@atproto/pds 0.5.5 → 0.5.7

package/dist/account-manager/helpers/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,OAAO,EACR,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAGjD,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAa7D;AAuBD,eAAO,MAAM,QAAQ,OACf,SAAS,WACJ,OAAO,QACV,SAAS,iBACA,YAAY,yHAiB5B,CAAA;AAED,eAAO,MAAM,WAAW,OAAQ,SAAS,MAAM,OAAO,mMAKZ,CAAA;AAE1C,eAAO,MAAM,QAAQ,OACf,SAAS,UACL;IACN,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,mBAAmB,CAAC,EAAE,YAAY,CAAA;CACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8SAoCF,CAAA;AAED,eAAO,MAAM,aAAa,OAAQ,SAAS,OAAO,MAAM,yLAEN,CAAA;AAElD,eAAO,MAAM,QAAQ,OACf,SAAS,MACT,MAAM,cACE,OAAO,mBACF,YAAY,WACpB,YAAY,kMAcE,CAAA;AAEzB,eAAO,MAAM,QAAQ,OAAQ,SAAS,WAAW,OAAO,yLAEE,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EACL,IAAI,EACJ,GAAG,EACH,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,OAAO,EACR,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAGjD,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAa7D;AAuBD,eAAO,MAAM,QAAQ,OACf,SAAS,WACJ,OAAO,QACV,SAAS,iBACA,YAAY,yHAiB5B,CAAA;AAED,eAAO,MAAM,WAAW,OAAQ,SAAS,MAAM,OAAO;;;EAKZ,CAAA;AAE1C,eAAO,MAAM,QAAQ,OACf,SAAS,UACL;IACN,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,mBAAmB,CAAC,EAAE,YAAY,CAAA;CACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8TAoCF,CAAA;AAED,eAAO,MAAM,WAAW,OAAc,SAAS,OAAO,GAAG,kBAOxD,CAAA;AAED,eAAO,MAAM,QAAQ,OACf,SAAS,MACT,MAAM,cACE,OAAO,mBACF,YAAY,WACpB,YAAY,kIAcE,CAAA;AAEzB,eAAO,MAAM,QAAQ,OAAQ,SAAS,WAAW,OAAO,yHAEE,CAAA"}

package/dist/account-manager/helpers/token.js

@@ -8,7 +8,7 @@ export function toTokenData(row) {
         clientId: row.clientId,
         clientAuth: fromJson(row.clientAuth),
         deviceId: row.deviceId,
-        sub: row.did,
+        did: row.did,
         parameters: fromJson(row.parameters),
         code: row.code,
         scope: row.scope,
@@ -42,7 +42,7 @@ export const createQB = (db, tokenId, data, refreshToken) => {
         clientId: data.clientId,
         clientAuth: toJson(data.clientAuth),
         deviceId: data.deviceId,
-        did: data.sub,
+        did: data.did,
         parameters: toJson(data.parameters),
         details: data.details ? toJson(data.details) : null,
         code: data.code,
@@ -65,27 +65,30 @@ export const findByQB = (db, search) => {
         throw new TypeError('At least one search parameter is required');
     }
     return selectTokenInfoQB(db)
-        .if(search.id !== undefined, (qb) => 
+        .$if(search.id !== undefined, (qb) => 
     // uses primary key index
     qb.where('token.id', '=', search.id))
-        .if(search.did !== undefined, (qb) => 
+        .$if(search.did !== undefined, (qb) => 
     // uses "token_did_idx" index
     qb.where('token.did', '=', search.did))
-        .if(search.code !== undefined, (qb) => 
+        .$if(search.code !== undefined, (qb) => 
     // uses "token_code_idx" partial index (hence the null check)
     qb
         .where('token.code', '=', search.code)
         .where('token.code', 'is not', null))
-        .if(search.tokenId !== undefined, (qb) => 
+        .$if(search.tokenId !== undefined, (qb) => 
     // uses "token_token_id_idx"
     qb.where('token.tokenId', '=', search.tokenId))
-        .if(search.currentRefreshToken !== undefined, (qb) => 
+        .$if(search.currentRefreshToken !== undefined, (qb) => 
     // uses "token_refresh_token_unique_idx"
     qb.where('token.currentRefreshToken', '=', search.currentRefreshToken));
 };
-export const removeByDidQB = (db, did) => 
-// uses "token_did_idx" index
-db.db.deleteFrom('token').where('did', '=', did);
+export const removeByDid = async (db, did) => {
+    await db.executeWithRetry(db.db
+        .deleteFrom('token')
+        // uses "token_did_idx" index
+        .where('did', '=', did));
+};
 export const rotateQB = (db, id, newTokenId, newRefreshToken, newData) => db.db
     .updateTable('token')
     .set({

package/dist/account-manager/helpers/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/token.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,EAAa,EAAE,EAAE,CAC1C,eAAe,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC/C,2DAA2D;KAC1D,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;KAC5C,MAAM,CAAC;IACN,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,2BAA2B;IAC3B,aAAa;CACd,CAAC,CAAA;AAEN,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,OAAgB,EAChB,IAAe,EACf,YAA2B,EAC3B,EAAE;IACF,OAAO,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACtC,OAAO;QACP,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QACnD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,mBAAmB,EAAE,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAa,EAAE,EAAW,EAAE,EAAE,CACxD,EAAE,CAAC,EAAE;KACF,UAAU,CAAC,OAAO,CAAC;KACnB,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KACzB,KAAK,CAAC,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC;KAC5C,MAAM,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,MAMC,EACD,EAAE;IACF,IACE,MAAM,CAAC,EAAE,KAAK,SAAS;QACvB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,CAAC,mBAAmB,KAAK,SAAS,EACxC,CAAC;QACD,0BAA0B;QAC1B,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IAClE,CAAC;IAED,OAAO,iBAAiB,CAAC,EAAE,CAAC;SACzB,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IAClC,yBAAyB;IACzB,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,EAAG,CAAC,CACtC;SACA,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACnC,6BAA6B;IAC7B,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAI,CAAC,CACxC;SACA,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACpC,6DAA6D;IAC7D,EAAE;SACC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,IAAK,CAAC;SACtC