@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/client/Pending.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Pending}, or a {@link WithoutKey}.
+ *
+ * @example
+ * ```ts
+ * const pending = Pending.from(await unseal(c, 'oauth'))
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Pending.js.map

package/dist/client/Pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pending.js","sourceRoot":"","sources":["../../src/client/Pending.ts"],"names":[],"mappings":"AAgCA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAClB,KAAY;IAEZ,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Permissions.d.ts

@@ -0,0 +1,36 @@
+/**
+ * What an app's access key may do.
+ * @module
+ */
+import type { KeyAuthorization } from 'ox/tempo';
+/**
+ * What an app's access key may do, as Viem's `accessKey.authorize` takes it. Tempo ID fills what it
+ * leaves out with its defaults. `chainId` types the authorization's `key.chainId`.
+ */
+export type Permissions<chainId extends number = number> = {
+    /** The key's chain, such as `tempoTestnet.id`. Defaults to the instance's `chainId`. */
+    chainId?: chainId | undefined;
+    /** Unix seconds, such as Viem's `Expiry.days(1)`. Defaults to a year from the request. */
+    expiry?: number | undefined;
+    /**
+     * How much of each token the key may spend, in base units, in total or per `period` seconds.
+     * Defaults to about $1,000 of each token that `scopes` call, or of OUSD.
+     */
+    limits?: KeyAuthorization.KeyAuthorization['limits'];
+    /** The calls the key may make. Defaults to transfers of each token it limits. */
+    scopes?: KeyAuthorization.KeyAuthorization['scopes'];
+};
+/**
+ * Instantiates a {@link Permissions}, keeping `chainId` as a literal type.
+ *
+ * @example
+ * ```ts
+ * const permissions = Permissions.from({
+ *   expiry: Expiry.days(1),
+ *   limits: [{ limit: 10_000_000n, token: ousd }],
+ *   scopes: [Scopes.tip20(ousd).transfer()],
+ * })
+ * ```
+ */
+export declare function from<const chainId extends number = number>(value: Permissions<chainId>): Permissions<chainId>;
+//# sourceMappingURL=Permissions.d.ts.map

package/dist/client/Permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Permissions.d.ts","sourceRoot":"","sources":["../../src/client/Permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7B,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACpD,iFAAiF;IACjF,MAAM,CAAC,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;CACrD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACxD,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,GAC1B,WAAW,CAAC,OAAO,CAAC,CAEtB"}

package/dist/client/Permissions.js

@@ -0,0 +1,16 @@
+/**
+ * Instantiates a {@link Permissions}, keeping `chainId` as a literal type.
+ *
+ * @example
+ * ```ts
+ * const permissions = Permissions.from({
+ *   expiry: Expiry.days(1),
+ *   limits: [{ limit: 10_000_000n, token: ousd }],
+ *   scopes: [Scopes.tip20(ousd).transfer()],
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Permissions.js.map

package/dist/client/Permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Permissions.js","sourceRoot":"","sources":["../../src/client/Permissions.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,IAAI,CAClB,KAA2B;IAE3B,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Storage.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Where a redirect keeps its state until Tempo ID redirects back.
+ * @module
+ */
+/** Keeps a redirect's state, as structured-clone storage such as IndexedDB does. */
+export type Storage = {
+    /** Reads the value at `key`, or `undefined`. */
+    getItem: (key: string) => Promise<unknown>;
+    /** Deletes the value at `key`. */
+    removeItem: (key: string) => Promise<void>;
+    /** Writes `value` at `key`, without serializing it. */
+    setItem: (key: string, value: unknown) => Promise<void>;
+};
+/**
+ * Instantiates a {@link Storage}.
+ *
+ * @example
+ * ```ts
+ * const storage = Storage.from({
+ *   getItem: (key) => idb.get(key),
+ *   removeItem: (key) => idb.del(key),
+ *   setItem: (key, value) => idb.set(key, value),
+ * })
+ * ```
+ */
+export declare function from(value: Storage): Storage;
+//# sourceMappingURL=Storage.d.ts.map

package/dist/client/Storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.d.ts","sourceRoot":"","sources":["../../src/client/Storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oFAAoF;AACpF,MAAM,MAAM,OAAO,GAAG;IACpB,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,kCAAkC;IAClC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,uDAAuD;IACvD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5C"}

package/dist/client/Storage.js

@@ -0,0 +1,16 @@
+/**
+ * Instantiates a {@link Storage}.
+ *
+ * @example
+ * ```ts
+ * const storage = Storage.from({
+ *   getItem: (key) => idb.get(key),
+ *   removeItem: (key) => idb.del(key),
+ *   setItem: (key, value) => idb.set(key, value),
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Storage.js.map

package/dist/client/Storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Storage.js","sourceRoot":"","sources":["../../src/client/Storage.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/TempoAccount.d.ts

