@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/cli/commands/whoami.js

@@ -0,0 +1,24 @@
+/**
+ * `tempo-id whoami`: shows the signed-in user's email and the Tempo Account of the stored access
+ * key, with the access token refreshed when it expires.
+ * @module
+ */
+import { Cli } from 'incur';
+import * as User from '../User.js';
+export default Cli.command({
+    description: 'Show the signed-in user and Tempo Account.',
+    env: User.env,
+    async run(c) {
+        const Session = await User.loadSession();
+        if (!Session)
+            return c.error(User.missingPeers);
+        const user = await Session.whoami({
+            home: c.env.TEMPO_HOME,
+            url: c.env.TEMPO_ID_URL,
+        });
+        if (!user)
+            return c.error(User.signedOut);
+        return user;
+    },
+});
+//# sourceMappingURL=whoami.js.map

package/dist/cli/commands/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAC3B,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAElC,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EAAE,4CAA4C;IACzD,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY;SACxB,CAAC,CAAA;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAC,CAAA"}

package/dist/client/Actions.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Tempo ID's actions. Each takes an instance from `Auth.create`. Each sign-in flow has its own
+ * namespace, `oauth` holds the standard OAuth endpoints for tokens an app holds, and the actions
+ * every flow shares sit at the top level.
+ * @module
+ */
+import type { Account } from 'viem/tempo';
+import { type Auth } from './Auth.js';
+import type { Authorization } from './Authorization.js';
+import type { Permissions } from './Permissions.js';
+import type { Tokens } from './Tokens.js';
+export * as account from './actions/account.js';
+export * as device from './actions/device.js';
+export * as email from './actions/email.js';
+export * as oauth from './actions/oauth.js';
+export * as passkey from './actions/passkey.js';
+export * as provider from './actions/provider.js';
+export * as realm from './actions/realm.js';
+export * as redirect from './actions/redirect.js';
+/**
+ * Authorizes a first-party app, which skips consent, for a user already signed in to Tempo ID, with
+ * `POST /v1/authorize`, from a page on its redirect URI's origin. Any other app fails with
+ * `rejected`, and authorizes through a redirect. Returns `undefined` without a session, so the app
+ * shows sign-in. The key must fit Tempo ID's headless ceiling. An `account` that the call names
+ * becomes the app's account for its later requests. With `key: false`, the call returns the tokens
+ * and the user alone.
+ *
+ * A user who holds no Tempo Account in the app's realms receives `rejected`, since the call creates
+ * none. `Actions.account.get` creates the first one.
+ *
+ * Throws a `RequestError` with reason `webauthn_required` when a passkey owns the account, since a
+ * passkey signs a key only on a page that shows it. `Actions.redirect.start` then authorizes the
+ * key on Tempo ID's pages.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.authorize(auth)
+ * if (!authorization) showSignIn()
+ * ```
+ */
+export declare function authorize<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options?: authorize.Options<chainId, key>): Promise<authorize.ReturnType<chainId, key>>;
+export declare namespace authorize {
+    type Options<chainId extends number = number, key extends boolean = true> = {
+        /**
+         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
+         * defaults to the one the app selected, or the user's oldest. Defaults to a new key.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * The address of the user's Tempo Account the key acts for, such as the one that
+         * `Actions.account.get` returns. Takes the place of `accessKey`'s `access`, and becomes
+         * the app's account for its later requests that name none.
+         */
+        account?: `0x${string}` | undefined;
+        /**
+         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
+         * Tempo ID binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
+         * `tempo-id:sign` scope may send one, and only with a key.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /**
+         * Whether the call authorizes an access key. With `false`, it returns the tokens and the user
+         * alone. Defaults to `true`.
+         */
+        key?: key | undefined;
+        /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /**
+     * The authorization, or the tokens and the user alone with `key: false`. A `boolean` `key`
+     * returns either. `undefined` without a session.
+     */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = (key extends false ? Omit<Authorization<chainId>, 'account' | 'key'> : Authorization<chainId>) | undefined;
+}
+/**
+ * Exchanges a refresh token for new tokens. Refresh tokens rotate, so store the new one.
+ *
+ * @example
+ * ```ts
+ * const tokens = await Actions.refresh(auth, {
+ *   refreshToken: saved.refreshToken,
+ * })
+ * ```
+ */
+export declare function refresh(auth: Auth, options: refresh.Options): Promise<Tokens>;
+export declare namespace refresh {
+    type Options = {
+        /** The latest refresh token. Each refresh rotates it. */
+        refreshToken: string;
+    };
+}
+/**
+ * Ends the user's Tempo ID session, which signs them out of every app that relies on it.
+ *
+ * @example
+ * ```ts
+ * await Actions.signOut(auth)
+ * ```
+ */
+export declare function signOut(auth: Auth): Promise<void>;
+//# sourceMappingURL=Actions.d.ts.map

package/dist/client/Actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Actions.d.ts","sourceRoot":"","sources":["../../src/client/Actions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA4B,MAAM,WAAW,CAAA;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AACjD,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAM,GAC5C,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAgC7C;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC1E;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;WAIG;QACH,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;QACnC;;;;WAIG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE;;;WAGG;QACH,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,6FAA6F;QAC7F,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED;;;OAGG;IACH,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IAExB,CAAC,GAAG,SAAS,KAAK,GACd,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAC/C,aAAa,CAAC,OAAO,CAAC,CAAC,GAC3B,SAAS,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,CAAC,OAAO,GACvB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb,yDAAyD;QACzD,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvD"}

package/dist/client/Actions.js

@@ -0,0 +1,90 @@
+import { ChallengeWithoutKeyError } from './Auth.js';
+import * as AccessKey from './internal/accessKey.js';
+import * as Api from './internal/api.js';
+import { request } from './internal/request.js';
+export * as account from './actions/account.js';
+export * as device from './actions/device.js';
+export * as email from './actions/email.js';
+export * as oauth from './actions/oauth.js';
+export * as passkey from './actions/passkey.js';
+export * as provider from './actions/provider.js';
+export * as realm from './actions/realm.js';
+export * as redirect from './actions/redirect.js';
+/**
+ * Authorizes a first-party app, which skips consent, for a user already signed in to Tempo ID, with
+ * `POST /v1/authorize`, from a page on its redirect URI's origin. Any other app fails with
+ * `rejected`, and authorizes through a redirect. Returns `undefined` without a session, so the app
+ * shows sign-in. The key must fit Tempo ID's headless ceiling. An `account` that the call names
+ * becomes the app's account for its later requests. With `key: false`, the call returns the tokens
+ * and the user alone.
+ *
+ * A user who holds no Tempo Account in the app's realms receives `rejected`, since the call creates
+ * none. `Actions.account.get` creates the first one.
+ *
+ * Throws a `RequestError` with reason `webauthn_required` when a passkey owns the account, since a
+ * passkey signs a key only on a page that shows it. `Actions.redirect.start` then authorizes the
+ * key on Tempo ID's pages.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.authorize(auth)
+ * if (!authorization) showSignIn()
+ * ```
+ */
+export async function authorize(auth, options = {}) {
+    // A challenge rides in the key, so a call without one refuses it before any request.
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    // Checking the session first avoids a failed request for a visitor without one.
+    const session = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/auth/session', auth.url), {
+        credentials: 'include',
+    }));
+    if (!session.user)
+        return undefined;
+    const key = options.key === false
+        ? undefined
+        : await AccessKey.resolve(options.accessKey);
+    const response = await Api.post(auth, '/v1/authorize', {
+        json: request(auth, {
+            accessKey: key?.accessKey,
+            account: options.account,
+            challenge: options.challenge,
+            permissions: options.permissions,
+        }),
+    });
+    // The session can end between the two requests.
+    if (response.status === 401)
+        return undefined;
+    const body = await Api.json(response);
+    // `key` decides both the type and the runtime value of the result.
+    return (key ? Api.authorization(body, key) : Api.withoutKey(body));
+}
+/**
+ * Exchanges a refresh token for new tokens. Refresh tokens rotate, so store the new one.
+ *
+ * @example
+ * ```ts
+ * const tokens = await Actions.refresh(auth, {
+ *   refreshToken: saved.refreshToken,
+ * })
+ * ```
+ */
+export async function refresh(auth, options) {
+    return Api.tokens(await Api.token(auth, {
+        grant_type: 'refresh_token',
+        refresh_token: options.refreshToken,
+    }));
+}
+/**
+ * Ends the user's Tempo ID session, which signs them out of every app that relies on it.
+ *
+ * @example
+ * ```ts
+ * await Actions.signOut(auth)
+ * ```
+ */
+export async function signOut(auth) {
+    // A JSON body keeps the request out of Tempo ID's CSRF check for cross-site form posts.
+    await Api.json(await Api.post(auth, '/v1/auth/logout', { json: {} }));
+}
+//# sourceMappingURL=Actions.js.map

package/dist/client/Actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Actions.js","sourceRoot":"","sources":["../../src/client/Actions.ts"],"names":[],"mappings":"AAOA,OAAO,EAAa,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AACpD,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAI/C,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AACjD,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAI7B,IAAU,EACV,OAAO,GAAoC,EAAE;IAE7C,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IAEtC,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACjE,WAAW,EAAE,SAAS;KACvB,CAAC,CACH,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAEnC,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE;QACrD,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YAClB,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;KACH,CAAC,CAAA;IACF,gDAAgD;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAe,QAAQ,CAAC,CAAA;IACnD,mEAAmE;IACnE,OAAO,CACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CACpB,CAAA;AACzC,CAAC;AA4CD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAU,EACV,OAAwB;IAExB,OAAO,GAAG,CAAC,MAAM,CACf,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QACpB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CACH,CAAA;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAU;IACtC,wFAAwF;IACxF,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC"}

package/dist/client/Auth.d.ts

@@ -0,0 +1,161 @@
+/**
+ * A Tempo ID instance, which every action takes. Create one with {@link create}, then pass it
+ * to each action in `Actions`. Every sign-in returns an `Authorization`: the user's tokens and a
+ * Viem access key account.
+ *
+ * @example
+ * ```ts
+ * import { Actions, Auth } from '@tempoxyz/id/client'
+ * import { Expiry, Scopes } from 'viem/tempo'
+ * import { tempo } from 'viem/tempo/chains'
+ * import * as Tokens from 'viem/tokens'
+ *
+ * // OUSD has its mainnet address on every Tempo chain.
+ * const ousd = Tokens.ousd(tempo.id).address
+ *
+ * const auth = Auth.create({ clientId: 'client_…', dev: true })
+ *
+ * const authorization = await Actions.authorize(auth, {
+ *   permissions: {
+ *     expiry: Expiry.days(1),
+ *     limits: [{ limit: 10_000_000n, token: ousd }],
+ *     scopes: [Scopes.tip20(ousd).transfer()],
+ *   },
+ * })
+ * ```
+ * @module
+ */
+import type { Account as ViemAccount } from 'viem/tempo';
+import * as AccountState from './internal/account.js';
+import type { Storage } from './Storage.js';
+/**
+ * The account of a client extended with `tempoId`: an access key account that each sign-in sets
+ * and sign-out empties. Reading it while signed out throws {@link SignedOutError}.
+ */
+export type Account = ViemAccount.AccessKeyAccount & {
+    /** What the account signs as, which only the `tempoId` extension reads. */
+    readonly [AccountState.key]: AccountState.State;
+};
+/** A Tempo ID instance, which every action takes. */
+export type Auth = {
+    /** The chain the app's keys act on, unless an action's `permissions` names another. */
+    chainId: number;
+    /** The app's client ID, from its registration as an OAuth app in Tempo ID. */
+    clientId: string;
+    /** The app's client secret. Only a backend holds one. */
+    clientSecret?: string | undefined;
+    /** Calls Tempo ID. Defaults to the global `fetch`. */
+    fetch?: typeof globalThis.fetch | undefined;
+    /** Where Tempo ID redirects back to. Defaults to the page's origin in a browser. */
+    redirectUri?: string | undefined;
+    /** The scopes the app's tokens carry. */
+    scope: string;
+    /**
+     * Where `Actions.redirect.start` keeps its state until Tempo ID redirects back. It must keep
+     * objects as they are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
+     */
+    storage?: Storage | undefined;
+    /** Where Tempo ID runs, such as `https://id.tempo.xyz`. */
+    url: string;
+};
+/** An action received a `challenge` with `key: false`, and a challenge rides in a key. */
+export declare class ChallengeWithoutKeyError extends Error {
+    readonly name = "Auth.ChallengeWithoutKeyError";
+    constructor();
+}
+/** A request Tempo ID refused, with its status and message. */
+export declare class RequestError extends Error {
+    readonly name = "Auth.RequestError";
+    /** The OAuth error code, such as `invalid_authorization_details`. */
+    readonly code: string;
+    /** The request field at fault, as a dotted path. */
+    readonly field: string | undefined;
+    /** The values the refusal compared, such as `limit` and `maximum`. Base units are decimal strings. */
+    readonly meta: Readonly<Record<string, number | string>> | undefined;
+    /** A stable name for the refusal, to branch on. */
+    readonly reason: RequestError.Reason | undefined;
+    /**
+     * Whether a sign-in's code or passkey verified before Tempo ID refused the authorization, so the
+     * user is signed in. `false` for every other refusal.
+     */
+    readonly signedIn: boolean;
+    /** The HTTP status of Tempo ID's response, or 0 for a request that received none. */
+    readonly status: number;
+    /** The page that explains the error. */
+    readonly uri: string | undefined;
+    constructor(options: RequestError.Options);
+}
+export declare namespace RequestError {
+    type Options = {
+        /** The error that caused this one, such as a network failure. */
+        cause?: unknown;
+        /** The OAuth error code, such as `invalid_authorization_details`. */
+        code: string;
+        /** The request field at fault, as a dotted path. */
+        field?: string | undefined;
+        /** The fault and its fix, from `error_description`. */
+        message: string;
+        /** The values the refusal compared, such as `limit` and `maximum`. Base units are decimal strings. */
+        meta?: Readonly<Record<string, number | string>> | undefined;
+        /** A stable name for the refusal, to branch on. Absent from the issuer's own errors. */
+        reason?: Reason | undefined;
+        /** Whether a sign-in's code or passkey verified before the refusal. Defaults to `false`. */
+        signedIn?: boolean | undefined;
+        /** The HTTP status of Tempo ID's response. */
+        status: number;
+        /** The page that explains the error, from `error_uri`. */
+        uri?: string | undefined;
+    };
+    /** Each refusal's stable name. `docs/errors.md` explains each one. */
+    type Reason = 'already_decided' | 'approval_pending' | 'authorization_expired' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'duplicate_scope' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_id_token_hint' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'invalid_recipients' | 'limit_exceeds_maximum' | 'logout_not_permitted' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'passkey_link_expired' | 'passkey_not_permitted' | 'post_logout_redirect_not_permitted' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'return_to_not_permitted' | 'scope_without_limit' | 'session_changed' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unknown_provider' | 'unsupported_call' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+}
+/** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
+export declare class SignedOutError extends Error {
+    readonly name = "Auth.SignedOutError";
+    constructor();
+}
+/**
+ * Creates the account of a client extended with `tempoId`. It holds no key until a sign-in sets
+ * it, and reading it before then throws {@link SignedOutError}, so a transaction fails before it
+ * reaches the node. Each client needs its own, since the account signs as one user.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export declare function account(): Account;
+/**
+ * Creates a Tempo ID instance.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'client_…' })
+ * ```
+ */
+export declare function create(options: create.Options): Auth;
+export declare namespace create {
+    type Options = Omit<Auth, 'chainId' | 'scope' | 'url'> & {
+        /**
+         * The chain the app's keys act on, such as `client.chain.id`. Defaults to Tempo mainnet, or to
+         * Tempo testnet with `dev`.
+         */
+        chainId?: number | undefined;
+        /**
+         * Whether to use Tempo ID's development deployment, `https://id.tehq.dev`, with keys on
+         * Tempo testnet unless `chainId` names another chain. Defaults to `false`.
+         */
+        dev?: boolean | undefined;
+        /**
+         * Scopes the app's tokens carry beyond `openid` and `email`, which every instance includes.
+         * Defaults to `offline_access`, for a refresh token.
+         */
+        scope?: string | undefined;
+        /** Where Tempo ID runs. Defaults to `https://id.tempo.xyz`, or `https://id.tehq.dev` with `dev`. */
+        url?: string | undefined;
+    };
+}
+//# sourceMappingURL=Auth.d.ts.map

package/dist/client/Auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../src/client/Auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,YAAY,CAAA;AAExD,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,GAAG;IACnD,2EAA2E;IAC3E,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,KAAK,CAAA;CAChD,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,IAAI,GAAG;IACjB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;IAC3C,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7B,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,0FAA0F;AAC1F,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,mCAAkC;IAExD,cAIC;CACF;AAED,+DAA+D;AAC/D,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,uBAAsB;IAC5C,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,sGAAsG;IACtG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EASxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,iEAAiE;QACjE,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,qEAAqE;QACrE,IAAI,EAAE,MAAM,CAAA;QACZ,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,uDAAuD;QACvD,OAAO,EAAE,MAAM,CAAA;QACf,sGAAsG;QACtG,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;QAC5D,wFAAwF;QACxF,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,4FAA4F;QAC5F,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC9B,8CAA8C;QAC9C,MAAM,EAAE,MAAM,CAAA;QACd,0DAA0D;QAC1D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;IAED,sEAAsE;IACtE,KAAK,MAAM,GACP,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,gBAAgB,GAChB,yBAAyB,GACzB,oBAAoB,GACpB,qBAAqB,GACrB,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,wBAAwB,GACxB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,oBAAoB,GACpB,uBAAuB,GACvB,sBAAsB,GACtB,gBAAgB,GAChB,wBAAwB,GACxB,aAAa,GACb,oBAAoB,GACpB,sBAAsB,GACtB,uBAAuB,GACvB,oCAAoC,GACpC,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,iBAAiB,GACjB,kBAAkB,GAClB,YAAY,GACZ,cAAc,GACd,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,CAAA;CACxB;AAED,6FAA6F;AAC7F,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,yBAAwB;IAE9C,cAIC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,OAAO,IAAI,OAAO,CA4BjC;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAUpD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG;QACvD;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B;;;WAGG;QACH,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,oGAAoG;QACpG,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;CACF"}

package/dist/client/Auth.js

@@ -0,0 +1,113 @@
+import { tempo, tempoTestnet } from 'viem/tempo/chains';
+import * as AccountState from './internal/account.js';
+/** An action received a `challenge` with `key: false`, and a challenge rides in a key. */
+export class ChallengeWithoutKeyError extends Error {
+    name = 'Auth.ChallengeWithoutKeyError';
+    constructor() {
+        super('A challenge rides in the key authorization, so a sign-in with `key: false` takes none. Remove `challenge`, or request a key.');
+    }
+}
+/** A request Tempo ID refused, with its status and message. */
+export class RequestError extends Error {
+    name = 'Auth.RequestError';
+    /** The OAuth error code, such as `invalid_authorization_details`. */
+    code;
+    /** The request field at fault, as a dotted path. */
+    field;
+    /** The values the refusal compared, such as `limit` and `maximum`. Base units are decimal strings. */
+    meta;
+    /** A stable name for the refusal, to branch on. */
+    reason;
+    /**
+     * Whether a sign-in's code or passkey verified before Tempo ID refused the authorization, so the
+     * user is signed in. `false` for every other refusal.
+     */
+    signedIn;
+    /** The HTTP status of Tempo ID's response, or 0 for a request that received none. */
+    status;
+    /** The page that explains the error. */
+    uri;
+    constructor(options) {
+        super(options.message, { cause: options.cause });
+        this.code = options.code;
+        this.field = options.field;
+        this.meta = options.meta;
+        this.reason = options.reason;
+        this.signedIn = options.signedIn ?? false;
+        this.status = options.status;
+        this.uri = options.uri;
+    }
+}
+/** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
+export class SignedOutError extends Error {
+    name = 'Auth.SignedOutError';
+    constructor() {
+        super("The client's account is signed out. Sign in through `client.auth` before sending.");
+    }
+}
+/**
+ * Creates the account of a client extended with `tempoId`. It holds no key until a sign-in sets
+ * it, and reading it before then throws {@link SignedOutError}, so a transaction fails before it
+ * reaches the node. Each client needs its own, since the account signs as one user.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export function account() {
+    const state = { account: undefined };
+    // Viem reads a client's account only when an action runs, through property reads, `in` checks,
+    // and spreads. Each trap reads through to the account that the latest sign-in set.
+    const proxy = new Proxy({}, {
+        get(_, key) {
+            if (key === AccountState.key)
+                return state;
+            if (state.account)
+                return Reflect.get(state.account, key);
+            // Promise resolution, serialization, and inspection probe these, which must not throw.
+            if (typeof key === 'symbol' || key === 'then' || key === 'toJSON')
+                return undefined;
+            throw new SignedOutError();
+        },
+        getOwnPropertyDescriptor(_, key) {
+            if (!state.account)
+                return undefined;
+            const descriptor = Reflect.getOwnPropertyDescriptor(state.account, key);
+            // A proxy may report a property its empty target lacks only as configurable.
+            return descriptor && { ...descriptor, configurable: true };
+        },
+        has: (_, key) => key === AccountState.key ||
+            (state.account !== undefined && Reflect.has(state.account, key)),
+        ownKeys: () => (state.account ? Reflect.ownKeys(state.account) : []),
+    });
+    return proxy;
+}
+/**
+ * Creates a Tempo ID instance.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'client_…' })
+ * ```
+ */
+export function create(options) {
+    const { chainId, dev, scope = 'offline_access', url, ...rest } = options;
+    // Every authorization reads the user from the ID token, which needs `openid` and `email`.
+    const scopes = scope.split(' ').filter(Boolean);
+    return {
+        ...rest,
+        chainId: chainId ?? (dev ? tempoTestnet.id : tempo.id),
+        scope: [...new Set(['openid', 'email', ...scopes])].join(' '),
+        url: url ?? (dev ? urls.dev : urls.production),
+    };
+}
+/** Where Tempo ID runs unless `create` receives a `url`. */
+const urls = {
+    dev: 'https://id.tehq.dev',
+    production: 'https://id.tempo.xyz',
+};
+//# sourceMappingURL=Auth.js.map

package/dist/client/Auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/client/Auth.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AAmCrD,0FAA0F;AAC1F,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,+BAA+B,CAAA;IAExD;QACE,KAAK,CACH,8HAA8H,CAC/H,CAAA;IACH,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,mBAAmB,CAAA;IAC5C,qEAAqE;IAC5D,IAAI,CAAQ;IACrB,oDAAoD;IAC3C,KAAK,CAAoB;IAClC,sGAAsG;IAC7F,IAAI,CAAuD;IACpE,mDAAmD;IAC1C,MAAM,CAAiC;IAChD;;;OAGG;IACM,QAAQ,CAAS;IAC1B,qFAAqF;IAC5E,MAAM,CAAQ;IACvB,wCAAwC;IAC/B,GAAG,CAAoB;IAEhC,YAAY,OAA6B;QACvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACxB,CAAC;CACF;AA8ED,6FAA6F;AAC7F,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,qBAAqB,CAAA;IAE9C;QACE,KAAK,CACH,mFAAmF,CACpF,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,KAAK,GAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IACxD,+FAA+F;IAC/F,mFAAmF;IACnF,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,EAAE,EACF;QACE,GAAG,CAAC,CAAC,EAAE,GAAG;YACR,IAAI,GAAG,KAAK,YAAY,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAA;YAC1C,IAAI,KAAK,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACzD,uFAAuF;YACvF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ;gBAC/D,OAAO,SAAS,CAAA;YAClB,MAAM,IAAI,cAAc,EAAE,CAAA;QAC5B,CAAC;QACD,wBAAwB,CAAC,CAAC,EAAE,GAAG;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YACpC,MAAM,UAAU,GAAG,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACvE,6EAA6E;YAC7E,OAAO,UAAU,IAAI,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;QAC5D,CAAC;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CACd,GAAG,KAAK,YAAY,CAAC,GAAG;YACxB,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CACF,CAAA;IACD,OAAO,KAAgB,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACxE,0FAA0F;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;KAC/C,CAAA;AACH,CAAC;AAwBD,4DAA4D;AAC5D,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,qBAAqB;IAC1B,UAAU,EAAE,sBAAsB;CAC1B,CAAA"}

package/dist/client/Authorization.d.ts

@@ -0,0 +1,29 @@
+/**
+ * What every sign-in returns: the app's tokens for Tempo APIs, its access key, and the user.
+ * @module
+ */
+import type * as Key from './Key.js';
+import type { Tokens } from './Tokens.js';
+import type { User } from './User.js';
+/**
+ * What every sign-in returns: the app's tokens for Tempo APIs, with its access key and the user.
+ * `chainId` is the key's chain, as a literal type when the sign-in's `permissions` named one.
+ */
+export type Authorization<chainId extends number = number> = Tokens & {
+    /** The user's Tempo Account, as a Viem account that signs with the app's access key. */
+    account: ReturnType<typeof Key.toAccount>;
+    /** The same key as data, for apps that store it and rebuild it with `Key.toAccount`. */
+    key: Key.Key<chainId>;
+    /** The signed-in user, from the ID token. */
+    user: User;
+};
+/**
+ * Instantiates a {@link Authorization}.
+ *
+ * @example
+ * ```ts
+ * const authorization = Authorization.from({ ...saved, account: Key.toAccount(saved.key) })
+ * ```
+ */
+export declare function from<chainId extends number = number>(value: Authorization<chainId>): Authorization<chainId>;
+//# sourceMappingURL=Authorization.d.ts.map

package/dist/client/Authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorization.d.ts","sourceRoot":"","sources":["../../src/client/Authorization.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAA;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG;IACpE,wFAAwF;IACxF,OAAO,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAA;IACzC,wFAAwF;IACxF,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrB,6CAA6C;IAC7C,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAClD,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAC5B,aAAa,CAAC,OAAO,CAAC,CAExB"}

package/dist/client/Authorization.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Authorization}.
+ *
+ * @example
+ * ```ts
+ * const authorization = Authorization.from({ ...saved, account: Key.toAccount(saved.key) })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Authorization.js.map

package/dist/client/Authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorization.js","sourceRoot":"","sources":["../../src/client/Authorization.ts"],"names":[],"mappings":"AAqBA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAA6B;IAE7B,OAAO,KAAK,CAAA;AACd,CAAC"}