@atproto/pds 0.5.35 → 0.5.37

package/dist/actor-store/actor-store.js

@@ -1,3 +1,55 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 import assert from 'node:assert';
 import fs, { mkdir } from 'node:fs/promises';
 import path from 'node:path';
@@ -45,41 +97,77 @@ export class ActorStore {
             await retrySqlite(() => db.db.selectFrom('repo_root').selectAll().execute());
         }
         catch (err) {
-            db.close();
+            await db.close();
             throw err;
         }
         return db;
     }
     async read(did, fn) {
-        const db = await this.openDb(did);
+        const env_1 = { stack: [], error: void 0, hasError: false };
         try {
+            const db = __addDisposableResource(env_1, await this.openDb(did), true);
             const getKeypair = () => this.keypair(did);
-            return await fn(new ActorStoreReader(did, db, this.resources, getKeypair));
+            const reader = __addDisposableResource(env_1, new ActorStoreReader(did, db, this.resources, getKeypair), true);
+            return await fn(reader);
+        }
+        catch (e_1) {
+            env_1.error = e_1;
+            env_1.hasError = true;
         }
         finally {
-            db.close();
+            const result_1 = __disposeResources(env_1);
+            if (result_1)
+                await result_1;
         }
     }
     async transact(did, fn) {
-        const keypair = await this.keypair(did);
-        const db = await this.openDb(did);
+        const env_2 = { stack: [], error: void 0, hasError: false };
         try {
-            return await db.transaction((dbTxn) => {
-                return fn(new ActorStoreTransactor(did, dbTxn, keypair, this.resources));
+            const keypair = await this.keypair(did);
+            const db = __addDisposableResource(env_2, await this.openDb(did), true);
+            return await db.transaction(async (dbTxn) => {
+                const env_3 = { stack: [], error: void 0, hasError: false };
+                try {
+                    const transactor = __addDisposableResource(env_3, new ActorStoreTransactor(did, dbTxn, keypair, this.resources), true);
+                    return await fn(transactor);
+                }
+                catch (e_3) {
+                    env_3.error = e_3;
+                    env_3.hasError = true;
+                }
+                finally {
+                    const result_3 = __disposeResources(env_3);
+                    if (result_3)
+                        await result_3;
+                }
             });
         }
+        catch (e_2) {
+            env_2.error = e_2;
+            env_2.hasError = true;
+        }
         finally {
-            db.close();
+            const result_2 = __disposeResources(env_2);
+            if (result_2)
+                await result_2;
         }
     }
     async writeNoTransaction(did, fn) {
-        const keypair = await this.keypair(did);
-        const db = await this.openDb(did);
+        const env_4 = { stack: [], error: void 0, hasError: false };
         try {
-            return await fn(new ActorStoreWriter(did, db, keypair, this.resources));
+            const keypair = await this.keypair(did);
+            const db = __addDisposableResource(env_4, await this.openDb(did), true);
+            const writer = __addDisposableResource(env_4, new ActorStoreWriter(did, db, keypair, this.resources), true);
+            return await fn(writer);
+        }
+        catch (e_4) {
+            env_4.error = e_4;
+            env_4.hasError = true;
         }
         finally {
-            db.close();
+            const result_4 = __disposeResources(env_4);
+            if (result_4)
+                await result_4;
         }
     }
     async create(did, keypair) {
@@ -99,22 +187,34 @@ export class ActorStore {
             await migrator.migrateToLatestOrThrow();
         }
         finally {
-            db.close();
+            await db.close();
         }
     }
     async destroy(did) {
-        const blobstore = this.resources.blobstore(did);
-        if (blobstore instanceof DiskBlobStore) {
-            await blobstore.deleteAll();
-        }
-        else {
-            const cids = await this.read(did, async (store) => store.repo.blob.getBlobCids());
-            await blobstore.deleteMany(cids).catch((err) => {
-                blobStoreLogger.error({ did, cids, err }, 'Failed to delete blobs');
-            });
+        const env_5 = { stack: [], error: void 0, hasError: false };
+        try {
+            const blobstore = __addDisposableResource(env_5, this.resources.blobstore(did), true);
+            if (blobstore instanceof DiskBlobStore) {
+                await blobstore.deleteAll();
+            }
+            else {
+                const cids = await this.read(did, async (store) => store.repo.blob.getBlobCids());
+                await blobstore.deleteMany(cids).catch((err) => {
+                    blobStoreLogger.error({ did, cids, err }, 'Failed to delete blobs');
+                });
+            }
+            const { directory } = await this.getLocation(did);
+            await rmIfExists(directory, true);
+        }
+        catch (e_5) {
+            env_5.error = e_5;
+            env_5.hasError = true;
+        }
+        finally {
+            const result_5 = __disposeResources(env_5);
+            if (result_5)
+                await result_5;
         }
-        const { directory } = await this.getLocation(did);
-        await rmIfExists(directory, true);
     }
     async reserveKeypair(did) {
         let keyLoc;

package/dist/actor-store/actor-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"actor-store.js","sourceRoot":"","sources":["../../src/actor-store/actor-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AAGzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAgB,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhE,MAAM,OAAO,UAAU;IAGrB,YACS,GAAqB,EACrB,SAA8B;mBAD9B,GAAG;yBACH,SAAS;QAEhB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC/C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC9C,OAAO,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;QAE/D,4FAA4F;QAC5F,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CACpD,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,KAAK,EAAE,CAAA;YACV,MAAM,GAAG,CAAA;QACX,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAc,EACd,EAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,OAAO,MAAM,EAAE,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;QAC5E,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,GAAc,EACd,EAAoD;QAEpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpC,OAAO,EAAE,CAAC,IAAI,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC1E,CAAC,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,EAAgD;QAEhD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QACzE,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAA0B;QAClD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC1E,uBAAuB;QACvB,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;QACtC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAExC,MAAM,EAAE,GAAY,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,EAAE,CAAA;YACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,CAAC,sBAAsB,EAAE,CAAA;QACzC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAc;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,SAAS,YAAY,aAAa,EAAE,CAAC;YACvC,MAAM,SAAS,CAAC,SAAS,EAAE,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAC9B,CAAA;YACD,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7C,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAY;QAC/B,IAAI,MAA0B,CAAA;QAC9B,IAAI,GAAG,EAAE,CAAC;YACR,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;YAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAA;YACvB,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACzD,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAClD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,eAAuB;QAEvB,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,GAAY;QACrD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,EAAc;QAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC5C,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAA0C,EAAE;IAC5E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,OAAO,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,CACJ,IAAI,KAAK,UAAU;QACjB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACtB,qBAAqB,IAAI,EAAE,CAC5B,CAAA;AACH,CAAC","sourcesContent":["import assert from 'node:assert'\nimport fs, { mkdir } from 'node:fs/promises'\nimport path from 'node:path'\nimport { fileExists, readIfExists, rmIfExists } from '@atproto/common'\nimport * as crypto from '@atproto/crypto'\nimport type { ExportableKeypair, Keypair } from '@atproto/crypto'\nimport type { DidString } from '@atproto/lex'\nimport { InvalidRequestError } from '@atproto/xrpc-server'\nimport type { ActorStoreConfig } from '../config/index.js'\nimport { retrySqlite } from '../db/index.js'\nimport { DiskBlobStore } from '../disk-blobstore.js'\nimport { blobStoreLogger } from '../logger.js'\nimport { ActorStoreReader } from './actor-store-reader.js'\nimport type { ActorStoreResources } from './actor-store-resources.js'\nimport { ActorStoreTransactor } from './actor-store-transactor.js'\nimport { ActorStoreWriter } from './actor-store-writer.js'\nimport { type ActorDb, getDb, getMigrator } from './db/index.js'\n\nexport class ActorStore {\n  reservedKeyDir: string\n\n  constructor(\n    public cfg: ActorStoreConfig,\n    public resources: ActorStoreResources,\n  ) {\n    this.reservedKeyDir = path.join(cfg.directory, 'reserved_keys')\n  }\n\n  async getLocation(did: string) {\n    const didHash = await crypto.sha256Hex(did)\n    const directory = path.join(this.cfg.directory, didHash.slice(0, 2), did)\n    const dbLocation = path.join(directory, `store.sqlite`)\n    const keyLocation = path.join(directory, `key`)\n    return { directory, dbLocation, keyLocation }\n  }\n\n  async exists(did: string): Promise<boolean> {\n    const location = await this.getLocation(did)\n    return await fileExists(location.dbLocation)\n  }\n\n  async keypair(did: string): Promise<Keypair> {\n    const { keyLocation } = await this.getLocation(did)\n    const privKey = await fs.readFile(keyLocation)\n    return crypto.Secp256k1Keypair.import(privKey)\n  }\n\n  async openDb(did: string): Promise<ActorDb> {\n    const { dbLocation } = await this.getLocation(did)\n    const exists = await fileExists(dbLocation)\n    if (!exists) {\n      throw new InvalidRequestError('Repo not found', 'NotFound')\n    }\n\n    const db = getDb(dbLocation, this.cfg.disableWalAutoCheckpoint)\n\n    // run a simple select with retry logic to ensure the db is ready (not in wal recovery mode)\n    try {\n      await retrySqlite(() =>\n        db.db.selectFrom('repo_root').selectAll().execute(),\n      )\n    } catch (err) {\n      db.close()\n      throw err\n    }\n\n    return db\n  }\n\n  async read<T>(\n    did: DidString,\n    fn: (fn: ActorStoreReader) => T | PromiseLike<T>,\n  ) {\n    const db = await this.openDb(did)\n    try {\n      const getKeypair = () => this.keypair(did)\n      return await fn(new ActorStoreReader(did, db, this.resources, getKeypair))\n    } finally {\n      db.close()\n    }\n  }\n\n  async transact<T>(\n    did: DidString,\n    fn: (fn: ActorStoreTransactor) => T | PromiseLike<T>,\n  ) {\n    const keypair = await this.keypair(did)\n    const db = await this.openDb(did)\n    try {\n      return await db.transaction((dbTxn) => {\n        return fn(new ActorStoreTransactor(did, dbTxn, keypair, this.resources))\n      })\n    } finally {\n      db.close()\n    }\n  }\n\n  async writeNoTransaction<T>(\n    did: DidString,\n    fn: (fn: ActorStoreWriter) => T | PromiseLike<T>,\n  ) {\n    const keypair = await this.keypair(did)\n    const db = await this.openDb(did)\n    try {\n      return await fn(new ActorStoreWriter(did, db, keypair, this.resources))\n    } finally {\n      db.close()\n    }\n  }\n\n  async create(did: string, keypair: ExportableKeypair) {\n    const { directory, dbLocation, keyLocation } = await this.getLocation(did)\n    // ensure subdir exists\n    await mkdir(directory, { recursive: true })\n    const exists = await fileExists(dbLocation)\n    if (exists) {\n      throw new InvalidRequestError('Repo already exists', 'AlreadyExists')\n    }\n    const privKey = await keypair.export()\n    await fs.writeFile(keyLocation, privKey)\n\n    const db: ActorDb = getDb(dbLocation, this.cfg.disableWalAutoCheckpoint)\n    try {\n      await db.ensureWal()\n      const migrator = getMigrator(db)\n      await migrator.migrateToLatestOrThrow()\n    } finally {\n      db.close()\n    }\n  }\n\n  async destroy(did: DidString) {\n    const blobstore = this.resources.blobstore(did)\n    if (blobstore instanceof DiskBlobStore) {\n      await blobstore.deleteAll()\n    } else {\n      const cids = await this.read(did, async (store) =>\n        store.repo.blob.getBlobCids(),\n      )\n      await blobstore.deleteMany(cids).catch((err) => {\n        blobStoreLogger.error({ did, cids, err }, 'Failed to delete blobs')\n      })\n    }\n\n    const { directory } = await this.getLocation(did)\n    await rmIfExists(directory, true)\n  }\n\n  async reserveKeypair(did?: string): Promise<string> {\n    let keyLoc: string | undefined\n    if (did) {\n      assertSafePathPart(did)\n      keyLoc = path.join(this.reservedKeyDir, did)\n      const maybeKey = await loadKey(keyLoc)\n      if (maybeKey) {\n        return maybeKey.did()\n      }\n    }\n    const keypair = await crypto.Secp256k1Keypair.create({ exportable: true })\n    const keyDid = keypair.did()\n    keyLoc = keyLoc ?? path.join(this.reservedKeyDir, keyDid)\n    await mkdir(this.reservedKeyDir, { recursive: true })\n    await fs.writeFile(keyLoc, await keypair.export())\n    return keyDid\n  }\n\n  async getReservedKeypair(\n    signingKeyOrDid: string,\n  ): Promise<ExportableKeypair | undefined> {\n    return loadKey(path.join(this.reservedKeyDir, signingKeyOrDid))\n  }\n\n  async clearReservedKeypair(keyDid: string, did?: string) {\n    await rmIfExists(path.join(this.reservedKeyDir, keyDid))\n    if (did) {\n      await rmIfExists(path.join(this.reservedKeyDir, did))\n    }\n  }\n\n  async storePlcOp(did: string, op: Uint8Array) {\n    const { directory } = await this.getLocation(did)\n    const opLoc = path.join(directory, `did-op`)\n    await fs.writeFile(opLoc, op)\n  }\n\n  async getPlcOp(did: string): Promise<Uint8Array> {\n    const { directory } = await this.getLocation(did)\n    const opLoc = path.join(directory, `did-op`)\n    return await fs.readFile(opLoc)\n  }\n\n  async clearPlcOp(did: string) {\n    const { directory } = await this.getLocation(did)\n    const opLoc = path.join(directory, `did-op`)\n    await rmIfExists(opLoc)\n  }\n}\n\nconst loadKey = async (loc: string): Promise<ExportableKeypair | undefined> => {\n  const privKey = await readIfExists(loc)\n  if (!privKey) return undefined\n  return crypto.Secp256k1Keypair.import(privKey, { exportable: true })\n}\n\nfunction assertSafePathPart(part: string) {\n  const normalized = path.normalize(part)\n  assert(\n    part === normalized &&\n      !part.startsWith('.') &&\n      !part.includes('/') &&\n      !part.includes('\\\\'),\n    `unsafe path part: ${part}`,\n  )\n}\n"]}
+{"version":3,"file":"actor-store.js","sourceRoot":"","sources":["../../src/actor-store/actor-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AAGzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAgB,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhE,MAAM,OAAO,UAAU;IAGrB,YACS,GAAqB,EACrB,SAA8B;mBAD9B,GAAG;yBACH,SAAS;QAEhB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC/C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC9C,OAAO,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;QAE/D,4FAA4F;QAC5F,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CACpD,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;YAChB,MAAM,GAAG,CAAA;QACX,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CACR,GAAc,EACd,EAAgD;;;YAEhD,MAAY,EAAE,kCAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAA,CAAA;YACvC,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAY,MAAM,kCAAG,IAAI,gBAAgB,CACvC,GAAG,EACH,EAAE,EACF,IAAI,CAAC,SAAS,EACd,UAAU,CACX,OAAA,CAAA;YACD,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;;;;;;;;;;;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,GAAc,EACd,EAA4D;;;YAE5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACvC,MAAY,EAAE,kCAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAA,CAAA;YACvC,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;;;oBAC1C,MAAY,UAAU,kCAAG,IAAI,oBAAoB,CAC/C,GAAG,EACH,KAAK,EACL,OAAO,EACP,IAAI,CAAC,SAAS,CACf,OAAA,CAAA;oBACD,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAA;;;;;;;;;;;YAC7B,CAAC,CAAC,CAAA;;;;;;;;;;;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,GAAc,EACd,EAAoD;;;YAEpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACvC,MAAY,EAAE,kCAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAA,CAAA;YACvC,MAAY,MAAM,kCAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAA,CAAA;YAC3E,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;;;;;;;;;;;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAA0B;QAClD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC1E,uBAAuB;QACvB,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;QACtC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAExC,MAAM,EAAE,GAAY,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,EAAE,CAAA;YACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,QAAQ,CAAC,sBAAsB,EAAE,CAAA;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAc;;;YAC1B,MAAY,SAAS,kCAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAA,CAAA;YACrD,IAAI,SAAS,YAAY,aAAa,EAAE,CAAC;gBACvC,MAAM,SAAS,CAAC,SAAS,EAAE,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAChD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAC9B,CAAA;gBACD,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC7C,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAA;gBACrE,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YACjD,MAAM,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;;;;;;;;;;;IACnC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAY;QAC/B,IAAI,MAA0B,CAAA;QAC9B,IAAI,GAAG,EAAE,CAAC;YACR,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;YAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAA;YACvB,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACzD,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAClD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,eAAuB;QAEvB,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,GAAY;QACrD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,EAAc;QAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC5C,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;CACF;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAA0C,EAAE;IAC5E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,OAAO,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,CACJ,IAAI,KAAK,UAAU;QACjB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EACtB,qBAAqB,IAAI,EAAE,CAC5B,CAAA;AACH,CAAC","sourcesContent":["import assert from 'node:assert'\nimport fs, { mkdir } from 'node:fs/promises'\nimport path from 'node:path'\nimport { fileExists, readIfExists, rmIfExists } from '@atproto/common'\nimport * as crypto from '@atproto/crypto'\nimport type { ExportableKeypair, Keypair } from '@atproto/crypto'\nimport type { DidString } from '@atproto/lex'\nimport { InvalidRequestError } from '@atproto/xrpc-server'\nimport type { ActorStoreConfig } from '../config/index.js'\nimport { retrySqlite } from '../db/index.js'\nimport { DiskBlobStore } from '../disk-blobstore.js'\nimport { blobStoreLogger } from '../logger.js'\nimport { ActorStoreReader } from './actor-store-reader.js'\nimport type { ActorStoreResources } from './actor-store-resources.js'\nimport { ActorStoreTransactor } from './actor-store-transactor.js'\nimport { ActorStoreWriter } from './actor-store-writer.js'\nimport { type ActorDb, getDb, getMigrator } from './db/index.js'\n\nexport class ActorStore {\n  reservedKeyDir: string\n\n  constructor(\n    public cfg: ActorStoreConfig,\n    public resources: ActorStoreResources,\n  ) {\n    this.reservedKeyDir = path.join(cfg.directory, 'reserved_keys')\n  }\n\n  async getLocation(did: string) {\n    const didHash = await crypto.sha256Hex(did)\n    const directory = path.join(this.cfg.directory, didHash.slice(0, 2), did)\n    const dbLocation = path.join(directory, `store.sqlite`)\n    const keyLocation = path.join(directory, `key`)\n    return { directory, dbLocation, keyLocation }\n  }\n\n  async exists(did: string): Promise<boolean> {\n    const location = await this.getLocation(did)\n    return await fileExists(location.dbLocation)\n  }\n\n  async keypair(did: string): Promise<Keypair> {\n    const { keyLocation } = await this.getLocation(did)\n    const privKey = await fs.readFile(keyLocation)\n    return crypto.Secp256k1Keypair.import(privKey)\n  }\n\n  async openDb(did: string): Promise<ActorDb> {\n    const { dbLocation } = await this.getLocation(did)\n    const exists = await fileExists(dbLocation)\n    if (!exists) {\n      throw new InvalidRequestError('Repo not found', 'NotFound')\n    }\n\n    const db = getDb(dbLocation, this.cfg.disableWalAutoCheckpoint)\n\n    // run a simple select with retry logic to ensure the db is ready (not in wal recovery mode)\n    try {\n      await retrySqlite(() =>\n        db.db.selectFrom('repo_root').selectAll().execute(),\n      )\n    } catch (err) {\n      await db.close()\n      throw err\n    }\n\n    return db\n  }\n\n  async read<T>(\n    did: DidString,\n    fn: (fn: ActorStoreReader) => T | PromiseLike<T>,\n  ) {\n    await using db = await this.openDb(did)\n    const getKeypair = () => this.keypair(did)\n    await using reader = new ActorStoreReader(\n      did,\n      db,\n      this.resources,\n      getKeypair,\n    )\n    return await fn(reader)\n  }\n\n  async transact<T>(\n    did: DidString,\n    fn: (transactor: ActorStoreTransactor) => T | PromiseLike<T>,\n  ) {\n    const keypair = await this.keypair(did)\n    await using db = await this.openDb(did)\n    return await db.transaction(async (dbTxn) => {\n      await using transactor = new ActorStoreTransactor(\n        did,\n        dbTxn,\n        keypair,\n        this.resources,\n      )\n      return await fn(transactor)\n    })\n  }\n\n  async writeNoTransaction<T>(\n    did: DidString,\n    fn: (writer: ActorStoreWriter) => T | PromiseLike<T>,\n  ) {\n    const keypair = await this.keypair(did)\n    await using db = await this.openDb(did)\n    await using writer = new ActorStoreWriter(did, db, keypair, this.resources)\n    return await fn(writer)\n  }\n\n  async create(did: string, keypair: ExportableKeypair) {\n    const { directory, dbLocation, keyLocation } = await this.getLocation(did)\n    // ensure subdir exists\n    await mkdir(directory, { recursive: true })\n    const exists = await fileExists(dbLocation)\n    if (exists) {\n      throw new InvalidRequestError('Repo already exists', 'AlreadyExists')\n    }\n    const privKey = await keypair.export()\n    await fs.writeFile(keyLocation, privKey)\n\n    const db: ActorDb = getDb(dbLocation, this.cfg.disableWalAutoCheckpoint)\n    try {\n      await db.ensureWal()\n      const migrator = getMigrator(db)\n      await migrator.migrateToLatestOrThrow()\n    } finally {\n      await db.close()\n    }\n  }\n\n  async destroy(did: DidString) {\n    await using blobstore = this.resources.blobstore(did)\n    if (blobstore instanceof DiskBlobStore) {\n      await blobstore.deleteAll()\n    } else {\n      const cids = await this.read(did, async (store) =>\n        store.repo.blob.getBlobCids(),\n      )\n      await blobstore.deleteMany(cids).catch((err) => {\n        blobStoreLogger.error({ did, cids, err }, 'Failed to delete blobs')\n      })\n    }\n\n    const { directory } = await this.getLocation(did)\n    await rmIfExists(directory, true)\n  }\n\n  async reserveKeypair(did?: string): Promise<string> {\n    let keyLoc: string | undefined\n    if (did) {\n      assertSafePathPart(did)\n      keyLoc = path.join(this.reservedKeyDir, did)\n      const maybeKey = await loadKey(keyLoc)\n      if (maybeKey) {\n        return maybeKey.did()\n      }\n    }\n    const keypair = await crypto.Secp256k1Keypair.create({ exportable: true })\n    const keyDid = keypair.did()\n    keyLoc = keyLoc ?? path.join(this.reservedKeyDir, keyDid)\n    await mkdir(this.reservedKeyDir, { recursive: true })\n    await fs.writeFile(keyLoc, await keypair.export())\n    return keyDid\n  }\n\n  async getReservedKeypair(\n    signingKeyOrDid: string,\n  ): Promise<ExportableKeypair | undefined> {\n    return loadKey(path.join(this.reservedKeyDir, signingKeyOrDid))\n  }\n\n  async clearReservedKeypair(keyDid: string, did?: string) {\n    await rmIfExists(path.join(this.reservedKeyDir, keyDid))\n    if (did) {\n      await rmIfExists(path.join(this.reservedKeyDir, did))\n    }\n  }\n\n  async storePlcOp(did: string, op: Uint8Array) {\n    const { directory } = await this.getLocation(did)\n    const opLoc = path.join(directory, `did-op`)\n    await fs.writeFile(opLoc, op)\n  }\n\n  async getPlcOp(did: string): Promise<Uint8Array> {\n    const { directory } = await this.getLocation(did)\n    const opLoc = path.join(directory, `did-op`)\n    return await fs.readFile(opLoc)\n  }\n\n  async clearPlcOp(did: string) {\n    const { directory } = await this.getLocation(did)\n    const opLoc = path.join(directory, `did-op`)\n    await rmIfExists(opLoc)\n  }\n}\n\nconst loadKey = async (loc: string): Promise<ExportableKeypair | undefined> => {\n  const privKey = await readIfExists(loc)\n  if (!privKey) return undefined\n  return crypto.Secp256k1Keypair.import(privKey, { exportable: true })\n}\n\nfunction assertSafePathPart(part: string) {\n  const normalized = path.normalize(part)\n  assert(\n    part === normalized &&\n      !part.startsWith('.') &&\n      !part.includes('/') &&\n      !part.includes('\\\\'),\n    `unsafe path part: ${part}`,\n  )\n}\n"]}

package/dist/api/com/atproto/admin/updateAccountEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateAccountEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA2BvD"}
+{"version":3,"file":"updateAccountEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwBvD"}

package/dist/api/com/atproto/admin/updateAccountEmail.js

@@ -19,10 +19,7 @@ export default function (server, ctx) {
                 });
                 return;
             }
-            await ctx.accountManager.updateAccountEmail({
-                did: account.did,
-                email: body.email,
-            });
+            await ctx.accountManager.updateAccountEmail(account.did, body.email);
         },
     });
 }

package/dist/api/com/atproto/admin/updateAccountEmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateAccountEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChE,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAC1E,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBAClE,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC;gBAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.updateAccountEmail, {\n    auth: ctx.authVerifier.adminToken,\n    handler: async ({ input: { body }, req }) => {\n      const account = await ctx.accountManager.getAccount(body.account, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError(`Account does not exist: ${body.account}`)\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        await ctx.entrywayClient.xrpc(com.atproto.admin.updateAccountEmail, {\n          headers,\n          body,\n        })\n        return\n      }\n\n      await ctx.accountManager.updateAccountEmail({\n        did: account.did,\n        email: body.email,\n      })\n    },\n  })\n}\n"]}
+{"version":3,"file":"updateAccountEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChE,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAC1E,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBAClE,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.updateAccountEmail, {\n    auth: ctx.authVerifier.adminToken,\n    handler: async ({ input: { body }, req }) => {\n      const account = await ctx.accountManager.getAccount(body.account, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError(`Account does not exist: ${body.account}`)\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        await ctx.entrywayClient.xrpc(com.atproto.admin.updateAccountEmail, {\n          headers,\n          body,\n        })\n        return\n      }\n\n      await ctx.accountManager.updateAccountEmail(account.did, body.email)\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/repo/importRepo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"importRepo.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/importRepo.ts"],"names":[],"mappings":"AAUA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAqFvD"}
+{"version":3,"file":"importRepo.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/importRepo.ts"],"names":[],"mappings":"AAWA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA8FvD"}

package/dist/api/com/atproto/repo/importRepo.js

@@ -1,6 +1,6 @@
 import { TID } from '@atproto/common';
 import { enumBlobRefs } from '@atproto/lex-data';
-import { BlockMap, WriteOpAction, getAndParseRecord, readCarStream, verifyDiff, } from '@atproto/repo';
+import { BlockMap, VisitedCidError, WriteOpAction, getAndParseRecord, readCarStream, verifyDiff, } from '@atproto/repo';
 import { AtUri } from '@atproto/syntax';
 import { InvalidRequestError } from '@atproto/xrpc-server';
 import { ACCESS_FULL } from '../../../../auth-scope.js';
@@ -38,7 +38,12 @@ export default function (server, ctx) {
                 const rev = TID.nextStr();
                 const did = store.repo.did;
                 const currRepo = await store.repo.maybeLoadRepo();
-                const diff = await verifyDiff(currRepo, blockMap, roots[0], undefined, undefined, { ensureLeaves: false });
+                const diff = await verifyDiff(currRepo, blockMap, roots[0], undefined, undefined, { ensureLeaves: false }).catch((cause) => {
+                    if (cause instanceof VisitedCidError) {
+                        throw new InvalidRequestError(`invalid MST: node referenced more than once: ${cause.cid}`, undefined, { cause });
+                    }
+                    throw cause;
+                });
                 diff.commit.rev = rev;
                 await store.repo.storage.applyCommit(diff.commit, currRepo === null);
                 // @NOTE There is no point in performing the following concurrently

