@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/internal/Authorize.d.ts

@@ -0,0 +1,532 @@
+import { z } from 'zod';
+import type * as Apps from './Apps.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as KeyAuthorization from './KeyAuthorization.js';
+import * as Validation from './Validation.js';
+declare const InvalidOriginError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "unauthorized_client";
+            reason: "invalid_origin";
+        };
+    };
+    readonly reason: "invalid_origin";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** A headless request came from an origin that its redirect URI does not allow. */
+export declare class InvalidOriginError extends InvalidOriginError_base {
+    readonly name = "Authorize.InvalidOriginError";
+}
+declare const RejectedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "rejected";
+        };
+    };
+    readonly reason: "rejected";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * The request names no registered app or redirect URI, the app is not a first-party app, or the app
+ * cannot receive tokens headlessly.
+ */
+export declare class RejectedError extends RejectedError_base {
+    readonly name = "Authorize.RejectedError";
+    constructor(options?: RejectedError.Options);
+}
+export declare namespace RejectedError {
+    type Options = {
+        /** The refusal's description, in place of the default that names the fields to check. */
+        description?: string | undefined;
+    };
+}
+/** Zod schemas for headless authorization requests and their responses. */
+export declare namespace schema {
+    /** The tokens that a public app receives. */
+    const tokens: z.ZodObject<{
+        access_token: z.ZodString;
+        expires_in: z.ZodNumber;
+        id_token: z.ZodOptional<z.ZodString>;
+        refresh_token: z.ZodOptional<z.ZodString>;
+        token_type: z.ZodString;
+    }, z.core.$strip>;
+    /** A message whose EIP-191 hash becomes a key authorization's witness. */
+    const challenge: z.ZodOptional<z.ZodString>;
+    /** An app's headless authorization request. */
+    const request: z.ZodPipe<z.ZodObject<{
+        challenge: z.ZodOptional<z.ZodString>;
+        client_id: z.ZodString;
+        code_challenge: z.ZodOptional<z.ZodString>;
+        key_authorization: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+            account: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            address: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            chainId: z.ZodOptional<z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>>;
+            expiry: z.ZodOptional<z.ZodNumber>;
+            keyType: z.ZodOptional<z.ZodEnum<{
+                p256: "p256";
+                secp256k1: "secp256k1";
+                webAuthn: "webAuthn";
+            }>>;
+            limits: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                limit: z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>;
+                period: z.ZodOptional<z.ZodNumber>;
+                token: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            publicKey: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            scopes: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                address: z.ZodTemplateLiteral<`0x${string}`>;
+                recipients: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodTemplateLiteral<`0x${string}`>>>>;
+                selector: z.ZodOptional<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodString]>>;
+            }, z.core.$strip>>>>;
+        }, z.core.$strip>, z.ZodTransform<{
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }, {
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        }>>>;
+        redirect_uri: z.ZodURL;
+        scope: z.ZodOptional<z.ZodString>;
+        state: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodTransform<{
+        challenge?: string | undefined;
+        client_id: string;
+        code_challenge?: string | undefined;
+        key_authorization?: ({
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }) | undefined;
+        redirect_uri: string;
+        scope?: string | undefined;
+        state?: string | undefined;
+    }, {
+        challenge?: string | undefined;
+        client_id: string;
+        code_challenge?: string | undefined;
+        key_authorization?: ({
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }) | undefined;
+        redirect_uri: string;
+        scope?: string | undefined;
+        state?: string | undefined;
+    }>>;
+    /**
+     * The key of a redirect's authorization request: the `challenge` and the decoded
+     * `key_authorization` of its `/authorize` query, with the challenge bound as the key's witness.
+     */
+    const redirect: z.ZodPipe<z.ZodObject<{
+        challenge: z.ZodOptional<z.ZodString>;
+        key_authorization: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+            account: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            address: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            chainId: z.ZodOptional<z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>>;
+            expiry: z.ZodOptional<z.ZodNumber>;
+            keyType: z.ZodOptional<z.ZodEnum<{
+                p256: "p256";
+                secp256k1: "secp256k1";
+                webAuthn: "webAuthn";
+            }>>;
+            limits: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                limit: z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>;
+                period: z.ZodOptional<z.ZodNumber>;
+                token: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            publicKey: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            scopes: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                address: z.ZodTemplateLiteral<`0x${string}`>;
+                recipients: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodTemplateLiteral<`0x${string}`>>>>;
+                selector: z.ZodOptional<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodString]>>;
+            }, z.core.$strip>>>>;
+        }, z.core.$strip>, z.ZodTransform<{
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }, {
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        }>>>;
+    }, z.core.$strip>, z.ZodTransform<({
+        account?: `0x${string}` | undefined;
+        address?: `0x${string}` | undefined;
+        chainId?: bigint | undefined;
+        expiry?: number | undefined;
+        keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+        limits?: readonly {
+            limit: bigint;
+            period?: number | undefined;
+            token: `0x${string}`;
+        }[] | undefined;
+        publicKey?: `0x${string}` | undefined;
+        scopes?: readonly {
+            address: `0x${string}`;
+            recipients?: readonly `0x${string}`[] | undefined;
+            selector?: string | undefined;
+        }[] | undefined;
+    } & {
+        chainId: bigint;
+        expiry: number;
+        limits: NonNullable<readonly {
+            limit: bigint;
+            period?: number | undefined;
+            token: `0x${string}`;
+        }[] | undefined>;
+        scopes: NonNullable<readonly {
+            address: `0x${string}`;
+            recipients?: readonly `0x${string}`[] | undefined;
+            selector?: string | undefined;
+        }[] | undefined>;
+        witness?: import("ox/Hex").Hex | undefined;
+    }) | undefined, {
+        challenge?: string | undefined;
+        key_authorization?: ({
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }) | undefined;
+    }>>;
+    /** What a headless authorization returns: a code or tokens, with any signed key. */
+    const response: z.ZodObject<{
+        account: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+        code: z.ZodOptional<z.ZodString>;
+        key_authorization: z.ZodOptional<z.ZodObject<{
+            account: z.ZodOptional<z.ZodNullable<z.ZodTemplateLiteral<`0x${string}`>>>;
+            allowedCalls: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                selectorRules: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                    recipients: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodTemplateLiteral<`0x${string}`>>>>;
+                    selector: z.ZodTemplateLiteral<`0x${string}`>;
+                }, z.core.$strip>>>>;
+                target: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            chainId: z.ZodTemplateLiteral<`0x${string}`>;
+            expiry: z.ZodOptional<z.ZodNullable<z.ZodTemplateLiteral<`0x${string}`>>>;
+            keyId: z.ZodTemplateLiteral<`0x${string}`>;
+            keyType: z.ZodString;
+            limits: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                limit: z.ZodTemplateLiteral<`0x${string}`>;
+                period: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                token: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            signature: z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                r: z.ZodTemplateLiteral<`0x${string}`>;
+                s: z.ZodTemplateLiteral<`0x${string}`>;
+                type: z.ZodLiteral<"secp256k1">;
+                v: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                yParity: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>, z.ZodObject<{
+                preHash: z.ZodBoolean;
+                pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                r: z.ZodTemplateLiteral<`0x${string}`>;
+                s: z.ZodTemplateLiteral<`0x${string}`>;
+                type: z.ZodLiteral<"p256">;
+            }, z.core.$strip>, z.ZodObject<{
+                pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                r: z.ZodTemplateLiteral<`0x${string}`>;
+                s: z.ZodTemplateLiteral<`0x${string}`>;
+                type: z.ZodLiteral<"webAuthn">;
+                webauthnData: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>], "type">, z.ZodObject<{
+                keyId: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                signature: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    r: z.ZodTemplateLiteral<`0x${string}`>;
+                    s: z.ZodTemplateLiteral<`0x${string}`>;
+                    type: z.ZodLiteral<"secp256k1">;
+                    v: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                    yParity: z.ZodTemplateLiteral<`0x${string}`>;
+                }, z.core.$strip>, z.ZodObject<{
+                    preHash: z.ZodBoolean;
+                    pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                    pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                    r: z.ZodTemplateLiteral<`0x${string}`>;
+                    s: z.ZodTemplateLiteral<`0x${string}`>;
+                    type: z.ZodLiteral<"p256">;
+                }, z.core.$strip>, z.ZodObject<{
+                    pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                    pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                    r: z.ZodTemplateLiteral<`0x${string}`>;
+                    s: z.ZodTemplateLiteral<`0x${string}`>;
+                    type: z.ZodLiteral<"webAuthn">;
+                    webauthnData: z.ZodTemplateLiteral<`0x${string}`>;
+                }, z.core.$strip>], "type">;
+                type: z.ZodLiteral<"keychain">;
+                userAddress: z.ZodTemplateLiteral<`0x${string}`>;
+                version: z.ZodOptional<z.ZodEnum<{
+                    v1: "v1";
+                    v2: "v2";
+                }>>;
+            }, z.core.$strip>]>;
+            witness: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+        }, z.core.$strip>>;
+        state: z.ZodOptional<z.ZodString>;
+        tokens: z.ZodOptional<z.ZodObject<{
+            access_token: z.ZodString;
+            expires_in: z.ZodNumber;
+            id_token: z.ZodOptional<z.ZodString>;
+            refresh_token: z.ZodOptional<z.ZodString>;
+            token_type: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}
+/** An app's headless authorization request. */
+export type Request = z.output<typeof schema.request>;
+/**
+ * Returns why Tempo ID refuses a headless `request`, or `undefined` when the caller may make it:
+ *
+ * - The app must exist, register `redirect_uri`, and be a first-party app, which skips consent.
