@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/client/actions/realm.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Lists the realms the app reaches: the sets of Tempo Accounts its settings name.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+/**
+ * Lists the realms the app reaches, in its settings' order. The first holds a user's first account.
+ *
+ * @example
+ * ```ts
+ * const realms = await Actions.realm.list(auth)
+ * // [{ id: 'default', name: 'Tempo' }]
+ * ```
+ */
+export declare function list(auth: Auth): Promise<list.ReturnType>;
+export declare namespace list {
+    type ReturnType = readonly {
+        /** The realm ID, such as `default` or `tempo-cash`. */
+        id: string;
+        /** The realm's display name, such as `Tempo Cash`. */
+        name: string;
+    }[];
+}
+//# sourceMappingURL=realm.d.ts.map

package/dist/client/actions/realm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.d.ts","sourceRoot":"","sources":["../../../src/client/actions/realm.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC;;;;;;;;GAQG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAU/D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,UAAU,GAAG,SAAS;QACzB,uDAAuD;QACvD,EAAE,EAAE,MAAM,CAAA;QACV,sDAAsD;QACtD,IAAI,EAAE,MAAM,CAAA;KACb,EAAE,CAAA;CACJ"}

package/dist/client/actions/realm.js

@@ -0,0 +1,15 @@
+import * as Api from '../internal/api.js';
+/**
+ * Lists the realms the app reaches, in its settings' order. The first holds a user's first account.
+ *
+ * @example
+ * ```ts
+ * const realms = await Actions.realm.list(auth)
+ * // [{ id: 'default', name: 'Tempo' }]
+ * ```
+ */
+export async function list(auth) {
+    const { realms } = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/realms?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url)));
+    return realms;
+}
+//# sourceMappingURL=realm.js.map

package/dist/client/actions/realm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.js","sourceRoot":"","sources":["../../../src/client/actions/realm.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU;IACnC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CACzB,IAAI,GAAG,CACL,cAAc,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EACjE,IAAI,CAAC,GAAG,CACT,CACF,CACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/client/actions/redirect.d.ts

@@ -0,0 +1,153 @@
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import * as Pending from '../Pending.js';
+import type { Permissions } from '../Permissions.js';
+/** `complete` received a `key` that differs from the one `start` received for the stored redirect. */
+export declare class KeyMismatchError extends Error {
+    readonly name = "Actions.redirect.KeyMismatchError";
+    constructor(options: {
+        stored: boolean;
+    });
+}
+/**
+ * Finishes a {@link start} when the page loads with Tempo ID's callback, and returns `undefined`
+ * otherwise. The code is redeemed once, however often the page calls this. A callback that denies
+ * this page's redirect, such as `error=access_denied`, throws a `RequestError` with that `error` as
+ * its `code` and status 0.
+ *
+ * @example
+ * ```ts
+ * const authorization =
+ *   (await Actions.redirect.complete(auth)) ??
+ *   (await Actions.authorize(auth))
+ * ```
+ */
+export declare function complete<const key extends boolean = true>(auth: Auth, options?: complete.Options<key>): Promise<complete.ReturnType<key>>;
+export declare namespace complete {
+    type Options<key extends boolean = true> = {
+        /** The key the app passed to {@link start}, if it supplied one. */
+        accessKey?: Account.Account | undefined;
+        /**
+         * The `key` that {@link start} received: `false` for a sign-in without a key. Defaults to
+         * `true`. A stored redirect that `start` began with another `key` throws
+         * {@link KeyMismatchError}.
+         */
+        key?: key | undefined;
+    };
+    /**
+     * The authorization, or the tokens and the user alone for a sign-in without a key. `undefined`
+     * when the page is not a redirect's callback.
+     */
+    type ReturnType<key extends boolean = true> = (key extends false ? handleCallback.WithoutKey : Authorization) | undefined;
+}
+/**
+ * Returns the URL that signs the user in on Tempo ID's pages and redirects back with a code,
+ * and the `Pending` state to keep until then, such as in a sealed cookie.
+ * {@link handleCallback} redeems the code for the tokens and the key authorization.
+ *
+ * @example
+ * ```ts
+ * const { pending, url } = await Actions.redirect.createUrl(auth, {
+ *   redirectUri: 'https://app.example/auth/callback',
+ * })
+ * await seal(c, 'oauth', pending)
+ * return c.redirect(url)
+ * ```
+ */
+export declare function createUrl<const key extends boolean = true>(auth: Auth, options?: createUrl.Options<key>): Promise<createUrl.ReturnType<key>>;
+export declare namespace createUrl {
+    type Options<key extends boolean = true> = {
+        /**
+         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key, whose material `pending` keeps.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
+         * Tempo ID binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
+         * `tempo-id:sign` scope may send one. With `key: false`, the call throws
+         * `Auth.ChallengeWithoutKeyError`.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /**
+         * Whether the sign-in authorizes an access key. With `false`, the request carries no key
+         * authorization, and {@link handleCallback} returns the tokens and the user alone. Defaults to
+         * `true`.
+         */
+        key?: key | undefined;
+        /** What the key may do. Tempo ID's pages show it, and the headless ceiling fills what it leaves out. */
+        permissions?: Permissions | undefined;
+        /** Where Tempo ID redirects back to. Defaults to the instance's `redirectUri`. */
+        redirectUri?: string | undefined;
+    };
+    type ReturnType<key extends boolean = true> = {
+        /** What to keep until the callback, such as in a sealed cookie. */
+        pending: key extends false ? Pending.WithoutKey : Pending.Pending;
+        /** Where to send the browser. */
+        url: string;
+    };
+}
+/**
+ * Finishes a sign-in redirect: checks its state, and redeems the code with the PKCE verifier (and
+ * the client secret, for a backend) for the tokens and the key authorization.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.redirect.handleCallback(auth, {
+ *   pending: await unseal(c, 'oauth'),
+ *   url: c.req.url,
+ * })
+ * ```
+ */
+export declare function handleCallback<const pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending>(auth: Auth, options: handleCallback.Options<pending>): Promise<handleCallback.ReturnType<pending>>;
+export declare namespace handleCallback {
+    type Options<pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending> = {
+        /** The key the app passed to `createUrl`, if it supplied one. */
+        accessKey?: Account.Account | undefined;
+        /** What `createUrl` returned to keep. */
+        pending: pending;
+        /** The callback URL Tempo ID redirected to. */
+        url: string | URL;
+    };
+    /**
+     * The authorization, or the tokens and the user alone for a `Pending.WithoutKey`. A `pending`
+     * typed as either returns either.
+     */
+    type ReturnType<pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending> = [pending] extends [Pending.WithoutKey] ? WithoutKey : [pending] extends [Pending.Pending] ? Authorization : Authorization | WithoutKey;
+    /** What a sign-in without a key returns: the tokens and the user. */
+    type WithoutKey = Omit<Authorization, 'account' | 'key'>;
+}
+/**
+ * Sends the browser to Tempo ID's pages to sign in, keeping the redirect's state in `storage`.
+ * {@link complete} finishes it when the browser returns.
+ *
+ * @example
+ * ```ts
+ * await Actions.redirect.start(auth)
+ * ```
+ */
+export declare function start(auth: Auth, options?: start.Options): Promise<void>;
+export declare namespace start {
+    type Options = {
+        /**
+         * The key to authorize, as a Viem account. Pass it to {@link complete} too. Defaults to a new
+         * key, which `storage` keeps until the browser returns.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
+         * Tempo ID binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
+         * `tempo-id:sign` scope may send one.
+         */
+        challenge?: string | undefined;
+        /**
+         * Whether the sign-in authorizes an access key. With `false`, {@link complete} returns the
+         * tokens and the user alone. Defaults to `true`.
+         */
+        key?: boolean | undefined;
+        /** What the key may do. Tempo ID's pages show it, and the headless ceiling fills what it leaves out. */
+        permissions?: Permissions | undefined;
+    };
+}
+//# sourceMappingURL=redirect.d.ts.map

package/dist/client/actions/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/client/actions/redirect.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA0C,MAAM,YAAY,CAAA;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAKxD,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,sGAAsG;AACtG,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,uCAAsC;IAE5D,YAAY,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,EAMvC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EACvD,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAM,GAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAsEnC;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QACzC,mEAAmE;QACnE,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;WAIG;QACH,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;KACtB,CAAA;IAED;;;OAGG;IACH,KAAK,UAAU,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IACtC,CAAC,GAAG,SAAS,KAAK,GAAG,cAAc,CAAC,UAAU,GAAG,aAAa,CAAC,GAC/D,SAAS,CAAA;CACd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAC9D,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAM,GACnC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CA8CpC;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QACzC;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;;WAKG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE;;;;WAIG;QACH,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,wGAAwG;QACxG,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;QACrC,kFAAkF;QAClF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACjC,CAAA;IAED,KAAK,UAAU,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC5C,mEAAmE;QACnE,OAAO,EAAE,GAAG,SAAS,KAAK,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,CAAA;QACjE,iCAAiC;QACjC,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,KAAK,CAAC,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,EAE5E,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAqD7C;AAED,MAAM,CAAC,OAAO,WAAW,cAAc,CAAC;IACtC,KAAK,OAAO,CACV,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,IACpE;QACF,iEAAiE;QACjE,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC,yCAAyC;QACzC,OAAO,EAAE,OAAO,CAAA;QAChB,+CAA+C;QAC/C,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAClB,CAAA;IAED;;;OAGG;IACH,KAAK,UAAU,CACb,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,IACpE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,GACtC,UAAU,GACV,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GACjC,aAAa,GACb,aAAa,GAAG,UAAU,CAAA;IAEhC,qEAAqE;IACrE,KAAK,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,KAAK,CAAC,OAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B;;;WAGG;QACH,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,wGAAwG;QACxG,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KACtC,CAAA;CACF"}

package/dist/client/actions/redirect.js

@@ -0,0 +1,236 @@
+/**
+ * Signs the user in on Tempo ID's pages, which redirect back with a code. `start` and `complete`
+ * keep the redirect's state in `storage` for a browser app. `createUrl` and `handleCallback` leave
+ * it to the app to keep, for a backend or a native app.
+ * @module
+ */
+import { Base64, Bytes, Hash } from 'ox';
+import { ChallengeWithoutKeyError, RequestError } from '../Auth.js';
+import * as AccessKey from '../internal/accessKey.js';
+import * as Api from '../internal/api.js';
+import { keyAuthorization } from '../internal/request.js';
+import * as Store from '../internal/store.js';
+import * as Pending from '../Pending.js';
+/** `complete` received a `key` that differs from the one `start` received for the stored redirect. */
+export class KeyMismatchError extends Error {
+    name = 'Actions.redirect.KeyMismatchError';
+    constructor(options) {
+        super(options.stored
+            ? 'The redirect authorized a key, but `complete` received `key: false`. Pass the `key` that `start` received.'
+            : 'The redirect authorized no key, but `complete` did not receive `key: false`. Pass the `key` that `start` received.');
+    }
+}
+/**
+ * Finishes a {@link start} when the page loads with Tempo ID's callback, and returns `undefined`
+ * otherwise. The code is redeemed once, however often the page calls this. A callback that denies
+ * this page's redirect, such as `error=access_denied`, throws a `RequestError` with that `error` as
+ * its `code` and status 0.
+ *
+ * @example
+ * ```ts
+ * const authorization =
+ *   (await Actions.redirect.complete(auth)) ??
+ *   (await Actions.authorize(auth))
+ * ```
+ */
+export function complete(auth, options = {}) {
+    completed ??= (async () => {
+        const store = Store.get(auth);
+        const stored = (await store.getItem(storageKey));
+        const url = new URL(window.location.href);
+        // A registered redirect URI may hold its own `error`, which the app keeps. Only an `error` that
+        // the callback added after it belongs to the authorization response.
+        const redirectUri = stored?.redirectUri ?? url.origin;
+        const registered = new URL(redirectUri).searchParams;
+        const added = (name) => response(url, { name, redirectUri });
+        // A custom `storage` may return `null` for a missing item.
+        const ours = stored != null && url.searchParams.get('state') === stored.state;
+        // The result's type follows `key`, so a redirect that `start` began with another `key` fails. The
+        // state and the URL stay, so a page load that passes the right `key` finishes the redirect.
+        if (ours &&
+            url.searchParams.has('code') &&
+            (stored.key === false) !== (options.key === false))
+            throw new KeyMismatchError({ stored: stored.key !== false });
+        await store.removeItem(storageKey);
+        // The app keeps its own query and fragment, without the callback's parameters. A code this page
+        // did not request is dropped too, since it redeems for whoever crafted its request. A page that is
+        // no callback of this page keeps its own `state` and `error` parameters.
+        const callback = [
+            'code',
+            'error',
+            'error_description',
+            'error_uri',
+            'state',
+        ];
+        if (ours || url.searchParams.has('code')) {
+            const clean = new URL(url);
+            for (const name of callback) {
+                clean.searchParams.delete(name);
+                for (const value of registered.getAll(name))
+                    clean.searchParams.append(name, value);
+            }
+            window.history.replaceState(null, '', clean.pathname + clean.search + clean.hash);
+        }
+        // A denial of this page's redirect throws, so the app never mistakes it for a page load
+        // without a callback and authorizes another way.
+        const error = added('error');
+        if (ours && error)
+            throw new RequestError({
+                code: error,
+                message: added('error_description') ?? error,
+                status: 0,
+                uri: added('error_uri'),
+            });
+        if (!url.searchParams.has('code') || !stored)
+            return undefined;
+        return handleCallback(auth, {
+            accessKey: options.accessKey,
+            pending: stored,
+            url,
+        });
+    })();
+    // The check above holds the stored redirect to `key`, which types the result.
+    return completed;
+}
+/**
+ * Returns the URL that signs the user in on Tempo ID's pages and redirects back with a code,
+ * and the `Pending` state to keep until then, such as in a sealed cookie.
+ * {@link handleCallback} redeems the code for the tokens and the key authorization.
+ *
+ * @example
+ * ```ts
+ * const { pending, url } = await Actions.redirect.createUrl(auth, {
+ *   redirectUri: 'https://app.example/auth/callback',
+ * })
