@theoo/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Theoo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,81 @@
+# @theoo/sdk
+
+The client for [Theoo](https://github.com/) — smart accounts owned by a
+passkey that never leaves the user's device. No seed phrase, no extension, and
+no key on a server.
+
+```sh
+npm install @theoo/sdk
+```
+
+```ts
+import { Theoo } from "@theoo/sdk";
+import { browserPasskeys, LocalStorageTokenStore } from "@theoo/sdk/browser";
+
+const theoo = new Theoo({
+  baseUrl: "https://theoo.example.com",
+  apiKey: "theoo_pub_…",              // publishable: safe in a page
+  passkeys: browserPasskeys,
+  tokens: new LocalStorageTokenStore(),
+});
+
+await theoo.auth.begin({ provider: "email", destination: "you@example.com" });
+await theoo.auth.complete({ kind: "code", challengeId, code });
+await theoo.auth.enrolPasskey();      // this passkey now owns the account
+
+await theoo.me.operations.run({
+  kind: "call",
+  call: { to: "0x…", value: "0", data: "0x" },
+});
+```
+
+Works in browsers and on servers. React bindings are in
+[`@theoo/react`](https://www.npmjs.com/package/@theoo/react); native
+ones in
+[`@theoo/react-native`](https://www.npmjs.com/package/@theoo/react-native).
+
+Theoo is self-hosted: this package talks to a service you run. See the
+`docs/` directory of the repository for running one, the HTTP API, and the
+full SDK reference.
+
+## Security
+
+**Which key goes where.** A **publishable** key (`theoo_pub_…`) is meant to
+ship in a page: it reaches only the sign-in routes and the routes an end
+user's own bearer token already scopes to that user, and only from the origins
+its tenant registered. A **secret** key (`theoo_…`) can act for *any* of your
+users and must never reach a browser.
+
+**Where sessions are stored.** `LocalStorageTokenStore` keeps the access and
+refresh tokens in `localStorage`, which any script running on your page can
+read. If your app has an XSS hole, that hole reaches the session.
+
+It is worth being precise about what that does and does not mean. A stolen
+session can act as the user *within what a session is allowed to do* — read
+their account, start operations that then need a passkey. It **cannot** move
+funds or take the account: every operation is signed on the user's device by
+a passkey this package never sees and the server never holds. There is no
+seed phrase to steal and nothing to export.
+
+Choose accordingly:
+
+| Store | Use it when |
+| :--- | :--- |
+| `LocalStorageTokenStore` | The session should survive a reload. The usual choice. |
+| `MemoryTokenStore` | You would rather a reload sign the user out than leave a token readable by script. |
+| Your own `TokenStore` | You want the tokens somewhere else — a worker, an encrypted store, your own backend. |
+
+**Transport.** Every request sends the API key and, when acting for a user,
+a bearer token. So the client:
+
+* **refuses a plaintext `http://` base URL** unless it is loopback. Pass
+  `allowInsecureHttp: true` only for a server crossing a network you control.
+* **does not follow redirects** (`redirect: "error"`). The API never issues
+  one, and a redirect would hand `x-api-key` to whatever host it named.
+* **sends no cookies** (`credentials: "omit"`), so nothing here is a CSRF
+  target.
+* **logs nothing.** There are no `console` calls in this package, so no token
+  reaches a log by accident.
+
+**Dependencies.** This package has none. `@theoo/react` depends only on this
+one. Nothing third-party enters your bundle through Theoo.