+ * - The app must be a web app, and its page must call from its redirect URI's origin. A native app
+ *   authorizes through an authentication sheet.
+ * - A key must come from a page of an app without a client secret, fit the headless ceiling, and
+ *   carry a challenge only for an app with the `tempo-id:sign` scope. Any other app authorizes a key
+ *   through a redirect or the device grant.
+ */
+export declare function check(request: Request, options: check.Options): ErrorResponse.Instance<typeof check.errors> | undefined;
+export declare namespace check {
+    type Options = {
+        /** The app that `client_id` names, or `undefined` when no app has it. */
+        app: Pick<Apps.App, 'redirectUris' | 'secret' | 'sign' | 'skipConsent' | 'type'> | undefined;
+        /** The request's `Origin`, if any. */
+        origin: string | undefined;
+    };
+    /** The refusals `check` returns. Its return type admits no other. */
+    const errors: readonly [typeof KeyAuthorization.DuplicateLimitError, typeof KeyAuthorization.DuplicateScopeError, typeof KeyAuthorization.EmptyLimitsError, typeof KeyAuthorization.EmptyScopesError, typeof KeyAuthorization.ExpiryPassedError, typeof KeyAuthorization.InvalidChainError, typeof KeyAuthorization.InvalidExpiryError, typeof KeyAuthorization.InvalidPeriodError, typeof KeyAuthorization.InvalidPublicKeyError, typeof KeyAuthorization.InvalidRecipientsError, typeof KeyAuthorization.MissingKeyError, typeof KeyAuthorization.MissingRecipientsError, typeof KeyAuthorization.ScopeWithoutLimitError, typeof KeyAuthorization.UnsupportedCallError, typeof KeyAuthorization.UnsupportedTokenError, typeof KeyAuthorization.ExpiryExceedsMaximumError, typeof KeyAuthorization.LimitExceedsMaximumError, typeof KeyAuthorization.ChallengeNotPermittedError, typeof InvalidOriginError, typeof RejectedError];
+}
+/**
+ * Returns why Tempo ID refuses `key` in a redirect's authorization request, or `undefined` when the
+ * owner may sign it once the user approves it. The approval page shows the key, so it applies the
+ * rules of `KeyAuthorization.check` and no headless ceiling. A challenge needs the app's
+ * `tempo-id:sign` scope, and the request needs a PKCE challenge, whose verifier receives the key.
+ */
+export declare function checkKey(options: checkKey.Options): ErrorResponse.Instance<typeof checkKey.errors> | undefined;
+export declare namespace checkKey {
+    type Options = {
+        /** The app that `clientId` names, or `undefined` when no app has it. */
+        app: Pick<Apps.App, 'sign'> | undefined;
+        /** The client ID of the app that requests the key. */
+        clientId: string;
+        /** The request's `code_challenge`, if any. */
+        codeChallenge: string | null | undefined;
+        /** The key that the request carries. */
+        key: KeyAuthorization.Key;
+    };
+    /** The refusals `checkKey` returns. Its return type admits no other. */
+    const errors: readonly [typeof KeyAuthorization.DuplicateLimitError, typeof KeyAuthorization.DuplicateScopeError, typeof KeyAuthorization.EmptyLimitsError, typeof KeyAuthorization.EmptyScopesError, typeof KeyAuthorization.ExpiryPassedError, typeof KeyAuthorization.InvalidChainError, typeof KeyAuthorization.InvalidExpiryError, typeof KeyAuthorization.InvalidPeriodError, typeof KeyAuthorization.InvalidPublicKeyError, typeof KeyAuthorization.InvalidRecipientsError, typeof KeyAuthorization.MissingKeyError, typeof KeyAuthorization.MissingRecipientsError, typeof KeyAuthorization.ScopeWithoutLimitError, typeof KeyAuthorization.UnsupportedCallError, typeof KeyAuthorization.UnsupportedTokenError, typeof KeyAuthorization.ChallengeNotPermittedError, typeof RejectedError];
+}
+/**
+ * Returns the key that a redirect's authorization `query` carries: its `key_authorization`,
+ * base64url JSON, with its `challenge` bound as the witness. Returns `undefined` for a query without
+ * a key, and `Validation.InvalidFieldError` for a key that does not parse, a challenge without a
+ * key, or a repeated parameter, so a page cannot show one value and approve another.
+ */
+export declare function fromQuery(query: URLSearchParams): KeyAuthorization.Key | Validation.InvalidFieldError | undefined;
+/**
+ * Returns the parameters of an authorization request that carries `key_authorization` with
+ * `consent` added to `prompt`, so the approval page shows the key, also for an app that skips
+ * consent. A key that names no expiry gains the default, so approval signs the expiry that the page
+ * shows. Returns other parameters unchanged.
+ */
+export declare function prepare(parameters: URLSearchParams): URLSearchParams;
+export {};
+//# sourceMappingURL=Authorize.d.ts.map

package/dist/internal/Authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorize.d.ts","sourceRoot":"","sources":["../../src/internal/Authorize.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE7C,mFAAmF;AACnF,qBAAa,kBAAmB,SAAQ,uBAAsC;IAC5E,SAAkB,IAAI,kCAAiC;CACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,kBAAgC;IACjE,SAAkB,IAAI,6BAA4B;IAElD,YAAY,OAAO,GAAE,aAAa,CAAC,OAAY,EAM9C;CACF;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,KAAK,OAAO,GAAG;QACb,yFAAyF;QACzF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACjC,CAAA;CACF;AAED,2EAA2E;AAC3E,yBAAiB,MAAM,CAAC;IACtB,6CAA6C;IACtC,MAAM,MAAM;;;;;;qBAgCqD,CAAA;IAExE,0EAA0E;IACnE,MAAM,SAAS,4BASlB,CAAA;IAEJ,+CAA+C;IACxC,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwEhB,CAAA;IAEJ;;;OAGG;IACI,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAalB,CAAA;IAEH,oFAAoF;IAC7E,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA4BjB,CAAA;CACL;AAED,+CAA+C;AAC/C,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;AAErD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CACnB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,KAAK,CAAC,OAAO,GACrB,aAAa,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,CA2CzD;AAED,yBAAiB,KAAK,CAAC;IACrB,KAAY,OAAO,GAAG;QACpB,yEAAyE;QACzE,GAAG,EACC,IAAI,CACF,IAAI,CAAC,GAAG,EACR,cAAc,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,CAC5D,GACD,SAAS,CAAA;QACb,sCAAsC;QACtC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;IAED,qEAAqE;IAC9D,MAAM,MAAM,s3BAKT,CAAA;CACX;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,aAAa,CAAC,QAAQ,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAW5D;AAED,yBAAiB,QAAQ,CAAC;IACxB,KAAY,OAAO,GAAG;QACpB,wEAAwE;QACxE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;QACvC,sDAAsD;QACtD,QAAQ,EAAE,MAAM,CAAA;QAChB,8CAA8C;QAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QACxC,wCAAwC;QACxC,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAA;KAC1B,CAAA;IAED,wEAAwE;IACjE,MAAM,MAAM,svBAIT,CAAA;CACX;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,eAAe,GACrB,gBAAgB,CAAC,GAAG,GAAG,UAAU,CAAC,iBAAiB,GAAG,SAAS,CAoBjE;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAAE,eAAe,mBA8BlD"}