accounts 0.12.2 → 0.14.0

package/src/react-native/adapter.ts

@@ -8,11 +8,11 @@ import {
   RpcResponse,
 } from 'ox'
 import { KeyAuthorization } from 'ox/tempo'
-import { prepareTransactionRequest } from 'viem/actions'
 import { Actions, Account as TempoAccount, Secp256k1 } from 'viem/tempo'
 
 import * as AccessKey from '../core/AccessKey.js'
 import * as Adapter from '../core/Adapter.js'
+import * as AccessKeyTransaction from '../core/internal/AccessKeyTransaction.js'
 import type * as Storage from '../core/Storage.js'
 
 /**
@@ -58,19 +58,19 @@ export function reactNative(options: reactNative.Options): Adapter.Adapter {
       const keyAuthorization = deserialized as KeyAuthorization.Signed
 
       if (keyAuthorization.address.toLowerCase() === keyAddress.toLowerCase())
-        AccessKey.save({
-          address,
-          keyAuthorization,
+        AccessKey.add({
+          account: address,
+          authorization: keyAuthorization,
           privateKey: entry.key,
           store,
         })
       else
-        store.setState((state) => ({
-          accessKeys: state.accessKeys.filter(
-            (accessKey) =>
-              accessKey.address.toLowerCase() !== keyAuthorization.address.toLowerCase(),
-          ),
-        }))
+        AccessKey.remove({
+          account: address,
+          accessKey: keyAuthorization.address,
+          chainId: Number(keyAuthorization.chainId),
+          store,
+        })
 
       return {
         account,
@@ -127,9 +127,9 @@ export function reactNative(options: reactNative.Options): Adapter.Adapter {
     ) {
       if (!managedKey) return
 
-      AccessKey.save({
-        address,
-        keyAuthorization,
+      AccessKey.add({
+        account: address,
+        authorization: keyAuthorization,
         privateKey: managedKey.key,
         store,
       })
@@ -189,36 +189,47 @@ export function reactNative(options: reactNative.Options): Adapter.Adapter {
       return result.keyAuthorization
     }
 
-    async function withManagedAccessKey<result>(
-      fn: (
-        account: TempoAccount.Account,
-        keyAuthorization?: KeyAuthorization.Signed | undefined,
-      ) => Promise<result>,
+    async function prepareManagedTransaction(
+      client: ReturnType<typeof getClient>,
+      parameters: AccessKeyTransaction.create.PrepareParameters,
+      options: {
+        calls?: AccessKeyTransaction.create.Options['calls'] | undefined
+        chainId?: number | undefined
+      } = {},
     ) {
-      const rootAddress = store.getState().accounts[store.getState().activeAccount]?.address
-      const managedKey = rootAddress ? await loadManagedKey(rootAddress) : undefined
-
-      const account = managedKey?.account ?? getAccount({ signable: true })
-      let keyAuthorization = AccessKey.getPending(account, { store })
-      if (rootAddress && managedKey && !keyAuthorization)
-        if (!(await isManagedKeyAuthorized(rootAddress, managedKey)))
-          keyAuthorization = await reauthorizeManagedKey(rootAddress, managedKey)
+      const state = store.getState()
+      const address = parameters.from ?? state.accounts[state.activeAccount]?.address
+      if (!address) throw new core_Provider.DisconnectedError({ message: 'No active account.' })
+      const managedKey = await loadManagedKey(address)
+      if (managedKey && !(await isManagedKeyAuthorized(address, managedKey)))
+        await reauthorizeManagedKey(address, managedKey)
+      const transaction = await AccessKeyTransaction.create({
+        address,
+        calls: options.calls,
+        chainId: options.chainId ?? state.chainId,
+        client,
+        store,
+      })
+      if (!transaction)
+        throw new core_Provider.UnauthorizedError({
+          message: `Account "${address}" cannot sign with an access key.`,
+        })
+      return await transaction.prepare(parameters)
+    }
 
