756876a0901e4a87675df17972d32), [`52e51de`](https://github.com/bluesky-social/atproto/commit/52e51de0fc7b27173fe7ecc2c7b47ec476a8c1bf)]:
+  - @atproto/repo@0.11.0
+  - @atproto/crypto@0.5.7
+  - @atproto/oauth-provider@0.23.1
+  - @atproto/aws@0.3.19
+  - @atproto-labs/opentelemetry-node@0.3.0
+  - @atproto/lex-data@0.1.8
+  - @atproto/identity@0.5.16
+  - @atproto/xrpc-server@0.13.4
+  - @atproto/common@0.8.5
+  - @atproto/lex@0.3.14
+  - @atproto/lex-cbor@0.1.7
+  - @atproto/lex-document@0.1.13
+  - @atproto/lex-json@0.1.7
+  - @atproto-labs/xrpc-utils@0.1.25
+
+## 0.5.36
+
+### Patch Changes
+
+- [#5562](https://github.com/bluesky-social/atproto/pull/5562) [`f632a35`](https://github.com/bluesky-social/atproto/commit/f632a35e8641644022bf430c6e3b34b1382cab55) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove the need to provide a `plcRotationKey` secret when and override is provided
+
+- [#5563](https://github.com/bluesky-social/atproto/pull/5563) [`af8c350`](https://github.com/bluesky-social/atproto/commit/af8c3501cd32e82cf8128683445656aa6708608d) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Report a handle or email belonging to a deactivated or taken down account as an `InvalidRequest` from `com.atproto.server.createAccount`, instead of failing with an `InternalServerError` once the insert hits the unique index.
+
+- [#5556](https://github.com/bluesky-social/atproto/pull/5556) [`5019f55`](https://github.com/bluesky-social/atproto/commit/5019f5537317ee75ad4527db212bc27c3085fe67) Thanks [@dependabot](https://github.com/apps/dependabot)! - build(deps-dev): bump the dev-dependencies group across 1 directory with 25 updates
+
+- [#5562](https://github.com/bluesky-social/atproto/pull/5562) [`f632a35`](https://github.com/bluesky-social/atproto/commit/f632a35e8641644022bf430c6e3b34b1382cab55) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Honour the `plcRotationKey` override passed to `PDS.create` when updating handles and when creating or tombstoning accounts through OAuth.
+
+- [#5563](https://github.com/bluesky-social/atproto/pull/5563) [`af8c350`](https://github.com/bluesky-social/atproto/commit/af8c3501cd32e82cf8128683445656aa6708608d) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Name the handle, rather than the email, when account creation conflicts on the handle.
+
+- [#5207](https://github.com/bluesky-social/atproto/pull/5207) [`f5f0aab`](https://github.com/bluesky-social/atproto/commit/f5f0aab4cf3046de3dddd9251a07003d29e3c0be) Thanks [@ThisIsMissEm](https://github.com/ThisIsMissEm)! - Fix email authentication factor toggles, including repeated requests, without treating an omitted setting as a request to disable two-factor authentication.
+
+- [#5459](https://github.com/bluesky-social/atproto/pull/5459) [`136e214`](https://github.com/bluesky-social/atproto/commit/136e2145b893773a94e9620df37be5215cdb57a3) Thanks [@gcwill70](https://github.com/gcwill70)! - Allow takendown accounts to file actioned-subject appeals through the PDS.
