@atproto/pds 0.5.55 → 0.5.56

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @atproto/pds
 
+## 0.5.56
+
+### Patch Changes
+
+- [#5846](https://github.com/bluesky-social/atproto/pull/5846) [`39d702c`](https://github.com/bluesky-social/atproto/commit/39d702c851d469d7340fc0c5946959063769f849) Thanks [@amckinley](https://github.com/amckinley)! - Add `PDS_ENTRYWAY_API_URL`, the URL this PDS uses for its own requests to the entryway, e.g. a local proxy that adds mTLS. It defaults to `PDS_ENTRYWAY_URL`, which remains the entryway's public URL: the OAuth issuer and the authorization server the PDS advertises.
+
+- [#5847](https://github.com/bluesky-social/atproto/pull/5847) [`0849c24`](https://github.com/bluesky-social/atproto/commit/0849c24d492a9286e90c1734f2483d6ed7423d73) Thanks [@amckinley](https://github.com/amckinley)! - Accept the entryway's service JWT on `com.atproto.server.createAccount` when the PDS runs behind an entryway, on the same terms as the other entryway-called routes (`lxm` `com.atproto.server.createAccount`, `aud` this PDS's service DID); a valid one bypasses rate limits. Behind an entryway, a bearer token on this route must be such a JWT: other bearer tokens are no longer verified as user service auth. Unauthenticated calls are still accepted, even with `PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH=true`, so that the entryway can start signing this call; enforcement under that setting follows in a later release, once it does. PDSes without entryway configuration are unaffected.
+
+- [#5845](https://github.com/bluesky-social/atproto/pull/5845) [`7f619af`](https://github.com/bluesky-social/atproto/commit/7f619aff86f452f1ac2320b6926d88a8968b319d) Thanks [@amckinley](https://github.com/amckinley)! - Attribute entryway traffic for rate limiting by signed tokens instead of by IP address. A request that a route authenticates with the entryway service JWT bypasses rate limits; routes that do not authenticate apply them as usual. A user request the entryway proxies may carry an `x-entryway-relay` token (ES256K, `typ: "JWT"`, issued by `PDS_ENTRYWAY_DID` for this PDS's service DID, no `lxm`, at most 120 seconds long, signed with the `PDS_ENTRYWAY_JWT_VERIFY_KEY_K256_PUBLIC_KEY_HEX` key); when it verifies, the request's IP address (`req.ip`) becomes the token's `client_ip`, in canonical form, so rate limits key on the end user. Invalid relay tokens are ignored and logged at debug level with a short reason code, and request logs redact the `x-entryway-relay` header. `com.atproto.admin.getSubjectStatus` now also accepts the entryway service JWT. `PDS_RATE_LIMIT_BYPASS_IPS` keeps working as before, and PDSes without entryway configuration are unaffected.
+
+- [#5844](https://github.com/bluesky-social/atproto/pull/5844) [`1033419`](https://github.com/bluesky-social/atproto/commit/103341946f8bdb2abb5409866b234ad17812f7b8) Thanks [@amckinley](https://github.com/amckinley)! - Accept short-lived service JWTs from the entryway on `com.atproto.admin.deleteAccount`, `com.atproto.admin.updateAccountHandle`, `com.atproto.admin.updateSubjectStatus` and `com.atproto.server.reserveSigningKey`. Tokens must be ES256K with `typ: "JWT"`, issued by `PDS_ENTRYWAY_DID` for this PDS's service DID, bound to the called method through `lxm`, live at most 5 minutes, and be signed with the `PDS_ENTRYWAY_JWT_VERIFY_KEY_K256_PUBLIC_KEY_HEX` key. Setting `PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH=true` makes these routes refuse the admin password and unauthenticated callers; `updateSubjectStatus` still accepts the moderation service. PDSes without entryway configuration are unaffected.
+
+- [#5852](https://github.com/bluesky-social/atproto/pull/5852) [`870a534`](https://github.com/bluesky-social/atproto/commit/870a5346d0e9374cb99e60bf88a98c27d3d34cfe) Thanks [@estrattonbailey](https://github.com/estrattonbailey)! - Increase the app.bsky.actor.putPreferences JSON request-body limit from 150 KiB to 300 KiB without changing the global PDS limit.
+
+- [#5762](https://github.com/bluesky-social/atproto/pull/5762) [`7a46712`](https://github.com/bluesky-social/atproto/commit/7a467120982d9ff1559afeb3a26989dad5877d17) Thanks [@haileyok](https://github.com/haileyok)! - Redact cookie and set-cookie headers in HTTP request and response logs.
+- Updated dependencies [[`ac78dcf`](https://github.com/bluesky-social/atproto/commit/ac78dcf2cba6505f822b6db093a14d489eee1c49), [`7a46712`](https://github.com/bluesky-social/atproto/commit/7a467120982d9ff1559afeb3a26989dad5877d17)]:
+  - @atproto/lex-cbor@0.1.10
+  - @atproto/common@0.8.10
+  - @atproto/repo@0.11.5
+  - @atproto/xrpc-server@0.13.10
+  - @atproto/aws@0.3.24
+  - @atproto/oauth-provider@0.25.6
+  - @atproto-labs/xrpc-utils@0.1.31
+
 ## 0.5.55
 
 ### Patch Changes

package/dist/api/app/bsky/actor/putPreferences.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"putPreferences.d.ts","sourceRoot":"","sources":["../../../../../src/api/app/bsky/actor/putPreferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAGvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAQxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAkDvD"}
+{"version":3,"file":"putPreferences.d.ts","sourceRoot":"","sources":["../../../../../src/api/app/bsky/actor/putPreferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAGvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAQxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAqDvD"}

package/dist/api/app/bsky/actor/putPreferences.js

@@ -15,6 +15,9 @@ export default function (server, ctx) {
                 permissions.assertRpc({ aud, lxm });
             },
         }),
+        opts: {
+            jsonLimit: 300 * 1024,
+        },
         handler: async ({ req, auth, input }) => {
             const { did } = auth.credentials;
             // If the request has a proxy header different from the bsky app view,

package/dist/api/app/bsky/actor/putPreferences.js.map

@@ -1 +1 @@
-{"version":3,"file":"putPreferences.js","sourceRoot":"","sources":["../../../../../src/api/app/bsky/actor/putPreferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,4BAA4B,CAAA;AAEnC,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAA;IAC3B,IAAI,CAAC,WAAW;QAAE,OAAM;IAExB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAClC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAA;gBAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBACzC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACrC,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;YAEhC,sEAAsE;YACtE,0DAA0D;YAC1D,8EAA8E;YAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAA;YAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC,GAAG,eAAe,EAAE,CAAC;gBAC9C,oEAAoE;gBACpE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;oBAC5B,GAAG;iBACJ,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAwB,EAAE,CAAA;YAClD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnC,kBAAkB,CAAC,IAAI,CAAC,IAAyB,CAAC,CAAA;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;gBAChE,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GACjB,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;gBAClC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAEtC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,UAAU,EAAE;oBACjE,aAAa;iBACd,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AccountPreference } from '../../../../actor-store/preference/reader.js'\nimport { isAccessFull } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { app } from '../../../../lexicons/index.js'\nimport {\n  bareDidFromProxyTo,\n  computeProxyTo,\n  pipethrough,\n} from '../../../../pipethrough.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { bskyAppView } = ctx\n  if (!bskyAppView) return\n\n  server.add(app.bsky.actor.putPreferences, {\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      authorize: (permissions, { req }) => {\n        const lxm = app.bsky.actor.putPreferences.$lxm\n        const aud = computeProxyTo(ctx, req, lxm)\n        permissions.assertRpc({ aud, lxm })\n      },\n    }),\n    handler: async ({ req, auth, input }) => {\n      const { did } = auth.credentials\n\n      // If the request has a proxy header different from the bsky app view,\n      // we need to proxy the request to the requested app view.\n      // @TODO This behavior should not be implemented as part of the XRPC framework\n      const lxm = app.bsky.actor.putPreferences.$lxm\n      const aud = computeProxyTo(ctx, req, lxm)\n      if (aud !== `${bskyAppView.did}#bsky_appview`) {\n        // Phase 1 of service auth updates: outbound JWT keeps bare-DID aud.\n        return pipethrough(ctx, req, {\n          iss: did,\n          aud: bareDidFromProxyTo(aud),\n          lxm,\n        })\n      }\n\n      const checkedPreferences: AccountPreference[] = []\n      for (const pref of input.body.preferences) {\n        if (typeof pref.$type === 'string') {\n          checkedPreferences.push(pref as AccountPreference)\n        } else {\n          throw new InvalidRequestError('Preference is missing a $type')\n        }\n      }\n\n      const hasAccessFull =\n        auth.credentials.type === 'access' &&\n        isAccessFull(auth.credentials.scope)\n\n      await ctx.actorStore.transact(did, async (actorTxn) => {\n        await actorTxn.pref.putPreferences(checkedPreferences, 'app.bsky', {\n          hasAccessFull,\n        })\n      })\n    },\n  })\n}\n"]}
+{"version":3,"file":"putPreferences.js","sourceRoot":"","sources":["../../../../../src/api/app/bsky/actor/putPreferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,4BAA4B,CAAA;AAEnC,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAA;IAC3B,IAAI,CAAC,WAAW;QAAE,OAAM;IAExB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAClC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAA;gBAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBACzC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACrC,CAAC;SACF,CAAC;QACF,IAAI,EAAE;YACJ,SAAS,EAAE,GAAG,GAAG,IAAI;SACtB;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YACtC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;YAEhC,sEAAsE;YACtE,0DAA0D;YAC1D,8EAA8E;YAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAA;YAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACzC,IAAI,GAAG,KAAK,GAAG,WAAW,CAAC,GAAG,eAAe,EAAE,CAAC;gBAC9C,oEAAoE;gBACpE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC3B,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;oBAC5B,GAAG;iBACJ,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAwB,EAAE,CAAA;YAClD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnC,kBAAkB,CAAC,IAAI,CAAC,IAAyB,CAAC,CAAA;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;gBAChE,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GACjB,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;gBAClC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAEtC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACpD,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,UAAU,EAAE;oBACjE,aAAa;iBACd,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AccountPreference } from '../../../../actor-store/preference/reader.js'\nimport { isAccessFull } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { app } from '../../../../lexicons/index.js'\nimport {\n  bareDidFromProxyTo,\n  computeProxyTo,\n  pipethrough,\n} from '../../../../pipethrough.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { bskyAppView } = ctx\n  if (!bskyAppView) return\n\n  server.add(app.bsky.actor.putPreferences, {\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      authorize: (permissions, { req }) => {\n        const lxm = app.bsky.actor.putPreferences.$lxm\n        const aud = computeProxyTo(ctx, req, lxm)\n        permissions.assertRpc({ aud, lxm })\n      },\n    }),\n    opts: {\n      jsonLimit: 300 * 1024,\n    },\n    handler: async ({ req, auth, input }) => {\n      const { did } = auth.credentials\n\n      // If the request has a proxy header different from the bsky app view,\n      // we need to proxy the request to the requested app view.\n      // @TODO This behavior should not be implemented as part of the XRPC framework\n      const lxm = app.bsky.actor.putPreferences.$lxm\n      const aud = computeProxyTo(ctx, req, lxm)\n      if (aud !== `${bskyAppView.did}#bsky_appview`) {\n        // Phase 1 of service auth updates: outbound JWT keeps bare-DID aud.\n        return pipethrough(ctx, req, {\n          iss: did,\n          aud: bareDidFromProxyTo(aud),\n          lxm,\n        })\n      }\n\n      const checkedPreferences: AccountPreference[] = []\n      for (const pref of input.body.preferences) {\n        if (typeof pref.$type === 'string') {\n          checkedPreferences.push(pref as AccountPreference)\n        } else {\n          throw new InvalidRequestError('Preference is missing a $type')\n        }\n      }\n\n      const hasAccessFull =\n        auth.credentials.type === 'access' &&\n        isAccessFull(auth.credentials.scope)\n\n      await ctx.actorStore.transact(did, async (actorTxn) => {\n        await actorTxn.pref.putPreferences(checkedPreferences, 'app.bsky', {\n          hasAccessFull,\n        })\n      })\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/admin/deleteAccount.js

@@ -1,7 +1,7 @@
 import { com } from '../../../../lexicons/index.js';
 export default function (server, ctx) {
     server.add(com.atproto.admin.deleteAccount, {
-        auth: ctx.authVerifier.adminToken,
+        auth: ctx.authVerifier.adminTokenOrEntrywayService,
         handler: async ({ input }) => {
             const { did } = input.body;
             // @NOTE Order matters here: first "unlink" the account by removing it

package/dist/api/com/atproto/admin/deleteAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"deleteAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/deleteAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE;QAC1C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;QACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAA;YAE1B,sEAAsE;YACtE,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;YAClD,CAAC;oBAAS,CAAC;gBACT,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.deleteAccount, {\n    auth: ctx.authVerifier.adminToken,\n    handler: async ({ input }) => {\n      const { did } = input.body\n\n      // @NOTE Order matters here: first \"unlink\" the account by removing it\n      // from the account manager database (\"source of truth\"), then notify the\n      // sequencer, and finally cleanup files from the file system.\n      await ctx.accountManager.deleteAccount(did)\n      try {\n        await ctx.sequencer.sequenceAccountDeletion(did)\n      } finally {\n        await ctx.actorStore.destroy(did)\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"deleteAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/deleteAccount.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE;QAC1C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,2BAA2B;QAClD,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAA;YAE1B,sEAAsE;YACtE,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;YAClD,CAAC;oBAAS,CAAC;gBACT,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.deleteAccount, {\n    auth: ctx.authVerifier.adminTokenOrEntrywayService,\n    handler: async ({ input }) => {\n      const { did } = input.body\n\n      // @NOTE Order matters here: first \"unlink\" the account by removing it\n      // from the account manager database (\"source of truth\"), then notify the\n      // sequencer, and finally cleanup files from the file system.\n      await ctx.accountManager.deleteAccount(did)\n      try {\n        await ctx.sequencer.sequenceAccountDeletion(did)\n      } finally {\n        await ctx.actorStore.destroy(did)\n      }\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/admin/getSubjectStatus.js

@@ -4,7 +4,7 @@ import { InvalidRequestError } from '@atproto/xrpc-server';
 import { com } from '../../../../lexicons/index.js';
 export default function (server, ctx) {
     server.add(com.atproto.admin.getSubjectStatus, {
-        auth: ctx.authVerifier.moderator,
+        auth: ctx.authVerifier.moderatorOrEntrywayService,
         handler: async ({ params }) => {
             const { did, uri, blob } = params;
             let body = null;

package/dist/api/com/atproto/admin/getSubjectStatus.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSubjectStatus.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/getSubjectStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAC7C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,SAAS;QAChC,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YACjC,IAAI,IAAI,GAA0D,IAAI,CAAA;YACtE,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,mBAAmB,CAC3B,0CAA0C,CAC3C,CAAA;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CACxD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAA;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,GAAG;wBACL,OAAO,EAAE;4BACP,KAAK,EAAE,oCAAoC;4BAC3C,GAAG,EAAE,GAAG;4BACR,GAAG,EAAE,IAAI;yBACV;wBACD,QAAQ;qBACT,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;gBAChC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAC/C,SAAS,CAAC,GAAG,EACb,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,GAAG,CAAC;oBACV,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC;oBAC/C,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC;iBAC5C,CAAC,CACL,CAAA;gBACD,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;oBACpB,IAAI,GAAG;wBACL,OAAO,EAAE;4BACP,KAAK,EAAE,4BAA4B;4BACnC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;4BACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;yBACpB;wBACD,QAAQ;qBACT,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;gBAClE,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,GAAG;wBACL,OAAO,EAAE;4BACP,KAAK,EAAE,gCAAgC;4BACvC,GAAG,EAAE,GAAG;yBACT;wBACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;qBAChC,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAA;YACtD,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;YAChE,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI;aACL,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { parseCid } from '@atproto/lex-data'\nimport { AtUri } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.getSubjectStatus, {\n    auth: ctx.authVerifier.moderator,\n    handler: async ({ params }) => {\n      const { did, uri, blob } = params\n      let body: com.atproto.admin.getSubjectStatus.$OutputBody | null = null\n      if (blob) {\n        if (!did) {\n          throw new InvalidRequestError(\n            'Must provide a did to request blob state',\n          )\n        }\n        const takedown = await ctx.actorStore.read(did, (store) =>\n          store.repo.blob.getBlobTakedownStatus(parseCid(blob)),\n        )\n        if (takedown) {\n          body = {\n            subject: {\n              $type: 'com.atproto.admin.defs#repoBlobRef',\n              did: did,\n              cid: blob,\n            },\n            takedown,\n          }\n        }\n      } else if (uri) {\n        const parsedUri = new AtUri(uri)\n        const [takedown, cid] = await ctx.actorStore.read(\n          parsedUri.did,\n          (store) =>\n            Promise.all([\n              store.record.getRecordTakedownStatus(parsedUri),\n              store.record.getCurrentRecordCid(parsedUri),\n            ]),\n        )\n        if (cid && takedown) {\n          body = {\n            subject: {\n              $type: 'com.atproto.repo.strongRef',\n              uri: parsedUri.toString(),\n              cid: cid.toString(),\n            },\n            takedown,\n          }\n        }\n      } else if (did) {\n        const status = await ctx.accountManager.getAccountAdminStatus(did)\n        if (status) {\n          body = {\n            subject: {\n              $type: 'com.atproto.admin.defs#repoRef',\n              did: did,\n            },\n            takedown: status.takedown,\n            deactivated: status.deactivated,\n          }\n        }\n      } else {\n        throw new InvalidRequestError('No provided subject')\n      }\n      if (body === null) {\n        throw new InvalidRequestError('Subject not found', 'NotFound')\n      }\n      return {\n        encoding: 'application/json' as const,\n        body,\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"getSubjectStatus.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/getSubjectStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;QAC7C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,0BAA0B;QACjD,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;YACjC,IAAI,IAAI,GAA0D,IAAI,CAAA;YACtE,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,mBAAmB,CAC3B,0CAA0C,CAC3C,CAAA;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CACxD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAA;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,GAAG;wBACL,OAAO,EAAE;4BACP,KAAK,EAAE,oCAAoC;4BAC3C,GAAG,EAAE,GAAG;4BACR,GAAG,EAAE,IAAI;yBACV;wBACD,QAAQ;qBACT,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA;gBAChC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAC/C,SAAS,CAAC,GAAG,EACb,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,GAAG,CAAC;oBACV,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,SAAS,CAAC;oBAC/C,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC;iBAC5C,CAAC,CACL,CAAA;gBACD,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;oBACpB,IAAI,GAAG;wBACL,OAAO,EAAE;4BACP,KAAK,EAAE,4BAA4B;4BACnC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;4BACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;yBACpB;wBACD,QAAQ;qBACT,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;gBAClE,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,GAAG;wBACL,OAAO,EAAE;4BACP,KAAK,EAAE,gCAAgC;4BACvC,GAAG,EAAE,GAAG;yBACT;wBACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;qBAChC,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAA;YACtD,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;YAChE,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI;aACL,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { parseCid } from '@atproto/lex-data'\nimport { AtUri } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.getSubjectStatus, {\n    auth: ctx.authVerifier.moderatorOrEntrywayService,\n    handler: async ({ params }) => {\n      const { did, uri, blob } = params\n      let body: com.atproto.admin.getSubjectStatus.$OutputBody | null = null\n      if (blob) {\n        if (!did) {\n          throw new InvalidRequestError(\n            'Must provide a did to request blob state',\n          )\n        }\n        const takedown = await ctx.actorStore.read(did, (store) =>\n          store.repo.blob.getBlobTakedownStatus(parseCid(blob)),\n        )\n        if (takedown) {\n          body = {\n            subject: {\n              $type: 'com.atproto.admin.defs#repoBlobRef',\n              did: did,\n              cid: blob,\n            },\n            takedown,\n          }\n        }\n      } else if (uri) {\n        const parsedUri = new AtUri(uri)\n        const [takedown, cid] = await ctx.actorStore.read(\n          parsedUri.did,\n          (store) =>\n            Promise.all([\n              store.record.getRecordTakedownStatus(parsedUri),\n              store.record.getCurrentRecordCid(parsedUri),\n            ]),\n        )\n        if (cid && takedown) {\n          body = {\n            subject: {\n              $type: 'com.atproto.repo.strongRef',\n              uri: parsedUri.toString(),\n              cid: cid.toString(),\n            },\n            takedown,\n          }\n        }\n      } else if (did) {\n        const status = await ctx.accountManager.getAccountAdminStatus(did)\n        if (status) {\n          body = {\n            subject: {\n              $type: 'com.atproto.admin.defs#repoRef',\n              did: did,\n            },\n            takedown: status.takedown,\n            deactivated: status.deactivated,\n          }\n        }\n      } else {\n        throw new InvalidRequestError('No provided subject')\n      }\n      if (body === null) {\n        throw new InvalidRequestError('Subject not found', 'NotFound')\n      }\n      return {\n        encoding: 'application/json' as const,\n        body,\n      }\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/admin/updateAccountHandle.js