-      try {
-        return await fn(account, keyAuthorization ?? undefined)
-      } catch (error) {
-        AccessKey.remove(account, { store })
-        throw error
-      }
+    async function loadManagedAccount(address: Adapter.signPersonalMessage.Parameters['address']) {
+      await loadManagedKey(address)
+      return getAccount({ address, signable: true })
     }
 
     async function authorize(request: {
       account?: Adapter.authorizeAccessKey.ReturnType['rootAddress'] | undefined
       authorizeAccessKey: Adapter.authorizeAccessKey.Parameters | undefined
       method: 'wallet_authorizeAccessKey' | 'wallet_connect'
+      showDeposit?: Adapter.createAccount.Parameters['showDeposit'] | undefined
     }) {
       const { host, redirectUri, open = defaultOpen } = options
-      const { account, authorizeAccessKey, method } = request
+      const { account, authorizeAccessKey, method, showDeposit } = request
 
       const managedKey =
         authorizeAccessKey && !authorizeAccessKey.publicKey && !authorizeAccessKey.address
@@ -251,6 +262,7 @@ export function reactNative(options: reactNative.Options): Adapter.Adapter {
           ? { limits: authorizeAccessKey.limits.map((l) => ({ ...l, limit: String(l.limit) })) }
           : {}),
         pubKey: publicKey,
+        ...(showDeposit !== undefined ? { showDeposit } : {}),
         state,
       })
 
@@ -303,8 +315,29 @@ export function reactNative(options: reactNative.Options): Adapter.Adapter {
             rootAddress: result.accountAddress,
           }
         },
-        async createAccount(params, request) {
-          return this.loadAccounts(params, request)
+        async createAccount(parameters) {
+          if (parameters?.digest)
+            throw unsupported(
+              '`wallet_connect` digest signing not supported by React Native adapter.',
+            )
+
+          const result = await authorize({
+            authorizeAccessKey: parameters?.authorizeAccessKey,
+            method: 'wallet_connect',
+            ...(parameters?.showDeposit !== undefined
+              ? { showDeposit: parameters.showDeposit }
+              : {}),
+          })
+
+          return {
+            accounts: [
+              {
+                address: result.accountAddress,
+                capabilities: {},
+              },
+            ],
+            keyAuthorization: KeyAuthorization.toRpc(result.keyAuthorization),
+          }
         },
         async loadAccounts(parameters) {
           if (parameters?.digest)
@@ -333,74 +366,57 @@ export function reactNative(options: reactNative.Options): Adapter.Adapter {
         async sendTransaction(parameters) {
           const { feePayer, ...rest } = parameters
           const client = getClient(typeof feePayer === 'string' ? { feePayer } : {})
-          const { account, prepared } = await withManagedAccessKey(
-            async (account, keyAuthorization) => ({
-              account,
-              prepared: await prepareTransactionRequest(client, {
-                account,
-                ...rest,
-                ...(feePayer ? { feePayer: true } : {}),
-                ...(keyAuthorization ? { keyAuthorization } : {}),
-                type: 'tempo',
-              } as never),
-            }),
+          const prepared = await prepareManagedTransaction(
+            client,
+            {
+              ...rest,
+              ...(feePayer ? { feePayer: true } : {}),
+            },
+            {
+              calls: parameters.calls as AccessKeyTransaction.create.Options['calls'],
+              chainId: parameters.chainId,
+            },
           )
-          const signed = await account.signTransaction(prepared as never)
-          const result = await client.request({
-            method: 'eth_sendRawTransaction' as never,
-            params: [signed],
-          })
-          AccessKey.removePending(account, { store })
-          return result
+          return await prepared.send()
         },
         async sendTransactionSync(parameters) {
           const { feePayer, ...rest } = parameters
           const client = getClient(typeof feePayer === 'string' ? { feePayer } : {})
-          const { account, prepared } = await withManagedAccessKey(
-            async (account, keyAuthorization) => ({
-              account,
-              prepared: await prepareTransactionRequest(client, {
-                account,
-                ...rest,
-                ...(feePayer ? { feePayer: true } : {}),
-                ...(keyAuthorization ? { keyAuthorization } : {}),
-                type: 'tempo',
-              } as never),
-            }),
+          const prepared = await prepareManagedTransaction(
+            client,
+            {
+              ...rest,
+              ...(feePayer ? { feePayer: true } : {}),
+            },
+            {
+              calls: parameters.calls as AccessKeyTransaction.create.Options['calls'],
+              chainId: parameters.chainId,
+            },
           )
-          const signed = await account.signTransaction(prepared as never)
-          const result = await client.request({
-            method: 'eth_sendRawTransactionSync' as never,
-            params: [signed],
-          })
-          AccessKey.removePending(account, { store })
-          return result
+          return await prepared.sendSync()
         },
         async signPersonalMessage({ address, data }) {
-          await loadManagedKey(address)
-          const account = getAccount({ address, signable: true })
+          const account = await loadManagedAccount(address)
           return await account.signMessage({ message: { raw: data } })
         },
         async signTransaction(parameters) {
           const { feePayer, ...rest } = parameters
           const client = getClient(typeof feePayer === 'string' ? { feePayer } : {})
-          const { account, prepared } = await withManagedAccessKey(
-            async (account, keyAuthorization) => ({
-              account,
-              prepared: await prepareTransactionRequest(client, {
-                account,
-                ...rest,
-                ...(feePayer ? { feePayer: true } : {}),
-                ...(keyAuthorization ? { keyAuthorization } : {}),
-                type: 'tempo',
-              } as never),
-            }),
+          const prepared = await prepareManagedTransaction(
+            client,
+            {
+              ...rest,
+              ...(feePayer ? { feePayer: true } : {}),
+            },
+            {
+              calls: parameters.calls as AccessKeyTransaction.create.Options['calls'],
+              chainId: parameters.chainId,
+            },
           )
-          return await account.signTransaction(prepared as never)
+          return await prepared.sign()
         },
         async signTypedData({ address, data }) {
-          await loadManagedKey(address)
-          const account = getAccount({ address, signable: true })
+          const account = await loadManagedAccount(address)
           return await account.signTypedData(JSON.parse(data) as never)
         },
       },
@@ -490,6 +506,7 @@ function buildAuthUrl(
     keyType?: string | undefined
     limits?: readonly { token: string; limit: string }[] | undefined
     pubKey: Hex.Hex
+    showDeposit?: Adapter.createAccount.Parameters['showDeposit'] | undefined
     state: string
   },
 ): string {
@@ -501,6 +518,9 @@ function buildAuthUrl(
   url.searchParams.set('chainId', String(params.chainId))
   if (typeof params.expiry !== 'undefined') url.searchParams.set('expiry', String(params.expiry))
   if (params.limits) url.searchParams.set('limits', JSON.stringify(params.limits))
+  if (params.showDeposit === true) url.searchParams.set('showDeposit', 'true')
+  else if (params.showDeposit)
+    url.searchParams.set('showDeposit', JSON.stringify(params.showDeposit))
   url.searchParams.set('callback', params.callback)
   url.searchParams.set('state', params.state)
   return url.toString()

