@atproto/pds 0.5.52 → 0.5.56

package/dist/config/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAElE,MAAM,UAAU,OAAO;IACrB,OAAO;QACL,UAAU;QACV,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;QAChC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,iBAAiB,EAAE,MAAM,CAAC,0BAA0B,CAAC;QACrD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,gBAAgB,EAAE,OAAO,CAAC,4BAA4B,CAAC;QACvD,aAAa,EAAE,MAAM,CAAC,0BAA0B,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC;QAEhC,WAAW;QACX,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAEpD,QAAQ;QACR,mBAAmB,EAAE,OAAO,CAAC,2BAA2B,CAAC;QAEzD,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC;QACzC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC;QAEzC,kBAAkB,EAAE,MAAM,CAAC,0BAA0B,CAAC;QACtD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAEpD,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,oBAAoB,CAAC;QAC3C,wBAAwB,EAAE,OAAO,CAAC,wCAAwC,CAAC;QAC3E,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,kBAAkB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QAEvD,cAAc;QACd,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,mBAAmB,EAAE,MAAM,CAAC,4BAA4B,CAAC;QAEzD,0BAA0B;QAC1B,KAAK;QACL,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,yBAAyB,EAAE,OAAO,CAAC,mCAAmC,CAAC;QACvE,sBAAsB,EAAE,MAAM,CAAC,gCAAgC,CAAC;QAChE,0BAA0B,EAAE,MAAM,CAAC,oCAAoC,CAAC;QACxE,0BAA0B,EAAE,MAAM,CAAC,oCAAoC,CAAC;QACxE,2BAA2B,EAAE,MAAM,CAAC,qCAAqC,CAAC;QAC1E,OAAO;QACP,qBAAqB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAC5D,wBAAwB,EAAE,MAAM,CAAC,iCAAiC,CAAC;QAEnE,WAAW;QACX,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACpC,gBAAgB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACnD,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAC/C,eAAe,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAClD,cAAc,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC9C,oBAAoB,EAAE,OAAO,CAAC,4BAA4B,CAAC,EAAE,6BAA6B;QAC1F,uBAAuB,EAAE,OAAO,CAAC,+BAA+B,CAAC;QACjE,uBAAuB,EAAE,OAAO,CAAC,iCAAiC,CAAC;QAEnE,WAAW;QACX,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvC,oCAAoC,EAAE,MAAM,CAC1C,iDAAiD,CAClD;QACD,sBAAsB,EAAE,MAAM,CAAC,+BAA+B,CAAC;QAE/D,UAAU;QACV,cAAc,EAAE,OAAO,CAAC,qBAAqB,CAAC;QAC9C,cAAc,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAEvC,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,oBAAoB,CAAC;QAC1C,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,4BAA4B,EAAE,OAAO,CACnC,qCAAqC,CACtC;QACD,sBAAsB,EAAE,MAAM,CAAC,+BAA+B,CAAC;QAC/D,sBAAsB,EAAE,MAAM,CAAC,8BAA8B,CAAC;QAE9D,eAAe;QACf,qBAAqB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAC5D,mBAAmB,EAAE,MAAM,CAAC,4BAA4B,CAAC;QAEzD,UAAU;QACV,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAC/C,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAC/C,wBAAwB,EAAE,MAAM,CAAC,mCAAmC,CAAC;QAErE,cAAc;QACd,aAAa,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAC5C,aAAa,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAE5C,iBAAiB;QACjB,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAElD,cAAc;QACd,iBAAiB,EAAE,OAAO,CAAC,yBAAyB,CAAC;QACrD,kBAAkB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACvD,kBAAkB,EAAE,OAAO,CAAC,2BAA2B,CAAC;QAExD,QAAQ;QACR,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,oBAAoB,EAAE,MAAM,CAAC,4BAA4B,CAAC;QAE1D,WAAW;QACX,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC;QAEjC,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACnC,aAAa,EAAE,MAAM,CAAC,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,MAAM,CAAC,0BAA0B,CAAC;QAEtD,MAAM;QACN,sBAAsB,EAAE,MAAM,CAAC,iCAAiC,CAAC;QACjE,SAAS;QACT,+BAA+B,EAAE,MAAM,CACrC,2CAA2C,CAC5C;QAED,kCAAkC;QAClC,qBAAqB,EAAE,OAAO,CAAC,6BAA6B,CAAC;QAE7D,QAAQ;QACR,oBAAoB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAE3D,QAAQ;QACR,eAAe,EAAE,OAAO,CAAC,uBAAuB,CAAC;QACjD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,oBAAoB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAC3D,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,qBAAqB,EAAE,OAAO,CAAC,6BAA6B,CAAC;QAE7D,qBAAqB;QACrB,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;KACzD,CAAA;AACH,CAAC","sourcesContent":["import { envBool, envInt, envList, envStr } from '@atproto/common'\n\nexport function readEnv() {\n  return {\n    // service\n    port: envInt('PDS_PORT'),\n    hostname: envStr('PDS_HOSTNAME'),\n    serviceDid: envStr('PDS_SERVICE_DID'),\n    serviceName: envStr('PDS_SERVICE_NAME'),\n    version: envStr('PDS_VERSION'),\n    homeUrl: envStr('PDS_HOME_URL'),\n    logoUrl: envStr('PDS_LOGO_URL'),\n    privacyPolicyUrl: envStr('PDS_PRIVACY_POLICY_URL'),\n    supportUrl: envStr('PDS_SUPPORT_URL'),\n    termsOfServiceUrl: envStr('PDS_TERMS_OF_SERVICE_URL'),\n    contactEmailAddress: envStr('PDS_CONTACT_EMAIL_ADDRESS'),\n    acceptingImports: envBool('PDS_ACCEPTING_REPO_IMPORTS'),\n    maxImportSize: envInt('PDS_MAX_REPO_IMPORT_SIZE'),\n    blobUploadLimit: envInt('PDS_BLOB_UPLOAD_LIMIT'),\n    devMode: envBool('PDS_DEV_MODE'),\n\n    // hCaptcha\n    hcaptchaSiteKey: envStr('PDS_HCAPTCHA_SITE_KEY'),\n    hcaptchaSecretKey: envStr('PDS_HCAPTCHA_SECRET_KEY'),\n    hcaptchaTokenSalt: envStr('PDS_HCAPTCHA_TOKEN_SALT'),\n\n    // OAuth\n    trustedOAuthClients: envList('PDS_OAUTH_TRUSTED_CLIENTS'),\n\n    // branding\n    primaryColor: envStr('PDS_PRIMARY_COLOR'),\n    errorColor: envStr('PDS_ERROR_COLOR'),\n    warningColor: envStr('PDS_WARNING_COLOR'),\n    infoColor: envStr('PDS_INFO_COLOR'),\n    successColor: envStr('PDS_SUCCESS_COLOR'),\n\n    backgroundLightUrl: envStr('PDS_BACKGROUND_LIGHT_URL'),\n    backgroundDarkUrl: envStr('PDS_BACKGROUND_DARK_URL'),\n\n    // database\n    dataDirectory: envStr('PDS_DATA_DIRECTORY'),\n    disableWalAutoCheckpoint: envBool('PDS_SQLITE_DISABLE_WAL_AUTO_CHECKPOINT'),\n    accountDbLocation: envStr('PDS_ACCOUNT_DB_LOCATION'),\n    sequencerDbLocation: envStr('PDS_SEQUENCER_DB_LOCATION'),\n    didCacheDbLocation: envStr('PDS_DID_CACHE_DB_LOCATION'),\n\n    // actor store\n    actorStoreDirectory: envStr('PDS_ACTOR_STORE_DIRECTORY'),\n    actorStoreCacheSize: envInt('PDS_ACTOR_STORE_CACHE_SIZE'),\n\n    // blobstore: one required\n    // s3\n    blobstoreS3Bucket: envStr('PDS_BLOBSTORE_S3_BUCKET'),\n    blobstoreS3Region: envStr('PDS_BLOBSTORE_S3_REGION'),\n    blobstoreS3Endpoint: envStr('PDS_BLOBSTORE_S3_ENDPOINT'),\n    blobstoreS3ForcePathStyle: envBool('PDS_BLOBSTORE_S3_FORCE_PATH_STYLE'),\n    blobstoreS3AccessKeyId: envStr('PDS_BLOBSTORE_S3_ACCESS_KEY_ID'),\n    blobstoreS3SecretAccessKey: envStr('PDS_BLOBSTORE_S3_SECRET_ACCESS_KEY'),\n    blobstoreS3UploadTimeoutMs: envInt('PDS_BLOBSTORE_S3_UPLOAD_TIMEOUT_MS'),\n    blobstoreS3RequestTimeoutMs: envInt('PDS_BLOBSTORE_S3_REQUEST_TIMEOUT_MS'),\n    // disk\n    blobstoreDiskLocation: envStr('PDS_BLOBSTORE_DISK_LOCATION'),\n    blobstoreDiskTmpLocation: envStr('PDS_BLOBSTORE_DISK_TMP_LOCATION'),\n\n    // identity\n    didPlcUrl: envStr('PDS_DID_PLC_URL'),\n    didCacheStaleTTL: envInt('PDS_DID_CACHE_STALE_TTL'),\n    didCacheMaxTTL: envInt('PDS_DID_CACHE_MAX_TTL'),\n    resolverTimeout: envInt('PDS_ID_RESOLVER_TIMEOUT'),\n    recoveryDidKey: envStr('PDS_RECOVERY_DID_KEY'),\n    serviceHandleDomains: envList('PDS_SERVICE_HANDLE_DOMAINS'), // public hostname by default\n    handleBackupNameservers: envList('PDS_HANDLE_BACKUP_NAMESERVERS'),\n    enableDidDocWithSession: envBool('PDS_ENABLE_DID_DOC_WITH_SESSION'),\n\n    // entryway\n    entrywayUrl: envStr('PDS_ENTRYWAY_URL'),\n    entrywayDid: envStr('PDS_ENTRYWAY_DID'),\n    entrywayJwtVerifyKeyK256PublicKeyHex: envStr(\n      'PDS_ENTRYWAY_JWT_VERIFY_KEY_K256_PUBLIC_KEY_HEX',\n    ),\n    entrywayPlcRotationKey: envStr('PDS_ENTRYWAY_PLC_ROTATION_KEY'),\n\n    // invites\n    inviteRequired: envBool('PDS_INVITE_REQUIRED'),\n    inviteInterval: envInt('PDS_INVITE_INTERVAL'),\n    inviteEpoch: envInt('PDS_INVITE_EPOCH'),\n\n    // email\n    emailSmtpUrl: envStr('PDS_EMAIL_SMTP_URL'),\n    emailFromAddress: envStr('PDS_EMAIL_FROM_ADDRESS'),\n    emailDisableConfirmationLink: envBool(\n      'PDS_EMAIL_DISABLE_CONFIRMATION_LINK',\n    ),\n    moderationEmailSmtpUrl: envStr('PDS_MODERATION_EMAIL_SMTP_URL'),\n    moderationEmailAddress: envStr('PDS_MODERATION_EMAIL_ADDRESS'),\n\n    // subscription\n    maxSubscriptionBuffer: envInt('PDS_MAX_SUBSCRIPTION_BUFFER'),\n    repoBackfillLimitMs: envInt('PDS_REPO_BACKFILL_LIMIT_MS'),\n\n    // appview\n    bskyAppViewUrl: envStr('PDS_BSKY_APP_VIEW_URL'),\n    bskyAppViewDid: envStr('PDS_BSKY_APP_VIEW_DID'),\n    bskyAppViewCdnUrlPattern: envStr('PDS_BSKY_APP_VIEW_CDN_URL_PATTERN'),\n\n    // mod service\n    modServiceUrl: envStr('PDS_MOD_SERVICE_URL'),\n    modServiceDid: envStr('PDS_MOD_SERVICE_DID'),\n\n    // report service\n    reportServiceUrl: envStr('PDS_REPORT_SERVICE_URL'),\n    reportServiceDid: envStr('PDS_REPORT_SERVICE_DID'),\n\n    // rate limits\n    rateLimitsEnabled: envBool('PDS_RATE_LIMITS_ENABLED'),\n    rateLimitBypassKey: envStr('PDS_RATE_LIMIT_BYPASS_KEY'),\n    rateLimitBypassIps: envList('PDS_RATE_LIMIT_BYPASS_IPS'),\n\n    // redis\n    redisScratchAddress: envStr('PDS_REDIS_SCRATCH_ADDRESS'),\n    redisScratchPassword: envStr('PDS_REDIS_SCRATCH_PASSWORD'),\n\n    // crawlers\n    crawlers: envList('PDS_CRAWLERS'),\n\n    // secrets\n    dpopSecret: envStr('PDS_DPOP_SECRET'),\n    jwtSecret: envStr('PDS_JWT_SECRET'),\n    adminPassword: envStr('PDS_ADMIN_PASSWORD'),\n    entrywayAdminToken: envStr('PDS_ENTRYWAY_ADMIN_TOKEN'),\n\n    // kms\n    plcRotationKeyKmsKeyId: envStr('PDS_PLC_ROTATION_KEY_KMS_KEY_ID'),\n    // memory\n    plcRotationKeyK256PrivateKeyHex: envStr(\n      'PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX',\n    ),\n\n    // user provided url http requests\n    disableSsrfProtection: envBool('PDS_DISABLE_SSRF_PROTECTION'),\n\n    // fetch\n    fetchMaxResponseSize: envInt('PDS_FETCH_MAX_RESPONSE_SIZE'),\n\n    // proxy\n    proxyAllowHTTP2: envBool('PDS_PROXY_ALLOW_HTTP2'),\n    proxyHeadersTimeout: envInt('PDS_PROXY_HEADERS_TIMEOUT'),\n    proxyBodyTimeout: envInt('PDS_PROXY_BODY_TIMEOUT'),\n    proxyMaxResponseSize: envInt('PDS_PROXY_MAX_RESPONSE_SIZE'),\n    proxyMaxRetries: envInt('PDS_PROXY_MAX_RETRIES'),\n    proxyPreferCompressed: envBool('PDS_PROXY_PREFER_COMPRESSED'),\n\n    // lexicon resolution\n    lexiconDidAuthority: envStr('PDS_LEXICON_AUTHORITY_DID'),\n  }\n}\n\nexport type ServerEnvironment = Partial<ReturnType<typeof readEnv>>\n"]}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAElE,MAAM,UAAU,OAAO;IACrB,OAAO;QACL,UAAU;QACV,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;QAChC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,iBAAiB,EAAE,MAAM,CAAC,0BAA0B,CAAC;QACrD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,gBAAgB,EAAE,OAAO,CAAC,4BAA4B,CAAC;QACvD,aAAa,EAAE,MAAM,CAAC,0BAA0B,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC;QAEhC,WAAW;QACX,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAEpD,QAAQ;QACR,mBAAmB,EAAE,OAAO,CAAC,2BAA2B,CAAC;QAEzD,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC;QACzC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC;QACzC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC;QAEzC,kBAAkB,EAAE,MAAM,CAAC,0BAA0B,CAAC;QACtD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAEpD,WAAW;QACX,aAAa,EAAE,MAAM,CAAC,oBAAoB,CAAC;QAC3C,wBAAwB,EAAE,OAAO,CAAC,wCAAwC,CAAC;QAC3E,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,kBAAkB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QAEvD,cAAc;QACd,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,mBAAmB,EAAE,MAAM,CAAC,4BAA4B,CAAC;QAEzD,0BAA0B;QAC1B,KAAK;QACL,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,iBAAiB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACpD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,yBAAyB,EAAE,OAAO,CAAC,mCAAmC,CAAC;QACvE,sBAAsB,EAAE,MAAM,CAAC,gCAAgC,CAAC;QAChE,0BAA0B,EAAE,MAAM,CAAC,oCAAoC,CAAC;QACxE,0BAA0B,EAAE,MAAM,CAAC,oCAAoC,CAAC;QACxE,2BAA2B,EAAE,MAAM,CAAC,qCAAqC,CAAC;QAC1E,OAAO;QACP,qBAAqB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAC5D,wBAAwB,EAAE,MAAM,CAAC,iCAAiC,CAAC;QAEnE,WAAW;QACX,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACpC,gBAAgB,EAAE,MAAM,CAAC,yBAAyB,CAAC;QACnD,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAC/C,eAAe,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAClD,cAAc,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC9C,oBAAoB,EAAE,OAAO,CAAC,4BAA4B,CAAC,EAAE,6BAA6B;QAC1F,uBAAuB,EAAE,OAAO,CAAC,+BAA+B,CAAC;QACjE,uBAAuB,EAAE,OAAO,CAAC,iCAAiC,CAAC;QAEnE,WAAW;QACX,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvC,cAAc,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAC9C,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QACvC,oCAAoC,EAAE,MAAM,CAC1C,iDAAiD,CAClD;QACD,sBAAsB,EAAE,MAAM,CAAC,+BAA+B,CAAC;QAC/D,0BAA0B,EAAE,OAAO,CAAC,mCAAmC,CAAC;QAExE,UAAU;QACV,cAAc,EAAE,OAAO,CAAC,qBAAqB,CAAC;QAC9C,cAAc,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAEvC,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,oBAAoB,CAAC;QAC1C,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,4BAA4B,EAAE,OAAO,CACnC,qCAAqC,CACtC;QACD,sBAAsB,EAAE,MAAM,CAAC,+BAA+B,CAAC;QAC/D,sBAAsB,EAAE,MAAM,CAAC,8BAA8B,CAAC;QAE9D,eAAe;QACf,qBAAqB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAC5D,mBAAmB,EAAE,MAAM,CAAC,4BAA4B,CAAC;QAEzD,UAAU;QACV,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAC/C,cAAc,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAC/C,wBAAwB,EAAE,MAAM,CAAC,mCAAmC,CAAC;QAErE,cAAc;QACd,aAAa,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAC5C,aAAa,EAAE,MAAM,CAAC,qBAAqB,CAAC;QAE5C,iBAAiB;QACjB,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAElD,cAAc;QACd,iBAAiB,EAAE,OAAO,CAAC,yBAAyB,CAAC;QACrD,kBAAkB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACvD,kBAAkB,EAAE,OAAO,CAAC,2BAA2B,CAAC;QAExD,QAAQ;QACR,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,oBAAoB,EAAE,MAAM,CAAC,4BAA4B,CAAC;QAE1D,WAAW;QACX,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC;QAEjC,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACnC,aAAa,EAAE,MAAM,CAAC,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,MAAM,CAAC,0BAA0B,CAAC;QAEtD,MAAM;QACN,sBAAsB,EAAE,MAAM,CAAC,iCAAiC,CAAC;QACjE,SAAS;QACT,+BAA+B,EAAE,MAAM,CACrC,2CAA2C,CAC5C;QAED,kCAAkC;QAClC,qBAAqB,EAAE,OAAO,CAAC,6BAA6B,CAAC;QAE7D,QAAQ;QACR,oBAAoB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAE3D,QAAQ;QACR,eAAe,EAAE,OAAO,CAAC,uBAAuB,CAAC;QACjD,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,wBAAwB,CAAC;QAClD,oBAAoB,EAAE,MAAM,CAAC,6BAA6B,CAAC;QAC3D,eAAe,EAAE,MAAM,CAAC,uBAAuB,CAAC;QAChD,qBAAqB,EAAE,OAAO,CAAC,6BAA6B,CAAC;QAE7D,qBAAqB;QACrB,mBAAmB,EAAE,MAAM,CAAC,2BAA2B,CAAC;KACzD,CAAA;AACH,CAAC","sourcesContent":["import { envBool, envInt, envList, envStr } from '@atproto/common'\n\nexport function readEnv() {\n  return {\n    // service\n    port: envInt('PDS_PORT'),\n    hostname: envStr('PDS_HOSTNAME'),\n    serviceDid: envStr('PDS_SERVICE_DID'),\n    serviceName: envStr('PDS_SERVICE_NAME'),\n    version: envStr('PDS_VERSION'),\n    homeUrl: envStr('PDS_HOME_URL'),\n    logoUrl: envStr('PDS_LOGO_URL'),\n    privacyPolicyUrl: envStr('PDS_PRIVACY_POLICY_URL'),\n    supportUrl: envStr('PDS_SUPPORT_URL'),\n    termsOfServiceUrl: envStr('PDS_TERMS_OF_SERVICE_URL'),\n    contactEmailAddress: envStr('PDS_CONTACT_EMAIL_ADDRESS'),\n    acceptingImports: envBool('PDS_ACCEPTING_REPO_IMPORTS'),\n    maxImportSize: envInt('PDS_MAX_REPO_IMPORT_SIZE'),\n    blobUploadLimit: envInt('PDS_BLOB_UPLOAD_LIMIT'),\n    devMode: envBool('PDS_DEV_MODE'),\n\n    // hCaptcha\n    hcaptchaSiteKey: envStr('PDS_HCAPTCHA_SITE_KEY'),\n    hcaptchaSecretKey: envStr('PDS_HCAPTCHA_SECRET_KEY'),\n    hcaptchaTokenSalt: envStr('PDS_HCAPTCHA_TOKEN_SALT'),\n\n    // OAuth\n    trustedOAuthClients: envList('PDS_OAUTH_TRUSTED_CLIENTS'),\n\n    // branding\n    primaryColor: envStr('PDS_PRIMARY_COLOR'),\n    errorColor: envStr('PDS_ERROR_COLOR'),\n    warningColor: envStr('PDS_WARNING_COLOR'),\n    infoColor: envStr('PDS_INFO_COLOR'),\n    successColor: envStr('PDS_SUCCESS_COLOR'),\n\n    backgroundLightUrl: envStr('PDS_BACKGROUND_LIGHT_URL'),\n    backgroundDarkUrl: envStr('PDS_BACKGROUND_DARK_URL'),\n\n    // database\n    dataDirectory: envStr('PDS_DATA_DIRECTORY'),\n    disableWalAutoCheckpoint: envBool('PDS_SQLITE_DISABLE_WAL_AUTO_CHECKPOINT'),\n    accountDbLocation: envStr('PDS_ACCOUNT_DB_LOCATION'),\n    sequencerDbLocation: envStr('PDS_SEQUENCER_DB_LOCATION'),\n    didCacheDbLocation: envStr('PDS_DID_CACHE_DB_LOCATION'),\n\n    // actor store\n    actorStoreDirectory: envStr('PDS_ACTOR_STORE_DIRECTORY'),\n    actorStoreCacheSize: envInt('PDS_ACTOR_STORE_CACHE_SIZE'),\n\n    // blobstore: one required\n    // s3\n    blobstoreS3Bucket: envStr('PDS_BLOBSTORE_S3_BUCKET'),\n    blobstoreS3Region: envStr('PDS_BLOBSTORE_S3_REGION'),\n    blobstoreS3Endpoint: envStr('PDS_BLOBSTORE_S3_ENDPOINT'),\n    blobstoreS3ForcePathStyle: envBool('PDS_BLOBSTORE_S3_FORCE_PATH_STYLE'),\n    blobstoreS3AccessKeyId: envStr('PDS_BLOBSTORE_S3_ACCESS_KEY_ID'),\n    blobstoreS3SecretAccessKey: envStr('PDS_BLOBSTORE_S3_SECRET_ACCESS_KEY'),\n    blobstoreS3UploadTimeoutMs: envInt('PDS_BLOBSTORE_S3_UPLOAD_TIMEOUT_MS'),\n    blobstoreS3RequestTimeoutMs: envInt('PDS_BLOBSTORE_S3_REQUEST_TIMEOUT_MS'),\n    // disk\n    blobstoreDiskLocation: envStr('PDS_BLOBSTORE_DISK_LOCATION'),\n    blobstoreDiskTmpLocation: envStr('PDS_BLOBSTORE_DISK_TMP_LOCATION'),\n\n    // identity\n    didPlcUrl: envStr('PDS_DID_PLC_URL'),\n    didCacheStaleTTL: envInt('PDS_DID_CACHE_STALE_TTL'),\n    didCacheMaxTTL: envInt('PDS_DID_CACHE_MAX_TTL'),\n    resolverTimeout: envInt('PDS_ID_RESOLVER_TIMEOUT'),\n    recoveryDidKey: envStr('PDS_RECOVERY_DID_KEY'),\n    serviceHandleDomains: envList('PDS_SERVICE_HANDLE_DOMAINS'), // public hostname by default\n    handleBackupNameservers: envList('PDS_HANDLE_BACKUP_NAMESERVERS'),\n    enableDidDocWithSession: envBool('PDS_ENABLE_DID_DOC_WITH_SESSION'),\n\n    // entryway\n    entrywayUrl: envStr('PDS_ENTRYWAY_URL'),\n    entrywayApiUrl: envStr('PDS_ENTRYWAY_API_URL'),\n    entrywayDid: envStr('PDS_ENTRYWAY_DID'),\n    entrywayJwtVerifyKeyK256PublicKeyHex: envStr(\n      'PDS_ENTRYWAY_JWT_VERIFY_KEY_K256_PUBLIC_KEY_HEX',\n    ),\n    entrywayPlcRotationKey: envStr('PDS_ENTRYWAY_PLC_ROTATION_KEY'),\n    entrywayRequireServiceAuth: envBool('PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH'),\n\n    // invites\n    inviteRequired: envBool('PDS_INVITE_REQUIRED'),\n    inviteInterval: envInt('PDS_INVITE_INTERVAL'),\n    inviteEpoch: envInt('PDS_INVITE_EPOCH'),\n\n    // email\n    emailSmtpUrl: envStr('PDS_EMAIL_SMTP_URL'),\n    emailFromAddress: envStr('PDS_EMAIL_FROM_ADDRESS'),\n    emailDisableConfirmationLink: envBool(\n      'PDS_EMAIL_DISABLE_CONFIRMATION_LINK',\n    ),\n    moderationEmailSmtpUrl: envStr('PDS_MODERATION_EMAIL_SMTP_URL'),\n    moderationEmailAddress: envStr('PDS_MODERATION_EMAIL_ADDRESS'),\n\n    // subscription\n    maxSubscriptionBuffer: envInt('PDS_MAX_SUBSCRIPTION_BUFFER'),\n    repoBackfillLimitMs: envInt('PDS_REPO_BACKFILL_LIMIT_MS'),\n\n    // appview\n    bskyAppViewUrl: envStr('PDS_BSKY_APP_VIEW_URL'),\n    bskyAppViewDid: envStr('PDS_BSKY_APP_VIEW_DID'),\n    bskyAppViewCdnUrlPattern: envStr('PDS_BSKY_APP_VIEW_CDN_URL_PATTERN'),\n\n    // mod service\n    modServiceUrl: envStr('PDS_MOD_SERVICE_URL'),\n    modServiceDid: envStr('PDS_MOD_SERVICE_DID'),\n\n    // report service\n    reportServiceUrl: envStr('PDS_REPORT_SERVICE_URL'),\n    reportServiceDid: envStr('PDS_REPORT_SERVICE_DID'),\n\n    // rate limits\n    rateLimitsEnabled: envBool('PDS_RATE_LIMITS_ENABLED'),\n    rateLimitBypassKey: envStr('PDS_RATE_LIMIT_BYPASS_KEY'),\n    rateLimitBypassIps: envList('PDS_RATE_LIMIT_BYPASS_IPS'),\n\n    // redis\n    redisScratchAddress: envStr('PDS_REDIS_SCRATCH_ADDRESS'),\n    redisScratchPassword: envStr('PDS_REDIS_SCRATCH_PASSWORD'),\n\n    // crawlers\n    crawlers: envList('PDS_CRAWLERS'),\n\n    // secrets\n    dpopSecret: envStr('PDS_DPOP_SECRET'),\n    jwtSecret: envStr('PDS_JWT_SECRET'),\n    adminPassword: envStr('PDS_ADMIN_PASSWORD'),\n    entrywayAdminToken: envStr('PDS_ENTRYWAY_ADMIN_TOKEN'),\n\n    // kms\n    plcRotationKeyKmsKeyId: envStr('PDS_PLC_ROTATION_KEY_KMS_KEY_ID'),\n    // memory\n    plcRotationKeyK256PrivateKeyHex: envStr(\n      'PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX',\n    ),\n\n    // user provided url http requests\n    disableSsrfProtection: envBool('PDS_DISABLE_SSRF_PROTECTION'),\n\n    // fetch\n    fetchMaxResponseSize: envInt('PDS_FETCH_MAX_RESPONSE_SIZE'),\n\n    // proxy\n    proxyAllowHTTP2: envBool('PDS_PROXY_ALLOW_HTTP2'),\n    proxyHeadersTimeout: envInt('PDS_PROXY_HEADERS_TIMEOUT'),\n    proxyBodyTimeout: envInt('PDS_PROXY_BODY_TIMEOUT'),\n    proxyMaxResponseSize: envInt('PDS_PROXY_MAX_RESPONSE_SIZE'),\n    proxyMaxRetries: envInt('PDS_PROXY_MAX_RETRIES'),\n    proxyPreferCompressed: envBool('PDS_PROXY_PREFER_COMPRESSED'),\n\n    // lexicon resolution\n    lexiconDidAuthority: envStr('PDS_LEXICON_AUTHORITY_DID'),\n  }\n}\n\nexport type ServerEnvironment = Partial<ReturnType<typeof readEnv>>\n"]}

package/dist/context.d.ts

@@ -4,7 +4,7 @@ import type { Redis } from 'ioredis';
 import type * as undici from 'undici';
 import * as crypto from '@atproto/crypto';
 import { IdResolver } from '@atproto/identity';
-import { Client } from '@atproto/lex';
+import { Client } from '@atproto/lex-client';
 import { OAuthProvider } from '@atproto/oauth-provider/provider';
 import type { BlobStoreCreator } from '@atproto/repo';
 import { type Fetch } from '@atproto-labs/fetch-node';

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAGpC,OAAO,KAAK,KAAK,MAAM,MAAM,QAAQ,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAKL,aAAa,EACd,MAAM,kCAAkC,CAAA;AAEzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAKrD,OAAO,EAAE,KAAK,KAAK,EAAiB,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAGrE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAEzD,OAAO,EACL,YAAY,EAGb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAInB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAKrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,gBAAgB,CAAA;IAC3B,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,YAAY,EAAE,YAAY,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;CAClB,CAAA;AAED,qBAAa,UAAW,YAAW,eAAe;IACzC,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,gBAAgB,CAAA;IAC3B,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,YAAY,EAAE,YAAY,CAAA;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;IAExB,YAAY,IAAI,EAAE,iBAAiB,EAyBlC;IAED,OAAa,OAAO,CAClB,GAAG,GAAE,iBAA6B,EAClC,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAIrB;IAED,OAAa,UAAU,CACrB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAmdrB;IAEK,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;OAGhD;IAEK,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;OAQvE;IAED,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO;;MAE3C;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CASxC;IAEK,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;OAQ7D;IAEK,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,mBAQzD;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAwB7B;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;CACF;eAUc,UAAU"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAClC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAGpC,OAAO,KAAK,KAAK,MAAM,MAAM,QAAQ,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,OAAO,EAKL,aAAa,EACd,MAAM,kCAAkC,CAAA;AAEzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAKrD,OAAO,EAAE,KAAK,KAAK,EAAiB,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAGrE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAEzD,OAAO,EACL,YAAY,EAGb,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAInB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAKrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,gBAAgB,CAAA;IAC3B,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,YAAY,EAAE,YAAY,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;CAClB,CAAA;AAED,qBAAa,UAAW,YAAW,eAAe;IACzC,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,gBAAgB,CAAA;IAC3B,WAAW,EAAE,kBAAkB,CAAA;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAA;IACrB,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,eAAe,EAAE,eAAe,CAAA;IAChC,YAAY,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAA;IAC7B,SAAS,EAAE,KAAK,CAAA;IAChB,YAAY,EAAE,YAAY,CAAA;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAC,OAAO,CAAA;IAC9B,GAAG,EAAE,YAAY,CAAA;IAExB,YAAY,IAAI,EAAE,iBAAiB,EAyBlC;IAED,OAAa,OAAO,CAClB,GAAG,GAAE,iBAA6B,EAClC,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAIrB;IAED,OAAa,UAAU,CACrB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CA4drB;IAEK,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;OAGhD;IAEK,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;OAQvE;IAED,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO;;MAE3C;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CASxC;IAEK,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;OAQ7D;IAEK,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,mBAQzD;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAwB7B;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;CACF;eAUc,UAAU"}

package/dist/context.js

@@ -5,7 +5,7 @@ import * as ui8 from 'uint8arrays';
 import { KmsKeypair, S3BlobStore } from '@atproto/aws';
 import * as crypto from '@atproto/crypto';
 import { IdResolver } from '@atproto/identity';
-import { Client } from '@atproto/lex';
+import { Client } from '@atproto/lex-client';
 import { parseCid } from '@atproto/lex-data';
 import { AccessTokenMode, JoseKey, LexResolver, LexResolverError, OAuthProvider, } from '@atproto/oauth-provider/provider';
 import { OAuthVerifier } from '@atproto/oauth-provider/verifier';
@@ -144,7 +144,7 @@ export class AppContext {
             })
             : undefined;
         const entrywayClient = cfg.entryway
-            ? new Client({ service: cfg.entryway.url }, {
+            ? new Client({ service: cfg.entryway.apiUrl }, {
                 // Trust internal services to send us well-formed responses
                 strictResponseProcessing: false,
                 validateResponse: cfg.service.devMode,
@@ -152,7 +152,7 @@ export class AppContext {
             : undefined;
         const entrywayAdminClient = cfg.entryway && secrets.entrywayAdminToken
             ? new Client({
-                service: cfg.entryway.url,
+                service: cfg.entryway.apiUrl,
                 headers: {
                     authorization: basicAuthHeader('admin', secrets.entrywayAdminToken),
                 },
@@ -368,6 +368,12 @@ export class AppContext {
                 entryway: cfg.entryway?.did,
                 modService: cfg.modService?.did,
             },
+            entrywayServiceAuth: cfg.entryway
+                ? {
+                    didKey: crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, ui8.fromString(cfg.entryway.jwtPublicKeyHex, 'hex')),
+                    required: cfg.entryway.requireServiceAuth,
+                }
+                : undefined,
         });
         return new AppContext({
             actorStore,

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAGnC,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EACL,eAAe,EACf,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,aAAa,GACd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAEhE,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAc,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAIL,QAAQ,EACR,YAAY,EACZ,OAAO,GACR,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EACL,WAAW,GAEZ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AA6BhD,MAAM,OAAO,UAAU;IA0BrB,YAAY,IAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,GAAG,GAAsB,OAAO,EAAE,EAClC,SAAsC;QAEtC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACjC,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,GAAiB,EACjB,OAAsB,EACtB,SAAsC;QAEtC,gDAAgD;QAEhD,MAAM,SAAS,GACb,SAAS,EAAE,SAAS;YACpB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI;gBAC9B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;oBAC5B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;oBAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;oBAChC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;oBAC5C,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW;oBACtC,eAAe,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe;oBAC9C,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,gBAAgB;iBACjD,CAAC;gBACJ,CAAC,CAAC,aAAa,CAAC,OAAO,CACnB,GAAG,CAAC,SAAS,CAAC,QAAQ,EACtB,GAAG,CAAC,SAAS,CAAC,YAAY,CAC3B,CAAC,CAAA;QAER,MAAM,aAAa,GACjB,GAAG,CAAC,KAAK,KAAK,IAAI;YAChB,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,MAAM,GAAG,IAAI,YAAY,CAC7B,aAAa,EACb,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,KAAK,CAAC,MAAM,CACjB,CAAA;QAED,MAAM,gBAAgB,GACpB,GAAG,CAAC,eAAe,KAAK,IAAI;YAC1B,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QAEpE;;;;;;;;WAQG;QACH,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,WAAW,EAAE,KAAK;YAClB,qBAAqB,EAAE,KAAK;YAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB;YAEhD,KAAK,EAAE,UAAU,KAAK,EAAE,IAAI;gBAC1B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACnE,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAEhE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;gBAE1C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,GAAG,CAAC,EAAE,CAAC,aAAa,EACpB,GAAG,CAAC,QAAQ,CAAC,aAAa,EAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,EACxB,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;QAE/B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;YAChC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YAC3B,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe;YACrC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,uBAAuB;YACvD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAErD,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,eAAe,EACf,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,GAAG,CAAC,QAAQ,CACb,CAAA;QACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAC7B,GAAG,CAAC,EAAE,CAAC,cAAc,EACrB,QAAQ,EACR,SAAS,EACT,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK;YAC5B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW;YACjC,CAAC,CAAC,IAAI,WAAW,CAAC;gBACd,GAAG,GAAG,CAAC,WAAW;gBAClB,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU;YACrC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAC/B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa;YACvC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,EAClC;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ;YACjC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,EAC7B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,mBAAmB,GACvB,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB;YACxC,CAAC,CAAC,IAAI,MAAM,CACR;gBACE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE;oBACP,aAAa,EAAE,eAAe,CAC5B,OAAO,EACP,OAAO,CAAC,kBAAkB,CAC3B;iBACF;aACF,EACD;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ;YAC/B,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,WAAW,CACZ,CAAA;QAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YAChD,SAAS;YACT,eAAe;SAChB,CAAC,CAAA;QAEF,MAAM,cAAc,GAClB,SAAS,EAAE,cAAc;YACzB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,KAAK,KAAK;gBACzC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK;iBACpC,CAAC;gBACJ,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,KAAK,QAAQ;oBAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAClC,OAAO,CAAC,cAAc,CAAC,aAAa,CACrC;oBACH,CAAC,CAAC,SAAS,CAAC,CAAA;QAElB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,GAAG,EACH,UAAU,EACV,UAAU,EACV,YAAY,EACZ,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,CACf,CAAA;QACD,MAAM,cAAc,CAAC,cAAc,EAAE,CAAA;QAErC,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;YAClC,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS,EAAE,kCAAkC;YACvD,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YACpC,KAAK,EAAE;gBACL,+DAA+D;gBAC/D,iEAAiE;gBACjE,wDAAwD;gBACxD,4DAA4D;gBAC5D,kCAAkC;gBAClC,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;oBAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;wBACnD,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,IAAI;qBACvB,CAAC,CAAA;oBAEF,MAAM,EAAE,cAAc,EAAE,CAAA;oBAExB,4DAA4D;oBAC5D,4BAA4B;oBAC5B,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;wBACzB,MAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,0BAA0B,GAAG,EAAE,CAAC,CAAA;oBACnE,CAAC;oBAED,uDAAuD;oBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa;wBAAE,OAAO,SAAS,CAAA;oBAEvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;wBAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;oBAC1C,CAAC,CAAC,CAAA;oBAEF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;wBAC1C,MAAM,IAAI,gBAAgB,CACxB,IAAI,EACJ,+BAA+B,GAAG,EAAE,CACrC,CAAA;oBACH,CAAC;oBAED,OAAO;wBACL,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzB,MAAM,EAAE,MAAM,CAAC,KAAK;qBACrB,CAAA;gBACH,CAAC;gBACD,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;oBAChC,qBAAqB,CAAC,IAAI,CACxB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,EACpD,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBACD,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;oBACvB,qBAAqB,CAAC,KAAK,CACzB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC5B,qBAAqB,CACtB,CAAA;gBACH,CAAC;gBACD,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC/B,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EACzB,iCAAiC,CAClC,CAAA;oBACD,+DAA+D;oBAC/D,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAA;gBACjC,CAAC;gBACD,wBAAwB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;oBAC5C,qBAAqB,CAAC,IAAI,CACxB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EACtC,sBAAsB,CACvB,CAAA;gBACH,CAAC;gBACD,uBAAuB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;oBACnC,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC9B,8BAA8B,CAC/B,CAAA;gBACH,CAAC;aACF;SACF,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CACrC,cAAc,EACd,eAAe,EACf,WAAW,CACZ,CAAA;QAED,qEAAqE;QACrE,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE7C,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ;YACtC,CAAC,CAAC,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACrE,KAAK,EAAE,IAAI,UAAU,CACnB,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAC5B;gBACD,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;gBACxC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,oBAAoB;gBACvD,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,iEAAiE;gBACjE,0DAA0D;gBAC1D,kEAAkE;gBAClE,sEAAsE;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,oBAAoB;gBACpB,2BAA2B,EAAE,IAAI;gBACjC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;gBAC9B,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBACpC,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,uBAAuB;gBACzD,WAAW,EAAE,SAAS,EAAE,SAAS;gBACjC,QAAQ,EAAE;oBACR,gDAAgD;oBAChD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;wBACjB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;wBAC1C,8DAA8D;wBAC9D,gEAAgE;wBAChE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,GAAW,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC3D,CAAC;oBACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBACtB,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAU,CAAC,CAAA;oBAC1C,CAAC;oBACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;wBACjB,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;oBAChC,CAAC;iBACF;gBACD,SAAS;gBACT,WAAW;gBACX,QAAQ,EAAE;oBACR,mBAAmB,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;iBACxD;gBACD,mEAAmE;gBACnE,gEAAgE;gBAChE,kEAAkE;gBAClE,oEAAoE;gBACpE,0DAA0D;gBAC1D,eAAe,EAAE,eAAe,CAAC,QAAQ;gBAEzC,aAAa,CAAC,QAAQ;oBACpB,OAAO;wBACL,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC;qBAClE,CAAA;gBACH,CAAC;gBACD,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACpC,MAAM,CAAC,cAAc,CAAC;wBACpB,MAAM,EAAE,OAAO;wBACf,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ;wBACR,OAAO,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;wBAChC,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAA;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;oBAC9B,MAAM,CAAC,QAAQ,CAAC;wBACd,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ;qBACT,CAAC,CAAA;gBACJ,CAAC;gBACD,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAC9B,MAAM,CAAC,eAAe,CAAC;wBACrB,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,gBAAgB,EAAE,MAAM,CAAC,YAAY;wBACrC,aAAa,EAAE,MAAM,CAAC,SAAS;wBAC/B,kBAAkB,EAAE,MAAM,CAAC,cAAc;qBAC1C,CAAC,CAAA;gBACJ,CAAC;gBACD,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAChC,MAAM,CAAC,cAAc,CAAC;wBACpB,MAAM,EAAE,OAAO;wBACf,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ,EAAE,MAAM,CAAC,EAAE;qBACpB,CAAC,CAAA;gBACJ,CAAC;gBACD,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAClC,MAAM,CAAC,gBAAgB,CAAC;wBACtB,MAAM,EAAE,OAAO;wBACf,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ,EAAE,MAAM,CAAC,EAAE;qBACpB,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,aAAa,GACjB,aAAa,IAAI,sCAAsC;YACvD,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACvE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;oBAC9C,wEAAwE;oBACxE,oCAAoC;oBACpC,IAAI,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjC,WAAW,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EACpD,6CAA6C,CAC9C,CAAA;oBACH,CAAC;oBAED,IAAI,cAAc,EAAE,CAAC;wBACnB,OAAO,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;oBACjE,CAAC;oBAED,OAAO,OAAO,CAAA;gBAChB,CAAC;aACF,CAAC,CAAA;QAEJ,MAAM,YAAY,GAAG,IAAI,YAAY,CACnC,cAAc,EACd,UAAU,EACV,aAAa,EACb;YACE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,YAAY,IAAI,YAAY;YACpC,SAAS,EAAE,OAAO,CAAC,aAAa;YAChC,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG;gBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG;aAChC;SACF,CACF,CAAA;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,UAAU;YACV,SAAS;YACT,WAAW;YACX,MAAM;YACN,gBAAgB;YAChB,QAAQ;YACR,UAAU;YACV,SAAS;YACT,cAAc;YACd,SAAS;YACT,eAAe;YACf,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,eAAe;YACf,cAAc;YACd,mBAAmB;YACnB,UAAU;YACV,SAAS;YACT,YAAY;YACZ,aAAa;YACb,cAAc;YACd,GAAG;YACH,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW;QAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAoB,EAAE,GAAW,EAAE,GAAW;QACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC3C,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CACJ,CAAA;QACD,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,uBAAuB,CAAC,GAAoB;QAC1C,OAAO,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,OAAqB;QAC9B,OAAO,IAAI,MAAM,CACf,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,EAClC;YACE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;YACzC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;YAC1C,wBAAwB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;SACnD,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,wBAAwB,CAAC;YAC9B,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,qEAAqE;QACrE,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAA;QACtC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;YAChC,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;gBACnC,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAA;oBACjC,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC;4BACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;wBACjC,CAAC;gCAAS,CAAC;4BACT,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAA;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAC1B,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,EACjD,WAAW,CACZ,CAAA;IACD,OAAO,SAAS,OAAO,EAAE,CAAA;AAC3B,CAAC,CAAA;AAED,eAAe,UAAU,CAAA","sourcesContent":["import assert from 'node:assert'\nimport * as plc from '@did-plc/lib'\nimport type express from 'express'\nimport type { Redis } from 'ioredis'\nimport * as nodemailer from 'nodemailer'\nimport * as ui8 from 'uint8arrays'\nimport type * as undici from 'undici'\nimport { KmsKeypair, S3BlobStore } from '@atproto/aws'\nimport * as crypto from '@atproto/crypto'\nimport { IdResolver } from '@atproto/identity'\nimport { Client } from '@atproto/lex'\nimport { parseCid } from '@atproto/lex-data'\nimport {\n  AccessTokenMode,\n  JoseKey,\n  LexResolver,\n  LexResolverError,\n  OAuthProvider,\n} from '@atproto/oauth-provider/provider'\nimport { OAuthVerifier } from '@atproto/oauth-provider/verifier'\nimport type { BlobStoreCreator } from '@atproto/repo'\nimport {\n  createServiceAuthHeaders,\n  createServiceJwt,\n} from '@atproto/xrpc-server'\nimport { type Fetch, safeFetchWrap } from '@atproto-labs/fetch-node'\nimport { AccountManager } from './account-manager/account-manager.js'\nimport { OAuthStore } from './account-manager/oauth-store.js'\nimport { ScopeReferenceGetter } from './account-manager/scope-reference-getter.js'\nimport { ActorStore } from './actor-store/actor-store.js'\nimport { authPassthru, forwardedFor } from './api/proxy.js'\nimport {\n  AuthVerifier,\n  createPublicKeyObject,\n  createSecretKeyObject,\n} from './auth-verifier.js'\nimport { BackgroundQueue } from './background.js'\nimport { BskyAppView } from './bsky-app-view.js'\nimport {\n  type ServerConfig,\n  type ServerEnvironment,\n  type ServerSecrets,\n  envToCfg,\n  envToSecrets,\n  readEnv,\n} from './config/index.js'\nimport { Crawlers } from './crawlers.js'\nimport { DidSqliteCache } from './did-cache/index.js'\nimport { DiskBlobStore } from './disk-blobstore.js'\nimport { events } from './events.js'\nimport { ImageUrlBuilder } from './image/image-url-builder.js'\nimport { fetchLogger, lexiconResolverLogger, oauthLogger } from './logger.js'\nimport { ServerMailer } from './mailer/index.js'\nimport { ModerationMailer } from './mailer/moderation.js'\nimport { buildProxyAgent } from './pipethrough.js'\nimport {\n  LocalViewer,\n  type LocalViewerCreator,\n} from './read-after-write/viewer.js'\nimport { getRedisClient } from './redis.js'\nimport { Sequencer } from './sequencer/index.js'\n\nexport type AppContextOptions = {\n  actorStore: ActorStore\n  blobstore: BlobStoreCreator\n  localViewer: LocalViewerCreator\n  mailer: ServerMailer\n  moderationMailer: ModerationMailer\n  didCache: DidSqliteCache\n  idResolver: IdResolver\n  plcClient: plc.Client\n  accountManager: AccountManager\n  sequencer: Sequencer\n  backgroundQueue: BackgroundQueue\n  redisScratch?: Redis\n  crawlers: Crawlers\n  bskyAppView?: BskyAppView\n  moderationClient?: Client\n  reportingClient?: Client\n  entrywayClient?: Client\n  entrywayAdminClient?: Client\n  proxyAgent: undici.Dispatcher\n  safeFetch: Fetch\n  oauthProvider?: OAuthProvider\n  authVerifier: AuthVerifier\n  plcRotationKey: crypto.Keypair\n  cfg: ServerConfig\n}\n\nexport class AppContext implements AsyncDisposable {\n  public actorStore: ActorStore\n  public blobstore: BlobStoreCreator\n  public localViewer: LocalViewerCreator\n  public mailer: ServerMailer\n  public moderationMailer: ModerationMailer\n  public didCache: DidSqliteCache\n  public idResolver: IdResolver\n  public plcClient: plc.Client\n  public accountManager: AccountManager\n  public sequencer: Sequencer\n  public backgroundQueue: BackgroundQueue\n  public redisScratch?: Redis\n  public crawlers: Crawlers\n  public bskyAppView?: BskyAppView\n  public moderationClient: Client | undefined\n  public reportingClient: Client | undefined\n  public entrywayClient: Client | undefined\n  public entrywayAdminClient: Client | undefined\n  public proxyAgent: undici.Dispatcher\n  public safeFetch: Fetch\n  public authVerifier: AuthVerifier\n  public oauthProvider?: OAuthProvider\n  public plcRotationKey: crypto.Keypair\n  public cfg: ServerConfig\n\n  constructor(opts: AppContextOptions) {\n    this.actorStore = opts.actorStore\n    this.blobstore = opts.blobstore\n    this.localViewer = opts.localViewer\n    this.mailer = opts.mailer\n    this.moderationMailer = opts.moderationMailer\n    this.didCache = opts.didCache\n    this.idResolver = opts.idResolver\n    this.plcClient = opts.plcClient\n    this.accountManager = opts.accountManager\n    this.sequencer = opts.sequencer\n    this.backgroundQueue = opts.backgroundQueue\n    this.redisScratch = opts.redisScratch\n    this.crawlers = opts.crawlers\n    this.bskyAppView = opts.bskyAppView\n    this.moderationClient = opts.moderationClient\n    this.reportingClient = opts.reportingClient\n    this.entrywayClient = opts.entrywayClient\n    this.entrywayAdminClient = opts.entrywayAdminClient\n    this.proxyAgent = opts.proxyAgent\n    this.safeFetch = opts.safeFetch\n    this.authVerifier = opts.authVerifier\n    this.oauthProvider = opts.oauthProvider\n    this.plcRotationKey = opts.plcRotationKey\n    this.cfg = opts.cfg\n  }\n\n  static async fromEnv(\n    env: ServerEnvironment = readEnv(),\n    overrides?: Partial<AppContextOptions>,\n  ): Promise<AppContext> {\n    const cfg = envToCfg(env)\n    const secrets = envToSecrets(env)\n    return AppContext.fromConfig(cfg, secrets, overrides)\n  }\n\n  static async fromConfig(\n    cfg: ServerConfig,\n    secrets: ServerSecrets,\n    overrides?: Partial<AppContextOptions>,\n  ): Promise<AppContext> {\n    // @TODO Implement using an AsyncDisposableStack\n\n    const blobstore: BlobStoreCreator =\n      overrides?.blobstore ??\n      (cfg.blobstore.provider === 's3'\n        ? S3BlobStore.creator({\n            bucket: cfg.blobstore.bucket,\n            region: cfg.blobstore.region,\n            endpoint: cfg.blobstore.endpoint,\n            forcePathStyle: cfg.blobstore.forcePathStyle,\n            credentials: cfg.blobstore.credentials,\n            uploadTimeoutMs: cfg.blobstore.uploadTimeoutMs,\n            requestTimeoutMs: cfg.blobstore.requestTimeoutMs,\n          })\n        : DiskBlobStore.creator(\n            cfg.blobstore.location,\n            cfg.blobstore.tempLocation,\n          ))\n\n    const mailTransport =\n      cfg.email !== null\n        ? nodemailer.createTransport(cfg.email.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const mailer = new ServerMailer(\n      mailTransport,\n      cfg.email,\n      cfg.branding,\n      cfg.oauth.issuer,\n    )\n\n    const modMailTransport =\n      cfg.moderationEmail !== null\n        ? nodemailer.createTransport(cfg.moderationEmail.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const moderationMailer = new ModerationMailer(modMailTransport, cfg)\n\n    /**\n     * A fetch() function that protects against SSRF attacks, large responses &\n     * known bad domains. This function can safely be used to fetch user\n     * provided URLs (unless \"disableSsrfProtection\" is true, of course).\n     *\n     * @note **DO NOT** wrap `safeFetch` with any logging or other transforms as\n     * this might prevent the use of explicit `redirect: \"follow\"` init from\n     * working. See {@link safeFetchWrap}.\n     */\n    const safeFetch = safeFetchWrap({\n      allowIpHost: false,\n      allowImplicitRedirect: false,\n      responseMaxSize: cfg.fetch.maxResponseSize,\n      ssrfProtection: !cfg.fetch.disableSsrfProtection,\n\n      fetch: function (input, init) {\n        const method =\n          init?.method ?? (input instanceof Request ? input.method : 'GET')\n        const uri = input instanceof Request ? input.url : String(input)\n\n        fetchLogger.info({ method, uri }, 'fetch')\n\n        return globalThis.fetch.call(this, input, init)\n      },\n    })\n\n    const didCache = new DidSqliteCache(\n      cfg.db.didCacheDbLoc,\n      cfg.identity.cacheStaleTTL,\n      cfg.identity.cacheMaxTTL,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    await didCache.migrateOrThrow()\n\n    const idResolver = new IdResolver({\n      plcUrl: cfg.identity.plcUrl,\n      didCache,\n      timeout: cfg.identity.resolverTimeout,\n      backupNameservers: cfg.identity.handleBackupNameservers,\n      fetch: safeFetch,\n    })\n    const plcClient = new plc.Client(cfg.identity.plcUrl)\n\n    const backgroundQueue = new BackgroundQueue(undefined, { concurrency: 5 })\n    const crawlers = new Crawlers(\n      backgroundQueue,\n      cfg.service.hostname,\n      cfg.crawlers,\n    )\n    const sequencer = new Sequencer(\n      cfg.db.sequencerDbLoc,\n      crawlers,\n      undefined,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    const redisScratch = cfg.redis\n      ? getRedisClient(cfg.redis.address, cfg.redis.password)\n      : undefined\n\n    const bskyAppView = cfg.bskyAppView\n      ? new BskyAppView({\n          ...cfg.bskyAppView,\n          validateResponse: cfg.service.devMode,\n        })\n      : undefined\n\n    const moderationClient = cfg.modService\n      ? new Client(\n          { service: cfg.modService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const reportingClient = cfg.reportService\n      ? new Client(\n          { service: cfg.reportService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayClient = cfg.entryway\n      ? new Client(\n          { service: cfg.entryway.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayAdminClient =\n      cfg.entryway && secrets.entrywayAdminToken\n        ? new Client(\n            {\n              service: cfg.entryway.url,\n              headers: {\n                authorization: basicAuthHeader(\n                  'admin',\n                  secrets.entrywayAdminToken,\n                ),\n              },\n            },\n            {\n              // Trust internal services to send us well-formed responses\n              strictResponseProcessing: false,\n              validateResponse: cfg.service.devMode,\n            },\n          )\n        : undefined\n\n    const jwtSecretKey = createSecretKeyObject(secrets.jwtSecret)\n    const jwtPublicKey = cfg.entryway\n      ? createPublicKeyObject(cfg.entryway.jwtPublicKeyHex)\n      : null\n\n    const imageUrlBuilder = new ImageUrlBuilder(\n      cfg.service.hostname,\n      bskyAppView,\n    )\n\n    const actorStore = new ActorStore(cfg.actorStore, {\n      blobstore,\n      backgroundQueue,\n    })\n\n    const plcRotationKey =\n      overrides?.plcRotationKey ??\n      (secrets.plcRotationKey?.provider === 'kms'\n        ? await KmsKeypair.load({\n            keyId: secrets.plcRotationKey.keyId,\n          })\n        : secrets.plcRotationKey?.provider === 'memory'\n          ? await crypto.Secp256k1Keypair.import(\n              secrets.plcRotationKey.privateKeyHex,\n            )\n          : undefined)\n\n    if (!plcRotationKey) {\n      throw new Error('Must configure plc rotation key')\n    }\n\n    const accountManager = new AccountManager(\n      cfg,\n      actorStore,\n      idResolver,\n      jwtSecretKey,\n      mailer,\n      sequencer,\n      plcClient,\n      plcRotationKey,\n    )\n    await accountManager.migrateOrThrow()\n\n    // @TODO Use this lexResolver instance to implement validation of records\n    // created with the \"validate\" option. Before doing so, ensure that 1) a\n    // didCache is provided, and 2) that nsid->lexicon are cached.\n    const lexResolver = new LexResolver({\n      fetch: safeFetch,\n      didCache: undefined, // @TODO provide a dedicated cache\n      plcDirectoryUrl: cfg.identity.plcUrl,\n      hooks: {\n        // @NOTE Lexicons hosted by this PDS are read straight from the\n        // actor store. Fetching them over the network would require this\n        // server to reach its own public endpoint, which is not\n        // guaranteed to work (SSRF protection, missing NAT hairpin,\n        // internal reverse proxies, ...).\n        onFetch: async ({ uri, did, nsid, signal }) => {\n          const account = await accountManager.getAccount(did, {\n            includeDeactivated: true,\n            includeTakenDown: true,\n          })\n\n          signal?.throwIfAborted()\n\n          // Mirror what com.atproto.sync.getRecord would answer to an\n          // unauthenticated requester\n          if (account?.takedownRef) {\n            throw new LexResolverError(nsid, `Repo is not available: ${did}`)\n          }\n\n          // Not hosted here: fall back to the network resolution\n          if (!account || account.deactivatedAt) return undefined\n\n          const record = await actorStore.read(account.did, (store) => {\n            return store.record.getRecord(uri, null)\n          })\n\n          if (!record || record.takedownRef != null) {\n            throw new LexResolverError(\n              nsid,\n              `Lexicon record not found at ${uri}`,\n            )\n          }\n\n          return {\n            cid: parseCid(record.cid),\n            record: record.value,\n          }\n        },\n        onFetchResult({ uri, cid, source }) {\n          lexiconResolverLogger.info(\n            { uri: uri.toString(), cid: cid.toString(), source },\n            'Fetched lexicon',\n          )\n        },\n        onFetchError({ err, uri }) {\n          lexiconResolverLogger.error(\n            { uri: uri.toString(), err },\n            'Lexicon fetch error',\n          )\n        },\n        onResolveAuthority: ({ nsid }) => {\n          lexiconResolverLogger.debug(\n            { nsid: nsid.toString() },\n            'Resolving lexicon DID authority',\n          )\n          // Override the lexicon did resolution to point to a custom PDS\n          return cfg.lexicon.didAuthority\n        },\n        onResolveAuthorityResult({ nsid, did, source }) {\n          lexiconResolverLogger.info(\n            { nsid: nsid.toString(), did, source },\n            'Resolved lexicon DID',\n          )\n        },\n        onResolveAuthorityError({ nsid, err }) {\n          lexiconResolverLogger.error(\n            { nsid: nsid.toString(), err },\n            'Lexicon DID resolution error',\n          )\n        },\n      },\n    })\n\n    const localViewer = LocalViewer.creator(\n      accountManager,\n      imageUrlBuilder,\n      bskyAppView,\n    )\n\n    // An agent for performing HTTP requests based on user provided URLs.\n    const proxyAgent = buildProxyAgent(cfg.proxy)\n\n    const oauthProvider = cfg.oauth.provider\n      ? new OAuthProvider({\n          issuer: cfg.oauth.issuer,\n          keyset: [await JoseKey.fromKeyLike(jwtSecretKey, undefined, 'HS256')],\n          store: new OAuthStore(\n            accountManager,\n            actorStore,\n            imageUrlBuilder,\n            backgroundQueue,\n            mailer,\n            sequencer,\n            plcClient,\n            plcRotationKey,\n            cfg.service.publicUrl,\n            cfg.identity.recoveryDidKey,\n          ),\n          redis: redisScratch,\n          dpopSecret: secrets.dpopSecret,\n          inviteCodeRequired: cfg.invites.required,\n          availableUserDomains: cfg.identity.serviceHandleDomains,\n          hcaptcha: cfg.oauth.provider.hcaptcha,\n          branding: cfg.oauth.provider.branding,\n          // @NOTE Not operator-configurable on purpose: changing the email\n          // address unconditionally clears `emailAuthFactorAt` (see\n          // `account-manager/helpers/account.ts`), so the warning describes\n          // what this implementation always does rather than a preference. This\n          // is because updating email writes an unconfirmed email to the email\n          // column, which means leaving email based 2FA enabled can result in\n          // account lock-out.\n          show2FaWarningOnEmailUpdate: true,\n          allowHttp: cfg.service.devMode,\n          plcDirectoryUrl: cfg.identity.plcUrl,\n          fallbackNameservers: cfg.identity.handleBackupNameservers,\n          handleCache: undefined, // Memory\n          didCache: {\n            // Map didCache to SimpleCache<Did, DidDocument>\n            get: async (did) => {\n              const res = await didCache.checkCache(did)\n              // Expired entries are only ever refreshed by a resolution, so\n              // report them as missing rather than serving them indefinitely.\n              return res && !res.expired ? (res.doc as any) : undefined\n            },\n            set: async (did, doc) => {\n              await didCache.cacheDid(did, doc as any)\n            },\n            del: async (did) => {\n              await didCache.clearEntry(did)\n            },\n          },\n          safeFetch,\n          lexResolver,\n          metadata: {\n            protected_resources: [new URL(cfg.oauth.issuer).origin],\n          },\n          // If the PDS is both an authorization server & resource server (no\n          // entryway), we can afford to check the token validity on every\n          // request. This allows revoked tokens to be rejected immediately.\n          // This also allows JWT to be shorter since some claims (notably the\n          // \"scope\" claim) do not need to be included in the token.\n          accessTokenMode: AccessTokenMode.stateful,\n\n          getClientInfo(clientId) {\n            return {\n              isTrusted: cfg.oauth.provider?.trustedClients?.includes(clientId),\n            }\n          },\n          onSignedUp({ account, data, clientId }) {\n            events.accountCreated({\n              source: 'oauth',\n              did: account.did,\n              clientId,\n              invited: data.inviteCode != null,\n              deactivated: false,\n            })\n          },\n          onSignedIn({ account, clientId }) {\n            events.signedIn({\n              did: account.did,\n              clientId,\n            })\n          },\n          onAuthorized({ account, client }) {\n            events.oauthAuthorized({\n              did: account.did,\n              clientId: client.id,\n              clientFirstParty: client.isFirstParty,\n              clientTrusted: client.isTrusted,\n              clientConfidential: client.isConfidential,\n            })\n          },\n          onTokenCreated({ account, client }) {\n            events.sessionCreated({\n              source: 'oauth',\n              did: account.did,\n              clientId: client.id,\n            })\n          },\n          onTokenRefreshed({ account, client }) {\n            events.sessionRefreshed({\n              source: 'oauth',\n              did: account.did,\n              clientId: client.id,\n            })\n          },\n        })\n      : undefined\n\n    const scopeRefGetter = entrywayClient\n      ? new ScopeReferenceGetter(entrywayClient, redisScratch)\n      : undefined\n\n    const oauthVerifier: OAuthVerifier =\n      oauthProvider ?? // OAuthProvider extends OAuthVerifier\n      new OAuthVerifier({\n        issuer: cfg.oauth.issuer,\n        keyset: [await JoseKey.fromKeyLike(jwtPublicKey!, undefined, 'ES256K')],\n        dpopSecret: secrets.dpopSecret,\n        redis: redisScratch,\n        onDecodeToken: async ({ payload, dpopProof }) => {\n          // @TODO drop this once oauth provider no longer accepts DPoP proof with\n          // query or fragment in \"htu\" claim.\n          if (dpopProof?.htu.match(/[?#]/)) {\n            oauthLogger.info(\n              { htu: dpopProof.htu, client_id: payload.client_id },\n              'DPoP proof \"htu\" contains query or fragment',\n            )\n          }\n\n          if (scopeRefGetter) {\n            payload.scope = await scopeRefGetter.dereference(payload.scope)\n          }\n\n          return payload\n        },\n      })\n\n    const authVerifier = new AuthVerifier(\n      accountManager,\n      idResolver,\n      oauthVerifier,\n      {\n        publicUrl: cfg.service.publicUrl,\n        jwtKey: jwtPublicKey ?? jwtSecretKey,\n        adminPass: secrets.adminPassword,\n        dids: {\n          pds: cfg.service.did,\n          entryway: cfg.entryway?.did,\n          modService: cfg.modService?.did,\n        },\n      },\n    )\n\n    return new AppContext({\n      actorStore,\n      blobstore,\n      localViewer,\n      mailer,\n      moderationMailer,\n      didCache,\n      idResolver,\n      plcClient,\n      accountManager,\n      sequencer,\n      backgroundQueue,\n      redisScratch,\n      crawlers,\n      bskyAppView,\n      moderationClient,\n      reportingClient,\n      entrywayClient,\n      entrywayAdminClient,\n      proxyAgent,\n      safeFetch,\n      authVerifier,\n      oauthProvider,\n      plcRotationKey,\n      cfg,\n      ...(overrides ?? {}),\n    })\n  }\n\n  async appviewAuthHeaders(did: string, lxm: string) {\n    assert(this.bskyAppView)\n    return this.serviceAuthHeaders(did, this.bskyAppView.did, lxm)\n  }\n\n  async entrywayAuthHeaders(req: express.Request, did: string, lxm: string) {\n    assert(this.cfg.entryway)\n    const headers = await this.serviceAuthHeaders(\n      did,\n      this.cfg.entryway.did,\n      lxm,\n    )\n    return forwardedFor(req, headers)\n  }\n\n  entrywayPassthruHeaders(req: express.Request) {\n    return forwardedFor(req, authPassthru(req))\n  }\n\n  /**\n   * A {@link Client} for a service URL that was resolved from a DID document,\n   * i.e. a URL the PDS does not control. Routes the request through\n   * {@link safeFetch}, which restricts it to https origins that resolve to\n   * unicast addresses, and caps the response size. Lexicon validation follows\n   * the service's dev mode, as it does for the AppView client.\n   *\n   * Any call built from a DID document's service endpoint must use this.\n   */\n  safeClient(service: string | URL): Client {\n    return new Client(\n      { service, fetch: this.safeFetch },\n      {\n        validateRequest: this.cfg.service.devMode,\n        validateResponse: this.cfg.service.devMode,\n        strictResponseProcessing: this.cfg.service.devMode,\n      },\n    )\n  }\n\n  async serviceAuthHeaders(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceAuthHeaders({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n\n  async serviceAuthJwt(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceJwt({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n\n  async destroy(): Promise<void> {\n    // @TODO Implement this using an AsyncDisposableStack when it becomes\n    // widely available.\n    try {\n      await this.backgroundQueue.destroy()\n    } finally {\n      try {\n        await this.sequencer.destroy()\n      } finally {\n        try {\n          await this.accountManager.close()\n        } finally {\n          try {\n            await this.redisScratch?.quit()\n          } finally {\n            try {\n              await this.proxyAgent.destroy()\n            } finally {\n              await this.blobstore[Symbol.asyncDispose]()\n            }\n          }\n        }\n      }\n    }\n  }\n\n  async [Symbol.asyncDispose]() {\n    await this.destroy()\n  }\n}\n\nconst basicAuthHeader = (username: string, password: string) => {\n  const encoded = ui8.toString(\n    ui8.fromString(`${username}:${password}`, 'utf8'),\n    'base64pad',\n  )\n  return `Basic ${encoded}`\n}\n\nexport default AppContext\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AAGnC,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EACL,eAAe,EACf,OAAO,EACP,WAAW,EACX,gBAAgB,EAChB,aAAa,GACd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAEhE,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAc,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAIL,QAAQ,EACR,YAAY,EACZ,OAAO,GACR,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EACL,WAAW,GAEZ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AA6BhD,MAAM,OAAO,UAAU;IA0BrB,YAAY,IAAuB;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAC7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACnD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,GAAG,GAAsB,OAAO,EAAE,EAClC,SAAsC;QAEtC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACjC,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,GAAiB,EACjB,OAAsB,EACtB,SAAsC;QAEtC,gDAAgD;QAEhD,MAAM,SAAS,GACb,SAAS,EAAE,SAAS;YACpB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI;gBAC9B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;oBAClB,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;oBAC5B,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM;oBAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;oBAChC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;oBAC5C,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW;oBACtC,eAAe,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe;oBAC9C,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,gBAAgB;iBACjD,CAAC;gBACJ,CAAC,CAAC,aAAa,CAAC,OAAO,CACnB,GAAG,CAAC,SAAS,CAAC,QAAQ,EACtB,GAAG,CAAC,SAAS,CAAC,YAAY,CAC3B,CAAC,CAAA;QAER,MAAM,aAAa,GACjB,GAAG,CAAC,KAAK,KAAK,IAAI;YAChB,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/C,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,MAAM,GAAG,IAAI,YAAY,CAC7B,aAAa,EACb,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,KAAK,CAAC,MAAM,CACjB,CAAA;QAED,MAAM,gBAAgB,GACpB,GAAG,CAAC,eAAe,KAAK,IAAI;YAC1B,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAEzD,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QAEpE;;;;;;;;WAQG;QACH,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,WAAW,EAAE,KAAK;YAClB,qBAAqB,EAAE,KAAK;YAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB;YAEhD,KAAK,EAAE,UAAU,KAAK,EAAE,IAAI;gBAC1B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACnE,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAEhE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,CAAA;gBAE1C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,IAAI,cAAc,CACjC,GAAG,CAAC,EAAE,CAAC,aAAa,EACpB,GAAG,CAAC,QAAQ,CAAC,aAAa,EAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,EACxB,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;QAE/B,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;YAChC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YAC3B,QAAQ;YACR,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,eAAe;YACrC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,uBAAuB;YACvD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAErD,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,eAAe,EACf,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,GAAG,CAAC,QAAQ,CACb,CAAA;QACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAC7B,GAAG,CAAC,EAAE,CAAC,cAAc,EACrB,QAAQ,EACR,SAAS,EACT,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAChC,CAAA;QACD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK;YAC5B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW;YACjC,CAAC,CAAC,IAAI,WAAW,CAAC;gBACd,GAAG,GAAG,CAAC,WAAW;gBAClB,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU;YACrC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAC/B;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa;YACvC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,EAClC;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ;YACjC,CAAC,CAAC,IAAI,MAAM,CACR,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAChC;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,mBAAmB,GACvB,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,kBAAkB;YACxC,CAAC,CAAC,IAAI,MAAM,CACR;gBACE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBAC5B,OAAO,EAAE;oBACP,aAAa,EAAE,eAAe,CAC5B,OAAO,EACP,OAAO,CAAC,kBAAkB,CAC3B;iBACF;aACF,EACD;gBACE,2DAA2D;gBAC3D,wBAAwB,EAAE,KAAK;gBAC/B,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aACtC,CACF;YACH,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ;YAC/B,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrD,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,WAAW,CACZ,CAAA;QAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YAChD,SAAS;YACT,eAAe;SAChB,CAAC,CAAA;QAEF,MAAM,cAAc,GAClB,SAAS,EAAE,cAAc;YACzB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,KAAK,KAAK;gBACzC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK;iBACpC,CAAC;gBACJ,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,KAAK,QAAQ;oBAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAClC,OAAO,CAAC,cAAc,CAAC,aAAa,CACrC;oBACH,CAAC,CAAC,SAAS,CAAC,CAAA;QAElB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,cAAc,CACvC,GAAG,EACH,UAAU,EACV,UAAU,EACV,YAAY,EACZ,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,CACf,CAAA;QACD,MAAM,cAAc,CAAC,cAAc,EAAE,CAAA;QAErC,yEAAyE;QACzE,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;YAClC,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,SAAS,EAAE,kCAAkC;YACvD,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YACpC,KAAK,EAAE;gBACL,+DAA+D;gBAC/D,iEAAiE;gBACjE,wDAAwD;gBACxD,4DAA4D;gBAC5D,kCAAkC;gBAClC,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;oBAC5C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;wBACnD,kBAAkB,EAAE,IAAI;wBACxB,gBAAgB,EAAE,IAAI;qBACvB,CAAC,CAAA;oBAEF,MAAM,EAAE,cAAc,EAAE,CAAA;oBAExB,4DAA4D;oBAC5D,4BAA4B;oBAC5B,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;wBACzB,MAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,0BAA0B,GAAG,EAAE,CAAC,CAAA;oBACnE,CAAC;oBAED,uDAAuD;oBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa;wBAAE,OAAO,SAAS,CAAA;oBAEvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;wBAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;oBAC1C,CAAC,CAAC,CAAA;oBAEF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;wBAC1C,MAAM,IAAI,gBAAgB,CACxB,IAAI,EACJ,+BAA+B,GAAG,EAAE,CACrC,CAAA;oBACH,CAAC;oBAED,OAAO;wBACL,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzB,MAAM,EAAE,MAAM,CAAC,KAAK;qBACrB,CAAA;gBACH,CAAC;gBACD,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;oBAChC,qBAAqB,CAAC,IAAI,CACxB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,EACpD,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBACD,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;oBACvB,qBAAqB,CAAC,KAAK,CACzB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC5B,qBAAqB,CACtB,CAAA;gBACH,CAAC;gBACD,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC/B,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EACzB,iCAAiC,CAClC,CAAA;oBACD,+DAA+D;oBAC/D,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,CAAA;gBACjC,CAAC;gBACD,wBAAwB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;oBAC5C,qBAAqB,CAAC,IAAI,CACxB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EACtC,sBAAsB,CACvB,CAAA;gBACH,CAAC;gBACD,uBAAuB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;oBACnC,qBAAqB,CAAC,KAAK,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAC9B,8BAA8B,CAC/B,CAAA;gBACH,CAAC;aACF;SACF,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CACrC,cAAc,EACd,eAAe,EACf,WAAW,CACZ,CAAA;QAED,qEAAqE;QACrE,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE7C,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ;YACtC,CAAC,CAAC,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACrE,KAAK,EAAE,IAAI,UAAU,CACnB,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAC5B;gBACD,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;gBACxC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,oBAAoB;gBACvD,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACrC,iEAAiE;gBACjE,0DAA0D;gBAC1D,kEAAkE;gBAClE,sEAAsE;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,oBAAoB;gBACpB,2BAA2B,EAAE,IAAI;gBACjC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;gBAC9B,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBACpC,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,uBAAuB;gBACzD,WAAW,EAAE,SAAS,EAAE,SAAS;gBACjC,QAAQ,EAAE;oBACR,gDAAgD;oBAChD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;wBACjB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;wBAC1C,8DAA8D;wBAC9D,gEAAgE;wBAChE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,GAAW,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC3D,CAAC;oBACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBACtB,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAU,CAAC,CAAA;oBAC1C,CAAC;oBACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;wBACjB,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;oBAChC,CAAC;iBACF;gBACD,SAAS;gBACT,WAAW;gBACX,QAAQ,EAAE;oBACR,mBAAmB,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;iBACxD;gBACD,mEAAmE;gBACnE,gEAAgE;gBAChE,kEAAkE;gBAClE,oEAAoE;gBACpE,0DAA0D;gBAC1D,eAAe,EAAE,eAAe,CAAC,QAAQ;gBAEzC,aAAa,CAAC,QAAQ;oBACpB,OAAO;wBACL,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC;qBAClE,CAAA;gBACH,CAAC;gBACD,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACpC,MAAM,CAAC,cAAc,CAAC;wBACpB,MAAM,EAAE,OAAO;wBACf,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ;wBACR,OAAO,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;wBAChC,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAA;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;oBAC9B,MAAM,CAAC,QAAQ,CAAC;wBACd,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ;qBACT,CAAC,CAAA;gBACJ,CAAC;gBACD,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAC9B,MAAM,CAAC,eAAe,CAAC;wBACrB,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ,EAAE,MAAM,CAAC,EAAE;wBACnB,gBAAgB,EAAE,MAAM,CAAC,YAAY;wBACrC,aAAa,EAAE,MAAM,CAAC,SAAS;wBAC/B,kBAAkB,EAAE,MAAM,CAAC,cAAc;qBAC1C,CAAC,CAAA;gBACJ,CAAC;gBACD,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAChC,MAAM,CAAC,cAAc,CAAC;wBACpB,MAAM,EAAE,OAAO;wBACf,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ,EAAE,MAAM,CAAC,EAAE;qBACpB,CAAC,CAAA;gBACJ,CAAC;gBACD,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAClC,MAAM,CAAC,gBAAgB,CAAC;wBACtB,MAAM,EAAE,OAAO;wBACf,GAAG,EAAE,OAAO,CAAC,GAAG;wBAChB,QAAQ,EAAE,MAAM,CAAC,EAAE;qBACpB,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC;YACxD,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,aAAa,GACjB,aAAa,IAAI,sCAAsC;YACvD,IAAI,aAAa,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;gBACxB,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,YAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACvE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;oBAC9C,wEAAwE;oBACxE,oCAAoC;oBACpC,IAAI,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBACjC,WAAW,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EACpD,6CAA6C,CAC9C,CAAA;oBACH,CAAC;oBAED,IAAI,cAAc,EAAE,CAAC;wBACnB,OAAO,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;oBACjE,CAAC;oBAED,OAAO,OAAO,CAAA;gBAChB,CAAC;aACF,CAAC,CAAA;QAEJ,MAAM,YAAY,GAAG,IAAI,YAAY,CACnC,cAAc,EACd,UAAU,EACV,aAAa,EACb;YACE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;YAChC,MAAM,EAAE,YAAY,IAAI,YAAY;YACpC,SAAS,EAAE,OAAO,CAAC,aAAa;YAChC,IAAI,EAAE;gBACJ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG;gBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG;aAChC;YACD,mBAAmB,EAAE,GAAG,CAAC,QAAQ;gBAC/B,CAAC,CAAC;oBACE,MAAM,EAAE,MAAM,CAAC,YAAY,CACzB,MAAM,CAAC,iBAAiB,EACxB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,CACpD;oBACD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,kBAAkB;iBAC1C;gBACH,CAAC,CAAC,SAAS;SACd,CACF,CAAA;QAED,OAAO,IAAI,UAAU,CAAC;YACpB,UAAU;YACV,SAAS;YACT,WAAW;YACX,MAAM;YACN,gBAAgB;YAChB,QAAQ;YACR,UAAU;YACV,SAAS;YACT,cAAc;YACd,SAAS;YACT,eAAe;YACf,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,gBAAgB;YAChB,eAAe;YACf,cAAc;YACd,mBAAmB;YACnB,UAAU;YACV,SAAS;YACT,YAAY;YACZ,aAAa;YACb,cAAc;YACd,GAAG;YACH,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW;QAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAoB,EAAE,GAAW,EAAE,GAAW;QACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC3C,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CACJ,CAAA;QACD,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAED,uBAAuB,CAAC,GAAoB;QAC1C,OAAO,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,UAAU,CAAC,OAAqB;QAC9B,OAAO,IAAI,MAAM,CACf,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,EAClC;YACE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;YACzC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;YAC1C,wBAAwB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;SACnD,CACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,wBAAwB,CAAC;YAC9B,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,gBAAgB,CAAC;YACtB,GAAG,EAAE,GAAG;YACR,GAAG;YACH,GAAG;YACH,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,qEAAqE;QACrE,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAA;QACtC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAA;YAChC,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;gBACnC,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAA;oBACjC,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC;4BACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;wBACjC,CAAC;gCAAS,CAAC;4BACT,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAA;wBAC7C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAC1B,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,EACjD,WAAW,CACZ,CAAA;IACD,OAAO,SAAS,OAAO,EAAE,CAAA;AAC3B,CAAC,CAAA;AAED,eAAe,UAAU,CAAA","sourcesContent":["import assert from 'node:assert'\nimport * as plc from '@did-plc/lib'\nimport type express from 'express'\nimport type { Redis } from 'ioredis'\nimport * as nodemailer from 'nodemailer'\nimport * as ui8 from 'uint8arrays'\nimport type * as undici from 'undici'\nimport { KmsKeypair, S3BlobStore } from '@atproto/aws'\nimport * as crypto from '@atproto/crypto'\nimport { IdResolver } from '@atproto/identity'\nimport { Client } from '@atproto/lex-client'\nimport { parseCid } from '@atproto/lex-data'\nimport {\n  AccessTokenMode,\n  JoseKey,\n  LexResolver,\n  LexResolverError,\n  OAuthProvider,\n} from '@atproto/oauth-provider/provider'\nimport { OAuthVerifier } from '@atproto/oauth-provider/verifier'\nimport type { BlobStoreCreator } from '@atproto/repo'\nimport {\n  createServiceAuthHeaders,\n  createServiceJwt,\n} from '@atproto/xrpc-server'\nimport { type Fetch, safeFetchWrap } from '@atproto-labs/fetch-node'\nimport { AccountManager } from './account-manager/account-manager.js'\nimport { OAuthStore } from './account-manager/oauth-store.js'\nimport { ScopeReferenceGetter } from './account-manager/scope-reference-getter.js'\nimport { ActorStore } from './actor-store/actor-store.js'\nimport { authPassthru, forwardedFor } from './api/proxy.js'\nimport {\n  AuthVerifier,\n  createPublicKeyObject,\n  createSecretKeyObject,\n} from './auth-verifier.js'\nimport { BackgroundQueue } from './background.js'\nimport { BskyAppView } from './bsky-app-view.js'\nimport {\n  type ServerConfig,\n  type ServerEnvironment,\n  type ServerSecrets,\n  envToCfg,\n  envToSecrets,\n  readEnv,\n} from './config/index.js'\nimport { Crawlers } from './crawlers.js'\nimport { DidSqliteCache } from './did-cache/index.js'\nimport { DiskBlobStore } from './disk-blobstore.js'\nimport { events } from './events.js'\nimport { ImageUrlBuilder } from './image/image-url-builder.js'\nimport { fetchLogger, lexiconResolverLogger, oauthLogger } from './logger.js'\nimport { ServerMailer } from './mailer/index.js'\nimport { ModerationMailer } from './mailer/moderation.js'\nimport { buildProxyAgent } from './pipethrough.js'\nimport {\n  LocalViewer,\n  type LocalViewerCreator,\n} from './read-after-write/viewer.js'\nimport { getRedisClient } from './redis.js'\nimport { Sequencer } from './sequencer/index.js'\n\nexport type AppContextOptions = {\n  actorStore: ActorStore\n  blobstore: BlobStoreCreator\n  localViewer: LocalViewerCreator\n  mailer: ServerMailer\n  moderationMailer: ModerationMailer\n  didCache: DidSqliteCache\n  idResolver: IdResolver\n  plcClient: plc.Client\n  accountManager: AccountManager\n  sequencer: Sequencer\n  backgroundQueue: BackgroundQueue\n  redisScratch?: Redis\n  crawlers: Crawlers\n  bskyAppView?: BskyAppView\n  moderationClient?: Client\n  reportingClient?: Client\n  entrywayClient?: Client\n  entrywayAdminClient?: Client\n  proxyAgent: undici.Dispatcher\n  safeFetch: Fetch\n  oauthProvider?: OAuthProvider\n  authVerifier: AuthVerifier\n  plcRotationKey: crypto.Keypair\n  cfg: ServerConfig\n}\n\nexport class AppContext implements AsyncDisposable {\n  public actorStore: ActorStore\n  public blobstore: BlobStoreCreator\n  public localViewer: LocalViewerCreator\n  public mailer: ServerMailer\n  public moderationMailer: ModerationMailer\n  public didCache: DidSqliteCache\n  public idResolver: IdResolver\n  public plcClient: plc.Client\n  public accountManager: AccountManager\n  public sequencer: Sequencer\n  public backgroundQueue: BackgroundQueue\n  public redisScratch?: Redis\n  public crawlers: Crawlers\n  public bskyAppView?: BskyAppView\n  public moderationClient: Client | undefined\n  public reportingClient: Client | undefined\n  public entrywayClient: Client | undefined\n  public entrywayAdminClient: Client | undefined\n  public proxyAgent: undici.Dispatcher\n  public safeFetch: Fetch\n  public authVerifier: AuthVerifier\n  public oauthProvider?: OAuthProvider\n  public plcRotationKey: crypto.Keypair\n  public cfg: ServerConfig\n\n  constructor(opts: AppContextOptions) {\n    this.actorStore = opts.actorStore\n    this.blobstore = opts.blobstore\n    this.localViewer = opts.localViewer\n    this.mailer = opts.mailer\n    this.moderationMailer = opts.moderationMailer\n    this.didCache = opts.didCache\n    this.idResolver = opts.idResolver\n    this.plcClient = opts.plcClient\n    this.accountManager = opts.accountManager\n    this.sequencer = opts.sequencer\n    this.backgroundQueue = opts.backgroundQueue\n    this.redisScratch = opts.redisScratch\n    this.crawlers = opts.crawlers\n    this.bskyAppView = opts.bskyAppView\n    this.moderationClient = opts.moderationClient\n    this.reportingClient = opts.reportingClient\n    this.entrywayClient = opts.entrywayClient\n    this.entrywayAdminClient = opts.entrywayAdminClient\n    this.proxyAgent = opts.proxyAgent\n    this.safeFetch = opts.safeFetch\n    this.authVerifier = opts.authVerifier\n    this.oauthProvider = opts.oauthProvider\n    this.plcRotationKey = opts.plcRotationKey\n    this.cfg = opts.cfg\n  }\n\n  static async fromEnv(\n    env: ServerEnvironment = readEnv(),\n    overrides?: Partial<AppContextOptions>,\n  ): Promise<AppContext> {\n    const cfg = envToCfg(env)\n    const secrets = envToSecrets(env)\n    return AppContext.fromConfig(cfg, secrets, overrides)\n  }\n\n  static async fromConfig(\n    cfg: ServerConfig,\n    secrets: ServerSecrets,\n    overrides?: Partial<AppContextOptions>,\n  ): Promise<AppContext> {\n    // @TODO Implement using an AsyncDisposableStack\n\n    const blobstore: BlobStoreCreator =\n      overrides?.blobstore ??\n      (cfg.blobstore.provider === 's3'\n        ? S3BlobStore.creator({\n            bucket: cfg.blobstore.bucket,\n            region: cfg.blobstore.region,\n            endpoint: cfg.blobstore.endpoint,\n            forcePathStyle: cfg.blobstore.forcePathStyle,\n            credentials: cfg.blobstore.credentials,\n            uploadTimeoutMs: cfg.blobstore.uploadTimeoutMs,\n            requestTimeoutMs: cfg.blobstore.requestTimeoutMs,\n          })\n        : DiskBlobStore.creator(\n            cfg.blobstore.location,\n            cfg.blobstore.tempLocation,\n          ))\n\n    const mailTransport =\n      cfg.email !== null\n        ? nodemailer.createTransport(cfg.email.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const mailer = new ServerMailer(\n      mailTransport,\n      cfg.email,\n      cfg.branding,\n      cfg.oauth.issuer,\n    )\n\n    const modMailTransport =\n      cfg.moderationEmail !== null\n        ? nodemailer.createTransport(cfg.moderationEmail.smtpUrl)\n        : nodemailer.createTransport({ jsonTransport: true })\n\n    const moderationMailer = new ModerationMailer(modMailTransport, cfg)\n\n    /**\n     * A fetch() function that protects against SSRF attacks, large responses &\n     * known bad domains. This function can safely be used to fetch user\n     * provided URLs (unless \"disableSsrfProtection\" is true, of course).\n     *\n     * @note **DO NOT** wrap `safeFetch` with any logging or other transforms as\n     * this might prevent the use of explicit `redirect: \"follow\"` init from\n     * working. See {@link safeFetchWrap}.\n     */\n    const safeFetch = safeFetchWrap({\n      allowIpHost: false,\n      allowImplicitRedirect: false,\n      responseMaxSize: cfg.fetch.maxResponseSize,\n      ssrfProtection: !cfg.fetch.disableSsrfProtection,\n\n      fetch: function (input, init) {\n        const method =\n          init?.method ?? (input instanceof Request ? input.method : 'GET')\n        const uri = input instanceof Request ? input.url : String(input)\n\n        fetchLogger.info({ method, uri }, 'fetch')\n\n        return globalThis.fetch.call(this, input, init)\n      },\n    })\n\n    const didCache = new DidSqliteCache(\n      cfg.db.didCacheDbLoc,\n      cfg.identity.cacheStaleTTL,\n      cfg.identity.cacheMaxTTL,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    await didCache.migrateOrThrow()\n\n    const idResolver = new IdResolver({\n      plcUrl: cfg.identity.plcUrl,\n      didCache,\n      timeout: cfg.identity.resolverTimeout,\n      backupNameservers: cfg.identity.handleBackupNameservers,\n      fetch: safeFetch,\n    })\n    const plcClient = new plc.Client(cfg.identity.plcUrl)\n\n    const backgroundQueue = new BackgroundQueue(undefined, { concurrency: 5 })\n    const crawlers = new Crawlers(\n      backgroundQueue,\n      cfg.service.hostname,\n      cfg.crawlers,\n    )\n    const sequencer = new Sequencer(\n      cfg.db.sequencerDbLoc,\n      crawlers,\n      undefined,\n      cfg.db.disableWalAutoCheckpoint,\n    )\n    const redisScratch = cfg.redis\n      ? getRedisClient(cfg.redis.address, cfg.redis.password)\n      : undefined\n\n    const bskyAppView = cfg.bskyAppView\n      ? new BskyAppView({\n          ...cfg.bskyAppView,\n          validateResponse: cfg.service.devMode,\n        })\n      : undefined\n\n    const moderationClient = cfg.modService\n      ? new Client(\n          { service: cfg.modService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const reportingClient = cfg.reportService\n      ? new Client(\n          { service: cfg.reportService.url },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayClient = cfg.entryway\n      ? new Client(\n          { service: cfg.entryway.apiUrl },\n          {\n            // Trust internal services to send us well-formed responses\n            strictResponseProcessing: false,\n            validateResponse: cfg.service.devMode,\n          },\n        )\n      : undefined\n    const entrywayAdminClient =\n      cfg.entryway && secrets.entrywayAdminToken\n        ? new Client(\n            {\n              service: cfg.entryway.apiUrl,\n              headers: {\n                authorization: basicAuthHeader(\n                  'admin',\n                  secrets.entrywayAdminToken,\n                ),\n              },\n            },\n            {\n              // Trust internal services to send us well-formed responses\n              strictResponseProcessing: false,\n              validateResponse: cfg.service.devMode,\n            },\n          )\n        : undefined\n\n    const jwtSecretKey = createSecretKeyObject(secrets.jwtSecret)\n    const jwtPublicKey = cfg.entryway\n      ? createPublicKeyObject(cfg.entryway.jwtPublicKeyHex)\n      : null\n\n    const imageUrlBuilder = new ImageUrlBuilder(\n      cfg.service.hostname,\n      bskyAppView,\n    )\n\n    const actorStore = new ActorStore(cfg.actorStore, {\n      blobstore,\n      backgroundQueue,\n    })\n\n    const plcRotationKey =\n      overrides?.plcRotationKey ??\n      (secrets.plcRotationKey?.provider === 'kms'\n        ? await KmsKeypair.load({\n            keyId: secrets.plcRotationKey.keyId,\n          })\n        : secrets.plcRotationKey?.provider === 'memory'\n          ? await crypto.Secp256k1Keypair.import(\n              secrets.plcRotationKey.privateKeyHex,\n            )\n          : undefined)\n\n    if (!plcRotationKey) {\n      throw new Error('Must configure plc rotation key')\n    }\n\n    const accountManager = new AccountManager(\n      cfg,\n      actorStore,\n      idResolver,\n      jwtSecretKey,\n      mailer,\n      sequencer,\n      plcClient,\n      plcRotationKey,\n    )\n    await accountManager.migrateOrThrow()\n\n    // @TODO Use this lexResolver instance to implement validation of records\n    // created with the \"validate\" option. Before doing so, ensure that 1) a\n    // didCache is provided, and 2) that nsid->lexicon are cached.\n    const lexResolver = new LexResolver({\n      fetch: safeFetch,\n      didCache: undefined, // @TODO provide a dedicated cache\n      plcDirectoryUrl: cfg.identity.plcUrl,\n      hooks: {\n        // @NOTE Lexicons hosted by this PDS are read straight from the\n        // actor store. Fetching them over the network would require this\n        // server to reach its own public endpoint, which is not\n        // guaranteed to work (SSRF protection, missing NAT hairpin,\n        // internal reverse proxies, ...).\n        onFetch: async ({ uri, did, nsid, signal }) => {\n          const account = await accountManager.getAccount(did, {\n            includeDeactivated: true,\n            includeTakenDown: true,\n          })\n\n          signal?.throwIfAborted()\n\n          // Mirror what com.atproto.sync.getRecord would answer to an\n          // unauthenticated requester\n          if (account?.takedownRef) {\n            throw new LexResolverError(nsid, `Repo is not available: ${did}`)\n          }\n\n          // Not hosted here: fall back to the network resolution\n          if (!account || account.deactivatedAt) return undefined\n\n          const record = await actorStore.read(account.did, (store) => {\n            return store.record.getRecord(uri, null)\n          })\n\n          if (!record || record.takedownRef != null) {\n            throw new LexResolverError(\n              nsid,\n              `Lexicon record not found at ${uri}`,\n            )\n          }\n\n          return {\n            cid: parseCid(record.cid),\n            record: record.value,\n          }\n        },\n        onFetchResult({ uri, cid, source }) {\n          lexiconResolverLogger.info(\n            { uri: uri.toString(), cid: cid.toString(), source },\n            'Fetched lexicon',\n          )\n        },\n        onFetchError({ err, uri }) {\n          lexiconResolverLogger.error(\n            { uri: uri.toString(), err },\n            'Lexicon fetch error',\n          )\n        },\n        onResolveAuthority: ({ nsid }) => {\n          lexiconResolverLogger.debug(\n            { nsid: nsid.toString() },\n            'Resolving lexicon DID authority',\n          )\n          // Override the lexicon did resolution to point to a custom PDS\n          return cfg.lexicon.didAuthority\n        },\n        onResolveAuthorityResult({ nsid, did, source }) {\n          lexiconResolverLogger.info(\n            { nsid: nsid.toString(), did, source },\n            'Resolved lexicon DID',\n          )\n        },\n        onResolveAuthorityError({ nsid, err }) {\n          lexiconResolverLogger.error(\n            { nsid: nsid.toString(), err },\n            'Lexicon DID resolution error',\n          )\n        },\n      },\n    })\n\n    const localViewer = LocalViewer.creator(\n      accountManager,\n      imageUrlBuilder,\n      bskyAppView,\n    )\n\n    // An agent for performing HTTP requests based on user provided URLs.\n    const proxyAgent = buildProxyAgent(cfg.proxy)\n\n    const oauthProvider = cfg.oauth.provider\n      ? new OAuthProvider({\n          issuer: cfg.oauth.issuer,\n          keyset: [await JoseKey.fromKeyLike(jwtSecretKey, undefined, 'HS256')],\n          store: new OAuthStore(\n            accountManager,\n            actorStore,\n            imageUrlBuilder,\n            backgroundQueue,\n            mailer,\n            sequencer,\n            plcClient,\n            plcRotationKey,\n            cfg.service.publicUrl,\n            cfg.identity.recoveryDidKey,\n          ),\n          redis: redisScratch,\n          dpopSecret: secrets.dpopSecret,\n          inviteCodeRequired: cfg.invites.required,\n          availableUserDomains: cfg.identity.serviceHandleDomains,\n          hcaptcha: cfg.oauth.provider.hcaptcha,\n          branding: cfg.oauth.provider.branding,\n          // @NOTE Not operator-configurable on purpose: changing the email\n          // address unconditionally clears `emailAuthFactorAt` (see\n          // `account-manager/helpers/account.ts`), so the warning describes\n          // what this implementation always does rather than a preference. This\n          // is because updating email writes an unconfirmed email to the email\n          // column, which means leaving email based 2FA enabled can result in\n          // account lock-out.\n          show2FaWarningOnEmailUpdate: true,\n          allowHttp: cfg.service.devMode,\n          plcDirectoryUrl: cfg.identity.plcUrl,\n          fallbackNameservers: cfg.identity.handleBackupNameservers,\n          handleCache: undefined, // Memory\n          didCache: {\n            // Map didCache to SimpleCache<Did, DidDocument>\n            get: async (did) => {\n              const res = await didCache.checkCache(did)\n              // Expired entries are only ever refreshed by a resolution, so\n              // report them as missing rather than serving them indefinitely.\n              return res && !res.expired ? (res.doc as any) : undefined\n            },\n            set: async (did, doc) => {\n              await didCache.cacheDid(did, doc as any)\n            },\n            del: async (did) => {\n              await didCache.clearEntry(did)\n            },\n          },\n          safeFetch,\n          lexResolver,\n          metadata: {\n            protected_resources: [new URL(cfg.oauth.issuer).origin],\n          },\n          // If the PDS is both an authorization server & resource server (no\n          // entryway), we can afford to check the token validity on every\n          // request. This allows revoked tokens to be rejected immediately.\n          // This also allows JWT to be shorter since some claims (notably the\n          // \"scope\" claim) do not need to be included in the token.\n          accessTokenMode: AccessTokenMode.stateful,\n\n          getClientInfo(clientId) {\n            return {\n              isTrusted: cfg.oauth.provider?.trustedClients?.includes(clientId),\n            }\n          },\n          onSignedUp({ account, data, clientId }) {\n            events.accountCreated({\n              source: 'oauth',\n              did: account.did,\n              clientId,\n              invited: data.inviteCode != null,\n              deactivated: false,\n            })\n          },\n          onSignedIn({ account, clientId }) {\n            events.signedIn({\n              did: account.did,\n              clientId,\n            })\n          },\n          onAuthorized({ account, client }) {\n            events.oauthAuthorized({\n              did: account.did,\n              clientId: client.id,\n              clientFirstParty: client.isFirstParty,\n              clientTrusted: client.isTrusted,\n              clientConfidential: client.isConfidential,\n            })\n          },\n          onTokenCreated({ account, client }) {\n            events.sessionCreated({\n              source: 'oauth',\n              did: account.did,\n              clientId: client.id,\n            })\n          },\n          onTokenRefreshed({ account, client }) {\n            events.sessionRefreshed({\n              source: 'oauth',\n              did: account.did,\n              clientId: client.id,\n            })\n          },\n        })\n      : undefined\n\n    const scopeRefGetter = entrywayClient\n      ? new ScopeReferenceGetter(entrywayClient, redisScratch)\n      : undefined\n\n    const oauthVerifier: OAuthVerifier =\n      oauthProvider ?? // OAuthProvider extends OAuthVerifier\n      new OAuthVerifier({\n        issuer: cfg.oauth.issuer,\n        keyset: [await JoseKey.fromKeyLike(jwtPublicKey!, undefined, 'ES256K')],\n        dpopSecret: secrets.dpopSecret,\n        redis: redisScratch,\n        onDecodeToken: async ({ payload, dpopProof }) => {\n          // @TODO drop this once oauth provider no longer accepts DPoP proof with\n          // query or fragment in \"htu\" claim.\n          if (dpopProof?.htu.match(/[?#]/)) {\n            oauthLogger.info(\n              { htu: dpopProof.htu, client_id: payload.client_id },\n              'DPoP proof \"htu\" contains query or fragment',\n            )\n          }\n\n          if (scopeRefGetter) {\n            payload.scope = await scopeRefGetter.dereference(payload.scope)\n          }\n\n          return payload\n        },\n      })\n\n    const authVerifier = new AuthVerifier(\n      accountManager,\n      idResolver,\n      oauthVerifier,\n      {\n        publicUrl: cfg.service.publicUrl,\n        jwtKey: jwtPublicKey ?? jwtSecretKey,\n        adminPass: secrets.adminPassword,\n        dids: {\n          pds: cfg.service.did,\n          entryway: cfg.entryway?.did,\n          modService: cfg.modService?.did,\n        },\n        entrywayServiceAuth: cfg.entryway\n          ? {\n              didKey: crypto.formatDidKey(\n                crypto.SECP256K1_JWT_ALG,\n                ui8.fromString(cfg.entryway.jwtPublicKeyHex, 'hex'),\n              ),\n              required: cfg.entryway.requireServiceAuth,\n            }\n          : undefined,\n      },\n    )\n\n    return new AppContext({\n      actorStore,\n      blobstore,\n      localViewer,\n      mailer,\n      moderationMailer,\n      didCache,\n      idResolver,\n      plcClient,\n      accountManager,\n      sequencer,\n      backgroundQueue,\n      redisScratch,\n      crawlers,\n      bskyAppView,\n      moderationClient,\n      reportingClient,\n      entrywayClient,\n      entrywayAdminClient,\n      proxyAgent,\n      safeFetch,\n      authVerifier,\n      oauthProvider,\n      plcRotationKey,\n      cfg,\n      ...(overrides ?? {}),\n    })\n  }\n\n  async appviewAuthHeaders(did: string, lxm: string) {\n    assert(this.bskyAppView)\n    return this.serviceAuthHeaders(did, this.bskyAppView.did, lxm)\n  }\n\n  async entrywayAuthHeaders(req: express.Request, did: string, lxm: string) {\n    assert(this.cfg.entryway)\n    const headers = await this.serviceAuthHeaders(\n      did,\n      this.cfg.entryway.did,\n      lxm,\n    )\n    return forwardedFor(req, headers)\n  }\n\n  entrywayPassthruHeaders(req: express.Request) {\n    return forwardedFor(req, authPassthru(req))\n  }\n\n  /**\n   * A {@link Client} for a service URL that was resolved from a DID document,\n   * i.e. a URL the PDS does not control. Routes the request through\n   * {@link safeFetch}, which restricts it to https origins that resolve to\n   * unicast addresses, and caps the response size. Lexicon validation follows\n   * the service's dev mode, as it does for the AppView client.\n   *\n   * Any call built from a DID document's service endpoint must use this.\n   */\n  safeClient(service: string | URL): Client {\n    return new Client(\n      { service, fetch: this.safeFetch },\n      {\n        validateRequest: this.cfg.service.devMode,\n        validateResponse: this.cfg.service.devMode,\n        strictResponseProcessing: this.cfg.service.devMode,\n      },\n    )\n  }\n\n  async serviceAuthHeaders(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceAuthHeaders({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n\n  async serviceAuthJwt(did: string, aud: string, lxm: string) {\n    const keypair = await this.actorStore.keypair(did)\n    return createServiceJwt({\n      iss: did,\n      aud,\n      lxm,\n      keypair,\n    })\n  }\n\n  async destroy(): Promise<void> {\n    // @TODO Implement this using an AsyncDisposableStack when it becomes\n    // widely available.\n    try {\n      await this.backgroundQueue.destroy()\n    } finally {\n      try {\n        await this.sequencer.destroy()\n      } finally {\n        try {\n          await this.accountManager.close()\n        } finally {\n          try {\n            await this.redisScratch?.quit()\n          } finally {\n            try {\n              await this.proxyAgent.destroy()\n            } finally {\n              await this.blobstore[Symbol.asyncDispose]()\n            }\n          }\n        }\n      }\n    }\n  }\n\n  async [Symbol.asyncDispose]() {\n    await this.destroy()\n  }\n}\n\nconst basicAuthHeader = (username: string, password: string) => {\n  const encoded = ui8.toString(\n    ui8.fromString(`${username}:${password}`, 'utf8'),\n    'base64pad',\n  )\n  return `Basic ${encoded}`\n}\n\nexport default AppContext\n"]}

package/dist/crawlers.js

@@ -1,4 +1,4 @@
-import { xrpc } from '@atproto/lex';
+import { xrpc } from '@atproto/lex-client';
 import { com } from './lexicons/index.js';
 import { crawlerLogger as log } from './logger.js';
 const NOTIFY_THRESHOLD = 20 * 60e3;

package/dist/crawlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"crawlers.js","sourceRoot":"","sources":["../src/crawlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAA;AACzC,OAAO,EAAE,aAAa,IAAI,GAAG,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,MAAM,OAAO,QAAQ;IAGnB,YACmB,eAAgC,EAChC,QAAgB,EAChB,QAA0B;QAF1B,oBAAe,GAAf,eAAe,CAAiB;QAChC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAkB;QALrC,iBAAY,GAAG,CAAC,QAAQ,CAAA;IAM7B,CAAC;IAEJ,cAAc;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,IAAI,CAAC,YAAY,GAAG,GAAG,GAAG,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;YACvB,IAAI,CAAC,YAAY,EAAE,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,YAAY;QACd,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBAClC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE;wBACjD,eAAe,EAAE,KAAK;wBACtB,gBAAgB,EAAE,KAAK;wBACvB,wBAAwB,EAAE,KAAK;wBAC/B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;qBAClC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF","sourcesContent":["import { xrpc } from '@atproto/lex'\nimport type { BackgroundQueue } from './background.js'\nimport { com } from './lexicons/index.js'\nimport { crawlerLogger as log } from './logger.js'\n\nconst NOTIFY_THRESHOLD = 20 * 60e3\n\nexport class Crawlers {\n  private lastNotified = -Infinity\n\n  constructor(\n    private readonly backgroundQueue: BackgroundQueue,\n    private readonly hostname: string,\n    private readonly crawlers: Iterable<string>,\n  ) {}\n\n  notifyOfUpdate() {\n    const now = Date.now()\n    if (this.lastNotified < now - NOTIFY_THRESHOLD) {\n      this.lastNotified = now\n      this.requestCrawl()\n    } else {\n      // @TODO We should probably actually schedule (setTimeout) a crawl for\n      // when the threshold is met, instead of just waiting for the next update\n      // to trigger it. Not doing this now as it requires cleanup logic on\n      // shutdown.\n    }\n  }\n\n  private requestCrawl() {\n    for (const crawler of this.crawlers) {\n      this.backgroundQueue.add(async () => {\n        try {\n          await xrpc(crawler, com.atproto.sync.requestCrawl, {\n            validateRequest: false,\n            validateResponse: false,\n            strictResponseProcessing: false,\n            body: { hostname: this.hostname },\n          })\n        } catch (err) {\n          log.warn({ err, crawler }, 'failed to request crawl')\n        }\n      })\n    }\n  }\n}\n"]}
+{"version":3,"file":"crawlers.js","sourceRoot":"","sources":["../src/crawlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAE1C,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAA;AACzC,OAAO,EAAE,aAAa,IAAI,GAAG,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,MAAM,OAAO,QAAQ;IAGnB,YACmB,eAAgC,EAChC,QAAgB,EAChB,QAA0B;QAF1B,oBAAe,GAAf,eAAe,CAAiB;QAChC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAkB;QALrC,iBAAY,GAAG,CAAC,QAAQ,CAAA;IAM7B,CAAC;IAEJ,cAAc;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,IAAI,CAAC,YAAY,GAAG,GAAG,GAAG,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;YACvB,IAAI,CAAC,YAAY,EAAE,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,YAAY;QACd,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBAClC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE;wBACjD,eAAe,EAAE,KAAK;wBACtB,gBAAgB,EAAE,KAAK;wBACvB,wBAAwB,EAAE,KAAK;wBAC/B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;qBAClC,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF","sourcesContent":["import { xrpc } from '@atproto/lex-client'\nimport type { BackgroundQueue } from './background.js'\nimport { com } from './lexicons/index.js'\nimport { crawlerLogger as log } from './logger.js'\n\nconst NOTIFY_THRESHOLD = 20 * 60e3\n\nexport class Crawlers {\n  private lastNotified = -Infinity\n\n  constructor(\n    private readonly backgroundQueue: BackgroundQueue,\n    private readonly hostname: string,\n    private readonly crawlers: Iterable<string>,\n  ) {}\n\n  notifyOfUpdate() {\n    const now = Date.now()\n    if (this.lastNotified < now - NOTIFY_THRESHOLD) {\n      this.lastNotified = now\n      this.requestCrawl()\n    } else {\n      // @TODO We should probably actually schedule (setTimeout) a crawl for\n      // when the threshold is met, instead of just waiting for the next update\n      // to trigger it. Not doing this now as it requires cleanup logic on\n      // shutdown.\n    }\n  }\n\n  private requestCrawl() {\n    for (const crawler of this.crawlers) {\n      this.backgroundQueue.add(async () => {\n        try {\n          await xrpc(crawler, com.atproto.sync.requestCrawl, {\n            validateRequest: false,\n            validateResponse: false,\n            strictResponseProcessing: false,\n            body: { hostname: this.hostname },\n          })\n        } catch (err) {\n          log.warn({ err, crawler }, 'failed to request crawl')\n        }\n      })\n    }\n  }\n}\n"]}

package/dist/entryway-attribution.d.ts

@@ -0,0 +1,39 @@
+import type { KeyObject } from 'node:crypto';
+import type express from 'express';
+import type { HandlerContext } from '@atproto/xrpc-server';
+export declare class EntrywayRelayTokenError extends Error {
+    readonly reason: string;
+    /**
+     * @param reason Why the token was refused, as a short code (such as jose's
+     * error code) so that logging it reveals nothing of the token or the client.
+     */
+    constructor(reason: string, options?: ErrorOptions);
+}
+/**
+ * Rate limit bypass for requests the entryway makes with its service JWT.
+ * Routes authenticate requests before applying rate limits, so this relies on
+ * the route having accepted the token rather than verifying it again.
+ */
+export declare const entrywayRateLimitBypass: ({ auth }: HandlerContext) => boolean;
+/**
+ * Attributes the user requests the entryway proxies to the users rather than
+ * to the entryway, by the relay token it signs. The rate limiters key on
+ * `req.ip`, and on methods the PDS proxies they run before anything
+ * authenticates the request, so the token is verified here, ahead of the XRPC
+ * router.
+ */
+export declare function entrywayAttribution(relayTokenOpts: EntrywayRelayTokenOptions): express.RequestHandler;
+type EntrywayRelayTokenOptions = {
+    entrywayDid: string;
+    pdsDid: string;
+    key: KeyObject;
+};
+/**
+ * Verifies the relay token that the entryway attaches to the user requests it
+ * proxies, and returns the client IP address it attests to, in canonical form.
+ *
+ * @throws {EntrywayRelayTokenError} if the token is not valid
+ */
+export declare function verifyEntrywayRelayToken(token: string, opts: EntrywayRelayTokenOptions): Promise<string>;
+export {};
+//# sourceMappingURL=entryway-attribution.d.ts.map

package/dist/entryway-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entryway-attribution.d.ts","sourceRoot":"","sources":["../src/entryway-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,OAAO,MAAM,SAAS,CAAA;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAS1D,qBAAa,uBAAwB,SAAQ,KAAK;aAM9B,MAAM,EAAE,MAAM;IALhC;;;OAGG;IACH,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,CAAC,EAAE,YAAY,EAGvB;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,aAAc,cAAc,KAAG,OAIlE,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,yBAAyB,GACxC,OAAO,CAAC,cAAc,CA2BxB;AAED,KAAK,yBAAyB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,SAAS,CAAA;CACf,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/entryway-attribution.js

@@ -0,0 +1,101 @@
+import * as jose from 'jose';
+import { httpLogger } from './logger.js';
+import { canonicalIp } from './util/ip.js';
+const ENTRYWAY_RELAY_HEADER = 'x-entryway-relay';
+const ENTRYWAY_RELAY_TOKEN_MAX_LIFETIME_SEC = 2 * 60;
+const ENTRYWAY_RELAY_TOKEN_CLOCK_TOLERANCE_SEC = 30;
+export class EntrywayRelayTokenError extends Error {
+    /**
+     * @param reason Why the token was refused, as a short code (such as jose's
+     * error code) so that logging it reveals nothing of the token or the client.
+     */
+    constructor(reason, options) {
+        super(`Invalid entryway relay token: ${reason}`, options);
+        this.reason = reason;
+    }
+}
+/**
+ * Rate limit bypass for requests the entryway makes with its service JWT.
+ * Routes authenticate requests before applying rate limits, so this relies on
+ * the route having accepted the token rather than verifying it again.
+ */
+export const entrywayRateLimitBypass = ({ auth }) => {
+    if (!auth)
+        return false;
+    const credentials = auth.credentials;
+    return credentials?.type === 'entryway_service';
+};
+/**
+ * Attributes the user requests the entryway proxies to the users rather than
+ * to the entryway, by the relay token it signs. The rate limiters key on
+ * `req.ip`, and on methods the PDS proxies they run before anything
+ * authenticates the request, so the token is verified here, ahead of the XRPC
+ * router.
+ */
+export function entrywayAttribution(relayTokenOpts) {
+    return async (req, res, next) => {
+        const relayToken = req.headers[ENTRYWAY_RELAY_HEADER];
+        if (typeof relayToken === 'string') {
+            try {
+                const clientIp = await verifyEntrywayRelayToken(relayToken, relayTokenOpts);
+                // Shadows express's "ip" getter so that everything reading req.ip
+                // (rate limit keys, x-forwarded-for to the entryway) sees the client.
+                Object.defineProperty(req, 'ip', {
+                    value: clientIp,
+                    configurable: true,
+                    enumerable: true,
+                });
+            }
+            catch (err) {
+                // Never fatal: the request stays attributed to its actual source. Only
+                // the reason is logged, as the token itself carries the client's IP.
+                const reason = err instanceof EntrywayRelayTokenError ? err.reason : 'error';
+                httpLogger.debug({ reason }, 'ignoring invalid entryway relay token');
+            }
+        }
+        next();
+    };
+}
+/**
+ * Verifies the relay token that the entryway attaches to the user requests it
+ * proxies, and returns the client IP address it attests to, in canonical form.
+ *
+ * @throws {EntrywayRelayTokenError} if the token is not valid
+ */
+export async function verifyEntrywayRelayToken(token, opts) {
+    return jose
+        .jwtVerify(token, opts.key, {
+        algorithms: ['ES256K'],
+        // Pinned so that access tokens ("at+jwt") are refused
+        typ: 'JWT',
+        issuer: opts.entrywayDid,
+        audience: opts.pdsDid,
+        requiredClaims: ['iat', 'exp', 'client_ip'],
+        // Also refuses an "iat" in the future
+        maxTokenAge: ENTRYWAY_RELAY_TOKEN_MAX_LIFETIME_SEC,
+        clockTolerance: ENTRYWAY_RELAY_TOKEN_CLOCK_TOLERANCE_SEC,
+    })
+        .then(checkEntrywayRelayClaims, (err) => {
+        const reason = err instanceof jose.errors.JOSEError ? err.code : 'error';
+        throw new EntrywayRelayTokenError(reason, { cause: err });
+    });
+}
+// Checks what jwtVerify() does not: "lxm" is refused so that a relay token and
+// a service JWT can never stand in for each other, and "exp" may be at most 120
+// seconds after "iat". Returns the attested client IP in canonical form.
+function checkEntrywayRelayClaims({ payload }) {
+    const { iat, exp, lxm, client_ip: clientIp } = payload;
+    if (lxm !== undefined) {
+        throw new EntrywayRelayTokenError('has_lxm');
+    }
+    // jwtVerify() made "iat" and "exp" required numbers
+    if (exp - iat > ENTRYWAY_RELAY_TOKEN_MAX_LIFETIME_SEC) {
+        throw new EntrywayRelayTokenError('bad_lifetime');
+    }
+    const ip = typeof clientIp === 'string' ? canonicalIp(clientIp) : null;
+    if (!ip) {
+        throw new EntrywayRelayTokenError('bad_client_ip');
+    }
+    return ip;
+}
+//# sourceMappingURL=entryway-attribution.js.map

package/dist/entryway-attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entryway-attribution.js","sourceRoot":"","sources":["../src/entryway-attribution.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEhD,MAAM,qCAAqC,GAAG,CAAC,GAAG,EAAE,CAAA;AACpD,MAAM,wCAAwC,GAAG,EAAE,CAAA;AAEnD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD;;;OAGG;IACH,YACkB,MAAc,EAC9B,OAAsB;QAEtB,KAAK,CAAC,iCAAiC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAA;sBAHzC,MAAM;IAIxB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,EAAE,IAAI,EAAkB,EAAW,EAAE;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAiC,CAAA;IAC1D,OAAO,WAAW,EAAE,IAAI,KAAK,kBAAkB,CAAA;AACjD,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,cAAyC;IAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;QACrD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,UAAU,EACV,cAAc,CACf,CAAA;gBACD,kEAAkE;gBAClE,sEAAsE;gBACtE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE;oBAC/B,KAAK,EAAE,QAAQ;oBACf,YAAY,EAAE,IAAI;oBAClB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,MAAM,GACV,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;gBAC/D,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,uCAAuC,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,IAA+B;IAE/B,OAAO,IAAI;SACR,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;QAC1B,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,sDAAsD;QACtD,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,IAAI,CAAC,WAAW;QACxB,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;QAC3C,sCAAsC;QACtC,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,wCAAwC;KACzD,CAAC;SACD,IAAI,CAAC,wBAAwB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,GAAG,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAA;QACxE,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;AACN,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,SAAS,wBAAwB,CAAC,EAAE,OAAO,EAAwB;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAC9C,CAAC;IACD,oDAAoD;IACpD,IAAI,GAAI,GAAG,GAAI,GAAG,qCAAqC,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAA;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,uBAAuB,CAAC,eAAe,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC","sourcesContent":["import type { KeyObject } from 'node:crypto'\nimport type express from 'express'\nimport * as jose from 'jose'\nimport type { HandlerContext } from '@atproto/xrpc-server'\nimport { httpLogger } from './logger.js'\nimport { canonicalIp } from './util/ip.js'\n\nconst ENTRYWAY_RELAY_HEADER = 'x-entryway-relay'\n\nconst ENTRYWAY_RELAY_TOKEN_MAX_LIFETIME_SEC = 2 * 60\nconst ENTRYWAY_RELAY_TOKEN_CLOCK_TOLERANCE_SEC = 30\n\nexport class EntrywayRelayTokenError extends Error {\n  /**\n   * @param reason Why the token was refused, as a short code (such as jose's\n   * error code) so that logging it reveals nothing of the token or the client.\n   */\n  constructor(\n    public readonly reason: string,\n    options?: ErrorOptions,\n  ) {\n    super(`Invalid entryway relay token: ${reason}`, options)\n  }\n}\n\n/**\n * Rate limit bypass for requests the entryway makes with its service JWT.\n * Routes authenticate requests before applying rate limits, so this relies on\n * the route having accepted the token rather than verifying it again.\n */\nexport const entrywayRateLimitBypass = ({ auth }: HandlerContext): boolean => {\n  if (!auth) return false\n  const credentials = auth.credentials as { type?: unknown }\n  return credentials?.type === 'entryway_service'\n}\n\n/**\n * Attributes the user requests the entryway proxies to the users rather than\n * to the entryway, by the relay token it signs. The rate limiters key on\n * `req.ip`, and on methods the PDS proxies they run before anything\n * authenticates the request, so the token is verified here, ahead of the XRPC\n * router.\n */\nexport function entrywayAttribution(\n  relayTokenOpts: EntrywayRelayTokenOptions,\n): express.RequestHandler {\n  return async (req, res, next) => {\n    const relayToken = req.headers[ENTRYWAY_RELAY_HEADER]\n    if (typeof relayToken === 'string') {\n      try {\n        const clientIp = await verifyEntrywayRelayToken(\n          relayToken,\n          relayTokenOpts,\n        )\n        // Shadows express's \"ip\" getter so that everything reading req.ip\n        // (rate limit keys, x-forwarded-for to the entryway) sees the client.\n        Object.defineProperty(req, 'ip', {\n          value: clientIp,\n          configurable: true,\n          enumerable: true,\n        })\n      } catch (err) {\n        // Never fatal: the request stays attributed to its actual source. Only\n        // the reason is logged, as the token itself carries the client's IP.\n        const reason =\n          err instanceof EntrywayRelayTokenError ? err.reason : 'error'\n        httpLogger.debug({ reason }, 'ignoring invalid entryway relay token')\n      }\n    }\n\n    next()\n  }\n}\n\ntype EntrywayRelayTokenOptions = {\n  entrywayDid: string\n  pdsDid: string\n  key: KeyObject\n}\n\n/**\n * Verifies the relay token that the entryway attaches to the user requests it\n * proxies, and returns the client IP address it attests to, in canonical form.\n *\n * @throws {EntrywayRelayTokenError} if the token is not valid\n */\nexport async function verifyEntrywayRelayToken(\n  token: string,\n  opts: EntrywayRelayTokenOptions,\n): Promise<string> {\n  return jose\n    .jwtVerify(token, opts.key, {\n      algorithms: ['ES256K'],\n      // Pinned so that access tokens (\"at+jwt\") are refused\n      typ: 'JWT',\n      issuer: opts.entrywayDid,\n      audience: opts.pdsDid,\n      requiredClaims: ['iat', 'exp', 'client_ip'],\n      // Also refuses an \"iat\" in the future\n      maxTokenAge: ENTRYWAY_RELAY_TOKEN_MAX_LIFETIME_SEC,\n      clockTolerance: ENTRYWAY_RELAY_TOKEN_CLOCK_TOLERANCE_SEC,\n    })\n    .then(checkEntrywayRelayClaims, (err) => {\n      const reason = err instanceof jose.errors.JOSEError ? err.code : 'error'\n      throw new EntrywayRelayTokenError(reason, { cause: err })\n    })\n}\n\n// Checks what jwtVerify() does not: \"lxm\" is refused so that a relay token and\n// a service JWT can never stand in for each other, and \"exp\" may be at most 120\n// seconds after \"iat\". Returns the attested client IP in canonical form.\nfunction checkEntrywayRelayClaims({ payload }: jose.JWTVerifyResult): string {\n  const { iat, exp, lxm, client_ip: clientIp } = payload\n  if (lxm !== undefined) {\n    throw new EntrywayRelayTokenError('has_lxm')\n  }\n  // jwtVerify() made \"iat\" and \"exp\" required numbers\n  if (exp! - iat! > ENTRYWAY_RELAY_TOKEN_MAX_LIFETIME_SEC) {\n    throw new EntrywayRelayTokenError('bad_lifetime')\n  }\n  const ip = typeof clientIp === 'string' ? canonicalIp(clientIp) : null\n  if (!ip) {\n    throw new EntrywayRelayTokenError('bad_client_ip')\n  }\n  return ip\n}\n"]}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,sBAAsB,CAAA;AAG7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAGjC,OAAO,OAAO,MAAM,SAAS,CAAA;AAG7B,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAInB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEjE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAOxC,OAAO,EACL,KAAK,SAAS,EACd,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AAEjD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,CACzC,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EACrC,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CACtC,CAAA;AAED,qBAAa,GAAI,YAAW,eAAe;IAClC,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,OAAO,CAAC,WAAW,CAAA;IACxB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAA;IAC3B,OAAO,CAAC,UAAU,CAAC,CAAgB;IAEnC,YAAY,IAAI,EAAE;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAA;KAAE,EAG9D;IAED,OAAa,OAAO,CAClB,GAAG,GAAE,iBAA6B,EAClC,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,GAAG,CAAC,CAId;IAED;;;OAGG;IACH,OAAa,GAAG,CAAC,EACf,GAAe,EACf,MAAM,EAAE,WAAW,EACnB,OAA+B,EAC/B,SAAqB,EACrB,SAAqB,GACtB,GAAE;QACD,GAAG,CAAC,EAAE,iBAAiB,CAAA;QACvB,MAAM,CAAC,EAAE,WAAW,CAAA;QACpB,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAA;QACnC;;;WAGG;QACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CrB;IAED,OAAa,MAAM,CACjB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,GAAG,CAAC,CA8Dd;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAQlC;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7B;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;CACF;eAEc,GAAG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,sBAAsB,CAAA;AAG7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAGjC,OAAO,OAAO,MAAM,SAAS,CAAA;AAG7B,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAInB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAMjE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAOxC,OAAO,EACL,KAAK,SAAS,EACd,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,KAAK,SAAS,MAAM,sBAAsB,CAAA;AAEjD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,CACzC,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EACrC,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CACtC,CAAA;AAED,qBAAa,GAAI,YAAW,eAAe;IAClC,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,OAAO,CAAC,WAAW,CAAA;IACxB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAA;IAC3B,OAAO,CAAC,UAAU,CAAC,CAAgB;IAEnC,YAAY,IAAI,EAAE;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAA;KAAE,EAG9D;IAED,OAAa,OAAO,CAClB,GAAG,GAAE,iBAA6B,EAClC,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,GAAG,CAAC,CAId;IAED;;;OAGG;IACH,OAAa,GAAG,CAAC,EACf,GAAe,EACf,MAAM,EAAE,WAAW,EACnB,OAA+B,EAC/B,SAAqB,EACrB,SAAqB,GACtB,GAAE;QACD,GAAG,CAAC,EAAE,iBAAiB,CAAA;QACvB,MAAM,CAAC,EAAE,WAAW,CAAA;QACpB,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAA;QACnC;;;WAGG;QACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CrB;IAED,OAAa,MAAM,CACjB,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,aAAa,EACtB,SAAS,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACrC,OAAO,CAAC,GAAG,CAAC,CA2Ed;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAQlC;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7B;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;CACF;eAEc,GAAG"}

package/dist/index.js

@@ -64,9 +64,11 @@ import { DAY, SECOND } from '@atproto/common';
 import { ResponseType, XRPCError, createServer, } from '@atproto/xrpc-server';
 import apiRoutes from './api/index.js';
 import * as authRoutes from './auth-routes.js';
+import { createPublicKeyObject } from './auth-verifier.js';
 import * as basicRoutes from './basic-routes.js';
 import { envToCfg, envToSecrets, readEnv, } from './config/index.js';
 import { AppContext } from './context.js';
+import { entrywayAttribution, entrywayRateLimitBypass, } from './entryway-attribution.js';
 import * as error from './error.js';
 import { loggerMiddleware, pdsLogger } from './logger.js';
 import { proxyHandler } from './pipethrough.js';
@@ -171,7 +173,7 @@ export class PDS {
                 }
                 return XRPCError.fromError(err);
             },
-            rateLimits: buildRateLimitsConfig(rateLimits, ctx.redisScratch),
+            rateLimits: buildRateLimitsConfig(rateLimits, ctx.redisScratch, cfg.entryway ? entrywayRateLimitBypass : undefined),
         });
         apiRoutes(server, ctx);
         const app = express();
@@ -184,6 +186,13 @@ export class PDS {
             ...getTrustedIps(cfg),
         ]);
         app.use(loggerMiddleware);
+        if (cfg.entryway) {
+            app.use(entrywayAttribution({
+                entrywayDid: cfg.entryway.did,
+                pdsDid: cfg.service.did,
+                key: createPublicKeyObject(cfg.entryway.jwtPublicKeyHex),
+            }));
+        }
         app.use(compression());
         app.use(authRoutes.createRouter(ctx)); // Before CORS
         app.use(cors({ maxAge: DAY / SECOND }));