@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/client/Decorator.d.ts

@@ -0,0 +1,170 @@
+/**
+ * `tempoId`, a Viem client extension that adds Tempo ID's actions as `client.auth`. It reads the
+ * chain from the client, and sets the client's {@link Auth.Account} at each sign-in, so the client
+ * sends with the signed-in user's access key.
+ *
+ * @example
+ * ```ts
+ * import { Auth, tempoId } from '@tempoxyz/id/client'
+ * import { createClient } from 'viem/tempo'
+ * import { tempoTestnet } from 'viem/tempo/chains'
+ *
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ *
+ * await client.auth.email.signIn({ code, email })
+ * await client.token.transferSync({ amount, to, token })
+ * ```
+ * @module
+ */
+import type { Chain, Client, Transport } from 'viem';
+import * as Actions from './Actions.js';
+import * as Auth from './Auth.js';
+import type { Authorization } from './Authorization.js';
+import * as Key from './Key.js';
+import type * as Pending from './Pending.js';
+import type { User } from './User.js';
+/** A client created without `account: Auth.account()`, which the extension sets at sign-in. */
+export declare class AccountRequiredError extends Error {
+    readonly name = "Decorator.AccountRequiredError";
+    constructor();
+}
+/** A client created without a chain, which the extension reads the instance's `chainId` from. */
+export declare class ChainRequiredError extends Error {
+    readonly name = "Decorator.ChainRequiredError";
+    constructor();
+}
+/**
+ * A sign-in that another sign-in or a sign-out overtook. The client keeps the newer state, so the
+ * overtaken authorization is never returned to sign with.
+ */
+export declare class SupersededError extends Error {
+    readonly name = "Decorator.SupersededError";
+    constructor();
+}
+/**
+ * Returns a Viem client extension that adds Tempo ID's actions as `client.auth`. Each member calls
+ * the action of the same name in `Actions` with one instance, whose `chainId` is the client's chain.
+ * Each sign-in sets the client's account to the authorization's, and `signOut` empties it at once.
+ * A sign-in that another sign-in or a sign-out overtook throws {@link SupersededError}. Throws
+ * {@link ChainRequiredError} for a client without a chain, and {@link AccountRequiredError} for one
+ * whose account is not an `Auth.account()`.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export declare function tempoId(options: tempoId.Options): <transport extends Transport, chain extends Chain>(client: Client<transport, chain, Auth.Account>) => tempoId.Decorator<chain['id']>;
+export declare namespace tempoId {
+    /** `Auth.create`'s options, without `chainId`, which the extension reads from the client. */
+    type Options = Omit<Auth.create.Options, 'chainId'>;
+    /**
+     * What the extension adds to a client on the chain `chainId`. Each member's `permissions.chainId`
+     * defaults to `chainId`, and an override names another chain.
+     */
+    type Decorator<chainId extends number> = {
+        /** Tempo ID's actions, with the extension's instance. */
+        auth: {
+            /** Actions for the user's Tempo Account. */
+            account: {
+                /** `Actions.account.get`. */
+                get: () => Promise<Actions.account.get.ReturnType>;
+            };
+            /**
+             * `Actions.authorize`, which sets the client's account, or empties it for an authorization
+             * without a key or a user without a session.
+             */
+            authorize: <const id extends number = chainId, const key extends boolean = true>(options?: Actions.authorize.Options<id, key>) => Promise<Actions.authorize.ReturnType<id, key>>;
+            /** Actions for device authorization grants. */
+            device: {
+                /** `Actions.device.authorize`, whose `wait` sets the client's account. */
+                authorize: <const id extends number = chainId>(options?: Actions.device.authorize.Options<id>) => Promise<Actions.device.authorize.ReturnType<id>>;
+            };
+            /** Actions for sign-in with an emailed code. */
+            email: {
+                /** `Actions.email.sendCode`. */
+                sendCode: (options: Actions.email.sendCode.Options) => Promise<void>;
+                /**
+                 * `Actions.email.signIn`, which sets the client's account, or empties it for a sign-in without
+                 * a key, or for a refusal whose `signedIn` is `true`. A sign-in that another sign-in or a
+                 * sign-out overtook throws {@link SupersededError}.
