@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/app/server/wrangler.json

@@ -0,0 +1 @@
+{"configPath":"/home/runner/work/id/id/src/app/.void-wrangler.jsonc","userConfigPath":"/home/runner/work/id/id/src/app/.void-wrangler.jsonc","topLevelName":"tempoxyz-id-app","definedEnvironments":[],"compatibility_date":"2026-02-24","compatibility_flags":["nodejs_compat"],"jsx_factory":"React.createElement","jsx_fragment":"React.Fragment","rules":[{"type":"ESModule","globs":["**/*.js","**/*.mjs"]}],"name":"tempoxyz-id-app","main":"index.js","triggers":{"crons":["0 * * * *"]},"assets":{"binding":"ASSETS","directory":"../client"},"vars":{},"secrets":{"required":["SECRET","URL"]},"durable_objects":{"bindings":[]},"workflows":[],"migrations":[],"exports":{},"kv_namespaces":[],"cloudchamber":{},"send_email":[],"queues":{"producers":[],"consumers":[]},"connect":[],"r2_buckets":[],"d1_databases":[],"vectorize":[],"ai_search_namespaces":[],"ai_search":[],"agent_memory":[],"hyperdrive":[],"services":[],"analytics_engine_datasets":[],"dispatch_namespaces":[],"mtls_certificates":[],"pipelines":[],"k2":[],"secrets_store_secrets":[],"artifacts":[],"unsafe_hello_world":[],"flagship":[],"worker_loaders":[],"ratelimits":[{"name":"ACCOUNT_LIMIT","namespace_id":"1007","simple":{"limit":60,"period":60}},{"name":"AUTHORIZE_LIMIT","namespace_id":"1001","simple":{"limit":60,"period":60}},{"name":"DEVICE_LIMIT","namespace_id":"1002","simple":{"limit":10,"period":60}},{"name":"SIGN_IN_CODE_LIMIT","namespace_id":"1003","simple":{"limit":5,"period":60}},{"name":"SIGN_IN_IP_LIMIT","namespace_id":"1004","simple":{"limit":100,"period":60}},{"name":"TOKEN_APP_LIMIT","namespace_id":"1008","simple":{"limit":600,"period":60}},{"name":"TOKEN_LIMIT","namespace_id":"1006","simple":{"limit":300,"period":60}}],"vpc_services":[],"vpc_networks":[],"version_metadata":{"binding":"CF_VERSION_METADATA"},"logfwdr":{"bindings":[]},"upload_source_maps":true,"python_modules":{"exclude":["**/*.pyc"]},"dev":{"ip":"localhost","local_protocol":"http","upstream_protocol":"http","enable_containers":true,"generate_types":false},"no_bundle":true}

package/dist/cli/Admin.d.ts

@@ -0,0 +1,38 @@
+/**
+ * What the `tempo-id admin` commands share: the options and variables that name the database, and
+ * the loaders of the app and realm commands' modules. incur imports every command when the CLI
+ * starts, so this module imports only incur, and each module loads only when its commands run.
+ * @module
+ */
+import { z } from 'incur';
+/** The variables that name the database. */
+export declare const env: z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** The error for a command without a database URL. */
+export declare const missingDatabaseUrl: {
+    readonly code: 'missing_database_url';
+    readonly message: 'Missing database URL. Set --database-url or DATABASE_URL to a direct Postgres connection string.';
+};
+/** The error for an app, realm, or signing key command without one of its optional peers. */
+export declare const missingPeers: {
+    readonly code: 'missing_peer';
+    readonly message: 'Missing peer dependencies. Install better-auth, @better-auth/core, @better-auth/oauth-provider, drizzle-orm, and zod to run the admin apps, realms, and rotate-key commands.';
+};
+/** The options that name the database. */
+export declare const options: z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Loads the module that the app and signing key commands share, or returns `undefined` when one of
+ * its optional peers is not installed.
+ */
+export declare function loadApps(): Promise<typeof import("./Apps.js") | undefined>;
+/**
+ * Loads the module that the realm commands share, or returns `undefined` when one of its optional
+ * peers is not installed.
+ */
+export declare function loadRealms(): Promise<typeof import("./Realms.js") | undefined>;
+/** Returns the module that `promise` loads, or `undefined` when one of its packages is missing. */
+export declare function optional<module>(promise: Promise<module>): Promise<module | undefined>;
+//# sourceMappingURL=Admin.d.ts.map

