@tempoxyz/id 0.0.0-pr-751.sha-6fdf21b → 0.0.0-pr-749.sha-e9face1

package/dist/{Connections-4J63W3O3.js → Connections-K44EJ6F7.js}

@@ -4,9 +4,9 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-QL7UYVGP.js";
+} from "./chunk-CMIMUIV7.js";
 import "./chunk-HWONYWNC.js";
-import "./chunk-2BJJYAAI.js";
+import "./chunk-UGIWBXMZ.js";
 import "./chunk-MLKGABMK.js";
 export {
   attach,

package/dist/{Server-GHH2TOPL.js → Server-CAPWBFI3.js}

@@ -5,7 +5,7 @@ import {
 import {
   PendingNotFoundError,
   RequestError
-} from "./chunk-2BJJYAAI.js";
+} from "./chunk-UGIWBXMZ.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/internal/BackendCookie.ts

package/dist/{Sheet-D644QHD6.js → Sheet-2VUMVJXV.js}

@@ -4,8 +4,8 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-OR4H7ZKK.js";
-import "./chunk-2BJJYAAI.js";
+} from "./chunk-S3QDABXG.js";
+import "./chunk-UGIWBXMZ.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-RXFSIUSG.js → chunk-6Y4DXPDA.js}

@@ -1,10 +1,10 @@
 import {
   dialog_exports,
   redirect_exports
-} from "./chunk-MLMRZMAK.js";
+} from "./chunk-YXEQ42DK.js";
 import {
   connections_exports
-} from "./chunk-QL7UYVGP.js";
+} from "./chunk-CMIMUIV7.js";
 import {
   AccessKeyRequiredError,
   AccessKey_exports,
@@ -43,7 +43,7 @@ import {
   unlisted,
   user,
   withoutKey
-} from "./chunk-2BJJYAAI.js";
+} from "./chunk-UGIWBXMZ.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";

package/dist/{chunk-QL7UYVGP.js → chunk-CMIMUIV7.js}

@@ -9,7 +9,7 @@ import {
   from,
   json,
   post
-} from "./chunk-2BJJYAAI.js";
+} from "./chunk-UGIWBXMZ.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";

package/dist/{chunk-OR4H7ZKK.js → chunk-S3QDABXG.js}

@@ -2,7 +2,7 @@ import {
   openPopup,
   received,
   watchPopup
-} from "./chunk-2BJJYAAI.js";
+} from "./chunk-UGIWBXMZ.js";
 
 // ../../accounts/src/internal/Sheet.ts
 import {
@@ -461,13 +461,11 @@ function frame(options) {
   adopt();
   const dialog = document.createElement("dialog");
   dialog.setAttribute(attribute, "");
-  dialog.setAttribute("aria-label", "Add funds with Tempo");
+  dialog.setAttribute("aria-label", options.label);
   const element = document.createElement("iframe");
-  element.setAttribute("allow", "payment");
-  element.setAttribute(
-    "sandbox",
-    "allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts"
-  );
+  element.setAttribute("allow", options.allow);
+  element.setAttribute("referrerpolicy", "origin");
+  element.setAttribute("sandbox", options.sandbox);
   element.setAttribute("title", "Tempo ID");
   element.style.height = "420px";
   element.src = options.url;
@@ -489,7 +487,7 @@ function frame(options) {
     panel.setAttribute("data-panel", "");
     const text = document.createElement("p");
     text.setAttribute("aria-live", "polite");
-    text.textContent = "Continue in a Tempo ID window to add funds.";
+    text.textContent = options.text;
     const primary = document.createElement("button");
     primary.setAttribute("data-primary", "");
     primary.type = "button";

package/dist/{chunk-2BJJYAAI.js → chunk-UGIWBXMZ.js}

@@ -39,12 +39,16 @@ __export(Accounts_exports, {
 // ../../accounts/src/actions/account.ts
 var account_exports = {};
 __export(account_exports, {
+  BlockedError: () => BlockedError,
+  OriginError: () => OriginError,
+  PageRequiredError: () => PageRequiredError,
   connection: () => connection,
   connections: () => connections,
   disconnect: () => disconnect,
   disconnectApp: () => disconnectApp,
   get: () => get,
   revokeAccessKey: () => revokeAccessKey,
+  revokeAccessKeys: () => revokeAccessKeys,
   signMessage: () => signMessage,
   signTypedData: () => signTypedData,
   updateAccessKey: () => updateAccessKey,
@@ -493,7 +497,141 @@ function withoutKey(body, options = {}) {
   };
 }
 
+// ../../accounts/src/internal/Callback.ts
+function received(value, options) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const data = value;
+  if (data.type === `${options.prefix}.callback` && typeof data.url === "string")
+    return { url: data.url };
+  if (data.type !== `${options.prefix}.result` || typeof data.authorization !== "object" || data.authorization === null)
+    return void 0;
+  return {
+    authorization: data.authorization,
+    ...typeof data.state === "string" ? { state: data.state } : {}
+  };
+}
+function checkState(url, options) {
+  if (url.searchParams.getAll("state").at(-1) !== options.state)
+    throw new RequestError({
+      code: "invalid_request",
+      field: "state",
+      message: "Invalid `state` in the callback URL. Start sign-in again from this app.",
+      status: 400
+    });
+}
+function error2(url, options) {
+  const code = parameter(url, { ...options, name: "error" });
+  if (!code) return void 0;
+  return new RequestError({
+    code,
+    message: parameter(url, { ...options, name: "error_description" }) ?? code,
+    status: 0,
+    uri: parameter(url, { ...options, name: "error_uri" })
+  });
+}
+function parameter(url, options) {
+  const registered = new URL(options.redirectUri).searchParams.getAll(
+    options.name
+  ).length;
+  return url.searchParams.getAll(options.name)[registered];
+}
+
+// ../../accounts/src/internal/Chains.ts
+var devIds = { devnet: 31318, localnet: 1337 };
+var ids = { mainnet: 4217, testnet: 42431 };
+function parameter2(options) {
+  const name = Object.keys(ids).find(
+    (key) => ids[key] === options.chainId
+  );
+  return name ?? String(options.chainId);
+}
+
+// ../../accounts/src/internal/Popup.ts
+var closeGrace = 1e3;
+var closeInterval = 100;
+function openPopup(url) {
+  const width = 432;
+  const height = 420;
+  const left = window.screenX + (window.outerWidth - width) / 2;
+  const top = window.screenY + (window.outerHeight - height) / 2;
+  return window.open(
+    url,
+    "_blank",
+    `popup,width=${width},height=${height},left=${left},top=${top}`
+  );
+}
+function watchPopup(popup, options) {
+  let open2 = false;
+  let closedAt;
+  const listener = (event) => {
+    if (event.origin !== options.origin || event.source !== popup) return;
+    const data = event.data;
+    if (data?.type === "tempo-id:popup.open") {
+      open2 = true;
+      return;
+    }
+    const callback = received(data, { prefix: "tempo-id:popup" });
+    if (!callback) return;
+    stop();
+    options.onCallback(callback);
+  };
+  const interval = setInterval(() => {
+    if (!open2 || !popup.closed) return;
+    if (closedAt === void 0) {
+      closedAt = Date.now();
+      options.onClosed?.();
+    }
+    if (Date.now() - closedAt < closeGrace) return;
+    stop();
+    options.onClose();
+  }, closeInterval);
+  const stop = () => {
+    clearInterval(interval);
+    window.removeEventListener("message", listener);
+  };
+  window.addEventListener("message", listener);
+  return stop;
+}
+function apple() {
+  const agent = navigator.userAgent;
+  if (/iPad|iPhone|iPod/.test(agent)) return true;
+  return /Macintosh/.test(agent) && navigator.maxTouchPoints > 1;
+}
+function coinflow(options) {
+  const { amount, chainId, token: token2 } = options;
+  if (amount === void 0 || token2 !== "MACH") return false;
+  if (chainId !== ids.mainnet) return false;
+  return apple();
+}
+function activated() {
+  return navigator.userActivation?.isActive ?? true;
+}
+
 // ../../accounts/src/actions/account.ts
+var BlockedError = class extends Error {
+  name = "Actions.account.BlockedError";
+  constructor() {
+    super(
+      "The browser blocked the approval popup. Call the action in a click handler, before any `await`, or open the approval page in a frame or through a redirect."
+    );
+  }
+};
+var OriginError = class extends Error {
+  name = "Actions.account.OriginError";
+  constructor(options) {
+    super(
+      `Invalid redirect URI: ${options.redirectUri} is not on this page's origin, ${options.origin}. Call the action on a page of the redirect URI's origin, or open the approval page through a redirect.`
+    );
+  }
+};
+var PageRequiredError = class extends Error {
+  name = "Actions.account.PageRequiredError";
+  constructor() {
+    super(
+      "No browser window: the approval page opens in a frame or a popup only from a page. Open it through a redirect instead."
+    );
+  }
+};
 async function connection(auth, options) {
   const url = new URL(
     `/v1/connection?${new URLSearchParams({ client_id: auth.clientId })}`,
@@ -592,20 +730,35 @@ async function get(auth, options = {}) {
 }
 async function revokeAccessKey(auth, options) {
   const { accessKey: accessKey2, accessToken: accessToken2, account: account2, chainId } = options;
-  if (options.redirect) {
-    const redirectUri = options.redirectUri ?? auth.redirectUri ?? (globalThis.location ? `${globalThis.location.origin}/` : void 0);
-    if (!redirectUri)
-      throw new Error("The approval page needs `redirectUri` to return to.");
-    const url = new URL("/access-keys/revoke", auth.url);
-    url.search = new URLSearchParams({
+  if (options.redirect || options.dialog) {
+    if (options.dialog && typeof document === "undefined")
+      throw new PageRequiredError();
+    const redirectUri = approvalRedirectUri(auth, options);
+    const query = {
       account: account2,
       address: accessKey2,
       chain_id: String(chainId),
       client_id: auth.clientId,
       redirect_uri: redirectUri,
       ...options.state !== void 0 ? { state: options.state } : {}
-    }).toString();
-    return { url: url.href };
+    };
+    if (!options.dialog) {
+      const url2 = new URL("/access-keys/revoke", auth.url);
+      url2.search = new URLSearchParams(query).toString();
+      return { url: url2.href };
+    }
+    const url = await approve(auth, {
+      label: "Revoke access with Tempo",
+      mode: options.dialog,
+      noun: "revocation",
+      path: "/access-keys/revoke",
+      query,
+      signal: options.signal,
+      text: "Continue in a Tempo ID window to revoke access."
+    });
+    return {
+      transaction: transactionOf(url, { redirectUri }) ?? null
+    };
   }
   const json2 = {
     account: account2,
@@ -632,6 +785,34 @@ async function revokeAccessKey(auth, options) {
   );
   return body.receipt ? formatTransactionReceipt(body.receipt) : null;
 }
+async function revokeAccessKeys(auth, options) {
+  const { account: account2, chainId, getFn, keyIds: keyIds2 } = options;
+  const json2 = {
+    account: account2,
+    chainId,
+    client_id: auth.clientId,
+    ...keyIds2 ? { keyIds: keyIds2 } : {}
+  };
+  const path = "/v1/account/access-keys/revoke";
+  const first = await json(await post(auth, path, { json: json2 }));
+  const body = await (async () => {
+    if (!("step" in first)) return first;
+    const deserialized = Authentication.deserializeOptions(first.step.options);
+    const assertion = Authentication.serializeResponse(
+      await Authentication.sign(
+        // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+        getFn ? { ...deserialized, getFn } : deserialized
+      )
+    );
+    return await json(
+      await post(auth, path, { json: { ...json2, passkey: { assertion } } })
+    );
+  })();
+  return {
+    receipt: body.receipt ? formatTransactionReceipt(body.receipt) : null,
+    revoked: body.revoked
+  };
+}
 async function signMessage(auth, options) {
   const { account: account2, chain, message } = options;
   const body = await json(
@@ -686,12 +867,11 @@ async function updateAccessKey(auth, options) {
     } : {},
     ...options.scopes ? { scopes: options.scopes } : {}
   };
-  if (options.redirect) {
-    const redirectUri = options.redirectUri ?? auth.redirectUri ?? (globalThis.location ? `${globalThis.location.origin}/` : void 0);
-    if (!redirectUri)
-      throw new Error("The approval page needs `redirectUri` to return to.");
-    const url = new URL("/access-keys/update", auth.url);
-    url.search = new URLSearchParams({
+  if (options.redirect || options.dialog) {
+    if (options.dialog && typeof document === "undefined")
+      throw new PageRequiredError();
+    const redirectUri = approvalRedirectUri(auth, options);
+    const query = {
       account: account2,
       address: accessKey2,
       chain_id: String(chainId),
@@ -702,8 +882,24 @@ async function updateAccessKey(auth, options) {
         pad: false,
         url: true
       })
-    }).toString();
-    return { url: url.href };
+    };
+    if (!options.dialog) {
+      const url2 = new URL("/access-keys/update", auth.url);
+      url2.search = new URLSearchParams(query).toString();
+      return { url: url2.href };
+    }
+    const url = await approve(auth, {
+      label: "Change access with Tempo",
+      mode: options.dialog,
+      noun: "change",
+      path: "/access-keys/update",
+      query,
+      signal: options.signal,
+      text: "Continue in a Tempo ID window to change access."
+    });
+    const transaction = transactionOf(url, { redirectUri });
+    if (!transaction) throw transactionOf.missing();
+    return { transaction };
   }
   const body = await json(
     await post(auth, "/v1/account/access-keys/update", {
@@ -716,9 +912,130 @@ async function updateAccessKey(auth, options) {
       }
     })
   );
-  return formatTransactionReceipt(
-    body.receipt
-  );
+  return formatTransactionReceipt(body.receipt);
+}
+function approvalRedirectUri(auth, options) {
+  const redirectUri = options.redirectUri ?? auth.redirectUri ?? (globalThis.location ? `${globalThis.location.origin}/` : void 0);
+  if (!redirectUri)
+    throw new Error("The approval page needs `redirectUri` to return to.");
+  return redirectUri;
+}
+async function approve(auth, options) {
+  const { mode, path, query, signal } = options;
+  const redirectUri = query.redirect_uri;
+  signal?.throwIfAborted();
+  if (typeof document === "undefined") throw new PageRequiredError();
+  if (new URL(redirectUri).origin !== window.location.origin)
+    throw new OriginError({ origin: window.location.origin, redirectUri });
+  const origin = new URL(auth.url).origin;
+  const toUrl = (display) => {
+    const url = new URL(display === "frame" ? `/embed${path}` : path, auth.url);
+    url.search = new URLSearchParams({
+      ...query,
+      ...display === "popup" ? { display } : {}
+    }).toString();
+    return url.href;
+  };
+  const closed = () => new DOMException(`The user closed the ${options.noun}.`, "AbortError");
+  const finish = (value) => {
+    const url = new URL(value);
+    const refusal = error2(url, { redirectUri });
+    if (refusal) throw refusal;
+    return url;
+  };
+  const watch2 = async (popup) => {
+    let abort2;
+    let settled = false;
+    let unblock;
+    let unwatch;
+    try {
+      return await new Promise((resolve3, reject) => {
+        void import("./Sheet-2VUMVJXV.js").then(
+          (Sheet2) => {
+            if (settled) return;
+            unblock = Sheet2.waiting({
+              onCancel: () => reject(closed()),
+              popup
+            });
+          },
+          () => void 0
+        );
+        abort2 = () => reject(signal?.reason);
+        signal?.addEventListener("abort", abort2, { once: true });
+        unwatch = watchPopup(popup, {
+          onCallback: (value) => {
+            if (!("url" in value))
+              return reject(
+                new RequestError({
+                  code: "invalid_request",
+                  message: "Invalid return: the approval page posted no return URL. Try again.",
+                  status: 0
+                })
+              );
+            try {
+              resolve3(finish(value.url));
+            } catch (error3) {
+              reject(error3);
+            }
+          },
+          onClose: () => reject(closed()),
+          onClosed: () => unblock?.(),
+          origin
+        });
+      });
+    } finally {
+      settled = true;
+      if (abort2) signal?.removeEventListener("abort", abort2);
+      unblock?.();
+      unwatch?.();
+      popup.close();
+    }
+  };
+  if (mode === "popup") {
+    const popup = openPopup(toUrl("popup"));
+    if (popup === null) throw new BlockedError();
+    return await watch2(popup);
+  }
+  const Sheet = await import("./Sheet-2VUMVJXV.js");
+  signal?.throwIfAborted();
+  let abort;
+  let close;
+  try {
+    return await new Promise((resolve3, reject) => {
+      abort = () => reject(signal?.reason);
+      signal?.addEventListener("abort", abort, { once: true });
+      close = Sheet.frame({
+        // The page runs the passkey ceremony of the account's owner, for Tempo ID's origin.
+        allow: `publickey-credentials-get ${origin}`,
+        label: options.label,
+        onCallback: (value) => {
+          try {
+            resolve3(finish(value));
+          } catch (error3) {
+            reject(error3);
+          }
+        },
+        onCancel: () => reject(closed()),
+        onPopup: (entry) => {
+          const popup = openPopup(toUrl("popup"));
+          if (popup === null) {
+            if (!entry.automatic) reject(new BlockedError());
+            return false;
+          }
+          close?.();
+          watch2(popup).then(resolve3, reject);
+          return true;
+        },
+        origin,
+        sandbox: "allow-forms allow-same-origin allow-scripts",
+        text: options.text,
+        url: toUrl("frame")
+      });
+    });
+  } finally {
+    if (abort) signal?.removeEventListener("abort", abort);
+    close?.();
+  }
 }
 async function upgrade(auth, options) {
   const { getFn, key } = options;
@@ -767,6 +1084,22 @@ function toConnection(body) {
     app: body.app
   };
 }
+function transactionOf(url, options) {
+  const transaction = parameter(url, {
+    name: "transaction",
+    redirectUri: options.redirectUri
+  });
+  if (transaction === void 0) return void 0;
+  if (Hex.validate(transaction) && Hex.size(transaction) === 32)
+    return transaction;
+  throw transactionOf.missing();
+}
+transactionOf.missing = () => new RequestError({
+  code: "invalid_request",
+  field: "transaction",
+  message: "Invalid `transaction` in the return URL: it is not a transaction hash. Check the account on Tempo ID, then try again.",
+  status: 0
+});
 
 // ../../accounts/src/internal/Headless.ts
 import { Authentication as Authentication2 } from "ox/webauthn";
@@ -783,18 +1116,6 @@ function from2(value) {
 import { Address as Address2, Value } from "ox";
 import { Addresses, Scopes, Selectors } from "viem/tempo";
 import { defineToken, tokens as tokens2 } from "viem/tokens";
-
-// ../../accounts/src/internal/Chains.ts
-var devIds = { devnet: 31318, localnet: 1337 };
-var ids = { mainnet: 4217, testnet: 42431 };
-function parameter(options) {
-  const name = Object.keys(ids).find(
-    (key) => ids[key] === options.chainId
-  );
-  return name ?? String(options.chainId);
-}
-
-// ../../accounts/src/Permissions.ts
 var DecimalsUnknownError = class extends Error {
   name = "Permissions.DecimalsUnknownError";
   constructor(options) {
@@ -3193,7 +3514,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-CPAB7R2I.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-SWHB7N65.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -3211,7 +3532,9 @@ function plugin() {
       }
       return {
         callback: async () => (await get3()).callback(),
-        signIn: async (parameters) => (await get3()).signIn(parameters)
+        revokeAccessKey: async (parameters) => (await get3()).revokeAccessKey(parameters),
+        signIn: async (parameters) => (await get3()).signIn(parameters),
+        updateAccessKey: async (parameters) => (await get3()).updateAccessKey(parameters)
       };
     },
     // The loaded plugin adds no member, so its `extend` runs once the module loads, and this one
@@ -3342,115 +3665,13 @@ function served(options) {
 // ../../accounts/src/actions/funding.ts
 var funding_exports = {};
 __export(funding_exports, {
-  BlockedError: () => BlockedError,
-  OriginError: () => OriginError,
-  PageRequiredError: () => PageRequiredError,
+  BlockedError: () => BlockedError2,
+  OriginError: () => OriginError2,
+  PageRequiredError: () => PageRequiredError2,
   complete: () => complete2,
   open: () => open
 });
-
-// ../../accounts/src/internal/Callback.ts
-function received(value, options) {
-  if (typeof value !== "object" || value === null) return void 0;
-  const data = value;
-  if (data.type === `${options.prefix}.callback` && typeof data.url === "string")
-    return { url: data.url };
-  if (data.type !== `${options.prefix}.result` || typeof data.authorization !== "object" || data.authorization === null)
-    return void 0;
-  return {
-    authorization: data.authorization,
-    ...typeof data.state === "string" ? { state: data.state } : {}
-  };
-}
-function checkState(url, options) {
-  if (url.searchParams.getAll("state").at(-1) !== options.state)
-    throw new RequestError({
-      code: "invalid_request",
-      field: "state",
-      message: "Invalid `state` in the callback URL. Start sign-in again from this app.",
-      status: 400
-    });
-}
-function error2(url, options) {
-  const code = parameter2(url, { ...options, name: "error" });
-  if (!code) return void 0;
-  return new RequestError({
-    code,
-    message: parameter2(url, { ...options, name: "error_description" }) ?? code,
-    status: 0,
-    uri: parameter2(url, { ...options, name: "error_uri" })
-  });
-}
-function parameter2(url, options) {
-  const registered = new URL(options.redirectUri).searchParams.getAll(
-    options.name
-  ).length;
-  return url.searchParams.getAll(options.name)[registered];
-}
-
-// ../../accounts/src/internal/Popup.ts
-var closeGrace = 1e3;
-var closeInterval = 100;
-function openPopup(url) {
-  const width = 432;
-  const height = 420;
-  const left = window.screenX + (window.outerWidth - width) / 2;
-  const top = window.screenY + (window.outerHeight - height) / 2;
-  return window.open(
-    url,
-    "_blank",
-    `popup,width=${width},height=${height},left=${left},top=${top}`
-  );
-}
-function watchPopup(popup, options) {
-  let open2 = false;
-  let closedAt;
-  const listener = (event) => {
-    if (event.origin !== options.origin || event.source !== popup) return;
-    const data = event.data;
-    if (data?.type === "tempo-id:popup.open") {
-      open2 = true;
-      return;
-    }
-    const callback = received(data, { prefix: "tempo-id:popup" });
-    if (!callback) return;
-    stop();
-    options.onCallback(callback);
-  };
-  const interval = setInterval(() => {
-    if (!open2 || !popup.closed) return;
-    if (closedAt === void 0) {
-      closedAt = Date.now();
-      options.onClosed?.();
-    }
-    if (Date.now() - closedAt < closeGrace) return;
-    stop();
-    options.onClose();
-  }, closeInterval);
-  const stop = () => {
-    clearInterval(interval);
-    window.removeEventListener("message", listener);
-  };
-  window.addEventListener("message", listener);
-  return stop;
-}
-function apple() {
-  const agent = navigator.userAgent;
-  if (/iPad|iPhone|iPod/.test(agent)) return true;
-  return /Macintosh/.test(agent) && navigator.maxTouchPoints > 1;
-}
-function coinflow(options) {
-  const { amount, chainId, token: token2 } = options;
-  if (amount === void 0 || token2 !== "MACH") return false;
-  if (chainId !== ids.mainnet) return false;
-  return apple();
-}
-function activated() {
-  return navigator.userActivation?.isActive ?? true;
-}
-
-// ../../accounts/src/actions/funding.ts
-var BlockedError = class extends Error {
+var BlockedError2 = class extends Error {
   name = "Actions.funding.BlockedError";
   constructor() {
     super(
@@ -3458,7 +3679,7 @@ var BlockedError = class extends Error {
     );
   }
 };
-var OriginError = class extends Error {
+var OriginError2 = class extends Error {
   name = "Actions.funding.OriginError";
   constructor(options) {
     super(
@@ -3466,7 +3687,7 @@ var OriginError = class extends Error {
     );
   }
 };
-var PageRequiredError = class extends Error {
+var PageRequiredError2 = class extends Error {
   name = "Actions.funding.PageRequiredError";
   constructor() {
     super(
@@ -3502,7 +3723,7 @@ async function open(auth, options) {
   if (typeof options.address === "object")
     Promise.resolve(options.address).catch(() => void 0);
   signal?.throwIfAborted();
-  if (typeof document === "undefined") throw new PageRequiredError();
+  if (typeof document === "undefined") throw new PageRequiredError2();
   const mode = (() => {
     const value = options.mode ?? "frame";
     if (value !== "frame") return value;
@@ -3525,7 +3746,7 @@ async function open(auth, options) {
       ...entry.amount ? { amount: entry.amount } : {},
       // The page reads `mainnet` and `testnet` by name, and another chain by the name that the
       // deployment lists for its ID.
-      chain: parameter({ chainId: options.chainId ?? auth.chainId }),
+      chain: parameter2({ chainId: options.chainId ?? auth.chainId }),
       client_id: auth.clientId,
       ...entry.mode === "popup" ? { display: entry.mode } : {},
       ...currency === void 0 ? {} : { funding_currency: currency },
@@ -3550,10 +3771,10 @@ async function open(auth, options) {
     return void 0;
   }
   if (new URL(redirectUri).origin !== window.location.origin)
-    throw new OriginError({ origin: window.location.origin, redirectUri });
+    throw new OriginError2({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-D644QHD6.js");
+    const Sheet = await import("./Sheet-2VUMVJXV.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -3585,7 +3806,7 @@ async function open(auth, options) {
   const popup = openPopup(
     typeof options.address === "string" ? toUrl(options.address) : "about:blank"
   );
-  if (popup === null) throw new BlockedError();
+  if (popup === null) throw new BlockedError2();
   return await watch(auth, {
     address: read2(),
     popup,
@@ -3604,7 +3825,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-D644QHD6.js").then(
+        void import("./Sheet-2VUMVJXV.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -3669,7 +3890,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-D644QHD6.js");
+  const Sheet = await import("./Sheet-2VUMVJXV.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -3679,6 +3900,11 @@ async function frame(auth, options) {
         abort = () => reject(signal?.reason);
         signal?.addEventListener("abort", abort, { once: true });
         close = Sheet.frame({
+          // Apple Pay and Google Pay need the `payment` permission in a frame, and their sheets open
+          // popups from the frame's own clicks. The frame runs third-party scripts and nests the
+          // card issuer's page.
+          allow: "payment",
+          label: "Add funds with Tempo",
           onCallback: (value) => resolve3(
             complete2(auth, { redirectUri, url: value }) ?? {
               status: "continued"
@@ -3694,7 +3920,7 @@ async function frame(auth, options) {
               })
             );
             if (popup === null) {
-              if (!entry.automatic) reject(new BlockedError());
+              if (!entry.automatic) reject(new BlockedError2());
               return false;
             }
             close?.();
@@ -3705,6 +3931,8 @@ async function frame(auth, options) {
             return true;
           },
           origin: new URL(auth.url).origin,
+          sandbox: "allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts",
+          text: "Continue in a Tempo ID window to add funds.",
           url: toUrl(address)
         });
       }
@@ -4134,7 +4362,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-4J63W3O3.js").then(
+    attached ??= import("./Connections-K44EJ6F7.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;
@@ -4183,7 +4411,7 @@ function create4(options = {}) {
     },
     handler: {
       async fetch(request2) {
-        server ??= import("./Server-GHH2TOPL.js").then(
+        server ??= import("./Server-CAPWBFI3.js").then(
           (module) => module.create({
             accessKeys: connectionsOptions ? async () => (await connections2()).keyEndpoint : void 0,
             // The `backend` plugin's actions sit on the instance under its `id`.
@@ -4490,6 +4718,15 @@ export {
   user,
   tokens,
   withoutKey,
+  received,
+  checkState,
+  error2,
+  openPopup,
+  watchPopup,
+  coinflow,
+  activated,
+  revokeAccessKey,
+  updateAccessKey,
   account_exports,
   authorizeUrl,
   request,
@@ -4511,17 +4748,12 @@ export {
   toSession,
   unlisted,
   from4 as from2,
-  received,
-  checkState,
-  error2,
   get2 as get,
-  openPopup,
-  watchPopup,
-  coinflow,
-  activated,
   open,
   funding_exports,
+  KeyRequiredError,
   PendingNotFoundError,
   RequestError,
+  SignedOutError2 as SignedOutError,
   Accounts_exports
 };

package/dist/{chunk-MLMRZMAK.js → chunk-YXEQ42DK.js}

@@ -2,7 +2,7 @@ import {
   create,
   prompt,
   waiting
-} from "./chunk-OR4H7ZKK.js";
+} from "./chunk-S3QDABXG.js";
 import {
   basePath
 } from "./chunk-HWONYWNC.js";
@@ -27,7 +27,7 @@ import {
   tokens,
   user,
   watchPopup
-} from "./chunk-2BJJYAAI.js";
+} from "./chunk-UGIWBXMZ.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";

package/dist/commands/login.js

@@ -1,12 +1,12 @@
 import {
   env,
   login
-} from "../chunk-RXFSIUSG.js";
-import "../chunk-MLMRZMAK.js";
-import "../chunk-OR4H7ZKK.js";
-import "../chunk-QL7UYVGP.js";
+} from "../chunk-6Y4DXPDA.js";
+import "../chunk-YXEQ42DK.js";
+import "../chunk-S3QDABXG.js";
+import "../chunk-CMIMUIV7.js";
 import "../chunk-HWONYWNC.js";
-import "../chunk-2BJJYAAI.js";
+import "../chunk-UGIWBXMZ.js";
 import "../chunk-MLKGABMK.js";
 
 // src/commands/login.ts

package/dist/commands/logout.js

@@ -1,12 +1,12 @@
 import {
   env,
   remove
-} from "../chunk-RXFSIUSG.js";
-import "../chunk-MLMRZMAK.js";
-import "../chunk-OR4H7ZKK.js";
-import "../chunk-QL7UYVGP.js";
+} from "../chunk-6Y4DXPDA.js";
+import "../chunk-YXEQ42DK.js";
+import "../chunk-S3QDABXG.js";
+import "../chunk-CMIMUIV7.js";
 import "../chunk-HWONYWNC.js";
-import "../chunk-2BJJYAAI.js";
+import "../chunk-UGIWBXMZ.js";
 import "../chunk-MLKGABMK.js";
 
 // src/commands/logout.ts

package/dist/commands/whoami.js

@@ -2,12 +2,12 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-RXFSIUSG.js";
-import "../chunk-MLMRZMAK.js";
-import "../chunk-OR4H7ZKK.js";
-import "../chunk-QL7UYVGP.js";
+} from "../chunk-6Y4DXPDA.js";
+import "../chunk-YXEQ42DK.js";
+import "../chunk-S3QDABXG.js";
+import "../chunk-CMIMUIV7.js";
 import "../chunk-HWONYWNC.js";
-import "../chunk-2BJJYAAI.js";
+import "../chunk-UGIWBXMZ.js";
 import "../chunk-MLKGABMK.js";
 
 // src/commands/whoami.ts

package/dist/{dialog-CPAB7R2I.js → dialog-SWHB7N65.js}

@@ -2,17 +2,21 @@ import {
   callback,
   preload,
   signIn
-} from "./chunk-MLMRZMAK.js";
-import "./chunk-OR4H7ZKK.js";
+} from "./chunk-YXEQ42DK.js";
+import "./chunk-S3QDABXG.js";
 import {
   basePath
 } from "./chunk-HWONYWNC.js";
 import {
+  KeyRequiredError,
+  SignedOutError,
   accessKey,
   expired2 as expired,
   from2 as from,
-  toSession
-} from "./chunk-2BJJYAAI.js";
+  revokeAccessKey,
+  toSession,
+  updateAccessKey
+} from "./chunk-UGIWBXMZ.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts
@@ -51,12 +55,52 @@ function dialog(options = {}) {
   return from({
     actions: (context) => {
       const config = configOf(context);
+      const target = (session, parameters) => {
+        const entries = [session?.key, ...session?.keys ?? []].filter(
+          (entry2) => entry2 !== void 0 && (parameters.accessKey === void 0 || entry2.keyAuthorization.keyId.toLowerCase() === parameters.accessKey.toLowerCase()) && (parameters.account === void 0 || entry2.account.toLowerCase() === parameters.account.toLowerCase())
+        );
+        const entry = entries.find(
+          (entry2) => Number(entry2.chainId) === (parameters.chainId ?? config.chainId)
+        ) ?? (parameters.chainId === void 0 && parameters.accessKey !== void 0 && entries.length === 1 ? entries[0] : void 0);
+        const accessKey2 = parameters.accessKey ?? entry?.keyAuthorization.keyId;
+        const account = parameters.account ?? entry?.account;
+        const chainId = parameters.chainId ?? (entry ? Number(entry.chainId) : void 0) ?? config.chainId;
+        if (accessKey2 && account) return { accessKey: accessKey2, account, chainId };
+        const { status } = context.session.status.get();
+        if (status === "pending" || status === "reauthorizing")
+          throw new SignedOutError({ pending: true });
+        if (session && !expired(session))
+          throw new KeyRequiredError();
+        throw new SignedOutError();
+      };
+      const sessionOf = async (parameters) => {
+        if (parameters.accessKey && parameters.account && parameters.chainId !== void 0)
+          return void 0;
+        return await context.session.load();
+      };
+      const modeOf = (mode) => mode ?? (popup && !crossOriginOpenerPolicy ? "popup" : "iframe");
       return {
         /**
          * Completes a popup's sign-in on the page of the redirect URI, and closes the popup.
          * Returns whether the page was the callback of a popup.
          */
         callback: () => callback(config),
+        /**
+         * Revokes the app's own access key on Tempo ID's approval page, in the dialog or a popup, and
+         * returns the hash of the transaction, or `null` for an access key that the chain held
+         * revoked already. Defaults to the session's access key.
+         */
+        // An async member rejects every failure, and still opens a popup within the click, since it
+        // runs at once up to its first `await`.
+        revokeAccessKey: async (parameters = {}) => revokeAccessKey(config, {
+          ...target(
+            context.session.get() ?? await sessionOf(parameters),
+            parameters
+          ),
+          dialog: modeOf(parameters.mode),
+          redirectUri: parameters.redirectUri ?? backendRedirectUri(config),
+          signal: parameters.signal
+        }),
         /**
          * Signs the user in, sets the instance's session, and returns it. With `backend`, the
          * backend keeps the session, and the call returns the session that the page reads.
@@ -83,7 +127,23 @@ function dialog(options = {}) {
           const session = toSession(result);
           await change.commit(session);
           return session;
-        }
+        },
+        /**
+         * Changes the limits, the scopes, or both of the app's own access key on Tempo ID's approval
+         * page, in the dialog or a popup, and returns the hash of the transaction. Defaults to the
+         * session's access key.
+         */
+        updateAccessKey: async (parameters) => updateAccessKey(config, {
+          ...target(
+            context.session.get() ?? await sessionOf(parameters),
+            parameters
+          ),
+          dialog: modeOf(parameters.mode),
+          limits: parameters.limits,
+          redirectUri: parameters.redirectUri ?? backendRedirectUri(config),
+          scopes: parameters.scopes,
+          signal: parameters.signal
+        })
       };
     },
     // The plugin adds no member. It reads the instance's status, which only `extend` receives.

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-751.sha-6fdf21b",
+  "version": "0.0.0-pr-749.sha-e9face1",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {