@tempoxyz/id 0.0.0-stage → 0.0.0

package/dist/client/internal/api.d.ts

@@ -0,0 +1,106 @@
+import type { KeyAuthorization } from 'ox/tempo';
+import type { Account } from 'viem/tempo';
+import { type Auth, RequestError } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import * as Key from '../Key.js';
+import type { TempoAccount } from '../TempoAccount.js';
+import type { Tokens } from '../Tokens.js';
+import type { User } from '../User.js';
+/**
+ * Builds an authorization from what Tempo ID returned and the sign-in's key: the material the
+ * library generated, or the `accessKey` the app supplied. `chainId` is the chain the request named,
+ * which the key authorization repeats.
+ */
+export declare function authorization<chainId extends number = number>(body: Headless, options: {
+    accessKey?: Account.Account | undefined;
+    material: Key.Material;
+}): Authorization<chainId>;
+/** What the headless API returns for an authorization. */
+export type Headless = {
+    /** The Tempo Account the key acts for, present when the request asked for a key. */
+    account?: Key.Key['account'] | undefined;
+    /** The signed key authorization, in the node's RPC format, present when the request asked for a key. */
+    key_authorization?: KeyAuthorization.Rpc | undefined;
+    /** The tokens the sign-in issued, as the token endpoint returns them or already read into `Tokens`. */
+    tokens: TokenResponse | Tokens;
+};
+/** Reads a JSON response, and throws a {@link RequestError} for a refused request. */
+export declare function json<value = unknown>(response: Response): Promise<value>;
+/** An OAuth error response, with Tempo ID's extension members. */
+export type ErrorBody = {
+    /** The OAuth error code, which `reason` determines. */
+    error: string;
+    /** The fault and its fix. Its wording may change. */
+    error_description?: string | undefined;
+    /** The errors page, at the refusal's `reason`. */
+    error_uri?: string | undefined;
+    /** The request field at fault, as a dotted path. */
+    field?: string | undefined;
+    /** The values the refusal compared. Base units are decimal strings. */
+    meta?: Readonly<Record<string, number | string>> | undefined;
+    /** A stable name for the refusal. The issuer's own errors carry none. */
+    reason?: RequestError.Reason | undefined;
+};
+/** A {@link RequestError} from an OAuth error response, or from a refusal with no body. */
+export declare function error(body: Partial<ErrorBody>, options: {
+    status: number;
+}): RequestError;
+/** Posts JSON to Tempo ID's API with the session cookie. */
+export declare function post(auth: Auth, path: string, options: {
+    json: unknown;
+}): Promise<Response>;
+/** Calls Tempo ID's OAuth token endpoint with a standard OAuth form post, adding the client and any secret. */
+export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
+/** Reads the account's address, the type of its owner, which the API lists first, and its realm. */
+export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
+/** A Tempo Account as the API returns it, with the fields the package reads. */
+export type TempoAccountResponse = {
+    /** The account's address, the same on every Tempo chain. */
+    address: `0x${string}`;
+    /** The account's configuration, whose owners the API lists in order. */
+    config: {
+        /** The account's owners, each with the kind of key that holds it, such as `privy` or `webAuthn`. */
+        owners: readonly [{
+            type: string;
+        }, ...{
+            type: string;
+        }[]];
+    };
+    /** The realm the account belongs to, with its display name. */
+    realm: {
+        /** The realm ID: `default`, or one an app's settings name, such as `tempo-cash`. */
+        id: string;
+        /** The realm's display name, such as `Tempo Cash`. */
+        name: string;
+    };
+};
+/** What Tempo ID's token endpoint returns. Redeeming a redirect's code adds its key authorization. */
+export type TokenResponse = {
+    /** The access token, which authorizes the app's requests to its APIs. */
+    access_token: string;
+    /** The Tempo Account the key acts for, present with `key_authorization`. */
+    account?: Key.Key['account'] | undefined;
+    /** The access token's lifetime, in seconds. */
+    expires_in: number;
+    /** The OIDC ID token, which names the user. A refresh may omit it. */
+    id_token?: string | undefined;
+    /** The signed key authorization that the user approved with the code, if any. */
+    key_authorization?: KeyAuthorization.Rpc | undefined;
+    /** Exchanges for new tokens through `Actions.refresh`. It rotates on every refresh. */
+    refresh_token?: string | undefined;
+};
+/** Reads the signed-in user from the ID token of `tokens`, which every sign-in returns. */
+export declare function user(tokens: Tokens): User;
+/** Reads a token response into `Tokens`. */
+export declare function tokens(response: TokenResponse): Tokens;
+/**
+ * Rethrows an error that came after a sign-in's code or passkey verified as a {@link RequestError}
+ * marked `signedIn`, since the user is signed in. A failure without a response, such as a network
+ * error, has status 0 and the original error as its `cause`.
+ */
+export declare function signedIn(error: unknown): never;
+/** Reads what Tempo ID returned for an authorization without a key: the tokens and the user. */
+export declare function withoutKey(body: Headless): WithoutKey;
+/** What an authorization without a key returns: the tokens and the user. */
+export type WithoutKey = Omit<Authorization, 'account' | 'key'>;
+//# sourceMappingURL=api.d.ts.map

