@tempoxyz/example-auth-cli 0.0.0-pr-5.sha-414467e → 0.0.0-pr-6.sha-b989a0e

package/dist/Session.js

@@ -0,0 +1,46 @@
+/**
+ * The CLI's saved sign-in: the person, their tokens, and the CLI's access key, in a file only the
+ * current user can read. `TEMPO_AUTH_CREDENTIALS` moves the file.
+ * @module
+ */
+import * as Fs from 'node:fs/promises';
+import * as Os from 'node:os';
+import * as Path from 'node:path';
+import { Actions, Key } from '@tempoxyz/auth';
+import { auth } from './auth.config.js';
+/** Where the sign-in is saved. */
+const file = process.env.TEMPO_AUTH_CREDENTIALS ??
+    Path.join(Os.homedir(), '.config', 'tempo-auth', 'credentials.json');
+/**
+ * Returns the saved sign-in, refreshing its access token when it has expired, or `undefined`.
+ * A sign-in saved by an older CLI, or whose key has expired, counts as signed out, so `login`
+ * authorizes a new key.
+ */
+export async function get() {
+    const saved = await Fs.readFile(file, 'utf8')
+        .then((text) => JSON.parse(text))
+        .catch(() => undefined);
+    // Earlier CLIs saved no `key`, or kept the tokens at the top level, so those count as signed out.
+    if (!saved?.key?.keyAuthorization ||
+        !saved.tokens?.accessToken ||
+        Key.expired(saved.key))
+        return undefined;
+    if (saved.tokens.expiresAt - 30_000 > Date.now())
+        return saved;
+    const tokens = await Actions.refresh(auth, {
+        refreshToken: saved.tokens.refreshToken,
+    }).catch(() => undefined);
+    if (!tokens)
+        return undefined;
+    return save({ ...saved, tokens });
+}
+/** Forgets the saved sign-in. */
+export async function remove() {
+    await Fs.rm(file, { force: true });
+}
+/** Saves a sign-in, readable only by the current user. */
+export async function save(session) {
+    await Fs.mkdir(Path.dirname(file), { recursive: true });
+    await Fs.writeFile(file, JSON.stringify(session), { mode: 0o600 });
+    return session;
+}

package/dist/auth.config.js

@@ -0,0 +1,11 @@
+/**
+ * The Tempo Auth instance the CLI signs in through, configured from the environment.
+ * `TEMPO_AUTH_URL` points it at a deployment, such as a pull request's preview.
+ * @module
+ */
+import { Auth } from '@tempoxyz/auth';
+export const auth = Auth.create({
+    // The `tempo-cli` Connect app in the staging environment, which refreshes with its client ID alone.
+    clientId: process.env.CLI_CLIENT_ID ?? 'client_01M4N1K6HAT9QWVT2V59NNY48J',
+    url: process.env.TEMPO_AUTH_URL ?? 'http://localhost:5173',
+});

package/dist/commands/fund.js

@@ -1,18 +1,17 @@
 /** Funds the person's Tempo Account from the Tempo testnet faucet, including pathUSD for fees. @module */
 import { Cli } from 'incur';
-import * as Credentials from '../Credentials.js';
+import * as Session from '../Session.js';
 import { client } from '../viem.config.js';
 export default Cli.command({
     description: 'Fund your Tempo Account with testnet tokens',
-    env: Credentials.env,
     async run(c) {
-        const credentials = await Credentials.active(c.env);
-        if (!credentials)
+        const session = await Session.get();
+        if (!session)
             return c.error({
                 code: 'SIGNED_OUT',
                 message: 'Not signed in. Run `login`.',
             });
-        await client.faucet.fundSync({ account: credentials.key.account });
-        return { account: credentials.key.account, funded: true };
+        await client.faucet.fundSync({ account: session.key.account });
+        return { account: session.key.account, funded: true };
     },
 });

