@tempoxyz/id 0.0.0-stage → 0.0.1

package/src/api/account.ts

@@ -0,0 +1,2266 @@
+/**
+ * The signed-in user's Tempo Accounts, the creation of the first one, the registration of a passkey
+ * that owns another, and the realms an app reaches, under `/v1/account` and `/v1/realms`. The
+ * chains, their status, and the faucet that only Tempo ID's own pages call are under `/i`.
+ * @module
+ */
+import { type Context, Hono } from 'hono'
+import { Address, PublicKey } from 'ox'
+import {
+  KeyAuthorization as ox_KeyAuthorization,
+  SignatureEnvelope,
+} from 'ox/tempo'
+import { env } from 'void/env'
+import { Authentication, Registration } from 'webauthx/server'
+import * as z from 'zod'
+import * as core_Auth from '../internal/Auth.js'
+import * as Balance from '../internal/Balance.js'
+import * as BodyLimit from '../internal/BodyLimit.js'
+import * as Cache from '../internal/Cache.js'
+import * as Chain from '../internal/Chain.js'
+import * as ChainList from '../internal/ChainList.js'
+import * as ChainStatus from '../internal/ChainStatus.js'
+import * as ConfigurableAccount from '../internal/ConfigurableAccount.js'
+import type { Env } from '../internal/Env.js'
+import * as ErrorResponse from '../internal/ErrorResponse.js'
+import * as Faucet from '../internal/Faucet.js'
+import * as KeyAuthorization from '../internal/KeyAuthorization.js'
+import * as Log from '../internal/Log.js'
+import * as OpenApi from '../internal/OpenApi.js'
+import * as Owner from '../internal/Owner.js'
+import * as Passkey from '../internal/Passkey.js'
+import * as RateLimit from '../internal/RateLimit.js'
+import * as Realm from '../internal/Realm.js'
+import * as TempoAccount from '../internal/TempoAccount.js'
+import * as Timing from '../internal/Timing.js'
+import * as Validation from '../internal/Validation.js'
+import * as Wallet from '../internal/Wallet.js'
+import * as AccountStep from './lib/AccountStep.js'
+import * as Configure from './lib/Configure.js'
+import * as Cors from './lib/Cors.js'
+import { db } from './lib/Database.js'
+import * as Headless from './lib/Headless.js'
+import * as Session from './lib/Session.js'
+
+namespace schema {
+  const address = z.templateLiteral([
+    '0x',
+    z.string().regex(/^[0-9a-fA-F]{40}$/),
+  ])
+
+  export namespace account {
+    export const query = z.object({
+      chain: Chain.schema.optional().meta({
+        description:
+          'The chain whose balance each account carries: `mainnet`, `testnet`, or another chain that the deployment lists. Without it, the accounts carry no balance.',
+        examples: ['testnet'],
+      }),
+      client_id: z
+        .string()
+        .min(1)
+        .max(255)
+        .optional()
+        .meta({
+          description:
+            "The app's client ID, whose realms select the accounts. A browser page from an origin that none of the app's redirect URIs has receives the `default` realm, as does a request without one.",
+          examples: ['client_01JZ8Q6W3N1R5B4V7C2X9K0M3T'],
+        }),
+    })
+
+    export const response = z
+      .object({
+        email: z.email().meta({
+          description: "The user's email address.",
+          examples: ['ada@example.com'],
+        }),
+        id: z.string().meta({
+          description:
+            "The user's ID, which is the `sub` of every token Tempo ID issues for the user.",
+          examples: ['user_01JZ8Q6W3N1R5B4V7C2X9K0M3T'],
+        }),
+        name: z
+          .string()
+          .nullable()
+          .meta({
+            description:
+              "The user's name, or `null` for a user who signed up without one.",
+            examples: ['Ada Lovelace'],
+          }),
+        passkeys: z.boolean().meta({
+          description:
+            "Whether the realms the request reaches hold passkeys that sign in at Tempo ID's origin. Without `client_id`, the `default` realm's, where `POST /v1/account/passkey/options` registers a passkey.",
+          examples: [true],
+        }),
+        tempo: z
+          .array(
+            TempoAccount.schema.tempoAccount.extend({
+              balance: Balance.schema.balance.nullable().optional().meta({
+                description:
+                  "The USD value of the account's verified holdings on the chain that `chain` names, or absent without `chain`. `null` when the chain has no Tempo API URL, or the read fails or takes longer than 3 seconds.",
+              }),
+            }),
+          )
+          .readonly()
+          .meta({
+            description:
+              "The user's Tempo Accounts in the realms the request reaches: the account that the user selected for the app first, then oldest first.",
+          }),
+      })
+      .meta({ id: 'Account' })
+  }
+
+  export namespace create {
+    export const json = account.query
+
+    export const response = account.response
+  }
+
+  export namespace passkeyOptions {
+    // A JSON body, since `csrf()` refuses a body-less write, and the body requires a CORS preflight.
+    export const json = z.object({})
+
+    export const response = z.object({
+      options: z
+        .object({
+          publicKey: z
+            .object({
+              attestation: z.literal('none').meta({
+                description:
+                  'Tempo ID requests no attestation statement from the authenticator.',
+              }),
+              authenticatorSelection: z
+                .object({
+                  requireResidentKey: z.literal(true).meta({
+                    description:
+                      'The passkey must be discoverable, so it signs in without an email.',
+                  }),
+                  residentKey: z.literal('required').meta({
+                    description:
+                      'The passkey must be discoverable, so it signs in without an email.',
+                  }),
+                  userVerification: z.literal('required').meta({
+                    description:
+                      'Every passkey registration requires user verification.',
+                  }),
+                })
+                .meta({
+                  description: 'The authenticator that the passkey requires.',
+                }),
+              challenge: z.templateLiteral(['0x', z.string()]).meta({
+                description:
+                  'The single-use challenge, as hex. It expires after 5 minutes, and only the same user spends it.',
+                examples: [
+                  '0xf6310589abb21116acc6e123967ed0a125b5041c43f8e157237093e07eaa354c',
+                ],
+              }),
+              excludeCredentials: z
+                .array(
+                  z
+                    .object({
+                      id: z.string().meta({
+                        description: 'A credential ID, base64url.',
+                        examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+                      }),
+                      type: z.literal('public-key').meta({
+                        description: 'The credential type.',
+                      }),
+                    })
+                    .meta({
+                      description: 'A passkey that the user holds already.',
+                    }),
+                )
+                .optional()
+                .meta({
+                  description:
+                    "The user's passkeys of the relying party, which an authenticator that holds one of them refuses to replace. Absent for a user with none.",
+                }),
+              pubKeyCredParams: z
+                .array(
+                  z
+                    .object({
+                      alg: z.literal(-7).meta({
+                        description: 'ES256: ECDSA over P-256 with SHA-256.',
+                      }),
+                      type: z.literal('public-key').meta({
+                        description: 'The credential type.',
+                      }),
+                    })
+                    .meta({
+                      description:
+                        'The only key type that a Tempo Account accepts.',
+                    }),
+                )
+                .meta({
+                  description:
+                    'The key types the passkey may use: P-256 alone, which a Tempo Account verifies.',
+                }),
+              rp: z
+                .object({
+                  id: z.string().meta({
+                    description: 'The relying party ID of the `default` realm.',
+                    examples: ['tempo.xyz'],
+                  }),
+                  name: z.string().meta({
+                    description: "The `default` realm's display name.",
+                    examples: ['Tempo'],
+                  }),
+                })
+                .meta({ description: 'The relying party.' }),
+              user: z
+                .object({
+                  displayName: z.string().meta({
+                    description:
+                      "The user's name, or the email address for a user without one.",
+                    examples: ['Ada Lovelace'],
+                  }),
+                  id: z.string().meta({
+                    description:
+                      'A random user handle for this passkey, base64url, so a new passkey never replaces another in the authenticator.',
+                    examples: ['3q2-7wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'],
+                  }),
+                  name: z.email().meta({
+                    description: "The user's email address.",
+                    examples: ['ada@example.com'],
+                  }),
+                })
+                .meta({
+                  description:
+                    'The user, as the authenticator labels the passkey.',
+                }),
+            })
+            .meta({
+              description:
+                'The `PublicKeyCredentialCreationOptions`, serialized with the challenge as hex.',
+            }),
+        })
+        .meta({
+          description: 'The options for `navigator.credentials.create()`.',
+        }),
+    })
+  }
+
+  export namespace passkey {
+    export const json = z.object({
+      credential: Passkey.schema.credential,
+    })
+
+    export const response = z.object({
+      step: z
+        .object({
+          options: z
+            .object({
+              publicKey: z
+                .object({
