@tempoxyz/id 0.0.0-stage → 0.0.1

package/src/internal/KeyAuthorization.ts

@@ -0,0 +1,1536 @@
+/**
+ * Access keys (TIP-1011) that apps hold on a user's Tempo Account, in the shape of the Accounts
+ * SDK's `wallet_connect` capability. The user approves a key on a page, or it fits the headless
+ * ceiling. A challenge becomes the key's witness (TIP-1053).
+ * @module
+ */
+import { AbiFunction, Address, Hex, PublicKey, Value } from 'ox'
+import { AccountConfig, KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
+import { Authentication } from 'ox/webauthn'
+import { hashMessage, zeroAddress } from 'viem'
+import { Account, Addresses, Selectors } from 'viem/tempo'
+import {
+  tempo,
+  tempoDevnet,
+  tempoLocalnet,
+  tempoTestnet,
+} from 'viem/tempo/chains'
+import { defineToken, ousd as openUsd, tokens } from 'viem/tokens'
+import { z } from 'zod'
+import * as Apps from './Apps.js'
+import * as Chain from './Chain.js'
+import * as ErrorResponse from './ErrorResponse.js'
+import type * as Passkey from './Passkey.js'
+
+/** The request carries a challenge, which its app may not bind. */
+export class ChallengeNotPermittedError extends ErrorResponse.define(
+  'challenge_not_permitted',
+) {
+  override readonly name = 'KeyAuthorization.ChallengeNotPermittedError'
+
+  constructor(options: ChallengeNotPermittedError.Options) {
+    const { clientId } = options
+    super({
+      error_description: `Challenge not permitted: the app lacks the \`${Apps.signScope}\` scope. Remove \`challenge\`, or grant the app the scope.`,
+      field: 'challenge',
+      meta: { client_id: clientId, scope: Apps.signScope },
+    })
+  }
+}
+
+export declare namespace ChallengeNotPermittedError {
+  type Options = {
+    /** The app's client ID. */
+    clientId: string
+  }
+}
+
+/** Two limits name the same token. */
+export class DuplicateLimitError extends ErrorResponse.define(
+  'duplicate_limit',
+) {
+  override readonly name = 'KeyAuthorization.DuplicateLimitError'
+}
+
+/** Two scopes name one call on a target, or one target mixes any function with named ones. */
+export class DuplicateScopeError extends ErrorResponse.define(
+  'duplicate_scope',
+) {
+  override readonly name = 'KeyAuthorization.DuplicateScopeError'
+}
+
+/** `limits` is an empty list. */
+export class EmptyLimitsError extends ErrorResponse.define('empty_limits') {
+  override readonly name = 'KeyAuthorization.EmptyLimitsError'
+}
+
+/** `scopes` is an empty list. */
+export class EmptyScopesError extends ErrorResponse.define('empty_scopes') {
+  override readonly name = 'KeyAuthorization.EmptyScopesError'
+}
+
+/** A headless key lasts longer than a year. */
+export class ExpiryExceedsMaximumError extends ErrorResponse.define(
+  'expiry_exceeds_maximum',
+) {
+  override readonly name = 'KeyAuthorization.ExpiryExceedsMaximumError'
+}
+
+/** The key expiry is in the past. */
+export class ExpiryPassedError extends ErrorResponse.define('expiry_passed') {
+  override readonly name = 'KeyAuthorization.ExpiryPassedError'
+}
+
+/** The key chain ID is 0. */
+export class InvalidChainError extends ErrorResponse.define('invalid_chain') {
+  override readonly name = 'KeyAuthorization.InvalidChainError'
+}
+
+/** The key expiry is 0, which never expires. */
+export class InvalidExpiryError extends ErrorResponse.define('invalid_expiry') {
+  override readonly name = 'KeyAuthorization.InvalidExpiryError'
+}
+
+/** A limit's `period` is not a whole number of seconds. */
+export class InvalidPeriodError extends ErrorResponse.define('invalid_period') {
+  override readonly name = 'KeyAuthorization.InvalidPeriodError'
+}
+
+/** The key public key is not a valid point. */
+export class InvalidPublicKeyError extends ErrorResponse.define(
+  'invalid_public_key',
+) {
+  override readonly name = 'KeyAuthorization.InvalidPublicKeyError'
+}
+
+/** A scope's `recipients` repeats an address, names the zero address, or is on the wrong call. */
+export class InvalidRecipientsError extends ErrorResponse.define(
+  'invalid_recipients',
+) {
+  override readonly name = 'KeyAuthorization.InvalidRecipientsError'
+}
+
+/** A headless key limit exceeds the token’s ceiling. */
+export class LimitExceedsMaximumError extends ErrorResponse.define(
+  'limit_exceeds_maximum',
+) {
+  override readonly name = 'KeyAuthorization.LimitExceedsMaximumError'
+}
+
+/** The key authorization names no key. */
+export class MissingKeyError extends ErrorResponse.define('missing_key') {
+  override readonly name = 'KeyAuthorization.MissingKeyError'
+}
+
+/** A third-party app's key request leaves out `expiry`, `limits`, or `scopes`. */
+export class MissingPermissionsError extends ErrorResponse.define(
+  'missing_permissions',
+) {
+  override readonly name = 'KeyAuthorization.MissingPermissionsError'
+}
+
+/** An `approve` scope names no spenders. */
+export class MissingRecipientsError extends ErrorResponse.define(
+  'missing_recipients',
+) {
+  override readonly name = 'KeyAuthorization.MissingRecipientsError'
+}
+
+/** A scope calls a listed token that no limit names. */
+export class ScopeWithoutLimitError extends ErrorResponse.define(
+  'scope_without_limit',
+) {
+  override readonly name = 'KeyAuthorization.ScopeWithoutLimitError'
+}
+
+/** A selector does not parse, a TIP-20 scope allows any function, or a headless call is unknown. */
+export class UnsupportedCallError extends ErrorResponse.define(
+  'unsupported_call',
+) {
+  override readonly name = 'KeyAuthorization.UnsupportedCallError'
+}
+
+/** A limit names a token that is not supported on the chain. */
+export class UnsupportedTokenError extends ErrorResponse.define(
+  'unsupported_token',
+) {
+  override readonly name = 'KeyAuthorization.UnsupportedTokenError'
+}
+
+/** The key names a passkey-owned Tempo Account, whose passkey signs only on a Tempo ID page. */
+export class WebAuthnRequiredError extends ErrorResponse.define(
+  'webauthn_required',
+) {
+  override readonly name = 'KeyAuthorization.WebAuthnRequiredError'
+
+  constructor(options: WebAuthnRequiredError.Options) {
+    super({
+      error_description:
+        options.description ??
