@tempoxyz/id 0.0.0-pr-718.sha-8b3b450 → 0.0.0-pr-723.sha-e2f626f

package/dist/{Connections-DLVOXLEL.js → Connections-GTESLWTN.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-7JMEEUUA.js";
-import "./chunk-MTJSZT4S.js";
+} from "./chunk-K4WPSEXZ.js";
+import "./chunk-AOIGHDXR.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-II5IGP5J.js → Sheet-GQPH2MUR.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-MTJSZT4S.js";
+} from "./chunk-AOIGHDXR.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-MTJSZT4S.js → chunk-AOIGHDXR.js}

@@ -308,6 +308,7 @@ async function clientAuthentication(auth) {
   if (auth.clientSecret) return { client_secret: auth.clientSecret };
   return {};
 }
+var revokeTimeout = 1e4;
 async function revoke(auth, options) {
   const body = new URLSearchParams({
     client_id: auth.clientId,
@@ -315,29 +316,38 @@ async function revoke(auth, options) {
     token_type_hint: "refresh_token",
     ...await clientAuthentication(auth)
   });
-  const response = await (auth.fetch ?? fetch)(
-    new URL("/oauth2/revoke", auth.url),
-    {
-      body,
-      // A session cookie fails the issuer's origin check, and the revocation needs none.
-      credentials: "omit",
-      method: "POST",
-      // A redirect would send the refresh token and the client authentication to another origin.
-      redirect: "manual"
-    }
-  ).catch((error3) => {
-    throw new RequestError({
-      cause: error3,
-      code: "server_error",
-      message: "The revocation received no response. Check the connection, and sign out again.",
-      status: 0
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), revokeTimeout);
+  try {
+    const response = await (auth.fetch ?? fetch)(
+      new URL("/oauth2/revoke", auth.url),
+      {
+        body,
+        // A session cookie fails the issuer's origin check, and the revocation needs none.
+        credentials: "omit",
+        method: "POST",
+        // A redirect would send the refresh token and the client authentication to another origin.
+        redirect: "manual",
+        signal: controller.signal
+      }
+    ).catch((error3) => {
+      if (controller.signal.aborted) return void 0;
+      throw new RequestError({
+        cause: error3,
+        code: "server_error",
+        message: "The revocation received no response. Check the connection, and sign out again.",
+        status: 0
+      });
     });
-  });
-  if (response.ok) {
-    await response.body?.cancel();
-    return;
+    if (!response) return;
+    if (response.ok) {
+      await response.body?.cancel();
+      return;
+    }
+    await json(response);
+  } finally {
+    clearTimeout(timer);
   }
-  await json(response);
 }
 var clientAssertionType = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 async function tokenHeaders(auth, options) {
@@ -359,6 +369,16 @@ function requestHeaders(init, options) {
 function bound(token2) {
   return jkt(token2) !== void 0;
 }
+function lifetime(token2) {
+  try {
+    const claims = JSON.parse(Base642.toString(token2.split(".")[1] ?? ""));
+    if (typeof claims.exp !== "number" || typeof claims.iat !== "number")
+      return void 0;
+    return (claims.exp - claims.iat) * 1e3;
+  } catch {
+    return void 0;
+  }
+}
 function jkt(token2) {
   try {
     const claims = JSON.parse(Base642.toString(token2.split(".")[1] ?? ""));
@@ -1005,9 +1025,9 @@ async function authorizeUrl(auth, options) {
   if (!accessKey2 && options.challenge !== void 0)
     throw new ChallengeWithoutKeyError();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
-  const key = accessKey2 ? await resolve(accessKey2) : void 0;
+  const key = accessKey2 && !("address" in accessKey2) ? await resolve(accessKey2) : void 0;
   const pending = from2({
-    ...key ? key.material : { key: false },
+    ...key ? key.material : accessKey2 ? {} : { key: false },
     chainId: auth.chainId,
     clientId: auth.clientId,
     redirectUri,
@@ -1015,9 +1035,13 @@ async function authorizeUrl(auth, options) {
     state: Base644.fromBytes(Bytes2.random(16), base64url),
     verifier: Base644.fromBytes(Bytes2.random(32), base64url)
   });
-  const authorization2 = key && accessKey2 ? keyAuthorization(auth, {
-    accessKey: { ...accessKey2, account: key.accessKey }
-  }) : void 0;
+  const authorization2 = (() => {
+    if (!accessKey2) return void 0;
+    if ("address" in accessKey2) return keyAuthorization(auth, { accessKey: accessKey2 });
+    return keyAuthorization(auth, {
+      accessKey: { ...accessKey2, account: key.accessKey }
+    });
+  })();
   const url = new URL("/oauth2/authorize", auth.url);
   const parameters = new URLSearchParams({
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
@@ -1074,23 +1098,39 @@ function request(auth, options) {
   };
 }
 function keyAuthorization(auth, options) {
-  const { account: signer } = options.accessKey;
-  const permissions2 = resolve2(options.accessKey, {
+  const { accessKey: accessKey2 } = options;
+  const permissions2 = resolve2(accessKey2, {
     chainId: auth.chainId
   });
-  const account2 = options.account ?? (signer.accessKeyAddress ? signer.address : void 0);
+  const named = (() => {
+    if ("address" in accessKey2)
+      return {
+        account: options.account ?? accessKey2.access,
+        address: accessKey2.address,
+        keyType: accessKey2.type ?? "secp256k1",
+        witness: accessKey2.witness
+      };
+    const { account: signer } = accessKey2;
+    return {
+      account: options.account ?? (signer.accessKeyAddress ? signer.address : void 0),
+      address: signer.accessKeyAddress ?? signer.address,
+      keyType: signer.keyType,
+      witness: void 0
+    };
+  })();
   return {
-    ...account2 ? { account: account2 } : {},
-    address: signer.accessKeyAddress ?? signer.address,
+    ...named.account ? { account: named.account } : {},
+    address: named.address,
     chainId: Hex2.fromNumber(permissions2.chainId),
     expiry: permissions2.expiry,
-    keyType: signer.keyType,
+    keyType: named.keyType,
     limits: permissions2.limits?.map(({ limit, period, token: token2 }) => ({
       limit: Hex2.fromNumber(limit),
       ...period ? { period } : {},
       token: token2
     })),
-    scopes: permissions2.scopes
+    scopes: permissions2.scopes,
+    ...named.witness ? { witness: named.witness } : {}
   };
 }
 function funding(options) {
@@ -1672,6 +1712,7 @@ var funding_exports = {};
 __export(funding_exports, {
   BlockedError: () => BlockedError,
   OriginError: () => OriginError,
+  PageRequiredError: () => PageRequiredError,
   complete: () => complete2,
   open: () => open
 });
@@ -1691,6 +1732,14 @@ var OriginError = class extends Error {
     );
   }
 };
+var PageRequiredError = class extends Error {
+  name = "Actions.funding.PageRequiredError";
+  constructor() {
+    super(
+      "No browser window: the deposit page opens only from a page. On a server, pass `funding` to `accounts.backend.start`. In a CLI, pass it to `accounts.device.signIn`."
+    );
+  }
+};
 function complete2(auth, options = {}) {
   const own2 = options.url === void 0;
   const url = new URL(options.url ?? window.location.href);
@@ -1716,6 +1765,10 @@ function complete2(auth, options = {}) {
 }
 async function open(auth, options) {
   const { amount, currency, signal, token: token2 } = options;
+  if (typeof options.address === "object")
+    Promise.resolve(options.address).catch(() => void 0);
+  signal?.throwIfAborted();
+  if (typeof document === "undefined") throw new PageRequiredError();
   const mode = (() => {
     const value = options.mode ?? "frame";
     if (value !== "frame") return value;
@@ -1727,8 +1780,6 @@ async function open(auth, options) {
       return "popup";
     return value;
   })();
-  if (options.address instanceof Promise) options.address.catch(() => void 0);
-  signal?.throwIfAborted();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
   const toUrl = (address2, entry = { mode }) => {
     const url = new URL(
@@ -1768,7 +1819,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-II5IGP5J.js");
+    const Sheet = await import("./Sheet-GQPH2MUR.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1819,7 +1870,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-II5IGP5J.js").then(
+        void import("./Sheet-GQPH2MUR.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1884,7 +1935,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-II5IGP5J.js");
+  const Sheet = await import("./Sheet-GQPH2MUR.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -2052,7 +2103,7 @@ function complete3(auth, options = {}) {
       removed
     ]);
     return finish({
-      accessKey: own(options.accessKey),
+      accessKey: options.accessKey,
       body,
       pending: stored
     });
@@ -2065,7 +2116,7 @@ async function createUrl(auth, options = {}) {
 }
 async function handleCallback(auth, options) {
   return finish({
-    accessKey: own(options.accessKey),
+    accessKey: options.accessKey,
     body: await redeem(auth, {
       pending: options.pending,
       url: new URL(options.url)
@@ -2094,7 +2145,7 @@ function handleResult(options) {
       status: 400
     });
   return finish({
-    accessKey: own(options.accessKey),
+    accessKey: options.accessKey,
     body: authorization2,
     pending: options.pending
   });
@@ -2172,13 +2223,24 @@ function finish(options) {
       signedIn: true,
       status: 400
     });
+  if (options.accessKey && "address" in options.accessKey) {
+    const tokens3 = tokens(body);
+    return {
+      ...tokens3,
+      key: from({
+        account: body.account,
+        keyAuthorization: body.key_authorization
+      }),
+      user: user(tokens3)
+    };
+  }
   return authorization(
     {
       account: body.account,
       key_authorization: body.key_authorization,
       tokens: body
     },
-    { accessKey: options.accessKey, material }
+    { accessKey: own(options.accessKey), material }
   );
 }
 async function prefetch(auth) {
@@ -2204,16 +2266,28 @@ async function prefetch(auth) {
   return urls;
 }
 async function start(auth, options = {}) {
-  const { pending, url } = await createUrl(auth, options);
   const store2 = get2(auth.store);
+  const [{ pending, url }, stored] = await Promise.all([
+    createUrl(auth, options),
+    (async () => store2.getItem(indexKey))()
+  ]);
+  const index = stored ?? [];
   const now = Date.now();
   const expiresAt = now + pendingLifetime;
-  const index = await store2.getItem(indexKey) ?? [];
-  const expired3 = index.filter((entry) => entry.expiresAt <= now);
-  const kept = index.filter((entry) => entry.expiresAt > now);
+  const page = [
+    ...(written.get(store2) ?? []).filter((entry) => entry.expiresAt > now),
+    { expiresAt, state: pending.state }
+  ];
+  written.set(store2, page);
+  const rows = [
+    ...index,
+    ...page.filter((entry) => !index.some((row) => row.state === entry.state))
+  ];
+  const expired3 = rows.filter((entry) => entry.expiresAt <= now);
+  const kept = rows.filter((entry) => entry.expiresAt > now);
   await Promise.all([
     ...expired3.map((entry) => store2.removeItem(storeKey(entry.state))),
-    store2.setItem(indexKey, [...kept, { expiresAt, state: pending.state }], {
+    store2.setItem(indexKey, kept, {
       expiresAt
     }),
     store2.setItem(storeKey(pending.state), pending, { expiresAt })
@@ -2222,6 +2296,7 @@ async function start(auth, options = {}) {
   window.location.assign(url);
 }
 var completed = /* @__PURE__ */ new WeakMap();
+var written = /* @__PURE__ */ new WeakMap();
 var indexKey = "tempo-id:redirects";
 var pendingLifetime = 60 * 60 * 1e3;
 var legacyStoreKey = "tempo-id:redirect";
@@ -2413,7 +2488,7 @@ async function authorize3(auth, options) {
   let broadcast;
   let name;
   let unwatch;
-  let written;
+  let written2;
   let sheet = reused;
   try {
     const { pending, url: popupUrl } = await Promise.race([
@@ -2435,8 +2510,8 @@ async function authorize3(auth, options) {
     if (mode === "iframe")
       sheet ??= create2({ url: frameUrl(auth, { redirectUri }) });
     name = channel({ state: pending.state });
-    written = Promise.resolve(store2.setItem(name, true));
-    await Promise.race([written, aborted, closed, replaced]);
+    written2 = Promise.resolve(store2.setItem(name, true));
+    await Promise.race([written2, aborted, closed, replaced]);
     if (popup?.closed)
       throw new DOMException("The user closed the sign-in.", "AbortError");
     const listener = new BroadcastChannel(name);
@@ -2519,7 +2594,7 @@ async function authorize3(auth, options) {
     popup?.close();
     if (name) {
       const item = name;
-      void (written ?? Promise.resolve()).then(() => store2.removeItem(item)).catch(() => {
+      void (written2 ?? Promise.resolve()).then(() => store2.removeItem(item)).catch(() => {
       });
     }
   }
@@ -2666,10 +2741,10 @@ __export(email_exports2, {
 import { Authentication as Authentication3 } from "ox/webauthn";
 
 // ../../accounts/src/internal/Registration.ts
-var lifetime = 4 * 60 * 1e3;
+var lifetime2 = 4 * 60 * 1e3;
 function from3(value, options) {
   return {
-    expiresAt: options.requestedAt + lifetime,
+    expiresAt: options.requestedAt + lifetime2,
     options: value.options,
     ...value.proof ? { proof: value.proof } : {}
   };
@@ -3315,9 +3390,10 @@ function create3(options) {
         // The message names a sign-out, which other tabs count as one. Another empty write,
         // such as a renewal of an expired session, empties their session as `set` does.
         save: (args) => {
+          const signOut3 = args.event.type.startsWith("signOut");
           const message = {
-            everywhere: args.context.signingOut?.everywhere,
-            signOut: args.event.type.startsWith("signOut")
+            everywhere: signOut3 && args.context.signingOut?.everywhere,
+            signOut: signOut3
           };
           writes?.save(name, args.context.session).then(() => channel2?.postMessage(message)).catch(() => void 0);
         }
@@ -3325,11 +3401,13 @@ function create3(options) {
     })
   ).start() : void 0;
   let obtained = 0;
+  let obtainedLogouts = 0;
   let held = actor?.getSnapshot().context.session;
   actor?.subscribe((snapshot) => {
     if (snapshot.context.session === held) return;
     held = snapshot.context.session;
     obtained = Date.now();
+    obtainedLogouts = snapshot.context.logouts.remote;
   });
   const context = () => actor.getSnapshot().context;
   function set(session2, options2 = {}) {
@@ -3460,9 +3538,17 @@ function create3(options) {
         (entry) => typeof entry === "string"
       ) : [];
     },
+    /**
+     * Returns the tokens that the entry holds once the store took the write, at most the latest 16,
+     * or `undefined` when the store refused it.
+     */
     async write(tokens3) {
       const key = `${name}:unanswered`;
-      await (async () => tokens3.length === 0 ? store2?.removeItem(key) : store2?.setItem(key, tokens3.slice(-16)))().catch(() => void 0);
+      const held2 = tokens3.slice(-16);
+      return (async () => {
+        await (held2.length === 0 ? store2?.removeItem(key) : store2?.setItem(key, held2));
+        return held2;
+      })().catch(() => void 0);
     }
   };
   const revoked = {
@@ -3673,6 +3759,7 @@ function create3(options) {
     return () => subscription.unsubscribe();
   }
   const rotated = /* @__PURE__ */ new Map();
+  const retained = /* @__PURE__ */ new Map();
   const authorizations = /* @__PURE__ */ new Set();
   return {
     actor,
@@ -3938,19 +4025,41 @@ function create3(options) {
     await hydrate();
     await writes?.flush().catch(() => void 0);
     const local = actor ? context().session : void 0;
+    const unsaved = !!local && writes?.unsaved() === local;
+    const logouts = obtainedLogouts;
+    const since = obtained;
     const before = await read2();
     actor?.send({ type: "signOut" });
     const ownSignIns = actor ? context().signIns : 0;
     rotated.clear();
     const emptied = settle(writes?.flush());
     return exclusive(async () => {
-      const [{ failed, stored }, earlier, digests] = await Promise.all([
-        emptied.then(async (failed2) => ({ failed: failed2, stored: await read2() })),
-        unanswered2.read(),
-        revoked.read()
-      ]);
+      const [{ failed, stored }, earlier, digests, entries] = await Promise.all(
+        [
+          emptied.then(async (failed2) => ({ failed: failed2, stored: await read2() })),
+          unanswered2.read(),
+          revoked.read(),
+          unsaved ? rotations.read() : void 0
+        ]
+      );
+      const held2 = !before || !local || before.user.id !== local.user.id;
+      const revocable = (token2) => machines2.revocable({
+        entries,
+        held: held2,
+        live: token2 && entries ? rotations.successor(entries, token2) : void 0,
+        remote: !!actor && context().logouts.remote !== logouts,
+        revoked: options2.revoked,
+        since,
+        token: token2
+      });
       const current = actor ? context().session : void 0;
-      const ending = machines2.ending({ before, current, local, stored });
+      const ending = machines2.ending({
+        before,
+        current,
+        failed: unsaved,
+        local,
+        stored
+      });
       if (ending.empty)
         actor?.send({ type: current ? "save" : "signOut.empty" });
       const saved = ending.empty ? await settle(writes?.flush()) : void 0;
@@ -3959,11 +4068,24 @@ function create3(options) {
       const skipped = ended?.refreshToken ? rotated.get(ended.refreshToken) : void 0;
       const signIns = actor ? context().signIns : 0;
       const known = !!ended?.refreshToken && ended.refreshToken === options2.revoked;
-      const revoking = known || ended?.refreshToken && rotated.has(ended.refreshToken) || revoked.has(digests, ended) ? void 0 : ended;
-      const pending = (earlier ?? []).filter(
+      const stale = unsaved && ended === local && !revocable(ended?.refreshToken);
+      const revoking = known || stale || ended?.refreshToken && rotated.has(ended.refreshToken) || revoked.has(digests, ended) ? void 0 : ended;
+      const unsavedToken = revocable(ending.unsaved?.refreshToken) ? ending.unsaved?.refreshToken : void 0;
+      const resent = machines2.resent({
+        remote: actor ? context().logouts.remote : void 0,
+        retained
+      });
+      const pending = [
+        .../* @__PURE__ */ new Set([
+          ...earlier ?? [],
+          ...resent,
+          ...unsavedToken ? [unsavedToken] : []
+        ])
+      ].filter(
         (token2) => token2 !== revoking?.refreshToken && !revoked.has(digests, { refreshToken: token2 })
       );
       const answered2 = /* @__PURE__ */ new Set();
+      const errors = /* @__PURE__ */ new Map();
       const signedOut = await settle(
         signOut2(revoking, {
           logout: machines2.logout({
@@ -3983,6 +4105,9 @@ function create3(options) {
               answered2.add(refreshToken);
               return Promise.resolve();
             },
+            onUnanswered: (error3) => {
+              errors.set(refreshToken, error3);
+            },
             refreshToken
           })),
           unrevoked: skipped
@@ -3996,22 +4121,47 @@ function create3(options) {
         ...pending.filter((token2) => answered2.has(token2)),
         ...revoking?.refreshToken && answered2.has(revoking.refreshToken) ? [revoking.refreshToken] : []
       ];
-      await Promise.all([
+      const [, persisted] = await Promise.all([
         revoked.write(digests, marks),
         (async () => {
           if (earlier === void 0) {
             const again = live.length > 0 ? await unanswered2.read() : void 0;
-            if (again)
-              await unanswered2.write([
-                ...again.filter((token2) => !live.includes(token2)),
-                ...live
-              ]);
-          } else if (earlier.length > 0 || live.length > 0)
-            await unanswered2.write(live);
+            if (!again) return live.length === 0 ? [] : void 0;
+            return unanswered2.write([
+              ...again.filter((token2) => !live.includes(token2)),
+              ...live
+            ]);
+          }
+          if (earlier.length > 0 || live.length > 0)
+            return unanswered2.write(live);
+          return [];
         })()
       ]);
+      const kept = machines2.retains({
+        live,
+        logouts,
+        persisted,
+        retained,
+        unsaved: [
+          ...unsavedToken ? [unsavedToken] : [],
+          ...unsaved && local?.refreshToken ? [local.refreshToken] : []
+        ]
+      });
+      retained.clear();
+      for (const [token2, remote] of kept) retained.set(token2, remote);
       if (erased) throw erased.error;
       if (signedOut) throw signedOut.error;
+      const unsent = [...unsavedToken ? [unsavedToken] : [], ...resent];
+      const failing = unsent.find(
+        (token2) => pending.includes(token2) && !answered2.has(token2)
+      );
+      if (failing && errors.has(failing)) throw errors.get(failing);
+      if (failing)
+        throw new RequestError({
+          code: "server_error",
+          message: "Revocation failed: no response for the refresh token of the unsaved session. Sign out again once online.",
+          status: 0
+        });
     });
   }
 }
@@ -4042,13 +4192,16 @@ function settle(promise) {
 function queue(store2, options = {}) {
   let pending = Promise.resolve();
   let failed = false;
-  const enqueue = (write) => {
+  let unsaved;
+  const enqueue = (write, session2) => {
     const next = pending.catch(() => void 0).then(write).then(
       () => {
         failed = false;
+        unsaved = void 0;
       },
       (error3) => {
         failed = true;
+        unsaved = session2;
         throw error3;
       }
     );
@@ -4065,6 +4218,8 @@ function queue(store2, options = {}) {
   };
   return {
     failed: () => failed,
+    /** Returns the session that the last write failed to save, or `undefined` after a saved write. */
+    unsaved: () => unsaved,
     /**
      * Resolves when every earlier write completed. It reads the queue after a microtask, since a
      * change that a subscriber sends during another change is processed only once that change's
@@ -4079,7 +4234,8 @@ function queue(store2, options = {}) {
       () => store2.setItem(name, {
         state: { session: toSaved(session2) },
         version: 0
-      })
+      }),
+      session2
     ),
     storage
   };
@@ -4163,6 +4319,7 @@ var machines2;
       logout: assign2((args) => ({
         logouts: {
           ...args.context.logouts,
+          remote: args.context.logouts.remote + 1,
           started: args.context.logouts.started + 1
         }
       })),
@@ -4199,7 +4356,11 @@ var machines2;
         const { logouts, signingOut } = args.context;
         const { everywhere } = args.event;
         return {
-          logouts: everywhere ? { running: logouts.running + 1, started: logouts.started + 1 } : logouts,
+          logouts: everywhere ? {
+            ...logouts,
+            running: logouts.running + 1,
+            started: logouts.started + 1
+          } : logouts,
           marked: !everywhere,
           signingOut: { everywhere, runs: (signingOut?.runs ?? 0) + 1 }
         };
@@ -4240,7 +4401,7 @@ var machines2;
       authorizations: 0,
       delegations: 0,
       loaded: false,
-      logouts: { running: 0, started: 0 },
+      logouts: { remote: 0, running: 0, started: 0 },
       marked: false,
       refusals: 0,
       renewing: void 0,
@@ -4298,17 +4459,24 @@ var machines2;
   }
   machines4.adoptable = adoptable;
   function ending(options) {
-    const { before, current, local, stored } = options;
-    const ended2 = machines4.newer(before, local) ? before : local;
-    if (!stored || !ended2) return { empty: false, kept: false, session: ended2 };
+    const { before, current, failed, local, stored } = options;
+    const ended2 = (() => {
+      if (failed && !before) return local;
+      return machines4.newer(before, local) ? before : local;
+    })();
+    const unsaved = failed && before && local && before.user.id !== local.user.id ? local : void 0;
+    if (!stored || !ended2)
+      return { empty: false, kept: false, session: ended2, unsaved };
+    const held = !(failed && !before);
     const own2 = stored.refreshToken === current?.refreshToken;
-    const later = !own2 && stored.user.id === ended2.user.id && stored.key?.keyAuthorization.keyId === ended2.key?.keyAuthorization.keyId && stored.refreshToken !== ended2.refreshToken && stored.expiresAt >= ended2.expiresAt;
-    const stale = !own2 && stored.refreshToken === ended2.refreshToken;
+    const later = held && !own2 && stored.user.id === ended2.user.id && stored.key?.keyAuthorization.keyId === ended2.key?.keyAuthorization.keyId && stored.refreshToken !== ended2.refreshToken && stored.expiresAt >= ended2.expiresAt;
+    const stale = held && !own2 && stored.refreshToken === ended2.refreshToken;
     const kept = !own2 && !later && !stale && stored.user.id !== ended2.user.id;
     return {
       empty: later || stale,
       kept,
-      session: later ? stored : ended2
+      session: later ? stored : ended2,
+      unsaved
     };
   }
   machines4.ending = ending;
@@ -4327,6 +4495,32 @@ var machines2;
     return first.at > since - 1e3;
   }
   machines4.lacks = lacks;
+  function resent(options) {
+    const { remote, retained } = options;
+    return [...retained].filter(([, entered]) => remote === void 0 || remote === entered).map(([token2]) => token2);
+  }
+  machines4.resent = resent;
+  function retains(options) {
+    const { live, logouts, persisted, retained, unsaved } = options;
+    const result = /* @__PURE__ */ new Map();
+    for (const token2 of live) {
+      if (persisted?.includes(token2)) continue;
+      const entered = retained.get(token2);
+      if (entered !== void 0) result.set(token2, entered);
+      else if (unsaved.includes(token2)) result.set(token2, logouts);
+    }
+    return result;
+  }
+  machines4.retains = retains;
+  function revocable(options) {
+    const { entries, held, live, remote, revoked, since, token: token2 } = options;
+    if (!token2 || token2 === revoked) return false;
+    if (remote) return false;
+    if (!held) return true;
+    if (!entries || machines4.lacks({ entries, since })) return false;
+    return live === token2;
+  }
+  machines4.revocable = revocable;
   function loggedOut(options) {
     const { current, started } = options;
     if (current.logouts.started !== started.logouts.started) return true;
@@ -4418,11 +4612,13 @@ var machines2;
   }
   machines4.declined = declined;
   function rotated(options) {
-    const { current, now, started } = options;
-    if (!started?.refreshToken) return false;
-    if (current.user.id !== started.user.id) return false;
+    const { current, lifetime: lifetime3, now, started, startedAt } = options;
+    if (started && !started.refreshToken) return false;
+    if (started && current.user.id !== started.user.id) return false;
     if (current.expiresAt <= now) return false;
-    return current.refreshToken !== started.refreshToken;
+    if (lifetime3 === void 0) return false;
+    if (current.expiresAt - lifetime3 <= startedAt) return false;
+    return current.refreshToken !== started?.refreshToken;
   }
   machines4.rotated = rotated;
   function switches(options) {
@@ -4506,13 +4702,11 @@ async function run(context, parameters) {
 }
 function refresh3(context, options = {}) {
   const { margin } = options;
-  const started = margin === void 0 ? context.session.reload().catch(() => void 0) : void 0;
+  const started = context.session.get();
+  const startedAt = Date.now();
   return context.session.exclusive(async () => {
     await context.session.load({ locked: true });
-    const [current, before] = await Promise.all([
-      context.session.reload(),
-      started
-    ]);
+    const current = await context.session.reload();
     const refreshToken = current?.refreshToken;
     if (!current || !refreshToken) return void 0;
     checkBound(context.config, { accessToken: current.accessToken });
@@ -4520,10 +4714,12 @@ function refresh3(context, options = {}) {
       await context.session.change({ update: true }).commit(current);
       return context.session.get();
     }
-    if (machines2.rotated({
+    if (margin === void 0 && machines2.rotated({
       current,
+      lifetime: lifetime(current.accessToken),
       now: Date.now(),
-      started: before
+      started,
+      startedAt
     })) {
       await context.session.change({ update: true }).commit(current);
       return context.session.get();
@@ -4712,7 +4908,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-FFLTODHO.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-TGNSW7U4.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -5026,7 +5222,15 @@ function create4(options = {}) {
             return void 0;
           return revoke2(ended.refreshToken, onRevoked);
         })(),
-        ...pending.map((entry) => revoke2(entry.refreshToken, entry.onRevoked))
+        ...pending.map(async (entry) => {
+          const result = await revoke2(entry.refreshToken, entry.onRevoked);
+          if (result) {
+            if (typeof result.error === "object" && result.error)
+              unanswered2.add(result.error);
+            entry.onUnanswered?.(result.error);
+          }
+          return void 0;
+        })
       ]);
       const loggedOut = logout && !thirdParty(config.clientId);
       if (loggedOut) {
@@ -5079,6 +5283,7 @@ function create4(options = {}) {
     plugin2.setup?.(context);
   }
   let refreshing;
+  let rotating;
   async function ownAccessToken() {
     if (typeof document !== "undefined" || "WorkerGlobalScope" in globalThis)
       return void 0;
@@ -5116,7 +5321,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-DLVOXLEL.js").then(
+    attached ??= import("./Connections-GTESLWTN.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;
@@ -5202,7 +5407,9 @@ function create4(options = {}) {
         },
         signedOut: session2.signedOut
       }),
-      refresh: () => refresh3(context),
+      refresh: () => rotating ??= refresh3(context).finally(() => {
+        rotating = void 0;
+      }),
       status: session2.status,
       subscribe: session2.subscribe
     },

package/dist/{chunk-O3UAZSAM.js → chunk-DN57D5UC.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-MTJSZT4S.js";
+} from "./chunk-AOIGHDXR.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/{chunk-7JMEEUUA.js → chunk-K4WPSEXZ.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-MTJSZT4S.js";
+} from "./chunk-AOIGHDXR.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-O3UAZSAM.js";
-import "../chunk-7JMEEUUA.js";
-import "../chunk-MTJSZT4S.js";
+} from "../chunk-DN57D5UC.js";
+import "../chunk-K4WPSEXZ.js";
+import "../chunk-AOIGHDXR.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-O3UAZSAM.js";
-import "../chunk-7JMEEUUA.js";
-import "../chunk-MTJSZT4S.js";
+} from "../chunk-DN57D5UC.js";
+import "../chunk-K4WPSEXZ.js";
+import "../chunk-AOIGHDXR.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-O3UAZSAM.js";
-import "../chunk-7JMEEUUA.js";
-import "../chunk-MTJSZT4S.js";
+} from "../chunk-DN57D5UC.js";
+import "../chunk-K4WPSEXZ.js";
+import "../chunk-AOIGHDXR.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-FFLTODHO.js → dialog-TGNSW7U4.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-MTJSZT4S.js";
+} from "./chunk-AOIGHDXR.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-718.sha-8b3b450",
+  "version": "0.0.0-pr-723.sha-e2f626f",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {