@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/cli/commands/whoami.js

@@ -0,0 +1,24 @@
+/**
+ * `tempo-id whoami`: shows the user's email and the Tempo Account of the stored access key. It
+ * refreshes an access token that expires.
+ * @module
+ */
+import { Cli } from 'incur';
+import * as User from '../User.js';
+export default Cli.command({
+    description: 'Show the signed-in user and Tempo Account.',
+    env: User.env,
+    async run(c) {
+        const Session = await User.loadSession();
+        if (!Session)
+            return c.error(User.missingPeers);
+        const user = await Session.whoami({
+            home: c.env.TEMPO_HOME,
+            url: c.env.TEMPO_ID_URL,
+        });
+        if (!user)
+            return c.error(User.signedOut);
+        return user;
+    },
+});
+//# sourceMappingURL=whoami.js.map

package/dist/cli/commands/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAC3B,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAElC,eAAe,GAAG,CAAC,OAAO,CAAC;IACzB,WAAW,EAAE,4CAA4C;IACzD,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,KAAK,CAAC,GAAG,CAAC,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAE/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY;SACxB,CAAC,CAAA;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAC,CAAA"}

package/dist/client/Actions.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Tempo ID's actions, each of which takes an instance from `Auth.create`.
+ * @module
+ */
+import type { Authentication } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import { type Auth } from './Auth.js';
+import type { Authorization } from './Authorization.js';
+import type { Permissions } from './Permissions.js';
+import type { Tokens } from './Tokens.js';
+export * as account from './actions/account.js';
+export * as device from './actions/device.js';
+export * as email from './actions/email.js';
+export * as oauth from './actions/oauth.js';
+export * as passkey from './actions/passkey.js';
+export * as realm from './actions/realm.js';
+export * as redirect from './actions/redirect.js';
+/**
+ * Authorizes a first-party app for a user already signed in to Tempo ID, from a page on a redirect
+ * URI's origin. Returns `undefined` without a session. The key must fit the headless ceiling.
+ *
+ * With a key, a user without a Tempo Account in the app's realms receives a first one in the app's
+ * first realm. Another app, or a user whose first realm creates no account, receives `rejected`.
+ * With `passkey`, a passkey that owns the account signs the key on the page, so call it from a
+ * click. Without it, or when the passkey's relying party does not cover the page, the account
+ * throws `webauthn_required`, so authorize through `Actions.redirect.start`. With `passkey`, a
+ * wallet.tempo passkey's account that waits for its upgrade signs the key as the passkey's own
+ * account, and `upgradeAvailable` is `true`. `Actions.account.upgrade` with the key then upgrades
+ * it. Without `passkey`, such an account throws `upgrade_required`.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.authorize(auth)
+ * if (!result) showSignIn()
+ * ```
+ */
+export declare function authorize<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options?: authorize.Options<chainId, key>): Promise<authorize.ReturnType<chainId, key>>;
+export declare namespace authorize {
+    type Options<chainId extends number = number, key extends boolean = true> = {
+        /**
+         * The key to authorize. Defaults to a new key. Its `access` names the Tempo Account, which
+         * defaults to the app's selected account, or the user's oldest.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * The Tempo Account the key acts for, in place of `accessKey`'s `access`, such as one from
+         * `Actions.account.get`. It becomes the app's account for later requests that name none.
+         */
+        account?: `0x${string}` | undefined;
+        /**
+         * A message whose EIP-191 hash the key authorization binds as its `witness`. Needs the
+         * `tempo-id:sign` scope and a key.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /** Runs the ceremony of the passkey that owns the account. Defaults to `navigator.credentials.get`. */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** Whether the call authorizes an access key. Defaults to `true`. */
+        key?: key | undefined;
+        /**
+         * Whether a passkey that owns the account signs the key on the page, with `getFn` or
+         * `navigator.credentials.get`. The ceremony prompts the user, so the call needs a click.
+         * Defaults to `false`.
+         */
+        passkey?: ([key] extends [false] ? never : boolean) | undefined;
+        /** What the key may do, within the headless ceiling. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /**
+     * The authorization, without its key for `key: false`, and whether its account can upgrade.
+     * `undefined` without a session.
+     */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = {
+        /** The authorization, without its key for `key: false`. */
+        authorization: key extends false ? Omit<Authorization<chainId>, 'account' | 'key'> : Authorization<chainId>;
+        /**
+         * Whether the key's account is a wallet.tempo passkey's that waits for its upgrade on the
+         * key's chain. `Actions.account.upgrade` with the key upgrades it, and keeps the key.
+         */
+        upgradeAvailable: boolean;
+    } | undefined;
+}
+/**
+ * Exchanges a refresh token for new tokens. Refresh tokens rotate, so store the new one.
+ *
+ * @example
+ * ```ts
+ * const tokens = await Actions.refresh(auth, {
+ *   refreshToken: saved.refreshToken,
+ * })
+ * ```
+ */
+export declare function refresh(auth: Auth, options: refresh.Options): Promise<Tokens>;
+export declare namespace refresh {
+    type Options = {
+        /** The latest refresh token. */
+        refreshToken: string;
+    };
+}
+/**
+ * Ends the user's Tempo ID session, which signs the user out of every app that relies on it.
+ *
+ * @example
+ * ```ts
+ * await Actions.signOut(auth)
+ * ```
+ */
+export declare function signOut(auth: Auth): Promise<void>;
+//# sourceMappingURL=Actions.d.ts.map