package/dist/assurance.d.ts

@@ -0,0 +1,14 @@
+import type { AssuranceLevel, Caller } from "./types.js";
+/**
+ * How strongly a caller is authenticated *right now*.
+ *
+ * A step-up — proving possession again on the strongest factor the account
+ * has — raises a caller to `verified`, and that elevation decays. Reading
+ * `subject.aal` gives the base level and silently ignores whether the
+ * elevation has since gone stale, which is the wrong answer for anything
+ * worth gating.
+ *
+ * @param now Unix seconds. Defaults to this machine's clock.
+ */
+export declare function effectiveAssurance(caller: Caller, now?: number): AssuranceLevel;
+//# sourceMappingURL=assurance.d.ts.map

package/dist/assurance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance.d.ts","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAgC,GAAG,cAAc,CAMtG"}

package/dist/assurance.js

@@ -0,0 +1,20 @@
+/**
+ * How strongly a caller is authenticated *right now*.
+ *
+ * A step-up — proving possession again on the strongest factor the account
+ * has — raises a caller to `verified`, and that elevation decays. Reading
+ * `subject.aal` gives the base level and silently ignores whether the
+ * elevation has since gone stale, which is the wrong answer for anything
+ * worth gating.
+ *
+ * @param now Unix seconds. Defaults to this machine's clock.
+ */
+export function effectiveAssurance(caller, now = Math.floor(Date.now() / 1000)) {
+    const fresh = caller.subject.stepUpFreshUntil;
+    if (fresh !== null && fresh > now)
+        return "verified";
+    // A subject whose base level is already `verified` was elevated at some
+    // point and has no live step-up now, so it falls back to possession.
+    return caller.subject.aal === "verified" ? "possession" : caller.subject.aal;
+}
+//# sourceMappingURL=assurance.js.map

package/dist/assurance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assurance.js","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,UAAU,CAAC;IACrD,wEAAwE;IACxE,qEAAqE;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;AAC/E,CAAC"}

package/dist/base64url.d.ts

@@ -0,0 +1,4 @@
+/** base64url without padding, the WebAuthn JSON encoding. Works in browsers, Node and React Native. */
+export declare function encode(input: ArrayBuffer | Uint8Array): string;
+export declare function decode(input: string): Uint8Array;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../src/base64url.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAMvG,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAa9D;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAchD"}

package/dist/base64url.js

@@ -0,0 +1,45 @@
+/** base64url without padding, the WebAuthn JSON encoding. Works in browsers, Node and React Native. */
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const LOOKUP = {};
+for (let i = 0; i < ALPHABET.length; i++)
+    LOOKUP[ALPHABET[i]] = i;
+export function encode(input) {
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const a = bytes[i];
+        const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+        const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+        out += ALPHABET[a >> 2];
+        out += ALPHABET[((a & 3) << 4) | (b >> 4)];
+        if (i + 1 < bytes.length)
+            out += ALPHABET[((b & 15) << 2) | (c >> 6)];
+        if (i + 2 < bytes.length)
+            out += ALPHABET[c & 63];
+    }
+    return out;
+}
+export function decode(input) {
+    const s = input.replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+    const out = new Uint8Array(Math.floor((s.length * 3) / 4));
+    let o = 0;
+    for (let i = 0; i < s.length; i += 4) {
+        const a = at(s, i);
+        const b = at(s, i + 1);
+        const c = i + 2 < s.length ? at(s, i + 2) : 0;
+        const d = i + 3 < s.length ? at(s, i + 3) : 0;
+        out[o++] = (a << 2) | (b >> 4);
+        if (i + 2 < s.length)
+            out[o++] = ((b & 15) << 4) | (c >> 2);
+        if (i + 3 < s.length)
+            out[o++] = ((c & 3) << 6) | d;
+    }
+    return out;
+}
+function at(s, i) {
+    const v = LOOKUP[s[i] ?? ""];
+    if (v === undefined)
+        throw new Error(`base64url: bad character at ${i}`);
+    return v;
+}
+//# sourceMappingURL=base64url.js.map