+
+- [#5207](https://github.com/bluesky-social/atproto/pull/5207) [`f5f0aab`](https://github.com/bluesky-social/atproto/commit/f5f0aab4cf3046de3dddd9251a07003d29e3c0be) Thanks [@ThisIsMissEm](https://github.com/ThisIsMissEm)! - Add email-based authentication factor (2FA) for account sign-in
+
+- [#5562](https://github.com/bluesky-social/atproto/pull/5562) [`f632a35`](https://github.com/bluesky-social/atproto/commit/f632a35e8641644022bf430c6e3b34b1382cab55) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add `overrides?: Partial<AppContextOptions>` argument to `PDS.fromEnv`
+- Updated dependencies [[`5019f55`](https://github.com/bluesky-social/atproto/commit/5019f5537317ee75ad4527db212bc27c3085fe67), [`f5f0aab`](https://github.com/bluesky-social/atproto/commit/f5f0aab4cf3046de3dddd9251a07003d29e3c0be)]:
+  - @atproto/crypto@0.5.6
+  - @atproto/did@0.5.6
+  - @atproto/identity@0.5.15
+  - @atproto/repo@0.10.15
+  - @atproto/xrpc-server@0.13.3
+  - @atproto/oauth-provider@0.23.0
+  - @atproto/aws@0.3.18
+  - @atproto/common@0.8.4
+  - @atproto/oauth-scopes@0.5.13
+  - @atproto-labs/xrpc-utils@0.1.24
+  - @atproto/lex@0.3.13
+
 ## 0.5.35
 
 ### Patch Changes

package/dist/account-manager/account-manager.d.ts

@@ -15,6 +15,10 @@ import * as accountHelpers from './helpers/account.js';
 import { AccountStatus, type ActorAccount } from './helpers/account.js';
 import * as password from './helpers/password.js';
 export { AccountStatus, formatAccountStatus } from './helpers/account.js';
+export type UpdateAccountEmailOptions = {
+    sendConfirmationEmail?: boolean;
+    locale?: string;
+};
 /**
  * Thrown by {@link AccountManager.login} when the identifier resolved to a
  * known account but the supplied credentials (account password / app
@@ -31,6 +35,26 @@ export declare class InvalidPasswordError extends AuthRequiredError {
     readonly did: DidString;
     constructor(did: DidString, errorMessage?: string);
 }
+/**
+ * Thrown by {@link AccountManager.login} when the credentials were valid but
+ * the account requires a second authentication factor. A one-time code has
+ * already been dispatched by the time this is thrown.
+ *
+ * XRPC-native like every other error this class raises: `AuthFactorTokenRequired`
+ * is the error name `com.atproto.server.createSession` declares, so that path
+ * needs no translation. The OAuth boundary ({@link OAuthStore.authenticateAccount})
+ * converts it to `SecondAuthenticationFactorRequiredError` — which is why
+ * `factor` and `hint` are carried as fields rather than baked into the message.
+ *
+ * @NOTE Subclasses {@link AuthRequiredError}, so any `instanceof` check against
+ * the base class must come *after* this one — see the ordering note in
+ * `OAuthStore.authenticateAccount`.
+ */
+export declare class AuthFactorRequiredError extends AuthRequiredError {
+    readonly factor: 'emailOtp';
+    readonly hint: string;
+    constructor(factor: 'emailOtp', hint: string, errorMessage?: string);
+}
 export type AccountManagerDbConfig = {
     accountDbLoc: string;
     disableWalAutoCheckpoint: boolean;
@@ -49,7 +73,7 @@ export declare class AccountManager {
     get serviceDid(): DidString;
     get serviceHandleDomains(): string[];
     migrateOrThrow(): Promise<void>;
-    close(): void;
+    close(): Promise<void>;
     getAccount(handleOrDid: AtIdentifierString, flags?: accountHelpers.AvailabilityFlags): Promise<ActorAccount | null>;
     getAccounts(dids: DidString[], flags?: accountHelpers.AvailabilityFlags): Promise<Map<string, ActorAccount>>;
     getAccountByEmail(email: string, flags?: accountHelpers.AvailabilityFlags): Promise<ActorAccount | null>;
@@ -159,9 +183,11 @@ export declare class AccountManager {
     }>;
     rotateRefreshToken(id: string): any;
     revokeRefreshToken(id: string): Promise<boolean>;
-    login({ identifier, password, }: {
+    login({ identifier, password, authFactorToken, locale, }: {
         identifier: string;
         password: string;
+        authFactorToken?: string | undefined;
+        locale?: string | undefined;
     }): Promise<{
         user: ActorAccount;
         appPassword: password.AppPassDescript | null;
@@ -203,17 +229,42 @@ export declare class AccountManager {
     }): Promise<{
         tokenRequired: boolean;
     }>;
+    checkUpdateEmail(did: DidString, email: string, token?: string): Promise<ActorAccount>;
     /**
      * @throws UserAlreadyExistsError if the new email is already in use by another account
      */
-    updateEmail(did: DidString, email: string, token?: string, opts?: {
-        locale?: string;
-        sendConfirmationEmail?: boolean;
+    updateEmail(did: DidString, email: string, token?: string, opts?: UpdateAccountEmailOptions): Promise<ActorAccount>;
+    updateAccountEmail(did: DidString, email: string, opts?: UpdateAccountEmailOptions): Promise<void>;
+    /**
+     * Enable email-based two-factor authentication. Enabling is immediate: the
+     * account must already have a confirmed email matching `email`, since the
+     * factor delivers one-time codes to that address. Returns
+     * `{ account, tokenRequired }` for symmetry with future factors that require
+     * a confirmation step; email-based 2FA never does, so `tokenRequired` is
+     * always `false`.