+        `Passkey required: Tempo Account ${options.account} signs key authorizations only with its passkey, on a Tempo ID page. Authorize through a redirect, popup, or device grant, or name another account.`,
+      field: 'key_authorization.account',
+      meta: { account: options.account },
+    })
+  }
+}
+
+export declare namespace WebAuthnRequiredError {
+  type Options = {
+    /** The passkey-owned account. */
+    account: `0x${string}`
+    /** Replaces the default `error_description`. */
+    description?: string | undefined
+  }
+}
+
+/** A `0x`-prefixed hex string, with its digits checked for `Hex.toBigInt`. */
+const hex = z
+  .templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]*$/)])
+  .meta({ pattern: '^0x[0-9a-fA-F]*$' })
+
+/** A 20-byte address. */
+const address = z
+  .templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]{40}$/)])
+  .meta({ pattern: '^0x[0-9a-fA-F]{40}$' })
+
+/** A hex quantity of at most 256 bits, which bounds work before authentication. */
+const quantity = z
+  .templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]{0,64}$/)])
+  .meta({ pattern: '^0x[0-9a-fA-F]{0,64}$' })
+
+/** A 32-byte value as hex. */
+const bytes32 = z
+  .templateLiteral(['0x', z.string().regex(/^[0-9a-fA-F]{64}$/)])
+  .meta({ pattern: '^0x[0-9a-fA-F]{64}$' })
+
+/** A bigint, sent as a hex quantity, which carries `examples` since Zod drops a codec's. */
+function bigint(options: bigint.Options) {
+  return z.codec(
+    z.union([quantity.meta({ examples: options.examples }), z.bigint()]),
+    z.bigint(),
+    {
+      decode: (value) =>
+        typeof value === 'bigint'
+          ? value
+          : value === '0x'
+            ? 0n
+            : Hex.toBigInt(value),
+      encode: (value) => Hex.fromNumber(value),
+    },
+  )
+}
+
+declare namespace bigint {
+  type Options = {
+    /** Hex examples for the OpenAPI document. */
+    examples: readonly `0x${string}`[]
+  }
+}
+
+/** An app's key authorization request as sent, with the Tempo Account it acts for. */
+const sent = z.object({
+  /** The Tempo Account. Defaults to the account selected at sign-in, or the oldest. */
+  account: z.optional(address).meta({
+    description:
+      'The Tempo Account the key acts for. Defaults to the account selected at sign-in, or else the oldest account.',
+    examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
+  }),
+  /** The access key's address. `publicKey` may stand in for it. */
+  address: z.optional(address).meta({
+    description:
+      "The access key's address. Required unless `publicKey` is present.",
+    examples: ['0x81c0f22bd173c115d18eeea0f6a38e935ecf52fb'],
+  }),
+  /** Defaults to Tempo mainnet. */
+  chainId: z.optional(bigint({ examples: ['0x1079'] })).meta({
+    description:
+      'The chain ID the key acts on, as a hex quantity. Defaults to Tempo mainnet.',
+  }),
+  /** Unix seconds. Defaults to a year from now, for a first-party app. */
+  expiry: z.optional(z.number()).meta({
+    description:
+      'When the key expires, in Unix seconds. Defaults to one year after the request for a first-party app, and a third-party app must name it.',
+    examples: [1893456000],
+  }),
+  /** Defaults to `secp256k1`. */
+  keyType: z.optional(z.enum(['p256', 'secp256k1', 'webAuthn'])).meta({
+    description:
+      'The signature scheme of the access key. Defaults to `secp256k1`.',
+    examples: ['secp256k1'],
+  }),
+  /** Defaults to the cap of each token it calls, or of OUSD, for a first-party app. */
+  limits: z
+    .optional(
+      z
+        .array(
+          z.object({
+            limit: bigint({ examples: ['0x989680'] }).meta({
+              description:
+                'The most of the token the key may spend, in base units, as a hex quantity. Applies per period when `period` is set.',
+            }),
+            period: z.optional(z.number()).meta({
+              description:
+                'Seconds after which the limit resets. Omitted or 0 for a one-time limit.',
+              examples: [86400],
+            }),
+            token: address.meta({
+              description: 'The TIP-20 token the limit applies to.',
+              examples: ['0x20c0000000000000000000006a37DA5C996874BE'],
+            }),
+          }),
+        )
+        .readonly(),
+    )
+    .meta({
+      description:
+        'The spending limit on each token. Defaults to the cap of each token that the scopes call, else of OUSD, for a first-party app, and a third-party app must name them.',
+    }),
+  /** The access key's public key. */
+  publicKey: z.optional(hex).meta({
+    description:
+      "The access key's uncompressed public key, as hex. Tempo ID derives `address` from it when `address` is absent.",
+    examples: [
+      '0x0438ef39ed22456a6956f380ebc18c50bd18c0402658bc52903817cc8a1e8b2f7ed1da68afc7f343c1debc44c04ac60e62e96bbb261d2226e7a7b96e64fd0f0765',
+    ],
+  }),
+  /** Defaults to transfers of each token it limits, for a first-party app. */
+  scopes: z
+    .optional(
+      z
+        .array(
+          z.object({
+            address: address.meta({
+              description:
+                'The contract the key may call, such as a TIP-20 token or the TIP-1034 channel reserve at `0x4d50500000000000000000000000000000000000`.',
+              examples: ['0x20c0000000000000000000006a37DA5C996874BE'],
+            }),
+            recipients: z.optional(z.array(address).readonly()).meta({
+              description:
+                'The only addresses the call may name as recipient or spender. Required for `approve`, and refused on any call but `transfer`, `transferWithMemo`, and `approve` on a TIP-20 token.',
+              examples: [['0xff5deded16eb46018387144ff8bf41f26afb41af']],
+            }),
+            selector: z.optional(z.union([hex, z.string().max(256)])).meta({
+              description:
+                'The function the key may call, as a 4-byte selector or a function signature. Absent, the key may call any function on the contract, which a TIP-20 token refuses, and the target takes no other scope. A headless flow accepts only `transfer`, `transferWithMemo`, and `approve` on a listed token, and `open` and `topUp` on the channel reserve, unless the app holds `tempo-id:sign`.',
+              examples: ['0xa9059cbb', 'transfer(address,uint256)'],
+            }),
+          }),
+        )
+        .readonly(),
+    )
+    .meta({
+      description:
+        'The calls the key may make. Defaults to `transfer` and `transferWithMemo` on each token that the key limits for a first-party app, and a third-party app must name them.',
+    }),
+})
+
+/** Zod schemas for key authorization requests and responses. */
+export namespace schema {
+  /** The Tempo Account a signed key acts for. */
+  export const account = address.meta({
+    description: 'The Tempo Account the key acts for.',
+    examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
+  })
+
+  /** An app's key authorization request, with the headless ceiling as its defaults. */
+  export const request = z.optional(sent.transform(defaults)).meta({
+    description:
+      "A key authorization for the app's own key: the shape of the Accounts SDK's `wallet_connect` `authorizeAccessKey` capability. Omitted fields default to the headless ceiling.",
+    id: 'KeyAuthorizationRequest',
+  })
+
+  /** What a key grants, as `describe` returns it. */
+  export const description = z
+    .object({
+      account: address.optional().meta({
+        description:
+          'The Tempo Account the request names. Absent when the request names none.',
+        examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
+      }),
+      calls: z
+        .array(
+          z.object({
+            call: z.enum(['open', 'topUp']).meta({
+              description:
+                'The call on the channel reserve, which MPP sessions pay through: `open` starts a payment channel, and `topUp` adds to its deposit.',
