@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/Validation.d.ts

@@ -0,0 +1,52 @@
+/** Turns a failed request validation into an `invalid_field` refusal that names each field. @module */
+import * as ErrorResponse from './ErrorResponse.js';
+declare const InvalidFieldError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "invalid_field";
+        };
+    };
+    readonly reason: "invalid_field";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** A field is missing or malformed. Names each field the issues refused, with what it expects. `field` is the first. */
+export declare class InvalidFieldError extends InvalidFieldError_base {
+    readonly name = "Validation.InvalidFieldError";
+    constructor(options: InvalidFieldError.Options);
+}
+export declare namespace InvalidFieldError {
+    type Options = {
+        /** The issues validation reported. */
+        issues: readonly Issue[];
+    };
+    /** A Standard Schema issue, as Zod and Hono's validators report it. */
+    type Issue = {
+        /** The validator's description of the problem. */
+        message: string;
+        /** The segments from the input's root to the refused value. Absent for the root itself. */
+        path?: readonly (PropertyKey | {
+            /** The segment's property key. */
+            key: PropertyKey;
+        })[] | undefined;
+    };
+}
+export {};
+//# sourceMappingURL=Validation.d.ts.map

package/dist/internal/Validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.d.ts","sourceRoot":"","sources":["../../src/internal/Validation.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEnD,wHAAwH;AACxH,qBAAa,iBAAkB,SAAQ,sBAAqC;IAC1E,SAAkB,IAAI,kCAAiC;IAEvD,YAAY,OAAO,EAAE,iBAAiB,CAAC,OAAO,EAW7C;CACF;AAED,MAAM,CAAC,OAAO,WAAW,iBAAiB,CAAC;IACzC,KAAK,OAAO,GAAG;QACb,sCAAsC;QACtC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;KACzB,CAAA;IAED,uEAAuE;IACvE,KAAK,KAAK,GAAG;QACX,kDAAkD;QAClD,OAAO,EAAE,MAAM,CAAA;QACf,2FAA2F;QAC3F,IAAI,CAAC,EACD,SAAS,CACL,WAAW,GACX;YACE,kCAAkC;YAClC,GAAG,EAAE,WAAW,CAAA;SACjB,CACJ,EAAE,GACH,SAAS,CAAA;KACd,CAAA;CACF"}

package/dist/internal/Validation.js

@@ -0,0 +1,22 @@
+/** Turns a failed request validation into an `invalid_field` refusal that names each field. @module */
+import * as ErrorResponse from './ErrorResponse.js';
+/** A field is missing or malformed. Names each field the issues refused, with what it expects. `field` is the first. */
+export class InvalidFieldError extends ErrorResponse.define('invalid_field') {
+    name = 'Validation.InvalidFieldError';
+    constructor(options) {
+        const { issues } = options;
+        super({
+            error_description: `Invalid request. ${issues
+                .map((issue) => `${path(issue) ? `\`${path(issue)}\`` : 'Body'}: ${issue.message}.`)
+                .join(' ')}`,
+            field: issues[0] && path(issues[0]) ? path(issues[0]) : undefined,
+        });
+    }
+}
+/** The dotted path of the field `issue` refused. */
+function path(issue) {
+    return (issue.path ?? [])
+        .map((segment) => typeof segment === 'object' ? String(segment.key) : String(segment))
+        .join('.');
+}
+//# sourceMappingURL=Validation.js.map

package/dist/internal/Validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.js","sourceRoot":"","sources":["../../src/internal/Validation.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,wHAAwH;AACxH,MAAM,OAAO,iBAAkB,SAAQ,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;IACxD,IAAI,GAAG,8BAA8B,CAAA;IAEvD,YAAY,OAAkC;QAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,KAAK,CAAC;YACJ,iBAAiB,EAAE,oBAAoB,MAAM;iBAC1C,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,GAAG,CACtE;iBACA,IAAI,CAAC,GAAG,CAAC,EAAE;YACd,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC,CAAA;IACJ,CAAC;CACF;AAyBD,oDAAoD;AACpD,SAAS,IAAI,CAAC,KAA8B;IAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACpE;SACA,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/internal/Verification.d.ts

