@tempoxyz/id 0.0.0-pr-723.sha-e2f626f → 0.0.0-pr-670.sha-e3c7fc8

package/dist/{Connections-GTESLWTN.js → Connections-DLVOXLEL.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-K4WPSEXZ.js";
-import "./chunk-AOIGHDXR.js";
+} from "./chunk-7JMEEUUA.js";
+import "./chunk-MTJSZT4S.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-GQPH2MUR.js → Sheet-II5IGP5J.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-AOIGHDXR.js";
+} from "./chunk-MTJSZT4S.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-K4WPSEXZ.js → chunk-7JMEEUUA.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-AOIGHDXR.js";
+} from "./chunk-MTJSZT4S.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/{chunk-AOIGHDXR.js → chunk-MTJSZT4S.js}

@@ -308,7 +308,6 @@ async function clientAuthentication(auth) {
   if (auth.clientSecret) return { client_secret: auth.clientSecret };
   return {};
 }
-var revokeTimeout = 1e4;
 async function revoke(auth, options) {
   const body = new URLSearchParams({
     client_id: auth.clientId,
@@ -316,38 +315,29 @@ async function revoke(auth, options) {
     token_type_hint: "refresh_token",
     ...await clientAuthentication(auth)
   });
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), revokeTimeout);
-  try {
-    const response = await (auth.fetch ?? fetch)(
-      new URL("/oauth2/revoke", auth.url),
-      {
-        body,
-        // A session cookie fails the issuer's origin check, and the revocation needs none.
-        credentials: "omit",
-        method: "POST",
-        // A redirect would send the refresh token and the client authentication to another origin.
-        redirect: "manual",
-        signal: controller.signal
-      }
-    ).catch((error3) => {
-      if (controller.signal.aborted) return void 0;
-      throw new RequestError({
-        cause: error3,
-        code: "server_error",
-        message: "The revocation received no response. Check the connection, and sign out again.",
-        status: 0
-      });
-    });
-    if (!response) return;
-    if (response.ok) {
-      await response.body?.cancel();
-      return;
+  const response = await (auth.fetch ?? fetch)(
+    new URL("/oauth2/revoke", auth.url),
+    {
+      body,
+      // A session cookie fails the issuer's origin check, and the revocation needs none.
+      credentials: "omit",
+      method: "POST",
+      // A redirect would send the refresh token and the client authentication to another origin.
+      redirect: "manual"
     }
-    await json(response);
-  } finally {
-    clearTimeout(timer);
+  ).catch((error3) => {
+    throw new RequestError({
+      cause: error3,
+      code: "server_error",
+      message: "The revocation received no response. Check the connection, and sign out again.",
+      status: 0
+    });
+  });
+  if (response.ok) {
+    await response.body?.cancel();
+    return;
   }
+  await json(response);
 }
 var clientAssertionType = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
 async function tokenHeaders(auth, options) {
@@ -369,16 +359,6 @@ function requestHeaders(init, options) {
 function bound(token2) {
   return jkt(token2) !== void 0;
 }
-function lifetime(token2) {
-  try {
-    const claims = JSON.parse(Base642.toString(token2.split(".")[1] ?? ""));
-    if (typeof claims.exp !== "number" || typeof claims.iat !== "number")
-      return void 0;
-    return (claims.exp - claims.iat) * 1e3;
-  } catch {
-    return void 0;
-  }
-}
 function jkt(token2) {
   try {
     const claims = JSON.parse(Base642.toString(token2.split(".")[1] ?? ""));
@@ -1025,9 +1005,9 @@ async function authorizeUrl(auth, options) {
   if (!accessKey2 && options.challenge !== void 0)
     throw new ChallengeWithoutKeyError();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
-  const key = accessKey2 && !("address" in accessKey2) ? await resolve(accessKey2) : void 0;
+  const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const pending = from2({
-    ...key ? key.material : accessKey2 ? {} : { key: false },
+    ...key ? key.material : { key: false },
     chainId: auth.chainId,
     clientId: auth.clientId,
     redirectUri,
@@ -1035,13 +1015,9 @@ async function authorizeUrl(auth, options) {
     state: Base644.fromBytes(Bytes2.random(16), base64url),
     verifier: Base644.fromBytes(Bytes2.random(32), base64url)
   });
-  const authorization2 = (() => {
-    if (!accessKey2) return void 0;
-    if ("address" in accessKey2) return keyAuthorization(auth, { accessKey: accessKey2 });
-    return keyAuthorization(auth, {
-      accessKey: { ...accessKey2, account: key.accessKey }
-    });
-  })();
+  const authorization2 = key && accessKey2 ? keyAuthorization(auth, {
+    accessKey: { ...accessKey2, account: key.accessKey }
+  }) : void 0;
   const url = new URL("/oauth2/authorize", auth.url);
   const parameters = new URLSearchParams({
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
@@ -1098,39 +1074,23 @@ function request(auth, options) {
   };
 }
 function keyAuthorization(auth, options) {
-  const { accessKey: accessKey2 } = options;
-  const permissions2 = resolve2(accessKey2, {
+  const { account: signer } = options.accessKey;
+  const permissions2 = resolve2(options.accessKey, {
     chainId: auth.chainId
   });
-  const named = (() => {
-    if ("address" in accessKey2)
-      return {
-        account: options.account ?? accessKey2.access,
-        address: accessKey2.address,
-        keyType: accessKey2.type ?? "secp256k1",
-        witness: accessKey2.witness
-      };
-    const { account: signer } = accessKey2;
-    return {
-      account: options.account ?? (signer.accessKeyAddress ? signer.address : void 0),
-      address: signer.accessKeyAddress ?? signer.address,
-      keyType: signer.keyType,
-      witness: void 0
-    };
-  })();
+  const account2 = options.account ?? (signer.accessKeyAddress ? signer.address : void 0);
   return {
-    ...named.account ? { account: named.account } : {},
-    address: named.address,
+    ...account2 ? { account: account2 } : {},
+    address: signer.accessKeyAddress ?? signer.address,
     chainId: Hex2.fromNumber(permissions2.chainId),
     expiry: permissions2.expiry,
-    keyType: named.keyType,
+    keyType: signer.keyType,
     limits: permissions2.limits?.map(({ limit, period, token: token2 }) => ({
       limit: Hex2.fromNumber(limit),
       ...period ? { period } : {},
       token: token2
     })),
-    scopes: permissions2.scopes,
-    ...named.witness ? { witness: named.witness } : {}
+    scopes: permissions2.scopes
   };
 }
 function funding(options) {
@@ -1712,7 +1672,6 @@ var funding_exports = {};
 __export(funding_exports, {
   BlockedError: () => BlockedError,
   OriginError: () => OriginError,
-  PageRequiredError: () => PageRequiredError,
   complete: () => complete2,
   open: () => open
 });
@@ -1732,14 +1691,6 @@ var OriginError = class extends Error {
     );
   }
 };
-var PageRequiredError = class extends Error {
-  name = "Actions.funding.PageRequiredError";
-  constructor() {
-    super(
-      "No browser window: the deposit page opens only from a page. On a server, pass `funding` to `accounts.backend.start`. In a CLI, pass it to `accounts.device.signIn`."
