@tempoxyz/id 0.0.1 → 0.0.2

package/src/internal/KeyAuthorization.ts

@@ -232,7 +232,7 @@ const sent = z.object({
   /** The Tempo Account. Defaults to the account selected at sign-in, or the oldest. */
   account: z.optional(address).meta({
     description:
-      'The Tempo Account the key acts for. Defaults to the account selected at sign-in, or else the oldest account.',
+      'The Tempo Account that the key acts for. Defaults to the account selected for the app, else the oldest.',
     examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
   }),
   /** The access key's address. `publicKey` may stand in for it. */
@@ -249,7 +249,7 @@ const sent = z.object({
   /** Unix seconds. Defaults to a year from now, for a first-party app. */
   expiry: z.optional(z.number()).meta({
     description:
-      'When the key expires, in Unix seconds. Defaults to one year after the request for a first-party app, and a third-party app must name it.',
+      'When the key expires, in Unix seconds. Defaults to one year for a first-party app, and is required for a third-party app.',
     examples: [1893456000],
   }),
   /** Defaults to `secp256k1`. */
@@ -266,11 +266,11 @@ const sent = z.object({
           z.object({
             limit: bigint({ examples: ['0x989680'] }).meta({
               description:
-                'The most of the token the key may spend, in base units, as a hex quantity. Applies per period when `period` is set.',
+                'The maximum amount of the token that the key can spend, in base units, as a hex quantity. With `period`, the maximum for each period.',
             }),
             period: z.optional(z.number()).meta({
               description:
-                'Seconds after which the limit resets. Omitted or 0 for a one-time limit.',
+                'The seconds after which the limit resets. Absent or 0 for a one-time limit.',
               examples: [86400],
             }),
             token: address.meta({
@@ -283,12 +283,12 @@ const sent = z.object({
     )
     .meta({
       description:
-        'The spending limit on each token. Defaults to the cap of each token that the scopes call, else of OUSD, for a first-party app, and a third-party app must name them.',
+        'The spending limit for each token. Defaults to the headless ceiling for a first-party app, and is required for a third-party app.',
     }),
   /** The access key's public key. */
   publicKey: z.optional(hex).meta({
     description:
-      "The access key's uncompressed public key, as hex. Tempo ID derives `address` from it when `address` is absent.",
+      "The access key's uncompressed public key, as hex. Required without `address`.",
     examples: [
       '0x0438ef39ed22456a6956f380ebc18c50bd18c0402658bc52903817cc8a1e8b2f7ed1da68afc7f343c1debc44c04ac60e62e96bbb261d2226e7a7b96e64fd0f0765',
     ],
@@ -301,17 +301,17 @@ const sent = z.object({
           z.object({
             address: address.meta({
               description:
-                'The contract the key may call, such as a TIP-20 token or the TIP-1034 channel reserve at `0x4d50500000000000000000000000000000000000`.',
+                'The contract that the key can call, such as a TIP-20 token or the TIP-1034 channel reserve.',
               examples: ['0x20c0000000000000000000006a37DA5C996874BE'],
             }),
             recipients: z.optional(z.array(address).readonly()).meta({
               description:
-                'The only addresses the call may name as recipient or spender. Required for `approve`, and refused on any call but `transfer`, `transferWithMemo`, and `approve` on a TIP-20 token.',
+                'The only recipients or spenders that the call can name. Required for `approve`, and valid only for `transfer`, `transferWithMemo`, and `approve`.',
               examples: [['0xff5deded16eb46018387144ff8bf41f26afb41af']],
             }),
             selector: z.optional(z.union([hex, z.string().max(256)])).meta({
               description:
-                'The function the key may call, as a 4-byte selector or a function signature. Absent, the key may call any function on the contract, which a TIP-20 token refuses, and the target takes no other scope. A headless flow accepts only `transfer`, `transferWithMemo`, and `approve` on a listed token, and `open` and `topUp` on the channel reserve, unless the app holds `tempo-id:sign`.',
+                'The function that the key can call, as a 4-byte selector or a function signature. Absent to allow any function, which a TIP-20 token refuses.',
               examples: ['0xa9059cbb', 'transfer(address,uint256)'],
             }),
           }),
@@ -320,7 +320,7 @@ const sent = z.object({
     )
     .meta({
       description:
-        'The calls the key may make. Defaults to `transfer` and `transferWithMemo` on each token that the key limits for a first-party app, and a third-party app must name them.',
+        'The calls that the key can make. Defaults to `transfer` and `transferWithMemo` on each limited token for a first-party app, and is required for a third-party app.',
     }),
 })
 
