@atproto/pds 0.5.5 → 0.5.6

package/dist/account-manager/db/migrations/005-oauth-account-management.js.map

@@ -1 +1 @@
-{"version":3,"file":"005-oauth-account-management.js","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/005-oauth-account-management.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,OAAO,EAAwB,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtE,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,2DAA2D;AAC3D,yBAAyB;AACzB,sEAAsE;AAEtE,MAAM,CAAC,KAAK,UAAU,EAAE,CACtB,EAmBE;IAEF,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,EAAE;SACL,UAAU,CAAC,gBAAgB,CAAC;SAC5B,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;SACzB,KAAK,CAAC,iBAAiB,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACrE,OAAO,EAAE,CAAA;IAEZ,4BAA4B;IAC5B,qEAAqE;IACrE,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,gBAAgB,CAAC;SAC7B,WAAW,EAAE;SACb,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,uBAAuB,CAAC,mBAAmB,EAAE;QAC5C,UAAU,EAAE,kEAAkE;QAC9E,KAAK;KACN,CAAC;SACD,uBAAuB,CACtB,uBAAuB,EACvB,CAAC,KAAK,CAAC,EACP,SAAS,EACT,CAAC,KAAK,CAAC;IACP,qEAAqE;IACrE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnD;SACA,uBAAuB,CACtB,6BAA6B,EAC7B,CAAC,UAAU,CAAC,EACZ,QAAQ,EACR,CAAC,IAAI,CAAC;IACN,qEAAqE;IACrE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnD;SACA,OAAO,EAAE,CAAA;IAEZ,+CAA+C;IAC/C,oEAAoE;IACpE,MAAM,EAAE;SACL,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;SACtD,UAAU,CACT,EAAE;SACC,UAAU,CAAC,gBAAgB,CAAC;SAC5B,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,8BAA8B,CAAC,CAAC,iBAAiB;SACxD,MAAM,CAAC,8BAA8B,CAAC;SACtC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;SACzB,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;IAClB,oDAAoD;IACpD,2DAA2D;IAC3D,EAAE;SACC,UAAU,CAAC,SAAS,CAAC;SACrB,SAAS,EAAE;SACX,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,oBAAoB,CAAC,CACtD,CACJ;SACA,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;SAClC,OAAO,EAAE,CAAA;IAEZ,8EAA8E;IAC9E,uDAAuD;IAEvD,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,wBAAwB,CAAC;SACrC,EAAE,CAAC,gBAAgB,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,OAAO,EAAE,CAAA;IAEZ,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,mBAAmB,CAAC;SAChC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACpD,uBAAuB,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;SACpE,uBAAuB,CACtB,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,SAAS,EACT,CAAC,KAAK,CAAC;IACP,qEAAqE;IACrE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnD;SACA,OAAO,EAAE,CAAA;IAEZ,4EAA4E;IAC5E,4EAA4E;IAC5E,oCAAoC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAmB;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAA;IACxD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAA;AACvD,CAAC","sourcesContent":["import { Kysely } from 'kysely'\nimport { HOUR } from '@atproto/common'\nimport { ClientId, DeviceId } from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded, toDateISO } from '../../../db/index.js'\n\n// @NOTE this migration has been updated to be idempotent through\n// the insertInto('account_device') step. this allows users to roll\n// forward if the migration partially succeeded on first run, failing\n// on a fk constraint during the insertInto('account_device') step.\n// this previously occurred under the following conditions:\n//  a. a user was deleted\n//  b. this user used oauth functionality with \"remember me\" selected.\n\nexport async function up(\n  db: Kysely<{\n    account: {\n      did: string\n    }\n    device_account: {\n      did: string\n      deviceId: DeviceId\n\n      remember: 0 | 1\n      authenticatedAt: string\n      authorizedClients: JsonEncoded<ClientId[]>\n    }\n    account_device: {\n      did: string\n      deviceId: DeviceId\n\n      createdAt: DateISO\n      updatedAt: DateISO\n    }\n  }>,\n): Promise<void> {\n  // Security: Delete any leftover device accounts that are not remembered\n  // @NOTE idempotent, see note at top of migration.\n  await db\n    .deleteFrom('device_account')\n    .where('remember', '=', 0)\n    .where('authenticatedAt', '<', toDateISO(new Date(Date.now() - HOUR)))\n    .execute()\n\n  // replaces \"device_account\"\n  // @NOTE idempotent from ifNotExists(), see note at top of migration.\n  await db.schema\n    .createTable('account_device')\n    .ifNotExists()\n    .addColumn('did', 'varchar', (col) => col.notNull())\n    .addColumn('deviceId', 'varchar', (col) => col.notNull())\n    .addColumn('createdAt', 'varchar', (col) => col.notNull())\n    .addColumn('updatedAt', 'varchar', (col) => col.notNull())\n    .addPrimaryKeyConstraint('account_device_pk', [\n      'deviceId', // first because this table will be joined from the \"device\" table\n      'did',\n    ])\n    .addForeignKeyConstraint(\n      'account_device_did_fk',\n      ['did'],\n      'account',\n      ['did'],\n      // cascade on delete, future-proofing on update (fk can't be altered)\n      (qb) => qb.onDelete('cascade').onUpdate('cascade'),\n    )\n    .addForeignKeyConstraint(\n      'account_device_device_id_fk',\n      ['deviceId'],\n      'device',\n      ['id'],\n      // cascade on delete, future-proofing on update (fk can't be altered)\n      (qb) => qb.onDelete('cascade').onUpdate('cascade'),\n    )\n    .execute()\n\n  // Migrate \"device_account\" to \"account_device\"\n  // @NOTE idempotent from onConflict(): see note at top of migration.\n  await db\n    .insertInto('account_device')\n    .columns(['did', 'deviceId', 'createdAt', 'updatedAt'])\n    .expression(\n      db\n        .selectFrom('device_account')\n        .select('did')\n        .select('deviceId')\n        .select('authenticatedAt as createdAt') // Best we can do\n        .select('authenticatedAt as updatedAt')\n        .where('remember', '=', 1)\n        .whereExists((qb) =>\n          // device_account does not have fkey on account.did,\n          // so we satisfy account_device_did_fk with this condition.\n          qb\n            .selectFrom('account')\n            .selectAll()\n            .whereRef('account.did', '=', 'device_account.did'),\n        ),\n    )\n    .onConflict((oc) => oc.doNothing())\n    .execute()\n\n  // @NOTE No need to create an index on \"deviceId\" for \"account_device\" because\n  // it is the first column in the primary key constraint\n\n  await db.schema\n    .createIndex('account_device_did_idx')\n    .on('account_device')\n    .column('did')\n    .execute()\n\n  await db.schema\n    .createTable('authorized_client')\n    .addColumn('did', 'varchar', (col) => col.notNull())\n    .addColumn('clientId', 'varchar', (col) => col.notNull())\n    .addColumn('createdAt', 'varchar', (col) => col.notNull())\n    .addColumn('updatedAt', 'varchar', (col) => col.notNull())\n    .addColumn('data', 'varchar', (col) => col.notNull())\n    .addPrimaryKeyConstraint('authorized_client_pk', ['did', 'clientId'])\n    .addForeignKeyConstraint(\n      'authorized_client_did_fk',\n      ['did'],\n      'account',\n      ['did'],\n      // cascade on delete, future-proofing on update (fk can't be altered)\n      (qb) => qb.onDelete('cascade').onUpdate('cascade'),\n    )\n    .execute()\n\n  // We don't migrate the \"device_account\" authorized clients. Users will need\n  // to reauthorize the client during the next oauth flow (minor inconvenience\n  // for authenticated clients users).\n}\n\nexport async function down(db: Kysely<unknown>): Promise<void> {\n  await db.schema.dropTable('authorized_client').execute()\n  await db.schema.dropTable('account_device').execute()\n}\n"]}
+{"version":3,"file":"005-oauth-account-management.js","sourceRoot":"","sources":["../../../../src/account-manager/db/migrations/005-oauth-account-management.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,OAAO,EAAwB,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtE,iEAAiE;AACjE,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,2DAA2D;AAC3D,yBAAyB;AACzB,sEAAsE;AAEtE,MAAM,CAAC,KAAK,UAAU,EAAE,CACtB,EAmBE;IAEF,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,EAAE;SACL,UAAU,CAAC,gBAAgB,CAAC;SAC5B,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;SACzB,KAAK,CAAC,iBAAiB,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACrE,OAAO,EAAE,CAAA;IAEZ,4BAA4B;IAC5B,qEAAqE;IACrE,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,gBAAgB,CAAC;SAC7B,WAAW,EAAE;SACb,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,uBAAuB,CAAC,mBAAmB,EAAE;QAC5C,UAAU,EAAE,kEAAkE;QAC9E,KAAK;KACN,CAAC;SACD,uBAAuB,CACtB,uBAAuB,EACvB,CAAC,KAAK,CAAC,EACP,SAAS,EACT,CAAC,KAAK,CAAC;IACP,qEAAqE;IACrE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnD;SACA,uBAAuB,CACtB,6BAA6B,EAC7B,CAAC,UAAU,CAAC,EACZ,QAAQ,EACR,CAAC,IAAI,CAAC;IACN,qEAAqE;IACrE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnD;SACA,OAAO,EAAE,CAAA;IAEZ,+CAA+C;IAC/C,oEAAoE;IACpE,MAAM,EAAE;SACL,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;SACtD,UAAU,CACT,EAAE;SACC,UAAU,CAAC,gBAAgB,CAAC;SAC5B,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,8BAA8B,CAAC,CAAC,iBAAiB;SACxD,MAAM,CAAC,8BAA8B,CAAC;SACtC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;SACzB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;IAChC,oDAAoD;IACpD,2DAA2D;IAC3D,MAAM,CACJ,UAAU,CAAC,SAAS,CAAC;SAClB,SAAS,EAAE;SACX,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE,oBAAoB,CAAC,CACtD,CACF,CACJ;SACA,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;SAClC,OAAO,EAAE,CAAA;IAEZ,8EAA8E;IAC9E,uDAAuD;IAEvD,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,wBAAwB,CAAC;SACrC,EAAE,CAAC,gBAAgB,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,OAAO,EAAE,CAAA;IAEZ,MAAM,EAAE,CAAC,MAAM;SACZ,WAAW,CAAC,mBAAmB,CAAC;SAChC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACnD,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACxD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACzD,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;SACpD,uBAAuB,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;SACpE,uBAAuB,CACtB,0BAA0B,EAC1B,CAAC,KAAK,CAAC,EACP,SAAS,EACT,CAAC,KAAK,CAAC;IACP,qEAAqE;IACrE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnD;SACA,OAAO,EAAE,CAAA;IAEZ,4EAA4E;IAC5E,4EAA4E;IAC5E,oCAAoC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAmB;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAA;IACxD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAA;AACvD,CAAC","sourcesContent":["import { Kysely } from 'kysely'\nimport { HOUR } from '@atproto/common'\nimport { ClientId, DeviceId } from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded, toDateISO } from '../../../db/index.js'\n\n// @NOTE this migration has been updated to be idempotent through\n// the insertInto('account_device') step. this allows users to roll\n// forward if the migration partially succeeded on first run, failing\n// on a fk constraint during the insertInto('account_device') step.\n// this previously occurred under the following conditions:\n//  a. a user was deleted\n//  b. this user used oauth functionality with \"remember me\" selected.\n\nexport async function up(\n  db: Kysely<{\n    account: {\n      did: string\n    }\n    device_account: {\n      did: string\n      deviceId: DeviceId\n\n      remember: 0 | 1\n      authenticatedAt: string\n      authorizedClients: JsonEncoded<ClientId[]>\n    }\n    account_device: {\n      did: string\n      deviceId: DeviceId\n\n      createdAt: DateISO\n      updatedAt: DateISO\n    }\n  }>,\n): Promise<void> {\n  // Security: Delete any leftover device accounts that are not remembered\n  // @NOTE idempotent, see note at top of migration.\n  await db\n    .deleteFrom('device_account')\n    .where('remember', '=', 0)\n    .where('authenticatedAt', '<', toDateISO(new Date(Date.now() - HOUR)))\n    .execute()\n\n  // replaces \"device_account\"\n  // @NOTE idempotent from ifNotExists(), see note at top of migration.\n  await db.schema\n    .createTable('account_device')\n    .ifNotExists()\n    .addColumn('did', 'varchar', (col) => col.notNull())\n    .addColumn('deviceId', 'varchar', (col) => col.notNull())\n    .addColumn('createdAt', 'varchar', (col) => col.notNull())\n    .addColumn('updatedAt', 'varchar', (col) => col.notNull())\n    .addPrimaryKeyConstraint('account_device_pk', [\n      'deviceId', // first because this table will be joined from the \"device\" table\n      'did',\n    ])\n    .addForeignKeyConstraint(\n      'account_device_did_fk',\n      ['did'],\n      'account',\n      ['did'],\n      // cascade on delete, future-proofing on update (fk can't be altered)\n      (qb) => qb.onDelete('cascade').onUpdate('cascade'),\n    )\n    .addForeignKeyConstraint(\n      'account_device_device_id_fk',\n      ['deviceId'],\n      'device',\n      ['id'],\n      // cascade on delete, future-proofing on update (fk can't be altered)\n      (qb) => qb.onDelete('cascade').onUpdate('cascade'),\n    )\n    .execute()\n\n  // Migrate \"device_account\" to \"account_device\"\n  // @NOTE idempotent from onConflict(): see note at top of migration.\n  await db\n    .insertInto('account_device')\n    .columns(['did', 'deviceId', 'createdAt', 'updatedAt'])\n    .expression(\n      db\n        .selectFrom('device_account')\n        .select('did')\n        .select('deviceId')\n        .select('authenticatedAt as createdAt') // Best we can do\n        .select('authenticatedAt as updatedAt')\n        .where('remember', '=', 1)\n        .where(({ exists, selectFrom }) =>\n          // device_account does not have fkey on account.did,\n          // so we satisfy account_device_did_fk with this condition.\n          exists(\n            selectFrom('account')\n              .selectAll()\n              .whereRef('account.did', '=', 'device_account.did'),\n          ),\n        ),\n    )\n    .onConflict((oc) => oc.doNothing())\n    .execute()\n\n  // @NOTE No need to create an index on \"deviceId\" for \"account_device\" because\n  // it is the first column in the primary key constraint\n\n  await db.schema\n    .createIndex('account_device_did_idx')\n    .on('account_device')\n    .column('did')\n    .execute()\n\n  await db.schema\n    .createTable('authorized_client')\n    .addColumn('did', 'varchar', (col) => col.notNull())\n    .addColumn('clientId', 'varchar', (col) => col.notNull())\n    .addColumn('createdAt', 'varchar', (col) => col.notNull())\n    .addColumn('updatedAt', 'varchar', (col) => col.notNull())\n    .addColumn('data', 'varchar', (col) => col.notNull())\n    .addPrimaryKeyConstraint('authorized_client_pk', ['did', 'clientId'])\n    .addForeignKeyConstraint(\n      'authorized_client_did_fk',\n      ['did'],\n      'account',\n      ['did'],\n      // cascade on delete, future-proofing on update (fk can't be altered)\n      (qb) => qb.onDelete('cascade').onUpdate('cascade'),\n    )\n    .execute()\n\n  // We don't migrate the \"device_account\" authorized clients. Users will need\n  // to reauthorize the client during the next oauth flow (minor inconvenience\n  // for authenticated clients users).\n}\n\nexport async function down(db: Kysely<unknown>): Promise<void> {\n  await db.schema.dropTable('authorized_client').execute()\n  await db.schema.dropTable('account_device').execute()\n}\n"]}

package/dist/account-manager/db/schema/authorization-request.d.ts

@@ -1,9 +1,9 @@
 import { Selectable } from 'kysely';
-import { ClientAuth, ClientAuthLegacy, Code, DeviceId, OAuthAuthorizationRequestParameters, OAuthClientId, RequestId } from '@atproto/oauth-provider';
+import { ClientAuth, ClientAuthLegacy, Code, DeviceId, Did, OAuthAuthorizationRequestParameters, OAuthClientId, RequestId } from '@atproto/oauth-provider';
 import { DateISO, JsonEncoded } from '../../../db/index.js';
 export interface AuthorizationRequest {
     id: RequestId;
-    did: string | null;
+    did: Did | null;
     deviceId: DeviceId | null;
     clientId: OAuthClientId;
     clientAuth: JsonEncoded<null | ClientAuth | ClientAuthLegacy>;

package/dist/account-manager/db/schema/authorization-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-request.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorization-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,QAAQ,EACR,mCAAmC,EACnC,aAAa,EACb,SAAS,EACV,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,SAAS,CAAA;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAEzB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,WAAW,CAAC,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAC,CAAA;IAC7D,UAAU,EAAE,WAAW,CAAC,mCAAmC,CAAC,CAAA;IAC5D,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB;AAED,MAAM,MAAM,yBAAyB,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAA;AAExE,eAAO,MAAM,SAAS,0BAA0B,CAAA;AAEhD,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;CAAE,CAAA"}
+{"version":3,"file":"authorization-request.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorization-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,mCAAmC,EACnC,aAAa,EACb,SAAS,EACV,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,SAAS,CAAA;IACb,GAAG,EAAE,GAAG,GAAG,IAAI,CAAA;IACf,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAEzB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,WAAW,CAAC,IAAI,GAAG,UAAU,GAAG,gBAAgB,CAAC,CAAA;IAC7D,UAAU,EAAE,WAAW,CAAC,mCAAmC,CAAC,CAAA;IAC5D,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB;AAED,MAAM,MAAM,yBAAyB,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAA;AAExE,eAAO,MAAM,SAAS,0BAA0B,CAAA;AAEhD,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;CAAE,CAAA"}

package/dist/account-manager/db/schema/authorization-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-request.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorization-request.ts"],"names":[],"mappings":"AA0BA,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAA","sourcesContent":["import { Selectable } from 'kysely'\nimport {\n  ClientAuth,\n  ClientAuthLegacy,\n  Code,\n  DeviceId,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientId,\n  RequestId,\n} from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded } from '../../../db/index.js'\n\nexport interface AuthorizationRequest {\n  id: RequestId\n  did: string | null\n  deviceId: DeviceId | null\n\n  clientId: OAuthClientId\n  clientAuth: JsonEncoded<null | ClientAuth | ClientAuthLegacy>\n  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>\n  expiresAt: DateISO\n  code: Code | null\n}\n\nexport type AuthorizationRequestEntry = Selectable<AuthorizationRequest>\n\nexport const tableName = 'authorization_request'\n\nexport type PartialDB = { [tableName]: AuthorizationRequest }\n"]}
+{"version":3,"file":"authorization-request.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorization-request.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAA","sourcesContent":["import { Selectable } from 'kysely'\nimport {\n  ClientAuth,\n  ClientAuthLegacy,\n  Code,\n  DeviceId,\n  Did,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientId,\n  RequestId,\n} from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded } from '../../../db/index.js'\n\nexport interface AuthorizationRequest {\n  id: RequestId\n  did: Did | null\n  deviceId: DeviceId | null\n\n  clientId: OAuthClientId\n  clientAuth: JsonEncoded<null | ClientAuth | ClientAuthLegacy>\n  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>\n  expiresAt: DateISO\n  code: Code | null\n}\n\nexport type AuthorizationRequestEntry = Selectable<AuthorizationRequest>\n\nexport const tableName = 'authorization_request'\n\nexport type PartialDB = { [tableName]: AuthorizationRequest }\n"]}

package/dist/account-manager/db/schema/authorized-client.d.ts

@@ -1,8 +1,8 @@
 import { Selectable } from 'kysely';
-import { AuthorizedClientData, OAuthClientId } from '@atproto/oauth-provider';
+import { AuthorizedClientData, Did, OAuthClientId } from '@atproto/oauth-provider';
 import { DateISO, JsonEncoded } from '../../../db/index.js';
 export interface AuthorizedClient {
-    did: string;
+    did: Did;
     clientId: OAuthClientId;
     createdAt: DateISO;
     updatedAt: DateISO;

package/dist/account-manager/db/schema/authorized-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-client.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorized-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,aAAa,CAAA;IAEvB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAElB,IAAI,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAA;CACxC;AAED,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;AAEhE,eAAO,MAAM,SAAS,sBAAsB,CAAA;AAE5C,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAA"}
+{"version":3,"file":"authorized-client.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorized-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EACL,oBAAoB,EACpB,GAAG,EACH,aAAa,EACd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,GAAG,CAAA;IACR,QAAQ,EAAE,aAAa,CAAA;IAEvB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAElB,IAAI,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAA;CACxC;AAED,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAA;AAEhE,eAAO,MAAM,SAAS,sBAAsB,CAAA;AAE5C,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAA"}

package/dist/account-manager/db/schema/authorized-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-client.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorized-client.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAA","sourcesContent":["import { Selectable } from 'kysely'\nimport { AuthorizedClientData, OAuthClientId } from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded } from '../../../db/index.js'\n\nexport interface AuthorizedClient {\n  did: string\n  clientId: OAuthClientId\n\n  createdAt: DateISO\n  updatedAt: DateISO\n\n  data: JsonEncoded<AuthorizedClientData>\n}\n\nexport type AuthorizedClientEntry = Selectable<AuthorizedClient>\n\nexport const tableName = 'authorized_client'\n\nexport type PartialDB = { [tableName]: AuthorizedClient }\n"]}
+{"version":3,"file":"authorized-client.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/authorized-client.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAA","sourcesContent":["import { Selectable } from 'kysely'\nimport {\n  AuthorizedClientData,\n  Did,\n  OAuthClientId,\n} from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded } from '../../../db/index.js'\n\nexport interface AuthorizedClient {\n  did: Did\n  clientId: OAuthClientId\n\n  createdAt: DateISO\n  updatedAt: DateISO\n\n  data: JsonEncoded<AuthorizedClientData>\n}\n\nexport type AuthorizedClientEntry = Selectable<AuthorizedClient>\n\nexport const tableName = 'authorized_client'\n\nexport type PartialDB = { [tableName]: AuthorizedClient }\n"]}

package/dist/account-manager/db/schema/token.d.ts

@@ -1,9 +1,9 @@
 import { Generated, Selectable } from 'kysely';
-import { ClientAuth, ClientAuthLegacy, Code, DeviceId, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientId, RefreshToken, Sub, TokenId } from '@atproto/oauth-provider';
+import { ClientAuth, ClientAuthLegacy, Code, DeviceId, Did, OAuthAuthorizationDetails, OAuthAuthorizationRequestParameters, OAuthClientId, RefreshToken, TokenId } from '@atproto/oauth-provider';
 import { DateISO, JsonEncoded } from '../../../db/cast.js';
 export interface Token {
     id: Generated<number>;
-    did: Sub;
+    did: Did;
     tokenId: TokenId;
     createdAt: DateISO;
     updatedAt: DateISO;

package/dist/account-manager/db/schema/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,QAAQ,EACR,yBAAyB,EACzB,mCAAmC,EACnC,aAAa,EACb,YAAY,EACZ,GAAG,EACH,OAAO,EACR,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;IACrB,GAAG,EAAE,GAAG,CAAA;IAER,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,WAAW,CAAC,UAAU,GAAG,gBAAgB,CAAC,CAAA;IACtD,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,WAAW,CAAC,mCAAmC,CAAC,CAAA;IAC5D,OAAO,EAAE,WAAW,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAA;IACtD,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,mBAAmB,EAAE,YAAY,GAAG,IAAI,CAAA;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AAE1C,eAAO,MAAM,SAAS,UAAU,CAAA;AAEhC,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,yBAAyB,EACzB,mCAAmC,EACnC,aAAa,EACb,YAAY,EACZ,OAAO,EACR,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;IACrB,GAAG,EAAE,GAAG,CAAA;IAER,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,WAAW,CAAC,UAAU,GAAG,gBAAgB,CAAC,CAAA;IACtD,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,WAAW,CAAC,mCAAmC,CAAC,CAAA;IAC5D,OAAO,EAAE,WAAW,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAA;IACtD,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,mBAAmB,EAAE,YAAY,GAAG,IAAI,CAAA;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AAE1C,eAAO,MAAM,SAAS,UAAU,CAAA;AAEhC,MAAM,MAAM,SAAS,GAAG;IAAE,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,CAAA"}

package/dist/account-manager/db/schema/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/token.ts"],"names":[],"mappings":"AAmCA,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAA","sourcesContent":["import { Generated, Selectable } from 'kysely'\nimport {\n  ClientAuth,\n  ClientAuthLegacy,\n  Code,\n  DeviceId,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientId,\n  RefreshToken,\n  Sub,\n  TokenId,\n} from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded } from '../../../db/cast.js'\n\nexport interface Token {\n  id: Generated<number>\n  did: Sub\n\n  tokenId: TokenId\n  createdAt: DateISO\n  updatedAt: DateISO\n  expiresAt: DateISO\n  clientId: OAuthClientId\n  clientAuth: JsonEncoded<ClientAuth | ClientAuthLegacy>\n  deviceId: DeviceId | null\n  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>\n  details: JsonEncoded<OAuthAuthorizationDetails> | null\n  code: Code | null\n  currentRefreshToken: RefreshToken | null\n  scope: string | null\n}\n\nexport type TokenEntry = Selectable<Token>\n\nexport const tableName = 'token'\n\nexport type PartialDB = { [tableName]: Token }\n"]}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../../src/account-manager/db/schema/token.ts"],"names":[],"mappings":"AAmCA,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAA","sourcesContent":["import { Generated, Selectable } from 'kysely'\nimport {\n  ClientAuth,\n  ClientAuthLegacy,\n  Code,\n  DeviceId,\n  Did,\n  OAuthAuthorizationDetails,\n  OAuthAuthorizationRequestParameters,\n  OAuthClientId,\n  RefreshToken,\n  TokenId,\n} from '@atproto/oauth-provider'\nimport { DateISO, JsonEncoded } from '../../../db/cast.js'\n\nexport interface Token {\n  id: Generated<number>\n  did: Did\n\n  tokenId: TokenId\n  createdAt: DateISO\n  updatedAt: DateISO\n  expiresAt: DateISO\n  clientId: OAuthClientId\n  clientAuth: JsonEncoded<ClientAuth | ClientAuthLegacy>\n  deviceId: DeviceId | null\n  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>\n  details: JsonEncoded<OAuthAuthorizationDetails> | null\n  code: Code | null\n  currentRefreshToken: RefreshToken | null\n  scope: string | null\n}\n\nexport type TokenEntry = Selectable<Token>\n\nexport const tableName = 'token'\n\nexport type PartialDB = { [tableName]: Token }\n"]}

package/dist/account-manager/helpers/account-device.d.ts

@@ -1,8 +1,8 @@
-import { DeviceId } from '@atproto/oauth-provider';
+import { DeviceId, Did } from '@atproto/oauth-provider';
 import { AccountDb } from '../db/index.js';
 export declare function upsertQB(db: AccountDb, deviceId: DeviceId, did: string): import("kysely").InsertQueryBuilder<import("../db/index.js").DatabaseSchema, "account_device", import("kysely").InsertResult>;
 export declare function selectQB(db: AccountDb, filter: {
-    sub?: string;
+    did?: Did;
     deviceId?: DeviceId;
 }): import("kysely").SelectQueryBuilder<{
     account: import("kysely").Nullable<import("../db/index.js").Account>;
@@ -20,198 +20,25 @@ export declare function selectQB(db: AccountDb, filter: {
     repo_root: import("../db/index.js").RepoRoot;
     token: import("../db/index.js").Token;
     used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor" | "device", import("kysely/dist/esm/util/type-utils.js").MergePartial<import("kysely/dist/esm/util/type-utils.js").MergePartial<Partial<Omit<{}, never>> & Partial<Omit<Partial<Omit<{}, never>>, never>> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor", "account.email" | "account.emailConfirmedAt" | "account.invitesDisabled" | "actor.createdAt" | "actor.deactivatedAt" | "actor.deleteAfter" | "actor.did" | "actor.handle" | "actor.takedownRef"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor", "account_device.createdAt as adCreatedAt" | "account_device.deviceId" | "account_device.updatedAt as adUpdatedAt"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor" | "device", "device.ipAddress" | "device.lastSeenAt" | "device.sessionId" | "device.userAgent">, Partial<Omit<{}, never>> & Partial<Omit<Partial<Omit<{}, never>>, never>> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor", "account.email" | "account.emailConfirmedAt" | "account.invitesDisabled" | "actor.createdAt" | "actor.deactivatedAt" | "actor.deleteAfter" | "actor.did" | "actor.handle" | "actor.takedownRef"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor", "account_device.createdAt as adCreatedAt" | "account_device.deviceId" | "account_device.updatedAt as adUpdatedAt"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor" | "device", "device.ipAddress" | "device.lastSeenAt" | "device.sessionId" | "device.userAgent">>, import("kysely/dist/esm/util/type-utils.js").MergePartial<Partial<Omit<{}, never>> & Partial<Omit<Partial<Omit<{}, never>>, never>> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor", "account.email" | "account.emailConfirmedAt" | "account.invitesDisabled" | "actor.createdAt" | "actor.deactivatedAt" | "actor.deleteAfter" | "actor.did" | "actor.handle" | "actor.takedownRef"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor", "account_device.createdAt as adCreatedAt" | "account_device.deviceId" | "account_device.updatedAt as adUpdatedAt"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor" | "device", "device.ipAddress" | "device.lastSeenAt" | "device.sessionId" | "device.userAgent">, Partial<Omit<{}, never>> & Partial<Omit<Partial<Omit<{}, never>>, never>> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor", "account.email" | "account.emailConfirmedAt" | "account.invitesDisabled" | "actor.createdAt" | "actor.deactivatedAt" | "actor.deleteAfter" | "actor.did" | "actor.handle" | "actor.takedownRef"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor", "account_device.createdAt as adCreatedAt" | "account_device.deviceId" | "account_device.updatedAt as adUpdatedAt"> & import("kysely").Selection<{
-    account: import("kysely").Nullable<import("../db/index.js").Account>;
-    account_device: import("../db/index.js").AccountDevice;
-    actor: import("../db/index.js").Actor;
-    app_password: import("../db/index.js").AppPassword;
-    authorization_request: import("../db/index.js").AuthorizationRequest;
-    authorized_client: import("../db/schema/authorized-client.js").AuthorizedClient;
-    device: import("../db/index.js").Device;
-    email_token: import("../db/index.js").EmailToken;
-    invite_code: import("../db/index.js").InviteCode;
-    invite_code_use: import("../db/index.js").InviteCodeUse;
-    lexicon: import("../db/index.js").Lexicon;
-    refresh_token: import("../db/index.js").RefreshToken;
-    repo_root: import("../db/index.js").RepoRoot;
-    token: import("../db/index.js").Token;
-    used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "account_device" | "actor" | "device", "device.ipAddress" | "device.lastSeenAt" | "device.sessionId" | "device.userAgent">>>>;
-export declare function removeQB(db: AccountDb, deviceId: DeviceId, did: string): import("kysely").DeleteQueryBuilder<import("kysely/dist/esm/parser/table-parser.js").From<import("../db/index.js").DatabaseSchema, "account_device">, "account_device", import("kysely").DeleteResult>;
+}, "account" | "account_device" | "actor" | "device", Partial<Omit<unknown, never>> & {
+    createdAt: string;
+    deactivatedAt: string | null;
+    deleteAfter: string | null;
+    did: `did:${string}:${string}`;
+    email: string | null;
+    emailConfirmedAt: import("@atproto/syntax").DatetimeString | null;
+    handle: `${string}.${string}` | null;
+    invitesDisabled: 0 | 1 | null;
+    takedownRef: string | null;
+} & {
+    adCreatedAt: `${string}T${string}Z`;
+    adUpdatedAt: `${string}T${string}Z`;
+    deviceId: `dev-${string}`;
+} & {
+    ipAddress: string;
+    lastSeenAt: `${string}T${string}Z`;
+    sessionId: `ses-${string}`;
+    userAgent: string | null;
+} & Partial<Omit<unknown, "adCreatedAt" | "adUpdatedAt" | "createdAt" | "deactivatedAt" | "deleteAfter" | "deviceId" | "did" | "email" | "emailConfirmedAt" | "handle" | "invitesDisabled" | "ipAddress" | "lastSeenAt" | "sessionId" | "takedownRef" | "userAgent">>>;
+export declare function removeQB(db: AccountDb, deviceId: DeviceId, did: string): import("kysely").DeleteQueryBuilder<import("../db/index.js").DatabaseSchema, "account_device", import("kysely").DeleteResult>;
 //# sourceMappingURL=account-device.d.ts.map

package/dist/account-manager/helpers/account-device.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-device.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account-device.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAGlD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAiBtE;AAED,wBAAgB,QAAQ,CACtB,EAAE,EAAE,SAAS,EACb,MAAM,EAAE;IACN,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6IA8BF;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,0MAKtE"}
+{"version":3,"file":"account-device.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account-device.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAiBtE;AAED,wBAAgB,QAAQ,CACtB,EAAE,EAAE,SAAS,EACb,MAAM,EAAE;IAAE,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uQA4B3C;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iIAKtE"}

package/dist/account-manager/helpers/account-device.js

@@ -18,7 +18,7 @@ export function upsertQB(db, deviceId, did) {
     }));
 }
 export function selectQB(db, filter) {
-    assert(filter.sub != null || filter.deviceId != null, 'Either sub or deviceId must be provided');
+    assert(filter.did != null || filter.deviceId != null, 'Either sub or deviceId must be provided');
     return (selectAccountQB(db, { includeDeactivated: true })
         // note: query planner should use "account_device_pk" index
         .innerJoin('account_device', 'account_device.did', 'actor.did')
@@ -34,8 +34,8 @@ export function selectQB(db, filter) {
         'device.ipAddress',
         'device.lastSeenAt',
     ])
-        .if(filter.sub != null, (qb) => qb.where('actor.did', '=', filter.sub))
-        .if(filter.deviceId != null, (qb) => qb.where('account_device.deviceId', '=', filter.deviceId)));
+        .$if(filter.did != null, (qb) => qb.where('actor.did', '=', filter.did))
+        .$if(filter.deviceId != null, (qb) => qb.where('account_device.deviceId', '=', filter.deviceId)));
 }
 export function removeQB(db, deviceId, did) {
     return db.db

package/dist/account-manager/helpers/account-device.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-device.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/account-device.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAGhC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,UAAU,QAAQ,CAAC,EAAa,EAAE,QAAkB,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IAEtB,OAAO,EAAE,CAAC,EAAE;SACT,UAAU,CAAC,gBAAgB,CAAC;SAC5B,MAAM,CAAC;QACN,GAAG;QACH,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;QACzB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;KAC1B,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE;IACjB,UAAU;IACV,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;KAC1B,CAAC,CACH,CAAA;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,EAAa,EACb,MAGC;IAED,MAAM,CACJ,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAC7C,yCAAyC,CAC1C,CAAA;IAED,OAAO,CACL,eAAe,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC/C,2DAA2D;SAC1D,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,CAAC;SAC9D,MAAM,CAAC;QACN,yBAAyB;QACzB,yCAAyC;QACzC,yCAAyC;KAC1C,CAAC;SACD,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,yBAAyB,CAAC;SAC3D,MAAM,CAAC;QACN,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;SACD,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAC7B,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAiB,CAAC,CACrD;SACA,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAClC,EAAE,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,QAAS,CAAC,CAC3D,CACJ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAa,EAAE,QAAkB,EAAE,GAAW;IACrE,OAAO,EAAE,CAAC,EAAE;SACT,UAAU,CAAC,gBAAgB,CAAC;SAC5B,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;SAChC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC","sourcesContent":["import assert from 'node:assert'\nimport { DeviceId } from '@atproto/oauth-provider'\nimport { DidString } from '@atproto/syntax'\nimport { toDateISO } from '../../db/index.js'\nimport { AccountDb } from '../db/index.js'\nimport { selectAccountQB } from './account.js'\n\nexport function upsertQB(db: AccountDb, deviceId: DeviceId, did: string) {\n  const now = new Date()\n\n  return db.db\n    .insertInto('account_device')\n    .values({\n      did,\n      deviceId,\n      createdAt: toDateISO(now),\n      updatedAt: toDateISO(now),\n    })\n    .onConflict((oc) =>\n      // uses pk\n      oc.columns(['deviceId', 'did']).doUpdateSet({\n        updatedAt: toDateISO(now),\n      }),\n    )\n}\n\nexport function selectQB(\n  db: AccountDb,\n  filter: {\n    sub?: string\n    deviceId?: DeviceId\n  },\n) {\n  assert(\n    filter.sub != null || filter.deviceId != null,\n    'Either sub or deviceId must be provided',\n  )\n\n  return (\n    selectAccountQB(db, { includeDeactivated: true })\n      // note: query planner should use \"account_device_pk\" index\n      .innerJoin('account_device', 'account_device.did', 'actor.did')\n      .select([\n        'account_device.deviceId',\n        'account_device.createdAt as adCreatedAt',\n        'account_device.updatedAt as adUpdatedAt',\n      ])\n      .innerJoin('device', 'device.id', 'account_device.deviceId')\n      .select([\n        'device.sessionId',\n        'device.userAgent',\n        'device.ipAddress',\n        'device.lastSeenAt',\n      ])\n      .if(filter.sub != null, (qb) =>\n        qb.where('actor.did', '=', filter.sub! as DidString),\n      )\n      .if(filter.deviceId != null, (qb) =>\n        qb.where('account_device.deviceId', '=', filter.deviceId!),\n      )\n  )\n}\n\nexport function removeQB(db: AccountDb, deviceId: DeviceId, did: string) {\n  return db.db\n    .deleteFrom('account_device')\n    .where('deviceId', '=', deviceId)\n    .where('did', '=', did)\n}\n"]}
+{"version":3,"file":"account-device.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/account-device.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,UAAU,QAAQ,CAAC,EAAa,EAAE,QAAkB,EAAE,GAAW;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IAEtB,OAAO,EAAE,CAAC,EAAE;SACT,UAAU,CAAC,gBAAgB,CAAC;SAC5B,MAAM,CAAC;QACN,GAAG;QACH,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;QACzB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;KAC1B,CAAC;SACD,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE;IACjB,UAAU;IACV,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;KAC1B,CAAC,CACH,CAAA;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,EAAa,EACb,MAA0C;IAE1C,MAAM,CACJ,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,EAC7C,yCAAyC,CAC1C,CAAA;IAED,OAAO,CACL,eAAe,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC/C,2DAA2D;SAC1D,SAAS,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,CAAC;SAC9D,MAAM,CAAC;QACN,yBAAyB;QACzB,yCAAyC;QACzC,yCAAyC;KAC1C,CAAC;SACD,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,yBAAyB,CAAC;SAC3D,MAAM,CAAC;QACN,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;SACD,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAI,CAAC,CAAC;SACxE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CACnC,EAAE,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,QAAS,CAAC,CAC3D,CACJ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,EAAa,EAAE,QAAkB,EAAE,GAAW;IACrE,OAAO,EAAE,CAAC,EAAE;SACT,UAAU,CAAC,gBAAgB,CAAC;SAC5B,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;SAChC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC","sourcesContent":["import assert from 'node:assert'\nimport { DeviceId, Did } from '@atproto/oauth-provider'\nimport { toDateISO } from '../../db/index.js'\nimport { AccountDb } from '../db/index.js'\nimport { selectAccountQB } from './account.js'\n\nexport function upsertQB(db: AccountDb, deviceId: DeviceId, did: string) {\n  const now = new Date()\n\n  return db.db\n    .insertInto('account_device')\n    .values({\n      did,\n      deviceId,\n      createdAt: toDateISO(now),\n      updatedAt: toDateISO(now),\n    })\n    .onConflict((oc) =>\n      // uses pk\n      oc.columns(['deviceId', 'did']).doUpdateSet({\n        updatedAt: toDateISO(now),\n      }),\n    )\n}\n\nexport function selectQB(\n  db: AccountDb,\n  filter: { did?: Did; deviceId?: DeviceId },\n) {\n  assert(\n    filter.did != null || filter.deviceId != null,\n    'Either sub or deviceId must be provided',\n  )\n\n  return (\n    selectAccountQB(db, { includeDeactivated: true })\n      // note: query planner should use \"account_device_pk\" index\n      .innerJoin('account_device', 'account_device.did', 'actor.did')\n      .select([\n        'account_device.deviceId',\n        'account_device.createdAt as adCreatedAt',\n        'account_device.updatedAt as adUpdatedAt',\n      ])\n      .innerJoin('device', 'device.id', 'account_device.deviceId')\n      .select([\n        'device.sessionId',\n        'device.userAgent',\n        'device.ipAddress',\n        'device.lastSeenAt',\n      ])\n      .$if(filter.did != null, (qb) => qb.where('actor.did', '=', filter.did!))\n      .$if(filter.deviceId != null, (qb) =>\n        qb.where('account_device.deviceId', '=', filter.deviceId!),\n      )\n  )\n}\n\nexport function removeQB(db: AccountDb, deviceId: DeviceId, did: string) {\n  return db.db\n    .deleteFrom('account_device')\n    .where('deviceId', '=', deviceId)\n    .where('did', '=', did)\n}\n"]}

package/dist/account-manager/helpers/account.d.ts

@@ -21,7 +21,7 @@ export declare enum AccountStatus {
     Deleted = "deleted",
     Deactivated = "deactivated"
 }
-export declare const selectAccountQB: (db: AccountDb, flags?: AvailabilityFlags) => import("kysely").QueryBuilderWithSelection<{
+export declare const selectAccountQB: (db: AccountDb, flags?: AvailabilityFlags) => import("kysely").SelectQueryBuilder<{
     account: import("kysely").Nullable<import("../db/index.js").Account>;
     account_device: import("../db/index.js").AccountDevice;
     actor: import("../db/index.js").Actor;
@@ -37,7 +37,17 @@ export declare const selectAccountQB: (db: AccountDb, flags?: AvailabilityFlags)
     repo_root: import("../db/index.js").RepoRoot;
     token: import("../db/index.js").Token;
     used_refresh_token: import("../db/index.js").UsedRefreshToken;
-}, "account" | "actor", import("kysely/dist/esm/util/type-utils.js").MergePartial<Partial<Omit<{}, never>>, Partial<Omit<{}, never>>>, "account.email" | "account.emailConfirmedAt" | "account.invitesDisabled" | "actor.createdAt" | "actor.deactivatedAt" | "actor.deleteAfter" | "actor.did" | "actor.handle" | "actor.takedownRef">;
+}, "account" | "actor", Partial<Omit<unknown, never>> & {
+    createdAt: string;
+    deactivatedAt: string | null;
+    deleteAfter: string | null;
+    did: `did:${string}:${string}`;
+    email: string | null;
+    emailConfirmedAt: DatetimeString | null;
+    handle: `${string}.${string}` | null;
+    invitesDisabled: 0 | 1 | null;
+    takedownRef: string | null;
+}>;
 export declare const getAccount: (db: AccountDb, handleOrDid: AtIdentifierString, flags?: AvailabilityFlags) => Promise<ActorAccount | null>;
 export declare const getAccounts: (db: AccountDb, dids: DidString[], flags?: AvailabilityFlags) => Promise<Map<string, ActorAccount>>;
 export declare const getAccountByEmail: (db: AccountDb, email: string, flags?: AvailabilityFlags) => Promise<ActorAccount | null>;
@@ -60,8 +70,8 @@ export declare const getAccountAdminStatus: (db: AccountDb, did: DidString) => P
     deactivated: com.atproto.admin.defs.StatusAttr;
 } | null>;
 export declare const updateAccountTakedownStatus: (db: AccountDb, did: DidString, takedown: com.atproto.admin.defs.StatusAttr) => Promise<void>;
-export declare const deactivateAccount: (db: AccountDb, did: DidString, deleteAfter: string | null) => Promise<void>;
-export declare const activateAccount: (db: AccountDb, did: DidString) => Promise<void>;
+export declare const deactivateAccount: (db: AccountDb, did: DidString, deleteAfter: string | null) => Promise<boolean>;
+export declare const activateAccount: (db: AccountDb, did: DidString, flags?: AvailabilityFlags) => Promise<boolean>;
 export declare const formatAccountStatus: (account: null | {
     takedownRef: string | null;
     deactivatedAt: string | null;