@@ -0,0 +1,24 @@
+import type * as Realm from './Realm.js';
+/**
+ * Stores a record with `identifier` and `value` until `expiresAt`, unless an unexpired record holds
+ * `identifier` or one of `others`, and returns whether it stored the record. The record's ID is its
+ * identifier, so two concurrent claims of one identifier conflict on the primary key, and only one
+ * stores it. A claim replaces an expired record under the same ID. The check also reads records
+ * with another ID, such as random ones, but a record with another ID that commits during the
+ * statement can escape the check. A caller that writes those concurrently holds a lock around the
+ * claim.
+ */
+export declare function claim(db: Realm.Database, options: claim.Options): Promise<boolean>;
+export declare namespace claim {
+    type Options = {
+        /** When the record expires. */
+        expiresAt: Date;
+        /** The record's identifier, which is also its ID. */
+        identifier: string;
+        /** Other identifiers whose unexpired record also prevents the claim. Default: none. */
+        others?: readonly string[] | undefined;
+        /** The record's value, a JSON string. */
+        value: string;
+    };
+}
+//# sourceMappingURL=Verification.d.ts.map

package/dist/internal/Verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Verification.d.ts","sourceRoot":"","sources":["../../src/internal/Verification.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAExC;;;;;;;;GAQG;AACH,wBAAsB,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,oBA0BrE;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,+BAA+B;QAC/B,SAAS,EAAE,IAAI,CAAA;QACf,qDAAqD;QACrD,UAAU,EAAE,MAAM,CAAA;QAClB,uFAAuF;QACvF,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QACtC,yCAAyC;QACzC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF"}

package/dist/internal/Verification.js

@@ -0,0 +1,37 @@
+/**
+ * Writes the single-use records that Tempo ID keeps in Better Auth's `verification` table, such as a
+ * spent request or a pending key challenge. One statement checks and writes each record.
+ * @module
+ */
+import { and, gt, inArray, lte, sql } from 'drizzle-orm';
+import * as Schema from '../app/db/schema.js';
+/**
+ * Stores a record with `identifier` and `value` until `expiresAt`, unless an unexpired record holds
+ * `identifier` or one of `others`, and returns whether it stored the record. The record's ID is its
+ * identifier, so two concurrent claims of one identifier conflict on the primary key, and only one
+ * stores it. A claim replaces an expired record under the same ID. The check also reads records
+ * with another ID, such as random ones, but a record with another ID that commits during the
+ * statement can escape the check. A caller that writes those concurrently holds a lock around the
+ * claim.
+ */
+export async function claim(db, options) {
+    const { expiresAt, identifier, others = [], value } = options;
+    const now = new Date();
+    const unspent = db
+        .select({ id: Schema.verification.id })
+        .from(Schema.verification)
+        .where(and(inArray(Schema.verification.identifier, [identifier, ...others]), gt(Schema.verification.expiresAt, now)));
+    const [row] = await db
+        .insert(Schema.verification)
+        // An insert from a query lists every column in the table's order: `created_at`, `expires_at`,
+        // `id`, `identifier`, `updated_at`, and `value`. Timestamps are UTC, as the columns store them.
+        .select(sql `select ${now.toISOString()}::timestamp, ${expiresAt.toISOString()}::timestamp, ${identifier}, ${identifier}, ${now.toISOString()}::timestamp, ${value} where not exists (${unspent})`)
+        .onConflictDoUpdate({
+        set: { createdAt: now, expiresAt, updatedAt: now, value },
+        setWhere: lte(Schema.verification.expiresAt, now),
+        target: Schema.verification.id,
+    })
+        .returning({ id: Schema.verification.id });
+    return row !== undefined;
+}
+//# sourceMappingURL=Verification.js.map

package/dist/internal/Verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Verification.js","sourceRoot":"","sources":["../../src/internal/Verification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAG7C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAkB,EAAE,OAAsB;IACpE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,OAAO,GAAG,EAAE;SACf,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;SACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC,EAChE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CACvC,CACF,CAAA;IACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC5B,8FAA8F;QAC9F,gGAAgG;SAC/F,MAAM,CACL,GAAG,CAAA,UAAU,GAAG,CAAC,WAAW,EAAE,gBAAgB,SAAS,CAAC,WAAW,EAAE,gBAAgB,UAAU,KAAK,UAAU,KAAK,GAAG,CAAC,WAAW,EAAE,gBAAgB,KAAK,sBAAsB,OAAO,GAAG,CAC1L;SACA,kBAAkB,CAAC;QAClB,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;QACzD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC;QACjD,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;KAC/B,CAAC;SACD,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5C,OAAO,GAAG,KAAK,SAAS,CAAA;AAC1B,CAAC"}