package/dist/api/com/atproto/repo/importRepo.js.map

@@ -1 +1 @@
-{"version":3,"file":"importRepo.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/importRepo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAe,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EACL,QAAQ,EACR,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE;QACtC,IAAI,EAAE;YACJ,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa;SACzC;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACtC,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;YAEhC,wEAAwE;YACxE,kCAAkC;YAClC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBACnB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;YAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YAED,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;gBACzB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAA;gBAE1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAA;gBACjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,QAAQ,EACR,QAAQ,EACR,KAAK,CAAC,CAAC,CAAC,EACR,SAAS,EACT,SAAS,EACT,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAA;gBACD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;gBACrB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAA;gBAEpE,mEAAmE;gBACnE,uCAAuC;gBACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;oBACzD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;wBAC1C,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;oBACtC,CAAC;yBAAM,CAAC;wBACN,IAAI,YAAoB,CAAA;wBACxB,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,gEAAgE;4BAChE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;4BAC3D,YAAY,GAAG,MAAM,CAAC,MAAM,CAAA;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,GAAG,CAChE,CAAA;wBACH,CAAC;wBAED,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAC5B,GAAG,EACH,KAAK,CAAC,GAAG,EACT,YAAY,EACZ,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,GAAG,CACJ,CAAA;wBACD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,YAAY,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CACjE,CAAA;wBACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;oBAChE,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { TID } from '@atproto/common'\nimport { type LexMap, enumBlobRefs } from '@atproto/lex-data'\nimport {\n  BlockMap,\n  WriteOpAction,\n  getAndParseRecord,\n  readCarStream,\n  verifyDiff,\n} from '@atproto/repo'\nimport { AtUri } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { ACCESS_FULL } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.importRepo, {\n    opts: {\n      blobLimit: ctx.cfg.service.maxImportSize,\n    },\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      scopes: ACCESS_FULL,\n      authorize: (permissions) => {\n        permissions.assertAccount({ attr: 'repo', action: 'manage' })\n      },\n    }),\n    handler: async ({ input, auth }) => {\n      if (!ctx.cfg.service.acceptingImports) {\n        throw new InvalidRequestError('Service is not accepting repo imports')\n      }\n\n      const { did } = auth.credentials\n\n      // @NOTE process as much as we can before the transaction, in particular\n      // the reading of the body stream.\n      const { roots, blocks } = await readCarStream(input.body)\n      if (roots.length !== 1) {\n        await blocks.dump()\n        throw new InvalidRequestError('expected one root')\n      }\n\n      const blockMap = new BlockMap()\n      for await (const block of blocks) {\n        blockMap.set(block.cid, block.bytes)\n      }\n\n      await ctx.actorStore.transact(did, async (store) => {\n        const now = new Date().toISOString()\n        const rev = TID.nextStr()\n        const did = store.repo.did\n\n        const currRepo = await store.repo.maybeLoadRepo()\n        const diff = await verifyDiff(\n          currRepo,\n          blockMap,\n          roots[0],\n          undefined,\n          undefined,\n          { ensureLeaves: false },\n        )\n        diff.commit.rev = rev\n        await store.repo.storage.applyCommit(diff.commit, currRepo === null)\n\n        // @NOTE There is no point in performing the following concurrently\n        // since better-sqlite3 is synchronous.\n        for (const write of diff.writes) {\n          const uri = AtUri.make(did, write.collection, write.rkey)\n          if (write.action === WriteOpAction.Delete) {\n            await store.record.deleteRecord(uri)\n          } else {\n            let parsedRecord: LexMap\n            try {\n              // @NOTE getAndParseRecord returns a promise for historical\n              // reasons but it's internal processing is actually synchronous.\n              const parsed = await getAndParseRecord(blockMap, write.cid)\n              parsedRecord = parsed.record\n            } catch {\n              throw new InvalidRequestError(\n                `Could not parse record at '${write.collection}/${write.rkey}'`,\n              )\n            }\n\n            await store.record.indexRecord(\n              uri,\n              write.cid,\n              parsedRecord,\n              write.action,\n              rev,\n              now,\n            )\n            const recordBlobs = Array.from(\n              enumBlobRefs(parsedRecord, { allowLegacy: true, strict: false }),\n            )\n            await store.repo.blob.insertBlobs(uri.toString(), recordBlobs)\n          }\n        }\n      })\n    },\n  })\n}\n"]}
+{"version":3,"file":"importRepo.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/importRepo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAe,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EACL,QAAQ,EACR,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE;QACtC,IAAI,EAAE;YACJ,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa;SACzC;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACtC,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;YAEhC,wEAAwE;YACxE,kCAAkC;YAClC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBACnB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;YAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC;YAED,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;gBACzB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAA;gBAE1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAA;gBACjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,QAAQ,EACR,QAAQ,EACR,KAAK,CAAC,CAAC,CAAC,EACR,SAAS,EACT,SAAS,EACT,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChB,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;wBACrC,MAAM,IAAI,mBAAmB,CAC3B,gDAAgD,KAAK,CAAC,GAAG,EAAE,EAC3D,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAA;oBACH,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;gBACrB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAA;gBAEpE,mEAAmE;gBACnE,uCAAuC;gBACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;oBACzD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;wBAC1C,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;oBACtC,CAAC;yBAAM,CAAC;wBACN,IAAI,YAAoB,CAAA;wBACxB,IAAI,CAAC;4BACH,2DAA2D;4BAC3D,gEAAgE;4BAChE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;4BAC3D,YAAY,GAAG,MAAM,CAAC,MAAM,CAAA;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,GAAG,CAChE,CAAA;wBACH,CAAC;wBAED,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAC5B,GAAG,EACH,KAAK,CAAC,GAAG,EACT,YAAY,EACZ,KAAK,CAAC,MAAM,EACZ,GAAG,EACH,GAAG,CACJ,CAAA;wBACD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,YAAY,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CACjE,CAAA;wBACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAA;oBAChE,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { TID } from '@atproto/common'\nimport { type LexMap, enumBlobRefs } from '@atproto/lex-data'\nimport {\n  BlockMap,\n  VisitedCidError,\n  WriteOpAction,\n  getAndParseRecord,\n  readCarStream,\n  verifyDiff,\n} from '@atproto/repo'\nimport { AtUri } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { ACCESS_FULL } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.importRepo, {\n    opts: {\n      blobLimit: ctx.cfg.service.maxImportSize,\n    },\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      scopes: ACCESS_FULL,\n      authorize: (permissions) => {\n        permissions.assertAccount({ attr: 'repo', action: 'manage' })\n      },\n    }),\n    handler: async ({ input, auth }) => {\n      if (!ctx.cfg.service.acceptingImports) {\n        throw new InvalidRequestError('Service is not accepting repo imports')\n      }\n\n      const { did } = auth.credentials\n\n      // @NOTE process as much as we can before the transaction, in particular\n      // the reading of the body stream.\n      const { roots, blocks } = await readCarStream(input.body)\n      if (roots.length !== 1) {\n        await blocks.dump()\n        throw new InvalidRequestError('expected one root')\n      }\n\n      const blockMap = new BlockMap()\n      for await (const block of blocks) {\n        blockMap.set(block.cid, block.bytes)\n      }\n\n      await ctx.actorStore.transact(did, async (store) => {\n        const now = new Date().toISOString()\n        const rev = TID.nextStr()\n        const did = store.repo.did\n\n        const currRepo = await store.repo.maybeLoadRepo()\n        const diff = await verifyDiff(\n          currRepo,\n          blockMap,\n          roots[0],\n          undefined,\n          undefined,\n          { ensureLeaves: false },\n        ).catch((cause) => {\n          if (cause instanceof VisitedCidError) {\n            throw new InvalidRequestError(\n              `invalid MST: node referenced more than once: ${cause.cid}`,\n              undefined,\n              { cause },\n            )\n          }\n          throw cause\n        })\n        diff.commit.rev = rev\n        await store.repo.storage.applyCommit(diff.commit, currRepo === null)\n\n        // @NOTE There is no point in performing the following concurrently\n        // since better-sqlite3 is synchronous.\n        for (const write of diff.writes) {\n          const uri = AtUri.make(did, write.collection, write.rkey)\n          if (write.action === WriteOpAction.Delete) {\n            await store.record.deleteRecord(uri)\n          } else {\n            let parsedRecord: LexMap\n            try {\n              // @NOTE getAndParseRecord returns a promise for historical\n              // reasons but it's internal processing is actually synchronous.\n              const parsed = await getAndParseRecord(blockMap, write.cid)\n              parsedRecord = parsed.record\n            } catch {\n              throw new InvalidRequestError(\n                `Could not parse record at '${write.collection}/${write.rkey}'`,\n              )\n            }\n\n            await store.record.indexRecord(\n              uri,\n              write.cid,\n              parsedRecord,\n              write.action,\n              rev,\n              now,\n            )\n            const recordBlobs = Array.from(\n              enumBlobRefs(parsedRecord, { allowLegacy: true, strict: false }),\n            )\n            await store.repo.blob.insertBlobs(uri.toString(), recordBlobs)\n          }\n        }\n      })\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/server/createAccount.js