+                 */
+                signIn: <const id extends number = chainId, const key extends boolean = true>(options: Actions.email.signIn.Options<id, key>) => Promise<Actions.email.signIn.ReturnType<id, key>>;
+            };
+            /** The instance the members call `Actions` with. */
+            instance: Auth.Auth;
+            /** Actions for the issuer's OAuth endpoints. */
+            oauth: {
+                /** `Actions.oauth.introspect`. */
+                introspect: (options: Actions.oauth.introspect.Options) => Promise<Actions.oauth.introspect.ReturnType>;
+                /** `Actions.oauth.jwks`. */
+                jwks: () => Promise<Actions.oauth.jwks.ReturnType>;
+                /** `Actions.oauth.userInfo`. */
+                userInfo: (options: Actions.oauth.userInfo.Options) => Promise<User>;
+            };
+            /** Actions for sign-in with a passkey. */
+            passkey: {
+                /**
+                 * `Actions.passkey.signIn`, which sets the client's account unless it returns a step, as
+                 * `auth.email.signIn` does. A step or sign-in that another sign-in or a sign-out overtook
+                 * throws {@link SupersededError}.
+                 */
+                signIn: <const id extends number = chainId, const key extends boolean = true>(options?: Actions.passkey.signIn.Options<id, key>) => Promise<Actions.passkey.signIn.ReturnType<id, key>>;
+            };
+            /** Actions for sign-in with an identity provider, such as Google or SSO. */
+            provider: {
+                /** `Actions.provider.list`. */
+                list: () => Promise<Actions.provider.list.ReturnType>;
+                /** `Actions.provider.signIn`. */
+                signIn: (options: Actions.provider.signIn.Options) => void;
+            };
+            /** Actions for the realms the app reaches. */
+            realm: {
+                /** `Actions.realm.list`. */
+                list: () => Promise<Actions.realm.list.ReturnType>;
+            };
+            /** Actions for sign-in through a redirect to Tempo ID's pages. */
+            redirect: {
+                /**
+                 * `Actions.redirect.complete`, which sets the client's account, or empties it for a sign-in
+                 * without a key. The first call settles the page load's redirect, and later calls return
+                 * the same result.
+                 */
+                complete: <const key extends boolean = true>(options?: Actions.redirect.complete.Options<key>) => Promise<Actions.redirect.complete.ReturnType<key>>;
+                /** `Actions.redirect.createUrl`. */
+                createUrl: <const key extends boolean = true>(options?: Actions.redirect.createUrl.Options<key>) => Promise<Actions.redirect.createUrl.ReturnType<key>>;
+                /**
+                 * `Actions.redirect.handleCallback`, which sets the client's account, or empties it for a
+                 * sign-in without a key.
+                 */
+                handleCallback: <const pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending>(options: Actions.redirect.handleCallback.Options<pending>) => Promise<Actions.redirect.handleCallback.ReturnType<pending>>;
+                /** `Actions.redirect.start`. */
+                start: (options?: Actions.redirect.start.Options) => Promise<void>;
+            };
+            /** `Actions.refresh`. */
+            refresh: (options: Actions.refresh.Options) => ReturnType<typeof Actions.refresh>;
+            /**
+             * Rebuilds a stored authorization's account with `Key.toAccount`, sets the client's account to
+             * it, and returns the authorization. `Key.from` fills the key's `chainId` when a sign-in stored
+             * before it existed leaves it out. Throws `Key.AccessKeyRequiredError` for a key that carries
+             * no material without the `accessKey` the app supplied.
+             */
+            restore: <id extends number = chainId>(authorization: Omit<Authorization<id>, 'account' | 'key'> & {
+                /** The stored key, with or without its `chainId`. */
+                key: Key.from.Value<id>;
+            }, options?: Key.toAccount.Options) => Authorization<id>;
+            /**
+             * `Actions.signOut`, which empties the client's account before the request, even when it
+             * fails, and discards any sign-in still pending.