@@ -0,0 +1,52 @@
+/**
+ * One of a user's Tempo Accounts.
+ * @module
+ */
+/** One of the user's Tempo Accounts. */
+export type TempoAccount = {
+    /**
+     * The address on the request's chain. On a chain with configurable accounts (TIP-1107), an
+     * account that Tempo ID created has its configuration's address. Elsewhere, its owner key's.
+     */
+    address: `0x${string}`;
+    /**
+     * Who signs the account's key authorizations: a Privy wallet (`privy`) or a development key
+     * (`secp256k1`), which Tempo ID signs with, or a passkey (`webAuthn`), which signs only on a
+     * Tempo ID page. An account with a cloud wallet among its owners names the cloud wallet. Treat
+     * another value as an owner that may refuse a key authorization.
+     */
+    owner: 'privy' | 'secp256k1' | 'webAuthn' | (string & {});
+    /** The owner keys. A configurable account can have several, such as a passkey and a Privy key. */
+    owners: readonly TempoAccount.Owner[];
+    /** The account's realm. An app reaches only the accounts of its realms. */
+    realm: {
+        /** `default`, or a realm that an app's settings name, such as `tempo-cash`. */
+        id: string;
+        /** The display name, such as `Tempo Cash`. */
+        name: string;
+    };
+};
+export declare namespace TempoAccount {
+    /** One owner key of a Tempo Account. */
+    type Owner = {
+        /** The owner key's address. */
+        address: `0x${string}`;
+        /** Who holds the key, as for `TempoAccount.owner`. */
+        type: 'privy' | 'secp256k1' | 'webAuthn' | (string & {});
+    };
+}
+/**
+ * Instantiates a {@link TempoAccount}.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = TempoAccount.from({
+ *   address: '0x…',
+ *   owner: 'privy',
+ *   owners: [{ address: '0x…', type: 'privy' }],
+ *   realm: { id: 'default', name: 'Tempo' },
+ * })
+ * ```
+ */
+export declare function from(value: TempoAccount): TempoAccount;
+//# sourceMappingURL=TempoAccount.d.ts.map

package/dist/client/TempoAccount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TempoAccount.d.ts","sourceRoot":"","sources":["../../src/client/TempoAccount.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG;IACzB;;;OAGG;IACH,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IACtB;;;;;OAKG;IACH,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACzD,kGAAkG;IAClG,MAAM,EAAE,SAAS,YAAY,CAAC,KAAK,EAAE,CAAA;IACrC,2EAA2E;IAC3E,KAAK,EAAE;QACL,+EAA+E;QAC/E,EAAE,EAAE,MAAM,CAAA;QACV,8CAA8C;QAC9C,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,wCAAwC;IACxC,KAAK,KAAK,GAAG;QACX,+BAA+B;QAC/B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;QACtB,sDAAsD;QACtD,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;KACzD,CAAA;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAEtD"}

package/dist/client/TempoAccount.js

@@ -0,0 +1,17 @@
+/**
+ * Instantiates a {@link TempoAccount}.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = TempoAccount.from({
+ *   address: '0x…',
+ *   owner: 'privy',
+ *   owners: [{ address: '0x…', type: 'privy' }],
+ *   realm: { id: 'default', name: 'Tempo' },
+ * })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=TempoAccount.js.map

package/dist/client/TempoAccount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TempoAccount.js","sourceRoot":"","sources":["../../src/client/TempoAccount.ts"],"names":[],"mappings":"AAuCA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,IAAI,CAAC,KAAmB;IACtC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/Tokens.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The app's tokens for Tempo APIs.
+ * @module
+ */
+/** The app's tokens for Tempo APIs. */
+export type Tokens = {
+    /** The Bearer token Tempo APIs accept. */
+    accessToken: string;
+    /** When the access token expires, in milliseconds. */
+    expiresAt: number;
+    /** The OIDC ID token, which names the user. A refresh may omit it. */
+    idToken?: string | undefined;
+    /** Exchanges for new tokens through `Actions.refresh`, and rotates on each refresh. */
+    refreshToken?: string | undefined;
+};
+/**
+ * Instantiates a {@link Tokens}.
+ *
+ * @example
+ * ```ts
+ * const tokens = Tokens.from({ ...saved, ...(await Actions.refresh(auth, { refreshToken })) })
+ * ```
+ */
+export declare function from(value: Tokens): Tokens;
+//# sourceMappingURL=Tokens.d.ts.map

package/dist/client/Tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.d.ts","sourceRoot":"","sources":["../../src/client/Tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,uCAAuC;AACvC,MAAM,MAAM,MAAM,GAAG;IACnB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAA;IACnB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1C"}

package/dist/client/Tokens.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link Tokens}.
+ *
+ * @example
+ * ```ts
+ * const tokens = Tokens.from({ ...saved, ...(await Actions.refresh(auth, { refreshToken })) })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=Tokens.js.map

package/dist/client/Tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.js","sourceRoot":"","sources":["../../src/client/Tokens.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/User.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The signed-in user.
+ * @module
+ */
+/** The signed-in user. */
+export type User = {
+    /** The user's verified email address. */
+    email: string;
+    /** The `sub` of every token, such as `user_…`. */
+    id: string;
+};
+/**
+ * Instantiates a {@link User}.
+ *
+ * @example
+ * ```ts
+ * const user = User.from({ email: claims.email, id: claims.sub })
+ * ```
+ */
+export declare function from(value: User): User;
+//# sourceMappingURL=User.d.ts.map

package/dist/client/User.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/client/User.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,0BAA0B;AAC1B,MAAM,MAAM,IAAI,GAAG;IACjB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAEtC"}

package/dist/client/User.js

@@ -0,0 +1,12 @@
+/**
+ * Instantiates a {@link User}.
+ *
+ * @example
+ * ```ts
+ * const user = User.from({ email: claims.email, id: claims.sub })
+ * ```
+ */
+export function from(value) {
+    return value;
+}
+//# sourceMappingURL=User.js.map

package/dist/client/User.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"User.js","sourceRoot":"","sources":["../../src/client/User.ts"],"names":[],"mappings":"AAYA;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,KAAW;IAC9B,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/actions/account.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Reads the signed-in user's Tempo Account for the app, and upgrades a wallet.tempo passkey's
+ * account from the app's page.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import type { Auth } from '../Auth.js';
+import * as Key from '../Key.js';
+import type { TempoAccount } from '../TempoAccount.js';
+/**
+ * Returns the user's Tempo Account for the app: the selected one, or the oldest in the app's
+ * realms. For a user without one, it creates a Privy-owned account in the first realm, if that
+ * realm has a Privy app. With `chain`, the address is the account's on that chain.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = await Actions.account.get(auth)
+ * // { address: '0x…', owner: 'webAuthn', owners: [{ address: '0x…', type: 'webAuthn' }], realm: { id: 'default', name: 'Tempo' } }
+ * ```
+ */
+export declare function get(auth: Auth, options?: get.Options): Promise<get.ReturnType>;
+export declare namespace get {
+    type Options = {
+        /**
+         * The chain that the app acts on, by its name in `GET /v1/chains`, such as `testnet`. On a
+         * chain with configurable accounts, the address is the configuration's. Absent, the owner key's.
+         */
+        chain?: string | undefined;
+    };
+    /** The account, or `undefined` when the user has none in the app's realms. */
+    type ReturnType = TempoAccount | undefined;
+}
+/**
+ * Upgrades a wallet.tempo passkey's account in place to a configurable account (TIP-1113), on the
+ * chain of `key`, from a page that the passkey's relying party covers. The passkey signs once. With
+ * `key`, a key that signed as the passkey's own account, Tempo ID first registers the key through a
+ * transaction that its access key signs and Tempo ID sponsors, so the key keeps working after the
+ * upgrade. The account keeps its address, and the passkey stays its only owner. Call it when a
+ * sign-in or `Actions.authorize` returns `upgradeAvailable: true`.
+ *
+ * Requires a sign-in within the last 10 minutes. An account that is configurable already throws
+ * `owner_exists`.
+ *
+ * @example
+ * ```ts
+ * const { authorization, upgradeAvailable } = await Actions.email.signIn(auth, {
+ *   code,
+ *   email,
+ * })
+ * if (upgradeAvailable)
+ *   await Actions.account.upgrade(auth, { key: authorization.key })
+ * ```
+ */
+export declare function upgrade(auth: Auth, options: upgrade.Options): Promise<TempoAccount>;
+export declare namespace upgrade {
+    type Options = {
+        /** The access key that the app supplied for `key`, when `key` carries no material. */
+        accessKey?: Key.toAccount.Options['accessKey'];
+        /** The account to upgrade. Defaults to `key.account`. */
+        account?: `0x${string}` | undefined;
+        /**
+         * The chain to upgrade on, by its name in `GET /v1/chains`, such as `testnet`. Defaults to the
+         * chain of `key`, or the first chain whose accounts are configurable.
+         */
+        chain?: string | undefined;
+        /** Runs the WebAuthn ceremony in place of `navigator.credentials.get`. */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /**
+         * The key of an authorization with `upgradeAvailable: true`, which the chain registers before
+         * the upgrade. Without it, a key that the passkey signed as its own account stops working.
+         */
+        key?: Key.Key | undefined;
+    };
+}
+//# sourceMappingURL=account.d.ts.map

package/dist/client/actions/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/client/actions/account.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,wBAAsB,GAAG,CACvB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,GAAG,CAAC,OAAY,GACxB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAqCzB;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;IAED,8EAA8E;IAC9E,KAAK,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,CAAC,OAAO,GACvB,OAAO,CAAC,YAAY,CAAC,CAgDvB;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG;QACb,sFAAsF;QACtF,SAAS,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC9C,yDAAyD;QACzD,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;QACnC;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,0EAA0E;QAC1E,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD;;;WAGG;QACH,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;KAC1B,CAAA;CACF"}

package/dist/client/actions/account.js

@@ -0,0 +1,102 @@
+/**
+ * Reads the signed-in user's Tempo Account for the app, and upgrades a wallet.tempo passkey's
+ * account from the app's page.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import * as Api from '../internal/api.js';
+import * as Key from '../Key.js';
+/**
+ * Returns the user's Tempo Account for the app: the selected one, or the oldest in the app's
+ * realms. For a user without one, it creates a Privy-owned account in the first realm, if that
+ * realm has a Privy app. With `chain`, the address is the account's on that chain.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = await Actions.account.get(auth)
+ * // { address: '0x…', owner: 'webAuthn', owners: [{ address: '0x…', type: 'webAuthn' }], realm: { id: 'default', name: 'Tempo' } }
+ * ```
+ */
+export async function get(auth, options = {}) {
+    const { chain } = options;
+    const listed = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/account?${new URLSearchParams({
+        ...(chain ? { chain } : {}),
+        client_id: auth.clientId,
+    })}`, auth.url), { credentials: 'include' }));
+    const tempo = await (async () => {
+        if (listed.tempo.length > 0)
+            return listed.tempo;
+        // Creation is a JSON write, which a page on another site cannot send.
+        const created = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
+            body: JSON.stringify({
+                ...(chain ? { chain } : {}),
+                client_id: auth.clientId,
+            }),
+            credentials: 'include',
+            headers: { 'content-type': 'application/json' },
+            method: 'POST',
+        }));
+        return created.tempo;
+    })();
+    const [account] = tempo;
+    if (!account)
+        return undefined;
+    return Api.tempoAccount(account);
+}
+/**
+ * Upgrades a wallet.tempo passkey's account in place to a configurable account (TIP-1113), on the
+ * chain of `key`, from a page that the passkey's relying party covers. The passkey signs once. With
+ * `key`, a key that signed as the passkey's own account, Tempo ID first registers the key through a
+ * transaction that its access key signs and Tempo ID sponsors, so the key keeps working after the
+ * upgrade. The account keeps its address, and the passkey stays its only owner. Call it when a
+ * sign-in or `Actions.authorize` returns `upgradeAvailable: true`.
+ *
+ * Requires a sign-in within the last 10 minutes. An account that is configurable already throws
+ * `owner_exists`.
+ *
+ * @example
+ * ```ts
+ * const { authorization, upgradeAvailable } = await Actions.email.signIn(auth, {
+ *   code,
+ *   email,
+ * })
+ * if (upgradeAvailable)
+ *   await Actions.account.upgrade(auth, { key: authorization.key })
+ * ```
+ */
+export async function upgrade(auth, options) {
+    const { chain, getFn, key } = options;
+    const account = options.account ?? key?.account;
+    // A key without material and without `accessKey` throws here, before the passkey's prompt.
+    const signer = key
+        ? Key.toAccount(key, { accessKey: options.accessKey })
+        : undefined;
+    const json = {
+        account,
+        ...(chain ? { chain } : {}),
+        client_id: auth.clientId,
+        ...(key ? { key_authorization: key.keyAuthorization } : {}),
+    };
+    const first = await Api.json(await Api.post(auth, '/v1/account/upgrade', { json }));
+    // An upgrade that the chain holds already returns the account without a step.
+    if ('account' in first)
+        return Api.tempoAccount(first.account);
+    const { step } = first;
+    const deserialized = Authentication.deserializeOptions(step.options);
+    const assertion = Authentication.serializeResponse(await Authentication.sign(
+    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+    getFn ? { ...deserialized, getFn } : deserialized));
+    // The access key signs its registration raw, and Tempo ID wraps the signature for the account.
+    const signature = step.key && signer
+        ? await signer.sign({ hash: step.key.digest, raw: true })
+        : undefined;
+    const upgraded = await Api.json(await Api.post(auth, '/v1/account/upgrade', {
+        json: {
+            ...json,
+            ...(signature ? { key: { signature } } : {}),
+            passkey: { assertion },
+        },
+    }));
+    return Api.tempoAccount(upgraded.account);
+}
+//# sourceMappingURL=account.js.map

package/dist/client/actions/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/client/actions/account.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AAExD,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAGhC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAU,EACV,OAAO,GAAgB,EAAE;IAEzB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAG3B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CACzB,IAAI,GAAG,CACL,eAAe,IAAI,eAAe,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;KACzB,CAAC,EAAE,EACJ,IAAI,CAAC,GAAG,CACT,EACD,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CACF,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAChD,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAG5B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;YAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC;YACF,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAA;QACD,OAAO,OAAO,CAAC,KAAK,CAAA;IACtB,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;AAClC,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAU,EACV,OAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,EAAE,OAAO,CAAA;IAC/C,2FAA2F;IAC3F,MAAM,MAAM,GAAG,GAAG;QAChB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,IAAI,GAAG;QACX,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAQ1B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACxD,8EAA8E;IAC9E,IAAI,SAAS,IAAI,KAAK;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAE9D,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACtB,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,iBAAiB,CAChD,MAAM,cAAc,CAAC,IAAI;IACvB,qGAAqG;IACrG,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAY,CAAC,CAAC,CAAC,YAAY,CAC7D,CACF,CAAA;IACD,+FAA+F;IAC/F,MAAM,SAAS,GACb,IAAI,CAAC,GAAG,IAAI,MAAM;QAChB,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzD,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,EAAE;QAC1C,IAAI,EAAE;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB;KACF,CAAC,CACH,CAAA;IACD,OAAO,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC3C,CAAC"}

package/dist/client/actions/device.d.ts

@@ -0,0 +1,52 @@
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * Starts the device grant for a CLI. The user approves `userCode` at `verificationUri`, and `wait`
+ * resolves with the authorization. The instance's `clientId` names the device app, such as
+ * `tempo-cli`, whose realms the sign-in uses.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'tempo-cli' })
+ * const device = await Actions.device.authorize(auth)
+ * console.log(`Open ${device.verificationUriComplete}`)
+ * const authorization = await device.wait()
+ * ```
+ */
+export declare function authorize<const chainId extends number = number>(auth: Auth, options?: authorize.Options<chainId>): Promise<authorize.ReturnType<chainId>>;
+export declare namespace authorize {
+    type Options<chainId extends number = number> = {
+        /**
+         * The key to authorize. Defaults to a new key. Its `access` names the Tempo Account, which
+         * defaults to the one the user selects at sign-in, or the user's oldest.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message whose EIP-191 hash the key authorization binds as its `witness`. Needs the
+         * `tempo-id:sign` scope.
+         */
+        challenge?: string | undefined;
+        /**
+         * The name that the approval page shows, up to 64 characters. Defaults to the hostname in Node,
+         * Bun, and Deno, or `Unknown device`.
+         */
+        device?: string | undefined;
+        /** What the key may do. The user approves it, so it may exceed the headless ceiling. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    type ReturnType<chainId extends number = number> = {
+        /** Seconds until the code expires. */
+        expiresIn: number;
+        /** The code that the user confirms. */
+        userCode: string;
+        /** Where the user enters the code. */
+        verificationUri: string;
+        /** Where the user approves the code, with the code filled in. */
+        verificationUriComplete: string;
+        /** Resolves with the authorization once the user approves, and throws on a denial or expiry. */
+        wait: () => Promise<Authorization<chainId>>;
+    };
+}
+//# sourceMappingURL=device.d.ts.map

package/dist/client/actions/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../src/client/actions/device.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAAgB,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAIxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACnE,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAM,GACvC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAgFxC;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;QAC9C;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,wFAAwF;QACxF,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED,KAAK,UAAU,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;QACjD,sCAAsC;QACtC,SAAS,EAAE,MAAM,CAAA;QACjB,uCAAuC;QACvC,QAAQ,EAAE,MAAM,CAAA;QAChB,sCAAsC;QACtC,eAAe,EAAE,MAAM,CAAA;QACvB,iEAAiE;QACjE,uBAAuB,EAAE,MAAM,CAAA;QAC/B,gGAAgG;QAChG,IAAI,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;KAC5C,CAAA;CACF"}

package/dist/client/actions/device.js

@@ -0,0 +1,103 @@
+/**
+ * Signs a CLI in through the device grant, which the user approves from any browser.
+ * @module
+ */
+import { Base64 } from 'ox';
+import { RequestError } from '../Auth.js';
+import * as AccessKey from '../internal/accessKey.js';
+import * as Api from '../internal/api.js';
+import { keyAuthorization } from '../internal/request.js';
+/**
+ * Starts the device grant for a CLI. The user approves `userCode` at `verificationUri`, and `wait`
+ * resolves with the authorization. The instance's `clientId` names the device app, such as
+ * `tempo-cli`, whose realms the sign-in uses.
+ *
+ * @example
+ * ```ts
+ * const auth = Auth.create({ clientId: 'tempo-cli' })
+ * const device = await Actions.device.authorize(auth)
+ * console.log(`Open ${device.verificationUriComplete}`)
+ * const authorization = await device.wait()
+ * ```
+ */
+export async function authorize(auth, options = {}) {
+    const key = await AccessKey.resolve(options.accessKey);
+    // The device authorization request (RFC 8628 §3.1), with the key as base64url JSON.
+    const code = await Api.json(await (auth.fetch ?? fetch)(new URL('/device/code', auth.url), {
+        body: new URLSearchParams({
+            ...(options.challenge === undefined
+                ? {}
+                : { challenge: options.challenge }),
+            // The instance's app is the device app that the CLI signs in to, such as `tempo-cli`.
+            client_id: auth.clientId,
+            device: options.device ?? hostname(),
+            key_authorization: Base64.fromString(JSON.stringify(keyAuthorization(auth, {
+                accessKey: key.accessKey,
+                permissions: options.permissions,
+            })), { pad: false, url: true }),
+        }),
+        method: 'POST',
+    }));
+    /** Polls until the user approves or denies the code, or it expires. */
+    async function wait() {
+        let interval = code.interval;
+        const deadline = Date.now() + code.expires_in * 1000;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, interval * 1000));
+            const body = await Api.token(auth, {
+                device_code: code.device_code,
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            }).catch((error) => {
+                // RFC 8628 §3.5: the device polls again until the user decides, and adds 5 seconds to its
+                // interval on `slow_down`.
+                if (!(error instanceof RequestError))
+                    throw error;
+                if (error.code === 'slow_down')
+                    interval += 5;
+                else if (error.code in messages)
+                    throw new RequestError({
+                        code: error.code,
+                        message: messages[error.code],
+                        status: error.status,
+                    });
+                else if (error.code !== 'authorization_pending')
+                    throw error;
+                return undefined;
+            });
+            if (!body)
+                continue;
+            return Api.authorization({
+                account: body.account,
+                key_authorization: body.key_authorization,
+                tokens: Api.tokens(body),
+            }, key);
+        }
+        throw new RequestError({
+            code: 'expired_token',
+            message: 'Device code expired. Request a new code.',
+            status: 400,
+        });
+    }
+    return {
+        expiresIn: code.expires_in,
+        userCode: code.user_code,
+        verificationUri: code.verification_uri,
+        verificationUriComplete: code.verification_uri_complete,
+        wait,
+    };
+}
+/** The message of each RFC 8628 error that ends the poll, as a CLI shows it. */
+const messages = {
+    access_denied: 'The user denied the request.',
+    expired_token: 'Device code expired. Request a new code.',
+};
+/**
+ * Returns the hostname, within the 64 characters that Tempo ID accepts. `getBuiltinModule` avoids
+ * an import of `node:os`, which browser and React Native bundlers fail to resolve.
+ */
+function hostname() {
+    const process = Reflect.get(globalThis, 'process');
+    const name = process?.getBuiltinModule?.('node:os')?.hostname().trim();
+    return name ? name.slice(0, 64) : 'Unknown device';
+}
+//# sourceMappingURL=device.js.map