package/dist/account-manager/helpers/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,YAAY,EAGb,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEtD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,IAAI,SAA2B;IAC/B,YACE,OAAO,SAAwE,EAC/E,OAAO,CAAC,EAAE,YAAY,EAGvB;CACF;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,eAAe,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,eAAe,OAAQ,SAAS,UAAU,iBAAiB;;;;;;;;;;;;;;;;uUAqBvE,CAAA;AAED,eAAO,MAAM,UAAU,OACjB,SAAS,eACA,kBAAkB,UACvB,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAW7B,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,QACP,SAAS,EAAE,UACT,iBAAiB,KACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAgBnC,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,SACN,MAAM,UACL,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAK7B,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,QACP;IACJ,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,kBAqBF,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,QACP;IACJ,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;CACvB,kBAiBF,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,OACR,SAAS,KACb,OAAO,CAAC,IAAI,CAkBd,CAAA;AAED,eAAO,MAAM,YAAY,OACnB,SAAS,OACR,SAAS,UACN,YAAY,kBAsBrB,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,OACR,SAAS,SACP,MAAM,kBAkBd,CAAA;AAED,eAAO,MAAM,mBAAmB,OAC1B,SAAS,OACR,SAAS,oBACI,cAAc,kBAQjC,CAAA;AAED,eAAO,MAAM,qBAAqB,OAC5B,SAAS,OACR,SAAS,KACb,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;IAC3C,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;CAC/C,GAAG,IAAI,CAYP,CAAA;AAED,eAAO,MAAM,2BAA2B,OAClC,SAAS,OACR,SAAS,YACJ,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,kBAQ5C,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,OACR,SAAS,eACD,MAAM,GAAG,IAAI,kBAW3B,CAAA;AAED,eAAO,MAAM,eAAe,OAAc,SAAS,OAAO,SAAS,kBAUlE,CAAA;AAED,eAAO,MAAM,mBAAmB,YACrB,IAAI,GAAG;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;;;;;;;;;;;;CAWF,CAAA"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/account.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,YAAY,EAGb,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEtD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,IAAI,SAA2B;IAC/B,YACE,OAAO,SAAwE,EAC/E,OAAO,CAAC,EAAE,YAAY,EAGvB;CACF;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,eAAe,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B,CAAA;AAED,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,eAAe,OAAQ,SAAS,UAAU,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBvE,CAAA;AAED,eAAO,MAAM,UAAU,OACjB,SAAS,eACA,kBAAkB,UACvB,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAW7B,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,QACP,SAAS,EAAE,UACT,iBAAiB,KACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAgBnC,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,SACN,MAAM,UACL,iBAAiB,KACxB,OAAO,CAAC,YAAY,GAAG,IAAI,CAK7B,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,QACP;IACJ,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB,kBAqBF,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,QACP;IACJ,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;CACvB,kBAiBF,CAAA;AAED,eAAO,MAAM,aAAa,OACpB,SAAS,OACR,SAAS,KACb,OAAO,CAAC,IAAI,CAkBd,CAAA;AAED,eAAO,MAAM,YAAY,OACnB,SAAS,OACR,SAAS,UACN,YAAY,kBA0BrB,CAAA;AAED,eAAO,MAAM,WAAW,OAClB,SAAS,OACR,SAAS,SACP,MAAM,kBAkBd,CAAA;AAED,eAAO,MAAM,mBAAmB,OAC1B,SAAS,OACR,SAAS,oBACI,cAAc,kBAQjC,CAAA;AAED,eAAO,MAAM,qBAAqB,OAC5B,SAAS,OACR,SAAS,KACb,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;IAC3C,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAA;CAC/C,GAAG,IAAI,CAYP,CAAA;AAED,eAAO,MAAM,2BAA2B,OAClC,SAAS,OACR,SAAS,YACJ,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,kBAQ5C,CAAA;AAED,eAAO,MAAM,iBAAiB,OACxB,SAAS,OACR,SAAS,eACD,MAAM,GAAG,IAAI,KACzB,OAAO,CAAC,OAAO,CAYjB,CAAA;AAED,eAAO,MAAM,eAAe,OACtB,SAAS,OACR,SAAS,UACN,iBAAiB,KACxB,OAAO,CAAC,OAAO,CAqBjB,CAAA;AAED,eAAO,MAAM,mBAAmB,YACrB,IAAI,GAAG;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;;;;;;;;;;;;CAWF,CAAA"}

package/dist/account-manager/helpers/account.js

@@ -21,8 +21,8 @@ export const selectAccountQB = (db, flags) => {
     return db.db
         .selectFrom('actor')
         .leftJoin('account', 'actor.did', 'account.did')
-        .if(!includeTakenDown, (qb) => qb.where(notSoftDeletedClause(ref('actor'))))
-        .if(!includeDeactivated, (qb) => qb.where('actor.deactivatedAt', 'is', null))
+        .$if(!includeTakenDown, (qb) => qb.where(notSoftDeletedClause(ref('actor'))))
+        .$if(!includeDeactivated, (qb) => qb.where('actor.deactivatedAt', 'is', null))
         .select([
         'actor.did',
         'actor.handle',
@@ -37,12 +37,12 @@ export const selectAccountQB = (db, flags) => {
 };
 export const getAccount = async (db, handleOrDid, flags) => {
     const found = await selectAccountQB(db, flags)
-        .where((qb) => {
+        .where((eb) => {
         if (isDidIdentifier(handleOrDid)) {
-            return qb.where('actor.did', '=', handleOrDid);
+            return eb('actor.did', '=', handleOrDid);
         }
         else {
-            return qb.where('actor.handle', '=', handleOrDid);
+            return eb('actor.handle', '=', handleOrDid);
         }
     })
         .executeTakeFirst();
@@ -117,11 +117,11 @@ export const updateHandle = async (db, did, handle) => {
         .updateTable('actor')
         .set({ handle })
         .where('did', '=', did)
-        .whereNotExists(db.db
+        .where(({ not, exists }) => not(exists(db.db
         .selectFrom('actor')
         .where('handle', '=', handle)
         .where('did', '!=', did)
-        .selectAll()));
+        .selectAll()))));
     if (res.numUpdatedRows < 1) {
         throw new UserAlreadyExistsError('Handle is already in use, please choose a different handle.');
     }
@@ -170,22 +170,28 @@ export const updateAccountTakedownStatus = async (db, did, takedown) => {
     await db.executeWithRetry(db.db.updateTable('actor').set({ takedownRef }).where('did', '=', did));
 };
 export const deactivateAccount = async (db, did, deleteAfter) => {
-    await db.executeWithRetry(db.db
+    const [res] = await db.executeWithRetry(db.db
         .updateTable('actor')
         .set({
         deactivatedAt: currentDatetimeString(),
         deleteAfter,
     })
         .where('did', '=', did));
+    return res.numUpdatedRows > 0;
 };
-export const activateAccount = async (db, did) => {
-    await db.executeWithRetry(db.db
+export const activateAccount = async (db, did, flags) => {
+    const { includeTakenDown = false, includeDeactivated = true } = flags ?? {};
+    const { ref } = db.db.dynamic;
+    const [res] = await db.executeWithRetry(db.db
         .updateTable('actor')
         .set({
         deactivatedAt: null,
         deleteAfter: null,
     })
-        .where('did', '=', did));
+        .where('did', '=', did)
+        .$if(!includeTakenDown, (q) => q.where(notSoftDeletedClause(ref('actor'))))
+        .$if(!includeDeactivated, (q) => q.where('actor.deactivatedAt', 'is not', null)));
+    return res.numUpdatedRows > 0;
 };
 export const formatAccountStatus = (account) => {
     if (!account) {