package/dist/client/Actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Actions.d.ts","sourceRoot":"","sources":["../../src/client/Actions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA4B,MAAM,WAAW,CAAA;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAM,GAC5C,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAoC7C;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC1E;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;WAGG;QACH,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;QACnC;;;WAGG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE,uGAAuG;QACvG,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD,qEAAqE;QACrE,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,OAAO,CAAC,GAAG,SAAS,CAAA;QAC/D,wDAAwD;QACxD,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED;;;OAGG;IACH,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IAExB;QACE,2DAA2D;QAC3D,aAAa,EAAE,GAAG,SAAS,KAAK,GAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAC/C,aAAa,CAAC,OAAO,CAAC,CAAA;QAC1B;;;WAGG;QACH,gBAAgB,EAAE,OAAO,CAAA;KAC1B,GACD,SAAS,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,CAAC,OAAO,GACvB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb,gCAAgC;QAChC,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvD"}

package/dist/client/Actions.js

@@ -0,0 +1,94 @@
+import { ChallengeWithoutKeyError } from './Auth.js';
+import * as AccessKey from './internal/accessKey.js';
+import * as Api from './internal/api.js';
+import * as Headless from './internal/headless.js';
+import { request } from './internal/request.js';
+export * as account from './actions/account.js';
+export * as device from './actions/device.js';
+export * as email from './actions/email.js';
+export * as oauth from './actions/oauth.js';
+export * as passkey from './actions/passkey.js';
+export * as realm from './actions/realm.js';
+export * as redirect from './actions/redirect.js';
+/**
+ * Authorizes a first-party app for a user already signed in to Tempo ID, from a page on a redirect
+ * URI's origin. Returns `undefined` without a session. The key must fit the headless ceiling.
+ *
+ * With a key, a user without a Tempo Account in the app's realms receives a first one in the app's
+ * first realm. Another app, or a user whose first realm creates no account, receives `rejected`.
+ * With `passkey`, a passkey that owns the account signs the key on the page, so call it from a
+ * click. Without it, or when the passkey's relying party does not cover the page, the account
+ * throws `webauthn_required`, so authorize through `Actions.redirect.start`. With `passkey`, a
+ * wallet.tempo passkey's account that waits for its upgrade signs the key as the passkey's own
+ * account, and `upgradeAvailable` is `true`. `Actions.account.upgrade` with the key then upgrades
+ * it. Without `passkey`, such an account throws `upgrade_required`.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.authorize(auth)
+ * if (!result) showSignIn()
+ * ```
+ */
+export async function authorize(auth, options = {}) {
+    // A challenge rides in the key, so a call without one refuses it before any request.
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    // Checking the session first avoids a failed request for a visitor without one.
+    const session = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/auth/session', auth.url), {
+        credentials: 'include',
+    }));
+    if (!session.user)
+        return undefined;
+    const key = options.key === false
+        ? undefined
+        : await AccessKey.resolve(options.accessKey);
+    // With `passkey`, a passkey that owns the account signs the key on the page.
+    const response = await Headless.post(auth, {
+        getFn: options.getFn,
+        json: request(auth, {
+            accessKey: key?.accessKey,
+            account: options.account,
+            challenge: options.challenge,
+            permissions: options.permissions,
+        }),
+        passkey: options.passkey ?? false,
+    });
+    // The session can end between the two requests.
+    if (response.status === 401)
+        return undefined;
+    const body = await Api.json(response);
+    // `key` decides both the type and the runtime value of the result.
+    return {
+        authorization: key ? Api.authorization(body, key) : Api.withoutKey(body),
+        upgradeAvailable: body.upgrade_available === true,
+    };
+}
+/**
+ * Exchanges a refresh token for new tokens. Refresh tokens rotate, so store the new one.
+ *
+ * @example
+ * ```ts
+ * const tokens = await Actions.refresh(auth, {
+ *   refreshToken: saved.refreshToken,
+ * })
+ * ```
+ */
+export async function refresh(auth, options) {
+    return Api.tokens(await Api.token(auth, {
+        grant_type: 'refresh_token',
+        refresh_token: options.refreshToken,
+    }));
+}
+/**
+ * Ends the user's Tempo ID session, which signs the user out of every app that relies on it.
+ *
+ * @example
+ * ```ts
+ * await Actions.signOut(auth)
+ * ```
+ */
+export async function signOut(auth) {
+    // A JSON body keeps the request out of Tempo ID's CSRF check for cross-site form posts.
+    await Api.json(await Api.post(auth, '/v1/auth/logout', { json: {} }));
+}
+//# sourceMappingURL=Actions.js.map

package/dist/client/Actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Actions.js","sourceRoot":"","sources":["../../src/client/Actions.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAE/D,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AACpD,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAA;AACxC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAI/C,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,OAAO,MAAM,sBAAsB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,oBAAoB,CAAA;AAC3C,OAAO,KAAK,QAAQ,MAAM,uBAAuB,CAAA;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAI7B,IAAU,EACV,OAAO,GAAoC,EAAE;IAE7C,qFAAqF;IACrF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IAEtC,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACjE,WAAW,EAAE,SAAS;KACvB,CAAC,CACH,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAEnC,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QACzC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;YAClB,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;KAClC,CAAC,CAAA;IACF,gDAAgD;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAe,QAAQ,CAAC,CAAA;IACnD,mEAAmE;IACnE,OAAO;QACL,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QACxE,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,KAAK,IAAI;KACZ,CAAA;AACzC,CAAC;AAuDD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAU,EACV,OAAwB;IAExB,OAAO,GAAG,CAAC,MAAM,CACf,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QACpB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CACH,CAAA;AACH,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAU;IACtC,wFAAwF;IACxF,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC"}