package/dist/cli/Admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Admin.d.ts","sourceRoot":"","sources":["../../src/cli/Admin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAEzB,4CAA4C;AAC5C,eAAO,MAAM,GAAG;;iBAOd,CAAA;AAEF,sDAAsD;AACtD,eAAO,MAAM,kBAAkB;aAC7B,IAAI,EAAE,sBAAsB;aAC5B,OAAO,EACL,kGAAkG;CAC5F,CAAA;AAEV,6FAA6F;AAC7F,eAAO,MAAM,YAAY;aACvB,IAAI,EAAE,cAAc;aACpB,OAAO,EACL,8KAA8K;CACxK,CAAA;AAEV,0CAA0C;AAC1C,eAAO,MAAM,OAAO;;iBAKlB,CAAA;AAEF;;;GAGG;AACH,wBAAsB,QAAQ,oDAG7B;AAED;;;GAGG;AACH,wBAAsB,UAAU,sDAG/B;AAED,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,+BAa9D"}

package/dist/cli/Admin.js

@@ -0,0 +1,62 @@
+/**
+ * What the `tempo-id admin` commands share: the options and variables that name the database, and
+ * the loaders of the app and realm commands' modules. incur imports every command when the CLI
+ * starts, so this module imports only incur, and each module loads only when its commands run.
+ * @module
+ */
+import { z } from 'incur';
+/** The variables that name the database. */
+export const env = z.object({
+    DATABASE_URL: z
+        .string()
+        .optional()
+        .describe('Postgres connection string. Used when --database-url is omitted.'),
+});
+/** The error for a command without a database URL. */
+export const missingDatabaseUrl = {
+    code: 'missing_database_url',
+    message: 'Missing database URL. Set --database-url or DATABASE_URL to a direct Postgres connection string.',
+};
+/** The error for an app, realm, or signing key command without one of its optional peers. */
+export const missingPeers = {
+    code: 'missing_peer',
+    message: 'Missing peer dependencies. Install better-auth, @better-auth/core, @better-auth/oauth-provider, drizzle-orm, and zod to run the admin apps, realms, and rotate-key commands.',
+};
+/** The options that name the database. */
+export const options = z.object({
+    databaseUrl: z
+        .string()
+        .optional()
+        .describe('Postgres connection string. Overrides DATABASE_URL.'),
+});
+/**
+ * Loads the module that the app and signing key commands share, or returns `undefined` when one of
+ * its optional peers is not installed.
+ */
+export async function loadApps() {
+    // A dynamic import, since the module needs optional peers that the other commands do not.
+    return await optional(import('./Apps.js'));
+}
+/**
+ * Loads the module that the realm commands share, or returns `undefined` when one of its optional
+ * peers is not installed.
+ */
+export async function loadRealms() {
+    // A dynamic import, since the module needs optional peers that the other commands do not.
+    return await optional(import('./Realms.js'));
+}
+/** Returns the module that `promise` loads, or `undefined` when one of its packages is missing. */
+export async function optional(promise) {
+    try {
+        return await promise;
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            'code' in error &&
+            error.code === 'ERR_MODULE_NOT_FOUND' &&
+            error.message.startsWith('Cannot find package'))
+            return undefined;
+        throw error;
+    }
+}
+//# sourceMappingURL=Admin.js.map

