@tempoxyz/auth 0.0.0-pr-19.sha-2c8fa8e → 0.0.0-pr-22.sha-291bbcb

package/dist/Actions.js

@@ -1,12 +1,16 @@
 /**
- * Tempo Auth's actions. Each takes an instance from `Auth.create`.
+ * Tempo Auth's actions. Each takes an instance from `Auth.create`. Each sign-in flow has its own
+ * namespace, and the actions every flow shares sit at the top level.
  * @module
  */
-import { Base64, Bytes, Hash, Hex } from 'ox';
 import { Secp256k1 } from 'viem/tempo';
-import { RequestError, } from './Auth.js';
-import * as Key from './Key.js';
+import * as Api from './internal/api.js';
 import { request } from './internal/request.js';
+export * as device from './actions/device.js';
+export * as email from './actions/email.js';
+export * as provider from './actions/provider.js';
+export * as redirect from './actions/redirect.js';
+export * as tempoAccount from './actions/tempoAccount.js';
 /**
  * Authorizes the app for a user already signed in to Tempo Auth, from any app. Returns
  * `undefined` without a session, so the app shows sign-in. The key must fit Tempo Auth's headless
@@ -20,236 +24,20 @@ import { request } from './internal/request.js';
  */
 export async function authorize(auth, options) {
     // Checking the session first answers a visitor without one with no failed request.
-    const session = await json(await (auth.fetch ?? fetch)(new URL('/api/auth/session', auth.url), {
+    const session = await Api.json(await (auth.fetch ?? fetch)(new URL('/api/auth/session', auth.url), {
         credentials: 'include',
     }));
     if (!session.user)
         return undefined;
     const privateKey = Secp256k1.randomPrivateKey();
-    const response = await post(auth, '/api/authorize', {
+    const response = await Api.post(auth, '/api/authorize', {
         json: request(auth, { ...options, privateKey }),
     });
     if (response.status === 401)
         return undefined;
-    return authorization(await json(response), { privateKey });
-}
-/**
- * Starts the device grant for a CLI: the user approves `userCode` at `verificationUri` from any
- * browser, and `wait` resolves once they do.
- *
- * @example
- * ```ts
- * const device = await Actions.authorizeDevice(auth, { accessKey, device: Os.hostname() })
- * console.log(`Open ${device.verificationUriComplete}`)
- * const authorization = await device.wait()
- * ```
- */
-export async function authorizeDevice(auth, options) {
-    const privateKey = Secp256k1.randomPrivateKey();
-    const code = await json(await post(auth, '/api/device/authorize', {
-        json: {
-            device: options.device,
-            keyAuthorization: request(auth, { ...options, privateKey })
-                .keyAuthorization,
-        },
-    }));
-    /** Polls until the user approves or denies the code, or it expires. */
-    async function wait() {
-        let interval = code.interval;
-        const deadline = Date.now() + code.expires_in * 1000;
-        while (Date.now() < deadline) {
-            await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-            const response = await post(auth, '/api/device/token', {
-                json: { device_code: code.device_code },
-            });
-            const body = (await response.json());
-            if ('access_token' in body)
-                return authorization({
-                    account: body.account,
-                    keyAuthorization: body.key_authorization,
-                    tokens: tokens(body),
-                }, { privateKey });
-            // RFC 8628 asks a client told to slow down to add 5 seconds to its interval.
-            if (body.error === 'slow_down')
-                interval += 5;
-            else if (body.error !== 'authorization_pending')
-                throw new RequestError({
-                    message: `Sign-in failed: ${body.error}.`,
-                    status: response.status,
-                });
-        }
-        throw new RequestError({ message: 'The code expired.', status: 400 });
-    }
-    return {
-        expiresIn: code.expires_in,
-        userCode: code.user_code,
-        verificationUri: code.verification_uri,
-        verificationUriComplete: code.verification_uri_complete,
-        wait,
-    };
-}
-/**
- * Returns the URL that signs the user in on Tempo Auth's pages and redirects back with a code,
- * and the {@link Pending} state to keep until then, such as in a sealed cookie.
- * {@link handleCallback} redeems the code for the tokens and the key authorization.