+     *
+     * @throws InvalidRequestError if the account has no confirmed, matching email
+     */
+    enableEmailAuthFactor(opts: {
+        did: DidString;
     }): Promise<ActorAccount>;
-    updateAccountEmail(opts: {
+    /**
+     * Disable email-based two-factor authentication. This supports a two-phase
+     * flow, if a token isn't initially supplied for proving control of the inbox
+     * which prevents a hijacked session from silently turning off the factor. The
+     * second call (with a valid `token`) actually disables it. Disabling an
+     * already-disabled factor is an idempotent no-op.
+     *
+     * @throws InvalidRequestError if the account has no matching email, or the
+     * token is invalid
+     * @throws InvalidRequestError with `TokenRequired` error code if a
+     * confirmation token is required but not provided
+     */
+    disableEmailAuthFactor(opts: {
         did: DidString;
-        email: string;
-    }): Promise<void>;
+        token?: string;
+        locale?: string;
+    }): Promise<ActorAccount>;
     resetPassword(opts: {
         password: string;
         token: string;

package/dist/account-manager/account-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager.d.ts","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,cAAc,CAAA;AAIvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAM5C,OAAO,EAAE,iBAAiB,EAAuB,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAQvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EAGvB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKvE,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAKjD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,iBAAiB;aAEvC,GAAG,EAAE,SAAS;IADhC,YACkB,GAAG,EAAE,SAAS,EAC9B,YAAY,SAAmC,EAGhD;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,qBAAa,cAAc;IAIvB,QAAQ,CAAC,GAAG,EAAE,YAAY;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO;IAVlC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IAEtB,YACW,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EAGjC;IAED,IAAI,UAAU,IAAI,SAAS,CAE1B;IAED,IAAI,oBAAoB,IAAI,MAAM,EAAE,CAEnC;IAEK,cAAc,kBAGnB;IAED,KAAK,SAEJ;IAKK,UAAU,CACd,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,WAAW,CACf,IAAI,EAAE,SAAS,EAAE,EACjB,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAEpC;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAIzD;IAEK,cAAc,CAClB,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3B;IAEK,gBAAgB,CAAC,WAAW,EAAE,kBAAkB;gBAUtC,aAAa,CAAC,OAAO;iBAAW,IAAI;;gBACpC,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAC1D;IAEK,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,EACE,GAAG,EACH,aAAqB,GACtB,GAAE;QACD,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,OAAO,CAAA;KACnB,GACL,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GACX,EAAE;QACD,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,iBAwCA;IAEK,uBAAuB,CAAC,IAAI,EAAE;QAClC,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB;;;OAWA;IAED;;;;;;;;OAQG;IACG,YAAY,CAChB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAwBlD;IAEK,oBAAoB,CACxB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QACT,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QAEpB,OAAO,EAAE,YAAY,CAAA;KACtB,CAAC,CAyBD;IAED;;;OAGG;IACG,mBAAmB,CACvB,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf;IAEK,aAAa,CAAC,GAAG,EAAE,SAAS,iBAEjC;IAEK,eAAe,CACnB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,iBAS5C;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS;;;cAEzC;IAEK,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,iBAEzD;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B;gBA1Qa,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAsS1D;IAEK,eAAe,CAAC,GAAG,EAAE,SAAS;gBA1SpB,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAyU1D;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS,iBAGzC;IAKK,aAAa,CACjB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,EAC5C,aAAa,UAAQ;;;OActB;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,OAsDlC;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,oBAElC;IAKK,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,GACT,EAAE;QACD,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC;QAEV,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAA;QAC5C,aAAa,EAAE,OAAO,CAAA;KACvB,CAAC,CA2CD;IAKK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,6DAExE;IAEK,gBAAgB,CAAC,GAAG,EAAE,SAAS;;;;SAEpC;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,CAE1C;IAEK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,