@@ -182,9 +182,14 @@ const validateInputsForLocalPds = async (ctx, input, requester) => {
         await ctx.accountManager.ensureInviteIsAvailable(inviteCode);
     }
     // check that the handle and email are available
+    //
+    // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and
+    // email uniqueness across taken down and deactivated accounts as well, so we
+    // must check for them when surfacing handle availability.
+    const availability = { includeTakenDown: true, includeDeactivated: true };
     const [handleAccnt, emailAcct] = await Promise.all([
-        ctx.accountManager.getAccount(handle),
-        ctx.accountManager.getAccountByEmail(email),
+        ctx.accountManager.getAccount(handle, availability),
+        ctx.accountManager.getAccountByEmail(email, availability),
     ]);
     if (handleAccnt) {
         throw new InvalidRequestError(`Handle already taken: ${handle}`);

package/dist/api/com/atproto/server/createAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle),\n    ctx.accountManager.getAccountByEmail(email),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}
+{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  //\n  // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n  // email uniqueness across taken down and deactivated accounts as well, so we\n  // must check for them when surfacing handle availability.\n  const availability = { includeTakenDown: true, includeDeactivated: true }\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle, availability),\n    ctx.accountManager.getAccountByEmail(email, availability),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}

package/dist/api/com/atproto/server/createSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwFvD"}
+{"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgGvD"}

package/dist/api/com/atproto/server/createSession.js

@@ -39,7 +39,13 @@ export default function (server, ctx) {
                 if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {
                     throw new AuthRequiredError('Password too long. Consider resetting your password.');
                 }
-                const { user, isSoftDeleted, appPassword } = await ctx.accountManager.login(body);
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                // @NOTE No translation needed for the second-factor challenge: `login()`
+                // throws `AuthFactorRequiredError`, already an `AuthRequiredError`
+                // carrying this method's declared `AuthFactorTokenRequired` error name.
+                const { user, isSoftDeleted, appPassword } = await ctx.accountManager.login({ ...body, locale });
                 if (!body.allowTakendown && isSoftDeleted) {
                     throw new AuthRequiredError('Account has been taken down', 'AccountTakedown');
                 }
@@ -63,6 +69,7 @@ export default function (server, ctx) {
                         handle: (user.handle ?? INVALID_HANDLE),
                         email: user.email ?? undefined,
                         emailConfirmed: !!user.emailConfirmedAt,
+                        emailAuthFactor: !!user.emailAuthFactorAt,
                         active,
                         status,
                     },

package/dist/api/com/atproto/server/createSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAEtC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  type MethodRateLimit,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const rateLimit: MethodRateLimit<\n    void,\n    com.atproto.server.createSession.$Params,\n    com.atproto.server.createSession.$Input\n  > = [\n    {\n      durationMs: DAY,\n      points: 300,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n    {\n      durationMs: 5 * MINUTE,\n      points: 30,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n  ]\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({ input: { body }, req }) => {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return entrywayClient.xrpc(com.atproto.server.createSession, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({\n        input: { body },\n      }): Promise<com.atproto.server.createSession.$Output> => {\n        if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n          throw new AuthRequiredError(\n            'Password too long. Consider resetting your password.',\n          )\n        }\n\n        const { user, isSoftDeleted, appPassword } =\n          await ctx.accountManager.login(body)\n\n        if (!body.allowTakendown && isSoftDeleted) {\n          throw new AuthRequiredError(\n            'Account has been taken down',\n            'AccountTakedown',\n          )\n        }\n\n        const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n          ctx.accountManager.createSession(\n            user.did,\n            appPassword,\n            isSoftDeleted,\n          ),\n          didDocForSession(ctx, user.did),\n        ])\n\n        const { status, active } = formatAccountStatus(user)\n\n        events.sessionCreated({\n          source: com.atproto.server.createSession.$lxm,\n          did: user.did,\n        })\n\n        return {\n          encoding: 'application/json',\n          body: {\n            accessJwt,\n            refreshJwt,\n\n            did: user.did as DidString,\n            // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n            didDoc,\n            handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n            email: user.email ?? undefined,\n            emailConfirmed: !!user.emailConfirmedAt,\n            active,\n            status,\n          },\n        }\n      },\n    })\n  }\n}\n"]}
+{"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;gBAErD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;wBACzC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  type MethodRateLimit,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const rateLimit: MethodRateLimit<\n    void,\n    com.atproto.server.createSession.$Params,\n    com.atproto.server.createSession.$Input\n  > = [\n    {\n      durationMs: DAY,\n      points: 300,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n    {\n      durationMs: 5 * MINUTE,\n      points: 30,\n      calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n    },\n  ]\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({ input: { body }, req }) => {\n        const { headers } = ctx.entrywayPassthruHeaders(req)\n        return entrywayClient.xrpc(com.atproto.server.createSession, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.createSession, {\n      rateLimit,\n      handler: async ({\n        input: { body },\n      }): Promise<com.atproto.server.createSession.$Output> => {\n        if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n          throw new AuthRequiredError(\n            'Password too long. Consider resetting your password.',\n          )\n        }\n\n        // @TODO get the locale somehow (either by adding a field in the request\n        // body, or by using the `Accept-Language` header).\n        const locale = undefined\n\n        // @NOTE No translation needed for the second-factor challenge: `login()`\n        // throws `AuthFactorRequiredError`, already an `AuthRequiredError`\n        // carrying this method's declared `AuthFactorTokenRequired` error name.\n        const { user, isSoftDeleted, appPassword } =\n          await ctx.accountManager.login({ ...body, locale })\n\n        if (!body.allowTakendown && isSoftDeleted) {\n          throw new AuthRequiredError(\n            'Account has been taken down',\n            'AccountTakedown',\n          )\n        }\n\n        const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n          ctx.accountManager.createSession(\n            user.did,\n            appPassword,\n            isSoftDeleted,\n          ),\n          didDocForSession(ctx, user.did),\n        ])\n\n        const { status, active } = formatAccountStatus(user)\n\n        events.sessionCreated({\n          source: com.atproto.server.createSession.$lxm,\n          did: user.did,\n        })\n\n        return {\n          encoding: 'application/json',\n          body: {\n            accessJwt,\n            refreshJwt,\n\n            did: user.did as DidString,\n            // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n            didDoc,\n            handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n            email: user.email ?? undefined,\n            emailConfirmed: !!user.emailConfirmedAt,\n            emailAuthFactor: !!user.emailAuthFactorAt,\n            active,\n            status,\n          },\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/getSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAIvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAuDvD"}
+{"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAIvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwDvD"}