- *
- * @example
- * ```ts
- * const { pending, url } = await Actions.createAuthorizationUrl(auth, {
- *   accessKey,
- *   redirectUri: 'https://app.example/auth/callback',
- * })
- * await seal(c, 'oauth', pending)
- * return c.redirect(url)
- * ```
- */
-export async function createAuthorizationUrl(auth, options) {
-    const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
-    const pending = {
-        privateKey: Secp256k1.randomPrivateKey(),
-        redirectUri,
-        // `Bytes.random` needs only `crypto.getRandomValues`, which React Native polyfills.
-        state: Base64.fromBytes(Bytes.random(16), base64url),
-        verifier: Base64.fromBytes(Bytes.random(32), base64url),
-    };
-    const { client_id, keyAuthorization, scope } = request(auth, {
-        accessKey: options.accessKey,
-        privateKey: pending.privateKey,
-    });
-    const url = new URL('/authorize', auth.url);
-    url.search = new URLSearchParams({
-        client_id,
-        code_challenge: Base64.fromBytes(Hash.sha256(Bytes.fromString(pending.verifier)), base64url),
-        key_authorization: Base64.fromString(JSON.stringify(keyAuthorization), base64url),
-        redirect_uri: redirectUri,
-        scope,
-        state: pending.state,
-    }).toString();
-    return { pending, url: url.href };
-}
-/**
- * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as an
- * access key's `account` to authorize keys on it.
- *
- * @example
- * ```ts
- * const tempoAccount = await Actions.createTempoAccount(auth)
- * await Actions.authorize(auth, {
- *   accessKey: { ...accessKey, account: tempoAccount.address },
- * })
- * ```
- */
-export async function createTempoAccount(auth) {
-    const { address } = await json(await post(auth, '/api/account/tempo', { json: {} }));
-    return { address };
-}
-/**
- * Lists the OAuth providers Tempo Auth offers, for an app that shows its own sign-in buttons.
- *
- * @example
- * ```ts
- * const providers = await Actions.getProviders(auth)
- * // [{ id: 'google', name: 'Google' }]
- * ```
- */
-export async function getProviders(auth) {
-    const { providers } = await json(await (auth.fetch ?? fetch)(new URL('/api/auth/providers', auth.url)));
-    return providers;
-}
-/**
- * Lists the signed-in user's Tempo Accounts, their default first.
- *
- * @example
- * ```ts
- * const [account, ...others] = await Actions.getTempoAccounts(auth)
- * ```
- */
-export async function getTempoAccounts(auth) {
-    const { tempo } = await json(await (auth.fetch ?? fetch)(new URL('/api/account', auth.url), {
-        credentials: 'include',
-    }));
-    return tempo.map(({ address }) => ({ address }));
-}
-/**
- * Finishes a sign-in redirect: checks its state, and redeems the code with the PKCE verifier (and
- * the client secret, for a backend) for the tokens and the key authorization.
- *
- * @example
- * ```ts
- * const authorization = await Actions.handleCallback(auth, {
- *   pending: await unseal(c, 'oauth'),
- *   url: c.req.url,
- * })
- * ```
- */
-export async function handleCallback(auth, options) {
-    const { pending } = options;
-    const params = new URL(options.url).searchParams;
-    const code = params.get('code');
-    if (!code || params.get('state') !== pending.state)
-        throw new RequestError({
-            message: 'Sign-in failed. Start again.',
-            status: 400,
-        });
-    const body = await token(auth, {
-        code,
-        code_verifier: pending.verifier,
-        grant_type: 'authorization_code',
-        redirect_uri: pending.redirectUri,
+    return Api.authorization(await Api.json(response), {
+        privateKey,
     });
-    if (!body.account || !body.key_authorization)
-        throw new RequestError({
-            message: 'Sign-in failed. Start again.',
-            status: 400,
-        });
-    return authorization({
-        account: body.account,
-        keyAuthorization: body.key_authorization,
-        tokens: body,
-    }, pending);
-}
-/**
- * Finishes a {@link redirect} when the page loads with Tempo Auth's callback, and returns
- * `undefined` otherwise. The code is redeemed once, however often the page calls this.
- *
- * @example
- * ```ts
- * const authorization =
- *   (await Actions.handleRedirect(auth)) ??