iBAOnD;IAKK,uBAAuB,CAAC,IAAI,EAAE,MAAM,iBAEzC;IAEK,iBAAiB,CACrB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,EAChD,QAAQ,EAAE,MAAM,iBAGjB;IAEK,wBAAwB,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,CAAC,GAAG,CAAC,iDAShB;IAEK,sBAAsB,CAAC,GAAG,EAAE,SAAS,iDAG1C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,8DAE9C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,+DAE9C;IAEK,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,oEAEvC;IAEK,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,iBAEhE;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,iBAErE;IAKK,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,mBAEhE;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAGd;IAEK,+BAA+B,CACnC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAId;IAEK,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,iBAkBxE;IAEK,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,yBAwB9D;IAEK,kBAAkB,CACtB,GAAG,EAAE,SAAS,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CA0BrC;IAED;;OAEG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1D,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,iBAM/D;IAEK,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,sCAS5D;IAEK,qBAAqB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,iBAUrE;CACF"}
+{"version":3,"file":"account-manager.d.ts","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,cAAc,CAAA;AAIvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAM5C,OAAO,EAAE,iBAAiB,EAAuB,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAQvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EAGvB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAMvE,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAKjD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,iBAAiB;aAEvC,GAAG,EAAE,SAAS;IADhC,YACkB,GAAG,EAAE,SAAS,EAC9B,YAAY,SAAmC,EAGhD;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,iBAAiB;aAE1C,MAAM,EAAE,UAAU;aAClB,IAAI,EAAE,MAAM;IAF9B,YACkB,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EAC5B,YAAY,SAAuD,EAGpE;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,qBAAa,cAAc;IAIvB,QAAQ,CAAC,GAAG,EAAE,YAAY;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO;IAVlC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;IAEtB,YACW,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EAGjC;IAED,IAAI,UAAU,IAAI,SAAS,CAE1B;IAED,IAAI,oBAAoB,IAAI,MAAM,EAAE,CAEnC;IAEK,cAAc,kBAGnB;IAEK,KAAK,kBAEV;IAKK,UAAU,CACd,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,WAAW,CACf,IAAI,EAAE,SAAS,EAAE,EACjB,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAEpC;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;IAEK,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAIzD;IAEK,cAAc,CAClB,WAAW,EAAE,kBAAkB,EAC/B,KAAK,CAAC,EAAE,cAAc,CAAC,iBAAiB,GACvC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3B;IAEK,gBAAgB,CAAC,WAAW,EAAE,kBAAkB;gBAUtC,aAAa,CAAC,OAAO;iBAAW,IAAI;;gBACpC,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAC1D;IAEK,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,EACE,GAAG,EACH,aAAqB,GACtB,GAAE;QACD,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,aAAa,CAAC,EAAE,OAAO,CAAA;KACnB,GACL,OAAO,CAAC,YAAY,CAAC,CA4CvB;IAEK,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GACX,EAAE;QACD,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,iBAwCA;IAEK,uBAAuB,CAAC,IAAI,EAAE;QAClC,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,GAAG,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB;;;OAWA;IAED;;;;;;;;OAQG;IACG,YAAY,CAChB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC,YAAY,GAAG;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAwBlD;IAEK,oBAAoB,CACxB,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QACT,GAAG,EAAE,SAAS,CAAA;QACd,MAAM,EAAE,YAAY,CAAA;QAEpB,OAAO,EAAE,YAAY,CAAA;KACtB,CAAC,CAyBD;IAED;;;OAGG;IACG,mBAAmB,CACvB,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf;IAEK,aAAa,CAAC,GAAG,EAAE,SAAS,iBAEjC;IAEK,eAAe,CACnB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,iBAS5C;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS;;;cAEzC;IAEK,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,iBAEzD;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,OAAO,CAAC,EAAE;QACR,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B;gBA1Qa,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAsS1D;IAEK,eAAe,CAAC,GAAG,EAAE,SAAS;gBA1SpB,aAAa,CAAC,SAAS;iBAAW,YAAY;;gBAC9C,aAAa,CAAC,WAAW;iBAAW,YAAY;;gBAChD,aAAa,CAAC,MAAM;iBAAW,YAAY;OAyU1D;IAEK,qBAAqB,CAAC,GAAG,EAAE,SAAS,iBAGzC;IAKK,aAAa,CACjB