@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/client/Decorator.d.ts

@@ -0,0 +1,172 @@
+/**
+ * The `tempoId` Viem client extension, which adds Tempo ID's actions as `client.auth`.
+ *
+ * @example
+ * ```ts
+ * import { Auth, tempoId } from '@tempoxyz/id/client'
+ * import { createClient } from 'viem/tempo'
+ * import { tempoTestnet } from 'viem/tempo/chains'
+ *
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ *
+ * await client.auth.email.signIn({ code, email })
+ * await client.token.transferSync({ amount, to, token })
+ * ```
+ * @module
+ */
+import type { Chain, Client, Transport } from 'viem';
+import * as Actions from './Actions.js';
+import * as Auth from './Auth.js';
+import type { Authorization } from './Authorization.js';
+import * as Key from './Key.js';
+import type * as Pending from './Pending.js';
+import type { TempoAccount } from './TempoAccount.js';
+import type { User } from './User.js';
+/** A client created without `account: Auth.account()`. */
+export declare class AccountRequiredError extends Error {
+    readonly name = "Decorator.AccountRequiredError";
+    constructor();
+}
+/** A client created without a chain, which the extension needs for `chainId`. */
+export declare class ChainRequiredError extends Error {
+    readonly name = "Decorator.ChainRequiredError";
+    constructor();
+}
+/**
+ * A sign-in that another sign-in or a sign-out overtook. The client keeps the newer state, and the
+ * overtaken result is never returned.
+ */
+export declare class SupersededError extends Error {
+    readonly name = "Decorator.SupersededError";
+    constructor();
+}
+/**
+ * Returns a Viem client extension that adds Tempo ID's actions as `client.auth`, with one instance
+ * on the client's chain. Each sign-in sets the client's account, and `signOut` empties it at once.
+ * An overtaken sign-in throws {@link SupersededError}. The extension throws
+ * {@link ChainRequiredError} without a chain, and {@link AccountRequiredError} without an
+ * `Auth.account()`.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export declare function tempoId(options: tempoId.Options): <transport extends Transport, chain extends Chain>(client: Client<transport, chain, Auth.Account>) => tempoId.Decorator<chain['id']>;
+export declare namespace tempoId {
+    /** `Auth.create`'s options, without `chainId`, which the extension reads from the client. */
+    type Options = Omit<Auth.create.Options, 'chainId'>;
+    /**
+     * What the extension adds to a client. `chainId` is the client's chain, the default of each
+     * member's `permissions.chainId`.
+     */
+    type Decorator<chainId extends number> = {
+        /** Tempo ID's actions, with the extension's instance. */
+        auth: {
+            /** Actions for the user's Tempo Account. */
+            account: {
+                /** `Actions.account.get`. */
+                get: (options?: Actions.account.get.Options) => Promise<Actions.account.get.ReturnType>;
+                /**
+                 * `Actions.account.upgrade`, with `key` defaulting to the key that the client signs with, so
+                 * the key keeps signing after the upgrade. Throws `Auth.SignedOutError` while signed out,
+                 * unless `account` names the account.
+                 */
+                upgrade: (options?: Actions.account.upgrade.Options) => Promise<TempoAccount>;
+            };
+            /**
+             * `Actions.authorize`, which sets the client's account, or empties it for `key: false` or a
+             * user without a session.
+             */
+            authorize: <const id extends number = chainId, const key extends boolean = true>(options?: Actions.authorize.Options<id, key>) => Promise<Actions.authorize.ReturnType<id, key>>;
+            /** Actions for the device grant. */
+            device: {
+                /** `Actions.device.authorize`, whose `wait` sets the client's account. */
+                authorize: <const id extends number = chainId>(options?: Actions.device.authorize.Options<id>) => Promise<Actions.device.authorize.ReturnType<id>>;
+            };
+            /** Actions for sign-in with an emailed code. */
+            email: {
+                /** `Actions.email.sendCode`. */
+                sendCode: (options: Actions.email.sendCode.Options) => Promise<void>;
+                /**
+                 * `Actions.email.signIn`, which sets the client's account, or empties it for `key: false`
+                 * or a refusal marked `signedIn`.
+                 */
+                signIn: <const id extends number = chainId, const key extends boolean = true>(options: Actions.email.signIn.Options<id, key>) => Promise<Actions.email.signIn.ReturnType<id, key>>;
+            };
+            /** The instance that the members pass to `Actions`. */
+            instance: Auth.Auth;
+            /** Actions for the issuer's OAuth endpoints. */
+            oauth: {
+                /** `Actions.oauth.introspect`. */
+                introspect: (options: Actions.oauth.introspect.Options) => Promise<Actions.oauth.introspect.ReturnType>;
+                /** `Actions.oauth.jwks`. */
+                jwks: () => Promise<Actions.oauth.jwks.ReturnType>;
+                /** `Actions.oauth.userInfo`. */
+                userInfo: (options: Actions.oauth.userInfo.Options) => Promise<User>;
+            };
+            /** Actions for sign-in with a passkey. */
+            passkey: {
+                /** `Actions.passkey.available`. */
+                available: () => Promise<boolean>;
+                /**
+                 * `Actions.passkey.prepare`, whose handle's `signIn` sets the client's account as
+                 * `auth.passkey.signIn` does.