package/dist/api/com/atproto/server/getSession.js

@@ -39,6 +39,7 @@ export default function (server, ctx) {
                     handle: (user.handle ?? INVALID_HANDLE),
                     email: user.email ?? undefined,
                     emailConfirmed: !!user.emailConfirmedAt,
+                    emailAuthFactor: !!user.emailAuthFactorAt,
                     active,
                     status,
                 }),

package/dist/api/com/atproto/server/getSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,GAAG,EAAE;gBACd,4DAA4D;YAC9D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,+BAA+B,CAChC,CAAA;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;gBAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,EAAE,WAAW,EAA8B,EAC3C,IAA+C;IAE/C,IACE,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.getSession, {\n    auth: ctx.authVerifier.authorization({\n      additional: [AuthScope.SignupQueued],\n      authorize: () => {\n        // Always allowed. \"email\" access is checked in the handler.\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          'com.atproto.server.getSession',\n        )\n\n        const { body } = await ctx.entrywayClient.xrpc(\n          com.atproto.server.getSession,\n          { headers },\n        )\n\n        return {\n          encoding: 'application/json' as const,\n          body: output(auth, body),\n        }\n      }\n\n      const did = auth.credentials.did\n      const [user, didDoc] = await Promise.all([\n        ctx.accountManager.getAccount(did, { includeDeactivated: true }),\n        didDocForSession(ctx, did),\n      ])\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      return {\n        encoding: 'application/json' as const,\n        body: output(auth, {\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          active,\n          status,\n        }),\n      }\n    },\n  })\n}\n\nfunction output(\n  { credentials }: OAuthOutput | AccessOutput,\n  data: com.atproto.server.getSession.$OutputBody,\n): com.atproto.server.getSession.$OutputBody {\n  if (\n    credentials.type === 'oauth' &&\n    !credentials.permissions.allowsAccount({ attr: 'email', action: 'read' })\n  ) {\n    const { email, emailAuthFactor, emailConfirmed, ...rest } = data\n    return rest\n  }\n\n  return data\n}\n"]}
+{"version":3,"file":"getSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,GAAG,EAAE;gBACd,4DAA4D;YAC9D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,+BAA+B,CAChC,CAAA;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;gBAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;oBACzC,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,EAAE,WAAW,EAA8B,EAC3C,IAA+C;IAE/C,IACE,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n  type DidString,\n  type HandleString,\n  INVALID_HANDLE,\n} from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.getSession, {\n    auth: ctx.authVerifier.authorization({\n      additional: [AuthScope.SignupQueued],\n      authorize: () => {\n        // Always allowed. \"email\" access is checked in the handler.\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          'com.atproto.server.getSession',\n        )\n\n        const { body } = await ctx.entrywayClient.xrpc(\n          com.atproto.server.getSession,\n          { headers },\n        )\n\n        return {\n          encoding: 'application/json' as const,\n          body: output(auth, body),\n        }\n      }\n\n      const did = auth.credentials.did\n      const [user, didDoc] = await Promise.all([\n        ctx.accountManager.getAccount(did, { includeDeactivated: true }),\n        didDocForSession(ctx, did),\n      ])\n      if (!user) {\n        throw new InvalidRequestError(\n          `Could not find user info for account: ${did}`,\n        )\n      }\n\n      const { status, active } = formatAccountStatus(user)\n\n      return {\n        encoding: 'application/json' as const,\n        body: output(auth, {\n          did: user.did as DidString,\n          // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n          didDoc,\n          handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n          email: user.email ?? undefined,\n          emailConfirmed: !!user.emailConfirmedAt,\n          emailAuthFactor: !!user.emailAuthFactorAt,\n          active,\n          status,\n        }),\n      }\n    },\n  })\n}\n\nfunction output(\n  { credentials }: OAuthOutput | AccessOutput,\n  data: com.atproto.server.getSession.$OutputBody,\n): com.atproto.server.getSession.$OutputBody {\n  if (\n    credentials.type === 'oauth' &&\n    !credentials.permissions.allowsAccount({ attr: 'email', action: 'read' })\n  ) {\n    const { email, emailAuthFactor, emailConfirmed, ...rest } = data\n    return rest\n  }\n\n  return data\n}\n"]}

package/dist/api/com/atproto/server/refreshSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgEvD"}
+{"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAiEvD"}

package/dist/api/com/atproto/server/refreshSession.js

@@ -49,6 +49,7 @@ export default function (server, ctx) {
                     handle: (user.handle ?? INVALID_HANDLE),
                     email: user.email ?? undefined,
                     emailConfirmed: !!user.emailConfirmedAt,
+                    emailAuthFactor: !!user.emailAuthFactorAt,
                     active,
                     status,
                 },