- *   (await Actions.authorize(auth, { accessKey }))
- * ```
- */
-export function handleRedirect(auth) {
-    redirected ??= (async () => {
-        const stored = storage(auth).getItem(storageKey);
-        storage(auth).removeItem(storageKey);
-        const url = new URL(window.location.href);
-        if (!url.searchParams.has('code'))
-            return undefined;
-        // The app keeps its own query and fragment, without the callback's parameters. A code this page
-        // did not request is dropped too, since it redeems for whoever crafted its request.
-        const clean = new URL(url);
-        for (const name of ['code', 'state'])
-            clean.searchParams.delete(name);
-        window.history.replaceState(null, '', clean.pathname + clean.search + clean.hash);
-        if (!stored)
-            return undefined;
-        return handleCallback(auth, { pending: JSON.parse(stored), url });
-    })();
-    return redirected;
-}
-/**
- * Sends the browser to Tempo Auth's pages to sign in, keeping the redirect's state in `storage`.
- *
- * @example
- * ```ts
- * await Actions.redirect(auth, { accessKey })
- * ```
- */
-export async function redirect(auth, options) {
-    const { pending, url } = await createAuthorizationUrl(auth, options);
-    storage(auth).setItem(storageKey, JSON.stringify(pending));
-    window.location.assign(url);
 }
 /**
  * Exchanges a refresh token for new tokens. Refresh tokens rotate, so store the new one.
@@ -262,38 +50,11 @@ export async function redirect(auth, options) {
  * ```
  */
 export async function refresh(auth, options) {
-    return tokens(await token(auth, {
+    return Api.tokens(await Api.token(auth, {
         grant_type: 'refresh_token',
         refresh_token: options.refreshToken,
     }));
 }
-/**
- * Emails the user a sign-in code. The response is the same for every address.
- *
- * @example
- * ```ts
- * await Actions.sendCode(auth, { email: 'user@example.com' })
- * ```
- */
-export async function sendCode(auth, options) {
-    await json(await post(auth, '/api/auth/code', { json: options }));
-}
-/**
- * Sends the browser to an OAuth provider, or to the SSO connection a {@link Step} names, and back to
- * `returnTo` signed in to Tempo Auth. The app then calls {@link authorize}.
- *
- * @example
- * ```ts
- * Actions.signIn(auth, { provider: 'google' })
- * ```
- */
-export function signIn(auth, options) {
-    const url = 'url' in options
-        ? new URL(options.url)
-        : new URL(`/api/auth/oauth/${options.provider}`, auth.url);
-    url.searchParams.set('return_to', options.returnTo ?? window.location.href);
-    window.location.assign(url);
-}
 /**
  * Ends the user's Tempo Auth session, which signs them out of every app that relies on it.
  *
@@ -304,104 +65,5 @@ export function signIn(auth, options) {
  */
 export async function signOut(auth) {
     // A JSON body keeps the request out of Tempo Auth's CSRF check for cross-site form posts.
-    await json(await post(auth, '/api/auth/logout', { json: {} }));
-}
-/**
- * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which {@link signIn} continues.
- *
- * @example
- * ```ts
- * const result = await Actions.verifyCode(auth, { accessKey, code, email })
- * if ('step' in result) Actions.signIn(auth, { url: result.step.url })
- * ```
- */
-export async function verifyCode(auth, options) {
-    const { accessKey, code, email } = options;
-    const privateKey = Secp256k1.randomPrivateKey();
-    const body = await json(await post(auth, '/api/auth/code/verify', {
-        json: {
-            authorize: request(auth, { accessKey, privateKey }),
-            code,
-            email,
-        },
-    }));
-    if ('step' in body)
-        return {
-            step: { ...body.step, url: new URL(body.step.url, auth.url).href },
-        };
-    return authorization(body.authorization, { privateKey });
-}
-/** Unpadded URL-safe Base64, as PKCE and `key_authorization` use. */
-const base64url = { pad: false, url: true };
-/** The redirect this page load returns from, so its code is redeemed once. */
-let redirected;
-/** Where a redirect keeps its state in `storage`. */
-const storageKey = 'tempo-auth:redirect';
-/** Builds an authorization from what Tempo Auth returned and the key the app generated. */
-function authorization(body, options) {
-    const key = {
-        account: body.account,
-        keyAuthorization: body.keyAuthorization,
-        privateKey: options.privateKey,
-    };
-    const tokens_ = 'accessToken' in body.tokens ? body.tokens : tokens(body.tokens);
-    const claims = JSON.parse(Base64.toString(tokens_.idToken.split('.')[1]));
-    return {
-        ...tokens_,
-        account: Key.toAccount(key),
-        key,
-        user: { email: claims.email, id: claims.sub },
-    };
-}
-/** Reads a JSON response, and throws a {@link RequestError} for a refused request. */
-async function json(response) {
-    // Some refusals, such as the CSRF check's, answer plain text.
