@tempoxyz/auth 0.0.0-pr-73.sha-163f721 → 0.0.0-pr-72.sha-b9acf1a

package/dist/Actions.d.ts

@@ -12,7 +12,6 @@ import type { Tokens } from './Tokens.ts';
 export * as device from './actions/device.ts';
 export * as email from './actions/email.ts';
 export * as oauth from './actions/oauth.ts';
-export * as passkey from './actions/passkey.ts';
 export * as provider from './actions/provider.ts';
 export * as redirect from './actions/redirect.ts';
 export * as tempoAccount from './actions/tempoAccount.ts';

package/dist/Actions.js

@@ -4,7 +4,6 @@ import { request } from './internal/request.js';
 export * as device from './actions/device.js';
 export * as email from './actions/email.js';
 export * as oauth from './actions/oauth.js';
-export * as passkey from './actions/passkey.js';
 export * as provider from './actions/provider.js';
 export * as redirect from './actions/redirect.js';
 export * as tempoAccount from './actions/tempoAccount.js';

package/dist/Auth.d.ts

@@ -86,7 +86,7 @@ export declare namespace RequestError {
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */
-    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'periodic_limit' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required' | 'witness_not_permitted';
+    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable';
 }
 /** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
 export declare class SignedOutError extends Error {

package/dist/Decorator.d.ts

@@ -95,10 +95,6 @@ export declare namespace tempoAuth {
                 /** `Actions.oauth.userInfo`. */
                 userInfo: (options: Actions.oauth.userInfo.Options) => Promise<User>;
             };
-            passkey: {
-                /** `Actions.passkey.signIn`, which sets the client's account unless it returns a step. */
-                signIn: <const id extends number = chainId>(options?: Actions.passkey.signIn.Options<id>) => Promise<Actions.passkey.signIn.ReturnType<id>>;
-            };
             provider: {
                 /** `Actions.provider.list`. */
                 list: () => Promise<Actions.provider.list.ReturnType>;

package/dist/Decorator.js

@@ -111,15 +111,6 @@ export function tempoAuth(options) {
                     jwks: () => Actions.oauth.jwks(auth),
                     userInfo: (options) => Actions.oauth.userInfo(auth, options),
                 },
-                passkey: {
-                    async signIn(options = {}) {
-                        const apply = begin();
-                        const result = await Actions.passkey.signIn(auth, options);
-                        if (!('step' in result))
-                            apply(result.account);
-                        return result;
-                    },
-                },
                 provider: {
                     list: () => Actions.provider.list(auth),
                     signIn: (options) => Actions.provider.signIn(auth, options),

package/dist/Permissions.d.ts

@@ -1,9 +1,7 @@
 /**
- * What an app's access key may do: its chain, expiry, spending limits, and call scopes, with any
- * witness its authorization binds.
+ * What an app's access key may do: its chain, expiry, spending limits, and call scopes.
  * @module
  */
-import type { Hex } from 'ox';
 import type { KeyAuthorization } from 'ox/tempo';
 /**
  * What an app's access key may do, as Viem's `accessKey.authorize` takes it. Tempo Auth fills what
@@ -15,15 +13,10 @@ export type Permissions<chainId extends number = number> = {
     chainId?: chainId | undefined;
     /** Unix seconds. Viem's `Expiry` builds one, such as `Expiry.days(1)`. Defaults to a year from now. */
     expiry?: number | undefined;
-    /** How much of each token the key may spend. Defaults to about $1,000 of each token it calls, or of OUSD. */
+    /** How much of each token the key may spend, in total or, with a `period` in seconds, per period. Defaults to about $1,000 of each token it calls, or of OUSD. */
     limits?: KeyAuthorization.KeyAuthorization['limits'];
     /** The calls the key may make. Defaults to transfers of each token it limits. */
     scopes?: KeyAuthorization.KeyAuthorization['scopes'];
-    /**
-     * A 32-byte value the owner's signature binds (TIP-1053), such as `hashMessage(challenge)` for a
-     * challenge the app's backend issued. Only an app with the `tempo-auth:sign` scope may send one.
-     */
-    witness?: Hex.Hex | undefined;
 };
 /**
  * Instantiates a {@link Permissions}, keeping `chainId` as a literal type.

package/dist/actions/email.d.ts

@@ -44,11 +44,6 @@ export declare namespace signIn {
         code: string;
         /** The address the code was sent to. */
         email: string;
-        /**
-         * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
-         * to the user.
-         */
-        link?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/actions/email.js