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CACvC;SACA,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACvC,4BAA4B;IAC5B,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,OAAQ,CAAC,CAChD;SACA,EAAE,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACnD,wCAAwC;IACxC,EAAE,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,EAAE,MAAM,CAAC,mBAAoB,CAAC,CACxE,CAAA;AACL,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAa,EAAE,GAAW,EAAE,EAAE;AAC1D,6BAA6B;AAC7B,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAElD,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,EAAU,EACV,UAAmB,EACnB,eAA6B,EAC7B,OAAqB,EACrB,EAAE,CACF,EAAE,CAAC,EAAE;KACF,WAAW,CAAC,OAAO,CAAC;KACpB,GAAG,CAAC;IACH,OAAO,EAAE,UAAU;IACnB,mBAAmB,EAAE,eAAe;IAEpC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC,KAAK;CACrB,CAAC;IACF,yBAAyB;KACxB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;AAEzB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAa,EAAE,OAAgB,EAAE,EAAE;AAC1D,iDAAiD;AACjD,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA","sourcesContent":["import { Selectable } from 'kysely'\nimport {\n  Code,\n  NewTokenData,\n  RefreshToken,\n  TokenData,\n  TokenId,\n} from '@atproto/oauth-provider'\nimport { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'\nimport { AccountDb, Token } from '../db/index.js'\nimport { selectAccountQB } from './account.js'\n\nexport function toTokenData(row: Selectable<Token>): TokenData {\n  return {\n    createdAt: fromDateISO(row.createdAt),\n    expiresAt: fromDateISO(row.expiresAt),\n    updatedAt: fromDateISO(row.updatedAt),\n    clientId: row.clientId,\n    clientAuth: fromJson(row.clientAuth),\n    deviceId: row.deviceId,\n    sub: row.did,\n    parameters: fromJson(row.parameters),\n    code: row.code,\n    scope: row.scope,\n  }\n}\n\nconst selectTokenInfoQB = (db: AccountDb) =>\n  selectAccountQB(db, { includeDeactivated: true })\n    // uses \"token_did_idx\" index (though unlikely in practice)\n    .innerJoin('token', 'token.did', 'actor.did')\n    .select([\n      'token.id',\n      'token.tokenId',\n      'token.createdAt',\n      'token.updatedAt',\n      'token.expiresAt',\n      'token.clientId',\n      'token.clientAuth',\n      'token.deviceId',\n      'token.did',\n      'token.parameters',\n      'token.details',\n      'token.code',\n      'token.currentRefreshToken',\n      'token.scope',\n    ])\n\nexport const createQB = (\n  db: AccountDb,\n  tokenId: TokenId,\n  data: TokenData,\n  refreshToken?: RefreshToken,\n) => {\n  return db.db.insertInto('token').values({\n    tokenId,\n    createdAt: toDateISO(data.createdAt),\n    expiresAt: toDateISO(data.expiresAt),\n    updatedAt: toDateISO(data.updatedAt),\n    clientId: data.clientId,\n    clientAuth: toJson(data.clientAuth),\n    deviceId: data.deviceId,\n    did: data.sub,\n    parameters: toJson(data.parameters),\n    details: data.details ? toJson(data.details) : null,\n    code: data.code,\n    currentRefreshToken: refreshToken || null,\n    scope: data.scope,\n  })\n}\n\nexport const forRotateQB = (db: AccountDb, id: TokenId) =>\n  db.db\n    .selectFrom('token')\n    .where('tokenId', '=', id)\n    .where('currentRefreshToken', 'is not', null)\n    .select(['id', 'currentRefreshToken'])\n\nexport const findByQB = (\n  db: AccountDb,\n  search: {\n    id?: number\n    did?: string\n    code?: Code\n    tokenId?: TokenId\n    currentRefreshToken?: RefreshToken\n  },\n) => {\n  if (\n    search.id === undefined &&\n    search.did === undefined &&\n    search.code === undefined &&\n    search.tokenId === undefined &&\n    search.currentRefreshToken === undefined\n  ) {\n    // Prevent accidental scan\n    throw new TypeError('At least one search parameter is required')\n  }\n\n  return selectTokenInfoQB(db)\n    .if(search.id !== undefined, (qb) =>\n      // uses primary key index\n      qb.where('token.id', '=', search.id!),\n    )\n    .if(search.did !== undefined, (qb) =>\n      // uses \"token_did_idx\" index\n      qb.where('token.did', '=', search.did!),\n    )\n    .if(search.code !== undefined, (qb) =>\n      // uses \"token_code_idx\" partial index (hence the null check)\n      qb\n        .where('token.code', '=', search.code!)\n        .where('token.code', 'is not', null),\n    )\n    .if(search.tokenId !== undefined, (qb) =>\n      // uses \"token_token_id_idx\"\n      qb.where('token.tokenId', '=', search.tokenId!),\n    )\n    .if(search.currentRefreshToken !== undefined, (qb) =>\n      // uses \"token_refresh_token_unique_idx\"\n      qb.where('token.currentRefreshToken', '=', search.currentRefreshToken!),\n    )\n}\n\nexport const removeByDidQB = (db: AccountDb, did: string) =>\n  // uses \"token_did_idx\" index\n  db.db.deleteFrom('token').where('did', '=', did)\n\nexport const rotateQB = (\n  db: AccountDb,\n  id: number,\n  newTokenId: TokenId,\n  newRefreshToken: RefreshToken,\n  newData: NewTokenData,\n) =>\n  db.db\n    .updateTable('token')\n    .set({\n      tokenId: newTokenId,\n      currentRefreshToken: newRefreshToken,\n\n      expiresAt: toDateISO(newData.expiresAt),\n      updatedAt: toDateISO(newData.updatedAt),\n      clientAuth: toJson(newData.clientAuth),\n      scope: newData.scope,\n    })\n    // uses primary key index\n    .where('id', '=', id)\n\nexport const removeQB = (db: AccountDb, tokenId: TokenId) =>\n  // uses \"used_refresh_token_fk\" to cascade delete\n  db.db.deleteFrom('token').where('tokenId', '=', tokenId)\n"]}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/account-manager/helpers/token.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,UAAU,WAAW,CAAC,GAAsB;IAChD,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,EAAa,EAAE,EAAE,CAC1C,eAAe,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC/C,2DAA2D;KAC1D,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;KAC5C,MAAM,CAAC;IACN,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,gBAAgB;IAChB,WAAW;IACX,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,2BAA2B;IAC3B,aAAa;CACd,CAAC,CAAA;AAEN,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,OAAgB,EAChB,IAAe,EACf,YAA2B,EAC3B,EAAE;IACF,OAAO,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACtC,OAAO;QACP,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QACnD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,mBAAmB,EAAE,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAa,EAAE,EAAW,EAAE,EAAE,CACxD,EAAE,CAAC,EAAE;KACF,UAAU,CAAC,OAAO,CAAC;KACnB,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KACzB,KAAK,CAAC,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC;KAC5C,MAAM,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,MAMC,EACD,EAAE;IACF,IACE,MAAM,CAAC,EAAE,KAAK,SAAS;QACvB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,CAAC,mBAAmB,KAAK,SAAS,EACxC,CAAC;QACD,0BAA0B;QAC1B,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IAClE,CAAC;IAED,OAAO,iBAAiB,CAAC,EAAE,CAAC;SACzB,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACnC,yBAAyB;IACzB,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,EAAG,CAAC,CACtC;SACA,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACpC,6BAA6B;IAC7B,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAI,CAAC,CACxC;SACA,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACrC,6DAA6D;IAC7D,EAAE;SACC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,IAAK,CAAC;SACtC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CACvC;SACA,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACxC,4BAA4B;IAC5B,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,OAAQ,CAAC,CAChD;SACA,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;IACpD,wCAAwC;IACxC,EAAE,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,EAAE,MAAM,CAAC,mBAAoB,CAAC,CACxE,CAAA;AACL,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,EAAa,EAAE,GAAQ,EAAE,EAAE;IAC3D,MAAM,EAAE,CAAC,gBAAgB,CACvB,EAAE,CAAC,EAAE;SACF,UAAU,CAAC,OAAO,CAAC;QACpB,6BAA6B;SAC5B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,EAAU,EACV,UAAmB,EACnB,eAA6B,EAC7B,OAAqB,EACrB,EAAE,CACF,EAAE,CAAC,EAAE;KACF,WAAW,CAAC,OAAO,CAAC;KACpB,GAAG,CAAC;IACH,OAAO,EAAE,UAAU;IACnB,mBAAmB,EAAE,eAAe;IAEpC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC,KAAK;CACrB,CAAC;IACF,yBAAyB;KACxB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;AAEzB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAa,EAAE,OAAgB,EAAE,EAAE;AAC1D,iDAAiD;AACjD,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA","sourcesContent":["import { Selectable } from 'kysely'\nimport {\n  Code,\n  Did,\n  NewTokenData,\n  RefreshToken,\n  TokenData,\n  TokenId,\n} from '@atproto/oauth-provider'\nimport { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'\nimport { AccountDb, Token } from '../db/index.js'\nimport { selectAccountQB } from './account.js'\n\nexport function toTokenData(row: Selectable<Token>): TokenData {\n  return {\n    createdAt: fromDateISO(row.createdAt),\n    expiresAt: fromDateISO(row.expiresAt),\n    updatedAt: fromDateISO(row.updatedAt),\n    clientId: row.clientId,\n    clientAuth: fromJson(row.clientAuth),\n    deviceId: row.deviceId,\n    did: row.did,\n    parameters: fromJson(row.parameters),\n    code: row.code,\n    scope: row.scope,\n  }\n}\n\nconst selectTokenInfoQB = (db: AccountDb) =>\n  selectAccountQB(db, { includeDeactivated: true })\n    // uses \"token_did_idx\" index (though unlikely in practice)\n    .innerJoin('token', 'token.did', 'actor.did')\n    .select([\n      'token.id',\n      'token.tokenId',\n      'token.createdAt',\n      'token.updatedAt',\n      'token.expiresAt',\n      'token.clientId',\n      'token.clientAuth',\n      'token.deviceId',\n      'token.did',\n      'token.parameters',\n      'token.details',\n      'token.code',\n      'token.currentRefreshToken',\n      'token.scope',\n    ])\n\nexport const createQB = (\n  db: AccountDb,\n  tokenId: TokenId,\n  data: TokenData,\n  refreshToken?: RefreshToken,\n) => {\n  return db.db.insertInto('token').values({\n    tokenId,\n    createdAt: toDateISO(data.createdAt),\n    expiresAt: toDateISO(data.expiresAt),\n    updatedAt: toDateISO(data.updatedAt),\n    clientId: data.clientId,\n    clientAuth: toJson(data.clientAuth),\n    deviceId: data.deviceId,\n    did: data.did,\n    parameters: toJson(data.parameters),\n    details: data.details ? toJson(data.details) : null,\n    code: data.code,\n    currentRefreshToken: refreshToken || null,\n    scope: data.scope,\n  })\n}\n\nexport const forRotateQB = (db: AccountDb, id: TokenId) =>\n  db.db\n    .selectFrom('token')\n    .where('tokenId', '=', id)\n    .where('currentRefreshToken', 'is not', null)\n    .select(['id', 'currentRefreshToken'])\n\nexport const findByQB = (\n  db: AccountDb,\n  search: {\n    id?: number\n    did?: Did\n    code?: Code\n    tokenId?: TokenId\n    currentRefreshToken?: RefreshToken\n  },\n) => {\n  if (\n    search.id === undefined &&\n    search.did === undefined &&\n    search.code === undefined &&\n    search.tokenId === undefined &&\n    search.currentRefreshToken === undefined\n  ) {\n    // Prevent accidental scan\n    throw new TypeError('At least one search parameter is required')\n  }\n\n  return selectTokenInfoQB(db)\n    .$if(search.id !== undefined, (qb) =>\n      // uses primary key index\n      qb.where('token.id', '=', search.id!),\n    )\n    .$if(search.did !== undefined, (qb) =>\n      // uses \"token_did_idx\" index\n      qb.where('token.did', '=', search.did!),\n    )\n    .$if(search.code !== undefined, (qb) =>\n      // uses \"token_code_idx\" partial index (hence the null check)\n      qb\n        .where('token.code', '=', search.code!)\n        .where('token.code', 'is not', null),\n    )\n    .$if(search.tokenId !== undefined, (qb) =>\n      // uses \"token_token_id_idx\"\n      qb.where('token.tokenId', '=', search.tokenId!),\n    )\n    .$if(search.currentRefreshToken !== undefined, (qb) =>\n      // uses \"token_refresh_token_unique_idx\"\n      qb.where('token.currentRefreshToken', '=', search.currentRefreshToken!),\n    )\n}\n\nexport const removeByDid = async (db: AccountDb, did: Did) => {\n  await db.executeWithRetry(\n    db.db\n      .deleteFrom('token')\n      // uses \"token_did_idx\" index\n      .where('did', '=', did),\n  )\n}\n\nexport const rotateQB = (\n  db: AccountDb,\n  id: number,\n  newTokenId: TokenId,\n  newRefreshToken: RefreshToken,\n  newData: NewTokenData,\n) =>\n  db.db\n    .updateTable('token')\n    .set({\n      tokenId: newTokenId,\n      currentRefreshToken: newRefreshToken,\n\n      expiresAt: toDateISO(newData.expiresAt),\n      updatedAt: toDateISO(newData.updatedAt),\n      clientAuth: toJson(newData.clientAuth),\n      scope: newData.scope,\n    })\n    // uses primary key index\n    .where('id', '=', id)\n\nexport const removeQB = (db: AccountDb, tokenId: TokenId) =>\n  // uses \"used_refresh_token_fk\" to cascade delete\n  db.db.deleteFrom('token').where('tokenId', '=', tokenId)\n"]}

package/dist/account-manager/helpers/used-refresh-token.d.ts

@@ -5,6 +5,10 @@ import { AccountDb } from '../db/index.js';
  * This is done through the foreign key constraint in the database.
  */
 export declare const insertQB: (db: AccountDb, tokenId: number, refreshToken: RefreshToken) => import("kysely").InsertQueryBuilder<import("../db/index.js").DatabaseSchema, "used_refresh_token", import("kysely").InsertResult>;
-export declare const findByTokenQB: (db: AccountDb, refreshToken: RefreshToken) => import("kysely").QueryBuilderWithSelection<import("kysely/dist/esm/parser/table-parser.js").From<import("../db/index.js").DatabaseSchema, "used_refresh_token">, "used_refresh_token", {}, "tokenId">;
-export declare const countQB: (db: AccountDb, refreshToken: RefreshToken) => import("kysely").QueryBuilderWithSelection<import("kysely/dist/esm/parser/table-parser.js").From<import("../db/index.js").DatabaseSchema, "used_refresh_token">, "used_refresh_token", {}, (qb: import("kysely").ExpressionBuilder<import("kysely/dist/esm/parser/table-parser.js").From<import("../db/index.js").DatabaseSchema, "used_refresh_token">, "used_refresh_token">) => import("kysely").AliasedAggregateFunctionBuilder<import("kysely/dist/esm/parser/table-parser.js").From<import("../db/index.js").DatabaseSchema, "used_refresh_token">, "used_refresh_token", number, "count">>;
+export declare const findByTokenQB: (db: AccountDb, refreshToken: RefreshToken) => import("kysely").SelectQueryBuilder<import("../db/index.js").DatabaseSchema, "used_refresh_token", {
+    tokenId: number;
+}>;
+export declare const countQB: (db: AccountDb, refreshToken: RefreshToken) => import("kysely").SelectQueryBuilder<import("../db/index.js").DatabaseSchema, "used_refresh_token", {
+    count: number;
+}>;
 //# sourceMappingURL=used-refresh-token.d.ts.map

package/dist/account-manager/helpers/used-refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"used-refresh-token.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/used-refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,QAAQ,OACf,SAAS,WACJ,MAAM,gBACD,YAAY,sIAKW,CAAA;AAEvC,eAAO,MAAM,aAAa,OAAQ,SAAS,gBAAgB,YAAY,0MAKjD,CAAA;AAEtB,eAAO,MAAM,OAAO,OAAQ,SAAS,gBAAgB,YAAY,skBAKG,CAAA"}
+{"version":3,"file":"used-refresh-token.d.ts","sourceRoot":"","sources":["../../../src/account-manager/helpers/used-refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,QAAQ,OACf,SAAS,WACJ,MAAM,gBACD,YAAY,sIAKW,CAAA;AAEvC,eAAO,MAAM,aAAa,OAAQ,SAAS,gBAAgB,YAAY;;EAKjD,CAAA;AAEtB,eAAO,MAAM,OAAO,OAAQ,SAAS,gBAAgB,YAAY;;EAKG,CAAA"}

package/dist/account-manager/oauth-store.d.ts

@@ -1,7 +1,7 @@
 import { Client } from '@did-plc/lib';
 import { Keypair } from '@atproto/crypto';
 import { HandleString } from '@atproto/lex';
-import { Account, AccountStore, AuthenticateAccountData, AuthorizedClientData, AuthorizedClients, ClientId, Code, DeviceAccount, DeviceData, DeviceId, DeviceStore, FoundRequestResult, LexiconData, LexiconStore, NewTokenData, RefreshToken, RequestData, RequestId, RequestStore, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, Sub, TokenData, TokenId, TokenInfo, TokenStore, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateEmailRequestOutput, UpdateHandleData, UpdateRequestData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from '@atproto/oauth-provider';
+import { Account, AccountStore, AuthenticateAccountData, AuthorizedClientData, AuthorizedClients, ClientId, Code, DeactivateAccountData, DeleteAccountConfirmInput, DeleteAccountRequestInput, DeviceAccount, DeviceData, DeviceId, DeviceStore, Did, FoundRequestResult, LexiconData, LexiconStore, NewTokenData, ReactivateAccountData, RefreshToken, RequestData, RequestId, RequestStore, ResetPasswordConfirmInput, ResetPasswordRequestInput, SignUpData, TokenData, TokenId, TokenInfo, TokenStore, UpdateEmailConfirmInput, UpdateEmailRequestInput, UpdateEmailRequestOutput, UpdateHandleData, UpdateRequestData, VerifyEmailConfirmInput, VerifyEmailRequestInput } from '@atproto/oauth-provider';
 import { ActorStore } from '../actor-store/actor-store.js';
 import { BackgroundQueue } from '../background.js';
 import { ImageUrlBuilder } from '../image/image-url-builder.js';
@@ -32,20 +32,20 @@ export declare class OAuthStore implements AccountStore, RequestStore, DeviceSto
     private verifyInviteCode;
     createAccount({ locale: _locale, inviteCode, handle, email, password, }: SignUpData): Promise<Account>;
     authenticateAccount({ locale: _locale, username: identifier, password, emailOtp, }: AuthenticateAccountData): Promise<Account>;
-    setAuthorizedClient(sub: Sub, clientId: ClientId, data: AuthorizedClientData): Promise<void>;
-    getAccount(sub: Sub): Promise<{
+    setAuthorizedClient(did: Did, clientId: ClientId, data: AuthorizedClientData): Promise<void>;
+    getAccount(did: Did): Promise<{
         account: Account;
         authorizedClients: AuthorizedClients;
     }>;
     upsertDeviceAccount(deviceId: DeviceId, sub: string): Promise<void>;
-    getDeviceAccount(deviceId: DeviceId, sub: string): Promise<DeviceAccount | null>;
-    removeDeviceAccount(deviceId: DeviceId, sub: Sub): Promise<void>;
+    getDeviceAccount(deviceId: DeviceId, did: Did): Promise<DeviceAccount | null>;
+    removeDeviceAccount(deviceId: DeviceId, did: Did): Promise<void>;
     listDeviceAccounts(filter: {
-        sub: Sub;
+        did: Did;
     } | {
         deviceId: DeviceId;
     }): Promise<DeviceAccount[]>;
-    resetPasswordRequest({ locale: _locale, email, }: ResetPasswordRequestInput): Promise<Account | null>;
+    resetPasswordRequest({ email, locale, }: ResetPasswordRequestInput): Promise<Account | null>;
     resetPasswordConfirm(data: ResetPasswordConfirmInput): Promise<Account | null>;
     verifyHandleAvailability(handle: HandleString): Promise<void>;
     createRequest(id: RequestId, data: RequestData): Promise<void>;
@@ -61,17 +61,21 @@ export declare class OAuthStore implements AccountStore, RequestStore, DeviceSto
     storeLexicon(nsid: string, data: LexiconData): Promise<void>;
     deleteLexicon(nsid: string): Promise<void>;
     createToken(id: TokenId, data: TokenData, refreshToken?: RefreshToken): Promise<void>;
-    listAccountTokens(sub: Sub): Promise<TokenInfo[]>;
+    listAccountTokens(did: Did): Promise<TokenInfo[]>;
     readToken(tokenId: TokenId): Promise<TokenInfo | null>;
     deleteToken(tokenId: TokenId): Promise<void>;
     rotateToken(tokenId: TokenId, newTokenId: TokenId, newRefreshToken: RefreshToken, newData: NewTokenData): Promise<void>;
     findTokenByRefreshToken(refreshToken: RefreshToken): Promise<TokenInfo | null>;
     findTokenByCode(code: Code): Promise<TokenInfo | null>;
-    verifyEmailRequest({ sub: did, locale, }: VerifyEmailRequestInput): Promise<void>;
-    verifyEmailConfirm({ sub: did, email, token, }: VerifyEmailConfirmInput): Promise<Account | null>;
-    updateEmailRequest({ sub: did, locale, }: UpdateEmailRequestInput): Promise<UpdateEmailRequestOutput>;
-    updateEmailConfirm({ sub: did, token, email, locale, }: UpdateEmailConfirmInput): Promise<Account | null>;
-    updateHandle({ sub: did, handle }: UpdateHandleData): Promise<Account>;
+    verifyEmailRequest({ did, locale, }: VerifyEmailRequestInput): Promise<void>;
+    verifyEmailConfirm({ did, email, token, }: VerifyEmailConfirmInput): Promise<Account | null>;
+    updateEmailRequest({ did, locale, }: UpdateEmailRequestInput): Promise<UpdateEmailRequestOutput>;
+    updateEmailConfirm({ did, token, email, locale, }: UpdateEmailConfirmInput): Promise<Account | null>;
+    updateHandle({ did, handle }: UpdateHandleData): Promise<Account>;
+    deactivateAccount({ did }: DeactivateAccountData): Promise<Account>;
+    reactivateAccount({ did }: ReactivateAccountData): Promise<Account>;
+    deleteAccountRequest({ did, locale, }: DeleteAccountRequestInput): Promise<void>;
+    deleteAccountConfirm({ did, token, password, }: DeleteAccountConfirmInput): Promise<void>;
     private toTokenInfo;
     private buildAccount;
 }

package/dist/account-manager/oauth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../src/account-manager/oauth-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAA2B,MAAM,cAAc,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAoB,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAEL,YAAY,EAKb,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,QAAQ,EACR,IAAI,EACJ,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,EACX,kBAAkB,EAMlB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,GAAG,EACH,SAAS,EACT,OAAO,EACP,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAKhC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAA;AAW3E;;;;;GAKG;AACH,qBAAa,UACX,YAAW,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU;IAG1E,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAVjC,YACmB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,OAAO,EACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC5C;IAEJ,OAAO,KAAK,EAAE,GAIb;IAED,OAAO,KAAK,UAAU,GAErB;YAEa,uBAAuB;YAavB,gBAAgB;IAYxB,aAAa,CAAC,EAClB,MAAM,EAAE,OAAO,EACf,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,GACT,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAqG/B;IAEK,mBAAmB,CAAC,EACxB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAER,QAAoB,GACrB,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC5C;IAEK,mBAAmB,CACvB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;IAEK,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;QAClC,OAAO,EAAE,OAAO,CAAA;QAChB,iBAAiB,EAAE,iBAAiB,CAAA;KACrC,CAAC,CAmBD;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE;IAEK,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAkB/B;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;IAEK,kBAAkB,CACtB,MAAM,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B1B;IAEK,oBAAoB,CAAC,EACzB,MAAM,EAAE,OAAO,EACf,KAAK,GACN,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAqBrD;IAEK,oBAAoB,CACxB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;IAEK,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBlE;IAIK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;IAEK,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAe5D;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAEK,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAKvE;IAIK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAEK,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,CAG/D;IAEK,YAAY,CAChB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpD;IAIK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAE3D;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAIK,WAAW,CACf,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf;IAEK,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAGtD;IAEK,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAK3D;IAEK,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjD;IAEK,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAW3B;IAEK,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EAAE,GAAG,EACR,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAazC;IAEK,kBAAkB,CAAC,EACvB,GAAG,EAAE,GAAG,EACR,KAAK,EACL,KAAK,GACN,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAenD;IAEK,kBAAkB,CAAC,EACvB,GAAG,EAAE,GAAG,EACR,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAK7D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EAAE,GAAG,EACR,KAAK,EACL,KAAK,EACL,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAkBnD;IAEK,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E;YAEa,WAAW;YAWX,YAAY;CAiC3B"}
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../../src/account-manager/oauth-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAA2B,MAAM,cAAc,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAoB,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAa,YAAY,EAAoB,MAAM,cAAc,CAAA;AACxE,OAAO,EACL,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,QAAQ,EACR,IAAI,EACJ,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,EACX,GAAG,EACH,kBAAkB,EAMlB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,UAAU,EACV,SAAS,EACT,OAAO,EACP,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAKhC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAA;AAW3E;;;;;GAKG;AACH,qBAAa,UACX,YAAW,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU;IAG1E,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAVjC,YACmB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,eAAe,EAChC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,OAAO,EACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC5C;IAEJ,OAAO,KAAK,EAAE,GAIb;IAED,OAAO,KAAK,UAAU,GAErB;YAEa,uBAAuB;YAavB,gBAAgB;IAYxB,aAAa,CAAC,EAClB,MAAM,EAAE,OAAO,EACf,UAAU,EACV,MAAM,EACN,KAAK,EACL,QAAQ,GACT,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAmG/B;IAEK,mBAAmB,CAAC,EACxB,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAER,QAAoB,GACrB,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC5C;IAEK,mBAAmB,CACvB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;IAEK,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;QAClC,OAAO,EAAE,OAAO,CAAA;QAChB,iBAAiB,EAAE,iBAAiB,CAAA;KACrC,CAAC,CAeD;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE;IAEK,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAkB/B;IAEK,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrE;IAEK,kBAAkB,CACtB,MAAM,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B1B;IAEK,oBAAoB,CAAC,EACzB,KAAK,EACL,MAAM,GACP,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBrD;IAEK,oBAAoB,CACxB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgBzB;IAEK,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBlE;IAIK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE;IAEK,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAe5D;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;IAEK,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;IAEK,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAKvE;IAIK,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAEK,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,CAG/D;IAEK,YAAY,CAChB,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpD;IAIK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAE3D;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAIK,WAAW,CACf,EAAE,EAAE,OAAO,EACX,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,YAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf;IAEK,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAGtD;IAEK,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAK3D;IAEK,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjD;IAEK,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEK,uBAAuB,CAC3B,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAW3B;IAEK,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzC;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,GACN,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAYnD;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAE7D;IAEK,kBAAkB,CAAC,EACvB,GAAG,EACH,KAAK,EACL,KAAK,EACL,MAAM,GACP,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAenD;IAEK,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtE;IAEK,iBAAiB,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAMxE;IAEK,iBAAiB,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAYxE;IAEK,oBAAoB,CAAC,EACzB,GAAG,EACH,MAAM,GACP,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3C;IAEK,oBAAoB,CAAC,EACzB,GAAG,EACH,KAAK,EACL,QAAQ,GACT,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC3C;YAEa,WAAW;YAWX,YAAY;CAkC3B"}

package/dist/account-manager/oauth-store.js

@@ -1,7 +1,7 @@
 import assert from 'node:assert';
 import { createOp as createPlcOp } from '@did-plc/lib';
 import { Secp256k1Keypair } from '@atproto/crypto';
-import { asAtIdentifierString, getBlobCidString, isDidString, isHandleString, } from '@atproto/lex';
+import { getBlobCidString } from '@atproto/lex';
 import { HandleUnavailableError, InvalidCredentialsError, InvalidInviteCodeError, InvalidRequestError, } from '@atproto/oauth-provider';
 import { AuthRequiredError as XrpcAuthRequiredError, InvalidRequestError as XrpcInvalidRequestError, } from '@atproto/xrpc-server';
 import { fromDateISO } from '../db/index.js';
@@ -66,7 +66,6 @@ export class OAuthStore {
     async createAccount({ locale: _locale, inviteCode, handle, email, password, }) {
         // @TODO Send an account creation confirmation email (+verification link) to the user (in their locale)
         // @NOTE Password strength & length already enforced by the OAuthProvider
-        assert(isHandleString(handle), 'Handle must be a valid HandleString');
         await Promise.all([
             this.verifyEmailAvailability(email),
             this.verifyHandleAvailability(handle),
@@ -184,27 +183,25 @@ export class OAuthStore {
             throw err;
         }
     }
-    async setAuthorizedClient(sub, clientId, data) {
-        await authorizedClientHelper.upsert(this.db, sub, clientId, data);
+    async setAuthorizedClient(did, clientId, data) {
+        await authorizedClientHelper.upsert(this.db, did, clientId, data);
     }
-    async getAccount(sub) {
-        const accountRow = await this.accountManager.getAccount(
-        // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-        asAtIdentifierString(sub), {
+    async getAccount(did) {
+        const accountRow = await this.accountManager.getAccount(did, {
             includeDeactivated: true,
             includeTakenDown: false,
         });
         assert(accountRow, 'Account not found');
         const account = await this.buildAccount(accountRow);
-        const authorizedClients = await authorizedClientHelper.getAuthorizedClients(this.db, sub);
+        const authorizedClients = await authorizedClientHelper.getAuthorizedClients(this.db, did);
         return { account, authorizedClients };
     }
     async upsertDeviceAccount(deviceId, sub) {
         await this.db.executeWithRetry(accountDeviceHelper.upsertQB(this.db, deviceId, sub));
     }
-    async getDeviceAccount(deviceId, sub) {
+    async getDeviceAccount(deviceId, did) {
         const row = await accountDeviceHelper
-            .selectQB(this.db, { deviceId, sub })
+            .selectQB(this.db, { deviceId, did })
             .executeTakeFirst();
         if (!row)
             return null;
@@ -212,13 +209,13 @@ export class OAuthStore {
             deviceId,
             deviceData: deviceHelper.rowToDeviceData(row),
             account: await this.buildAccount(row),
-            authorizedClients: await authorizedClientHelper.getAuthorizedClients(this.db, sub),
+            authorizedClients: await authorizedClientHelper.getAuthorizedClients(this.db, did),
             createdAt: fromDateISO(row.adCreatedAt),
             updatedAt: fromDateISO(row.adUpdatedAt),
         };
     }
-    async removeDeviceAccount(deviceId, sub) {
-        await this.db.executeWithRetry(accountDeviceHelper.removeQB(this.db, deviceId, sub));
+    async removeDeviceAccount(deviceId, did) {
+        await this.db.executeWithRetry(accountDeviceHelper.removeQB(this.db, deviceId, did));
     }
     async listDeviceAccounts(filter) {
         const rows = await accountDeviceHelper.selectQB(this.db, filter).execute();
@@ -238,7 +235,7 @@ export class OAuthStore {
             updatedAt: fromDateISO(row.adUpdatedAt),
         }));
     }
-    async resetPasswordRequest({ locale: _locale, email, }) {
+    async resetPasswordRequest({ email, locale, }) {
         const account = await this.accountManager.getAccountByEmail(email, {
             includeDeactivated: true,
             includeTakenDown: false,
@@ -247,8 +244,7 @@ export class OAuthStore {
             return null;
         const { handle } = account;
         const token = await this.accountManager.createEmailToken(account.did, 'reset_password');
-        // @TODO Use the locale to send the email in the right language
-        await this.mailer.sendResetPassword({ handle, token }, { to: account.email });
+        await this.mailer.sendResetPassword({ handle, token, locale }, { to: account.email });
         return this.buildAccount(account);
     }
     async resetPasswordConfirm(data) {
@@ -360,8 +356,8 @@ export class OAuthStore {
             return tokenHelper.createQB(dbTxn, id, data, refreshToken).execute();
         });
     }
-    async listAccountTokens(sub) {
-        const rows = await tokenHelper.findByQB(this.db, { did: sub }).execute();
+    async listAccountTokens(did) {
+        const rows = await tokenHelper.findByQB(this.db, { did }).execute();
         return Promise.all(rows.map((row) => this.toTokenInfo(row)));
     }
     async readToken(tokenId) {
@@ -412,9 +408,7 @@ export class OAuthStore {
         const row = await tokenHelper.findByQB(this.db, { code }).executeTakeFirst();
         return row ? this.toTokenInfo(row) : null;
     }
-    async verifyEmailRequest({ sub: did, locale, }) {
-        // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-        assert(isDidString(did), 'sub must be a valid DID string');
+    async verifyEmailRequest({ did, locale, }) {
         try {
             await this.accountManager.requestEmailConfirmation(did, { locale });
         }
@@ -425,9 +419,7 @@ export class OAuthStore {
             throw err;
         }
     }
-    async verifyEmailConfirm({ sub: did, email, token, }) {
-        // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-        assert(isDidString(did), 'sub must be a valid DID string');
+    async verifyEmailConfirm({ did, email, token, }) {
         try {
             const account = await this.accountManager.confirmEmail(did, email, token);
             return this.buildAccount(account);
@@ -439,14 +431,10 @@ export class OAuthStore {
             throw err;
         }
     }
-    async updateEmailRequest({ sub: did, locale, }) {
-        // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-        assert(isDidString(did), 'sub must be a valid DID string');
+    async updateEmailRequest({ did, locale, }) {
         return this.accountManager.requestEmailUpdate(did, { locale });
     }
-    async updateEmailConfirm({ sub: did, token, email, locale, }) {
-        // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-        assert(isDidString(did), 'sub must be a valid DID string');
+    async updateEmailConfirm({ did, token, email, locale, }) {
         try {
             const account = await this.accountManager.updateEmail(did, email, token, {
                 sendConfirmationEmail: true,
@@ -461,9 +449,7 @@ export class OAuthStore {
             throw cause;
         }
     }
-    async updateHandle({ sub: did, handle }) {
-        // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-        assert(isDidString(did), 'sub must be a valid DID string');
+    async updateHandle({ did, handle }) {
         try {
             const account = await this.accountManager.updateHandle(did, handle);
             return this.buildAccount(account);
@@ -472,6 +458,69 @@ export class OAuthStore {
             throw toHandleUnavailableError(err);
         }
     }
+    async deactivateAccount({ did }) {
+        const { account } = await this.accountManager.deactivateAccount(did, {
+            deleteCredentials: true,
+        });
+        return this.buildAccount(account);
+    }
+    async reactivateAccount({ did }) {
+        try {
+            const { account } = await this.accountManager.activateAccount(did);
+            return this.buildAccount(account);
+        }
+        catch (err) {
+            if (err instanceof XrpcInvalidRequestError) {
+                throw new InvalidRequestError(err.message, err);
+            }
+            throw err;
+        }
+    }
+    async deleteAccountRequest({ did, locale, }) {
+        // Mirror the XRPC `com.atproto.server.requestAccountDelete` flow
+        // (no-entryway path): generate an email confirmation token and dispatch
+        // it to the account's email address.
+        const account = await this.accountManager.getAccount(did, {
+            includeDeactivated: true,
+            includeTakenDown: true,
+        });
+        if (!account) {
+            throw new InvalidRequestError('Account not found');
+        }
+        if (!account.email) {
+            throw new InvalidRequestError('Account does not have an email address');
+        }
+        const token = await this.accountManager.createEmailToken(did, 'delete_account');
+        await this.mailer.sendAccountDelete({ token, locale }, { to: account.email });
+    }
+    async deleteAccountConfirm({ did, token, password, }) {
+        // Mirror the XRPC `com.atproto.server.deleteAccount` flow (no-entryway
+        // path): verify the password, validate the email confirmation token,
+        // destroy the actor store, delete the account row, and emit the
+        // tombstone account event.
+        const account = await this.accountManager.getAccount(did, {
+            includeDeactivated: true,
+            includeTakenDown: true,
+        });
+        if (!account) {
+            throw new InvalidRequestError('Account not found');
+        }
+        const validPass = await this.accountManager.verifyAccountPassword(did, password);
+        if (!validPass) {
+            throw new InvalidCredentialsError('Invalid did or password', did);
+        }
+        await this.accountManager.assertValidEmailToken(did, 'delete_account', token);
+        // @NOTE Order matters here: first "unlink" the account by removing it
+        // from the account manager database ("source of truth"), then notify the
+        // sequencer, and finally cleanup files from the file system.
+        await this.accountManager.deleteAccount(did);
+        try {
+            await this.sequencer.sequenceAccountDeletion(did);
+        }
+        finally {
+            await this.actorStore.destroy(did);
+        }
+    }
     async toTokenInfo(row) {
         return {
             id: row.tokenId,
@@ -482,14 +531,15 @@ export class OAuthStore {
     }
     async buildAccount(row) {
         const account = {
-            sub: row.did,
-            aud: this.serviceDid,
+            did: row.did,
+            pds: this.serviceDid,
             email: row.email || undefined,
-            email_verified: row.email ? row.emailConfirmedAt != null : undefined,
-            preferred_username: row.handle || undefined,
+            emailVerified: row.email ? row.emailConfirmedAt != null : undefined,
+            handle: row.handle || undefined,
+            deactivated: row.deactivatedAt != null,
         };
         if (!account.name || !account.picture) {
-            const did = account.sub;
+            const { did } = account;
             const profile = await this.actorStore
                 .read(did, async (store) => {
                 return store.record.getProfileRecord();