@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/internal/Wallet.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+/** The part of wallet.tempo's `Credentials` entrypoint that Tempo ID calls. */
+export type Service = {
+    /** Returns the passkey with `credentialId`, or `undefined` when wallet.tempo stores none. */
+    credential(options: {
+        credentialId: string;
+    }): Promise<unknown>;
+};
+/** A passkey that wallet.tempo stores. */
+export type Credential = z.output<typeof schema.credential>;
+declare namespace schema {
+    const credential: z.ZodObject<{
+        address: z.ZodString;
+        createdAt: z.ZodNullable<z.ZodNumber>;
+        email: z.ZodNullable<z.ZodEmail>;
+        publicKey: z.ZodTemplateLiteral<`0x04${string}`>;
+    }, z.core.$strip>;
+}
+/**
+ * Returns the passkey `id` that wallet.tempo stores, with its account's address, creation time in
+ * milliseconds, and verified email. Returns `undefined` when wallet.tempo does not store it,
+ * returns another shape, or names an address that its public key does not derive.
+ */
+export declare function credential(wallet: Service, options: credential.Options): Promise<{
+    address: string;
+    createdAt: number | null;
+    email: string | null;
+    publicKey: `0x04${string}`;
+} | undefined>;
+export declare namespace credential {
+    type Options = {
+        /** The credential ID, base64url. */
+        id: string;
+    };
+}
+export {};
+//# sourceMappingURL=Wallet.d.ts.map

package/dist/internal/Wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Wallet.d.ts","sourceRoot":"","sources":["../../src/internal/Wallet.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,+EAA+E;AAC/E,MAAM,MAAM,OAAO,GAAG;IACpB,6FAA6F;IAC7F,UAAU,CAAC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE,CAAA;AAED,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;AAE3D,kBAAU,MAAM,CAAC;IACR,MAAM,UAAU;;;;;qBAQrB,CAAA;CACH;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO;;;;;eAoB5E;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,OAAO,GAAG;QACb,oCAAoC;QACpC,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF"}

package/dist/internal/Wallet.js

@@ -0,0 +1,43 @@
+/**
+ * Reads wallet.tempo's passkeys through the optional `WALLET` service binding to its `Credentials`
+ * entrypoint. Tempo ID never reads wallet.tempo's stores, and validates what the binding returns.
+ * @module
+ */
+import { Address, PublicKey } from 'ox';
+import { z } from 'zod';
+var schema;
+(function (schema) {
+    schema.credential = z.object({
+        address: z.string().regex(/^0x[0-9a-fA-F]{40}$/),
+        createdAt: z.number().int().min(0).max(8.64e15).nullable(),
+        email: z.email().nullable(),
+        publicKey: z.templateLiteral([
+            '0x04',
+            z.string().regex(/^[0-9a-fA-F]{128}$/),
+        ]),
+    });
+})(schema || (schema = {}));
+/**
+ * Returns the passkey `id` that wallet.tempo stores, with its account's address, creation time in
+ * milliseconds, and verified email. Returns `undefined` when wallet.tempo does not store it,
+ * returns another shape, or names an address that its public key does not derive.
+ */
+export async function credential(wallet, options) {
+    const result = schema.credential.safeParse(await wallet.credential({ credentialId: options.id }));
+    if (!result.success)
+        return undefined;
+    // The stored address must be the account the public key owns, whatever wallet.tempo returns.
+    const derived = (() => {
+        try {
+            return Address.fromPublicKey(PublicKey.fromHex(result.data.publicKey));
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    if (!derived ||
+        !Address.isEqual(derived, result.data.address))
+        return undefined;
+    return result.data;
+}
+//# sourceMappingURL=Wallet.js.map

package/dist/internal/Wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Wallet.js","sourceRoot":"","sources":["../../src/internal/Wallet.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,IAAU,MAAM,CAUf;AAVD,WAAU,MAAM;IACD,iBAAU,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QAC1D,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC3B,SAAS,EAAE,CAAC,CAAC,eAAe,CAAC;YAC3B,MAAM;YACN,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;SACvC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,EAVS,MAAM,KAAN,MAAM,QAUf;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAe,EAAE,OAA2B;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CACxC,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CACtD,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAErC,6FAA6F;IAC7F,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QACpB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IACE,CAAC,OAAO;QACR,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAA0B,CAAC;QAEjE,OAAO,SAAS,CAAA;IAClB,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC"}

package/dist/worker.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The Worker entry: `App.create` runs Tempo ID in a Cloudflare Worker.
+ *
+ * ```ts
+ * import { App } from '@tempoxyz/id/worker'
+ *
+ * export default App.create({ from: 'Tempo ID <noreply@id.example.com>' })
+ * ```
+ * @module
+ */
+export * as App from './App.js';
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA"}

package/dist/worker.js

@@ -0,0 +1,12 @@
+/**
+ * The Worker entry: `App.create` runs Tempo ID in a Cloudflare Worker.
+ *
+ * ```ts
+ * import { App } from '@tempoxyz/id/worker'
+ *
+ * export default App.create({ from: 'Tempo ID <noreply@id.example.com>' })
+ * ```
+ * @module
+ */
+export * as App from './App.js';
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA"}

package/package.json

@@ -0,0 +1,82 @@
+{
+  "name": "@tempoxyz/id",
+  "version": "0.0.0-pr-187.sha-eed04d3",
+  "description": "Tempo ID: sign-in, tokens, and access keys for Tempo, on Better Auth and Void.",
+  "type": "module",
+  "exports": {
+    ".": {
+      "src": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "src": "./src/client.ts",
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    },
+    "./worker": {
+      "src": "./src/worker.ts",
+      "types": "./dist/worker.d.ts",
+      "default": "./dist/worker.js"
+    }
+  },
+  "imports": {
+    "#app": "./dist/app/server/index.js"
+  },
+  "bin": {
+    "tempo-id": "./dist/cli/bin.js",
+    "tempo-id.src": "./src/cli/bin.ts"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!**/*.test.ts",
+    "!src/app/.env*",
+    "!src/app/.void",
+    "!src/app/.void-wrangler.jsonc",
+    "!src/app/dist"
+  ],
+  "dependencies": {
+    "incur": "0.7.0",
+    "jose": "6.2.12",
+    "ox": "0.14.56",
+    "pg": "8.23.1",
+    "tldts": "7.4.16"
+  },
+  "peerDependencies": {
+    "@better-auth/core": "^1.7.8",
+    "@better-auth/oauth-provider": "^1.7.8",
+    "better-auth": "^1.7.8",
+    "drizzle-orm": "^0.45.4",
+    "viem": "^2.57.5",
+    "zod": "^4.6.7"
+  },
+  "peerDependenciesMeta": {
+    "@better-auth/core": {
+      "optional": true
+    },
+    "@better-auth/oauth-provider": {
+      "optional": true
+    },
+    "better-auth": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "viem": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tempoxyz/id.git"
+  },
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts"
+}

package/src/Api.ts

@@ -0,0 +1,151 @@
+/**
+ * Tempo ID's server: every Hono app in `api/`, mounted at the root so each app declares its full
+ * paths, under the middleware that every request passes, pages included. A path that no route
+ * serves renders a TanStack Start page. JSON routes start with `/v1`.
+ * @module
+ */
+import { Hono } from 'hono'
+import { except } from 'hono/combine'
+import { csrf } from 'hono/csrf'
+import { secureHeaders } from 'hono/secure-headers'
+import { trimTrailingSlash } from 'hono/trailing-slash'
+import { account } from './api/account.js'
+import { authenticate } from './api/authenticate.js'
+import { authorize } from './api/authorize.js'
+import { device } from './api/device.js'
+import { health } from './api/health.js'
+import * as Auth from './api/lib/Auth.js'
+import * as Cors from './api/lib/Cors.js'
+import { oauth } from './api/oauth.js'
+import { provider } from './api/provider.js'
+import * as BodyLimit from './internal/BodyLimit.js'
+import type { Env } from './internal/Env.js'
+import * as ErrorResponse from './internal/ErrorResponse.js'
+import * as OpenApi from './internal/OpenApi.js'
+import * as RequestId from './internal/RequestId.js'
+import * as Timing from './internal/Timing.js'
+
+/** Every route, with its RPC types, which `type App` carries for clients. */
+const routes = new Hono<Env>()
+  .route('/', health)
+  .route('/', account)
+  .route('/', authenticate)
+  .route('/', authorize)
+  .route('/', device)
+  .route('/', oauth)
+  .route('/', provider)
+
+/** The API's routes, whose RPC types a typed client reads. */
+export type App = typeof routes
+
+/**
+ * The root app, which serves every request. It is annotated, since its document route reads the app
+ * it belongs to, and `type App` carries the RPC types.
+ */
+export const api: Hono<Env> = new Hono<Env>()
+  // Middleware runs before the routes registered after it, so timing covers the rest. The request ID
+  // comes next, so every response and log entry carries it.
+  .use(Timing.middleware)
+  .use(RequestId.middleware())
+  // A form post carries `Origin: null` under `no-referrer`, so Void refuses an early sign-in submit.
+  // `same-origin` keeps the origin on same-origin posts, and sends no referrer to other sites.
+  .use(secureHeaders({ referrerPolicy: 'same-origin' }))
+  // A `GET` of a known path with a trailing slash, such as `/health/`, redirects to the path without it.
+  .use(trimTrailingSlash())
+  // CORS runs before the CSRF check and the body limit, so a browser reads their refusals. The OAuth
+  // discovery documents and the endpoints that read no cookie serve any page.
+  .use('/.well-known/oauth-authorization-server', Cors.oauth)
+  .use('/.well-known/openid-configuration', Cors.oauth)
+  .use('/device/code', Cors.oauth)
+  .use('/oauth2/introspect', Cors.oauth)
+  .use('/oauth2/introspection', Cors.oauth)
+  .use('/oauth2/jwks', Cors.oauth)
+  .use('/oauth2/revoke', Cors.oauth)
+  .use('/oauth2/token', Cors.oauth)
+  .use('/oauth2/userinfo', Cors.oauth)
+  .use('/v1/*', Cors.firstParty)
+  // Token endpoints authenticate each client, and server-to-server form posts carry no `Origin`.
+  // A device posts its device authorization request as a form, without `Origin`, too.
+  .use(except(['/device/code', '/oauth2/*'], csrf()))
+  // Before every route, so no validator reads an uncapped body.
+  .use('/device/code', BodyLimit.middleware)
+  .use('/oauth2/*', BodyLimit.middleware)
+  .use('/v1/*', BodyLimit.middleware)
+  .use(Auth.middleware)
+  .route('/', routes)
+  .get(
+    '/openapi.json',
+    OpenApi.describeRoute({
+      description: 'Returns this OpenAPI document.',
+      responses: {
+        200: {
+          content: { 'application/json': { schema: { type: 'object' } } },
+          description: 'The OpenAPI 3.1 document.',
+        },
+        ...OpenApi.errors([]),
+      },
+      tags: ['Reference'],
+    }),
+    async (c) =>
+      c.json(
+        await Timing.measure(c, OpenApi.document(api), 'OpenApi.document'),
+        200,
+      ),
+  )
+  // The reference runs only its pinned script, under the policy it sends.
+  .get(
+    '/docs',
+    OpenApi.describeRoute({
+      description: 'Renders this OpenAPI document as an API reference.',
+      responses: {
+        200: {
+          content: { 'text/html': { schema: { type: 'string' } } },
+          description: 'The API reference page.',
+        },
+        ...OpenApi.errors([]),
+      },
+      tags: ['Reference'],
+    }),
+    (c) => {
+      c.header('content-security-policy', OpenApi.referencePolicy)
+      return c.html(OpenApi.reference)
+    },
+  )
+  // A JSON API path of any version that matches no route, or a method that no route serves.
+  .all('/:version{v\\d+}/*', (c) =>
+    ErrorResponse.json(c, new ErrorResponse.UnknownEndpointError()),
+  )
+  // A path that no route serves is a page, unless its first segment is the API's.
+  .notFound(async (c) => {
+    if (serves(c.req.path))
+      return ErrorResponse.json(c, new ErrorResponse.UnknownEndpointError())
+    return Timing.measure(c, c.env.pages(c), 'page.render')
+  })
+  .onError(ErrorResponse.handle)
+
+/**
+ * Returns whether `path` is an API path: its first segment is one that a route of {@link api} starts
+ * with, such as `oauth2`, or a version, such as `v2`. Every other path is a page, and so is each of
+ * {@link pages}.
+ */
+function serves(path: string) {
+  if (pages.has(path)) return false
+  const segment = path.split('/')[1] ?? ''
+  return segments.has(segment) || /^v\d+$/.test(segment)
+}
+
+/**
+ * The pages whose first segment a route also starts with. The device page shares `device` with
+ * `POST /device/code`, the device authorization endpoint that discovery advertises.
+ */
+const pages = new Set(['/device'])
+
+/** The first segment of each route path, such as `v1`, `oauth2`, or `.well-known`. */
+const segments = new Set(
+  api.routes.flatMap((route) => {
+    const segment = route.path.split('/')[1] ?? ''
+    return segment && segment !== '*' && !segment.startsWith(':')
+      ? [segment]
+      : []
+  }),
+)

package/src/App.ts

@@ -0,0 +1,56 @@
+/**
+ * Tempo ID as a Cloudflare Worker. `App.create` returns the Worker's handlers, which serve the pages,
+ * the API, and the scheduled jobs of the built app. The Worker declares the bindings that the app
+ * reads, as `tempo-id init` writes them.
+ * @module
+ */
+import handlers from '#app'
+
+/** Creates Tempo ID's Worker handlers, with each deployment's own settings. */
+export function create(options: create.Options = {}): create.ReturnType {
+  const { from, url } = options
+
+  // The built app reads its settings from the bindings. The options join each request's bindings,
+  // so one Worker needs no settings in its Wrangler config.
+  const bindings = (env: Record<string, unknown>) => {
+    const sender = from ?? env.EMAIL_FROM
+    return {
+      ...env,
+      ...(sender ? { __VOID_EMAIL_FROM: sender } : {}),
+      ...(url ? { URL: url } : {}),
+    }
+  }
+
+  return {
+    fetch: (request, env, ctx) => handlers.fetch(request, bindings(env), ctx),
+    scheduled: (controller, env, ctx) =>
+      handlers.scheduled(controller, bindings(env), ctx),
+  }
+}
+
+export declare namespace create {
+  type Options = {
+    /**
+     * The sender of every email, such as `Tempo ID <noreply@id.example.com>`. Defaults to the
+     * `EMAIL_FROM` variable.
+     */
+    from?: string | undefined
+    /** Tempo ID's origin, such as `https://id.example.com`, and every token's `iss`. Defaults to the `URL` variable. */
+    url?: string | undefined
+  }
+
+  type ReturnType = {
+    /** Serves a request to the Worker. */
+    fetch: (
+      request: Request,
+      env: Record<string, unknown>,
+      ctx: unknown,
+    ) => Promise<Response>
+    /** Runs the cron triggers that the Worker's Wrangler config names. */
+    scheduled: (
+      controller: unknown,
+      env: Record<string, unknown>,
+      ctx: unknown,
+    ) => Promise<void>
+  }
+}