package/dist/cli/Admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Admin.js","sourceRoot":"","sources":["../../src/cli/Admin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAEzB,4CAA4C;AAC5C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE,CACnE;CACJ,CAAC,CAAA;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,sBAAsB;IAC5B,OAAO,EACL,kGAAkG;CAC5F,CAAA;AAEV,6FAA6F;AAC7F,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,cAAc;IACpB,OAAO,EACL,8KAA8K;CACxK,CAAA;AAEV,0CAA0C;AAC1C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qDAAqD,CAAC;CACnE,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,0FAA0F;IAC1F,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,0FAA0F;IAC1F,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAS,OAAwB;IAC7D,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAA;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,sBAAsB;YACrC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAE/C,OAAO,SAAS,CAAA;QAClB,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/cli/Apps.d.ts

@@ -0,0 +1,9 @@
+export * as Apps from '../internal/Apps.js';
+export * as SigningKey from '../internal/SigningKey.js';
+export { connect } from './Realms.js';
+/** Returns the error code and message for a refusal from `Apps` or `SigningKey`, or `undefined` for another error. */
+export declare function error(error: unknown): {
+    code: string;
+    message: string;
+} | undefined;
+//# sourceMappingURL=Apps.d.ts.map

package/dist/cli/Apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Apps.d.ts","sourceRoot":"","sources":["../../src/cli/Apps.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAErC,sHAAsH;AACtH,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO;;;cAanC"}

package/dist/cli/Apps.js

@@ -0,0 +1,36 @@
+/**
+ * What the `tempo-id admin apps` and `admin rotate-key` commands share: `Apps`, `SigningKey`, a
+ * Drizzle connection to the database, and the codes of the refusals that both throw. It needs the
+ * `better-auth`, `@better-auth/core`, `@better-auth/oauth-provider`, `drizzle-orm`, and `zod` peers,
+ * so the commands load it with `Admin.loadApps`.
+ * @module
+ */
+import * as Apps from '../internal/Apps.js';
+import * as SigningKey from '../internal/SigningKey.js';
+export * as Apps from '../internal/Apps.js';
+export * as SigningKey from '../internal/SigningKey.js';
+export { connect } from './Realms.js';
+/** Returns the error code and message for a refusal from `Apps` or `SigningKey`, or `undefined` for another error. */
+export function error(error) {
+    const code = (() => {
+        if (error instanceof Apps.ExistsError)
+            return 'app_exists';
+        if (error instanceof Apps.InvalidError)
+            return 'invalid_app';
+        if (error instanceof Apps.NotFoundError)
+            return 'unknown_app';
+        if (error instanceof Apps.PublicError)
+            return 'public_app';
+        if (error instanceof SigningKey.FullError)
+            return 'too_many_signing_keys';
+        if (error instanceof SigningKey.MissingError)
+            return 'missing_signing_key';
+        if (error instanceof SigningKey.SecretError)
+            return 'invalid_secret';
+        return undefined;
+    })();
+    if (!code || !(error instanceof Error))
+        return undefined;
+    return { code, message: error.message };
+}
+//# sourceMappingURL=Apps.js.map

package/dist/cli/Apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Apps.js","sourceRoot":"","sources":["../../src/cli/Apps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAA;AAEvD,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAErC,sHAAsH;AACtH,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;QACjB,IAAI,KAAK,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,YAAY,CAAA;QAC1D,IAAI,KAAK,YAAY,IAAI,CAAC,YAAY;YAAE,OAAO,aAAa,CAAA;QAC5D,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa;YAAE,OAAO,aAAa,CAAA;QAC7D,IAAI,KAAK,YAAY,IAAI,CAAC,WAAW;YAAE,OAAO,YAAY,CAAA;QAC1D,IAAI,KAAK,YAAY,UAAU,CAAC,SAAS;YAAE,OAAO,uBAAuB,CAAA;QACzE,IAAI,KAAK,YAAY,UAAU,CAAC,YAAY;YAAE,OAAO,qBAAqB,CAAA;QAC1E,IAAI,KAAK,YAAY,UAAU,CAAC,WAAW;YAAE,OAAO,gBAAgB,CAAA;QACpE,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;AACzC,CAAC"}

package/dist/cli/Cli.d.ts

@@ -0,0 +1,14 @@
+import { Cli as incur_Cli } from 'incur';
+import type * as V1 from './V1.js';
+/**
+ * Returns the `tempo-id` CLI, with the commands in `commands/`, and with `v1`, the group that
+ * `V1.load` returns.
+ */
+export declare function create(options?: create.Options): incur_Cli.Cli<{}, undefined, undefined, undefined, "tempo-id">;
+export declare namespace create {
+    type Options = {
+        /** The `v1` group, from the deployment's OpenAPI document. Absent, the CLI has no `v1` group. */
+        v1?: Awaited<ReturnType<typeof V1.load>> | undefined;
+    };
+}
+//# sourceMappingURL=Cli.d.ts.map

package/dist/cli/Cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cli.d.ts","sourceRoot":"","sources":["../../src/cli/Cli.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,OAAO,CAAA;AACxC,OAAO,KAAK,KAAK,EAAE,MAAM,SAAS,CAAA;AAYlC;;;GAGG;AACH,wBAAgB,MAAM,CAAC,OAAO,GAAE,MAAM,CAAC,OAAY,kEASlD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,iGAAiG;QACjG,EAAE,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAA;KACrD,CAAA;CACF"}

package/dist/cli/Cli.js

@@ -0,0 +1,27 @@
+/**
+ * The `tempo-id` CLI. Each command is a file in `commands/`, which incur routes by its path, such as
+ * `commands/admin/migrate.ts` for `tempo-id admin migrate`. `init` and `admin` work offline. `login`,
+ * `logout`, `whoami`, and the `v1` group reach Tempo ID over HTTP.
+ * @module
+ */
+import * as Fs from 'node:fs';
+import * as Path from 'node:path';
+import { Cli as incur_Cli } from 'incur';
+/** The package's version, from its `package.json` one folder above `src/` or `dist/`. */
+const version = JSON.parse(Fs.readFileSync(Path.join(import.meta.dirname, '..', '..', 'package.json'), 'utf8')).version;
+/**
+ * Returns the `tempo-id` CLI, with the commands in `commands/`, and with `v1`, the group that
+ * `V1.load` returns.
+ */
+export function create(options = {}) {
+    const cli = incur_Cli
+        .create('tempo-id', {
+        description: 'Create and operate Tempo ID projects.',
+        version,
+    })
+        .fs(new URL('./commands/', import.meta.url));
+    if (!options.v1)
+        return cli;
+    return cli.command('v1', options.v1);
+}
+//# sourceMappingURL=Cli.js.map

package/dist/cli/Cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Cli.js","sourceRoot":"","sources":["../../src/cli/Cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,OAAO,CAAA;AAGxC,yFAAyF;AACzF,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CACR,EAAE,CAAC,YAAY,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAC1D,MAAM,CACP,CAEJ,CAAC,OAAO,CAAA;AAET;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,OAAO,GAAmB,EAAE;IACjD,MAAM,GAAG,GAAG,SAAS;SAClB,MAAM,CAAC,UAAU,EAAE;QAClB,WAAW,EAAE,uCAAuC;QACpD,OAAO;KACR,CAAC;SACD,EAAE,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,GAAG,CAAA;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;AACtC,CAAC"}

package/dist/cli/Project.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Writes the project's files into `options.root`, skipping any that exist. Returns the paths it
+ * wrote.
+ */
+export declare function init(options: init.Options): {
+    paths: string[];
+};
+export declare namespace init {
+    type Options = {
+        /** The sender of every email, such as `Tempo ID <noreply@id.example.com>`. */
+        from: string;
+        /** The project's package name and Worker name. Defaults to the folder's name. */
+        name?: string | undefined;
+        /** The project's folder, which need not exist. */
+        root: string;
+        /** Tempo ID's origin, such as `https://id.example.com`, and every token's `iss`. */
+        url: string;
+    };
+}
+//# sourceMappingURL=Project.d.ts.map