+              examples: ['open', 'topUp'],
+            }),
+          }),
+        )
+        .readonly()
+        .meta({
+          description:
+            'The calls on the channel reserve, in the order of the scopes, which the screens list beside the limits. Transfers and approvals spend within the limits, so none is listed.',
+        }),
+      expiry: z.number().meta({
+        description: 'Unix seconds.',
+        examples: [1893456000],
+      }),
+      limits: z
+        .array(
+          z.object({
+            amount: z.string().meta({
+              description: 'In whole units.',
+              examples: ['1000'],
+            }),
+            currency: z.string().meta({
+              description:
+                "The tokens' currency, such as `USD`. A yield-bearing token names its own.",
+              examples: ['USD'],
+            }),
+            period: z
+              .number()
+              .optional()
+              .meta({
+                description:
+                  'Seconds after which the amount resets. Omitted for a one-time limit.',
+                examples: [86400],
+              }),
+            tokens: z
+              .array(
+                z.object({
+                  amount: z.string().meta({
+                    description: "The token's own limit, in whole units.",
+                    examples: ['1000'],
+                  }),
+                  symbol: z.string().meta({
+                    description:
+                      "The token's symbol, or its address when the token has no symbol.",
+                    examples: ['OUSD'],
+                  }),
+                }),
+              )
+              .readonly()
+              .meta({ description: 'The tokens the amount spans.' }),
+          }),
+        )
+        .readonly()
+        .meta({
+          description:
+            'The spending limits, totaled for each currency and period.',
+        }),
+      unrecognized: z
+        .array(
+          z.object({
+            address: address.meta({
+              description: 'The contract that the call targets.',
+              examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
+            }),
+            selector: hex.optional().meta({
+              description:
+                'The 4-byte selector of the function. Absent when the scope allows any function on the contract.',
+              examples: ['0x12345678'],
+            }),
+          }),
+        )
+        .readonly()
+        .meta({
+          description:
+            'The calls that Tempo ID does not recognize, which the screens warn about. Empty when it recognizes every call.',
+        }),
+    })
+    .meta({
+      description: 'What a key authorization grants, for approval screens.',
+      id: 'KeyAuthorizationDescription',
+    })
+
+  /** A primitive signature envelope, in the node's RPC format. */
+  const primitive = z
+    .discriminatedUnion('type', [
+      z
+        .object({
+          r: hex.meta({
+            description: "The signature's 32-byte `r` value.",
+            examples: [
+              '0x12fe6a88b99377b94d6a628a86b9df544202c7b03827f44b16ee1a266ab98e17',
+            ],
+          }),
+          s: hex.meta({
+            description: "The signature's 32-byte `s` value.",
+            examples: [
+              '0x4b6aa3723402498e07fb1f071673bd969d9f49a286af15ac60581d07ade24b77',
+            ],
+          }),
+          type: z.literal('secp256k1').meta({
+            description: 'A secp256k1 ECDSA signature.',
+          }),
+          v: hex.optional().meta({
+            description:
+              'The legacy recovery value, which `yParity` replaces. Absent in most envelopes.',
+            examples: ['0x1c'],
+          }),
+          yParity: hex.meta({
+            description:
+              'The parity of the y-coordinate of the curve point, `0x0` or `0x1`.',
+            examples: ['0x1'],
+          }),
+        })
+        .meta({ description: 'A secp256k1 signature.' }),
+      z
+        .object({
+          preHash: z.boolean().meta({
+            description:
+              'Whether the signer hashed the digest with SHA-256 before signing it, as WebCrypto keys do.',
+            examples: [true],
+          }),
+          pubKeyX: hex.meta({
+            description:
+              "The 32-byte x-coordinate of the signer's P256 public key.",
+            examples: [
+              '0xdae3e3e5faba0a2aca73d4d2a4b84ad46460f3f23af8a60b17b8a13537cfd440',
+            ],
+          }),
+          pubKeyY: hex.meta({
+            description:
+              "The 32-byte y-coordinate of the signer's P256 public key.",
+            examples: [
+              '0x816438c87ffd782cd0e37355eb83fbe1d4e5e905eaafa22fa27c32cc4abf7802',
+            ],
+          }),
+          r: hex.meta({
+            description: "The signature's 32-byte `r` value.",
+            examples: [
+              '0x9da52cc71c005844434ce6996f7ea3b3262f84ec3a5d54f1d22d0bba9f2e5ea9',
+            ],
+          }),
+          s: hex.meta({
+            description: "The signature's 32-byte `s` value.",
+            examples: [
+              '0x4b6aa3723402498e07fb1f071673bd969d9f49a286af15ac60581d07ade24b77',
+            ],
+          }),
+          type: z.literal('p256').meta({
+            description: 'A P256 (secp256r1) signature.',
+          }),
+        })
+        .meta({ description: 'A P256 signature, with its public key.' }),
+      z
+        .object({
+          pubKeyX: hex.meta({
+            description:
+              "The 32-byte x-coordinate of the passkey's P256 public key.",
+            examples: [
+              '0xdae3e3e5faba0a2aca73d4d2a4b84ad46460f3f23af8a60b17b8a13537cfd440',
+            ],
+          }),
+          pubKeyY: hex.meta({
+            description:
+              "The 32-byte y-coordinate of the passkey's P256 public key.",
+            examples: [
+              '0x816438c87ffd782cd0e37355eb83fbe1d4e5e905eaafa22fa27c32cc4abf7802',
+            ],
+          }),
+          r: hex.meta({
+            description: "The signature's 32-byte `r` value.",
+            examples: [
+              '0x9da52cc71c005844434ce6996f7ea3b3262f84ec3a5d54f1d22d0bba9f2e5ea9',
+            ],
+          }),
+          s: hex.meta({
+            description: "The signature's 32-byte `s` value.",
+            examples: [
+              '0x4b6aa3723402498e07fb1f071673bd969d9f49a286af15ac60581d07ade24b77',
+            ],
+          }),
+          type: z.literal('webAuthn').meta({
+            description: 'A WebAuthn passkey signature.',
+          }),
+          webauthnData: hex.meta({
+            description:
+              "The assertion's authenticator data followed by its `clientDataJSON`, as hex.",
+            examples: [
+              '0xa7cb28053c8ee4e5394fc67a0018dc1c622dad5ce3591b8ca13094ae86d11ba605000000007b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a2271334a306257467a6157356e6247567a6157647559585231636d566b6157646c633352765a6d746c65574631644767222c226f726967696e223a2268747470733a2f2f617574682e74656d706f2e78797a222c2263726f73734f726967696e223a66616c73657d',
+            ],
+          }),
+        })
+        .meta({ description: 'A WebAuthn signature, with its public key.' }),
+    ])
+    .meta({
+      description: 'A signature by one key, as secp256k1, P256, or WebAuthn.',
+    })
+
+  /** A signed key authorization in the node's RPC format, as `sign` returns it. */
+  export const rpc = z
+    .object({
+      account: address
+        .nullable()
+        .optional()
+        .meta({
+          description:
+            'The Tempo Account the key is bound to (TIP-1049). Absent or null when the key has no account binding.',
+          examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
+        }),
+      allowedCalls: z
+        .array(
+          z.object({
+            selectorRules: z