package/dist/commands/login.js

@@ -4,65 +4,34 @@
  * @module
  */
 import * as Os from 'node:os';
+import { Actions } from '@tempoxyz/auth';
 import { Cli } from 'incur';
-import * as Credentials from '../Credentials.js';
-import { Account, Secp256k1 } from 'viem/tempo';
-import * as TempoAccount from '../TempoAccount.js';
+import { Addresses, Expiry, Scopes } from 'viem/tempo';
+import { auth } from '../auth.config.js';
+import * as Session from '../Session.js';
+import { client } from '../viem.config.js';
 export default Cli.command({
     description: 'Sign in by approving a code in any browser',
-    env: Credentials.env,
     async *run(c) {
         // The approval page shows the key's limits beside the device.
-        const privateKey = Secp256k1.randomPrivateKey();
-        const authorized = await fetch(new URL('/api/device/authorize', c.env.TEMPO_AUTH_URL), {
-            body: JSON.stringify({
-                device: Os.hostname(),
-                keyAuthorization: TempoAccount.getKeyAuthorizationRequest(Account.fromSecp256k1(privateKey)),
-            }),
-            headers: { 'content-type': 'application/json' },
-            method: 'POST',
-        });
-        if (!authorized.ok)
-            return c.error({ code: 'AUTHORIZE', message: 'Could not start sign-in.' });
-        const code = (await authorized.json());
-        yield `Open ${code.verification_uri_complete}`;
-        yield `and confirm the code ${code.user_code}.`;
-        let interval = code.interval;
-        const deadline = Date.now() + code.expires_in * 1000;
-        while (Date.now() < deadline) {
-            await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-            const response = await fetch(new URL('/api/device/token', c.env.TEMPO_AUTH_URL), {
-                body: JSON.stringify({ device_code: code.device_code }),
-                headers: { 'content-type': 'application/json' },
-                method: 'POST',
-            });
-            const body = (await response.json());
-            if ('access_token' in body) {
-                const credentials = await Credentials.save(c.env, {
-                    key: {
-                        account: body.account,
-                        keyAuthorization: body.key_authorization,
-                        privateKey,
-                    },
-                    tokens: body,
-                });
-                const email = await Credentials.email(c.env, { credentials });
-                // A streaming command prints what it yields, not what it returns.
-                yield `Signed in as ${email}.`;
-                return c.ok({ email });
-            }
-            // RFC 8628 asks a client told to slow down to add 5 seconds to its interval.
-            if (body.error === 'slow_down')
-                interval += 5;
-            else if (body.error !== 'authorization_pending')
-                return c.error({
-                    code: 'DENIED',
-                    message: `Sign-in failed: ${body.error}.`,
-                });
-        }
-        return c.error({
-            code: 'EXPIRED',
-            message: 'The code expired. Sign in again.',
+        const device = await Actions.authorizeDevice(auth, {
+            accessKey: {
+                chainId: client.chain.id,
+                expiry: Expiry.days(1),
+                limits: [{ limit: 10000000n, token: Addresses.pathUsd }],
+                scopes: [Scopes.tip20(Addresses.pathUsd).transfer()],
+            },
+            device: Os.hostname(),
         });
+        yield `Open ${device.verificationUriComplete}`;
+        yield `and confirm the code ${device.userCode}.`;
+        const authorization = await device.wait().catch((error) => error);
+        if (authorization instanceof Error)
+            return c.error({ code: 'DENIED', message: authorization.message });
+        const { key, tokens, user } = authorization;
+        await Session.save({ key, tokens, user });
+        // A streaming command prints what it yields, not what it returns.
+        yield `Signed in as ${user.email}.`;
+        return c.ok({ email: user.email });
     },
 });

package/dist/commands/logout.js

@@ -1,11 +1,10 @@
 /** Forgets the saved tokens. @module */
 import { Cli } from 'incur';
-import * as Credentials from '../Credentials.js';
+import * as Session from '../Session.js';
 export default Cli.command({
     description: 'Sign out on this machine',
-    env: Credentials.env,
-    async run(c) {
-        await Credentials.remove(c.env);
+    async run() {
+        await Session.remove();
         return { signedOut: true };
     },
 });

package/dist/commands/send.js

@@ -1,9 +1,9 @@
 /** Sends pathUSD from the person's Tempo Account with the CLI's access key. @module */
+import { Key } from '@tempoxyz/auth';
 import { Cli, z } from 'incur';
 import { Value } from 'ox';
 import { Addresses } from 'viem/tempo';
-import * as Credentials from '../Credentials.js';
-import * as TempoAccount from '../TempoAccount.js';
+import * as Session from '../Session.js';
 import { client } from '../viem.config.js';
 export default Cli.command({
     args: z.object({
@@ -17,16 +17,15 @@ export default Cli.command({
             .describe('Amount of pathUSD, such as 0.01'),
     }),
     description: 'Send pathUSD from your Tempo Account',
-    env: Credentials.env,
     async run(c) {
-        const credentials = await Credentials.active(c.env);
-        if (!credentials)
+        const session = await Session.get();
+        if (!session)
             return c.error({
                 code: 'SIGNED_OUT',
                 message: 'Not signed in. Run `login`.',
             });
         const { receipt } = await client.token.transferSync({
-            account: TempoAccount.from(credentials.key),
+            account: Key.toAccount(session.key),
             amount: Value.from(c.args.amount, 6),
             to: c.args.to,
             token: Addresses.pathUsd,

package/dist/commands/whoami.js

@@ -1,19 +1,23 @@
 /** Prints the signed-in person's email and Tempo Account, refreshing the saved tokens when needed. @module */
 import { Cli } from 'incur';
-import * as Credentials from '../Credentials.js';
+import { auth } from '../auth.config.js';
+import * as Session from '../Session.js';
 export default Cli.command({
     description: 'Show who is signed in',
-    env: Credentials.env,
     async run(c) {
-        const credentials = await Credentials.active(c.env);
-        if (!credentials)
+        const session = await Session.get();
+        if (!session)
             return c.error({
                 code: 'SIGNED_OUT',
                 message: 'Not signed in. Run `login`.',
             });
-        return {
-            account: credentials.key.account,
-            email: await Credentials.email(c.env, { credentials }),
-        };
+        // Tempo Auth's userinfo endpoint answers for the access token, as any Tempo API would.
+        const response = await fetch(new URL('/oauth2/userinfo', auth.url), {
+            headers: { authorization: `Bearer ${session.tokens.accessToken}` },
+        });
+        if (!response.ok)
+            throw new Error(`userinfo answered ${response.status}.`);
+        const { email } = (await response.json());
+        return { account: session.key.account, email };
     },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/example-auth-cli",
-  "version": "0.0.0-pr-5.sha-414467e",
+  "version": "0.0.0-pr-6.sha-b989a0e",
   "description": "Signs in to Tempo through Tempo Auth's device grant.",
   "type": "module",
   "bin": {
@@ -15,7 +15,8 @@
   "dependencies": {
     "incur": "0.5.1",
     "ox": "0.14.56",
-    "viem": "https://pkg.pr.new/viem@0872b53"
+    "viem": "https://pkg.pr.new/viem@0872b53",
+    "@tempoxyz/auth": "0.0.0-pr-6.sha-b989a0e"
   },
   "devDependencies": {
     "@types/node": "26.6.4",