@@ -335,7 +335,7 @@ export namespace schema {
   /** An app's key authorization request, with the headless ceiling as its defaults. */
   export const request = z.optional(sent.transform(defaults)).meta({
     description:
-      "A key authorization for the app's own key: the shape of the Accounts SDK's `wallet_connect` `authorizeAccessKey` capability. Omitted fields default to the headless ceiling.",
+      "A request to authorize the app's own access key on the user's Tempo Account, in the shape of the Accounts SDK's `authorizeAccessKey` capability.",
     id: 'KeyAuthorizationRequest',
   })
 
@@ -343,8 +343,7 @@ export namespace schema {
   export const description = z
     .object({
       account: address.optional().meta({
-        description:
-          'The Tempo Account the request names. Absent when the request names none.',
+        description: 'The Tempo Account that the request names, if any.',
         examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
       }),
       calls: z
@@ -352,7 +351,7 @@ export namespace schema {
           z.object({
             call: z.enum(['open', 'topUp']).meta({
               description:
-                'The call on the channel reserve, which MPP sessions pay through: `open` starts a payment channel, and `topUp` adds to its deposit.',
+                'The call on the channel reserve: `open` starts a payment channel, and `topUp` adds to its deposit.',
               examples: ['open', 'topUp'],
             }),
           }),
@@ -360,7 +359,7 @@ export namespace schema {
         .readonly()
         .meta({
           description:
-            'The calls on the channel reserve, in the order of the scopes, which the screens list beside the limits. Transfers and approvals spend within the limits, so none is listed.',
+            'The calls on the channel reserve, in the order of the scopes. Transfers and approvals are not listed, since the limits cover them.',
         }),
       expiry: z.number().meta({
         description: 'Unix seconds.',
@@ -374,8 +373,7 @@ export namespace schema {
               examples: ['1000'],
             }),
             currency: z.string().meta({
-              description:
-                "The tokens' currency, such as `USD`. A yield-bearing token names its own.",
+              description: "The tokens' currency, such as `USD`.",
               examples: ['USD'],
             }),
             period: z
@@ -383,7 +381,7 @@ export namespace schema {
               .optional()
               .meta({
                 description:
-                  'Seconds after which the amount resets. Omitted for a one-time limit.',
+                  'The seconds after which the amount resets. Absent for a one-time limit.',
                 examples: [86400],
               }),
             tokens: z
@@ -426,7 +424,7 @@ export namespace schema {
         .readonly()
         .meta({
           description:
-            'The calls that Tempo ID does not recognize, which the screens warn about. Empty when it recognizes every call.',
+            'The calls that Tempo ID does not recognize, which the screens warn about.',
         }),
     })
     .meta({
@@ -455,8 +453,7 @@ export namespace schema {
             description: 'A secp256k1 ECDSA signature.',
           }),
           v: hex.optional().meta({
-            description:
-              'The legacy recovery value, which `yParity` replaces. Absent in most envelopes.',
+            description: 'The legacy recovery value, which `yParity` replaces.',
             examples: ['0x1c'],
           }),
           yParity: hex.meta({
@@ -557,7 +554,7 @@ export namespace schema {
         .optional()
         .meta({
           description:
-            'The Tempo Account the key is bound to (TIP-1049). Absent or null when the key has no account binding.',
+            'The Tempo Account that the key is bound to (TIP-1049), or absent or `null`.',
           examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
         }),
       allowedCalls: z
@@ -572,7 +569,7 @@ export namespace schema {
                     .optional()
                     .meta({
                       description:
-                        'The only addresses the call may name as recipient or spender. Absent when any address may receive.',
+                        'The only recipients or spenders that the call can name. Absent to allow any address.',
                       examples: [
                         ['0xff5deded16eb46018387144ff8bf41f26afb41af'],
                       ],
@@ -588,7 +585,7 @@ export namespace schema {
               .optional()
               .meta({
                 description:
-                  'The functions the key may call on the target. Absent when the key may call any function on it.',
+                  'The functions that the key can call on the target. Absent to allow any function.',
               }),
             target: address.meta({
               description: 'The contract the key may call.',
@@ -600,7 +597,7 @@ export namespace schema {
         .optional()
         .meta({
           description:
-            'The calls the key may make. Absent when the key may make any call.',
+            'The calls that the key can make. Absent to allow any call.',
         }),
       chainId: hex.meta({
         description: 'The chain ID the key acts on, as a hex quantity.',
@@ -611,7 +608,7 @@ export namespace schema {
         .optional()
         .meta({
           description:
-            'When the key expires, in Unix seconds, as a hex quantity. Absent or null when the key never expires.',
+            'When the key expires, in Unix seconds, as a hex quantity. Absent or `null` if it never expires.',
           examples: ['0x6acdc1b4'],
         }),
       keyId: address.meta({
@@ -620,7 +617,7 @@ export namespace schema {
       }),
       keyType: z.string().meta({
         description:
-          'The signature scheme of the access key: `secp256k1`, `p256`, or `webAuthn`. The node names a configurable account key `multisig`.',
+          'The signature scheme of the access key, or `multisig` for a configurable account key.',
         examples: ['secp256k1'],
       }),
       limits: z
@@ -628,12 +625,12 @@ export namespace schema {
           z.object({
             limit: hex.meta({
               description:
-                'The most of the token the key may spend, in base units, as a hex quantity. Applies per period when `period` is set.',
+                'The maximum amount of the token that the key can spend, in base units, as a hex quantity. With `period`, the maximum for each period.',
               examples: ['0x989680'],
             }),
             period: hex.optional().meta({
               description:
-                'Seconds after which the limit resets, as a hex quantity. Absent or `0x0` for a one-time limit.',
+                'The seconds after which the limit resets, as a hex quantity. Absent or `0x0` for a one-time limit.',
               examples: ['0x15180'],
             }),
             token: address.meta({
@@ -646,7 +643,7 @@ export namespace schema {
         .optional()
         .meta({
           description:
-            'The spending limit on each token, or absent when spending is unlimited. An empty list allows no spending.',
+            'The spending limit for each token. Absent for no limit, and empty to allow no spending.',
         }),
       signature: z
         .union([
@@ -662,7 +659,7 @@ export namespace schema {
             .object({
               keyId: address.optional().meta({
                 description:
-                  'The address of the access key that signed. Recovered from `signature` when absent.',
+                  'The address of the access key that signed. Absent to recover it from `signature`.',
                 examples: ['0x624f27c462b885a83c698cac444a106a8c519e25'],
               }),
               signature: primitive.meta({

package/src/internal/OpenApi.ts

@@ -67,6 +67,40 @@ const info = {
   version: '0.0.0',
 } as const
 
+/**
+ * The document's route groups, in the order the reference lists them. Each description names the
+ * requests of the group's flow in order.
+ */
+const tags = [
+  {
+    description:
+      'Sign-in with an emailed code or a passkey, in two requests each. The first returns a code or WebAuthn options, and the second verifies it and sets the session cookie.',
+    name: 'Authenticate',
+  },
+  {
+    description:
+      'Authorizes an app for the signed-in user. The redirect flow starts at `GET /oauth2/authorize` and ends at `POST /oauth2/token`, and a first-party page can use `POST /v1/authorize` without a redirect.',
+    name: 'Authorization',
+  },
+  {
+    description:
+      'Authorizes a device without a browser (RFC 8628). The device requests codes, the user approves the user code on the device page, and the device polls `POST /oauth2/token`.',
+    name: 'Device grant',
+  },
+  {
+    description:
+      "The signed-in user's Tempo Accounts and passkeys. A passkey registers in three requests: the options, the new credential, and the new passkey's signature.",
+    name: 'Account',
+  },
+  {
+    description:
+      "The issuer's standard OAuth 2.0 and OpenID Connect endpoints.",
+    name: 'OAuth',
+  },
+  { description: "The Worker's status.", name: 'Health' },
+  { description: 'This document and its API reference.', name: 'Reference' },
+]
+
 /**
  * Returns the OpenAPI document for `app`, generated on the first call. The document is reused for
  * the life of the isolate, since routes do not change while it runs. Every refusal joins its
@@ -295,6 +329,7 @@ async function generate(app: Hono<any, any, any>) {
       },
       info,
       openapi: '3.1.0',
+      tags,
     },
   })
 }

package/src/internal/Owner.ts

@@ -11,6 +11,7 @@ import type { Account, AccountConfig } from 'viem/tempo'
 import { sql } from 'drizzle-orm'
 import type * as Auth from './Auth.js'
 import type * as ErrorResponse from './ErrorResponse.js'
+import type * as Log from './Log.js'
 import type * as Privy from './Privy.js'
 import type * as Realm from './Realm.js'
 import type * as Timing from './Timing.js'
@@ -78,6 +79,21 @@ export declare namespace Kind {
       type Options = {
         /** The database or transaction to read. */
         db: Realm.Database
+        /**
+         * How old, in seconds, a cached read of an upstream service, such as Privy, may be. Absent,
+         * a kind reads its upstream service.
+         */
+        maxAge?: number | undefined
+        /**
+         * Keeps background work alive after the response, such as a store in a cache. Absent, a
+         * kind waits for that work.
+         */
+        waitUntil?: ((promise: Promise<unknown>) => void) | undefined
+        /**
+         * Logs a recoverable problem with the request's details, such as a failure of a cache.
+         * Absent, a kind logs without them.
+         */
+        warn?: ((options: Log.Options) => void) | undefined
       }
     }
   }