@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/client/actions/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/client/actions/device.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAE3B,OAAO,EAAa,YAAY,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAGzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAU,EACV,OAAO,GAA+B,EAAE;IAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,oFAAoF;IACpF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAQzB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAC7D,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;YACrC,sFAAsF;YACtF,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE;YACpC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAClC,IAAI,CAAC,SAAS,CACZ,gBAAgB,CAAC,IAAI,EAAE;gBACrB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CACH,EACD,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAC1B;SACF,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,KAAK,UAAU,IAAI;QACjB,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAA;YACpE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,8CAA8C;aAC3D,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,0FAA0F;gBAC1F,2BAA2B;gBAC3B,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;oBAAE,MAAM,KAAK,CAAA;gBACjD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;oBAAE,QAAQ,IAAI,CAAC,CAAA;qBACxC,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ;oBAC7B,MAAM,IAAI,YAAY,CAAC;wBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,IAA6B,CAAC;wBACtD,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAA;qBACC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB;oBAAE,MAAM,KAAK,CAAA;gBAC5D,OAAO,SAAS,CAAA;YAClB,CAAC,CAAC,CAAA;YACF,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,OAAO,GAAG,CAAC,aAAa,CACtB;gBACE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;aACzB,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,0CAA0C;YACnD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,uBAAuB,EAAE,IAAI,CAAC,yBAAyB;QACvD,IAAI;KACL,CAAA;AACH,CAAC;AAqCD,gFAAgF;AAChF,MAAM,QAAQ,GAAG;IACf,aAAa,EAAE,8BAA8B;IAC7C,aAAa,EAAE,0CAA0C;CACjD,CAAA;AAOV;;;GAGG;AACH,SAAS,QAAQ;IACf,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAwB,CAAA;IACzE,MAAM,IAAI,GAAG,OAAO,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;IACtE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACpD,CAAC"}

package/dist/client/actions/email.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Signs the user in with an emailed code, from the app's own sign-in form.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * Emails the user a sign-in code. The response is the same for every address.
+ *
+ * @example
+ * ```ts
+ * await Actions.email.sendCode(auth, { email: 'user@example.com' })
+ * ```
+ */
+export declare function sendCode(auth: Auth, options: sendCode.Options): Promise<void>;
+export declare namespace sendCode {
+    type Options = {
+        /** The user's email address. */
+        email: string;
+    };
+}
+/**
+ * Signs the user in with an emailed code, and authorizes a first-party app in the same request. The
+ * key must fit the headless ceiling. A sign-in with a key creates the user's first Tempo Account.
+ *
+ * With `link`, the passkey of `Actions.passkey.signIn`'s email step signs again, and signs the key.
+ * In a browser, a passkey that owns the account signs the key on the page after the code.
+ *
+ * A refusal after the code verified has `signedIn: true`. Outside a browser, and without `getFn`,
+ * an account that a passkey owns throws `webauthn_required`. Another passkey's account, whose
+ * relying party does not cover the page, throws it too. Then authorize through
+ * `Actions.redirect.start`.
+ *
+ * A wallet.tempo passkey's account that waits for its upgrade signs the key as the passkey's own
+ * account, and `upgradeAvailable` is `true`. `Actions.account.upgrade` with the key then upgrades
+ * the account with one more prompt, after Tempo ID registers the key.
+ *
+ * @example
+ * ```ts
+ * const { authorization } = await Actions.email.signIn(auth, { code, email })
+ * ```
+ */
+export declare function signIn<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options: signIn.Options<chainId, key>): Promise<signIn.ReturnType<chainId, key>>;
+export declare namespace signIn {
+    type Options<chainId extends number = number, key extends boolean = true> = {
+        /**
+         * The key to authorize. Defaults to a new key. Its `access` names the Tempo Account, which
+         * defaults to the app's selected account, or the user's oldest.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message whose EIP-191 hash the key authorization binds as its `witness`. Needs the
+         * `tempo-id:sign` scope and a key.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /** The 6-digit code that Tempo ID emailed. */
+        code: string;
+        /** The address that received the code. */
+        email: string;
+        /**
+         * Runs the ceremony of the passkey that `link` names, or of the passkey that owns the account,
+         * as for `Actions.passkey.signIn`. Defaults to `navigator.credentials.get`.