package/dist/Credentials.js

@@ -1,81 +0,0 @@
-/**
- * The tokens and access key the CLI keeps between runs, in a file only the current user can read.
- * Access tokens expire after minutes, so `active` refreshes them, and refresh tokens rotate on
- * every refresh.
- * @module
- */
-import * as Fs from 'node:fs/promises';
-import * as Os from 'node:os';
-import * as Path from 'node:path';
-import { z } from 'incur';
-import { KeyAuthorization } from 'ox/tempo';
-/** Where Tempo Auth runs, the CLI's Connect app, and where tokens live. */
-export const env = z.object({
-    TEMPO_AUTH_CREDENTIALS: z
-        .string()
-        .default(Path.join(Os.homedir(), '.config', 'tempo-auth', 'credentials.json')),
-    TEMPO_AUTH_URL: z.string().default('http://localhost:5173'),
-    // The `tempo-cli` Connect app in the staging environment, which refreshes with its client ID alone.
-    CLI_CLIENT_ID: z.string().default('client_01M4N1K6HAT9QWVT2V59NNY48J'),
-});
-/**
- * Returns the saved tokens, refreshing the access token when it has expired, or `undefined`.
- * Credentials without an access key, from an older CLI, or whose key has expired count as signed
- * out, so `login` authorizes a new key.
- */
-export async function active(env) {
-    const saved = await Fs.readFile(env.TEMPO_AUTH_CREDENTIALS, 'utf8')
-        // An older CLI saved no `key`, which this check catches at runtime.
-        .then((text) => JSON.parse(text))
-        .catch(() => undefined);
-    if (!saved?.key || expired(saved.key))
-        return undefined;
-    if (saved.expiresAt - 30_000 > Date.now())
-        return saved;
-    const response = await fetch(new URL('/oauth2/token', env.TEMPO_AUTH_URL), {
-        body: new URLSearchParams({
-            client_id: env.CLI_CLIENT_ID,
-            grant_type: 'refresh_token',
-            refresh_token: saved.refreshToken,
-        }),
-        method: 'POST',
-    });
-    if (!response.ok)
-        return undefined;
-    return save(env, {
-        key: saved.key,
-        tokens: (await response.json()),
-    });
-}
-/** Reads the signed-in person's email from Tempo Auth's userinfo endpoint. */
-export async function email(env, options) {
-    const response = await fetch(new URL('/oauth2/userinfo', env.TEMPO_AUTH_URL), {
-        headers: { authorization: `Bearer ${options.credentials.accessToken}` },
-    });
-    if (!response.ok)
-        throw new Error(`userinfo answered ${response.status}.`);
-    return (await response.json()).email;
-}
-/** Whether the key's authorization has expired. */
-function expired(key) {
-    const { expiry } = KeyAuthorization.fromRpc(key.keyAuthorization);
-    return Boolean(expiry) && expiry * 1000 <= Date.now();
-}
-/** Forgets the saved tokens. */
-export async function remove(env) {
-    await Fs.rm(env.TEMPO_AUTH_CREDENTIALS, { force: true });
-}
-/** Saves a token response and the access key, readable only by the current user. */
-export async function save(env, options) {
-    const credentials = {
-        accessToken: options.tokens.access_token,
-        expiresAt: Date.now() + options.tokens.expires_in * 1000,
-        key: options.key,
-        refreshToken: options.tokens.refresh_token,
-    };
-    await Fs.mkdir(Path.dirname(env.TEMPO_AUTH_CREDENTIALS), { recursive: true });
-    await Fs.writeFile(env.TEMPO_AUTH_CREDENTIALS, JSON.stringify(credentials), {
-        mode: 0o600,
-    });
-    return credentials;
-}

package/dist/TempoAccount.js

@@ -1,39 +0,0 @@
-/**
- * The app's access key on a person's Tempo Account. The app holds the key, asks Tempo Auth for a
- * key authorization for it, and sends with it on Tempo testnet. The first transaction carries the
- * authorization, which registers the key.
- * @module
- */
-import { Hex } from 'ox';
-import { KeyAuthorization } from 'ox/tempo';
-import { Account, Addresses, KeyAuthorizationManager } from 'viem/tempo';
-import { client } from './viem.config.js';
-/**
- * The key authorization request for `accessKey`, in the Accounts SDK's `wallet_connect` format: up
- * to 10 pathUSD in transfers, for a day.
- */
-export function getKeyAuthorizationRequest(accessKey) {
-    return {
-        address: accessKey.address,
-        chainId: Hex.fromNumber(client.chain.id),
-        expiry: Math.floor(Date.now() / 1000) + 24 * 60 * 60,
-        keyType: 'secp256k1',
-        limits: [{ limit: Hex.fromNumber(10000000n), token: Addresses.pathUsd }],
-        scopes: [
-            { address: Addresses.pathUsd, selector: 'transfer(address,uint256)' },
-        ],
-    };
-}
-/** The key as a viem account acting for the Tempo Account. viem attaches the authorization until the chain registers the key. */
-export function from(key) {
-    const keyAuthorizationManager = KeyAuthorizationManager.memory();
-    keyAuthorizationManager.set({
-        accessKey: Account.fromSecp256k1(key.privateKey).address,
-        address: key.account,
-        chainId: client.chain.id,
-    }, KeyAuthorization.fromRpc(key.keyAuthorization));
-    return Account.fromSecp256k1(key.privateKey, {
-        access: key.account,
-        keyAuthorizationManager,
-    });
-}