package/dist/client/Auth.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Creates the Tempo ID instance that every action in `Actions` takes.
+ *
+ * @example
+ * ```ts
+ * import { Actions, Auth } from '@tempoxyz/id/client'
+ * import { Expiry, Scopes } from 'viem/tempo'
+ * import { tempo } from 'viem/tempo/chains'
+ * import * as Tokens from 'viem/tokens'
+ *
+ * // OUSD has its mainnet address on every Tempo chain.
+ * const ousd = Tokens.ousd(tempo.id).address
+ *
+ * const auth = Auth.create({ clientId: 'client_…', dev: true })
+ *
+ * const authorization = await Actions.authorize(auth, {
+ *   permissions: {
+ *     expiry: Expiry.days(1),
+ *     limits: [{ limit: 10_000_000n, token: ousd }],
+ *     scopes: [Scopes.tip20(ousd).transfer()],
+ *   },
+ * })
+ * ```
+ * @module
+ */
+import type { Account as ViemAccount } from 'viem/tempo';
+import * as AccountState from './internal/account.js';
+import type { Storage } from './Storage.js';
+/**
+ * The account of a client extended with `tempoId`, which each sign-in sets and sign-out empties.
+ * Reading it while signed out throws {@link SignedOutError}.
+ */
+export type Account = ViemAccount.AccessKeyAccount & {
+    /** The account's state, which only the `tempoId` extension reads. */
+    readonly [AccountState.key]: AccountState.State;
+};
+/** A Tempo ID instance, which every action takes. */
+export type Auth = {
+    /** The chain of the app's keys, unless an action's `permissions` names another. */
+    chainId: number;
+    /** The app's client ID, from its registration as an OAuth app. */
+    clientId: string;
+    /** The app's client secret. Only a backend holds one. */
+    clientSecret?: string | undefined;
+    /** Calls Tempo ID. Defaults to the global `fetch`. */
+    fetch?: typeof globalThis.fetch | undefined;
+    /** Where Tempo ID redirects back to. Defaults to the page's origin in a browser. */
+    redirectUri?: string | undefined;
+    /** The scopes of the app's tokens, always with `openid` and `email`. */
+    scope: string;
+    /** Where `Actions.redirect.start` keeps its state, unserialized. Defaults to IndexedDB. */
+    storage?: Storage | undefined;
+    /** Where Tempo ID runs, such as `https://id.tempo.xyz`. */
+    url: string;
+};
+/** An action received a `challenge` with `key: false`. A challenge rides in a key. */
+export declare class ChallengeWithoutKeyError extends Error {
+    readonly name = "Auth.ChallengeWithoutKeyError";
+    constructor();
+}
+/** A request that Tempo ID refused. */
+export declare class RequestError extends Error {
+    readonly name = "Auth.RequestError";
+    /** The OAuth error code, such as `invalid_authorization_details`. */
+    readonly code: string;
+    /** The request field at fault, as a dotted path. */
+    readonly field: string | undefined;
+    /** The values that the refusal compared, such as `maximum`. Base units are decimal strings. */
+    readonly meta: Readonly<Record<string, number | string>> | undefined;
+    /** A stable name for the refusal, to branch on. */
+    readonly reason: RequestError.Reason | undefined;
+    /** Whether a sign-in verified before the refusal, so the user is signed in. */
+    readonly signedIn: boolean;
+    /** The HTTP status, or 0 for a request without a response. */
+    readonly status: number;
+    /** The page that explains the error. */
+    readonly uri: string | undefined;
+    constructor(options: RequestError.Options);
+}
+export declare namespace RequestError {
+    type Options = {
+        /** The error that caused this one. */
+        cause?: unknown;
+        /** The OAuth `error`. */
+        code: string;
+        /** The request field at fault. */
+        field?: string | undefined;
+        /** The `error_description`. */
+        message: string;
+        /** The values that the refusal compared. */
+        meta?: Readonly<Record<string, number | string>> | undefined;
+        /** The refusal's stable name. Absent from the issuer's own errors. */
+        reason?: Reason | undefined;
+        /** Whether a sign-in verified before the refusal. Defaults to `false`. */
+        signedIn?: boolean | undefined;
+        /** The HTTP status, or 0 without a response. */
+        status: number;
+        /** The `error_uri`. */
+        uri?: string | undefined;
+    };
+    /** Each refusal's stable name, as `docs/errors.md` explains. */
+    type Reason = 'already_decided' | 'authorization_expired' | 'body_too_large' | 'challenge_not_permitted' | 'config_conflict' | 'configurable_accounts_disabled' | 'cross_site_request' | 'duplicate_limit' | 'duplicate_scope' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_id_token_hint' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'invalid_recipients' | 'limit_exceeds_maximum' | 'logout_not_permitted' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_permissions' | 'missing_recipients' | 'not_configurable' | 'owner_exists' | 'passkey_limit' | 'passkey_link_expired' | 'passkey_not_permitted' | 'post_logout_redirect_not_permitted' | 'rate_limited' | 'reauthentication_required' | 'rejected' | 'scope_without_limit' | 'session_changed' | 'session_required' | 'sign_up_not_permitted' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_token' | 'upgrade_required' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+}
+/** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
+export declare class SignedOutError extends Error {
+    readonly name = "Auth.SignedOutError";
+    constructor();
+}
+/**
+ * Creates the account of a client extended with `tempoId`. Until a sign-in sets it, reading it
+ * throws {@link SignedOutError}. Each client needs its own, since the account signs as one user.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export declare function account(): Account;
+/**
+ * Creates a Tempo ID instance.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'client_…' })
+ * ```
+ */
+export declare function create(options: create.Options): Auth;
+export declare namespace create {
+    type Options = Omit<Auth, 'chainId' | 'scope' | 'url'> & {
+        /** The chain of the app's keys. Defaults to Tempo mainnet, or Tempo testnet with `dev`. */
+        chainId?: number | undefined;
+        /** Whether to use Tempo testnet. Defaults to `false`. */
+        dev?: boolean | undefined;
+        /** Scopes beyond `openid` and `email`. Defaults to `offline_access`, for a refresh token. */
+        scope?: string | undefined;
+        /** Defaults to `https://id.tempo.xyz`. */
+        url?: string | undefined;
+    };
+}
+//# sourceMappingURL=Auth.d.ts.map

