@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/client/Pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pending.js","sourceRoot":"","sources":["../../src/client/Pending.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAAY;IAEZ,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Permissions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * What an app's access key may do: its chain, expiry, spending limits, and call scopes.
+ * @module
+ */
+import type { KeyAuthorization } from 'ox/tempo';
+/**
+ * What an app's access key may do, as Viem's `accessKey.authorize` takes it. Tempo ID fills what
+ * it leaves out with the headless ceiling. `chainId` carries the chain's ID as a literal type, which
+ * the authorization's `key.chainId` keeps.
+ */
+export type Permissions<chainId extends number = number> = {
+    /** The chain the key acts on, such as `tempoTestnet.id`. Defaults to the instance's `chainId`. */
+    chainId?: chainId | undefined;
+    /** Unix seconds. Viem's `Expiry` builds one, such as `Expiry.days(1)`. Defaults to a year from now. */
+    expiry?: number | undefined;
+    /** How much of each token the key may spend, in total or, with a `period` in seconds, per period. Defaults to about $1,000 of each token it calls, or of OUSD. */
+    limits?: KeyAuthorization.KeyAuthorization['limits'];
+    /** The calls the key may make. Defaults to transfers of each token it limits. */
+    scopes?: KeyAuthorization.KeyAuthorization['scopes'];
+};
+/**
+ * Instantiates a {@link Permissions}, keeping `chainId` as a literal type.
+ *
+ * @example
+ * ```ts
+ * const permissions = Permissions.from({
+ *   expiry: Expiry.days(1),
+ *   limits: [{ limit: 10_000_000n, token: ousd }],
+ *   scopes: [Scopes.tip20(ousd).transfer()],
+ * })
+ * ```
+ */
+export declare function from<const chainId extends number = number>(value: Permissions<chainId>): Permissions<chainId>;
+//# sourceMappingURL=Permissions.d.ts.map

package/dist/client/Permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Permissions.d.ts","sourceRoot":"","sources":["../../src/client/Permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD;;;;GAIG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,kGAAkG;IAClG,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7B,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,kKAAkK;IAClK,MAAM,CAAC,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACpD,iFAAiF;IACjF,MAAM,CAAC,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;CACrD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACxD,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,GAC1B,WAAW,CAAC,OAAO,CAAC,CAEtB"}

package/dist/client/Permissions.js

@@ -0,0 +1,16 @@
+/**
+ * Instantiates a {@link Permissions}, keeping `chainId` as a literal type.
+ *
+ * @example
+ * ```ts
+ * const permissions = Permissions.from({
+ *   expiry: Expiry.days(1),
+ *   limits: [{ limit: 10_000_000n, token: ousd }],
+ *   scopes: [Scopes.tip20(ousd).transfer()],
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Permissions.js.map

package/dist/client/Permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Permissions.js","sourceRoot":"","sources":["../../src/client/Permissions.ts"],"names":[],"mappings":"AAsBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,IAAI,CAClB,KAA2B;IAE3B,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Provider.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The OAuth providers Tempo ID can offer.
+ * @module
+ */
+/** An OAuth provider's short name, as `Actions.provider.list` lists them. */
+export type Provider = 'google';
+/**
+ * Instantiates a {@link Provider}.
+ *
+ * @example
+ * ```ts
+ * const provider = Provider.from('google')
+ * ```
+ */
+export declare function from(value: Provider): Provider;
+//# sourceMappingURL=Provider.d.ts.map

package/dist/client/Provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Provider.d.ts","sourceRoot":"","sources":["../../src/client/Provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,6EAA6E;AAC7E,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAA;AAE/B;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAE9C"}

package/dist/client/Provider.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Provider}.
+ *
+ * @example
+ * ```ts
+ * const provider = Provider.from('google')
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Provider.js.map

package/dist/client/Provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Provider.js","sourceRoot":"","sources":["../../src/client/Provider.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,KAAe;IAClC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Step.d.ts