package/dist/client/internal/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/client/internal/api.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC3D,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE;IACP,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAA;CACvB,GACA,aAAa,CAAC,OAAO,CAAC,CAuBxB;AAED,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG;IACrB,oFAAoF;IACpF,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAA;IACxC,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,GAAG,SAAS,CAAA;IACpD,uGAAuG;IACvG,MAAM,EAAE,aAAa,GAAG,MAAM,CAAA;CAC/B,CAAA;AAED,sFAAsF;AACtF,wBAAsB,IAAI,CAAC,KAAK,GAAG,OAAO,EACxC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,KAAK,CAAC,CAMhB;AAED,kEAAkE;AAClE,MAAM,MAAM,SAAS,GAAG;IACtB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;IACb,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,uEAAuE;IACvE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC5D,yEAAyE;IACzE,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;CACzC,CAAA;AAED,2FAA2F;AAC3F,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,gBAa1E;AAED,4DAA4D;AAC5D,wBAAgB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,qBAOxE;AAED,+GAA+G;AAC/G,wBAAsB,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,0BAWnE;AAED,oGAAoG;AACpG,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CAMxE;AAED,gFAAgF;AAChF,MAAM,MAAM,oBAAoB,GAAG;IACjC,4DAA4D;IAC5D,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IACtB,wEAAwE;IACxE,MAAM,EAAE;QACN,oGAAoG;QACpG,MAAM,EAAE,SAAS,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,GAAG;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC,CAAA;KAC3D,CAAA;IACD,+DAA+D;IAC/D,KAAK,EAAE;QACL,oFAAoF;QACpF,EAAE,EAAE,MAAM,CAAA;QACV,sDAAsD;QACtD,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED,sGAAsG;AACtG,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAA;IACxC,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,GAAG,SAAS,CAAA;IACpD,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC,CAAA;AAED,2FAA2F;AAC3F,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKzC;AAED,4CAA4C;AAC5C,wBAAgB,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAOtD;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAoB9C;AAED,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAIrD;AAED,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,KAAK,CAAC,CAAA"}