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,EAC5C,aAAa,UAAQ;;;OActB;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,OAsDlC;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,oBAElC;IAKK,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,EACR,eAAe,EACf,MAAM,GACP,EAAE;QACD,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAIpC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC5B,GAAG,OAAO,CAAC;QAEV,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,EAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAA;QAC5C,aAAa,EAAE,OAAO,CAAA;KACvB,CAAC,CAoED;IAKK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,6DAExE;IAEK,gBAAgB,CAAC,GAAG,EAAE,SAAS;;;;SAEpC;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB;IAEK,iBAAiB,CACrB,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,CAE1C;IAEK,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,iBAOnD;IAKK,uBAAuB,CAAC,IAAI,EAAE,MAAM,iBAEzC;IAEK,iBAAiB,CACrB,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,EAChD,QAAQ,EAAE,MAAM,iBAGjB;IAEK,wBAAwB,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,CAAC,GAAG,CAAC,iDAShB;IAEK,sBAAsB,CAAC,GAAG,EAAE,SAAS,iDAG1C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,8DAE9C;IAEK,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,+DAE9C;IAEK,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,oEAEvC;IAEK,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,iBAEhE;IAEK,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,iBAErE;IAKK,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,mBAEhE;IAEK,qBAAqB,CACzB,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAGd;IAEK,+BAA+B,CACnC,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,MAAM,iBAId;IAEK,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,iBAkBxE;IAEK,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,yBAwB9D;IAEK,kBAAkB,CACtB,GAAG,EAAE,SAAS,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CA0BrC;IAEK,gBAAgB,CACpB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CA+BvB;IAED;;OAEG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,yBAAyB,GAC/B,OAAO,CAAC,YAAY,CAAC,CASvB;IAEK,kBAAkB,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,yBAAyB,iBAmBjC;IAED;;;;;;;;;OASG;IACG,qBAAqB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAuC3E;IAED;;;;;;;;;;;OAWG;IACG,sBAAsB,CAAC,IAAI,EAAE;QACjC,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyDxB;IAEK,aAAa,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,sCAS5D;IAEK,qBAAqB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,iBAUrE;CACF"}

package/dist/account-manager/account-manager.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert';
 import { isEmailValid } from '@hapi/address';
 import { isDisposableEmail } from 'disposable-email-domains-js';
-import { HOUR, wait } from '@atproto/common';
+import { HOUR, obfuscateEmail, wait } from '@atproto/common';
 import { isAtIdentifierString, } from '@atproto/lex';
 import { INVALID_HANDLE, currentDatetimeString, isValidTld, } from '@atproto/syntax';
 import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server';
@@ -16,6 +16,7 @@ import * as accountHelpers from './helpers/account.js';
 import { AccountStatus } from './helpers/account.js';
 import * as auth from './helpers/auth.js';
 import * as authorizedClientHelper from './helpers/authorized-client.js';
+import * as emailAuthFactor from './helpers/email-auth-factor.js';
 import * as emailToken from './helpers/email-token.js';
 import * as invite from './helpers/invite.js';
 import * as password from './helpers/password.js';
@@ -41,6 +42,28 @@ export class InvalidPasswordError extends AuthRequiredError {
         this.did = did;
     }
 }
+/**
+ * Thrown by {@link AccountManager.login} when the credentials were valid but
+ * the account requires a second authentication factor. A one-time code has
+ * already been dispatched by the time this is thrown.
+ *
+ * XRPC-native like every other error this class raises: `AuthFactorTokenRequired`
+ * is the error name `com.atproto.server.createSession` declares, so that path
+ * needs no translation. The OAuth boundary ({@link OAuthStore.authenticateAccount})
+ * converts it to `SecondAuthenticationFactorRequiredError` — which is why
+ * `factor` and `hint` are carried as fields rather than baked into the message.
+ *
+ * @NOTE Subclasses {@link AuthRequiredError}, so any `instanceof` check against
+ * the base class must come *after* this one — see the ordering note in
+ * `OAuthStore.authenticateAccount`.
+ */
+export class AuthFactorRequiredError extends AuthRequiredError {
+    constructor(factor, hint, errorMessage = 'A sign in code has been sent to your email address') {
+        super(errorMessage, 'AuthFactorTokenRequired');
+        this.factor = factor;
+        this.hint = hint;
+    }
+}
 export class AccountManager {
     constructor(cfg, actorStore, idResolver, jwtKey, mailer, sequencer, plcClient, plcRotationKey) {
         this.cfg = cfg;
@@ -63,8 +86,8 @@ export class AccountManager {
         await this.db.ensureWal();
         await getMigrator(this.db).migrateToLatestOrThrow();
     }
-    close() {
-        this.db.close();
+    async close() {
+        await this.db.close();
     }
     // Account
     // ----------
@@ -353,7 +376,7 @@ export class AccountManager {
     }
     // Login
     // ----------
-    async login({ identifier, password, }) {
+    async login({ identifier, password, authFactorToken, locale, }) {
         const start = Date.now();
         try {
             const identifierNormalized = identifier.toLowerCase();
@@ -384,6 +407,17 @@ export class AccountManager {
                     throw new InvalidPasswordError(user.did);
                 }
             }
+            if (authFactorToken) {
+                await this.assertValidEmailTokenAndCleanup(user.did, 'auth_factor', authFactorToken);
+                // require email factor when not using an app password
+            }
+            else if (user.email !== null &&
+                user.emailAuthFactorAt !== null &&
+                appPassword === null) {
+                const token = await this.createEmailToken(user.did, 'auth_factor');
+                await this.mailer.sendSignInAuthFactor({ token, handle: user.handle, locale }, { to: user.email });
+                throw new AuthFactorRequiredError('emailOtp', obfuscateEmail(user.email));
+            }
             return { user, appPassword, isSoftDeleted };
         }
         finally {
@@ -512,10 +546,7 @@ export class AccountManager {
         }
         return { tokenRequired: !!token };
     }
-    /**
-     * @throws UserAlreadyExistsError if the new email is already in use by another account
-     */
-    async updateEmail(did, email, token, opts) {
+    async checkUpdateEmail(did, email, token) {
         if (!isEmailValid(email) || isDisposableEmail(email)) {
             throw new InvalidRequestError('This email address is not supported, please use a different email.');
         }
@@ -524,34 +555,136 @@ export class AccountManager {
             includeTakenDown: true,
         });
         if (!account) {
-            throw new InvalidRequestError('account not found');
+            throw new InvalidRequestError(`Could not find user info for account: ${did}`);
         }
         const tokenRequired = !!account.emailConfirmedAt;
-        // require a token if account email is confirmed
-        if (!token && tokenRequired) {
-            throw new InvalidRequestError('confirmation token required', 'TokenRequired');
-        }
         if (token) {
             await this.assertValidEmailToken(did, 'update_email', token);
         }
-        await this.updateAccountEmail({ did, email });
+        else if (tokenRequired) {
+            // require a token if account email is confirmed
+            throw new InvalidRequestError('confirmation token required', 'TokenRequired');
+        }
+        return account;
+    }
+    /**
+     * @throws UserAlreadyExistsError if the new email is already in use by another account
+     */
+    async updateEmail(did, email, token, opts) {
+        const account = await this.checkUpdateEmail(did, email, token);
+        await this.updateAccountEmail(did, email, opts);
         account.email = email;
         account.emailConfirmedAt = null;
+        return account;
+    }
+    async updateAccountEmail(did, email, opts) {
+        await this.db.transaction(async (dbTxn) => {
+            await accountHelpers.updateEmail(dbTxn, did, email);
+            // @NOTE In the same transaction as the email write, deliberately: the
+            // new address is unconfirmed, and 2FA against an unconfirmed address can
+            // lock the user out. The account-manager UI warns about this, see
+            // `show2FaWarningOnEmailUpdate` in context.ts.
+            await emailAuthFactor.deleteForDid(dbTxn, did);
+            await emailToken.deleteAllEmailTokens(dbTxn, did);
+        });
         // Proactively send a confirmation email so that the user can confirm the
         // new email immediately.
         if (opts?.sendConfirmationEmail) {
             const token = await this.createEmailToken(did, 'confirm_email');
-            const locale = opts.locale;
+            const { locale } = opts;
             await this.mailer.sendConfirmEmail({ token, locale }, { to: email });
         }
-        return account;
     }
-    async updateAccountEmail(opts) {
-        const { did, email } = opts;
-        await this.db.transaction(async (dbTxn) => {
-            await accountHelpers.updateEmail(dbTxn, did, email);
-            await emailToken.deleteAllEmailTokens(dbTxn, did);
+    /**
+     * Enable email-based two-factor authentication. Enabling is immediate: the
+     * account must already have a confirmed email matching `email`, since the
+     * factor delivers one-time codes to that address. Returns
+     * `{ account, tokenRequired }` for symmetry with future factors that require
+     * a confirmation step; email-based 2FA never does, so `tokenRequired` is
+     * always `false`.
+     *
+     * @throws InvalidRequestError if the account has no confirmed, matching email
+     */
+    async enableEmailAuthFactor(opts) {
+        const { did } = opts;
+        const account = await this.getAccount(did, {
+            includeDeactivated: true,
+            includeTakenDown: true,
+        });
+        if (!account) {
+            throw new InvalidRequestError('account not found');
+        }
+        // Already enabled → nothing to change (idempotent).
+        if (account.emailAuthFactorAt) {
+            return account;
+        }
+        // Email confirmed → attempt to enable email-based 2FA.
+        if (account.email && account.emailConfirmedAt) {
+            const emailAuthFactorAt = await emailAuthFactor.enable(this.db, did, account.email);
+            // @NOTE The confirmed-email requirement is enforced in the insert's own
+            // SELECT, so a miss here means the address stopped being confirmed (or
+            // changed) between that read and this write. Nothing was persisted, so
+            // don't hand back an account claiming otherwise.
+            if (emailAuthFactorAt) {
+                account.emailAuthFactorAt = emailAuthFactorAt;
+                return account;
+            }
+        }
+        throw new InvalidRequestError('A confirmed email address is required to enable email-based two-factor authentication');
+    }
+    /**
+     * Disable email-based two-factor authentication. This supports a two-phase
+     * flow, if a token isn't initially supplied for proving control of the inbox
+     * which prevents a hijacked session from silently turning off the factor. The
+     * second call (with a valid `token`) actually disables it. Disabling an
+     * already-disabled factor is an idempotent no-op.
+     *
+     * @throws InvalidRequestError if the account has no matching email, or the
+     * token is invalid
+     * @throws InvalidRequestError with `TokenRequired` error code if a
+     * confirmation token is required but not provided
+     */
+    async disableEmailAuthFactor(opts) {
+        const { did, token, locale } = opts;
+        const account = await this.getAccount(did, {
+            includeDeactivated: true,
+            includeTakenDown: true,
         });
+        if (!account) {
+            throw new InvalidRequestError('account not found');
+        }
+        // Already disabled → idempotent no-op; nothing to confirm, no OTP sent.
+        if (!account.emailAuthFactorAt) {
+            return account;
+        }
+        // Fool-proof: account in invalid state
+        if (!account.email) {
+            throw new Error('account has no email address');
+        }
+        // Phase one: no token yet, send a one-time code and signal "pending". MUST
+        // use `update_email` due to social-app using requestEmailUpdate, not
+        // two-step updateEmail:
+        if (!token) {
+            const otp = await this.createEmailToken(did, 'update_email');
+            await this.mailer.sendUpdateEmail({ token: otp, locale: locale }, { to: account.email });
+            throw new InvalidRequestError('confirmation token required', 'TokenRequired');
+        }
+        // Phase two: verify the one-time code, then disable the factor.
+        await this.assertValidEmailTokenAndCleanup(did, 'update_email', token);
+        // The returned flag is deliberately ignored here, unlike in
+        // `enableEmailAuthFactor`. Disabling only conditions the write on `did` and
+        // `email` matching, so a miss means no row matched either, leaving nothing
+        // worth reporting. A deleted account has no factor left to disable, and a
+        // changed email drops the factor row in the same transaction (see
+        // `updateAccountEmail`). That second case stops arising once unconfirmed
+        // emails get a column of their own, since `account.email` will no longer
+        // move mid-flow; the conclusion holds either way.
+        //
+        // Enabling is the opposite: a miss there leaves the account in the very
+        // state the caller asked to change, hence the throw.
+        await emailAuthFactor.disable(this.db, did, account.email);
+        account.emailAuthFactorAt = null;
+        return account;
     }
     async resetPassword(opts) {
         const did = await emailToken.assertValidTokenAndFindDid(this.db, 'reset_password', opts.token);