@atproto/pds 0.5.52 → 0.5.56

package/dist/api/com/atproto/admin/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/util.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAmBhD,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,YAAsB;IACvE,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE;YACrD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;SACxD,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,EACE,iBAAiB,EACjB,SAAS,EACT,OAAO,GAKR;IAED,IAAI,cAAwC,CAAA;IAC5C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,cAAc,GAAG,OAAO,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACjD,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAkB;QAC/B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAmB;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;QACjC,SAAS,EAAE,OAAO,CAAC,SAA6B;QAChD,gBAAgB,EACb,OAAO,CAAC,gBAAiD,IAAI,SAAS;QACzE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,iBAAiB;YAChC,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC;YAC/B,CAAC,CAAC,SAAS;QACb,aAAa,EACV,OAAO,CAAC,aAA8C,IAAI,SAAS;KACvE,CAAA;AACH,CAAC","sourcesContent":["import type express from 'express'\nimport type { l } from '@atproto/lex'\nimport { INVALID_HANDLE } from '@atproto/syntax'\nimport type { ActorAccount } from '../../../../account-manager/helpers/account.js'\nimport type { CodeDetail } from '../../../../account-manager/helpers/invite.js'\nimport type { com } from '../../../../lexicons/index.js'\n\n// Output designed to passed as second arg to AtpAgent methods.\n// The encoding field here is a quirk of the AtpAgent.\nexport function authPassthru(\n  req: express.Request,\n  withEncoding?: false,\n): { headers: { authorization: string }; encoding: undefined } | undefined\n\nexport function authPassthru(\n  req: express.Request,\n  withEncoding: true,\n):\n  | { headers: { authorization: string }; encoding: 'application/json' }\n  | undefined\n\nexport function authPassthru(req: express.Request, withEncoding?: boolean) {\n  if (req.headers.authorization) {\n    return {\n      headers: { authorization: req.headers.authorization },\n      encoding: withEncoding ? 'application/json' : undefined,\n    }\n  }\n}\n\nexport function formatAccountInfo(\n  account: ActorAccount,\n  {\n    managesOwnInvites,\n    invitedBy,\n    invites,\n  }: {\n    managesOwnInvites: boolean\n    invites: Map<string, CodeDetail[]> | CodeDetail[]\n    invitedBy: Record<string, CodeDetail>\n  },\n): com.atproto.admin.defs.AccountView {\n  let invitesResults: CodeDetail[] | undefined\n  if (managesOwnInvites) {\n    if (Array.isArray(invites)) {\n      invitesResults = invites\n    } else {\n      invitesResults = invites.get(account.did) || []\n    }\n  }\n  return {\n    did: account.did as l.DidString,\n    handle: (account.handle ?? INVALID_HANDLE) as l.HandleString,\n    email: account.email ?? undefined,\n    indexedAt: account.createdAt as l.DatetimeString,\n    emailConfirmedAt:\n      (account.emailConfirmedAt as l.DatetimeString | undefined) ?? undefined,\n    invitedBy: managesOwnInvites ? invitedBy[account.did] : undefined,\n    invites: invitesResults,\n    invitesDisabled: managesOwnInvites\n      ? account.invitesDisabled === 1\n      : undefined,\n    deactivatedAt:\n      (account.deactivatedAt as l.DatetimeString | undefined) ?? undefined,\n  }\n}\n"]}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/util.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAmBhD,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,YAAsB;IACvE,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE;YACrD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;SACxD,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,EACE,iBAAiB,EACjB,SAAS,EACT,OAAO,GAKR;IAED,IAAI,cAAwC,CAAA;IAC5C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,cAAc,GAAG,OAAO,CAAA;QAC1B,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACjD,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAkB;QAC/B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAmB;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;QACjC,SAAS,EAAE,OAAO,CAAC,SAA6B;QAChD,gBAAgB,EACb,OAAO,CAAC,gBAAiD,IAAI,SAAS;QACzE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,iBAAiB;YAChC,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC;YAC/B,CAAC,CAAC,SAAS;QACb,aAAa,EACV,OAAO,CAAC,aAA8C,IAAI,SAAS;KACvE,CAAA;AACH,CAAC","sourcesContent":["import type express from 'express'\nimport type { l } from '@atproto/lex-schema'\nimport { INVALID_HANDLE } from '@atproto/syntax'\nimport type { ActorAccount } from '../../../../account-manager/helpers/account.js'\nimport type { CodeDetail } from '../../../../account-manager/helpers/invite.js'\nimport type { com } from '../../../../lexicons/index.js'\n\n// Output designed to passed as second arg to AtpAgent methods.\n// The encoding field here is a quirk of the AtpAgent.\nexport function authPassthru(\n  req: express.Request,\n  withEncoding?: false,\n): { headers: { authorization: string }; encoding: undefined } | undefined\n\nexport function authPassthru(\n  req: express.Request,\n  withEncoding: true,\n):\n  | { headers: { authorization: string }; encoding: 'application/json' }\n  | undefined\n\nexport function authPassthru(req: express.Request, withEncoding?: boolean) {\n  if (req.headers.authorization) {\n    return {\n      headers: { authorization: req.headers.authorization },\n      encoding: withEncoding ? 'application/json' : undefined,\n    }\n  }\n}\n\nexport function formatAccountInfo(\n  account: ActorAccount,\n  {\n    managesOwnInvites,\n    invitedBy,\n    invites,\n  }: {\n    managesOwnInvites: boolean\n    invites: Map<string, CodeDetail[]> | CodeDetail[]\n    invitedBy: Record<string, CodeDetail>\n  },\n): com.atproto.admin.defs.AccountView {\n  let invitesResults: CodeDetail[] | undefined\n  if (managesOwnInvites) {\n    if (Array.isArray(invites)) {\n      invitesResults = invites\n    } else {\n      invitesResults = invites.get(account.did) || []\n    }\n  }\n  return {\n    did: account.did as l.DidString,\n    handle: (account.handle ?? INVALID_HANDLE) as l.HandleString,\n    email: account.email ?? undefined,\n    indexedAt: account.createdAt as l.DatetimeString,\n    emailConfirmedAt:\n      (account.emailConfirmedAt as l.DatetimeString | undefined) ?? undefined,\n    invitedBy: managesOwnInvites ? invitedBy[account.did] : undefined,\n    invites: invitesResults,\n    invitesDisabled: managesOwnInvites\n      ? account.invitesDisabled === 1\n      : undefined,\n    deactivatedAt:\n      (account.deactivatedAt as l.DatetimeString | undefined) ?? undefined,\n  }\n}\n"]}

package/dist/api/com/atproto/identity/resolveHandle.js

@@ -1,4 +1,4 @@
-import { isDidString } from '@atproto/lex';
+import { isDidString } from '@atproto/lex-schema';
 import { InvalidRequestError } from '@atproto/xrpc-server';
 import { baseNormalizeAndValidate } from '../../../../handle/index.js';
 import { com } from '../../../../lexicons/index.js';

package/dist/api/com/atproto/identity/resolveHandle.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveHandle.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/identity/resolveHandle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEtD,qEAAqE;QACrE,uCAAuC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACxD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAgB,EAAE;iBACrC,CAAA;YACH,CAAC;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAChE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAC5D,CAAA;YACD,0DAA0D;YAC1D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,mBAAmB,CAC3B,0BAA0B,EAC1B,gBAAgB,CACjB,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAc,GAAG,CAAC,WAAW;YACpC,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,MAAM;iBACzB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC;iBACpD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,wBAAwB,CAAC;YACjD,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM;iBACxB,OAAO,CAAC,MAAM,CAAC;iBACf,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,EAC7D,wBAAwB,CACzB,CAAA;QAEP,OAAO;YACL,QAAQ,EAAE,kBAA2B;YACrC,IAAI,EAAE,EAAE,GAAG,EAAE;SACd,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAe;IAC/C,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,SAAS,EAAE;QACnE,KAAK;KACN,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { isDidString } from '@atproto/lex'\nimport type { DidString } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.identity.resolveHandle, async ({ params }) => {\n    const handle = baseNormalizeAndValidate(params.handle)\n\n    // when behind an entryway, the entryway is authoritative for handles\n    // rather than this pds' local accounts\n    if (!ctx.cfg.entryway) {\n      const user = await ctx.accountManager.getAccount(handle)\n      if (user) {\n        return {\n          encoding: 'application/json' as const,\n          body: { did: user.did as DidString },\n        }\n      }\n\n      const supportedHandle = ctx.cfg.identity.serviceHandleDomains.some(\n        (host) => handle.endsWith(host) || handle === host.slice(1),\n      )\n      // this should be in our DB & we couldn't find it, so fail\n      if (supportedHandle) {\n        throw new InvalidRequestError(\n          'Unable to resolve handle',\n          'HandleNotFound',\n        )\n      }\n    }\n\n    const did: DidString = ctx.bskyAppView\n      ? await ctx.bskyAppView.client\n          .call(com.atproto.identity.resolveHandle, { handle })\n          .then((r) => r.did, throwInvalidRequestError)\n      : await ctx.idResolver.handle\n          .resolve(handle)\n          .then(\n            (v) => (v && isDidString(v) ? v : throwInvalidRequestError()),\n            throwInvalidRequestError,\n          )\n\n    return {\n      encoding: 'application/json' as const,\n      body: { did },\n    }\n  })\n}\n\nfunction throwInvalidRequestError(cause?: unknown): never {\n  throw new InvalidRequestError('Unable to resolve handle', undefined, {\n    cause,\n  })\n}\n"]}
+{"version":3,"file":"resolveHandle.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/identity/resolveHandle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAClE,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEtD,qEAAqE;QACrE,uCAAuC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACxD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAgB,EAAE;iBACrC,CAAA;YACH,CAAC;YAED,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAChE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAC5D,CAAA;YACD,0DAA0D;YAC1D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,mBAAmB,CAC3B,0BAA0B,EAC1B,gBAAgB,CACjB,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAc,GAAG,CAAC,WAAW;YACpC,CAAC,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,MAAM;iBACzB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC;iBACpD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,wBAAwB,CAAC;YACjD,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM;iBACxB,OAAO,CAAC,MAAM,CAAC;iBACf,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,EAC7D,wBAAwB,CACzB,CAAA;QAEP,OAAO;YACL,QAAQ,EAAE,kBAA2B;YACrC,IAAI,EAAE,EAAE,GAAG,EAAE;SACd,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAe;IAC/C,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,SAAS,EAAE;QACnE,KAAK;KACN,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { isDidString } from '@atproto/lex-schema'\nimport type { DidString } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.identity.resolveHandle, async ({ params }) => {\n    const handle = baseNormalizeAndValidate(params.handle)\n\n    // when behind an entryway, the entryway is authoritative for handles\n    // rather than this pds' local accounts\n    if (!ctx.cfg.entryway) {\n      const user = await ctx.accountManager.getAccount(handle)\n      if (user) {\n        return {\n          encoding: 'application/json' as const,\n          body: { did: user.did as DidString },\n        }\n      }\n\n      const supportedHandle = ctx.cfg.identity.serviceHandleDomains.some(\n        (host) => handle.endsWith(host) || handle === host.slice(1),\n      )\n      // this should be in our DB & we couldn't find it, so fail\n      if (supportedHandle) {\n        throw new InvalidRequestError(\n          'Unable to resolve handle',\n          'HandleNotFound',\n        )\n      }\n    }\n\n    const did: DidString = ctx.bskyAppView\n      ? await ctx.bskyAppView.client\n          .call(com.atproto.identity.resolveHandle, { handle })\n          .then((r) => r.did, throwInvalidRequestError)\n      : await ctx.idResolver.handle\n          .resolve(handle)\n          .then(\n            (v) => (v && isDidString(v) ? v : throwInvalidRequestError()),\n            throwInvalidRequestError,\n          )\n\n    return {\n      encoding: 'application/json' as const,\n      body: { did },\n    }\n  })\n}\n\nfunction throwInvalidRequestError(cause?: unknown): never {\n  throw new InvalidRequestError('Unable to resolve handle', undefined, {\n    cause,\n  })\n}\n"]}

package/dist/api/com/atproto/repo/getRecord.js

@@ -1,4 +1,4 @@
-import { atUri } from '@atproto/lex';
+import { atUri } from '@atproto/lex-schema';
 import { InvalidRequestError } from '@atproto/xrpc-server';
 import { com } from '../../../../lexicons/index.js';
 import { pipethrough } from '../../../../pipethrough.js';

package/dist/api/com/atproto/repo/getRecord.js.map

@@ -1 +1 @@
-{"version":3,"file":"getRecord.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/getRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAEzD,8DAA8D;QAC9D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CACtD,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CACzC,CAAA;YACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,GAAG,EAAE,EACjC,gBAAgB,CACjB,CAAA;YACH,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,GAAG;oBACH,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CAAA;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAA;QAC1D,CAAC;QAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { atUri } from '@atproto/lex'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { pipethrough } from '../../../../pipethrough.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.getRecord, async ({ req, params }) => {\n    const { repo, collection, rkey, cid } = params\n    const did = await ctx.accountManager.getDidForActor(repo)\n\n    // fetch from pds if available, if not then fetch from appview\n    if (did) {\n      const uri = atUri(did, collection, rkey)\n      const record = await ctx.actorStore.read(did, (store) =>\n        store.record.getRecord(uri, cid ?? null),\n      )\n      if (!record || record.takedownRef !== null) {\n        throw new InvalidRequestError(\n          `Could not locate record: ${uri}`,\n          'RecordNotFound',\n        )\n      }\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          uri,\n          cid: record.cid,\n          value: record.value,\n        },\n      }\n    }\n\n    if (!ctx.cfg.bskyAppView) {\n      throw new InvalidRequestError(`Could not locate record`)\n    }\n\n    return pipethrough(ctx, req)\n  })\n}\n"]}
+{"version":3,"file":"getRecord.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/getRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAEzD,8DAA8D;QAC9D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CACtD,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CACzC,CAAA;YACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,GAAG,EAAE,EACjC,gBAAgB,CACjB,CAAA;YACH,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,GAAG;oBACH,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB;aACF,CAAA;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAA;QAC1D,CAAC;QAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { atUri } from '@atproto/lex-schema'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { pipethrough } from '../../../../pipethrough.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.getRecord, async ({ req, params }) => {\n    const { repo, collection, rkey, cid } = params\n    const did = await ctx.accountManager.getDidForActor(repo)\n\n    // fetch from pds if available, if not then fetch from appview\n    if (did) {\n      const uri = atUri(did, collection, rkey)\n      const record = await ctx.actorStore.read(did, (store) =>\n        store.record.getRecord(uri, cid ?? null),\n      )\n      if (!record || record.takedownRef !== null) {\n        throw new InvalidRequestError(\n          `Could not locate record: ${uri}`,\n          'RecordNotFound',\n        )\n      }\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          uri,\n          cid: record.cid,\n          value: record.value,\n        },\n      }\n    }\n\n    if (!ctx.cfg.bskyAppView) {\n      throw new InvalidRequestError(`Could not locate record`)\n    }\n\n    return pipethrough(ctx, req)\n  })\n}\n"]}

package/dist/api/com/atproto/repo/putRecord.js

@@ -1,5 +1,5 @@
-import { atUri } from '@atproto/lex';
 import { isLegacyBlobRef, parseCid, } from '@atproto/lex-data';
+import { atUri } from '@atproto/lex-schema';
 import { AuthRequiredError, InvalidRequestError, } from '@atproto/xrpc-server';
 import { app, com } from '../../../../lexicons/index.js';
 import { dbLogger } from '../../../../logger.js';

package/dist/api/com/atproto/repo/putRecord.js.map

@@ -1 +1 @@
-{"version":3,"file":"putRecord.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/putRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAIL,eAAe,EACf,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAGlB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAA;AAElC,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,6CAA6C;YAE7C,uBAAuB;YACvB,0BAA0B;YAC1B,SAAS,EAAE,GAAG,EAAE;gBACd,2DAA2D;YAC7D,CAAC;SACF,CAAC;QACF,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;gBAC3C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;aACpB;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;gBAC3C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;aACpB;SACF;QACD,IAAI,EAAE;YACJ,SAAS,EAAE,SAAS;SACrB;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACjC,MAAM,EACJ,IAAI,EACJ,UAAU,EACV,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,UAAU,GACX,GAAG,KAAK,CAAC,IAAI,CAAA;YAEd,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE;gBACvD,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;gBACjC,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;oBACtC,MAAM,EAAE,QAAQ;oBAChB,UAAU;iBACX,CAAC,CAAA;gBACF,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;oBACtC,MAAM,EAAE,QAAQ;oBAChB,UAAU;iBACX,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YACxC,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACnE,MAAM,aAAa,GACjB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;YAEpE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CACrD,GAAG,EACH,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;gBAChE,MAAM,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAA;gBAEjC,+FAA+F;gBAC/F,IAAI,QAAQ,IAAI,UAAU,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC5D,MAAM,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBACpD,CAAC;gBAED,MAAM,SAAS,GAAG;oBAChB,GAAG;oBACH,UAAU;oBACV,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,aAAa;oBACtB,QAAQ;iBACT,CAAA;gBAED,IAAI,KAAsC,CAAA;gBAC1C,IAAI,CAAC;oBACH,KAAK,GAAG,QAAQ;wBACd,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC;wBAChC,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;gBACpC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBAC5C,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;gBAED,QAAQ;gBACR,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO;wBACL,MAAM,EAAE,IAAI;wBACZ,KAAK;qBACN,CAAA;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI;qBAC/B,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;qBACrC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,IACE,GAAG,YAAY,kBAAkB;wBACjC,GAAG,YAAY,kBAAkB,EACjC,CAAC;wBACD,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;oBAC3D,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEJ,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAE/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAC1B,CAAC,CACF,CAAA;YAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,GAAG,CAAC,cAAc;qBACrB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;qBAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,QAAQ,CAAC,KAAK,CACZ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAC9C,+BAA+B,CAChC,CAAA;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE;oBACJ,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACzB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,MAAM;wBACZ,CAAC,CAAC;4BACE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;4BAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;yBAChB;wBACH,CAAC,CAAC,SAAS;oBACb,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,0BAA0B;AAC1B,KAAK,UAAU,0BAA0B,CACvC,UAAgC,EAChC,MAAc;IAEd,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAgC,EAChC,UAAyB;IAEzB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IAC5D,OAAO;QACL,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAA;AACH,CAAC","sourcesContent":["import { atUri } from '@atproto/lex'\nimport {\n  type LegacyBlobRef,\n  type LexMap,\n  type TypedBlobRef,\n  isLegacyBlobRef,\n  parseCid,\n} from '@atproto/lex-data'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport type { ActorStoreTransactor } from '../../../../actor-store/actor-store-transactor.js'\nimport type { AppContext } from '../../../../context.js'\nimport { app, com } from '../../../../lexicons/index.js'\nimport { dbLogger } from '../../../../logger.js'\nimport {\n  BadCommitSwapError,\n  BadRecordSwapError,\n  InvalidRecordError,\n  type PreparedCreate,\n  type PreparedUpdate,\n  prepareCreate,\n  prepareUpdate,\n} from '../../../../repo/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.putRecord, {\n    auth: ctx.authVerifier.authorization({\n      // @NOTE the \"checkTakedown\" and \"checkDeactivated\" checks are typically\n      // performed during auth. However, since this method's \"repo\" parameter\n      // can be a handle, we will need to fetch the account again to ensure that\n      // the handle matches the DID from the request's credentials. In order to\n      // avoid fetching the account twice (during auth, and then again in the\n      // controller), the checks are disabled here:\n\n      // checkTakedown: true,\n      // checkDeactivated: true,\n      authorize: () => {\n        // Performed in the handler as it requires the request body\n      },\n    }),\n    rateLimit: [\n      {\n        name: 'repo-write-hour',\n        calcKey: ({ auth }) => auth.credentials.did,\n        calcPoints: () => 2,\n      },\n      {\n        name: 'repo-write-day',\n        calcKey: ({ auth }) => auth.credentials.did,\n        calcPoints: () => 2,\n      },\n    ],\n    opts: {\n      jsonLimit: 1_000_000,\n    },\n    handler: async ({ auth, input }) => {\n      const {\n        repo,\n        collection,\n        rkey,\n        record,\n        validate,\n        swapCommit,\n        swapRecord,\n      } = input.body\n\n      const account = await ctx.authVerifier.findAccount(repo, {\n        checkDeactivated: true,\n        checkTakedown: true,\n      })\n\n      const did = account.did\n      if (did !== auth.credentials.did) {\n        throw new AuthRequiredError()\n      }\n\n      // We can't compute permissions based on the request payload (\"input\") in\n      // the 'auth' phase, so we do it here.\n      if (auth.credentials.type === 'oauth') {\n        auth.credentials.permissions.assertRepo({\n          action: 'create',\n          collection,\n        })\n        auth.credentials.permissions.assertRepo({\n          action: 'update',\n          collection,\n        })\n      }\n\n      const uri = atUri(did, collection, rkey)\n      const swapCommitCid = swapCommit ? parseCid(swapCommit) : undefined\n      const swapRecordCid =\n        typeof swapRecord === 'string' ? parseCid(swapRecord) : swapRecord\n\n      const { commit, write } = await ctx.actorStore.transact(\n        did,\n        async (actorTxn) => {\n          const current = await actorTxn.record.getRecord(uri, null, true)\n          const isUpdate = current !== null\n\n          // @TODO temporaray hack for legacy blob refs in profiles - remove after migrating legacy blobs\n          if (isUpdate && collection === app.bsky.actor.profile.$type) {\n            await updateProfileLegacyBlobRef(actorTxn, record)\n          }\n\n          const writeInfo = {\n            did,\n            collection,\n            rkey,\n            record,\n            swapCid: swapRecordCid,\n            validate,\n          }\n\n          let write: PreparedCreate | PreparedUpdate\n          try {\n            write = isUpdate\n              ? await prepareUpdate(writeInfo)\n              : await prepareCreate(writeInfo)\n          } catch (err) {\n            if (err instanceof InvalidRecordError) {\n              throw new InvalidRequestError(err.message)\n            }\n            throw err\n          }\n\n          // no-op\n          if (current && current.cid === write.cid.toString()) {\n            return {\n              commit: null,\n              write,\n            }\n          }\n\n          const commit = await actorTxn.repo\n            .processWrites([write], swapCommitCid)\n            .catch((err) => {\n              if (\n                err instanceof BadCommitSwapError ||\n                err instanceof BadRecordSwapError\n              ) {\n                throw new InvalidRequestError(err.message, 'InvalidSwap')\n              } else {\n                throw err\n              }\n            })\n\n          await ctx.sequencer.sequenceCommit(did, commit)\n\n          return { commit, write }\n        },\n      )\n\n      if (commit !== null) {\n        await ctx.accountManager\n          .updateRepoRoot(did, commit.cid, commit.rev)\n          .catch((err) => {\n            dbLogger.error(\n              { err, did, cid: commit.cid, rev: commit.rev },\n              'failed to update account root',\n            )\n          })\n      }\n\n      return {\n        encoding: 'application/json',\n        body: {\n          uri: write.uri.toString(),\n          cid: write.cid.toString(),\n          commit: commit\n            ? {\n                cid: commit.cid.toString(),\n                rev: commit.rev,\n              }\n            : undefined,\n          validationStatus: write.validationStatus,\n        },\n      }\n    },\n  })\n}\n\n// WARNING: mutates object\nasync function updateProfileLegacyBlobRef(\n  actorStore: ActorStoreTransactor,\n  record: LexMap,\n): Promise<void> {\n  if (isLegacyBlobRef(record.avatar)) {\n    record.avatar = await upgradeLegacyBlob(actorStore, record.avatar)\n  }\n  if (isLegacyBlobRef(record.banner)) {\n    record.banner = await upgradeLegacyBlob(actorStore, record.banner)\n  }\n}\n\nasync function upgradeLegacyBlob(\n  actorStore: ActorStoreTransactor,\n  legacyBlob: LegacyBlobRef,\n): Promise<TypedBlobRef> {\n  const ref = parseCid(legacyBlob.cid)\n  const blob = await actorStore.repo.blob.getBlobMetadata(ref)\n  return {\n    $type: 'blob',\n    mimeType: legacyBlob.mimeType,\n    ref,\n    size: blob.size,\n  }\n}\n"]}
+{"version":3,"file":"putRecord.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/putRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,eAAe,EACf,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAGlB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAA;AAElC,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,6CAA6C;YAE7C,uBAAuB;YACvB,0BAA0B;YAC1B,SAAS,EAAE,GAAG,EAAE;gBACd,2DAA2D;YAC7D,CAAC;SACF,CAAC;QACF,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;gBAC3C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;aACpB;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;gBAC3C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;aACpB;SACF;QACD,IAAI,EAAE;YACJ,SAAS,EAAE,SAAS;SACrB;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACjC,MAAM,EACJ,IAAI,EACJ,UAAU,EACV,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,UAAU,GACX,GAAG,KAAK,CAAC,IAAI,CAAA;YAEd,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE;gBACvD,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;YACvB,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;gBACjC,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,yEAAyE;YACzE,sCAAsC;YACtC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;oBACtC,MAAM,EAAE,QAAQ;oBAChB,UAAU;iBACX,CAAC,CAAA;gBACF,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC;oBACtC,MAAM,EAAE,QAAQ;oBAChB,UAAU;iBACX,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YACxC,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACnE,MAAM,aAAa,GACjB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;YAEpE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CACrD,GAAG,EACH,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;gBAChE,MAAM,QAAQ,GAAG,OAAO,KAAK,IAAI,CAAA;gBAEjC,+FAA+F;gBAC/F,IAAI,QAAQ,IAAI,UAAU,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC5D,MAAM,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBACpD,CAAC;gBAED,MAAM,SAAS,GAAG;oBAChB,GAAG;oBACH,UAAU;oBACV,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,aAAa;oBACtB,QAAQ;iBACT,CAAA;gBAED,IAAI,KAAsC,CAAA;gBAC1C,IAAI,CAAC;oBACH,KAAK,GAAG,QAAQ;wBACd,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC;wBAChC,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;gBACpC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBAC5C,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;gBAED,QAAQ;gBACR,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACpD,OAAO;wBACL,MAAM,EAAE,IAAI;wBACZ,KAAK;qBACN,CAAA;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI;qBAC/B,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;qBACrC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,IACE,GAAG,YAAY,kBAAkB;wBACjC,GAAG,YAAY,kBAAkB,EACjC,CAAC;wBACD,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;oBAC3D,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC,CAAC,CAAA;gBAEJ,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAE/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAC1B,CAAC,CACF,CAAA;YAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,GAAG,CAAC,cAAc;qBACrB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;qBAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACb,QAAQ,CAAC,KAAK,CACZ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAC9C,+BAA+B,CAChC,CAAA;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE;oBACJ,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACzB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,MAAM;wBACZ,CAAC,CAAC;4BACE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;4BAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;yBAChB;wBACH,CAAC,CAAC,SAAS;oBACb,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,0BAA0B;AAC1B,KAAK,UAAU,0BAA0B,CACvC,UAAgC,EAChC,MAAc;IAEd,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAgC,EAChC,UAAyB;IAEzB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IAC5D,OAAO;QACL,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAA;AACH,CAAC","sourcesContent":["import {\n  type LegacyBlobRef,\n  type LexMap,\n  type TypedBlobRef,\n  isLegacyBlobRef,\n  parseCid,\n} from '@atproto/lex-data'\nimport { atUri } from '@atproto/lex-schema'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport type { ActorStoreTransactor } from '../../../../actor-store/actor-store-transactor.js'\nimport type { AppContext } from '../../../../context.js'\nimport { app, com } from '../../../../lexicons/index.js'\nimport { dbLogger } from '../../../../logger.js'\nimport {\n  BadCommitSwapError,\n  BadRecordSwapError,\n  InvalidRecordError,\n  type PreparedCreate,\n  type PreparedUpdate,\n  prepareCreate,\n  prepareUpdate,\n} from '../../../../repo/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.putRecord, {\n    auth: ctx.authVerifier.authorization({\n      // @NOTE the \"checkTakedown\" and \"checkDeactivated\" checks are typically\n      // performed during auth. However, since this method's \"repo\" parameter\n      // can be a handle, we will need to fetch the account again to ensure that\n      // the handle matches the DID from the request's credentials. In order to\n      // avoid fetching the account twice (during auth, and then again in the\n      // controller), the checks are disabled here:\n\n      // checkTakedown: true,\n      // checkDeactivated: true,\n      authorize: () => {\n        // Performed in the handler as it requires the request body\n      },\n    }),\n    rateLimit: [\n      {\n        name: 'repo-write-hour',\n        calcKey: ({ auth }) => auth.credentials.did,\n        calcPoints: () => 2,\n      },\n      {\n        name: 'repo-write-day',\n        calcKey: ({ auth }) => auth.credentials.did,\n        calcPoints: () => 2,\n      },\n    ],\n    opts: {\n      jsonLimit: 1_000_000,\n    },\n    handler: async ({ auth, input }) => {\n      const {\n        repo,\n        collection,\n        rkey,\n        record,\n        validate,\n        swapCommit,\n        swapRecord,\n      } = input.body\n\n      const account = await ctx.authVerifier.findAccount(repo, {\n        checkDeactivated: true,\n        checkTakedown: true,\n      })\n\n      const did = account.did\n      if (did !== auth.credentials.did) {\n        throw new AuthRequiredError()\n      }\n\n      // We can't compute permissions based on the request payload (\"input\") in\n      // the 'auth' phase, so we do it here.\n      if (auth.credentials.type === 'oauth') {\n        auth.credentials.permissions.assertRepo({\n          action: 'create',\n          collection,\n        })\n        auth.credentials.permissions.assertRepo({\n          action: 'update',\n          collection,\n        })\n      }\n\n      const uri = atUri(did, collection, rkey)\n      const swapCommitCid = swapCommit ? parseCid(swapCommit) : undefined\n      const swapRecordCid =\n        typeof swapRecord === 'string' ? parseCid(swapRecord) : swapRecord\n\n      const { commit, write } = await ctx.actorStore.transact(\n        did,\n        async (actorTxn) => {\n          const current = await actorTxn.record.getRecord(uri, null, true)\n          const isUpdate = current !== null\n\n          // @TODO temporaray hack for legacy blob refs in profiles - remove after migrating legacy blobs\n          if (isUpdate && collection === app.bsky.actor.profile.$type) {\n            await updateProfileLegacyBlobRef(actorTxn, record)\n          }\n\n          const writeInfo = {\n            did,\n            collection,\n            rkey,\n            record,\n            swapCid: swapRecordCid,\n            validate,\n          }\n\n          let write: PreparedCreate | PreparedUpdate\n          try {\n            write = isUpdate\n              ? await prepareUpdate(writeInfo)\n              : await prepareCreate(writeInfo)\n          } catch (err) {\n            if (err instanceof InvalidRecordError) {\n              throw new InvalidRequestError(err.message)\n            }\n            throw err\n          }\n\n          // no-op\n          if (current && current.cid === write.cid.toString()) {\n            return {\n              commit: null,\n              write,\n            }\n          }\n\n          const commit = await actorTxn.repo\n            .processWrites([write], swapCommitCid)\n            .catch((err) => {\n              if (\n                err instanceof BadCommitSwapError ||\n                err instanceof BadRecordSwapError\n              ) {\n                throw new InvalidRequestError(err.message, 'InvalidSwap')\n              } else {\n                throw err\n              }\n            })\n\n          await ctx.sequencer.sequenceCommit(did, commit)\n\n          return { commit, write }\n        },\n      )\n\n      if (commit !== null) {\n        await ctx.accountManager\n          .updateRepoRoot(did, commit.cid, commit.rev)\n          .catch((err) => {\n            dbLogger.error(\n              { err, did, cid: commit.cid, rev: commit.rev },\n              'failed to update account root',\n            )\n          })\n      }\n\n      return {\n        encoding: 'application/json',\n        body: {\n          uri: write.uri.toString(),\n          cid: write.cid.toString(),\n          commit: commit\n            ? {\n                cid: commit.cid.toString(),\n                rev: commit.rev,\n              }\n            : undefined,\n          validationStatus: write.validationStatus,\n        },\n      }\n    },\n  })\n}\n\n// WARNING: mutates object\nasync function updateProfileLegacyBlobRef(\n  actorStore: ActorStoreTransactor,\n  record: LexMap,\n): Promise<void> {\n  if (isLegacyBlobRef(record.avatar)) {\n    record.avatar = await upgradeLegacyBlob(actorStore, record.avatar)\n  }\n  if (isLegacyBlobRef(record.banner)) {\n    record.banner = await upgradeLegacyBlob(actorStore, record.banner)\n  }\n}\n\nasync function upgradeLegacyBlob(\n  actorStore: ActorStoreTransactor,\n  legacyBlob: LegacyBlobRef,\n): Promise<TypedBlobRef> {\n  const ref = parseCid(legacyBlob.cid)\n  const blob = await actorStore.repo.blob.getBlobMetadata(ref)\n  return {\n    $type: 'blob',\n    mimeType: legacyBlob.mimeType,\n    ref,\n    size: blob.size,\n  }\n}\n"]}

package/dist/api/com/atproto/repo/uploadBlob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uploadBlob.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/uploadBlob.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,MAAM,EAGZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA+CvD"}
+{"version":3,"file":"uploadBlob.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/uploadBlob.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,MAAM,EAGZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgDvD"}

package/dist/api/com/atproto/repo/uploadBlob.js

@@ -11,6 +11,7 @@ export default function (server, ctx) {
             },
         }),
         rateLimit: {
+            calcKey: ({ auth }) => auth.credentials.did,
             durationMs: DAY,
             points: 1000,
         },

package/dist/api/com/atproto/repo/uploadBlob.js.map

@@ -1 +1 @@
-{"version":3,"file":"uploadBlob.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/uploadBlob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE;QACtC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,8BAA8B,CAAC;YACpD,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACtC,WAAW,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5C,CAAC;SACF,CAAC;QACF,SAAS,EAAE;YACT,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,IAAI;SACb;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAEtC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAClD,SAAS,EACT,KAAK,EAAE,KAAK,EAAE,EAAE;gBACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI;qBACnC,wBAAwB,CACvB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,EACd,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAChC;qBACA,KAAK,CAAC,yBAAyB,CAAC,CAAA;gBAEnC,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;oBACvC,MAAM,OAAO,GACX,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;oBAExD,qEAAqE;oBACrE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5D,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAA;oBAC9D,CAAC;oBAED,OAAO,OAAO,CAAA;gBAChB,CAAC,CAAC,CAAA;YACJ,CAAC,CACF,CAAA;YAED,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,EAAE,IAAI,EAAE;aACf,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,qDAAqD;IACrD,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAA;QAC1E,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IACb,CAAC;IACD,MAAM,GAAG,CAAA;AACX,CAAC","sourcesContent":["import { DAY } from '@atproto/common'\nimport {\n  type Server,\n  UpstreamTimeoutError,\n  parseReqEncoding,\n} from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.uploadBlob, {\n    auth: ctx.authVerifier.authorizationOrUserServiceAuth({\n      checkTakedown: true,\n      authorize: (permissions, { req }) => {\n        const encoding = parseReqEncoding(req)\n        permissions.assertBlob({ mime: encoding })\n      },\n    }),\n    rateLimit: {\n      durationMs: DAY,\n      points: 1000,\n    },\n    handler: async ({ auth, input }) => {\n      const requester = auth.credentials.did\n\n      const blob = await ctx.actorStore.writeNoTransaction(\n        requester,\n        async (store) => {\n          const metadata = await store.repo.blob\n            .uploadBlobAndGetMetadata(\n              input.body,\n              input.encoding,\n              ctx.cfg.service.blobUploadLimit,\n            )\n            .catch(throwAbortAsUpstreamError)\n\n          return store.transact(async (actorTxn) => {\n            const blobRef =\n              await actorTxn.repo.blob.trackUntetheredBlob(metadata)\n\n            // make the blob permanent if an associated record is already indexed\n            if (await actorTxn.repo.blob.hasRecordsForBlob(blobRef.ref)) {\n              await actorTxn.repo.blob.verifyBlobAndMakePermanent(blobRef)\n            }\n\n            return blobRef\n          })\n        },\n      )\n\n      return {\n        encoding: 'application/json' as const,\n        body: { blob },\n      }\n    },\n  })\n}\n\nfunction throwAbortAsUpstreamError(err: unknown): never {\n  // Blob store timeouts surface as AbortError (total upload timeout) or\n  // TimeoutError (stalled connection), possibly wrapped as an error cause\n  // (e.g. S3BlobStore's \"Blob upload timed out\" error). The depth limit\n  // guards against (pathological) cyclic cause chains.\n  for (let e = err, depth = 0; e instanceof Error && depth < 10; depth++) {\n    if (e.name === 'AbortError' || e.name === 'TimeoutError') {\n      throw new UpstreamTimeoutError('Operation timed out, please try again.')\n    }\n    e = e.cause\n  }\n  throw err\n}\n"]}
+{"version":3,"file":"uploadBlob.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/repo/uploadBlob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE;QACtC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,8BAA8B,CAAC;YACpD,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACtC,WAAW,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5C,CAAC;SACF,CAAC;QACF,SAAS,EAAE;YACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;YAC3C,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,IAAI;SACb;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAEtC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAClD,SAAS,EACT,KAAK,EAAE,KAAK,EAAE,EAAE;gBACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI;qBACnC,wBAAwB,CACvB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,EACd,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAChC;qBACA,KAAK,CAAC,yBAAyB,CAAC,CAAA;gBAEnC,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;oBACvC,MAAM,OAAO,GACX,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;oBAExD,qEAAqE;oBACrE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5D,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAA;oBAC9D,CAAC;oBAED,OAAO,OAAO,CAAA;gBAChB,CAAC,CAAC,CAAA;YACJ,CAAC,CACF,CAAA;YAED,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,EAAE,IAAI,EAAE;aACf,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,qDAAqD;IACrD,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAA;QAC1E,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;IACb,CAAC;IACD,MAAM,GAAG,CAAA;AACX,CAAC","sourcesContent":["import { DAY } from '@atproto/common'\nimport {\n  type Server,\n  UpstreamTimeoutError,\n  parseReqEncoding,\n} from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.repo.uploadBlob, {\n    auth: ctx.authVerifier.authorizationOrUserServiceAuth({\n      checkTakedown: true,\n      authorize: (permissions, { req }) => {\n        const encoding = parseReqEncoding(req)\n        permissions.assertBlob({ mime: encoding })\n      },\n    }),\n    rateLimit: {\n      calcKey: ({ auth }) => auth.credentials.did,\n      durationMs: DAY,\n      points: 1000,\n    },\n    handler: async ({ auth, input }) => {\n      const requester = auth.credentials.did\n\n      const blob = await ctx.actorStore.writeNoTransaction(\n        requester,\n        async (store) => {\n          const metadata = await store.repo.blob\n            .uploadBlobAndGetMetadata(\n              input.body,\n              input.encoding,\n              ctx.cfg.service.blobUploadLimit,\n            )\n            .catch(throwAbortAsUpstreamError)\n\n          return store.transact(async (actorTxn) => {\n            const blobRef =\n              await actorTxn.repo.blob.trackUntetheredBlob(metadata)\n\n            // make the blob permanent if an associated record is already indexed\n            if (await actorTxn.repo.blob.hasRecordsForBlob(blobRef.ref)) {\n              await actorTxn.repo.blob.verifyBlobAndMakePermanent(blobRef)\n            }\n\n            return blobRef\n          })\n        },\n      )\n\n      return {\n        encoding: 'application/json' as const,\n        body: { blob },\n      }\n    },\n  })\n}\n\nfunction throwAbortAsUpstreamError(err: unknown): never {\n  // Blob store timeouts surface as AbortError (total upload timeout) or\n  // TimeoutError (stalled connection), possibly wrapped as an error cause\n  // (e.g. S3BlobStore's \"Blob upload timed out\" error). The depth limit\n  // guards against (pathological) cyclic cause chains.\n  for (let e = err, depth = 0; e instanceof Error && depth < 10; depth++) {\n    if (e.name === 'AbortError' || e.name === 'TimeoutError') {\n      throw new UpstreamTimeoutError('Operation timed out, please try again.')\n    }\n    e = e.cause\n  }\n  throw err\n}\n"]}

package/dist/api/com/atproto/server/createAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAyHvD"}
+{"version":3,"file":"createAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwIvD"}

package/dist/api/com/atproto/server/createAccount.js

@@ -6,21 +6,32 @@ import { Secp256k1Keypair, } from '@atproto/crypto';
 import { ensureAtpDocument } from '@atproto/identity';
 import { AuthRequiredError, InvalidRequestError, } from '@atproto/xrpc-server';
 import { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js';
+import { bearerTokenFromReq } from '../../../../auth-verifier.js';
 import { events } from '../../../../events.js';
 import { baseNormalizeAndValidate } from '../../../../handle/index.js';
 import { com } from '../../../../lexicons/index.js';
 import { safeResolveDidDoc } from './util.js';
 export default function (server, ctx) {
+    // Like entrywayServiceOptional, but PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH does
+    // not apply yet: the entryway can only start signing createAccount once
+    // PDSes accept a signed call. Enforcement follows once it does.
+    const auth = ctx.cfg.entryway
+        ? (authCtx) => bearerTokenFromReq(authCtx.req) !== null
+            ? ctx.authVerifier.entrywayService(authCtx)
+            : ctx.authVerifier.unauthenticated(authCtx)
+        : ctx.authVerifier.userServiceAuthOptional;
     server.add(com.atproto.server.createAccount, {
         rateLimit: {
             durationMs: 5 * MINUTE,
             points: 100,
         },
-        auth: ctx.authVerifier.userServiceAuthOptional,
+        auth,
         handler: async ({ input, auth, req, }) => {
             // @NOTE Until this code and the OAuthStore's `createAccount` are
             // refactored together, any change made here must be reflected over there.
-            const requester = auth.credentials?.did ?? null;
+            const requester = auth.credentials?.type === 'user_service_auth'
+                ? auth.credentials.did
+                : null;
             const { did, handle, email, password, inviteCode, signingKey, plcOp, deactivated, } = ctx.entrywayClient
                 ? await validateInputsForEntrywayPds(ctx, input.body)
                 : await validateInputsForLocalPds(ctx, input.body, requester);

package/dist/api/com/atproto/server/createAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  //\n  // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n  // email uniqueness across taken down and deactivated accounts as well, so we\n  // must check for them when surfacing handle availability.\n  const availability = { includeTakenDown: true, includeDeactivated: true }\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle, availability),\n    ctx.accountManager.getAccountByEmail(email, availability),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}
+{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAMvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,IAAI,GAEN,GAAG,CAAC,GAAG,CAAC,QAAQ;QAClB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CACV,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YACtC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,uBAAuB,CAAA;IAE5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI;QACJ,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GACb,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,mBAAmB;gBAC5C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;gBACtB,CAAC,CAAC,IAAI,CAAA;YACV,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type MethodAuthVerifier,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type {\n  EntrywayServiceOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from '../../../../auth-output.js'\nimport { bearerTokenFromReq } from '../../../../auth-verifier.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  // Like entrywayServiceOptional, but PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH does\n  // not apply yet: the entryway can only start signing createAccount once\n  // PDSes accept a signed call. Enforcement follows once it does.\n  const auth: MethodAuthVerifier<\n    EntrywayServiceOutput | UserServiceAuthOutput | UnauthenticatedOutput\n  > = ctx.cfg.entryway\n    ? (authCtx) =>\n        bearerTokenFromReq(authCtx.req) !== null\n          ? ctx.authVerifier.entrywayService(authCtx)\n          : ctx.authVerifier.unauthenticated(authCtx)\n    : ctx.authVerifier.userServiceAuthOptional\n\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester =\n        auth.credentials?.type === 'user_service_auth'\n          ? auth.credentials.did\n          : null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  //\n  // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n  // email uniqueness across taken down and deactivated accounts as well, so we\n  // must check for them when surfacing handle availability.\n  const availability = { includeTakenDown: true, includeDeactivated: true }\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle, availability),\n    ctx.accountManager.getAccountByEmail(email, availability),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}

package/dist/api/com/atproto/server/describeServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"describeServer.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/describeServer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAgB,CAAA;QAC5C,MAAM,oBAAoB,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAA;QAClE,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAA;QACnD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAA;QACvD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAA6B,CAAA;QACnE,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAA8B,CAAA;QACrE,MAAM,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAA;QAE/D,OAAO;YACL,QAAQ,EAAE,kBAA2B;YACrC,IAAI,EAAE;gBACJ,GAAG;gBACH,oBAAoB;gBACpB,kBAAkB;gBAClB,eAAe;gBACf,KAAK,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;gBACxC,OAAO,EAAE;oBACP,KAAK,EAAE,mBAAmB;iBAC3B;aACF;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { UriString } from '@atproto/lex'\nimport type { DidString } from '@atproto/syntax'\nimport type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.describeServer, () => {\n    const did = ctx.cfg.service.did as DidString\n    const availableUserDomains = ctx.cfg.identity.serviceHandleDomains\n    const inviteCodeRequired = ctx.cfg.invites.required\n    const blobUploadLimit = ctx.cfg.service.blobUploadLimit\n    const privacyPolicy = ctx.cfg.service.privacyPolicyUrl as UriString\n    const termsOfService = ctx.cfg.service.termsOfServiceUrl as UriString\n    const contactEmailAddress = ctx.cfg.service.contactEmailAddress\n\n    return {\n      encoding: 'application/json' as const,\n      body: {\n        did,\n        availableUserDomains,\n        inviteCodeRequired,\n        blobUploadLimit,\n        links: { privacyPolicy, termsOfService },\n        contact: {\n          email: contactEmailAddress,\n        },\n      },\n    }\n  })\n}\n"]}
+{"version":3,"file":"describeServer.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/describeServer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAgB,CAAA;QAC5C,MAAM,oBAAoB,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAA;QAClE,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAA;QACnD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAA;QACvD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAA6B,CAAA;QACnE,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAA8B,CAAA;QACrE,MAAM,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAA;QAE/D,OAAO;YACL,QAAQ,EAAE,kBAA2B;YACrC,IAAI,EAAE;gBACJ,GAAG;gBACH,oBAAoB;gBACpB,kBAAkB;gBAClB,eAAe;gBACf,KAAK,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE;gBACxC,OAAO,EAAE;oBACP,KAAK,EAAE,mBAAmB;iBAC3B;aACF;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { UriString } from '@atproto/lex-schema'\nimport type { DidString } from '@atproto/syntax'\nimport type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.describeServer, () => {\n    const did = ctx.cfg.service.did as DidString\n    const availableUserDomains = ctx.cfg.identity.serviceHandleDomains\n    const inviteCodeRequired = ctx.cfg.invites.required\n    const blobUploadLimit = ctx.cfg.service.blobUploadLimit\n    const privacyPolicy = ctx.cfg.service.privacyPolicyUrl as UriString\n    const termsOfService = ctx.cfg.service.termsOfServiceUrl as UriString\n    const contactEmailAddress = ctx.cfg.service.contactEmailAddress\n\n    return {\n      encoding: 'application/json' as const,\n      body: {\n        did,\n        availableUserDomains,\n        inviteCodeRequired,\n        blobUploadLimit,\n        links: { privacyPolicy, termsOfService },\n        contact: {\n          email: contactEmailAddress,\n        },\n      },\n    }\n  })\n}\n"]}