package/dist/client/internal/api.js

@@ -0,0 +1,129 @@
+/**
+ * Calls Tempo ID's API, and reads its responses into what the actions return.
+ * @module
+ */
+import { Base64 } from 'ox';
+import { RequestError } from '../Auth.js';
+import * as Key from '../Key.js';
+/**
+ * Builds an authorization from what Tempo ID returned and the sign-in's key: the material the
+ * library generated, or the `accessKey` the app supplied. `chainId` is the chain the request named,
+ * which the key authorization repeats.
+ */
+export function authorization(body, options) {
+    const { accessKey, material } = options;
+    // A response to a request with a key always carries one, so its absence is a fault.
+    if (!body.account || !body.key_authorization)
+        throw new RequestError({
+            code: 'server_error',
+            message: 'Missing key authorization in the response to a request with a key. Sign in again.',
+            status: 200,
+        });
+    const key = Key.from({
+        ...material,
+        account: body.account,
+        keyAuthorization: body.key_authorization,
+    });
+    const tokens_ = 'accessToken' in body.tokens ? body.tokens : tokens(body.tokens);
+    return {
+        ...tokens_,
+        account: Key.toAccount(key, { accessKey }),
+        key,
+        user: user(tokens_),
+    };
+}
+/** Reads a JSON response, and throws a {@link RequestError} for a refused request. */
+export async function json(response) {
+    // Some refusals, such as the CSRF check's, return plain text.
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok)
+        throw error(body, { status: response.status });
+    return body;
+}
+/** A {@link RequestError} from an OAuth error response, or from a refusal with no body. */
+export function error(body, options) {
+    return new RequestError({
+        code: body.error ?? 'server_error',
+        field: body.field,
+        message: body.error_description ??
+            body.error ??
+            `Request failed with status ${options.status}.`,
+        meta: body.meta,
+        reason: body.reason,
+        status: options.status,
+        uri: body.error_uri,
+    });
+}
+/** Posts JSON to Tempo ID's API with the session cookie. */
+export function post(auth, path, options) {
+    return (auth.fetch ?? fetch)(new URL(path, auth.url), {
+        body: JSON.stringify(options.json),
+        credentials: 'include',
+        headers: { 'content-type': 'application/json' },
+        method: 'POST',
+    });
+}
+/** Calls Tempo ID's OAuth token endpoint with a standard OAuth form post, adding the client and any secret. */
+export async function token(auth, body) {
+    return json(await (auth.fetch ?? fetch)(new URL('/oauth2/token', auth.url), {
+        body: new URLSearchParams({
+            ...body,
+            client_id: auth.clientId,
+            ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
+        }),
+        method: 'POST',
+    }));
+}
+/** Reads the account's address, the type of its owner, which the API lists first, and its realm. */
+export function tempoAccount(account) {
+    return {
+        address: account.address,
+        owner: account.config.owners[0].type,
+        realm: { id: account.realm.id, name: account.realm.name },
+    };
+}
+/** Reads the signed-in user from the ID token of `tokens`, which every sign-in returns. */
+export function user(tokens) {
+    const claims = JSON.parse(Base64.toString(tokens.idToken.split('.')[1]));
+    return { email: claims.email, id: claims.sub };
+}
+/** Reads a token response into `Tokens`. */
+export function tokens(response) {
+    return {
+        accessToken: response.access_token,
+        expiresAt: Date.now() + response.expires_in * 1000,
+        idToken: response.id_token,
+        refreshToken: response.refresh_token,
+    };
+}
+/**
+ * Rethrows an error that came after a sign-in's code or passkey verified as a {@link RequestError}
+ * marked `signedIn`, since the user is signed in. A failure without a response, such as a network
+ * error, has status 0 and the original error as its `cause`.
+ */
+export function signedIn(error) {
+    if (!(error instanceof RequestError))
+        throw new RequestError({
+            cause: error,
+            code: 'server_error',
+            message: 'Authorization failed after the sign-in, with no response from Tempo ID. The user is signed in, so authorize again.',
+            signedIn: true,
+            status: 0,
+        });
+    throw new RequestError({
+        code: error.code,
+        field: error.field,
+        message: error.message,
+        meta: error.meta,
+        reason: error.reason,
+        signedIn: true,
+        status: error.status,
+        uri: error.uri,
+    });
+}
+/** Reads what Tempo ID returned for an authorization without a key: the tokens and the user. */
+export function withoutKey(body) {
+    const tokens_ = 'accessToken' in body.tokens ? body.tokens : tokens(body.tokens);
+    return { ...tokens_, user: user(tokens_) };
+}
+//# sourceMappingURL=api.js.map

package/dist/client/internal/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/client/internal/api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAG3B,OAAO,EAAa,YAAY,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAKhC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAc,EACd,OAGC;IAED,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACvC,oFAAoF;IACpF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAC1C,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,mFAAmF;YACrF,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAU;QAC5B,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;KACzC,CAAC,CAAA;IACF,MAAM,OAAO,GACX,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;QAC1C,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;KACpB,CAAA;AACH,CAAC;AAYD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,QAAkB;IAElB,8DAA8D;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CACjC,CAAA;IACpB,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,OAAO,IAAI,CAAA;AACb,CAAC;AAkBD,2FAA2F;AAC3F,MAAM,UAAU,KAAK,CAAC,IAAwB,EAAE,OAA2B;IACzE,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EACL,IAAI,CAAC,iBAAiB;YACtB,IAAI,CAAC,KAAK;YACV,8BAA8B,OAAO,CAAC,MAAM,GAAG;QACjD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,IAAI,CAAC,SAAS;KACpB,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,IAAI,CAAC,IAAU,EAAE,IAAY,EAAE,OAA0B;IACvE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,MAAM,EAAE,MAAM;KACf,CAAC,CAAA;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAU,EAAE,IAA4B;IAClE,OAAO,IAAI,CACT,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAC9D,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,GAAG,IAAI;YACP,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAA;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,OAA6B;IACxD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACpC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;KAC1D,CAAA;AACH,CAAC;AAoCD,2FAA2F;AAC3F,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CACd,CAAA;IACnC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,MAAM,CAAC,QAAuB;IAC5C,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAClD,OAAO,EAAE,QAAQ,CAAC,QAAQ;QAC1B,YAAY,EAAE,QAAQ,CAAC,aAAa;KACrC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC;YACrB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,oHAAoH;YACtH,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,CAAC;SACV,CAAC,CAAA;IACJ,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAA;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,OAAO,GACX,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAA;AAC5C,CAAC"}

package/dist/client/internal/headless.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Authorizes the app for the user whom a headless sign-in just signed in, for `Actions.email.signIn`
+ * and `Actions.passkey.signIn`.
+ * @module
+ */
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+import * as Api from './api.js';
+/**
+ * Sends `POST /v1/account`, which creates the user's first Tempo Account and returns the existing
+ * ones unchanged, then `POST /v1/authorize`. A sign-in without a key needs no account, so it sends
+ * the authorization alone. Each refusal is marked `signedIn`, since the user is signed in. An
+ * authorization for another user than `userId` throws `session_changed`, since another sign-in
+ * replaced the session in between.
+ */
+export declare function authorize(auth: Auth, options: authorize.Options): Promise<Authorization | Api.WithoutKey>;
+export declare namespace authorize {
+    type Options = {
+        /** The key to authorize. Defaults to a new key. */
+        accessKey?: Account.Account | undefined;
+        /** A message the key's witness binds. */
+        challenge?: string | undefined;
+        /** Whether the sign-in authorizes an access key. Defaults to `true`. */
+        key?: boolean | undefined;
+        /** What the key may do. */
+        permissions?: Permissions | undefined;
+        /** The ID of the user whom the sign-in verified. */
+        userId: string;
+    };
+}
+//# sourceMappingURL=headless.d.ts.map

package/dist/client/internal/headless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.d.ts","sourceRoot":"","sources":["../../../src/client/internal/headless.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAAgB,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAG/B;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,CAAC,OAAO,GACzB,OAAO,CAAC,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,CAsCzC;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,mDAAmD;QACnD,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC,yCAAyC;QACzC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,wEAAwE;QACxE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,2BAA2B;QAC3B,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;QACrC,oDAAoD;QACpD,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF"}

package/dist/client/internal/headless.js

@@ -0,0 +1,46 @@
+import { RequestError } from '../Auth.js';
+import * as AccessKey from './accessKey.js';
+import * as Api from './api.js';
+import { request } from './request.js';
+/**
+ * Sends `POST /v1/account`, which creates the user's first Tempo Account and returns the existing
+ * ones unchanged, then `POST /v1/authorize`. A sign-in without a key needs no account, so it sends
+ * the authorization alone. Each refusal is marked `signedIn`, since the user is signed in. An
+ * authorization for another user than `userId` throws `session_changed`, since another sign-in
+ * replaced the session in between.
+ */
+export async function authorize(auth, options) {
+    const { challenge, permissions } = options;
+    // The user is signed in already, so every failure from here on, key generation included, is marked.
+    try {
+        const key = options.key === false
+            ? undefined
+            : await AccessKey.resolve(options.accessKey);
+        if (key)
+            await Api.json(await Api.post(auth, '/v1/account', {
+                json: { client_id: auth.clientId },
+            }));
+        const body = await Api.json(await Api.post(auth, '/v1/authorize', {
+            json: request(auth, {
+                accessKey: key?.accessKey,
+                challenge,
+                permissions,
+            }),
+        }));
+        const authorization = key
+            ? Api.authorization(body, key)
+            : Api.withoutKey(body);
+        if (authorization.user.id !== options.userId)
+            throw new RequestError({
+                code: 'invalid_request',
+                message: 'Session changed: another sign-in replaced this one before the authorization. Sign in again.',
+                reason: 'session_changed',
+                status: 409,
+            });
+        return authorization;
+    }
+    catch (error) {
+        return Api.signedIn(error);
+    }
+}
+//# sourceMappingURL=headless.js.map

