@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/Authorize.d.ts

@@ -0,0 +1,526 @@
+import { z } from 'zod';
+import * as Apps from './Apps.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as KeyAuthorization from './KeyAuthorization.js';
+import * as Validation from './Validation.js';
+declare const InvalidOriginError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "unauthorized_client";
+            reason: "invalid_origin";
+        };
+    };
+    readonly reason: "invalid_origin";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** A headless request came from an origin that its redirect URI does not allow. */
+export declare class InvalidOriginError extends InvalidOriginError_base {
+    readonly name = "Authorize.InvalidOriginError";
+}
+declare const RejectedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "rejected";
+        };
+    };
+    readonly reason: "rejected";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The request names no registered app or redirect URI, or the app may not authorize headlessly. */
+export declare class RejectedError extends RejectedError_base {
+    readonly name = "Authorize.RejectedError";
+    constructor(options?: RejectedError.Options);
+}
+export declare namespace RejectedError {
+    type Options = {
+        /** Replaces the default `error_description`. */
+        description?: string | undefined;
+    };
+}
+/** Zod schemas for headless authorization requests and their responses. */
+export declare namespace schema {
+    /** The tokens that a public app receives. */
+    const tokens: z.ZodObject<{
+        access_token: z.ZodString;
+        expires_in: z.ZodNumber;
+        id_token: z.ZodOptional<z.ZodString>;
+        refresh_token: z.ZodOptional<z.ZodString>;
+        token_type: z.ZodString;
+    }, z.core.$strip>;
+    /** A message whose EIP-191 hash becomes a key authorization's witness. */
+    const challenge: z.ZodOptional<z.ZodString>;
+    /** An app's headless authorization request. */
+    const request: z.ZodPipe<z.ZodObject<{
+        challenge: z.ZodOptional<z.ZodString>;
+        client_id: z.ZodString;
+        code_challenge: z.ZodOptional<z.ZodString>;
+        key_authorization: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+            account: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            address: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            chainId: z.ZodOptional<z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>>;
+            expiry: z.ZodOptional<z.ZodNumber>;
+            keyType: z.ZodOptional<z.ZodEnum<{
+                p256: "p256";
+                secp256k1: "secp256k1";
+                webAuthn: "webAuthn";
+            }>>;
+            limits: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                limit: z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>;
+                period: z.ZodOptional<z.ZodNumber>;
+                token: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            publicKey: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            scopes: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                address: z.ZodTemplateLiteral<`0x${string}`>;
+                recipients: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodTemplateLiteral<`0x${string}`>>>>;
+                selector: z.ZodOptional<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodString]>>;
+            }, z.core.$strip>>>>;
+        }, z.core.$strip>, z.ZodTransform<{
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }, {
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        }>>>;
+        redirect_uri: z.ZodURL;
+        scope: z.ZodOptional<z.ZodString>;
+        skip_upgrade: z.ZodOptional<z.ZodBoolean>;
+        state: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodTransform<{
+        challenge?: string | undefined;
+        client_id: string;
+        code_challenge?: string | undefined;
+        key_authorization?: ({
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }) | undefined;
+        redirect_uri: string;
+        scope?: string | undefined;
+        skip_upgrade?: boolean | undefined;
+        state?: string | undefined;
+    }, {
+        challenge?: string | undefined;
+        client_id: string;
+        code_challenge?: string | undefined;
+        key_authorization?: ({
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }) | undefined;
+        redirect_uri: string;
+        scope?: string | undefined;
+        skip_upgrade?: boolean | undefined;
+        state?: string | undefined;
+    }>>;
+    /** The key of a redirect's `/authorize` query, with its `challenge` bound as the witness. */
+    const redirect: z.ZodPipe<z.ZodObject<{
+        challenge: z.ZodOptional<z.ZodString>;
+        key_authorization: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+            account: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            address: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            chainId: z.ZodOptional<z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>>;
+            expiry: z.ZodOptional<z.ZodNumber>;
+            keyType: z.ZodOptional<z.ZodEnum<{
+                p256: "p256";
+                secp256k1: "secp256k1";
+                webAuthn: "webAuthn";
+            }>>;
+            limits: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                limit: z.ZodCodec<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodBigInt]>, z.ZodBigInt>;
+                period: z.ZodOptional<z.ZodNumber>;
+                token: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            publicKey: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+            scopes: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                address: z.ZodTemplateLiteral<`0x${string}`>;
+                recipients: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodTemplateLiteral<`0x${string}`>>>>;
+                selector: z.ZodOptional<z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodString]>>;
+            }, z.core.$strip>>>>;
+        }, z.core.$strip>, z.ZodTransform<{
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }, {
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        }>>>;
+    }, z.core.$strip>, z.ZodTransform<({
+        account?: `0x${string}` | undefined;
+        address?: `0x${string}` | undefined;
+        chainId?: bigint | undefined;
+        expiry?: number | undefined;
+        keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+        limits?: readonly {
+            limit: bigint;
+            period?: number | undefined;
+            token: `0x${string}`;
+        }[] | undefined;
+        publicKey?: `0x${string}` | undefined;
+        scopes?: readonly {
+            address: `0x${string}`;
+            recipients?: readonly `0x${string}`[] | undefined;
+            selector?: string | undefined;
+        }[] | undefined;
+    } & {
+        chainId: bigint;
+        expiry: number;
+        limits: NonNullable<readonly {
+            limit: bigint;
+            period?: number | undefined;
+            token: `0x${string}`;
+        }[] | undefined>;
+        scopes: NonNullable<readonly {
+            address: `0x${string}`;
+            recipients?: readonly `0x${string}`[] | undefined;
+            selector?: string | undefined;
+        }[] | undefined>;
+        witness?: import("ox/Hex").Hex | undefined;
+    }) | undefined, {
+        challenge?: string | undefined;
+        key_authorization?: ({
+            account?: `0x${string}` | undefined;
+            address?: `0x${string}` | undefined;
+            chainId?: bigint | undefined;
+            expiry?: number | undefined;
+            keyType?: "p256" | "secp256k1" | "webAuthn" | undefined;
+            limits?: readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined;
+            publicKey?: `0x${string}` | undefined;
+            scopes?: readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined;
+        } & {
+            chainId: bigint;
+            expiry: number;
+            limits: NonNullable<readonly {
+                limit: bigint;
+                period?: number | undefined;
+                token: `0x${string}`;
+            }[] | undefined>;
+            scopes: NonNullable<readonly {
+                address: `0x${string}`;
+                recipients?: readonly `0x${string}`[] | undefined;
+                selector?: string | undefined;
+            }[] | undefined>;
+            witness?: import("ox/Hex").Hex | undefined;
+        }) | undefined;
+    }>>;
+    /** What a headless authorization returns: a code or tokens, with any signed key. */
+    const response: z.ZodObject<{
+        account: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+        code: z.ZodOptional<z.ZodString>;
+        key_authorization: z.ZodOptional<z.ZodObject<{
+            account: z.ZodOptional<z.ZodNullable<z.ZodTemplateLiteral<`0x${string}`>>>;
+            allowedCalls: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                selectorRules: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                    recipients: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodTemplateLiteral<`0x${string}`>>>>;
+                    selector: z.ZodTemplateLiteral<`0x${string}`>;
+                }, z.core.$strip>>>>;
+                target: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            chainId: z.ZodTemplateLiteral<`0x${string}`>;
+            expiry: z.ZodOptional<z.ZodNullable<z.ZodTemplateLiteral<`0x${string}`>>>;
+            keyId: z.ZodTemplateLiteral<`0x${string}`>;
+            keyType: z.ZodString;
+            limits: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                limit: z.ZodTemplateLiteral<`0x${string}`>;
+                period: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                token: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>>>>;
+            signature: z.ZodUnion<readonly [z.ZodTemplateLiteral<`0x${string}`>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                r: z.ZodTemplateLiteral<`0x${string}`>;
+                s: z.ZodTemplateLiteral<`0x${string}`>;
+                type: z.ZodLiteral<"secp256k1">;
+                v: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                yParity: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>, z.ZodObject<{
+                preHash: z.ZodBoolean;
+                pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                r: z.ZodTemplateLiteral<`0x${string}`>;
+                s: z.ZodTemplateLiteral<`0x${string}`>;
+                type: z.ZodLiteral<"p256">;
+            }, z.core.$strip>, z.ZodObject<{
+                pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                r: z.ZodTemplateLiteral<`0x${string}`>;
+                s: z.ZodTemplateLiteral<`0x${string}`>;
+                type: z.ZodLiteral<"webAuthn">;
+                webauthnData: z.ZodTemplateLiteral<`0x${string}`>;
+            }, z.core.$strip>], "type">, z.ZodObject<{
+                keyId: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                signature: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    r: z.ZodTemplateLiteral<`0x${string}`>;
+                    s: z.ZodTemplateLiteral<`0x${string}`>;
+                    type: z.ZodLiteral<"secp256k1">;
+                    v: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+                    yParity: z.ZodTemplateLiteral<`0x${string}`>;
+                }, z.core.$strip>, z.ZodObject<{
+                    preHash: z.ZodBoolean;
+                    pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                    pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                    r: z.ZodTemplateLiteral<`0x${string}`>;
+                    s: z.ZodTemplateLiteral<`0x${string}`>;
+                    type: z.ZodLiteral<"p256">;
+                }, z.core.$strip>, z.ZodObject<{
+                    pubKeyX: z.ZodTemplateLiteral<`0x${string}`>;
+                    pubKeyY: z.ZodTemplateLiteral<`0x${string}`>;
+                    r: z.ZodTemplateLiteral<`0x${string}`>;
+                    s: z.ZodTemplateLiteral<`0x${string}`>;
+                    type: z.ZodLiteral<"webAuthn">;
+                    webauthnData: z.ZodTemplateLiteral<`0x${string}`>;
+                }, z.core.$strip>], "type">;
+                type: z.ZodLiteral<"keychain">;
+                userAddress: z.ZodTemplateLiteral<`0x${string}`>;
+                version: z.ZodOptional<z.ZodEnum<{
+                    v1: "v1";
+                    v2: "v2";
+                }>>;
+            }, z.core.$strip>]>;
+            witness: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+        }, z.core.$strip>>;
+        state: z.ZodOptional<z.ZodString>;
+        tokens: z.ZodOptional<z.ZodObject<{
+            access_token: z.ZodString;
+            expires_in: z.ZodNumber;
+            id_token: z.ZodOptional<z.ZodString>;
+            refresh_token: z.ZodOptional<z.ZodString>;
+            token_type: z.ZodString;
+        }, z.core.$strip>>;
+        upgrade_available: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strip>;
+}
+/** An app's headless authorization request. */
+export type Request = z.output<typeof schema.request>;
+/**
+ * Returns why Tempo ID refuses a headless `request`, or `undefined`. The request must meet each rule:
+ *
+ * - The app is a registered first-party web app, and its page calls from the redirect URI's origin.
+ * - A key comes from an app without a client secret, and fits the headless ceiling. A challenge
+ *   needs `tempo-id:sign`.
+ */
+export declare function check(request: Request, options: check.Options): ErrorResponse.Instance<typeof check.errors> | undefined;
+export declare namespace check {
+    type Options = {
+        /** The app that `client_id` names, if any. */
+        app: Pick<Apps.App, 'firstParty' | 'redirectUris' | 'secret' | 'sign' | 'type'> | undefined;
+        /** The request's `Origin`, if any. */
+        origin: string | undefined;
+    };
+    /** The refusals `check` returns. Its return type admits no other. */
+    const errors: readonly [typeof KeyAuthorization.DuplicateLimitError, typeof KeyAuthorization.DuplicateScopeError, typeof KeyAuthorization.EmptyLimitsError, typeof KeyAuthorization.EmptyScopesError, typeof KeyAuthorization.ExpiryPassedError, typeof KeyAuthorization.InvalidChainError, typeof KeyAuthorization.InvalidExpiryError, typeof KeyAuthorization.InvalidPeriodError, typeof KeyAuthorization.InvalidPublicKeyError, typeof KeyAuthorization.InvalidRecipientsError, typeof KeyAuthorization.MissingKeyError, typeof KeyAuthorization.MissingRecipientsError, typeof KeyAuthorization.ScopeWithoutLimitError, typeof KeyAuthorization.UnsupportedCallError, typeof KeyAuthorization.UnsupportedTokenError, typeof KeyAuthorization.ExpiryExceedsMaximumError, typeof KeyAuthorization.LimitExceedsMaximumError, typeof KeyAuthorization.ChallengeNotPermittedError, typeof InvalidOriginError, typeof RejectedError];
+}
+/**
+ * Returns why Tempo ID refuses `key` in a redirect's authorization request, or `undefined`. The
+ * approval page shows the key, so the headless ceiling does not apply. The request needs a PKCE
+ * challenge, whose verifier receives the key.
+ */
+export declare function checkKey(options: checkKey.Options): ErrorResponse.Instance<typeof checkKey.errors> | undefined;
+export declare namespace checkKey {
+    type Options = {
+        /** The app that `clientId` names, if any. */
+        app: Pick<Apps.App, 'sign'> | undefined;
+        /** The requesting app's client ID. */
+        clientId: string;
+        /** The request's `code_challenge`, if any. */
+        codeChallenge: string | null | undefined;
+        /** The key that the request carries. */
+        key: KeyAuthorization.Key;
+        /** The request's parameters, with the key as the app sent it. */
+        query: URLSearchParams;
+    };
+    /** The refusals `checkKey` returns. Its return type admits no other. */
+    const errors: readonly [typeof KeyAuthorization.DuplicateLimitError, typeof KeyAuthorization.DuplicateScopeError, typeof KeyAuthorization.EmptyLimitsError, typeof KeyAuthorization.EmptyScopesError, typeof KeyAuthorization.ExpiryPassedError, typeof KeyAuthorization.InvalidChainError, typeof KeyAuthorization.InvalidExpiryError, typeof KeyAuthorization.InvalidPeriodError, typeof KeyAuthorization.InvalidPublicKeyError, typeof KeyAuthorization.InvalidRecipientsError, typeof KeyAuthorization.MissingKeyError, typeof KeyAuthorization.MissingRecipientsError, typeof KeyAuthorization.ScopeWithoutLimitError, typeof KeyAuthorization.UnsupportedCallError, typeof KeyAuthorization.UnsupportedTokenError, typeof KeyAuthorization.MissingPermissionsError, typeof KeyAuthorization.ChallengeNotPermittedError, typeof RejectedError];
+}
+/**
+ * Returns the key of a redirect's `query`, with its `challenge` bound as the witness, or `undefined`
+ * without one. Returns `Validation.InvalidFieldError` for an invalid key or a repeated parameter, so
+ * a page cannot show one value and approve another.
+ */
+export declare function fromQuery(query: URLSearchParams): KeyAuthorization.Key | Validation.InvalidFieldError | undefined;
+/**
+ * Returns `parameters` with `consent` added to `prompt` when they carry `key_authorization`, so the
+ * approval page shows the key. A first-party app's key without an expiry gains the default, so
+ * approval signs the expiry that the page shows.
+ */
+export declare function prepare(parameters: URLSearchParams): URLSearchParams;
+export {};
+//# sourceMappingURL=Authorize.d.ts.map

package/dist/internal/Authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorize.d.ts","sourceRoot":"","sources":["../../src/internal/Authorize.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAE7C,mFAAmF;AACnF,qBAAa,kBAAmB,SAAQ,uBAAsC;IAC5E,SAAkB,IAAI,kCAAiC;CACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,oGAAoG;AACpG,qBAAa,aAAc,SAAQ,kBAAgC;IACjE,SAAkB,IAAI,6BAA4B;IAElD,YAAY,OAAO,GAAE,aAAa,CAAC,OAAY,EAM9C;CACF;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,KAAK,OAAO,GAAG;QACb,gDAAgD;QAChD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACjC,CAAA;CACF;AAED,2EAA2E;AAC3E,yBAAiB,MAAM,CAAC;IACtB,6CAA6C;IACtC,MAAM,MAAM;;;;;;qBAgCqD,CAAA;IAExE,0EAA0E;IACnE,MAAM,SAAS,4BASlB,CAAA;IAEJ,+CAA+C;IACxC,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFhB,CAAA;IAEJ,6FAA6F;IACtF,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAalB,CAAA;IAEH,oFAAoF;IAC7E,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAgCjB,CAAA;CACL;AAED,+CAA+C;AAC/C,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;AAErD;;;;;;GAMG;AACH,wBAAgB,KAAK,CACnB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,KAAK,CAAC,OAAO,GACrB,aAAa,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,CA2CzD;AAED,yBAAiB,KAAK,CAAC;IACrB,KAAY,OAAO,GAAG;QACpB,8CAA8C;QAC9C,GAAG,EACC,IAAI,CACF,IAAI,CAAC,GAAG,EACR,YAAY,GAAG,cAAc,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAC3D,GACD,SAAS,CAAA;QACb,sCAAsC;QACtC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;IAED,qEAAqE;IAC9D,MAAM,MAAM,s3BAKT,CAAA;CACX;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,aAAa,CAAC,QAAQ,CAAC,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAkB5D;AAED,yBAAiB,QAAQ,CAAC;IACxB,KAAY,OAAO,GAAG;QACpB,6CAA6C;QAC7C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;QACvC,sCAAsC;QACtC,QAAQ,EAAE,MAAM,CAAA;QAChB,8CAA8C;QAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QACxC,wCAAwC;QACxC,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAA;QACzB,iEAAiE;QACjE,KAAK,EAAE,eAAe,CAAA;KACvB,CAAA;IAED,wEAAwE;IACjE,MAAM,MAAM,uyBAKT,CAAA;CACX;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,eAAe,GACrB,gBAAgB,CAAC,GAAG,GAAG,UAAU,CAAC,iBAAiB,GAAG,SAAS,CAoBjE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAAE,eAAe,mBA+BlD"}