@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/cli/commands/admin/realms/privy/set.js

@@ -0,0 +1,66 @@
+/**
+ * `tempo-id admin realms privy set`: sets the Privy app of a realm. The database holds the app
+ * secret only encrypted with `SECRET`.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        realmId: z.string().describe('Realm ID, such as tempo-cash.'),
+    }),
+    description: "Set the Privy app that holds a realm's Privy owners. It replaces an earlier Privy app.",
+    env: Admin.env.extend({
+        PRIVY_APP_SECRET: z
+            .string()
+            .optional()
+            .describe('Privy app secret. No flag takes it, so it stays out of the shell history.'),
+        SECRET: z
+            .string()
+            .optional()
+            .describe("The deployment's SECRET variable, which encrypts the app secret."),
+    }),
+    mcp: false,
+    options: Admin.options.extend({
+        appId: z.string().describe('Privy app ID.'),
+    }),
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const appSecret = c.env.PRIVY_APP_SECRET;
+        if (!appSecret)
+            return c.error({
+                code: 'missing_app_secret',
+                message: 'Missing Privy app secret. Set PRIVY_APP_SECRET.',
+            });
+        if (!c.env.SECRET)
+            return c.error({
+                code: 'missing_secret',
+                message: "Missing SECRET. Set it to the deployment's SECRET variable, which encrypts the app secret.",
+            });
+        const Realms = await Admin.loadRealms();
+        if (!Realms)
+            return c.error(Admin.missingPeers);
+        const client = Realms.connect({ connectionString });
+        try {
+            const realm = await Realms.Realm.setPrivy(client.db, {
+                appId: c.options.appId,
+                appSecret,
+                realmId: c.args.realmId,
+                secret: c.env.SECRET,
+            });
+            return { realm };
+        }
+        catch (error) {
+            const refusal = Realms.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=set.js.map

package/dist/cli/commands/admin/realms/privy/set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/privy/set.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAE7C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KAC9D,CAAC;IACF,WAAW,EACT,wFAAwF;IAC1F,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB,gBAAgB,EAAE,CAAC;aAChB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,2EAA2E,CAC5E;QACH,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,kEAAkE,CACnE;KACJ,CAAC;IACF,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;KAC5C,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAA;QACxC,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,CAAC,KAAK,CAAC;gBACb,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAA;QACJ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;YACf,OAAO,CAAC,CAAC,KAAK,CAAC;gBACb,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EACL,4FAA4F;aAC/F,CAAC,CAAA;QAEJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE;gBACnD,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;gBACtB,SAAS;gBACT,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;aACrB,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/realms/remove.d.ts

@@ -0,0 +1,11 @@
+/** `tempo-id admin realms remove`: removes a realm that no app reaches. @module */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=remove.d.ts.map

package/dist/cli/commands/admin/realms/remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/realms/remove.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/realms/remove.js

@@ -0,0 +1,35 @@
+/** `tempo-id admin realms remove`: removes a realm that no app reaches. @module */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        id: z.string().describe('Realm ID, such as tempo-cash.'),
+    }),
+    description: 'Remove a realm and its owner configurations. No app can name it.',
+    env: Admin.env,
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Realms = await Admin.loadRealms();
+        if (!Realms)
+            return c.error(Admin.missingPeers);
+        const client = Realms.connect({ connectionString });
+        try {
+            await Realms.Realm.remove(client.db, { id: c.args.id });
+            return { removed: c.args.id };
+        }
+        catch (error) {
+            const refusal = Realms.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=remove.js.map

package/dist/cli/commands/admin/realms/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/realms/remove.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAA;AAE1C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACzD,CAAC;IACF,WAAW,EACT,kEAAkE;IACpE,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;YACvD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/realms/secp256k1/disable.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `tempo-id admin realms secp256k1 disable`: turns off the secp256k1 owners that Tempo ID holds in a
+ * realm. The realm keeps the keys it holds, and lists them again when turned on.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    realmId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=disable.d.ts.map

package/dist/cli/commands/admin/realms/secp256k1/disable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/secp256k1/disable.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/realms/secp256k1/disable.js

@@ -0,0 +1,42 @@
+/**
+ * `tempo-id admin realms secp256k1 disable`: turns off the secp256k1 owners that Tempo ID holds in a
+ * realm. The realm keeps the keys it holds, and lists them again when turned on.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        realmId: z.string().describe('Realm ID, such as default.'),
+    }),
+    description: 'Turn off the secp256k1 owners that Tempo ID holds in a realm. The realm keeps its stored keys.',
+    env: Admin.env,
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Realms = await Admin.loadRealms();
+        if (!Realms)
+            return c.error(Admin.missingPeers);
+        const client = Realms.connect({ connectionString });
+        try {
+            const realm = await Realms.Realm.setSecp256k1(client.db, {
+                enabled: false,
+                realmId: c.args.realmId,
+            });
+            return { realm };
+        }
+        catch (error) {
+            const refusal = Realms.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=disable.js.map

package/dist/cli/commands/admin/realms/secp256k1/disable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disable.js","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/secp256k1/disable.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAE7C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KAC3D,CAAC;IACF,WAAW,EACT,gGAAgG;IAClG,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE;gBACvD,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;aACxB,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/realms/secp256k1/enable.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `tempo-id admin realms secp256k1 enable`: turns on the secp256k1 owners that Tempo ID holds in a
+ * realm, which then creates a user's first account there with a key that Tempo ID holds.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    realmId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=enable.d.ts.map

package/dist/cli/commands/admin/realms/secp256k1/enable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/secp256k1/enable.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/realms/secp256k1/enable.js

@@ -0,0 +1,42 @@
+/**
+ * `tempo-id admin realms secp256k1 enable`: turns on the secp256k1 owners that Tempo ID holds in a
+ * realm, which then creates a user's first account there with a key that Tempo ID holds.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        realmId: z.string().describe('Realm ID, such as default.'),
+    }),
+    description: 'Turn on the secp256k1 owners that Tempo ID holds in a realm, for tests and local development. Never turn them on in production, since the keys stay in the database.',
+    env: Admin.env,
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Realms = await Admin.loadRealms();
+        if (!Realms)
+            return c.error(Admin.missingPeers);
+        const client = Realms.connect({ connectionString });
+        try {
+            const realm = await Realms.Realm.setSecp256k1(client.db, {
+                enabled: true,
+                realmId: c.args.realmId,
+            });
+            return { realm };
+        }
+        catch (error) {
+            const refusal = Realms.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=enable.js.map

package/dist/cli/commands/admin/realms/secp256k1/enable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.js","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/secp256k1/enable.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAE7C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KAC3D,CAAC;IACF,WAAW,EACT,sKAAsK;IACxK,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE;gBACvD,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;aACxB,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/realms/secp256k1/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `tempo-id admin realms secp256k1`: the commands that turn on and off the secp256k1 owners that
+ * Tempo ID holds in a realm.
+ * @module
+ */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, undefined, undefined, undefined>;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/commands/admin/realms/secp256k1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/secp256k1/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/realms/secp256k1/index.js

@@ -0,0 +1,17 @@
+/**
+ * `tempo-id admin realms secp256k1`: the commands that turn on and off the secp256k1 owners that
+ * Tempo ID holds in a realm.
+ * @module
+ */
+import { Cli } from 'incur';
+export default Cli.command({
+    description: 'Manage the secp256k1 owners that Tempo ID holds in a realm, for tests and local development.',
+    mcp: false,
+    run(c) {
+        return c.error({
+            code: 'missing_command',
+            message: 'Missing command. Run `tempo-id admin realms secp256k1 --help` to list the commands.',
+        });
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/commands/admin/realms/secp256k1/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/cli/commands/admin/realms/secp256k1/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAE3B,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EACT,8FAA8F;IAChG,GAAG,EAAE,KAAK;IACV,GAAG,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAA;IACJ,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/realms/set.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `tempo-id admin realms set`: sets the realms that one app reaches, in order. The first realm holds
+ * a user's first account.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    clientId: z.ZodString;
+    realms: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=set.d.ts.map

package/dist/cli/commands/admin/realms/set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/realms/set.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/realms/set.js

@@ -0,0 +1,46 @@
+/**
+ * `tempo-id admin realms set`: sets the realms that one app reaches, in order. The first realm holds
+ * a user's first account.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        clientId: z.string().describe("OAuth app's client ID."),
+        realms: z
+            .array(z.string())
+            .default([])
+            .describe('Realm IDs, in order, such as default tempo-cash. None resets the app to the default realm.'),
+    }),
+    description: 'Set the realms that an app reaches, in order. The first realm holds a first account.',
+    env: Admin.env,
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Realms = await Admin.loadRealms();
+        if (!Realms)
+            return c.error(Admin.missingPeers);
+        const client = Realms.connect({ connectionString });
+        try {
+            const realms = await Realms.Realm.setForApp(client.db, {
+                clientId: c.args.clientId,
+                realms: c.args.realms,
+            });
+            return { realms };
+        }
+        catch (error) {
+            const refusal = Realms.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=set.js.map

package/dist/cli/commands/admin/realms/set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/realms/set.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAA;AAE1C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACvD,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,4FAA4F,CAC7F;KACJ,CAAC;IACF,WAAW,EACT,sFAAsF;IACxF,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE;gBACrD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;aACtB,CAAC,CAAA;YACF,OAAO,EAAE,MAAM,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/rotate-key.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `tempo-id admin rotate-key`: adds a new signing key, and retires the earlier one. `GET /oauth2/jwks`
+ * serves the new key at once, Tempo ID signs with it after the publication delay, and the JWKS serves
+ * the earlier key through its grace period.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<undefined, z.ZodObject<{
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+    SECRET: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=rotate-key.d.ts.map

package/dist/cli/commands/admin/rotate-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-key.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/admin/rotate-key.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/rotate-key.js

@@ -0,0 +1,46 @@
+/**
+ * `tempo-id admin rotate-key`: adds a new signing key, and retires the earlier one. `GET /oauth2/jwks`
+ * serves the new key at once, Tempo ID signs with it after the publication delay, and the JWKS serves
+ * the earlier key through its grace period.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../Admin.js';
+export default Cli.command({
+    description: 'Rotate the signing key. The new key signs after 5 minutes, and the JWKS serves the earlier key for 30 more days.',
+    env: Admin.env.extend({
+        SECRET: z
+            .string()
+            .optional()
+            .describe("The deployment's SECRET variable, which encrypts the signing keys."),
+    }),
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        if (!c.env.SECRET)
+            return c.error({
+                code: 'missing_secret',
+                message: "Missing SECRET. Set it to the deployment's SECRET variable, which encrypts the signing keys.",
+            });
+        const Apps = await Admin.loadApps();
+        if (!Apps)
+            return c.error(Admin.missingPeers);
+        const client = Apps.connect({ connectionString });
+        try {
+            return await Apps.SigningKey.rotate(client.db, { secret: c.env.SECRET });
+        }
+        catch (error) {
+            const refusal = Apps.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=rotate-key.js.map

package/dist/cli/commands/admin/rotate-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-key.js","sourceRoot":"","sources":["../../../../src/cli/commands/admin/rotate-key.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAA;AAEvC,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EACT,kHAAkH;IACpH,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,oEAAoE,CACrE;KACJ,CAAC;IACF,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC/D,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;YACf,OAAO,CAAC,CAAC,KAAK,CAAC;gBACb,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EACL,8FAA8F;aACjG,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/init.d.ts

@@ -0,0 +1,11 @@
+/** `tempo-id init`: writes a Tempo ID Worker project. @module */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    dir: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined, z.ZodObject<{
+    from: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=init.d.ts.map

package/dist/cli/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/init.js

@@ -0,0 +1,34 @@
+/** `tempo-id init`: writes a Tempo ID Worker project. @module */
+import { Cli, z } from 'incur';
+import * as Project from '../Project.js';
+export default Cli.command({
+    args: z.object({
+        dir: z
+            .string()
+            .optional()
+            .describe('The folder to write the project in. Defaults to the working directory.'),
+    }),
+    description: 'Write a Tempo ID Worker project.',
+    mcp: false,
+    options: z.object({
+        from: z
+            .string()
+            .describe('The sender of every email, such as "Tempo ID <noreply@id.example.com>".'),
+        name: z
+            .string()
+            .optional()
+            .describe("The project's package name and Worker name. Defaults to the folder's name."),
+        url: z
+            .string()
+            .describe("Tempo ID's origin, such as https://id.example.com, and every token's iss."),
+    }),
+    run(c) {
+        return Project.init({
+            from: c.options.from,
+            name: c.options.name,
+            root: c.args.dir ?? process.cwd(),
+            url: c.options.url,
+        });
+    },
+});
+//# sourceMappingURL=init.js.map

package/dist/cli/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,wEAAwE,CACzE;KACJ,CAAC;IACF,WAAW,EAAE,kCAAkC;IAC/C,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,CACP,yEAAyE,CAC1E;QACH,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,4EAA4E,CAC7E;QACH,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,QAAQ,CACP,2EAA2E,CAC5E;KACJ,CAAC;IACF,GAAG,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;YACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG;SACnB,CAAC,CAAA;IACJ,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/login.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `tempo-id login`: signs in through Tempo ID's device grant as the `tempo-cli` app, and stores the
+ * session with its access key.
+ * @module
+ */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, import("zod").ZodObject<{
+    TEMPO_HOME: import("zod").ZodOptional<import("zod").ZodString>;
+    TEMPO_ID_URL: import("zod").ZodOptional<import("zod").ZodURL>;
+}, import("zod/v4/core").$strip>, undefined, undefined>;
+export default _default;
+//# sourceMappingURL=login.d.ts.map

package/dist/cli/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/login.js

@@ -0,0 +1,29 @@
+/**
+ * `tempo-id login`: signs in through Tempo ID's device grant as the `tempo-cli` app, and stores the
+ * session with its access key.
+ * @module
+ */
+import { Cli } from 'incur';
+import * as User from '../User.js';
+export default Cli.command({
+    description: 'Sign in by approving a code in any browser, and store the session.',
+    env: User.env,
+    // An agent cannot approve the code in a browser for the user.
+    mcp: false,
+    async *run(c) {
+        const Session = await User.loadSession();
+        if (!Session)
+            return c.error(User.missingPeers);
+        const options = { home: c.env.TEMPO_HOME, url: c.env.TEMPO_ID_URL };
+        const device = await Session.login(options);
+        yield `Open ${device.verificationUriComplete}`;
+        yield `and confirm the code ${device.userCode}.`;
+        const session = await device.wait().catch((error) => error);
+        if (session instanceof Error)
+            return c.error({ code: 'not_signed_in', message: session.message });
+        // A streaming command prints what it yields, not what it returns.
+        yield `Signed in as ${session.user.email}.`;
+        return c.ok({ account: session.key.account, email: session.user.email });
+    },
+});
+//# sourceMappingURL=login.js.map

package/dist/cli/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAC3B,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAElC,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EACT,oEAAoE;IACtE,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,8DAA8D;IAC9D,GAAG,EAAE,KAAK;IACV,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAA;QACnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,QAAQ,MAAM,CAAC,uBAAuB,EAAE,CAAA;QAC9C,MAAM,wBAAwB,MAAM,CAAC,QAAQ,GAAG,CAAA;QAEhD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,OAAO,YAAY,KAAK;YAC1B,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAErE,kEAAkE;QAClE,MAAM,gBAAgB,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAA;QAC3C,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/logout.d.ts

@@ -0,0 +1,8 @@
+/** `tempo-id logout`: revokes the stored session's refresh token, and deletes the session. @module */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, import("zod").ZodObject<{
+    TEMPO_HOME: import("zod").ZodOptional<import("zod").ZodString>;
+    TEMPO_ID_URL: import("zod").ZodOptional<import("zod").ZodURL>;
+}, import("zod/v4/core").$strip>, undefined, undefined>;
+export default _default;
+//# sourceMappingURL=logout.d.ts.map

package/dist/cli/commands/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/logout.js

@@ -0,0 +1,19 @@
+/** `tempo-id logout`: revokes the stored session's refresh token, and deletes the session. @module */
+import { Cli } from 'incur';
+import * as User from '../User.js';
+export default Cli.command({
+    description: 'Sign out on this machine, and revoke the refresh token.',
+    env: User.env,
+    mcp: false,
+    async run(c) {
+        const Session = await User.loadSession();
+        if (!Session)
+            return c.error(User.missingPeers);
+        const revoked = await Session.remove({
+            home: c.env.TEMPO_HOME,
+            url: c.env.TEMPO_ID_URL,
+        });
+        return { revoked, signed_out: true };
+    },
+});
+//# sourceMappingURL=logout.js.map

package/dist/cli/commands/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAC3B,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAElC,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EAAE,yDAAyD;IACtE,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,GAAG,EAAE,KAAK;IACV,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY;SACxB,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IACtC,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/whoami.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `tempo-id whoami`: shows the signed-in user's email and the Tempo Account of the stored access
+ * key, with the access token refreshed when it expires.
+ * @module
+ */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, import("zod").ZodObject<{
+    TEMPO_HOME: import("zod").ZodOptional<import("zod").ZodString>;
+    TEMPO_ID_URL: import("zod").ZodOptional<import("zod").ZodURL>;
+}, import("zod/v4/core").$strip>, undefined, undefined>;
+export default _default;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/cli/commands/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA"}