package/dist/cli/Project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Project.d.ts","sourceRoot":"","sources":["../../src/cli/Project.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO;IA8E/B,KAAK;EACf;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,8EAA8E;QAC9E,IAAI,EAAE,MAAM,CAAA;QACZ,iFAAiF;QACjF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,kDAAkD;QAClD,IAAI,EAAE,MAAM,CAAA;QACZ,oFAAoF;QACpF,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF"}

package/dist/cli/Project.js

@@ -0,0 +1,88 @@
+/**
+ * Writes a Tempo ID Worker project: a Worker that runs `App.create`, and the Wrangler config that
+ * declares the bindings the app reads, as `apps/id` holds them.
+ * @module
+ */
+import * as Fs from 'node:fs';
+import * as Path from 'node:path';
+import * as Limits from '../internal/Limits.js';
+/** The package's own `package.json`, two folders above `src/cli/` or `dist/cli/`. */
+const manifest = JSON.parse(Fs.readFileSync(Path.join(import.meta.dirname, '..', '..', 'package.json'), 'utf8'));
+/** The Wrangler version a project deploys with. */
+const wrangler = '4.151.0';
+/**
+ * Writes the project's files into `options.root`, skipping any that exist. Returns the paths it
+ * wrote.
+ */
+export function init(options) {
+    const { from, root, url } = options;
+    const name = options.name ?? Path.basename(Path.resolve(root));
+    const files = {
+        '.gitignore': ['.dev.vars', '.wrangler', 'node_modules', ''].join('\n'),
+        'package.json': `${JSON.stringify({
+            name,
+            private: true,
+            type: 'module',
+            scripts: { deploy: 'wrangler deploy', dev: 'wrangler dev' },
+            dependencies: { '@tempoxyz/id': `^${manifest.version}` },
+            devDependencies: { wrangler },
+        }, null, 2)}\n`,
+        'worker.ts': [
+            '/** Runs Tempo ID on this host. @module */',
+            "import { App } from '@tempoxyz/id/worker'",
+            '',
+            'export default App.create()',
+            '',
+        ].join('\n'),
+        'wrangler.jsonc': [
+            '{',
+            '  "$schema": "node_modules/wrangler/config-schema.json",',
+            `  "name": ${JSON.stringify(name)},`,
+            '  "main": "worker.ts",',
+            '  "compatibility_date": "2026-02-24",',
+            '  "compatibility_flags": ["nodejs_compat"],',
+            "  // The app's client scripts and styles, from the package.",
+            '  "assets": {',
+            '    "binding": "ASSETS",',
+            '    "directory": "node_modules/@tempoxyz/id/dist/app/client",',
+            '    "run_worker_first": ["/**"],',
+            '  },',
+            '  // Postgres. Create a Hyperdrive configuration with `wrangler hyperdrive create`, and set its ID.',
+            '  "hyperdrive": [',
+            '    {',
+            '      "binding": "HYPERDRIVE",',
+            '      "id": "<hyperdrive-id>",',
+            '      "localConnectionString": "postgresql://localhost:5432/tempo_id",',
+            '    },',
+            '  ],',
+            '  // Each limit counts per Cloudflare location over its period, in seconds.',
+            '  "ratelimits": [',
+            ...Object.entries(Limits.limits).map(([binding, limit]) => `    { "name": "${binding}", "namespace_id": "${limit.namespace}", "simple": { "limit": ${limit.limit}, "period": ${limit.period} } },`),
+            '  ],',
+            '  // Set it with `wrangler secret put SECRET`, from `openssl rand -base64 32`.',
+            '  "secrets": { "required": ["SECRET"] },',
+            "  // Sign-in codes. The sender's domain needs Cloudflare Email Sending on the account.",
+            '  "send_email": [{ "name": "SEND_EMAIL" }],',
+            '  // The cleanup of expired rows.',
+            '  "triggers": { "crons": ["0 * * * *"] },',
+            '  "vars": {',
+            `    "EMAIL_FROM": ${JSON.stringify(from)},`,
+            `    "URL": ${JSON.stringify(url)},`,
+            '  },',
+            '  "version_metadata": { "binding": "CF_VERSION_METADATA" },',
+            '}',
+            '',
+        ].join('\n'),
+    };
+    const written = [];
+    for (const [path, content] of Object.entries(files)) {
+        const target = Path.join(root, path);
+        if (Fs.existsSync(target))
+            continue;
+        Fs.mkdirSync(Path.dirname(target), { recursive: true });
+        Fs.writeFileSync(target, content);
+        written.push(path);
+    }
+    return { paths: written };
+}
+//# sourceMappingURL=Project.js.map