package/src/server/CliAuth.test-d.ts

@@ -13,6 +13,14 @@ describe('createRequest', () => {
       keyType?: 'secp256k1' | 'p256' | 'webAuthn' | undefined
       limits?: readonly { token: Hex; limit: bigint }[] | undefined
       pubKey: Hex
+      showDeposit?:
+        | boolean
+        | {
+            amount?: string | undefined
+            displayName?: string | undefined
+            token?: string | undefined
+          }
+        | undefined
     }>()
   })
 
@@ -20,6 +28,13 @@ describe('createRequest', () => {
     type Request = z.output<typeof CliAuth.createRequest>
     expectTypeOf<Request>().not.toHaveProperty('scopes')
   })
+
+  test('showDeposit does not include address or chainId', () => {
+    type Request = z.output<typeof CliAuth.createRequest>
+    type ShowDeposit = Exclude<Exclude<Request['showDeposit'], boolean | undefined>, undefined>
+    expectTypeOf<ShowDeposit>().not.toHaveProperty('address')
+    expectTypeOf<ShowDeposit>().not.toHaveProperty('chainId')
+  })
 })
 
 describe('pollResponse', () => {
@@ -44,6 +59,14 @@ describe('pendingResponse', () => {
       keyType: 'secp256k1' | 'p256' | 'webAuthn'
       limits?: readonly { token: Hex; limit: bigint }[] | undefined
       pubKey: Hex
+      showDeposit?:
+        | boolean
+        | {
+            amount?: string | undefined
+            displayName?: string | undefined
+            token?: string | undefined
+          }
+        | undefined
       status: 'pending'
     }>()
   })

