@atproto/pds 0.5.35 → 0.5.37

package/dist/account-manager/account-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager.js","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAGhC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAG5C,OAAO,EAIL,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,GACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE7E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAGzC,OAAO,EAGL,KAAK,EACL,WAAW,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,UAAU,MAAM,0BAA0B,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AACjD,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAqB,SAAQ,iBAAiB;IACzD,YACkB,GAAc,EAC9B,YAAY,GAAG,gCAAgC;QAE/C,KAAK,CAAC,YAAY,CAAC,CAAA;mBAHH,GAAG;IAIrB,CAAC;CACF;AAOD,MAAM,OAAO,cAAc;IAGzB,YACW,GAAiB,EACjB,UAAsB,EACtB,UAAsB,EACtB,MAAiB,EACjB,MAAoB,EACpB,SAAoB,EACpB,SAAoB,EACpB,cAAuB;mBAPvB,GAAG;0BACH,UAAU;0BACV,UAAU;sBACV,MAAM;sBACN,MAAM;yBACN,SAAS;yBACT,SAAS;8BACT,cAAc;QAEvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAA;IAC7B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;QACzB,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,sBAAsB,EAAE,CAAA;IACrD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,UAAU,CACd,WAA+B,EAC/B,KAAwC;QAExC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC/D,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAiB,EACjB,KAAwC;QAExC,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAwC;QAExC,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAc;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAA+B,EAC/B,KAAwC;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrD,OAAO,GAAG,EAAE,GAAG,IAAI,IAAI,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAA+B;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,GAClE,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAI8B,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,MAAc,EACd,EACE,GAAG,EACH,aAAa,GAAG,KAAK,GACtB,GAGG,EAAE;QAEN,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAEnD,iBAAiB;QACjB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,EACrC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,aAAa;QACb,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,mBAAmB,CAC3B,kCAAkC,EAClC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3D,yCAAyC;YACzC,8BAA8B,CAC5B,UAAU,EACV,IAAI,CAAC,oBAAoB,EACzB,aAAa,CACd,CAAA;QACH,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,mBAAmB,CACpB,CAAA;YACH,CAAC;YAED,4CAA4C;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACpE,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,8CAA8C;gBAC9C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GAWX;QACC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACjE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,cAAc,GAClB,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YAEvE,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,EAAE;oBAC1C,GAAG;oBACH,KAAK;oBACL,cAAc;iBACf,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE;gBAClC,GAAG;gBACH,UAAU;gBACV,GAAG;aACJ,CAAC,CAAA;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,iBAAiB,CAC1B,KAAK,EACL,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EACnC,IAAI,CACL,CAAA;YACH,CAAC;YAED,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAS7B;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,MAAM;SACxB,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAEjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAErC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACzD,GAAG,EACH,SAAS,EACT,OAAO,CACR,CAAA;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,iEAAiE;YACjE,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,CAC5C,CAAA;YACH,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAE3C,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAOrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC9D,aAAa,EAAE,OAAO,EAAE,aAAa;YACrC,GAAG;SACJ,CAAC,CAAA;QAEF,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,MAAM,EAAE,EACjC,oBAAoB,CACrB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAc,EACd,MAAoB;QAEpB,MAAM,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAc;QAChC,OAAO,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,GAAc,EACd,QAA2C;QAE3C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YACtE,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC/C,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,OAAO,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAc,EAAE,GAAQ,EAAE,GAAW;QACxD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,OAGC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnC,MAAM,sBAAsB,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnE,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAClD,CAAC;YAED,OAAO,cAAc,CAAC,iBAAiB,CACrC,KAAK,EACL,GAAG,EACH,OAAO,EAAE,WAAW,IAAI,IAAI,CAC7B,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,6CAA6C;QAC7C,IAAI,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QAE/D,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAc;QAClC,MAAM,gCAAgC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC/D,yCAAyC;YACzC,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAA;QAEzC,IAAI,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACrC,6CAA6C;YAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACzD,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAC5C,GAAG,EACH,OAAO,CAAC,MAAM,IAAI,cAAc,EAChC,MAAM,EACN,QAAQ,CACT,CAAA;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAED,OAAO;IACP,aAAa;IAEb,KAAK,CAAC,aAAa,CACjB,GAAc,EACd,WAA4C,EAC5C,aAAa,GAAG,KAAK;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG;YACH,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC;SACpD,CAAC,CAAA;QACF,mFAAmF;QACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAC1D,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,yDAAyD;QACzD,mEAAmE;QACnE,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAE5E,mDAAmD;QACnD,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAA;QACjC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC,CAAA;QAEjE,MAAM,SAAS,GACb,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAA;QAEjE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,0DAA0D;QAC1D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAEvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,CAAC;gBACV,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE;oBAChC,EAAE;oBACF,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,MAAM;iBACP,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC;aACjE,CAAC,CACH,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACpC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,QAAQ;IACR,aAAa;IAEb,KAAK,CAAC,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,GAIT;QAMC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YAErD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE;oBACjD,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI;iBACvB,CAAC;gBACJ,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;oBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE;wBAC1C,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,IAAI;qBACvB,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAA;YAEV,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAEvC,IAAI,WAAW,GAAoC,IAAI,CAAA;YACvD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACvD,IAAI,CAAC,GAAG,EACR,QAAQ,CACT,CAAA;YACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,8DAA8D;gBAC9D,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;gBACD,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACzB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QAC7C,CAAC;gBAAS,CAAC;YACT,0BAA0B;YAC1B,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,aAAa;IAEb,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY,EAAE,UAAmB;QACvE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAc;QACnC,OAAO,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,WAAmB;QAEnB,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACxD,yEAAyE;YACzE,0BAA0B;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,WAAmB;QAEnB,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;YAC5C,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD,CAAC,CACH,CAAA;IACH,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgD,EAChD,QAAgB;QAEhB,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,UAAkB,EAClB,KAAe,EACf,aAAqB,EACrB,QAAe;QAEf,OAAO,MAAM,CAAC,wBAAwB,CACpC,IAAI,CAAC,EAAE,EACP,UAAU,EACV,KAAK,EACL,aAAa,EACb,QAAQ,CACT,CAAA;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,GAAc;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAe;QACtC,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,GAAc,EAAE,QAAiB;QAC/D,OAAO,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAA6C;QACpE,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACjD,CAAC;IAED,eAAe;IACf,aAAa;IAEb,KAAK,CAAC,gBAAgB,CAAC,GAAc,EAAE,OAA0B;QAC/D,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,+BAA+B,CACnC,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/D,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,GAAc,EAAE,IAA0B;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;QAE/D,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAc,EAAE,KAAa,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YAC9D,MAAM,cAAc,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAA;QAE3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,IAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC;YAClD,CAAC,CAAC,IAAI,CAAA;QAER,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/B,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAC/B,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAa,EACb,KAAc,EACd,IAA2D;QAE3D,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;QAEhD,gDAAgD;QAChD,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;QACH,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QAC9D,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAE7C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;QACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAA;QAE/B,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAuC;QAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAC3B,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;YACnD,MAAM,UAAU,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAyC;QAC3D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,0BAA0B,CACrD,IAAI,CAAC,EAAE,EACP,gBAAgB,EAChB,IAAI,CAAC,KAAK,CACX,CAAA;QACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAElE,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAA0C;QACpE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACpB,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YAC3D,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,CAAC;YACzD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC;SAC1C,CAAC,CACH,CAAA;IACH,CAAC;CACF","sourcesContent":["import assert from 'node:assert'\nimport type { KeyObject } from 'node:crypto'\nimport type { Client as PlcClient } from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { HOUR, wait } from '@atproto/common'\nimport type { Keypair } from '@atproto/crypto'\nimport type { IdResolver } from '@atproto/identity'\nimport {\n  type AtIdentifierString,\n  type DidString,\n  type HandleString,\n  isAtIdentifierString,\n} from '@atproto/lex'\nimport type { Cid } from '@atproto/lex-data'\nimport {\n  INVALID_HANDLE,\n  currentDatetimeString,\n  isValidTld,\n} from '@atproto/syntax'\nimport { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'\nimport type { ActorStore } from '../actor-store/actor-store.js'\nimport { assertValidDidDocumentForService } from '../api/com/atproto/server/util.js'\nimport { AuthScope } from '../auth-scope.js'\nimport type { ServerConfig } from '../config/config.js'\nimport { softDeleted } from '../db/index.js'\nimport { hasExplicitSlur } from '../handle/explicit-slurs.js'\nimport {\n  baseNormalizeAndValidate,\n  ensureHandleServiceConstraints,\n  isServiceDomain,\n} from '../handle/index.js'\nimport type { com } from '../lexicons/index.js'\nimport { httpLogger } from '../logger.js'\nimport type { ServerMailer } from '../mailer/index.js'\nimport type { Sequencer } from '../sequencer/index.js'\nimport {\n  type AccountDb,\n  type EmailTokenPurpose,\n  getDb,\n  getMigrator,\n} from './db/index.js'\nimport * as accountHelpers from './helpers/account.js'\nimport { AccountStatus, type ActorAccount } from './helpers/account.js'\nimport * as auth from './helpers/auth.js'\nimport * as authorizedClientHelper from './helpers/authorized-client.js'\nimport * as emailToken from './helpers/email-token.js'\nimport * as invite from './helpers/invite.js'\nimport * as password from './helpers/password.js'\nimport * as repo from './helpers/repo.js'\nimport * as scrypt from './helpers/scrypt.js'\nimport * as token from './helpers/token.js'\n\nexport { AccountStatus, formatAccountStatus } from './helpers/account.js'\n\n/**\n * Thrown by {@link AccountManager.login} when the identifier resolved to a\n * known account but the supplied credentials (account password / app\n * password) did not match. The matched `did` is attached so downstream\n * callers can distinguish \"identifier known, credentials wrong\" from\n * \"identifier unknown\" (which continues to throw a plain\n * {@link AuthRequiredError}).\n *\n * Callers should take care that remote clients *cannot* distinguish the above,\n * to prevent enumeration attacks. (Tested for in\n * packages/pds/tests/auth.test.ts)\n */\nexport class InvalidPasswordError extends AuthRequiredError {\n  constructor(\n    public readonly did: DidString,\n    errorMessage = 'Invalid identifier or password',\n  ) {\n    super(errorMessage)\n  }\n}\n\nexport type AccountManagerDbConfig = {\n  accountDbLoc: string\n  disableWalAutoCheckpoint: boolean\n}\n\nexport class AccountManager {\n  readonly db: AccountDb\n\n  constructor(\n    readonly cfg: ServerConfig,\n    readonly actorStore: ActorStore,\n    readonly idResolver: IdResolver,\n    readonly jwtKey: KeyObject,\n    readonly mailer: ServerMailer,\n    readonly sequencer: Sequencer,\n    readonly plcClient: PlcClient,\n    readonly plcRotationKey: Keypair,\n  ) {\n    this.db = getDb(cfg.db.accountDbLoc, cfg.db.disableWalAutoCheckpoint)\n  }\n\n  get serviceDid(): DidString {\n    return this.cfg.service.did\n  }\n\n  get serviceHandleDomains(): string[] {\n    return this.cfg.identity.serviceHandleDomains\n  }\n\n  async migrateOrThrow() {\n    await this.db.ensureWal()\n    await getMigrator(this.db).migrateToLatestOrThrow()\n  }\n\n  close() {\n    this.db.close()\n  }\n\n  // Account\n  // ----------\n\n  async getAccount(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccount(this.db, handleOrDid, flags)\n  }\n\n  async getAccounts(\n    dids: DidString[],\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<Map<string, ActorAccount>> {\n    return accountHelpers.getAccounts(this.db, dids, flags)\n  }\n\n  async getAccountByEmail(\n    email: string,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccountByEmail(this.db, email, flags)\n  }\n\n  async isAccountActivated(did: DidString): Promise<boolean> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) return false\n    return !account.deactivatedAt\n  }\n\n  async getDidForActor(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<DidString | null> {\n    const got = await this.getAccount(handleOrDid, flags)\n    return got?.did ?? null\n  }\n\n  async getAccountStatus(handleOrDid: AtIdentifierString) {\n    const got = await this.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    const { active, status = active ? AccountStatus.Active : undefined } =\n      accountHelpers.formatAccountStatus(got)\n    assert(status != null)\n    return { status, account: got } as\n      | { status: AccountStatus.Deleted; account: null }\n      | { status: AccountStatus.Takendown; account: ActorAccount }\n      | { status: AccountStatus.Deactivated; account: ActorAccount }\n      | { status: AccountStatus.Active; account: ActorAccount }\n  }\n\n  async normalizeAndValidateHandle(\n    handle: string,\n    {\n      did,\n      allowAnyValid = false,\n    }: {\n      did?: string\n      allowAnyValid?: boolean\n    } = {},\n  ): Promise<HandleString> {\n    const normalized = baseNormalizeAndValidate(handle)\n\n    // tld validation\n    if (!isValidTld(normalized)) {\n      throw new InvalidRequestError(\n        'Handle TLD is invalid or disallowed',\n        'InvalidHandle',\n      )\n    }\n    // slur check\n    if (!allowAnyValid && hasExplicitSlur(normalized)) {\n      throw new InvalidRequestError(\n        'Inappropriate language in handle',\n        'InvalidHandle',\n      )\n    }\n    if (isServiceDomain(normalized, this.serviceHandleDomains)) {\n      // verify constraints on a service domain\n      ensureHandleServiceConstraints(\n        normalized,\n        this.serviceHandleDomains,\n        allowAnyValid,\n      )\n    } else {\n      // When creating an account (no did yet), we require the handle to be a\n      // local service domain. Updating to a custom handle will be possible once\n      // the account was created.