package/dist/cli/Project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Project.js","sourceRoot":"","sources":["../../src/cli/Project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,uBAAuB,CAAA;AAE/C,qFAAqF;AACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,EAAE,CAAC,YAAY,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAC1D,MAAM,CACP,CACqB,CAAA;AAExB,mDAAmD;AACnD,MAAM,QAAQ,GAAG,SAAS,CAAA;AAE1B;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,OAAqB;IACxC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9D,MAAM,KAAK,GAAG;QACZ,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvE,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,CAC/B;YACE,IAAI;YACJ,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE;YAC3D,YAAY,EAAE,EAAE,cAAc,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE;YACxD,eAAe,EAAE,EAAE,QAAQ,EAAE;SAC9B,EACD,IAAI,EACJ,CAAC,CACF,IAAI;QACL,WAAW,EAAE;YACX,4CAA4C;YAC5C,2CAA2C;YAC3C,EAAE;YACF,6BAA6B;YAC7B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,gBAAgB,EAAE;YAChB,GAAG;YACH,0DAA0D;YAC1D,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YACpC,wBAAwB;YACxB,uCAAuC;YACvC,6CAA6C;YAC7C,6DAA6D;YAC7D,eAAe;YACf,0BAA0B;YAC1B,+DAA+D;YAC/D,kCAAkC;YAClC,MAAM;YACN,qGAAqG;YACrG,mBAAmB;YACnB,OAAO;YACP,gCAAgC;YAChC,gCAAgC;YAChC,wEAAwE;YACxE,QAAQ;YACR,MAAM;YACN,6EAA6E;YAC7E,mBAAmB;YACnB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAClC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CACnB,kBAAkB,OAAO,uBAAuB,KAAK,CAAC,SAAS,2BAA2B,KAAK,CAAC,KAAK,eAAe,KAAK,CAAC,MAAM,OAAO,CAC1I;YACD,MAAM;YACN,gFAAgF;YAChF,0CAA0C;YAC1C,wFAAwF;YACxF,6CAA6C;YAC7C,mCAAmC;YACnC,2CAA2C;YAC3C,aAAa;YACb,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG;YACpC,MAAM;YACN,6DAA6D;YAC7D,GAAG;YACH,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAA;IAED,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAQ;QACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACjC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC3B,CAAC"}

package/dist/cli/Realms.d.ts

@@ -0,0 +1,24 @@
+import * as Schema from '../app/db/schema.js';
+export * as Realm from '../internal/Realm.js';
+/**
+ * Connects to the database at `connectionString` directly, never through Hyperdrive. Call `end` once
+ * the command is done with it.
+ */
+export declare function connect(options: connect.Options): {
+    db: import("drizzle-orm/node-postgres").NodePgDatabase<typeof Schema> & {
+        $client: import("pg").Pool;
+    };
+    end: () => Promise<void>;
+};
+export declare namespace connect {
+    type Options = {
+        /** A direct Postgres connection string. */
+        connectionString: string;
+    };
+}
+/** Returns the error code and message for a refusal from `Realm`, or `undefined` for another error. */
+export declare function error(error: unknown): {
+    code: string;
+    message: string;
+} | undefined;
+//# sourceMappingURL=Realms.d.ts.map

