@tempoxyz/auth 0.0.0-pr-73.sha-45751db → 0.0.0-pr-75.sha-0f45efb

package/dist/Auth.d.ts

@@ -51,8 +51,9 @@ export type Auth = {
     /** The scopes the app's tokens carry. */
     scope: string;
     /**
-     * Where `Actions.redirect.start` keeps its state until Tempo Auth redirects back. It must keep
-     * objects as they are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
+     * Where `Actions.redirect.start` keeps its state until Tempo Auth redirects back, and
+     * `Actions.passkey.signIn` keeps a new key its email step signed. It must keep objects as they
+     * are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
      */
     storage?: Storage | undefined;
     /** Where Tempo Auth runs, such as `https://auth.tempo.xyz`. */

package/dist/actions/email.d.ts

@@ -52,7 +52,8 @@ export declare namespace signIn {
         email: string;
         /**
          * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
-         * to the user.
+         * to the user. When the step is `signed`, the call returns the key that passkey sign-in
+         * authorized with its assertion, given the same `accessKey` if the app supplied one.
          */
         link?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */

package/dist/actions/email.js

@@ -1,5 +1,6 @@
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
+import * as Link from '../internal/link.js';
 import { request } from '../internal/request.js';
 /**
  * Emails the user a sign-in code. The response is the same for every address.
@@ -24,7 +25,10 @@ export async function sendCode(auth, options) {
  */
 export async function signIn(auth, options) {
     const { challenge, code, email, link, permissions } = options;
-    const key = await AccessKey.resolve(options.accessKey);
+    // A one-tap passkey sign-in's email step already signed the key it generated, which Tempo Auth
+    // returns once this request names it again.
+    const kept = link ? await Link.get(auth, { link }) : undefined;
+    const key = kept ?? (await AccessKey.resolve(options.accessKey));
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {
             authorize: request(auth, {
@@ -37,6 +41,9 @@ export async function signIn(auth, options) {
             ...(link ? { link } : {}),
         },
     }));
+    // A refusal throws above, which keeps the key for a retry with a new code.
+    if (kept)
+        await Link.release(auth);
     if ('step' in body)
         return {
             step: { ...body.step, url: new URL(body.step.url, auth.url).href },