@@ -0,0 +1,21 @@
+/**
+ * A step a sign-in needs before it finishes, such as the SSO connection an address requires.
+ * @module
+ */
+/** A step that a sign-in needs before it finishes: the SSO connection that an address requires. */
+export type Step = {
+    /** The kind of step. */
+    type: 'sso';
+    /** Where `Actions.provider.signIn` sends the browser to take the step. */
+    url: string;
+};
+/**
+ * Instantiates a {@link Step}.
+ *
+ * @example
+ * ```ts
+ * const step = Step.from({ type: 'sso', url })
+ * ```
+ */
+export declare function from(value: Step): Step;
+//# sourceMappingURL=Step.d.ts.map

package/dist/client/Step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Step.d.ts","sourceRoot":"","sources":["../../src/client/Step.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mGAAmG;AACnG,MAAM,MAAM,IAAI,GAAG;IACjB,wBAAwB;IACxB,IAAI,EAAE,KAAK,CAAA;IACX,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAEtC"}

package/dist/client/Step.js

@@ -0,0 +1,16 @@
+/**
+ * A step a sign-in needs before it finishes, such as the SSO connection an address requires.
+ * @module
+ */
+/**
+ * Instantiates a {@link Step}.
+ *
+ * @example
+ * ```ts
+ * const step = Step.from({ type: 'sso', url })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Step.js.map

package/dist/client/Step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Step.js","sourceRoot":"","sources":["../../src/client/Step.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,KAAW;IAC9B,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Storage.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Where a redirect keeps its state until Tempo ID redirects back.
+ * @module
+ */
+/** Keeps a redirect's state, as structured-clone storage such as IndexedDB does. */
+export type Storage = {
+    /** Reads the value at `key`, or `undefined`. */
+    getItem: (key: string) => Promise<unknown>;
+    /** Deletes the value at `key`. */
+    removeItem: (key: string) => Promise<void>;
+    /** Writes `value` at `key`, without serializing it. */
+    setItem: (key: string, value: unknown) => Promise<void>;
+};
+/**
+ * Instantiates a {@link Storage}.
+ *
+ * @example
+ * ```ts
+ * const storage = Storage.from({
+ *   getItem: (key) => idb.get(key),
+ *   removeItem: (key) => idb.del(key),
+ *   setItem: (key, value) => idb.set(key, value),
+ * })
+ * ```
+ */
+export declare function from(value: Storage): Storage;
+//# sourceMappingURL=Storage.d.ts.map

package/dist/client/Storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.d.ts","sourceRoot":"","sources":["../../src/client/Storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oFAAoF;AACpF,MAAM,MAAM,OAAO,GAAG;IACpB,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,kCAAkC;IAClC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,uDAAuD;IACvD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5C"}

package/dist/client/Storage.js

@@ -0,0 +1,16 @@
+/**
+ * Instantiates a {@link Storage}.
+ *
+ * @example
+ * ```ts
+ * const storage = Storage.from({
+ *   getItem: (key) => idb.get(key),
+ *   removeItem: (key) => idb.del(key),
+ *   setItem: (key, value) => idb.set(key, value),
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Storage.js.map

package/dist/client/Storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.js","sourceRoot":"","sources":["../../src/client/Storage.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/TempoAccount.d.ts

@@ -0,0 +1,40 @@
+/**
+ * One of a user's Tempo Accounts.
+ * @module
+ */
+/** One of the user's Tempo Accounts. */
+export type TempoAccount = {
+    /** The account's address, the same on every Tempo chain. */
+    address: `0x${string}`;
+    /**
+     * Who holds the account's owner key: a Privy wallet, which Tempo ID signs with (`privy`), a key
+     * that Tempo ID holds and signs with in development (`secp256k1`), or a passkey, which signs only
+     * on a Tempo ID page (`webAuthn`). Treat another value as an owner that may refuse a key
+     * authorization.
+     */
+    owner: 'privy' | 'secp256k1' | 'webAuthn' | (string & {});
+    /**
+     * The realm the account belongs to: `default`, or one the app's settings name, such as
+     * `tempo-cash`, with its display name. An app reaches only the accounts of its realms.
+     */
+    realm: {
+        /** The realm ID: `default`, or one an app's settings name, such as `tempo-cash`. */
+        id: string;
+        /** The realm's display name, such as `Tempo Cash`. */
+        name: string;
+    };
+};
+/**
+ * Instantiates a {@link TempoAccount}.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = TempoAccount.from({
+ *   address: '0x…',
+ *   owner: 'privy',
+ *   realm: { id: 'default', name: 'Tempo' },
+ * })
+ * ```
+ */
+export declare function from(value: TempoAccount): TempoAccount;
+//# sourceMappingURL=TempoAccount.d.ts.map

package/dist/client/TempoAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TempoAccount.d.ts","sourceRoot":"","sources":["../../src/client/TempoAccount.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG;IACzB,4DAA4D;IAC5D,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IACtB;;;;;OAKG;IACH,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,EAAE;QACL,oFAAoF;QACpF,EAAE,EAAE,MAAM,CAAA;QACV,sDAAsD;QACtD,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAEtD"}

package/dist/client/TempoAccount.js

@@ -0,0 +1,16 @@
+/**
+ * Instantiates a {@link TempoAccount}.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = TempoAccount.from({
+ *   address: '0x…',
+ *   owner: 'privy',
+ *   realm: { id: 'default', name: 'Tempo' },
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=TempoAccount.js.map

package/dist/client/TempoAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TempoAccount.js","sourceRoot":"","sources":["../../src/client/TempoAccount.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,IAAI,CAAC,KAAmB;IACtC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Tokens.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The app's tokens for Tempo APIs.
+ * @module
+ */
+/** The app's tokens for Tempo APIs. */
+export type Tokens = {
+    /** The Bearer token Tempo APIs accept. */
+    accessToken: string;
+    /** When the access token expires, in milliseconds. */
+    expiresAt: number;
+    /** The OIDC ID token, which names the user. A refresh may omit it. */
+    idToken?: string | undefined;
+    /** Exchanges for new tokens through `Actions.refresh`. It rotates on every refresh. */
+    refreshToken?: string | undefined;
+};
+/**
+ * Instantiates a {@link Tokens}.
+ *
+ * @example
+ * ```ts
+ * const tokens = Tokens.from({ ...saved, ...(await Actions.refresh(auth, { refreshToken })) })
+ * ```
+ */
+export declare function from(value: Tokens): Tokens;
+//# sourceMappingURL=Tokens.d.ts.map

package/dist/client/Tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.d.ts","sourceRoot":"","sources":["../../src/client/Tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,uCAAuC;AACvC,MAAM,MAAM,MAAM,GAAG;IACnB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAA;IACnB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1C"}

package/dist/client/Tokens.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Tokens}.
+ *
+ * @example
+ * ```ts
+ * const tokens = Tokens.from({ ...saved, ...(await Actions.refresh(auth, { refreshToken })) })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Tokens.js.map

package/dist/client/Tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.js","sourceRoot":"","sources":["../../src/client/Tokens.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/User.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The signed-in user.
+ * @module
+ */
+/** The signed-in user. */
+export type User = {
+    /** The user's verified email address. */
+    email: string;
+    /** The user's ID, the `sub` of every token. */
+    id: string;
+};
+/**
+ * Instantiates a {@link User}.
+ *
+ * @example
+ * ```ts
+ * const user = User.from({ email: claims.email, id: claims.sub })
+ * ```
+ */
+export declare function from(value: User): User;
+//# sourceMappingURL=User.d.ts.map

package/dist/client/User.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/client/User.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,0BAA0B;AAC1B,MAAM,MAAM,IAAI,GAAG;IACjB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAEtC"}

package/dist/client/User.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link User}.
+ *
+ * @example
+ * ```ts
+ * const user = User.from({ email: claims.email, id: claims.sub })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=User.js.map

package/dist/client/User.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.js","sourceRoot":"","sources":["../../src/client/User.ts"],"names":[],"mappings":"AAYA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,KAAW;IAC9B,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/actions/account.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Reads the signed-in user's Tempo Account for the app, with its realm.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+import type { TempoAccount } from '../TempoAccount.js';
+/**
+ * Returns the signed-in user's Tempo Account for the app, with its `realm`: the account that the
+ * user selected for the app in the account step, or else the oldest in the app's realms. Returns
+ * `undefined` when the user has no account in those realms. For a user with none, the call sends
+ * `POST /v1/account`, which creates a Privy-owned one in the app's first realm when that realm has a
+ * Privy app.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = await Actions.account.get(auth)
+ * // { address: '0x…', owner: 'webAuthn', realm: { id: 'default', name: 'Tempo' } }
+ * ```
+ */
+export declare function get(auth: Auth): Promise<get.ReturnType>;
+export declare namespace get {
+    /** The user's Tempo Account for the app, or `undefined` when the user has none in its realms. */
+    type ReturnType = TempoAccount | undefined;
+}
+//# sourceMappingURL=account.d.ts.map

package/dist/client/actions/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/client/actions/account.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD;;;;;;;;;;;;GAYG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CA8B7D;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,iGAAiG;IACjG,KAAK,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;CAC3C"}

package/dist/client/actions/account.js

@@ -0,0 +1,34 @@
+import * as Api from '../internal/api.js';
+/**
+ * Returns the signed-in user's Tempo Account for the app, with its `realm`: the account that the
+ * user selected for the app in the account step, or else the oldest in the app's realms. Returns
+ * `undefined` when the user has no account in those realms. For a user with none, the call sends
+ * `POST /v1/account`, which creates a Privy-owned one in the app's first realm when that realm has a
+ * Privy app.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = await Actions.account.get(auth)
+ * // { address: '0x…', owner: 'webAuthn', realm: { id: 'default', name: 'Tempo' } }
+ * ```
+ */
+export async function get(auth) {
+    const listed = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/account?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url), { credentials: 'include' }));
+    const tempo = await (async () => {
+        if (listed.tempo.length > 0)
+            return listed.tempo;
+        // Creation is a JSON write, which a page on another site cannot send.
+        const created = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
+            body: JSON.stringify({ client_id: auth.clientId }),
+            credentials: 'include',
+            headers: { 'content-type': 'application/json' },
+            method: 'POST',
+        }));
+        return created.tempo;
+    })();
+    const [account] = tempo;
+    if (!account)
+        return undefined;
+    return Api.tempoAccount(account);
+}
+//# sourceMappingURL=account.js.map

package/dist/client/actions/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/client/actions/account.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAGzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAU;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAG3B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CACzB,IAAI,GAAG,CACL,eAAe,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAClE,IAAI,CAAC,GAAG,CACT,EACD,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CACF,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAChD,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAG5B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;YAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClD,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAA;QACD,OAAO,OAAO,CAAC,KAAK,CAAA;IACtB,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;AAClC,CAAC"}

package/dist/client/actions/device.d.ts

@@ -0,0 +1,53 @@
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * Starts the device grant for a CLI: the user approves `userCode` at `verificationUri` from any
+ * browser, and `wait` resolves once they do. The instance's `clientId` names the device app that
+ * the CLI signs in to, such as `tempo-cli`, whose realms the sign-in uses.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'tempo-cli' })
+ * const device = await Actions.device.authorize(auth)
+ * console.log(`Open ${device.verificationUriComplete}`)
+ * const authorization = await device.wait()
+ * ```
+ */
+export declare function authorize<const chainId extends number = number>(auth: Auth, options?: authorize.Options<chainId>): Promise<authorize.ReturnType<chainId>>;
+export declare namespace authorize {
+    type Options<chainId extends number = number> = {
+        /**
+         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
+         * Tempo ID binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
+         * `tempo-id:sign` scope may send one.
+         */
+        challenge?: string | undefined;
+        /**
+         * The name the approval page shows. Defaults to the machine's hostname in Node, Bun, and Deno,
+         * and to `Unknown device` elsewhere.
+         */
+        device?: string | undefined;
+        /** What the CLI's key may do. The approval page shows it beside the device, and the headless ceiling fills what it leaves out. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    type ReturnType<chainId extends number = number> = {
+        /** Seconds until the code expires. */
+        expiresIn: number;
+        /** The code the user confirms in the browser. */
+        userCode: string;
+        /** Where the user enters the code. */
+        verificationUri: string;
+        /** Where the user approves the code, with it already filled in. */
+        verificationUriComplete: string;
+        /** Resolves with the authorization once the user approves. */
+        wait: () => Promise<Authorization<chainId>>;
+    };
+}
+//# sourceMappingURL=device.d.ts.map

package/dist/client/actions/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../src/client/actions/device.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAAgB,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAKxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACnE,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAM,GACvC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAqExC;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;QAC9C;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,kIAAkI;QAClI,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED,KAAK,UAAU,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;QACjD,sCAAsC;QACtC,SAAS,EAAE,MAAM,CAAA;QACjB,iDAAiD;QACjD,QAAQ,EAAE,MAAM,CAAA;QAChB,sCAAsC;QACtC,eAAe,EAAE,MAAM,CAAA;QACvB,mEAAmE;QACnE,uBAAuB,EAAE,MAAM,CAAA;QAC/B,8DAA8D;QAC9D,IAAI,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;KAC5C,CAAA;CACF"}

package/dist/client/actions/device.js

@@ -0,0 +1,79 @@
+import { RequestError } from '../Auth.js';
+import * as AccessKey from '../internal/accessKey.js';
+import * as Api from '../internal/api.js';
+import { keyAuthorization } from '../internal/request.js';
+/**
+ * Starts the device grant for a CLI: the user approves `userCode` at `verificationUri` from any
+ * browser, and `wait` resolves once they do. The instance's `clientId` names the device app that
+ * the CLI signs in to, such as `tempo-cli`, whose realms the sign-in uses.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'tempo-cli' })
+ * const device = await Actions.device.authorize(auth)
+ * console.log(`Open ${device.verificationUriComplete}`)
+ * const authorization = await device.wait()
+ * ```
+ */
+export async function authorize(auth, options = {}) {
+    const key = await AccessKey.resolve(options.accessKey);
+    const code = await Api.json(await Api.post(auth, '/v1/device/authorize', {
+        json: {
+            ...(options.challenge === undefined
+                ? {}
+                : { challenge: options.challenge }),
+            // The instance's app is the device app that the CLI signs in to, such as `tempo-cli`.
+            client_id: auth.clientId,
+            device: options.device ?? hostname(),
+            key_authorization: keyAuthorization(auth, {
+                accessKey: key.accessKey,
+                permissions: options.permissions,
+            }),
+        },
+    }));
+    /** Polls until the user approves or denies the code, or it expires. */
+    async function wait() {
+        let interval = code.interval;
+        const deadline = Date.now() + code.expires_in * 1000;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, interval * 1000));
+            const response = await Api.post(auth, '/v1/device/token', {
+                json: { client_id: auth.clientId, device_code: code.device_code },
+            });
+            const body = (await response.json());
+            if ('access_token' in body)
+                return Api.authorization({
+                    account: body.account,
+                    key_authorization: body.key_authorization,
+                    tokens: Api.tokens(body),
+                }, key);
+            // RFC 8628 requires a client that receives `slow_down` to add 5 seconds to its interval.
+            if (body.error === 'slow_down')
+                interval += 5;
+            else if (body.error !== 'authorization_pending')
+                throw Api.error(body, { status: response.status });
+        }
+        throw new RequestError({
+            code: 'expired_token',
+            message: 'Device code expired. Request a new code.',
+            status: 400,
+        });
+    }
+    return {
+        expiresIn: code.expires_in,
+        userCode: code.user_code,
+        verificationUri: code.verification_uri,
+        verificationUriComplete: code.verification_uri_complete,
+        wait,
+    };
+}
+/**
+ * The machine's hostname, within the 64 characters Tempo ID accepts. `getBuiltinModule` loads
+ * `node:os` without an import, which browser and React Native bundlers would fail to resolve.
+ */
+function hostname() {
+    const process = Reflect.get(globalThis, 'process');
+    const name = process?.getBuiltinModule?.('node:os')?.hostname().trim();
+    return name ? name.slice(0, 64) : 'Unknown device';
+}
+//# sourceMappingURL=device.js.map

package/dist/client/actions/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/client/actions/device.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,YAAY,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAIzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAU,EACV,OAAO,GAA+B,EAAE;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAQzB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,EAAE;QAC3C,IAAI,EAAE;YACJ,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YACrC,sFAAsF;YACtF,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE;YACpC,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,EAAE;gBACxC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC;SACH;KACF,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,KAAK,UAAU,IAAI;QACjB,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAA;YACpE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE;gBACxD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aAClE,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlB,CAAA;YACjB,IAAI,cAAc,IAAI,IAAI;gBACxB,OAAO,GAAG,CAAC,aAAa,CACtB;oBACE,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;iBACzB,EACD,GAAG,CACJ,CAAA;YACH,yFAAyF;YACzF,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;gBAAE,QAAQ,IAAI,CAAC,CAAA;iBACxC,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB;gBAC7C,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,0CAA0C;YACnD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,uBAAuB,EAAE,IAAI,CAAC,yBAAyB;QACvD,IAAI;KACL,CAAA;AACH,CAAC;AA2CD;;;GAGG;AACH,SAAS,QAAQ;IACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAwB,CAAA;IACzE,MAAM,IAAI,GAAG,OAAO,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;IACtE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACpD,CAAC"}