accounts 0.21.1 → 1.0.0-alpha.1

package/CHANGELOG.md

@@ -1,19 +1,53 @@
 # accounts
 
+## 1.0.0-alpha.1
+
+### Major Changes
+
+- Initial release.
+
+### Minor Changes
+
+- e698723: Added `audience` to `AccessToken.create` of `accounts/internal`, which verifies the access tokens of a registered resource, such as an MCP server, whose `aud` names the resource's identifier. `Actions.oauth.introspect` returns the token's `aud` as `audience`.
+- 2e01ee5: Added `redirect`, `redirectUri`, and `state` to `Actions.account.revokeAccessKey` of `accounts/internal`. With `redirect: true`, it returns the `url` of Tempo ID's approval page at `/access-keys/revoke`, where any owner of the account signs the revocation, a passkey included.
+  
+  ```ts
+  import { Actions } from 'accounts/internal'
+  
+  const { url } = await Actions.account.revokeAccessKey(accounts.config, {
+    accessKey: session.key.keyAuthorization.keyId,
+    account: session.key.account,
+    chainId: 4217,
+    redirect: true,
+  })
+  ```
+
+### Patch Changes
+
+- 690f13b: Added `allowance_redeemed` and `unknown_allowance` to `Accounts.RequestError.Reason`, the refusals of Tempo ID's `POST /v1/access-keys/connect`.
+
+## 1.0.0-alpha.0
+
+### Major Changes
+
+- dcdbf50: Initial release.
+
 ## 0.21.1
 
 ### Patch Changes
 
 - b2535d3: Reclaim expired in-memory KV entries on writes and propagate finite cache TTLs to backing storage. Capacity remains unlimited by default; opt in with `Kv.memory({ maxEntries })` to reject new keys at a chosen capacity without evicting live authentication state. Deployments must size an explicit cap and apply admission controls to avoid blocking legitimate writes.
-  
+
   Validate the current adapter account before local access-key transaction paths and discard keys belonging to accounts omitted by a new wallet selection. Privy revocation now waits for successful execution before deleting local key state, retaining keys on pending or failed revocations.
-  
+
   Upgrade Hono to 4.13.11 to fix double-decoding of static paths that could bypass middleware.
+
 - 00b6ee3: Updated `viem` to 2.57.12 and `ox` to 0.14.59, which derive configurable account addresses from the hash of the initial config. The `viem` peer range now starts at 2.57.12, since an earlier Viem derives other addresses.
 - 80bdb13: `Handler.relay` no longer signs as its own fee payer when a request names an app's fee payer URL and that relay returns an unsigned fill. It answers with an invalid-params error instead, so an app's URL can no longer make the relay's fee payer pay without its `validate`.
 - b38af80: Treat a retried `eth_sendRawTransaction` or `eth_sendRawTransactionSync` that the node rejects with `already known` or `nonce too low` as successful when the node knows the transaction's hash. viem's transports retry a submission after a timeout, a network error or a 5xx response, so a transaction that landed on the first attempt could previously fail the send.
-  
+
   An access-key send that times out or loses its response no longer falls back to signing the same calls with the root account, which could send them twice.
+
 - 581bf10: Fixed `Handler` listeners to respond with a 400 to requests with an unparseable `Host` header or request target.
 - 9c6dee1: Fixed Node request listeners to safely cancel oversized uploads and close unfinished connections after sending the response.
 - 51f3b65: Added `handoff` to the postMessage `tempoWallet()` adapter and `Handoff.read()`. Tempo Wallet shows a QR code so someone without a passkey on the computer can approve the request with their phone. By default the requesting tab receives the result. With `handoff.url`, the phone's browser opens that page on the app's origin instead, and it receives the result and an access key the phone generated, which `Handoff.read()` returns. `handoff: false` hides the QR code.
@@ -24,8 +58,9 @@
 - 7b24e3e: Added `WebAuthnCeremony.deferred`, a `WebAuthnCeremony.server` variant that answers registration as soon as the passkey is created and verifies it with the server in the background, retrying requests that fail in transit. The `webAuthn` adapter makes logins and disconnects wait for that verification for up to 10 s, then cancels it, so it can't replace the session that follows. A registration whose server-parsed public key differs from the client's is refused, and one acknowledged without its session ends the session in place. If the server rejects the registration while the page is open, the adapter removes the account and its access keys and keeps the public key in storage; a later login with the passkey restores the account. `WebAuthnCeremony.server` now also ends its session on `wallet_disconnect` when passed as `ceremony`. `WebAuthnCeremony.server`'s `logout` now fails on an error response other than 404. `Handler.webAuthn`'s `/register` revokes the session presented with it when it issues a new one, and answers a retry after a stored registration with `Credential already exists` even when the challenge was already used.
 - 904e9b0: `WebAuthnCeremony.deferred` now also answers a login with a known passkey as soon as its signature checks out against the stored public key, and verifies it with the server (`POST /login`) in the background. `verifyAuthentication` takes an optional `credential` (the signed challenge, public key and RP ID) and `signal`, and may return `verified`, which resolves `{ session }`. The `webAuthn` adapter passes its stored credential and makes later logins, sign-ups and disconnects wait for the verification. A login the server refuses (it doesn't know the credential, the signature fails, or a hook denies it with 401 or 403) ends the session in place and drops the account. A login whose outcome stays unknown (it failed in transit, a retry found its challenge consumed, or the server failed for another reason) ends the session in place (retrying the logout until it succeeds or a later login, sign-up or disconnect cancels it) and keeps the account. `WebAuthnCeremony.server`'s `verifyAuthentication` now returns only its declared fields. Signing a digest with the latest registration's own credential (e.g. an access key authorized right after sign-up) no longer waits for that registration to land, since it needs no server login. `verifyAuthentication` also takes `ready`, a promise a server-backed ceremony waits for before sending `/login`: the adapter passes its wait for earlier registrations, so a deferred login answers at once and only its background `/login` waits. `verifyRegistration` takes `ready` too: a sign-up answers at once, and its background `/register` waits for logins and registrations still verifying, so it still sets the session last.
 - 84d2087: Added `prefetch` to `WebAuthnCeremony.server` and `WebAuthnCeremony.deferred`. It fetches a login and a registration challenge ahead of the ceremonies that use them, so their options are built locally instead of waiting for the server to store a challenge. Each challenge taken is replaced in the background. The `webAuthn` adapter's login with a known passkey uses a prefetched challenge (`takeChallenge`) instead of registering a random one. `Handler.webAuthn`'s `/register/options` issues a challenge without a `name`, and `/register` then takes the name sent with the credential. It binds a random `userId` when none is sent, so `Provider` no longer generates one for `wallet_connect` sign-ups; `WebAuthnCeremony.local`, and `WebAuthnCeremony.server` when it requests its own options, generate a random one instead. The `webAuthn` adapter still passes a random one to ceremonies that don't prefetch.
-  
+
   `Handler.webAuthn`'s `/register/options` and `/login/options` now return the challenge `ttl` (seconds) alongside `options`, and `/register` rejects a login challenge.
+
 - 6a163eb: `Handler.webAuthn`: `/register` reads the challenge and checks for a duplicate credential in parallel, and deletes the challenge after responding when the runtime exposes `waitUntil` (pass the execution context to `handler.fetch`). Stores with `take` (e.g. `Kv.memory`, `Kv.durableObject`) now consume register and login challenges atomically, so each is single-use.
 
 ## 0.21.0
@@ -33,8 +68,9 @@
 ### Minor Changes
 
 - a60b2c6: Added `provider.ready()`, which resolves once the provider has loaded its stored state and rejects with `Store.HydrationError` when the storage read fails or takes longer than the new `hydrationTimeout` option (default 10 seconds). `request` now waits for the load instead of continuing with an empty store after 100ms, and rejects with an `RpcResponse.InternalError` caused by the `Store.HydrationError` when the load fails. `getAccount` throws `Store.HydrationError` until the load finishes instead of reporting no accounts.
-  
+
   The default storage now uses IndexedDB only where `indexedDB` exists, so React Native gets memory storage, and keeps state in memory when IndexedDB fails.
+
 - 4008d21: Add an optional `chainId` to `wallet_revokeAccessKey` so callers can revoke an access key on a specific chain. The provider rejects a chain it is not configured for. Local, Privy, dialog, device-code (including CLI), postMessage and mobile web auth revocations target that chain and remove the local key for it only after the revocation succeeds. Other JSON-RPC adapters reject a `chainId` other than the active chain. Omitting `chainId` keeps revoking on the active chain.
 
 ### Patch Changes

package/README.md

@@ -6,7 +6,7 @@
   </picture>
 </p>
 
-<p align="center"><b>Tempo Accounts SDK for apps and wallets building stablecoin experiences on Tempo.</b></p>
+<p align="center"><b>Accounts SDK for Apps building on Tempo</b></p>
 
 <p align="center">
   <a href="https://accounts.tempo.xyz">Website</a> · <a href="https://accounts.tempo.xyz/docs">Docs</a> · <a href="#install">Install</a> · <a href="#examples">Examples</a> · <a href="#development">Development</a>
@@ -14,26 +14,50 @@
 
 ---
 
+> [!WARNING]
+> `accounts@1` is in alpha, under the `alpha` dist-tag. Its API is not stable yet.
+
 ## Quick Prompt
 
 Prompt your agent:
 
 ```
-Read accounts.tempo.xyz/docs and integrate Tempo Wallet into my application
+Read accounts.tempo.xyz and integrate Tempo into my application
 ```
 
 ## Install
 
 ```bash
-npm i accounts
+npm i accounts@alpha viem
 ```
 
 ```bash
-pnpm i accounts
+pnpm i accounts@alpha viem
 ```
 
 ```bash
-bun i accounts
+bun i accounts@alpha viem
+```
+
+## Usage
+
+Create an instance with `Accounts.create`, and add a plugin from `accounts/plugins` for each sign-in method. Without a sign-in plugin, users sign in through Tempo ID in a dialog on the page:
+
+```ts
+import { Accounts } from 'accounts'
+import { viem } from 'accounts/plugins'
+
+const accounts = Accounts.create({
+  // Each sign-in requests an access key that may spend up to 10 OUSD for a day.
+  accessKey: {
+    expiry: '1d',
+    limits: [{ limit: '10', token: 'ousd' }],
+  },
+  plugins: [viem()],
+})
+
+await accounts.dialog.signIn()
+await accounts.token.transferSync({ amount, to, token })
 ```
 
 ## Documentation
@@ -48,67 +72,23 @@ Join the Telegram group to chat with the team and other devs: [@mpp_devs](https:
 
 ## Examples
 
-| Example                                                       | Description                                                                      |
-| ------------------------------------------------------------- | -------------------------------------------------------------------------------- |
-| [basic](./examples/basic)                                     | Wagmi-based setup using the `tempoWallet` connector to connect to Tempo Wallet.  |
-| [deposits](./examples/deposits)                               | Open the deposit UI with optional pre-filled fields.                             |
-| [cli](./examples/cli)                                         | Minimal CLI setup to connect and authorize local keys using Tempo Wallet.        |
-| [webauthn](./examples/webauthn)                               | Domain-bound passkey example using Wagmi and the `webAuthn` connector.           |
-| [access-key](./examples/access-key)                           | Authorize access keys using Tempo Wallet to submit transactions without prompts. |
-| [access-key-and-webauthn](./examples/access-key-and-webauthn) | Authorize access keys using domain-bound Passkeys.                               |
-| [fee-payer](./examples/fee-payer)                             | Sponsor transactions via Tempo Wallet.                                           |
-| [fee-payer-and-webauthn](./examples/fee-payer-and-webauthn)   | Sponsor transactions using a Cloudflare Worker with domain-bound Passkeys.       |
-| [mpp](./examples/mpp)                                         | Auto-pay HTTP `402` responses served by a Hono server using `mppx/hono`.         |
+| Example                       | Description                                                              |
+| ----------------------------- | ------------------------------------------------------------------------ |
+| [web](./examples/web)         | Sign in through a dialog on the page, and send OUSD with the access key. |
+| [wagmi](./examples/wagmi)     | Sign in through wagmi's `connect`, with the `tempoId` connector.         |
+| [backend](./examples/backend) | Sign in through a redirect, with the session on a Cloudflare Worker.     |
+| [cli](./examples/cli)         | Sign in through the device grant, with a code approved in a browser.     |
+| [mobile](./examples/mobile)   | Sign in through the system browser in an Expo app.                       |
 
 ## Development
 
-Requires [Docker](https://docs.docker.com/get-docker/) and [OrbStack](https://orbstack.dev/) (recommended on macOS for automatic HTTPS `.accounts.local` domains).
-
 ```sh
-pnpm dev              # start all dev services via docker compose
 pnpm build            # build library
 pnpm check            # lint + format
 pnpm check:types      # type checks
 pnpm test             # run tests
 ```
 
-### Services
-
-| Service          | OrbStack URL                        |
-| ---------------- | ----------------------------------- |
-| Playground       | `https://playground.accounts.local` |
-| Dialog Reference | `https://dialog-ref.accounts.local` |
-| Docs             | `https://docs.accounts.local`       |
-| Wagmi Playground | `https://wagmi.accounts.local`      |
-
-## Deployment
-
-The docs site is configured for Vercel as a monorepo project.
-
-| Setting        | Value        |
-| -------------- | ------------ |
-| Root Directory | `site`       |
-| Build Command  | `pnpm build` |
-| Dev Command    | `pnpm dev`   |
-
-Set `VITE_BASE_URL` to the production docs origin when using a custom domain.
-
-### Playgrounds
-
-| Playground                   | Command          | Description                                  |
-| ---------------------------- | ---------------- | -------------------------------------------- |
-| [web](./playgrounds/web)     | `pnpm dev`       | Web playground for dialog + adapter testing. |
-| [wagmi](./playgrounds/wagmi) | `pnpm dev:wagmi` | Wagmi-based playground with connectors.      |
-| [cli](./playgrounds/cli)     | `pnpm dev:cli`   | CLI playground for device-code auth flow.    |
-
-### Reference Implementations
-
-The `ref-impls/` directory contains reference implementations for building with Tempo Accounts SDK:
-
-| Directory           | Description                                                                                                                                                                              |
-| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ref-impls/dialog/` | Minimal, unstyled embed dialog app demonstrating how to build a custom embed using the `Remote` API. Select `dialogRefImpl` in the web playground's adapter dropdown to test against it. |
-
 ## License
 
 <sup>

package/dist/Accounts.d.ts

@@ -0,0 +1,320 @@
+/**
+ * Creates a Tempo ID instance: its configuration, the session of its user, and the namespaces of its
+ * plugins.
+ *
+ * @example
+ * ```ts
+ * import { Accounts, Plugin } from 'accounts'
+ * const accounts = Accounts.create({
+ *   accessKey: {
+ *     expiry: '1d',
+ *     limits: [{ limit: '10', token: 'ousd' }],
+ *   },
+ *   plugins: [email()],
+ * })
+ *
+ * const session = await accounts.session.get()
+ * ```
+ * @module
+ */
+import type * as ClientAssertion from './internal/ClientAssertion.js';
+import type { Dpop } from './internal/Dpop.js';
+import * as Core from './internal/Core.js';
+import * as DefaultDialog from './internal/DefaultDialog.js';
+import * as InternalSession from './internal/Session.js';
+import type { Permissions } from './Permissions.js';
+import * as Plugin from './Plugin.js';
+import { funding } from './plugins/funding.js';
+import type * as Session from './Session.js';
+import type { Store } from './Store.js';
+import type * as TempoAccount from './internal/TempoAccount.js';
+/** Tempo ID lists no chain with the access key's chain ID, so the client's account signs no message on it. */
+export declare class ChainUnavailableError extends Error {
+    readonly name = "Accounts.ChainUnavailableError";
+    constructor(options: ChainUnavailableError.Options);
+}
+export declare namespace ChainUnavailableError {
+    type Options = {
+        /** The access key's chain ID. */
+        chainId: number;
+    };
+}
+/** An action received a `challenge` without `accessKey`. A challenge rides in an access key. */
+export declare class ChallengeWithoutKeyError extends Error {
+    readonly name = "Accounts.ChallengeWithoutKeyError";
+    constructor();
+}
+/** `Accounts.create` received no `clientId` outside a browser, where no page's origin can serve as one. */
+export declare class ClientIdRequiredError extends Error {
+    readonly name = "Accounts.ClientIdRequiredError";
+    constructor();
+}
+/**
+ * A `signOut` with `everywhere` from an app that is not first-party, which Tempo ID refuses to end
+ * the user's Tempo ID session for.
+ */
+export declare class EverywhereNotAllowedError extends Error {
+    readonly name = "Accounts.EverywhereNotAllowedError";
+    constructor();
+}
+/**
+ * The client's account signs messages and typed data only, since its sign-in requested no access key, so
+ * it sends no transaction.
+ */
+export declare class KeyRequiredError extends Error {
+    readonly name = "Accounts.KeyRequiredError";
+    constructor();
+}
+/**
+ * A backend's `complete` received a session ID without a redirect in progress, such as a callback
+ * that arrived twice, or after 10 minutes.
+ */
+export declare class PendingNotFoundError extends Error {
+    readonly name = "Accounts.PendingNotFoundError";
+    constructor();
+}
+/** A request that Tempo ID refused. */
+export declare class RequestError extends Error {
+    readonly name = "Accounts.RequestError";
+    /** The OAuth error code, such as `invalid_authorization_details`. */
+    readonly code: string;
+    /** The request field at fault, as a dotted path. */
+    readonly field: string | undefined;
+    /** The values that the refusal compared, such as `maximum`. Base units are decimal strings. */
+    readonly meta: Readonly<Record<string, number | string>> | undefined;
+    /** A stable name for the refusal, to branch on. */
+    readonly reason: RequestError.Reason | undefined;
+    /** Whether a sign-in verified before the refusal, so the user is signed in. */
+    readonly signedIn: boolean;
+    /** The HTTP status, or 0 for a request without a response. */
+    readonly status: number;
+    /** The page that explains the error. */
+    readonly uri: string | undefined;
+    constructor(options: RequestError.Options);
+}
+export declare namespace RequestError {
+    type Options = {
+        /** The error that caused this one. */
+        cause?: unknown;
+        /** The OAuth `error`. */
+        code: string;
+        /** The request field at fault. */
+        field?: string | undefined;
+        /** The `error_description`. */
+        message: string;
+        /** The values that the refusal compared. */
+        meta?: Readonly<Record<string, number | string>> | undefined;
+        /** The refusal's stable name. Absent from the issuer's own errors. */
+        reason?: Reason | undefined;
+        /** Whether a sign-in verified before the refusal. Defaults to `false`. */
+        signedIn?: boolean | undefined;
+        /** The HTTP status, or 0 without a response. */
+        status: number;
+        /** The `error_uri`. */
+        uri?: string | undefined;
+    };
+    /** Each refusal's stable name, as `docs/errors.md` explains. */
+    type Reason = 'access_key_taken' | 'allowance_redeemed' | 'already_decided' | 'app_exists' | 'authorization_expired' | 'backend_sign_in_not_permitted' | 'body_too_large' | 'challenge_not_permitted' | 'config_conflict' | 'configurable_accounts_disabled' | 'consent_required' | 'cross_site_request' | 'duplicate_limit' | 'duplicate_scope' | 'embed_not_permitted' | 'employee_required' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'funding_unavailable' | 'insufficient_balance' | 'invalid_app' | 'invalid_chain' | 'invalid_client' | 'invalid_client_attestation' | 'invalid_code' | 'invalid_dpop_proof' | 'invalid_expiry' | 'invalid_field' | 'invalid_id_token_hint' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'invalid_realm' | 'invalid_recipients' | 'invalid_resource' | 'invalid_target' | 'invalid_token' | 'limit_exceeds_maximum' | 'localhost_not_permitted' | 'logout_not_permitted' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_permissions' | 'missing_recipients' | 'not_configurable' | 'origin_required' | 'owner_exists' | 'owner_unavailable' | 'passkey_limit' | 'passkey_link_expired' | 'passkey_not_permitted' | 'passkey_register_not_permitted' | 'payment_declined' | 'post_logout_redirect_not_permitted' | 'privy_app_taken' | 'public_app' | 'pushed_authorization_required' | 'rate_limited' | 'realm_exists' | 'realm_in_use' | 'reauthentication_required' | 'registrar_required' | 'rejected' | 'relying_party_taken' | 'resource_exists' | 'scope_without_limit' | 'session_changed' | 'session_required' | 'sign_not_permitted' | 'sign_out_link_expired' | 'sign_up_not_permitted' | 'signing_key_in_use' | 'too_many_signing_keys' | 'unexpected' | 'unknown_allowance' | 'unknown_app' | 'unknown_code' | 'unknown_endpoint' | 'unknown_key' | 'unknown_order' | 'unknown_realm' | 'unknown_resource' | 'unknown_screening' | 'unknown_session' | 'unknown_signing_key' | 'unknown_user' | 'unsupported_call' | 'unsupported_token' | 'upgrade_required' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+}
+/** A revocation of an access key that the chain holds revoked already. */
+export declare class RevokedError extends Error {
+    readonly name = "Accounts.RevokedError";
+    constructor(options: RevokedError.Options);
+}
+export declare namespace RevokedError {
+    type Options = {
+        /** The access key's address. */
+        accessKey: `0x${string}`;
+    };
+}
+/** A Viem client's account read while the instance holds no session. */
+export declare class SignedOutError extends Error {
+    readonly name = "Accounts.SignedOutError";
+    constructor();
+}
+/**
+ * A sign-in that another sign-in or a sign-out overtook. The instance keeps the newer session, and
+ * the overtaken result is never returned.
+ */
+export declare class SupersededError extends Error {
+    readonly name = "Accounts.SupersededError";
+    constructor();
+}
+/** The configuration of an instance, which every action of `Actions` takes. */
+export type Config = {
+    /** The chain of the app's access keys, unless a sign-in's `accessKey` names another. */
+    chainId: number;
+    /**
+     * Signs a client assertion for each request that authenticates the app, for an app with
+     * `private_key_jwt`. Only a backend holds one. Excludes `clientSecret`.
+     */
+    clientAssertion?: ClientAssertion.Signer | undefined;
+    /**
+     * The app's client ID: from its registration as an OAuth app, the URL of its metadata document,
+     * its origin, such as `https://app.example` or a localhost origin in local development, or, for a
+     * CLI without a registration, `cli:` and its name, such as `cli:acme-deploy`. In a browser, it
+     * defaults to the page's origin.
+     */
+    clientId: string;
+    /** The app's client secret. Only a backend holds one. */
+    clientSecret?: string | undefined;
+    /**
+     * The key that binds the app's tokens (RFC 9449). Each token request sends a proof from it, and
+     * Tempo ID issues `DPoP` tokens. Absent, the tokens are Bearer tokens, unless the app requires DPoP.
+     */
+    dpop?: Dpop | undefined;
+    /** Calls Tempo ID. Defaults to the global `fetch`. */
+    fetch?: typeof globalThis.fetch | undefined;
+    /**
+     * Runs the ceremony of a passkey that owns the account, in place of `navigator.credentials.get`,
+     * also for a session that the instance restores. The `passkey` plugin sets its own `getFn`.
+     */
+    getFn?: TempoAccount.deserialize.Options['getFn'];
+    /**
+     * Whether a redirect or dialog pushes each authorization request to `/oauth2/par` (RFC 9126). The
+     * plugin of the flow sets it. Defaults to `true` for an instance with `clientSecret` or
+     * `clientAssertion`, and to `false` otherwise.
+     */
+    par?: boolean | undefined;
+    /** Where Tempo ID redirects back to. Defaults to the page's origin in a browser. */
+    redirectUri?: string | undefined;
+    /** The scopes of the app's tokens, always with `openid` and `email`. */
+    scope: string;
+    /**
+     * Where the instance keeps its session and each redirect's state. Defaults to IndexedDB in a
+     * browser. Outside a browser, the instance holds a session only with a store, such as on a device
+     * or in a CLI, since a backend's instance serves many users.
+     */
+    store?: Store | undefined;
+    /** Where Tempo ID runs, such as `https://id.tempo.xyz`. */
+    url: string;
+};
+/**
+ * A Tempo ID instance: its configuration, its session, and the namespace of each plugin. An instance
+ * without a sign-in plugin holds the `dialog` plugin, and an instance without the `funding` plugin
+ * holds it with its default options.
+ */
+export type Accounts<plugins extends readonly Plugin.Plugin[] = readonly Plugin.Plugin[]> = Plugin.Namespaces<WithFunding<WithSignIn<plugins>>> & Plugin.Members<plugins> & {
+    /** The user's Tempo Account that Tempo ID selects for the app. */
+    account: {
+        /**
+         * Returns the account on the instance's chain, and creates one for a user who has none in the
+         * app's realms.
+         */
+        get: (parameters?: Core.getAccount.Parameters) => Promise<TempoAccount.TempoAccount | undefined>;
+        /**
+         * Upgrades a wallet.tempo passkey's account to a configurable account, when a sign-in returns
+         * `upgradeAvailable: true`. The session's access key keeps working, and the session's account becomes
+         * the upgraded account.
+         */
+        upgrade: (parameters?: Core.upgradeAccount.Parameters) => Promise<TempoAccount.TempoAccount>;
+    };
+    /**
+     * Requests the app's tokens, and an access key, for the user's Tempo ID session in the
+     * browser, with no sign-in. Sets the session, and returns it, or empties it and returns
+     * `undefined` when the browser holds no Tempo ID session.
+     */
+    authorize: (parameters?: Core.authorize.Parameters) => Promise<Core.authorize.ReturnType>;
+    /** The instance's configuration, which every action of `Actions` takes. */
+    config: Config;
+    /** The session of the instance's user. */
+    session: {
+        /**
+         * The XState actor of the session, or `undefined` for an instance without a session, such as
+         * a backend's. Its snapshot's `value` is the status, `pending`, `reauthorizing`, `signedIn`,
+         * or `signedOut`, and its `context.session` is the session. Read it, and send it no event: the
+         * instance's actions change the session.
+         */
+        actor: InternalSession.machines.session.Actor | undefined;
+        /**
+         * Returns the session. The first call reads the saved session, and each call first runs the
+         * plugins' `restore` hooks, such as a redirect's callback. Returns `undefined`, and empties
+         * the session, when the saved access key expired. Makes no request unless a hook does. With
+         * `reauthorize`, a call that finds no session, or an expired one, authorizes the browser's Tempo
+         * ID session, as `authorize` does, unless a sign-out without `everywhere` followed the last
+         * sign-in.
+         */
+        get: (parameters?: Core.getSession.Parameters) => Promise<Session.Session | undefined>;
+        /**
+         * Refreshes the session's tokens with its refresh token, saves them, and returns the session.
+         * Returns `undefined` without a session or a refresh token.
+         */
+        refresh: () => Promise<Session.Session | undefined>;
+        /**
+         * The status of the session, with the session to show: `get` returns it, and `subscribe`
+         * calls its listener with each new status and the one before it. `signedOut` for an instance
+         * without a session, such as a backend's.
+         */
+        status: InternalSession.Status;
+        /** Calls `listener` with each new session and the one before it. Returns the unsubscribe. */
+        subscribe: (listener: (session: Session.Session | undefined, previous: Session.Session | undefined) => void) => () => void;
+    };
+    /**
+     * Empties the session at once, also when the request fails, deletes the saved session, and
+     * revokes its refresh token. With `everywhere`, a first-party app also ends the user's Tempo ID
+     * session, which signs the user out of every app that relies on it. Without it, `session.get`
+     * with `reauthorize` signs the user in again only after the next sign-in. Throws
+     * {@link EverywhereNotAllowedError} for `everywhere` from any other app, and signs nothing out.
+     */
+    signOut: (parameters?: {
+        /** Whether the user's Tempo ID session ends too, for a first-party app. Defaults to `false`. */
+        everywhere?: boolean | undefined;
+    }) => Promise<void>;
+};
+/**
+ * Returns the configuration that every action of `Actions` takes, with its defaults, and no session
+ * or plugin. `Accounts.create` builds its own with it. Throws {@link ClientIdRequiredError} outside a
+ * browser without `clientId`.
+ *
+ * @example
+ * ```ts
+ * const config = Accounts.from({ clientId: 'client_…', clientSecret })
+ * const tokens = await Actions.refresh(config, { refreshToken })
+ * ```
+ */
+export declare function from(options?: from.Options): Config;
+export declare namespace from {
+    type Options = Omit<Partial<Config>, 'chainId' | 'scope' | 'url'> & {
+        /** The chain of the app's access keys. Defaults to Tempo mainnet, or Tempo testnet with `dev`. */
+        chainId?: number | undefined;
+        /** Whether to use Tempo testnet. Defaults to `false`. */
+        dev?: boolean | undefined;
+        /** Scopes beyond `openid` and `email`. Defaults to `offline_access`, for a refresh token. */
+        scope?: string | undefined;
+        /** Defaults to `https://id.tempo.xyz`. */
+        url?: string | undefined;
+    };
+}
+/**
+ * Creates an instance. In a browser, the instance holds the session of its user and saves it to
+ * `store`, which defaults to IndexedDB. Elsewhere, it holds a session only with a `store`, such as
+ * `Store.file` in a CLI.
+ * Throws {@link ClientIdRequiredError} outside a browser without `clientId`.
+ *
+ * @example
+ * ```ts
+ * const accounts = Accounts.create({ plugins: [dialog()] })
+ * ```
+ */
+export declare function create<const plugins extends readonly Plugin.Option[] = []>(options?: create.Options<plugins>): Accounts<Plugin.Flatten<plugins>>;
+export declare namespace create {
+    type Options<plugins extends readonly Plugin.Option[] = readonly Plugin.Option[]> = Omit<from.Options, 'par'> & {
+        /**
+         * The access key of each sign-in that names none: what it may do, or a function that the
+         * instance calls at each sign-in to return it. A duration expiry, such as `'7d'`, counts from
+         * the sign-in. Without an expiry, Tempo ID fills it with the app's refresh token lifetime.
+         * Absent, a sign-in without `accessKey` requests no access key.
+         */
+        accessKey?: Permissions | (() => Permissions | undefined) | undefined;
+        /**
+         * The plugins, each of which adds a namespace with its `id`. An entry can be a list, such as a
+         * preset that combines plugins, or a falsy value, which adds nothing. Defaults to none.
+         */
+        plugins?: plugins | undefined;
+    };
+}
+/** `plugins`, with the `dialog` plugin when none of them signs the user in. */
+export type WithSignIn<plugins extends readonly Plugin.Plugin[]> = string extends plugins[number]['id'] ? plugins : [Extract<plugins[number]['id'], DefaultDialog.SignInId>] extends [never] ? readonly [...plugins, DefaultDialog.Dialog] : plugins;
+/** `plugins`, with the `funding` plugin and its default options when none of them is `funding`. */
+export type WithFunding<plugins extends readonly Plugin.Plugin[]> = string extends plugins[number]['id'] ? plugins : 'funding' extends plugins[number]['id'] ? plugins : readonly [...plugins, ReturnType<typeof funding>];
+//# sourceMappingURL=Accounts.d.ts.map

package/dist/Accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Accounts.d.ts","sourceRoot":"","sources":["../src/Accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,eAAe,MAAM,+BAA+B,CAAA;AACrE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAI9C,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAE5D,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAE/D,8GAA8G;AAC9G,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,oCAAmC;IAEzD,YAAY,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAIjD;CACF;AAED,MAAM,CAAC,OAAO,WAAW,qBAAqB,CAAC;IAC7C,KAAK,OAAO,GAAG;QACb,iCAAiC;QACjC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,gGAAgG;AAChG,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,uCAAsC;IAE5D,cAIC;CACF;AAED,2GAA2G;AAC3G,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,oCAAmC;IAEzD,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAkB,IAAI,wCAAuC;IAE7D,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,+BAA8B;IAEpD,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,mCAAkC;IAExD,cAIC;CACF;AAED,uCAAuC;AACvC,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,2BAA0B;IAChD,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;IAChD,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EASxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,sCAAsC;QACtC,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,yBAAyB;QACzB,IAAI,EAAE,MAAM,CAAA;QACZ,kCAAkC;QAClC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,+BAA+B;QAC/B,OAAO,EAAE,MAAM,CAAA;QACf,4CAA4C;QAC5C,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;QAC5D,sEAAsE;QACtE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,0EAA0E;QAC1E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC9B,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAA;QACd,uBAAuB;QACvB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;IAED,gEAAgE;IAChE,KAAK,MAAM,GACP,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,GACvB,+BAA+B,GAC/B,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,GACjB,gCAAgC,GAChC,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,cAAc,GACd,cAAc,GACd,wBAAwB,GACxB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,GACrB,sBAAsB,GACtB,aAAa,GACb,eAAe,GACf,gBAAgB,GAChB,4BAA4B,GAC5B,cAAc,GACd,oBAAoB,GACpB,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,yBAAyB,GACzB,sBAAsB,GACtB,gBAAgB,GAChB,wBAAwB,GACxB,aAAa,GACb,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,eAAe,GACf,sBAAsB,GACtB,uBAAuB,GACvB,gCAAgC,GAChC,kBAAkB,GAClB,oCAAoC,GACpC,iBAAiB,GACjB,YAAY,GACZ,+BAA+B,GAC/B,cAAc,GACd,cAAc,GACd,cAAc,GACd,2BAA2B,GAC3B,oBAAoB,GACpB,UAAU,GACV,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GACpB,uBAAuB,GACvB,uBAAuB,GACvB,oBAAoB,GACpB,uBAAuB,GACvB,YAAY,GACZ,mBAAmB,GACnB,aAAa,GACb,cAAc,GACd,kBAAkB,GAClB,aAAa,GACb,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,CAAA;CACxB;AAED,0EAA0E;AAC1E,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,2BAA0B;IAEhD,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EAExC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,gCAAgC;QAChC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;KACzB,CAAA;CACF;AAED,wEAAwE;AACxE,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,6BAA4B;IAElD,cAEC;CACF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,8BAA6B;IAEnD,cAIC;CACF;AAED,+EAA+E;AAC/E,MAAM,MAAM,MAAM,GAAG;IACnB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC,MAAM,GAAG,SAAS,CAAA;IACpD;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IACvB,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;IAC3C;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;IACzB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAClB,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,IACjE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GACrD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;IACxB,kEAAkE;IAClE,OAAO,EAAE;QACP;;;WAGG;QACH,GAAG,EAAE,CACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,KACpC,OAAO,CAAC,YAAY,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;QACnD;;;;WAIG;QACH,OAAO,EAAE,CACP,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,KACxC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;KACxC,CAAA;IACD;;;;OAIG;IACH,SAAS,EAAE,CACT,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,KACnC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACvC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,0CAA0C;IAC1C,OAAO,EAAE;QACP;;;;;WAKG;QACH,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;QACzD;;;;;;;WAOG;QACH,GAAG,EAAE,CACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,KACpC,OAAO,CAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;QACzC;;;WAGG;QACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;QACnD;;;;WAIG;QACH,MAAM,EAAE,eAAe,CAAC,MAAM,CAAA;QAC9B,6FAA6F;QAC7F,SAAS,EAAE,CACT,QAAQ,EAAE,CACR,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,EACpC,QAAQ,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,KAClC,IAAI,KACN,MAAM,IAAI,CAAA;KAChB,CAAA;IACD;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE;QACrB,gGAAgG;QAChG,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpB,CAAA;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,IAAI,CAAC,OAAY,GAAG,MAAM,CAqBvD;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG;QAClE,kGAAkG;QAClG,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,yDAAyD;QACzD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,6FAA6F;QAC7F,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,0CAA0C;QAC1C,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EACxE,OAAO,GAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAM,GACpC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAmNnC;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,CACV,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,IACjE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG;QAC9B;;;;;WAKG;QACH,SAAS,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;QACrE;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF;AAED,+EAA+E;AAC/E,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,IAG7D,MAAM,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAChC,OAAO,GACP,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACtE,SAAS,CAAC,GAAG,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAA;AAEf,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,IAE9D,MAAM,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAChC,OAAO,GACP,SAAS,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GACrC,OAAO,GACP,SAAS,CAAC,GAAG,OAAO,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAA"}