@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/client/actions/passkey.js

@@ -0,0 +1,170 @@
+/**
+ * Signs the user in with a passkey from the app's own sign-in form, and authorizes the app's key.
+ * The handle of {@link prepare} requests the sign-in's options before the user acts, so its sign-in
+ * starts the ceremony without a request.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import { ChallengeWithoutKeyError } from '../Auth.js';
+import * as Api from '../internal/api.js';
+import * as Headless from '../internal/headless.js';
+/**
+ * Returns whether a passkey sign-in for the app runs on this page, from `GET /v1/realms`: the page
+ * is on one of the app's redirect URI origins, and a realm's passkeys cover the page and Tempo ID.
+ * The handle of {@link prepare} requests options only where it returns `true`, so no options request
+ * fails. Returns `false` from a server that does not report it, and where the browser cannot read
+ * the response, such as on a page of no first-party app, which receives no CORS grant.
+ *
+ * @example
+ * ```ts
+ * if (await Actions.passkey.available(auth)) showPasskeyButton()
+ * ```
+ */
+export async function available(auth) {
+    const response = await (auth.fetch ?? fetch)(new URL(`/v1/realms?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url)).catch(() => undefined);
+    // The browser refuses a response without a CORS grant, as to a page of no first-party app, where
+    // the options request would fail too.
+    if (!response)
+        return false;
+    const { passkeys } = await Api.json(response);
+    return passkeys === true;
+}
+/**
+ * How long a sign-in uses prepared options, in milliseconds: a minute short of the 5 minutes that
+ * their challenge lasts, so the challenge stays valid through the ceremony.
+ */
+const preparedLifetime = 4 * 60 * 1000;
+/**
+ * Prepares a passkey sign-in before the user acts, such as when the sign-in form shows, and
+ * returns its handle. The handle checks {@link available}, and where it returns `true`, requests
+ * the sign-in's options and the key that it authorizes, so the handle's `signIn` starts the
+ * ceremony without a request. Create a new handle when the request options change.
+ *
+ * The handle owns its options. A sign-in uses them once, and requests new ones after 4 minutes.
+ * A ceremony that the user cancels leaves them unspent for the next sign-in. A sign-in that sends
+ * its assertion spends their challenge, so after a refusal the handle prepares new options.
+ *
+ * `prepare` never throws, and a failed request leaves no options. The handle's `signIn` then
+ * requests them, and throws what {@link signIn} throws.
+ *
+ * @example
+ * ```ts
+ * // Once the sign-in form shows:
+ * const passkey = Actions.passkey.prepare(auth, { permissions })
+ * if (await passkey.available) showPasskeyButton()
+ * // On the passkey button:
+ * const result = await passkey.signIn()
+ * ```
+ */
+export function prepare(auth, options = {}) {
+    const ready = available(auth).catch(() => false);
+    // Requests options only where passkeys sign in, so no request fails on a page without them.
+    const ahead = () => ready
+        .then((passkeys) => passkeys ? requestOptions(auth, options) : undefined)
+        .catch(() => undefined);
+    let pending = ahead();
+    return {
+        available: ready,
+        async signIn(signInOptions = {}) {
+            // Takes the options before the first await, so a sign-in that starts beside this one
+            // requests options of its own instead of the same challenge.
+            const taken = pending;
+            pending = undefined;
+            const entry = await taken;
+            const prepared = entry && entry.expiresAt > Date.now()
+                ? entry
+                : await requestOptions(auth, options);
+            const assertion = await sign(prepared, signInOptions).catch((error) => {
+                // The ceremony sent no assertion, so the challenge is unspent for the next sign-in.
+                pending ??= Promise.resolve(prepared);
+                throw error;
+            });
+            return (await verify(auth, { assertion, prepared }).catch((error) => {
+                pending ??= ahead();
+                throw error;
+            }));
+        },
+    };
+}
+/**
+ * Signs the user in with a passkey, and authorizes a first-party app with the same assertion. The
+ * key must fit the headless ceiling. A user without a Tempo Account receives one.
+ *
+ * Returns an email step for a wallet.tempo passkey whose account has no email. Pass its `link` to
+ * `Actions.email.signIn`.
+ *
+ * A page off the app's redirect URI origins throws `invalid_origin`, and one that the realms'
+ * relying party does not cover throws `passkey_not_permitted`. A refusal after the passkey verified
+ * has `signedIn: true`. An account that another passkey owns throws `webauthn_required`, so
+ * authorize through `Actions.redirect.start`.
+ *
+ * A wallet.tempo passkey's account that waits for its upgrade signs the key as the passkey's own
+ * account, and `upgradeAvailable` is `true`. `Actions.account.upgrade` with the key then upgrades
+ * the account with one more prompt, after Tempo ID registers the key.
+ *
+ * It requests the sign-in's options when called. {@link prepare} requests them before the user
+ * acts instead.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.passkey.signIn(auth)
+ * if ('step' in result) showEmailForm()
+ * ```
+ */
+export async function signIn(auth, options = {}) {
+    const prepared = await requestOptions(auth, options);
+    const assertion = await sign(prepared, options);
+    // `key` decides both the type and the runtime value of the result.
+    return (await verify(auth, { assertion, prepared }));
+}
+/**
+ * Requests the options of a passkey sign-in, and the key that they authorize.
+ * @throws {ChallengeWithoutKeyError} For a challenge with `key: false`, before any request.
+ */
+async function requestOptions(auth, options) {
+    const { credentialId, mediation } = options;
+    // A challenge rides in the key, so a sign-in without one refuses it before it signs in.
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    // The options carry the authorization request, so the challenge is its key's digest.
+    const { authorize, key } = await Headless.prepare(auth, options);
+    // The challenge's lifetime starts at Tempo ID before the response arrives, so the options' does too.
+    const requestedAt = Date.now();
+    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
+        json: {
+            authorize,
+            // The app's realms decide the relying party, which must cover the page's origin.
+            client_id: auth.clientId,
+            ...(credentialId === undefined ? {} : { credentialId }),
+            ...(mediation === undefined ? {} : { mediation }),
+        },
+    }));
+    return {
+        authorize,
+        expiresAt: requestedAt + preparedLifetime,
+        key,
+        options: Authentication.deserializeOptions(requested.options),
+        request: options,
+    };
+}
+/** Runs the WebAuthn ceremony over the prepared options, and returns the serialized assertion. */
+async function sign(prepared, options) {
+    const { getFn } = options;
+    return Authentication.serializeResponse(await Authentication.sign(
+    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+    getFn ? { ...prepared.options, getFn } : prepared.options));
+}
+/** Sends the assertion, and returns the authorization, or the email step of a passkey without one. */
+async function verify(auth, options) {
+    const { assertion, prepared } = options;
+    const body = await Headless.read(await Api.post(auth, '/v1/auth/passkey/verify', { json: { assertion } }));
+    if ('step' in body)
+        return { step: { link: body.step.link, type: body.step.type } };
+    return await Headless.complete(auth, {
+        authorize: prepared.authorize,
+        body,
+        key: prepared.key,
+        request: prepared.request,
+    });
+}
+//# sourceMappingURL=passkey.js.map