@@ -23,14 +23,13 @@ export async function sendCode(auth, options) {
  * ```
  */
 export async function signIn(auth, options) {
-    const { code, email, link, permissions } = options;
+    const { code, email, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {
             authorize: request(auth, { accessKey: key.accessKey, permissions }),
             code,
             email,
-            ...(link ? { link } : {}),
         },
     }));
     if ('step' in body)

package/dist/internal/request.d.ts

@@ -22,7 +22,6 @@ export declare function request(auth: Auth, options: {
             token: `0x${string}`;
         }[] | undefined;
         scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
-        witness: `0x${string}` | undefined;
     };
     redirect_uri: string;
     scope: string;

package/dist/internal/request.js

@@ -24,7 +24,6 @@ export function request(auth, options) {
                 token,
             })),
             scopes: permissions.scopes,
-            witness: permissions.witness,
         },
         redirect_uri: auth.redirectUri ?? `${globalThis.location?.origin ?? auth.url}/`,
         scope: auth.scope,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-73.sha-163f721",
+  "version": "0.0.0-pr-72.sha-b9acf1a",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {

package/dist/actions/passkey.d.ts

@@ -1,53 +0,0 @@
-/**
- * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
- * it holds for Tempo's domain, so the app needs no email first.
- * @module
- */
-import { Authentication } from 'ox/webauthn';
-import type { Account } from 'viem/tempo';
-import type { Auth } from '../Auth.ts';
-import type { Authorization } from '../Authorization.ts';
-import type { Permissions } from '../Permissions.ts';
-/**
- * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
- * for a wallet.tempo passkey whose account has no email: the app signs the user in with
- * `Actions.email.signIn`, passing the step's `link`, which links the passkey. Throws a `RequestError` with reason
- * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
- * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
- * the user is already signed in.
- *
- * @example
- * ```ts
- * const result = await Actions.passkey.signIn(auth)
- * if ('step' in result) showEmailForm()
- * ```
- */
-export declare function signIn<const chainId extends number = number>(auth: Auth, options?: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
-export declare namespace signIn {
-    type Options<chainId extends number = number> = {
-        /**
-         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
-         */
-        accessKey?: Account.Account | undefined;
-        /**
-         * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
-         * module. Its assertion must report a web origin on the relying party's domain that the app
-         * registered, so an Android app's facet origin is refused.
-         */
-        getFn?: Authentication.sign.Options['getFn'] | undefined;
-        /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
-        permissions?: Permissions<chainId> | undefined;
-    };
-    /** The step a wallet.tempo passkey without an email needs: an emailed code, which links it. */
-    type EmailStep = {
-        /** Passed as `link` to `Actions.email.signIn`, which links the passkey to that user. */
-        link: string;
-        /** The kind of step. */
-        type: 'email';
-    };
-    /** The authorization, or the email step. */
-    type ReturnType<chainId extends number = number> = Authorization<chainId> | {
-        step: EmailStep;
-    };
-}

package/dist/actions/passkey.js

@@ -1,41 +0,0 @@
-/**
- * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
- * it holds for Tempo's domain, so the app needs no email first.
- * @module
- */
-import { Authentication } from 'ox/webauthn';
-import * as AccessKey from '../internal/accessKey.js';
-import * as Api from '../internal/api.js';
-import { request } from '../internal/request.js';
-/**
- * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
- * for a wallet.tempo passkey whose account has no email: the app signs the user in with
- * `Actions.email.signIn`, passing the step's `link`, which links the passkey. Throws a `RequestError` with reason
- * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
- * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
- * the user is already signed in.
- *
- * @example
- * ```ts
- * const result = await Actions.passkey.signIn(auth)
- * if ('step' in result) showEmailForm()
- * ```
- */
-export async function signIn(auth, options = {}) {
-    const { getFn, permissions } = options;
-    const key = await AccessKey.resolve(options.accessKey);
-    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', { json: {} }));
-    const deserialized = Authentication.deserializeOptions(requested.options);
-    const assertion = Authentication.serializeResponse(await Authentication.sign(
-    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
-    getFn ? { ...deserialized, getFn } : deserialized));
-    const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
-        json: {
-            assertion,
-            authorize: request(auth, { accessKey: key.accessKey, permissions }),
-        },
-    }));
-    if ('step' in body)
-        return { step: body.step };
-    return Api.authorization(body.authorization, key);
-}