@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/client/actions/email.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Signs the user in with a code emailed to them, from the app's own sign-in form.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * Emails the user a sign-in code. The response is the same for every address.
+ *
+ * @example
+ * ```ts
+ * await Actions.email.sendCode(auth, { email: 'user@example.com' })
+ * ```
+ */
+export declare function sendCode(auth: Auth, options: sendCode.Options): Promise<void>;
+export declare namespace sendCode {
+    type Options = {
+        /** The user's email address. */
+        email: string;
+    };
+}
+/**
+ * Signs the user in with the code they were emailed, then authorizes the app for the signed-in user.
+ * Only a first-party app authorizes this way. A sign-in with a key creates the user's first Tempo
+ * Account with `POST /v1/account`, then sends `POST /v1/authorize`. The key acts for the account
+ * `accessKey` names, or the app's selected account, or the user's oldest. With `key: false`, the
+ * call returns the tokens and the user alone.
+ *
+ * A refusal after the code verified throws a `RequestError` whose `signedIn` is `true`, since the
+ * user is signed in. A passkey-owned account throws `webauthn_required`, and
+ * `Actions.redirect.start` then authorizes the key on Tempo ID's pages.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.email.signIn(auth, { code, email })
+ * ```
+ */
+export declare function signIn<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options: signIn.Options<chainId, key>): Promise<signIn.ReturnType<chainId, key>>;
+export declare namespace signIn {
+    type Options<chainId extends number = number, key extends boolean = true> = {
+        /**
+         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
+         * defaults to the one the app selected, or the user's oldest. Defaults to a new key.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
+         * Tempo ID binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
+         * `tempo-id:sign` scope may send one, and only with a key.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /** The 6-digit code the user was emailed. */
+        code: string;
+        /** The address the code was sent to. */
+        email: string;
+        /**
+         * Runs the WebAuthn ceremony of the passkey that `link` names in place of
+         * `navigator.credentials.get`, as for `Actions.passkey.signIn`. Unused without `link`.
+         */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /**
+         * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
+         * to the user. The call first runs a ceremony of that passkey, whose assertion Tempo ID requires
+         * with the link.
+         */
+        link?: string | undefined;
+        /**
+         * Whether the sign-in authorizes an access key. With `false`, the call creates no Tempo
+         * Account, and returns the tokens and the user alone. Defaults to `true`.
+         */
+        key?: key | undefined;
+        /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /**
+     * The authorization, or the tokens and the user alone with `key: false`. A `boolean` `key`
+     * returns either.
+     */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = key extends false ? Omit<Authorization<chainId>, 'account' | 'key'> : Authorization<chainId>;
+}
+//# sourceMappingURL=email.d.ts.map

package/dist/client/actions/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/client/actions/email.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA4B,MAAM,YAAY,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,gCAAgC;QAChC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,MAAM,CAC1B,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GACpC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAmC1C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC1E;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;WAIG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE,6CAA6C;QAC7C,IAAI,EAAE,MAAM,CAAA;QACZ,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAA;QACb;;;WAGG;QACH,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD;;;;WAIG;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB;;;WAGG;QACH,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,6FAA6F;QAC7F,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED;;;OAGG;IACH,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IACxB,GAAG,SAAS,KAAK,GACjB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAC/C,aAAa,CAAC,OAAO,CAAC,CAAA;CAC3B"}

package/dist/client/actions/email.js

@@ -0,0 +1,63 @@
+/**
+ * Signs the user in with a code emailed to them, from the app's own sign-in form.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import { ChallengeWithoutKeyError } from '../Auth.js';
+import * as Api from '../internal/api.js';
+import * as Headless from '../internal/headless.js';
+/**
+ * Emails the user a sign-in code. The response is the same for every address.
+ *
+ * @example
+ * ```ts
+ * await Actions.email.sendCode(auth, { email: 'user@example.com' })
+ * ```
+ */
+export async function sendCode(auth, options) {
+    await Api.json(await Api.post(auth, '/v1/auth/code', { json: options }));
+}
+/**
+ * Signs the user in with the code they were emailed, then authorizes the app for the signed-in user.
+ * Only a first-party app authorizes this way. A sign-in with a key creates the user's first Tempo
+ * Account with `POST /v1/account`, then sends `POST /v1/authorize`. The key acts for the account
+ * `accessKey` names, or the app's selected account, or the user's oldest. With `key: false`, the
+ * call returns the tokens and the user alone.
+ *
+ * A refusal after the code verified throws a `RequestError` whose `signedIn` is `true`, since the
+ * user is signed in. A passkey-owned account throws `webauthn_required`, and
+ * `Actions.redirect.start` then authorizes the key on Tempo ID's pages.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.email.signIn(auth, { code, email })
+ * ```
+ */
+export async function signIn(auth, options) {
+    const { code, email, getFn, link } = options;
+    // A challenge rides in the key, so a sign-in without one refuses it before it signs in.
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    // The link's passkey signs again, so a page left at the email step links nothing for the next
+    // person, who cannot sign with it.
+    const assertion = await (async () => {
+        if (!link)
+            return undefined;
+        const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
+            json: { client_id: auth.clientId, link },
+        }));
+        const deserialized = Authentication.deserializeOptions(requested.options);
+        return Authentication.serializeResponse(await Authentication.sign(
+        // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+        getFn ? { ...deserialized, getFn } : deserialized));
+    })();
+    const { user } = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
+        json: { code, email, ...(link ? { assertion, link } : {}) },
+    }));
+    // `key` decides both the type and the runtime value of the result.
+    return (await Headless.authorize(auth, {
+        ...options,
+        userId: user.id,
+    }));
+}
+//# sourceMappingURL=email.js.map

package/dist/client/actions/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/client/actions/email.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AAExD,OAAO,EAAa,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AAGnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAU,EACV,OAAyB;IAEzB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAI1B,IAAU,EACV,OAAqC;IAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAC5C,wFAAwF;IACxF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,8FAA8F;IAC9F,mCAAmC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC3B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAG9B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE;YAC/C,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;SACzC,CAAC,CACH,CAAA;QACD,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACzE,OAAO,cAAc,CAAC,iBAAiB,CACrC,MAAM,cAAc,CAAC,IAAI;QACvB,qGAAqG;QACrG,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAY,CAAC,CAAC,CAAC,YAAY,CAC7D,CACF,CAAA;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,EAAE;QAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC5D,CAAC,CACH,CAAA;IAED,mEAAmE;IACnE,OAAO,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;QACrC,GAAG,OAAO;QACV,MAAM,EAAE,IAAI,CAAC,EAAE;KAChB,CAAC,CAAoC,CAAA;AACxC,CAAC"}

package/dist/client/actions/oauth.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Calls Tempo ID's standard OAuth endpoints for tokens an app already holds: introspection, the
+ * user's claims, and the signing keys that verify every token.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+import type { User } from '../User.js';
+/**
+ * Checks whether a token is still active at the issuer (RFC 7662). An API verifies access tokens
+ * locally against {@link jwks}, and calls this only where a revoked session must stop working at
+ * once. The instance's client secret authenticates the request, so only a backend calls it.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.oauth.introspect(auth, { token: accessToken })
+ * if (!result.active) return c.json({ error: 'Sign in again.' }, 401)
+ * ```
+ */
+export declare function introspect(auth: Auth, options: introspect.Options): Promise<introspect.ReturnType>;
+export declare namespace introspect {
+    type Options = {
+        /** The access token or refresh token to check. */
+        token: string;
+        /** The kind of token, which speeds up the issuer's lookup. */
+        tokenTypeHint?: 'access_token' | 'refresh_token' | undefined;
+    };
+    /** Whether the token is active, and the issuer's claims about an active one. */
+    type ReturnType = {
+        /** The token is expired, revoked, or was never issued. */
+        active: false;
+    } | {
+        /** The token is active. */
+        active: true;
+        /** The app the token was issued to. */
+        clientId: string | undefined;
+        /** When the token expires, in milliseconds. */
+        expiresAt: number | undefined;
+        /** When the token was issued, in milliseconds. */
+        issuedAt: number | undefined;
+        /** The scopes the token carries, space-separated. */
+        scope: string | undefined;
+        /** The user the token names, the `sub` of every token. */
+        userId: string | undefined;
+    };
+}
+/**
+ * Returns the issuer's JSON Web Key Set, whose keys verify every Tempo ID token. An API passes Tempo
+ * ID's `/oauth2/jwks` URL to a JWT library that caches the set and fetches it again for an unknown
+ * `kid`, such as jose's `createRemoteJWKSet`. An API that caches the set itself also fetches it again
+ * for an unknown `kid`, at most once in a cooldown, since a key rotation signs new tokens with a new
+ * key.
+ *
+ * @example
+ * ```ts
+ * import { createLocalJWKSet, errors, jwtVerify } from 'jose'
+ *
+ * let keys = createLocalJWKSet(await Actions.oauth.jwks(auth))
+ * let fetchedAt = Date.now()
+ * let refetch: Promise<void> | undefined
+ *
+ * async function verify(accessToken: string) {
+ *   try {
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   } catch (error) {
+ *     if (!(error instanceof errors.JWKSNoMatchingKey)) throw error
+ *     // A rotation adds a key. Concurrent failures share one fetch, and the cooldown bounds the
+ *     // fetches that forged `kid` values cause.
+ *     if (!refetch) {
+ *       if (Date.now() - fetchedAt < 30_000) throw error
+ *       fetchedAt = Date.now()
+ *       refetch = Actions.oauth
+ *         .jwks(auth)
+ *         .then((set) => {
+ *           keys = createLocalJWKSet(set)
+ *         })
+ *         .finally(() => {
+ *           refetch = undefined
+ *         })
+ *     }
+ *     await refetch
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   }
+ * }
+ *
+ * const { payload } = await verify(accessToken)
+ * // Every app's token carries the same audience, so an API also allows each app by `client_id`.
+ * if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
+ * ```
+ */
+export declare function jwks(auth: Auth): Promise<jwks.ReturnType>;
+export declare namespace jwks {
+    /** The key set, in RFC 7517's format, which JWT libraries read as is. */
+    type ReturnType = {
+        /** The issuer's signing keys. */
+        keys: JsonWebKey[];
+    };
+}
+/**
+ * Returns the user an access token names, from the issuer's UserInfo endpoint (OIDC Core §5.3).
+ * Access tokens carry no email, so an API that needs it calls this once per user.
+ *
+ * @example
+ * ```ts
+ * const user = await Actions.oauth.userInfo(auth, { accessToken })
+ * // { email: 'user@example.com', id: 'user_…' }
+ * ```
+ */
+export declare function userInfo(auth: Auth, options: userInfo.Options): Promise<User>;
+export declare namespace userInfo {
+    type Options = {
+        /** The access token, from any sign-in or refresh. */
+        accessToken: string;
+    };
+}
+//# sourceMappingURL=oauth.d.ts.map

package/dist/client/actions/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/client/actions/oauth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,UAAU,CAAC,OAAO,GAC1B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CA8BhC;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,OAAO,GAAG;QACb,kDAAkD;QAClD,KAAK,EAAE,MAAM,CAAA;QACb,8DAA8D;QAC9D,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAA;KAC7D,CAAA;IAED,gFAAgF;IAChF,KAAK,UAAU,GACX;QACE,0DAA0D;QAC1D,MAAM,EAAE,KAAK,CAAA;KACd,GACD;QACE,2BAA2B;QAC3B,MAAM,EAAE,IAAI,CAAA;QACZ,uCAAuC;QACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,+CAA+C;QAC/C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B,kDAAkD;QAClD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,qDAAqD;QACrD,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,0DAA0D;QAC1D,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;CACN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAI/D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,yEAAyE;IACzE,KAAK,UAAU,GAAG;QAChB,iCAAiC;QACjC,IAAI,EAAE,UAAU,EAAE,CAAA;KACnB,CAAA;CACF;AAED;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF"}

package/dist/client/actions/oauth.js

@@ -0,0 +1,105 @@
+import * as Api from '../internal/api.js';
+/**
+ * Checks whether a token is still active at the issuer (RFC 7662). An API verifies access tokens
+ * locally against {@link jwks}, and calls this only where a revoked session must stop working at
+ * once. The instance's client secret authenticates the request, so only a backend calls it.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.oauth.introspect(auth, { token: accessToken })
+ * if (!result.active) return c.json({ error: 'Sign in again.' }, 401)
+ * ```
+ */
+export async function introspect(auth, options) {
+    const { token, tokenTypeHint } = options;
+    const body = await Api.json(await (auth.fetch ?? fetch)(new URL('/oauth2/introspect', auth.url), {
+        body: new URLSearchParams({
+            client_id: auth.clientId,
+            ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
+            token,
+            ...(tokenTypeHint ? { token_type_hint: tokenTypeHint } : {}),
+        }),
+        method: 'POST',
+    }));
+    // An inactive token carries no other members (RFC 7662 §2.2).
+    if (!body.active)
+        return { active: false };
+    return {
+        active: true,
+        clientId: body.client_id,
+        expiresAt: body.exp === undefined ? undefined : body.exp * 1000,
+        issuedAt: body.iat === undefined ? undefined : body.iat * 1000,
+        scope: body.scope,
+        userId: body.sub,
+    };
+}
+/**
+ * Returns the issuer's JSON Web Key Set, whose keys verify every Tempo ID token. An API passes Tempo
+ * ID's `/oauth2/jwks` URL to a JWT library that caches the set and fetches it again for an unknown
+ * `kid`, such as jose's `createRemoteJWKSet`. An API that caches the set itself also fetches it again
+ * for an unknown `kid`, at most once in a cooldown, since a key rotation signs new tokens with a new
+ * key.
+ *
+ * @example
+ * ```ts
+ * import { createLocalJWKSet, errors, jwtVerify } from 'jose'
+ *
+ * let keys = createLocalJWKSet(await Actions.oauth.jwks(auth))
+ * let fetchedAt = Date.now()
+ * let refetch: Promise<void> | undefined
+ *
+ * async function verify(accessToken: string) {
+ *   try {
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   } catch (error) {
+ *     if (!(error instanceof errors.JWKSNoMatchingKey)) throw error
+ *     // A rotation adds a key. Concurrent failures share one fetch, and the cooldown bounds the
+ *     // fetches that forged `kid` values cause.
+ *     if (!refetch) {
+ *       if (Date.now() - fetchedAt < 30_000) throw error
+ *       fetchedAt = Date.now()
+ *       refetch = Actions.oauth
+ *         .jwks(auth)
+ *         .then((set) => {
+ *           keys = createLocalJWKSet(set)
+ *         })
+ *         .finally(() => {
+ *           refetch = undefined
+ *         })
+ *     }
+ *     await refetch
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   }
+ * }
+ *
+ * const { payload } = await verify(accessToken)
+ * // Every app's token carries the same audience, so an API also allows each app by `client_id`.
+ * if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
+ * ```
+ */
+export async function jwks(auth) {
+    return Api.json(await (auth.fetch ?? fetch)(new URL('/oauth2/jwks', auth.url)));
+}
+/**
+ * Returns the user an access token names, from the issuer's UserInfo endpoint (OIDC Core §5.3).
+ * Access tokens carry no email, so an API that needs it calls this once per user.
+ *
+ * @example
+ * ```ts
+ * const user = await Actions.oauth.userInfo(auth, { accessToken })
+ * // { email: 'user@example.com', id: 'user_…' }
+ * ```
+ */
+export async function userInfo(auth, options) {
+    const response = await (auth.fetch ?? fetch)(new URL('/oauth2/userinfo', auth.url), { headers: { authorization: `Bearer ${options.accessToken}` } });
+    // RFC 6750 §3 names a rejected bearer token `invalid_token`. The issuer's 401 body uses its own
+    // code, or none, so the refusal always carries the standard one.
+    if (response.status === 401)
+        throw Api.error({
+            error: 'invalid_token',
+            error_description: 'Invalid or expired access token. Refresh the tokens, or sign in again.',
+        }, { status: 401 });
+    const claims = await Api.json(response);
+    return { email: claims.email, id: claims.sub };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/client/actions/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/client/actions/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,OAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAQzB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACnE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,KAAK;YACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAA;IACD,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1C,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI;QAC/D,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI;QAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,GAAG;KACjB,CAAA;AACH,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU;IACnC,OAAO,GAAG,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAU,EACV,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAC1C,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,EACrC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,CAChE,CAAA;IACD,gGAAgG;IAChG,iEAAiE;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACzB,MAAM,GAAG,CAAC,KAAK,CACb;YACE,KAAK,EAAE,eAAe;YACtB,iBAAiB,EACf,wEAAwE;SAC3E,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAiC,QAAQ,CAAC,CAAA;IACvE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC"}

package/dist/client/actions/passkey.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Signs the user in with a passkey from the app's own sign-in form, and authorizes the app's key.
+ * By default the browser offers every passkey it holds for the relying party of the app's realms,
+ * so the app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * Signs the user in with a passkey, then authorizes the app for the signed-in user, as
+ * `Actions.email.signIn` does. Only a first-party app authorizes this way. The page's origin must
+ * be the origin of one of the app's redirect URIs, and the relying party of the app's realms must
+ * cover it, or the call throws `passkey_not_permitted`. A sign-in with a key
+ * creates the user's first Tempo Account with `POST /v1/account`, then sends `POST /v1/authorize`.
+ * With `key: false`, the call returns the tokens and the user alone.
+ *
+ * Returns the email step for a wallet.tempo passkey whose account has no email. The app then signs
+ * the user in with `Actions.email.signIn`, which takes the step's `link` and links the passkey once
+ * the passkey signs again.
+ *
+ * A refusal after the passkey verified throws a `RequestError` whose `signedIn` is `true`, since
+ * the user is signed in. A passkey-owned account throws `webauthn_required`, since a passkey signs a
+ * key only on a page that shows it, and `Actions.redirect.start` then authorizes the key on Tempo
+ * ID's pages.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.passkey.signIn(auth)
+ * if ('step' in result) showEmailForm()
+ * ```
+ */
+export declare function signIn<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options?: signIn.Options<chainId, key>): Promise<signIn.ReturnType<chainId, key>>;
+export declare namespace signIn {
+    type Options<chainId extends number = number, key extends boolean = true> = {
+        /**
+         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
+         * defaults to the one the app selected, or the user's oldest. Defaults to a new key.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
+         * Tempo ID binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
+         * `tempo-id:sign` scope may send one, and only with a key.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /**
+         * The credential ID, or up to 16 IDs, the browser offers. Each is unpadded base64url, as
+         * `PublicKeyCredential.id` reports it, of 1 to 1,023 bytes. A padded or otherwise non-canonical
+         * encoding throws a `RequestError` with reason `invalid_field`. Defaults to every passkey the
+         * browser holds for the relying party, as an empty list does.
+         */
+        credentialId?: readonly string[] | string | undefined;
+        /**
+         * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
+         * module. Its assertion must report the origin of the page that sends the requests, so an
+         * Android app's facet origin is refused.
+         */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** How the browser mediates the ceremony, such as `conditional` for passkey autofill. Defaults to the browser's own mediation. */
+        mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined;
+        /**
+         * Whether the sign-in authorizes an access key. With `false`, the call creates no Tempo
+         * Account, and returns the tokens and the user alone. Defaults to `true`.
+         */
+        key?: key | undefined;
+        /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /** The step a wallet.tempo passkey without an email needs: an emailed code, which links it. */
+    type EmailStep = {
+        /** Passed as `link` to `Actions.email.signIn`, which links the passkey to that user. */
+        link: string;
+        /** The kind of step. */
+        type: 'email';
+    };
+    /**
+     * The authorization, or the tokens and the user alone with `key: false`, or the email step of a
+     * wallet.tempo passkey without an email. A `boolean` `key` returns either authorization.
+     */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = (key extends false ? Omit<Authorization<chainId>, 'account' | 'key'> : Authorization<chainId>) | {
+        /** The email step to complete before the authorization. */
+        step: EmailStep;
+    };
+}
+//# sourceMappingURL=passkey.d.ts.map

package/dist/client/actions/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/client/actions/passkey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA4B,MAAM,YAAY,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,MAAM,CAC1B,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAM,GACzC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAmC1C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC1E;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;;WAIG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE;;;;;WAKG;QACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAA;QACrD;;;;WAIG;QACH,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD,kIAAkI;QAClI,SAAS,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAA;QAC1E;;;WAGG;QACH,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,6FAA6F;QAC7F,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED,+FAA+F;IAC/F,KAAK,SAAS,GAAG;QACf,wFAAwF;QACxF,IAAI,EAAE,MAAM,CAAA;QACZ,wBAAwB;QACxB,IAAI,EAAE,OAAO,CAAA;KACd,CAAA;IAED;;;OAGG;IACH,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IAExB,CAAC,GAAG,SAAS,KAAK,GACd,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAC/C,aAAa,CAAC,OAAO,CAAC,CAAC,GAC3B;QACE,2DAA2D;QAC3D,IAAI,EAAE,SAAS,CAAA;KAChB,CAAA;CACN"}

package/dist/client/actions/passkey.js

@@ -0,0 +1,60 @@
+/**
+ * Signs the user in with a passkey from the app's own sign-in form, and authorizes the app's key.
+ * By default the browser offers every passkey it holds for the relying party of the app's realms,
+ * so the app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import { ChallengeWithoutKeyError } from '../Auth.js';
+import * as Api from '../internal/api.js';
+import * as Headless from '../internal/headless.js';
+/**
+ * Signs the user in with a passkey, then authorizes the app for the signed-in user, as
+ * `Actions.email.signIn` does. Only a first-party app authorizes this way. The page's origin must
+ * be the origin of one of the app's redirect URIs, and the relying party of the app's realms must
+ * cover it, or the call throws `passkey_not_permitted`. A sign-in with a key
+ * creates the user's first Tempo Account with `POST /v1/account`, then sends `POST /v1/authorize`.
+ * With `key: false`, the call returns the tokens and the user alone.
+ *
+ * Returns the email step for a wallet.tempo passkey whose account has no email. The app then signs
+ * the user in with `Actions.email.signIn`, which takes the step's `link` and links the passkey once
+ * the passkey signs again.
+ *
+ * A refusal after the passkey verified throws a `RequestError` whose `signedIn` is `true`, since
+ * the user is signed in. A passkey-owned account throws `webauthn_required`, since a passkey signs a
+ * key only on a page that shows it, and `Actions.redirect.start` then authorizes the key on Tempo
+ * ID's pages.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.passkey.signIn(auth)
+ * if ('step' in result) showEmailForm()
+ * ```
+ */
+export async function signIn(auth, options = {}) {
+    const { credentialId, getFn, mediation } = options;
+    // A challenge rides in the key, so a sign-in without one refuses it before it signs in.
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
+        json: {
+            // The app's realms decide the relying party, which must cover the page's origin.
+            client_id: auth.clientId,
+            ...(credentialId === undefined ? {} : { credentialId }),
+            ...(mediation === undefined ? {} : { mediation }),
+        },
+    }));
+    const deserialized = Authentication.deserializeOptions(requested.options);
+    const assertion = Authentication.serializeResponse(await Authentication.sign(
+    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+    getFn ? { ...deserialized, getFn } : deserialized));
+    const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', { json: { assertion } }));
+    if ('step' in body)
+        return { step: { link: body.step.link, type: body.step.type } };
+    // `key` decides both the type and the runtime value of the result.
+    return (await Headless.authorize(auth, {
+        ...options,
+        userId: body.user.id,
+    }));
+}
+//# sourceMappingURL=passkey.js.map

package/dist/client/actions/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../../src/client/actions/passkey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AAExD,OAAO,EAAa,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AAGnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAI1B,IAAU,EACV,OAAO,GAAiC,EAAE;IAE1C,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAClD,wFAAwF;IACxF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAG9B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE;QAC/C,IAAI,EAAE;YACJ,iFAAiF;YACjF,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD;KACF,CAAC,CACH,CAAA;IACD,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,cAAc,CAAC,iBAAiB,CAChD,MAAM,cAAc,CAAC,IAAI;IACvB,qGAAqG;IACrG,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAY,CAAC,CAAC,CAAC,YAAY,CAC7D,CACF,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAEzB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3E,IAAI,MAAM,IAAI,IAAI;QAChB,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IAEjE,mEAAmE;IACnE,OAAO,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;QACrC,GAAG,OAAO;QACV,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;KACrB,CAAC,CAAoC,CAAA;AACxC,CAAC"}

package/dist/client/actions/provider.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Signs the user in to Tempo ID through an OAuth provider or an SSO connection, from the app's
+ * own sign-in buttons.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+import type { Provider } from '../Provider.js';
+/**
+ * Lists the OAuth providers Tempo ID offers, for an app that shows its own sign-in buttons.
+ *
+ * @example
+ * ```ts
+ * const providers = await Actions.provider.list(auth)
+ * // [{ id: 'google', name: 'Google' }]
+ * ```
+ */
+export declare function list(auth: Auth): Promise<list.ReturnType>;
+export declare namespace list {
+    type ReturnType = readonly {
+        /** The provider's short name, which `signIn` takes. */
+        id: Provider;
+        /** The name to show, such as `Google`. */
+        name: string;
+    }[];
+}
+/**
+ * Sends the browser to an OAuth provider, or to the SSO connection a `Step` names, and back to
+ * `returnTo` signed in to Tempo ID. Unlike `Actions.email.signIn`, it does not authorize the
+ * app: the app calls `Actions.authorize` once the browser returns.
+ *
+ * @example
+ * ```ts
+ * Actions.provider.signIn(auth, { provider: 'google' })
+ * ```
+ */
+export declare function signIn(auth: Auth, options: signIn.Options): void;
+export declare namespace signIn {
+    type Options = ({
+        /** The OAuth provider to sign in with, from `list`. */
+        provider: Provider;
+    } | {
+        /** The URL of a `Step`, such as the SSO connection an address requires. */
+        url: string;
+    }) & {
+        /** Where to return. Defaults to the current page. It must be on one of the app's origins. */
+        returnTo?: string | undefined;
+    };
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/client/actions/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/client/actions/provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;;;;;;GAQG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAK/D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,UAAU,GAAG,SAAS;QACzB,uDAAuD;QACvD,EAAE,EAAE,QAAQ,CAAA;QACZ,0CAA0C;QAC1C,IAAI,EAAE,MAAM,CAAA;KACb,EAAE,CAAA;CACJ;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAShE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG,CACX;QACE,uDAAuD;QACvD,QAAQ,EAAE,QAAQ,CAAA;KACnB,GACD;QACE,2EAA2E;QAC3E,GAAG,EAAE,MAAM,CAAA;KACZ,CACJ,GAAG;QACF,6FAA6F;QAC7F,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF"}

package/dist/client/actions/provider.js

@@ -0,0 +1,34 @@
+import * as Api from '../internal/api.js';
+/**
+ * Lists the OAuth providers Tempo ID offers, for an app that shows its own sign-in buttons.
+ *
+ * @example
+ * ```ts
+ * const providers = await Actions.provider.list(auth)
+ * // [{ id: 'google', name: 'Google' }]
+ * ```
+ */
+export async function list(auth) {
+    const { providers } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/auth/providers', auth.url)));
+    return providers;
+}
+/**
+ * Sends the browser to an OAuth provider, or to the SSO connection a `Step` names, and back to
+ * `returnTo` signed in to Tempo ID. Unlike `Actions.email.signIn`, it does not authorize the
+ * app: the app calls `Actions.authorize` once the browser returns.
+ *
+ * @example
+ * ```ts
+ * Actions.provider.signIn(auth, { provider: 'google' })
+ * ```
+ */
+export function signIn(auth, options) {
+    const url = 'url' in options
+        ? new URL(options.url)
+        : new URL(`/v1/auth/oauth/${options.provider}`, auth.url);
+    url.searchParams.set('return_to', options.returnTo ?? window.location.href);
+    // An account step after the sign-in lists the accounts of this app's realms.
+    url.searchParams.set('client_id', auth.clientId);
+    window.location.assign(url);
+}
+//# sourceMappingURL=provider.js.map

package/dist/client/actions/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/client/actions/provider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAGzC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU;IACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAClC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CACrE,CAAA;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,IAAU,EAAE,OAAuB;IACxD,MAAM,GAAG,GACP,KAAK,IAAI,OAAO;QACd,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACtB,CAAC,CAAC,IAAI,GAAG,CAAC,kBAAkB,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3E,6EAA6E;IAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC"}