-    const body = (await response.json().catch(() => ({})));
-    if (!response.ok)
-        throw new RequestError({
-            message: body.error ?? 'Something went wrong.',
-            status: response.status,
-        });
-    return body;
-}
-/** Posts JSON to Tempo Auth's API with the session cookie. */
-function post(auth, path, options) {
-    return (auth.fetch ?? fetch)(new URL(path, auth.url), {
-        ...(options.json === undefined
-            ? {}
-            : {
-                body: JSON.stringify(options.json),
-                headers: { 'content-type': 'application/json' },
-            }),
-        credentials: 'include',
-        method: 'POST',
-    });
-}
-/** Where a redirect keeps its state: the instance's `storage`, or the page's session storage. */
-function storage(auth) {
-    return auth.storage ?? sessionStorage;
-}
-/**
- * Calls Tempo Auth's OAuth token endpoint, adding the client and any secret. It forwards standard
- * OAuth form posts to WorkOS.
- */
-async function token(auth, body) {
-    return json(await (auth.fetch ?? fetch)(new URL('/oauth2/token', auth.url), {
-        body: new URLSearchParams({
-            ...body,
-            client_id: auth.clientId,
-            ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
-        }),
-        method: 'POST',
-    }));
-}
-/** Reads a token response into `Tokens`. */
-function tokens(response) {
-    return {
-        accessToken: response.access_token,
-        expiresAt: Date.now() + response.expires_in * 1000,
-        idToken: response.id_token,
-        refreshToken: response.refresh_token,
-    };
+    await Api.json(await Api.post(auth, '/api/auth/logout', { json: {} }));
 }

package/dist/Auth.d.ts

@@ -44,7 +44,7 @@ export type Auth = {
 };
 /** What an app's access key may do, as viem's `accessKey.signAuthorization` takes it. */
 export type AccessKey = Pick<KeyAuthorization.KeyAuthorization, 'limits' | 'scopes'> & {
-    /** The user's Tempo Account the key acts for, from `getTempoAccounts`. Defaults to their first. */
+    /** The user's Tempo Account the key acts for, from `Actions.tempoAccount.list`. Defaults to their first. */
     account?: `0x${string}` | undefined;
     /** The chain the key acts on, such as `tempoTestnet.id`. */
     chainId: number;
@@ -83,13 +83,13 @@ export type User = {
     /** The user's ID, the `sub` of every token. */
     id: string;
 };
-/** An OAuth provider's short name, as `Actions.getProviders` lists them. */
+/** An OAuth provider's short name, as `Actions.provider.list` lists them. */
 export type Provider = 'apple' | 'bitbucket' | 'github' | 'gitlab' | 'google' | 'intuit' | 'linkedin' | 'microsoft' | 'salesforce' | 'slack' | 'xero';
 /** A step a sign-in needs before it finishes, such as the SSO connection an address requires. */
 export type Step = {
     /** The kind of step. */
     type: 'sso';
-    /** Where `Actions.signIn` sends the browser to take the step. */
+    /** Where `Actions.provider.signIn` sends the browser to take the step. */
     url: string;
 };
 /** A sign-in redirect in progress: what the app keeps until Tempo Auth redirects back. */

package/dist/actions/device.d.ts

@@ -0,0 +1,33 @@
+import { type AccessKey, type Auth, type Authorization } from '../Auth.ts';
+/**
+ * Starts the device grant for a CLI: the user approves `userCode` at `verificationUri` from any
+ * browser, and `wait` resolves once they do.