package/dist/api/com/atproto/server/getServiceAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"getServiceAuth.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getServiceAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEpE,OAAO,EACL,mBAAmB,EAEnB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,WAAW,GACZ,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,4BAA4B,CAAA;AAEnC,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAElC;YACA,UAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;YACjC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,MAAM,CAAA;gBACjC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACrC,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAEhC,oEAAoE;YACpE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;YAEvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,mBAAmB,CAC3B,4DAA4D,CAC7D,CAAA;YACH,CAAC;YAED,2HAA2H;YAC3H,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvC,4DAA4D;gBAC5D,4CAA4C;gBAC5C,IACE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBACnC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAC7C,CAAC;oBACD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;gBAClE,CAAC;gBAED,qEAAqE;gBACrE,mCAAmC;gBACnC,IACE,GAAG,IAAI,IAAI;oBACX,kBAAkB,CAAC,GAAG,CAAC;oBACvB,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAC3C,CAAC;oBACD,MAAM,IAAI,mBAAmB,CAC3B,iFAAiF,GAAG,EAAE,CACvF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBACpC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACb,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,EACvB,eAAe,CAChB,CAAA;gBACH,CAAC;qBAAM,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,mBAAmB,CAC3B,2EAA2E,EAC3E,eAAe,CAChB,CAAA;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;oBACjC,MAAM,IAAI,mBAAmB,CAC3B,wFAAwF,EACxF,eAAe,CAChB,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAC3B,2EAA2E,GAAG,EAAE,CACjF,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEjD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;gBACnC,GAAG,EAAE,GAAG;gBACR,GAAG;gBACH,GAAG;gBACH,GAAG;gBACH,OAAO;aACR,CAAC,CAAA;YACF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,KAAK;iBACN;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { HOUR, MINUTE } from '@atproto/common'\nimport { isAtprotoDid, isAtprotoDidRefAbsolute } from '@atproto/did'\nimport type { l } from '@atproto/lex'\nimport {\n  InvalidRequestError,\n  type Server,\n  createServiceJwt,\n} from '@atproto/xrpc-server'\nimport {\n  AuthScope,\n  isAccessPrivileged,\n  isTakendown,\n} from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport {\n  isPrivilegedMethod,\n  isProtectedMethod,\n} from '../../../../pipethrough.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.getServiceAuth, {\n    auth: ctx.authVerifier.authorization<\n      l.InferMethodParams<typeof com.atproto.server.getServiceAuth.main>\n    >({\n      additional: [AuthScope.Takendown],\n      authorize: (permissions, { params }) => {\n        const { aud, lxm = '*' } = params\n        permissions.assertRpc({ aud, lxm })\n      },\n    }),\n    handler: async ({ params, auth }) => {\n      const did = auth.credentials.did\n\n      // @NOTE \"exp\" is expressed in seconds since epoch, not milliseconds\n      const { aud, exp, lxm = null } = params\n\n      if (!isAtprotoDid(aud) && !isAtprotoDidRefAbsolute(aud)) {\n        throw new InvalidRequestError(\n          'aud must be a valid atproto DID or did#serviceId reference',\n        )\n      }\n\n      // Takendown accounts should not be able to generate service auth tokens except for methods necessary for account migration\n      if (auth.credentials.type === 'access') {\n        // @NOTE We should probably use \"ForbiddenError\" here. Using\n        // \"InvalidRequestError\" for legacy reasons.\n        if (\n          isTakendown(auth.credentials.scope) &&\n          lxm !== com.atproto.server.createAccount.$lxm\n        ) {\n          throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n        }\n\n        // @NOTE \"oauth\" based credentials already checked through permission\n        // set in \"authorize\" method above.\n        if (\n          lxm != null &&\n          isPrivilegedMethod(lxm) &&\n          !isAccessPrivileged(auth.credentials.scope)\n        ) {\n          throw new InvalidRequestError(\n            `insufficient access to request a service auth token for the following method: ${lxm}`,\n          )\n        }\n      }\n\n      if (exp) {\n        const diff = exp * 1000 - Date.now()\n        if (diff < 0) {\n          throw new InvalidRequestError(\n            'expiration is in past',\n            'BadExpiration',\n          )\n        } else if (diff > HOUR) {\n          throw new InvalidRequestError(\n            'cannot request a token with an expiration more than an hour in the future',\n            'BadExpiration',\n          )\n        } else if (!lxm && diff > MINUTE) {\n          throw new InvalidRequestError(\n            'cannot request a method-less token with an expiration more than a minute in the future',\n            'BadExpiration',\n          )\n        }\n      }\n\n      if (lxm && isProtectedMethod(lxm)) {\n        throw new InvalidRequestError(\n          `cannot request a service auth token for the following protected method: ${lxm}`,\n        )\n      }\n\n      const keypair = await ctx.actorStore.keypair(did)\n\n      const token = await createServiceJwt({\n        iss: did,\n        aud,\n        exp,\n        lxm,\n        keypair,\n      })\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          token,\n        },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"getServiceAuth.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getServiceAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEpE,OAAO,EACL,mBAAmB,EAEnB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,WAAW,GACZ,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,4BAA4B,CAAA;AAEnC,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAElC;YACA,UAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;YACjC,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,MAAM,CAAA;gBACjC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACrC,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAEhC,oEAAoE;YACpE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;YAEvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,mBAAmB,CAC3B,4DAA4D,CAC7D,CAAA;YACH,CAAC;YAED,2HAA2H;YAC3H,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvC,4DAA4D;gBAC5D,4CAA4C;gBAC5C,IACE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBACnC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAC7C,CAAC;oBACD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;gBAClE,CAAC;gBAED,qEAAqE;gBACrE,mCAAmC;gBACnC,IACE,GAAG,IAAI,IAAI;oBACX,kBAAkB,CAAC,GAAG,CAAC;oBACvB,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAC3C,CAAC;oBACD,MAAM,IAAI,mBAAmB,CAC3B,iFAAiF,GAAG,EAAE,CACvF,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBACpC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACb,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,EACvB,eAAe,CAChB,CAAA;gBACH,CAAC;qBAAM,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,mBAAmB,CAC3B,2EAA2E,EAC3E,eAAe,CAChB,CAAA;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;oBACjC,MAAM,IAAI,mBAAmB,CAC3B,wFAAwF,EACxF,eAAe,CAChB,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAC3B,2EAA2E,GAAG,EAAE,CACjF,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEjD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;gBACnC,GAAG,EAAE,GAAG;gBACR,GAAG;gBACH,GAAG;gBACH,GAAG;gBACH,OAAO;aACR,CAAC,CAAA;YACF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,KAAK;iBACN;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { HOUR, MINUTE } from '@atproto/common'\nimport { isAtprotoDid, isAtprotoDidRefAbsolute } from '@atproto/did'\nimport type { l } from '@atproto/lex-schema'\nimport {\n  InvalidRequestError,\n  type Server,\n  createServiceJwt,\n} from '@atproto/xrpc-server'\nimport {\n  AuthScope,\n  isAccessPrivileged,\n  isTakendown,\n} from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport {\n  isPrivilegedMethod,\n  isProtectedMethod,\n} from '../../../../pipethrough.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.getServiceAuth, {\n    auth: ctx.authVerifier.authorization<\n      l.InferMethodParams<typeof com.atproto.server.getServiceAuth.main>\n    >({\n      additional: [AuthScope.Takendown],\n      authorize: (permissions, { params }) => {\n        const { aud, lxm = '*' } = params\n        permissions.assertRpc({ aud, lxm })\n      },\n    }),\n    handler: async ({ params, auth }) => {\n      const did = auth.credentials.did\n\n      // @NOTE \"exp\" is expressed in seconds since epoch, not milliseconds\n      const { aud, exp, lxm = null } = params\n\n      if (!isAtprotoDid(aud) && !isAtprotoDidRefAbsolute(aud)) {\n        throw new InvalidRequestError(\n          'aud must be a valid atproto DID or did#serviceId reference',\n        )\n      }\n\n      // Takendown accounts should not be able to generate service auth tokens except for methods necessary for account migration\n      if (auth.credentials.type === 'access') {\n        // @NOTE We should probably use \"ForbiddenError\" here. Using\n        // \"InvalidRequestError\" for legacy reasons.\n        if (\n          isTakendown(auth.credentials.scope) &&\n          lxm !== com.atproto.server.createAccount.$lxm\n        ) {\n          throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n        }\n\n        // @NOTE \"oauth\" based credentials already checked through permission\n        // set in \"authorize\" method above.\n        if (\n          lxm != null &&\n          isPrivilegedMethod(lxm) &&\n          !isAccessPrivileged(auth.credentials.scope)\n        ) {\n          throw new InvalidRequestError(\n            `insufficient access to request a service auth token for the following method: ${lxm}`,\n          )\n        }\n      }\n\n      if (exp) {\n        const diff = exp * 1000 - Date.now()\n        if (diff < 0) {\n          throw new InvalidRequestError(\n            'expiration is in past',\n            'BadExpiration',\n          )\n        } else if (diff > HOUR) {\n          throw new InvalidRequestError(\n            'cannot request a token with an expiration more than an hour in the future',\n            'BadExpiration',\n          )\n        } else if (!lxm && diff > MINUTE) {\n          throw new InvalidRequestError(\n            'cannot request a method-less token with an expiration more than a minute in the future',\n            'BadExpiration',\n          )\n        }\n      }\n\n      if (lxm && isProtectedMethod(lxm)) {\n        throw new InvalidRequestError(\n          `cannot request a service auth token for the following protected method: ${lxm}`,\n        )\n      }\n\n      const keypair = await ctx.actorStore.keypair(did)\n\n      const token = await createServiceJwt({\n        iss: did,\n        aud,\n        exp,\n        lxm,\n        keypair,\n      })\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          token,\n        },\n      }\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/server/reserveSigningKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reserveSigningKey.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAUvD"}
+{"version":3,"file":"reserveSigningKey.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAavD"}

package/dist/api/com/atproto/server/reserveSigningKey.js

@@ -1,6 +1,9 @@
 import { com } from '../../../../lexicons/index.js';
 export default function (server, ctx) {
     server.add(com.atproto.server.reserveSigningKey, {
+        auth: ctx.cfg.entryway
+            ? ctx.authVerifier.entrywayServiceOptional
+            : undefined,
         handler: async ({ input }) => {
             const signingKey = await ctx.actorStore.reserveKeypair(input.body.did);
             return {

package/dist/api/com/atproto/server/reserveSigningKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"reserveSigningKey.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;QAC/C,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtE,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.reserveSigningKey, {\n    handler: async ({ input }) => {\n      const signingKey = await ctx.actorStore.reserveKeypair(input.body.did)\n      return {\n        encoding: 'application/json' as const,\n        body: { signingKey },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"reserveSigningKey.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ;YACpB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,uBAAuB;YAC1C,CAAC,CAAC,SAAS;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtE,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.reserveSigningKey, {\n    auth: ctx.cfg.entryway\n      ? ctx.authVerifier.entrywayServiceOptional\n      : undefined,\n    handler: async ({ input }) => {\n      const signingKey = await ctx.actorStore.reserveKeypair(input.body.did)\n      return {\n        encoding: 'application/json' as const,\n        body: { signingKey },\n      }\n    },\n  })\n}\n"]}

package/dist/app-view.d.ts

@@ -1,4 +1,4 @@
-import { Client } from '@atproto/lex';
+import { Client } from '@atproto/lex-client';
 export type AppViewOptions = {
     url: string;
     did: string;

package/dist/app-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-view.d.ts","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,OAAO;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,aAAa,CAAC,CAAQ;IAE9B,YAAY,OAAO,EAAE,cAAc,EAIlC;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;CACF"}
+{"version":3,"file":"app-view.d.ts","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,qBAAa,OAAO;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,aAAa,CAAC,CAAQ;IAE9B,YAAY,OAAO,EAAE,cAAc,EAIlC;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;CACF"}

package/dist/app-view.js

@@ -1,5 +1,5 @@
 import { format } from 'node:util';
-import { Client } from '@atproto/lex';
+import { Client } from '@atproto/lex-client';
 export class AppView {
     constructor(options) {
         this.did = options.did;

package/dist/app-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-view.js","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAQrC,MAAM,OAAO,OAAO;IAKlB,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport class AppView {\n  public did: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.client = new Client({ service: options.url })\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}
+{"version":3,"file":"app-view.js","sourceRoot":"","sources":["../src/app-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAQ5C,MAAM,OAAO,OAAO;IAKlB,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex-client'\n\nexport type AppViewOptions = {\n  url: string\n  did: string\n  cdnUrlPattern?: string\n}\n\nexport class AppView {\n  public did: string\n  public client: Client\n  private cdnUrlPattern?: string\n\n  constructor(options: AppViewOptions) {\n    this.did = options.did\n    this.client = new Client({ service: options.url })\n    this.cdnUrlPattern = options.cdnUrlPattern\n  }\n\n  getImageUrl(pattern: string, did: string, cid: string): string | undefined {\n    if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n  }\n}\n"]}

package/dist/auth-output.d.ts

@@ -15,6 +15,12 @@ export type ModServiceOutput = {
         did: DidString;
     };
 };
+export type EntrywayServiceOutput = {
+    credentials: {
+        type: 'entryway_service';
+        did: DidString;
+    };
+};
 export type AccessOutput<S extends AuthScope = AuthScope> = {
     credentials: {
         type: 'access';

package/dist/auth-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-output.d.ts","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;QACnB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC1D,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAA;QACd,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,CAAC,CAAA;KACT,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE;QACX,IAAI,EAAE,OAAO,CAAA;QACb,GAAG,EAAE,SAAS,CAAA;QACd,WAAW,EAAE,gBAAgB,CAAA;KAC9B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,SAAS,CAAA;QACf,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,SAAS,CAAC,OAAO,CAAA;QACxB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAA;QACzB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA"}
+{"version":3,"file":"auth-output.d.ts","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;QACnB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,kBAAkB,CAAA;QACxB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC1D,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAA;QACd,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,CAAC,CAAA;KACT,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE;QACX,IAAI,EAAE,OAAO,CAAA;QACb,GAAG,EAAE,SAAS,CAAA;QACd,WAAW,EAAE,gBAAgB,CAAA;KAC9B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,SAAS,CAAA;QACf,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,SAAS,CAAC,OAAO,CAAA;QACxB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAA;QACzB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA"}

package/dist/auth-output.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"","sourcesContent":["import type { ScopePermissions } from '@atproto/oauth-scopes'\nimport type { DidString } from '@atproto/syntax'\nimport type { AuthScope } from './auth-scope.js'\n\nexport type UnauthenticatedOutput = {\n  credentials: null\n}\n\nexport type AdminTokenOutput = {\n  credentials: {\n    type: 'admin_token'\n  }\n}\n\nexport type ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    did: DidString\n  }\n}\n\nexport type AccessOutput<S extends AuthScope = AuthScope> = {\n  credentials: {\n    type: 'access'\n    did: DidString\n    scope: S\n  }\n}\n\nexport type OAuthOutput = {\n  credentials: {\n    type: 'oauth'\n    did: DidString\n    permissions: ScopePermissions\n  }\n}\n\nexport type RefreshOutput = {\n  credentials: {\n    type: 'refresh'\n    did: DidString\n    scope: AuthScope.Refresh\n    tokenId: string\n  }\n}\n\nexport type UserServiceAuthOutput = {\n  credentials: {\n    type: 'user_service_auth'\n    did: DidString\n  }\n}\n"]}
+{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"","sourcesContent":["import type { ScopePermissions } from '@atproto/oauth-scopes'\nimport type { DidString } from '@atproto/syntax'\nimport type { AuthScope } from './auth-scope.js'\n\nexport type UnauthenticatedOutput = {\n  credentials: null\n}\n\nexport type AdminTokenOutput = {\n  credentials: {\n    type: 'admin_token'\n  }\n}\n\nexport type ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    did: DidString\n  }\n}\n\nexport type EntrywayServiceOutput = {\n  credentials: {\n    type: 'entryway_service'\n    did: DidString\n  }\n}\n\nexport type AccessOutput<S extends AuthScope = AuthScope> = {\n  credentials: {\n    type: 'access'\n    did: DidString\n    scope: S\n  }\n}\n\nexport type OAuthOutput = {\n  credentials: {\n    type: 'oauth'\n    did: DidString\n    permissions: ScopePermissions\n  }\n}\n\nexport type RefreshOutput = {\n  credentials: {\n    type: 'refresh'\n    did: DidString\n    scope: AuthScope.Refresh\n    tokenId: string\n  }\n}\n\nexport type UserServiceAuthOutput = {\n  credentials: {\n    type: 'user_service_auth'\n    did: DidString\n  }\n}\n"]}

package/dist/auth-verifier.d.ts

@@ -1,14 +1,14 @@
 import { type KeyObject } from 'node:crypto';
-import type { IncomingMessage } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import * as jose from 'jose';
 import { type IdResolver } from '@atproto/identity';
-import { type AtIdentifierString, type DidString } from '@atproto/lex';
+import { type AtIdentifierString, type DidString } from '@atproto/lex-schema';
 import type { OAuthVerifier } from '@atproto/oauth-provider/verifier';
 import { type ScopePermissions } from '@atproto/oauth-scopes';
 import { type Awaitable, type MethodAuthContext, type MethodAuthVerifier, type Params } from '@atproto/xrpc-server';
 import type { AccountManager } from './account-manager/account-manager.js';
 import type { ActorAccount } from './account-manager/helpers/account.js';
-import type { AccessOutput, AdminTokenOutput, ModServiceOutput, OAuthOutput, RefreshOutput, UnauthenticatedOutput, UserServiceAuthOutput } from './auth-output.js';
+import type { AccessOutput, AdminTokenOutput, EntrywayServiceOutput, ModServiceOutput, OAuthOutput, RefreshOutput, UnauthenticatedOutput, UserServiceAuthOutput } from './auth-output.js';
 import { AuthScope } from './auth-scope.js';
 import type { WithRequired } from './util/types.js';
 export type VerifiedOptions = {
@@ -33,6 +33,11 @@ export type AuthVerifierOpts = {
         entryway?: string;
         modService?: string;
     };
+    entrywayServiceAuth?: {
+        /** did:key form of the entryway's JWT verify key */
+        didKey: string;
+        required: boolean;
+    };
 };
 export type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> = WithRequired<Omit<jose.JWTVerifyOptions, 'scopes'> & {
     scopes: readonly S[];
@@ -50,6 +55,7 @@ export declare class AuthVerifier {
     private _publicUrl;
     private _jwtKey;
     private _adminPass;
+    private _entrywayServiceAuth;
     dids: AuthVerifierOpts['dids'];
     constructor(accountManager: AccountManager, idResolver: IdResolver, oauthVerifier: OAuthVerifier, opts: AuthVerifierOpts);
     unauthenticated: MethodAuthVerifier<UnauthenticatedOutput>;
@@ -58,6 +64,10 @@ export declare class AuthVerifier {
     modService: MethodAuthVerifier<ModServiceOutput>;
     /** @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. */
     moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput>;
+    entrywayService: MethodAuthVerifier<EntrywayServiceOutput>;
+    entrywayServiceOptional: MethodAuthVerifier<EntrywayServiceOutput | UnauthenticatedOutput>;
+    adminTokenOrEntrywayService: MethodAuthVerifier<AdminTokenOutput | EntrywayServiceOutput>;
+    moderatorOrEntrywayService: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput | EntrywayServiceOutput>;
     protected access<S extends AuthScope>(options: VerifiedOptions & Required<ScopedOptions<S>>): MethodAuthVerifier<AccessOutput<S>>;
     refresh(options?: {
         allowExpired?: boolean;
@@ -90,6 +100,15 @@ export declare class AuthVerifier {
         lxm?: string;
         jti?: string;
     }>;
+    protected verifyEntrywayServiceJwt(req: IncomingMessage): Promise<{
+        iss: DidString | `${DidString}#${string}`;
+        aud: string;
+        exp: number;
+        lxm?: string;
+        jti?: string;
+    }>;
+    protected isEntrywayIssuedJwt(req: IncomingMessage): boolean;
+    protected assertEntrywayServiceAuthNotRequired(res: ServerResponse): void;
 }
 export declare function isUserOrAdmin(auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput, did: string): boolean;
 export declare const bearerTokenFromReq: (req: IncomingMessage) => string | null;

package/dist/auth-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAKrB,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAMvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,OAAO,EAAE,KAAK,SAAS,EAAE,CAAA;AAEzB,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAa5D,CAAA"}
+{"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,mBAAmB,CAAC,EAAE;QACpB,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,OAAO,CAAA;KAClB,CAAA;CACF,CAAA;AAKD,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAQd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IATrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,oBAAoB,CAAyC;IAC9D,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAOvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEI,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAMA;IAEM,2BAA2B,EAAE,kBAAkB,CACpD,gBAAgB,GAAG,qBAAqB,CACzC,CASA;IAEM,0BAA0B,EAAE,kBAAkB,CACnD,gBAAgB,GAAG,gBAAgB,GAAG,qBAAqB,CAC5D,CAQA;IAED,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;IAED,UAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe;;;;;;OAiD5D;IAED,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAU3D;IAED,SAAS,CAAC,oCAAoC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAKxE;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,OAAO,EAAE,KAAK,SAAS,EAAE,CAAA;AAEzB,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAa5D,CAAA"}