package/dist/internal/Wallet.d.ts

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+/** The part of wallet.tempo's `Credentials` entrypoint that Tempo ID calls. */
+export type Service = {
+    /** Returns the passkey with `credentialId`, or `undefined` when wallet.tempo stores none. */
+    credential(options: {
+        credentialId: string;
+    }): Promise<unknown>;
+    /** Returns the passkeys of the accounts whose verified email is `email`, oldest first, each with its ID. */
+    credentials(options: {
+        email: string;
+    }): Promise<unknown>;
+};
+/** A passkey that wallet.tempo stores. */
+export type Credential = z.output<typeof schema.credential>;
+/** A passkey that wallet.tempo stores, with its credential ID, as {@link credentials} returns it. */
+export type Listed = Credential & {
+    /** The credential ID, base64url. */
+    credentialId: string;
+};
+declare namespace schema {
+    const credential: z.ZodObject<{
+        address: z.ZodString;
+        createdAt: z.ZodNullable<z.ZodNumber>;
+        email: z.ZodNullable<z.ZodEmail>;
+        publicKey: z.ZodTemplateLiteral<`0x04${string}`>;
+    }, z.core.$strip>;
+    const listed: z.ZodArray<z.ZodObject<{
+        address: z.ZodString;
+        createdAt: z.ZodNullable<z.ZodNumber>;
+        email: z.ZodNullable<z.ZodEmail>;
+        publicKey: z.ZodTemplateLiteral<`0x04${string}`>;
+        credentialId: z.ZodString;
+    }, z.core.$strip>>;
+}
+/**
+ * Returns the passkey `id` that wallet.tempo stores, with its account's address, creation time in
+ * milliseconds, and verified email. Returns `undefined` when wallet.tempo does not store it,
+ * returns another shape, or names an address that its public key does not derive.
+ */
+export declare function credential(wallet: Service, options: credential.Options): Promise<{
+    address: string;
+    createdAt: number | null;
+    email: string | null;
+    publicKey: `0x04${string}`;
+} | undefined>;
+export declare namespace credential {
+    type Options = {
+        /** The credential ID, base64url. */
+        id: string;
+    };
+}
+/**
+ * Returns the passkeys that wallet.tempo stores for the accounts whose verified email is `email`,
+ * oldest first. Call it only with the email of a signed-in user, whose sign-in proved it, so the list
+ * reveals nothing to another person. An entry that names an address its public key does not derive
+ * is left out, and a list of another shape is empty.
+ */
+export declare function credentials(wallet: Service, options: credentials.Options): Promise<readonly Listed[]>;
+export declare namespace credentials {
+    type Options = {
+        /** The signed-in user's verified email. */
+        email: string;
+    };
+}
+export {};
+//# sourceMappingURL=Wallet.d.ts.map

package/dist/internal/Wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Wallet.d.ts","sourceRoot":"","sources":["../../src/internal/Wallet.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,+EAA+E;AAC/E,MAAM,MAAM,OAAO,GAAG;IACpB,6FAA6F;IAC7F,UAAU,CAAC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/D,4GAA4G;IAC5G,WAAW,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC1D,CAAA;AAED,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;AAE3D,qGAAqG;AACrG,MAAM,MAAM,MAAM,GAAG,UAAU,GAAG;IAChC,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,kBAAU,MAAM,CAAC;IACR,MAAM,UAAU;;;;;qBAQrB,CAAA;IAEK,MAAM,MAAM;;;;;;sBAIlB,CAAA;CACF;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO;;;;;eAM5E;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,OAAO,GAAG;QACb,oCAAoC;QACpC,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,WAAW,CAAC,OAAO,GAC3B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM5B;AAED,MAAM,CAAC,OAAO,WAAW,WAAW,CAAC;IACnC,KAAK,OAAO,GAAG;QACb,2CAA2C;QAC3C,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF"}

package/dist/internal/Wallet.js

@@ -0,0 +1,59 @@
+/**
+ * Reads wallet.tempo's passkeys through the optional `WALLET` service binding to its `Credentials`
+ * entrypoint. Tempo ID never reads wallet.tempo's stores, and validates what the binding returns.
+ * @module
+ */
+import { Address, PublicKey } from 'ox';
+import { z } from 'zod';
+var schema;
+(function (schema) {
+    schema.credential = z.object({
+        address: z.string().regex(/^0x[0-9a-fA-F]{40}$/),
+        createdAt: z.number().int().min(0).max(8.64e15).nullable(),
+        email: z.email().nullable(),
+        publicKey: z.templateLiteral([
+            '0x04',
+            z.string().regex(/^[0-9a-fA-F]{128}$/),
+        ]),
+    });
+    schema.listed = z.array(schema.credential.extend({
+        credentialId: z.string().regex(/^[A-Za-z0-9_-]{1,1366}$/),
+    }));
+})(schema || (schema = {}));
+/**
+ * Returns the passkey `id` that wallet.tempo stores, with its account's address, creation time in
+ * milliseconds, and verified email. Returns `undefined` when wallet.tempo does not store it,
+ * returns another shape, or names an address that its public key does not derive.
+ */
+export async function credential(wallet, options) {
+    const result = schema.credential.safeParse(await wallet.credential({ credentialId: options.id }));
+    if (!result.success || !derives(result.data))
+        return undefined;
+    return result.data;
+}
+/**
+ * Returns the passkeys that wallet.tempo stores for the accounts whose verified email is `email`,
+ * oldest first. Call it only with the email of a signed-in user, whose sign-in proved it, so the list
+ * reveals nothing to another person. An entry that names an address its public key does not derive
+ * is left out, and a list of another shape is empty.
+ */
+export async function credentials(wallet, options) {
+    const result = schema.listed.safeParse(await wallet.credentials({ email: options.email }));
+    if (!result.success)
+        return [];
+    return result.data.filter(derives);
+}
+/** Returns whether `credential`'s public key derives its address, whatever wallet.tempo returns. */
+function derives(credential) {
+    const derived = (() => {
+        try {
+            return Address.fromPublicKey(PublicKey.fromHex(credential.publicKey));
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    return (derived !== undefined &&
+        Address.isEqual(derived, credential.address));
+}
+//# sourceMappingURL=Wallet.js.map

package/dist/internal/Wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Wallet.js","sourceRoot":"","sources":["../../src/internal/Wallet.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAmBvB,IAAU,MAAM,CAgBf;AAhBD,WAAU,MAAM;IACD,iBAAU,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QAC1D,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC3B,SAAS,EAAE,CAAC,CAAC,eAAe,CAAC;YAC3B,MAAM;YACN,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;SACvC,CAAC;KACH,CAAC,CAAA;IAEW,aAAM,GAAG,CAAC,CAAC,KAAK,CAC3B,iBAAU,CAAC,MAAM,CAAC;QAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;KAC1D,CAAC,CACH,CAAA;AACH,CAAC,EAhBS,MAAM,KAAN,MAAM,QAgBf;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAe,EAAE,OAA2B;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CACxC,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CACtD,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAe,EACf,OAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACpC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CACnD,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACpC,CAAC;AASD,oGAAoG;AACpG,SAAS,OAAO,CAAC,UAAsB;IACrC,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QACpB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,OAA0B,CAAC,CAChE,CAAA;AACH,CAAC"}

package/dist/internal/owners/Passkey.d.ts

@@ -0,0 +1,9 @@
+import * as Owner from '../Owner.js';
+/**
+ * Linked wallet.tempo passkeys, and passkeys that users register, as owner keys. Each owns the
+ * account at the address that its public key derives, in each realm whose relying party the passkey
+ * belongs to. A sign-in passkey, whose row holds no address, owns no account. A
+ * passkey signs only in the browser, and an account's creation creates none.
+ */
+export declare const owner: Owner.Kind<"webAuthn", readonly []>;
+//# sourceMappingURL=Passkey.d.ts.map

package/dist/internal/owners/Passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passkey.d.ts","sourceRoot":"","sources":["../../../src/internal/owners/Passkey.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,KAAK,qCA0DhB,CAAA"}

package/dist/internal/owners/Passkey.js

@@ -0,0 +1,58 @@
+/**
+ * Linked wallet.tempo passkeys, and passkeys that users register, as owner keys, which
+ * `TempoAccount.kinds` lists. Passkey sign-in, links, and registration live in `Passkey.ts`.
+ * @module
+ */
+import { and, asc, eq, inArray, isNotNull } from 'drizzle-orm';
+import { Account } from 'viem/tempo';
+import * as Schema from '../../app/db/schema.js';
+import * as Owner from '../Owner.js';
+/**
+ * Linked wallet.tempo passkeys, and passkeys that users register, as owner keys. Each owns the
+ * account at the address that its public key derives, in each realm whose relying party the passkey
+ * belongs to. A sign-in passkey, whose row holds no address, owns no account. A
+ * passkey signs only in the browser, and an account's creation creates none.
+ */
+export const owner = Owner.kind({
+    errors: [],
+    load(_c, options) {
+        const { userId } = options;
+        const realms = options.realms.filter((realm) => realm.passkeys);
+        return Promise.resolve({
+            async list(_c, options) {
+                if (realms.length === 0)
+                    return [];
+                const keys = await options.db
+                    .select()
+                    .from(Schema.keys)
+                    .where(and(eq(Schema.keys.userId, userId), 
+                // A sign-in passkey holds no address, so it owns no account.
+                isNotNull(Schema.keys.address), inArray(Schema.keys.rpId, realms.map((realm) => realm.passkeys.rpId))))
+                    .orderBy(asc(Schema.keys.createdAt), asc(Schema.keys.id));
+                return keys.flatMap((key) => realms
+                    .filter((realm) => realm.passkeys.rpId === key.rpId)
+                    .map((realm) => Owner.from({
+                    account: Account.fromConfig({
+                        owners: [
+                            Account.fromWebAuthnP256({ id: key.id, publicKey: key.publicKey }, { rpId: key.rpId }),
+                        ],
+                    }),
+                    createdAt: key.createdAt,
+                    credential: {
+                        id: key.id,
+                        publicKey: key.publicKey,
+                        rpId: key.rpId,
+                    },
+                    // `wallet` is the earlier name of the `tempo-wallet` source, until a migration
+                    // renames it, so both are wallet.tempo passkeys that linked.
+                    linked: ['tempo-wallet', 'wallet'].includes(key.source),
+                    realm,
+                    signer: undefined,
+                    type: 'webAuthn',
+                })));
+            },
+        });
+    },
+    type: 'webAuthn',
+});
+//# sourceMappingURL=Passkey.js.map

package/dist/internal/owners/Passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passkey.js","sourceRoot":"","sources":["../../../src/internal/owners/Passkey.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAA;AAChD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,EAAE;IACV,IAAI,CAAC,EAAE,EAAE,OAAO;QACd,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAE/D,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO;gBACpB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBAElC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;qBAC1B,MAAM,EAAE;qBACR,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;qBACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBAC9B,6DAA6D;gBAC7D,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,IAAI,EAChB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAS,CAAC,IAAI,CAAC,CAC5C,CACF,CACF;qBACA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;gBAE3D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1B,MAAM;qBACH,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAS,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC;qBACpD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,KAAK,CAAC,IAAI,CAAC;oBACT,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC;wBAC1B,MAAM,EAAE;4BACN,OAAO,CAAC,gBAAgB,CACtB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAoB,EAAE,EACnD,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CACnB;yBACF;qBACF,CAAC;oBACF,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,UAAU,EAAE;wBACV,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,SAAS,EAAE,GAAG,CAAC,SAAoB;wBACnC,IAAI,EAAE,GAAG,CAAC,IAAI;qBACf;oBACD,+EAA+E;oBAC/E,6DAA6D;oBAC7D,MAAM,EAAE,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBACvD,KAAK;oBACL,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,UAAU;iBACjB,CAAC,CACH,CACJ,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,EAAE,UAAU;CACjB,CAAC,CAAA"}

package/dist/internal/owners/Privy.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Privy wallets as owner keys, which `TempoAccount.kinds` lists. The Privy client, its wallets, and
+ * its tokens live in `Privy.ts`.
+ * @module
+ */
+import * as ErrorResponse from '../ErrorResponse.js';
+import * as Owner from '../Owner.js';
+/**
+ * Privy wallets as owner keys. A realm's Privy app holds the user's wallets in the realm, and creates
+ * the user's first wallet there. A wallet signs on the server with a token that only Privy trusts.
+ */
+export declare const owner: Owner.Kind<"privy", readonly [typeof ErrorResponse.RateLimitedError, typeof ErrorResponse.UpstreamUnavailableError]>;
+//# sourceMappingURL=Privy.d.ts.map

package/dist/internal/owners/Privy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Privy.d.ts","sourceRoot":"","sources":["../../../src/internal/owners/Privy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAKpC;;;GAGG;AACH,eAAO,MAAM,KAAK,sHAkEhB,CAAA"}