package/dist/actions/passkey.d.ts

@@ -1,6 +1,7 @@
 /**
- * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
- * it holds for Tempo's domain, so the app needs no email first.
+ * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
+ * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
+ * email first.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
@@ -9,13 +10,17 @@ import type { Auth } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import type { Permissions } from '../Permissions.ts';
 /**
- * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
- * for a wallet.tempo passkey whose account has no email: the app signs the user in with
+ * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
+ * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
+ * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
+ * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a
+ * wallet.tempo passkey whose account has no email: the app signs the user in with
  * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`, which this call does not authorize. Throws a `RequestError` with reason
- * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
- * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
- * the user is already signed in.
+ * `accessKey`, `challenge`, and `permissions`. A `signed` step's assertion already signed the key,
+ * which that call returns without another tap, so a new key waits in the instance's `storage`.
+ * Throws a `RequestError` with reason `webauthn_required` when another passkey owns
+ * the account, which signs only on Tempo Auth's pages, where `Actions.redirect.start` authorizes it
+ * for the signed-in user.
  *
  * @example
  * ```ts
@@ -37,12 +42,16 @@ export declare namespace signIn {
          * `tempo-auth:sign` scope may send one.
          */
         challenge?: string | undefined;
+        /** The credential ID, or IDs, the browser offers. Defaults to every passkey it holds for Tempo's domain. */
+        credentialId?: string | readonly string[] | undefined;
         /**
          * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
          * module. Its assertion must report a web origin on the relying party's domain that the app
          * registered, so an Android app's facet origin is refused.
          */
         getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** How the browser mediates the ceremony, such as `conditional` for passkey autofill. */
+        mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
@@ -50,6 +59,11 @@ export declare namespace signIn {
     type EmailStep = {
         /** Passed as `link` to `Actions.email.signIn`, which links the passkey to that user. */
         link: string;
+        /**
+         * Whether the assertion already signed the key, which `Actions.email.signIn` returns with
+         * `link`. Otherwise that call authorizes the key itself.
+         */
+        signed: boolean;
         /** The kind of step. */
         type: 'email';
     };

package/dist/actions/passkey.js

@@ -1,20 +1,26 @@
 /**
- * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
- * it holds for Tempo's domain, so the app needs no email first.
+ * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
+ * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
+ * email first.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
+import * as Link from '../internal/link.js';
 import { request } from '../internal/request.js';
 /**
- * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
- * for a wallet.tempo passkey whose account has no email: the app signs the user in with
+ * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
+ * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
+ * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
+ * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a
+ * wallet.tempo passkey whose account has no email: the app signs the user in with
  * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`, which this call does not authorize. Throws a `RequestError` with reason
- * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
- * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
- * the user is already signed in.
+ * `accessKey`, `challenge`, and `permissions`. A `signed` step's assertion already signed the key,
+ * which that call returns without another tap, so a new key waits in the instance's `storage`.
+ * Throws a `RequestError` with reason `webauthn_required` when another passkey owns
+ * the account, which signs only on Tempo Auth's pages, where `Actions.redirect.start` authorizes it
+ * for the signed-in user.
  *
  * @example
  * ```ts
@@ -23,24 +29,36 @@ import { request } from '../internal/request.js';
  * ```
  */
 export async function signIn(auth, options = {}) {
-    const { challenge, getFn, permissions } = options;
+    const { challenge, credentialId, getFn, mediation, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
-    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', { json: {} }));
+    const authorize = request(auth, {
+        accessKey: key.accessKey,
+        challenge,
+        permissions,
+    });
+    // A page sends the request with the options, so the challenge is its key's digest. A native app
+    // sends no `Origin` to bind one-tap to, so it sends the request with the assertion instead.
+    const native = !/^https?:/i.test(authorize.redirect_uri);
+    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
+        json: {
+            ...(native ? {} : { authorize }),
+            ...(credentialId ? { credentialId } : {}),
+            ...(mediation ? { mediation } : {}),
+        },
+    }));
     const deserialized = Authentication.deserializeOptions(requested.options);
     const assertion = Authentication.serializeResponse(await Authentication.sign(
     // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
     getFn ? { ...deserialized, getFn } : deserialized));
     const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
-        json: {
-            assertion,
-            authorize: request(auth, {
-                accessKey: key.accessKey,
-                challenge,
-                permissions,
-            }),
-        },
+        json: native ? { assertion, authorize } : { assertion },
     }));
-    if ('step' in body)
+    if ('step' in body) {
+        // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
+        // library generated waits for it in `storage`.
+        if (body.step.signed && !options.accessKey)
+            await Link.keep(auth, { link: body.step.link, material: key.material });