+              .array(
+                z.object({
+                  recipients: z
+                    .array(address)
+                    .readonly()
+                    .optional()
+                    .meta({
+                      description:
+                        'The only addresses the call may name as recipient or spender. Absent when any address may receive.',
+                      examples: [
+                        ['0xff5deded16eb46018387144ff8bf41f26afb41af'],
+                      ],
+                    }),
+                  selector: hex.meta({
+                    description:
+                      'The 4-byte selector of the function the key may call.',
+                    examples: ['0xa9059cbb'],
+                  }),
+                }),
+              )
+              .readonly()
+              .optional()
+              .meta({
+                description:
+                  'The functions the key may call on the target. Absent when the key may call any function on it.',
+              }),
+            target: address.meta({
+              description: 'The contract the key may call.',
+              examples: ['0x20c0000000000000000000006a37DA5C996874BE'],
+            }),
+          }),
+        )
+        .readonly()
+        .optional()
+        .meta({
+          description:
+            'The calls the key may make. Absent when the key may make any call.',
+        }),
+      chainId: hex.meta({
+        description: 'The chain ID the key acts on, as a hex quantity.',
+        examples: ['0xa5bf'],
+      }),
+      expiry: hex
+        .nullable()
+        .optional()
+        .meta({
+          description:
+            'When the key expires, in Unix seconds, as a hex quantity. Absent or null when the key never expires.',
+          examples: ['0x6acdc1b4'],
+        }),
+      keyId: address.meta({
+        description: "The access key's address.",
+        examples: ['0x81c0f22bd173c115d18eeea0f6a38e935ecf52fb'],
+      }),
+      keyType: z.string().meta({
+        description:
+          'The signature scheme of the access key: `secp256k1`, `p256`, or `webAuthn`. The node names a configurable account key `multisig`.',
+        examples: ['secp256k1'],
+      }),
+      limits: z
+        .array(
+          z.object({
+            limit: hex.meta({
+              description:
+                'The most of the token the key may spend, in base units, as a hex quantity. Applies per period when `period` is set.',
+              examples: ['0x989680'],
+            }),
+            period: hex.optional().meta({
+              description:
+                'Seconds after which the limit resets, as a hex quantity. Absent or `0x0` for a one-time limit.',
+              examples: ['0x15180'],
+            }),
+            token: address.meta({
+              description: 'The TIP-20 token the limit applies to.',
+              examples: ['0x20c0000000000000000000006a37DA5C996874BE'],
+            }),
+          }),
+        )
+        .readonly()
+        .optional()
+        .meta({
+          description:
+            'The spending limit on each token, or absent when spending is unlimited. An empty list allows no spending.',
+        }),
+      signature: z
+        .union([
+          hex.meta({
+            description:
+              "A configurable account's RLP-encoded signature, which carries its owner approvals.",
+            examples: [
+              '0xf8a094ff5deded16eb46018387144ff8bf41f26afb41afc0f87cf87a80a012fe6a88b99377b94d6a628a86b9df544202c7b03827f44b16ee1a266ab98e17a04b6aa3723402498e07fb1f071673bd969d9f49a286af15ac60581d07ade24b77',
+            ],
+          }),
+          primitive,
+          z
+            .object({
+              keyId: address.optional().meta({
+                description:
+                  'The address of the access key that signed. Recovered from `signature` when absent.',
+                examples: ['0x624f27c462b885a83c698cac444a106a8c519e25'],
+              }),
+              signature: primitive.meta({
+                description: "The access key's own signature.",
+              }),
+              type: z.literal('keychain').meta({
+                description: 'A signature by an access key for an account.',
+              }),
+              userAddress: address.meta({
+                description: 'The Tempo Account the access key signs for.',
+                examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
+              }),
+              version: z
+                .enum(['v1', 'v2'])
+                .optional()
+                .meta({
+                  description:
+                    'The keychain signature version, `v1` by default. `v2` binds the signature to `userAddress`.',
+                  examples: ['v2'],
+                }),
+            })
+            .meta({
+              description:
+                'An access key signature that wraps a primitive signature.',
+            }),
+        ])
+        .meta({
+          description: "The owner's signature envelope, in the node's format.",
+        }),
+      witness: bytes32.optional().meta({
+        description:
+          'The witness the signature binds, when the request sent one.',
+        examples: [
+          '0xf1e22f902be2546fe35d49388503ef7ea5c6c0e95a0f4b89d474e58793b64dec',
+        ],
+      }),
+    })
+    .meta({
+      description:
+        "A signed key authorization (TIP-1011), in the node's RPC format.",
+      id: 'KeyAuthorization',
+    })
+}
+
+/** An app's key authorization request. */
+export type Key = NonNullable<z.output<typeof schema.request>>
+
+/** A key authorization request as sent. */
+type Request = z.output<typeof sent>
+
+/** A key authorization request with every default filled. */
+type Defaulted = Request & {
+  chainId: bigint
+  expiry: number
+  limits: NonNullable<Request['limits']>
+  scopes: NonNullable<Request['scopes']>
+  /** The witness that the owner's signature binds, from the request's challenge. */
+  witness?: Hex.Hex | undefined
+}
+
+/** A key's default lifetime, and a headless key's longest, in seconds. */
+export const lifetime = 365 * 24 * 60 * 60
+
+/** OUSD's address, the same on every Tempo chain, and the default token. */
+const ousd = openUsd(tempo.id).address
+
+/** Tempo chains, whose token addresses Viem's token list holds. */
+export const chains = Chain.known
+
+/** The default chain of a key: Tempo mainnet. */
+export const defaultChainId = tempo.id
+
+/** About $1,000 in each currency, in whole units. Unlisted currencies are yield-bearing dollars. */
+// ponytail: the rates are fixed. If caps must track markets closely, price them live.
+const caps: Record<string, string> = {
+  BRL: '5000',
+  BTC: '0.01',
+  CHF: '800',
+  EUR: '850',
+  GBP: '750',
+  USD: '1000',
+}
+
+/**
+ * MACH, the machine token that MPP sessions pay in, at the same address on mainnet and Moderato.
+ * Viem's token list does not name it.
+ */
+// ponytail: drop MACH once Viem's token list names it.
+const mach = defineToken({
+  addresses: {
+    [tempo.id]: '0x20c000000000000000000000f37de3740adec032',
+    [tempoTestnet.id]: '0x20c000000000000000000000f37de3740adec032',
+  },
+  currency: 'USD',
+  decimals: 6,
+  name: 'MACH',
+  symbol: 'MACH',
+})
+
+/** Viem's Tempo tokens and MACH, by chain ID and lowercase address, with each cap in base units. */
+const listed = new Map<
+  string,
+  {
+    address: Address.Address
+    cap: bigint
+    currency: string
+    decimals: number
+    symbol: string
+  }
+>(
+  [...tokens.tempo, mach].flatMap((token) =>
+    chains.flatMap((chain) => {
+      const addresses = token.addresses as Record<number, string>
+      // Devnets and a local Tempo node predeploy the testnet's tokens, at the same addresses, and
+      // Viem's list names none for them. OUSD has its mainnet address on every Tempo chain, which
+      // Viem's list names only for mainnet.
+      // ponytail: drop the OUSD fallback once Viem lists OUSD on testnet.
+      const address =
+        addresses[chain.id] ??
+        (chain.id === tempoDevnet.id || chain.id === tempoLocalnet.id
+          ? addresses[tempoTestnet.id]
+          : undefined) ??
+        (token.symbol === 'OUSD' ? addresses[tempo.id] : undefined)
+      if (!address) return []
+      const cap = caps[token.currency ?? ''] ?? caps.USD!
+      return [
+        [
+          `${chain.id}:${address.toLowerCase()}`,
+          {
+            address: Address.checksum(address),
+            cap: Value.from(cap, token.decimals),
+            currency: token.currency,
+            decimals: token.decimals,
+            symbol: token.symbol ?? address,
+          },
+        ] as const,
+      ]
+    }),
+  ),
+)
+
+/**
+ * TIP-20 calls that the key's limits bound. `approve` needs a spender allowlist, since an approved
+ * spender moves tokens without the key.
+ */
+const calls = {
+  approve: AbiFunction.getSelector('approve(address,uint256)'),
+  transfer: AbiFunction.getSelector('transfer(address,uint256)'),
+  transferWithMemo: AbiFunction.getSelector(
+    'transferWithMemo(address,uint256,bytes32)',
+  ),
+}
+
+/** The TIP-1034 channel reserve, whose `open` and `topUp` deposits spend within key limits. */
+const reserve = {
+  address: Addresses.tip20ChannelReserve,
+  open: Selectors.tip20ChannelReserve.open,
+  topUp: Selectors.tip20ChannelReserve.topUp,
+}
+
+/**
+ * Whether `scope` calls `transfer`, `transferWithMemo`, or `approve` on a listed token, or `open` or
+ * `topUp` on the channel reserve. The approval screens warn about any other call.
+ */
+function recognized(key: Key, scope: Key['scopes'][number]) {
+  const selector =
+    scope.selector === undefined ? undefined : normalize(scope.selector)
+  if (scope.address.toLowerCase() === reserve.address)
+    return selector === reserve.open || selector === reserve.topUp
+  return (
+    Boolean(token(key, scope.address)) &&
+    (selector === calls.approve ||
+      selector === calls.transfer ||
+      selector === calls.transferWithMemo)
+  )
+}
+
+/** Returns `key` with the EIP-191 hash of `challenge` as its witness, or unchanged without one. */
+export function bind(key: Key, options: bind.Options): Key {
+  if (options.challenge === undefined) return key
+  return { ...key, witness: hashMessage(options.challenge) }
+}
+
+export declare namespace bind {
+  type Options = {
+    /** The app's challenge, such as a sign-in message from its backend. */
+    challenge: string | undefined
+  }
+}
+
+/**
+ * Returns the refusal for a `key` that breaks the rules of every flow, or `undefined`. Its `field`
+ * is a path under `key_authorization`.
+ */
+export function check(
+  key: Key,
+): ErrorResponse.Instance<typeof check.errors> | undefined {
+  const now = Math.floor(Date.now() / 1000)
+
+  // Nodes reject chain ID zero, so a key names its chain.
+  if (!key.chainId)
+    return new InvalidChainError({
+      error_description:
+        'Invalid `chainId`: 0. Use a Tempo chain ID, such as 4217.',
+      field: 'key_authorization.chainId',
+      meta: { chain_id: 0 },
+    })
+  const chainId = Number(key.chainId)
+  if (!key.address && !key.publicKey)
+    return new MissingKeyError({
+      error_description:
+        'Missing `address` or `publicKey`. Provide the access key.',
+      field: 'key_authorization.address',
+    })
+  // The chain rejects the zero address, which no key holds, also beside a public key.
+  if (key.address === zeroAddress)
+    return new MissingKeyError({
+      error_description:
+        'Invalid `address`: the zero address holds no key. Provide the address of the access key.',
+      field: 'key_authorization.address',
+    })
+  if (key.publicKey && !parse(key.publicKey))
+    return new InvalidPublicKeyError({
+      error_description:
+        'Invalid `publicKey`. Provide an uncompressed public key, or `address`.',
+      field: 'key_authorization.publicKey',
+    })
+  if (!Number.isSafeInteger(key.expiry))
+    return new InvalidExpiryError({
+      error_description: `Invalid \`expiry\`: ${key.expiry} is not a whole number of seconds. Use a future Unix time in seconds.`,
+      field: 'key_authorization.expiry',
+      meta: { expiry: key.expiry },
+    })
+  // Zero means the key never expires.
+  if (key.expiry === 0)
+    return new InvalidExpiryError({
+      error_description:
+        'Invalid `expiry`: 0 never expires. Use a future Unix time.',
+      field: 'key_authorization.expiry',
+      meta: { expiry: 0 },
+    })
+  if (key.expiry <= now)
+    return new ExpiryPassedError({
+      error_description: `Invalid \`expiry\`: ${date(key.expiry)} has passed. Use a future Unix time.`,
+      field: 'key_authorization.expiry',
+      meta: { expiry: key.expiry, now },
+    })
+  if (!key.limits.length)
+    return new EmptyLimitsError({
+      error_description:
+        'Empty `limits`. Name at least one token, or omit `limits`.',
+      field: 'key_authorization.limits',
+    })
+  if (!key.scopes.length)
+    return new EmptyScopesError({
+      error_description:
+        'Empty `scopes`. Name at least one call, or omit `scopes`.',
+      field: 'key_authorization.scopes',
+    })
+
+  const seen = new Set<string>()
+  for (const [index, limit] of key.limits.entries()) {
+    // TIP-1011 rejects a key that limits one token twice.
+    if (seen.has(limit.token.toLowerCase()))
+      return new DuplicateLimitError({
+        error_description: `Duplicate limit for ${limit.token}. Limit each token once.`,
+        field: `key_authorization.limits.${index}.token`,
+        meta: { token: limit.token },
+      })
+    seen.add(limit.token.toLowerCase())
+
+    const listing = token(key, limit.token)
+    if (!listing)
+      return new UnsupportedTokenError({
+        error_description: `Unsupported token on chain ${chainId}: ${limit.token}. Use a supported token, such as OUSD.`,
+        field: `key_authorization.limits.${index}.token`,
+        meta: { chain_id: chainId, token: limit.token },
+      })
+    if (
+      limit.period !== undefined &&
+      (!Number.isSafeInteger(limit.period) || limit.period < 0)
+    )
+      return new InvalidPeriodError({
+        error_description: `Invalid \`period\` on the ${listing.symbol} limit: ${limit.period}. Use a whole number of seconds, or 0 for a one-time limit.`,
+        field: `key_authorization.limits.${index}.period`,
+        meta: {
+          period: limit.period,
+          symbol: listing.symbol,
+          token: listing.address,
+        },
+      })
+  }
+
+  const rules = new Set<string>()
+  // Whether each target's scopes allow any function or name functions. TIP-1011 groups the scopes
+  // of a target into one rule, which cannot hold both, so the signed key would drop one.
+  const targets = new Map<string, 'any' | 'named'>()
+  for (const [index, scope] of key.scopes.entries()) {
+    const listing = token(key, scope.address)
+    // A call on a listed token moves it, so the key limits that token.
+    if (
+      listing &&
+      !key.limits.some((limit) => Address.isEqual(limit.token, scope.address))
+    )
+      return new ScopeWithoutLimitError({
+        error_description: `Scope on ${listing.symbol} has no limit. Add a limit for it, or remove the scope.`,
+        field: `key_authorization.scopes.${index}.address`,
+        meta: { token: scope.address },
+      })
+
+    const target = listing?.symbol ?? scope.address
+    const named = {
+      ...(listing ? { symbol: listing.symbol } : {}),
+      token: scope.address,
+    }
+    // An empty selector names no function, so it is refused, not read as any function.
+    const selector =
+      scope.selector === undefined ? undefined : normalize(scope.selector)
+    if (scope.selector !== undefined && !selector)
+      return new UnsupportedCallError({
+        error_description: `Unsupported call on ${target}: the selector does not parse. Use a 4-byte selector or a function signature.`,
+        field: `key_authorization.scopes.${index}.selector`,
+        meta: named,
+      })
+    // Any function includes `approve`, whose spenders TIP-1011 attaches only to an `approve` scope.
+    if (!selector && tip20(scope.address))
+      return new UnsupportedCallError({
+        error_description: `Unsupported call on ${target}: any function, which includes \`approve\` without spenders. Name each function in \`selector\`, such as \`transfer\`.`,
+        field: `key_authorization.scopes.${index}.selector`,
+        meta: named,
+      })
+    // An approved spender moves tokens without the key ([TIP-1011](https://tips.sh/1011)).
+    if (selector === calls.approve && !scope.recipients?.length)
+      return new MissingRecipientsError({
+        error_description: `Missing \`recipients\` for \`approve\` on ${target}. Name the allowed spenders.`,
+        field: `key_authorization.scopes.${index}.recipients`,
+        meta: named,
+      })
+    // TIP-1011 accepts recipients only on these calls on a TIP-20 token.
+    if (
+      scope.recipients?.length &&
+      (!tip20(scope.address) ||
+        (selector !== calls.approve &&
+          selector !== calls.transfer &&
+          selector !== calls.transferWithMemo))
+    )
+      return new InvalidRecipientsError({
+        error_description: `Invalid \`recipients\` for ${selector ?? 'any function'} on ${target}. Remove \`recipients\`, since only \`transfer\`, \`transferWithMemo\`, and \`approve\` on a TIP-20 token take them.`,
+        field: `key_authorization.scopes.${index}.recipients`,
+        meta: named,
+      })
+
+    // TIP-1011 rejects a key that names one call on a target twice.
+    const rule = `${scope.address.toLowerCase()}:${selector ?? 'any'}`
+    if (rules.has(rule))
+      return new DuplicateScopeError({
+        error_description: `Duplicate scope for ${selector ?? 'any function'} on ${target}. Name each call on a target once.`,
+        field: `key_authorization.scopes.${index}.selector`,
+        meta: { ...(selector ? { selector } : {}), ...named },
+      })
+    rules.add(rule)
+
+    const kind = selector ? 'named' : 'any'
+    const other = targets.get(scope.address.toLowerCase())
+    if (other && other !== kind)
+      return new DuplicateScopeError({
+        error_description: `Conflicting scopes on ${target}: one allows any function, and another names ${selector ?? 'a function'}. Keep the scope for any function, or name each function.`,
+        field: `key_authorization.scopes.${index}.selector`,
+        meta: { ...(selector ? { selector } : {}), ...named },
+      })
+    targets.set(scope.address.toLowerCase(), kind)
+
+    // TIP-1011 rejects recipients that hold the zero address or repeat an address.
+    const unique = new Set<string>()
+    const position = (scope.recipients ?? []).findIndex((entry) => {
+      const recipient = entry.toLowerCase()
+      if (recipient === zeroAddress || unique.has(recipient)) return true
+      unique.add(recipient)
+      return false
+    })
+    const recipient = scope.recipients?.[position]
+    if (recipient)
+      return new InvalidRecipientsError({
+        error_description: `Invalid recipient ${recipient} for ${selector} on ${target}. Name each recipient once, and never the zero address.`,
+        field: `key_authorization.scopes.${index}.recipients.${position}`,
+        meta: { recipient, ...named },
+      })
+  }
+  return undefined
+}
+
+export namespace check {
+  /** The refusals `check` returns. Its return type admits no other. */
+  export const errors = [
+    DuplicateLimitError,
+    DuplicateScopeError,
+    EmptyLimitsError,
+    EmptyScopesError,
+    ExpiryPassedError,
+    InvalidChainError,
+    InvalidExpiryError,
+    InvalidPeriodError,
+    InvalidPublicKeyError,
+    InvalidRecipientsError,
+    MissingKeyError,
+    MissingRecipientsError,
+    ScopeWithoutLimitError,
+    UnsupportedCallError,
+    UnsupportedTokenError,
+  ] as const
+}
+
+/** Returns `ChallengeNotPermittedError` if `key` has a witness that the app may not bind. */
+export function checkChallenge(
+  options: checkChallenge.Options,
+): ErrorResponse.Instance<typeof checkChallenge.errors> | undefined {
+  const { app, clientId, key } = options
+  if (!key?.witness) return undefined
+  if (!app?.sign) return new ChallengeNotPermittedError({ clientId })
+  return undefined
+}
+
+export namespace checkChallenge {
+  export type Options = {
+    /** The app, or `undefined` when no app has `clientId`. */
+    app: Pick<Apps.App, 'sign'> | undefined
+    /** The requesting app's client ID. */
+    clientId: string
+    /** A key without a `witness`, or no key, passes. */
+    key: Key | undefined
+  }
+
+  /** The refusals `checkChallenge` returns. */
+  export const errors = [ChallengeNotPermittedError] as const
+}
+
+/**
+ * Returns `MissingPermissionsError` when a third-party app's raw request `sent` leaves out
+ * `expiry`, `limits`, or `scopes`, else `undefined`. A third-party app receives no defaults.
+ */
+export function checkExplicit(
+  sent: unknown,
+): ErrorResponse.Instance<typeof checkExplicit.errors> | undefined {
+  // A value that is no object names no field, and the schema refuses it after this check.
+  const fields: Record<string, unknown> =
+    typeof sent === 'object' && sent !== null ? { ...sent } : {}
+  const missing = (['expiry', 'limits', 'scopes'] as const).filter(
+    (field) => fields[field] === undefined,
+  )
+  const [first] = missing
+  if (!first) return undefined
+  const names = missing.map((field) => `\`${field}\``)
+  const list = (() => {
+    if (names.length === 1) return names[0]
+    if (names.length === 2) return `${names[0]} and ${names[1]}`
+    return `${names.slice(0, -1).join(', ')}, and ${names.at(-1)}`
+  })()
+  return new MissingPermissionsError({
+    error_description: `Missing ${list}. Name the expiry, limits, and scopes of the key, since a third-party app receives no defaults.`,
+    field: `key_authorization.${first}`,
+    meta: { missing: missing.join(' ') },
+  })
+}
+
+export namespace checkExplicit {
+  /** The refusals `checkExplicit` returns. Its return type admits no other. */
+  export const errors = [MissingPermissionsError] as const
+}
+
+/** Returns the refusal for `key` in a flow without a page, from `check` or the headless ceiling. */
+export function checkHeadless(
+  key: Key,
+  options: checkHeadless.Options,
+): ErrorResponse.Instance<typeof checkHeadless.errors> | undefined {
+  const error = check(key)
+  if (error) return error
+
+  // No page shows the user an unrecognized call, so only an app that holds `tempo-id:sign` sends one.
+  const index = key.scopes.findIndex((scope) => !recognized(key, scope))
+  const scope = key.scopes[index]
+  if (scope && !options.sign) {
+    const listing = token(key, scope.address)
+    const selector =
+      scope.selector === undefined ? undefined : normalize(scope.selector)
+    return new UnsupportedCallError({
+      error_description: `Unrecognized call on ${listing?.symbol ?? scope.address}: ${selector ?? 'any function'}. Authorize through a redirect or device grant, where the user approves it, or grant the app the \`${Apps.signScope}\` scope.`,
+      field: `key_authorization.scopes.${index}.selector`,
+      meta: {
+        ...(selector ? { selector } : {}),
+        ...(listing ? { symbol: listing.symbol } : {}),
+        token: scope.address,
+      },
+    })
+  }
+
+  const now = Math.floor(Date.now() / 1000)
+  const chainId = Number(key.chainId)
+  if (key.expiry > now + lifetime)
+    return new ExpiryExceedsMaximumError({
+      error_description: `Invalid \`expiry\`: ${date(key.expiry)} exceeds the one-year maximum. Use an earlier expiry, or authorize through a redirect or device grant.`,
+      field: 'key_authorization.expiry',
+      meta: { expiry: key.expiry, maximum: now + lifetime },
+    })
+  for (const [index, limit] of key.limits.entries()) {
+    const listing = token(key, limit.token)!
+    // A periodic limit resets each period, so the ceiling bounds what it allows before the key expires.
+    const periods = limit.period
+      ? BigInt(Math.ceil((key.expiry - now) / limit.period))
+      : 1n
+    const total = limit.limit * periods
+    if (total > listing.cap)
+      return new LimitExceedsMaximumError({
+        error_description: `Invalid ${listing.symbol} limit: ${Value.format(total, listing.decimals)}${periods > 1n ? ` over ${periods} periods before the key expires` : ''} exceeds the ${Value.format(listing.cap, listing.decimals)} maximum. ${periods > 1n ? 'Lower the limit or shorten the expiry' : 'Lower the limit'}, or authorize through a redirect or device grant.`,
+        field: `key_authorization.limits.${index}.limit`,
+        meta: {
+          chain_id: chainId,
+          // The compared total: the limit, times its periods before the key expires.
+          limit: total.toString(),
+          maximum: listing.cap.toString(),
+          periods: Number(periods),
+          symbol: listing.symbol,
+          token: listing.address,
+        },
+      })
+  }
+  return undefined
+}
+
+export namespace checkHeadless {
+  export type Options = {
+    /** Whether the app holds `tempo-id:sign`, which permits unrecognized calls. */
+    sign: boolean
+  }
+
+  /** The refusals `checkHeadless` returns: `check`'s, then the headless ceiling's. */
+  export const errors = [
+    ...check.errors,
+    ExpiryExceedsMaximumError,
+    LimitExceedsMaximumError,
+  ] as const
+}
+
+/** Returns what a `key` that passes `check` grants, with limits totaled per currency and period. */
+export function describe(key: Key): Description {
+  // The screens state spending per currency, so limits on tokens of one currency and period add up.
+  const totals = new Map<
+    string,
+    {
+      amount: bigint
+      currency: string
+      decimals: number
+      period: number
+      tokens: { amount: string; symbol: string }[]
+    }
+  >()
+  for (const limit of key.limits) {
+    const listing = token(key, limit.token)!
+    const period = limit.period ?? 0
+    const group = `${listing.currency}\0${period}`
+    const total = totals.get(group)
+    if (!total) {
+      totals.set(group, {
+        amount: limit.limit,
+        currency: listing.currency,
+        decimals: listing.decimals,
+        period,
+        tokens: [
+          {
+            amount: Value.format(limit.limit, listing.decimals),
+            symbol: listing.symbol,
+          },
+        ],
+      })
+      continue
+    }
+
+    total.tokens.push({
+      amount: Value.format(limit.limit, listing.decimals),
+      symbol: listing.symbol,
+    })
+
+    const decimals = Math.max(total.decimals, listing.decimals)
+    total.amount =
+      total.amount * 10n ** BigInt(decimals - total.decimals) +
+      limit.limit * 10n ** BigInt(decimals - listing.decimals)
+    total.decimals = decimals
+  }
+
+  return {
+    account: key.account,
+    // Transfers and approvals spend within the limits, which the screens state already.
+    calls: key.scopes.flatMap((scope): Description['calls'] => {
+      if (scope.address.toLowerCase() !== reserve.address) return []
+      const selector =
+        scope.selector === undefined ? undefined : normalize(scope.selector)
+      if (selector === reserve.open) return [{ call: 'open' }]
+      if (selector === reserve.topUp) return [{ call: 'topUp' }]
+      return []
+    }),
+    expiry: key.expiry,
+    limits: [...totals.values()].map((total) => ({
+      amount: Value.format(total.amount, total.decimals),
+      currency: total.currency,
+      ...(total.period ? { period: total.period } : {}),
+      tokens: total.tokens,
+    })),
+    unrecognized: key.scopes
+      .filter((scope) => !recognized(key, scope))
+      .map((scope) => {
+        const selector =
+          scope.selector === undefined ? undefined : normalize(scope.selector)
+        return {
+          address: Address.checksum(scope.address),
+          ...(selector ? { selector } : {}),
+        }
+      }),
+  }
+}
+
+/** What a key grants, as the approval screens show it. */
+export type Description = z.output<typeof schema.description>
+
+/**
+ * Returns the digest that the account's owner signs for `key`, which is a passkey's WebAuthn
+ * challenge. An owner's digest binds no account, so it is known before the passkey is. `witness`
+ * replaces the key's own. For a configurable account, each owner signs its configuration's digest.
+ */
+export function digest(options: digest.Options) {
+  const { account } = options
+  const { key: accessKey, ...rest } = parameters(options.key)
+  const payload = KeyAuthorization.getSignPayload({
+    ...rest,
+    address: accessKey.address,
+    type: accessKey.type,
+    ...(options.witness ? { witness: options.witness } : {}),
+    ...(account ? { account: account.address } : {}),
+  } as never)
+  if (!account) return payload
+  return AccountConfig.getSignPayload({
+    account: account.address,
+    config: account.config,
+    payload,
+  })
+}
+
+export declare namespace digest {
+  type Options = {
+    /** The configurable account that the key acts for. Absent, the owner key is the account. */
+    account?: Account.ConfigurableAccount<AccountConfig.Config> | undefined
+    /** The key authorization to commit to. */
+    key: Key
+    /** Replaces the key's own witness, as a sign-in with key signature binds it. */
+    witness?: Hex.Hex | undefined
+  }
+}
+
+/** Returns the access key's address, or the address of its `publicKey`. */
+export function keyId(key: Key) {
+  return parameters(key).key.address
+}
+
+/** Returns the listed tokens on the chain with `chainId`. */
+export function listings(options: listings.Options) {
+  const prefix = `${options.chainId}:`
+  return [...listed].flatMap((entry) =>
+    entry[0].startsWith(prefix) ? [entry[1]] : [],
+  )
+}
+
+export declare namespace listings {
+  type Options = {
+    /** The chain's ID. */
+    chainId: number
+  }
+}
+
+/**
+ * Signs `key` with `owner`, the account's owner key, and returns it in the node's RPC format. A
+ * configurable account signs through one of its owners, and its authorization binds the account.
+ */
+export async function sign(
+  owner: Parameters<typeof Account.signKeyAuthorization>[0],
+  options: sign.Options,
+) {
+  const configurable =
+    owner.source === 'configurable' && 'config' in owner && owner.config
+      ? { config: owner.config as AccountConfig.Config }
+      : undefined
+  return KeyAuthorization.toRpc(
+    await Account.signKeyAuthorization(owner, {
+      ...parameters(options.key),
+      ...(configurable ? { configurable } : {}),
+    }),
+  )
+}
+
+export declare namespace sign {
+  type Options = {
+    /** A key authorization that `check` accepts. */
+    key: Key
+  }
+}
+
+/**
+ * Signs `key` with a verified passkey `assertion` over its {@link digest}, in the RPC format. For a
+ * configurable account, the assertion is the passkey owner's approval in the account's envelope.
+ */
+export async function signWithAssertion(
+  assertion: Passkey.Assertion,
+  options: signWithAssertion.Options,
+) {
+  const { account } = options
+  const { metadata, signature } = Authentication.deserializeResponse(assertion)
+  const challenge = digest({ account, key: options.key })
+  const publicKey = PublicKey.fromHex(options.publicKey)
+  // The passkey already signed the digest, so this owner returns the assertion as its envelope.
+  const owner = Account.from({
+    keyType: 'webAuthn',
+    publicKey,
+    sign(request) {
+      if (request.hash !== challenge)
+        return Promise.reject(
+          new Error('The assertion signs another key authorization.'),
+        )
+      return Promise.resolve(
+        SignatureEnvelope.serialize({
+          metadata: {
+            authenticatorData: metadata.authenticatorData,
+            clientDataJSON: metadata.clientDataJSON,
+          },
+          publicKey,
+          signature,
+          type: 'webAuthn',
+        }),
+      )
+    },
+  })
+  if (!account) return await sign(owner, { key: options.key })
+
+  // A configurable account signs through the passkey, one of its owners. Viem derives the address
+  // of an initial configuration, and takes it for any later version.
+  const owners = account.config.owners.map((entry) => ({
+    owner: Address.isEqual(entry.owner, owner.address) ? owner : entry.owner,
+    weight: Number(entry.weight),
+  }))
+  const { salt, threshold, version } = account.config
+  const configurable =
+    BigInt(version) === 0n
+      ? Account.fromConfig({ owners, salt, threshold: Number(threshold) })
+      : Account.fromConfig({
+          address: account.address,
+          owners,
+          salt,
+          threshold: Number(threshold),
+          version,
+        })
+  return await sign(configurable, { key: options.key })
+}
+
+export declare namespace signWithAssertion {
+  type Options = {
+    /**
+     * The configurable account that the key acts for, on the chain where it is configurable. Absent,
+     * the passkey itself acts as the account.
+     */
+    account?: Account.ConfigurableAccount<AccountConfig.Config> | undefined
+    /** The key authorization that the assertion signs. */
+    key: Key
+    /** The passkey's uncompressed P256 public key. */
+    publicKey: Hex.Hex
+  }
+}
+
+/**
+ * Fills what a request leaves out with the headless ceiling: Tempo mainnet, a year, the cap of each
+ * token it calls or of OUSD, and transfers of each token it limits.
+ */
+function defaults(key: Request): Defaulted {
+  const chainId = key.chainId ?? BigInt(defaultChainId)
+  // Each listed token the scopes call takes its cap. Scopes that call no listed token, or empty
+  // scopes that `check` refuses, take the cap of OUSD.
+  const called = [
+    ...new Map(
+      (key.scopes ?? []).flatMap((scope) => {
+        const listing = listed.get(`${chainId}:${scope.address.toLowerCase()}`)
+        return listing ? [[listing.address, listing] as const] : []
+      }),
+    ).values(),
+  ]
+  // On a chain without OUSD, a zero limit remains, which `check` refuses as an unsupported token.
+  const limits =
+    key.limits ??
+    (called.length
+      ? called.map((listing) => ({
+          limit: listing.cap,
+          token: listing.address,
+        }))
+      : [
+          {
+            limit: listed.get(`${chainId}:${ousd.toLowerCase()}`)?.cap ?? 0n,
+            token: ousd,
+          },
+        ])
+  const scopes =
+    key.scopes ??
+    limits.flatMap((limit) =>
+      [calls.transfer, calls.transferWithMemo].map((selector) => ({
+        address: limit.token,
+        selector,
+      })),
+    )
+  return {
+    ...key,
+    chainId,
+    expiry: key.expiry ?? Math.floor(Date.now() / 1000) + lifetime,
+    limits,
+    scopes,
+  }
+}
+
+/** Whether `address` has the full 12-byte TIP-20 prefix, which no other contract shares. */
+export function tip20(address: string) {
+  return address.toLowerCase().startsWith('0x20c000000000000000000000')
+}
+
+/** The listed token at `address` on the key's chain, if any. */
+function token(key: Key, address: string) {
+  return listed.get(`${Number(key.chainId)}:${address.toLowerCase()}`)
+}
+
+/** Returns a selector or signature as lowercase hex, or `undefined` if it does not parse. */
+function normalize(selector: string) {
+  if (/^0x[0-9a-fA-F]{8}$/.test(selector))
+    return selector.toLowerCase() as `0x${string}`
+  // The parser throws on a malformed signature, which the caller refuses as an unsupported call.
+  try {
+    return AbiFunction.getSelector(selector)
+  } catch {
+    return undefined
+  }
+}
+
+/** The fields of `key` that its owner signs, as `Account.signKeyAuthorization` takes them. */
+function parameters(key: Key) {
+  return {
+    chainId: key.chainId!,
+    expiry: key.expiry,
+    key: {
+      address: key.address ?? parse(key.publicKey!)!,
+      // The Accounts SDK's default for a key the app holds.
+      type: key.keyType ?? ('secp256k1' as const),
+    },
+    limits: key.limits,
+    scopes: key.scopes,
+    ...(key.witness ? { witness: key.witness } : {}),
+  }
+}
+
+/** A Unix time as a UTC date and time, for messages. */
+function date(seconds: number) {
+  return new Date(seconds * 1000).toUTCString()
+}
+
+/** The address of a public key, or `undefined` when it is not a valid point. */
+function parse(publicKey: `0x${string}`) {
+  try {
+    return Address.fromPublicKey(PublicKey.from(publicKey))
+  } catch {
+    return undefined
+  }
+}