feat: sign in and authorize access keys through Tempo ID with accounts@alpha

.env.example

@@ -13,6 +13,7 @@ SLACK_CLIENT_ID=                # Printed by `pnpm slack:app create`
 SLACK_CLIENT_SECRET=            # Printed by `pnpm slack:app create`
 SLACK_SIGNING_SECRET=           # Printed by `pnpm slack:app create`
 TEMPO_API_KEY=                  # Tempo API key with data:read and rpc-relay:sponsor scopes
+TEMPO_ID_CLIENT_SECRET=         # Client secret of the `tipbot` app in Tempo ID (`tempo-id admin apps`)
 TWITTER_ACCESS_TOKEN=           # Twitter/X OAuth 1.0a access token for posting replies
 TWITTER_ACCESS_TOKEN_SECRET=    # Twitter/X OAuth 1.0a access token secret for posting replies
 TWITTER_API_URL=                # Defaults to https://api.twitter.com

.github/workflows/check.yml

@@ -12,6 +12,8 @@ permissions:
   contents: read
 
 env:
+  # Pinned Tempo ID image of the end-to-end suite, by the `tempoxyz/id` commit that built it.
+  ID_DEV_IMAGE: ghcr.io/tempoxyz/id-dev:cbdd6c0dbfbbf47930b90bf4f0e277e9425f1033
   # Pinned known-good Tempo Docker image. Supports tags or sha256 digests.
   VITE_TEMPO_IMAGE: sha256:80769b5615556fcdb9f158de0c699523613fb3901c2df3e58bc770dab106ead1
   WRANGLER_SEND_METRICS: false
@@ -139,9 +141,11 @@ jobs:
   e2e:
     name: E2E
     runs-on: ubuntu-latest
+    # The id-dev image is private to the organization, so the job reads it with its token.
     permissions:
       contents: read
       id-token: write
+      packages: read
     steps:
       - name: Secure runner
         uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
@@ -163,6 +167,11 @@ jobs:
           (cd node_modules/better-sqlite3 && ./node_modules/.bin/prebuild-install || node-gyp rebuild --release)
           node -e "new (require('better-sqlite3'))(':memory:').close()"
 
+      - name: Log in to GHCR
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: echo "$GITHUB_TOKEN" | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
       - name: Run E2E tests
         run: pnpm test:e2e
 

package.json

@@ -35,17 +35,16 @@
     "@tanstack/react-router": "1.170.44",
     "@tanstack/react-start": "1.169.2",
     "@tanstack/router-plugin": "1.168.46",
-    "accounts": "^0.15.2",
+    "accounts": "1.0.0-alpha.1",
     "chat": "4.27.0",
     "hono": "4.13.13",
     "kysely": "0.28.17",
     "nanoid": "^5.1.16",
-    "ox": "0.14.20",
+    "ox": "0.14.59",
     "react": "19.2.5",
     "react-dom": "19.2.5",
     "tapimo": "0.5.2",
-    "viem": "^2.55.10",
-    "wagmi": "^3.6.14",
+    "viem": "^2.57.12",
     "zod": "4.6.6"
   },
   "devDependencies": {