+         */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /**
+         * The `link` from `Actions.passkey.signIn`'s email step, which links that passkey to the user.
+         * The call first runs the passkey's ceremony.
+         */
+        link?: string | undefined;
+        /** Whether to authorize an access key and create a first Tempo Account. Defaults to `true`. */
+        key?: key | undefined;
+        /** What the key may do, within the headless ceiling. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /** The authorization, without its key for `key: false`, and whether its account can upgrade. */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = {
+        /** The authorization, without its key for `key: false`. */
+        authorization: key extends false ? Omit<Authorization<chainId>, 'account' | 'key'> : Authorization<chainId>;
+        /**
+         * Whether the key's account is a wallet.tempo passkey's that waits for its upgrade on the key's
+         * chain. `Actions.account.upgrade` with the key upgrades it, and keeps the key.
+         */
+        upgradeAvailable: boolean;
+    };
+}
+//# sourceMappingURL=email.d.ts.map

package/dist/client/actions/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/client/actions/email.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA4B,MAAM,YAAY,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,gCAAgC;QAChC,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,MAAM,CAC1B,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GACpC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAqD1C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC1E;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;WAGG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE,8CAA8C;QAC9C,IAAI,EAAE,MAAM,CAAA;QACZ,0CAA0C;QAC1C,KAAK,EAAE,MAAM,CAAA;QACb;;;WAGG;QACH,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,+FAA+F;QAC/F,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,wDAAwD;QACxD,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED,gGAAgG;IAChG,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IACxB;QACF,2DAA2D;QAC3D,aAAa,EAAE,GAAG,SAAS,KAAK,GAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAC/C,aAAa,CAAC,OAAO,CAAC,CAAA;QAC1B;;;WAGG;QACH,gBAAgB,EAAE,OAAO,CAAA;KAC1B,CAAA;CACF"}

package/dist/client/actions/email.js

@@ -0,0 +1,86 @@
+/**
+ * Signs the user in with an emailed code, from the app's own sign-in form.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import { ChallengeWithoutKeyError } from '../Auth.js';
+import * as Api from '../internal/api.js';
+import * as Headless from '../internal/headless.js';
+/**
+ * Emails the user a sign-in code. The response is the same for every address.
+ *
+ * @example
+ * ```ts
+ * await Actions.email.sendCode(auth, { email: 'user@example.com' })
+ * ```
+ */
+export async function sendCode(auth, options) {
+    await Api.json(await Api.post(auth, '/v1/auth/code', { json: options }));
+}
+/**
+ * Signs the user in with an emailed code, and authorizes a first-party app in the same request. The
+ * key must fit the headless ceiling. A sign-in with a key creates the user's first Tempo Account.
+ *
+ * With `link`, the passkey of `Actions.passkey.signIn`'s email step signs again, and signs the key.
+ * In a browser, a passkey that owns the account signs the key on the page after the code.
+ *
+ * A refusal after the code verified has `signedIn: true`. Outside a browser, and without `getFn`,
+ * an account that a passkey owns throws `webauthn_required`. Another passkey's account, whose
+ * relying party does not cover the page, throws it too. Then authorize through
+ * `Actions.redirect.start`.
+ *
+ * A wallet.tempo passkey's account that waits for its upgrade signs the key as the passkey's own
+ * account, and `upgradeAvailable` is `true`. `Actions.account.upgrade` with the key then upgrades
+ * the account with one more prompt, after Tempo ID registers the key.
+ *
+ * @example
+ * ```ts
+ * const { authorization } = await Actions.email.signIn(auth, { code, email })
+ * ```
+ */
+export async function signIn(auth, options) {
+    const { code, email, getFn, link } = options;
+    // A challenge rides in the key, so a sign-in without one refuses it before it signs in.
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    // The authorization request rides with the sign-in, so one request signs in, creates the first
+    // account, and signs the key. The link's passkey signs again, so a page left at the email step
+    // links nothing for the next person, who cannot sign with it. Its options carry the authorization
+    // request, so the same assertion signs the key.
+    const prepared = await Headless.prepare(auth, options);
+    const assertion = await (async () => {
+        if (!link)
+            return undefined;
+        const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
+            json: { authorize: prepared.authorize, client_id: auth.clientId, link },
+        }));
+        const deserialized = Authentication.deserializeOptions(requested.options);
+        return Authentication.serializeResponse(await Authentication.sign(
+        // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+        getFn ? { ...deserialized, getFn } : deserialized));
+    })();
+    const response = await Api.post(auth, '/v1/auth/code/verify', {
+        json: {
+            code,
+            email,
+            ...(link
+                ? { assertion, link }
+                : {
+                    authorize: prepared.authorize,
+                    // A passkey that owns the account signs the key on this page, in place of a redirect.
+                    ...(Headless.steps(prepared.authorize, { getFn })
+                        ? { passkey: true }
+                        : {}),
+                }),
+        },
+    });
+    // The sign-in authorizes in the same request, after the code signed the user in. `key` decides
+    // both the type and the runtime value of the result.
+    return (await Headless.complete(auth, {
+        body: await Headless.read(response),
+        authorize: prepared.authorize,
+        key: prepared.key,
+        request: options,
+    }));
+}
+//# sourceMappingURL=email.js.map

package/dist/client/actions/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/client/actions/email.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AAExD,OAAO,EAAa,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AAGnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAU,EACV,OAAyB;IAEzB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AASD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAI1B,IAAU,EACV,OAAqC;IAErC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAC5C,wFAAwF;IACxF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,+FAA+F;IAC/F,+FAA+F;IAC/F,kGAAkG;IAClG,gDAAgD;IAChD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC3B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAG9B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE;YAC/C,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;SACxE,CAAC,CACH,CAAA;QACD,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACzE,OAAO,cAAc,CAAC,iBAAiB,CACrC,MAAM,cAAc,CAAC,IAAI;QACvB,qGAAqG;QACrG,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAY,CAAC,CAAC,CAAC,YAAY,CAC7D,CACF,CAAA;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,EAAE;QAC5D,IAAI,EAAE;YACJ,IAAI;YACJ,KAAK;YACL,GAAG,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;gBACrB,CAAC,CAAC;oBACE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,sFAAsF;oBACtF,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC;wBAC/C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;wBACnB,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;SACP;KACF,CAAC,CAAA;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACpC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAGtB,QAAQ,CAAC;QACZ,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAoC,CAAA;AACxC,CAAC"}

package/dist/client/actions/oauth.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Calls Tempo ID's standard OAuth endpoints for tokens that an app holds.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+import type { User } from '../User.js';
+/**
+ * Checks whether a token is active (RFC 7662). Unlike local verification against {@link jwks}, it
+ * reports a revoked token inactive at once. The client secret authenticates the request, so only a
+ * backend calls it.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.oauth.introspect(auth, { token: accessToken })
+ * if (!result.active) return c.json({ error: 'Sign in again.' }, 401)
+ * ```
+ */
+export declare function introspect(auth: Auth, options: introspect.Options): Promise<introspect.ReturnType>;
+export declare namespace introspect {
+    type Options = {
+        /** The access token or refresh token to check. */
+        token: string;
+        /** The kind of token, which speeds up the lookup. */
+        tokenTypeHint?: 'access_token' | 'refresh_token' | undefined;
+    };
+    /** Whether the token is active, with the issuer's claims about an active one. */
+    type ReturnType = {
+        /** The token is expired, revoked, or never issued. */
+        active: false;
+    } | {
+        /** The token is active. */
+        active: true;
+        /** The app the token was issued to. */
+        clientId: string | undefined;
+        /** When the token expires, in milliseconds. */
+        expiresAt: number | undefined;
+        /** When the token was issued, in milliseconds. */
+        issuedAt: number | undefined;
+        /** The token's scopes, space-separated. */
+        scope: string | undefined;
+        /** The user that the token names, as its `sub`. */
+        userId: string | undefined;
+    };
+}
+/**
+ * Returns the issuer's JSON Web Key Set, whose keys verify every Tempo ID token. A key rotation
+ * signs with a new key, so fetch the set again for an unknown `kid`, at most once in a cooldown.
+ * jose's `createRemoteJWKSet` does this from the `/oauth2/jwks` URL.
+ *
+ * @example
+ * ```ts
+ * import { createLocalJWKSet, errors, jwtVerify } from 'jose'
+ *
+ * let keys = createLocalJWKSet(await Actions.oauth.jwks(auth))
+ * let fetchedAt = Date.now()
+ * let refetch: Promise<void> | undefined
+ *
+ * async function verify(accessToken: string) {
+ *   try {
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   } catch (error) {
+ *     if (!(error instanceof errors.JWKSNoMatchingKey)) throw error
+ *     // Concurrent failures share one fetch. The cooldown bounds fetches for forged `kid` values.
+ *     if (!refetch) {
+ *       if (Date.now() - fetchedAt < 30_000) throw error
+ *       fetchedAt = Date.now()
+ *       refetch = Actions.oauth
+ *         .jwks(auth)
+ *         .then((set) => {
+ *           keys = createLocalJWKSet(set)
+ *         })
+ *         .finally(() => {
+ *           refetch = undefined
+ *         })
+ *     }
+ *     await refetch
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   }
+ * }
+ *
+ * const { payload } = await verify(accessToken)
+ * // Every app's token carries the same audience, so allow each app by its `client_id`.
+ * if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
+ * ```
+ */
+export declare function jwks(auth: Auth): Promise<jwks.ReturnType>;
+export declare namespace jwks {
+    /** The key set, in RFC 7517's format. */
+    type ReturnType = {
+        /** The issuer's signing keys. */
+        keys: JsonWebKey[];
+    };
+}
+/**
+ * Returns the user that an access token names, from the UserInfo endpoint (OIDC Core §5.3). Access
+ * tokens carry no email, so an API that needs it calls this once per user. Throws `invalid_token`
+ * for a rejected token.
+ *
+ * @example
+ * ```ts
+ * const user = await Actions.oauth.userInfo(auth, { accessToken })
+ * // { email: 'user@example.com', id: 'user_…' }
+ * ```
+ */
+export declare function userInfo(auth: Auth, options: userInfo.Options): Promise<User>;
+export declare namespace userInfo {
+    type Options = {
+        /** An access token, from any sign-in or refresh. */
+        accessToken: string;
+    };
+}
+//# sourceMappingURL=oauth.d.ts.map

package/dist/client/actions/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/client/actions/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,UAAU,CAAC,OAAO,GAC1B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CA8BhC;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,OAAO,GAAG;QACb,kDAAkD;QAClD,KAAK,EAAE,MAAM,CAAA;QACb,qDAAqD;QACrD,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAA;KAC7D,CAAA;IAED,iFAAiF;IACjF,KAAK,UAAU,GACX;QACE,sDAAsD;QACtD,MAAM,EAAE,KAAK,CAAA;KACd,GACD;QACE,2BAA2B;QAC3B,MAAM,EAAE,IAAI,CAAA;QACZ,uCAAuC;QACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,+CAA+C;QAC/C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B,kDAAkD;QAClD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,2CAA2C;QAC3C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,mDAAmD;QACnD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;CACN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAI/D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,yCAAyC;IACzC,KAAK,UAAU,GAAG;QAChB,iCAAiC;QACjC,IAAI,EAAE,UAAU,EAAE,CAAA;KACnB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF"}

package/dist/client/actions/oauth.js

@@ -0,0 +1,103 @@
+import * as Api from '../internal/api.js';
+/**
+ * Checks whether a token is active (RFC 7662). Unlike local verification against {@link jwks}, it
+ * reports a revoked token inactive at once. The client secret authenticates the request, so only a
+ * backend calls it.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.oauth.introspect(auth, { token: accessToken })
+ * if (!result.active) return c.json({ error: 'Sign in again.' }, 401)
+ * ```
+ */
+export async function introspect(auth, options) {
+    const { token, tokenTypeHint } = options;
+    const body = await Api.json(await (auth.fetch ?? fetch)(new URL('/oauth2/introspect', auth.url), {
+        body: new URLSearchParams({
+            client_id: auth.clientId,
+            ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
+            token,
+            ...(tokenTypeHint ? { token_type_hint: tokenTypeHint } : {}),
+        }),
+        method: 'POST',
+    }));
+    // An inactive token carries no other members (RFC 7662 §2.2).
+    if (!body.active)
+        return { active: false };
+    return {
+        active: true,
+        clientId: body.client_id,
+        expiresAt: body.exp === undefined ? undefined : body.exp * 1000,
+        issuedAt: body.iat === undefined ? undefined : body.iat * 1000,
+        scope: body.scope,
+        userId: body.sub,
+    };
+}
+/**
+ * Returns the issuer's JSON Web Key Set, whose keys verify every Tempo ID token. A key rotation
+ * signs with a new key, so fetch the set again for an unknown `kid`, at most once in a cooldown.
+ * jose's `createRemoteJWKSet` does this from the `/oauth2/jwks` URL.
+ *
+ * @example
+ * ```ts
+ * import { createLocalJWKSet, errors, jwtVerify } from 'jose'
+ *
+ * let keys = createLocalJWKSet(await Actions.oauth.jwks(auth))
+ * let fetchedAt = Date.now()
+ * let refetch: Promise<void> | undefined
+ *
+ * async function verify(accessToken: string) {
+ *   try {
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   } catch (error) {
+ *     if (!(error instanceof errors.JWKSNoMatchingKey)) throw error
+ *     // Concurrent failures share one fetch. The cooldown bounds fetches for forged `kid` values.
+ *     if (!refetch) {
+ *       if (Date.now() - fetchedAt < 30_000) throw error
+ *       fetchedAt = Date.now()
+ *       refetch = Actions.oauth
+ *         .jwks(auth)
+ *         .then((set) => {
+ *           keys = createLocalJWKSet(set)
+ *         })
+ *         .finally(() => {
+ *           refetch = undefined
+ *         })
+ *     }
+ *     await refetch
+ *     return await jwtVerify(accessToken, keys, { audience, issuer })
+ *   }
+ * }
+ *
+ * const { payload } = await verify(accessToken)
+ * // Every app's token carries the same audience, so allow each app by its `client_id`.
+ * if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
+ * ```
+ */
+export async function jwks(auth) {
+    return Api.json(await (auth.fetch ?? fetch)(new URL('/oauth2/jwks', auth.url)));
+}
+/**
+ * Returns the user that an access token names, from the UserInfo endpoint (OIDC Core §5.3). Access
+ * tokens carry no email, so an API that needs it calls this once per user. Throws `invalid_token`
+ * for a rejected token.
+ *
+ * @example
+ * ```ts
+ * const user = await Actions.oauth.userInfo(auth, { accessToken })
+ * // { email: 'user@example.com', id: 'user_…' }
+ * ```
+ */
+export async function userInfo(auth, options) {
+    const response = await (auth.fetch ?? fetch)(new URL('/oauth2/userinfo', auth.url), { headers: { authorization: `Bearer ${options.accessToken}` } });
+    // RFC 6750 §3 names a rejected bearer token `invalid_token`. The issuer's 401 body uses its own
+    // code, or none, so the refusal always carries the standard one.
+    if (response.status === 401)
+        throw Api.error({
+            error: 'invalid_token',
+            error_description: 'Invalid or expired access token. Refresh the tokens, or sign in again.',
+        }, { status: 401 });
+    const claims = await Api.json(response);
+    return { email: claims.email, id: claims.sub };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/client/actions/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/client/actions/oauth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAGzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,OAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAQzB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACnE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,KAAK;YACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAA;IACD,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1C,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI;QAC/D,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI;QAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,GAAG;KACjB,CAAA;AACH,CAAC;AAgCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU;IACnC,OAAO,GAAG,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAU,EACV,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAC1C,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,EACrC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,CAChE,CAAA;IACD,gGAAgG;IAChG,iEAAiE;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACzB,MAAM,GAAG,CAAC,KAAK,CACb;YACE,KAAK,EAAE,eAAe;YACtB,iBAAiB,EACf,wEAAwE;SAC3E,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAiC,QAAQ,CAAC,CAAA;IACvE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC"}

package/dist/client/actions/passkey.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Signs the user in with a passkey from the app's own sign-in form, and authorizes the app's key.
+ * The handle of {@link prepare} requests the sign-in's options before the user acts, so its sign-in
+ * starts the ceremony without a request.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+/**
+ * Returns whether a passkey sign-in for the app runs on this page, from `GET /v1/realms`: the page
+ * is on one of the app's redirect URI origins, and a realm's passkeys cover the page and Tempo ID.
+ * The handle of {@link prepare} requests options only where it returns `true`, so no options request
+ * fails. Returns `false` from a server that does not report it, and where the browser cannot read
+ * the response, such as on a page of no first-party app, which receives no CORS grant.
+ *
+ * @example
+ * ```ts
+ * if (await Actions.passkey.available(auth)) showPasskeyButton()
+ * ```
+ */
+export declare function available(auth: Auth): Promise<boolean>;
+/**
+ * Prepares a passkey sign-in before the user acts, such as when the sign-in form shows, and
+ * returns its handle. The handle checks {@link available}, and where it returns `true`, requests
+ * the sign-in's options and the key that it authorizes, so the handle's `signIn` starts the
+ * ceremony without a request. Create a new handle when the request options change.
+ *
+ * The handle owns its options. A sign-in uses them once, and requests new ones after 4 minutes.
+ * A ceremony that the user cancels leaves them unspent for the next sign-in. A sign-in that sends
+ * its assertion spends their challenge, so after a refusal the handle prepares new options.
+ *
+ * `prepare` never throws, and a failed request leaves no options. The handle's `signIn` then
+ * requests them, and throws what {@link signIn} throws.
+ *
+ * @example
+ * ```ts
+ * // Once the sign-in form shows:
+ * const passkey = Actions.passkey.prepare(auth, { permissions })
+ * if (await passkey.available) showPasskeyButton()
+ * // On the passkey button:
+ * const result = await passkey.signIn()
+ * ```
+ */
+export declare function prepare<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options?: prepare.Options<chainId, key>): prepare.ReturnType<chainId, key>;
+export declare namespace prepare {
+    type Options<chainId extends number = number, key extends boolean = true> = {
+        /**
+         * The key to authorize. Defaults to a new key. Its `access` names the Tempo Account, which
+         * defaults to the app's selected account, or the user's oldest.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message whose EIP-191 hash the key authorization binds as its `witness`. Needs the
+         * `tempo-id:sign` scope and a key.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /**
+         * The credential ID, or up to 16 IDs, that the browser offers. Each is unpadded base64url of 1
+         * to 1,023 bytes, or the call throws `invalid_field`. Defaults to every passkey.
+         */
+        credentialId?: readonly string[] | string | undefined;
+        /** The browser's mediation, such as `conditional` for autofill. Defaults to its own. */
+        mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined;
+        /** Whether to authorize an access key and create a first Tempo Account. Defaults to `true`. */
+        key?: key | undefined;
+        /** What the key may do, within the headless ceiling. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /** The prepared sign-in's handle. */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = {
+        /** Whether a passkey sign-in runs on this page, as {@link available} returns. Never rejects. */
+        available: Promise<boolean>;
+        /**
+         * Signs in as {@link signIn} does, with the handle's options. Requests new options if the
+         * handle holds none, or if they are older than 4 minutes.
+         */
+        signIn: (options?: SignInOptions) => Promise<signIn.ReturnType<chainId, key>>;
+    };
+    /** The options of the handle's `signIn`. */
+    type SignInOptions = Pick<signIn.Options, 'getFn'>;
+}
+/**
+ * Signs the user in with a passkey, and authorizes a first-party app with the same assertion. The
+ * key must fit the headless ceiling. A user without a Tempo Account receives one.
+ *
+ * Returns an email step for a wallet.tempo passkey whose account has no email. Pass its `link` to
+ * `Actions.email.signIn`.
+ *
+ * A page off the app's redirect URI origins throws `invalid_origin`, and one that the realms'
+ * relying party does not cover throws `passkey_not_permitted`. A refusal after the passkey verified
+ * has `signedIn: true`. An account that another passkey owns throws `webauthn_required`, so
+ * authorize through `Actions.redirect.start`.
+ *
+ * A wallet.tempo passkey's account that waits for its upgrade signs the key as the passkey's own
+ * account, and `upgradeAvailable` is `true`. `Actions.account.upgrade` with the key then upgrades
+ * the account with one more prompt, after Tempo ID registers the key.
+ *
+ * It requests the sign-in's options when called. {@link prepare} requests them before the user
+ * acts instead.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.passkey.signIn(auth)
+ * if ('step' in result) showEmailForm()
+ * ```
+ */
+export declare function signIn<const chainId extends number = number, const key extends boolean = true>(auth: Auth, options?: signIn.Options<chainId, key>): Promise<signIn.ReturnType<chainId, key>>;
+export declare namespace signIn {
+    type Options<chainId extends number = number, key extends boolean = true> = prepare.Options<chainId, key> & {
+        /**
+         * Runs the WebAuthn ceremony in place of `navigator.credentials.get`. Its assertion must report
+         * the page's origin, so Tempo ID refuses an Android facet origin.
+         */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+    };
+    /** The step of a wallet.tempo passkey without an email: an emailed code links it. */
+    type EmailStep = {
+        /** The `link` that `Actions.email.signIn` takes to link the passkey to its user. */
+        link: string;
+        /** The kind of step. */
+        type: 'email';
+    };
+    /** The authorization, without its key for `key: false`, and whether its account can upgrade, or the email step. */
+    type ReturnType<chainId extends number = number, key extends boolean = true> = {
+        /** The authorization, without its key for `key: false`. */
+        authorization: key extends false ? Omit<Authorization<chainId>, 'account' | 'key'> : Authorization<chainId>;
+        /**
+         * Whether the key's account is a wallet.tempo passkey's that waits for its upgrade on the
+         * key's chain. `Actions.account.upgrade` with the key upgrades it, and keeps the key.
+         */
+        upgradeAvailable: boolean;
+    } | {
+        /** The email step, which comes before the authorization. */
+        step: EmailStep;
+    };
+}
+//# sourceMappingURL=passkey.d.ts.map

package/dist/client/actions/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/client/actions/passkey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA4B,MAAM,YAAY,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAIxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAc5D;AAQD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,OAAO,CACrB,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAM,GAC1C,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAsClC;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC1E;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;WAGG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE;;;WAGG;QACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAAA;QACrD,wFAAwF;QACxF,SAAS,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAA;QAC1E,+FAA+F;QAC/F,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,wDAAwD;QACxD,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KAC/C,CAAA;IAED,qCAAqC;IACrC,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IACxB;QACF,gGAAgG;QAChG,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QAC3B;;;WAGG;QACH,MAAM,EAAE,CACN,OAAO,CAAC,EAAE,aAAa,KACpB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;KAC9C,CAAA;IAED,4CAA4C;IAC5C,KAAK,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;CACnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,MAAM,CAC1B,KAAK,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EACrC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAEhC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAM,GACzC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAQ1C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,CACV,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IACxB,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG;QAClC;;;WAGG;QACH,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;KACzD,CAAA;IAED,qFAAqF;IACrF,KAAK,SAAS,GAAG;QACf,oFAAoF;QACpF,IAAI,EAAE,MAAM,CAAA;QACZ,wBAAwB;QACxB,IAAI,EAAE,OAAO,CAAA;KACd,CAAA;IAED,mHAAmH;IACnH,KAAK,UAAU,CACb,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,GAAG,SAAS,OAAO,GAAG,IAAI,IAExB;QACE,2DAA2D;QAC3D,aAAa,EAAE,GAAG,SAAS,KAAK,GAC5B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,GAC/C,aAAa,CAAC,OAAO,CAAC,CAAA;QAC1B;;;WAGG;QACH,gBAAgB,EAAE,OAAO,CAAA;KAC1B,GACD;QACE,4DAA4D;QAC5D,IAAI,EAAE,SAAS,CAAA;KAChB,CAAA;CACN"}