package/dist/client/actions/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../../src/client/actions/passkey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AAExD,OAAO,EAAa,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AAGnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAU;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAC1C,IAAI,GAAG,CACL,cAAc,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EACjE,IAAI,CAAC,GAAG,CACT,CACF,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACxB,iGAAiG;IACjG,sCAAsC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CACjC,QAAQ,CACT,CAAA;IACD,OAAO,QAAQ,KAAK,IAAI,CAAA;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,OAAO,CAIrB,IAAU,EACV,OAAO,GAAkC,EAAE;IAE3C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;IAChD,4FAA4F;IAC5F,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,KAAK;SACF,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACjB,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CACrD;SACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC3B,IAAI,OAAO,GAA8C,KAAK,EAAE,CAAA;IAEhE,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,EAAE;YAC7B,qFAAqF;YACrF,6DAA6D;YAC7D,MAAM,KAAK,GAAG,OAAO,CAAA;YACrB,OAAO,GAAG,SAAS,CAAA;YACnB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAA;YACzB,MAAM,QAAQ,GACZ,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBACnC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,KAAK,CACzD,CAAC,KAAc,EAAE,EAAE;gBACjB,oFAAoF;gBACpF,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACrC,MAAM,KAAK,CAAA;YACb,CAAC,CACF,CAAA;YACD,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CACvD,CAAC,KAAc,EAAE,EAAE;gBACjB,OAAO,KAAK,KAAK,EAAE,CAAA;gBACnB,MAAM,KAAK,CAAA;YACb,CAAC,CACF,CAAoC,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAI1B,IAAU,EACV,OAAO,GAAiC,EAAE;IAE1C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/C,mEAAmE;IACnE,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAGlD,CAAA;AACH,CAAC;AA0DD;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAU,EACV,OAAyC;IAEzC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC3C,wFAAwF;IACxF,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,qFAAqF;IACrF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAChE,qGAAqG;IACrG,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAG9B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE;QAC/C,IAAI,EAAE;YACJ,SAAS;YACT,iFAAiF;YACjF,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD;KACF,CAAC,CACH,CAAA;IACD,OAAO;QACL,SAAS;QACT,SAAS,EAAE,WAAW,GAAG,gBAAgB;QACzC,GAAG;QACH,OAAO,EAAE,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7D,OAAO,EAAE,OAAO;KACjB,CAAA;AACH,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,IAAI,CAAC,QAAkB,EAAE,OAA8B;IACpE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,OAAO,cAAc,CAAC,iBAAiB,CACrC,MAAM,cAAc,CAAC,IAAI;IACvB,qGAAqG;IACrG,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CACrE,CACF,CAAA;AACH,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,MAAM,CAAC,IAAU,EAAE,OAAuB;IACvD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAG9B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;IAC3E,IAAI,MAAM,IAAI,IAAI;QAChB,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IACjE,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAA;AACJ,CAAC"}

package/dist/client/actions/realm.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Lists the realms that the app reaches.
+ * @module
+ */
+import type { Auth } from '../Auth.js';
+/**
+ * Lists the realms that the app reaches, in its settings' order. The first holds a user's first
+ * account.
+ *
+ * @example
+ * ```ts
+ * const realms = await Actions.realm.list(auth)
+ * // [{ id: 'default', name: 'Tempo' }]
+ * ```
+ */
+export declare function list(auth: Auth): Promise<list.ReturnType>;
+export declare namespace list {
+    type ReturnType = readonly {
+        /** The realm ID, such as `default` or `tempo-cash`. */
+        id: string;
+        /** The display name, such as `Tempo Cash`. */
+        name: string;
+    }[];
+}
+//# sourceMappingURL=realm.d.ts.map

package/dist/client/actions/realm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.d.ts","sourceRoot":"","sources":["../../../src/client/actions/realm.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC;;;;;;;;;GASG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAU/D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,UAAU,GAAG,SAAS;QACzB,uDAAuD;QACvD,EAAE,EAAE,MAAM,CAAA;QACV,8CAA8C;QAC9C,IAAI,EAAE,MAAM,CAAA;KACb,EAAE,CAAA;CACJ"}

package/dist/client/actions/realm.js

@@ -0,0 +1,16 @@
+import * as Api from '../internal/api.js';
+/**
+ * Lists the realms that the app reaches, in its settings' order. The first holds a user's first
+ * account.
+ *
+ * @example
+ * ```ts
+ * const realms = await Actions.realm.list(auth)
+ * // [{ id: 'default', name: 'Tempo' }]
+ * ```
+ */
+export async function list(auth) {
+    const { realms } = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/realms?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url)));
+    return realms;
+}
+//# sourceMappingURL=realm.js.map

package/dist/client/actions/realm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm.js","sourceRoot":"","sources":["../../../src/client/actions/realm.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAEzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU;IACnC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CACzB,IAAI,GAAG,CACL,cAAc,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EACjE,IAAI,CAAC,GAAG,CACT,CACF,CACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/client/actions/redirect.d.ts

@@ -0,0 +1,152 @@
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import * as Pending from '../Pending.js';
+import type { Permissions } from '../Permissions.js';
+/** `complete` received a `key` other than the one that `start` received. */
+export declare class KeyMismatchError extends Error {
+    readonly name = "Actions.redirect.KeyMismatchError";
+    constructor(options: {
+        stored: boolean;
+    });
+}
+/**
+ * Finishes a {@link start} when the page loads with Tempo ID's callback, and returns `undefined`
+ * otherwise. It redeems the code once, however often the page calls it. With the default storage,
+ * it sends the code exchange at once, from the tab's copy of the verifier, before IndexedDB returns
+ * the rest of the redirect's state. A callback that denies the
+ * redirect, such as `error=access_denied`, throws a `RequestError` with that `code` and status 0.
+ *
+ * @example
+ * ```ts
+ * const authorization =
+ *   (await Actions.redirect.complete(auth)) ??
+ *   (await Actions.authorize(auth))
+ * ```
+ */
+export declare function complete<const key extends boolean = true>(auth: Auth, options?: complete.Options<key>): Promise<complete.ReturnType<key>>;
+export declare namespace complete {
+    type Options<key extends boolean = true> = {
+        /** The key that the app passed to {@link start}, if any. */
+        accessKey?: Account.Account | undefined;
+        /** Must equal `start`'s `key`, or {@link KeyMismatchError} throws. Defaults to `true`. */
+        key?: key | undefined;
+    };
+    /** `undefined` when the page is not a redirect's callback. */
+    type ReturnType<key extends boolean = true> = (key extends false ? handleCallback.WithoutKey : Authorization) | undefined;
+}
+/**
+ * Returns the authorization URL, `/oauth2/authorize`, which redirects to Tempo ID's sign-in or
+ * approval page, and the `Pending` state to keep until the callback. {@link handleCallback} redeems
+ * the code.
+ *
+ * @example
+ * ```ts
+ * const { pending, url } = await Actions.redirect.createUrl(auth, {
+ *   redirectUri: 'https://app.example/auth/callback',
+ * })
+ * await seal(c, 'oauth', pending)
+ * return c.redirect(url)
+ * ```
+ */
+export declare function createUrl<const key extends boolean = true>(auth: Auth, options?: createUrl.Options<key>): Promise<createUrl.ReturnType<key>>;
+export declare namespace createUrl {
+    type Options<key extends boolean = true> = {
+        /**
+         * The key to authorize. Defaults to a new key, whose material `pending` keeps. Its `access`
+         * names the Tempo Account, which defaults to the one the user selects, or the user's oldest.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message whose EIP-191 hash the key authorization binds as its `witness`. Needs the
+         * `tempo-id:sign` scope. With `key: false`, the call throws `Auth.ChallengeWithoutKeyError`.
+         */
+        challenge?: ([key] extends [false] ? never : string) | undefined;
+        /** Whether the sign-in authorizes an access key. Defaults to `true`. */
+        key?: key | undefined;
+        /** What the key may do. The user approves it, so it may exceed the headless ceiling. */
+        permissions?: Permissions | undefined;
+        /** Defaults to the instance's `redirectUri`, or the page's origin. */
+        redirectUri?: string | undefined;
+    };
+    type ReturnType<key extends boolean = true> = {
+        /** What to keep until the callback, such as in a sealed cookie. */
+        pending: key extends false ? Pending.WithoutKey : Pending.Pending;
+        /** Where to send the browser. */
+        url: string;
+    };
+}
+/**
+ * Checks the callback's `state`, and redeems its code for the authorization. Throws a
+ * `RequestError` for a forged `state`, a callback without a `code`, or a refused code.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.redirect.handleCallback(auth, {
+ *   pending: await unseal(c, 'oauth'),
+ *   url: c.req.url,
+ * })
+ * ```
+ */
+export declare function handleCallback<const pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending>(auth: Auth, options: handleCallback.Options<pending>): Promise<handleCallback.ReturnType<pending>>;
+export declare namespace handleCallback {
+    type Options<pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending> = {
+        /** The key that the app passed to `createUrl`, if any. */
+        accessKey?: Account.Account | undefined;
+        /** What `createUrl` returned to keep. */
+        pending: pending;
+        /** The callback URL that Tempo ID redirected to. */
+        url: string | URL;
+    };
+    /** The authorization, without its key for a `Pending.WithoutKey`. */
+    type ReturnType<pending extends Pending.Pending | Pending.WithoutKey = Pending.Pending> = [pending] extends [Pending.WithoutKey] ? WithoutKey : [pending] extends [Pending.Pending] ? Authorization : Authorization | WithoutKey;
+    /** A sign-in without a key: the tokens and the user. */
+    type WithoutKey = Omit<Authorization, 'account' | 'key'>;
+}
+/**
+ * Prefetches the scripts and style sheets of Tempo ID's sign-in page, from `GET /v1/auth/assets`, so
+ * the page that {@link start} opens loads them from the browser's cache. A browser partitions its
+ * cache by site, so only a page on Tempo ID's site, such as `app.tempo.xyz` for `id.tempo.xyz`,
+ * gains. Returns the URLs of the assets. Outside a browser, it prefetches nothing.
+ *
+ * It never throws. A failed read returns no URLs, and the sign-in page loads its assets itself.
+ *
+ * @example
+ * ```ts
+ * // Once the sign-in button shows:
+ * void Actions.redirect.prefetch(auth)
+ * ```
+ */
+export declare function prefetch(auth: Auth): Promise<prefetch.ReturnType>;
+export declare namespace prefetch {
+    /** The absolute URLs of the sign-in page's scripts and style sheets. */
+    type ReturnType = readonly string[];
+}
+/**
+ * Sends the browser to Tempo ID's pages to sign in, and keeps the redirect's state in `storage`.
+ * With the default storage, it also keeps the `state`, the redirect URI, and the PKCE verifier in
+ * the tab's `sessionStorage`, without the key's material. {@link complete} finishes it when the
+ * browser returns.
+ *
+ * @example
+ * ```ts
+ * await Actions.redirect.start(auth)
+ * ```
+ */
+export declare function start(auth: Auth, options?: start.Options): Promise<void>;
+export declare namespace start {
+    type Options = {
+        /** The key to authorize, which {@link complete} needs too. Defaults to a new key. */
+        accessKey?: Account.Account | undefined;
+        /**
+         * A message whose EIP-191 hash the key authorization binds as its `witness`. Needs the
+         * `tempo-id:sign` scope and a key.
+         */
+        challenge?: string | undefined;
+        /** Whether the sign-in authorizes an access key. Defaults to `true`. */
+        key?: boolean | undefined;
+        /** What the key may do. The user approves it, so it may exceed the headless ceiling. */
+        permissions?: Permissions | undefined;
+    };
+}
+//# sourceMappingURL=redirect.d.ts.map

package/dist/client/actions/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../../src/client/actions/redirect.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAA0C,MAAM,YAAY,CAAA;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMxD,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,4EAA4E;AAC5E,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,uCAAsC;IAE5D,YAAY,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,EAMvC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,QAAQ,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EACvD,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAM,GAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAqFnC;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QACzC,4DAA4D;QAC5D,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC,0FAA0F;QAC1F,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;KACtB,CAAA;IAED,8DAA8D;IAC9D,KAAK,UAAU,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IACtC,CAAC,GAAG,SAAS,KAAK,GAAG,cAAc,CAAC,UAAU,GAAG,aAAa,CAAC,GAC/D,SAAS,CAAA;CACd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,EAC9D,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAM,GACnC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAiDpC;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QACzC;;;WAGG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;WAGG;QACH,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAA;QAChE,wEAAwE;QACxE,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAA;QACrB,wFAAwF;QACxF,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;QACrC,sEAAsE;QACtE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACjC,CAAA;IAED,KAAK,UAAU,CAAC,GAAG,SAAS,OAAO,GAAG,IAAI,IAAI;QAC5C,mEAAmE;QACnE,OAAO,EAAE,GAAG,SAAS,KAAK,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,CAAA;QACjE,iCAAiC;QACjC,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;CACF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,KAAK,CAAC,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,EAE5E,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAS7C;AAED,MAAM,CAAC,OAAO,WAAW,cAAc,CAAC;IACtC,KAAK,OAAO,CACV,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,IACpE;QACF,0DAA0D;QAC1D,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC,yCAAyC;QACzC,OAAO,EAAE,OAAO,CAAA;QAChB,oDAAoD;QACpD,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAClB,CAAA;IAED,qEAAqE;IACrE,KAAK,UAAU,CACb,OAAO,SAAS,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,IACpE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,GACtC,UAAU,GACV,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GACjC,aAAa,GACb,aAAa,GAAG,UAAU,CAAA;IAEhC,wDAAwD;IACxD,KAAK,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD;AAiGD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAuBvE;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,wEAAwE;IACxE,KAAK,UAAU,GAAG,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,KAAK,CACzB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,KAAK,CAAC,OAAY,GAC1B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,CAAC,OAAO,WAAW,KAAK,CAAC;IAC7B,KAAK,OAAO,GAAG;QACb,qFAAqF;QACrF,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,wEAAwE;QACxE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,wFAAwF;QACxF,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KACtC,CAAA;CACF"}