@@ -4,7 +4,7 @@ export default function (server, ctx) {
     const { entrywayClient } = ctx;
     if (entrywayClient) {
         server.add(com.atproto.admin.updateAccountHandle, {
-            auth: ctx.authVerifier.adminToken,
+            auth: ctx.authVerifier.adminTokenOrEntrywayService,
             handler: async ({ input: { body } }) => {
                 const { did, handle } = await ctx.accountManager.validateHandleUpdate(body.did, body.handle, { allowAnyValid: true });
                 // the pds defers to the entryway for updating the handle in the user's

package/dist/api/com/atproto/admin/updateAccountHandle.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateAccountHandle.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountHandle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;YACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,oBAAoB,CACnE,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,MAAM,EACX,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAA;gBAED,uEAAuE;gBACvE,0DAA0D;gBAC1D,6BAA6B;gBAC7B,EAAE;gBACF,oEAAoE;gBACpE,4EAA4E;gBAC5E,EAAE;gBACF,0EAA0E;gBAC1E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG;qBACjC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC;qBAC7B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBAEzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAClC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;gBAChE,CAAC;gBAED,MAAM,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;YACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBACrC,MAAM,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;oBAC3D,aAAa,EAAE,IAAI;iBACpB,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  if (entrywayClient) {\n    server.add(com.atproto.admin.updateAccountHandle, {\n      auth: ctx.authVerifier.adminToken,\n      handler: async ({ input: { body } }) => {\n        const { did, handle } = await ctx.accountManager.validateHandleUpdate(\n          body.did,\n          body.handle,\n          { allowAnyValid: true },\n        )\n\n        // the pds defers to the entryway for updating the handle in the user's\n        // did doc. here was just check that the handle is already\n        // bidirectionally confirmed.\n        //\n        // -> entryway(identity.updateHandle) [update handle, submit plc op]\n        // -> pds(admin.updateAccountHandle)  [track handle, sequence handle update]\n        //\n        // @TODO if handle is taken according to this PDS, should we force-update?\n        const doc = await ctx.idResolver.did\n          .resolveAtprotoData(did, true)\n          .catch(() => undefined)\n\n        if (!doc || doc.handle !== handle) {\n          throw new InvalidRequestError('Handle does not match DID doc')\n        }\n\n        await ctx.accountManager.updateAccountHandle(did, handle)\n      },\n    })\n  } else {\n    server.add(com.atproto.admin.updateAccountHandle, {\n      auth: ctx.authVerifier.adminToken,\n      handler: async ({ input: { body } }) => {\n        await ctx.accountManager.updateHandle(body.did, body.handle, {\n          allowAnyValid: true,\n        })\n      },\n    })\n  }\n}\n"]}
+{"version":3,"file":"updateAccountHandle.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateAccountHandle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,2BAA2B;YAClD,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,oBAAoB,CACnE,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,MAAM,EACX,EAAE,aAAa,EAAE,IAAI,EAAE,CACxB,CAAA;gBAED,uEAAuE;gBACvE,0DAA0D;gBAC1D,6BAA6B;gBAC7B,EAAE;gBACF,oEAAoE;gBACpE,4EAA4E;gBAC5E,EAAE;gBACF,0EAA0E;gBAC1E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG;qBACjC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC;qBAC7B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBAEzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAClC,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;gBAChE,CAAC;gBAED,MAAM,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3D,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAChD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,UAAU;YACjC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBACrC,MAAM,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;oBAC3D,aAAa,EAAE,IAAI;iBACpB,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  if (entrywayClient) {\n    server.add(com.atproto.admin.updateAccountHandle, {\n      auth: ctx.authVerifier.adminTokenOrEntrywayService,\n      handler: async ({ input: { body } }) => {\n        const { did, handle } = await ctx.accountManager.validateHandleUpdate(\n          body.did,\n          body.handle,\n          { allowAnyValid: true },\n        )\n\n        // the pds defers to the entryway for updating the handle in the user's\n        // did doc. here was just check that the handle is already\n        // bidirectionally confirmed.\n        //\n        // -> entryway(identity.updateHandle) [update handle, submit plc op]\n        // -> pds(admin.updateAccountHandle)  [track handle, sequence handle update]\n        //\n        // @TODO if handle is taken according to this PDS, should we force-update?\n        const doc = await ctx.idResolver.did\n          .resolveAtprotoData(did, true)\n          .catch(() => undefined)\n\n        if (!doc || doc.handle !== handle) {\n          throw new InvalidRequestError('Handle does not match DID doc')\n        }\n\n        await ctx.accountManager.updateAccountHandle(did, handle)\n      },\n    })\n  } else {\n    server.add(com.atproto.admin.updateAccountHandle, {\n      auth: ctx.authVerifier.adminToken,\n      handler: async ({ input: { body } }) => {\n        await ctx.accountManager.updateHandle(body.did, body.handle, {\n          allowAnyValid: true,\n        })\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/admin/updateSubjectStatus.js

@@ -4,7 +4,7 @@ import { InvalidRequestError } from '@atproto/xrpc-server';
 import { com } from '../../../../lexicons/index.js';
 export default function (server, ctx) {
     server.add(com.atproto.admin.updateSubjectStatus, {
-        auth: ctx.authVerifier.moderator,
+        auth: ctx.authVerifier.moderatorOrEntrywayService,
         handler: async ({ input }) => {
             const { subject, takedown, deactivated } = input.body;
             if (takedown?.applied && deactivated != null && !deactivated.applied) {