         return { step: body.step };
+    }
     return Api.authorization(body.authorization, key);
 }

package/dist/actions/redirect.js

@@ -8,8 +8,8 @@ import { Base64, Bytes, Hash } from 'ox';
 import { RequestError } from '../Auth.js';
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
-import * as IndexedDb from '../internal/indexedDb.js';
 import { request } from '../internal/request.js';
+import * as Store from '../internal/store.js';
 import * as Pending from '../Pending.js';
 /**
  * Finishes a {@link start} when the page loads with Tempo Auth's callback, and returns `undefined`
@@ -24,8 +24,8 @@ import * as Pending from '../Pending.js';
  */
 export function complete(auth, options = {}) {
     completed ??= (async () => {
-        const stored = (await storage(auth).getItem(storageKey));
-        await storage(auth).removeItem(storageKey);
+        const stored = (await Store.get(auth).getItem(storageKey));
+        await Store.get(auth).removeItem(storageKey);
         const url = new URL(window.location.href);
         if (!url.searchParams.has('code'))
             return undefined;
@@ -148,18 +148,12 @@ export async function handleCallback(auth, options) {
  */
 export async function start(auth, options = {}) {
     const { pending, url } = await createUrl(auth, options);
-    await storage(auth).setItem(storageKey, pending);
+    await Store.get(auth).setItem(storageKey, pending);
     window.location.assign(url);
 }
 /** Unpadded URL-safe Base64, as PKCE and `key_authorization` use. */
 const base64url = { pad: false, url: true };
 /** The redirect this page load returns from, so its code is redeemed once. */
 let completed;
-/** The default `storage`, opened on first use. */
-let indexedDb;
 /** Where a redirect keeps its state in `storage`. */
 const storageKey = 'tempo-auth:redirect';
-/** Where a redirect keeps its state: the instance's `storage`, or IndexedDB. */
-function storage(auth) {
-    return auth.storage ?? (indexedDb ??= IndexedDb.create());
-}

package/dist/internal/accessKey.d.ts

@@ -5,6 +5,11 @@ import type * as Key from '../Key.ts';
  * a `CryptoKey` across page loads. Elsewhere a CLI or native app must store the key as a string.
  */
 export declare function resolve(accessKey: Account.Account | undefined): Promise<resolve.ReturnType>;
+/**
+ * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
+ * empty material of a key the app supplied.
+ */
+export declare function restore(material: Key.Material): resolve.ReturnType | undefined;
 export declare namespace resolve {
     type ReturnType = {
         /** The key, as a Viem account that signs with it. */

package/dist/internal/accessKey.js

@@ -24,3 +24,14 @@ export async function resolve(accessKey) {
         material: { privateKey },
     };
 }
+/**
+ * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
+ * empty material of a key the app supplied.
+ */
+export function restore(material) {
+    if (material.keyPair)
+        return { accessKey: Account.fromWebCryptoP256(material.keyPair), material };
+    if (material.privateKey)
+        return { accessKey: Account.fromSecp256k1(material.privateKey), material };
+    return undefined;
+}

package/dist/internal/link.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Keeps a new key that a one-tap passkey sign-in signed, until the emailed-code sign-in that sends
+ * its email step's `link` returns the key's authorization.
+ * @module
+ */
+import type { Auth } from '../Auth.ts';
+import type * as Key from '../Key.ts';
+import * as AccessKey from './accessKey.ts';
+/** Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. */
+export declare function keep(auth: Auth, options: keep.Options): Promise<void>;
+export declare namespace keep {
+    type Options = {
+        /** The email step's `link`. */
+        link: string;
+        /** The key `AccessKey.resolve` generated. */
+        material: Key.Material;
+    };
+}
+/**
+ * Returns the key kept for `link`, or `undefined` when none is. Leaves it in place, so a refused
+ * code retries with the same key, until {@link release} removes it.
+ */
+export declare function get(auth: Auth, options: get.Options): Promise<AccessKey.resolve.ReturnType | undefined>;
+export declare namespace get {
+    type Options = {
+        /** The `link` the emailed-code sign-in sends. */
+        link: string;
+    };
+}
+/** Removes the kept key, once the emailed-code sign-in that used it finished. */
+export declare function release(auth: Auth): Promise<void>;

package/dist/internal/link.js

@@ -0,0 +1,22 @@
+import * as AccessKey from './accessKey.js';
+import * as Store from './store.js';
+/** Where the key waits in `storage`. A later email step replaces it. */
+const storageKey = 'tempo-auth:passkey-link';
+/** Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. */
+export async function keep(auth, options) {
+    await Store.get(auth)?.setItem(storageKey, options);
+}
+/**
+ * Returns the key kept for `link`, or `undefined` when none is. Leaves it in place, so a refused
+ * code retries with the same key, until {@link release} removes it.
+ */
+export async function get(auth, options) {
+    const kept = (await Store.get(auth)?.getItem(storageKey));
+    if (kept?.link !== options.link)
+        return undefined;
+    return AccessKey.restore(kept.material);
+}
+/** Removes the kept key, once the emailed-code sign-in that used it finished. */
+export async function release(auth) {
+    await Store.get(auth)?.removeItem(storageKey);
+}

package/dist/internal/store.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Resolves where actions keep state across page loads: the instance's `storage`, or IndexedDB.
+ * @module
+ */
+import type { Auth } from '../Auth.ts';
+import type { Storage } from '../Storage.ts';
+/**
+ * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
+ * when the instance names no `storage`.
+ */
+export declare function get(auth: Auth): Storage | undefined;

package/dist/internal/store.js

@@ -0,0 +1,14 @@
+import * as IndexedDb from './indexedDb.js';
+/** The default `storage`, opened on first use. */
+let indexedDb;
+/**
+ * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
+ * when the instance names no `storage`.
+ */
+export function get(auth) {
+    if (auth.storage)
+        return auth.storage;
+    if (typeof indexedDB === 'undefined')
+        return undefined;
+    return (indexedDb ??= IndexedDb.create());
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-73.sha-45751db",
+  "version": "0.0.0-pr-75.sha-0f45efb",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {