accounts 0.14.6 → 0.14.8

package/dist/core/AccessKey.d.ts

@@ -2,6 +2,7 @@ import { Address, Hex, WebCryptoP256 } from 'ox';
 import { KeyAuthorization } from 'ox/tempo';
 import { type Client, type Transport } from 'viem';
 import { Account as TempoAccount } from 'viem/tempo';
+import type { StoreApi } from 'zustand';
 import type { OneOf } from '../internal/types.js';
 import type * as Store from './Store.js';
 declare const status: {
@@ -49,7 +50,7 @@ export type AccessKey = {
     keyPair: Awaited<ReturnType<typeof WebCryptoP256.createKeyPair>>;
 }>;
 /** Calls used to match access key scopes. */
-type Call = {
+export type Call = {
     /** Contract address being called. */
     to?: Address.Address | undefined;
     /** Calldata being sent. */
@@ -69,8 +70,8 @@ type StatusQuery = {
     client: Client<Transport>;
     /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
     now?: number | undefined;
-    /** Reactive state store. */
-    store: Store.Store;
+    /** Access-key manager options. */
+    store: ManagerOptions;
 };
 /** Access key selection query. */
 type SelectQuery = {
@@ -82,9 +83,58 @@ type SelectQuery = {
     chainId: number;
     /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
     now?: number | undefined;
-    /** Reactive state store. */
-    store: Store.Store;
+    /** Access-key manager options. */
+    store: ManagerOptions;
 };
+/** Access key authorization reuse policy. */
+export type ReusePolicy = {
+    /** Minimum Unix timestamp a reusable key must be valid through. */
+    minExpiry?: number | undefined;
+    /** Minimum spending limits a reusable key must satisfy. */
+    minLimits?: readonly KeyAuthorization.TokenLimit[] | undefined;
+};
+/** Access key authorization parameters plus SDK-only reuse policy. */
+export type ReusableAuthorization = Omit<prepareAuthorization.Options, 'chainId'> & {
+    /** Chain ID the key authorization is scoped to. */
+    chainId?: bigint | number | undefined;
+    /** SDK-only reuse policy. Not sent over RPC. */
+    reuse?: ReusePolicy | undefined;
+};
+type ReusableQuery = {
+    /** Root account address. */
+    account: Address.Address;
+    /** Calls the access key must be able to sign. */
+    calls?: readonly Call[] | undefined;
+    /** Chain ID the access key must be authorized on. */
+    chainId: number;
+    /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
+    now?: number | undefined;
+    /** Access key authorization parameters with optional reuse policy. */
+    parameters: ReusableAuthorization;
+    /** Access-key manager options. */
+    store: ManagerOptions;
+};
+type CallsQuery = {
+    /** Calls the authorization must be able to sign. */
+    calls?: readonly Call[] | undefined;
+    /** Access key authorization parameters. */
+    parameters: Pick<ReusableAuthorization, 'scopes'>;
+};
+type ListQuery = {
+    /** Root account address. */
+    account: Address.Address;
+    /** Specific access key address to match. */
+    accessKey?: Address.Address | undefined;
+    /** Chain ID the access key is scoped to. */
+    chainId: number;
+    /** Access-key manager dependencies. */
+    store: ManagerOptions;
+};
+type ManagerOptions = {
+    /** Zustand store containing access-key metadata. */
+    state: Pick<StoreApi<Store.State>, 'getState' | 'setState'>;
+};
+/** Access-key identity. */
 type Key = {
     /** Root account address. */
     account: Address.Address;
@@ -92,22 +142,33 @@ type Key = {
     accessKey: Address.Address;
     /** Chain ID the access key is scoped to. */
     chainId: number;
-    /** Reactive state store. */
-    store: Store.Store;
 };
-/** Generates a P256 key pair and access key account. */
-export declare function generate(options?: generate.Options): Promise<generate.ReturnType>;
-export declare namespace generate {
-    type Options = {
-        /** Root account to attach to the access key. */
-        account?: TempoAccount.Account | undefined;
-    };
-    type ReturnType = {
-        /** The generated access key account. */
-        accessKey: TempoAccount.AccessKeyAccount;
-        /** Generated key pair to pass to `authorizeAccessKey`. */
-        keyPair: Awaited<globalThis.ReturnType<typeof WebCryptoP256.createKeyPair>>;
-    };
+/** Store-bound access-key operations. */
+type Manager = {
+    /** Adds a signed access-key authorization. */
+    add: (options: Omit<add.Options, 'store'>) => add.ReturnType;
+    /** Prepares, signs, and saves an access key authorization. */
+    authorize: (options: Omit<authorize.Options, 'store'>) => Promise<authorize.ReturnType>;
+    /** Clears all access-key records. */
+    clear: () => void;
+    /** Returns publication status for a stored or on-chain access key. */
+    getStatus: (options: Omit<StatusQuery, 'store'>) => Promise<Status>;
+    /** Returns a locally-signable access key account by exact address. */
+    get: (options: Omit<get.Options, 'store'>) => Promise<get.ReturnType>;
+    /** Returns access-key metadata matching a query. */
+    list: (options: Omit<ListQuery, 'store'>) => readonly AccessKey[];
+    /** Removes an access-key record. */
+    remove: (options: Omit<remove.Options, 'store'>) => void;
+    /** Selects a locally-signable access key account for an intent. */
+    select: (options: Omit<SelectQuery, 'store'>) => Promise<TempoAccount.AccessKeyAccount | undefined>;
+    /** Updates stored authorization metadata for an existing access key. */
+    updateAuthorization: (options: Omit<updateAuthorization.Options, 'store'>) => void;
+};
+/** Creates store-bound access-key operations. */
+export declare function createManager(options: createManager.Options): Manager;
+export declare namespace createManager {
+    /** Options for {@link createManager}. */
+    type Options = ManagerOptions;
 }
 /** Prepares an unsigned key authorization and local key material when needed. */
 export declare function prepareAuthorization(options: prepareAuthorization.Options): Promise<prepareAuthorization.ReturnType>;
@@ -124,10 +185,18 @@ export declare namespace prepareAuthorization {
         keyType?: 'secp256k1' | 'p256' | 'webAuthn' | undefined;
         /** TIP-20 spending limits for this key. */
         limits?: readonly KeyAuthorization.TokenLimit[] | undefined;
+        /** Exported private key backing the access key. */
+        privateKey?: Hex.Hex | undefined;
         /** External public key to derive the access key address from. */
         publicKey?: Hex.Hex | undefined;
         /** Call scopes restricting which contracts/selectors this key can call. */
         scopes?: readonly KeyAuthorization.Scope[] | undefined;
+        /**
+         * TIP-1053 witness (32 bytes) to bind into the key authorization. Set to
+         * `hashMessage(message)` to fuse a Sign-In-with-Tempo proof into the
+         * access-key authorization so both are covered by a single signature.
+         */
+        witness?: Hex.Hex | undefined;
     };
     /** Prepared unsigned key authorization and optional local key material. */
     type ReturnType = {
@@ -135,6 +204,8 @@ export declare namespace prepareAuthorization {
         keyAuthorization: KeyAuthorization.KeyAuthorization<false>;
         /** Generated WebCrypto key pair for local access keys. */
         keyPair?: Awaited<globalThis.ReturnType<typeof WebCryptoP256.createKeyPair>> | undefined;
+        /** Exported private key backing an external access key. */
+        privateKey?: Hex.Hex | undefined;
     };
 }
 /** Prepares, signs, and saves an access key authorization. */
@@ -152,15 +223,36 @@ export declare namespace authorize {
             chainId?: bigint | number | undefined;
         };
         /** Reactive state store. */
-        store: Store.Store;
+        store: ManagerOptions;
     };
     /** Signed key authorization in RPC form. */
     type ReturnType = KeyAuthorization.Rpc;
 }
+/** Returns whether a local access key satisfies reusable authorization parameters. */
+export declare function hasReusableAuthorization(options: ReusableQuery): Promise<boolean>;
+/** Returns whether an authorization request could sign the provided calls. */
+export declare function canAuthorizeCalls(options: CallsQuery): boolean;
 /** Returns publication status for a stored or on-chain access key. */
 export declare function getStatus(options: StatusQuery): Promise<Status>;
 /** Selects a locally-signable access key account for an intent. */
 export declare function select(options: SelectQuery): Promise<TempoAccount.AccessKeyAccount | undefined>;
+/** Returns a locally-signable access key account by exact address. */
+export declare function get(options: get.Options): Promise<get.ReturnType>;
+export declare namespace get {
+    type Options = {
+        /** Root account address. */
+        account: Address.Address;
+        /** Specific access key address to match. */
+        accessKey: Address.Address;
+        /** Chain ID the access key must be authorized on. */
+        chainId: number;
+        /** Current Unix timestamp in seconds. Defaults to `Date.now() / 1000`. */
+        now?: number | undefined;
+        /** Reactive state store. */
+        store: ManagerOptions;
+    };
+    type ReturnType = TempoAccount.AccessKeyAccount | undefined;
+}
 /** Adds a signed access key authorization. */
 export declare function add(options: add.Options): add.ReturnType;
 export declare namespace add {
@@ -175,16 +267,28 @@ export declare namespace add {
         /** The WebCrypto key pair backing the access key. */
         keyPair?: Awaited<globalThis.ReturnType<typeof WebCryptoP256.createKeyPair>> | undefined;
         /** Reactive state store. */
-        store: Store.Store;
+        store: ManagerOptions;
     };
     /** Stored access key record. */
     type ReturnType = AccessKey;
 }
+declare function updateAuthorization(options: updateAuthorization.Options): void;
+declare namespace updateAuthorization {
+    type Options = Key & {
+        /** Signed key authorization for the access key. */
+        authorization: KeyAuthorization.Signed;
+        /** Reactive state store. */
+        store: ManagerOptions;
+    };
+}
 /** Removes an access key record. */
 export declare function remove(options: remove.Options): void;
 export declare namespace remove {
     /** Options for {@link remove}. */
-    type Options = Key;
+    type Options = Key & {
+        /** Reactive state store. */
+        store: ManagerOptions;
+    };
 }
 /** Returns whether an error means an access key is already unavailable on-chain. */
 export declare function isUnavailableError(error: unknown): boolean;

package/dist/core/AccessKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessKey.d.ts","sourceRoot":"","sources":["../../src/core/AccessKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,OAAO,EAAE,GAAG,EAA0B,aAAa,EAAE,MAAM,IAAI,CAAA;AACrF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAC7D,OAAO,EACL,OAAO,IAAI,YAAY,EAGxB,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAExC,QAAA,MAAM,MAAM;IACV,+CAA+C;;IAE/C,yFAAyF;;IAEzF,sDAAsD;;IAEtD,oDAAoD;;CAE5C,CAAA;AAIV,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,MAAM,CAAC,CAAA;AAElD,kDAAkD;AAClD,MAAM,MAAM,SAAS,GAAG;IACtB,0BAA0B;IAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAA;IACvB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACtD,gBAAgB;IAChB,OAAO,EAAE,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,CAAA;IACxD,iDAAiD;IACjD,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,EAAE,GAAG,SAAS,CAAA;IAC7F,2EAA2E;IAC3E,MAAM,CAAC,EACH;QACE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAA;QACvC,UAAU,CAAC,EAAE,SAAS,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAA;KACpD,EAAE,GACH,SAAS,CAAA;CACd,GAAG,KAAK,CACL,EAAE,GACF;IACE,uDAAuD;IACvD,UAAU,EAAE,GAAG,CAAC,GAAG,CAAA;CACpB,GACD;IACE,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAA;CACjE,CACJ,CAAA;AAED,6CAA6C;AAC7C,KAAK,IAAI,GAAG;IACV,qCAAqC;IACrC,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IAChC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;CAC3B,CAAA;AAED,+BAA+B;AAC/B,KAAK,WAAW,GAAG;IACjB,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,CAAA;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACzB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,4BAA4B;IAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;CACnB,CAAA;AAED,kCAAkC;AAClC,KAAK,WAAW,GAAG;IACjB,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,CAAA;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,4BAA4B;IAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;CACnB,CAAA;AAED,KAAK,GAAG,GAAG;IACT,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,0BAA0B;IAC1B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;IAC1B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;CACnB,CAAA;AAiBD,wDAAwD;AACxD,wBAAsB,QAAQ,CAAC,OAAO,GAAE,QAAQ,CAAC,OAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAQ3F;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,gDAAgD;QAChD,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,SAAS,CAAA;KAC3C,CAAA;IAED,KAAK,UAAU,GAAG;QAChB,wCAAwC;QACxC,SAAS,EAAE,YAAY,CAAC,gBAAgB,CAAA;QACxC,0DAA0D;QAC1D,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAA;KAC5E,CAAA;CACF;AAED,iFAAiF;AACjF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,CAAC,OAAO,GACpC,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC,CA6B1C;AAED,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,gDAAgD;IAChD,KAAK,OAAO,GAAG;QACb,+DAA+D;QAC/D,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACrC,mDAAmD;QACnD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;QACxB,2CAA2C;QAC3C,MAAM,EAAE,MAAM,CAAA;QACd,oEAAoE;QACpE,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;QACvD,2CAA2C;QAC3C,MAAM,CAAC,EAAE,SAAS,gBAAgB,CAAC,UAAU,EAAE,GAAG,SAAS,CAAA;QAC3D,iEAAiE;QACjE,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QAC/B,2EAA2E;QAC3E,MAAM,CAAC,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,GAAG,SAAS,CAAA;KACvD,CAAA;IAED,2EAA2E;IAC3E,KAAK,UAAU,GAAG;QAChB,gEAAgE;QAChE,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC1D,0DAA0D;QAC1D,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,GAAG,SAAS,CAAA;KACzF,CAAA;CACF;AAED,8DAA8D;AAC9D,wBAAsB,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAoBzF;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,qCAAqC;IACrC,KAAK,OAAO,GAAG;QACb,0EAA0E;QAC1E,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;QACvD,mFAAmF;QACnF,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;QACxB,2CAA2C;QAC3C,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;YAC1D,mDAAmD;YACnD,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;SACtC,CAAA;QACD,4BAA4B;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;KACnB,CAAA;IAED,4CAA4C;IAC5C,KAAK,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAA;CACvC;AAED,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BrE;AAED,mEAAmE;AACnE,wBAAsB,MAAM,CAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAiBpD;AAkCD,8CAA8C;AAC9C,wBAAgB,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CA6BxD;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,+BAA+B;IAC/B,KAAK,OAAO,GAAG;QACb,sDAAsD;QACtD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,mDAAmD;QACnD,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAA;QACtC,uDAAuD;QACvD,UAAU,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QAChC,qDAAqD;QACrD,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,GAAG,SAAS,CAAA;QACxF,4BAA4B;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAA;KACnB,CAAA;IAED,gCAAgC;IAChC,KAAK,UAAU,GAAG,SAAS,CAAA;CAC5B;AAWD,oCAAoC;AACpC,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAKpD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,kCAAkC;IAClC,KAAK,OAAO,GAAG,GAAG,CAAA;CACnB;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D"}
+{"version":3,"file":"AccessKey.d.ts","sourceRoot":"","sources":["../../src/core/AccessKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,OAAO,EAAE,GAAG,EAA0B,aAAa,EAAE,MAAM,IAAI,CAAA;AACrF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAC7D,OAAO,EACL,OAAO,IAAI,YAAY,EAGxB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAExC,QAAA,MAAM,MAAM;IACV,+CAA+C;;IAE/C,yFAAyF;;IAEzF,sDAAsD;;IAEtD,oDAAoD;;CAE5C,CAAA;AAIV,KAAK,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,MAAM,CAAC,CAAA;AAElD,kDAAkD;AAClD,MAAM,MAAM,SAAS,GAAG;IACtB,0BAA0B;IAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAA;IACvB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,MAAM,GAAG,SAAS,CAAA;IACtD,gBAAgB;IAChB,OAAO,EAAE,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,CAAA;IACxD,iDAAiD;IACjD,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,EAAE,GAAG,SAAS,CAAA;IAC7F,2EAA2E;IAC3E,MAAM,CAAC,EACH;QACE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAA;QACvC,UAAU,CAAC,EAAE,SAAS,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAA;KACpD,EAAE,GACH,SAAS,CAAA;CACd,GAAG,KAAK,CACL,EAAE,GACF;IACE,uDAAuD;IACvD,UAAU,EAAE,GAAG,CAAC,GAAG,CAAA;CACpB,GACD;IACE,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,CAAA;CACjE,CACJ,CAAA;AAED,6CAA6C;AAC7C,MAAM,MAAM,IAAI,GAAG;IACjB,qCAAqC;IACrC,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IAChC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;CAC3B,CAAA;AAED,+BAA+B;AAC/B,KAAK,WAAW,GAAG;IACjB,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,CAAA;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACzB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,kCAAkC;IAClC,KAAK,EAAE,cAAc,CAAA;CACtB,CAAA;AAED,kCAAkC;AAClC,KAAK,WAAW,GAAG;IACjB,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,CAAA;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,kCAAkC;IAClC,KAAK,EAAE,cAAc,CAAA;CACtB,CAAA;AAED,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG;IACxB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,SAAS,gBAAgB,CAAC,UAAU,EAAE,GAAG,SAAS,CAAA;CAC/D,CAAA;AAED,sEAAsE;AACtE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;IAClF,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,gDAAgD;IAChD,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CAChC,CAAA;AAED,KAAK,aAAa,GAAG;IACnB,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,iDAAiD;IACjD,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,CAAA;IACnC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,sEAAsE;IACtE,UAAU,EAAE,qBAAqB,CAAA;IACjC,kCAAkC;IAClC,KAAK,EAAE,cAAc,CAAA;CACtB,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,SAAS,IAAI,EAAE,GAAG,SAAS,CAAA;IACnC,2CAA2C;IAC3C,UAAU,EAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAA;CAClD,CAAA;AAED,KAAK,SAAS,GAAG;IACf,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,KAAK,EAAE,cAAc,CAAA;CACtB,CAAA;AAED,KAAK,cAAc,GAAG;IACpB,oDAAoD;IACpD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC,CAAA;CAC5D,CAAA;AAED,2BAA2B;AAC3B,KAAK,GAAG,GAAG;IACT,4BAA4B;IAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;IACxB,0BAA0B;IAC1B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;IAC1B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,yCAAyC;AACzC,KAAK,OAAO,GAAG;IACb,8CAA8C;IAC9C,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,UAAU,CAAA;IAC5D,8DAA8D;IAC9D,SAAS,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACvF,qCAAqC;IACrC,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,sEAAsE;IACtE,SAAS,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACnE,sEAAsE;IACtE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IACrE,oDAAoD;IACpD,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,SAAS,SAAS,EAAE,CAAA;IACjE,oCAAoC;IACpC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACxD,mEAAmE;IACnE,MAAM,EAAE,CACN,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,KAChC,OAAO,CAAC,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;IACvD,wEAAwE;IACxE,mBAAmB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CACnF,CAAA;AAED,iDAAiD;AACjD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,GAAG,OAAO,CAYrE;AAED,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,yCAAyC;IACzC,KAAK,OAAO,GAAG,cAAc,CAAA;CAC9B;AAED,iFAAiF;AACjF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,CAAC,OAAO,GACpC,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC,CA+D1C;AAED,MAAM,CAAC,OAAO,WAAW,oBAAoB,CAAC;IAC5C,gDAAgD;IAChD,KAAK,OAAO,GAAG;QACb,+DAA+D;QAC/D,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;QACrC,mDAAmD;QACnD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;QACxB,2CAA2C;QAC3C,MAAM,EAAE,MAAM,CAAA;QACd,oEAAoE;QACpE,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;QACvD,2CAA2C;QAC3C,MAAM,CAAC,EAAE,SAAS,gBAAgB,CAAC,UAAU,EAAE,GAAG,SAAS,CAAA;QAC3D,mDAAmD;QACnD,UAAU,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QAChC,iEAAiE;QACjE,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QAC/B,2EAA2E;QAC3E,MAAM,CAAC,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,GAAG,SAAS,CAAA;QACtD;;;;WAIG;QACH,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;KAC9B,CAAA;IAED,2EAA2E;IAC3E,KAAK,UAAU,GAAG;QAChB,gEAAgE;QAChE,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAC1D,0DAA0D;QAC1D,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,GAAG,SAAS,CAAA;QACxF,2DAA2D;QAC3D,UAAU,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;KACjC,CAAA;CACF;AAED,8DAA8D;AAC9D,wBAAsB,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAsBzF;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,qCAAqC;IACrC,KAAK,OAAO,GAAG;QACb,0EAA0E;QAC1E,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;QACvD,mFAAmF;QACnF,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;QACxB,2CAA2C;QAC3C,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;YAC1D,mDAAmD;YACnD,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;SACtC,CAAA;QACD,4BAA4B;QAC5B,KAAK,EAAE,cAAc,CAAA;KACtB,CAAA;IAED,4CAA4C;IAC5C,KAAK,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAA;CACvC;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAavF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAE9D;AAED,sEAAsE;AACtE,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BrE;AAED,mEAAmE;AACnE,wBAAsB,MAAM,CAC1B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAsBpD;AAED,sEAAsE;AACtE,wBAAsB,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAgBvE;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,KAAK,OAAO,GAAG;QACb,4BAA4B;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,4CAA4C;QAC5C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;QAC1B,qDAAqD;QACrD,OAAO,EAAE,MAAM,CAAA;QACf,0EAA0E;QAC1E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACxB,4BAA4B;QAC5B,KAAK,EAAE,cAAc,CAAA;KACtB,CAAA;IAED,KAAK,UAAU,GAAG,YAAY,CAAC,gBAAgB,GAAG,SAAS,CAAA;CAC5D;AAkCD,8CAA8C;AAC9C,wBAAgB,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CA8BxD;AAED,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,+BAA+B;IAC/B,KAAK,OAAO,GAAG;QACb,sDAAsD;QACtD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAA;QACxB,mDAAmD;QACnD,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAA;QACtC,uDAAuD;QACvD,UAAU,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;QAChC,qDAAqD;QACrD,OAAO,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC,GAAG,SAAS,CAAA;QACxF,4BAA4B;QAC5B,KAAK,EAAE,cAAc,CAAA;KACtB,CAAA;IAED,gCAAgC;IAChC,KAAK,UAAU,GAAG,SAAS,CAAA;CAC5B;AAWD,iBAAS,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAYvE;AAED,OAAO,WAAW,mBAAmB,CAAC;IACpC,KAAK,OAAO,GAAG,GAAG,GAAG;QACnB,mDAAmD;QACnD,aAAa,EAAE,gBAAgB,CAAC,MAAM,CAAA;QACtC,4BAA4B;QAC5B,KAAK,EAAE,cAAc,CAAA;KACtB,CAAA;CACF;AAED,oCAAoC;AACpC,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAKpD;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,kCAAkC;IAClC,KAAK,OAAO,GAAG,GAAG,GAAG;QACnB,4BAA4B;QAC5B,KAAK,EAAE,cAAc,CAAA;KACtB,CAAA;CACF;AAQD,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D"}

package/dist/core/AccessKey.js

@@ -14,16 +14,48 @@ const status = {
     expired: 'expired',
 };
 const unavailableErrorNames = new Set(['KeyAlreadyRevoked', 'KeyNotFound']);
-/** Generates a P256 key pair and access key account. */
-export async function generate(options = {}) {
-    const { account } = options;
-    const keyPair = await WebCryptoP256.createKeyPair();
-    const accessKey = TempoAccount.fromWebCryptoP256(keyPair, account ? { access: account } : undefined);
-    return { accessKey, keyPair };
+/** Creates store-bound access-key operations. */
+export function createManager(options) {
+    return {
+        add: (parameters) => add({ ...parameters, store: options }),
+        authorize: (parameters) => authorize({ ...parameters, store: options }),
+        clear: () => clear({ store: options }),
+        get: (parameters) => get({ ...parameters, store: options }),
+        getStatus: (parameters) => getStatus({ ...parameters, store: options }),
+        list: (parameters) => list({ ...parameters, store: options }),
+        remove: (parameters) => remove({ ...parameters, store: options }),
+        select: (parameters) => select({ ...parameters, store: options }),
+        updateAuthorization: (parameters) => updateAuthorization({ ...parameters, store: options }),
+    };
 }
 /** Prepares an unsigned key authorization and local key material when needed. */
 export async function prepareAuthorization(options) {
-    const { address, chainId, expiry, keyType, limits, publicKey, scopes } = options;
+    const { address, chainId, expiry, keyType, limits, privateKey, publicKey, scopes, witness } = options;
+    if (privateKey) {
+        const type = keyType ?? 'secp256k1';
+        const accessKey = (() => {
+            switch (type) {
+                case 'secp256k1':
+                    return TempoAccount.fromSecp256k1(privateKey);
+                case 'p256':
+                    return TempoAccount.fromP256(privateKey);
+                case 'webAuthn':
+                    throw new RpcResponse.InvalidParamsError({
+                        message: '`privateKey` cannot be used with `keyType: "webAuthn"`.',
+                    });
+            }
+        })();
+        const keyAuthorization = KeyAuthorization.from({
+            address: accessKey.address,
+            chainId: BigInt(chainId),
+            expiry,
+            limits,
+            scopes,
+            type,
+            ...(witness ? { witness } : {}),
+        });
+        return { keyAuthorization, privateKey };
+    }
     if (address || publicKey) {
         const keyAuthorization = KeyAuthorization.from({
             address: address ?? Address.fromPublicKey(PublicKey.from(publicKey)),
@@ -32,6 +64,7 @@ export async function prepareAuthorization(options) {
             limits,
             scopes,
             type: keyType ?? 'secp256k1',
+            ...(witness ? { witness } : {}),
         });
         return { keyAuthorization };
     }
@@ -39,6 +72,10 @@ export async function prepareAuthorization(options) {
         throw new RpcResponse.InvalidParamsError({
             message: `\`keyType: "${keyType}"\` requires externally generated key material; provide \`publicKey\` or \`address\`.`,
         });
+    if (!globalThis.crypto?.subtle)
+        throw new RpcResponse.InvalidParamsError({
+            message: 'Generated P256 access keys require WebCrypto support; provide `publicKey` or `address` instead.',
+        });
     const keyPair = await WebCryptoP256.createKeyPair();
     const keyAuthorization = KeyAuthorization.from({
         address: Address.fromPublicKey(PublicKey.from(keyPair.publicKey)),
@@ -47,12 +84,14 @@ export async function prepareAuthorization(options) {
         limits,
         scopes,
         type: 'p256',
+        ...(witness ? { witness } : {}),
     });
     return { keyAuthorization, keyPair };
 }
 /** Prepares, signs, and saves an access key authorization. */
 export async function authorize(options) {
-    const { account, chainId, parameters, store } = options;
+    const { account, chainId, parameters } = options;
+    const { store } = options;
     const prepared = await prepareAuthorization({
         ...parameters,
         chainId: parameters.chainId ?? chainId,
@@ -66,15 +105,39 @@ export async function authorize(options) {
         account: account.address,
         authorization: keyAuthorization,
         ...(prepared.keyPair ? { keyPair: prepared.keyPair } : {}),
+        ...(prepared.privateKey ? { privateKey: prepared.privateKey } : {}),
         store,
     });
     return KeyAuthorization.toRpc(keyAuthorization);
 }
+/** Returns whether a local access key satisfies reusable authorization parameters. */
+export async function hasReusableAuthorization(options) {
+    const { account, calls, chainId, parameters, store } = options;
+    const now = options.now ?? Date.now() / 1000;
+    const records = list({ account, chainId, store });
+    for (const record of records) {
+        if (isExpired(record.expiry, now))
+            continue;
+        if (!authorizationMatches(record, parameters))
+            continue;
+        if (calls && !recordScopesMatch(record, { calls }))
+            continue;
+        if (!(await hydrate(record, store)))
+            continue;
+        return true;
+    }
+    return false;
+}
+/** Returns whether an authorization request could sign the provided calls. */
+export function canAuthorizeCalls(options) {
+    return scopesMatch(options.parameters.scopes, { calls: options.calls });
+}
 /** Returns publication status for a stored or on-chain access key. */
 export async function getStatus(options) {
-    const { accessKey, account, calls, chainId, client, store } = options;
+    const { accessKey, account, calls, chainId, client } = options;
+    const { store } = options;
     const now = options.now ?? Date.now() / 1000;
-    const local = list({ account, accessKey, chainId, store }).find((key) => scopesMatch(key, { calls }));
+    const local = list({ account, accessKey, chainId, store }).find((key) => recordScopesMatch(key, { calls }));
     if (local) {
         if (isExpired(local.expiry, now))
             return status.expired;
@@ -105,18 +168,42 @@ export async function select(options) {
     const now = options.now ?? Date.now() / 1000;
     const records = list({ account, chainId, store });
     for (const record of records) {
-        if (!scopesMatch(record, { calls }))
+        if (!recordScopesMatch(record, { calls }))
             continue;
         if (isExpired(record.expiry, now)) {
-            remove({ accessKey: record.address, account: record.access, chainId: record.chainId, store });
+            await remove({
+                accessKey: record.address,
+                account: record.access,
+                chainId: record.chainId,
+                store,
+            });
             continue;
         }
-        const account_accessKey = hydrate(record, store);
+        const account_accessKey = await hydrate(record, store);
         if (!account_accessKey)
             continue;
         return account_accessKey;
     }
 }
+/** Returns a locally-signable access key account by exact address. */
+export async function get(options) {
+    const { accessKey, account, chainId } = options;
+    const { store } = options;
+    const now = options.now ?? Date.now() / 1000;
+    const record = list({ account, accessKey, chainId, store })[0];
+    if (!record)
+        return undefined;
+    if (isExpired(record.expiry, now)) {
+        await remove({
+            accessKey: record.address,
+            account: record.access,
+            chainId: record.chainId,
+            store,
+        });
+        return undefined;
+    }
+    return await hydrate(record, store);
+}
 function createKeyAuthorizationManager(store) {
     return TempoKeyAuthorizationManager.from({
         source: {
@@ -137,11 +224,11 @@ function createKeyAuthorizationManager(store) {
                 });
             },
             set(key, keyAuthorization) {
-                patch({
+                updateAuthorization({
                     account: key.address,
                     accessKey: key.accessKey,
+                    authorization: keyAuthorization,
                     chainId: key.chainId,
-                    patch: { keyAuthorization },
                     store,
                 });
             },
@@ -150,7 +237,8 @@ function createKeyAuthorizationManager(store) {
 }
 /** Adds a signed access key authorization. */
 export function add(options) {
-    const { account, authorization, keyPair, privateKey, store } = options;
+    const { account, authorization, keyPair, privateKey } = options;
+    const { store } = options;
     const base = {
         address: authorization.address,
         access: account,
@@ -162,7 +250,7 @@ export function add(options) {
         scopes: authorization.scopes,
     };
     const record = (privateKey ? { ...base, privateKey } : keyPair ? { ...base, keyPair } : base);
-    store.setState((state) => ({
+    store.state.setState((state) => ({
         accessKeys: [
             record,
             ...state.accessKeys.filter((entry) => !matches(entry, {
@@ -182,13 +270,31 @@ function clearAuthorization(options) {
         store,
     });
 }
+function updateAuthorization(options) {
+    const { authorization, store, ...key } = options;
+    patch({
+        ...key,
+        patch: {
+            expiry: authorization.expiry ?? undefined,
+            keyAuthorization: authorization,
+            limits: authorization.limits,
+            scopes: authorization.scopes,
+        },
+        store,
+    });
+}
 /** Removes an access key record. */
 export function remove(options) {
     const { store, ...key } = options;
-    store.setState((state) => ({
+    store.state.setState((state) => ({
         accessKeys: state.accessKeys.filter((record) => !matches(record, key)),
     }));
 }
+/** Clears all access-key records. */
+function clear(options) {
+    const { store } = options;
+    store.state.setState({ accessKeys: [] });
+}
 /** Returns whether an error means an access key is already unavailable on-chain. */
 export function isUnavailableError(error) {
     if (error instanceof BaseError) {
@@ -203,8 +309,10 @@ export function isUnavailableError(error) {
         return false;
     return unavailableErrorNames.has(ExecutionError.parse(error).errorName);
 }
-function scopesMatch(key, options) {
-    const scopes = key.scopes;
+function recordScopesMatch(key, options) {
+    return scopesMatch(key.scopes, options);
+}
+function scopesMatch(scopes, options) {
     if (typeof scopes === 'undefined')
         return true;
     if (!Array.isArray(scopes))
@@ -224,16 +332,7 @@ function scopesMatch(key, options) {
             const selector = scope.selector;
             if (!selector)
                 return scope.recipients ? scope.recipients.length === 0 : true;
-            const scopeSelector = (() => {
-                try {
-                    return (selector.startsWith('0x') && selector.length === 10
-                        ? selector
-                        : AbiFunction.getSelector(selector)).toLowerCase();
-                }
-                catch {
-                    return undefined;
-                }
-            })();
+            const scopeSelector = normalizeSelector(selector);
             if (!scopeSelector || callSelector !== scopeSelector)
                 return false;
             if (!scope.recipients || scope.recipients.length === 0)
@@ -247,6 +346,66 @@ function scopesMatch(key, options) {
         });
     });
 }
+function authorizationMatches(key, parameters) {
+    if (!scopesCover(key.scopes, parameters.scopes))
+        return false;
+    if (typeof parameters.reuse?.minExpiry === 'number' &&
+        key.expiry &&
+        key.expiry < parameters.reuse.minExpiry)
+        return false;
+    if (!limitsCover(key.limits, parameters.reuse?.minLimits))
+        return false;
+    return true;
+}
+function scopesCover(existing, requested) {
+    if (!requested)
+        return true;
+    if (!existing)
+        return true;
+    return requested.every((scope) => existing.some((candidate) => scopeCovers(candidate, scope)));
+}
+function scopeCovers(existing, requested) {
+    if (!isScope(existing) || !isScope(requested))
+        return false;
+    if (existing.address.toLowerCase() !== requested.address.toLowerCase())
+        return false;
+    if (!selectorCovers(existing.selector, requested.selector))
+        return false;
+    return recipientsCover(existing.recipients, requested.recipients);
+}
+function selectorCovers(existing, requested) {
+    if (!existing)
+        return true;
+    if (!requested)
+        return false;
+    const selector_existing = normalizeSelector(existing);
+    const selector_requested = normalizeSelector(requested);
+    return !!selector_existing && selector_existing === selector_requested;
+}
+function normalizeSelector(value) {
+    try {
+        return (value.startsWith('0x') && value.length === 10 ? value : AbiFunction.getSelector(value)).toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+function recipientsCover(existing, requested) {
+    if (!existing || existing.length === 0)
+        return true;
+    if (!requested || requested.length === 0)
+        return false;
+    return requested.every((address) => existing.some((candidate) => candidate.toLowerCase() === address.toLowerCase()));
+}
+function limitsCover(existing, requested) {
+    if (!requested)
+        return true;
+    if (!existing)
+        return true;
+    return requested.every((limit) => existing.some((candidate) => candidate.token.toLowerCase() === limit.token.toLowerCase() &&
+        Number(candidate.period ?? 0) === Number(limit.period ?? 0) &&
+        BigInt(candidate.limit) >= BigInt(limit.limit)));
+}
 function isScope(scope) {
     if (!scope || typeof scope !== 'object')
         return false;
@@ -265,7 +424,7 @@ function isScope(scope) {
     }
     return true;
 }
-function hydrate(accessKey, store) {
+async function hydrate(accessKey, store) {
     const keyAuthorizationManager = createKeyAuthorizationManager(store);
     if ('keyPair' in accessKey && accessKey.keyPair)
         return TempoAccount.fromWebCryptoP256(accessKey.keyPair, {
@@ -314,11 +473,11 @@ async function getPublishedStatus(client, options) {
 }
 function list(options) {
     const { store, ...query } = options;
-    return store.getState().accessKeys.filter((key) => matches(key, query));
+    return store.state.getState().accessKeys.filter((key) => matches(key, query));
 }
 function patch(options) {
     const { patch, store, ...key } = options;
-    store.setState((state) => ({
+    store.state.setState((state) => ({
         accessKeys: state.accessKeys.map((record) => {
             if (!matches(record, key))
                 return record;