package/dist/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../src/base64url.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAEvG,MAAM,QAAQ,GAAG,kEAAkE,CAAC;AACpF,MAAM,MAAM,GAA2B,EAAE,CAAC;AAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;AAEnE,MAAM,UAAU,MAAM,CAAC,KAA+B;IACpD,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;YAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/browser.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The browser's passkey API, as a `PasskeyProvider`. Import from
+ * `@theoo/sdk/browser`; the main entry stays free of DOM assumptions so
+ * servers and React Native can use it.
+ */
+import { type PasskeyProvider } from "./webauthn.js";
+import type { TokenStore, StoredTokens } from "./tokens.js";
+export declare const browserPasskeys: PasskeyProvider;
+/** Whether this browser can do a passkey ceremony at all. */
+export declare function passkeysAvailable(): Promise<boolean>;
+/** Tokens in `localStorage`, under one key. Survives reloads; cleared on sign-out. */
+export declare class LocalStorageTokenStore implements TokenStore {
+    private readonly key;
+    constructor(key?: string);
+    load(): Promise<StoredTokens | null>;
+    save(tokens: StoredTokens | null): Promise<void>;
+}
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAyD,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAE5G,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoB5D,eAAO,MAAM,eAAe,EAAE,eAe7B,CAAC;AAEF,6DAA6D;AAC7D,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO1D;AAED,sFAAsF;AACtF,qBAAa,sBAAuB,YAAW,UAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,SAAkB;IAC5C,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAQpC,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAQvD"}

package/dist/browser.js

@@ -0,0 +1,72 @@
+/**
+ * The browser's passkey API, as a `PasskeyProvider`. Import from
+ * `@theoo/sdk/browser`; the main entry stays free of DOM assumptions so
+ * servers and React Native can use it.
+ */
+import { credentialToJSON, toCreationOptions, toRequestOptions } from "./webauthn.js";
+function pkc() {
+    if (typeof PublicKeyCredential === "undefined") {
+        throw new Error("Passkeys are not available in this browser.");
+    }
+    return PublicKeyCredential;
+}
+function toJSON(cred) {
+    if (!cred)
+        throw new Error("The passkey ceremony was cancelled.");
+    const c = cred;
+    return typeof c.toJSON === "function" ? c.toJSON() : credentialToJSON(c);
+}
+export const browserPasskeys = {
+    async create(options) {
+        const P = pkc();
+        const publicKey = P.parseCreationOptionsFromJSON
+            ? P.parseCreationOptionsFromJSON(options.publicKey ?? options)
+            : toCreationOptions(options);
+        return toJSON(await navigator.credentials.create({ publicKey }));
+    },
+    async get(options) {
+        const P = pkc();
+        const publicKey = P.parseRequestOptionsFromJSON
+            ? P.parseRequestOptionsFromJSON(options.publicKey ?? options)
+            : toRequestOptions(options);
+        return toJSON(await navigator.credentials.get({ publicKey }));
+    },
+};
+/** Whether this browser can do a passkey ceremony at all. */
+export async function passkeysAvailable() {
+    if (typeof PublicKeyCredential === "undefined")
+        return false;
+    try {
+        return await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    }
+    catch {
+        return false;
+    }
+}
+/** Tokens in `localStorage`, under one key. Survives reloads; cleared on sign-out. */
+export class LocalStorageTokenStore {
+    constructor(key = "theoo.session") {
+        this.key = key;
+    }
+    async load() {
+        try {
+            const raw = localStorage.getItem(this.key);
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async save(tokens) {
+        try {
+            if (tokens)
+                localStorage.setItem(this.key, JSON.stringify(tokens));
+            else
+                localStorage.removeItem(this.key);
+        }
+        catch {
+            /* private mode, quota: the session simply does not persist */
+        }
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAwB,MAAM,eAAe,CAAC;AAS5G,SAAS,GAAG;IACV,IAAI,OAAO,mBAAmB,KAAK,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,mBAA0B,CAAC;AACpC,CAAC;AAED,SAAS,MAAM,CAAC,IAAuB;IACrC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,IAAwD,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAU,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C,KAAK,CAAC,MAAM,CAAC,OAAwB;QACnC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,CAAC,CAAC,4BAA4B;YAC9C,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;YAC9D,CAAC,CAAE,iBAAiB,CAAC,OAAO,CAAmD,CAAC;QAClF,OAAO,MAAM,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,OAAwB;QAChC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,CAAC,CAAC,2BAA2B;YAC7C,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;YAC7D,CAAC,CAAE,gBAAgB,CAAC,OAAO,CAAkD,CAAC;QAChF,OAAO,MAAM,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,OAAO,mBAAmB,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,MAAM,mBAAmB,CAAC,6CAA6C,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,sBAAsB;IACjC,YAA6B,MAAM,eAAe;QAArB,QAAG,GAAH,GAAG,CAAkB;IAAG,CAAC;IACtD,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAA2B;QACpC,IAAI,CAAC;YACH,IAAI,MAAM;gBAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;;gBAC9D,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;CACF"}

package/dist/client.d.ts

@@ -0,0 +1,331 @@
+import type { StoredTokens, TokenStore } from "./tokens.js";
+import { Transport, type FetchLike } from "./transport.js";
+import type { AuthChallenge, AuthOutcome, AvailableChain, BeginAuthRequest, ChainCall, ClientInfo, CompleteAuthRequest, Elevation, IdentitySummary, Me, OperationKind, OperationStatus, PreparedOperation, RecoveryStatus, ApiKeySummary, Caller, ChainOption, IssuedKey, NewProject, NewProjectKey, Project, SessionGrant, SessionRenewal, SessionKey, SmartAccount, SolanaAccount, SolanaAction, SolanaOperationStatus, SolanaRecoveryStatus, SolanaSessionGrant, SolanaSessionKey, PreparedSolanaOperation } from "./types.js";
+import type { PasskeyProvider } from "./webauthn.js";
+export interface TheooOptions {
+    /** Where Theoo is served, e.g. `https://theoo.example.com`. */
+    baseUrl: string;
+    /** A publishable key in an app; a secret key on your server. */
+    apiKey: string;
+    /** How passkey ceremonies run here. `browserPasskeys` from `@theoo/sdk/browser`, or the React Native provider. */
+    passkeys?: PasskeyProvider;
+    tokens?: TokenStore;
+    fetch?: FetchLike;
+    /** What the end user's client looks like, sent with every request that acts for them. */
+    client?: ClientInfo;
+    onSession?: (tokens: StoredTokens | null) => void;
+}
+export interface WaitOptions {
+    intervalMs?: number;
+    timeoutMs?: number;
+}
+/**
+ * The Theoo client.
+ *
+ * With a publishable key it is an end user's client: `auth`, then everything
+ * under `me`. With a secret key it is the tenant's server: `users(id)` to act
+ * for any user.
+ */
+export declare class Theoo {
+    readonly transport: Transport;
+    private readonly passkeys?;
+    private readonly client;
+    constructor(opts: TheooOptions);
+    private ceremony;
+    readonly auth: {
+        /** Start a sign-in (or, with a signed-in user, an add-this-factor). */
+        begin: (req: BeginAuthRequest) => Promise<AuthChallenge>;
+        /** Finish a sign-in. Stores the session. */
+        complete: (req: CompleteAuthRequest) => Promise<AuthOutcome>;
+        /** Email or phone: send a code, then `submit(code)`. */
+        withCode: (provider: "email" | "phone", destination: string, purpose?: BeginAuthRequest["purpose"]) => Promise<{
+            challenge: {
+                kind: "code";
+                challengeId: string;
+                destinationMasked: string;
+                expiresAt: number;
+                devCode?: string | null;
+            };
+            submit: (code: string) => Promise<AuthOutcome>;
+        }>;
+        /** Google or KingsChat: where to send the user, then `submit` with what comes back. */
+        withProvider: (provider: "google" | "kingschat") => Promise<{
+            challenge: {
+                kind: "redirect";
+                state: string;
+                url: string;
+            } | {
+                kind: "popup";
+                state: string;
+                url: string;
+                expectsPostMessage: boolean;
+            };
+            /** After the provider's callback: the `code` it returned. */
+            submitCode: (code: string) => Promise<AuthOutcome>;
+            /** A token the provider's own SDK already produced. */
+            submitToken: (accessToken: string) => Promise<AuthOutcome>;
+        }>;
+        /** A passkey the user already has. One ceremony, no typing. */
+        withPasskey: () => Promise<AuthOutcome>;
+        /** Enrol a passkey on the signed-in user. The account on chain is owned by the first one. */
+        enrolPasskey: (label?: string) => Promise<AuthOutcome>;
+        refresh: () => Promise<StoredTokens | null>;
+        signOut: () => Promise<void>;
+        session: () => Promise<StoredTokens | null>;
+    };
+    readonly me: {
+        get: () => Promise<Me>;
+        account: (chain?: number) => Promise<SmartAccount | null>;
+        identities: () => Promise<IdentitySummary[]>;
+        unlinkIdentity: (provider: IdentitySummary["provider"], subject: string) => Promise<void>;
+        signOutEverywhere: () => Promise<void>;
+        /** Prove presence again with a passkey, for actions that demand freshness. */
+        stepUp: () => Promise<Elevation>;
+        operations: {
+            prepare: (kind: OperationKind, chain?: number) => Promise<PreparedOperation>;
+            submit: (id: string, assertion: unknown) => Promise<OperationStatus>;
+            get: (id: string) => Promise<OperationStatus>;
+            list: () => Promise<OperationStatus[]>;
+            /** Prepare, have the passkey sign, submit, and wait for inclusion. */
+            run: (kind: OperationKind, o?: {
+                chain?: number;
+                wait?: WaitOptions | false;
+            }) => Promise<OperationStatus>;
+            wait: (id: string, w?: WaitOptions) => Promise<OperationStatus>;
+        };
+        recovery: {
+            status: (chain?: number) => Promise<RecoveryStatus>;
+            /** Start moving the account to the newest passkey. Needs a fresh step-up on `/me`. */
+            begin: (chain?: number) => Promise<RecoveryStatus>;
+            complete: (chain?: number) => Promise<RecoveryStatus>;
+        };
+        sessions: {
+            list: () => Promise<SessionKey[]>;
+            get: (id: string) => Promise<SessionKey>;
+            /** Act under a session key: no passkey, within the grant. */
+            execute: (id: string, call: ChainCall) => Promise<OperationStatus>;
+            /** Grant a session: a passkey-signed operation. Returns the session once the grant is on chain. */
+            grant: (session: SessionGrant, o?: {
+                chain?: number;
+                wait?: WaitOptions;
+            }) => Promise<{
+                session: SessionKey;
+                operation: OperationStatus;
+            }>;
+            /**
+             * Extend a key that already exists, keeping its address. One passkey
+             * ceremony and no new key to distribute — and the spent counter
+             * restarts, because that is what the account does with a fresh grant.
+             */
+            renew: (session: SessionRenewal, o?: {
+                chain?: number;
+                wait?: WaitOptions;
+            }) => Promise<{
+                session: SessionKey;
+                operation: OperationStatus;
+            }>;
+            revoke: (id: string, o?: {
+                chain?: number;
+                wait?: WaitOptions;
+            }) => Promise<OperationStatus>;
+        };
+        solana: {
+            account: (cluster?: string) => Promise<SolanaAccount | null>;
+            operations: {
+                prepare: (action: SolanaAction, cluster?: string) => Promise<PreparedSolanaOperation>;
+                submit: (id: string, assertion: unknown) => Promise<SolanaOperationStatus>;
+                get: (id: string) => Promise<SolanaOperationStatus>;
+                list: () => Promise<SolanaOperationStatus[]>;
+                run: (action: SolanaAction, cluster?: string) => Promise<SolanaOperationStatus>;
+            };
+            /**
+             * Session keys on Solana. The key signs the transaction itself, so
+             * `execute` is one call: no ceremony, no confirmation to wait for.
+             */
+            sessions: {
+                list: () => Promise<SolanaSessionKey[]>;
+                get: (id: string) => Promise<SolanaSessionKey>;
+                /** Act under a session key: no passkey, within the grant. */
+                execute: (id: string, action: SolanaAction) => Promise<SolanaOperationStatus>;
+                /** Grant a session: a passkey-signed operation, as every grant is. */
+                grant: (session: SolanaSessionGrant, cluster?: string) => Promise<{
+                    session: SolanaSessionKey;
+                    operation: SolanaOperationStatus;
+                }>;
+                /** The same, on Solana: one ceremony, the same key, the tally reset. */
+                renew: (session: SessionRenewal, cluster?: string) => Promise<{
+                    session: SolanaSessionKey;
+                    operation: SolanaOperationStatus;
+                }>;
+                revoke: (id: string, cluster?: string) => Promise<SolanaOperationStatus>;
+            };
+            /** Guardian recovery on Solana: the same shape as the EVM side. */
+            recovery: {
+                status: (cluster?: string) => Promise<SolanaRecoveryStatus>;
+                /** Needs a fresh step-up on `/me`. */
+                begin: (cluster?: string) => Promise<SolanaRecoveryStatus>;
+                complete: (cluster?: string) => Promise<SolanaRecoveryStatus>;
+            };
+        };
+    };
+    /**
+     * Self-serve projects, for a console app.
+     *
+     * These act as the signed-in *developer* — a user of the console tenant —
+     * so they need that tenant's publishable key and the developer's own bearer
+     * token, exactly like any other `/v1/me` call. A developer can only ever
+     * reach projects they created.
+     */
+    console: {
+        /**
+         * Every chain a project could be pointed at, across both account models.
+         *
+         * Not the same as {@link chains}, which answers for the calling tenant.
+         * A project does not exist yet when this is asked.
+         */
+        chains: () => Promise<AvailableChain[]>;
+        projects: () => Promise<Project[]>;
+        create: (project: NewProject) => Promise<Project>;
+        keys: (slug: string) => Promise<ApiKeySummary[]>;
+        /** The key is in the response and never again. Show it once, then store it. */
+        issueKey: (slug: string, key: NewProjectKey) => Promise<IssuedKey>;
+        revokeKey: (slug: string, prefix: string) => Promise<{
+            revoked: boolean;
+        }>;
+        /** Rename a project. Cosmetic — the slug does not move. */
+        rename: (slug: string, name: string) => Promise<Project>;
+        /**
+         * Change which chain a call that names none gets. Safe at any time: it
+         * moves no address. Refused if the chain is not registered for the
+         * project's account model.
+         */
+        setDefaultChain: (slug: string, chain: number) => Promise<Project>;
+        /**
+         * Put a project away, or take it back out. Not a delete: the accounts it
+         * owns exist on a chain and archiving does not touch them. An archived
+         * project's keys stop working and it stops counting against the project
+         * limit.
+         */
+        setArchived: (slug: string, archived: boolean) => Promise<Project>;
+        setOrigins: (slug: string, origins: string[]) => Promise<Project>;
+        /** Lowering is always allowed; raising is capped at the operator's ceiling. */
+        setBudget: (slug: string, dailyWei: string | null) => Promise<Project>;
+    };
+    /**
+     * The chains this tenant's users can hold accounts on.
+     *
+     * Readable with a publishable key, so an app can offer a choice rather
+     * than hardcoding what an operator may change. Pass `chain` to any
+     * account or operation call to use one.
+     */
+    chains(): Promise<ChainOption[]>;
+    /**
+     * Resolve an end user's access token into who they are.
+     *
+     * For a server holding a token its front end sent: it says which user, in
+     * which session, and how strongly they are authenticated. Needs a secret
+     * key, because it speaks for the tenant rather than for a user.
+     *
+     * Use {@link effectiveAssurance} on the result rather than reading
+     * `subject.aal`, which is the base level and ignores a step-up that has
+     * since gone stale.
+     */
+    authenticate(accessToken: string): Promise<Caller>;
+    users(userId: string): {
+        account: (chain?: number) => Promise<SmartAccount | null>;
+        identities: () => Promise<IdentitySummary[]>;
+        signOutEverywhere: (reason?: string) => Promise<void>;
+        operations: {
+            prepare: (kind: OperationKind, chain?: number) => Promise<PreparedOperation>;
+            submit: (id: string, assertion: unknown) => Promise<OperationStatus>;
+            get: (id: string) => Promise<OperationStatus>;
+            list: () => Promise<OperationStatus[]>;
+            /** Prepare, have the passkey sign, submit, and wait for inclusion. */
+            run: (kind: OperationKind, o?: {
+                chain?: number;
+                wait?: WaitOptions | false;
+            }) => Promise<OperationStatus>;
+            wait: (id: string, w?: WaitOptions) => Promise<OperationStatus>;
+        };
+        recovery: {
+            status: (chain?: number) => Promise<RecoveryStatus>;
+            /** Start moving the account to the newest passkey. Needs a fresh step-up on `/me`. */
+            begin: (chain?: number) => Promise<RecoveryStatus>;
+            complete: (chain?: number) => Promise<RecoveryStatus>;
+        };
+        sessions: {
+            list: () => Promise<SessionKey[]>;
+            get: (id: string) => Promise<SessionKey>;
+            /** Act under a session key: no passkey, within the grant. */
+            execute: (id: string, call: ChainCall) => Promise<OperationStatus>;
+            /** Grant a session: a passkey-signed operation. Returns the session once the grant is on chain. */
+            grant: (session: SessionGrant, o?: {
+                chain?: number;
+                wait?: WaitOptions;
+            }) => Promise<{
+                session: SessionKey;
+                operation: OperationStatus;
+            }>;
+            /**
+             * Extend a key that already exists, keeping its address. One passkey
+             * ceremony and no new key to distribute — and the spent counter
+             * restarts, because that is what the account does with a fresh grant.
+             */
+            renew: (session: SessionRenewal, o?: {
+                chain?: number;
+                wait?: WaitOptions;
+            }) => Promise<{
+                session: SessionKey;
+                operation: OperationStatus;
+            }>;
+            revoke: (id: string, o?: {
+                chain?: number;
+                wait?: WaitOptions;
+            }) => Promise<OperationStatus>;
+        };
+        solana: {
+            account: (cluster?: string) => Promise<SolanaAccount | null>;
+            operations: {
+                prepare: (action: SolanaAction, cluster?: string) => Promise<PreparedSolanaOperation>;
+                submit: (id: string, assertion: unknown) => Promise<SolanaOperationStatus>;
+                get: (id: string) => Promise<SolanaOperationStatus>;
+                list: () => Promise<SolanaOperationStatus[]>;
+                run: (action: SolanaAction, cluster?: string) => Promise<SolanaOperationStatus>;
+            };
+            /**
+             * Session keys on Solana. The key signs the transaction itself, so
+             * `execute` is one call: no ceremony, no confirmation to wait for.
+             */
+            sessions: {
+                list: () => Promise<SolanaSessionKey[]>;
+                get: (id: string) => Promise<SolanaSessionKey>;
+                /** Act under a session key: no passkey, within the grant. */
+                execute: (id: string, action: SolanaAction) => Promise<SolanaOperationStatus>;
+                /** Grant a session: a passkey-signed operation, as every grant is. */
+                grant: (session: SolanaSessionGrant, cluster?: string) => Promise<{
+                    session: SolanaSessionKey;
+                    operation: SolanaOperationStatus;
+                }>;
+                /** The same, on Solana: one ceremony, the same key, the tally reset. */
+                renew: (session: SessionRenewal, cluster?: string) => Promise<{
+                    session: SolanaSessionKey;
+                    operation: SolanaOperationStatus;
+                }>;
+                revoke: (id: string, cluster?: string) => Promise<SolanaOperationStatus>;
+            };
+            /** Guardian recovery on Solana: the same shape as the EVM side. */
+            recovery: {
+                status: (cluster?: string) => Promise<SolanaRecoveryStatus>;
+                /** Needs a fresh step-up on `/me`. */
+                begin: (cluster?: string) => Promise<SolanaRecoveryStatus>;
+                complete: (cluster?: string) => Promise<SolanaRecoveryStatus>;
+            };
+        };
+    };
+    /** The user's Solana account and operations: the same passkey, a second ledger. */
+    private solanaAt;
+    private operationsAt;
+    private recoveryAt;
+    private sessionsAt;
+}
+//# sourceMappingURL=client.d.ts.map