package/dist/client/Auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../src/client/Auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,YAAY,CAAA;AAExD,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,gBAAgB,GAAG;IACnD,qEAAqE;IACrE,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,KAAK,CAAA;CAChD,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,IAAI,GAAG;IACjB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;IAC3C,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7B,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,sFAAsF;AACtF,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,mCAAkC;IAExD,cAIC;CACF;AAED,uCAAuC;AACvC,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,uBAAsB;IAC5C,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;IAChD,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EASxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,sCAAsC;QACtC,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,yBAAyB;QACzB,IAAI,EAAE,MAAM,CAAA;QACZ,kCAAkC;QAClC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,+BAA+B;QAC/B,OAAO,EAAE,MAAM,CAAA;QACf,4CAA4C;QAC5C,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;QAC5D,sEAAsE;QACtE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,0EAA0E;QAC1E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC9B,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAA;QACd,uBAAuB;QACvB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;IAED,gEAAgE;IAChE,KAAK,MAAM,GACP,iBAAiB,GACjB,uBAAuB,GACvB,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,GACjB,gCAAgC,GAChC,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,wBAAwB,GACxB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,oBAAoB,GACpB,uBAAuB,GACvB,sBAAsB,GACtB,gBAAgB,GAChB,wBAAwB,GACxB,aAAa,GACb,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,sBAAsB,GACtB,uBAAuB,GACvB,oCAAoC,GACpC,cAAc,GACd,2BAA2B,GAC3B,UAAU,GACV,qBAAqB,GACrB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,YAAY,GACZ,cAAc,GACd,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,CAAA;CACxB;AAED,6FAA6F;AAC7F,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,yBAAwB;IAE9C,cAIC;CACF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,IAAI,OAAO,CA4BjC;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAUpD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG;QACvD,2FAA2F;QAC3F,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,yDAAyD;QACzD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,6FAA6F;QAC7F,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,0CAA0C;QAC1C,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;CACF"}

package/dist/client/Auth.js

@@ -0,0 +1,106 @@
+import { tempo, tempoTestnet } from 'viem/tempo/chains';
+import * as AccountState from './internal/account.js';
+/** An action received a `challenge` with `key: false`. A challenge rides in a key. */
+export class ChallengeWithoutKeyError extends Error {
+    name = 'Auth.ChallengeWithoutKeyError';
+    constructor() {
+        super('A challenge rides in the key authorization, so a sign-in with `key: false` takes none. Remove `challenge`, or request a key.');
+    }
+}
+/** A request that Tempo ID refused. */
+export class RequestError extends Error {
+    name = 'Auth.RequestError';
+    /** The OAuth error code, such as `invalid_authorization_details`. */
+    code;
+    /** The request field at fault, as a dotted path. */
+    field;
+    /** The values that the refusal compared, such as `maximum`. Base units are decimal strings. */
+    meta;
+    /** A stable name for the refusal, to branch on. */
+    reason;
+    /** Whether a sign-in verified before the refusal, so the user is signed in. */
+    signedIn;
+    /** The HTTP status, or 0 for a request without a response. */
+    status;
+    /** The page that explains the error. */
+    uri;
+    constructor(options) {
+        super(options.message, { cause: options.cause });
+        this.code = options.code;
+        this.field = options.field;
+        this.meta = options.meta;
+        this.reason = options.reason;
+        this.signedIn = options.signedIn ?? false;
+        this.status = options.status;
+        this.uri = options.uri;
+    }
+}
+/** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
+export class SignedOutError extends Error {
+    name = 'Auth.SignedOutError';
+    constructor() {
+        super("The client's account is signed out. Sign in through `client.auth` before sending.");
+    }
+}
+/**
+ * Creates the account of a client extended with `tempoId`. Until a sign-in sets it, reading it
+ * throws {@link SignedOutError}. Each client needs its own, since the account signs as one user.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export function account() {
+    const state = { account: undefined, key: undefined };
+    // Viem reads a client's account only when an action runs, through property reads, `in` checks,
+    // and spreads. Each trap reads through to the account that the latest sign-in set.
+    const proxy = new Proxy({}, {
+        get(_, key) {
+            if (key === AccountState.key)
+                return state;
+            if (state.account)
+                return Reflect.get(state.account, key);
+            // Promise resolution, serialization, and inspection probe these, which must not throw.
+            if (typeof key === 'symbol' || key === 'then' || key === 'toJSON')
+                return undefined;
+            throw new SignedOutError();
+        },
+        getOwnPropertyDescriptor(_, key) {
+            if (!state.account)
+                return undefined;
+            const descriptor = Reflect.getOwnPropertyDescriptor(state.account, key);
+            // A proxy may report a property its empty target lacks only as configurable.
+            return descriptor && { ...descriptor, configurable: true };
+        },
+        has: (_, key) => key === AccountState.key ||
+            (state.account !== undefined && Reflect.has(state.account, key)),
+        ownKeys: () => (state.account ? Reflect.ownKeys(state.account) : []),
+    });
+    return proxy;
+}
+/**
+ * Creates a Tempo ID instance.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'client_…' })
+ * ```
+ */
+export function create(options) {
+    const { chainId, dev, scope = 'offline_access', url, ...rest } = options;
+    // Every authorization reads the user from the ID token, which needs `openid` and `email`.
+    const scopes = scope.split(' ').filter(Boolean);
+    return {
+        ...rest,
+        chainId: chainId ?? (dev ? tempoTestnet.id : tempo.id),
+        scope: [...new Set(['openid', 'email', ...scopes])].join(' '),
+        url: url ?? defaultUrl,
+    };
+}
+/** Where Tempo ID runs unless `create` receives a `url`. */
+const defaultUrl = 'https://id.tempo.xyz';
+//# sourceMappingURL=Auth.js.map

package/dist/client/Auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/client/Auth.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AAgCrD,sFAAsF;AACtF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,+BAA+B,CAAA;IAExD;QACE,KAAK,CACH,8HAA8H,CAC/H,CAAA;IACH,CAAC;CACF;AAED,uCAAuC;AACvC,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,mBAAmB,CAAA;IAC5C,qEAAqE;IAC5D,IAAI,CAAQ;IACrB,oDAAoD;IAC3C,KAAK,CAAoB;IAClC,+FAA+F;IACtF,IAAI,CAAuD;IACpE,mDAAmD;IAC1C,MAAM,CAAiC;IAChD,+EAA+E;IACtE,QAAQ,CAAS;IAC1B,8DAA8D;IACrD,MAAM,CAAQ;IACvB,wCAAwC;IAC/B,GAAG,CAAoB;IAEhC,YAAY,OAA6B;QACvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACxB,CAAC;CACF;AAiFD,6FAA6F;AAC7F,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,qBAAqB,CAAA;IAE9C;QACE,KAAK,CACH,mFAAmF,CACpF,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,KAAK,GAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IACxE,+FAA+F;IAC/F,mFAAmF;IACnF,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,EAAE,EACF;QACE,GAAG,CAAC,CAAC,EAAE,GAAG;YACR,IAAI,GAAG,KAAK,YAAY,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAA;YAC1C,IAAI,KAAK,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACzD,uFAAuF;YACvF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ;gBAC/D,OAAO,SAAS,CAAA;YAClB,MAAM,IAAI,cAAc,EAAE,CAAA;QAC5B,CAAC;QACD,wBAAwB,CAAC,CAAC,EAAE,GAAG;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YACpC,MAAM,UAAU,GAAG,OAAO,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YACvE,6EAA6E;YAC7E,OAAO,UAAU,IAAI,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;QAC5D,CAAC;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CACd,GAAG,KAAK,YAAY,CAAC,GAAG;YACxB,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CACF,CAAA;IACD,OAAO,KAAgB,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,OAAuB;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IACxE,0FAA0F;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,GAAG,EAAE,GAAG,IAAI,UAAU;KACvB,CAAA;AACH,CAAC;AAeD,4DAA4D;AAC5D,MAAM,UAAU,GAAG,sBAAsB,CAAA"}

package/dist/client/Authorization.d.ts

@@ -0,0 +1,29 @@
+/**
+ * What every sign-in returns.
+ * @module
+ */
+import type * as Key from './Key.js';
+import type { Tokens } from './Tokens.js';
+import type { User } from './User.js';
+/**
+ * The tokens, the access key, and the user. `chainId` types `key.chainId`, as a literal when
+ * `permissions` names one.
+ */
+export type Authorization<chainId extends number = number> = Tokens & {
+    /** The user's Tempo Account, as a Viem account that signs with the app's access key. */
+    account: ReturnType<typeof Key.toAccount>;
+    /** The same key as data, which `Key.toAccount` rebuilds into `account`. */
+    key: Key.Key<chainId>;
+    /** The signed-in user, from the ID token. */
+    user: User;
+};
+/**
+ * Instantiates a {@link Authorization}.
+ *
+ * @example
+ * ```ts
+ * const authorization = Authorization.from({ ...saved, account: Key.toAccount(saved.key) })
+ * ```
+ */
+export declare function from<chainId extends number = number>(value: Authorization<chainId>): Authorization<chainId>;
+//# sourceMappingURL=Authorization.d.ts.map

package/dist/client/Authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorization.d.ts","sourceRoot":"","sources":["../../src/client/Authorization.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAA;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG;IACpE,wFAAwF;IACxF,OAAO,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAA;IACzC,2EAA2E;IAC3E,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrB,6CAA6C;IAC7C,IAAI,EAAE,IAAI,CAAA;CACX,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAClD,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAC5B,aAAa,CAAC,OAAO,CAAC,CAExB"}

package/dist/client/Authorization.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Authorization}.
+ *
+ * @example
+ * ```ts
+ * const authorization = Authorization.from({ ...saved, account: Key.toAccount(saved.key) })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Authorization.js.map

package/dist/client/Authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorization.js","sourceRoot":"","sources":["../../src/client/Authorization.ts"],"names":[],"mappings":"AAqBA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAA6B;IAE7B,OAAO,KAAK,CAAA;AACd,CAAC"}