@atproto/pds 0.5.35 → 0.5.37

package/dist/account-manager/helpers/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAKL,qBAAqB,EACrB,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAI9E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE/C,YACE,OAAO,GAAG,qEAAqE,EAC/E,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QALzB,SAAI,GAAG,wBAAwB,CAAA;IAM/B,CAAC;CACF;AAaD,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,wCAAuB,CAAA;IACvB,wCAAuB,CAAA;IACvB,oCAAmB,CAAA;IACnB,4CAA2B,CAAA;AAC7B,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAa,EAAE,KAAyB,EAAE,EAAE;IAC1E,MAAM,EAAE,gBAAgB,GAAG,KAAK,EAAE,kBAAkB,GAAG,KAAK,EAAE,GAAG,KAAK,IAAI,EAAE,CAAA;IAC5E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAA;IAC7B,OAAO,EAAE,CAAC,EAAE;SACT,UAAU,CAAC,OAAO,CAAC;SACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC;SAC/C,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAC7B,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAC7C;SACA,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CAC/B,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,CAAC,CAC5C;SACA,MAAM,CAAC;QACN,WAAW;QACX,cAAc;QACd,iBAAiB;QACjB,mBAAmB;QACnB,qBAAqB;QACrB,mBAAmB;QACnB,eAAe;QACf,0BAA0B;QAC1B,yBAAyB;KAC1B,CAAC,CAAA;AACN,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,EAAa,EACb,WAA+B,EAC/B,KAAyB,EACK,EAAE;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC;SAC3C,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE;QACZ,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC,CAAC;SACD,gBAAgB,EAAE,CAAA;IACrB,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,EAAa,EACb,IAAiB,EACjB,KAAyB,EACW,EAAE;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAE/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC;SAC9C,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;SAC9B,OAAO,EAAE,CAAA;IAEZ,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,EAAa,EACb,KAAa,EACb,KAAyB,EACK,EAAE;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC;SAC3C,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SACxC,gBAAgB,EAAE,CAAA;IACrB,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,EAAa,EACb,IAIC,EACD,EAAE;IACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7C,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAC5C,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,OAAO,CAAC;SACnB,MAAM,CAAC;QACN,GAAG;QACH,MAAM;QACN,SAAS;QACT,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QAC7C,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;SAClC,SAAS,CAAC,KAAK,CAAC,CACpB,CAAA;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,EAAa,EACb,IAIC,EACD,EAAE;IACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IAC3C,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAC5C,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,SAAS,CAAC;SACrB,MAAM,CAAC;QACN,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,cAAc;KACf,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;SAClC,SAAS,CAAC,KAAK,CAAC,CACpB,CAAA;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,EAAa,EACb,GAAc,EACC,EAAE;IACjB,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACrD,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACvD,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACzD,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAC3D,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CACvD,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,GAAc,EACd,MAAoB,EACpB,EAAE;IACF,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,OAAO,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;SACf,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,GAAG,CACD,MAAM,CACJ,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,OAAO,CAAC;SACnB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;SAC5B,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;SACvB,SAAS,EAAE,CACf,CACF,CACF,CACJ,CAAA;IACD,IAAI,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAC9B,6DAA6D,CAC9D,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,EAAa,EACb,GAAc,EACd,KAAa,EACb,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE;aACF,WAAW,CAAC,SAAS,CAAC;aACtB,GAAG,CAAC;YACH,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,gBAAgB,EAAE,IAAI;SACvB,CAAC;aACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAa,EACb,GAAc,EACd,gBAAgC,EAChC,EAAE;IACF,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,SAAS,CAAC;SACtB,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC;SACzB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,EAAa,EACb,GAAc,EAIN,EAAE;IACV,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,EAAE;SACpB,UAAU,CAAC,OAAO,CAAC;SACnB,MAAM,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;SACxC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,gBAAgB,EAAE,CAAA;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW;QAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACzC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACtB,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,EAAa,EACb,GAAc,EACd,QAA2C,EAC3C,EAAE;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO;QAClC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACvE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,EAAa,EACb,GAAc,EACd,WAA0B,EACR,EAAE;IACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,OAAO,CAAC;SACpB,GAAG,CAAC;QACH,aAAa,EAAE,qBAAqB,EAAE;QACtC,WAAW;KACZ,CAAC;SACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;IAED,OAAO,GAAG,CAAC,cAAc,GAAG,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,EAAa,EACb,GAAc,EACd,KAAyB,EACP,EAAE;IACpB,MAAM,EAAE,gBAAgB,GAAG,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,CAAA;IAC3E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAA;IAE7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,OAAO,CAAC;SACpB,GAAG,CAAC;QACH,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;KAClB,CAAC;SACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAC5C;SACA,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC/C,CACJ,CAAA;IAED,OAAO,GAAG,CAAC,cAAc,GAAG,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAGC,EACD,EAAE;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAW,CAAA;IAClE,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAW,CAAA;IACpE,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,WAAW,EAAW,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAW,CAAA;IACrD,CAAC;AACH,CAAC,CAAA","sourcesContent":["import { DAY } from '@atproto/common'\nimport {\n  type AtIdentifierString,\n  type DatetimeString,\n  type DidString,\n  type HandleString,\n  currentDatetimeString,\n  isDidIdentifier,\n} from '@atproto/lex'\nimport { isErrUniqueViolation, notSoftDeletedClause } from '../../db/index.js'\nimport type { com } from '../../lexicons/index.js'\nimport type { AccountDb, ActorEntry } from '../db/index.js'\n\nexport class UserAlreadyExistsError extends Error {\n  name = 'UserAlreadyExistsError'\n  constructor(\n    message = 'This email address is already in use, please use a different email.',\n    options?: ErrorOptions,\n  ) {\n    super(message, options)\n  }\n}\n\nexport type ActorAccount = ActorEntry & {\n  email: string | null\n  emailConfirmedAt: string | null\n  invitesDisabled: 0 | 1 | null\n}\n\nexport type AvailabilityFlags = {\n  includeTakenDown?: boolean\n  includeDeactivated?: boolean\n}\n\nexport enum AccountStatus {\n  Active = 'active',\n  Takendown = 'takendown',\n  Suspended = 'suspended',\n  Deleted = 'deleted',\n  Deactivated = 'deactivated',\n}\n\nexport const selectAccountQB = (db: AccountDb, flags?: AvailabilityFlags) => {\n  const { includeTakenDown = false, includeDeactivated = false } = flags ?? {}\n  const { ref } = db.db.dynamic\n  return db.db\n    .selectFrom('actor')\n    .leftJoin('account', 'actor.did', 'account.did')\n    .$if(!includeTakenDown, (qb) =>\n      qb.where(notSoftDeletedClause(ref('actor'))),\n    )\n    .$if(!includeDeactivated, (qb) =>\n      qb.where('actor.deactivatedAt', 'is', null),\n    )\n    .select([\n      'actor.did',\n      'actor.handle',\n      'actor.createdAt',\n      'actor.takedownRef',\n      'actor.deactivatedAt',\n      'actor.deleteAfter',\n      'account.email',\n      'account.emailConfirmedAt',\n      'account.invitesDisabled',\n    ])\n}\n\nexport const getAccount = async (\n  db: AccountDb,\n  handleOrDid: AtIdentifierString,\n  flags?: AvailabilityFlags,\n): Promise<ActorAccount | null> => {\n  const found = await selectAccountQB(db, flags)\n    .where((eb) => {\n      if (isDidIdentifier(handleOrDid)) {\n        return eb('actor.did', '=', handleOrDid)\n      } else {\n        return eb('actor.handle', '=', handleOrDid)\n      }\n    })\n    .executeTakeFirst()\n  return found || null\n}\n\nexport const getAccounts = async (\n  db: AccountDb,\n  dids: DidString[],\n  flags?: AvailabilityFlags,\n): Promise<Map<string, ActorAccount>> => {\n  const results = new Map<string, ActorAccount>()\n\n  if (!dids.length) {\n    return results\n  }\n\n  const accounts = await selectAccountQB(db, flags)\n    .where('actor.did', 'in', dids)\n    .execute()\n\n  accounts.forEach((account) => {\n    results.set(account.did, account)\n  })\n\n  return results\n}\n\nexport const getAccountByEmail = async (\n  db: AccountDb,\n  email: string,\n  flags?: AvailabilityFlags,\n): Promise<ActorAccount | null> => {\n  const found = await selectAccountQB(db, flags)\n    .where('email', '=', email.toLowerCase())\n    .executeTakeFirst()\n  return found || null\n}\n\nexport const registerActor = async (\n  db: AccountDb,\n  opts: {\n    did: DidString\n    handle: HandleString\n    deactivated?: boolean\n  },\n) => {\n  const { did, handle, deactivated } = opts\n  const now = Date.now()\n  const createdAt = new Date(now).toISOString()\n  const [registered] = await db.executeWithRetry(\n    db.db\n      .insertInto('actor')\n      .values({\n        did,\n        handle,\n        createdAt,\n        deactivatedAt: deactivated ? createdAt : null,\n        deleteAfter: deactivated ? new Date(now + 3 * DAY).toISOString() : null,\n      })\n      .onConflict((oc) => oc.doNothing())\n      .returning('did'),\n  )\n  if (!registered) {\n    throw new UserAlreadyExistsError()\n  }\n}\n\nexport const registerAccount = async (\n  db: AccountDb,\n  opts: {\n    did: string\n    email: string\n    passwordScrypt: string\n  },\n) => {\n  const { did, email, passwordScrypt } = opts\n  const [registered] = await db.executeWithRetry(\n    db.db\n      .insertInto('account')\n      .values({\n        did,\n        email: email.toLowerCase(),\n        passwordScrypt,\n      })\n      .onConflict((oc) => oc.doNothing())\n      .returning('did'),\n  )\n  if (!registered) {\n    throw new UserAlreadyExistsError()\n  }\n}\n\nexport const deleteAccount = async (\n  db: AccountDb,\n  did: DidString,\n): Promise<void> => {\n  // Not done in transaction because it would be too long, prone to contention.\n  // Also, this can safely be run multiple times if it fails.\n  await db.executeWithRetry(\n    db.db.deleteFrom('repo_root').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('email_token').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('refresh_token').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('account').where('account.did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('actor').where('actor.did', '=', did),\n  )\n}\n\nexport const updateHandle = async (\n  db: AccountDb,\n  did: DidString,\n  handle: HandleString,\n) => {\n  // No-op if the handle is the same, but still returns 1 row affected, so that\n  // it can be used to check for existence of the account.\n  const [res] = await db.executeWithRetry(\n    db.db\n      .updateTable('actor')\n      .set({ handle })\n      .where('did', '=', did)\n      .where(({ not, exists }) =>\n        not(\n          exists(\n            db.db\n              .selectFrom('actor')\n              .where('handle', '=', handle)\n              .where('did', '!=', did)\n              .selectAll(),\n          ),\n        ),\n      ),\n  )\n  if (res.numUpdatedRows < 1) {\n    throw new UserAlreadyExistsError(\n      'Handle is already in use, please choose a different handle.',\n    )\n  }\n}\n\nexport const updateEmail = async (\n  db: AccountDb,\n  did: DidString,\n  email: string,\n) => {\n  try {\n    await db.executeWithRetry(\n      db.db\n        .updateTable('account')\n        .set({\n          email: email.toLowerCase(),\n          emailConfirmedAt: null,\n        })\n        .where('did', '=', did),\n    )\n  } catch (err) {\n    if (isErrUniqueViolation(err)) {\n      throw new UserAlreadyExistsError()\n    }\n    throw err\n  }\n}\n\nexport const setEmailConfirmedAt = async (\n  db: AccountDb,\n  did: DidString,\n  emailConfirmedAt: DatetimeString,\n) => {\n  await db.executeWithRetry(\n    db.db\n      .updateTable('account')\n      .set({ emailConfirmedAt })\n      .where('did', '=', did),\n  )\n}\n\nexport const getAccountAdminStatus = async (\n  db: AccountDb,\n  did: DidString,\n): Promise<{\n  takedown: com.atproto.admin.defs.StatusAttr\n  deactivated: com.atproto.admin.defs.StatusAttr\n} | null> => {\n  const res = await db.db\n    .selectFrom('actor')\n    .select(['takedownRef', 'deactivatedAt'])\n    .where('did', '=', did)\n    .executeTakeFirst()\n  if (!res) return null\n  const takedown = res.takedownRef\n    ? { applied: true, ref: res.takedownRef }\n    : { applied: false }\n  const deactivated = res.deactivatedAt ? { applied: true } : { applied: false }\n  return { takedown, deactivated }\n}\n\nexport const updateAccountTakedownStatus = async (\n  db: AccountDb,\n  did: DidString,\n  takedown: com.atproto.admin.defs.StatusAttr,\n) => {\n  const takedownRef = takedown.applied\n    ? (takedown.ref ?? currentDatetimeString())\n    : null\n  await db.executeWithRetry(\n    db.db.updateTable('actor').set({ takedownRef }).where('did', '=', did),\n  )\n}\n\nexport const deactivateAccount = async (\n  db: AccountDb,\n  did: DidString,\n  deleteAfter: string | null,\n): Promise<boolean> => {\n  const [res] = await db.executeWithRetry(\n    db.db\n      .updateTable('actor')\n      .set({\n        deactivatedAt: currentDatetimeString(),\n        deleteAfter,\n      })\n      .where('did', '=', did),\n  )\n\n  return res.numUpdatedRows > 0\n}\n\nexport const activateAccount = async (\n  db: AccountDb,\n  did: DidString,\n  flags?: AvailabilityFlags,\n): Promise<boolean> => {\n  const { includeTakenDown = false, includeDeactivated = true } = flags ?? {}\n  const { ref } = db.db.dynamic\n\n  const [res] = await db.executeWithRetry(\n    db.db\n      .updateTable('actor')\n      .set({\n        deactivatedAt: null,\n        deleteAfter: null,\n      })\n      .where('did', '=', did)\n      .$if(!includeTakenDown, (q) =>\n        q.where(notSoftDeletedClause(ref('actor'))),\n      )\n      .$if(!includeDeactivated, (q) =>\n        q.where('actor.deactivatedAt', 'is not', null),\n      ),\n  )\n\n  return res.numUpdatedRows > 0\n}\n\nexport const formatAccountStatus = (\n  account: null | {\n    takedownRef: string | null\n    deactivatedAt: string | null\n  },\n) => {\n  if (!account) {\n    return { active: false, status: AccountStatus.Deleted } as const\n  } else if (account.takedownRef) {\n    return { active: false, status: AccountStatus.Takendown } as const\n  } else if (account.deactivatedAt) {\n    return { active: false, status: AccountStatus.Deactivated } as const\n  } else {\n    return { active: true, status: undefined } as const\n  }\n}\n"]}
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAKL,qBAAqB,EACrB,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAI9E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE/C,YACE,OAAO,GAAG,qEAAqE,EAC/E,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QALzB,SAAI,GAAG,wBAAwB,CAAA;IAM/B,CAAC;CACF;AAcD,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,wCAAuB,CAAA;IACvB,wCAAuB,CAAA;IACvB,oCAAmB,CAAA;IACnB,4CAA2B,CAAA;AAC7B,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAa,EAAE,KAAyB,EAAE,EAAE;IAC1E,MAAM,EAAE,gBAAgB,GAAG,KAAK,EAAE,kBAAkB,GAAG,KAAK,EAAE,GAAG,KAAK,IAAI,EAAE,CAAA;IAC5E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAA;IAC7B,OAAO,EAAE,CAAC,EAAE;SACT,UAAU,CAAC,OAAO,CAAC;SACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC;SAC/C,QAAQ,CACP,2BAA2B,EAC3B,WAAW,EACX,+BAA+B,CAChC;SACA,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAC7B,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAC7C;SACA,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CAC/B,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,CAAC,CAC5C;SACA,MAAM,CAAC;QACN,WAAW;QACX,cAAc;QACd,iBAAiB;QACjB,mBAAmB;QACnB,qBAAqB;QACrB,mBAAmB;QACnB,eAAe;QACf,0BAA0B;QAC1B,yBAAyB;QACzB,yEAAyE;KAC1E,CAAC,CAAA;AACN,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,EAAa,EACb,WAA+B,EAC/B,KAAyB,EACK,EAAE;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC;SAC3C,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE;QACZ,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC,CAAC;SACD,gBAAgB,EAAE,CAAA;IACrB,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,EAAa,EACb,IAAiB,EACjB,KAAyB,EACW,EAAE;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAE/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC;SAC9C,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;SAC9B,OAAO,EAAE,CAAA;IAEZ,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,EAAa,EACb,KAAa,EACb,KAAyB,EACK,EAAE;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC;SAC3C,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SACxC,gBAAgB,EAAE,CAAA;IACrB,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,EAAa,EACb,IAIC,EACD,EAAE;IACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7C,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAC5C,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,OAAO,CAAC;SACnB,MAAM,CAAC;QACN,GAAG;QACH,MAAM;QACN,SAAS;QACT,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QAC7C,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;SAClC,SAAS,CAAC,KAAK,CAAC,CACpB,CAAA;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,CAC9B,6DAA6D,CAC9D,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,EAAa,EACb,IAIC,EACD,EAAE;IACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IAC3C,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAC5C,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,SAAS,CAAC;SACrB,MAAM,CAAC;QACN,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,cAAc;KACf,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;SAClC,SAAS,CAAC,KAAK,CAAC,CACpB,CAAA;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,EAAa,EACb,GAAc,EACC,EAAE;IACjB,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACrD,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACvD,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACrE,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACzD,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAC3D,CAAA;IACD,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CACvD,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,GAAc,EACd,MAAoB,EACpB,EAAE;IACF,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,OAAO,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;SACf,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CACzB,GAAG,CACD,MAAM,CACJ,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,OAAO,CAAC;SACnB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;SAC5B,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;SACvB,SAAS,EAAE,CACf,CACF,CACF,CACJ,CAAA;IACD,IAAI,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAC9B,6DAA6D,CAC9D,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,EAAa,EACb,GAAc,EACd,KAAa,EACb,EAAE;IACF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE;aACF,WAAW,CAAC,SAAS,CAAC;aACtB,GAAG,CAAC;YACH,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;YAC1B,gBAAgB,EAAE,IAAI;SACvB,CAAC;aACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAa,EACb,GAAc,EACd,gBAAgC,EAChC,EAAE;IACF,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,SAAS,CAAC;SACtB,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC;SACzB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,EAAa,EACb,GAAc,EAIN,EAAE;IACV,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,EAAE;SACpB,UAAU,CAAC,OAAO,CAAC;SACnB,MAAM,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;SACxC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,gBAAgB,EAAE,CAAA;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW;QAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACzC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACtB,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,EAAa,EACb,GAAc,EACd,QAA2C,EAC3C,EAAE;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO;QAClC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACvE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,EAAa,EACb,GAAc,EACd,WAA0B,EACR,EAAE;IACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,OAAO,CAAC;SACpB,GAAG,CAAC;QACH,aAAa,EAAE,qBAAqB,EAAE;QACtC,WAAW;KACZ,CAAC;SACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;IAED,OAAO,GAAG,CAAC,cAAc,GAAG,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,EAAa,EACb,GAAc,EACd,KAAyB,EACP,EAAE;IACpB,MAAM,EAAE,gBAAgB,GAAG,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,CAAA;IAC3E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAA;IAE7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,WAAW,CAAC,OAAO,CAAC;SACpB,GAAG,CAAC;QACH,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,IAAI;KAClB,CAAC;SACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAC5C;SACA,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC/C,CACJ,CAAA;IAED,OAAO,GAAG,CAAC,cAAc,GAAG,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAGC,EACD,EAAE;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAW,CAAA;IAClE,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAW,CAAA;IACpE,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,WAAW,EAAW,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAW,CAAA;IACrD,CAAC;AACH,CAAC,CAAA","sourcesContent":["import { DAY } from '@atproto/common'\nimport {\n  type AtIdentifierString,\n  type DatetimeString,\n  type DidString,\n  type HandleString,\n  currentDatetimeString,\n  isDidIdentifier,\n} from '@atproto/lex'\nimport { isErrUniqueViolation, notSoftDeletedClause } from '../../db/index.js'\nimport type { com } from '../../lexicons/index.js'\nimport type { AccountDb, ActorEntry } from '../db/index.js'\n\nexport class UserAlreadyExistsError extends Error {\n  name = 'UserAlreadyExistsError'\n  constructor(\n    message = 'This email address is already in use, please use a different email.',\n    options?: ErrorOptions,\n  ) {\n    super(message, options)\n  }\n}\n\nexport type ActorAccount = ActorEntry & {\n  email: string | null\n  emailConfirmedAt: string | null\n  emailAuthFactorAt: string | null\n  invitesDisabled: 0 | 1 | null\n}\n\nexport type AvailabilityFlags = {\n  includeTakenDown?: boolean\n  includeDeactivated?: boolean\n}\n\nexport enum AccountStatus {\n  Active = 'active',\n  Takendown = 'takendown',\n  Suspended = 'suspended',\n  Deleted = 'deleted',\n  Deactivated = 'deactivated',\n}\n\nexport const selectAccountQB = (db: AccountDb, flags?: AvailabilityFlags) => {\n  const { includeTakenDown = false, includeDeactivated = false } = flags ?? {}\n  const { ref } = db.db.dynamic\n  return db.db\n    .selectFrom('actor')\n    .leftJoin('account', 'actor.did', 'account.did')\n    .leftJoin(\n      'account_email_auth_factor',\n      'actor.did',\n      'account_email_auth_factor.did',\n    )\n    .$if(!includeTakenDown, (qb) =>\n      qb.where(notSoftDeletedClause(ref('actor'))),\n    )\n    .$if(!includeDeactivated, (qb) =>\n      qb.where('actor.deactivatedAt', 'is', null),\n    )\n    .select([\n      'actor.did',\n      'actor.handle',\n      'actor.createdAt',\n      'actor.takedownRef',\n      'actor.deactivatedAt',\n      'actor.deleteAfter',\n      'account.email',\n      'account.emailConfirmedAt',\n      'account.invitesDisabled',\n      'account_email_auth_factor.emailAuthFactorEnabledAt as emailAuthFactorAt',\n    ])\n}\n\nexport const getAccount = async (\n  db: AccountDb,\n  handleOrDid: AtIdentifierString,\n  flags?: AvailabilityFlags,\n): Promise<ActorAccount | null> => {\n  const found = await selectAccountQB(db, flags)\n    .where((eb) => {\n      if (isDidIdentifier(handleOrDid)) {\n        return eb('actor.did', '=', handleOrDid)\n      } else {\n        return eb('actor.handle', '=', handleOrDid)\n      }\n    })\n    .executeTakeFirst()\n  return found || null\n}\n\nexport const getAccounts = async (\n  db: AccountDb,\n  dids: DidString[],\n  flags?: AvailabilityFlags,\n): Promise<Map<string, ActorAccount>> => {\n  const results = new Map<string, ActorAccount>()\n\n  if (!dids.length) {\n    return results\n  }\n\n  const accounts = await selectAccountQB(db, flags)\n    .where('actor.did', 'in', dids)\n    .execute()\n\n  accounts.forEach((account) => {\n    results.set(account.did, account)\n  })\n\n  return results\n}\n\nexport const getAccountByEmail = async (\n  db: AccountDb,\n  email: string,\n  flags?: AvailabilityFlags,\n): Promise<ActorAccount | null> => {\n  const found = await selectAccountQB(db, flags)\n    .where('email', '=', email.toLowerCase())\n    .executeTakeFirst()\n  return found || null\n}\n\nexport const registerActor = async (\n  db: AccountDb,\n  opts: {\n    did: DidString\n    handle: HandleString\n    deactivated?: boolean\n  },\n) => {\n  const { did, handle, deactivated } = opts\n  const now = Date.now()\n  const createdAt = new Date(now).toISOString()\n  const [registered] = await db.executeWithRetry(\n    db.db\n      .insertInto('actor')\n      .values({\n        did,\n        handle,\n        createdAt,\n        deactivatedAt: deactivated ? createdAt : null,\n        deleteAfter: deactivated ? new Date(now + 3 * DAY).toISOString() : null,\n      })\n      .onConflict((oc) => oc.doNothing())\n      .returning('did'),\n  )\n  if (!registered) {\n    throw new UserAlreadyExistsError(\n      'Handle is already in use, please choose a different handle.',\n    )\n  }\n}\n\nexport const registerAccount = async (\n  db: AccountDb,\n  opts: {\n    did: string\n    email: string\n    passwordScrypt: string\n  },\n) => {\n  const { did, email, passwordScrypt } = opts\n  const [registered] = await db.executeWithRetry(\n    db.db\n      .insertInto('account')\n      .values({\n        did,\n        email: email.toLowerCase(),\n        passwordScrypt,\n      })\n      .onConflict((oc) => oc.doNothing())\n      .returning('did'),\n  )\n  if (!registered) {\n    throw new UserAlreadyExistsError()\n  }\n}\n\nexport const deleteAccount = async (\n  db: AccountDb,\n  did: DidString,\n): Promise<void> => {\n  // Not done in transaction because it would be too long, prone to contention.\n  // Also, this can safely be run multiple times if it fails.\n  await db.executeWithRetry(\n    db.db.deleteFrom('repo_root').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('email_token').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('account_email_auth_factor').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('refresh_token').where('did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('account').where('account.did', '=', did),\n  )\n  await db.executeWithRetry(\n    db.db.deleteFrom('actor').where('actor.did', '=', did),\n  )\n}\n\nexport const updateHandle = async (\n  db: AccountDb,\n  did: DidString,\n  handle: HandleString,\n) => {\n  // No-op if the handle is the same, but still returns 1 row affected, so that\n  // it can be used to check for existence of the account.\n  const [res] = await db.executeWithRetry(\n    db.db\n      .updateTable('actor')\n      .set({ handle })\n      .where('did', '=', did)\n      .where(({ not, exists }) =>\n        not(\n          exists(\n            db.db\n              .selectFrom('actor')\n              .where('handle', '=', handle)\n              .where('did', '!=', did)\n              .selectAll(),\n          ),\n        ),\n      ),\n  )\n  if (res.numUpdatedRows < 1) {\n    throw new UserAlreadyExistsError(\n      'Handle is already in use, please choose a different handle.',\n    )\n  }\n}\n\nexport const updateEmail = async (\n  db: AccountDb,\n  did: DidString,\n  email: string,\n) => {\n  try {\n    await db.executeWithRetry(\n      db.db\n        .updateTable('account')\n        .set({\n          email: email.toLowerCase(),\n          emailConfirmedAt: null,\n        })\n        .where('did', '=', did),\n    )\n  } catch (err) {\n    if (isErrUniqueViolation(err)) {\n      throw new UserAlreadyExistsError()\n    }\n    throw err\n  }\n}\n\nexport const setEmailConfirmedAt = async (\n  db: AccountDb,\n  did: DidString,\n  emailConfirmedAt: DatetimeString,\n) => {\n  await db.executeWithRetry(\n    db.db\n      .updateTable('account')\n      .set({ emailConfirmedAt })\n      .where('did', '=', did),\n  )\n}\n\nexport const getAccountAdminStatus = async (\n  db: AccountDb,\n  did: DidString,\n): Promise<{\n  takedown: com.atproto.admin.defs.StatusAttr\n  deactivated: com.atproto.admin.defs.StatusAttr\n} | null> => {\n  const res = await db.db\n    .selectFrom('actor')\n    .select(['takedownRef', 'deactivatedAt'])\n    .where('did', '=', did)\n    .executeTakeFirst()\n  if (!res) return null\n  const takedown = res.takedownRef\n    ? { applied: true, ref: res.takedownRef }\n    : { applied: false }\n  const deactivated = res.deactivatedAt ? { applied: true } : { applied: false }\n  return { takedown, deactivated }\n}\n\nexport const updateAccountTakedownStatus = async (\n  db: AccountDb,\n  did: DidString,\n  takedown: com.atproto.admin.defs.StatusAttr,\n) => {\n  const takedownRef = takedown.applied\n    ? (takedown.ref ?? currentDatetimeString())\n    : null\n  await db.executeWithRetry(\n    db.db.updateTable('actor').set({ takedownRef }).where('did', '=', did),\n  )\n}\n\nexport const deactivateAccount = async (\n  db: AccountDb,\n  did: DidString,\n  deleteAfter: string | null,\n): Promise<boolean> => {\n  const [res] = await db.executeWithRetry(\n    db.db\n      .updateTable('actor')\n      .set({\n        deactivatedAt: currentDatetimeString(),\n        deleteAfter,\n      })\n      .where('did', '=', did),\n  )\n\n  return res.numUpdatedRows > 0\n}\n\nexport const activateAccount = async (\n  db: AccountDb,\n  did: DidString,\n  flags?: AvailabilityFlags,\n): Promise<boolean> => {\n  const { includeTakenDown = false, includeDeactivated = true } = flags ?? {}\n  const { ref } = db.db.dynamic\n\n  const [res] = await db.executeWithRetry(\n    db.db\n      .updateTable('actor')\n      .set({\n        deactivatedAt: null,\n        deleteAfter: null,\n      })\n      .where('did', '=', did)\n      .$if(!includeTakenDown, (q) =>\n        q.where(notSoftDeletedClause(ref('actor'))),\n      )\n      .$if(!includeDeactivated, (q) =>\n        q.where('actor.deactivatedAt', 'is not', null),\n      ),\n  )\n\n  return res.numUpdatedRows > 0\n}\n\nexport const formatAccountStatus = (\n  account: null | {\n    takedownRef: string | null\n    deactivatedAt: string | null\n  },\n) => {\n  if (!account) {\n    return { active: false, status: AccountStatus.Deleted } as const\n  } else if (account.takedownRef) {\n    return { active: false, status: AccountStatus.Takendown } as const\n  } else if (account.deactivatedAt) {\n    return { active: false, status: AccountStatus.Deactivated } as const\n  } else {\n    return { active: true, status: undefined } as const\n  }\n}\n"]}

package/dist/account-manager/helpers/email-auth-factor.d.ts

@@ -0,0 +1,46 @@
+import { type DatetimeString } from '@atproto/lex';
+import type { AccountDb } from '../db/index.js';
+/**
+ * Enables the email auth factor for `did`, provided `email` is still the
+ * account's address and is still confirmed.
+ *
+ * @NOTE `INSERT … SELECT` rather than a read followed by a write: the factor
+ * lives in its own table, so that guard would otherwise be a separate query
+ * with a window in between. Selecting *from* `account` keeps it a single
+ * statement, so it holds atomically against a concurrent email change.
+ *
+ * Enabling an already-enabled factor is idempotent and keeps the original
+ * timestamp: the conflict clause re-assigns the column to itself, which touches
+ * the row so `RETURNING` still yields it without moving the clock. `DO NOTHING`
+ * would skip the row and return nothing, making "already enabled" and "guard
+ * failed" indistinguishable.
+ *
+ * @returns the stored timestamp, so callers mirror what the database actually
+ * holds rather than a value they minted themselves. `null` means the guard
+ * failed — no row was written and the account is unchanged.
+ */
+export declare const enable: (db: AccountDb, did: string, email: string) => Promise<DatetimeString | null>;
+/**
+ * Disables the email auth factor for `did`, provided `email` is still the
+ * account's address. Disabling an already-disabled factor is a no-op.
+ *
+ * Unlike enabling there is no `emailConfirmedAt` guard — turning a factor off
+ * never needs the address to be confirmed.
+ *
+ * @returns whether a row was removed.
+ */
+export declare const disable: (db: AccountDb, did: string, email: string) => Promise<boolean>;
+/**
+ * Drops the email auth factor for `did` unconditionally.
+ *
+ * For the paths where the account's own state makes the factor invalid rather
+ * than the user asking to turn it off: an email change (2FA on an unconfirmed
+ * address can lock the user out) and account deletion. Callers changing the
+ * email must do so in the same transaction as the email write, since the two
+ * are no longer one row.
+ *
+ * TODO: Store unconfirmed emails separately, see note in context.ts — at which
+ * point changing an email no longer needs to disable 2FA at all.
+ */
+export declare const deleteForDid: (db: AccountDb, did: string) => Promise<void>;
+//# sourceMappingURL=email-auth-factor.d.ts.map

package/dist/account-manager/helpers/email-auth-factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-auth-factor.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/email-auth-factor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,cAAc,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,MAAM,OACb,SAAS,OACR,MAAM,SACJ,MAAM,KACZ,OAAO,CAAC,cAAc,GAAG,IAAI,CA+B/B,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,OACd,SAAS,OACR,MAAM,SACJ,MAAM,KACZ,OAAO,CAAC,OAAO,CAgBjB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,OACnB,SAAS,OACR,MAAM,KACV,OAAO,CAAC,IAAI,CAId,CAAA"}

package/dist/account-manager/helpers/email-auth-factor.js

@@ -0,0 +1,77 @@
+import { currentDatetimeString } from '@atproto/lex';
+/**
+ * Enables the email auth factor for `did`, provided `email` is still the
+ * account's address and is still confirmed.
+ *
+ * @NOTE `INSERT … SELECT` rather than a read followed by a write: the factor
+ * lives in its own table, so that guard would otherwise be a separate query
+ * with a window in between. Selecting *from* `account` keeps it a single
+ * statement, so it holds atomically against a concurrent email change.
+ *
+ * Enabling an already-enabled factor is idempotent and keeps the original
+ * timestamp: the conflict clause re-assigns the column to itself, which touches
+ * the row so `RETURNING` still yields it without moving the clock. `DO NOTHING`
+ * would skip the row and return nothing, making "already enabled" and "guard
+ * failed" indistinguishable.
+ *
+ * @returns the stored timestamp, so callers mirror what the database actually
+ * holds rather than a value they minted themselves. `null` means the guard
+ * failed — no row was written and the account is unchanged.
+ */
+export const enable = async (db, did, email) => {
+    const emailAuthFactorEnabledAt = currentDatetimeString();
+    const [row] = await db.executeWithRetry(db.db
+        .insertInto('account_email_auth_factor')
+        .columns(['did', 'emailAuthFactorEnabledAt'])
+        .expression((eb) => eb
+        .selectFrom('account')
+        .select((eb2) => [
+        'account.did',
+        eb2.val(emailAuthFactorEnabledAt).as('emailAuthFactorEnabledAt'),
+    ])
+        .where('did', '=', did)
+        .where('email', '=', email.toLowerCase())
+        .where('emailConfirmedAt', 'is not', null))
+        .onConflict((oc) => oc.column('did').doUpdateSet((eb) => ({
+        // The bare column is the stored value; `excluded` would be the one
+        // just offered. Self-assigning preserves the original timestamp.
+        emailAuthFactorEnabledAt: eb.ref('account_email_auth_factor.emailAuthFactorEnabledAt'),
+    })))
+        .returning('emailAuthFactorEnabledAt'));
+    return row?.emailAuthFactorEnabledAt ?? null;
+};
+/**
+ * Disables the email auth factor for `did`, provided `email` is still the
+ * account's address. Disabling an already-disabled factor is a no-op.
+ *
+ * Unlike enabling there is no `emailConfirmedAt` guard — turning a factor off
+ * never needs the address to be confirmed.
+ *
+ * @returns whether a row was removed.
+ */
+export const disable = async (db, did, email) => {
+    const [res] = await db.executeWithRetry(db.db
+        .deleteFrom('account_email_auth_factor')
+        .where('did', '=', did)
+        .where(({ exists, selectFrom }) => exists(selectFrom('account')
+        .selectAll()
+        .where('account.did', '=', did)
+        .where('account.email', '=', email.toLowerCase()))));
+    return res.numDeletedRows > 0;
+};
+/**
+ * Drops the email auth factor for `did` unconditionally.
+ *
+ * For the paths where the account's own state makes the factor invalid rather
+ * than the user asking to turn it off: an email change (2FA on an unconfirmed
+ * address can lock the user out) and account deletion. Callers changing the
+ * email must do so in the same transaction as the email write, since the two
+ * are no longer one row.
+ *
+ * TODO: Store unconfirmed emails separately, see note in context.ts — at which
+ * point changing an email no longer needs to disable 2FA at all.
+ */
+export const deleteForDid = async (db, did) => {
+    await db.executeWithRetry(db.db.deleteFrom('account_email_auth_factor').where('did', '=', did));
+};
+//# sourceMappingURL=email-auth-factor.js.map

package/dist/account-manager/helpers/email-auth-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-auth-factor.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/email-auth-factor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGzE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,EAAa,EACb,GAAW,EACX,KAAa,EACmB,EAAE;IAClC,MAAM,wBAAwB,GAAG,qBAAqB,EAAE,CAAA;IAExD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,2BAA2B,CAAC;SACvC,OAAO,CAAC,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;SAC5C,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CACjB,EAAE;SACC,UAAU,CAAC,SAAS,CAAC;SACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACf,aAAa;QACb,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC;KACjE,CAAC;SACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SACxC,KAAK,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC7C;SACA,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CACjB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpC,mEAAmE;QACnE,iEAAiE;QACjE,wBAAwB,EAAE,EAAE,CAAC,GAAG,CAC9B,oDAAoD,CACrD;KACF,CAAC,CAAC,CACJ;SACA,SAAS,CAAC,0BAA0B,CAAC,CACzC,CAAA;IAED,OAAO,GAAG,EAAE,wBAAwB,IAAI,IAAI,CAAA;AAC9C,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAC1B,EAAa,EACb,GAAW,EACX,KAAa,EACK,EAAE;IACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,gBAAgB,CACrC,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,2BAA2B,CAAC;SACvC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SACtB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAChC,MAAM,CACJ,UAAU,CAAC,SAAS,CAAC;SAClB,SAAS,EAAE;SACX,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC;SAC9B,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CACpD,CACF,CACJ,CAAA;IAED,OAAO,GAAG,CAAC,cAAc,GAAG,CAAC,CAAA;AAC/B,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,GAAW,EACI,EAAE;IACjB,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CACrE,CAAA;AACH,CAAC,CAAA","sourcesContent":["import { type DatetimeString, currentDatetimeString } from '@atproto/lex'\nimport type { AccountDb } from '../db/index.js'\n\n/**\n * Enables the email auth factor for `did`, provided `email` is still the\n * account's address and is still confirmed.\n *\n * @NOTE `INSERT … SELECT` rather than a read followed by a write: the factor\n * lives in its own table, so that guard would otherwise be a separate query\n * with a window in between. Selecting *from* `account` keeps it a single\n * statement, so it holds atomically against a concurrent email change.\n *\n * Enabling an already-enabled factor is idempotent and keeps the original\n * timestamp: the conflict clause re-assigns the column to itself, which touches\n * the row so `RETURNING` still yields it without moving the clock. `DO NOTHING`\n * would skip the row and return nothing, making \"already enabled\" and \"guard\n * failed\" indistinguishable.\n *\n * @returns the stored timestamp, so callers mirror what the database actually\n * holds rather than a value they minted themselves. `null` means the guard\n * failed — no row was written and the account is unchanged.\n */\nexport const enable = async (\n  db: AccountDb,\n  did: string,\n  email: string,\n): Promise<DatetimeString | null> => {\n  const emailAuthFactorEnabledAt = currentDatetimeString()\n\n  const [row] = await db.executeWithRetry(\n    db.db\n      .insertInto('account_email_auth_factor')\n      .columns(['did', 'emailAuthFactorEnabledAt'])\n      .expression((eb) =>\n        eb\n          .selectFrom('account')\n          .select((eb2) => [\n            'account.did',\n            eb2.val(emailAuthFactorEnabledAt).as('emailAuthFactorEnabledAt'),\n          ])\n          .where('did', '=', did)\n          .where('email', '=', email.toLowerCase())\n          .where('emailConfirmedAt', 'is not', null),\n      )\n      .onConflict((oc) =>\n        oc.column('did').doUpdateSet((eb) => ({\n          // The bare column is the stored value; `excluded` would be the one\n          // just offered. Self-assigning preserves the original timestamp.\n          emailAuthFactorEnabledAt: eb.ref(\n            'account_email_auth_factor.emailAuthFactorEnabledAt',\n          ),\n        })),\n      )\n      .returning('emailAuthFactorEnabledAt'),\n  )\n\n  return row?.emailAuthFactorEnabledAt ?? null\n}\n\n/**\n * Disables the email auth factor for `did`, provided `email` is still the\n * account's address. Disabling an already-disabled factor is a no-op.\n *\n * Unlike enabling there is no `emailConfirmedAt` guard — turning a factor off\n * never needs the address to be confirmed.\n *\n * @returns whether a row was removed.\n */\nexport const disable = async (\n  db: AccountDb,\n  did: string,\n  email: string,\n): Promise<boolean> => {\n  const [res] = await db.executeWithRetry(\n    db.db\n      .deleteFrom('account_email_auth_factor')\n      .where('did', '=', did)\n      .where(({ exists, selectFrom }) =>\n        exists(\n          selectFrom('account')\n            .selectAll()\n            .where('account.did', '=', did)\n            .where('account.email', '=', email.toLowerCase()),\n        ),\n      ),\n  )\n\n  return res.numDeletedRows > 0\n}\n\n/**\n * Drops the email auth factor for `did` unconditionally.\n *\n * For the paths where the account's own state makes the factor invalid rather\n * than the user asking to turn it off: an email change (2FA on an unconfirmed\n * address can lock the user out) and account deletion. Callers changing the\n * email must do so in the same transaction as the email write, since the two\n * are no longer one row.\n *\n * TODO: Store unconfirmed emails separately, see note in context.ts — at which\n * point changing an email no longer needs to disable 2FA at all.\n */\nexport const deleteForDid = async (\n  db: AccountDb,\n  did: string,\n): Promise<void> => {\n  await db.executeWithRetry(\n    db.db.deleteFrom('account_email_auth_factor').where('did', '=', did),\n  )\n}\n"]}

package/dist/account-manager/helpers/invite.d.ts

@@ -17,6 +17,7 @@ export declare const ensureInviteIsAvailable: (db: AccountDb, inviteCode: string
 export declare const selectInviteCodesQb: (db: AccountDb) => import("kysely").SelectQueryBuilder<{
     account: import("../db/index.js").Account;
     account_device: import("../db/index.js").AccountDevice;
+    account_email_auth_factor: import("../db/schema/account-email-auth-factor.js").AccountEmailAuthFactor;
     actor: import("../db/index.js").Actor;
     app_password: import("../db/index.js").AppPassword;
     authorization_request: import("../db/index.js").AuthorizationRequest;

package/dist/account-manager/helpers/invite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/invite.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAGrB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3D,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAA;AAC3D,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;AAE3D,eAAO,MAAM,iBAAiB,OACxB,SAAS,YACH;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,YACtC,MAAM,kBAkBjB,CAAA;AAED,eAAO,MAAM,wBAAwB,OAC/B,SAAS,cACD,MAAM,SACX,MAAM,EAAE,iBACA,MAAM,YACX,CAAC,GAAG,CAAC,KACd,OAAO,CAAC,UAAU,EAAE,CA+BtB,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,QACP;IACJ,GAAG,EAAE,SAAS,CAAA;IACd,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;CACpB,kBAUF,CAAA;AAED,eAAO,MAAM,uBAAuB,OAC9B,SAAS,cACD,MAAM,KACjB,OAAO,CAAC,IAAI,CA4Bd,CAAA;AAED,eAAO,MAAM,mBAAmB,OAAQ,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBhD,CAAA;AAED,eAAO,MAAM,sBAAsB,OAC7B,SAAS,QACP,MAAM,EAAE,KACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAqBnC,CAAA;AAED,eAAO,MAAM,kBAAkB,OACzB,SAAS,SACN,MAAM,EAAE,KACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAgBnC,CAAA;AAED,eAAO,MAAM,uBAAuB,OAC9B,SAAS,QACP,SAAS,EAAE,KAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAiCpC,CAAA;AAED,eAAO,MAAM,kBAAkB,OACzB,SAAS,QACP;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,kBAmB9C,CAAA;AAED,eAAO,MAAM,yBAAyB,OAChC,SAAS,OACR,SAAS,YACJ,OAAO,kBAQlB,CAAA"}
+{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/invite.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAGrB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3D,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAA;AAC3D,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;AAE3D,eAAO,MAAM,iBAAiB,OACxB,SAAS,YACH;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,YACtC,MAAM,kBAkBjB,CAAA;AAED,eAAO,MAAM,wBAAwB,OAC/B,SAAS,cACD,MAAM,SACX,MAAM,EAAE,iBACA,MAAM,YACX,CAAC,GAAG,CAAC,KACd,OAAO,CAAC,UAAU,EAAE,CA+BtB,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,QACP;IACJ,GAAG,EAAE,SAAS,CAAA;IACd,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;CACpB,kBAUF,CAAA;AAED,eAAO,MAAM,uBAAuB,OAC9B,SAAS,cACD,MAAM,KACjB,OAAO,CAAC,IAAI,CA4Bd,CAAA;AAED,eAAO,MAAM,mBAAmB,OAAQ,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBhD,CAAA;AAED,eAAO,MAAM,sBAAsB,OAC7B,SAAS,QACP,MAAM,EAAE,KACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAqBnC,CAAA;AAED,eAAO,MAAM,kBAAkB,OACzB,SAAS,SACN,MAAM,EAAE,KACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAgBnC,CAAA;AAED,eAAO,MAAM,uBAAuB,OAC9B,SAAS,QACP,SAAS,EAAE,KAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAiCpC,CAAA;AAED,eAAO,MAAM,kBAAkB,OACzB,SAAS,QACP;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,kBAmB9C,CAAA;AAED,eAAO,MAAM,yBAAyB,OAChC,SAAS,OACR,SAAS,YACJ,OAAO,kBAQlB,CAAA"}

package/dist/account-manager/helpers/token.d.ts

@@ -16,6 +16,7 @@ export declare const findByQB: (db: AccountDb, search: {
 }) => import("kysely").SelectQueryBuilder<{
     account: import("kysely").Nullable<import("../db/index.js").Account>;
     account_device: import("../db/index.js").AccountDevice;
+    account_email_auth_factor: import("kysely").Nullable<import("../db/schema/account-email-auth-factor.js").AccountEmailAuthFactor>;
     actor: import("../db/index.js").Actor;
     app_password: import("../db/index.js").AppPassword;
     authorization_request: import("../db/index.js").AuthorizationRequest;
@@ -29,12 +30,13 @@ export declare const findByQB: (db: AccountDb, search: {
     repo_root: import("../db/index.js").RepoRoot;
     token: Token;
     used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor" | "token", Partial<Omit<unknown, never>> & {
+}, "account" | "account_email_auth_factor" | "actor" | "token", Partial<Omit<unknown, never>> & {
     createdAt: string;
     deactivatedAt: string | null;
     deleteAfter: string | null;
     did: `did:${string}:${string}`;
     email: string | null;
+    emailAuthFactorAt: import("@atproto/syntax").DatetimeString | null;
     emailConfirmedAt: import("@atproto/syntax").DatetimeString | null;
     handle: `${string}.${string}` | null;
     invitesDisabled: 0 | 1 | null;
@@ -91,7 +93,7 @@ export declare const findByQB: (db: AccountDb, search: {
     scope: string | null;
     tokenId: `tok-${string}`;
     updatedAt: `${string}T${string}Z`;
-} & Partial<Omit<unknown, "clientAuth" | "clientId" | "code" | "createdAt" | "currentRefreshToken" | "deactivatedAt" | "deleteAfter" | "details" | "deviceId" | "did" | "email" | "emailConfirmedAt" | "expiresAt" | "handle" | "id" | "invitesDisabled" | "parameters" | "scope" | "takedownRef" | "tokenId" | "updatedAt">>>;
+} & Partial<Omit<unknown, "clientAuth" | "clientId" | "code" | "createdAt" | "currentRefreshToken" | "deactivatedAt" | "deleteAfter" | "details" | "deviceId" | "did" | "email" | "emailAuthFactorAt" | "emailConfirmedAt" | "expiresAt" | "handle" | "id" | "invitesDisabled" | "parameters" | "scope" | "takedownRef" | "tokenId" | "updatedAt">>>;
 export declare const removeByDid: (db: AccountDb, did: Did) => Promise<void>;
 export declare const rotateQB: (db: AccountDb, id: number, newTokenId: TokenId, newRefreshToken: RefreshToken, newData: NewTokenData) => import("kysely").UpdateQueryBuilder<import("../db/index.js").DatabaseSchema, "token", "token", import("kysely").UpdateResult>;
 export declare const removeQB: (db: AccountDb, tokenId: TokenId) => import("kysely").DeleteQueryBuilder<import("../db/index.js").DatabaseSchema, "token", import("kysely").DeleteResult>;

package/dist/account-manager/helpers/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EACV,IAAI,EACJ,GAAG,EACH,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,OAAO,EACR,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAGtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAa7D;AAuBD,eAAO,MAAM,QAAQ,OACf,SAAS,WACJ,OAAO,QACV,SAAS,iBACA,YAAY,yHAiB5B,CAAA;AAED,eAAO,MAAM,WAAW,OAAQ,SAAS,MAAM,OAAO;;;EAKZ,CAAA;AAE1C,eAAO,MAAM,QAAQ,OACf,SAAS,UACL;IACN,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,mBAAmB,CAAC,EAAE,YAAY,CAAA;CACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8TAoCF,CAAA;AAED,eAAO,MAAM,WAAW,OAAc,SAAS,OAAO,GAAG,kBAOxD,CAAA;AAED,eAAO,MAAM,QAAQ,OACf,SAAS,MACT,MAAM,cACE,OAAO,mBACF,YAAY,WACpB,YAAY,kIAcE,CAAA;AAEzB,eAAO,MAAM,QAAQ,OAAQ,SAAS,WAAW,OAAO,yHAEE,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EACV,IAAI,EACJ,GAAG,EACH,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,OAAO,EACR,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAGtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAa7D;AAuBD,eAAO,MAAM,QAAQ,OACf,SAAS,WACJ,OAAO,QACV,SAAS,iBACA,YAAY,yHAiB5B,CAAA;AAED,eAAO,MAAM,WAAW,OAAQ,SAAS,MAAM,OAAO;;;EAKZ,CAAA;AAE1C,eAAO,MAAM,QAAQ,OACf,SAAS,UACL;IACN,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,mBAAmB,CAAC,EAAE,YAAY,CAAA;CACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oVAoCF,CAAA;AAED,eAAO,MAAM,WAAW,OAAc,SAAS,OAAO,GAAG,kBAOxD,CAAA;AAED,eAAO,MAAM,QAAQ,OACf,SAAS,MACT,MAAM,cACE,OAAO,mBACF,YAAY,WACpB,YAAY,kIAcE,CAAA;AAEzB,eAAO,MAAM,QAAQ,OAAQ,SAAS,WAAW,OAAO,yHAEE,CAAA"}

package/dist/account-manager/oauth-store.d.ts

@@ -1,7 +1,7 @@
 import { type Client } from '@did-plc/lib';
 import { type Keypair } from '@atproto/crypto';
 import { type HandleString } from '@atproto/lex';
-import type { Account, AccountStore, AuthenticateAccountData, AuthorizedClientData, AuthorizedClients, ClientId, Code, DeactivateAccountData, DeleteAccountConfirmInput, DeleteAccountRequestInput, DeviceAccount, DeviceData, DeviceId, DeviceStore, Did, FoundRequestResult, LexiconData, LexiconStore, NewTokenData, ReactivateAccountData, RefreshToken, RequestData, RequestId, RequestStore, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, TokenData, TokenId, TokenInfo, TokenStore, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateEmailRequestOutput, UpdateHandleData, UpdateRequestData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from '@atproto/oauth-provider/store';
+import type { Account, AccountStore, AuthenticateAccountData, AuthorizedClientData, AuthorizedClients, ClientId, Code, DeactivateAccountData, DeleteAccountConfirmInput, DeleteAccountRequestInput, DeviceAccount, DeviceData, DeviceId, DeviceStore, Did, DisableEmailAuthFactorInput, EnableEmailAuthFactorInput, FoundRequestResult, LexiconData, LexiconStore, NewTokenData, ReactivateAccountData, RefreshToken, RequestData, RequestId, RequestStore, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, TokenData, TokenId, TokenInfo, TokenStore, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateEmailRequestOutput, UpdateHandleData, UpdateRequestData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from '@atproto/oauth-provider/store';
 import type { ActorStore } from '../actor-store/actor-store.js';
 import type { BackgroundQueue } from '../background.js';
 import type { ImageUrlBuilder } from '../image/image-url-builder.js';
@@ -31,7 +31,7 @@ export declare class OAuthStore implements AccountStore, RequestStore, DeviceSto
     private verifyEmailAvailability;
     private verifyInviteCode;
     createAccount({ locale: _locale, inviteCode, handle, email, password, }: SignUpData): Promise<Account>;
-    authenticateAccount({ locale: _locale, username: identifier, password, emailOtp, }: AuthenticateAccountData): Promise<Account>;
+    authenticateAccount({ locale, username: identifier, password, emailOtp, }: AuthenticateAccountData): Promise<Account>;
     setAuthorizedClient(did: Did, clientId: ClientId, data: AuthorizedClientData): Promise<void>;
     getAccount(did: Did): Promise<{
         account: Account;
@@ -71,6 +71,8 @@ export declare class OAuthStore implements AccountStore, RequestStore, DeviceSto
     verifyEmailConfirm({ did, email, token, }: VerifyEmailConfirmInput): Promise<Account | null>;
     updateEmailRequest({ did, locale, }: UpdateEmailRequestInput): Promise<UpdateEmailRequestOutput>;
     updateEmailConfirm({ did, token, email, locale, }: UpdateEmailConfirmInput): Promise<Account | null>;
+    enableEmailAuthFactor({ did, }: EnableEmailAuthFactorInput): Promise<Account>;
+    disableEmailAuthFactor({ did, token, locale, }: DisableEmailAuthFactorInput): Promise<Account>;
     updateHandle({ did, handle }: UpdateHandleData): Promise<Account>;
     deactivateAccount({ did, deleteAfter, }: DeactivateAccountData): Promise<Account>;
     reactivateAccount({ did }: ReactivateAccountData): Promise<Account>;

package/dist/account-manager/oauth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../src/account-manager/oauth-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAA2B,MAAM,cAAc,CAAA;AAEnE,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,cAAc,CAAA;AAMrB,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,QAAQ,EACR,IAAI,EACJ,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,EACX,GAAG,EACH,kBAAkB,EAElB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,SAAS,EACT,OAAO,EACP,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,+BAA+B,CAAA;AAKtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAA;AAWhF;;;;;GAKG;AACH,qBAAa,UACX,YAAW,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU;IAG1E,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAVjC,YACmB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,OAAO,EACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC5C;IAEJ,OAAO,KAAK,EAAE,GAIb;IAED,OAAO,KAAK,UAAU,GAErB;YAEa,uBAAuB;YAavB,gBAAgB;IAexB,aAAa,CAAC,EAClB,MAAM,EAAE,OAAO,EACf,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,GACT,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAmG/B;IAEK,mBAAmB,CAAC,EACxB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAER,QAAoB,GACrB,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC5C;IAEK,mBAAmB,CACvB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;IAEK,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;QAClC,OAAO,EAAE,OAAO,CAAA;QAChB,iBAAiB,EAAE,iBAAiB,CAAA;KACrC,CAAC,CAeD;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE;IAEK,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAkB/B;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;IAEK,kBAAkB,CACtB,MAAM,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B1B;IAEK,oBAAoB,CAAC,EACzB,KAAK,EACL,MAAM,GACP,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBrD;IAEK,oBAAoB,CACxB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;IAEK,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBlE;IAIK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;IAEK,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAe5D;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAEK,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAKvE;IAIK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAEK,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,CAG/D;IAEK,YAAY,CAChB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpD;IAIK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAE3D;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAIK,WAAW,CACf,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf;IAEK,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAGtD;IAEK,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAK3D;IAEK,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjD;IAEK,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAW3B;IAEK,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzC;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,GACN,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAYnD;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAE7D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,EACL,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAenD;IAEK,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtE;IAEK,iBAAiB,CAAC,EACtB,GAAG,EACH,WAAW,GACZ,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1C;IAEK,iBAAiB,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxE;IAEK,oBAAoB,CAAC,EACzB,GAAG,EACH,MAAM,GACP,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3C;IAEK,oBAAoB,CAAC,EACzB,GAAG,EACH,KAAK,EACL,QAAQ,GACT,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC3C;YAEa,WAAW;YAWX,YAAY;CAkC3B"}
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../src/account-manager/oauth-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAA2B,MAAM,cAAc,CAAA;AAEnE,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,iBAAiB,CAAA;AAChE,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,cAAc,CAAA;AAOrB,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,QAAQ,EACR,IAAI,EACJ,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,EACX,GAAG,EACH,2BAA2B,EAC3B,0BAA0B,EAC1B,kBAAkB,EAElB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,SAAS,EACT,OAAO,EACP,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,+BAA+B,CAAA;AAKtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAA;AAW7B;;;;;GAKG;AACH,qBAAa,UACX,YAAW,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU;IAG1E,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAVjC,YACmB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,OAAO,EACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC5C;IAEJ,OAAO,KAAK,EAAE,GAIb;IAED,OAAO,KAAK,UAAU,GAErB;YAEa,uBAAuB;YAavB,gBAAgB;IAexB,aAAa,CAAC,EAClB,MAAM,EAAE,OAAO,EACf,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,GACT,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAmG/B;IAEK,mBAAmB,CAAC,EACxB,MAAM,EACN,QAAQ,EAAE,UAAU,EACpB,QAAQ,EACR,QAAQ,GACT,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CA4C5C;IAEK,mBAAmB,CACvB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;IAEK,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;QAClC,OAAO,EAAE,OAAO,CAAA;QAChB,iBAAiB,EAAE,iBAAiB,CAAA;KACrC,CAAC,CAeD;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE;IAEK,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAkB/B;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;IAEK,kBAAkB,CACtB,MAAM,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B1B;IAEK,oBAAoB,CAAC,EACzB,KAAK,EACL,MAAM,GACP,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBrD;IAEK,oBAAoB,CACxB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;IAEK,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBlE;IAIK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;IAEK,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAe5D;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAEK,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAKvE;IAIK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAEK,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,CAG/D;IAEK,YAAY,CAChB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpD;IAIK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAE3D;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAIK,WAAW,CACf,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf;IAEK,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAGtD;IAEK,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAK3D;IAEK,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjD;IAEK,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAW3B;IAEK,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzC;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,GACN,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAYnD;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAE7D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,EACL,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAenD;IAEK,qBAAqB,CAAC,EAC1B,GAAG,GACJ,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC,CAY/C;IAEK,sBAAsB,CAAC,EAC3B,GAAG,EACH,KAAK,EACL,MAAM,GACP,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBhD;IAEK,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtE;IAEK,iBAAiB,CAAC,EACtB,GAAG,EACH,WAAW,GACZ,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1C;IAEK,iBAAiB,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxE;IAEK,oBAAoB,CAAC,EACzB,GAAG,EACH,MAAM,GACP,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3C;IAEK,oBAAoB,CAAC,EACzB,GAAG,EACH,KAAK,EACL,QAAQ,GACT,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC3C;YAEa,WAAW;YAWX,YAAY;CAmC3B"}

package/dist/account-manager/oauth-store.js

@@ -2,11 +2,11 @@ import assert from 'node:assert';
 import { createOp as createPlcOp } from '@did-plc/lib';
 import { Secp256k1Keypair } from '@atproto/crypto';
 import { getBlobCidString, } from '@atproto/lex';
-import { HandleUnavailableError, InvalidCredentialsError, InvalidRequestError, } from '@atproto/oauth-provider/errors';
+import { HandleUnavailableError, InvalidCredentialsError, InvalidRequestError, SecondAuthenticationFactorRequiredError, } from '@atproto/oauth-provider/errors';
 import { AuthRequiredError as XrpcAuthRequiredError, InvalidRequestError as XrpcInvalidRequestError, } from '@atproto/xrpc-server';
 import { fromDateISO } from '../db/index.js';
 import { dbLogger } from '../logger.js';
-import { InvalidPasswordError } from './account-manager.js';
+import { AuthFactorRequiredError, InvalidPasswordError, } from './account-manager.js';
 import * as accountDeviceHelper from './helpers/account-device.js';
 import { UserAlreadyExistsError } from './helpers/account.js';
 import * as authRequestHelper from './helpers/authorization-request.js';
@@ -151,16 +151,15 @@ export class OAuthStore {
             throw err;
         }
     }
-    async authenticateAccount({ locale: _locale, username: identifier, password, 
-    // Not supported by the PDS (yet?)
-    emailOtp = undefined, }) {
+    async authenticateAccount({ locale, username: identifier, password, emailOtp, }) {
         // @TODO (?) Send an email to the user to notify them of the login attempt
         try {
-            // Should never happen
-            if (emailOtp != null) {
-                throw new Error('Email OTP is not supported');
-            }
-            const { user, appPassword, isSoftDeleted } = await this.accountManager.login({ identifier, password });
+            const { user, appPassword, isSoftDeleted } = await this.accountManager.login({
+                identifier,
+                password,
+                authFactorToken: emailOtp,
+                locale,
+            });
             if (isSoftDeleted) {
                 throw new InvalidRequestError('Account was taken down');
             }
@@ -170,13 +169,20 @@ export class OAuthStore {
             return this.buildAccount(user);
         }
         catch (err) {
-            // `InvalidPasswordError` is a subclass of `XrpcAuthRequiredError`,
-            // so it must be checked first. Surfacing the matched `did` as the
-            // `sub` lets the oauth-provider's `onSignInFailed` hook distinguish
-            // "identifier known, credentials wrong" from "identifier unknown".
+            // `InvalidPasswordError` and `AuthFactorRequiredError` are both
+            // subclasses of `XrpcAuthRequiredError`, so both must be checked first.
             if (err instanceof InvalidPasswordError) {
+                // Surfacing the matched `did` as the `sub` lets the oauth-provider's
+                // `onSignInFailed` hook distinguish "identifier known, credentials wrong"
+                // from "identifier unknown".
                 throw new InvalidCredentialsError(err.message, err.did, err);
             }
+            // @NOTE The credentials were valid here — the account simply owes a
+            // second factor, and `login()` has already sent the code. This is the
+            // XRPC → OAuth translation that keeps `AccountManager` OAuth-free.
+            if (err instanceof AuthFactorRequiredError) {
+                throw new SecondAuthenticationFactorRequiredError(err.factor, err.hint, err);
+            }
             if (err instanceof XrpcAuthRequiredError) {
                 throw new InvalidCredentialsError(err.message, undefined, err);
             }
@@ -449,6 +455,33 @@ export class OAuthStore {
             throw cause;
         }
     }
+    async enableEmailAuthFactor({ did, }) {
+        try {
+            const account = await this.accountManager.enableEmailAuthFactor({ did });
+            return this.buildAccount(account);
+        }
+        catch (err) {
+            if (err instanceof XrpcInvalidRequestError) {
+                throw new InvalidRequestError(err.message, err);
+            }
+            throw err;
+        }
+    }
+    async disableEmailAuthFactor({ did, token, locale, }) {
+        const account = await this.accountManager
+            .disableEmailAuthFactor({ did, token, locale })
+            .catch((err) => {
+            if (err instanceof XrpcInvalidRequestError) {
+                if (err.error === 'TokenRequired') {
+                    throw new SecondAuthenticationFactorRequiredError('emailOtp', '***', err.message);
+                }
+                throw new InvalidRequestError(err.message, err);
+            }
+            // Unexpected error (should not happen)
+            throw err;
+        });
+        return this.buildAccount(account);
+    }
     async updateHandle({ did, handle }) {
         try {
             const account = await this.accountManager.updateHandle(did, handle);
@@ -536,6 +569,7 @@ export class OAuthStore {
             pds: this.serviceDid,
             email: row.email || undefined,
             emailVerified: row.email ? row.emailConfirmedAt != null : undefined,
+            emailAuthFactor: row.email ? row.emailAuthFactorAt != null : undefined,
             handle: row.handle || undefined,
             deactivated: row.deactivatedAt != null,
         };