+                 */
+                prepare: <const id extends number = chainId, const key extends boolean = true>(options?: Actions.passkey.prepare.Options<id, key>) => Actions.passkey.prepare.ReturnType<id, key>;
+                /**
+                 * `Actions.passkey.signIn`, which sets the client's account as `auth.email.signIn` does,
+                 * unless it returns a step.
+                 */
+                signIn: <const id extends number = chainId, const key extends boolean = true>(options?: Actions.passkey.signIn.Options<id, key>) => Promise<Actions.passkey.signIn.ReturnType<id, key>>;
+            };
+            /** Actions for the realms the app reaches. */
+            realm: {
+                /** `Actions.realm.list`. */
+                list: () => Promise<Actions.realm.list.ReturnType>;
+            };
+            /** Actions for sign-in through a redirect to Tempo ID's pages. */
+            redirect: {
+                /**
+                 * `Actions.redirect.complete`, which sets the client's account, or empties it for a sign-in
+                 * without a key. Later calls on the page load return the first call's result.
+                 */
+                complete: <const key extends boolean = true>(options?: Actions.redirect.complete.Options<key>) => Promise<Actions.redirect.complete.ReturnType<key>>;
+                /** `Actions.redirect.createUrl`. */
+                createUrl: <const key extends boolean = true>(options?: Actions.redirect.createUrl.Options<key>) => Promise<Actions.redirect.createUrl.ReturnType<key>>;
+                /**
+                 * `Actions.redirect.handleCallback`, which sets the client's account, or empties it for a
+                 * sign-in without a key.
+                 */
+                handleCallback: <const pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending>(options: Actions.redirect.handleCallback.Options<pending>) => Promise<Actions.redirect.handleCallback.ReturnType<pending>>;
+                /** `Actions.redirect.prefetch`. */
+                prefetch: () => Promise<Actions.redirect.prefetch.ReturnType>;
+                /** `Actions.redirect.start`. */
+                start: (options?: Actions.redirect.start.Options) => Promise<void>;
+            };
+            /** `Actions.refresh`. */
+            refresh: (options: Actions.refresh.Options) => ReturnType<typeof Actions.refresh>;
+            /**
+             * Rebuilds a stored authorization's account with `Key.toAccount`, sets the client's account
+             * to it, and returns the authorization. Throws `Key.AccessKeyRequiredError` for a key without
+             * material and no `accessKey`.
+             */
+            restore: <id extends number = chainId>(authorization: Omit<Authorization<id>, 'account' | 'key'> & {
+                /** The stored key, with or without its `chainId`. */
+                key: Key.from.Value<id>;
+            }, options?: Key.toAccount.Options) => Authorization<id>;
+            /**
+             * `Actions.signOut`, which empties the client's account before the request, even when it
+             * fails, and discards any pending sign-in.
+             */
+            signOut: () => Promise<void>;
+        };
+    };
+}
+//# sourceMappingURL=Decorator.d.ts.map

package/dist/client/Decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decorator.d.ts","sourceRoot":"","sources":["../../src/client/Decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACpD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC,0DAA0D;AAC1D,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,oCAAmC;IAEzD,cAIC;CACF;AAED,iFAAiF;AACjF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,kCAAiC;IAEvD,cAEC;CACF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,+BAA8B;IAEpD,cAIC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IACtC,SAAS,SAAS,SAAS,EAAE,KAAK,SAAS,KAAK,UAC9C,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAC7C,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAgNlC;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,6FAA6F;IAC7F,KAAK,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAEnD;;;OAGG;IACH,KAAK,SAAS,CAAC,OAAO,SAAS,MAAM,IAAI;QACvC,yDAAyD;QACzD,IAAI,EAAE;YACJ,4CAA4C;YAC5C,OAAO,EAAE;gBACP,6BAA6B;gBAC7B,GAAG,EAAE,CACH,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,KAClC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBAC5C;;;;mBAIG;gBACH,OAAO,EAAE,CACP,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KACtC,OAAO,CAAC,YAAY,CAAC,CAAA;aAC3B,CAAA;YACD;;;eAGG;YACH,SAAS,EAAE,CACT,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KACzC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;YACnD,oCAAoC;YACpC,MAAM,EAAE;gBACN,0EAA0E;gBAC1E,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EAC3C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,KAC3C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;aACtD,CAAA;YACD,gDAAgD;YAChD,KAAK,EAAE;gBACL,gCAAgC;gBAChC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;gBACpE;;;mBAGG;gBACH,MAAM,EAAE,CACN,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KAC3C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;aACvD,CAAA;YACD,uDAAuD;YACvD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAA;YACnB,gDAAgD;YAChD,KAAK,EAAE;gBACL,kCAAkC;gBAClC,UAAU,EAAE