package/dist/cli/Realms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Realms.d.ts","sourceRoot":"","sources":["../../src/cli/Realms.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAG7C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAE7C;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO;IAM5C,EAAE;;;IACF,GAAG;EAEN;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb,2CAA2C;QAC3C,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;CACF;AAED,uGAAuG;AACvG,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO;;;cAanC"}

package/dist/cli/Realms.js

@@ -0,0 +1,49 @@
+/**
+ * What the `tempo-id admin realms` commands share: `Realm`, a Drizzle connection to the database,
+ * and the codes of the refusals that `Realm` throws. It needs the `better-auth`, `drizzle-orm`, and
+ * `zod` peers, so the commands load it with `Admin.loadRealms`.
+ * @module
+ */
+import { drizzle } from 'drizzle-orm/node-postgres';
+import pg from 'pg';
+import * as Schema from '../app/db/schema.js';
+import * as Realm from '../internal/Realm.js';
+export * as Realm from '../internal/Realm.js';
+/**
+ * Connects to the database at `connectionString` directly, never through Hyperdrive. Call `end` once
+ * the command is done with it.
+ */
+export function connect(options) {
+    const pool = new pg.Pool({
+        connectionString: options.connectionString,
+        max: 1,
+    });
+    return {
+        db: drizzle({ client: pool, schema: Schema }),
+        end: () => pool.end(),
+    };
+}
+/** Returns the error code and message for a refusal from `Realm`, or `undefined` for another error. */
+export function error(error) {
+    const code = (() => {
+        if (error instanceof Realm.InUseError)
+            return 'realm_in_use';
+        if (error instanceof Realm.InvalidError)
+            return 'invalid_realm';
+        if (error instanceof Realm.NotFoundAppError)
+            return 'unknown_app';
+        if (error instanceof Realm.NotFoundError)
+            return 'unknown_realm';
+        if (error instanceof Realm.TakenError)
+            return 'realm_exists';
+        if (error instanceof Realm.TakenPasskeysError)
+            return 'relying_party_taken';
+        if (error instanceof Realm.TakenPrivyAppError)
+            return 'privy_app_taken';
+        return undefined;
+    })();
+    if (!code || !(error instanceof Error))
+        return undefined;
+    return { code, message: error.message };
+}
+//# sourceMappingURL=Realms.js.map

package/dist/cli/Realms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Realms.js","sourceRoot":"","sources":["../../src/cli/Realms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACnD,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAE7C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAE7C;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAwB;IAC9C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,GAAG,EAAE,CAAC;KACP,CAAC,CAAA;IACF,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;KACtB,CAAA;AACH,CAAC;AASD,uGAAuG;AACvG,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;QACjB,IAAI,KAAK,YAAY,KAAK,CAAC,UAAU;YAAE,OAAO,cAAc,CAAA;QAC5D,IAAI,KAAK,YAAY,KAAK,CAAC,YAAY;YAAE,OAAO,eAAe,CAAA;QAC/D,IAAI,KAAK,YAAY,KAAK,CAAC,gBAAgB;YAAE,OAAO,aAAa,CAAA;QACjE,IAAI,KAAK,YAAY,KAAK,CAAC,aAAa;YAAE,OAAO,eAAe,CAAA;QAChE,IAAI,KAAK,YAAY,KAAK,CAAC,UAAU;YAAE,OAAO,cAAc,CAAA;QAC5D,IAAI,KAAK,YAAY,KAAK,CAAC,kBAAkB;YAAE,OAAO,qBAAqB,CAAA;QAC3E,IAAI,KAAK,YAAY,KAAK,CAAC,kBAAkB;YAAE,OAAO,iBAAiB,CAAA;QACvE,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;AACzC,CAAC"}