package/src/server/CliAuth.test.ts

@@ -109,6 +109,7 @@ async function createRequest(
     expiry?: number | undefined
     keyType?: 'secp256k1' | 'p256' | 'webAuthn' | undefined
     limits?: readonly { token: `0x${string}`; limit: bigint }[] | undefined
+    showDeposit?: z.output<typeof CliAuth.createRequest>['showDeposit'] | undefined
   } = {},
 ) {
   const key = options.accessKey ?? accessKey
@@ -128,6 +129,7 @@ async function createRequest(
         : { keyType: key.keyType }),
       ...('limits' in options ? (options.limits ? { limits: options.limits } : {}) : { limits }),
       pubKey: key.publicKey,
+      ...(options.showDeposit !== undefined ? { showDeposit: options.showDeposit } : {}),
     } satisfies z.output<typeof CliAuth.createRequest>,
   }
 }
@@ -671,6 +673,51 @@ describe('pending', () => {
     `)
   })
 
+  test('behavior: preserves showDeposit for browser approval', async () => {
+    const store = CliAuth.Store.memory()
+    const { request } = await createRequest('device-code-verifier', {
+      showDeposit: {
+        amount: '50',
+        displayName: 'DoorDash',
+        token: 'USDC',
+      },
+    })
+    const { code } = await CliAuth.createDeviceCode({
+      chainId: chain.id,
+      random: () => new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7]),
+      request,
+      store,
+    })
+
+    const result = await CliAuth.pending({
+      code,
+      store,
+    })
+
+    expect(result).toMatchInlineSnapshot(`
+      {
+        "accessKeyAddress": "${accessKey.address.toLowerCase()}",
+        "chainId": 1337n,
+        "code": "ABCDEFGH",
+        "expiry": ${expiry},
+        "keyType": "p256",
+        "limits": [
+          {
+            "limit": 1000n,
+            "token": "0x20c0000000000000000000000000000000000001",
+          },
+        ],
+        "pubKey": "${accessKey.publicKey}",
+        "showDeposit": {
+          "amount": "50",
+          "displayName": "DoorDash",
+          "token": "USDC",
+        },
+        "status": "pending",
+      }
+    `)
+  })
+
   test('behavior: handler returns 404 for an unknown code', async () => {
     const handler = Handler.codeAuth()
 

package/src/server/CliAuth.ts

@@ -2,7 +2,7 @@ import { Address, Base64, Bytes, Hex, PublicKey } from 'ox'
 import { KeyAuthorization as TempoKeyAuthorization, SignatureEnvelope } from 'ox/tempo'
 import { createClient, http, type Chain, type Client, type Transport } from 'viem'
 import { verifyHash } from 'viem/actions'
-import { tempo } from 'viem/chains'
+import { tempo } from 'viem/tempo/chains'
 import * as z from 'zod/mini'
 
 import * as u from '../core/zod/utils.js'
@@ -12,6 +12,16 @@ import type { Kv } from './Kv.js'
 const maxLimits = 10
 const limit = z.object({ token: u.address(), limit: u.bigint() })
 const limits = z.readonly(z.array(limit).check(z.maxLength(maxLimits)))
+const showDeposit = z.optional(
+  z.union([
+    z.boolean(),
+    z.object({
+      amount: z.optional(z.string()),
+      displayName: z.optional(z.string()),
+      token: z.optional(z.union([u.address(), z.string()])),
+    }),
+  ]),
+)
 const defaultTtlMs = 10 * 60 * 1_000
 const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'
 
@@ -38,6 +48,7 @@ export const createRequest = z.object({
   keyType: z.optional(keyType),
   limits: z.optional(limits),
   pubKey: u.hex(),
+  showDeposit,
 })
 
 /** Response body for `POST /cli-auth/device-code`. */
@@ -75,6 +86,7 @@ export const pendingResponse = z.object({
   keyType,
   limits: z.optional(limits),
   pubKey: u.hex(),
+  showDeposit,
   status: z.literal('pending'),
 })
 
@@ -103,6 +115,7 @@ export const entry = u.oneOf([
     keyType,
     limits: z.optional(limits),
     pubKey: u.hex(),
+    showDeposit,
     status: z.literal('pending'),
   }),
   z.object({
@@ -119,6 +132,7 @@ export const entry = u.oneOf([
     keyType,
     limits: z.optional(limits),
     pubKey: u.hex(),
+    showDeposit,
     status: z.literal('authorized'),
   }),
   z.object({
@@ -136,6 +150,7 @@ export const entry = u.oneOf([
     keyType,
     limits: z.optional(limits),
     pubKey: u.hex(),
+    showDeposit,
     status: z.literal('consumed'),
   }),
 ])
@@ -576,6 +591,9 @@ export function from(options: from.Options = {}): CliAuth {
         keyType,
         ...(approved.limits ? { limits: approved.limits } : {}),
         pubKey,
+        ...(options.request.showDeposit !== undefined
+          ? { showDeposit: options.request.showDeposit }
+          : {}),
         status: 'pending',
       })
 
@@ -601,6 +619,7 @@ export function from(options: from.Options = {}): CliAuth {
         keyType: current.keyType,
         ...(current.limits ? { limits: current.limits } : {}),
         pubKey: current.pubKey,
+        ...(current.showDeposit !== undefined ? { showDeposit: current.showDeposit } : {}),
         status: 'pending',
       }
     },

package/src/server/Handler.test-d.ts

@@ -1,7 +1,7 @@
 import { hc } from 'hono/client'
 import type { ExtractSchema } from 'hono/types'
 import { http, type Chain, type Transport } from 'viem'
-import { tempo, tempoModerato } from 'viem/chains'
+import { tempo, tempoModerato } from 'viem/tempo/chains'
 import { describe, expectTypeOf, test } from 'vp/test'
 
 import * as CliAuth from './CliAuth.js'

package/src/server/Kv.test.ts

@@ -47,6 +47,36 @@ describe('memory', () => {
     expect(await kv.get('a')).toMatchInlineSnapshot(`"v2"`)
   })
 
+  test('create: writes only when key is absent', async () => {
+    const kv = Kv.memory()
+
+    expect(await kv.create!('a', 'v1')).toMatchInlineSnapshot(`true`)
+    expect(await kv.create!('a', 'v2')).toMatchInlineSnapshot(`false`)
+    expect(await kv.get('a')).toMatchInlineSnapshot(`"v1"`)
+  })
+
+  test('create: replaces expired entries', async () => {
+    let now = 1_000_000
+    const kv = Kv.memory({ now: () => now })
+
+    await kv.set('a', 'v1', { ttl: 1 })
+    now += 2_000
+    expect(await kv.create!('a', 'v2')).toMatchInlineSnapshot(`true`)
+    expect(await kv.get('a')).toMatchInlineSnapshot(`"v2"`)
+  })
+
+  test('create: concurrent callers — only one writes', async () => {
+    const kv = Kv.memory()
+
+    const results = await Promise.all([kv.create!('a', 'v1'), kv.create!('a', 'v2')])
+    expect(results.filter(Boolean)).toMatchInlineSnapshot(`
+      [
+        true,
+      ]
+    `)
+    expect(await kv.get('a')).toMatchInlineSnapshot(`"v1"`)
+  })
+
   test('take: returns the value and removes the entry', async () => {
     const kv = Kv.memory()
 
@@ -163,6 +193,18 @@ describe('durableObject + NonceStorage', () => {
     `)
   })
 
+  test('create: concurrent callers — only one wins', async () => {
+    const kv = Kv.durableObject(fakeDurableObject())
+
+    const results = await Promise.all([kv.create!('a', 'v1'), kv.create!('a', 'v2')])
+    expect(results.filter(Boolean)).toMatchInlineSnapshot(`
+      [
+        true,
+      ]
+    `)
+    expect(await kv.get('a')).toMatchInlineSnapshot(`"v1"`)
+  })
+
   test('take: missing key returns undefined', async () => {
     const kv = Kv.durableObject(fakeDurableObject())
     expect(await kv.take!('missing')).toMatchInlineSnapshot(`undefined`)
@@ -226,6 +268,15 @@ describe('cloudflare', () => {
     expect(kv.take).toBeUndefined()
   })
 
+  test('create: NOT implemented (CF KV is not linearizable)', () => {
+    const kv = Kv.cloudflare({
+      get: async () => null,
+      put: async () => {},
+      delete: async () => {},
+    })
+    expect(kv.create).toBeUndefined()
+  })
+
   test('ttl: passes expirationTtl seconds to underlying put', async () => {
     const puts: { key: string; value: string; options: unknown }[] = []
     const fakeKv = {

package/src/server/Kv.ts

@@ -16,6 +16,16 @@ export type Kv = {
   set: (key: string, value: unknown, options?: set.Options | undefined) => Promise<void>
   /** Delete a value by key. */
   delete: (key: string) => Promise<void>
+  /**
+   * Atomic create-if-absent. Returns `true` when the value was written,
+   * `false` when a non-expired value already exists.
+   *
+   * Optional. Backends with a linearizable create primitive should
+   * implement this so consumers can atomically reject duplicates.
+   * Consumers may fall back to `get` then `set` when strict atomicity is
+   * not required.
+   */
+  create?: (key: string, value: unknown, options?: set.Options | undefined) => Promise<boolean>
   /**
    * Atomic read-and-delete. Returns the value if present, `undefined` if
    * missing or expired. Across concurrent callers, exactly one observer
@@ -51,11 +61,10 @@ export function from<kv extends Kv>(kv: kv): kv {
  * Cloudflare KV's minimum TTL is 60 seconds; the platform enforces its own
  * minimum independent of what's passed here.
  *
- * **Not safe for one-time-consume semantics.** Cloudflare KV is eventually
- * consistent across data centers — concurrent read+delete races can let
- * the same key be "consumed" twice. `take` is intentionally NOT
- * implemented. Use a Durable Object (or another linearizable backend)
- * for the SIWE challenge nonce store.
+ * **Not safe for one-time-consume or unique-key semantics.**
+ * Cloudflare KV is eventually consistent across data centers, so `take`
+ * and `create` are intentionally NOT implemented. Use a Durable Object
+ * (or another linearizable backend) for the SIWE challenge nonce store.
  */
 export function cloudflare(kv: cloudflare.Parameters): Kv {
   return from({
@@ -84,10 +93,11 @@ export declare namespace cloudflare {
 
 /**
  * Adapt a Cloudflare Durable Object namespace into a `Kv` with atomic
- * `take`. Unlike `Kv.cloudflare`, a Durable Object's storage is
- * single-actor and linearizable — `take` (read+delete) is guaranteed
- * atomic across concurrent callers, which makes this the recommended
- * backend for SIWE challenge nonce storage on Cloudflare Workers.
+ * `take` and `create`. Unlike `Kv.cloudflare`, a Durable Object's
+ * storage is single-actor and linearizable, so `take` (read+delete) and
+ * `create` (create-if-absent) are guaranteed atomic across concurrent
+ * callers. This makes it the recommended backend for SIWE challenge
+ * nonce storage on Cloudflare Workers.
  *
  * Pair with `Kv.NonceStorage` (or your own DO class implementing the
  * same fetch protocol).
@@ -147,6 +157,12 @@ export function durableObject(
     async set(key, value, options) {
       await rpc('set', key, { value, ttl: options?.ttl })
     },
+    async create(key, value, options) {
+      const { created } = (await rpc('create', key, { value, ttl: options?.ttl })) as {
+        created: boolean
+      }
+      return created
+    },
     async delete(key) {
       await rpc('delete', key)
     },
@@ -228,6 +244,17 @@ export class NonceStorage {
       await this.state.storage.put(key, entry)
       return Response.json({})
     }
+    if (op === 'create') {
+      const current = await this.state.storage.get<NonceStorage.Entry>(key)
+      if (current && !isExpired(current)) return Response.json({ created: false })
+
+      const body = (await request.json()) as { value: unknown; ttl?: number }
+      const entry: NonceStorage.Entry = body.ttl
+        ? { value: body.value, expiresAt: Date.now() + body.ttl * 1000 }
+        : { value: body.value }
+      await this.state.storage.put(key, entry)
+      return Response.json({ created: true })
+    }
     if (op === 'delete') {
       await this.state.storage.delete(key)
       return Response.json({})
@@ -280,6 +307,13 @@ export function memory(options: memory.Options = {}): Kv {
       const expiresAt = options?.ttl ? now() + options.ttl * 1000 : undefined
       store.set(key, expiresAt !== undefined ? { value, expiresAt } : { value })
     },
+    async create(key, value, options) {
+      const entry = store.get(key)
+      if (entry && !isExpired(entry)) return false
+      const expiresAt = options?.ttl ? now() + options.ttl * 1000 : undefined
+      store.set(key, expiresAt !== undefined ? { value, expiresAt } : { value })
+      return true
+    },
     // Atomic in-process: the synchronous `Map.get` + `Map.delete` runs
     // in a single microtask, so concurrent `take(key)` callers (within
     // the same Node/Bun/Worker process) cannot both observe the value.