,CACV,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,KACtC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBACjD,4BAA4B;gBAC5B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAClD,gCAAgC;gBAChC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;aACrE,CAAA;YACD,0CAA0C;YAC1C,OAAO,EAAE;gBACP,mCAAmC;gBACnC,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;gBACjC;;;mBAGG;gBACH,OAAO,EAAE,CACP,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KAC/C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAChD;;;mBAGG;gBACH,MAAM,EAAE,CACN,KAAK,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACjC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,KAC9C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;aACzD,CAAA;YACD,8CAA8C;YAC9C,KAAK,EAAE;gBACL,4BAA4B;gBAC5B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;aACnD,CAAA;YACD,kEAAkE;YAClE,QAAQ,EAAE;gBACR;;;mBAGG;gBACH,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EACzC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAC7C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;gBACvD,oCAAoC;gBACpC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAC1C,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,KAC9C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;gBACxD;;;mBAGG;gBACH,cAAc,EAAE,CACd,KAAK,CAAC,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GACxD,OAAO,CAAC,OAAO,EAEjB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KACtD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;gBACjE,mCAAmC;gBACnC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAC7D,gCAAgC;gBAChC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;aACnE,CAAA;YACD,yBAAyB;YACzB,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,KAC7B,UAAU,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC;;;;eAIG;YACH,OAAO,EAAE,CAAC,EAAE,SAAS,MAAM,GAAG,OAAO,EACnC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAAG;gBAC1D,qDAAqD;gBACrD,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;aACxB,EACD,OAAO,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,KAC5B,aAAa,CAAC,EAAE,CAAC,CAAA;YACtB;;;eAGG;YACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;SAC7B,CAAA;KACF,CAAA;CACF"}

package/dist/client/Decorator.js

@@ -0,0 +1,241 @@
+import * as Actions from './Actions.js';
+import * as Auth from './Auth.js';
+import * as AccountState from './internal/account.js';
+import * as Key from './Key.js';
+/** A client created without `account: Auth.account()`. */
+export class AccountRequiredError extends Error {
+    name = 'Decorator.AccountRequiredError';
+    constructor() {
+        super('The client has no Tempo ID account. Create the client with `account: Auth.account()`.');
+    }
+}
+/** A client created without a chain, which the extension needs for `chainId`. */
+export class ChainRequiredError extends Error {
+    name = 'Decorator.ChainRequiredError';
+    constructor() {
+        super('The client has no chain. Create the client with a Tempo `chain`.');
+    }
+}
+/**
+ * A sign-in that another sign-in or a sign-out overtook. The client keeps the newer state, and the
+ * overtaken result is never returned.
+ */
+export class SupersededError extends Error {
+    name = 'Decorator.SupersededError';
+    constructor() {
+        super('Another sign-in or a sign-out completed while this sign-in was pending. Sign in again.');
+    }
+}
+/**
+ * Returns a Viem client extension that adds Tempo ID's actions as `client.auth`, with one instance
+ * on the client's chain. Each sign-in sets the client's account, and `signOut` empties it at once.
+ * An overtaken sign-in throws {@link SupersededError}. The extension throws
+ * {@link ChainRequiredError} without a chain, and {@link AccountRequiredError} without an
+ * `Auth.account()`.
+ *
+ * @example
+ * ```ts
+ * const client = createClient({
+ *   account: Auth.account(),
+ *   chain: tempoTestnet,
+ * }).extend(tempoId({ clientId: 'client_…' }))
+ * ```
+ */
+export function tempoId(options) {
+    return (client) => {
+        if (!client.chain)
+            throw new ChainRequiredError();
+        const state = client.account?.[AccountState.key];
+        if (!state)
+            throw new AccountRequiredError();
+        const auth = Auth.create({ ...options, chainId: client.chain.id });
+        // Counts changes to the client's account. Each sign-in applies its result only when no other
+        // sign-in or sign-out completed after it began. A stale result never replaces a newer one,
+        // and a sign-in still pending at sign-out never signs the client back in.
+        let version = 0;
+        // The version that the latest sign-out produced, until another change follows it.
+        let signedOut;
+        // The redirect result that `complete` settled on this page load.
+        let completing;
+        /**
+         * Begins a change to the client's account. If a newer change completed first, each operation
+         * throws {@link SupersededError}, except `apply(undefined)`. A `signedIn` refusal empties the
+         * account.
+         */
+        const begin = () => {
+            const started = version;
+            // A sign-in that finishes after sign-out can set a new server session, so it ends that
+            // session again, unless a newer change already followed the sign-out.
+            const superseded = async () => {
+                if (signedOut === version)
+                    await Actions.signOut(auth);
+                return new SupersededError();
+            };
+            return {
+                async apply(authorization) {
+                    if (version !== started) {
+                        if (authorization)
+                            throw await superseded();
+                        return;
+                    }
+                    state.account = authorization?.account;
+                    state.key = authorization?.key;
+                    version++;
+                },
+                async check() {
+                    if (version !== started)
+                        throw await superseded();
+                },
+                // An arrow function, which `catch` takes unbound.
+                fail: async (error) => {
+                    if (version !== started)
+                        throw await superseded();
+                    if (error instanceof Auth.RequestError && error.signedIn) {
+                        state.account = undefined;
+                        state.key = undefined;
+                        version++;
+                    }
+                    throw error;
+                },
+                async settle(result) {
+                    if ('account' in result)
+                        return this.apply(result);
+                    // The check and the change run with no `await` between them, so no other change lands
+                    // after the check, and an overtaken result throws even without an account.
+                    if (version !== started)
+                        throw await superseded();
+                    state.account = undefined;
+                    state.key = undefined;
+                    version++;
+                },
+            };
+        };
+        /** Runs a passkey sign-in, and sets the client's account, unless it returns the email step. */
+        const passkeySignIn = async (fn) => {
+            const change = begin();
+            const result = await fn().catch(change.fail);
+            if ('step' in result)
+                await change.check();
+            else
+                await change.settle(result.authorization);
+            return result;
+        };
+        return {
+            auth: {
+                account: {
+                    get: (options) => Actions.account.get(auth, options),
+                    // The client's own key registers before the upgrade, as its own account sends.
+                    upgrade(options = {}) {
+                        const key = options.key ?? state.key;
+                        if (!key && !options.account)
+                            throw new Auth.SignedOutError();
+                        // The client's account signs for its own key, also one that the app supplied, which
+                        // carries no material.
+                        const accessKey = options.accessKey ?? (options.key ? undefined : state.account);
+                        return Actions.account.upgrade(auth, { ...options, accessKey, key });
+                    },
+                },
+                async authorize(options = {}) {
+                    const change = begin();
+                    const result = await Actions.authorize(auth, options);
+                    // Without a session, the client stops signing as the user it last authorized.
+                    if (result)
+                        await change.settle(result.authorization);
+                    else
+                        await change.apply(undefined);
+                    return result;
+                },
+                device: {
+                    async authorize(options = {}) {
+                        const change = begin();
+                        const device = await Actions.device.authorize(auth, options);
+                        return {
+                            ...device,
+                            async wait() {
+                                const authorization = await device.wait();
+                                await change.apply(authorization);
+                                return authorization;
+                            },
+                        };
+                    },
+                },
+                email: {
+                    sendCode: (options) => Actions.email.sendCode(auth, options),
+                    async signIn(options) {
+                        const change = begin();
+                        const result = await Actions.email
+                            .signIn(auth, options)
+                            .catch(change.fail);
+                        await change.settle(result.authorization);
+                        return result;
+                    },
+                },
+                instance: auth,
+                oauth: {
+                    introspect: (options) => Actions.oauth.introspect(auth, options),
+                    jwks: () => Actions.oauth.jwks(auth),
+                    userInfo: (options) => Actions.oauth.userInfo(auth, options),
+                },
+                passkey: {
+                    available: () => Actions.passkey.available(auth),
+                    prepare(options = {}) {
+                        const prepared = Actions.passkey.prepare(auth, options);
+                        return {
+                            available: prepared.available,
+                            signIn: (signInOptions = {}) => passkeySignIn(() => prepared.signIn(signInOptions)),
+                        };
+                    },
+                    signIn: (options = {}) => passkeySignIn(() => Actions.passkey.signIn(auth, options)),
+                },
+                realm: {
+                    list: () => Actions.realm.list(auth),
+                },
+                redirect: {
+                    complete(options = {}) {
+                        // A page load settles its redirect once, so a later call never applies a result that a
+                        // newer sign-in replaced.
+                        completing ??= (async () => {
+                            const change = begin();
+                            const authorization = await Actions.redirect.complete(auth, options);
+                            // `undefined` means the page is not a callback, which shows nothing about the session.
+                            if (authorization)
+                                await change.settle(authorization);
+                            return authorization;
+                        })();
+                        // The first call's `key` typed the settled result, which later calls share.
+                        return completing;
+                    },
+                    createUrl: (options = {}) => Actions.redirect.createUrl(auth, options),
+                    async handleCallback(options) {
+                        const change = begin();
+                        const authorization = await Actions.redirect.handleCallback(auth, options);
+                        await change.settle(authorization);
+                        return authorization;
+                    },
+                    prefetch: () => Actions.redirect.prefetch(auth),
+                    start: (options = {}) => Actions.redirect.start(auth, options),
+                },
+                refresh: (options) => Actions.refresh(auth, options),
+                restore: (authorization, options = {}) => {
+                    // A sign-in stored before `Key.chainId` existed gains it here.
+                    const key = Key.from(authorization.key);
+                    const account = Key.toAccount(key, options);
+                    state.account = account;
+                    state.key = key;
+                    version++;
+                    return { ...authorization, account, key };
+                },
+                async signOut() {
+                    // The client stops signing at once, even when the request fails, and any sign-in still
+                    // pending is discarded, since the user asked to leave.
+                    state.account = undefined;
+                    state.key = undefined;
+                    version++;
+                    signedOut = version;
+                    await Actions.signOut(auth);
+                },
+            },
+        };
+    };
+}
+//# sourceMappingURL=Decorator.js.map

package/dist/client/Decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decorator.js","sourceRoot":"","sources":["../../src/client/Decorator.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,OAAO,KAAK,YAAY,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAK/B,0DAA0D;AAC1D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,gCAAgC,CAAA;IAEzD;QACE,KAAK,CACH,uFAAuF,CACxF,CAAA;IACH,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,8BAA8B,CAAA;IAEvD;QACE,KAAK,CAAC,kEAAkE,CAAC,CAAA;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACtB,IAAI,GAAG,2BAA2B,CAAA;IAEpD;QACE,KAAK,CACH,wFAAwF,CACzF,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,OAAwB;IAC9C,OAAO,CACL,MAA8C,EACd,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;QACjD,MAAM,KAAK,GAAI,MAAM,CAAC,OAA6C,EAAE,CACnE,YAAY,CAAC,GAAG,CACjB,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAA;QAE5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAElE,6FAA6F;QAC7F,2FAA2F;QAC3F,0EAA0E;QAC1E,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,kFAAkF;QAClF,IAAI,SAA6B,CAAA;QACjC,iEAAiE;QACjE,IAAI,UAES,CAAA;QAEb;;;;WAIG;QACH,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,MAAM,OAAO,GAAG,OAAO,CAAA;YACvB,uFAAuF;YACvF,sEAAsE;YACtE,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;gBAC5B,IAAI,SAAS,KAAK,OAAO;oBAAE,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACtD,OAAO,IAAI,eAAe,EAAE,CAAA;YAC9B,CAAC,CAAA;YACD,OAAO;gBACL,KAAK,CAAC,KAAK,CACT,aAAiE;oBAEjE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;wBACxB,IAAI,aAAa;4BAAE,MAAM,MAAM,UAAU,EAAE,CAAA;wBAC3C,OAAM;oBACR,CAAC;oBACD,KAAK,CAAC,OAAO,GAAG,aAAa,EAAE,OAAO,CAAA;oBACtC,KAAK,CAAC,GAAG,GAAG,aAAa,EAAE,GAAG,CAAA;oBAC9B,OAAO,EAAE,CAAA;gBACX,CAAC;gBACD,KAAK,CAAC,KAAK;oBACT,IAAI,OAAO,KAAK,OAAO;wBAAE,MAAM,MAAM,UAAU,EAAE,CAAA;gBACnD,CAAC;gBACD,kDAAkD;gBAClD,IAAI,EAAE,KAAK,EAAE,KAAc,EAAkB,EAAE;oBAC7C,IAAI,OAAO,KAAK,OAAO;wBAAE,MAAM,MAAM,UAAU,EAAE,CAAA;oBACjD,IAAI,KAAK,YAAY,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;wBACzD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;wBACzB,KAAK,CAAC,GAAG,GAAG,SAAS,CAAA;wBACrB,OAAO,EAAE,CAAA;oBACX,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,KAAK,CAAC,MAAM,CACV,MAAkE;oBAElE,IAAI,SAAS,IAAI,MAAM;wBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;oBAClD,sFAAsF;oBACtF,2EAA2E;oBAC3E,IAAI,OAAO,KAAK,OAAO;wBAAE,MAAM,MAAM,UAAU,EAAE,CAAA;oBACjD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;oBACzB,KAAK,CAAC,GAAG,GAAG,SAAS,CAAA;oBACrB,OAAO,EAAE,CAAA;gBACX,CAAC;aACF,CAAA;QACH,CAAC,CAAA;QAED,+FAA+F;QAC/F,MAAM,aAAa,GAAG,KAAK,EAGzB,EAAyB,EACzB,EAAE;YACF,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,MAAM,IAAI,MAAM;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;;gBACrC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YAC9C,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QAED,OAAO;YACL,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;oBACpD,+EAA+E;oBAC/E,OAAO,CAAC,OAAO,GAAG,EAAE;wBAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAA;wBACpC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;4BAAE,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAA;wBAC7D,oFAAoF;wBACpF,uBAAuB;wBACvB,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;wBAChE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;oBACtE,CAAC;iBACF;gBACD,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE;oBAC1B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;oBACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;oBACrD,8EAA8E;oBAC9E,IAAI,MAAM;wBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;;wBAChD,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;oBAClC,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,EAAE;oBACN,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE;wBAC1B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;wBAC5D,OAAO;4BACL,GAAG,MAAM;4BACT,KAAK,CAAC,IAAI;gCACR,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gCACzC,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;gCACjC,OAAO,aAAa,CAAA;4BACtB,CAAC;yBACF,CAAA;oBACH,CAAC;iBACF;gBACD,KAAK,EAAE;oBACL,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;oBAC5D,KAAK,CAAC,MAAM,CAAC,OAAO;wBAClB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK;6BAC/B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;6BACrB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBACrB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;wBACzC,OAAO,MAAM,CAAA;oBACf,CAAC;iBACF;gBACD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE;oBACL,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;oBAChE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;iBAC7D;gBACD,OAAO,EAAE;oBACP,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;oBAChD,OAAO,CAAC,OAAO,GAAG,EAAE;wBAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;wBACvD,OAAO;4BACL,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,MAAM,EAAE,CAAC,aAAa,GAAG,EAAE,EAAE,EAAE,CAC7B,aAAa,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;yBACtD,CAAA;oBACH,CAAC;oBACD,MAAM,EAAE,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CACvB,aAAa,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;iBAC7D;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrC;gBACD,QAAQ,EAAE;oBACR,QAAQ,CAAC,OAAO,GAAG,EAAE;wBACnB,uFAAuF;wBACvF,0BAA0B;wBAC1B,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;4BACzB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;4BACtB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CACnD,IAAI,EACJ,OAAO,CACR,CAAA;4BACD,uFAAuF;4BACvF,IAAI,aAAa;gCAAE,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;4BACrD,OAAO,aAAa,CAAA;wBACtB,CAAC,CAAC,EAAE,CAAA;wBACJ,4EAA4E;wBAC5E,OAAO,UAAmB,CAAA;oBAC5B,CAAC;oBACD,SAAS,EAAE,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;oBAC3C,KAAK,CAAC,cAAc,CAAC,OAAO;wBAC1B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAA;wBACtB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CACzD,IAAI,EACJ,OAAO,CACR,CAAA;wBACD,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;wBAClC,OAAO,aAAa,CAAA;oBACtB,CAAC;oBACD,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC/C,KAAK,EAAE,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;iBAC/D;gBACD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;gBACpD,OAAO,EAAE,CAAC,aAAa,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;oBACvC,+DAA+D;oBAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;oBACvC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;oBAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;oBACvB,KAAK,CAAC,GAAG,GAAG,GAAG,CAAA;oBACf,OAAO,EAAE,CAAA;oBACT,OAAO,EAAE,GAAG,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;gBAC3C,CAAC;gBACD,KAAK,CAAC,OAAO;oBACX,uFAAuF;oBACvF,uDAAuD;oBACvD,KAAK,CAAC,OAAO,GAAG,SAAS,CAAA;oBACzB,KAAK,CAAC,GAAG,GAAG,SAAS,CAAA;oBACrB,OAAO,EAAE,CAAA;oBACT,SAAS,GAAG,OAAO,CAAA;oBACnB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC7B,CAAC;aACF;SACF,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/client/Key.d.ts

@@ -0,0 +1,82 @@
+/**
+ * An app's access key on a user's Tempo Account, as the app stores it.
+ * @module
+ */
+import { type Address, type Hex, type WebCryptoP256 } from 'ox';
+import { KeyAuthorization } from 'ox/tempo';
+import type { OneOf } from 'viem';
+import { Account } from 'viem/tempo';
+/**
+ * A stored access key. A browser key is a non-extractable WebCrypto key pair, and any other a
+ * secp256k1 private key. A key that the app supplied as `accessKey` carries no material.
+ */
+export type Key<chainId extends number = number> = {
+    /** The Tempo Account the key acts for. */
+    account: Address.Address;
+    /** The chain the key acts on, from its authorization. */
+    chainId: chainId;
+    /** The signed authorization, in the node's RPC format. */
+    keyAuthorization: KeyAuthorization.Rpc;
+} & Material;
+/** The key material that the library generated for a sign-in. */
+export type Material = OneOf<{
+    /** A non-extractable WebCrypto P256 key pair, in a browser. */
+    keyPair: WebCryptoP256.createKeyPair.ReturnType;
+} | {
+    /** A secp256k1 private key, outside a browser. Keep it as secret as a session. */
+    privateKey: Hex.Hex;
+} | {}>;
+/** `toAccount` received a key without material, and no `accessKey`. */
+export declare class AccessKeyRequiredError extends Error {
+    readonly name = "Key.AccessKeyRequiredError";
+    constructor();
+}
+/**
+ * Whether the key's authorization is expired, so a new sign-in must authorize a new key.
+ *
+ * @example
+ * ```ts
+ * if (Key.expired(saved.key)) await signInAgain()
+ * ```
+ */
+export declare function expired(key: Key): boolean;
+/**
+ * Instantiates a {@link Key}, and fills an absent `chainId` from the key authorization.
+ *
+ * @example
+ * ```ts
+ * const key = Key.from(JSON.parse(saved).key)
+ * ```
+ */
+export declare function from<chainId extends number = number>(value: from.Value<chainId>): Key<chainId>;
+export declare namespace from {
+    type Value<chainId extends number = number> = {
+        /** The Tempo Account the key acts for. */
+        account: Address.Address;
+        /** The key's chain. Defaults to the key authorization's chain. */
+        chainId?: chainId | undefined;
+        /** The signed authorization, in the node's RPC format. */
+        keyAuthorization: KeyAuthorization.Rpc;
+    } & Material;
+}
+/**
+ * Returns the key as a Viem access key account for its Tempo Account. Viem attaches the
+ * authorization to transactions until the chain registers the key. Throws
+ * {@link AccessKeyRequiredError} for a key without material and no `accessKey`.
+ *
+ * @example
+ * ```ts
+ * import { Key } from '@tempoxyz/id/client'
+ *
+ * const account = Key.toAccount(key)
+ * await client.token.transferSync({ account, amount, to, token })
+ * ```
+ */
+export declare function toAccount(key: Key, options?: toAccount.Options): Account.AccessKeyAccount;
+export declare namespace toAccount {
+    type Options = {
+        /** The key that the app supplied to the sign-in, which signs for a key without material. */
+        accessKey?: Account.Account | undefined;
+    };
+}
+//# sourceMappingURL=Key.d.ts.map

package/dist/client/Key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Key.d.ts","sourceRoot":"","sources":["../../src/client/Key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAa,KAAK,aAAa,EAAE,MAAM,IAAI,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAA;AACjC,OAAO,EAAE,OAAO,EAA2B,MAAM,YAAY,CAAA;AAE7D;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACjD,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAA;IAChB,0DAA0D;IAC1D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAA;CACvC,GAAG,QAAQ,CAAA;AAEZ,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,KAAK,CACxB;IACE,+DAA+D;IAC/D,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,UAAU,CAAA;CAChD,GACD;IACE,kFAAkF;IAClF,UAAU,EAAE,GAAG,CAAC,GAAG,CAAA;CACpB,GACD,EAAE,CACL,CAAA;AAED,uEAAuE;AACvE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAkB,IAAI,gCAA+B;IAErD,cAEC;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,GAAG,WAG/B;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAClD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GACzB,GAAG,CAAC,OAAO,CAAC,CAOd;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;QAC5C,0CAA0C;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,kEAAkE;QAClE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC7B,0DAA0D;QAC1D,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAA;KACvC,GAAG,QAAQ,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,GAAG,EACR,OAAO,GAAE,SAAS,CAAC,OAAY,GAC9B,OAAO,CAAC,gBAAgB,CA0B1B;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,4FAA4F;QAC5F,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;KACxC,CAAA;CACF"}

package/dist/client/Key.js

@@ -0,0 +1,81 @@
+/**
+ * An app's access key on a user's Tempo Account, as the app stores it.
+ * @module
+ */
+import { PublicKey } from 'ox';
+import { KeyAuthorization } from 'ox/tempo';
+import { Account, KeyAuthorizationManager } from 'viem/tempo';
+/** `toAccount` received a key without material, and no `accessKey`. */
+export class AccessKeyRequiredError extends Error {
+    name = 'Key.AccessKeyRequiredError';
+    constructor() {
+        super('The key carries no material. Pass the `accessKey` the app supplied.');
+    }
+}
+/**
+ * Whether the key's authorization is expired, so a new sign-in must authorize a new key.
+ *
+ * @example
+ * ```ts
+ * if (Key.expired(saved.key)) await signInAgain()
+ * ```
+ */
+export function expired(key) {
+    const { expiry } = KeyAuthorization.fromRpc(key.keyAuthorization);
+    return Boolean(expiry) && expiry * 1000 <= Date.now();
+}
+/**
+ * Instantiates a {@link Key}, and fills an absent `chainId` from the key authorization.
+ *
+ * @example
+ * ```ts
+ * const key = Key.from(JSON.parse(saved).key)
+ * ```
+ */
+export function from(value) {
+    if (value.chainId !== undefined)
+        return { ...value, chainId: value.chainId };
+    // The node signs the chain ID the request named, so it is the request's literal.
+    const chainId = Number(KeyAuthorization.fromRpc(value.keyAuthorization).chainId);
+    return { ...value, chainId };
+}
+/**
+ * Returns the key as a Viem access key account for its Tempo Account. Viem attaches the
+ * authorization to transactions until the chain registers the key. Throws
+ * {@link AccessKeyRequiredError} for a key without material and no `accessKey`.
+ *
+ * @example
+ * ```ts
+ * import { Key } from '@tempoxyz/id/client'
+ *
+ * const account = Key.toAccount(key)
+ * await client.token.transferSync({ account, amount, to, token })
+ * ```
+ */
+export function toAccount(key, options = {}) {
+    const { accessKey } = options;
+    const keyAuthorization = KeyAuthorization.fromRpc(key.keyAuthorization);
+    const keyAuthorizationManager = KeyAuthorizationManager.memory();
+    // The memory manager stores synchronously, so the authorization is in place before the account
+    // is returned.
+    void keyAuthorizationManager.set({
+        accessKey: keyAuthorization.address,
+        address: key.account,
+        chainId: Number(keyAuthorization.chainId),
+    }, keyAuthorization);
+    const access = { access: key.account, keyAuthorizationManager };
+    if (key.keyPair)
+        return Account.fromWebCryptoP256(key.keyPair, access);
+    if (key.privateKey)
+        return Account.fromSecp256k1(key.privateKey, access);
+    if (!accessKey)
+        throw new AccessKeyRequiredError();
+    // A raw signature is the key's own, which the bound account wraps for the Tempo Account.
+    return Account.from({
+        ...access,
+        keyType: accessKey.keyType,
+        publicKey: PublicKey.fromHex(accessKey.publicKey),
+        sign: (parameters) => accessKey.sign({ ...parameters, raw: true }),
+    });
+}
+//# sourceMappingURL=Key.js.map

package/dist/client/Key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Key.js","sourceRoot":"","sources":["../../src/client/Key.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0B,SAAS,EAAsB,MAAM,IAAI,CAAA;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AA4B7D,uEAAuE;AACvE,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC7B,IAAI,GAAG,4BAA4B,CAAA;IAErD;QACE,KAAK,CAAC,qEAAqE,CAAC,CAAA;IAC9E,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAQ;IAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACjE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,MAAO,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAA0B;IAE1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IAC5E,iFAAiF;IACjF,MAAM,OAAO,GAAG,MAAM,CACpB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAC9C,CAAA;IACZ,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACvB,GAAQ,EACR,OAAO,GAAsB,EAAE;IAE/B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACvE,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,EAAE,CAAA;IAChE,+FAA+F;IAC/F,eAAe;IACf,KAAK,uBAAuB,CAAC,GAAG,CAC9B;QACE,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;KAC1C,EACD,gBAAgB,CACjB,CAAA;IACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAE/D,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACtE,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACxE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IAClD,yFAAyF;IACzF,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,GAAG,MAAM;QACT,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;KACnE,CAAC,CAAA;AACJ,CAAC"}

package/dist/client/Pending.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A sign-in redirect in progress, which an app keeps until Tempo ID redirects back.
+ * @module
+ */
+import type * as Key from './Key.js';
+/**
+ * A redirect that authorizes a new access key, with the key's material. {@link WithoutKey}
+ * authorizes none.
+ */
+export type Pending = Key.Material & Base & {
+    /** Absent, since the redirect authorizes a key. */
+    key?: undefined;
+};
+/** What every sign-in redirect keeps. */
+type Base = {
+    /** Where Tempo ID redirects back to. The code exchange repeats it. */
+    redirectUri: string;
+    /** The value that the callback must echo, so a forged callback fails. */
+    state: string;
+    /** The PKCE verifier that redeems the code. */
+    verifier: string;
+};
+/** A redirect that authorizes no access key. */
+export type WithoutKey = Base & {
+    /** `false`, since the redirect authorizes no key. */
+    key: false;
+};
+/**
+ * Instantiates a {@link Pending}, or a {@link WithoutKey}.
+ *
+ * @example
+ * ```ts
+ * const pending = Pending.from(await unseal(c, 'oauth'))
+ * ```
+ */
+export declare function from<const value extends Pending | WithoutKey>(value: value): value;
+export {};
+//# sourceMappingURL=Pending.d.ts.map

package/dist/client/Pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pending.d.ts","sourceRoot":"","sources":["../../src/client/Pending.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAA;AAEpC;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,GAChC,IAAI,GAAG;IACL,mDAAmD;IACnD,GAAG,CAAC,EAAE,SAAS,CAAA;CAChB,CAAA;AAEH,yCAAyC;AACzC,KAAK,IAAI,GAAG;IACV,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,gDAAgD;AAChD,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG;IAC9B,qDAAqD;IACrD,GAAG,EAAE,KAAK,CAAA;CACX,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,OAAO,GAAG,UAAU,EAC3D,KAAK,EAAE,KAAK,GACX,KAAK,CAEP"}