+ *
+ * @example
+ * ```ts
+ * const device = await Actions.device.authorize(auth, { accessKey, device: Os.hostname() })
+ * console.log(`Open ${device.verificationUriComplete}`)
+ * const authorization = await device.wait()
+ * ```
+ */
+export declare function authorize(auth: Auth, options: authorize.Options): Promise<authorize.ReturnType>;
+export declare namespace authorize {
+    type Options = {
+        /** What the CLI's key may do. The approval page shows it beside the device. */
+        accessKey: AccessKey;
+        /** The name the approval page shows, such as the machine's hostname. */
+        device: string;
+    };
+    type ReturnType = {
+        /** Seconds until the code expires. */
+        expiresIn: number;
+        /** The code the user confirms in the browser. */
+        userCode: string;
+        /** Where the user enters the code. */
+        verificationUri: string;
+        /** Where the user approves the code, with it already filled in. */
+        verificationUriComplete: string;
+        /** Resolves with the authorization once the user approves. */
+        wait: () => Promise<Authorization>;
+    };
+}

package/dist/actions/device.js

@@ -0,0 +1,59 @@
+import { Secp256k1 } from 'viem/tempo';
+import { RequestError, } from '../Auth.js';
+import * as Api from '../internal/api.js';
+import { request } from '../internal/request.js';
+/**
+ * Starts the device grant for a CLI: the user approves `userCode` at `verificationUri` from any
+ * browser, and `wait` resolves once they do.
+ *
+ * @example
+ * ```ts
+ * const device = await Actions.device.authorize(auth, { accessKey, device: Os.hostname() })
+ * console.log(`Open ${device.verificationUriComplete}`)
+ * const authorization = await device.wait()
+ * ```
+ */
+export async function authorize(auth, options) {
+    const privateKey = Secp256k1.randomPrivateKey();
+    const code = await Api.json(await Api.post(auth, '/api/device/authorize', {
+        json: {
+            device: options.device,
+            keyAuthorization: request(auth, { ...options, privateKey })
+                .keyAuthorization,
+        },
+    }));
+    /** Polls until the user approves or denies the code, or it expires. */
+    async function wait() {
+        let interval = code.interval;
+        const deadline = Date.now() + code.expires_in * 1000;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, interval * 1000));
+            const response = await Api.post(auth, '/api/device/token', {
+                json: { device_code: code.device_code },
+            });
+            const body = (await response.json());
+            if ('access_token' in body)
+                return Api.authorization({
+                    account: body.account,
+                    keyAuthorization: body.key_authorization,
+                    tokens: Api.tokens(body),
+                }, { privateKey });
+            // RFC 8628 asks a client told to slow down to add 5 seconds to its interval.
+            if (body.error === 'slow_down')
+                interval += 5;
+            else if (body.error !== 'authorization_pending')
+                throw new RequestError({
+                    message: `Sign-in failed: ${body.error}.`,
+                    status: response.status,
+                });
+        }
+        throw new RequestError({ message: 'The code expired.', status: 400 });
+    }
+    return {
+        expiresIn: code.expires_in,
+        userCode: code.user_code,
+        verificationUri: code.verification_uri,
+        verificationUriComplete: code.verification_uri_complete,
+        wait,
+    };
+}

package/dist/actions/email.d.ts

@@ -0,0 +1,41 @@
+import type { AccessKey, Auth, Authorization, Step } from '../Auth.ts';
+/**
+ * Emails the user a sign-in code. The response is the same for every address.
+ *
+ * @example
+ * ```ts
+ * await Actions.email.sendCode(auth, { email: 'user@example.com' })
+ * ```
+ */
+export declare function sendCode(auth: Auth, options: sendCode.Options): Promise<void>;
+export declare namespace sendCode {
+    type Options = {
+        /** The user's email address. */
+        email: string;
+    };
+}
+/**
+ * Signs the user in with the code they were emailed, and authorizes the app in the same call.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.email.signIn(auth, { accessKey, code, email })
+ * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
+ * ```
+ */
+export declare function signIn(auth: Auth, options: signIn.Options): Promise<signIn.ReturnType>;
+export declare namespace signIn {
+    type Options = {
+        /** What the app's key may do. It must fit the headless ceiling. */
+        accessKey: AccessKey;
+        /** The 6-digit code the user was emailed. */
+        code: string;
+        /** The address the code was sent to. */
+        email: string;
+    };
+    /** The authorization, or the step the address requires first. */
+    type ReturnType = Authorization | {
+        step: Step;
+    };
+}

package/dist/actions/email.js

@@ -0,0 +1,44 @@
+/**
+ * Signs the user in with a code emailed to them, from the app's own sign-in form.