+ * await seal(c, 'oauth', pending)
+ * return c.redirect(url)
+ * ```
+ */
+export async function createUrl(auth, options = {}) {
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
+    const key = options.key === false
+        ? undefined
+        : await AccessKey.resolve(options.accessKey);
+    const pending = Pending.from({
+        ...(key ? key.material : { key: false }),
+        redirectUri,
+        // `Bytes.random` needs only `crypto.getRandomValues`, which React Native polyfills.
+        state: Base64.fromBytes(Bytes.random(16), base64url),
+        verifier: Base64.fromBytes(Bytes.random(32), base64url),
+    });
+    const authorization = key
+        ? keyAuthorization(auth, {
+            accessKey: key.accessKey,
+            permissions: options.permissions,
+        })
+        : undefined;
+    const url = new URL('/authorize', auth.url);
+    url.search = new URLSearchParams({
+        ...(options.challenge === undefined
+            ? {}
+            : { challenge: options.challenge }),
+        client_id: auth.clientId,
+        code_challenge: Base64.fromBytes(Hash.sha256(Bytes.fromString(pending.verifier)), base64url),
+        ...(authorization
+            ? {
+                key_authorization: Base64.fromString(JSON.stringify(authorization), base64url),
+            }
+            : {}),
+        redirect_uri: redirectUri,
+        scope: auth.scope,
+        state: pending.state,
+    }).toString();
+    // `options.key` decides both the type and the runtime value of `pending`.
+    return { pending, url: url.href };
+}
+/**
+ * Finishes a sign-in redirect: checks its state, and redeems the code with the PKCE verifier (and
+ * the client secret, for a backend) for the tokens and the key authorization.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.redirect.handleCallback(auth, {
+ *   pending: await unseal(c, 'oauth'),
+ *   url: c.req.url,
+ * })
+ * ```
+ */
+export async function handleCallback(auth, options) {
+    const { key, redirectUri, state, verifier, ...material } = options.pending;
+    const url = new URL(options.url);
+    const added = (name) => response(url, { name, redirectUri });
+    // State comes first, so a forged link cannot supply the error an app shows.
+    if (url.searchParams.get('state') !== state)
+        throw new RequestError({
+            code: 'invalid_request',
+            field: 'state',
+            message: 'Invalid `state` in the callback URL. Start sign-in again from this app.',
+            status: 400,
+        });
+    const code = url.searchParams.get('code');
+    if (!code)
+        throw new RequestError({
+            code: added('error') ?? 'invalid_request',
+            field: 'code',
+            message: added('error_description') ??
+                'Missing `code` in the callback URL. Start sign-in again.',
+            status: 400,
+        });
+    const body = await Api.token(auth, {
+        code,
+        code_verifier: verifier,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri,
+    });
+    // `pending.key` decides both the type and the runtime value of the result.
+    if (key === false) {
+        const tokens = Api.tokens(body);
+        return {
+            ...tokens,
+            user: Api.user(tokens),
+        };
+    }
+    if (!body.account || !body.key_authorization)
+        throw new RequestError({
+            code: 'invalid_grant',
+            message: 'Missing key authorization in the token response. The code was already redeemed, or did not request a key. Start sign-in again.',
+            status: 400,
+        });
+    return Api.authorization({
+        account: body.account,
+        key_authorization: body.key_authorization,
+        tokens: body,
+    }, { accessKey: options.accessKey, material });
+}
+/**
+ * Sends the browser to Tempo ID's pages to sign in, keeping the redirect's state in `storage`.
+ * {@link complete} finishes it when the browser returns.
+ *
+ * @example
+ * ```ts
+ * await Actions.redirect.start(auth)
+ * ```
+ */
+export async function start(auth, options = {}) {
+    const { pending, url } = await createUrl(auth, options);
+    await Store.get(auth).setItem(storageKey, pending);
+    window.location.assign(url);
+}
+/** Unpadded URL-safe Base64, as PKCE and `key_authorization` use. */
+const base64url = { pad: false, url: true };
+/** The redirect this page load returns from, so its code is redeemed once. */
+let completed;
+/** Where a redirect keeps its state in `storage`. */
+const storageKey = 'tempo-id:redirect';
+/**
+ * Returns the first value of `name` that the authorization response added to the callback URL. A
+ * registered redirect URI may hold its own `error` parameters, which come first, since the issuer
+ * appends a refusal's. It replaces `code` and `state`, which have one value.
+ */
+function response(url, options) {
+    const registered = new URL(options.redirectUri).searchParams.getAll(options.name).length;
+    return url.searchParams.getAll(options.name)[registered];
+}
+//# sourceMappingURL=redirect.js.map

package/dist/client/actions/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/client/actions/redirect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAExC,OAAO,EAAa,wBAAwB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9E,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAC7C,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAGxC,sGAAsG;AACtG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAAY,OAA4B;QACtC,KAAK,CACH,OAAO,CAAC,MAAM;YACZ,CAAC,CAAC,4GAA4G;YAC9G,CAAC,CAAC,oHAAoH,CACzH,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAU,EACV,OAAO,GAA0B,EAAE;IAEnC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAIlC,CAAA;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,gGAAgG;QAChG,qEAAqE;QACrE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,GAAG,CAAC,MAAM,CAAA;QACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,CAAA;QACpD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,2DAA2D;QAC3D,MAAM,IAAI,GACR,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK,CAAA;QAClE,kGAAkG;QAClG,4FAA4F;QAC5F,IACE,IAAI;YACJ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5B,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC;YAElD,MAAM,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAA;QAE9D,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAClC,gGAAgG;QAChG,mGAAmG;QACnG,yEAAyE;QACzE,MAAM,QAAQ,GAAG;YACf,MAAM;YACN,OAAO;YACP,mBAAmB;YACnB,WAAW;YACX,OAAO;SACR,CAAA;QACD,IAAI,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC/B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBACzC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC1C,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,YAAY,CACzB,IAAI,EACJ,EAAE,EACF,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAC3C,CAAA;QACH,CAAC;QAED,wFAAwF;QACxF,iDAAiD;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,IAAI,IAAI,KAAK;YACf,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,KAAK;gBAC5C,MAAM,EAAE,CAAC;gBACT,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;aACxB,CAAC,CAAA;QACJ,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC9D,OAAO,cAAc,CAAC,IAAI,EAAE;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,MAAM;YACf,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,EAAE,CAAA;IACJ,8EAA8E;IAC9E,OAAO,SAA8C,CAAA;AACvD,CAAC;AAuBD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAU,EACV,OAAO,GAA2B,EAAE;IAEpC,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAA;IACzE,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxC,WAAW;QACX,oFAAoF;QACpF,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;QACpD,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;KACxD,CAAC,CAAA;IACF,MAAM,aAAa,GAAG,GAAG;QACvB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAC3C,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,cAAc,EAAE,MAAM,CAAC,SAAS,CAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAC/C,SAAS,CACV;QACD,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAClC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAC7B,SAAS,CACV;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC,QAAQ,EAAE,CAAA;IACb,0EAA0E;IAC1E,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAA+B,CAAA;AAChE,CAAC;AAoCD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAGlC,IAAU,EACV,OAAwC;IAExC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAA;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IACpE,4EAA4E;IAC5E,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK;QACzC,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,OAAO;YACd,OAAO,EACL,yEAAyE;YAC3E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,iBAAiB;YACzC,KAAK,EAAE,MAAM;YACb,OAAO,EACL,KAAK,CAAC,mBAAmB,CAAC;gBAC1B,0DAA0D;YAC5D,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IAEJ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QACjC,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAA;IACF,2EAA2E;IAC3E,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO;YACL,GAAG,MAAM;YACT,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;SACe,CAAA;IACzC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAC1C,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EACL,gIAAgI;YAClI,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,OAAO,GAAG,CAAC,aAAa,CACtB;QACE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI;KACb,EACD,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CACL,CAAA;AACzC,CAAC;AA8BD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAU,EACV,OAAO,GAAkB,EAAE;IAE3B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvD,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAyBD,qEAAqE;AACrE,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAW,CAAA;AAEpD,8EAA8E;AAC9E,IAAI,SAA4D,CAAA;AAEhE,qDAAqD;AACrD,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAEtC;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAQ,EAAE,OAAyB;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,MAAM,CACjE,OAAO,CAAC,IAAI,CACb,CAAC,MAAM,CAAA;IACR,OAAO,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAA;AAC1D,CAAC"}

package/dist/client/internal/accessKey.d.ts

@@ -0,0 +1,21 @@
+import { Account } from 'viem/tempo';
+import type * as Key from '../Key.js';
+/**
+ * Returns the app's key, or creates one. A browser key is non-extractable, since IndexedDB keeps
+ * a `CryptoKey` across page loads. Elsewhere a CLI or native app must store the key as a string.
+ */
+export declare function resolve(accessKey: Account.Account | undefined): Promise<resolve.ReturnType>;
+/**
+ * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
+ * empty material of a key the app supplied.
+ */
+export declare function restore(material: Key.Material): resolve.ReturnType | undefined;
+export declare namespace resolve {
+    type ReturnType = {
+        /** The key, as a Viem account that signs with it. */
+        accessKey: Account.Account;
+        /** What the authorization keeps to rebuild the key. Empty for a key the app supplied. */
+        material: Key.Material;
+    };
+}
+//# sourceMappingURL=accessKey.d.ts.map

package/dist/client/internal/accessKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessKey.d.ts","sourceRoot":"","sources":["../../../src/client/internal/accessKey.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAa,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,KAAK,GAAG,MAAM,WAAW,CAAA;AAErC;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAgB7B;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GACrB,OAAO,CAAC,UAAU,GAAG,SAAS,CAMhC;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,UAAU,GAAG;QAChB,qDAAqD;QACrD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;QAC1B,yFAAyF;QACzF,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAA;KACvB,CAAA;CACF"}

package/dist/client/internal/accessKey.js

@@ -0,0 +1,38 @@
+/**
+ * Resolves the access key a sign-in authorizes: the one the app supplied, or a new one.
+ * @module
+ */
+import { WebCryptoP256 } from 'ox';
+import { Account, Secp256k1 } from 'viem/tempo';
+/**
+ * Returns the app's key, or creates one. A browser key is non-extractable, since IndexedDB keeps
+ * a `CryptoKey` across page loads. Elsewhere a CLI or native app must store the key as a string.
+ */
+export async function resolve(accessKey) {
+    if (accessKey)
+        return { accessKey, material: {} };
+    if (typeof indexedDB !== 'undefined') {
+        const keyPair = await WebCryptoP256.createKeyPair();
+        return {
+            accessKey: Account.fromWebCryptoP256(keyPair),
+            material: { keyPair },
+        };
+    }
+    const privateKey = Secp256k1.randomPrivateKey();
+    return {
+        accessKey: Account.fromSecp256k1(privateKey),
+        material: { privateKey },
+    };
+}
+/**
+ * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
+ * empty material of a key the app supplied.
+ */
+export function restore(material) {
+    if (material.keyPair)
+        return { accessKey: Account.fromWebCryptoP256(material.keyPair), material };
+    if (material.privateKey)
+        return { accessKey: Account.fromSecp256k1(material.privateKey), material };
+    return undefined;
+}
+//# sourceMappingURL=accessKey.js.map

package/dist/client/internal/accessKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessKey.js","sourceRoot":"","sources":["../../../src/client/internal/accessKey.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAG/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAsC;IAEtC,IAAI,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAEjD,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAA;QACnD,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAC7C,QAAQ,EAAE,EAAE,OAAO,EAAE;SACtB,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAA;IAC/C,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,EAAE,UAAU,EAAE;KACzB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CACrB,QAAsB;IAEtB,IAAI,QAAQ,CAAC,OAAO;QAClB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC7E,IAAI,QAAQ,CAAC,UAAU;QACrB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5E,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/client/internal/account.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The state behind `Auth.account()`: the access key account a sign-in set, which the account reads
+ * through to. The `tempoId` extension reads and writes it through {@link key}.
+ * @module
+ */
+import type { Account } from 'viem/tempo';
+/** The property that holds an `Auth.account()`'s state. Other accounts lack it. */
+export declare const key: unique symbol;
+/** What an `Auth.account()` signs as. */
+export type State = {
+    /** The signed-in access key account, or `undefined` while signed out. */
+    account: Account.AccessKeyAccount | undefined;
+};
+//# sourceMappingURL=account.d.ts.map

package/dist/client/internal/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/client/internal/account.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC,mFAAmF;AACnF,eAAO,MAAM,GAAG,eAA6B,CAAA;AAE7C,yCAAyC;AACzC,MAAM,MAAM,KAAK,GAAG;IAClB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAA;CAC9C,CAAA"}

package/dist/client/internal/account.js

@@ -0,0 +1,3 @@
+/** The property that holds an `Auth.account()`'s state. Other accounts lack it. */
+export const key = Symbol('tempo-id.account');
+//# sourceMappingURL=account.js.map

package/dist/client/internal/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/client/internal/account.ts"],"names":[],"mappings":"AAOA,mFAAmF;AACnF,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA"}