\n      if (did == null) {\n        throw new InvalidRequestError(\n          'Not a supported handle domain',\n          'UnsupportedDomain',\n        )\n      }\n\n      // verify resolution of a non-service domain\n      const resolvedDid = await this.idResolver.handle.resolve(normalized)\n      if (resolvedDid !== did) {\n        // @TODO This should use a distinct error code\n        throw new InvalidRequestError('External handle did not resolve to DID')\n      }\n    }\n\n    return normalized\n  }\n\n  async createAccount({\n    did,\n    handle,\n    email,\n    password,\n    repoCid,\n    repoRev,\n    inviteCode,\n    deactivated,\n    refreshJwt,\n  }: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n    refreshJwt?: string\n  }) {\n    if (password && password.length > scrypt.NEW_PASSWORD_MAX_LENGTH) {\n      throw new InvalidRequestError('Password too long')\n    }\n\n    const passwordScrypt =\n      email && password ? await scrypt.genSaltAndHash(password) : undefined\n\n    const now = currentDatetimeString()\n    return this.db.transaction(async (dbTxn) => {\n      if (inviteCode) {\n        await invite.ensureInviteIsAvailable(dbTxn, inviteCode)\n      }\n\n      await accountHelpers.registerActor(dbTxn, { did, handle, deactivated })\n\n      if (email && passwordScrypt) {\n        await accountHelpers.registerAccount(dbTxn, {\n          did,\n          email,\n          passwordScrypt,\n        })\n      }\n\n      await invite.recordInviteUse(dbTxn, {\n        did,\n        inviteCode,\n        now,\n      })\n\n      if (refreshJwt) {\n        await auth.storeRefreshToken(\n          dbTxn,\n          auth.decodeRefreshToken(refreshJwt),\n          null,\n        )\n      }\n\n      await repo.updateRoot(dbTxn, did, repoCid, repoRev)\n    })\n  }\n\n  async createAccountAndSession(opts: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n  }) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: opts.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: AuthScope.Access,\n    })\n\n    await this.createAccount({ ...opts, refreshJwt })\n\n    return { accessJwt, refreshJwt }\n  }\n\n  /**\n   * Validates the requested handle, updates the PLC document if needed, persists\n   * the new handle locally, and emits an identity event.\n   *\n   * @throws {InvalidRequestError} when the handle is invalid, taken by another\n   * account, or cannot be resolved for non-service domains.\n   *\n   * @see {@link AccountManager.updateAccountHandle} for behavior when the PLC update fails.\n   */\n  async updateHandle(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<ActorAccount & { handle: HandleString }> {\n    const { account, handle } = await this.validateHandleUpdate(\n      did,\n      newHandle,\n      options,\n    )\n\n    if (did.startsWith('did:plc:')) {\n      // @TODO We should verify the status before issuing a PLC update.\n      await this.plcClient.updateHandle(did, this.plcRotationKey, handle)\n    } else {\n      const resolved = await this.idResolver.did.resolveAtprotoData(did, true)\n      if (resolved.handle !== handle) {\n        throw new InvalidRequestError(\n          'DID is not properly configured for handle',\n        )\n      }\n    }\n\n    // @NOTE If the next line fails (for any reason), we don't \"rollback\" the\n    // PLC update above. The caller can just call this method again.\n    await this.updateAccountHandle(did, handle)\n\n    return { ...account, handle }\n  }\n\n  async validateHandleUpdate(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<{\n    did: DidString\n    handle: HandleString\n    // Returned for convenience\n    account: ActorAccount\n  }> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const handle = await this.normalizeAndValidateHandle(newHandle, {\n      allowAnyValid: options?.allowAnyValid,\n      did,\n    })\n\n    // Pessimistic check to handle spam: also enforced by updateAccountHandle() and the db.\n    const existing = await this.getAccount(handle, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (existing && existing.did !== did) {\n      throw new InvalidRequestError(\n        `Handle already taken: ${handle}`,\n        'HandleNotAvailable',\n      )\n    }\n\n    return { did, handle, account }\n  }\n\n  /**\n   * @note Failure to emit the identity event will silently be ignored. Users\n   * can emit the event again by updating their handle to the same value.\n   */\n  async updateAccountHandle(\n    did: DidString,\n    handle: HandleString,\n  ): Promise<void> {\n    await accountHelpers.updateHandle(this.db, did, handle)\n\n    try {\n      await this.sequencer.sequenceIdentity(did, handle)\n    } catch (err) {\n      httpLogger.error({ err, did, handle }, 'failed to sequence handle update')\n    }\n  }\n\n  async deleteAccount(did: DidString) {\n    return accountHelpers.deleteAccount(this.db, did)\n  }\n\n  async takedownAccount(\n    did: DidString,\n    takedown: com.atproto.admin.defs.StatusAttr,\n  ) {\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateAccountTakedownStatus(dbTxn, did, takedown)\n      await auth.revokeRefreshTokensByDid(dbTxn, did)\n      await token.removeByDid(dbTxn, did)\n    })\n\n    await this.sequenceAccountStatus(did)\n  }\n\n  async getAccountAdminStatus(did: DidString) {\n    return accountHelpers.getAccountAdminStatus(this.db, did)\n  }\n\n  async updateRepoRoot(did: DidString, cid: Cid, rev: string) {\n    return repo.updateRoot(this.db, did, cid, rev)\n  }\n\n  async deactivateAccount(\n    did: DidString,\n    options?: {\n      deleteCredentials?: boolean\n      deleteAfter?: string | null\n    },\n  ) {\n    const wasUpdated = await this.db.transaction(async (dbTxn) => {\n      if (options?.deleteCredentials) {\n        await token.removeByDid(dbTxn, did)\n        await authorizedClientHelper.deleteAllAuthorizedClients(dbTxn, did)\n        await password.deleteAllAppPasswords(dbTxn, did)\n      }\n\n      return accountHelpers.deactivateAccount(\n        dbTxn,\n        did,\n        options?.deleteAfter ?? null,\n      )\n    })\n\n    if (!wasUpdated) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    // Account is likely soft-deleted (takendown)\n    if (accountStatus.status === AccountStatus.Deleted) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    await this.sequencer.sequenceAccount(did, accountStatus.status)\n\n    return accountStatus\n  }\n\n  async activateAccount(did: DidString) {\n    await assertValidDidDocumentForService(this, did)\n\n    const found = await accountHelpers.activateAccount(this.db, did, {\n      // We cannot activate a takendown account\n      includeTakenDown: false,\n      includeDeactivated: true,\n    })\n    if (!found) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    const { account, status } = accountStatus\n\n    if (status === AccountStatus.Deleted) {\n      // A concurrent operation deleted the account\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const syncData = await this.actorStore.read(did, (store) => {\n      return store.repo.getSyncEventData()\n    })\n\n    await this.sequencer.sequenceAccountActivation(\n      did,\n      account.handle ?? INVALID_HANDLE,\n      status,\n      syncData,\n    )\n\n    return accountStatus\n  }\n\n  async sequenceAccountStatus(did: DidString) {\n    const { status } = await this.getAccountStatus(did)\n    await this.sequencer.sequenceAccount(did, status)\n  }\n\n  // Auth\n  // ----------\n\n  async createSession(\n    did: DidString,\n    appPassword: password.AppPassDescript | null,\n    isSoftDeleted = false,\n  ) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(appPassword, isSoftDeleted),\n    })\n    // For soft deleted accounts don't store refresh token so that it can't be rotated.\n    if (!isSoftDeleted) {\n      const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n      await auth.storeRefreshToken(this.db, refreshPayload, appPassword)\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async rotateRefreshToken(id: string) {\n    const token = await auth.getRefreshToken(this.db, id)\n    if (!token) return null\n\n    const now = new Date()\n\n    // take the chance to tidy all of a user's expired tokens\n    // does not need to be transactional since this is just best-effort\n    await auth.deleteExpiredRefreshTokens(this.db, token.did, now.toISOString())\n\n    // Shorten the refresh token lifespan down from its\n    // original expiration time to its revocation grace period.\n    const prevExpiresAt = new Date(token.expiresAt)\n    const REFRESH_GRACE_MS = 2 * HOUR\n    const graceExpiresAt = new Date(now.getTime() + REFRESH_GRACE_MS)\n\n    const expiresAt =\n      graceExpiresAt < prevExpiresAt ? graceExpiresAt : prevExpiresAt\n\n    if (expiresAt <= now) {\n      return null\n    }\n\n    // Determine the next refresh token id: upon refresh token\n    // reuse you always receive a refresh token with the same id.\n    const nextId = token.nextId ?? auth.getRefreshTokenId()\n\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: token.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(token.appPassword),\n      jti: nextId,\n    })\n\n    const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n    try {\n      await this.db.transaction((dbTxn) =>\n        Promise.all([\n          auth.addRefreshGracePeriod(dbTxn, {\n            id,\n            expiresAt: expiresAt.toISOString(),\n            nextId,\n          }),\n          auth.storeRefreshToken(dbTxn, refreshPayload, token.appPassword),\n        ]),\n      )\n    } catch (err) {\n      if (err instanceof auth.ConcurrentRefreshError) {\n        return this.rotateRefreshToken(id)\n      }\n      throw err\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async revokeRefreshToken(id: string) {\n    return auth.revokeRefreshToken(this.db, id)\n  }\n\n  // Login\n  // ----------\n\n  async login({\n    identifier,\n    password,\n  }: {\n    identifier: string\n    password: string\n  }): Promise<{\n    // @TODO we should rename this \"account\" for consistency\n    user: ActorAccount\n    appPassword: password.AppPassDescript | null\n    isSoftDeleted: boolean\n  }> {\n    const start = Date.now()\n    try {\n      const identifierNormalized = identifier.toLowerCase()\n\n      const user = identifierNormalized.includes('@')\n        ? await this.getAccountByEmail(identifierNormalized, {\n            includeDeactivated: true,\n            includeTakenDown: true,\n          })\n        : isAtIdentifierString(identifierNormalized)\n          ? await this.getAccount(identifierNormalized, {\n              includeDeactivated: true,\n              includeTakenDown: true,\n            })\n          : null\n\n      if (!user) {\n        throw new AuthRequiredError('Invalid identifier or password')\n      }\n      const isSoftDeleted = softDeleted(user)\n\n      let appPassword: password.AppPassDescript | null = null\n      const validAccountPass = await this.verifyAccountPassword(\n        user.did,\n        password,\n      )\n      if (!validAccountPass) {\n        // takendown/suspended accounts cannot login with app password\n        if (isSoftDeleted) {\n          throw new InvalidPasswordError(user.did)\n        }\n        appPassword = await this.verifyAppPassword(user.did, password)\n        if (appPassword === null) {\n          throw new InvalidPasswordError(user.did)\n        }\n      }\n\n      return { user, appPassword, isSoftDeleted }\n    } finally {\n      // Mitigate timing attacks\n      await wait(350 - (Date.now() - start))\n    }\n  }\n\n  // Passwords\n  // ----------\n\n  async createAppPassword(did: DidString, name: string, privileged: boolean) {\n    return password.createAppPassword(this.db, did, name, privileged)\n  }\n\n  async listAppPasswords(did: DidString) {\n    return password.listAppPasswords(this.db, did)\n  }\n\n  async verifyAccountPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<boolean> {\n    if (passwordStr.length > scrypt.OLD_PASSWORD_MAX_LENGTH) {\n      // @NOTE Avoid throwing from here to avoid leaking account email validity\n      // through error messages.\n      return false\n    }\n\n    return password.verifyAccountPassword(this.db, did, passwordStr)\n  }\n\n  async verifyAppPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<password.AppPassDescript | null> {\n    return password.verifyAppPassword(this.db, did, passwordStr)\n  }\n\n  async revokeAppPassword(did: DidString, name: string) {\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.deleteAppPassword(dbTxn, did, name),\n        auth.revokeAppPasswordRefreshToken(dbTxn, did, name),\n      ]),\n    )\n  }\n\n  // Invites\n  // ----------\n\n  async ensureInviteIsAvailable(code: string) {\n    return invite.ensureInviteIsAvailable(this.db, code)\n  }\n\n  async createInviteCodes(\n    toCreate: { account: string; codes: string[] }[],\n    useCount: number,\n  ) {\n    return invite.createInviteCodes(this.db, toCreate, useCount)\n  }\n\n  async createAccountInviteCodes(\n    forAccount: string,\n    codes: string[],\n    expectedTotal: number,\n    disabled: 0 | 1,\n  ) {\n    return invite.createAccountInviteCodes(\n      this.db,\n      forAccount,\n      codes,\n      expectedTotal,\n      disabled,\n    )\n  }\n\n  async getAccountInvitesCodes(did: DidString) {\n    const inviteCodes = await invite.getAccountsInviteCodes(this.db, [did])\n    return inviteCodes.get(did) ?? []\n  }\n\n  async getAccountsInvitesCodes(dids: DidString[]) {\n    return invite.getAccountsInviteCodes(this.db, dids)\n  }\n\n  async getInvitedByForAccounts(dids: DidString[]) {\n    return invite.getInvitedByForAccounts(this.db, dids)\n  }\n\n  async getInviteCodesUses(codes: string[]) {\n    return invite.getInviteCodesUses(this.db, codes)\n  }\n\n  async setAccountInvitesDisabled(did: DidString, disabled: boolean) {\n    return invite.setAccountInvitesDisabled(this.db, did, disabled)\n  }\n\n  async disableInviteCodes(opts: { codes: string[]; accounts: string[] }) {\n    return invite.disableInviteCodes(this.db, opts)\n  }\n\n  // Email Tokens\n  // ----------\n\n  async createEmailToken(did: DidString, purpose: EmailTokenPurpose) {\n    return emailToken.createEmailToken(this.db, did, purpose)\n  }\n\n  async assertValidEmailToken(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    return emailToken.assertValidToken(this.db, did, purpose, token)\n  }\n\n  async assertValidEmailTokenAndCleanup(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    await emailToken.assertValidToken(this.db, did, purpose, token)\n    await emailToken.deleteEmailToken(this.db, did, purpose)\n  }\n\n  async requestEmailConfirmation(did: DidString, opts?: { locale?: string }) {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const locale = opts?.locale\n    const token = await this.createEmailToken(did, 'confirm_email')\n\n    await this.mailer.sendConfirmEmail({ token, locale }, { to: account.email })\n  }\n\n  async confirmEmail(did: DidString, email: string, token: string) {\n    const user = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!user) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    if (user.email !== email.toLowerCase()) {\n      throw new InvalidRequestError('invalid email', 'InvalidEmail')\n    }\n\n    await emailToken.assertValidToken(this.db, did, 'confirm_email', token)\n    const now = currentDatetimeString()\n    await this.db.transaction(async (dbTxn) => {\n      await emailToken.deleteEmailToken(dbTxn, did, 'confirm_email')\n      await accountHelpers.setEmailConfirmedAt(dbTxn, did, now)\n    })\n\n    user.emailConfirmedAt = now\n\n    return user\n  }\n\n  async requestEmailUpdate(\n    did: DidString,\n    opts?: { locale?: string },\n  ): Promise<{ tokenRequired: boolean }> {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const token = account.emailConfirmedAt\n      ? await this.createEmailToken(did, 'update_email')\n      : null\n\n    if (token) {\n      await this.mailer.sendUpdateEmail(\n        { token, locale: opts?.locale },\n        { to: account.email },\n      )\n    }\n\n    return { tokenRequired: !!token }\n  }\n\n  /**\n   * @throws UserAlreadyExistsError if the new email is already in use by another account\n   */\n  async updateEmail(\n    did: DidString,\n    email: string,\n    token?: string,\n    opts?: { locale?: string; sendConfirmationEmail?: boolean },\n  ): Promise<ActorAccount> {\n    if (!isEmailValid(email) || isDisposableEmail(email)) {\n      throw new InvalidRequestError(\n        'This email address is not supported, please use a different email.',\n      )\n    }\n\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    const tokenRequired = !!account.emailConfirmedAt\n\n    // require a token if account email is confirmed\n    if (!token && tokenRequired) {\n      throw new InvalidRequestError(\n        'confirmation token required',\n        'TokenRequired',\n      )\n    }\n\n    if (token) {\n      await this.assertValidEmailToken(did, 'update_email', token)\n    }\n\n    await this.updateAccountEmail({ did, email })\n\n    account.email = email\n    account.emailConfirmedAt = null\n\n    // Proactively send a confirmation email so that the user can confirm the\n    // new email immediately.\n    if (opts?.sendConfirmationEmail) {\n      const token = await this.createEmailToken(did, 'confirm_email')\n      const locale = opts.locale\n      await this.mailer.sendConfirmEmail({ token, locale }, { to: email })\n    }\n\n    return account\n  }\n\n  async updateAccountEmail(opts: { did: DidString; email: string }) {\n    const { did, email } = opts\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateEmail(dbTxn, did, email)\n      await emailToken.deleteAllEmailTokens(dbTxn, did)\n    })\n  }\n\n  async resetPassword(opts: { password: string; token: string }) {\n    const did = await emailToken.assertValidTokenAndFindDid(\n      this.db,\n      'reset_password',\n      opts.token,\n    )\n    await this.updateAccountPassword({ did, password: opts.password })\n\n    return did\n  }\n\n  async updateAccountPassword(opts: { did: DidString; password: string }) {\n    const { did } = opts\n    const passwordScrypt = await scrypt.genSaltAndHash(opts.password)\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.updateUserPassword(dbTxn, { did, passwordScrypt }),\n        emailToken.deleteEmailToken(dbTxn, did, 'reset_password'),\n        auth.revokeRefreshTokensByDid(dbTxn, did),\n      ]),\n    )\n  }\n}\n"]}
+{"version":3,"file":"account-manager.js","sourceRoot":"","sources":["../../src/account-manager/account-manager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAGhC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAG5D,OAAO,EAIL,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,GACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE7E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAGzC,OAAO,EAGL,KAAK,EACL,WAAW,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,eAAe,MAAM,gCAAgC,CAAA;AACjE,OAAO,KAAK,UAAU,MAAM,0BAA0B,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AACjD,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAOzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAqB,SAAQ,iBAAiB;IACzD,YACkB,GAAc,EAC9B,YAAY,GAAG,gCAAgC;QAE/C,KAAK,CAAC,YAAY,CAAC,CAAA;mBAHH,GAAG;IAIrB,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,uBAAwB,SAAQ,iBAAiB;IAC5D,YACkB,MAAkB,EAClB,IAAY,EAC5B,YAAY,GAAG,oDAAoD;QAEnE,KAAK,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAA;sBAJ9B,MAAM;oBACN,IAAI;IAItB,CAAC;CACF;AAOD,MAAM,OAAO,cAAc;IAGzB,YACW,GAAiB,EACjB,UAAsB,EACtB,UAAsB,EACtB,MAAiB,EACjB,MAAoB,EACpB,SAAoB,EACpB,SAAoB,EACpB,cAAuB;mBAPvB,GAAG;0BACH,UAAU;0BACV,UAAU;sBACV,MAAM;sBACN,MAAM;yBACN,SAAS;yBACT,SAAS;8BACT,cAAc;QAEvB,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAA;IAC7B,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAA;QACzB,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,sBAAsB,EAAE,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,UAAU,CACd,WAA+B,EAC/B,KAAwC;QAExC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAC/D,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAiB,EACjB,KAAwC;QAExC,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAwC;QAExC,OAAO,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAc;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAA+B,EAC/B,KAAwC;QAExC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrD,OAAO,GAAG,EAAE,GAAG,IAAI,IAAI,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAA+B;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,GAClE,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAI8B,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,0BAA0B,CAC9B,MAAc,EACd,EACE,GAAG,EACH,aAAa,GAAG,KAAK,GACtB,GAGG,EAAE;QAEN,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAEnD,iBAAiB;QACjB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAC3B,qCAAqC,EACrC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,aAAa;QACb,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,mBAAmB,CAC3B,kCAAkC,EAClC,eAAe,CAChB,CAAA;QACH,CAAC;QACD,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3D,yCAAyC;YACzC,8BAA8B,CAC5B,UAAU,EACV,IAAI,CAAC,oBAAoB,EACzB,aAAa,CACd,CAAA;QACH,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,0EAA0E;YAC1E,2BAA2B;YAC3B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,mBAAmB,CACpB,CAAA;YACH,CAAC;YAED,4CAA4C;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACpE,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,8CAA8C;gBAC9C,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAClB,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,GAWX;QACC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACjE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,cAAc,GAClB,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YAEvE,IAAI,KAAK,IAAI,cAAc,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,EAAE;oBAC1C,GAAG;oBACH,KAAK;oBACL,cAAc;iBACf,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE;gBAClC,GAAG;gBACH,UAAU;gBACV,GAAG;aACJ,CAAC,CAAA;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,iBAAiB,CAC1B,KAAK,EACL,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EACnC,IAAI,CACL,CAAA;YACH,CAAC;YAED,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAS7B;QACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,SAAS,CAAC,MAAM;SACxB,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAEjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAErC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACzD,GAAG,EACH,SAAS,EACT,OAAO,CACR,CAAA;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,iEAAiE;YACjE,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,CAC5C,CAAA;YACH,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAE3C,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,GAAc,EACd,SAAiB,EACjB,OAAqC;QAOrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC9D,aAAa,EAAE,OAAO,EAAE,aAAa;YACrC,GAAG;SACJ,CAAC,CAAA;QAEF,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;YAC7C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,MAAM,EAAE,EACjC,oBAAoB,CACrB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAc,EACd,MAAoB;QAEpB,MAAM,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAc;QAChC,OAAO,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,GAAc,EACd,QAA2C;QAE3C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YACtE,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC/C,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,OAAO,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAc,EAAE,GAAQ,EAAE,GAAW;QACxD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,OAGC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3D,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnC,MAAM,sBAAsB,CAAC,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBACnE,MAAM,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAClD,CAAC;YAED,OAAO,cAAc,CAAC,iBAAiB,CACrC,KAAK,EACL,GAAG,EACH,OAAO,EAAE,WAAW,IAAI,IAAI,CAC7B,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,6CAA6C;QAC7C,IAAI,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QAE/D,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAc;QAClC,MAAM,gCAAgC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;YAC/D,yCAAyC;YACzC,gBAAgB,EAAE,KAAK;YACvB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,CAAA;QAEzC,IAAI,MAAM,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACrC,6CAA6C;YAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACzD,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAC5C,GAAG,EACH,OAAO,CAAC,MAAM,IAAI,cAAc,EAChC,MAAM,EACN,QAAQ,CACT,CAAA;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc;QACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAED,OAAO;IACP,aAAa;IAEb,KAAK,CAAC,aAAa,CACjB,GAAc,EACd,WAA4C,EAC5C,aAAa,GAAG,KAAK;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG;YACH,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC;SACpD,CAAC,CAAA;QACF,mFAAmF;QACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAC1D,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QAEtB,yDAAyD;QACzD,mEAAmE;QACnE,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QAE5E,mDAAmD;QACnD,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAA;QACjC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC,CAAA;QAEjE,MAAM,SAAS,GACb,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAA;QAEjE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,0DAA0D;QAC1D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAEvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACxD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1C,GAAG,EAAE,MAAM;SACZ,CAAC,CAAA;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,OAAO,CAAC,GAAG,CAAC;gBACV,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE;oBAChC,EAAE;oBACF,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,MAAM;iBACP,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC;aACjE,CAAC,CACH,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;YACpC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,QAAQ;IACR,aAAa;IAEb,KAAK,CAAC,KAAK,CAAC,EACV,UAAU,EACV,QAAQ,EACR,eAAe,EACf,MAAM,GASP;QAMC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,oBAAoB,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YAErD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE;oBACjD,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI;iBACvB,CAAC;gBACJ,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;oBAC1C,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE;wBAC1C,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,IAAI;qBACvB,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAA;YAEV,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAEvC,IAAI,WAAW,GAAoC,IAAI,CAAA;YACvD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,qBAAqB,CACvD,IAAI,CAAC,GAAG,EACR,QAAQ,CACT,CAAA;YACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,8DAA8D;gBAC9D,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;gBACD,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;oBACzB,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC1C,CAAC;YACH,CAAC;YAED,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,+BAA+B,CACxC,IAAI,CAAC,GAAG,EACR,aAAa,EACb,eAAe,CAChB,CAAA;gBACD,sDAAsD;YACxD,CAAC;iBAAM,IACL,IAAI,CAAC,KAAK,KAAK,IAAI;gBACnB,IAAI,CAAC,iBAAiB,KAAK,IAAI;gBAC/B,WAAW,KAAK,IAAI,EACpB,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;gBAElE,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACpC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EACtC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CACnB,CAAA;gBAED,MAAM,IAAI,uBAAuB,CAC/B,UAAU,EACV,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3B,CAAA;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;QAC7C,CAAC;gBAAS,CAAC;YACT,0BAA0B;YAC1B,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,aAAa;IAEb,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY,EAAE,UAAmB;QACvE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAc;QACnC,OAAO,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,WAAmB;QAEnB,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;YACxD,yEAAyE;YACzE,0BAA0B;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,GAAc,EACd,WAAmB;QAEnB,OAAO,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,IAAY;QAClD,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;YAC5C,IAAI,CAAC,6BAA6B,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD,CAAC,CACH,CAAA;IACH,CAAC;IAED,UAAU;IACV,aAAa;IAEb,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgD,EAChD,QAAgB;QAEhB,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,UAAkB,EAClB,KAAe,EACf,aAAqB,EACrB,QAAe;QAEf,OAAO,MAAM,CAAC,wBAAwB,CACpC,IAAI,CAAC,EAAE,EACP,UAAU,EACV,KAAK,EACL,aAAa,EACb,QAAQ,CACT,CAAA;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,GAAc;QACzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACvE,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAiB;QAC7C,OAAO,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAe;QACtC,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,GAAc,EAAE,QAAiB;QAC/D,OAAO,MAAM,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAA6C;QACpE,OAAO,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACjD,CAAC;IAED,eAAe;IACf,aAAa;IAEb,KAAK,CAAC,gBAAgB,CAAC,GAAc,EAAE,OAA0B;QAC/D,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,+BAA+B,CACnC,GAAc,EACd,OAA0B,EAC1B,KAAa;QAEb,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/D,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,GAAc,EAAE,IAA0B;QACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;QAE/D,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAc,EAAE,KAAa,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;QACvE,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAA;QACnC,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;YAC9D,MAAM,cAAc,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAA;QAE3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,IAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC;YAClD,CAAC,CAAC,IAAI,CAAA;QAER,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/B,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAC/B,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;QACH,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,GAAc,EACd,KAAa,EACb,KAAc;QAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;QACH,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;QAEhD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QAC9D,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,gDAAgD;YAChD,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAa,EACb,KAAc,EACd,IAAgC;QAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QAE9D,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAE/C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;QACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAA;QAE/B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,KAAa,EACb,IAAgC;QAEhC,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;YACnD,sEAAsE;YACtE,yEAAyE;YACzE,kEAAkE;YAClE,+CAA+C;YAC/C,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC9C,MAAM,UAAU,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;QAEF,yEAAyE;QACzE,yBAAyB;QACzB,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;YAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;YACvB,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAwB;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,oDAAoD;QACpD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,uDAAuD;QACvD,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,MAAM,CACpD,IAAI,CAAC,EAAE,EACP,GAAG,EACH,OAAO,CAAC,KAAK,CACd,CAAA;YAED,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,iDAAiD;YACjD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;gBAE7C,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mBAAmB,CAC3B,uFAAuF,CACxF,CAAA;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,sBAAsB,CAAC,IAI5B;QACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QAEnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC/B,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,wBAAwB;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAC9B,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CACtB,CAAA;YAED,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QAEtE,4DAA4D;QAC5D,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,kDAAkD;QAClD,EAAE;QACF,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAE1D,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAA;QAEhC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAyC;QAC3D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,0BAA0B,CACrD,IAAI,CAAC,EAAE,EACP,gBAAgB,EAChB,IAAI,CAAC,KAAK,CACX,CAAA;QACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAElE,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAA0C;QACpE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACpB,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YAC3D,UAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,CAAC;YACzD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC;SAC1C,CAAC,CACH,CAAA;IACH,CAAC;CACF","sourcesContent":["import