+             */
+            signOut: () => Promise<void>;
+        };
+    };
+}
+//# sourceMappingURL=Decorator.d.ts.map

package/dist/client/Decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decorator.d.ts","sourceRoot":"","sources":["../../src/client/Decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEpD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,oCAAmC;IAEzD,cAIC;CACF;AAED,iGAAiG;AACjG,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,kCAAiC;IAEvD,cAEC;CACF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,+BAA8B;IAEpD,cAIC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IACtC,SAAS,SAAS,SAAS,EAAE,KAAK,SAAS,KAAK,UAC9C,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAC7C,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAwLlC;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,6FAA6F;IAC7F,KAAK,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAEnD;;;OAGG;IACH,KAAK,SAAS,CAAC,OAAO,SAAS,MAAM,IAAI;QACvC,yDAAyD;QACzD,IAAI,EAAE;YACJ,4CAA4C;YAC5C,OAAO,EAAE;gBACP,6BAA6B;gBAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;aACnD,CAAA;YACD;;;eAGG;YACH,SAAS,EAAE,CACT,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KACzC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;YACnD,+CAA+C;YAC/C,MAAM,EAAE;gBACN,0EAA0E;gBAC1E,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EAC3C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,KAC3C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;aACtD,CAAA;YACD,gDAAgD;YAChD,KAAK,EAAE;gBACL,gCAAgC;gBAChC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;gBACpE;;;;mBAIG;gBACH,MAAM,EAAE,CACN,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KAC3C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;aACvD,CAAA;YACD,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAA;YACnB,gDAAgD;YAChD,KAAK,EAAE;gBACL,kCAAkC;gBAClC,UAAU,EAAE,CACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,KACtC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBACjD,4BAA4B;gBAC5B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAClD,gCAAgC;gBAChC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;aACrE,CAAA;YACD,0CAA0C;YAC1C,OAAO,EAAE;gBACP;;;;mBAIG;gBACH,MAAM,EAAE,CACN,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KAC9C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;aACzD,CAAA;YACD,4EAA4E;YAC5E,QAAQ,EAAE;gBACR,+BAA+B;gBAC/B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBACrD,iCAAiC;gBACjC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;aAC3D,CAAA;YACD,8CAA8C;YAC9C,KAAK,EAAE;gBACL,4BAA4B;gBAC5B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;aACnD,CAAA;YACD,kEAAkE;YAClE,QAAQ,EAAE;gBACR;;;;mBAIG;gBACH,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EACzC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAC7C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;gBACvD,oCAAoC;gBACpC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAC1C,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,KAC9C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;gBACxD;;;mBAGG;gBACH,cAAc,EAAE,CACd,KAAK,CAAC,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GACxD,OAAO,CAAC,OAAO,EAEjB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KACtD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;gBACjE,gCAAgC;gBAChC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;aACnE,CAAA;YACD,yBAAyB;YACzB,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,KAC7B,UAAU,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC;;;;;eAKG;YACH,OAAO,EAAE,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACnC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAAG;gBAC1D,qDAAqD;gBACrD,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;aACxB,EACD,OAAO,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,KAC5B,aAAa,CAAC,EAAE,CAAC,CAAA;YACtB;;;eAGG;YACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;SAC7B,CAAA;KACF,CAAA;CACF"}

package/dist/client/Decorator.js

@@ -0,0 +1,227 @@
+import * as Actions from './Actions.js';
+import * as Auth from './Auth.js';
+import * as AccountState from './internal/account.js';
+import * as Key from './Key.js';
+/** A client created without `account: Auth.account()`, which the extension sets at sign-in. */
+export class AccountRequiredError extends Error {
+    name = 'Decorator.AccountRequiredError';
+    constructor() {
+        super('The client has no Tempo ID account. Create the client with `account: Auth.account()`.');
+    }
+}
+/** A client created without a chain, which the extension reads the instance's `chainId` from. */
+export class ChainRequiredError extends Error {
+    name = 'Decorator.ChainRequiredError';
+    constructor() {
+        super('The client has no chain. Create the client with a Tempo `chain`.');
+    }
+}
+/**
+ * A sign-in that another sign-in or a sign-out overtook. The client keeps the newer state, so the
+ * overtaken authorization is never returned to sign with.
+ */
+export class SupersededError extends Error {
+    name = 'Decorator.SupersededError';
+    constructor() {
+        super('Another sign-in or a sign-out completed while this sign-in was pending. Sign in again.');
+    }
+}
+/**
+ * Returns a Viem client extension that adds Tempo ID's actions as `client.auth`. Each member calls
+ * the action of the same name in `Actions` with one instance, whose `chainId` is the client's chain.
+ * Each sign-in sets the client's account to the authorization's, and `signOut` empties it at once.
+ * A sign-in that another sign-in or a sign-out overtook throws {@link SupersededError}. Throws
+ * {@link ChainRequiredError} for a client without a chain, and {@link AccountRequiredError} for one
+ * whose account is not an `Auth.account()`.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export function tempoId(options) {
+    return (client) => {
+        if (!client.chain)
+            throw new ChainRequiredError();
+        const state = client.account?.[AccountState.key];
+        if (!state)
+            throw new AccountRequiredError();
+        const auth = Auth.create({ ...options, chainId: client.chain.id });
+        // Counts changes to the client's account. Each sign-in applies its result only when no other
+        // sign-in or sign-out completed after it began. A stale result never replaces a newer one,
+        // and a sign-in still pending at sign-out never signs the client back in.
+        let version = 0;
+        // The version that the latest sign-out produced, until another change follows it.
+        let signedOut;
+        // The redirect result that `complete` settled on this page load.
+        let completing;
+        /**
+         * Begins an operation that changes the client's account. `apply` applies its result: the
+         * account to sign with, or `undefined` to stop signing. `check` accepts a result that changes
+         * no account, such as a step. Applying an account, or checking a step, that a newer change
+         * overtook throws {@link SupersededError}. The caller never holds a result that the
+         * client's newer state contradicts. `settle` applies a result's account, or empties the account
+         * for a result without a key. `fail` rethrows the operation's error, or throws `SupersededError`
+         * when a newer change overtook it, so the caller never acts on a stale refusal. A refusal marked
+         * `signedIn` also empties the account, since the user whom the sign-in signed in does not hold it.
+         */
+        const begin = () => {
+            const started = version;
+            // A sign-in that finishes after sign-out can set a new server session, so it ends that
+            // session again, unless a newer change already followed the sign-out.
+            const superseded = async () => {
+                if (signedOut === version)
+                    await Actions.signOut(auth);
+                return new SupersededError();
+            };
+            return {
+                async apply(account) {
+                    if (version !== started) {
+                        if (account)
+                            throw await superseded();
+                        return;
+                    }
+                    state.account = account;
+                    version++;
+                },
+                async check() {
+                    if (version !== started)
+                        throw await superseded();
+                },
+                // An arrow function, which `catch` takes unbound.
+                fail: async (error) => {
+                    if (version !== started)
+                        throw await superseded();
+                    if (error instanceof Auth.RequestError && error.signedIn) {
+                        state.account = undefined;
+                        version++;
+                    }
+                    throw error;
+                },
+                async settle(result) {
+                    if ('account' in result)
+                        return this.apply(result.account);
+                    // The check and the change run with no `await` between them, so no other change lands
+                    // after the check, and an overtaken result throws even without an account.
+                    if (version !== started)
+                        throw await superseded();
+                    state.account = undefined;
+                    version++;
+                },
+            };
+        };
+        return {
+            auth: {
+                account: {
+                    get: () => Actions.account.get(auth),
+                },
+                async authorize(options = {}) {
+                    const change = begin();
+                    const authorization = await Actions.authorize(auth, options);
+                    // Without a session, the client stops signing as the user it last authorized.
+                    if (authorization)
+                        await change.settle(authorization);
+                    else
+                        await change.apply(undefined);
+                    return authorization;
+                },
+                device: {
+                    async authorize(options = {}) {
+                        const change = begin();
+                        const device = await Actions.device.authorize(auth, options);
+                        return {
+                            ...device,
+                            async wait() {
+                                const authorization = await device.wait();
+                                await change.apply(authorization.account);
+                                return authorization;
+                            },
+                        };
+                    },
+                },
+                email: {
+                    sendCode: (options) => Actions.email.sendCode(auth, options),
+                    async signIn(options) {
+                        const change = begin();
+                        const authorization = await Actions.email
+                            .signIn(auth, options)
+                            .catch(change.fail);
+                        await change.settle(authorization);
+                        return authorization;
+                    },
+                },
+                instance: auth,
+                oauth: {
+                    introspect: (options) => Actions.oauth.introspect(auth, options),
+                    jwks: () => Actions.oauth.jwks(auth),
+                    userInfo: (options) => Actions.oauth.userInfo(auth, options),
+                },
+                passkey: {
+                    async signIn(options = {}) {
+                        const change = begin();
+                        const result = await Actions.passkey
+                            .signIn(auth, options)
+                            .catch(change.fail);
+                        if ('step' in result)
+                            await change.check();
+                        else
+                            await change.settle(result);
+                        return result;
+                    },
+                },
+                provider: {
+                    list: () => Actions.provider.list(auth),
+                    signIn: (options) => Actions.provider.signIn(auth, options),
+                },
+                realm: {
+                    list: () => Actions.realm.list(auth),
+                },
+                redirect: {
+                    complete(options = {}) {
+                        // A page load settles its redirect once, so a later call never applies a result that a
+                        // newer sign-in replaced.
+                        completing ??= (async () => {
+                            const change = begin();
+                            const authorization = await Actions.redirect.complete(auth, options);
+                            // `undefined` means the page is not a callback, which shows nothing about the session.
+                            if (authorization)
+                                await change.settle(authorization);
+                            return authorization;
+                        })();
+                        // The first call's `key` typed the settled result, which later calls share.
+                        return completing;
+                    },
+                    createUrl: (options = {}) => Actions.redirect.createUrl(auth, options),
+                    async handleCallback(options) {
+                        const change = begin();
+                        const authorization = await Actions.redirect.handleCallback(auth, options);
+                        await change.settle(authorization);
+                        return authorization;
+                    },
+                    start: (options = {}) => Actions.redirect.start(auth, options),
+                },
+                refresh: (options) => Actions.refresh(auth, options),
+                restore: (authorization, options = {}) => {
+                    // A sign-in stored before `Key.chainId` existed gains it here.
+                    const key = Key.from(authorization.key);
+                    const account = Key.toAccount(key, options);
+                    state.account = account;
+                    version++;
+                    return { ...authorization, account, key };
+                },
+                async signOut() {
+                    // The client stops signing at once, even when the request fails, and any sign-in still
+                    // pending is discarded, since the user asked to leave.
+                    state.account = undefined;
+                    version++;
+                    signedOut = version;
+                    await Actions.signOut(auth);
+                },
+            },
+        };
+    };
+}
+//# sourceMappingURL=Decorator.js.map

package/dist/client/Decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decorator.js","sourceRoot":"","sources":["../../src/client/Decorator.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAI/B,+FAA+F;AAC/F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,gCAAgC,CAAA;IAEzD;QACE,KAAK,CACH,uFAAuF,CACxF,CAAA;IACH,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,8BAA8B,CAAA;IAEvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAA;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACtB,IAAI,GAAG,2BAA2B,CAAA;IAEpD;QACE,KAAK,CACH,wFAAwF,CACzF,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,OAAO,CAAC,OAAwB;IAC9C,OAAO,CACL,MAA8C,EACd,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;QACjD,MAAM,KAAK,GAAI,MAAM,CAAC,OAA6C,EAAE,CACnE,YAAY,CAAC,GAAG,CACjB,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAE5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAElE,6FAA6F;QAC7F,2FAA2F;QAC3F,0EAA0E;QAC1E,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,kFAAkF;QAClF,IAAI,SAA6B,CAAA;QACjC,iEAAiE;QACjE,IAAI,UAES,CAAA;QAEb;;;;;;;;;WASG;QACH,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAA;YACvB,uFAAuF;YACvF,sEAAsE;YACtE,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;gBAC5B,IAAI,SAAS,KAAK,OAAO;oBAAE,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACtD,OAAO,IAAI,eAAe,EAAE,CAAA;YAC9B,CAAC,CAAA;YACD,OAAO;gBACL,KAAK,CAAC,KAAK,CAAC,OAAiD;oBAC3D,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;wBACxB,IAAI,OAAO;4BAAE,MAAM,MAAM,UAAU,EAAE,CAAA;wBACrC,OAAM;oBACR,CAAC;oBACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;oBACvB,OAAO,EAAE,CAAA;gBACX,CAAC;gBACD,KAAK,CAAC,KAAK;oBACT,IAAI,OAAO,KAAK,OAAO;wBAAE,MAAM,MAAM,UAAU,EAAE,CAAA;gBACnD,CAAC;gBACD,kDAAkD;gBAClD,IAAI,EAAE,KAAK,EAAE,KAAc,EAAkB,EAAE;oBAC7C,IAAI,OAAO,KAAK,OAAO;wBAAE,MAAM,MAAM,UAAU,EAAE,CAAA;oBACjD,IAAI,KAAK,YAAY,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;wBACzD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;wBACzB,OAAO,EAAE,CAAA;oBACX,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,KAAK,CAAC,MAAM,CACV,MAAkE;oBAElE,IAAI,SAAS,IAAI,MAAM;wBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;oBAC1D,sFAAsF;oBACtF,2EAA2E;oBAC3E,IAAI,OAAO,KAAK,OAAO;wBAAE,MAAM,MAAM,UAAU,EAAE,CAAA;oBACjD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;oBACzB,OAAO,EAAE,CAAA;gBACX,CAAC;aACF,CAAA;QACH,CAAC,CAAA;QAED,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;iBACrC;gBACD,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE;oBAC1B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;oBACtB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;oBAC5D,8EAA8E;oBAC9E,IAAI,aAAa;wBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;;wBAChD,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;oBAClC,OAAO,aAAa,CAAA;gBACtB,CAAC;gBACD,MAAM,EAAE;oBACN,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE;wBAC1B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;wBAC5D,OAAO;4BACL,GAAG,MAAM;4BACT,KAAK,CAAC,IAAI;gCACR,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gCACzC,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;gCACzC,OAAO,aAAa,CAAA;4BACtB,CAAC;yBACF,CAAA;oBACH,CAAC;iBACF;gBACD,KAAK,EAAE;oBACL,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;oBAC5D,KAAK,CAAC,MAAM,CAAC,OAAO;wBAClB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK;6BACtC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;6BACrB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBACrB,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;wBAClC,OAAO,aAAa,CAAA;oBACtB,CAAC;iBACF;gBACD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE;oBACL,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;oBAChE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;iBAC7D;gBACD,OAAO,EAAE;oBACP,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,EAAE;wBACvB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO;6BACjC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;6BACrB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBACrB,IAAI,MAAM,IAAI,MAAM;4BAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;;4BACrC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBAChC,OAAO,MAAM,CAAA;oBACf,CAAC;iBACF;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;oBACvC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;iBAC5D;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrC;gBACD,QAAQ,EAAE;oBACR,QAAQ,CAAC,OAAO,GAAG,EAAE;wBACnB,uFAAuF;wBACvF,0BAA0B;wBAC1B,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;4BACzB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;4BACtB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CACnD,IAAI,EACJ,OAAO,CACR,CAAA;4BACD,uFAAuF;4BACvF,IAAI,aAAa;gCAAE,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;4BACrD,OAAO,aAAa,CAAA;wBACtB,CAAC,CAAC,EAAE,CAAA;wBACJ,4EAA4E;wBAC5E,OAAO,UAAmB,CAAA;oBAC5B,CAAC;oBACD,SAAS,EAAE,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;oBAC3C,KAAK,CAAC,cAAc,CAAC,OAAO;wBAC1B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CACzD,IAAI,EACJ,OAAO,CACR,CAAA;wBACD,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;wBAClC,OAAO,aAAa,CAAA;oBACtB,CAAC;oBACD,KAAK,EAAE,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;iBAC/D;gBACD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;gBACpD,OAAO,EAAE,CAAC,aAAa,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;oBACvC,+DAA+D;oBAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;oBACvC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;oBAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;oBACvB,OAAO,EAAE,CAAA;oBACT,OAAO,EAAE,GAAG,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;gBAC3C,CAAC;gBACD,KAAK,CAAC,OAAO;oBACX,uFAAuF;oBACvF,uDAAuD;oBACvD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;oBACzB,OAAO,EAAE,CAAA;oBACT,SAAS,GAAG,OAAO,CAAA;oBACnB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7B,CAAC;aACF;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/client/Key.d.ts

@@ -0,0 +1,85 @@
+/**
+ * An app's access key on a user's Tempo Account, as the app stores it: the account it acts for,
+ * the authorization Tempo ID signed for it, and the key material the library generated.
+ * @module
+ */
+import { type Address, type Hex, type WebCryptoP256 } from 'ox';
+import { KeyAuthorization } from 'ox/tempo';
+import type { OneOf } from 'viem';
+import { Account } from 'viem/tempo';
+/**
+ * A stored access key. A browser key is a non-extractable WebCrypto key pair, which IndexedDB
+ * keeps without exporting. Elsewhere it is a secp256k1 private key, as JSON for a cookie or a file.
+ * A key the app supplied as `accessKey` carries no material.
+ */
+export type Key<chainId extends number = number> = {
+    /** The Tempo Account the key acts for. */
+    account: Address.Address;
+    /** The chain the key acts on, from its authorization. */
+    chainId: chainId;
+    /** The signed authorization, in the node's RPC format. */
+    keyAuthorization: KeyAuthorization.Rpc;
+} & Material;
+/** The key material the library generated for a sign-in. */
+export type Material = OneOf<{
+    /** A non-extractable WebCrypto P256 key pair, in a browser. */
+    keyPair: WebCryptoP256.createKeyPair.ReturnType;
+} | {
+    /** A secp256k1 private key, outside a browser. Keep it as secret as a session. */
+    privateKey: Hex.Hex;
+} | {}>;
+/** A key the app supplied as `accessKey`, which `toAccount` needs to rebuild its account. */
+export declare class AccessKeyRequiredError extends Error {
+    readonly name = "Key.AccessKeyRequiredError";
+    constructor();
+}
+/**
+ * Whether the key's authorization is expired, so a new sign-in must authorize a new key.
+ *
+ * @example
+ * ```ts
+ * if (Key.expired(saved.key)) await signInAgain()
+ * ```
+ */
+export declare function expired(key: Key): boolean;
+/**
+ * Instantiates a {@link Key}. Fills `chainId` from the key authorization when the value leaves it
+ * out, as a key stored before `chainId` existed does.
+ *
+ * @example
+ * ```ts
+ * const key = Key.from(JSON.parse(saved).key)
+ * ```
+ */
+export declare function from<chainId extends number = number>(value: from.Value<chainId>): Key<chainId>;
+export declare namespace from {
+    type Value<chainId extends number = number> = {
+        /** The Tempo Account the key acts for. */
+        account: Address.Address;
+        /** The chain the key acts on. Defaults to the key authorization's. */
+        chainId?: chainId | undefined;
+        /** The signed authorization, in the node's RPC format. */
+        keyAuthorization: KeyAuthorization.Rpc;
+    } & Material;
+}
+/**
+ * Returns the key as a Viem access key account acting for its Tempo Account. Viem attaches the
+ * authorization to transactions until the chain registers the key. A key the app supplied signs
+ * with that `accessKey`. Throws {@link AccessKeyRequiredError} when neither holds key material.
+ *
+ * @example
+ * ```ts
+ * import { Key } from '@tempoxyz/id/client'
+ *
+ * const account = Key.toAccount(key)
+ * await client.token.transferSync({ account, amount, to, token })
+ * ```
+ */
+export declare function toAccount(key: Key, options?: toAccount.Options): Account.AccessKeyAccount;
+export declare namespace toAccount {
+    type Options = {
+        /** The key the app supplied to the sign-in, for a key that carries no material. */
+        accessKey?: Account.Account | undefined;
+    };
+}
+//# sourceMappingURL=Key.d.ts.map

package/dist/client/Key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Key.d.ts","sourceRoot":"","sources":["../../src/client/Key.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAa,KAAK,aAAa,EAAE,MAAM,IAAI,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAA;AACjC,OAAO,EAAE,OAAO,EAA2B,MAAM,YAAY,CAAA;AAE7D;;;;GAIG;AACH,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACjD,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAA;IAChB,0DAA0D;IAC1D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAA;CACvC,GAAG,QAAQ,CAAA;AAEZ,4DAA4D;AAC5D,MAAM,MAAM,QAAQ,GAAG,KAAK,CACxB;IACE,+DAA+D;IAC/D,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,UAAU,CAAA;CAChD,GACD;IACE,kFAAkF;IAClF,UAAU,EAAE,GAAG,CAAC,GAAG,CAAA;CACpB,GACD,EAAE,CACL,CAAA;AAED,6FAA6F;AAC7F,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAkB,IAAI,gCAA+B;IAErD,cAEC;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,GAAG,WAG/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAClD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GACzB,GAAG,CAAC,OAAO,CAAC,CAOd;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;QAC5C,0CAA0C;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,sEAAsE;QACtE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC7B,0DAA0D;QAC1D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAA;KACvC,GAAG,QAAQ,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,GAAG,EACR,OAAO,GAAE,SAAS,CAAC,OAAY,GAC9B,OAAO,CAAC,gBAAgB,CA0B1B;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,mFAAmF;QACnF,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;KACxC,CAAA;CACF"}

package/dist/client/Key.js

@@ -0,0 +1,83 @@
+/**
+ * An app's access key on a user's Tempo Account, as the app stores it: the account it acts for,
+ * the authorization Tempo ID signed for it, and the key material the library generated.
+ * @module
+ */
+import { PublicKey } from 'ox';
+import { KeyAuthorization } from 'ox/tempo';
+import { Account, KeyAuthorizationManager } from 'viem/tempo';
+/** A key the app supplied as `accessKey`, which `toAccount` needs to rebuild its account. */
+export class AccessKeyRequiredError extends Error {
+    name = 'Key.AccessKeyRequiredError';
+    constructor() {
+        super('The key carries no material. Pass the `accessKey` the app supplied.');
+    }
+}
+/**
+ * Whether the key's authorization is expired, so a new sign-in must authorize a new key.
+ *
+ * @example
+ * ```ts
+ * if (Key.expired(saved.key)) await signInAgain()
+ * ```
+ */
+export function expired(key) {
+    const { expiry } = KeyAuthorization.fromRpc(key.keyAuthorization);
+    return Boolean(expiry) && expiry * 1000 <= Date.now();
+}
+/**
+ * Instantiates a {@link Key}. Fills `chainId` from the key authorization when the value leaves it
+ * out, as a key stored before `chainId` existed does.
+ *
+ * @example
+ * ```ts
+ * const key = Key.from(JSON.parse(saved).key)
+ * ```
+ */
+export function from(value) {
+    if (value.chainId !== undefined)
+        return { ...value, chainId: value.chainId };
+    // The node signs the chain ID the request named, so it is the request's literal.
+    const chainId = Number(KeyAuthorization.fromRpc(value.keyAuthorization).chainId);
+    return { ...value, chainId };
+}
+/**
+ * Returns the key as a Viem access key account acting for its Tempo Account. Viem attaches the
+ * authorization to transactions until the chain registers the key. A key the app supplied signs
+ * with that `accessKey`. Throws {@link AccessKeyRequiredError} when neither holds key material.
+ *
+ * @example
+ * ```ts
+ * import { Key } from '@tempoxyz/id/client'
+ *
+ * const account = Key.toAccount(key)
+ * await client.token.transferSync({ account, amount, to, token })
+ * ```
+ */
+export function toAccount(key, options = {}) {
+    const { accessKey } = options;
+    const keyAuthorization = KeyAuthorization.fromRpc(key.keyAuthorization);
+    const keyAuthorizationManager = KeyAuthorizationManager.memory();
+    // The memory manager stores synchronously, so the authorization is in place before the account
+    // is returned.