-    );
-  }
-};
 function complete2(auth, options = {}) {
   const own2 = options.url === void 0;
   const url = new URL(options.url ?? window.location.href);
@@ -1765,10 +1716,6 @@ function complete2(auth, options = {}) {
 }
 async function open(auth, options) {
   const { amount, currency, signal, token: token2 } = options;
-  if (typeof options.address === "object")
-    Promise.resolve(options.address).catch(() => void 0);
-  signal?.throwIfAborted();
-  if (typeof document === "undefined") throw new PageRequiredError();
   const mode = (() => {
     const value = options.mode ?? "frame";
     if (value !== "frame") return value;
@@ -1780,6 +1727,8 @@ async function open(auth, options) {
       return "popup";
     return value;
   })();
+  if (options.address instanceof Promise) options.address.catch(() => void 0);
+  signal?.throwIfAborted();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
   const toUrl = (address2, entry = { mode }) => {
     const url = new URL(
@@ -1819,7 +1768,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-GQPH2MUR.js");
+    const Sheet = await import("./Sheet-II5IGP5J.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1870,7 +1819,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-GQPH2MUR.js").then(
+        void import("./Sheet-II5IGP5J.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1935,7 +1884,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-GQPH2MUR.js");
+  const Sheet = await import("./Sheet-II5IGP5J.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -2103,7 +2052,7 @@ function complete3(auth, options = {}) {
       removed
     ]);
     return finish({
-      accessKey: options.accessKey,
+      accessKey: own(options.accessKey),
       body,
       pending: stored
     });
@@ -2116,7 +2065,7 @@ async function createUrl(auth, options = {}) {
 }
 async function handleCallback(auth, options) {
   return finish({
-    accessKey: options.accessKey,
+    accessKey: own(options.accessKey),
     body: await redeem(auth, {
       pending: options.pending,
       url: new URL(options.url)
@@ -2145,7 +2094,7 @@ function handleResult(options) {
       status: 400
     });
   return finish({
-    accessKey: options.accessKey,
+    accessKey: own(options.accessKey),
     body: authorization2,
     pending: options.pending
   });
@@ -2223,24 +2172,13 @@ function finish(options) {
       signedIn: true,
       status: 400
     });
-  if (options.accessKey && "address" in options.accessKey) {
-    const tokens3 = tokens(body);
-    return {
-      ...tokens3,
-      key: from({
-        account: body.account,
-        keyAuthorization: body.key_authorization
-      }),
-      user: user(tokens3)
-    };
-  }
   return authorization(
     {
       account: body.account,
       key_authorization: body.key_authorization,
       tokens: body
     },
-    { accessKey: own(options.accessKey), material }
+    { accessKey: options.accessKey, material }
   );
 }
 async function prefetch(auth) {
@@ -2266,28 +2204,16 @@ async function prefetch(auth) {
   return urls;
 }
 async function start(auth, options = {}) {
+  const { pending, url } = await createUrl(auth, options);
   const store2 = get2(auth.store);
-  const [{ pending, url }, stored] = await Promise.all([
-    createUrl(auth, options),
-    (async () => store2.getItem(indexKey))()
-  ]);
-  const index = stored ?? [];
   const now = Date.now();
   const expiresAt = now + pendingLifetime;
-  const page = [
-    ...(written.get(store2) ?? []).filter((entry) => entry.expiresAt > now),
-    { expiresAt, state: pending.state }
-  ];
-  written.set(store2, page);
-  const rows = [
-    ...index,
-    ...page.filter((entry) => !index.some((row) => row.state === entry.state))
-  ];
-  const expired3 = rows.filter((entry) => entry.expiresAt <= now);
-  const kept = rows.filter((entry) => entry.expiresAt > now);
+  const index = await store2.getItem(indexKey) ?? [];