assert from 'node:assert'\nimport type { KeyObject } from 'node:crypto'\nimport type { Client as PlcClient } from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { HOUR, obfuscateEmail, wait } from '@atproto/common'\nimport type { Keypair } from '@atproto/crypto'\nimport type { IdResolver } from '@atproto/identity'\nimport {\n  type AtIdentifierString,\n  type DidString,\n  type HandleString,\n  isAtIdentifierString,\n} from '@atproto/lex'\nimport type { Cid } from '@atproto/lex-data'\nimport {\n  INVALID_HANDLE,\n  currentDatetimeString,\n  isValidTld,\n} from '@atproto/syntax'\nimport { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'\nimport type { ActorStore } from '../actor-store/actor-store.js'\nimport { assertValidDidDocumentForService } from '../api/com/atproto/server/util.js'\nimport { AuthScope } from '../auth-scope.js'\nimport type { ServerConfig } from '../config/config.js'\nimport { softDeleted } from '../db/index.js'\nimport { hasExplicitSlur } from '../handle/explicit-slurs.js'\nimport {\n  baseNormalizeAndValidate,\n  ensureHandleServiceConstraints,\n  isServiceDomain,\n} from '../handle/index.js'\nimport type { com } from '../lexicons/index.js'\nimport { httpLogger } from '../logger.js'\nimport type { ServerMailer } from '../mailer/index.js'\nimport type { Sequencer } from '../sequencer/index.js'\nimport {\n  type AccountDb,\n  type EmailTokenPurpose,\n  getDb,\n  getMigrator,\n} from './db/index.js'\nimport * as accountHelpers from './helpers/account.js'\nimport { AccountStatus, type ActorAccount } from './helpers/account.js'\nimport * as auth from './helpers/auth.js'\nimport * as authorizedClientHelper from './helpers/authorized-client.js'\nimport * as emailAuthFactor from './helpers/email-auth-factor.js'\nimport * as emailToken from './helpers/email-token.js'\nimport * as invite from './helpers/invite.js'\nimport * as password from './helpers/password.js'\nimport * as repo from './helpers/repo.js'\nimport * as scrypt from './helpers/scrypt.js'\nimport * as token from './helpers/token.js'\n\nexport { AccountStatus, formatAccountStatus } from './helpers/account.js'\n\nexport type UpdateAccountEmailOptions = {\n  sendConfirmationEmail?: boolean\n  locale?: string\n}\n\n/**\n * Thrown by {@link AccountManager.login} when the identifier resolved to a\n * known account but the supplied credentials (account password / app\n * password) did not match. The matched `did` is attached so downstream\n * callers can distinguish \"identifier known, credentials wrong\" from\n * \"identifier unknown\" (which continues to throw a plain\n * {@link AuthRequiredError}).\n *\n * Callers should take care that remote clients *cannot* distinguish the above,\n * to prevent enumeration attacks. (Tested for in\n * packages/pds/tests/auth.test.ts)\n */\nexport class InvalidPasswordError extends AuthRequiredError {\n  constructor(\n    public readonly did: DidString,\n    errorMessage = 'Invalid identifier or password',\n  ) {\n    super(errorMessage)\n  }\n}\n\n/**\n * Thrown by {@link AccountManager.login} when the credentials were valid but\n * the account requires a second authentication factor. A one-time code has\n * already been dispatched by the time this is thrown.\n *\n * XRPC-native like every other error this class raises: `AuthFactorTokenRequired`\n * is the error name `com.atproto.server.createSession` declares, so that path\n * needs no translation. The OAuth boundary ({@link OAuthStore.authenticateAccount})\n * converts it to `SecondAuthenticationFactorRequiredError` — which is why\n * `factor` and `hint` are carried as fields rather than baked into the message.\n *\n * @NOTE Subclasses {@link AuthRequiredError}, so any `instanceof` check against\n * the base class must come *after* this one — see the ordering note in\n * `OAuthStore.authenticateAccount`.\n */\nexport class AuthFactorRequiredError extends AuthRequiredError {\n  constructor(\n    public readonly factor: 'emailOtp',\n    public readonly hint: string,\n    errorMessage = 'A sign in code has been sent to your email address',\n  ) {\n    super(errorMessage, 'AuthFactorTokenRequired')\n  }\n}\n\nexport type AccountManagerDbConfig = {\n  accountDbLoc: string\n  disableWalAutoCheckpoint: boolean\n}\n\nexport class AccountManager {\n  readonly db: AccountDb\n\n  constructor(\n    readonly cfg: ServerConfig,\n    readonly actorStore: ActorStore,\n    readonly idResolver: IdResolver,\n    readonly jwtKey: KeyObject,\n    readonly mailer: ServerMailer,\n    readonly sequencer: Sequencer,\n    readonly plcClient: PlcClient,\n    readonly plcRotationKey: Keypair,\n  ) {\n    this.db = getDb(cfg.db.accountDbLoc, cfg.db.disableWalAutoCheckpoint)\n  }\n\n  get serviceDid(): DidString {\n    return this.cfg.service.did\n  }\n\n  get serviceHandleDomains(): string[] {\n    return this.cfg.identity.serviceHandleDomains\n  }\n\n  async migrateOrThrow() {\n    await this.db.ensureWal()\n    await getMigrator(this.db).migrateToLatestOrThrow()\n  }\n\n  async close() {\n    await this.db.close()\n  }\n\n  // Account\n  // ----------\n\n  async getAccount(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccount(this.db, handleOrDid, flags)\n  }\n\n  async getAccounts(\n    dids: DidString[],\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<Map<string, ActorAccount>> {\n    return accountHelpers.getAccounts(this.db, dids, flags)\n  }\n\n  async getAccountByEmail(\n    email: string,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<ActorAccount | null> {\n    return accountHelpers.getAccountByEmail(this.db, email, flags)\n  }\n\n  async isAccountActivated(did: DidString): Promise<boolean> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) return false\n    return !account.deactivatedAt\n  }\n\n  async getDidForActor(\n    handleOrDid: AtIdentifierString,\n    flags?: accountHelpers.AvailabilityFlags,\n  ): Promise<DidString | null> {\n    const got = await this.getAccount(handleOrDid, flags)\n    return got?.did ?? null\n  }\n\n  async getAccountStatus(handleOrDid: AtIdentifierString) {\n    const got = await this.getAccount(handleOrDid, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    const { active, status = active ? AccountStatus.Active : undefined } =\n      accountHelpers.formatAccountStatus(got)\n    assert(status != null)\n    return { status, account: got } as\n      | { status: AccountStatus.Deleted; account: null }\n      | { status: AccountStatus.Takendown; account: ActorAccount }\n      | { status: AccountStatus.Deactivated; account: ActorAccount }\n      | { status: AccountStatus.Active; account: ActorAccount }\n  }\n\n  async normalizeAndValidateHandle(\n    handle: string,\n    {\n      did,\n      allowAnyValid = false,\n    }: {\n      did?: string\n      allowAnyValid?: boolean\n    } = {},\n  ): Promise<HandleString> {\n    const normalized = baseNormalizeAndValidate(handle)\n\n    // tld validation\n    if (!isValidTld(normalized)) {\n      throw new InvalidRequestError(\n        'Handle TLD is invalid or disallowed',\n        'InvalidHandle',\n      )\n    }\n    // slur check\n    if (!allowAnyValid && hasExplicitSlur(normalized)) {\n      throw new InvalidRequestError(\n        'Inappropriate language in handle',\n        'InvalidHandle',\n      )\n    }\n    if (isServiceDomain(normalized, this.serviceHandleDomains)) {\n      // verify constraints on a service domain\n      ensureHandleServiceConstraints(\n        normalized,\n        this.serviceHandleDomains,\n        allowAnyValid,\n      )\n    } else {\n      // When creating an account (no did yet), we require the handle to be a\n      // local service domain. Updating to a custom handle will be possible once\n      // the account was created.\n      if (did == null) {\n        throw new InvalidRequestError(\n          'Not a supported handle domain',\n          'UnsupportedDomain',\n        )\n      }\n\n      // verify resolution of a non-service domain\n      const resolvedDid = await this.idResolver.handle.resolve(normalized)\n      if (resolvedDid !== did) {\n        // @TODO This should use a distinct error code\n        throw new InvalidRequestError('External handle did not resolve to DID')\n      }\n    }\n\n    return normalized\n  }\n\n  async createAccount({\n    did,\n    handle,\n    email,\n    password,\n    repoCid,\n    repoRev,\n    inviteCode,\n    deactivated,\n    refreshJwt,\n  }: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n    refreshJwt?: string\n  }) {\n    if (password && password.length > scrypt.NEW_PASSWORD_MAX_LENGTH) {\n      throw new InvalidRequestError('Password too long')\n    }\n\n    const passwordScrypt =\n      email && password ? await scrypt.genSaltAndHash(password) : undefined\n\n    const now = currentDatetimeString()\n    return this.db.transaction(async (dbTxn) => {\n      if (inviteCode) {\n        await invite.ensureInviteIsAvailable(dbTxn, inviteCode)\n      }\n\n      await accountHelpers.registerActor(dbTxn, { did, handle, deactivated })\n\n      if (email && passwordScrypt) {\n        await accountHelpers.registerAccount(dbTxn, {\n          did,\n          email,\n          passwordScrypt,\n        })\n      }\n\n      await invite.recordInviteUse(dbTxn, {\n        did,\n        inviteCode,\n        now,\n      })\n\n      if (refreshJwt) {\n        await auth.storeRefreshToken(\n          dbTxn,\n          auth.decodeRefreshToken(refreshJwt),\n          null,\n        )\n      }\n\n      await repo.updateRoot(dbTxn, did, repoCid, repoRev)\n    })\n  }\n\n  async createAccountAndSession(opts: {\n    did: DidString\n    handle: HandleString\n    email?: string\n    password?: string\n    repoCid: Cid\n    repoRev: string\n    inviteCode?: string\n    deactivated?: boolean\n  }) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: opts.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: AuthScope.Access,\n    })\n\n    await this.createAccount({ ...opts, refreshJwt })\n\n    return { accessJwt, refreshJwt }\n  }\n\n  /**\n   * Validates the requested handle, updates the PLC document if needed, persists\n   * the new handle locally, and emits an identity event.\n   *\n   * @throws {InvalidRequestError} when the handle is invalid, taken by another\n   * account, or cannot be resolved for non-service domains.\n   *\n   * @see {@link AccountManager.updateAccountHandle} for behavior when the PLC update fails.\n   */\n  async updateHandle(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<ActorAccount & { handle: HandleString }> {\n    const { account, handle } = await this.validateHandleUpdate(\n      did,\n      newHandle,\n      options,\n    )\n\n    if (did.startsWith('did:plc:')) {\n      // @TODO We should verify the status before issuing a PLC update.\n      await this.plcClient.updateHandle(did, this.plcRotationKey, handle)\n    } else {\n      const resolved = await this.idResolver.did.resolveAtprotoData(did, true)\n      if (resolved.handle !== handle) {\n        throw new InvalidRequestError(\n          'DID is not properly configured for handle',\n        )\n      }\n    }\n\n    // @NOTE If the next line fails (for any reason), we don't \"rollback\" the\n    // PLC update above. The caller can just call this method again.\n    await this.updateAccountHandle(did, handle)\n\n    return { ...account, handle }\n  }\n\n  async validateHandleUpdate(\n    did: DidString,\n    newHandle: string,\n    options?: { allowAnyValid?: boolean },\n  ): Promise<{\n    did: DidString\n    handle: HandleString\n    // Returned for convenience\n    account: ActorAccount\n  }> {\n    const account = await this.getAccount(did, { includeDeactivated: true })\n    if (!account) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const handle = await this.normalizeAndValidateHandle(newHandle, {\n      allowAnyValid: options?.allowAnyValid,\n      did,\n    })\n\n    // Pessimistic check to handle spam: also enforced by updateAccountHandle() and the db.\n    const existing = await this.getAccount(handle, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (existing && existing.did !== did) {\n      throw new InvalidRequestError(\n        `Handle already taken: ${handle}`,\n        'HandleNotAvailable',\n      )\n    }\n\n    return { did, handle, account }\n  }\n\n  /**\n   * @note Failure to emit the identity event will silently be ignored. Users\n   * can emit the event again by updating their handle to the same value.\n   */\n  async updateAccountHandle(\n    did: DidString,\n    handle: HandleString,\n  ): Promise<void> {\n    await accountHelpers.updateHandle(this.db, did, handle)\n\n    try {\n      await this.sequencer.sequenceIdentity(did, handle)\n    } catch (err) {\n      httpLogger.error({ err, did, handle }, 'failed to sequence handle update')\n    }\n  }\n\n  async deleteAccount(did: DidString) {\n    return accountHelpers.deleteAccount(this.db, did)\n  }\n\n  async takedownAccount(\n    did: DidString,\n    takedown: com.atproto.admin.defs.StatusAttr,\n  ) {\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateAccountTakedownStatus(dbTxn, did, takedown)\n      await auth.revokeRefreshTokensByDid(dbTxn, did)\n      await token.removeByDid(dbTxn, did)\n    })\n\n    await this.sequenceAccountStatus(did)\n  }\n\n  async getAccountAdminStatus(did: DidString) {\n    return accountHelpers.getAccountAdminStatus(this.db, did)\n  }\n\n  async updateRepoRoot(did: DidString, cid: Cid, rev: string) {\n    return repo.updateRoot(this.db, did, cid, rev)\n  }\n\n  async deactivateAccount(\n    did: DidString,\n    options?: {\n      deleteCredentials?: boolean\n      deleteAfter?: string | null\n    },\n  ) {\n    const wasUpdated = await this.db.transaction(async (dbTxn) => {\n      if (options?.deleteCredentials) {\n        await token.removeByDid(dbTxn, did)\n        await authorizedClientHelper.deleteAllAuthorizedClients(dbTxn, did)\n        await password.deleteAllAppPasswords(dbTxn, did)\n      }\n\n      return accountHelpers.deactivateAccount(\n        dbTxn,\n        did,\n        options?.deleteAfter ?? null,\n      )\n    })\n\n    if (!wasUpdated) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    // Account is likely soft-deleted (takendown)\n    if (accountStatus.status === AccountStatus.Deleted) {\n      throw new InvalidRequestError('Account not found')\n    }\n\n    await this.sequencer.sequenceAccount(did, accountStatus.status)\n\n    return accountStatus\n  }\n\n  async activateAccount(did: DidString) {\n    await assertValidDidDocumentForService(this, did)\n\n    const found = await accountHelpers.activateAccount(this.db, did, {\n      // We cannot activate a takendown account\n      includeTakenDown: false,\n      includeDeactivated: true,\n    })\n    if (!found) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const accountStatus = await this.getAccountStatus(did)\n\n    const { account, status } = accountStatus\n\n    if (status === AccountStatus.Deleted) {\n      // A concurrent operation deleted the account\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    const syncData = await this.actorStore.read(did, (store) => {\n      return store.repo.getSyncEventData()\n    })\n\n    await this.sequencer.sequenceAccountActivation(\n      did,\n      account.handle ?? INVALID_HANDLE,\n      status,\n      syncData,\n    )\n\n    return accountStatus\n  }\n\n  async sequenceAccountStatus(did: DidString) {\n    const { status } = await this.getAccountStatus(did)\n    await this.sequencer.sequenceAccount(did, status)\n  }\n\n  // Auth\n  // ----------\n\n  async createSession(\n    did: DidString,\n    appPassword: password.AppPassDescript | null,\n    isSoftDeleted = false,\n  ) {\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(appPassword, isSoftDeleted),\n    })\n    // For soft deleted accounts don't store refresh token so that it can't be rotated.\n    if (!isSoftDeleted) {\n      const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n      await auth.storeRefreshToken(this.db, refreshPayload, appPassword)\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async rotateRefreshToken(id: string) {\n    const token = await auth.getRefreshToken(this.db, id)\n    if (!token) return null\n\n    const now = new Date()\n\n    // take the chance to tidy all of a user's expired tokens\n    // does not need to be transactional since this is just best-effort\n    await auth.deleteExpiredRefreshTokens(this.db, token.did, now.toISOString())\n\n    // Shorten the refresh token lifespan down from its\n    // original expiration time to its revocation grace period.\n    const prevExpiresAt = new Date(token.expiresAt)\n    const REFRESH_GRACE_MS = 2 * HOUR\n    const graceExpiresAt = new Date(now.getTime() + REFRESH_GRACE_MS)\n\n    const expiresAt =\n      graceExpiresAt < prevExpiresAt ? graceExpiresAt : prevExpiresAt\n\n    if (expiresAt <= now) {\n      return null\n    }\n\n    // Determine the next refresh token id: upon refresh token\n    // reuse you always receive a refresh token with the same id.\n    const nextId = token.nextId ?? auth.getRefreshTokenId()\n\n    const { accessJwt, refreshJwt } = await auth.createTokens({\n      did: token.did,\n      jwtKey: this.jwtKey,\n      serviceDid: this.serviceDid,\n      scope: auth.formatScope(token.appPassword),\n      jti: nextId,\n    })\n\n    const refreshPayload = auth.decodeRefreshToken(refreshJwt)\n    try {\n      await this.db.transaction((dbTxn) =>\n        Promise.all([\n          auth.addRefreshGracePeriod(dbTxn, {\n            id,\n            expiresAt: expiresAt.toISOString(),\n            nextId,\n          }),\n          auth.storeRefreshToken(dbTxn, refreshPayload, token.appPassword),\n        ]),\n      )\n    } catch (err) {\n      if (err instanceof auth.ConcurrentRefreshError) {\n        return this.rotateRefreshToken(id)\n      }\n      throw err\n    }\n    return { accessJwt, refreshJwt }\n  }\n\n  async revokeRefreshToken(id: string) {\n    return auth.revokeRefreshToken(this.db, id)\n  }\n\n  // Login\n  // ----------\n\n  async login({\n    identifier,\n    password,\n    authFactorToken,\n    locale,\n  }: {\n    identifier: string\n    password: string\n    authFactorToken?: string | undefined\n    // Only the OAuth sign-in path carries one; `com.atproto.server.createSession`\n    // declares no locale input, so the challenge email falls back to the\n    // default template there.\n    locale?: string | undefined\n  }): Promise<{\n    // @TODO we should rename this \"account\" for consistency\n    user: ActorAccount\n    appPassword: password.AppPassDescript | null\n    isSoftDeleted: boolean\n  }> {\n    const start = Date.now()\n    try {\n      const identifierNormalized = identifier.toLowerCase()\n\n      const user = identifierNormalized.includes('@')\n        ? await this.getAccountByEmail(identifierNormalized, {\n            includeDeactivated: true,\n            includeTakenDown: true,\n          })\n        : isAtIdentifierString(identifierNormalized)\n          ? await this.getAccount(identifierNormalized, {\n              includeDeactivated: true,\n              includeTakenDown: true,\n            })\n          : null\n\n      if (!user) {\n        throw new AuthRequiredError('Invalid identifier or password')\n      }\n      const isSoftDeleted = softDeleted(user)\n\n      let appPassword: password.AppPassDescript | null = null\n      const validAccountPass = await this.verifyAccountPassword(\n        user.did,\n        password,\n      )\n      if (!validAccountPass) {\n        // takendown/suspended accounts cannot login with app password\n        if (isSoftDeleted) {\n          throw new InvalidPasswordError(user.did)\n        }\n        appPassword = await this.verifyAppPassword(user.did, password)\n        if (appPassword === null) {\n          throw new InvalidPasswordError(user.did)\n        }\n      }\n\n      if (authFactorToken) {\n        await this.assertValidEmailTokenAndCleanup(\n          user.did,\n          'auth_factor',\n          authFactorToken,\n        )\n        // require email factor when not using an app password\n      } else if (\n        user.email !== null &&\n        user.emailAuthFactorAt !== null &&\n        appPassword === null\n      ) {\n        const token = await this.createEmailToken(user.did, 'auth_factor')\n\n        await this.mailer.sendSignInAuthFactor(\n          { token, handle: user.handle, locale },\n          { to: user.email },\n        )\n\n        throw new AuthFactorRequiredError(\n          'emailOtp',\n          obfuscateEmail(user.email),\n        )\n      }\n\n      return { user, appPassword, isSoftDeleted }\n    } finally {\n      // Mitigate timing attacks\n      await wait(350 - (Date.now() - start))\n    }\n  }\n\n  // Passwords\n  // ----------\n\n  async createAppPassword(did: DidString, name: string, privileged: boolean) {\n    return password.createAppPassword(this.db, did, name, privileged)\n  }\n\n  async listAppPasswords(did: DidString) {\n    return password.listAppPasswords(this.db, did)\n  }\n\n  async verifyAccountPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<boolean> {\n    if (passwordStr.length > scrypt.OLD_PASSWORD_MAX_LENGTH) {\n      // @NOTE Avoid throwing from here to avoid leaking account email validity\n      // through error messages.\n      return false\n    }\n\n    return password.verifyAccountPassword(this.db, did, passwordStr)\n  }\n\n  async verifyAppPassword(\n    did: DidString,\n    passwordStr: string,\n  ): Promise<password.AppPassDescript | null> {\n    return password.verifyAppPassword(this.db, did, passwordStr)\n  }\n\n  async revokeAppPassword(did: DidString, name: string) {\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.deleteAppPassword(dbTxn, did, name),\n        auth.revokeAppPasswordRefreshToken(dbTxn, did, name),\n      ]),\n    )\n  }\n\n  // Invites\n  // ----------\n\n  async ensureInviteIsAvailable(code: string) {\n    return invite.ensureInviteIsAvailable(this.db, code)\n  }\n\n  async createInviteCodes(\n    toCreate: { account: string; codes: string[] }[],\n    useCount: number,\n  ) {\n    return invite.createInviteCodes(this.db, toCreate, useCount)\n  }\n\n  async createAccountInviteCodes(\n    forAccount: string,\n    codes: string[],\n    expectedTotal: number,\n    disabled: 0 | 1,\n  ) {\n    return invite.createAccountInviteCodes(\n      this.db,\n      forAccount,\n      codes,\n      expectedTotal,\n      disabled,\n    )\n  }\n\n  async getAccountInvitesCodes(did: DidString) {\n    const inviteCodes = await invite.getAccountsInviteCodes(this.db, [did])\n    return inviteCodes.get(did) ?? []\n  }\n\n  async getAccountsInvitesCodes(dids: DidString[]) {\n    return invite.getAccountsInviteCodes(this.db, dids)\n  }\n\n  async getInvitedByForAccounts(dids: DidString[]) {\n    return invite.getInvitedByForAccounts(this.db, dids)\n  }\n\n  async getInviteCodesUses(codes: string[]) {\n    return invite.getInviteCodesUses(this.db, codes)\n  }\n\n  async setAccountInvitesDisabled(did: DidString, disabled: boolean) {\n    return invite.setAccountInvitesDisabled(this.db, did, disabled)\n  }\n\n  async disableInviteCodes(opts: { codes: string[]; accounts: string[] }) {\n    return invite.disableInviteCodes(this.db, opts)\n  }\n\n  // Email Tokens\n  // ----------\n\n  async createEmailToken(did: DidString, purpose: EmailTokenPurpose) {\n    return emailToken.createEmailToken(this.db, did, purpose)\n  }\n\n  async assertValidEmailToken(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    return emailToken.assertValidToken(this.db, did, purpose, token)\n  }\n\n  async assertValidEmailTokenAndCleanup(\n    did: DidString,\n    purpose: EmailTokenPurpose,\n    token: string,\n  ) {\n    await emailToken.assertValidToken(this.db, did, purpose, token)\n    await emailToken.deleteEmailToken(this.db, did, purpose)\n  }\n\n  async requestEmailConfirmation(did: DidString, opts?: { locale?: string }) {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const locale = opts?.locale\n    const token = await this.createEmailToken(did, 'confirm_email')\n\n    await this.mailer.sendConfirmEmail({ token, locale }, { to: account.email })\n  }\n\n  async confirmEmail(did: DidString, email: string, token: string) {\n    const user = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!user) {\n      throw new InvalidRequestError('user not found', 'AccountNotFound')\n    }\n\n    if (user.email !== email.toLowerCase()) {\n      throw new InvalidRequestError('invalid email', 'InvalidEmail')\n    }\n\n    await emailToken.assertValidToken(this.db, did, 'confirm_email', token)\n    const now = currentDatetimeString()\n    await this.db.transaction(async (dbTxn) => {\n      await emailToken.deleteEmailToken(dbTxn, did, 'confirm_email')\n      await accountHelpers.setEmailConfirmedAt(dbTxn, did, now)\n    })\n\n    user.emailConfirmedAt = now\n\n    return user\n  }\n\n  async requestEmailUpdate(\n    did: DidString,\n    opts?: { locale?: string },\n  ): Promise<{ tokenRequired: boolean }> {\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    if (!account.email) {\n      throw new InvalidRequestError('account does not have an email address')\n    }\n\n    const token = account.emailConfirmedAt\n      ? await this.createEmailToken(did, 'update_email')\n      : null\n\n    if (token) {\n      await this.mailer.sendUpdateEmail(\n        { token, locale: opts?.locale },\n        { to: account.email },\n      )\n    }\n\n    return { tokenRequired: !!token }\n  }\n\n  async checkUpdateEmail(\n    did: DidString,\n    email: string,\n    token?: string,\n  ): Promise<ActorAccount> {\n    if (!isEmailValid(email) || isDisposableEmail(email)) {\n      throw new InvalidRequestError(\n        'This email address is not supported, please use a different email.',\n      )\n    }\n\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError(\n        `Could not find user info for account: ${did}`,\n      )\n    }\n\n    const tokenRequired = !!account.emailConfirmedAt\n\n    if (token) {\n      await this.assertValidEmailToken(did, 'update_email', token)\n    } else if (tokenRequired) {\n      // require a token if account email is confirmed\n      throw new InvalidRequestError(\n        'confirmation token required',\n        'TokenRequired',\n      )\n    }\n\n    return account\n  }\n\n  /**\n   * @throws UserAlreadyExistsError if the new email is already in use by another account\n   */\n  async updateEmail(\n    did: DidString,\n    email: string,\n    token?: string,\n    opts?: UpdateAccountEmailOptions,\n  ): Promise<ActorAccount> {\n    const account = await this.checkUpdateEmail(did, email, token)\n\n    await this.updateAccountEmail(did, email, opts)\n\n    account.email = email\n    account.emailConfirmedAt = null\n\n    return account\n  }\n\n  async updateAccountEmail(\n    did: DidString,\n    email: string,\n    opts?: UpdateAccountEmailOptions,\n  ) {\n    await this.db.transaction(async (dbTxn) => {\n      await accountHelpers.updateEmail(dbTxn, did, email)\n      // @NOTE In the same transaction as the email write, deliberately: the\n      // new address is unconfirmed, and 2FA against an unconfirmed address can\n      // lock the user out. The account-manager UI warns about this, see\n      // `show2FaWarningOnEmailUpdate` in context.ts.\n      await emailAuthFactor.deleteForDid(dbTxn, did)\n      await emailToken.deleteAllEmailTokens(dbTxn, did)\n    })\n\n    // Proactively send a confirmation email so that the user can confirm the\n    // new email immediately.\n    if (opts?.sendConfirmationEmail) {\n      const token = await this.createEmailToken(did, 'confirm_email')\n      const { locale } = opts\n      await this.mailer.sendConfirmEmail({ token, locale }, { to: email })\n    }\n  }\n\n  /**\n   * Enable email-based two-factor authentication. Enabling is immediate: the\n   * account must already have a confirmed email matching `email`, since the\n   * factor delivers one-time codes to that address. Returns\n   * `{ account, tokenRequired }` for symmetry with future factors that require\n   * a confirmation step; email-based 2FA never does, so `tokenRequired` is\n   * always `false`.\n   *\n   * @throws InvalidRequestError if the account has no confirmed, matching email\n   */\n  async enableEmailAuthFactor(opts: { did: DidString }): Promise<ActorAccount> {\n    const { did } = opts\n\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    // Already enabled → nothing to change (idempotent).\n    if (account.emailAuthFactorAt) {\n      return account\n    }\n\n    // Email confirmed → attempt to enable email-based 2FA.\n    if (account.email && account.emailConfirmedAt) {\n      const emailAuthFactorAt = await emailAuthFactor.enable(\n        this.db,\n        did,\n        account.email,\n      )\n\n      // @NOTE The confirmed-email requirement is enforced in the insert's own\n      // SELECT, so a miss here means the address stopped being confirmed (or\n      // changed) between that read and this write. Nothing was persisted, so\n      // don't hand back an account claiming otherwise.\n      if (emailAuthFactorAt) {\n        account.emailAuthFactorAt = emailAuthFactorAt\n\n        return account\n      }\n    }\n\n    throw new InvalidRequestError(\n      'A confirmed email address is required to enable email-based two-factor authentication',\n    )\n  }\n\n  /**\n   * Disable email-based two-factor authentication. This supports a two-phase\n   * flow, if a token isn't initially supplied for proving control of the inbox\n   * which prevents a hijacked session from silently turning off the factor. The\n   * second call (with a valid `token`) actually disables it. Disabling an\n   * already-disabled factor is an idempotent no-op.\n   *\n   * @throws InvalidRequestError if the account has no matching email, or the\n   * token is invalid\n   * @throws InvalidRequestError with `TokenRequired` error code if a\n   * confirmation token is required but not provided\n   */\n  async disableEmailAuthFactor(opts: {\n    did: DidString\n    token?: string\n    locale?: string\n  }): Promise<ActorAccount> {\n    const { did, token, locale } = opts\n\n    const account = await this.getAccount(did, {\n      includeDeactivated: true,\n      includeTakenDown: true,\n    })\n\n    if (!account) {\n      throw new InvalidRequestError('account not found')\n    }\n\n    // Already disabled → idempotent no-op; nothing to confirm, no OTP sent.\n    if (!account.emailAuthFactorAt) {\n      return account\n    }\n\n    // Fool-proof: account in invalid state\n    if (!account.email) {\n      throw new Error('account has no email address')\n    }\n\n    // Phase one: no token yet, send a one-time code and signal \"pending\". MUST\n    // use `update_email` due to social-app using requestEmailUpdate, not\n    // two-step updateEmail:\n    if (!token) {\n      const otp = await this.createEmailToken(did, 'update_email')\n      await this.mailer.sendUpdateEmail(\n        { token: otp, locale: locale },\n        { to: account.email },\n      )\n\n      throw new InvalidRequestError(\n        'confirmation token required',\n        'TokenRequired',\n      )\n    }\n\n    // Phase two: verify the one-time code, then disable the factor.\n    await this.assertValidEmailTokenAndCleanup(did, 'update_email', token)\n\n    // The returned flag is deliberately ignored here, unlike in\n    // `enableEmailAuthFactor`. Disabling only conditions the write on `did` and\n    // `email` matching, so a miss means no row matched either, leaving nothing\n    // worth reporting. A deleted account has no factor left to disable, and a\n    // changed email drops the factor row in the same transaction (see\n    // `updateAccountEmail`). That second case stops arising once unconfirmed\n    // emails get a column of their own, since `account.email` will no longer\n    // move mid-flow; the conclusion holds either way.\n    //\n    // Enabling is the opposite: a miss there leaves the account in the very\n    // state the caller asked to change, hence the throw.\n    await emailAuthFactor.disable(this.db, did, account.email)\n\n    account.emailAuthFactorAt = null\n\n    return account\n  }\n\n  async resetPassword(opts: { password: string; token: string }) {\n    const did = await emailToken.assertValidTokenAndFindDid(\n      this.db,\n      'reset_password',\n      opts.token,\n    )\n    await this.updateAccountPassword({ did, password: opts.password })\n\n    return did\n  }\n\n  async updateAccountPassword(opts: { did: DidString; password: string }) {\n    const { did } = opts\n    const passwordScrypt = await scrypt.genSaltAndHash(opts.password)\n    await this.db.transaction(async (dbTxn) =>\n      Promise.all([\n        password.updateUserPassword(dbTxn, { did, passwordScrypt }),\n        emailToken.deleteEmailToken(dbTxn, did, 'reset_password'),\n        auth.revokeRefreshTokensByDid(dbTxn, did),\n      ]),\n    )\n  }\n}\n"]}

package/dist/account-manager/db/migrations/008-account-email-auth-factor.d.ts

@@ -0,0 +1,9 @@
+import type { Kysely } from 'kysely';
+/**
+ * A dedicated table rather than a column on `account`: further authentication
+ * factors can then be added without altering `account` again, which sqlite
+ * makes tedious. A row exists only while the factor is enabled.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=008-account-email-auth-factor.d.ts.map

package/dist/account-manager/db/migrations/008-account-email-auth-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"008-account-email-auth-factor.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/008-account-email-auth-factor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEpC;;;;GAIG;AACH,wBAAsB,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3D;AAED,wBAAsB,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7D"}

package/dist/account-manager/db/migrations/008-account-email-auth-factor.js

@@ -0,0 +1,16 @@
+/**
+ * A dedicated table rather than a column on `account`: further authentication
+ * factors can then be added without altering `account` again, which sqlite
+ * makes tedious. A row exists only while the factor is enabled.
+ */
+export async function up(db) {
+    await db.schema
+        .createTable('account_email_auth_factor')
+        .addColumn('did', 'varchar', (col) => col.primaryKey())
+        .addColumn('emailAuthFactorEnabledAt', 'varchar', (col) => col.notNull())
+        .execute();
+}
+export async function down(db) {
+    await db.schema.dropTable('account_email_auth_factor').execute();
+}
+//# sourceMappingURL=008-account-email-auth-factor.js.map

package/dist/account-manager/db/migrations/008-account-email-auth-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"008-account-email-auth-factor.js","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/008-account-email-auth-factor.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,EAAmB;IAC1C,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,2BAA2B,CAAC;SACxC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;SACtD,SAAS,CAAC,0BAA0B,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxE,OAAO,EAAE,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAmB;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC,OAAO,EAAE,CAAA;AAClE,CAAC","sourcesContent":["import type { Kysely } from 'kysely'\n\n/**\n * A dedicated table rather than a column on `account`: further authentication\n * factors can then be added without altering `account` again, which sqlite\n * makes tedious. A row exists only while the factor is enabled.\n */\nexport async function up(db: Kysely<unknown>): Promise<void> {\n  await db.schema\n    .createTable('account_email_auth_factor')\n    .addColumn('did', 'varchar', (col) => col.primaryKey())\n    .addColumn('emailAuthFactorEnabledAt', 'varchar', (col) => col.notNull())\n    .execute()\n}\n\nexport async function down(db: Kysely<unknown>): Promise<void> {\n  await db.schema.dropTable('account_email_auth_factor').execute()\n}\n"]}

package/dist/account-manager/db/migrations/index.d.ts

@@ -5,6 +5,7 @@ import * as mig004 from './004-oauth.js';
 import * as mig005 from './005-oauth-account-management.js';
 import * as mig006 from './006-oauth-permission-sets.js';
 import * as mig007 from './007-lexicon-failures-index.js';
+import * as mig008 from './008-account-email-auth-factor.js';
 declare const _default: {
     '001': typeof mig001;
     '002': typeof mig002;
@@ -13,6 +14,7 @@ declare const _default: {
     '005': typeof mig005;
     '006': typeof mig006;
     '007': typeof mig007;
+    '008': typeof mig008;
 };
 export default _default;
 //# sourceMappingURL=index.d.ts.map

package/dist/account-manager/db/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gCAAgC,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAA;;IAGvD,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gCAAgC,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAA;AACzD,OAAO,KAAK,MAAM,MAAM,oCAAoC,CAAA;;IAG1D,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK"}

package/dist/account-manager/db/migrations/index.js

@@ -5,6 +5,7 @@ import * as mig004 from './004-oauth.js';
 import * as mig005 from './005-oauth-account-management.js';
 import * as mig006 from './006-oauth-permission-sets.js';
 import * as mig007 from './007-lexicon-failures-index.js';
+import * as mig008 from './008-account-email-auth-factor.js';
 export default {
     '001': mig001,
     '002': mig002,
@@ -13,5 +14,6 @@ export default {
     '005': mig005,
     '006': mig006,
     '007': mig007,
+    '008': mig008,
 };
 //# sourceMappingURL=index.js.map

package/dist/account-manager/db/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gCAAgC,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAA;AAEzD,eAAe;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;CACd,CAAA","sourcesContent":["import * as mig001 from './001-init.js'\nimport * as mig002 from './002-account-deactivation.js'\nimport * as mig003 from './003-privileged-app-passwords.js'\nimport * as mig004 from './004-oauth.js'\nimport * as mig005 from './005-oauth-account-management.js'\nimport * as mig006 from './006-oauth-permission-sets.js'\nimport * as mig007 from './007-lexicon-failures-index.js'\n\nexport default {\n  '001': mig001,\n  '002': mig002,\n  '003': mig003,\n  '004': mig004,\n  '005': mig005,\n  '006': mig006,\n  '007': mig007,\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,+BAA+B,CAAA;AACvD,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,mCAAmC,CAAA;AAC3D,OAAO,KAAK,MAAM,MAAM,gCAAgC,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAA;AACzD,OAAO,KAAK,MAAM,MAAM,oCAAoC,CAAA;AAE5D,eAAe;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;CACd,CAAA","sourcesContent":["import * as mig001 from './001-init.js'\nimport * as mig002 from './002-account-deactivation.js'\nimport * as mig003 from './003-privileged-app-passwords.js'\nimport * as mig004 from './004-oauth.js'\nimport * as mig005 from './005-oauth-account-management.js'\nimport * as mig006 from './006-oauth-permission-sets.js'\nimport * as mig007 from './007-lexicon-failures-index.js'\nimport * as mig008 from './008-account-email-auth-factor.js'\n\nexport default {\n  '001': mig001,\n  '002': mig002,\n  '003': mig003,\n  '004': mig004,\n  '005': mig005,\n  '006': mig006,\n  '007': mig007,\n  '008': mig008,\n}\n"]}

package/dist/account-manager/db/schema/account-email-auth-factor.d.ts

@@ -0,0 +1,20 @@
+import type { Selectable } from 'kysely';
+import type { DatetimeString } from '@atproto/lex';
+/**
+ * Email-based two-factor authentication, kept out of `account` so that adding
+ * further factors later does not mean altering that table again.
+ *
+ * A row exists only while the factor is enabled — there is no "disabled" row —
+ * so `selectAccountQB` reaches it with a LEFT join and surfaces a null when the
+ * factor is off.
+ */
+export interface AccountEmailAuthFactor {
+    did: string;
+    emailAuthFactorEnabledAt: DatetimeString;
+}
+export type AccountEmailAuthFactorEntry = Selectable<AccountEmailAuthFactor>;
+export declare const tableName = "account_email_auth_factor";
+export type PartialDB = {
+    [tableName]: AccountEmailAuthFactor;
+};
+//# sourceMappingURL=account-email-auth-factor.d.ts.map

package/dist/account-manager/db/schema/account-email-auth-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-email-auth-factor.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/account-email-auth-factor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,cAAc,CAAA;CACzC;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAA;AAE5E,eAAO,MAAM,SAAS,8BAA8B,CAAA;AAEpD,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA"}

package/dist/account-manager/db/schema/account-email-auth-factor.js

@@ -0,0 +1,2 @@
+export const tableName = 'account_email_auth_factor';
+//# sourceMappingURL=account-email-auth-factor.js.map

package/dist/account-manager/db/schema/account-email-auth-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-email-auth-factor.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/account-email-auth-factor.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,SAAS,GAAG,2BAA2B,CAAA","sourcesContent":["import type { Selectable } from 'kysely'\nimport type { DatetimeString } from '@atproto/lex'\n\n/**\n * Email-based two-factor authentication, kept out of `account` so that adding\n * further factors later does not mean altering that table again.\n *\n * A row exists only while the factor is enabled — there is no \"disabled\" row —\n * so `selectAccountQB` reaches it with a LEFT join and surfaces a null when the\n * factor is off.\n */\nexport interface AccountEmailAuthFactor {\n  did: string\n  emailAuthFactorEnabledAt: DatetimeString\n}\n\nexport type AccountEmailAuthFactorEntry = Selectable<AccountEmailAuthFactor>\n\nexport const tableName = 'account_email_auth_factor'\n\nexport type PartialDB = { [tableName]: AccountEmailAuthFactor }\n"]}

package/dist/account-manager/db/schema/email-token.d.ts

@@ -1,5 +1,5 @@
 import type { DidString } from '@atproto/syntax';
-export type EmailTokenPurpose = 'confirm_email' | 'update_email' | 'reset_password' | 'delete_account' | 'plc_operation';
+export type EmailTokenPurpose = 'confirm_email' | 'update_email' | 'reset_password' | 'delete_account' | 'plc_operation' | 'auth_factor';
 export interface EmailToken {
     purpose: EmailTokenPurpose;
     did: DidString;

package/dist/account-manager/db/schema/email-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-token.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/email-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,CAAA;AAEnB,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,GAAG,EAAE,SAAS,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,SAAS,gBAAgB,CAAA;AAEtC,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAA;CAAE,CAAA"}
+{"version":3,"file":"email-token.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/email-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,eAAe,GACf,aAAa,CAAA;AAEjB,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,GAAG,EAAE,SAAS,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,eAAO,MAAM,SAAS,gBAAgB,CAAA;AAEtC,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,UAAU,CAAA;CAAE,CAAA"}

package/dist/account-manager/db/schema/email-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-token.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/email-token.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAA","sourcesContent":["import type { DidString } from '@atproto/syntax'\n\nexport type EmailTokenPurpose =\n  | 'confirm_email'\n  | 'update_email'\n  | 'reset_password'\n  | 'delete_account'\n  | 'plc_operation'\n\nexport interface EmailToken {\n  purpose: EmailTokenPurpose\n  did: DidString\n  token: string\n  requestedAt: string\n}\n\nexport const tableName = 'email_token'\n\nexport type PartialDB = { [tableName]: EmailToken }\n"]}
+{"version":3,"file":"email-token.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/email-token.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAA","sourcesContent":["import type { DidString } from '@atproto/syntax'\n\nexport type EmailTokenPurpose =\n  | 'confirm_email'\n  | 'update_email'\n  | 'reset_password'\n  | 'delete_account'\n  | 'plc_operation'\n  | 'auth_factor'\n\nexport interface EmailToken {\n  purpose: EmailTokenPurpose\n  did: DidString\n  token: string\n  requestedAt: string\n}\n\nexport const tableName = 'email_token'\n\nexport type PartialDB = { [tableName]: EmailToken }\n"]}

package/dist/account-manager/db/schema/index.d.ts

@@ -1,4 +1,5 @@
 import type * as accountDevice from './account-device.js';
+import type * as accountEmailAuthFactor from './account-email-auth-factor.js';
 import type * as account from './account.js';
 import type * as actor from './actor.js';
 import type * as appPassword from './app-password.js';
@@ -12,7 +13,7 @@ import type * as refreshToken from './refresh-token.js';
 import type * as repoRoot from './repo-root.js';
 import type * as token from './token.js';
 import type * as usedRefreshToken from './used-refresh-token.js';
-export type DatabaseSchema = actor.PartialDB & account.PartialDB & accountDevice.PartialDB & authorizedClient.PartialDB & device.PartialDB & oauthRequest.PartialDB & token.PartialDB & usedRefreshToken.PartialDB & refreshToken.PartialDB & appPassword.PartialDB & repoRoot.PartialDB & inviteCode.PartialDB & lexicon.PartialDB & emailToken.PartialDB;
+export type DatabaseSchema = actor.PartialDB & account.PartialDB & accountDevice.PartialDB & accountEmailAuthFactor.PartialDB & authorizedClient.PartialDB & device.PartialDB & oauthRequest.PartialDB & token.PartialDB & usedRefreshToken.PartialDB & refreshToken.PartialDB & appPassword.PartialDB & repoRoot.PartialDB & inviteCode.PartialDB & lexicon.PartialDB & emailToken.PartialDB;
 export type { Actor, ActorEntry } from './actor.js';
 export type { Account, AccountEntry } from './account.js';
 export type { AccountDevice } from './account-device.js';

package/dist/account-manager/db/schema/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,KAAK,gBAAgB,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,KAAK,UAAU,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,KAAK,UAAU,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,KAAK,gBAAgB,MAAM,yBAAyB,CAAA;AAEhE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,GAC1C,OAAO,CAAC,SAAS,GACjB,aAAa,CAAC,SAAS,GACvB,gBAAgB,CAAC,SAAS,GAC1B,MAAM,CAAC,SAAS,GAChB,YAAY,CAAC,SAAS,GACtB,KAAK,CAAC,SAAS,GACf,gBAAgB,CAAC,SAAS,GAC1B,YAAY,CAAC,SAAS,GACtB,WAAW,CAAC,SAAS,GACrB,QAAQ,CAAC,SAAS,GAClB,UAAU,CAAC,SAAS,GACpB,OAAO,CAAC,SAAS,GACjB,UAAU,CAAC,SAAS,CAAA;AAEtB,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACnD,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACzD,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,KAAK,sBAAsB,MAAM,gCAAgC,CAAA;AAC7E,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,KAAK,WAAW,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,KAAK,gBAAgB,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,KAAK,UAAU,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,KAAK,UAAU,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,KAAK,YAAY,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,KAAK,gBAAgB,MAAM,yBAAyB,CAAA;AAEhE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,GAC1C,OAAO,CAAC,SAAS,GACjB,aAAa,CAAC,SAAS,GACvB,sBAAsB,CAAC,SAAS,GAChC,gBAAgB,CAAC,SAAS,GAC1B,MAAM,CAAC,SAAS,GAChB,YAAY,CAAC,SAAS,GACtB,KAAK,CAAC,SAAS,GACf,gBAAgB,CAAC,SAAS,GAC1B,YAAY,CAAC,SAAS,GACtB,WAAW,CAAC,SAAS,GACrB,QAAQ,CAAC,SAAS,GAClB,UAAU,CAAC,SAAS,GACpB,OAAO,CAAC,SAAS,GACjB,UAAU,CAAC,SAAS,CAAA;AAEtB,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACnD,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACzD,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/account-manager/db/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/index.ts"],"names":[],"mappings":"","sourcesContent":["import type * as accountDevice from './account-device.js'\nimport type * as account from './account.js'\nimport type * as actor from './actor.js'\nimport type * as appPassword from './app-password.js'\nimport type * as oauthRequest from './authorization-request.js'\nimport type * as authorizedClient from './authorized-client.js'\nimport type * as device from './device.js'\nimport type * as emailToken from './email-token.js'\nimport type * as inviteCode from './invite-code.js'\nimport type * as lexicon from './lexicon.js'\nimport type * as refreshToken from './refresh-token.js'\nimport type * as repoRoot from './repo-root.js'\nimport type * as token from './token.js'\nimport type * as usedRefreshToken from './used-refresh-token.js'\n\nexport type DatabaseSchema = actor.PartialDB &\n  account.PartialDB &\n  accountDevice.PartialDB &\n  authorizedClient.PartialDB &\n  device.PartialDB &\n  oauthRequest.PartialDB &\n  token.PartialDB &\n  usedRefreshToken.PartialDB &\n  refreshToken.PartialDB &\n  appPassword.PartialDB &\n  repoRoot.PartialDB &\n  inviteCode.PartialDB &\n  lexicon.PartialDB &\n  emailToken.PartialDB\n\nexport type { Actor, ActorEntry } from './actor.js'\nexport type { Account, AccountEntry } from './account.js'\nexport type { AccountDevice } from './account-device.js'\nexport type { Device } from './device.js'\nexport type { AuthorizationRequest } from './authorization-request.js'\nexport type { Token } from './token.js'\nexport type { Lexicon } from './lexicon.js'\nexport type { UsedRefreshToken } from './used-refresh-token.js'\nexport type { RepoRoot } from './repo-root.js'\nexport type { RefreshToken } from './refresh-token.js'\nexport type { AppPassword } from './app-password.js'\nexport type { InviteCode, InviteCodeUse } from './invite-code.js'\nexport type { EmailToken, EmailTokenPurpose } from './email-token.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/index.ts"],"names":[],"mappings":"","sourcesContent":["import type * as accountDevice from './account-device.js'\nimport type * as accountEmailAuthFactor from './account-email-auth-factor.js'\nimport type * as account from './account.js'\nimport type * as actor from './actor.js'\nimport type * as appPassword from './app-password.js'\nimport type * as oauthRequest from './authorization-request.js'\nimport type * as authorizedClient from './authorized-client.js'\nimport type * as device from './device.js'\nimport type * as emailToken from './email-token.js'\nimport type * as inviteCode from './invite-code.js'\nimport type * as lexicon from './lexicon.js'\nimport type * as refreshToken from './refresh-token.js'\nimport type * as repoRoot from './repo-root.js'\nimport type * as token from './token.js'\nimport type * as usedRefreshToken from './used-refresh-token.js'\n\nexport type DatabaseSchema = actor.PartialDB &\n  account.PartialDB &\n  accountDevice.PartialDB &\n  accountEmailAuthFactor.PartialDB &\n  authorizedClient.PartialDB &\n  device.PartialDB &\n  oauthRequest.PartialDB &\n  token.PartialDB &\n  usedRefreshToken.PartialDB &\n  refreshToken.PartialDB &\n  appPassword.PartialDB &\n  repoRoot.PartialDB &\n  inviteCode.PartialDB &\n  lexicon.PartialDB &\n  emailToken.PartialDB\n\nexport type { Actor, ActorEntry } from './actor.js'\nexport type { Account, AccountEntry } from './account.js'\nexport type { AccountDevice } from './account-device.js'\nexport type { Device } from './device.js'\nexport type { AuthorizationRequest } from './authorization-request.js'\nexport type { Token } from './token.js'\nexport type { Lexicon } from './lexicon.js'\nexport type { UsedRefreshToken } from './used-refresh-token.js'\nexport type { RepoRoot } from './repo-root.js'\nexport type { RefreshToken } from './refresh-token.js'\nexport type { AppPassword } from './app-password.js'\nexport type { InviteCode, InviteCodeUse } from './invite-code.js'\nexport type { EmailToken, EmailTokenPurpose } from './email-token.js'\n"]}

package/dist/account-manager/helpers/account-device.d.ts

@@ -7,6 +7,7 @@ export declare function selectQB(db: AccountDb, filter: {
 }): import("kysely").SelectQueryBuilder<{
     account: import("kysely").Nullable<import("../db/index.js").Account>;
     account_device: import("../db/index.js").AccountDevice;
+    account_email_auth_factor: import("kysely").Nullable<import("../db/schema/account-email-auth-factor.js").AccountEmailAuthFactor>;
     actor: import("../db/index.js").Actor;
     app_password: import("../db/index.js").AppPassword;
     authorization_request: import("../db/index.js").AuthorizationRequest;
@@ -20,12 +21,13 @@ export declare function selectQB(db: AccountDb, filter: {
     repo_root: import("../db/index.js").RepoRoot;
     token: import("../db/index.js").Token;
     used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor" | "device", Partial<Omit<unknown, never>> & {
+}, "account" | "account_device" | "account_email_auth_factor" | "actor" | "device", Partial<Omit<unknown, never>> & {
     createdAt: string;
     deactivatedAt: string | null;
     deleteAfter: string | null;
     did: `did:${string}:${string}`;
     email: string | null;
+    emailAuthFactorAt: import("@atproto/syntax").DatetimeString | null;
     emailConfirmedAt: import("@atproto/syntax").DatetimeString | null;
     handle: `${string}.${string}` | null;
     invitesDisabled: 0 | 1 | null;
@@ -39,6 +41,6 @@ export declare function selectQB(db: AccountDb, filter: {
     lastSeenAt: `${string}T${string}Z`;
     sessionId: `ses-${string}`;
     userAgent: string | null;
-} & Partial<Omit<unknown, "adCreatedAt" | "adUpdatedAt" | "createdAt" | "deactivatedAt" | "deleteAfter" | "deviceId" | "did" | "email" | "emailConfirmedAt" | "handle" | "invitesDisabled" | "ipAddress" | "lastSeenAt" | "sessionId" | "takedownRef" | "userAgent">>>;
+} & Partial<Omit<unknown, "adCreatedAt" | "adUpdatedAt" | "createdAt" | "deactivatedAt" | "deleteAfter" | "deviceId" | "did" | "email" | "emailAuthFactorAt" | "emailConfirmedAt" | "handle" | "invitesDisabled" | "ipAddress" | "lastSeenAt" | "sessionId" | "takedownRef" | "userAgent">>>;
 export declare function removeQB(db: AccountDb, deviceId: DeviceId, did: string): import("kysely").DeleteQueryBuilder<import("../db/index.js").DatabaseSchema, "account_device", import("kysely").DeleteResult>;
 //# sourceMappingURL=account-device.d.ts.map

package/dist/account-manager/helpers/account-device.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-device.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account-device.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAiBtE;AAED,wBAAgB,QAAQ,CACtB,EAAE,EAAE,SAAS,EACb,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uQA4B3C;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAKtE"}
+{"version":3,"file":"account-device.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account-device.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAiBtE;AAED,wBAAgB,QAAQ,CACtB,EAAE,EAAE,SAAS,EACb,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6RA4B3C;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAKtE"}

package/dist/account-manager/helpers/account.d.ts

@@ -8,6 +8,7 @@ export declare class UserAlreadyExistsError extends Error {
 export type ActorAccount = ActorEntry & {
     email: string | null;
     emailConfirmedAt: string | null;
+    emailAuthFactorAt: string | null;
     invitesDisabled: 0 | 1 | null;
 };
 export type AvailabilityFlags = {
@@ -24,6 +25,7 @@ export declare enum AccountStatus {
 export declare const selectAccountQB: (db: AccountDb, flags?: AvailabilityFlags) => import("kysely").SelectQueryBuilder<{
     account: import("kysely").Nullable<import("../db/index.js").Account>;
     account_device: import("../db/index.js").AccountDevice;
+    account_email_auth_factor: import("kysely").Nullable<import("../db/schema/account-email-auth-factor.js").AccountEmailAuthFactor>;
     actor: import("../db/index.js").Actor;
     app_password: import("../db/index.js").AppPassword;
     authorization_request: import("../db/index.js").AuthorizationRequest;
@@ -37,12 +39,13 @@ export declare const selectAccountQB: (db: AccountDb, flags?: AvailabilityFlags)
     repo_root: import("../db/index.js").RepoRoot;
     token: import("../db/index.js").Token;
     used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor", Partial<Omit<unknown, never>> & {
+}, "account" | "account_email_auth_factor" | "actor", Partial<Omit<unknown, never>> & {
     createdAt: string;
     deactivatedAt: string | null;
     deleteAfter: string | null;
     did: `did:${string}:${string}`;
     email: string | null;
+    emailAuthFactorAt: DatetimeString | null;
     emailConfirmedAt: DatetimeString | null;
     handle: `${string}.${string}` | null;
     invitesDisabled: 0 | 1 | null;

package/dist/account-manager/helpers/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EAGlB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,IAAI,SAA2B;IAC/B,YACE,OAAO,SAAwE,EAC/E,OAAO,CAAC,EAAE,YAAY,EAGvB;CACF;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,eAAe,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,eAAe,OAAQ,SAAS,UAAU,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBvE,CAAA;AAED,eAAO,MAAM,UAAU,OACjB,SAAS,eACA,kBAAkB,UACvB,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAW7B,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,QACP,SAAS,EAAE,UACT,iBAAiB,KACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAgBnC,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,SACN,MAAM,UACL,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAK7B,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,QACP;IACJ,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,kBAqBF,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,QACP;IACJ,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;CACvB,kBAiBF,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,OACR,SAAS,KACb,OAAO,CAAC,IAAI,CAkBd,CAAA;AAED,eAAO,MAAM,YAAY,OACnB,SAAS,OACR,SAAS,UACN,YAAY,kBA0BrB,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,OACR,SAAS,SACP,MAAM,kBAkBd,CAAA;AAED,eAAO,MAAM,mBAAmB,OAC1B,SAAS,OACR,SAAS,oBACI,cAAc,kBAQjC,CAAA;AAED,eAAO,MAAM,qBAAqB,OAC5B,SAAS,OACR,SAAS,KACb,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;IAC3C,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;CAC/C,GAAG,IAAI,CAYP,CAAA;AAED,eAAO,MAAM,2BAA2B,OAClC,SAAS,OACR,SAAS,YACJ,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,kBAQ5C,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,OACR,SAAS,eACD,MAAM,GAAG,IAAI,KACzB,OAAO,CAAC,OAAO,CAYjB,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,OACR,SAAS,UACN,iBAAiB,KACxB,OAAO,CAAC,OAAO,CAqBjB,CAAA;AAED,eAAO,MAAM,mBAAmB,YACrB,IAAI,GAAG;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;;;;;;;;;;;;CAWF,CAAA"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EAGlB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3D,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,IAAI,SAA2B;IAC/B,YACE,OAAO,SAAwE,EAC/E,OAAO,CAAC,EAAE,YAAY,EAGvB;CACF;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,eAAe,OAAQ,SAAS,UAAU,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BvE,CAAA;AAED,eAAO,MAAM,UAAU,OACjB,SAAS,eACA,kBAAkB,UACvB,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAW7B,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,QACP,SAAS,EAAE,UACT,iBAAiB,KACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAgBnC,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,SACN,MAAM,UACL,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAK7B,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,QACP;IACJ,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,kBAuBF,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,QACP;IACJ,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;CACvB,kBAiBF,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,OACR,SAAS,KACb,OAAO,CAAC,IAAI,CAqBd,CAAA;AAED,eAAO,MAAM,YAAY,OACnB,SAAS,OACR,SAAS,UACN,YAAY,kBA0BrB,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,OACR,SAAS,SACP,MAAM,kBAkBd,CAAA;AAED,eAAO,MAAM,mBAAmB,OAC1B,SAAS,OACR,SAAS,oBACI,cAAc,kBAQjC,CAAA;AAED,eAAO,MAAM,qBAAqB,OAC5B,SAAS,OACR,SAAS,KACb,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;IAC3C,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;CAC/C,GAAG,IAAI,CAYP,CAAA;AAED,eAAO,MAAM,2BAA2B,OAClC,SAAS,OACR,SAAS,YACJ,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,kBAQ5C,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,OACR,SAAS,eACD,MAAM,GAAG,IAAI,KACzB,OAAO,CAAC,OAAO,CAYjB,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,OACR,SAAS,UACN,iBAAiB,KACxB,OAAO,CAAC,OAAO,CAqBjB,CAAA;AAED,eAAO,MAAM,mBAAmB,YACrB,IAAI,GAAG;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;;;;;;;;;;;;CAWF,CAAA"}

package/dist/account-manager/helpers/account.js

@@ -21,6 +21,7 @@ export const selectAccountQB = (db, flags) => {
     return db.db
         .selectFrom('actor')
         .leftJoin('account', 'actor.did', 'account.did')
+        .leftJoin('account_email_auth_factor', 'actor.did', 'account_email_auth_factor.did')
         .$if(!includeTakenDown, (qb) => qb.where(notSoftDeletedClause(ref('actor'))))
         .$if(!includeDeactivated, (qb) => qb.where('actor.deactivatedAt', 'is', null))
         .select([
@@ -33,6 +34,7 @@ export const selectAccountQB = (db, flags) => {
         'account.email',
         'account.emailConfirmedAt',
         'account.invitesDisabled',
+        'account_email_auth_factor.emailAuthFactorEnabledAt as emailAuthFactorAt',
     ]);
 };
 export const getAccount = async (db, handleOrDid, flags) => {
@@ -83,7 +85,7 @@ export const registerActor = async (db, opts) => {
         .onConflict((oc) => oc.doNothing())
         .returning('did'));
     if (!registered) {
-        throw new UserAlreadyExistsError();
+        throw new UserAlreadyExistsError('Handle is already in use, please choose a different handle.');
     }
 };
 export const registerAccount = async (db, opts) => {
@@ -106,6 +108,7 @@ export const deleteAccount = async (db, did) => {
     // Also, this can safely be run multiple times if it fails.
     await db.executeWithRetry(db.db.deleteFrom('repo_root').where('did', '=', did));
     await db.executeWithRetry(db.db.deleteFrom('email_token').where('did', '=', did));
+    await db.executeWithRetry(db.db.deleteFrom('account_email_auth_factor').where('did', '=', did));
     await db.executeWithRetry(db.db.deleteFrom('refresh_token').where('did', '=', did));
     await db.executeWithRetry(db.db.deleteFrom('account').where('account.did', '=', did));
     await db.executeWithRetry(db.db.deleteFrom('actor').where('actor.did', '=', did));