package/dist/api/com/atproto/admin/updateSubjectStatus.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateSubjectStatus.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateSubjectStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAChD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,SAAS;QAChC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAA;YAErD,IAAI,QAAQ,EAAE,OAAO,IAAI,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAC3B,0DAA0D,CAC3D,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBACjE,CAAC;qBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAClC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACrD,MAAM,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;oBAC9D,CAAC,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACzD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EACrB,QAAQ,CACT,CAAA;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;wBACxB,MAAM,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACzD,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACvD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,UAAU;YACV,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,OAAO;oBACP,QAAQ;iBACT;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { parseCid } from '@atproto/lex-data'\nimport { AtUri } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.updateSubjectStatus, {\n    auth: ctx.authVerifier.moderator,\n    handler: async ({ input }) => {\n      const { subject, takedown, deactivated } = input.body\n\n      if (takedown?.applied && deactivated != null && !deactivated.applied) {\n        throw new InvalidRequestError(\n          `Cannot activate and takedown an account at the same time`,\n        )\n      }\n\n      if (takedown) {\n        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {\n          await ctx.accountManager.takedownAccount(subject.did, takedown)\n        } else if (com.atproto.repo.strongRef.$isTypeOf(subject)) {\n          const uri = new AtUri(subject.uri)\n          await ctx.actorStore.transact(uri.did, async (store) => {\n            await store.record.updateRecordTakedownStatus(uri, takedown)\n          })\n        } else if (com.atproto.admin.defs.repoBlobRef.$isTypeOf(subject)) {\n          await ctx.actorStore.transact(subject.did, async (store) => {\n            await store.repo.blob.updateBlobTakedownStatus(\n              parseCid(subject.cid),\n              takedown,\n            )\n          })\n        } else {\n          throw new InvalidRequestError(`Invalid subject (${subject.$type})`)\n        }\n      }\n\n      if (deactivated) {\n        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {\n          if (deactivated.applied) {\n            await ctx.accountManager.deactivateAccount(subject.did)\n          } else {\n            await ctx.accountManager.activateAccount(subject.did)\n          }\n        }\n      }\n\n      // @NOTE accountManager will sequence an account status when updating the\n      // status, so we don't *need* to sequence the account status here.\n      // However, this endpoint historically has always sequenced the account\n      // status.\n      if (!takedown && !deactivated) {\n        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {\n          await ctx.accountManager.sequenceAccountStatus(subject.did)\n        }\n      }\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          subject,\n          takedown,\n        },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"updateSubjectStatus.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/updateSubjectStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AAEvE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE;QAChD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,0BAA0B;QACjD,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAA;YAErD,IAAI,QAAQ,EAAE,OAAO,IAAI,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACrE,MAAM,IAAI,mBAAmB,CAC3B,0DAA0D,CAC3D,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBACjE,CAAC;qBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAClC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACrD,MAAM,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;oBAC9D,CAAC,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACzD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EACrB,QAAQ,CACT,CAAA;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;wBACxB,MAAM,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACzD,CAAC;yBAAM,CAAC;wBACN,MAAM,GAAG,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACvD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,UAAU;YACV,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC7D,CAAC;YACH,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,OAAO;oBACP,QAAQ;iBACT;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { parseCid } from '@atproto/lex-data'\nimport { AtUri } from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.admin.updateSubjectStatus, {\n    auth: ctx.authVerifier.moderatorOrEntrywayService,\n    handler: async ({ input }) => {\n      const { subject, takedown, deactivated } = input.body\n\n      if (takedown?.applied && deactivated != null && !deactivated.applied) {\n        throw new InvalidRequestError(\n          `Cannot activate and takedown an account at the same time`,\n        )\n      }\n\n      if (takedown) {\n        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {\n          await ctx.accountManager.takedownAccount(subject.did, takedown)\n        } else if (com.atproto.repo.strongRef.$isTypeOf(subject)) {\n          const uri = new AtUri(subject.uri)\n          await ctx.actorStore.transact(uri.did, async (store) => {\n            await store.record.updateRecordTakedownStatus(uri, takedown)\n          })\n        } else if (com.atproto.admin.defs.repoBlobRef.$isTypeOf(subject)) {\n          await ctx.actorStore.transact(subject.did, async (store) => {\n            await store.repo.blob.updateBlobTakedownStatus(\n              parseCid(subject.cid),\n              takedown,\n            )\n          })\n        } else {\n          throw new InvalidRequestError(`Invalid subject (${subject.$type})`)\n        }\n      }\n\n      if (deactivated) {\n        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {\n          if (deactivated.applied) {\n            await ctx.accountManager.deactivateAccount(subject.did)\n          } else {\n            await ctx.accountManager.activateAccount(subject.did)\n          }\n        }\n      }\n\n      // @NOTE accountManager will sequence an account status when updating the\n      // status, so we don't *need* to sequence the account status here.\n      // However, this endpoint historically has always sequenced the account\n      // status.\n      if (!takedown && !deactivated) {\n        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {\n          await ctx.accountManager.sequenceAccountStatus(subject.did)\n        }\n      }\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          subject,\n          takedown,\n        },\n      }\n    },\n  })\n}\n"]}

package/dist/api/com/atproto/server/createAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAyHvD"}
+{"version":3,"file":"createAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwIvD"}

package/dist/api/com/atproto/server/createAccount.js

@@ -6,21 +6,32 @@ import { Secp256k1Keypair, } from '@atproto/crypto';
 import { ensureAtpDocument } from '@atproto/identity';
 import { AuthRequiredError, InvalidRequestError, } from '@atproto/xrpc-server';
 import { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js';
+import { bearerTokenFromReq } from '../../../../auth-verifier.js';
 import { events } from '../../../../events.js';
 import { baseNormalizeAndValidate } from '../../../../handle/index.js';
 import { com } from '../../../../lexicons/index.js';
 import { safeResolveDidDoc } from './util.js';
 export default function (server, ctx) {
+    // Like entrywayServiceOptional, but PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH does
+    // not apply yet: the entryway can only start signing createAccount once
+    // PDSes accept a signed call. Enforcement follows once it does.
+    const auth = ctx.cfg.entryway
+        ? (authCtx) => bearerTokenFromReq(authCtx.req) !== null
+            ? ctx.authVerifier.entrywayService(authCtx)
+            : ctx.authVerifier.unauthenticated(authCtx)
+        : ctx.authVerifier.userServiceAuthOptional;
     server.add(com.atproto.server.createAccount, {
         rateLimit: {
             durationMs: 5 * MINUTE,
             points: 100,
         },
-        auth: ctx.authVerifier.userServiceAuthOptional,
+        auth,
         handler: async ({ input, auth, req, }) => {
             // @NOTE Until this code and the OAuthStore's `createAccount` are
             // refactored together, any change made here must be reflected over there.
-            const requester = auth.credentials?.did ?? null;
+            const requester = auth.credentials?.type === 'user_service_auth'
+                ? auth.credentials.did
+                : null;
             const { did, handle, email, password, inviteCode, signingKey, plcOp, deactivated, } = ctx.entrywayClient
                 ? await validateInputsForEntrywayPds(ctx, input.body)
                 : await validateInputsForLocalPds(ctx, input.body, requester);

package/dist/api/com/atproto/server/createAccount.js.map

@@ -1 +1 @@
-{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth: ctx.authVerifier.userServiceAuthOptional,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester = auth.credentials?.did ?? null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  //\n  // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n  // email uniqueness across taken down and deactivated accounts as well, so we\n  // must check for them when surfacing handle availability.\n  const availability = { includeTakenDown: true, includeDeactivated: true }\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle, availability),\n    ctx.accountManager.getAccountByEmail(email, availability),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}
+{"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAMvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,IAAI,GAEN,GAAG,CAAC,GAAG,CAAC,QAAQ;QAClB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CACV,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YACtC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,uBAAuB,CAAA;IAE5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI;QACJ,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GACb,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,mBAAmB;gBAC5C,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;gBACtB,CAAC,CAAC,IAAI,CAAA;YACV,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n  type ExportableKeypair,\n  type Keypair,\n  Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n  AuthRequiredError,\n  InvalidRequestError,\n  type MethodAuthVerifier,\n  type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type {\n  EntrywayServiceOutput,\n  UnauthenticatedOutput,\n  UserServiceAuthOutput,\n} from '../../../../auth-output.js'\nimport { bearerTokenFromReq } from '../../../../auth-verifier.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  // Like entrywayServiceOptional, but PDS_ENTRYWAY_REQUIRE_SERVICE_AUTH does\n  // not apply yet: the entryway can only start signing createAccount once\n  // PDSes accept a signed call. Enforcement follows once it does.\n  const auth: MethodAuthVerifier<\n    EntrywayServiceOutput | UserServiceAuthOutput | UnauthenticatedOutput\n  > = ctx.cfg.entryway\n    ? (authCtx) =>\n        bearerTokenFromReq(authCtx.req) !== null\n          ? ctx.authVerifier.entrywayService(authCtx)\n          : ctx.authVerifier.unauthenticated(authCtx)\n    : ctx.authVerifier.userServiceAuthOptional\n\n  server.add(com.atproto.server.createAccount, {\n    rateLimit: {\n      durationMs: 5 * MINUTE,\n      points: 100,\n    },\n    auth,\n    handler: async ({\n      input,\n      auth,\n      req,\n    }): Promise<com.atproto.server.createAccount.$Output> => {\n      // @NOTE Until this code and the OAuthStore's `createAccount` are\n      // refactored together, any change made here must be reflected over there.\n\n      const requester =\n        auth.credentials?.type === 'user_service_auth'\n          ? auth.credentials.did\n          : null\n      const {\n        did,\n        handle,\n        email,\n        password,\n        inviteCode,\n        signingKey,\n        plcOp,\n        deactivated,\n      } = ctx.entrywayClient\n        ? await validateInputsForEntrywayPds(ctx, input.body)\n        : await validateInputsForLocalPds(ctx, input.body, requester)\n\n      await ctx.actorStore.create(did, signingKey)\n\n      try {\n        const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n          return actorTxn.repo.createRepo([])\n        })\n\n        const canTombstone =\n          // @NOTE IMPORTANT Because the user may be bringing their own did, we\n          // must make sure not to tombstone their did on failure if we didn't\n          // create it here.\n          !ctx.entrywayClient && !input.body.did && !!plcOp\n\n        // Generate a real did with PLC\n        if (plcOp) {\n          await ctx.plcClient.sendOperation(did, plcOp)\n        }\n\n        try {\n          const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n          const creds = await ctx.accountManager.createAccountAndSession({\n            did,\n            handle,\n            email,\n            password,\n            repoCid: commit.cid,\n            repoRev: commit.rev,\n            inviteCode,\n            deactivated,\n          })\n\n          try {\n            const sequenceEvt = !deactivated\n            if (sequenceEvt) {\n              await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n            }\n\n            try {\n              await ctx.actorStore\n                .clearReservedKeypair(signingKey.did(), did)\n                .catch((err) => {\n                  // @NOTE This is a cleanup operation so we won't fail the whole\n                  // flow if it fails, but we log it just in case\n                  req.log.error(\n                    { did, signingKeyDid: signingKey.did(), err },\n                    'Failed to clear reserved keypair',\n                  )\n                })\n\n              events.accountCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n                invited: !!inviteCode,\n                deactivated,\n              })\n              events.sessionCreated({\n                source: com.atproto.server.createAccount.$lxm,\n                did,\n              })\n\n              return {\n                encoding: 'application/json' as const,\n                body: {\n                  handle,\n                  did: did,\n                  // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n                  didDoc,\n                  accessJwt: creds.accessJwt,\n                  refreshJwt: creds.refreshJwt,\n                },\n              }\n            } catch (err) {\n              if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n              throw err\n            }\n          } catch (err) {\n            await ctx.accountManager.deleteAccount(did)\n            throw err\n          }\n        } catch (err) {\n          if (canTombstone) {\n            await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n          }\n          throw err\n        }\n      } catch (err) {\n        await ctx.actorStore.destroy(did)\n        throw err\n      }\n    },\n  })\n}\n\nconst validateInputsForEntrywayPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n) => {\n  const handle = baseNormalizeAndValidate(input.handle)\n\n  const { did, plcOp } = input\n  if (!did || !plcOp) {\n    throw new InvalidRequestError(\n      'non-entryway pds requires bringing a DID and plcOp',\n    )\n  }\n  if (!check.is(plcOp, plc.def.operation)) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n  if (!plcRotationKey || !plcOp.rotationKeys.includes(plcRotationKey)) {\n    throw new InvalidRequestError(\n      'PLC DID does not include service rotation key',\n      'IncompatibleDidDoc',\n    )\n  }\n  try {\n    await plc.assureValidOp(plcOp)\n    await plc.assureValidSig([plcRotationKey], plcOp)\n  } catch (err) {\n    throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n  }\n  const doc = plc.formatDidDoc({ did, ...plcOp })\n  const data = ensureAtpDocument(doc)\n\n  let signingKey: ExportableKeypair | undefined\n  if (input.did) {\n    signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n  }\n  if (!signingKey) {\n    signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n  }\n  if (!signingKey) {\n    throw new InvalidRequestError('reserved signing key does not exist')\n  }\n\n  validateAtprotoData(data, {\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signingKey: signingKey.did(),\n  })\n\n  return {\n    did,\n    handle,\n    email: undefined,\n    password: undefined,\n    inviteCode: undefined,\n    signingKey,\n    plcOp,\n    deactivated: false,\n  }\n}\n\nconst validateInputsForLocalPds = async (\n  ctx: AppContext,\n  input: com.atproto.server.createAccount.$InputBody,\n  requester: string | null,\n) => {\n  const { email, password, inviteCode } = input\n  if (input.plcOp) {\n    throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n  }\n\n  if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n    throw new InvalidRequestError(\n      `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n    )\n  }\n\n  if (ctx.cfg.invites.required && !inviteCode) {\n    throw new InvalidRequestError(\n      'No invite code provided',\n      'InvalidInviteCode',\n    )\n  }\n\n  if (!email) {\n    throw new InvalidRequestError('Email is required')\n  } else if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n    )\n  }\n\n  // normalize & ensure valid handle\n  const handle = await ctx.accountManager.normalizeAndValidateHandle(\n    input.handle,\n    { did: input.did },\n  )\n\n  // check that the invite code still has uses\n  if (ctx.cfg.invites.required && inviteCode) {\n    await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n  }\n\n  // check that the handle and email are available\n  //\n  // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n  // email uniqueness across taken down and deactivated accounts as well, so we\n  // must check for them when surfacing handle availability.\n  const availability = { includeTakenDown: true, includeDeactivated: true }\n  const [handleAccnt, emailAcct] = await Promise.all([\n    ctx.accountManager.getAccount(handle, availability),\n    ctx.accountManager.getAccountByEmail(email, availability),\n  ])\n  if (handleAccnt) {\n    throw new InvalidRequestError(`Handle already taken: ${handle}`)\n  } else if (emailAcct) {\n    throw new InvalidRequestError(`Email already taken: ${email}`)\n  }\n\n  // determine the did & any plc ops we need to send\n  // if the provided did document is poorly setup, we throw\n  const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n  let did: DidString\n  let plcOp: plc.Operation | null\n  let deactivated = false\n  if (input.did) {\n    if (input.did !== requester) {\n      throw new AuthRequiredError(\n        `Missing auth to create account with did: ${input.did}`,\n      )\n    }\n    did = input.did\n    plcOp = null\n    deactivated = true\n  } else {\n    const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n    did = formatted.did as DidString\n    plcOp = formatted.op\n  }\n\n  return {\n    did,\n    handle,\n    email,\n    password,\n    inviteCode,\n    signingKey,\n    plcOp,\n    deactivated,\n  }\n}\n\nconst formatDidAndPlcOp = async (\n  ctx: AppContext,\n  handle: string,\n  input: com.atproto.server.createAccount.$InputBody,\n  signingKey: Keypair,\n) => {\n  // if the user is not bringing a DID, then we format a create op for PLC\n  const rotationKeys = [ctx.plcRotationKey.did()]\n  if (ctx.cfg.identity.recoveryDidKey) {\n    rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n  }\n  if (input.recoveryKey) {\n    rotationKeys.unshift(input.recoveryKey)\n  }\n  return plc.createOp({\n    signingKey: signingKey.did(),\n    rotationKeys,\n    handle,\n    pds: ctx.cfg.service.publicUrl,\n    signer: ctx.plcRotationKey,\n  })\n}\nconst validateAtprotoData = (\n  data: AtprotoData,\n  expected: {\n    handle: string\n    pds: string\n    signingKey: string\n  },\n) => {\n  // if the user is bringing their own did:\n  // resolve the user's did doc data, including rotationKeys if did:plc\n  // determine if we have the capability to make changes to their DID\n  if (data.handle !== expected.handle) {\n    throw new InvalidRequestError(\n      'provided handle does not match DID document handle',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.pds !== expected.pds) {\n    throw new InvalidRequestError(\n      'DID document pds endpoint does not match service endpoint',\n      'IncompatibleDidDoc',\n    )\n  } else if (data.signingKey !== expected.signingKey) {\n    throw new InvalidRequestError(\n      'DID document signing key does not match service signing key',\n      'IncompatibleDidDoc',\n    )\n  }\n}\n"]}

package/dist/api/com/atproto/server/reserveSigningKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reserveSigningKey.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAUvD"}
+{"version":3,"file":"reserveSigningKey.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAavD"}

package/dist/api/com/atproto/server/reserveSigningKey.js

@@ -1,6 +1,9 @@
 import { com } from '../../../../lexicons/index.js';
 export default function (server, ctx) {
     server.add(com.atproto.server.reserveSigningKey, {
+        auth: ctx.cfg.entryway
+            ? ctx.authVerifier.entrywayServiceOptional
+            : undefined,
         handler: async ({ input }) => {
             const signingKey = await ctx.actorStore.reserveKeypair(input.body.did);
             return {

package/dist/api/com/atproto/server/reserveSigningKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"reserveSigningKey.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;QAC/C,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtE,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.reserveSigningKey, {\n    handler: async ({ input }) => {\n      const signingKey = await ctx.actorStore.reserveKeypair(input.body.did)\n      return {\n        encoding: 'application/json' as const,\n        body: { signingKey },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"reserveSigningKey.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/reserveSigningKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ;YACpB,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,uBAAuB;YAC1C,CAAC,CAAC,SAAS;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtE,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,EAAE,UAAU,EAAE;aACrB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.reserveSigningKey, {\n    auth: ctx.cfg.entryway\n      ? ctx.authVerifier.entrywayServiceOptional\n      : undefined,\n    handler: async ({ input }) => {\n      const signingKey = await ctx.actorStore.reserveKeypair(input.body.did)\n      return {\n        encoding: 'application/json' as const,\n        body: { signingKey },\n      }\n    },\n  })\n}\n"]}

package/dist/auth-output.d.ts

@@ -15,6 +15,12 @@ export type ModServiceOutput = {
         did: DidString;
     };
 };
+export type EntrywayServiceOutput = {
+    credentials: {
+        type: 'entryway_service';
+        did: DidString;
+    };
+};
 export type AccessOutput<S extends AuthScope = AuthScope> = {
     credentials: {
         type: 'access';

package/dist/auth-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-output.d.ts","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;QACnB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC1D,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAA;QACd,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,CAAC,CAAA;KACT,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE;QACX,IAAI,EAAE,OAAO,CAAA;QACb,GAAG,EAAE,SAAS,CAAA;QACd,WAAW,EAAE,gBAAgB,CAAA;KAC9B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,SAAS,CAAA;QACf,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,SAAS,CAAC,OAAO,CAAA;QACxB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAA;QACzB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA"}
+{"version":3,"file":"auth-output.d.ts","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,IAAI,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE;QACX,IAAI,EAAE,aAAa,CAAA;QACnB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,kBAAkB,CAAA;QACxB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC1D,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAA;QACd,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,CAAC,CAAA;KACT,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE;QACX,IAAI,EAAE,OAAO,CAAA;QACb,GAAG,EAAE,SAAS,CAAA;QACd,WAAW,EAAE,gBAAgB,CAAA;KAC9B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE;QACX,IAAI,EAAE,SAAS,CAAA;QACf,GAAG,EAAE,SAAS,CAAA;QACd,KAAK,EAAE,SAAS,CAAC,OAAO,CAAA;QACxB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE;QACX,IAAI,EAAE,mBAAmB,CAAA;QACzB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA"}

package/dist/auth-output.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"","sourcesContent":["import type { ScopePermissions } from '@atproto/oauth-scopes'\nimport type { DidString } from '@atproto/syntax'\nimport type { AuthScope } from './auth-scope.js'\n\nexport type UnauthenticatedOutput = {\n  credentials: null\n}\n\nexport type AdminTokenOutput = {\n  credentials: {\n    type: 'admin_token'\n  }\n}\n\nexport type ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    did: DidString\n  }\n}\n\nexport type AccessOutput<S extends AuthScope = AuthScope> = {\n  credentials: {\n    type: 'access'\n    did: DidString\n    scope: S\n  }\n}\n\nexport type OAuthOutput = {\n  credentials: {\n    type: 'oauth'\n    did: DidString\n    permissions: ScopePermissions\n  }\n}\n\nexport type RefreshOutput = {\n  credentials: {\n    type: 'refresh'\n    did: DidString\n    scope: AuthScope.Refresh\n    tokenId: string\n  }\n}\n\nexport type UserServiceAuthOutput = {\n  credentials: {\n    type: 'user_service_auth'\n    did: DidString\n  }\n}\n"]}
+{"version":3,"file":"auth-output.js","sourceRoot":"","sources":["../src/auth-output.ts"],"names":[],"mappings":"","sourcesContent":["import type { ScopePermissions } from '@atproto/oauth-scopes'\nimport type { DidString } from '@atproto/syntax'\nimport type { AuthScope } from './auth-scope.js'\n\nexport type UnauthenticatedOutput = {\n  credentials: null\n}\n\nexport type AdminTokenOutput = {\n  credentials: {\n    type: 'admin_token'\n  }\n}\n\nexport type ModServiceOutput = {\n  credentials: {\n    type: 'mod_service'\n    did: DidString\n  }\n}\n\nexport type EntrywayServiceOutput = {\n  credentials: {\n    type: 'entryway_service'\n    did: DidString\n  }\n}\n\nexport type AccessOutput<S extends AuthScope = AuthScope> = {\n  credentials: {\n    type: 'access'\n    did: DidString\n    scope: S\n  }\n}\n\nexport type OAuthOutput = {\n  credentials: {\n    type: 'oauth'\n    did: DidString\n    permissions: ScopePermissions\n  }\n}\n\nexport type RefreshOutput = {\n  credentials: {\n    type: 'refresh'\n    did: DidString\n    scope: AuthScope.Refresh\n    tokenId: string\n  }\n}\n\nexport type UserServiceAuthOutput = {\n  credentials: {\n    type: 'user_service_auth'\n    did: DidString\n  }\n}\n"]}

package/dist/auth-verifier.d.ts

@@ -1,5 +1,5 @@
 import { type KeyObject } from 'node:crypto';
-import type { IncomingMessage } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import * as jose from 'jose';
 import { type IdResolver } from '@atproto/identity';
 import { type AtIdentifierString, type DidString } from '@atproto/lex-schema';
@@ -8,7 +8,7 @@ import { type ScopePermissions } from '@atproto/oauth-scopes';
 import { type Awaitable, type MethodAuthContext, type MethodAuthVerifier, type Params } from '@atproto/xrpc-server';
 import type { AccountManager } from './account-manager/account-manager.js';
 import type { ActorAccount } from './account-manager/helpers/account.js';
-import type { AccessOutput, AdminTokenOutput, ModServiceOutput, OAuthOutput, RefreshOutput, UnauthenticatedOutput, UserServiceAuthOutput } from './auth-output.js';
+import type { AccessOutput, AdminTokenOutput, EntrywayServiceOutput, ModServiceOutput, OAuthOutput, RefreshOutput, UnauthenticatedOutput, UserServiceAuthOutput } from './auth-output.js';
 import { AuthScope } from './auth-scope.js';
 import type { WithRequired } from './util/types.js';
 export type VerifiedOptions = {
@@ -33,6 +33,11 @@ export type AuthVerifierOpts = {
         entryway?: string;
         modService?: string;
     };
+    entrywayServiceAuth?: {
+        /** did:key form of the entryway's JWT verify key */
+        didKey: string;
+        required: boolean;
+    };
 };
 export type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> = WithRequired<Omit<jose.JWTVerifyOptions, 'scopes'> & {
     scopes: readonly S[];
@@ -50,6 +55,7 @@ export declare class AuthVerifier {
     private _publicUrl;
     private _jwtKey;
     private _adminPass;
+    private _entrywayServiceAuth;
     dids: AuthVerifierOpts['dids'];
     constructor(accountManager: AccountManager, idResolver: IdResolver, oauthVerifier: OAuthVerifier, opts: AuthVerifierOpts);
     unauthenticated: MethodAuthVerifier<UnauthenticatedOutput>;
@@ -58,6 +64,10 @@ export declare class AuthVerifier {
     modService: MethodAuthVerifier<ModServiceOutput>;
     /** @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. */
     moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput>;
+    entrywayService: MethodAuthVerifier<EntrywayServiceOutput>;
+    entrywayServiceOptional: MethodAuthVerifier<EntrywayServiceOutput | UnauthenticatedOutput>;
+    adminTokenOrEntrywayService: MethodAuthVerifier<AdminTokenOutput | EntrywayServiceOutput>;
+    moderatorOrEntrywayService: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput | EntrywayServiceOutput>;
     protected access<S extends AuthScope>(options: VerifiedOptions & Required<ScopedOptions<S>>): MethodAuthVerifier<AccessOutput<S>>;
     refresh(options?: {
         allowExpired?: boolean;
@@ -90,6 +100,15 @@ export declare class AuthVerifier {
         lxm?: string;
         jti?: string;
     }>;
+    protected verifyEntrywayServiceJwt(req: IncomingMessage): Promise<{
+        iss: DidString | `${DidString}#${string}`;
+        aud: string;
+        exp: number;
+        lxm?: string;
+        jti?: string;
+    }>;
+    protected isEntrywayIssuedJwt(req: IncomingMessage): boolean;
+    protected assertEntrywayServiceAuthNotRequired(res: ServerResponse): void;
 }
 export declare function isUserOrAdmin(auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput, did: string): boolean;
 export declare const bearerTokenFromReq: (req: IncomingMessage) => string | null;

package/dist/auth-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAMvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,OAAO,EAAE,KAAK,SAAS,EAAE,CAAA;AAEzB,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAa5D,CAAA"}
+{"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAA;AAK5B,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,mBAAmB,CAAC,EAAE;QACpB,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,OAAO,CAAA;KAClB,CAAA;CACF,CAAA;AAKD,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAQd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IATrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,oBAAoB,CAAyC;IAC9D,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAOvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEI,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAMA;IAEM,2BAA2B,EAAE,kBAAkB,CACpD,gBAAgB,GAAG,qBAAqB,CACzC,CASA;IAEM,0BAA0B,EAAE,kBAAkB,CACnD,gBAAgB,GAAG,gBAAgB,GAAG,qBAAqB,CAC5D,CAQA;IAED,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;IAED,UAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe;;;;;;OAiD5D;IAED,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAU3D;IAED,SAAS,CAAC,oCAAoC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAKxE;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,OAAO,EAAE,KAAK,SAAS,EAAE,CAAA;AAEzB,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAa5D,CAAA"}