+  const expired3 = index.filter((entry) => entry.expiresAt <= now);
+  const kept = index.filter((entry) => entry.expiresAt > now);
   await Promise.all([
     ...expired3.map((entry) => store2.removeItem(storeKey(entry.state))),
-    store2.setItem(indexKey, kept, {
+    store2.setItem(indexKey, [...kept, { expiresAt, state: pending.state }], {
       expiresAt
     }),
     store2.setItem(storeKey(pending.state), pending, { expiresAt })
@@ -2296,7 +2222,6 @@ async function start(auth, options = {}) {
   window.location.assign(url);
 }
 var completed = /* @__PURE__ */ new WeakMap();
-var written = /* @__PURE__ */ new WeakMap();
 var indexKey = "tempo-id:redirects";
 var pendingLifetime = 60 * 60 * 1e3;
 var legacyStoreKey = "tempo-id:redirect";
@@ -2488,7 +2413,7 @@ async function authorize3(auth, options) {
   let broadcast;
   let name;
   let unwatch;
-  let written2;
+  let written;
   let sheet = reused;
   try {
     const { pending, url: popupUrl } = await Promise.race([
@@ -2510,8 +2435,8 @@ async function authorize3(auth, options) {
     if (mode === "iframe")
       sheet ??= create2({ url: frameUrl(auth, { redirectUri }) });
     name = channel({ state: pending.state });
-    written2 = Promise.resolve(store2.setItem(name, true));
-    await Promise.race([written2, aborted, closed, replaced]);
+    written = Promise.resolve(store2.setItem(name, true));
+    await Promise.race([written, aborted, closed, replaced]);
     if (popup?.closed)
       throw new DOMException("The user closed the sign-in.", "AbortError");
     const listener = new BroadcastChannel(name);
@@ -2594,7 +2519,7 @@ async function authorize3(auth, options) {
     popup?.close();
     if (name) {
       const item = name;
-      void (written2 ?? Promise.resolve()).then(() => store2.removeItem(item)).catch(() => {
+      void (written ?? Promise.resolve()).then(() => store2.removeItem(item)).catch(() => {
       });
     }
   }
@@ -2741,10 +2666,10 @@ __export(email_exports2, {
 import { Authentication as Authentication3 } from "ox/webauthn";
 
 // ../../accounts/src/internal/Registration.ts
-var lifetime2 = 4 * 60 * 1e3;
+var lifetime = 4 * 60 * 1e3;
 function from3(value, options) {
   return {
-    expiresAt: options.requestedAt + lifetime2,
+    expiresAt: options.requestedAt + lifetime,
     options: value.options,
     ...value.proof ? { proof: value.proof } : {}
   };
@@ -3390,10 +3315,9 @@ function create3(options) {
         // The message names a sign-out, which other tabs count as one. Another empty write,
         // such as a renewal of an expired session, empties their session as `set` does.
         save: (args) => {
-          const signOut3 = args.event.type.startsWith("signOut");
           const message = {
-            everywhere: signOut3 && args.context.signingOut?.everywhere,
-            signOut: signOut3
+            everywhere: args.context.signingOut?.everywhere,
+            signOut: args.event.type.startsWith("signOut")
           };
           writes?.save(name, args.context.session).then(() => channel2?.postMessage(message)).catch(() => void 0);
         }
@@ -3401,13 +3325,11 @@ function create3(options) {
     })
   ).start() : void 0;
   let obtained = 0;
-  let obtainedLogouts = 0;
   let held = actor?.getSnapshot().context.session;
   actor?.subscribe((snapshot) => {
     if (snapshot.context.session === held) return;
     held = snapshot.context.session;
     obtained = Date.now();
-    obtainedLogouts = snapshot.context.logouts.remote;
   });
   const context = () => actor.getSnapshot().context;
   function set(session2, options2 = {}) {
@@ -3538,17 +3460,9 @@ function create3(options) {
         (entry) => typeof entry === "string"
       ) : [];
     },
-    /**
-     * Returns the tokens that the entry holds once the store took the write, at most the latest 16,
-     * or `undefined` when the store refused it.
-     */
     async write(tokens3) {
       const key = `${name}:unanswered`;
-      const held2 = tokens3.slice(-16);
-      return (async () => {
-        await (held2.length === 0 ? store2?.removeItem(key) : store2?.setItem(key, held2));
-        return held2;
-      })().catch(() => void 0);
+      await (async () => tokens3.length === 0 ? store2?.removeItem(key) : store2?.setItem(key, tokens3.slice(-16)))().catch(() => void 0);
     }
   };
   const revoked = {
@@ -3759,7 +3673,6 @@ function create3(options) {
     return () => subscription.unsubscribe();
   }
   const rotated = /* @__PURE__ */ new Map();
-  const retained = /* @__PURE__ */ new Map();
   const authorizations = /* @__PURE__ */ new Set();
   return {
     actor,
@@ -4025,41 +3938,19 @@ function create3(options) {
     await hydrate();
     await writes?.flush().catch(() => void 0);
     const local = actor ? context().session : void 0;
-    const unsaved = !!local && writes?.unsaved() === local;
-    const logouts = obtainedLogouts;
-    const since = obtained;
     const before = await read2();
     actor?.send({ type: "signOut" });
     const ownSignIns = actor ? context().signIns : 0;
     rotated.clear();
     const emptied = settle(writes?.flush());
     return exclusive(async () => {
-      const [{ failed, stored }, earlier, digests, entries] = await Promise.all(
-        [
-          emptied.then(async (failed2) => ({ failed: failed2, stored: await read2() })),
-          unanswered2.read(),
-          revoked.read(),
-          unsaved ? rotations.read() : void 0
-        ]
-      );
-      const held2 = !before || !local || before.user.id !== local.user.id;
-      const revocable = (token2) => machines2.revocable({
-        entries,
-        held: held2,
-        live: token2 && entries ? rotations.successor(entries, token2) : void 0,
-        remote: !!actor && context().logouts.remote !== logouts,
-        revoked: options2.revoked,
-        since,
-        token: token2
-      });
+      const [{ failed, stored }, earlier, digests] = await Promise.all([
+        emptied.then(async (failed2) => ({ failed: failed2, stored: await read2() })),
+        unanswered2.read(),
+        revoked.read()
+      ]);
       const current = actor ? context().session : void 0;
-      const ending = machines2.ending({
-        before,
-        current,
-        failed: unsaved,
-        local,
-        stored
-      });
+      const ending = machines2.ending({ before, current, local, stored });
       if (ending.empty)
         actor?.send({ type: current ? "save" : "signOut.empty" });
       const saved = ending.empty ? await settle(writes?.flush()) : void 0;
@@ -4068,24 +3959,11 @@ function create3(options) {
       const skipped = ended?.refreshToken ? rotated.get(ended.refreshToken) : void 0;
       const signIns = actor ? context().signIns : 0;
       const known = !!ended?.refreshToken && ended.refreshToken === options2.revoked;
-      const stale = unsaved && ended === local && !revocable(ended?.refreshToken);
-      const revoking = known || stale || ended?.refreshToken && rotated.has(ended.refreshToken) || revoked.has(digests, ended) ? void 0 : ended;
-      const unsavedToken = revocable(ending.unsaved?.refreshToken) ? ending.unsaved?.refreshToken : void 0;
-      const resent = machines2.resent({
-        remote: actor ? context().logouts.remote : void 0,
-        retained
-      });
-      const pending = [
-        .../* @__PURE__ */ new Set([
-          ...earlier ?? [],
-          ...resent,
-          ...unsavedToken ? [unsavedToken] : []
-        ])
-      ].filter(
+      const revoking = known || ended?.refreshToken && rotated.has(ended.refreshToken) || revoked.has(digests, ended) ? void 0 : ended;
+      const pending = (earlier ?? []).filter(
         (token2) => token2 !== revoking?.refreshToken && !revoked.has(digests, { refreshToken: token2 })
       );
       const answered2 = /* @__PURE__ */ new Set();
-      const errors = /* @__PURE__ */ new Map();
       const signedOut = await settle(
         signOut2(revoking, {
           logout: machines2.logout({
@@ -4105,9 +3983,6 @@ function create3(options) {
               answered2.add(refreshToken);
               return Promise.resolve();
             },
-            onUnanswered: (error3) => {
-              errors.set(refreshToken, error3);
-            },
             refreshToken
           })),
           unrevoked: skipped
@@ -4121,47 +3996,22 @@ function create3(options) {
         ...pending.filter((token2) => answered2.has(token2)),
         ...revoking?.refreshToken && answered2.has(revoking.refreshToken) ? [revoking.refreshToken] : []
       ];
-      const [, persisted] = await Promise.all([
+      await Promise.all([
         revoked.write(digests, marks),
         (async () => {
           if (earlier === void 0) {
             const again = live.length > 0 ? await unanswered2.read() : void 0;
-            if (!again) return live.length === 0 ? [] : void 0;
-            return unanswered2.write([
-              ...again.filter((token2) => !live.includes(token2)),
-              ...live
-            ]);
-          }
-          if (earlier.length > 0 || live.length > 0)
-            return unanswered2.write(live);
-          return [];
+            if (again)
+              await unanswered2.write([
+                ...again.filter((token2) => !live.includes(token2)),
+                ...live
+              ]);
+          } else if (earlier.length > 0 || live.length > 0)
+            await unanswered2.write(live);
         })()
       ]);
-      const kept = machines2.retains({
-        live,
-        logouts,
-        persisted,
-        retained,
-        unsaved: [
-          ...unsavedToken ? [unsavedToken] : [],
-          ...unsaved && local?.refreshToken ? [local.refreshToken] : []
-        ]
-      });
-      retained.clear();
-      for (const [token2, remote] of kept) retained.set(token2, remote);
       if (erased) throw erased.error;
       if (signedOut) throw signedOut.error;
-      const unsent = [...unsavedToken ? [unsavedToken] : [], ...resent];
-      const failing = unsent.find(
-        (token2) => pending.includes(token2) && !answered2.has(token2)
-      );
-      if (failing && errors.has(failing)) throw errors.get(failing);
-      if (failing)
-        throw new RequestError({
-          code: "server_error",
-          message: "Revocation failed: no response for the refresh token of the unsaved session. Sign out again once online.",
-          status: 0
-        });
     });
   }
 }
@@ -4192,16 +4042,13 @@ function settle(promise) {
 function queue(store2, options = {}) {
   let pending = Promise.resolve();
   let failed = false;
-  let unsaved;
-  const enqueue = (write, session2) => {
+  const enqueue = (write) => {
     const next = pending.catch(() => void 0).then(write).then(
       () => {
         failed = false;
-        unsaved = void 0;
       },
       (error3) => {
         failed = true;
-        unsaved = session2;
         throw error3;
       }
     );
@@ -4218,8 +4065,6 @@ function queue(store2, options = {}) {
   };
   return {
     failed: () => failed,
-    /** Returns the session that the last write failed to save, or `undefined` after a saved write. */
-    unsaved: () => unsaved,
     /**
      * Resolves when every earlier write completed. It reads the queue after a microtask, since a
      * change that a subscriber sends during another change is processed only once that change's
@@ -4234,8 +4079,7 @@ function queue(store2, options = {}) {
       () => store2.setItem(name, {
         state: { session: toSaved(session2) },
         version: 0
-      }),
-      session2
+      })
     ),
     storage
   };
@@ -4319,7 +4163,6 @@ var machines2;
       logout: assign2((args) => ({
         logouts: {
           ...args.context.logouts,
-          remote: args.context.logouts.remote + 1,
           started: args.context.logouts.started + 1
         }
       })),
@@ -4356,11 +4199,7 @@ var machines2;
         const { logouts, signingOut } = args.context;
         const { everywhere } = args.event;
         return {
-          logouts: everywhere ? {
-            ...logouts,
-            running: logouts.running + 1,
-            started: logouts.started + 1
-          } : logouts,
+          logouts: everywhere ? { running: logouts.running + 1, started: logouts.started + 1 } : logouts,
           marked: !everywhere,
           signingOut: { everywhere, runs: (signingOut?.runs ?? 0) + 1 }
         };
@@ -4401,7 +4240,7 @@ var machines2;
       authorizations: 0,
       delegations: 0,
       loaded: false,
-      logouts: { remote: 0, running: 0, started: 0 },
+      logouts: { running: 0, started: 0 },
       marked: false,
       refusals: 0,
       renewing: void 0,
@@ -4459,24 +4298,17 @@ var machines2;
   }
   machines4.adoptable = adoptable;
   function ending(options) {
-    const { before, current, failed, local, stored } = options;
-    const ended2 = (() => {
-      if (failed && !before) return local;
-      return machines4.newer(before, local) ? before : local;
-    })();
-    const unsaved = failed && before && local && before.user.id !== local.user.id ? local : void 0;
-    if (!stored || !ended2)
-      return { empty: false, kept: false, session: ended2, unsaved };
-    const held = !(failed && !before);
+    const { before, current, local, stored } = options;
+    const ended2 = machines4.newer(before, local) ? before : local;
+    if (!stored || !ended2) return { empty: false, kept: false, session: ended2 };
     const own2 = stored.refreshToken === current?.refreshToken;
-    const later = held && !own2 && stored.user.id === ended2.user.id && stored.key?.keyAuthorization.keyId === ended2.key?.keyAuthorization.keyId && stored.refreshToken !== ended2.refreshToken && stored.expiresAt >= ended2.expiresAt;
-    const stale = held && !own2 && stored.refreshToken === ended2.refreshToken;
+    const later = !own2 && stored.user.id === ended2.user.id && stored.key?.keyAuthorization.keyId === ended2.key?.keyAuthorization.keyId && stored.refreshToken !== ended2.refreshToken && stored.expiresAt >= ended2.expiresAt;
+    const stale = !own2 && stored.refreshToken === ended2.refreshToken;
     const kept = !own2 && !later && !stale && stored.user.id !== ended2.user.id;
     return {
       empty: later || stale,
       kept,
-      session: later ? stored : ended2,
-      unsaved
+      session: later ? stored : ended2
     };
   }
   machines4.ending = ending;
@@ -4495,32 +4327,6 @@ var machines2;
     return first.at > since - 1e3;
   }
   machines4.lacks = lacks;
-  function resent(options) {
-    const { remote, retained } = options;
-    return [...retained].filter(([, entered]) => remote === void 0 || remote === entered).map(([token2]) => token2);
-  }
-  machines4.resent = resent;
-  function retains(options) {
-    const { live, logouts, persisted, retained, unsaved } = options;
-    const result = /* @__PURE__ */ new Map();
-    for (const token2 of live) {
-      if (persisted?.includes(token2)) continue;
-      const entered = retained.get(token2);
-      if (entered !== void 0) result.set(token2, entered);
-      else if (unsaved.includes(token2)) result.set(token2, logouts);
-    }
-    return result;
-  }
-  machines4.retains = retains;
-  function revocable(options) {
-    const { entries, held, live, remote, revoked, since, token: token2 } = options;
-    if (!token2 || token2 === revoked) return false;
-    if (remote) return false;
-    if (!held) return true;
-    if (!entries || machines4.lacks({ entries, since })) return false;
-    return live === token2;
-  }
-  machines4.revocable = revocable;
   function loggedOut(options) {
     const { current, started } = options;
     if (current.logouts.started !== started.logouts.started) return true;
@@ -4612,13 +4418,11 @@ var machines2;
   }
   machines4.declined = declined;
   function rotated(options) {
-    const { current, lifetime: lifetime3, now, started, startedAt } = options;
-    if (started && !started.refreshToken) return false;
-    if (started && current.user.id !== started.user.id) return false;
+    const { current, now, started } = options;
+    if (!started?.refreshToken) return false;
+    if (current.user.id !== started.user.id) return false;
     if (current.expiresAt <= now) return false;
-    if (lifetime3 === void 0) return false;
-    if (current.expiresAt - lifetime3 <= startedAt) return false;
-    return current.refreshToken !== started?.refreshToken;
+    return current.refreshToken !== started.refreshToken;
   }
   machines4.rotated = rotated;
   function switches(options) {
@@ -4702,11 +4506,13 @@ async function run(context, parameters) {
 }
 function refresh3(context, options = {}) {
   const { margin } = options;
-  const started = context.session.get();
-  const startedAt = Date.now();
+  const started = margin === void 0 ? context.session.reload().catch(() => void 0) : void 0;
   return context.session.exclusive(async () => {
     await context.session.load({ locked: true });
-    const current = await context.session.reload();
+    const [current, before] = await Promise.all([
+      context.session.reload(),
+      started
+    ]);
     const refreshToken = current?.refreshToken;
     if (!current || !refreshToken) return void 0;
     checkBound(context.config, { accessToken: current.accessToken });
@@ -4714,12 +4520,10 @@ function refresh3(context, options = {}) {
       await context.session.change({ update: true }).commit(current);
       return context.session.get();
     }
-    if (margin === void 0 && machines2.rotated({
+    if (machines2.rotated({
       current,
-      lifetime: lifetime(current.accessToken),
       now: Date.now(),
-      started,
-      startedAt
+      started: before
     })) {
       await context.session.change({ update: true }).commit(current);
       return context.session.get();
@@ -4908,7 +4712,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-TGNSW7U4.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-FFLTODHO.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -5222,15 +5026,7 @@ function create4(options = {}) {
             return void 0;
           return revoke2(ended.refreshToken, onRevoked);
         })(),
-        ...pending.map(async (entry) => {
-          const result = await revoke2(entry.refreshToken, entry.onRevoked);
-          if (result) {
-            if (typeof result.error === "object" && result.error)
-              unanswered2.add(result.error);
-            entry.onUnanswered?.(result.error);
-          }
-          return void 0;
-        })
+        ...pending.map((entry) => revoke2(entry.refreshToken, entry.onRevoked))
       ]);
       const loggedOut = logout && !thirdParty(config.clientId);
       if (loggedOut) {
@@ -5283,7 +5079,6 @@ function create4(options = {}) {
     plugin2.setup?.(context);
   }
   let refreshing;
-  let rotating;
   async function ownAccessToken() {
     if (typeof document !== "undefined" || "WorkerGlobalScope" in globalThis)
       return void 0;
@@ -5321,7 +5116,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-GTESLWTN.js").then(
+    attached ??= import("./Connections-DLVOXLEL.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;
@@ -5407,9 +5202,7 @@ function create4(options = {}) {
         },
         signedOut: session2.signedOut
       }),
-      refresh: () => rotating ??= refresh3(context).finally(() => {
-        rotating = void 0;
-      }),
+      refresh: () => refresh3(context),
       status: session2.status,
       subscribe: session2.subscribe
     },

package/dist/{chunk-DN57D5UC.js → chunk-O3UAZSAM.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-AOIGHDXR.js";
+} from "./chunk-MTJSZT4S.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-DN57D5UC.js";
-import "../chunk-K4WPSEXZ.js";
-import "../chunk-AOIGHDXR.js";
+} from "../chunk-O3UAZSAM.js";
+import "../chunk-7JMEEUUA.js";
+import "../chunk-MTJSZT4S.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-DN57D5UC.js";
-import "../chunk-K4WPSEXZ.js";
-import "../chunk-AOIGHDXR.js";
+} from "../chunk-O3UAZSAM.js";
+import "../chunk-7JMEEUUA.js";
+import "../chunk-MTJSZT4S.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-DN57D5UC.js";
-import "../chunk-K4WPSEXZ.js";
-import "../chunk-AOIGHDXR.js";
+} from "../chunk-O3UAZSAM.js";
+import "../chunk-7JMEEUUA.js";
+import "../chunk-MTJSZT4S.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-TGNSW7U4.js → dialog-FFLTODHO.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-AOIGHDXR.js";
+} from "./chunk-MTJSZT4S.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-723.sha-e2f626f",
+  "version": "0.0.0-pr-670.sha-e3c7fc8",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {