@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/client/internal/api.js

@@ -0,0 +1,136 @@
+/**
+ * Calls Tempo ID's API, and reads its responses into what the actions return.
+ * @module
+ */
+import { Base64 } from 'ox';
+import { RequestError } from '../Auth.js';
+import * as Key from '../Key.js';
+/**
+ * Builds an authorization from Tempo ID's response and the sign-in's key: generated material, or
+ * the app's `accessKey`. Throws `server_error` for a response without the key authorization.
+ */
+export function authorization(body, options) {
+    const { accessKey, material } = options;
+    // A response to a request with a key always carries one, so its absence is a fault.
+    if (!body.account || !body.key_authorization)
+        throw new RequestError({
+            code: 'server_error',
+            message: 'Missing key authorization in the response to a request with a key. Sign in again.',
+            status: 200,
+        });
+    const key = Key.from({
+        ...material,
+        account: body.account,
+        keyAuthorization: body.key_authorization,
+    });
+    const tokens_ = 'accessToken' in body.tokens ? body.tokens : tokens(body.tokens);
+    return {
+        ...tokens_,
+        account: Key.toAccount(key, { accessKey }),
+        key,
+        user: user(tokens_),
+    };
+}
+/** Reads a JSON response, and throws a {@link RequestError} for a refusal. */
+export async function json(response) {
+    // Some refusals, such as the CSRF check's, return plain text.
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok)
+        throw error(body, { status: response.status });
+    return body;
+}
+/** Returns a {@link RequestError} for an OAuth error response, or a refusal without a body. */
+export function error(body, options) {
+    return new RequestError({
+        code: body.error ?? 'server_error',
+        field: body.field,
+        message: body.error_description ??
+            body.error ??
+            `Request failed with status ${options.status}.`,
+        meta: body.meta,
+        reason: body.reason,
+        status: options.status,
+        uri: body.error_uri,
+    });
+}
+/** Posts JSON to Tempo ID's API with the session cookie. */
+export function post(auth, path, options) {
+    return (auth.fetch ?? fetch)(new URL(path, auth.url), {
+        body: JSON.stringify(options.json),
+        credentials: 'include',
+        headers: { 'content-type': 'application/json' },
+        method: 'POST',
+    });
+}
+/** Posts a form to the token endpoint, with the client ID and any client secret. */
+export async function token(auth, body) {
+    return json(await (auth.fetch ?? fetch)(new URL('/oauth2/token', auth.url), {
+        body: new URLSearchParams({
+            ...body,
+            client_id: auth.clientId,
+            ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
+        }),
+        method: 'POST',
+    }));
+}
+/** Reads the account's address, its owners, the type of the owner that signs its keys, and its realm. */
+export function tempoAccount(account) {
+    // A configuration sorts its owners by address. A cloud wallet signs the account's keys whenever it
+    // is an owner, so it names the account's owner before a passkey does.
+    const owner = account.config.owners.find((entry) => entry.type !== 'webAuthn') ??
+        account.config.owners[0];
+    return {
+        address: account.address,
+        owner: owner.type,
+        owners: account.config.owners.map((entry) => ({
+            address: entry.owner,
+            type: entry.type,
+        })),
+        realm: { id: account.realm.id, name: account.realm.name },
+    };
+}
+/** Reads the signed-in user from the ID token of `tokens`. */
+export function user(tokens) {
+    const claims = JSON.parse(Base64.toString(tokens.idToken.split('.')[1]));
+    return { email: claims.email, id: claims.sub };
+}
+/** Reads a token response into `Tokens`. */
+export function tokens(response) {
+    return {
+        accessToken: response.access_token,
+        expiresAt: Date.now() + response.expires_in * 1000,
+        idToken: response.id_token,
+        refreshToken: response.refresh_token,
+    };
+}
+/**
+ * Rethrows an error after a sign-in verified as a {@link RequestError} marked `signedIn`. An error
+ * without a response, such as a network error, has status 0 and the original as its `cause`.
+ */
+export function signedIn(error) {
+    if (!(error instanceof RequestError))
+        throw new RequestError({
+            cause: error,
+            code: 'server_error',
+            message: 'Authorization failed after the sign-in, with no response from Tempo ID. The user is signed in, so authorize again.',
+            signedIn: true,
+            status: 0,
+        });
+    throw new RequestError({
+        cause: error.cause,
+        code: error.code,
+        field: error.field,
+        message: error.message,
+        meta: error.meta,
+        reason: error.reason,
+        signedIn: true,
+        status: error.status,
+        uri: error.uri,
+    });
+}
+/** Reads an authorization without a key: the tokens and the user. */
+export function withoutKey(body) {
+    const tokens_ = 'accessToken' in body.tokens ? body.tokens : tokens(body.tokens);
+    return { ...tokens_, user: user(tokens_) };
+}
+//# sourceMappingURL=api.js.map

package/dist/client/internal/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/client/internal/api.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAG3B,OAAO,EAAa,YAAY,EAAE,MAAM,YAAY,CAAA;AAEpD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAKhC;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAc,EACd,OAGC;IAED,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACvC,oFAAoF;IACpF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAC1C,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,mFAAmF;YACrF,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAU;QAC5B,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;KACzC,CAAC,CAAA;IACF,MAAM,OAAO,GACX,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;QAC1C,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;KACpB,CAAA;AACH,CAAC;AAcD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,QAAkB;IAElB,8DAA8D;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CACjC,CAAA;IACpB,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,OAAO,IAAI,CAAA;AACb,CAAC;AAkBD,+FAA+F;AAC/F,MAAM,UAAU,KAAK,CAAC,IAAwB,EAAE,OAA2B;IACzE,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EACL,IAAI,CAAC,iBAAiB;YACtB,IAAI,CAAC,KAAK;YACV,8BAA8B,OAAO,CAAC,MAAM,GAAG;QACjD,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,IAAI,CAAC,SAAS;KACpB,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,IAAI,CAAC,IAAU,EAAE,IAAY,EAAE,OAA0B;IACvE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,MAAM,EAAE,MAAM;KACf,CAAC,CAAA;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAU,EAAE,IAA4B;IAClE,OAAO,IAAI,CACT,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QAC9D,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,GAAG,IAAI;YACP,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAA;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,OAA6B;IACxD,mGAAmG;IACnG,sEAAsE;IACtE,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC1B,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,KAAK,CAAC,KAAK;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;KAC1D,CAAA;AACH,CAAC;AAoCD,8DAA8D;AAC9D,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CACd,CAAA;IACnC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,MAAM,CAAC,QAAuB;IAC5C,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,YAAY;QAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAClD,OAAO,EAAE,QAAQ,CAAC,QAAQ;QAC1B,YAAY,EAAE,QAAQ,CAAC,aAAa;KACrC,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC;YACrB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,oHAAoH;YACtH,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,CAAC;SACV,CAAC,CAAA;IACJ,MAAM,IAAI,YAAY,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAA;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,OAAO,GACX,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAA;AAC5C,CAAC"}

package/dist/client/internal/headless.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Authorizes the app after a headless sign-in, for `Actions.email.signIn` and
+ * `Actions.passkey.signIn`.
+ * @module
+ */
+import { Authentication, type Types } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import { type Auth } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import type { Permissions } from '../Permissions.js';
+import * as AccessKey from './accessKey.js';
+import * as Api from './api.js';
+import { request } from './request.js';
+/** A headless authorization, and whether its account can upgrade, as the actions return them. */
+export type Result = {
+    /** The authorization, without its key for `key: false`. */
+    authorization: Authorization | Api.WithoutKey;
+    /**
+     * Whether the key's account is a wallet.tempo passkey's that waits for its upgrade on the key's
+     * chain. The key signed as the passkey's own account, and `Actions.account.upgrade` with it
+     * registers the key and upgrades the account.
+     */
+    upgradeAvailable: boolean;
+};
+/**
+ * Sends `POST /v1/account`, which creates the user's first Tempo Account, then
+ * `POST /v1/authorize`. A sign-in without a key skips the account. Each refusal is marked
+ * `signedIn`. An authorization for a user other than `userId` throws `session_changed`.
+ */
+export declare function authorize(auth: Auth, options: authorize.Options): Promise<Result>;
+export declare namespace authorize {
+    type Options = {
+        /** The key to authorize. Defaults to a new key. */
+        accessKey?: Account.Account | undefined;
+        /** A message that the key's witness binds. */
+        challenge?: string | undefined;
+        /** Runs the ceremony of the passkey that owns the account. Defaults to `navigator.credentials.get`. */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** Whether the sign-in authorizes an access key. Defaults to `true`. */
+        key?: boolean | undefined;
+        /** What the key may do. */
+        permissions?: Permissions | undefined;
+        /** The user that the sign-in verified. */
+        userId: string;
+    };
+}
+/**
+ * Returns the authorization that a sign-in returned in its own response. For a server that returns
+ * none, such as one that predates it, it calls {@link authorize}. Each refusal is marked `signedIn`.
+ */
+export declare function complete(auth: Auth, options: complete.Options): Promise<Result>;
+export declare namespace complete {
+    type Options = {
+        /** The authorization request that the sign-in sent, which the passkey step repeats. */
+        authorize: ReturnType<typeof request>;
+        /** The sign-in's response. */
+        body: {
+            /**
+             * The authorization, or the passkey step for a passkey-owned account. Absent from a server
+             * that predates the authorization in the sign-in.
+             */
+            authorization?: Api.Headless | Step | undefined;
+            /** The signed-in user. */
+            user: {
+                id: string;
+            };
+        };
+        /** The key that the request authorized, or `undefined` without one. */
+        key: AccessKey.resolve.ReturnType | undefined;
+        /** The sign-in's options, for a server that returns no authorization. */
+        request: prepare.Options;
+    };
+}
+/**
+ * Returns the key, or none with `key: false`, and the authorization request that a sign-in sends:
+ * an emailed-code sign-in with its code, and a passkey sign-in with its options.
+ */
+export declare function prepare(auth: Auth, options: prepare.Options): Promise<{
+    authorize: {
+        challenge?: string;
+        client_id: string;
+        key_authorization?: {
+            account?: `0x${string}`;
+            address: `0x${string}`;
+            chainId: `0x${string}`;
+            expiry: number | undefined;
+            keyType: "p256" | "secp256k1" | "webAuthn";
+            limits: {
+                limit: `0x${string}`;
+                period?: number;
+                token: `0x${string}`;
+            }[] | undefined;
+            scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
+        };
+        redirect_uri: string;
+        scope: string;
+        skip_upgrade?: boolean;
+    };
+    key: AccessKey.resolve.ReturnType | undefined;
+}>;
+export declare namespace prepare {
+    type Options = Omit<authorize.Options, 'userId'>;
+}
+/**
+ * Reads the JSON response of a sign-in that carried the authorization request. A refusal with the
+ * `Tempo-Id-Signed-In` header came after the session started, so it is marked `signedIn`.
+ */
+export declare function read<value>(response: Response): Promise<value>;
+/**
+ * Sends `POST /v1/authorize` with `json`. For a request with a key, on a page that runs passkey
+ * ceremonies, it requests the passkey step, signs it with {@link sign}, and returns the repeated
+ * request's response. Otherwise it returns the response of the one request.
+ */
+export declare function post(auth: Auth, options: post.Options): Promise<Response>;
+export declare namespace post {
+    type Options = {
+        /** Runs the ceremony of the passkey that owns the account. Defaults to `navigator.credentials.get`. */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** The authorization request. */
+        json: ReturnType<typeof request>;
+        /** Whether a passkey-owned account signs the key on the page. Defaults to `true`. */
+        passkey?: boolean | undefined;
+    };
+}
+/**
+ * Signs the options of the passkey `step` with the passkey on the page, and repeats
+ * `POST /v1/authorize` with the assertion and the step's expiry. Returns that response. A failed
+ * ceremony, such as a dismissed prompt or a passkey that this device does not hold, throws
+ * `webauthn_required`, so the app can authorize through a redirect.
+ */
+export declare function sign(auth: Auth, options: sign.Options): Promise<Response>;
+export declare namespace sign {
+    type Options = {
+        /** Runs the passkey's ceremony. Defaults to `navigator.credentials.get`. */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** The authorization request that returned the step. */
+        json: ReturnType<typeof request>;
+        /** The passkey step. */
+        step: Step;
+    };
+}
+/**
+ * Returns whether a request asks for the passkey step: it carries a key, and the page runs passkey
+ * ceremonies, through `getFn` or `navigator.credentials`.
+ */
+export declare function steps(json: ReturnType<typeof request>, options: Pick<post.Options, 'getFn'>): boolean;
+/** The passkey step of a headless authorization, which the page signs before it repeats the request. */
+export type Step = {
+    /** The key's expiry in Unix seconds, which the repeated request sends. */
+    expiry: number;
+    /** The step. */
+    step: {
+        /** The options for `navigator.credentials.get()`, whose challenge is the key's digest. */
+        options: Types.CredentialRequestOptions<true>;
+        /** The kind of step. */
+        type: 'passkey';
+    };
+};
+//# sourceMappingURL=headless.d.ts.map

package/dist/client/internal/headless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.d.ts","sourceRoot":"","sources":["../../../src/client/internal/headless.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAAgB,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,iGAAiG;AACjG,MAAM,MAAM,MAAM,GAAG;IACnB,2DAA2D;IAC3D,aAAa,EAAE,aAAa,GAAG,GAAG,CAAC,UAAU,CAAA;IAC7C;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,CAAC,OAAO,GACzB,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,mDAAmD;QACnD,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACvC,8CAA8C;QAC9C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,uGAAuG;QACvG,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD,wEAAwE;QACxE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,2BAA2B;QAC3B,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;QACrC,0CAA0C;QAC1C,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,uFAAuF;QACvF,SAAS,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAA;QACrC,8BAA8B;QAC9B,IAAI,EAAE;YACJ;;;eAGG;YACH,aAAa,CAAC,EAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAA;YAC/C,0BAA0B;YAC1B,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SACrB,CAAA;QACD,uEAAuE;QACvE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAA;QAC7C,yEAAyE;QACzE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;KACzB,CAAA;CACF;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;GAajE;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;CACjD;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAQpE;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,qBAsB3D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,uGAAuG;QACvG,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD,iCAAiC;QACjC,IAAI,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAA;QAChC,qFAAqF;QACrF,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,qBAgC3D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG;QACb,4EAA4E;QAC5E,KAAK,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAA;QACxD,wDAAwD;QACxD,IAAI,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAA;QAChC,wBAAwB;QACxB,IAAI,EAAE,IAAI,CAAA;KACX,CAAA;CACF;AAED;;;GAGG;AACH,wBAAgB,KAAK,CACnB,IAAI,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,EAChC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,WAOrC;AAED,wGAAwG;AACxG,MAAM,MAAM,IAAI,GAAG;IACjB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB;IAChB,IAAI,EAAE;QACJ,0FAA0F;QAC1F,OAAO,EAAE,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAA;QAC7C,wBAAwB;QACxB,IAAI,EAAE,SAAS,CAAA;KAChB,CAAA;CACF,CAAA"}

package/dist/client/internal/headless.js

@@ -0,0 +1,196 @@
+/**
+ * Authorizes the app after a headless sign-in, for `Actions.email.signIn` and
+ * `Actions.passkey.signIn`.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import { RequestError } from '../Auth.js';
+import * as AccessKey from './accessKey.js';
+import * as Api from './api.js';
+import { request } from './request.js';
+/**
+ * Sends `POST /v1/account`, which creates the user's first Tempo Account, then
+ * `POST /v1/authorize`. A sign-in without a key skips the account. Each refusal is marked
+ * `signedIn`. An authorization for a user other than `userId` throws `session_changed`.
+ */
+export async function authorize(auth, options) {
+    const { challenge, getFn, permissions } = options;
+    // The user is signed in already, so every failure from here on, key generation included, is marked.
+    try {
+        const key = options.key === false
+            ? undefined
+            : await AccessKey.resolve(options.accessKey);
+        if (key)
+            await Api.json(await Api.post(auth, '/v1/account', {
+                json: { client_id: auth.clientId },
+            }));
+        const body = await Api.json(await post(auth, {
+            getFn,
+            json: request(auth, {
+                accessKey: key?.accessKey,
+                challenge,
+                permissions,
+            }),
+        }));
+        const authorization = key
+            ? Api.authorization(body, key)
+            : Api.withoutKey(body);
+        if (authorization.user.id !== options.userId)
+            throw sessionChanged();
+        return { authorization, upgradeAvailable: body.upgrade_available === true };
+    }
+    catch (error) {
+        return Api.signedIn(error);
+    }
+}
+/**
+ * Returns the authorization that a sign-in returned in its own response. For a server that returns
+ * none, such as one that predates it, it calls {@link authorize}. Each refusal is marked `signedIn`.
+ */
+export async function complete(auth, options) {
+    const { body, key } = options;
+    if (!body.authorization)
+        // The request's own `accessKey`, so a key that the library generates keeps its material.
+        return await authorize(auth, { ...options.request, userId: body.user.id });
+    try {
+        const signed = 'step' in body.authorization
+            ? await Api.json(await sign(auth, {
+                getFn: options.request.getFn,
+                json: options.authorize,
+                step: body.authorization,
+            }))
+            : body.authorization;
+        const authorization = key
+            ? Api.authorization(signed, key)
+            : Api.withoutKey(signed);
+        if (authorization.user.id !== body.user.id)
+            throw sessionChanged();
+        return {
+            authorization,
+            upgradeAvailable: signed.upgrade_available === true,
+        };
+    }
+    catch (error) {
+        return Api.signedIn(error);
+    }
+}
+/**
+ * Returns the key, or none with `key: false`, and the authorization request that a sign-in sends:
+ * an emailed-code sign-in with its code, and a passkey sign-in with its options.
+ */
+export async function prepare(auth, options) {
+    const key = options.key === false
+        ? undefined
+        : await AccessKey.resolve(options.accessKey);
+    return {
+        authorize: request(auth, {
+            accessKey: key?.accessKey,
+            challenge: options.challenge,
+            permissions: options.permissions,
+        }),
+        key,
+    };
+}
+/**
+ * Reads the JSON response of a sign-in that carried the authorization request. A refusal with the
+ * `Tempo-Id-Signed-In` header came after the session started, so it is marked `signedIn`.
+ */
+export async function read(response) {
+    try {
+        return await Api.json(response);
+    }
+    catch (error) {
+        if (response.headers.get('Tempo-Id-Signed-In') === 'true')
+            return Api.signedIn(error);
+        throw error;
+    }
+}
+/**
+ * Sends `POST /v1/authorize` with `json`. For a request with a key, on a page that runs passkey
+ * ceremonies, it requests the passkey step, signs it with {@link sign}, and returns the repeated
+ * request's response. Otherwise it returns the response of the one request.
+ */
+export async function post(auth, options) {
+    const { getFn, json, passkey = true } = options;
+    const response = await Api.post(auth, '/v1/authorize', {
+        json: {
+            ...json,
+            ...(passkey && steps(json, { getFn }) ? { passkey: true } : {}),
+        },
+    });
+    if (!response.ok)
+        return response;
+    // A successful response is the authorization or the step, which Tempo ID's schema validates.
+    const body = (await response.clone().json());
+    if (!('step' in body))
+        return response;
+    const signed = await sign(auth, { getFn, json, step: body });
+    if (signed.ok)
+        return signed;
+    // A session that ended during the ceremony reads as a missing session, as on the first request.
+    // Any other refusal, such as `webauthn_rejected`, which also has status 401, throws its reason.
+    const refused = (await signed
+        .clone()
+        .json()
+        .catch(() => ({})));
+    if (refused.reason !== 'session_required')
+        await Api.json(signed);
+    return signed;
+}
+/**
+ * Signs the options of the passkey `step` with the passkey on the page, and repeats
+ * `POST /v1/authorize` with the assertion and the step's expiry. Returns that response. A failed
+ * ceremony, such as a dismissed prompt or a passkey that this device does not hold, throws
+ * `webauthn_required`, so the app can authorize through a redirect.
+ */
+export async function sign(auth, options) {
+    const { getFn, json, step } = options;
+    const deserialized = Authentication.deserializeOptions(step.step.options);
+    const signed = await Authentication.sign(
+    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+    getFn ? { ...deserialized, getFn } : deserialized).catch((error) => {
+        throw new RequestError({
+            cause: error,
+            code: 'interaction_required',
+            message: "Passkey ceremony failed: the account's passkey did not sign the key on this page. Authorize through a redirect, whose approval page signs it.",
+            reason: 'webauthn_required',
+            status: 0,
+        });
+    });
+    const assertion = Authentication.serializeResponse(signed);
+    // The step's expiry keeps the digest that the passkey signed, in place of a new default.
+    return await Api.post(auth, '/v1/authorize', {
+        json: {
+            ...json,
+            ...(json.key_authorization
+                ? {
+                    key_authorization: {
+                        ...json.key_authorization,
+                        expiry: step.expiry,
+                    },
+                }
+                : {}),
+            passkey: { assertion },
+        },
+    });
+}
+/**
+ * Returns whether a request asks for the passkey step: it carries a key, and the page runs passkey
+ * ceremonies, through `getFn` or `navigator.credentials`.
+ */
+export function steps(json, options) {
+    if (!json.key_authorization)
+        return false;
+    return (options.getFn !== undefined ||
+        globalThis.navigator?.credentials !== undefined);
+}
+/** Returns the refusal of an authorization for another user than the sign-in's. */
+function sessionChanged() {
+    return new RequestError({
+        code: 'invalid_request',
+        message: 'Session changed: another sign-in replaced this one before the authorization. Sign in again.',
+        reason: 'session_changed',
+        status: 409,
+    });
+}
+//# sourceMappingURL=headless.js.map

package/dist/client/internal/headless.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless.js","sourceRoot":"","sources":["../../../src/client/internal/headless.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAA;AAExD,OAAO,EAAa,YAAY,EAAE,MAAM,YAAY,CAAA;AAGpD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AActC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAU,EACV,OAA0B;IAE1B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IACjD,oGAAoG;IACpG,IAAI,CAAC;QACH,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,GAAG;YACL,MAAM,GAAG,CAAC,IAAI,CACZ,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE;gBAClC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnC,CAAC,CACH,CAAA;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CACzB,MAAM,IAAI,CAAC,IAAI,EAAE;YACf,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBAClB,SAAS,EAAE,GAAG,EAAE,SAAS;gBACzB,SAAS;gBACT,WAAW;aACZ,CAAC;SACH,CAAC,CACH,CAAA;QACD,MAAM,aAAa,GAAG,GAAG;YACvB,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM;YAAE,MAAM,cAAc,EAAE,CAAA;QACpE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAA;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC;AAmBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAU,EACV,OAAyB;IAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAI,CAAC,IAAI,CAAC,aAAa;QACrB,yFAAyF;QACzF,OAAO,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,GACV,MAAM,IAAI,IAAI,CAAC,aAAa;YAC1B,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CACZ,MAAM,IAAI,CAAC,IAAI,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;gBAC5B,IAAI,EAAE,OAAO,CAAC,SAAS;gBACvB,IAAI,EAAE,IAAI,CAAC,aAAa;aACzB,CAAC,CACH;YACH,CAAC,CAAC,IAAI,CAAC,aAAa,CAAA;QACxB,MAAM,aAAa,GAAG,GAAG;YACvB,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,cAAc,EAAE,CAAA;QAClE,OAAO;YACL,aAAa;YACb,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,KAAK,IAAI;SACpD,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC;AAuBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAU,EAAE,OAAwB;IAChE,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE;YACvB,SAAS,EAAE,GAAG,EAAE,SAAS;YACzB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,GAAG;KACJ,CAAA;AACH,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAQ,QAAkB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAQ,QAAQ,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM;YACvD,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU,EAAE,OAAqB;IAC1D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE;QACrD,IAAI,EAAE;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE;KACF,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAA;IACjC,6FAA6F;IAC7F,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAwB,CAAA;IACnE,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC5B,gGAAgG;IAChG,gGAAgG;IAChG,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM;SAC1B,KAAK,EAAE;SACP,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2B,CAAA;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB;QAAE,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjE,OAAO,MAAM,CAAA;AACf,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAU,EAAE,OAAqB;IAC1D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACrC,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI;IACtC,qGAAqG;IACrG,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAY,CAAC,CAAC,CAAC,YAAY,CAC7D,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACzB,MAAM,IAAI,YAAY,CAAC;YACrB,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EACL,+IAA+I;YACjJ,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,CAAC;SACV,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,cAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1D,yFAAyF;IACzF,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE;QAC3C,IAAI,EAAE;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,IAAI,CAAC,iBAAiB;gBACxB,CAAC,CAAC;oBACE,iBAAiB,EAAE;wBACjB,GAAG,IAAI,CAAC,iBAAiB;wBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB;KACF,CAAC,CAAA;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,KAAK,CACnB,IAAgC,EAChC,OAAoC;IAEpC,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAA;IACzC,OAAO,CACL,OAAO,CAAC,KAAK,KAAK,SAAS;QAC3B,UAAU,CAAC,SAAS,EAAE,WAAW,KAAK,SAAS,CAChD,CAAA;AACH,CAAC;AAeD,mFAAmF;AACnF,SAAS,cAAc;IACrB,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EACL,6FAA6F;QAC/F,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,GAAG;KACZ,CAAC,CAAA;AACJ,CAAC"}

package/dist/client/internal/indexedDb.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The default `storage` in a browser. IndexedDB keeps a non-extractable `CryptoKey` as it is.
+ * @module
+ */
+import type { Storage } from '../Storage.js';
+/** Opens a store in the page's IndexedDB. */
+export declare function create(): Storage;
+//# sourceMappingURL=indexedDb.d.ts.map

package/dist/client/internal/indexedDb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDb.d.ts","sourceRoot":"","sources":["../../../src/client/internal/indexedDb.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C,6CAA6C;AAC7C,wBAAgB,MAAM,IAAI,OAAO,CAgChC"}

package/dist/client/internal/indexedDb.js

@@ -0,0 +1,32 @@
+/** Opens a store in the page's IndexedDB. */
+export function create() {
+    const database = new Promise((resolve, reject) => {
+        const request = indexedDB.open('tempo-id');
+        request.onupgradeneeded = () => request.result.createObjectStore(store);
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+    /** Runs one request against the store, and resolves with its result. */
+    async function run(mode, fn) {
+        const objectStore = (await database)
+            .transaction(store, mode)
+            .objectStore(store);
+        return new Promise((resolve, reject) => {
+            const request = fn(objectStore);
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+        });
+    }
+    return {
+        getItem: (key) => run('readonly', (objectStore) => objectStore.get(key)),
+        async removeItem(key) {
+            await run('readwrite', (objectStore) => objectStore.delete(key));
+        },
+        async setItem(key, value) {
+            await run('readwrite', (objectStore) => objectStore.put(value, key));
+        },
+    };
+}
+/** The object store that holds every value. */
+const store = 'store';
+//# sourceMappingURL=indexedDb.js.map

package/dist/client/internal/indexedDb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"indexedDb.js","sourceRoot":"","sources":["../../../src/client/internal/indexedDb.ts"],"names":[],"mappings":"AAOA,6CAA6C;AAC7C,MAAM,UAAU,MAAM;IACpB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1C,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACvE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,wEAAwE;IACxE,KAAK,UAAU,GAAG,CAChB,IAAwB,EACxB,EAAsD;QAEtD,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC;aACjC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC;aACxB,WAAW,CAAC,KAAK,CAAC,CAAA;QACrB,OAAO,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,CAAA;YAC/B,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/C,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxE,KAAK,CAAC,UAAU,CAAC,GAAG;YAClB,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAClE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK;YACtB,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QACtE,CAAC;KACF,CAAA;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,KAAK,GAAG,OAAO,CAAA"}

package/dist/client/internal/request.d.ts

@@ -0,0 +1,56 @@
+import type { Account } from 'viem/tempo';
+import type { Auth } from '../Auth.js';
+import type { Permissions } from '../Permissions.js';
+/** Returns the authorization request, with a key authorization request when `accessKey` is set. */
+export declare function request(auth: Auth, options: {
+    /** The key to authorize, if any. */
+    accessKey?: Account.Account | undefined;
+    /** The Tempo Account the key acts for, in place of the one `accessKey` names. */
+    account?: `0x${string}` | undefined;
+    /** A message that the key's witness binds. */
+    challenge?: string | undefined;
+    permissions?: Permissions | undefined;
+}): {
+    challenge?: string;
+    client_id: string;
+    key_authorization?: {
+        account?: `0x${string}`;
+        address: `0x${string}`;
+        chainId: `0x${string}`;
+        expiry: number | undefined;
+        keyType: "p256" | "secp256k1" | "webAuthn";
+        limits: {
+            limit: `0x${string}`;
+            period?: number;
+            token: `0x${string}`;
+        }[] | undefined;
+        scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
+    };
+    redirect_uri: string;
+    scope: string;
+    skip_upgrade?: boolean;
+};
+/**
+ * Returns the key authorization request. An access key account names its Tempo Account, and a plain
+ * key leaves the choice to Tempo ID.
+ */
+export declare function keyAuthorization(auth: Auth, options: {
+    /** The key to authorize. */
+    accessKey: Account.Account;
+    /** The Tempo Account the key acts for, in place of the one `accessKey` names. */
+    account?: `0x${string}` | undefined;
+    permissions?: Permissions | undefined;
+}): {
+    account?: `0x${string}`;
+    address: `0x${string}`;
+    chainId: `0x${string}`;
+    expiry: number | undefined;
+    keyType: "p256" | "secp256k1" | "webAuthn";
+    limits: {
+        limit: `0x${string}`;
+        period?: number;
+        token: `0x${string}`;
+    }[] | undefined;
+    scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
+};
+//# sourceMappingURL=request.d.ts.map

package/dist/client/internal/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/client/internal/request.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,mGAAmG;AACnG,wBAAgB,OAAO,CACrB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;IACP,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,iFAAiF;IACjF,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;IACnC,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CACtC;;;;;;;;;;;;;;;;;;;EAgBF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;IACP,4BAA4B;IAC5B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;IAC1B,iFAAiF;IACjF,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;IACnC,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CACtC;;;;;;;;;;;;EAmBF"}