@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/cli/Session.js

@@ -0,0 +1,229 @@
+/**
+ * The CLI's stored session from `tempo-id login`, in `id/credentials.json` under `TEMPO_HOME`. Only
+ * the current user can read the file.
+ * @module
+ */
+import * as Fs from 'node:fs/promises';
+import * as Os from 'node:os';
+import * as Path from 'node:path';
+import * as Actions from '../client/Actions.js';
+import * as Auth from '../client/Auth.js';
+import * as Key from '../client/Key.js';
+/** The client ID of Tempo ID's own device app. */
+export const clientId = 'tempo-cli';
+/** Returns the `tempo-cli` client of Tempo ID at `url`. */
+export function auth(options) {
+    return Auth.create({ clientId, url: options.url });
+}
+/**
+ * Returns the stored session, and refreshes its access token if it expires within 30 seconds.
+ * Returns `undefined` if no session is usable or the refresh fails. A session from another
+ * deployment is not usable, so its tokens never reach `url`.
+ */
+export async function get(options) {
+    const saved = await usable(options);
+    if (!saved)
+        return undefined;
+    if (saved.expiresAt - 30_000 > Date.now())
+        return saved;
+    // Issuers revoke every refresh token of the app for the user when one is sent twice, so one
+    // process at a time refreshes, and it reads the file again once it holds the lock.
+    return await locked(options, async () => {
+        const current = await usable(options);
+        if (!current)
+            return undefined;
+        if (current.expiresAt - 30_000 > Date.now())
+            return current;
+        if (!current.refreshToken)
+            return undefined;
+        const tokens = await Actions.refresh(auth(options), {
+            refreshToken: current.refreshToken,
+        }).catch(() => undefined);
+        if (!tokens)
+            return undefined;
+        return await save({ ...options, session: { ...current, ...tokens } });
+    });
+}
+/**
+ * Starts the device grant with a new access key, and returns the code and `wait`. Once the user
+ * approves, `wait` stores the new session, revokes the refresh token of the replaced one, and
+ * returns it. It rejects with `Auth.RequestError` if the user denies the code or it expires.
+ */
+export async function login(options) {
+    const client = auth(options);
+    const device = await Actions.device.authorize(client);
+    return {
+        ...device,
+        async wait() {
+            const { account: _, ...authorization } = await device.wait();
+            return await locked(options, async () => {
+                const replaced = await readSession(options);
+                // The new session is stored first, so a failed write keeps the replaced one usable.
+                const session = await save({
+                    home: options.home,
+                    session: { ...authorization, url: new URL(client.url).origin },
+                });
+                // The replaced session's refresh token goes only to the deployment that issued it.
+                if (replaced.status === 'found' &&
+                    replaced.session.refreshToken &&
+                    replaced.session.url)
+                    await revoke({
+                        token: replaced.session.refreshToken,
+                        url: replaced.session.url,
+                    });
+                return session;
+            });
+        },
+    };
+}
+/**
+ * Revokes the stored refresh token at the deployment that issued it, and deletes the session either
+ * way. Returns `false` if the token is not revoked, such as without a network.
+ */
+export async function remove(options) {
+    return await locked(options, async () => {
+        const read = await readSession(options);
+        const revoked = await (async () => {
+            if (read.status === 'missing')
+                return true;
+            if (read.status === 'invalid')
+                return false;
+            const { refreshToken, url } = read.session;
+            if (!refreshToken)
+                return true;
+            // A session stored before its origin was recorded names no deployment to revoke it at.
+            if (!url)
+                return false;
+            return await revoke({ token: refreshToken, url });
+        })();
+        await Fs.rm(file(options), { force: true });
+        return revoked;
+    });
+}
+/**
+ * Stores `session`, readable only by the current user, and returns it. One rename replaces the
+ * earlier session, so a failed write keeps it.
+ */
+export async function save(options) {
+    const path = file(options);
+    await Fs.mkdir(Path.dirname(path), { mode: 0o700, recursive: true });
+    const temporary = `${path}.${crypto.randomUUID()}.tmp`;
+    try {
+        await Fs.writeFile(temporary, JSON.stringify(options.session), {
+            flag: 'wx',
+            mode: 0o600,
+        });
+        await Fs.rename(temporary, path);
+    }
+    catch (error) {
+        await Fs.rm(temporary, { force: true });
+        throw error;
+    }
+    return options.session;
+}
+/**
+ * Returns the user's email and the Tempo Account of the session's access key, or `undefined`
+ * without a session.
+ */
+export async function whoami(options) {
+    const session = await get(options);
+    if (!session)
+        return undefined;
+    // The UserInfo endpoint accepts the access token, as any Tempo API does.
+    const user = await Actions.oauth.userInfo(auth(options), {
+        accessToken: session.accessToken,
+    });
+    return { account: session.key.account, email: user.email };
+}
+/** Returns the path of the session file under `home`, or `~/.tempo` if `home` is unset or empty. */
+function file(options) {
+    return Path.join(options.home || Path.join(Os.homedir(), '.tempo'), 'id', 'credentials.json');
+}
+/**
+ * Runs `fn` while this process holds the session's lock file. It takes over a lock older than
+ * {@link lockLifetime}.
+ */
+async function locked(options, fn) {
+    const path = `${file(options)}.lock`;
+    await Fs.mkdir(Path.dirname(path), { mode: 0o700, recursive: true });
+    for (;;) {
+        const handle = await Fs.open(path, 'wx', 0o600).catch((error) => {
+            if (error.code === 'EEXIST')
+                return undefined;
+            throw error;
+        });
+        if (handle) {
+            await handle.close();
+            break;
+        }
+        const stat = await Fs.stat(path).catch(() => undefined);
+        if (stat && Date.now() - stat.mtimeMs > lockLifetime)
+            await Fs.rm(path, { force: true });
+        else
+            await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await Fs.rm(path, { force: true });
+    }
+}
+/** Milliseconds that a lock holds at most, which covers a refresh or a revocation. */
+const lockLifetime = 30_000;
+/**
+ * Reads the stored session. Returns `missing` without a file, and `invalid` for a file that holds
+ * no JSON object.
+ */
+async function readSession(options) {
+    return await Fs.readFile(file(options), 'utf8').then((text) => {
+        const session = (() => {
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        if (typeof session !== 'object' || !session)
+            return { status: 'invalid' };
+        return { session: session, status: 'found' };
+    }, (error) => {
+        if (error.code === 'ENOENT')
+            return { status: 'missing' };
+        return { status: 'invalid' };
+    });
+}
+/**
+ * Returns the stored session, or `undefined` if another deployment issued it, or it has no user,
+ * access token, or unexpired access key.
+ */
+async function usable(options) {
+    const read = await readSession(options);
+    const saved = read.status === 'found' ? read.session : undefined;
+    if (saved?.url !== new URL(auth(options).url).origin ||
+        !saved.user ||
+        !saved.key?.keyAuthorization ||
+        !saved.accessToken ||
+        Key.expired(saved.key))
+        return undefined;
+    return saved;
+}
+/**
+ * Revokes `token` at the RFC 7009 endpoint of `url`, and returns whether it succeeded within 10
+ * seconds.
+ */
+async function revoke(options) {
+    const response = await fetch(new URL('/oauth2/revoke', options.url), {
+        body: new URLSearchParams({
+            client_id: clientId,
+            token: options.token,
+            token_type_hint: 'refresh_token',
+        }),
+        method: 'POST',
+        signal: AbortSignal.timeout(10_000),
+    }).catch(() => undefined);
+    await response?.body?.cancel();
+    return response?.ok ?? false;
+}
+//# sourceMappingURL=Session.js.map

package/dist/cli/Session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Session.js","sourceRoot":"","sources":["../../src/cli/Session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AAEzC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAA;AAQvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAA;AAEnC,2DAA2D;AAC3D,MAAM,UAAU,IAAI,CAAC,OAAqB;IACxC,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;AACpD,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAoB;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IAEvD,4FAA4F;IAC5F,mFAAmF;IACnF,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,OAAO,CAAA;QAC3D,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,SAAS,CAAA;QAE3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAClD,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,OAAO,MAAM,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAsB;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACrD,OAAO;QACL,GAAG,MAAM;QACT,KAAK,CAAC,IAAI;YACR,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC5D,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;gBAC3C,oFAAoF;gBACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;oBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;iBAC/D,CAAC,CAAA;gBACF,mFAAmF;gBACnF,IACE,QAAQ,CAAC,MAAM,KAAK,OAAO;oBAC3B,QAAQ,CAAC,OAAO,CAAC,YAAY;oBAC7B,QAAQ,CAAC,OAAO,CAAC,GAAG;oBAEpB,MAAM,MAAM,CAAC;wBACX,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;wBACpC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;qBAC1B,CAAC,CAAA;gBACJ,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAuB;IAClD,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;YAC1C,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAA;YAC9B,uFAAuF;YACvF,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAA;YACtB,OAAO,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,CAAC,CAAC,EAAE,CAAA;QACJ,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,OAAO,OAAO,CAAA;IAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7D,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAA;QACF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACvC,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAA;AACxB,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAuB;IAClD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;AAC5D,CAAC;AAMD,oGAAoG;AACpG,SAAS,IAAI,CAAC,OAAsC;IAClD,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EACjD,IAAI,EACJ,kBAAkB,CACnB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CACnB,OAAsC,EACtC,EAAoB;IAEpB,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;IACpC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACvE,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACrE,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACpB,MAAK;QACP,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACvD,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,YAAY;YAClD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;;YAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,YAAY,GAAG,MAAM,CAAA;AAE3B;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,OAAsC;IAK/D,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAClD,CAAC,IAAI,EAAU,EAAE;QACf,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzE,OAAO,EAAE,OAAO,EAAE,OAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACzD,CAAC,EACD,CAAC,KAAc,EAAU,EAAE;QACzB,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ;YACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC9B,CAAC,CACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CAAC,OAAoB;IACxC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,IACE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM;QAChD,CAAC,KAAK,CAAC,IAAI;QACX,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB;QAC5B,CAAC,KAAK,CAAC,WAAW;QAClB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;QAEtB,OAAO,SAAS,CAAA;IAClB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CAAC,OAAuC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;QACnE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,eAAe,EAAE,eAAe;SACjC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACzB,MAAM,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAC9B,OAAO,QAAQ,EAAE,EAAE,IAAI,KAAK,CAAA;AAC9B,CAAC"}

package/dist/cli/User.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the `login`, `logout`, and `whoami` commands share. incur imports every command at startup,
+ * so this module imports no optional peer.
+ * @module
+ */
+import { z } from 'incur';
+/** The variables that name Tempo ID and the folder of the stored session. */
+export declare const env: z.ZodObject<{
+    TEMPO_HOME: z.ZodOptional<z.ZodString>;
+    TEMPO_ID_URL: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+/** The error for a command without Viem, which the access key needs. */
+export declare const missingPeers: {
+    readonly code: 'missing_peer';
+    readonly message: 'Missing peer dependency. Install viem to run login, logout, and whoami.';
+};
+/** The error for a command without a session. */
+export declare const signedOut: {
+    readonly code: 'signed_out';
+    readonly message: 'Not signed in. Run `tempo-id login`.';
+};
+/** Loads the session module, or returns `undefined` without Viem, the client's optional peer. */
+export declare function loadSession(): Promise<typeof import("./Session.js") | undefined>;
+//# sourceMappingURL=User.d.ts.map

package/dist/cli/User.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/cli/User.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAGzB,6EAA6E;AAC7E,eAAO,MAAM,GAAG;;;iBAWd,CAAA;AAEF,wEAAwE;AACxE,eAAO,MAAM,YAAY;aACvB,IAAI,EAAE,cAAc;aACpB,OAAO,EACL,yEAAyE;CACnE,CAAA;AAEV,iDAAiD;AACjD,eAAO,MAAM,SAAS;aACpB,IAAI,EAAE,YAAY;aAClB,OAAO,EAAE,sCAAsC;CACvC,CAAA;AAEV,iGAAiG;AACjG,wBAAsB,WAAW,uDAGhC"}

package/dist/cli/User.js

@@ -0,0 +1,34 @@
+/**
+ * What the `login`, `logout`, and `whoami` commands share. incur imports every command at startup,
+ * so this module imports no optional peer.
+ * @module
+ */
+import { z } from 'incur';
+import * as Admin from './Admin.js';
+/** The variables that name Tempo ID and the folder of the stored session. */
+export const env = z.object({
+    TEMPO_HOME: z
+        .string()
+        .optional()
+        .describe('The folder that holds the session, in id/credentials.json. Defaults to ~/.tempo.'),
+    TEMPO_ID_URL: z
+        .url()
+        .optional()
+        .describe("Tempo ID's origin. Defaults to https://id.tempo.xyz."),
+});
+/** The error for a command without Viem, which the access key needs. */
+export const missingPeers = {
+    code: 'missing_peer',
+    message: 'Missing peer dependency. Install viem to run login, logout, and whoami.',
+};
+/** The error for a command without a session. */
+export const signedOut = {
+    code: 'signed_out',
+    message: 'Not signed in. Run `tempo-id login`.',
+};
+/** Loads the session module, or returns `undefined` without Viem, the client's optional peer. */
+export async function loadSession() {
+    // A dynamic import, since the module needs an optional peer that the other commands do not.
+    return await Admin.optional(import('./Session.js'));
+}
+//# sourceMappingURL=User.js.map

package/dist/cli/User.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.js","sourceRoot":"","sources":["../../src/cli/User.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AACzB,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAEnC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF,CACnF;IACH,YAAY,EAAE,CAAC;SACZ,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC,CAAA;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,cAAc;IACpB,OAAO,EACL,yEAAyE;CACnE,CAAA;AAEV,iDAAiD;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,sCAAsC;CACvC,CAAA;AAEV,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,4FAA4F;IAC5F,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AACrD,CAAC"}

package/dist/cli/V1.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The `tempo-id v1` group: one command per `/v1` route of a deployment, which incur generates from
+ * its OpenAPI document. The commands send no session, so routes that need one refuse them with
+ * status 401.
+ * @module
+ */
+/**
+ * Fetches the OpenAPI document of the deployment at `url`, and returns the `v1` group's definition
+ * for its `/v1` routes. Rejects if the deployment responds with an error, or not within 10 seconds.
+ */
+export declare function load(options: load.Options): Promise<{
+    basePath: string;
+    description: string;
+    fetch: (request: Request) => Promise<Response>;
+    openapi: {
+        paths: {
+            [k: string]: unknown;
+        };
+    };
+    openapiConfig: {
+        mode: 'namespace';
+    };
+}>;
+export declare namespace load {
+    type Options = {
+        /** The fetch that reaches the deployment. Defaults to the global `fetch`. */
+        fetch?: typeof globalThis.fetch | undefined;
+        /** Tempo ID's origin. */
+        url: string;
+    };
+}
+//# sourceMappingURL=V1.d.ts.map

package/dist/cli/V1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"V1.d.ts","sourceRoot":"","sources":["../../src/cli/V1.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH;;;GAGG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO;;;qBAwB3B,OAAO;;;;;;;QAQP,IAAI,EAAE,WAAW;;GAErC;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,6EAA6E;QAC7E,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;QAC3C,yBAAyB;QACzB,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF"}

package/dist/cli/V1.js

@@ -0,0 +1,38 @@
+/**
+ * The `tempo-id v1` group: one command per `/v1` route of a deployment, which incur generates from
+ * its OpenAPI document. The commands send no session, so routes that need one refuse them with
+ * status 401.
+ * @module
+ */
+/**
+ * Fetches the OpenAPI document of the deployment at `url`, and returns the `v1` group's definition
+ * for its `/v1` routes. Rejects if the deployment responds with an error, or not within 10 seconds.
+ */
+export async function load(options) {
+    const { url } = options;
+    const fetch = options.fetch ?? globalThis.fetch;
+    const response = await fetch(new URL('/openapi.json', url), {
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error(`Tempo ID at ${url} responded to /openapi.json with ${response.status}.`);
+    const document = (await response.json());
+    const paths = Object.fromEntries(Object.entries(document.paths ?? {}).flatMap(([path, item]) => path.startsWith('/v1/') ? [[path.slice('/v1'.length), item]] : []));
+    return {
+        basePath: '/v1',
+        description: "Call Tempo ID's /v1 API, one command per route.",
+        // Each request goes to the deployment, whatever origin incur builds it with. The path is set on
+        // the deployment's URL, never resolved against it, so a path argument such as `//host` keeps
+        // the deployment's origin.
+        fetch: (request) => {
+            const source = new URL(request.url);
+            const target = new URL(url);
+            target.pathname = source.pathname;
+            target.search = source.search;
+            return fetch(new Request(target, request));
+        },
+        openapi: { ...document, paths },
+        openapiConfig: { mode: 'namespace' },
+    };
+}
+//# sourceMappingURL=V1.js.map

package/dist/cli/V1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"V1.js","sourceRoot":"","sources":["../../src/cli/V1.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAqB;IAC9C,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE;QAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,oCAAoC,QAAQ,CAAC,MAAM,GAAG,CACzE,CAAA;IACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEtC,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAC5D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAClE,CACF,CAAA;IACD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iDAAiD;QAC9D,gGAAgG;QAChG,6FAA6F;QAC7F,2BAA2B;QAC3B,KAAK,EAAE,CAAC,OAAgB,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;YACjC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC7B,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE;QAC/B,aAAa,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE;KAC9C,CAAA;AACH,CAAC"}

package/dist/cli/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/cli/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":""}

package/dist/cli/bin.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/**
+ * Runs the `tempo-id` CLI. Only `v1` and `--mcp` load the OpenAPI document. If the deployment does
+ * not respond, both warn: a `v1` command exits with code 1, and an MCP server serves the other
+ * commands.
+ * @module
+ */
+/* istanbul ignore file -- The CLI's tests spawn it, and no report reads a child process. */
+import * as Cli from './Cli.js';
+import * as V1 from './V1.js';
+const argv = process.argv.slice(2);
+const url = process.env.TEMPO_ID_URL ?? 'https://id.tempo.xyz';
+/** incur's global options that take a value as the next argument. */
+const valued = [
+    '--filter-output',
+    '--format',
+    '--token-limit',
+    '--token-offset',
+];
+// The command is the first argument that is no option, since global options, such as
+// `--format json`, can come before it. An argument of another command can be `v1` too.
+const command = (() => {
+    for (let index = 0; index < argv.length; index++) {
+        const entry = argv[index];
+        if (!entry.startsWith('-'))
+            return entry;
+        if (valued.includes(entry))
+            index++;
+    }
+    return undefined;
+})();
+const group = command === 'v1';
+const v1 = await (async () => {
+    if (!group && !argv.includes('--mcp'))
+        return undefined;
+    return await V1.load({ url }).catch((error) => {
+        process.stderr.write(`The v1 commands are unavailable: ${error instanceof Error ? error.message : String(error)}\n`);
+        return null;
+    });
+})();
+// A `v1` command fails without its group. An MCP server serves the other commands.
+if (v1 === null && group)
+    process.exitCode = 1;
+else
+    await Cli.create({ v1: v1 ?? undefined }).serve();
+//# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,4FAA4F;AAC5F,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,sBAAsB,CAAA;AAC9D,qEAAqE;AACrE,MAAM,MAAM,GAAG;IACb,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,gBAAgB;CACjB,CAAA;AACD,qFAAqF;AACrF,uFAAuF;AACvF,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAE,CAAA;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,EAAE,CAAA;IACrC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAC,EAAE,CAAA;AACJ,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,CAAA;AAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;IAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IACvD,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC/F,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,EAAE,CAAA;AAEJ,mFAAmF;AACnF,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK;IAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;;IACzC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA"}

package/dist/cli/commands/admin/apps/create.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `tempo-id admin apps create`: registers an OAuth app. The output holds the client secret, which no
+ * later command returns.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<undefined, z.ZodObject<{
+    DATABASE_SCHEMA: z.ZodOptional<z.ZodString>;
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+    TEMPO_ID_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    device: z.ZodDefault<z.ZodBoolean>;
+    name: z.ZodString;
+    native: z.ZodDefault<z.ZodBoolean>;
+    postLogoutRedirectUri: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    redirectUri: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    secret: z.ZodDefault<z.ZodBoolean>;
+    sign: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=create.d.ts.map

package/dist/cli/commands/admin/apps/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/apps/create.js

@@ -0,0 +1,84 @@
+/**
+ * `tempo-id admin apps create`: registers an OAuth app. The output holds the client secret, which no
+ * later command returns.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../Admin.js';
+export default Cli.command({
+    description: 'Register a first-party OAuth app, which skips consent for requests without a key. The output holds its client secret, which no later command returns.',
+    env: Admin.env.extend({
+        TEMPO_ID_CLIENT_SECRET: z
+            .string()
+            .optional()
+            .describe('Client secret to keep with --secret, such as one that another deployment issued. No flag takes it, so it stays out of the shell history.'),
+    }),
+    // Hidden from MCP clients, as is every `admin apps` command, since the group returns client secrets.
+    mcp: false,
+    options: Admin.options.extend({
+        clientId: z
+            .string()
+            .optional()
+            .describe('Client ID to keep, such as one that another deployment issued. Defaults to a random ID.'),
+        device: z
+            .boolean()
+            .default(false)
+            .describe('Sign in through the device grant instead of a redirect, as a CLI does. A device app needs no redirect URI.'),
+        name: z.string().describe('Display name, which the approval page shows.'),
+        native: z
+            .boolean()
+            .default(false)
+            .describe('Register a mobile app instead of a web app.'),
+        postLogoutRedirectUri: z
+            .array(z.string())
+            .default([])
+            .describe('URI that the app returns to after it ends the session. Repeat the flag for each URI.'),
+        redirectUri: z
+            .array(z.string())
+            .default([])
+            .describe('Redirect URI. Repeat the flag for each URI, in each environment. Every app but a device app needs one.'),
+        secret: z
+            .boolean()
+            .default(false)
+            .describe('Issue a client secret, for an app with a backend. TEMPO_ID_CLIENT_SECRET sets it instead of a new one.'),
+        sign: z
+            .boolean()
+            .default(false)
+            .describe('Grant the tempo-id:sign scope, which permits the app to bind its own challenges and to request unrecognized key calls headlessly.'),
+    }),
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Apps = await Admin.loadApps();
+        if (!Apps)
+            return c.error(Admin.missingPeers);
+        const client = Apps.connect({ connectionString });
+        try {
+            return await Apps.Apps.create(client.db, {
+                clientId: c.options.clientId,
+                // The variable applies only with `--secret`, so an exported one never makes an app confidential.
+                clientSecret: c.options.secret
+                    ? c.env.TEMPO_ID_CLIENT_SECRET
+                    : undefined,
+                device: c.options.device,
+                name: c.options.name,
+                postLogoutRedirectUris: c.options.postLogoutRedirectUri,
+                redirectUris: c.options.redirectUri,
+                secret: c.options.secret,
+                sign: c.options.sign,
+                type: c.options.native ? 'native' : 'web',
+            });
+        }
+        catch (error) {
+            const refusal = Apps.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=create.js.map

package/dist/cli/commands/admin/apps/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAA;AAE1C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EACT,uJAAuJ;IACzJ,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACpB,sBAAsB,EAAE,CAAC;aACtB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,0IAA0I,CAC3I;KACJ,CAAC;IACF,qGAAqG;IACrG,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,yFAAyF,CAC1F;QACH,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,4GAA4G,CAC7G;QACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QACzE,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,qBAAqB,EAAE,CAAC;aACrB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,sFAAsF,CACvF;QACH,WAAW,EAAE,CAAC;aACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,wGAAwG,CACzG;QACH,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,wGAAwG,CACzG;QACH,IAAI,EAAE,CAAC;aACJ,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,mIAAmI,CACpI;KACJ,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gBACvC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAC5B,iGAAiG;gBACjG,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;oBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB;oBAC9B,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;gBACxB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;gBACpB,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;gBACvD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;gBACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;gBACxB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;gBACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;aAC1C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/apps/delete.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `tempo-id admin apps delete`: removes an OAuth app, with its consents, tokens, and realms.
+ * @module
+ */
+import { Cli, z } from 'incur';
+declare const _default: Cli.FileCommand<z.ZodObject<{
+    clientId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    DATABASE_SCHEMA: z.ZodOptional<z.ZodString>;
+    DATABASE_URL: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    databaseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, undefined>;
+export default _default;
+//# sourceMappingURL=delete.d.ts.map

package/dist/cli/commands/admin/apps/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/delete.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA"}

package/dist/cli/commands/admin/apps/delete.js

@@ -0,0 +1,41 @@
+/**
+ * `tempo-id admin apps delete`: removes an OAuth app, with its consents, tokens, and realms.
+ * @module
+ */
+import { Cli, z } from 'incur';
+import * as Admin from '../../../Admin.js';
+export default Cli.command({
+    args: z.object({
+        clientId: z.string().describe("OAuth app's client ID."),
+    }),
+    description: 'Remove an app, with its consents, tokens, and realms.',
+    env: Admin.env,
+    // Hidden from MCP clients, as is every `admin apps` command, since the group returns client secrets.
+    mcp: false,
+    options: Admin.options,
+    async run(c) {
+        const connectionString = c.options.databaseUrl ?? c.env.DATABASE_URL;
+        if (!connectionString)
+            return c.error(Admin.missingDatabaseUrl);
+        const Apps = await Admin.loadApps();
+        if (!Apps)
+            return c.error(Admin.missingPeers);
+        const client = Apps.connect({ connectionString });
+        try {
+            const app = await Apps.Apps.remove(client.db, {
+                clientId: c.args.clientId,
+            });
+            return { removed: app.clientId };
+        }
+        catch (error) {
+            const refusal = Apps.error(error);
+            if (refusal)
+                return c.error(refusal);
+            throw error;
+        }
+        finally {
+            await client.end();
+        }
+    },
+});
+//# sourceMappingURL=delete.js.map

package/dist/cli/commands/admin/apps/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/delete.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,KAAK,MAAM,mBAAmB,CAAA;AAE1C,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACxD,CAAC;IACF,WAAW,EAAE,uDAAuD;IACpE,GAAG,EAAE,KAAK,CAAC,GAAG;IACd,qGAAqG;IACrG,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QACpE,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAE/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gBAC5C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;aAC1B,CAAC,CAAA;YACF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjC,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}

package/dist/cli/commands/admin/apps/index.d.ts

@@ -0,0 +1,5 @@
+/** `tempo-id admin apps`: the commands that register and change OAuth apps. @module */
+import { Cli } from 'incur';
+declare const _default: Cli.FileCommand<undefined, undefined, undefined, undefined>;
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/commands/admin/apps/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/admin/apps/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA"}