+                  allowCredentials: z
+                    .array(
+                      z
+                        .object({
+                          id: Passkey.schema.credentialId.meta({
+                            description:
+                              'The credential ID of the new passkey, base64url.',
+                            examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+                          }),
+                          type: z.literal('public-key').meta({
+                            description: 'The credential type.',
+                          }),
+                        })
+                        .meta({ description: 'The new passkey.' }),
+                    )
+                    .meta({
+                      description:
+                        'The new passkey, the only one the browser offers.',
+                    }),
+                  challenge: z.templateLiteral(['0x', z.string()]).meta({
+                    description:
+                      'The single-use proof challenge, as hex. It expires after 5 minutes, and only the same user spends it.',
+                    examples: [
+                      '0xf6310589abb21116acc6e123967ed0a125b5041c43f8e157237093e07eaa354c',
+                    ],
+                  }),
+                  rpId: z.string().meta({
+                    description: 'The relying party ID of the `default` realm.',
+                    examples: ['tempo.xyz'],
+                  }),
+                  userVerification: z.literal('required').meta({
+                    description:
+                      'Every passkey signature requires user verification.',
+                  }),
+                })
+                .meta({
+                  description:
+                    'The `PublicKeyCredentialRequestOptions`, serialized with the challenge as hex.',
+                }),
+            })
+            .meta({
+              description: 'The options for `navigator.credentials.get()`.',
+            }),
+          type: z.literal('passkey').meta({
+            description:
+              'Sign the options with the new passkey, then send the assertion to `POST /v1/account/passkey/verify`.',
+          }),
+        })
+        .meta({
+          description:
+            "The next step: the new passkey's signature, which proves that the authenticator holds its private key.",
+        }),
+    })
+  }
+
+  export namespace passkeyVerify {
+    export const json = z.object({
+      account: address.optional().meta({
+        description:
+          "A configurable Tempo Account that the user's cloud wallet owns in the `default` realm, which the passkey joins as a second owner on `chain`. Absent, the passkey owns an account of its own.",
+        examples: ['0x7a3f9c2b1e5d8a4f6c0b3e7d9a2f5c8b1e4d7a0f'],
+      }),
+      assertion: Passkey.schema.assertion,
+      chain: Chain.schema.optional().meta({
+        description:
+          "The chain whose accounts are configurable, where `account` is, and whose address of the passkey's own account the response returns. Without it, the first such chain for `account`, and the passkey's own address otherwise.",
+        examples: ['local'],
+      }),
+    })
+
+    export const response = z.object({
+      address: z.string().meta({
+        description:
+          "The address of the Tempo Account that the passkey owns: `account`, or the passkey's own account on `chain`.",
+        examples: ['0x7a3f9c2b1e5d8a4f6c0b3e7d9a2f5c8b1e4d7a0f'],
+      }),
+      id: Passkey.schema.credentialId.meta({
+        description: 'The credential ID of the passkey, base64url.',
+        examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+      }),
+    })
+  }
+
+  export namespace realms {
+    export const query = account.query.omit({ chain: true })
+
+    export const response = z.object({
+      passkeys: z.boolean().meta({
+        description:
+          "Whether a passkey sign-in for the app runs on the page that sends the request, at a relying party of the app's realms. `false` without `client_id`, or for Tempo ID's own page.",
+        examples: [true],
+      }),
+      realms: z.array(TempoAccount.schema.realm).readonly().meta({
+        description:
+          "The realms the app reaches, never empty. The first holds a user's first account.",
+      }),
+    })
+  }
+
+  export namespace chains {
+    export const entry = z
+      .object({
+        chainId: z
+          .number()
+          .int()
+          .meta({
+            description: 'The ID of the Tempo chain that serves the name.',
+            examples: [42431],
+          }),
+        configurable: z.boolean().meta({
+          description:
+            'Whether Tempo Accounts can be upgraded to configurable accounts (TIP-1107) on the chain, as the deployment sets.',
+          examples: [false],
+        }),
+        name: Chain.schema.meta({
+          description: 'The name that the `chain` parameter carries.',
+          examples: ['testnet'],
+        }),
+      })
+      .meta({ description: 'A chain that a page can select.' })
+
+    export const response = z.object({
+      chains: z.array(entry).readonly().meta({
+        description:
+          "The chains in order: `mainnet`, `testnet`, then the deployment's listed chains.",
+      }),
+    })
+  }
+
+  export namespace pageChains {
+    export const response = z.object({
+      chains: z
+        .array(
+          chains.entry
+            .extend({
+              faucet: z.boolean().meta({
+                description:
+                  'Whether `POST /i/account/fund` funds an account on the chain, which every Tempo chain but mainnet offers.',
+                examples: [true],
+              }),
+            })
+            .meta({ description: 'A chain that a page can select.' }),
+        )
+        .readonly()
+        .meta({
+          description:
+            "The chains in order: `mainnet`, `testnet`, then the deployment's listed chains.",
+        }),
+    })
+  }
+
+  export namespace chainStatus {
+    export const response = z.object({
+      chains: z
+        .array(
+          z
+            .object({
+              api: z.enum(['down', 'none', 'up']).meta({
+                description:
+                  "Whether the chain's Tempo API responds on `/health`: `up`, `down`, or `none` when `TEMPO_API_URLS` lists none for the chain.",
+                examples: ['up'],
+              }),
+              chainId: z
+                .number()
+                .int()
+                .meta({
+                  description:
+                    'The ID of the Tempo chain that serves the name.',
+                  examples: [1337],
+                }),
+              name: Chain.schema.meta({
+                description: 'The name that the `chain` parameter carries.',
+                examples: ['local'],
+              }),
+              node: z.enum(['down', 'up']).meta({
+                description:
+                  "Whether the chain's node serves the chain ID: `up`, or `down` when it does not respond or serves another.",
+                examples: ['up'],
+              }),
+            })
+            .meta({ description: 'The status of a listed chain.' }),
+        )
+        .readonly()
+        .meta({
+          description:
+            "The deployment's listed chains in order, apart from `mainnet` and `testnet`.",
+        }),
+    })
+  }
+
+  export namespace fund {
+    export const json = z.object({
+      address: z
+        .templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]{40}$/)])
+        .meta({
+          description:
+            "The Tempo Account that receives the tokens, one of the user's accounts in the `default` realm.",
+          examples: ['0x7a3f9c2b1e5d8a4f6c0b3e7d9a2f5c8b1e4d7a0f'],
+          pattern: '^0x[0-9a-fA-F]{40}$',
+        }),
+      chain: Chain.schema.meta({
+        description:
+          'The test chain whose faucet drips the tokens: `testnet`, or a name that `GET /i/chains` lists. Tempo mainnet has no faucet.',
+        examples: ['testnet'],
+      }),
+    })
+
+    export const response = z.object({
+      transactions: z
+        .array(
+          z.templateLiteral(['0x', z.string().regex(/^[0-9a-f]{64}$/)]).meta({
+            description: 'The hash of one transfer from the faucet.',
+            examples: [
+              '0x5c504ed432cb51138bcf09aa5e8a410dd4a1e204ef84bfed1be16dfba1b22060',
+            ],
+          }),
+        )
+        .readonly()
+        .meta({
+          description:
+            'The hashes of the transfers, one for each token that the faucet drips, each one landed.',
+          examples: [
+            [
+              '0x5c504ed432cb51138bcf09aa5e8a410dd4a1e204ef84bfed1be16dfba1b22060',
+            ],
+          ],
+        }),
+    })
+  }
+
+  export namespace upgrade {
+    export const json = z
+      .object({
+        account: address.optional().meta({
+          description:
+            "One of the user's Tempo Accounts in the app's realms on `chain`, which a linked wallet.tempo passkey owns and the upgrade makes configurable. Absent with `credentialId`.",
+          examples: ['0x7a3f9c2b1e5d8a4f6c0b3e7d9a2f5c8b1e4d7a0f'],
+        }),
+        chain: Chain.schema.optional().meta({
+          description:
+            'The chain whose accounts are configurable, where the upgrade runs. Defaults to the first such chain that the deployment names.',
+          examples: ['local'],
+        }),
+        client_id: z
+          .string()
+          .min(1)
+          .max(255)
+          .optional()
+          .meta({
+            description:
+              'The app whose realms hold the account. Without it, the `default` realm.',
+            examples: ['client_01JZ8Q6W3N1R5B4V7C2X9K0M3T'],
+          }),
+        credentialId: Passkey.schema.credentialId.optional().meta({
+          description:
+            "A wallet.tempo passkey of the user's email that has not linked to the user yet, as `GET /i/account/passkeys` lists it. Its assertion over the upgrade links it. Absent with `account`. Only Tempo ID's own page sends it.",
+          examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+        }),
+        key: z
+          .object({
+            // A malformed signature is refused here, before the repeated request spends the step.
+            signature: z
+              .templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]*$/)])
+              .refine(primitive, {
+                message:
+                  'Expected the serialized signature envelope of a secp256k1, P256, or WebAuthn access key',
+              })
+              .meta({
+                description:
+                  "The access key's raw signature over `step.key.digest`, as a serialized signature envelope.",
+                examples: [
+                  '0x997c61aa10e2330c076d6ba7abca1e71703a8f039291db103a62e085c9b2cf0d3f7e31ec9028229acc83093fbb722fa700fd6e4ea15d584df1bf384eb0051e0d1c',
+                ],
+              }),
+          })
+          .optional()
+          .meta({
+            description:
+              "The access key's signature of its registration, on the repeated request of a step with `key`.",
+          }),
+        key_authorization: KeyAuthorization.schema.rpc.optional().meta({
+          description:
+            "A key that the passkey signed as the account's own key, such as with `skip_upgrade`, on the first request. The chain registers it before the upgrade, so it keeps working after. Its chain is the upgrade's when `chain` is absent.",
+        }),
+        passkey: z
+          .object({
+            assertion: Passkey.schema.assertion,
+          })
+          .optional()
+          .meta({
+            description:
+              "The passkey step's result: the passkey's assertion over the step's challenge. Absent on the first request.",
+          }),
+      })
+      .refine(
+        (value) =>
+          (value.account === undefined) !== (value.credentialId === undefined),
+        {
+          message: 'Name exactly one of `account` or `credentialId`.',
+          path: ['account'],
+        },
+      )
+
+    export const response = z.union([
+      z
+        .object({
+          account: TempoAccount.schema.tempoAccount,
+        })
+        .meta({ description: 'The installed configuration.' }),
+      z
+        .object({
+          step: z
+            .object({
+              options: z
+                .object({
+                  publicKey: z
+                    .object({
+                      allowCredentials: z
+                        .array(
+                          z
+                            .object({
+                              id: Passkey.schema.credentialId.meta({
+                                description:
+                                  "The credential ID of the account's passkey, base64url.",
+                                examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+                              }),
+                              type: z.literal('public-key').meta({
+                                description: 'The credential type.',
+                              }),
+                            })
+                            .meta({ description: "The account's passkey." }),
+                        )
+                        .meta({
+                          description:
+                            "The account's passkey, the only one the browser offers.",
+                        }),
+                      challenge: z.templateLiteral(['0x', z.string()]).meta({
+                        description:
+                          'The digest of the transaction that installs the configuration, as hex. It expires after 5 minutes, and only the same user spends it.',
+                        examples: [
+                          '0xf6310589abb21116acc6e123967ed0a125b5041c43f8e157237093e07eaa354c',
+                        ],
+                      }),
+                      rpId: z.string().meta({
+                        description: "The passkey's relying party ID.",
+                        examples: ['tempo.xyz'],
+                      }),
+                      userVerification: z.literal('required').meta({
+                        description:
+                          'Every passkey signature requires user verification.',
+                      }),
+                    })
+                    .meta({
+                      description:
+                        'The `PublicKeyCredentialRequestOptions`, serialized with the challenge as hex.',
+                    }),
+                })
+                .meta({
+                  description: 'The options for `navigator.credentials.get()`.',
+                }),
+              key: z
+                .object({
+                  digest: z.templateLiteral(['0x', z.string()]).meta({
+                    description:
+                      'The digest of the transaction that registers the key, which the access key signs raw. Tempo ID sponsors the transaction.',
+                    examples: [
+                      '0x3c8a5e1f0b7d2c946a1e8f3b5d7c9a2e4f6b8d0c1e3a5f7b9d2c4e6a8f0b1d3c',
+                    ],
+                  }),
+                })
+                .optional()
+                .meta({
+                  description:
+                    "The key's registration, for a request with `key_authorization` whose key the chain does not hold yet. Repeat the request with `key.signature` too.",
+                }),
+              type: z.literal('passkey').meta({
+                description:
+                  'Sign the options with the passkey, then repeat the request with `passkey.assertion`.',
+              }),
+            })
+            .meta({
+              description:
+                "The next step: the passkey's signature of the transaction, since only the passkey signs for the account.",
+            }),
+        })
+        .meta({ description: 'The passkey step.' }),
+    ])
+  }
+
+  export namespace passkeys {
+    export const response = z.object({
+      passkeys: z
+        .array(
+          z
+            .object({
+              address: address.meta({
+                description:
+                  "The address of the passkey's Tempo Account, which its public key derives.",
+                examples: ['0x7a3f9c2b1e5d8a4f6c0b3e7d9a2f5c8b1e4d7a0f'],
+              }),
+              credentialId: Passkey.schema.credentialId.meta({
+                description: 'The credential ID of the passkey, base64url.',
+                examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+              }),
+            })
+            .meta({ description: 'A wallet.tempo passkey of the email.' }),
+        )
+        .readonly()
+        .meta({
+          description:
+            "The passkeys that wallet.tempo stores for the user's email and that link to no user yet, oldest first. Empty without the wallet service.",
+        }),
+    })
+  }
+
+  export namespace upgrades {
+    export const query = z.object({
+      chain: Chain.schema.meta({
+        description:
+          'The chain to list upgrades on, such as the chain that the sign-in page shows. A chain whose accounts are not configurable lists none.',
+        examples: ['t14'],
+      }),
+    })
+
+    /** The name of the chain where an upgrade applies. */
+    const chain = Chain.schema.meta({
+      description:
+        'The name of the chain where the upgrade applies, which `CONFIGURABLE_ACCOUNTS` names.',
+      examples: ['t14'],
+    })
+
+    export const response = z.object({
+      upgrades: z
+        .array(
+          z.union([
+            z
+              .object({
+                account: address.meta({
+                  description:
+                    "The linked wallet.tempo passkey's account, which `POST /v1/account/upgrade` takes as `account`.",
+                  examples: ['0x7a3f9c2b1e5d8a4f6c0b3e7d9a2f5c8b1e4d7a0f'],
+                }),
+                chain,
+              })
+              .meta({
+                description:
+                  "A linked wallet.tempo passkey's account that is not configurable on the chain.",
+              }),
+            z
+              .object({
+                chain,
+                credentialId: Passkey.schema.credentialId.meta({
+                  description:
+                    'The credential ID of the wallet.tempo passkey, which `POST /v1/account/upgrade` takes as `credentialId`.',
+                  examples: ['KEbWNCc7NgaYnUyrNeFGX9_3Y-8'],
+                }),
+              })
+              .meta({
+                description:
+                  'A wallet.tempo passkey of the email that links to no user, whose upgrade links it.',
+              }),
+          ]),
+        )
+        .readonly()
+        .meta({
+          description:
+            'The upgrades, linked accounts first, in the order of the chains. Empty without a chain whose accounts are configurable.',
+        }),
+    })
+  }
+}
+
+/**
+ * How long the isolate keeps a listed chain's status, in milliseconds. However often the route is
+ * called, each isolate probes each chain at most once in this time.
+ */
+const statusTtl = 2_000
+
+/** The account routes. */
+export const account = new Hono<Env>()
+  .get(
+    '/v1/account',
+    OpenApi.describeRoute({
+      description:
+        'Reads the signed-in user and their Tempo Accounts in the realms of the app that `client_id` names, or of the `default` realm. The account that the user selected for the app comes first, then the oldest.',
+      responses: OpenApi.responses({
+        errors: [
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          ...TempoAccount.list.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+        ],
+        success: {
+          description: 'The user and their Tempo Accounts.',
+          schema: schema.account.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('query', schema.account.query),
+    async (c) => {
+      // The session cookie is `Lax`, so the only cross-site request that carries it is a top-level
+      // navigation. No app reads accounts that way, and a page on another site could otherwise spend
+      // the user's `ACCOUNT_LIMIT` by navigating a window here.
+      if (c.req.header('sec-fetch-site') === 'cross-site')
+        return ErrorResponse.json(c, new ErrorResponse.CrossSiteRequestError())
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+
+      // An unknown name is refused before it spends a read of the limit.
+      const { chain } = c.req.valid('query')
+      const target = chain
+        ? ChainList.resolve({
+            name: chain,
+            rpcUrl: env.TEMPO_RPC_URL,
+            rpcUrls: env.RPC_URLS,
+          })
+        : undefined
+      if (chain && !target)
+        return ErrorResponse.json(c, unknownChain({ chain }))
+
+      // Each read can call the Privy app of every realm with that app's secret, so one user's reads
+      // are limited before they spend the Privy quota that every user shares.
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      const stored = await Timing.measure(
+        c,
+        Realm.forRequest(c, {
+          clientId: c.req.valid('query').client_id,
+          db,
+          origin: c.req.header('origin'),
+          own: new URL(env.URL).origin,
+        }),
+        'Realm.forRequest',
+      )
+      const realms = await Timing.measure(
+        c,
+        Realm.withDefaults(c, { db, origin: env.URL, realms: stored }),
+        'Realm.withDefaults',
+      )
+      const tempo = await Timing.measure(
+        c,
+        TempoAccount.list(c, {
+          chainId: target?.chainId,
+          db,
+          env,
+          realms,
+          userId: session.user.id,
+        }),
+        'TempoAccount.list',
+      )
+      // The account that the user selected for the app comes first.
+      const { client_id: clientId } = c.req.valid('query')
+      const ordered = clientId
+        ? AccountStep.order(tempo, {
+            clientId,
+            cookie: c.req.header('cookie'),
+            sessionId: session.session.id,
+          })
+        : tempo
+      const balances = target
+        ? await Timing.measure(
+            c,
+            Balance.list(c, {
+              accounts: ordered,
+              apiUrl: Chain.apiUrl({
+                apiUrls: env.TEMPO_API_URLS,
+                chainId: target.chainId,
+              }),
+              chainId: target.chainId,
+            }),
+            'Balance.list',
+          )
+        : undefined
+      c.header('cache-control', 'private, no-store')
+      return c.json(
+        {
+          email: session.user.email,
+          id: session.user.id,
+          // Better Auth stores an empty name for a user who signed up without one.
+          name: session.user.name || null,
+          passkeys: Boolean(Passkey.relyingParty(realms, { origin: env.URL })),
+          tempo: ordered.map((account, index) =>
+            balances
+              ? { ...account, balance: balances[index] ?? null }
+              : account,
+          ),
+        },
+        200,
+      )
+    },
+  )
+  .post(
+    '/v1/account',
+    OpenApi.describeRoute({
+      description:
+        'Returns the signed-in user and their Tempo Accounts, as `GET /v1/account` does. For a user with no account or passkey, it also creates a Privy-owned account in the first realm, when that realm has a Privy app. The JSON body needs a CORS preflight, which Tempo ID grants only to the origins of first-party apps.',
+      responses: OpenApi.responses({
+        errors: [
+          ...BodyLimit.errors,
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          ...TempoAccount.create.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+        ],
+        success: {
+          description: 'The user and their Tempo Accounts.',
+          schema: schema.create.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('json', schema.create.json),
+    async (c) => {
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+
+      // An unknown name is refused before any work, so `POST` creates no account for it.
+      const { chain } = c.req.valid('json')
+      const target = chain
+        ? ChainList.resolve({
+            name: chain,
+            rpcUrl: env.TEMPO_RPC_URL,
+            rpcUrls: env.RPC_URLS,
+          })
+        : undefined
+      if (chain && !target)
+        return ErrorResponse.json(c, unknownChain({ chain }))
+
+      // The request reads every realm's Privy app as `GET /v1/account` does, so it counts against
+      // the same limit.
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      const stored = await Timing.measure(
+        c,
+        Realm.forRequest(c, {
+          clientId: c.req.valid('json').client_id,
+          db,
+          origin: c.req.header('origin'),
+          own: new URL(env.URL).origin,
+        }),
+        'Realm.forRequest',
+      )
+      const realms = await Timing.measure(
+        c,
+        Realm.withDefaults(c, { db, origin: env.URL, realms: stored }),
+        'Realm.withDefaults',
+      )
+      // A wallet.tempo passkey of the user's email becomes their account through its upgrade, so the
+      // request creates no cloud wallet beside it, as a sign-in does.
+      const waits = await Timing.measure(
+        c,
+        Configure.awaitsUpgrade(c, {
+          email: session.user.email,
+          realms,
+          userId: session.user.id,
+        }),
+        'Configure.awaitsUpgrade',
+      )
+      const options = {
+        chainId: target?.chainId,
+        db,
+        env,
+        realms,
+        userId: session.user.id,
+      }
+      const owners = await Timing.measure(
+        c,
+        waits ? TempoAccount.held(c, options) : TempoAccount.create(c, options),
+        'TempoAccount.create',
+      )
+      const tempo = owners.map(TempoAccount.serialize)
+      // The account that the user selected for the app comes first, as `GET /v1/account` lists it.
+      const { client_id: clientId } = c.req.valid('json')
+      const ordered = clientId
+        ? AccountStep.order(tempo, {
+            clientId,
+            cookie: c.req.header('cookie'),
+            sessionId: session.session.id,
+          })
+        : tempo
+      const balances = target
+        ? await Timing.measure(
+            c,
+            Balance.list(c, {
+              accounts: ordered,
+              apiUrl: Chain.apiUrl({
+                apiUrls: env.TEMPO_API_URLS,
+                chainId: target.chainId,
+              }),
+              chainId: target.chainId,
+            }),
+            'Balance.list',
+          )
+        : undefined
+      c.header('cache-control', 'private, no-store')
+      return c.json(
+        {
+          email: session.user.email,
+          id: session.user.id,
+          name: session.user.name || null,
+          passkeys: Boolean(Passkey.relyingParty(realms, { origin: env.URL })),
+          tempo: ordered.map((account, index) =>
+            balances
+              ? { ...account, balance: balances[index] ?? null }
+              : account,
+          ),
+        },
+        200,
+      )
+    },
+  )
+  .post(
+    '/v1/account/passkey/options',
+    OpenApi.describeRoute({
+      description:
+        "Issues a single-use registration challenge for the signed-in user, and returns creation options for a passkey of the `default` realm. Requires a sign-in within the last 10 minutes and fewer than 10 passkeys. Only Tempo ID's own page sends the request.",
+      responses: OpenApi.responses({
+        errors: [
+          ...BodyLimit.errors,
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+          Passkey.LimitError,
+          Passkey.NotPermittedError,
+          Passkey.ReauthenticationRequiredError,
+        ],
+        success: {
+          description: 'The creation options.',
+          schema: schema.passkeyOptions.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('json', schema.passkeyOptions.json),
+    async (c) => {
+      // The ceremony runs at Tempo ID's origin, so only its own page registers a passkey.
+      if (Cors.appOrigin(c))
+        return ErrorResponse.json(c, new ErrorResponse.CrossSiteRequestError())
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+      if (!fresh(session))
+        return ErrorResponse.json(
+          c,
+          new Passkey.ReauthenticationRequiredError(),
+        )
+
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      // One read returns the passkeys that the limit counts and the ones that the options exclude.
+      const userId = session.user.id
+      const held = await Timing.measure(
+        c,
+        Passkey.list(db, { userId }),
+        'Passkey.list',
+      )
+      if (
+        held.filter((key) => key.registered).length >= Passkey.registrationLimit
+      )
+        return ErrorResponse.json(c, new Passkey.LimitError())
+
+      const realms = await Timing.measure(
+        c,
+        Realm.withDefaults(c, {
+          db,
+          origin: env.URL,
+          realms: [
+            await Timing.measure(
+              c,
+              Cache.read(c, () => Realm.get(db, { id: Realm.defaultId }), [
+                'realm.get',
+                Realm.defaultId,
+              ]),
+              'Realm.get',
+            ),
+          ],
+        }),
+        'Realm.withDefaults',
+      )
+      const relyingParty = Passkey.relyingParty(realms, { origin: env.URL })
+      const realm = realms.find((entry) => entry.id === relyingParty?.realmId)
+      if (!relyingParty || !realm)
+        return ErrorResponse.json(c, new Passkey.NotPermittedError())
+
+      const challenge = await Timing.measure(
+        c,
+        Passkey.requestRegistration(db, { rpId: relyingParty.rpId, userId }),
+        'Passkey.requestRegistration',
+      )
+      const excluded = held.flatMap((key) =>
+        key.rpId === relyingParty.rpId ? [key.id] : [],
+      )
+      const options = schema.passkeyOptions.response.shape.options.parse(
+        Registration.getOptions({
+          authenticatorSelection: {
+            requireResidentKey: true,
+            residentKey: 'required',
+            userVerification: 'required',
+          },
+          challenge,
+          ...(excluded.length > 0 ? { excludeCredentialIds: excluded } : {}),
+          rp: { id: relyingParty.rpId, name: realm.name },
+          // A random handle per passkey, since an authenticator replaces the passkey of the same
+          // relying party and handle, and with it the only key of that passkey's account.
+          user: {
+            displayName: session.user.name || session.user.email,
+            id: crypto.getRandomValues(new Uint8Array(32)),
+            name: session.user.email,
+          },
+        }).options,
+      )
+      c.header('cache-control', 'private, no-store')
+      return c.json({ options }, 200)
+    },
+  )
+  .post(
+    '/v1/account/passkey',
+    OpenApi.describeRoute({
+      description:
+        "Verifies a new passkey's credential over a challenge from `POST /v1/account/passkey/options`, and returns a proof challenge for the passkey to sign. The attestation carries no signature, so only `POST /v1/account/passkey/verify` stores the passkey. Requires a sign-in within the last 10 minutes. Only Tempo ID's own page sends the request.",
+      responses: OpenApi.responses({
+        errors: [
+          ...BodyLimit.errors,
+          ...ErrorResponse.fromUpstream.errors,
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+          Passkey.LimitError,
+          Passkey.ReauthenticationRequiredError,
+          Passkey.WebAuthnRejectedError,
+        ],
+        success: {
+          description: 'The proof step.',
+          schema: schema.passkey.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('json', schema.passkey.json),
+    async (c) => {
+      if (Cors.appOrigin(c))
+        return ErrorResponse.json(c, new ErrorResponse.CrossSiteRequestError())
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+      if (!fresh(session))
+        return ErrorResponse.json(
+          c,
+          new Passkey.ReauthenticationRequiredError(),
+        )
+
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      // The challenge is spent before any other check, so a failed attempt cannot be retried.
+      const { credential } = c.req.valid('json')
+      const userId = session.user.id
+      const challenge = await Timing.measure(
+        c,
+        Passkey.takeRegistration(db, {
+          clientDataJSON: credential.clientDataJSON,
+          userId,
+        }),
+        'Passkey.takeRegistration',
+      )
+      const verified = challenge
+        ? Passkey.verifyRegistration(credential, {
+            challenge: challenge.challenge,
+            origin: new URL(env.URL).origin,
+            rpId: challenge.rpId,
+          })
+        : undefined
+      if (!challenge || !verified)
+        return ErrorResponse.json(c, new Passkey.WebAuthnRejectedError())
+
+      // A credential ID that wallet.tempo stores belongs to its passkey, which links at its first
+      // sign-in. A registration of it would take the ID with another key. The lookup and the count
+      // run together, and their refusals keep this order.
+      const [wallet, count] = await Promise.all([
+        (async () => {
+          if (!c.env.WALLET) return undefined
+          try {
+            return await Timing.measure(
+              c,
+              Wallet.credential(c.env.WALLET, { id: verified.id }),
+              'Wallet.credential',
+            )
+          } catch (error) {
+            // Only the binding call throws, so the failure is wallet.tempo's.
+            Log.warn(c, {
+              error,
+              message: 'The wallet service failed a passkey lookup.',
+            })
+            return (
+              (error instanceof Error && ErrorResponse.fromUpstream(error)) ||
+              new ErrorResponse.UpstreamUnavailableError()
+            )
+          }
+        })(),
+        Timing.measure(
+          c,
+          Passkey.registered(db, { userId }),
+          'Passkey.registered',
+        ),
+      ])
+      if (wallet instanceof ErrorResponse.ResponseError)
+        return ErrorResponse.json(c, wallet)
+      if (wallet)
+        return ErrorResponse.json(c, new Passkey.WebAuthnRejectedError())
+
+      if (count >= Passkey.registrationLimit)
+        return ErrorResponse.json(c, new Passkey.LimitError())
+
+      const proof = await Timing.measure(
+        c,
+        Passkey.requestProof(db, {
+          credential: verified,
+          rpId: challenge.rpId,
+          userId,
+        }),
+        'Passkey.requestProof',
+      )
+      const options = schema.passkey.response.shape.step.shape.options.parse(
+        Authentication.getOptions({
+          challenge: proof,
+          credentialId: [verified.id],
+          rpId: challenge.rpId,
+          userVerification: 'required',
+        }).options,
+      )
+      c.header('cache-control', 'private, no-store')
+      return c.json({ step: { options, type: 'passkey' as const } }, 200)
+    },
+  )
+  .post(
+    '/v1/account/passkey/verify',
+    OpenApi.describeRoute({
+      description:
+        "Registers a passkey for the signed-in user with its assertion over the proof challenge. The passkey owns its own Tempo Account in the `default` realm, or joins `account` as a second owner. Requires a sign-in within the last 10 minutes. Only Tempo ID's own page sends the request.",
+      responses: OpenApi.responses({
+        errors: [
+          ...BodyLimit.errors,
+          ...Configure.find.errors,
+          ...Configure.send.errors,
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          ConfigurableAccount.NotConfigurableError,
+          ConfigurableAccount.OwnerExistsError,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+          Passkey.LimitError,
+          Passkey.ReauthenticationRequiredError,
+          Passkey.WebAuthnRejectedError,
+        ],
+        success: {
+          description: 'The passkey and the address of the account it owns.',
+          schema: schema.passkeyVerify.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('json', schema.passkeyVerify.json),
+    async (c) => {
+      if (Cors.appOrigin(c))
+        return ErrorResponse.json(c, new ErrorResponse.CrossSiteRequestError())
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+      if (!fresh(session))
+        return ErrorResponse.json(
+          c,
+          new Passkey.ReauthenticationRequiredError(),
+        )
+
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      // The challenge is spent before any other check, so a failed attempt cannot be retried.
+      const { assertion } = c.req.valid('json')
+      const userId = session.user.id
+      const proof = await Timing.measure(
+        c,
+        Passkey.takeProof(db, {
+          clientDataJSON: assertion.metadata.clientDataJSON,
+          userId,
+        }),
+        'Passkey.takeProof',
+      )
+      // Only the attested public key verifies the proof, so the user holds its private key.
+      if (
+        !proof ||
+        assertion.id !== proof.id ||
+        !Passkey.verify(assertion, {
+          challenge: proof.challenge,
+          origin: new URL(env.URL).origin,
+          publicKey: proof.publicKey,
+          rpId: proof.rpId,
+        })
+      )
+        return ErrorResponse.json(c, new Passkey.WebAuthnRejectedError())
+
+      // A passkey that joins an account is checked before it is stored, so a refusal stores none.
+      const { account, chain } = c.req.valid('json')
+      const joined = account
+        ? await Timing.measure(
+            c,
+            Configure.find(c, { account, chain, userId }),
+            'Configure.find',
+          )
+        : undefined
+      if (joined instanceof ErrorResponse.ResponseError)
+        return ErrorResponse.json(c, joined)
+      // A passkey joins only an account that is configurable already.
+      if (joined && !joined.current)
+        return ErrorResponse.json(
+          c,
+          new ConfigurableAccount.NotConfigurableError({
+            account: Owner.address(joined.owner),
+            reason: 'upgrade',
+          }),
+        )
+      if (
+        joined &&
+        (joined.owner.type === 'webAuthn' ||
+          joined.current?.owners.some((entry) => entry.type === 'webAuthn'))
+      )
+        return ErrorResponse.json(
+          c,
+          new ConfigurableAccount.OwnerExistsError({
+            account: Owner.address(joined.owner),
+            owner: 'passkey',
+          }),
+        )
+
+      const stored = await Timing.measure(
+        c,
+        Passkey.register(db, {
+          id: proof.id,
+          publicKey: proof.publicKey,
+          rpId: proof.rpId,
+          userId,
+        }),
+        'Passkey.register',
+      )
+      TempoAccount.forget(c)
+      if (stored === 'limit')
+        return ErrorResponse.json(c, new Passkey.LimitError())
+      // Another row holds the credential ID or the address, or the realm's relying party changed.
+      if (stored !== 'stored')
+        return ErrorResponse.json(c, new Passkey.WebAuthnRejectedError())
+
+      const address = Address.checksum(
+        Address.fromPublicKey(PublicKey.fromHex(proof.publicKey)),
+      )
+      c.header('cache-control', 'private, no-store')
+      if (!joined) {
+        // On a chain whose accounts are configurable, the passkey owns the account that its initial
+        // configuration derives there, which no row stores.
+        const configurable = chain
+          ? ConfigurableAccount.chains({
+              rpcUrl: env.TEMPO_RPC_URL,
+              rpcUrls: env.RPC_URLS,
+              value: env.CONFIGURABLE_ACCOUNTS,
+            }).find((entry) => entry.name === chain)
+          : undefined
+        if (!configurable) return c.json({ address, id: proof.id }, 200)
+        const config = ConfigurableAccount.created({
+          chainId: configurable.chainId,
+          key: address,
+          type: 'webAuthn',
+        })
+        return c.json({ address: config.address, id: proof.id }, 200)
+      }
+
+      // The account's cloud wallet signs the change on the server: no passkey owns the account, so
+      // its key, or an owner of its configuration, is a kind that signs there. A failed change
+      // leaves the passkey stored, as the owner of its own account.
+      const { client, current, owner } = joined
+      const target = ConfigurableAccount.next({
+        add: [{ address, type: 'webAuthn', weight: 1 }],
+        address: Owner.address(owner),
+        chainId: joined.chain.chainId,
+        current,
+        type: owner.type,
+      })
+      await Configure.send(c, {
+        client,
+        current,
+        signing: Configure.signer(owner, { current }),
+        target,
+        userId,
+      })
+      return c.json({ address: target.address, id: proof.id }, 200)
+    },
+  )
+  .get(
+    '/v1/realms',
+    OpenApi.describeRoute({
+      description:
+        'Lists the realms of the app that `client_id` names, in order, and whether its passkey sign-in runs on the page that sends the request. An app without realms reaches the `default` realm alone.',
+      responses: OpenApi.responses({
+        errors: [...OpenApi.validate.errors],
+        success: {
+          description: 'The realms.',
+          schema: schema.realms.response,
+        },
+      }),
+      tags: ['Account'],
+    }),
+    OpenApi.validate('query', schema.realms.query),
+    async (c) => {
+      const clientId = c.req.valid('query').client_id
+      const realms = await Timing.measure(
+        c,
+        Realm.forRequest(c, {
+          clientId,
+          db,
+          origin: c.req.header('origin'),
+          own: new URL(env.URL).origin,
+        }),
+        'Realm.forRequest',
+      )
+      // The checks are those of `POST /v1/auth/passkey/options` from an app's page, so a page that
+      // reads `true` requests options that the route issues.
+      const page = Cors.appOrigin(c)
+      const passkeys = await (async () => {
+        if (!page || !clientId) return false
+        const app = await Timing.measure(
+          c,
+          Headless.app(c, { clientId }),
+          'Headless.app',
+        )
+        if (Passkey.checkPage({ app, clientId, origin: page })) return false
+        const reached = await Timing.measure(
+          c,
+          Realm.withDefaults(c, { db, origin: env.URL, realms }),
+          'Realm.withDefaults',
+        )
+        return (
+          Passkey.relyingParty(reached, { origin: env.URL, page }) !== undefined
+        )
+      })()
+      // The response follows the request's `Origin`, so no shared cache keeps it.
+      c.header('cache-control', 'private, no-store')
+      return c.json(
+        {
+          passkeys,
+          realms: realms.map((realm) => ({ id: realm.id, name: realm.name })),
+        },
+        200,
+      )
+    },
+  )
+  // The response names no RPC URL, since a listed URL can hold an RPC provider's key. Every app's
+  // page reads it, so it grants CORS to any origin.
+  .get(
+    '/v1/chains',
+    OpenApi.describeRoute({
+      description:
+        'Lists the chains that the `chain` parameter selects, each with its chain ID: `mainnet`, `testnet`, then the chains that the deployment lists.',
+      responses: OpenApi.responses({
+        success: {
+          description: 'The chains.',
+          schema: schema.chains.response,
+        },
+      }),
+      tags: ['Account'],
+    }),
+    (c) => c.json({ chains: chains() }, 200),
+  )
+  .get(
+    '/i/chains',
+    OpenApi.describeRoute({
+      description:
+        "Lists the chains that the `chain` parameter of `GET /v1/account` and `POST /v1/account` selects, as `GET /v1/chains` does, each with whether its faucet funds accounts. Internal: only Tempo ID's own pages send the request, so the public document leaves it out.",
+      // Internal routes stay out of `/openapi.json` and `/docs`.
+      hide: true,
+      responses: OpenApi.responses({
+        success: {
+          description: 'The chains.',
+          schema: schema.pageChains.response,
+        },
+      }),
+      tags: ['Account'],
+    }),
+    // Pages read the faucet here, so no page bundles the chain definitions that `Faucet` reads.
+    (c) =>
+      c.json(
+        {
+          chains: chains().map((entry) => ({
+            ...entry,
+            faucet: Faucet.chains.some((chain) => chain.id === entry.chainId),
+          })),
+        },
+        200,
+      ),
+  )
+  // The route probes the nodes and Tempo APIs that the deployment lists, so only Tempo ID's own
+  // page sends it, and the isolate keeps each status for `statusTtl`. The built-in chains are never
+  // probed, so a deployment that lists no other chain sends no probe.
+  .get(
+    '/i/chains/status',
+    OpenApi.describeRoute({
+      description:
+        "Returns whether the node and the Tempo API of each chain that the deployment lists respond, apart from `mainnet` and `testnet`. A probe that fails or takes longer than a second reads as `down`, and a status can be up to 2 seconds old. Internal: only Tempo ID's own page sends the request, so the public document leaves it out.",
+      // Internal routes stay out of `/openapi.json` and `/docs`.
+      hide: true,
+      responses: OpenApi.responses({
+        errors: [...Cors.internal.errors],
+        success: {
+          description: 'The status of each listed chain.',
+          schema: schema.chainStatus.response,
+        },
+      }),
+      tags: ['Account'],
+    }),
+    async (c) => {
+      const crossSite = Cors.internal(c)
+      if (crossSite) return ErrorResponse.json(c, crossSite)
+
+      const entries = ChainList.list({ value: env.RPC_URLS }).filter(
+        (entry) => !(entry.name in ChainList.ids),
+      )
+      const statuses = await Promise.all(
+        entries.map(async (entry) => {
+          const status = await Timing.measure(
+            c,
+            Cache.read(
+              c,
+              () =>
+                ChainStatus.get({
+                  apiUrl: Chain.apiUrl({
+                    apiUrls: env.TEMPO_API_URLS,
+                    chainId: entry.chainId,
+                  }),
+                  chainId: entry.chainId,
+                  rpcUrl: entry.url,
+                }),
+              ['ChainStatus.get', entry.name],
+              { ttl: statusTtl },
+            ),
+            'ChainStatus.get',
+          )
+          return { ...status, chainId: entry.chainId, name: entry.name }
+        }),
+      )
+
+      c.header('cache-control', 'no-store')
+      return c.json({ chains: statuses }, 200)
+    },
+  )
+  .post(
+    '/i/account/fund',
+    OpenApi.describeRoute({
+      description:
+        "Funds one of the signed-in user's Tempo Accounts in the `default` realm from the faucet of the test chain that `chain` names, and waits until each transfer lands. Tempo mainnet has no faucet. Internal: only Tempo ID's own page sends the request, so the public document leaves it out.",
+      // Internal routes stay out of `/openapi.json` and `/docs`.
+      hide: true,
+      responses: OpenApi.responses({
+        errors: [
+          ...BodyLimit.errors,
+          ...Cors.internal.errors,
+          ...OpenApi.validate.errors,
+          ...ErrorResponse.fromUpstream.errors,
+          ...RateLimit.check.errors,
+          ...TempoAccount.list.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+        ],
+        success: {
+          description: 'The transfers from the faucet.',
+          schema: schema.fund.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('json', schema.fund.json),
+    async (c) => {
+      const crossSite = Cors.internal(c)
+      if (crossSite) return ErrorResponse.json(c, crossSite)
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+
+      // A chain without a faucet is refused before the request spends a read of the limit.
+      const { address, chain } = c.req.valid('json')
+      const target = ChainList.resolve({
+        name: chain,
+        rpcUrl: env.TEMPO_RPC_URL,
+        rpcUrls: env.RPC_URLS,
+      })
+      if (!target) return ErrorResponse.json(c, unknownChain({ chain }))
+      const faucet = Faucet.chains.find((entry) => entry.id === target.chainId)
+      if (!faucet) return ErrorResponse.json(c, noFaucet({ chain }))
+
+      // The account check reads every realm's Privy app as `GET /v1/account` does, so it counts
+      // against the same limit.
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      const stored = await Timing.measure(
+        c,
+        Realm.forRequest(c, {
+          clientId: undefined,
+          db,
+          origin: c.req.header('origin'),
+          own: new URL(env.URL).origin,
+        }),
+        'Realm.forRequest',
+      )
+      const realms = await Timing.measure(
+        c,
+        Realm.withDefaults(c, { db, origin: env.URL, realms: stored }),
+        'Realm.withDefaults',
+      )
+      const tempo = await Timing.measure(
+        c,
+        TempoAccount.list(c, {
+          chainId: target.chainId,
+          db,
+          env,
+          realms,
+          userId: session.user.id,
+        }),
+        'TempoAccount.list',
+      )
+      // Only the user's own accounts receive tokens, so the faucet is no open relay.
+      const found = tempo.find(
+        (entry) => entry.address.toLowerCase() === address.toLowerCase(),
+      )
+      if (!found) return ErrorResponse.json(c, unknownAccount({ address }))
+
+      const transactions = await (async () => {
+        try {
+          return await Timing.measure(
+            c,
+            Faucet.fund({
+              address: found.address,
+              chain: faucet,
+              rpcUrl: target.rpcUrl,
+            }),
+            'Faucet.fund',
+          )
+        } catch (error) {
+          // `ErrorResponse.handle` maps and logs a 429, a 5xx, or no response. A JSON-RPC refusal or a
+          // transfer that never lands is the node's failure too, so it maps the same way.
+          if (!(error instanceof Error) || ErrorResponse.fromUpstream(error))
+            throw error
+          Log.warn(c, {
+            error,
+            message: 'The faucet did not fund the account.',
+          })
+          throw new ErrorResponse.UpstreamUnavailableError()
+        }
+      })()
+      return c.json({ transactions }, 200)
+    },
+  )
+  .post(
+    '/v1/account/upgrade',
+    OpenApi.describeRoute({
+      description:
+        "Upgrades a wallet.tempo passkey's Tempo Account of the signed-in user in place to a configurable account (TIP-1113), on a chain whose accounts are configurable. The account keeps its address, and the passkey stays its only owner. The first request returns the passkey step, and the repeat with `passkey.assertion` sends the upgrade. With `key_authorization`, Tempo ID first registers that key, sponsored, so it keeps working. Requires a sign-in within the last 10 minutes.",
+      responses: OpenApi.responses({
+        errors: [
+          ...BodyLimit.errors,
+          ...Configure.confirm.errors,
+          ...Configure.root.errors,
+          ...Cors.internal.errors,
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          core_Auth.SessionRequiredError,
+          KeyAuthorization.WebAuthnRequiredError,
+          Passkey.ReauthenticationRequiredError,
+          Validation.InvalidFieldError,
+        ],
+        success: {
+          description: 'The upgraded account, or the passkey step.',
+          schema: schema.upgrade.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('json', schema.upgrade.json),
+    async (c) => {
+      const {
+        account,
+        client_id: clientId,
+        credentialId,
+        key,
+        key_authorization: keyAuthorization,
+        passkey,
+      } = c.req.valid('json')
+      // Only Tempo ID's own page lists the passkeys of the email that have not linked, so only it
+      // links one.
+      const session = await owned(c, { internal: credentialId !== undefined })
+      if (session instanceof Response) return session
+      const userId = session.user.id
+
+      const requested = keyAuthorization
+        ? ox_KeyAuthorization.fromRpc(keyAuthorization as never)
+        : undefined
+      const chain =
+        c.req.valid('json').chain ??
+        (requested
+          ? ConfigurableAccount.on({ chainId: Number(requested.chainId), env })
+              ?.name
+          : undefined)
+      const root = await Timing.measure(
+        c,
+        Configure.root(c, {
+          account,
+          chain,
+          clientId,
+          credentialId,
+          email: session.user.email,
+          userId,
+        }),
+        'Configure.root',
+      )
+      if (root instanceof ErrorResponse.ResponseError)
+        return ErrorResponse.json(c, root)
+      c.header('cache-control', 'private, no-store')
+
+      // A first-party app's page runs the ceremony at its own origin, which the passkey's relying
+      // party must cover beside Tempo ID's.
+      const page = Cors.appOrigin(c)
+      const origin = page ?? new URL(env.URL).origin
+
+      // The repeated request sends the upgrade that the passkey step prepared, whose challenge it
+      // spends before any other check, so a refused assertion cannot be tried again.
+      if (passkey) {
+        const installed = await Timing.measure(
+          c,
+          Configure.confirm(c, {
+            account: root.account,
+            assertion: passkey.assertion,
+            client: root.client,
+            credential: root.credential,
+            keySignature: key?.signature,
+            link: root.link,
+            origin,
+            userId,
+          }),
+          'Configure.confirm',
+        )
+        if (installed instanceof ErrorResponse.ResponseError)
+          return ErrorResponse.json(c, installed)
+        const upgraded = await Timing.measure(
+          c,
+          reread(c, {
+            account: root.account,
+            chain: root.chain,
+            clientId,
+            userId,
+          }),
+          'reread',
+        )
+        return c.json({ account: upgraded }, 200)
+      }
+
+      // A passkey signs only at its relying party, which must cover Tempo ID's origin, and the app's.
+      if (
+        Passkey.relyingParty([root.realm], { origin: env.URL, page })?.rpId !==
+        root.credential.rpId
+      )
+        return ErrorResponse.json(
+          c,
+          passkeyElsewhere({ account: root.account }),
+        )
+
+      const target = ConfigurableAccount.next({
+        add: [],
+        address: root.account,
+        chainId: root.chain.chainId,
+        current: undefined,
+        type: 'webAuthn',
+      })
+
+      const refused = requested
+        ? unsignedKey(requested, {
+            chainId: root.chain.chainId,
+            publicKey: root.credential.publicKey,
+          })
+        : undefined
+      if (refused) return ErrorResponse.json(c, refused)
+      // A key that the chain holds already needs no registration, such as after an upgrade that failed.
+      // A revoked key cannot sign after the upgrade, and no registration replaces it.
+      const status = requested
+        ? await Configure.submit(c, () =>
+            ConfigurableAccount.keyStatus({
+              account: root.account,
+              client: root.client,
+              key: requested.address,
+            }),
+          )
+        : 'active'
+      if (status === 'revoked') return ErrorResponse.json(c, revokedKey())
+      const held = status === 'active'
+      // An upgrade that the chain accepted, and whose save failed, leaves the chain at the target. The
+      // repeated request saves it, since a new upgrade would conflict with the chain.
+      const done = await Timing.measure(
+        c,
+        ConfigurableAccount.installed({ client: root.client, target }),
+        'ConfigurableAccount.installed',
+      )
+      if (done) {
+        const refused = root.link
+          ? await Timing.measure(c, root.link(), 'Configure.link')
+          : undefined
+        if (refused) return ErrorResponse.json(c, refused)
+        await Timing.measure(
+          c,
+          ConfigurableAccount.save(db, { config: target, userId }),
+          'db.accountConfig.save',
+        )
+        const upgraded = await Timing.measure(
+          c,
+          reread(c, {
+            account: root.account,
+            chain: root.chain,
+            clientId,
+            userId,
+          }),
+          'reread',
+        )
+        // The upgrade retired the signature of the key that the passkey signed as the account's own,
+        // so the chain can no longer register it.
+        if (!held) return ErrorResponse.json(c, retiredKey())
+        return c.json({ account: upgraded }, 200)
+      }
+
+      const registration = held
+        ? undefined
+        : await Configure.submit(c, () =>
+            ConfigurableAccount.requestRegistration({
+              account: root.account,
+              client: root.client,
+              key: requested!,
+            }),
+          )
+      if (!held && !registration) return ErrorResponse.json(c, unregistrable())
+
+      const options =
+        schema.upgrade.response.options[1].shape.step.shape.options.parse(
+          await Timing.measure(
+            c,
+            Configure.request(c, {
+              account: root.account,
+              client: root.client,
+              credential: root.credential,
+              current: undefined,
+              registration,
+              target,
+              userId,
+            }),
+            'Configure.request',
+          ),
+        )
+      return c.json(
+        {
+          step: {
+            options,
+            ...(registration ? { key: { digest: registration.digest } } : {}),
+            type: 'passkey' as const,
+          },
+        },
+        200,
+      )
+    },
+  )
+  .get(
+    '/i/account/passkeys',
+    OpenApi.describeRoute({
+      description:
+        "Lists the wallet.tempo passkeys of the signed-in user's email that link to no user yet, which `POST /v1/account/upgrade` takes as `credentialId`. The sign-in proved the email, so the list reveals nothing to another person. Counts against the user's `ACCOUNT_LIMIT`. Refuses a cross-site navigation with `cross_site_request`. Internal: only Tempo ID's own page sends the request, so the public document leaves it out.",
+      // Internal routes stay out of `/openapi.json` and `/docs`.
+      hide: true,
+      responses: OpenApi.responses({
+        errors: [
+          ...ErrorResponse.fromUpstream.errors,
+          ...RateLimit.check.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+        ],
+        success: {
+          description: 'The passkeys.',
+          schema: schema.passkeys.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    async (c) => {
+      // The session cookie is `Lax`, so the only cross-site request that carries it is a top-level
+      // navigation, which could otherwise spend the user's `ACCOUNT_LIMIT` and call wallet.tempo.
+      // The page's loader calls the route in process, without `Sec-Fetch-Site`.
+      if (c.req.header('sec-fetch-site') === 'cross-site')
+        return ErrorResponse.json(c, new ErrorResponse.CrossSiteRequestError())
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      const listed = await Timing.measure(
+        c,
+        Configure.unlinked(c, { email: session.user.email }),
+        'Configure.unlinked',
+      )
+      c.header('cache-control', 'private, no-store')
+      return c.json(
+        {
+          passkeys: listed.map((entry) => ({
+            address: Address.checksum(entry.address as `0x${string}`),
+            credentialId: entry.credentialId,
+          })),
+        },
+        200,
+      )
+    },
+  )
+  .get(
+    '/i/account/upgrades',
+    OpenApi.describeRoute({
+      description:
+        "Lists the upgrades that wait for the signed-in user on `chain`, which the sign-in page offers, when `CONFIGURABLE_ACCOUNTS` names it. Each linked wallet.tempo passkey's account without a configuration on the chain comes first. For a user who holds no account, each wallet.tempo passkey of the email that links to no user follows. `POST /v1/account/upgrade` takes either. Reads stored rows and wallet.tempo, never a chain. Counts against the user's `ACCOUNT_LIMIT`. Refuses a cross-site navigation with `cross_site_request`. Internal: only Tempo ID's own page sends the request, so the public document leaves it out.",
+      // Internal routes stay out of `/openapi.json` and `/docs`.
+      hide: true,
+      responses: OpenApi.responses({
+        errors: [
+          ...ErrorResponse.fromUpstream.errors,
+          ...OpenApi.validate.errors,
+          ...RateLimit.check.errors,
+          core_Auth.SessionRequiredError,
+          ErrorResponse.CrossSiteRequestError,
+        ],
+        success: {
+          description: 'The upgrades.',
+          schema: schema.upgrades.response,
+        },
+      }),
+      security: [{ sessionCookie: [] }],
+      tags: ['Account'],
+    }),
+    OpenApi.validate('query', schema.upgrades.query),
+    async (c) => {
+      // A cross-site navigation carries the `Lax` cookie, and could spend the user's `ACCOUNT_LIMIT`,
+      // as on `GET /i/account/passkeys`.
+      if (c.req.header('sec-fetch-site') === 'cross-site')
+        return ErrorResponse.json(c, new ErrorResponse.CrossSiteRequestError())
+
+      const session = await Timing.measure(c, Session.get(c), 'Session.get')
+      if (!session)
+        return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+      const refused = await Timing.measure(
+        c,
+        RateLimit.check(c, {
+          limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+        }),
+        'RateLimit.check',
+      )
+      if (refused) return refused
+
+      const upgrades = await Timing.measure(
+        c,
+        Configure.upgrades(c, {
+          chain: c.req.valid('query').chain,
+          email: session.user.email,
+          userId: session.user.id,
+        }),
+        'Configure.upgrades',
+      )
+      c.header('cache-control', 'private, no-store')
+      return c.json({ upgrades }, 200)
+    },
+  )
+
+/**
+ * Checks an owner change's request: it comes from Tempo ID's own page, from a session that signed in
+ * within the last 10 minutes, within the user's `ACCOUNT_LIMIT`. Returns the session, or the refusal
+ * as a response.
+ */
+async function owned(c: Context<Env>, options: owned.Options = {}) {
+  const { internal = true } = options
+  const crossSite = internal ? Cors.internal(c) : undefined
+  if (crossSite) return ErrorResponse.json(c, crossSite)
+
+  const session = await Timing.measure(c, Session.get(c), 'Session.get')
+  if (!session)
+    return ErrorResponse.json(c, new core_Auth.SessionRequiredError())
+  // A new owner can sign for the account, so an open session alone adds none.
+  if (!fresh(session))
+    return ErrorResponse.json(c, new Passkey.ReauthenticationRequiredError())
+
+  const refused = await Timing.measure(
+    c,
+    RateLimit.check(c, {
+      limits: [{ binding: 'ACCOUNT_LIMIT', key: session.user.id }],
+    }),
+    'RateLimit.check',
+  )
+  if (refused) return refused
+  return session
+}
+
+declare namespace owned {
+  type Options = {
+    /** Whether only Tempo ID's own page sends the request. Defaults to `true`. */
+    internal?: boolean | undefined
+  }
+}
+
+/**
+ * Returns the refusal of `key` when the account's passkey, `publicKey`, did not sign it as the
+ * account's own key on the chain `chainId`, or it expired, or `undefined`. The chain verifies the
+ * signature itself when it registers the key.
+ */
+function unsignedKey(
+  key: ox_KeyAuthorization.Signed,
+  options: unsignedKey.Options,
+) {
+  const refuse = (message: string, field: string) =>
+    new Validation.InvalidFieldError({
+      issues: [{ message, path: ['key_authorization', field] }],
+    })
+  const { signature } = key
+  if (
+    signature.type !== 'webAuthn' ||
+    PublicKey.toHex(signature.publicKey, { includePrefix: false }) !==
+      PublicKey.toHex(PublicKey.fromHex(options.publicKey), {
+        includePrefix: false,
+      })
+  )
+    return refuse(
+      "The account's passkey did not sign the key. Send a key that the passkey signed as the account's own key, such as with `skip_upgrade`",
+      'signature',
+    )
+  if (Number(key.chainId) !== options.chainId)
+    return refuse(
+      `The key acts on chain ${Number(key.chainId)}, not the upgrade's chain ${options.chainId}. Send a key of the upgrade's chain`,
+      'chainId',
+    )
+  if (key.expiry && key.expiry * 1000 <= Date.now())
+    return refuse('The key expired. Authorize a new key', 'expiry')
+  return undefined
+}
+
+declare namespace unsignedKey {
+  type Options = {
+    /** The ID of the upgrade's chain. */
+    chainId: number
+    /** The account's passkey, an uncompressed P256 public key, hex. */
+    publicKey: `0x${string}`
+  }
+}
+
+/** Whether `value` is the serialized signature envelope of a key that signs alone, as an access key does. */
+function primitive(value: `0x${string}`) {
+  try {
+    return ['p256', 'secp256k1', 'webAuthn'].includes(
+      SignatureEnvelope.deserialize(value).type,
+    )
+  } catch {
+    // A value that does not deserialize is no envelope.
+    return false
+  }
+}
+
+/** Returns the refusal of a key that the chain holds as revoked. */
+function revokedKey() {
+  return new Validation.InvalidFieldError({
+    issues: [
+      {
+        message:
+          'The chain holds the key as revoked, so it signs nothing after the upgrade. Authorize a new key, then upgrade with it',
+        path: ['key_authorization'],
+      },
+    ],
+  })
+}
+
+/** Returns the refusal of a key that the chain did not register before the account upgraded. */
+function retiredKey() {
+  return new Validation.InvalidFieldError({
+    issues: [
+      {
+        message:
+          'The account upgraded before the chain registered the key, so the chain refuses its signature. The account is configurable now. Authorize a new key',
+        path: ['key_authorization'],
+      },
+    ],
+  })
+}
+
+/** Returns the refusal of a key whose scopes allow no TIP-20 transfer of 0, which its registration sends. */
+function unregistrable() {
+  return new Validation.InvalidFieldError({
+    issues: [
+      {
+        message:
+          'No scope of the key allows a TIP-20 `transfer` or `transferWithMemo`, so no transaction registers it before the upgrade. Authorize a key that allows one, or upgrade without `key_authorization`',
+        path: ['key_authorization', 'allowedCalls'],
+      },
+    ],
+  })
+}
+
+/** Returns the refusal of a passkey whose relying party does not cover Tempo ID's origin. */
+function passkeyElsewhere(options: passkeyElsewhere.Options) {
+  return new KeyAuthorization.WebAuthnRequiredError({
+    account: options.account,
+    description: `Passkey required: the passkey of Tempo Account ${options.account} signs only at its own relying party, which this page is not part of. Change the account there.`,
+  })
+}
+
+declare namespace passkeyElsewhere {
+  type Options = {
+    /** The account's address. */
+    account: `0x${string}`
+  }
+}
+
+/** Reads the user's account at `account` on `chain` again, after a change, as the API returns it. */
+async function reread(c: Context<Env>, options: reread.Options) {
+  const { account, chain, clientId, userId } = options
+  const realms = await Timing.measure(
+    c,
+    Configure.reach(c, { clientId }),
+    'Configure.reach',
+  )
+  const owners = await Timing.measure(
+    c,
+    TempoAccount.held(c, { chainId: chain.chainId, db, env, realms, userId }),
+    'TempoAccount.held',
+  )
+  const owner = owners.find(
+    (entry) => Owner.address(entry).toLowerCase() === account.toLowerCase(),
+  )
+  // The change stored the configuration first, so the account is listed. A concurrent change of
+  // the realms could still drop it, which the caller sees as a missing account.
+  if (!owner) throw new TempoAccount.ForeignAccountError({ account })
+  return TempoAccount.serialize(owner)
+}
+
+declare namespace reread {
+  type Options = {
+    /** The account's address. */
+    account: `0x${string}`
+    /** The chain of the change. */
+    chain: ConfigurableAccount.Entry
+    /** The app whose realms hold the account, if any. */
+    clientId?: string | undefined
+    /** The signed-in user's ID. */
+    userId: string
+  }
+}
+
+/** Returns the refusal of an `address` that is not one of the user's accounts. */
+function unknownAccount(options: unknownAccount.Options) {
+  return new Validation.InvalidFieldError({
+    issues: [
+      {
+        message: `The signed-in user has no Tempo Account at ${options.address}. Use an address that \`GET /v1/account\` lists`,
+        path: ['address'],
+      },
+    ],
+  })
+}
+
+declare namespace unknownAccount {
+  type Options = {
+    /** The address that the request sent. */
+    address: string
+  }
+}
+
+/** Returns the refusal of a `chain` whose node serves no faucet, such as Tempo mainnet. */
+function noFaucet(options: noFaucet.Options) {
+  return new Validation.InvalidFieldError({
+    issues: [
+      {
+        message: `The chain "${options.chain}" has no faucet. Use \`testnet\`, or a test chain that the deployment lists`,
+        path: ['chain'],
+      },
+    ],
+  })
+}
+
+declare namespace noFaucet {
+  type Options = {
+    /** The name that the request sent. */
+    chain: string
+  }
+}
+
+/**
+ * Returns whether `session` signed in within the last {@link Passkey.registrationFreshness} seconds,
+ * so it can register a passkey. Better Auth extends a session's expiry, never its creation time.
+ */
+/** Returns the refusal of a `chain` that names neither a built-in chain nor a listed one. */
+function unknownChain(options: unknownChain.Options) {
+  return new Validation.InvalidFieldError({
+    issues: [
+      {
+        message: `No chain is named "${options.chain}". Use \`mainnet\`, \`testnet\`, or another chain that the deployment lists`,
+        path: ['chain'],
+      },
+    ],
+  })
+}
+
+declare namespace unknownChain {
+  type Options = {
+    /** The name that the request sent. */
+    chain: string
+  }
+}
+
+function fresh(session: { session: { createdAt: Date } }) {
+  return (
+    Date.now() - session.session.createdAt.getTime() <
+    Passkey.registrationFreshness * 1000
+  )
+}
+
+/**
+ * The chains that `chain` selects: `mainnet`, `testnet`, then each other chain of `RPC_URLS`. Those
+ * that `CONFIGURABLE_ACCOUNTS` names are configurable.
+ */
+function chains() {
+  const configurable = ConfigurableAccount.chains({
+    rpcUrl: env.TEMPO_RPC_URL,
+    rpcUrls: env.RPC_URLS,
+    value: env.CONFIGURABLE_ACCOUNTS,
+  }).map((entry) => entry.chainId)
+  return [
+    { chainId: ChainList.ids.mainnet, name: 'mainnet' },
+    { chainId: ChainList.ids.testnet, name: 'testnet' },
+    // An entry for a built-in chain replaces its RPC URL, so the chain stays listed once.
+    ...ChainList.list({ value: env.RPC_URLS })
+      .filter((entry) => !(entry.name in ChainList.ids))
+      .map((entry) => ({ chainId: entry.chainId, name: entry.name })),
+  ].map((entry) => ({
+    ...entry,
+    configurable: configurable.includes(entry.chainId),
+  }))
+}