@tempoxyz/id 0.0.0-pr-670.sha-4e09ba6 → 0.0.0-pr-686.sha-fb0fe40

package/dist/{Connections-7J5I4L3Q.js → Connections-JINMLNXP.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-JJT3ITRO.js";
-import "./chunk-YDYAVOWG.js";
+} from "./chunk-A3TKBAOI.js";
+import "./chunk-JACZGAYL.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-PTAFRAX2.js → Sheet-5EGGSH3T.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-JACZGAYL.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-JJT3ITRO.js → chunk-A3TKBAOI.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-JACZGAYL.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/{chunk-YDYAVOWG.js → chunk-JACZGAYL.js}

@@ -102,7 +102,6 @@ async function proof(dpop2, options) {
 var AccessKey_exports = {};
 __export(AccessKey_exports, {
   AccessKeyRequiredError: () => AccessKeyRequiredError,
-  KeyTypeError: () => KeyTypeError,
   expired: () => expired,
   from: () => from,
   own: () => own,
@@ -121,14 +120,6 @@ var AccessKeyRequiredError = class extends Error {
     );
   }
 };
-var KeyTypeError = class extends Error {
-  name = "AccessKey.KeyTypeError";
-  constructor() {
-    super(
-      "The authorization is for a configurable account, not an access key. Sign in again for an access key."
-    );
-  }
-};
 function expired(key) {
   const { expiry } = KeyAuthorization.fromRpc(key.keyAuthorization);
   return Boolean(expiry) && expiry * 1e3 <= Date.now();
@@ -186,11 +177,9 @@ function toAccount(key, options = {}) {
   if (key.keyPair) return Account.fromWebCryptoP256(key.keyPair, access);
   if (key.privateKey) return Account.fromSecp256k1(key.privateKey, access);
   if (!accessKey2) throw new AccessKeyRequiredError();
-  const { type } = access.keyAuthorization;
-  if (type === "configurable") throw new KeyTypeError();
   return Account.from({
     ...access,
-    keyType: type,
+    keyType: accessKey2.keyType,
     publicKey: PublicKey.fromHex(accessKey2.publicKey),
     sign: (parameters) => accessKey2.sign({ ...parameters, raw: true })
   });
@@ -370,25 +359,6 @@ async function token(auth, body) {
     })
   );
 }
-async function refresh(auth, options) {
-  const config = {
-    ...auth,
-    fetch: ((input, init) => (auth.fetch ?? globalThis.fetch)(input, init).catch((error3) => {
-      throw new RequestError({
-        cause: error3,
-        code: "server_error",
-        message: "The refresh received no response. Check the connection, and refresh again.",
-        status: 0
-      });
-    }))
-  };
-  return tokens(
-    await token(config, {
-      grant_type: "refresh_token",
-      refresh_token: options.refreshToken
-    })
-  );
-}
 function tempoAccount(account2, options = {}) {
   const owner = account2.config.owners.find((entry) => entry.type !== "webAuthn") ?? account2.config.owners[0];
   const keys = account2.config.owners.map((entry) => ({
@@ -769,7 +739,7 @@ __export(Actions_exports, {
   passkey: () => passkey_exports,
   realm: () => realm_exports,
   redirect: () => redirect_exports,
-  refresh: () => refresh2,
+  refresh: () => refresh,
   signOut: () => signOut
 });
 
@@ -1482,38 +1452,14 @@ import {
 
 // ../../accounts/src/internal/IndexedDb.ts
 function create() {
-  let database;
-  function open2() {
-    if (database) return database;
-    const opened = new Promise((resolve3, reject) => {
-      const request4 = indexedDB.open("tempo-id");
-      request4.onupgradeneeded = () => request4.result.createObjectStore(store);
-      request4.onsuccess = () => {
-        request4.result.onclose = () => {
-          if (database === opened) database = void 0;
-        };
-        resolve3(request4.result);
-      };
-      request4.onerror = () => reject(request4.error);
-    });
-    database = opened;
-    opened.catch(() => {
-      if (database === opened) database = void 0;
-    });
-    return opened;
-  }
+  const database = new Promise((resolve3, reject) => {
+    const request4 = indexedDB.open("tempo-id");
+    request4.onupgradeneeded = () => request4.result.createObjectStore(store);
+    request4.onsuccess = () => resolve3(request4.result);
+    request4.onerror = () => reject(request4.error);
+  });
   async function run2(mode, fn) {
-    const transaction = await (async () => {
-      const opened = open2();
-      try {
-        return (await opened).transaction(store, mode);
-      } catch (error3) {
-        if (!(error3 instanceof DOMException) || error3.name !== "InvalidStateError")
-          throw error3;
-        if (database === opened) database = void 0;
-        return (await open2()).transaction(store, mode);
-      }
-    })();
+    const transaction = (await database).transaction(store, mode);
     return new Promise((resolve3, reject) => {
       const request4 = fn(transaction.objectStore(store));
       transaction.oncomplete = () => resolve3(request4.result);
@@ -1712,7 +1658,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-PTAFRAX2.js");
+    const Sheet = await import("./Sheet-5EGGSH3T.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1763,7 +1709,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-PTAFRAX2.js").then(
+        void import("./Sheet-5EGGSH3T.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1828,7 +1774,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-PTAFRAX2.js");
+  const Sheet = await import("./Sheet-5EGGSH3T.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -1944,22 +1890,12 @@ function complete3(auth, options = {}) {
     const ticket2 = take(auth);
     const early = ticket2 && url.searchParams.has("code") && url.searchParams.get("state") === ticket2.state ? redeem(auth, { pending: ticket2, url }) : void 0;
     early?.catch(() => void 0);
-    const state = url.searchParams.getAll("state").at(-1);
-    const entry = await (async () => {
-      if (state === void 0) return void 0;
-      const key = storeKey(state);
-      const value = await store2.getItem(key);
-      if (value != null) return { key, value };
-      const legacy = await store2.getItem(legacyStoreKey);
-      if (legacy?.state === state) return { key: legacyStoreKey, value: legacy };
-      return void 0;
-    })();
-    const stored = entry?.value;
+    const stored = await store2.getItem(storeKey);
     const redirectUri = stored?.redirectUri ?? url.origin;
     const registered = new URL(redirectUri).searchParams;
     if (stored != null && !owns(auth, stored)) return void 0;
-    const ours = stored != null && state === stored.state;
-    if (ours && entry) await store2.removeItem(entry.key);
+    const ours = stored != null && url.searchParams.get("state") === stored.state;
+    if (ours) await store2.removeItem(storeKey);
     const callback2 = [
       "code",
       "error",
@@ -2136,29 +2072,12 @@ async function prefetch(auth) {
 }
 async function start(auth, options = {}) {
   const { pending, url } = await createUrl(auth, options);
-  const store2 = get2(auth.store);
-  const now = Date.now();
-  const expiresAt = now + pendingLifetime;
-  const index = await store2.getItem(indexKey) ?? [];
-  const expired3 = index.filter((entry) => entry.expiresAt <= now);
-  const kept = index.filter((entry) => entry.expiresAt > now);
-  await Promise.all([
-    ...expired3.map((entry) => store2.removeItem(storeKey(entry.state))),
-    store2.setItem(indexKey, [...kept, { expiresAt, state: pending.state }], {
-      expiresAt
-    }),
-    store2.setItem(storeKey(pending.state), pending, { expiresAt })
-  ]);
+  await get2(auth.store).setItem(storeKey, pending);
   save(auth, pending);
   window.location.assign(url);
 }
 var completed = /* @__PURE__ */ new WeakMap();
-var indexKey = "tempo-id:redirects";
-var pendingLifetime = 60 * 60 * 1e3;
-var legacyStoreKey = "tempo-id:redirect";
-function storeKey(state) {
-  return `tempo-id:redirect:${state}`;
-}
+var storeKey = "tempo-id:redirect";
 
 // ../../accounts/src/actions/dialog.ts
 var BlockedError2 = class extends Error {
@@ -3172,8 +3091,13 @@ async function fetch2(auth, options) {
   return (auth.fetch ?? globalThis.fetch)(url, { ...init, headers, method });
 }
 var refreshRetryDelay = 1e3;
-async function refresh2(auth, options) {
-  const send2 = () => refresh(auth, options);
+async function refresh(auth, options) {
+  const send2 = async () => tokens(
+    await token(auth, {
+      grant_type: "refresh_token",
+      refresh_token: options.refreshToken
+    })
+  );
   try {
     return await send2();
   } catch (error3) {
@@ -3247,7 +3171,7 @@ async function run(context, parameters) {
   await change.commit(session2);
   return { ...session2, upgradeAvailable: result.upgradeAvailable };
 }
-function refresh3(context, options = {}) {
+function refresh2(context, options = {}) {
   const { margin } = options;
   return context.session.exclusive(async () => {
     await context.session.load({ locked: true });
@@ -3294,7 +3218,7 @@ function refresh3(context, options = {}) {
     const latest = await context.session.reload();
     const session2 = { ...current, ...tokens3 };
     if (held && !latest) {
-      const spansContexts = typeof indexedDB !== "undefined" && !!globalThis.navigator?.locks;
+      const spansContexts = typeof indexedDB !== "undefined" && globalThis.navigator?.locks;
       if (!spansContexts) return void 0;
       await context.session.change({ update: true }).commit(session2);
       return session2;
@@ -3411,7 +3335,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-7DSDKEHU.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-G77XBXD2.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -3609,45 +3533,44 @@ function create3(options) {
     }
   };
   const revoked = {
-    /** Returns whether `digests` hold the refresh token of `session`. */
-    has(digests, session2) {
-      if (!session2?.refreshToken) return false;
-      return digests.includes(digest(session2.refreshToken));
-    },
-    /** Reads the digests, or none when the read fails. */
-    async read() {
-      const value = await (async () => store2?.getItem(`${name}:revoked`))().catch(() => void 0);
-      return Array.isArray(value) ? value : [];
+    async has(session2) {
+      if (!store2 || !session2?.refreshToken) return false;
+      return (await readRevoked()).includes(digest(session2.refreshToken));
     },
     // ponytail: the 32 latest digests, enough for a sign-out's own token, the 16 pending tokens of
     // the unanswered entry, and the sessions that one store's contexts hold. A digest that the list
     // holds moves to its end.
-    /** Writes `digests` with the digest of each token of `tokens` at the end, in order. */
-    async write(digests, tokens3) {
-      if (!store2 || tokens3.length === 0) return;
-      const added = tokens3.map((token2) => digest(token2));
-      const next = [
-        ...digests.filter((entry) => !added.includes(entry)),
-        ...added.filter((entry, index) => added.lastIndexOf(entry) === index)
+    async add(session2) {
+      if (!store2 || !session2.refreshToken) return;
+      const added = digest(session2.refreshToken);
+      const digests = [
+        ...(await readRevoked()).filter((entry) => entry !== added),
+        added
       ].slice(-32);
-      await (async () => store2.setItem(`${name}:revoked`, next))().catch(
+      await (async () => store2.setItem(`${name}:revoked`, digests))().catch(
         () => void 0
       );
     }
   };
   async function revokeExpired(session2) {
-    const { refreshToken } = session2;
-    if (!refreshToken) return;
+    if (!session2.refreshToken) return;
     await exclusive(async () => {
-      const [stored, digests] = await Promise.all([read2(), revoked.read()]);
-      if (stored?.refreshToken && stored.refreshToken !== refreshToken) return;
-      if (revoked.has(digests, session2)) return;
+      const stored = await read2();
+      if (stored?.refreshToken && stored.refreshToken !== session2.refreshToken)
+        return;
+      if (await revoked.has(session2)) return;
       await signOut2(session2, {
         logout: false,
-        onRevoked: () => revoked.write(digests, [refreshToken])
+        onRevoked: () => revoked.add(session2)
       });
     }).catch(() => void 0);
   }
+  async function readRevoked() {
+    const value = await (async () => store2?.getItem(`${name}:revoked`))().catch(
+      () => void 0
+    );
+    return Array.isArray(value) ? value : [];
+  }
   function digest(token2) {
     return Hash3.sha256(Bytes3.fromString(token2), { as: "Hex" });
   }
@@ -3760,9 +3683,11 @@ function create3(options) {
           set(session2, {
             signIn: !!session2 && !options2.update && !options2.restore
           });
-          const clears = !!session2 && !options2.update && machines2.clears({ current: context(), started });
-          if (clears) actor.send({ type: "change.commit" });
-          await Promise.all([writes?.flush(), clears ? mark(false) : void 0]);
+          await writes?.flush();
+          if (session2 && !options2.update) {
+            actor.send({ type: "change.commit" });
+            await mark(false);
+          }
           if (session2) await onSignIn?.(session2);
         },
         fail: async (error3, failure = {}) => {
@@ -3861,11 +3786,8 @@ function create3(options) {
     rotated.clear();
     const emptied = settle(writes?.flush());
     return exclusive(async () => {
-      const [{ failed, stored }, earlier, digests] = await Promise.all([
-        emptied.then(async (failed2) => ({ failed: failed2, stored: await read2() })),
-        unanswered2.read(),
-        revoked.read()
-      ]);
+      const failed = await emptied;
+      const stored = await read2();
       const current = actor ? context().session : void 0;
       const ending = machines2.ending({ before, current, local, stored });
       if (ending.empty)
@@ -3876,9 +3798,12 @@ function create3(options) {
       const skipped = ended?.refreshToken ? rotated.get(ended.refreshToken) : void 0;
       const signIns = actor ? context().signIns : 0;
       const known = !!ended?.refreshToken && ended.refreshToken === options2.revoked;
-      const revoking = known || ended?.refreshToken && rotated.has(ended.refreshToken) || revoked.has(digests, ended) ? void 0 : ended;
+      if (known && ended) await revoked.add(ended);
+      const revoking = known || ended?.refreshToken && rotated.has(ended.refreshToken) || await revoked.has(ended) ? void 0 : ended;
+      const earlier = await unanswered2.read();
+      const marked = store2 ? await readRevoked() : [];
       const pending = (earlier ?? []).filter(
-        (token2) => token2 !== revoking?.refreshToken && !revoked.has(digests, { refreshToken: token2 })
+        (token2) => token2 !== revoking?.refreshToken && !marked.includes(digest(token2))
       );
       const answered = /* @__PURE__ */ new Set();
       const signedOut = await settle(
@@ -3891,9 +3816,9 @@ function create3(options) {
           }),
           // Only an answered revocation marks its token, also when the logout after it fails. One
           // without an answer leaves the next sign-out to send it again.
-          onRevoked: revoking ? () => {
+          onRevoked: revoking ? async () => {
             answered.add(revoking.refreshToken);
-            return Promise.resolve();
+            await revoked.add(revoking);
           } : void 0,
           pending: pending.map((refreshToken) => ({
             onRevoked: () => {
@@ -3908,25 +3833,19 @@ function create3(options) {
       const live = pending.filter((token2) => !answered.has(token2));
       if (signedOut && revoking?.refreshToken && !answered.has(revoking.refreshToken))
         live.push(revoking.refreshToken);
-      const marks = [
-        ...known && ended?.refreshToken ? [ended.refreshToken] : [],
-        ...pending.filter((token2) => answered.has(token2)),
-        ...revoking?.refreshToken && answered.has(revoking.refreshToken) ? [revoking.refreshToken] : []
-      ];
-      await Promise.all([
-        revoked.write(digests, marks),
-        (async () => {
-          if (earlier === void 0) {
-            const again = live.length > 0 ? await unanswered2.read() : void 0;
-            if (again)
-              await unanswered2.write([
-                ...again.filter((token2) => !live.includes(token2)),
-                ...live
-              ]);
-          } else if (earlier.length > 0 || live.length > 0)
-            await unanswered2.write(live);
-        })()
-      ]);
+      for (const token2 of pending)
+        if (answered.has(token2)) await revoked.add({ refreshToken: token2 });
+      if (revoking?.refreshToken && answered.has(revoking.refreshToken))
+        await revoked.add(revoking);
+      if (earlier === void 0) {
+        const again = live.length > 0 ? await unanswered2.read() : void 0;
+        if (again)
+          await unanswered2.write([
+            ...again.filter((token2) => !live.includes(token2)),
+            ...live
+          ]);
+      } else if (earlier.length > 0 || live.length > 0)
+        await unanswered2.write(live);
       if (erased) throw erased.error;
       if (signedOut) throw signedOut.error;
     });
@@ -4234,13 +4153,6 @@ var machines2;
     return current.signOuts !== started.signOuts;
   }
   machines4.overtaken = overtaken;
-  function clears(options) {
-    const { current, started } = options;
-    if (!current.signingOut) return true;
-    if (!started.signingOut) return false;
-    return current.signingOut.runs <= started.signingOut.runs;
-  }
-  machines4.clears = clears;
   function replaces(options) {
     const { current, failed, stored } = options;
     if (!failed) return machines4.newer(stored, current);
@@ -4352,7 +4264,7 @@ async function accessToken(context, options) {
     if (session2.expiresAt > Date.now()) return session2.accessToken;
     throw new SignedOutError();
   }
-  const refreshed = await refresh3(context, { margin: refreshMargin });
+  const refreshed = await refresh2(context, { margin: refreshMargin });
   if (refreshed?.user.id !== session2.user.id) throw new SignedOutError();
   return refreshed.accessToken;
 }
@@ -4612,7 +4524,7 @@ function create4(options = {}) {
     if (!current) throw new SignedOutError2();
     const token2 = await (async () => {
       if (current.expiresAt - 3e4 > Date.now()) return current.accessToken;
-      refreshing ??= refresh3(context, { margin: 3e4 }).finally(() => {
+      refreshing ??= refresh2(context, { margin: 3e4 }).finally(() => {
         refreshing = void 0;
       });
       if (current.expiresAt - 5e3 > Date.now()) {
@@ -4631,7 +4543,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-7J5I4L3Q.js").then(
+    attached ??= import("./Connections-JINMLNXP.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;
@@ -4704,7 +4616,7 @@ function create4(options = {}) {
         renew: accessKey_option === void 0,
         signedOut: session2.signedOut
       }),
-      refresh: () => refresh3(context),
+      refresh: () => refresh2(context),
       status: session2.status,
       subscribe: session2.subscribe
     },

package/dist/{chunk-FDHRRJQI.js → chunk-XNYCQ3QU.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-JACZGAYL.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-FDHRRJQI.js";
-import "../chunk-JJT3ITRO.js";
-import "../chunk-YDYAVOWG.js";
+} from "../chunk-XNYCQ3QU.js";
+import "../chunk-A3TKBAOI.js";
+import "../chunk-JACZGAYL.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-FDHRRJQI.js";
-import "../chunk-JJT3ITRO.js";
-import "../chunk-YDYAVOWG.js";
+} from "../chunk-XNYCQ3QU.js";
+import "../chunk-A3TKBAOI.js";
+import "../chunk-JACZGAYL.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-FDHRRJQI.js";
-import "../chunk-JJT3ITRO.js";
-import "../chunk-YDYAVOWG.js";
+} from "../chunk-XNYCQ3QU.js";
+import "../chunk-A3TKBAOI.js";
+import "../chunk-JACZGAYL.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-7DSDKEHU.js → dialog-G77XBXD2.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-JACZGAYL.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-670.sha-4e09ba6",
+  "version": "0.0.0-pr-686.sha-fb0fe40",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {
@@ -22,8 +22,8 @@
   "dependencies": {
     "incur": "0.7.0",
     "jose": "6.2.12",
-    "ox": "0.14.63",
-    "viem": "0.0.0-2b9026da097323e7e9be8914c53f58edcdd0249a",
+    "ox": "0.14.59",
+    "viem": "0.0.0-bf3ffc52b5633afebacf3d728d846080f1668f30",
     "xstate": "5.33.3",
     "zod": "4.6.7"
   },