package/dist/cli/Session.d.ts

@@ -0,0 +1,85 @@
+import * as Auth from '../client/Auth.js';
+import type * as Authorization from '../client/Authorization.js';
+/**
+ * A stored session, as `Actions.device.authorize` returns it, without its Viem account, and with
+ * the origin of the deployment that issued it.
+ */
+export type Session = Omit<Authorization.Authorization, 'account'> & {
+    /** The origin of the Tempo ID deployment that issued the tokens. */
+    url: string;
+};
+/** The client ID of Tempo ID's own device app, which every CLI shares. */
+export declare const clientId = "tempo-cli";
+/** Returns the client of Tempo ID at `url`, or at `https://id.tempo.xyz`, as `tempo-cli`. */
+export declare function auth(options: auth.Options): Auth.Auth;
+export declare namespace auth {
+    type Options = {
+        /** Tempo ID's origin. Defaults to `https://id.tempo.xyz`. */
+        url?: string | undefined;
+    };
+}
+/**
+ * Returns the stored session, with its access token refreshed when it expires within 30 seconds.
+ * Returns `undefined` without a session, for a session without a user or an access key, or for one
+ * whose key expired or whose refresh fails, so the user signs in again. A session that another
+ * deployment issued also returns `undefined`, so its tokens never reach the deployment at `url`.
+ */
+export declare function get(options: get.Options): Promise<Session | undefined>;
+export declare namespace get {
+    type Options = {
+        /** The folder that holds the session. Defaults to `~/.tempo`. */
+        home?: string | undefined;
+        /** Tempo ID's origin. Defaults to `https://id.tempo.xyz`. */
+        url?: string | undefined;
+    };
+}
+/**
+ * Starts Tempo ID's device grant with a new access key, and returns the code to show and `wait`.
+ * `wait` resolves once the user approves the code in a browser, stores the new session, revokes the
+ * refresh token of the session that it replaced, and returns the new session. It rejects with
+ * `Auth.RequestError` when the user denies the code or the code expires.
+ */
+export declare function login(options: login.Options): Promise<{
+    expiresIn: number;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    wait(): Promise<Session>;
+}>;
+export declare namespace login {
+    type Options = get.Options;
+}
+/**
+ * Revokes the stored session's refresh token at the deployment that issued it, and deletes the
+ * session. A failed revocation, such as without a network, or a file that holds no readable
+ * session, still deletes it, and returns `false`.
+ */
+export declare function remove(options: remove.Options): Promise<boolean>;
+export declare namespace remove {
+    type Options = get.Options;
+}
+/**
+ * Stores `session`, readable only by the current user, and returns it. The session replaces the
+ * stored one in one rename, so a failed write leaves the earlier session as it was.
+ */
+export declare function save(options: save.Options): Promise<Session>;
+export declare namespace save {
+    type Options = {
+        /** The folder that holds the session. Defaults to `~/.tempo`. */
+        home?: string | undefined;
+        /** The session to store. */
+        session: Session;
+    };
+}
+/**
+ * Returns the signed-in user's email, from Tempo ID's UserInfo endpoint, and the Tempo Account that
+ * the session's access key acts for. Returns `undefined` without a session.
+ */
+export declare function whoami(options: whoami.Options): Promise<{
+    account: `0x${string}`;
+    email: string;
+} | undefined>;
+export declare namespace whoami {
+    type Options = get.Options;
+}
+//# sourceMappingURL=Session.d.ts.map

package/dist/cli/Session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../src/cli/Session.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,KAAK,aAAa,MAAM,4BAA4B,CAAA;AAGhE;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG;IACnE,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,cAAc,CAAA;AAEnC,6FAA6F;AAC7F,wBAAgB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,aAEzC;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,6DAA6D;QAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAmB5E;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,iEAAiE;QACjE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,6DAA6D;QAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO;;;;;;GA0BjD;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,oBAanD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;CAC3B;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,oBAe/C;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,iEAAiE;QACjE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,4BAA4B;QAC5B,OAAO,EAAE,OAAO,CAAA;KACjB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO;;;eAQnD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;CAC3B"}