package/dist/client/internal/headless.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.js","sourceRoot":"","sources":["../../../src/client/internal/headless.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,YAAY,EAAE,MAAM,YAAY,CAAA;AAGpD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAU,EACV,OAA0B;IAE1B,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC1C,oGAAoG;IACpG,IAAI,CAAC;QACH,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,GAAG;YACL,MAAM,GAAG,CAAC,IAAI,CACZ,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE;gBAClC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnC,CAAC,CACH,CAAA;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CACzB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBAClB,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,SAAS;gBACT,WAAW;aACZ,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,aAAa,GAAG,GAAG;YACvB,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM;YAC1C,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,6FAA6F;gBAC/F,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,GAAG;aACZ,CAAC,CAAA;QACJ,OAAO,aAAa,CAAA;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC"}

package/dist/client/internal/indexedDb.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The default `storage` in a browser: IndexedDB, which keeps a non-extractable `CryptoKey` without
+ * exporting it.
+ * @module
+ */
+import type { Storage } from '../Storage.js';
+/** Opens a store in the page's IndexedDB. */
+export declare function create(): Storage;
+//# sourceMappingURL=indexedDb.d.ts.map

package/dist/client/internal/indexedDb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDb.d.ts","sourceRoot":"","sources":["../../../src/client/internal/indexedDb.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,6CAA6C;AAC7C,wBAAgB,MAAM,IAAI,OAAO,CAgChC"}

package/dist/client/internal/indexedDb.js

@@ -0,0 +1,32 @@
+/** Opens a store in the page's IndexedDB. */
+export function create() {
+    const database = new Promise((resolve, reject) => {
+        const request = indexedDB.open('tempo-id');
+        request.onupgradeneeded = () => request.result.createObjectStore(store);
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+    /** Runs one request against the store, and resolves with its result. */
+    async function run(mode, fn) {
+        const objectStore = (await database)
+            .transaction(store, mode)
+            .objectStore(store);
+        return new Promise((resolve, reject) => {
+            const request = fn(objectStore);
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+        });
+    }
+    return {
+        getItem: (key) => run('readonly', (objectStore) => objectStore.get(key)),
+        async removeItem(key) {
+            await run('readwrite', (objectStore) => objectStore.delete(key));
+        },
+        async setItem(key, value) {
+            await run('readwrite', (objectStore) => objectStore.put(value, key));
+        },
+    };
+}
+/** The object store that holds every value. */
+const store = 'store';
+//# sourceMappingURL=indexedDb.js.map

package/dist/client/internal/indexedDb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDb.js","sourceRoot":"","sources":["../../../src/client/internal/indexedDb.ts"],"names":[],"mappings":"AAOA,6CAA6C;AAC7C,MAAM,UAAU,MAAM;IACpB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1C,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACvE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,wEAAwE;IACxE,KAAK,UAAU,GAAG,CAChB,IAAwB,EACxB,EAAsD;QAEtD,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC;aACjC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;aACxB,WAAW,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,CAAA;YAC/B,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxE,KAAK,CAAC,UAAU,CAAC,GAAG;YAClB,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAClE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK;YACtB,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QACtE,CAAC;KACF,CAAA;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,KAAK,GAAG,OAAO,CAAA"}

package/dist/client/internal/request.d.ts

@@ -0,0 +1,58 @@
+import type { Account } from 'viem/tempo';
+import type { Auth } from '../Auth.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * The authorization request, with the key authorization request when the sign-in requests a key, in
+ * Tempo ID's wire format.
+ */
+export declare function request(auth: Auth, options: {
+    /** The key to authorize. Without one, the request carries no key authorization. */
+    accessKey?: Account.Account | undefined;
+    /** The user's Tempo Account the key acts for, in place of the one `accessKey` names. */
+    account?: `0x${string}` | undefined;
+    /** A message the key's witness binds. */
+    challenge?: string | undefined;
+    permissions?: Permissions | undefined;
+}): {
+    challenge?: string;
+    client_id: string;
+    key_authorization?: {
+        account?: `0x${string}`;
+        address: `0x${string}`;
+        chainId: `0x${string}`;
+        expiry: number | undefined;
+        keyType: "p256" | "secp256k1" | "webAuthn";
+        limits: {
+            limit: `0x${string}`;
+            period?: number;
+            token: `0x${string}`;
+        }[] | undefined;
+        scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
+    };
+    redirect_uri: string;
+    scope: string;
+};
+/**
+ * The key authorization request, in Tempo ID's wire format. An access key account names its Tempo
+ * Account through `access`, and a plain key leaves it to Tempo ID.
+ */
+export declare function keyAuthorization(auth: Auth, options: {
+    /** The key to authorize. */
+    accessKey: Account.Account;
+    /** The user's Tempo Account the key acts for, in place of the one `accessKey` names. */
+    account?: `0x${string}` | undefined;
+    permissions?: Permissions | undefined;
+}): {
+    account?: `0x${string}`;
+    address: `0x${string}`;
+    chainId: `0x${string}`;
+    expiry: number | undefined;
+    keyType: "p256" | "secp256k1" | "webAuthn";
+    limits: {
+        limit: `0x${string}`;
+        period?: number;
+        token: `0x${string}`;
+    }[] | undefined;
+    scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
+};
+//# sourceMappingURL=request.d.ts.map

package/dist/client/internal/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/client/internal/request.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,OAAO,CACrB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;IACP,mFAAmF;IACnF,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,wFAAwF;IACxF,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;IACnC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CACtC;;;;;;;;;;;;;;;;;;EAaF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;IACP,4BAA4B;IAC5B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;IAC1B,wFAAwF;IACxF,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;IACnC,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CACtC;;;;;;;;;;;;EAmBF"}

package/dist/client/internal/request.js

@@ -0,0 +1,45 @@
+/**
+ * Builds the authorization and key authorization requests the actions send, in Tempo ID's wire
+ * format. The root type check holds them to Tempo ID's routes.
+ * @module
+ */
+import { Hex } from 'ox';
+/**
+ * The authorization request, with the key authorization request when the sign-in requests a key, in
+ * Tempo ID's wire format.
+ */
+export function request(auth, options) {
+    const { accessKey, challenge } = options;
+    return {
+        ...(challenge === undefined ? {} : { challenge }),
+        client_id: auth.clientId,
+        ...(accessKey
+            ? { key_authorization: keyAuthorization(auth, { ...options, accessKey }) }
+            : {}),
+        redirect_uri: auth.redirectUri ?? `${globalThis.location?.origin ?? auth.url}/`,
+        scope: auth.scope,
+    };
+}
+/**
+ * The key authorization request, in Tempo ID's wire format. An access key account names its Tempo
+ * Account through `access`, and a plain key leaves it to Tempo ID.
+ */
+export function keyAuthorization(auth, options) {
+    const { accessKey, permissions = {} } = options;
+    const account = options.account ??
+        (accessKey.accessKeyAddress ? accessKey.address : undefined);
+    return {
+        ...(account ? { account } : {}),
+        address: accessKey.accessKeyAddress ?? accessKey.address,
+        chainId: Hex.fromNumber(permissions.chainId ?? auth.chainId),
+        expiry: permissions.expiry,
+        keyType: accessKey.keyType,
+        limits: permissions.limits?.map(({ limit, period, token }) => ({
+            limit: Hex.fromNumber(limit),
+            ...(period ? { period } : {}),
+            token,
+        })),
+        scopes: permissions.scopes,
+    };
+}
+//# sourceMappingURL=request.js.map

package/dist/client/internal/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/client/internal/request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,IAAI,CAAA;AAKxB;;;GAGG;AACH,MAAM,UAAU,OAAO,CACrB,IAAU,EACV,OAQC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACxC,OAAO;QACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,GAAG,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EACV,IAAI,CAAC,WAAW,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,GAAG,GAAG;QACnE,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAU,EACV,OAMC;IAED,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,OAAO,CAAA;IAC/C,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9D,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,CAAC,gBAAgB,IAAI,SAAS,CAAC,OAAO;QACxD,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAC5D,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,KAAK;SACN,CAAC,CAAC;QACH,MAAM,EAAE,WAAW,CAAC,MAAM;KAC3B,CAAA;AACH,CAAC"}

package/dist/client/internal/store.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Resolves where actions keep state across page loads: the instance's `storage`, or IndexedDB.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+import type { Storage } from '../Storage.js';
+/**
+ * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
+ * when the instance names no `storage`.
+ */
+export declare function get(auth: Auth): Storage | undefined;
+//# sourceMappingURL=store.d.ts.map

package/dist/client/internal/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/client/internal/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAM5C;;;GAGG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,IAAI,uBAI7B"}

package/dist/client/internal/store.js

@@ -0,0 +1,15 @@
+import * as IndexedDb from './indexedDb.js';
+/** The default `storage`, opened on first use. */
+let indexedDb;
+/**
+ * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
+ * when the instance names no `storage`.
+ */
+export function get(auth) {
+    if (auth.storage)
+        return auth.storage;
+    if (typeof indexedDB === 'undefined')
+        return undefined;
+    return (indexedDb ??= IndexedDb.create());
+}
+//# sourceMappingURL=store.js.map

package/dist/client/internal/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/client/internal/store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C,kDAAkD;AAClD,IAAI,SAA8B,CAAA;AAElC;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAA;IACrC,IAAI,OAAO,SAAS,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IACtD,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3C,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The client for apps that sign users in through Tempo ID. It returns Viem access key accounts on
+ * their Tempo Accounts, and imports nothing from the server code.
+ * @module
+ */
+export * as Actions from './client/Actions.js';
+export * as Auth from './client/Auth.js';
+export * as Authorization from './client/Authorization.js';
+export * as Decorator from './client/Decorator.js';
+export { tempoId } from './client/Decorator.js';
+export * as Key from './client/Key.js';
+export * as Pending from './client/Pending.js';
+export * as Permissions from './client/Permissions.js';
+export * as Provider from './client/Provider.js';
+export * as Step from './client/Step.js';
+export * as Storage from './client/Storage.js';
+export * as TempoAccount from './client/TempoAccount.js';
+export * as Tokens from './client/Tokens.js';
+export * as User from './client/User.js';
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA;AACxC,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAA;AACtD,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAA;AAChD,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA;AACxC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAA;AAC5C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA"}

package/dist/client.js

@@ -0,0 +1,20 @@
+/**
+ * The client for apps that sign users in through Tempo ID. It returns Viem access key accounts on
+ * their Tempo Accounts, and imports nothing from the server code.
+ * @module
+ */
+export * as Actions from './client/Actions.js';
+export * as Auth from './client/Auth.js';
+export * as Authorization from './client/Authorization.js';
+export * as Decorator from './client/Decorator.js';
+export { tempoId } from './client/Decorator.js';
+export * as Key from './client/Key.js';
+export * as Pending from './client/Pending.js';
+export * as Permissions from './client/Permissions.js';
+export * as Provider from './client/Provider.js';
+export * as Step from './client/Step.js';
+export * as Storage from './client/Storage.js';
+export * as TempoAccount from './client/TempoAccount.js';
+export * as Tokens from './client/Tokens.js';
+export * as User from './client/User.js';
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA;AACxC,OAAO,KAAK,aAAa,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAA;AACtD,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAA;AAChD,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA;AACxC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,0BAA0B,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAA;AAC5C,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Types that Tempo ID's client, server, and admin entry points share. The entry points arrive in the
+ * phases of `.agents/plans/rewrite.md`.
+ * @module
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAA"}

package/dist/index.js

@@ -0,0 +1,7 @@
+/**
+ * Types that Tempo ID's client, server, and admin entry points share. The entry points arrive in the
+ * phases of `.agents/plans/rewrite.md`.
+ * @module
+ */
+export {};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAA"}