package/dist/internal/owners/Privy.js

@@ -0,0 +1,59 @@
+/**
+ * Privy wallets as owner keys, which `TempoAccount.kinds` lists. The Privy client, its wallets, and
+ * its tokens live in `Privy.ts`.
+ * @module
+ */
+import * as ErrorResponse from '../ErrorResponse.js';
+import * as Owner from '../Owner.js';
+import * as Privy from '../Privy.js';
+import * as Realm from '../Realm.js';
+import * as Timing from '../Timing.js';
+/**
+ * Privy wallets as owner keys. A realm's Privy app holds the user's wallets in the realm, and creates
+ * the user's first wallet there. A wallet signs on the server with a token that only Privy trusts.
+ */
+export const owner = Owner.kind({
+    errors: ErrorResponse.fromUpstream.errors,
+    async load(c, options) {
+        const { db, env, realms, userId } = options;
+        const apps = await Timing.measure(c, Realm.privyApps(c, { db, realms, secret: env.SECRET }), 'Realm.privyApps');
+        const toOwner = (app, realm, wallet) => Owner.from({
+            account: Privy.toAccount({ app, wallet }),
+            createdAt: wallet.createdAt,
+            linked: false,
+            realm,
+            async signer(c, options) {
+                const jwt = await Timing.measure(c, Privy.token(options.auth, {
+                    app,
+                    privateKey: env.PRIVY_JWT_PRIVATE_KEY,
+                    userId,
+                }), 'Privy.token');
+                return Privy.toAccount({ app, token: jwt, wallet }).owners[0];
+            },
+            type: 'privy',
+        });
+        return {
+            create(realm) {
+                const app = apps.get(realm.id);
+                if (!app)
+                    return undefined;
+                return async (c) => {
+                    const wallet = await Timing.measure(c, Privy.firstWallet(c, { app, userId }), 'Privy.firstWallet');
+                    return toOwner(app, realm, wallet);
+                };
+            },
+            async list(c) {
+                const lists = await Promise.all(realms.map(async (realm) => {
+                    const app = apps.get(realm.id);
+                    if (!app)
+                        return [];
+                    const wallets = await Timing.measure(c, Privy.listWallets(c, { app, userId }), 'Privy.listWallets');
+                    return wallets.map((wallet) => toOwner(app, realm, wallet));
+                }));
+                return Owner.merge(lists);
+            },
+        };
+    },
+    type: 'privy',
+});
+//# sourceMappingURL=Privy.js.map

package/dist/internal/owners/Privy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Privy.js","sourceRoot":"","sources":["../../../src/internal/owners/Privy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,MAAM;IACzC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO;QACnB,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,CAAC,EACD,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,EACtD,iBAAiB,CAClB,CAAA;QAED,MAAM,OAAO,GAAG,CACd,GAAc,EACd,KAAkB,EAClB,MAAoB,EACpB,EAAE,CACF,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,KAAK;YACb,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO;gBACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,CAAC,EACD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACxB,GAAG;oBACH,UAAU,EAAE,GAAG,CAAC,qBAAqB;oBACrC,MAAM;iBACP,CAAC,EACF,aAAa,CACd,CAAA;gBACD,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAA;YAChE,CAAC;YACD,IAAI,EAAE,OAAO;SACd,CAAC,CAAA;QAEJ,OAAO;YACL,MAAM,CAAC,KAAK;gBACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC9B,IAAI,CAAC,GAAG;oBAAE,OAAO,SAAS,CAAA;gBAC1B,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;oBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CACjC,CAAC,EACD,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EACrC,mBAAmB,CACpB,CAAA;oBACD,OAAO,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;gBACpC,CAAC,CAAA;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC;gBACV,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;oBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;oBAC9B,IAAI,CAAC,GAAG;wBAAE,OAAO,EAAE,CAAA;oBACnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,CAAC,EACD,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EACrC,mBAAmB,CACpB,CAAA;oBACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;gBAC7D,CAAC,CAAC,CACH,CAAA;gBACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;SACF,CAAA;IACH,CAAC;IACD,IAAI,EAAE,OAAO;CACd,CAAC,CAAA"}

package/dist/internal/owners/Secp256k1.d.ts

@@ -0,0 +1,12 @@
+import * as Owner from '../Owner.js';
+/** The account of a listed owner signs nothing. Only the owner's `signer` signs. */
+export declare class SignerRequiredError extends Error {
+    readonly name = "Secp256k1.SignerRequiredError";
+    constructor();
+}
+/**
+ * Secp256k1 keys as owner keys. In each realm that holds them, the kind creates the user's first key
+ * and signs with it on the server.
+ */
+export declare const owner: Owner.Kind<"secp256k1", readonly []>;
+//# sourceMappingURL=Secp256k1.d.ts.map

package/dist/internal/owners/Secp256k1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secp256k1.d.ts","sourceRoot":"","sources":["../../../src/internal/owners/Secp256k1.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAIpC,oFAAoF;AACpF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAkB,IAAI,mCAAkC;IAExD,cAIC;CACF;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,sCAwFhB,CAAA"}

package/dist/internal/owners/Secp256k1.js

@@ -0,0 +1,99 @@
+/**
+ * Secp256k1 owner keys that Tempo ID creates, holds, and signs with itself, in the place of a Privy
+ * wallet, for the suites and local development. Each user holds at most one in each realm that
+ * `realm_secp256k1` names, and its row holds the private key encrypted with `SECRET`. A production
+ * realm never turns them on, since the key stays in Tempo ID's database.
+ * @module
+ */
+import { symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto';
+import { and, asc, eq, inArray } from 'drizzle-orm';
+import { generatePrivateKey, privateKeyToAccount, toAccount, } from 'viem/accounts';
+import { Account } from 'viem/tempo';
+import * as Schema from '../../app/db/schema.js';
+import * as Owner from '../Owner.js';
+import * as Timing from '../Timing.js';
+/** The account of a listed owner signs nothing. Only the owner's `signer` signs. */
+export class SignerRequiredError extends Error {
+    name = 'Secp256k1.SignerRequiredError';
+    constructor() {
+        super("The account of a secp256k1 owner signs nothing. Sign with the owner's signer.");
+    }
+}
+/**
+ * Secp256k1 keys as owner keys. In each realm that holds them, the kind creates the user's first key
+ * and signs with it on the server.
+ */
+export const owner = Owner.kind({
+    errors: [],
+    load(_c, options) {
+        const { env, userId } = options;
+        const realms = options.realms.filter((realm) => realm.secp256k1);
+        const toOwner = (row, realm) => Owner.from({
+            account: Account.fromConfig({ owners: [unsigned(row.address)] }),
+            createdAt: row.createdAt,
+            linked: false,
+            realm,
+            async signer() {
+                const privateKey = await symmetricDecrypt({
+                    data: row.privateKey,
+                    key: env.SECRET,
+                });
+                return privateKeyToAccount(privateKey);
+            },
+            type: 'secp256k1',
+        });
+        return Promise.resolve({
+            create(realm) {
+                if (!realms.some((entry) => entry.id === realm.id))
+                    return undefined;
+                return async (c) => {
+                    const privateKey = generatePrivateKey();
+                    // A concurrent create for the same user and realm keeps the first key, and both return it.
+                    // The update on conflict writes the stored user ID again, so the statement returns the row.
+                    const [row] = await Timing.measure(c, options.db
+                        .insert(Schema.secp256k1Owners)
+                        .values({
+                        address: privateKeyToAccount(privateKey).address,
+                        privateKey: await symmetricEncrypt({
+                            data: privateKey,
+                            key: env.SECRET,
+                        }),
+                        realmId: realm.id,
+                        userId,
+                    })
+                        .onConflictDoUpdate({
+                        set: { userId },
+                        target: [
+                            Schema.secp256k1Owners.userId,
+                            Schema.secp256k1Owners.realmId,
+                        ],
+                    })
+                        .returning(), 'db.secp256k1Owner.insert');
+                    return toOwner(row, realm);
+                };
+            },
+            async list(c, options) {
+                if (realms.length === 0)
+                    return [];
+                const rows = await Timing.measure(c, options.db
+                    .select()
+                    .from(Schema.secp256k1Owners)
+                    .where(and(eq(Schema.secp256k1Owners.userId, userId), inArray(Schema.secp256k1Owners.realmId, realms.map((realm) => realm.id))))
+                    .orderBy(asc(Schema.secp256k1Owners.createdAt), asc(Schema.secp256k1Owners.realmId)), 'db.secp256k1Owner.list');
+                return rows.map((row) => toOwner(row, realms.find((realm) => realm.id === row.realmId)));
+            },
+        });
+    },
+    type: 'secp256k1',
+});
+/** Returns a Viem account for `address` that signs nothing, as a listed owner's account. */
+function unsigned(address) {
+    const refuse = () => Promise.reject(new SignerRequiredError());
+    return toAccount({
+        address: address,
+        signMessage: refuse,
+        signTransaction: refuse,
+        signTypedData: refuse,
+    });
+}
+//# sourceMappingURL=Secp256k1.js.map

package/dist/internal/owners/Secp256k1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secp256k1.js","sourceRoot":"","sources":["../../../src/internal/owners/Secp256k1.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,GACV,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAA;AAChD,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAEpC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC,oFAAoF;AACpF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC1B,IAAI,GAAG,+BAA+B,CAAA;IAExD;QACE,KAAK,CACH,+EAA+E,CAChF,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,MAAM,EAAE,EAAE;IACV,IAAI,CAAC,EAAE,EAAE,OAAO;QACd,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAEhE,MAAM,OAAO,GAAG,CAAC,GAAQ,EAAE,KAAkB,EAAE,EAAE,CAC/C,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,KAAK;YACb,KAAK;YACL,KAAK,CAAC,MAAM;gBACV,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;oBACxC,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,GAAG,EAAE,GAAG,CAAC,MAAM;iBAChB,CAAC,CAAA;gBACF,OAAO,mBAAmB,CAAC,UAAqB,CAAC,CAAA;YACnD,CAAC;YACD,IAAI,EAAE,WAAW;SAClB,CAAC,CAAA;QAEJ,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,MAAM,CAAC,KAAK;gBACV,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACpE,OAAO,KAAK,EAAE,CAAC,EAAE,EAAE;oBACjB,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAA;oBACvC,2FAA2F;oBAC3F,4FAA4F;oBAC5F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,CAAC,EACD,OAAO,CAAC,EAAE;yBACP,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;yBAC9B,MAAM,CAAC;wBACN,OAAO,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC,OAAO;wBAChD,UAAU,EAAE,MAAM,gBAAgB,CAAC;4BACjC,IAAI,EAAE,UAAU;4BAChB,GAAG,EAAE,GAAG,CAAC,MAAM;yBAChB,CAAC;wBACF,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,MAAM;qBACP,CAAC;yBACD,kBAAkB,CAAC;wBAClB,GAAG,EAAE,EAAE,MAAM,EAAE;wBACf,MAAM,EAAE;4BACN,MAAM,CAAC,eAAe,CAAC,MAAM;4BAC7B,MAAM,CAAC,eAAe,CAAC,OAAO;yBAC/B;qBACF,CAAC;yBACD,SAAS,EAAE,EACd,0BAA0B,CAC3B,CAAA;oBACD,OAAO,OAAO,CAAC,GAAI,EAAE,KAAK,CAAC,CAAA;gBAC7B,CAAC,CAAA;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO;gBACnB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBAElC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAC/B,CAAC,EACD,OAAO,CAAC,EAAE;qBACP,MAAM,EAAE;qBACR,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;qBAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,OAAO,CACL,MAAM,CAAC,eAAe,CAAC,OAAO,EAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAChC,CACF,CACF;qBACA,OAAO,CACN,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EACrC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CACpC,EACH,wBAAwB,CACzB,CAAA;gBACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,OAAO,CACL,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,CAAE,CAClD,CACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,EAAE,WAAW;CAClB,CAAC,CAAA;AAKF,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAA;IAC9D,OAAO,SAAS,CAAC;QACf,OAAO,EAAE,OAAkB;QAC3B,WAAW,EAAE,MAAM;QACnB,eAAe,EAAE,MAAM;QACvB,aAAa,EAAE,MAAM;KACtB,CAAC,CAAA;AACJ,CAAC"}

package/dist/worker.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The Worker entry: `App.create` runs Tempo ID in a Cloudflare Worker.
+ *
+ * ```ts
+ * import { env } from 'cloudflare:workers'
+ * import { App } from '@tempoxyz/id/worker'
+ *
+ * export default App.create({
+ *   db: env.HYPERDRIVE,
+ *   email: { binding: env.SEND_EMAIL, from: 'Tempo ID <noreply@id.example.com>' },
+ *   secret: env.SECRET,
+ *   url: 'https://id.example.com',
+ * })
+ * ```
+ * @module
+ */
+export * as App from './App.js';
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA"}

package/dist/worker.js

@@ -0,0 +1,18 @@
+/**
+ * The Worker entry: `App.create` runs Tempo ID in a Cloudflare Worker.
+ *
+ * ```ts
+ * import { env } from 'cloudflare:workers'
+ * import { App } from '@tempoxyz/id/worker'
+ *
+ * export default App.create({
+ *   db: env.HYPERDRIVE,
+ *   email: { binding: env.SEND_EMAIL, from: 'Tempo ID <noreply@id.example.com>' },
+ *   secret: env.SECRET,
+ *   url: 'https://id.example.com',
+ * })
+ * ```
+ * @module
+ */
+export * as App from './App.js';
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA"}