+ * @module
+ */
+import { Secp256k1 } from 'viem/tempo';
+import * as Api from '../internal/api.js';
+import { request } from '../internal/request.js';
+/**
+ * Emails the user a sign-in code. The response is the same for every address.
+ *
+ * @example
+ * ```ts
+ * await Actions.email.sendCode(auth, { email: 'user@example.com' })
+ * ```
+ */
+export async function sendCode(auth, options) {
+    await Api.json(await Api.post(auth, '/api/auth/code', { json: options }));
+}
+/**
+ * Signs the user in with the code they were emailed, and authorizes the app in the same call.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.email.signIn(auth, { accessKey, code, email })
+ * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
+ * ```
+ */
+export async function signIn(auth, options) {
+    const { accessKey, code, email } = options;
+    const privateKey = Secp256k1.randomPrivateKey();
+    const body = await Api.json(await Api.post(auth, '/api/auth/code/verify', {
+        json: {
+            authorize: request(auth, { accessKey, privateKey }),
+            code,
+            email,
+        },
+    }));
+    if ('step' in body)
+        return {
+            step: { ...body.step, url: new URL(body.step.url, auth.url).href },
+        };
+    return Api.authorization(body.authorization, { privateKey });
+}

package/dist/actions/provider.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Signs the user in to Tempo Auth through an OAuth provider or an SSO connection, from the app's
+ * own sign-in buttons.
+ * @module
+ */
+import type { Auth, Provider } from '../Auth.ts';
+/**
+ * Lists the OAuth providers Tempo Auth offers, for an app that shows its own sign-in buttons.
+ *
+ * @example
+ * ```ts
+ * const providers = await Actions.provider.list(auth)
+ * // [{ id: 'google', name: 'Google' }]
+ * ```
+ */
+export declare function list(auth: Auth): Promise<list.ReturnType>;
+export declare namespace list {
+    type ReturnType = readonly {
+        /** The provider's short name, which `signIn` takes. */
+        id: Provider;
+        /** The name to show, such as `Google`. */
+        name: string;
+    }[];
+}
+/**
+ * Sends the browser to an OAuth provider, or to the SSO connection a `Step` names, and back to
+ * `returnTo` signed in to Tempo Auth. Unlike `Actions.email.signIn`, it does not authorize the
+ * app: the app calls `Actions.authorize` once the browser returns.
+ *
+ * @example
+ * ```ts
+ * Actions.provider.signIn(auth, { provider: 'google' })
+ * ```
+ */
+export declare function signIn(auth: Auth, options: signIn.Options): void;
+export declare namespace signIn {
+    type Options = ({
+        /** The OAuth provider to sign in with, from `list`. */
+        provider: Provider;
+    } | {
+        /** The URL of a `Step`, such as the SSO connection an address requires. */
+        url: string;
+    }) & {
+        /** Where to return. Defaults to the current page. It must be on an internal origin. */
+        returnTo?: string | undefined;
+    };
+}

package/dist/actions/provider.js

@@ -0,0 +1,31 @@
+import * as Api from '../internal/api.js';
+/**
+ * Lists the OAuth providers Tempo Auth offers, for an app that shows its own sign-in buttons.
+ *
+ * @example
+ * ```ts
+ * const providers = await Actions.provider.list(auth)
+ * // [{ id: 'google', name: 'Google' }]
+ * ```
+ */
+export async function list(auth) {
+    const { providers } = await Api.json(await (auth.fetch ?? fetch)(new URL('/api/auth/providers', auth.url)));
+    return providers;
+}
+/**
+ * Sends the browser to an OAuth provider, or to the SSO connection a `Step` names, and back to
+ * `returnTo` signed in to Tempo Auth. Unlike `Actions.email.signIn`, it does not authorize the
+ * app: the app calls `Actions.authorize` once the browser returns.
+ *
+ * @example
+ * ```ts
+ * Actions.provider.signIn(auth, { provider: 'google' })
+ * ```
+ */
+export function signIn(auth, options) {
+    const url = 'url' in options
+        ? new URL(options.url)
+        : new URL(`/api/auth/oauth/${options.provider}`, auth.url);
+    url.searchParams.set('return_to', options.returnTo ?? window.location.href);
+    window.location.assign(url);
+}