+    void keyAuthorizationManager.set({
+        accessKey: keyAuthorization.address,
+        address: key.account,
+        chainId: Number(keyAuthorization.chainId),
+    }, keyAuthorization);
+    const access = { access: key.account, keyAuthorizationManager };
+    if (key.keyPair)
+        return Account.fromWebCryptoP256(key.keyPair, access);
+    if (key.privateKey)
+        return Account.fromSecp256k1(key.privateKey, access);
+    if (!accessKey)
+        throw new AccessKeyRequiredError();
+    // A raw signature is the key's own, which the bound account wraps for the Tempo Account.
+    return Account.from({
+        ...access,
+        keyType: accessKey.keyType,
+        publicKey: PublicKey.fromHex(accessKey.publicKey),
+        sign: (parameters) => accessKey.sign({ ...parameters, raw: true }),
+    });
+}
+//# sourceMappingURL=Key.js.map

package/dist/client/Key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Key.js","sourceRoot":"","sources":["../../src/client/Key.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA0B,SAAS,EAAsB,MAAM,IAAI,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AA6B7D,6FAA6F;AAC7F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC7B,IAAI,GAAG,4BAA4B,CAAA;IAErD;QACE,KAAK,CAAC,qEAAqE,CAAC,CAAA;IAC9E,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAQ;IAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACjE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,MAAO,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,IAAI,CAClB,KAA0B;IAE1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IAC5E,iFAAiF;IACjF,MAAM,OAAO,GAAG,MAAM,CACpB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAC9C,CAAA;IACZ,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACvB,GAAQ,EACR,OAAO,GAAsB,EAAE;IAE/B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACvE,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,EAAE,CAAA;IAChE,+FAA+F;IAC/F,eAAe;IACf,KAAK,uBAAuB,CAAC,GAAG,CAC9B;QACE,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;KAC1C,EACD,gBAAgB,CACjB,CAAA;IACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAE/D,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACtE,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACxE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IAClD,yFAAyF;IACzF,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,GAAG,MAAM;QACT,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;KACnE,CAAC,CAAA;AACJ,CAAC"}

package/dist/client/Pending.d.ts

@@ -0,0 +1,39 @@
+/**
+ * A sign-in redirect in progress, which an app keeps until Tempo ID redirects back.
+ * @module
+ */
+import type * as Key from './Key.js';
+/**
+ * A sign-in redirect in progress: what the app keeps until Tempo ID redirects back, with the
+ * material of the new access key the callback authorizes. {@link WithoutKey} is a redirect that
+ * authorizes no key.
+ */
+export type Pending = Key.Material & Base & {
+    /** Absent, since the redirect authorizes a key. */
+    key?: undefined;
+};
+/** What every sign-in redirect keeps. */
+type Base = {
+    /** Where Tempo ID redirects back to, which the code exchange repeats. */
+    redirectUri: string;
+    /** The value the callback must echo, so a forged callback is refused. */
+    state: string;
+    /** The PKCE verifier that redeems the code. */
+    verifier: string;
+};
+/** A redirect that authorizes no access key. */
+export type WithoutKey = Base & {
+    /** `false`, since the redirect authorizes no key. */
+    key: false;
+};
+/**
+ * Instantiates a {@link Pending}, or a {@link WithoutKey}.
+ *
+ * @example
+ * ```ts
+ * const pending = Pending.from(await unseal(c, 'oauth'))
+ * ```
+ */
+export declare function from<const value extends Pending | WithoutKey>(value: value): value;
+export {};
+//# sourceMappingURL=Pending.d.ts.map

package/dist/client/Pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pending.d.ts","sourceRoot":"","sources":["../../src/client/Pending.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAA;AAEpC;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,GAChC,IAAI,GAAG;IACL,mDAAmD;IACnD,GAAG,CAAC,EAAE,SAAS,CAAA;CAChB,CAAA;AAEH,yCAAyC;AACzC,KAAK,IAAI,GAAG;IACV,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG;IAC9B,qDAAqD;IACrD,GAAG,EAAE,KAAK,CAAA;CACX,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,OAAO,GAAG,UAAU,EAC3D,KAAK,EAAE,KAAK,GACX,KAAK,CAEP"}

package/dist/client/Pending.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Pending}, or a {@link WithoutKey}.
+ *
+ * @example
+ * ```ts
+ * const pending = Pending.from(await unseal(c, 'oauth'))
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Pending.js.map