@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/cli/Session.js

@@ -0,0 +1,178 @@
+/**
+ * The CLI's stored session: the signed-in user, the tokens, and the access key that `tempo-id
+ * login` receives through Tempo ID's device grant as the `tempo-cli` app. The session lives in
+ * `id/credentials.json` under `TEMPO_HOME`, in a file only the current user can read.
+ * @module
+ */
+import * as Fs from 'node:fs/promises';
+import * as Os from 'node:os';
+import * as Path from 'node:path';
+import * as Actions from '../client/Actions.js';
+import * as Auth from '../client/Auth.js';
+import * as Key from '../client/Key.js';
+/** The client ID of Tempo ID's own device app, which every CLI shares. */
+export const clientId = 'tempo-cli';
+/** Returns the client of Tempo ID at `url`, or at `https://id.tempo.xyz`, as `tempo-cli`. */
+export function auth(options) {
+    return Auth.create({ clientId, url: options.url });
+}
+/**
+ * Returns the stored session, with its access token refreshed when it expires within 30 seconds.
+ * Returns `undefined` without a session, for a session without a user or an access key, or for one
+ * whose key expired or whose refresh fails, so the user signs in again. A session that another
+ * deployment issued also returns `undefined`, so its tokens never reach the deployment at `url`.
+ */
+export async function get(options) {
+    const read = await readSession(options);
+    const saved = read.status === 'found' ? read.session : undefined;
+    if (saved?.url !== new URL(auth(options).url).origin ||
+        !saved.user ||
+        !saved.key?.keyAuthorization ||
+        !saved.accessToken ||
+        Key.expired(saved.key))
+        return undefined;
+    if (saved.expiresAt - 30_000 > Date.now())
+        return saved;
+    if (!saved.refreshToken)
+        return undefined;
+    const tokens = await Actions.refresh(auth(options), {
+        refreshToken: saved.refreshToken,
+    }).catch(() => undefined);
+    if (!tokens)
+        return undefined;
+    return await save({ ...options, session: { ...saved, ...tokens } });
+}
+/**
+ * Starts Tempo ID's device grant with a new access key, and returns the code to show and `wait`.
+ * `wait` resolves once the user approves the code in a browser, stores the new session, revokes the
+ * refresh token of the session that it replaced, and returns the new session. It rejects with
+ * `Auth.RequestError` when the user denies the code or the code expires.
+ */
+export async function login(options) {
+    const client = auth(options);
+    const device = await Actions.device.authorize(client);
+    return {
+        ...device,
+        async wait() {
+            const { account: _, ...authorization } = await device.wait();
+            const replaced = await readSession(options);
+            // The new session is stored first, so a failed write keeps the replaced one usable.
+            const session = await save({
+                home: options.home,
+                session: { ...authorization, url: new URL(client.url).origin },
+            });
+            // The replaced session's refresh token goes only to the deployment that issued it.
+            if (replaced.status === 'found' &&
+                replaced.session.refreshToken &&
+                replaced.session.url)
+                await revoke({
+                    token: replaced.session.refreshToken,
+                    url: replaced.session.url,
+                });
+            return session;
+        },
+    };
+}
+/**
+ * Revokes the stored session's refresh token at the deployment that issued it, and deletes the
+ * session. A failed revocation, such as without a network, or a file that holds no readable
+ * session, still deletes it, and returns `false`.
+ */
+export async function remove(options) {
+    const read = await readSession(options);
+    const revoked = await (async () => {
+        if (read.status === 'missing')
+            return true;
+        if (read.status === 'invalid')
+            return false;
+        const { refreshToken, url } = read.session;
+        if (!refreshToken)
+            return true;
+        // A session stored before its origin was recorded names no deployment to revoke it at.
+        if (!url)
+            return false;
+        return await revoke({ token: refreshToken, url });
+    })();
+    await Fs.rm(file(options), { force: true });
+    return revoked;
+}
+/**
+ * Stores `session`, readable only by the current user, and returns it. The session replaces the
+ * stored one in one rename, so a failed write leaves the earlier session as it was.
+ */
+export async function save(options) {
+    const path = file(options);
+    await Fs.mkdir(Path.dirname(path), { mode: 0o700, recursive: true });
+    const temporary = `${path}.${crypto.randomUUID()}.tmp`;
+    try {
+        await Fs.writeFile(temporary, JSON.stringify(options.session), {
+            flag: 'wx',
+            mode: 0o600,
+        });
+        await Fs.rename(temporary, path);
+    }
+    catch (error) {
+        await Fs.rm(temporary, { force: true });
+        throw error;
+    }
+    return options.session;
+}
+/**
+ * Returns the signed-in user's email, from Tempo ID's UserInfo endpoint, and the Tempo Account that
+ * the session's access key acts for. Returns `undefined` without a session.
+ */
+export async function whoami(options) {
+    const session = await get(options);
+    if (!session)
+        return undefined;
+    // The UserInfo endpoint accepts the access token, as any Tempo API does.
+    const user = await Actions.oauth.userInfo(auth(options), {
+        accessToken: session.accessToken,
+    });
+    return { account: session.key.account, email: user.email };
+}
+/** Returns the path of the session's file under `home`, or under `~/.tempo` for an unset or empty `home`. */
+function file(options) {
+    return Path.join(options.home || Path.join(Os.homedir(), '.tempo'), 'id', 'credentials.json');
+}
+/**
+ * Reads the stored session. Returns `missing` without a file, and `invalid` for a file that holds
+ * no JSON object.
+ */
+async function readSession(options) {
+    return await Fs.readFile(file(options), 'utf8').then((text) => {
+        const session = (() => {
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        if (typeof session !== 'object' || !session)
+            return { status: 'invalid' };
+        return { session: session, status: 'found' };
+    }, (error) => {
+        if (error.code === 'ENOENT')
+            return { status: 'missing' };
+        return { status: 'invalid' };
+    });
+}
+/**
+ * Revokes `token` at the revocation endpoint (RFC 7009) of the deployment at `url`, and returns
+ * whether it succeeded. A deployment that does not respond within 10 seconds counts as a failure.
+ */
+async function revoke(options) {
+    const response = await fetch(new URL('/oauth2/revoke', options.url), {
+        body: new URLSearchParams({
+            client_id: clientId,
+            token: options.token,
+            token_type_hint: 'refresh_token',
+        }),
+        method: 'POST',
+        signal: AbortSignal.timeout(10_000),
+    }).catch(() => undefined);
+    await response?.body?.cancel();
+    return response?.ok ?? false;
+}
+//# sourceMappingURL=Session.js.map

package/dist/cli/Session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Session.js","sourceRoot":"","sources":["../../src/cli/Session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AAEzC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAA;AAWvC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAA;AAEnC,6FAA6F;AAC7F,MAAM,UAAU,IAAI,CAAC,OAAqB;IACxC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;AACpD,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAoB;IAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,IACE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM;QAChD,CAAC,KAAK,CAAC,IAAI;QACX,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB;QAC5B,CAAC,KAAK,CAAC,WAAW;QAClB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;QAEtB,OAAO,SAAS,CAAA;IAClB,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IACvD,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IAEzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,OAAO,MAAM,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAA;AACrE,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACrD,OAAO;QACL,GAAG,MAAM;QACT,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YAC3C,oFAAoF;YACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;aAC/D,CAAC,CAAA;YACF,mFAAmF;YACnF,IACE,QAAQ,CAAC,MAAM,KAAK,OAAO;gBAC3B,QAAQ,CAAC,OAAO,CAAC,YAAY;gBAC7B,QAAQ,CAAC,OAAO,CAAC,GAAG;gBAEpB,MAAM,MAAM,CAAC;oBACX,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;oBACpC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;iBAC1B,CAAC,CAAA;YACJ,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAuB;IAClD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QAC1C,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAA;QAC9B,uFAAuF;QACvF,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAA;QACtB,OAAO,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,OAAO,OAAO,CAAA;AAChB,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7D,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAA;QACF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACvC,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAA;AACxB,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAuB;IAClD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;AAC5D,CAAC;AAMD,6GAA6G;AAC7G,SAAS,IAAI,CAAC,OAAsC;IAClD,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EACjD,IAAI,EACJ,kBAAkB,CACnB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,OAAsC;IAK/D,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAClD,CAAC,IAAI,EAAU,EAAE;QACf,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzE,OAAO,EAAE,OAAO,EAAE,OAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACzD,CAAC,EACD,CAAC,KAAc,EAAU,EAAE;QACzB,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ;YACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9B,CAAC,CACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CAAC,OAAuC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;QACnE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,eAAe,EAAE,eAAe;SACjC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACzB,MAAM,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC9B,OAAO,QAAQ,EAAE,EAAE,IAAI,KAAK,CAAA;AAC9B,CAAC"}

package/dist/cli/User.d.ts

@@ -0,0 +1,29 @@
+/**
+ * What the `login`, `logout`, and `whoami` commands share: the variables that name Tempo ID and the
+ * session's folder, and the loader of the session module. incur imports every command when the CLI
+ * starts, so this module imports only incur, and the session module loads only when these commands
+ * run.
+ * @module
+ */
+import { z } from 'incur';
+/** The variables that name Tempo ID and the folder of the stored session. */
+export declare const env: z.ZodObject<{
+    TEMPO_HOME: z.ZodOptional<z.ZodString>;
+    TEMPO_ID_URL: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+/** The error for a command without Viem, which creates and signs with the access key. */
+export declare const missingPeers: {
+    readonly code: 'missing_peer';
+    readonly message: 'Missing peer dependency. Install viem to run login, logout, and whoami.';
+};
+/** The error for a command that needs a session, and finds none. */
+export declare const signedOut: {
+    readonly code: 'signed_out';
+    readonly message: 'Not signed in. Run `tempo-id login`.';
+};
+/**
+ * Loads the session module, or returns `undefined` when Viem, the client's optional peer, is not
+ * installed.
+ */
+export declare function loadSession(): Promise<typeof import("./Session.js") | undefined>;
+//# sourceMappingURL=User.d.ts.map

package/dist/cli/User.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/cli/User.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAGzB,6EAA6E;AAC7E,eAAO,MAAM,GAAG;;;iBAWd,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,YAAY;aACvB,IAAI,EAAE,cAAc;aACpB,OAAO,EACL,yEAAyE;CACnE,CAAA;AAEV,oEAAoE;AACpE,eAAO,MAAM,SAAS;aACpB,IAAI,EAAE,YAAY;aAClB,OAAO,EAAE,sCAAsC;CACvC,CAAA;AAEV;;;GAGG;AACH,wBAAsB,WAAW,uDAGhC"}

package/dist/cli/User.js

@@ -0,0 +1,39 @@
+/**
+ * What the `login`, `logout`, and `whoami` commands share: the variables that name Tempo ID and the
+ * session's folder, and the loader of the session module. incur imports every command when the CLI
+ * starts, so this module imports only incur, and the session module loads only when these commands
+ * run.
+ * @module
+ */
+import { z } from 'incur';
+import * as Admin from './Admin.js';
+/** The variables that name Tempo ID and the folder of the stored session. */
+export const env = z.object({
+    TEMPO_HOME: z
+        .string()
+        .optional()
+        .describe('The folder that holds the session, in id/credentials.json. Defaults to ~/.tempo.'),
+    TEMPO_ID_URL: z
+        .url()
+        .optional()
+        .describe("Tempo ID's origin. Defaults to https://id.tempo.xyz."),
+});
+/** The error for a command without Viem, which creates and signs with the access key. */
+export const missingPeers = {
+    code: 'missing_peer',
+    message: 'Missing peer dependency. Install viem to run login, logout, and whoami.',
+};
+/** The error for a command that needs a session, and finds none. */
+export const signedOut = {
+    code: 'signed_out',
+    message: 'Not signed in. Run `tempo-id login`.',
+};
+/**
+ * Loads the session module, or returns `undefined` when Viem, the client's optional peer, is not
+ * installed.
+ */
+export async function loadSession() {
+    // A dynamic import, since the module needs an optional peer that the other commands do not.
+    return await Admin.optional(import('./Session.js'));
+}
+//# sourceMappingURL=User.js.map

package/dist/cli/User.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.js","sourceRoot":"","sources":["../../src/cli/User.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AACzB,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAEnC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;IACH,YAAY,EAAE,CAAC;SACZ,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,cAAc;IACpB,OAAO,EACL,yEAAyE;CACnE,CAAA;AAEV,oEAAoE;AACpE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,sCAAsC;CACvC,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,4FAA4F;IAC5F,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AACrD,CAAC"}

package/dist/cli/V1.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `tempo-id v1` command group: one command per `/v1` route of a Tempo ID deployment, which incur
+ * generates from the deployment's OpenAPI document in its namespace mode, such as `tempo-id v1 auth
+ * providers` for `GET /v1/auth/providers`. The commands send no session, so the routes that need
+ * one refuse them with status 401.
+ * @module
+ */
+/**
+ * Fetches the OpenAPI document of the deployment at `url`, and returns the `v1` group's definition.
+ * The document keeps only the `/v1` routes, without the `/v1` prefix, which the group's name and
+ * base path supply. Rejects when the deployment does not respond within 10 seconds, or responds
+ * with an error.
+ */
+export declare function load(options: load.Options): Promise<{
+    basePath: string;
+    description: string;
+    fetch: (request: Request) => Promise<Response>;
+    openapi: {
+        paths: {
+            [k: string]: unknown;
+        };
+    };
+    openapiConfig: {
+        mode: 'namespace';
+    };
+}>;
+export declare namespace load {
+    type Options = {
+        /** The fetch that reaches the deployment. Defaults to the global `fetch`. */
+        fetch?: typeof globalThis.fetch | undefined;
+        /** Tempo ID's origin. */
+        url: string;
+    };
+}
+//# sourceMappingURL=V1.d.ts.map

package/dist/cli/V1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"V1.d.ts","sourceRoot":"","sources":["../../src/cli/V1.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO;;;qBAwB3B,OAAO;;;;;;;QAQP,IAAI,EAAE,WAAW;;GAErC;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,6EAA6E;QAC7E,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;QAC3C,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF"}

package/dist/cli/V1.js

@@ -0,0 +1,41 @@
+/**
+ * The `tempo-id v1` command group: one command per `/v1` route of a Tempo ID deployment, which incur
+ * generates from the deployment's OpenAPI document in its namespace mode, such as `tempo-id v1 auth
+ * providers` for `GET /v1/auth/providers`. The commands send no session, so the routes that need
+ * one refuse them with status 401.
+ * @module
+ */
+/**
+ * Fetches the OpenAPI document of the deployment at `url`, and returns the `v1` group's definition.
+ * The document keeps only the `/v1` routes, without the `/v1` prefix, which the group's name and
+ * base path supply. Rejects when the deployment does not respond within 10 seconds, or responds
+ * with an error.
+ */
+export async function load(options) {
+    const { url } = options;
+    const fetch = options.fetch ?? globalThis.fetch;
+    const response = await fetch(new URL('/openapi.json', url), {
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`Tempo ID at ${url} responded to /openapi.json with ${response.status}.`);
+    const document = (await response.json());
+    const paths = Object.fromEntries(Object.entries(document.paths ?? {}).flatMap(([path, item]) => path.startsWith('/v1/') ? [[path.slice('/v1'.length), item]] : []));
+    return {
+        basePath: '/v1',
+        description: "Call Tempo ID's /v1 API, one command per route.",
+        // Each request goes to the deployment, whatever origin incur builds it with. The path is set on
+        // the deployment's URL, never resolved against it, so a path argument such as `//host` keeps
+        // the deployment's origin.
+        fetch: (request) => {
+            const source = new URL(request.url);
+            const target = new URL(url);
+            target.pathname = source.pathname;
+            target.search = source.search;
+            return fetch(new Request(target, request));
+        },
+        openapi: { ...document, paths },
+        openapiConfig: { mode: 'namespace' },
+    };
+}
+//# sourceMappingURL=V1.js.map

package/dist/cli/V1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"V1.js","sourceRoot":"","sources":["../../src/cli/V1.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC9C,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE;QAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,oCAAoC,QAAQ,CAAC,MAAM,GAAG,CACzE,CAAA;IACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEtC,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAC5D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAClE,CACF,CAAA;IACD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iDAAiD;QAC9D,gGAAgG;QAChG,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,EAAE,CAAC,OAAgB,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;YACjC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC7B,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE;QAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE;KAC9C,CAAA;AACH,CAAC"}

package/dist/cli/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/cli/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":""}

package/dist/cli/bin.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/**
+ * Runs the `tempo-id` CLI with the process's arguments. Only `v1` and `--mcp` load Tempo ID's
+ * OpenAPI document, so every other command starts without the network. When the deployment does not
+ * respond, a `v1` command exits with code 1, and an MCP server serves the other commands. Both warn
+ * on stderr.
+ * @module
+ */
+import * as Cli from './Cli.js';
+import * as V1 from './V1.js';
+const argv = process.argv.slice(2);
+const url = process.env.TEMPO_ID_URL ?? 'https://id.tempo.xyz';
+/** incur's global options that take a value, which the command follows. */
+const valued = [
+    '--filter-output',
+    '--format',
+    '--token-limit',
+    '--token-offset',
+];
+// The command is the first argument that is no option, since global options, such as
+// `--format json`, can come before it. An argument of another command can be `v1` too.
+const command = (() => {
+    for (let index = 0; index < argv.length; index++) {
+        const entry = argv[index];
+        if (!entry.startsWith('-'))
+            return entry;
+        if (valued.includes(entry))
+            index++;
+    }
+    return undefined;
+})();
+const group = command === 'v1';
+const v1 = await (async () => {
+    if (!group && !argv.includes('--mcp'))
+        return undefined;
+    return await V1.load({ url }).catch((error) => {
+        process.stderr.write(`The v1 commands are unavailable: ${error instanceof Error ? error.message : String(error)}\n`);
+        return null;
+    });
+})();
+// A `v1` command fails without its group. An MCP server serves the other commands.
+if (v1 === null && group)
+    process.exitCode = 1;
+else
+    await Cli.create({ v1: v1 ?? undefined }).serve();
+//# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,sBAAsB,CAAA;AAC9D,2EAA2E;AAC3E,MAAM,MAAM,GAAG;IACb,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,gBAAgB;CACjB,CAAA;AACD,qFAAqF;AACrF,uFAAuF;AACvF,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAE,CAAA;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,EAAE,CAAA;IACrC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAC,EAAE,CAAA;AACJ,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,CAAA;AAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;IAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IACvD,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC/F,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,EAAE,CAAA;AAEJ,mFAAmF;AACnF,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK;IAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;;IACzC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA"}

package/dist/cli/commands/admin/apps/create.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `tempo-id admin apps create`: registers an OAuth app. The output holds the client secret, which no
+ * later command returns.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<undefined, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+    TEMPO_ID_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    device: z.ZodDefault<z.ZodBoolean>;
+    name: z.ZodString;
+    native: z.ZodDefault<z.ZodBoolean>;
+    postLogoutRedirectUri: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    redirectUri: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    secret: z.ZodDefault<z.ZodBoolean>;
+    sign: z.ZodDefault<z.ZodBoolean>;
+    skipConsent: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=create.d.ts.map

package/dist/cli/commands/admin/apps/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/apps/create.js

@@ -0,0 +1,89 @@
+/**
+ * `tempo-id admin apps create`: registers an OAuth app. The output holds the client secret, which no
+ * later command returns.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../Admin.js';
+export default Cli.command({
+    description: 'Register an OAuth app. The output holds its client secret, which no later command returns.',
+    env: Admin.env.extend({
+        TEMPO_ID_CLIENT_SECRET: z
+            .string()
+            .optional()
+            .describe('Client secret to keep with --secret, such as one that another deployment issued. No flag takes it, so it stays out of the shell history.'),
+    }),
+    // Hidden from MCP clients, as is every `admin apps` command, since the group returns client secrets.
+    mcp: false,
+    options: Admin.options.extend({
+        clientId: z
+            .string()
+            .optional()
+            .describe('Client ID to keep, such as one that another deployment issued. Defaults to a random ID.'),
+        device: z
+            .boolean()
+            .default(false)
+            .describe('Sign in through the device grant instead of a redirect, as a CLI does. A device app needs no redirect URI.'),
+        name: z.string().describe('Display name, which the approval page shows.'),
+        native: z
+            .boolean()
+            .default(false)
+            .describe('Register a mobile app instead of a web app.'),
+        postLogoutRedirectUri: z
+            .array(z.string())
+            .default([])
+            .describe('URI that the app returns to after it ends the session. Repeat the flag for each URI.'),
+        redirectUri: z
+            .array(z.string())
+            .default([])
+            .describe('Redirect URI. Repeat the flag for each URI, in each environment. Every app but a device app needs one.'),
+        secret: z
+            .boolean()
+            .default(false)
+            .describe('Issue a client secret, for an app with a backend. TEMPO_ID_CLIENT_SECRET sets it instead of a new one.'),
+        sign: z
+            .boolean()
+            .default(false)
+            .describe('Grant the tempo-id:sign scope, which permits the app to bind its own challenges.'),
+        skipConsent: z
+            .boolean()
+            .default(false)
+            .describe('Skip the approval page for requests without a key.'),
+    }),
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Apps = await Admin.loadApps();
+        if (!Apps)
+            return c.error(Admin.missingPeers);
+        const client = Apps.connect({ connectionString });
+        try {
+            return await Apps.Apps.create(client.db, {
+                clientId: c.options.clientId,
+                // The variable applies only with `--secret`, so an exported one never makes an app confidential.
+                clientSecret: c.options.secret
+                    ? c.env.TEMPO_ID_CLIENT_SECRET
+                    : undefined,
+                device: c.options.device,
+                name: c.options.name,
+                postLogoutRedirectUris: c.options.postLogoutRedirectUri,
+                redirectUris: c.options.redirectUri,
+                secret: c.options.secret,
+                sign: c.options.sign,
+                skipConsent: c.options.skipConsent,
+                type: c.options.native ? 'native' : 'web',
+            });
+        }
+        catch (error) {
+            const refusal = Apps.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=create.js.map

package/dist/cli/commands/admin/apps/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAA;AAE1C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EACT,4FAA4F;IAC9F,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB,sBAAsB,EAAE,CAAC;aACtB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,0IAA0I,CAC3I;KACJ,CAAC;IACF,qGAAqG;IACrG,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,yFAAyF,CAC1F;QACH,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,4GAA4G,CAC7G;QACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QACzE,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,qBAAqB,EAAE,CAAC;aACrB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,sFAAsF,CACvF;QACH,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,wGAAwG,CACzG;QACH,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,wGAAwG,CACzG;QACH,IAAI,EAAE,CAAC;aACJ,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,kFAAkF,CACnF;QACH,WAAW,EAAE,CAAC;aACX,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,oDAAoD,CAAC;KAClE,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gBACvC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAC5B,iGAAiG;gBACjG,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;oBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB;oBAC9B,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;gBACxB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;gBACpB,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;gBACvD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;gBACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;gBACxB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;gBACpB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;gBAClC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;aAC1C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/apps/delete.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `tempo-id admin apps delete`: removes an OAuth app, with its consents, tokens, and realms.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    clientId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=delete.d.ts.map

package/dist/cli/commands/admin/apps/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/delete.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/apps/delete.js

@@ -0,0 +1,41 @@
+/**
+ * `tempo-id admin apps delete`: removes an OAuth app, with its consents, tokens, and realms.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        clientId: z.string().describe("OAuth app's client ID."),
+    }),
+    description: 'Remove an app, with its consents, tokens, and realms.',
+    env: Admin.env,
+    // Hidden from MCP clients, as is every `admin apps` command, since the group returns client secrets.
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Apps = await Admin.loadApps();
+        if (!Apps)
+            return c.error(Admin.missingPeers);
+        const client = Apps.connect({ connectionString });
+        try {
+            const app = await Apps.Apps.remove(client.db, {
+                clientId: c.args.clientId,
+            });
+            return { removed: app.clientId };
+        }
+        catch (error) {
+            const refusal = Apps.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=delete.js.map

package/dist/cli/commands/admin/apps/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/delete.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAA;AAE1C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACxD,CAAC;IACF,WAAW,EAAE,uDAAuD;IACpE,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,qGAAqG;IACrG,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gBAC5C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;aAC1B,CAAC,CAAA;YACF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/apps/index.d.ts

@@ -0,0 +1,5 @@
+/** `tempo-id admin apps`: the commands that register and change OAuth apps. @module */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, undefined, undefined, undefined>;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/commands/admin/apps/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/apps/index.js

@@ -0,0 +1,14 @@
+/** `tempo-id admin apps`: the commands that register and change OAuth apps. @module */
+import { Cli } from 'incur';
+export default Cli.command({
+    description: 'Manage OAuth apps, their redirect URIs, and their scopes.',
+    // Hidden from MCP clients, as is every `admin apps` command, since the group returns client secrets.
+    mcp: false,
+    run(c) {
+        return c.error({
+            code: 'missing_command',
+            message: 'Missing command. Run `tempo-id admin apps --help` to list the commands.',
+        });
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/commands/admin/apps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAE3B,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EAAE,2DAA2D;IACxE,qGAAqG;IACrG,GAAG,EAAE,KAAK;IACV,GAAG,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EACL,yEAAyE;SAC5E,CAAC,CAAA;IACJ,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/apps/list.d.ts

@@ -0,0 +1,9 @@
+/** `tempo-id admin apps list`: lists every OAuth app, oldest first. @module */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, import("zod").ZodObject<{
+    DATABASE_URL: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+    databaseUrl: import("zod").ZodOptional<import("zod").ZodString>;
+}, import("zod/v4/core").$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=list.d.ts.map