@tempoxyz/auth 0.0.0-pr-73.sha-b3def8a → 0.0.0-pr-71.sha-b89841e

package/dist/Actions.d.ts

@@ -35,12 +35,6 @@ export declare namespace authorize {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/Actions.js

@@ -30,7 +30,6 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', {
         json: request(auth, {
             accessKey: key.accessKey,
-            challenge: options.challenge,
             permissions: options.permissions,
         }),
     });

package/dist/Auth.d.ts

@@ -86,7 +86,7 @@ export declare namespace RequestError {
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */
-    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
 }
 /** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
 export declare class SignedOutError extends Error {

package/dist/actions/device.d.ts

@@ -21,12 +21,6 @@ export declare namespace authorize {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /**
          * The name the approval page shows. Defaults to the machine's hostname in Node, Bun, and Deno,
          * and to `Unknown device` elsewhere.

package/dist/actions/device.js

@@ -17,9 +17,6 @@ export async function authorize(auth, options = {}) {
     const key = await AccessKey.resolve(options.accessKey);
     const code = await Api.json(await Api.post(auth, '/v1/device/authorize', {
         json: {
-            ...(options.challenge === undefined
-                ? {}
-                : { challenge: options.challenge }),
             device: options.device ?? hostname(),
             key_authorization: request(auth, {
                 accessKey: key.accessKey,

package/dist/actions/email.d.ts

@@ -40,12 +40,6 @@ export declare namespace signIn {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** The 6-digit code the user was emailed. */
         code: string;
         /** The address the code was sent to. */

package/dist/actions/email.js

@@ -23,15 +23,11 @@ export async function sendCode(auth, options) {
  * ```
  */
 export async function signIn(auth, options) {
-    const { challenge, code, email, link, permissions } = options;
+    const { code, email, link, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {
-            authorize: request(auth, {
-                accessKey: key.accessKey,
-                challenge,
-                permissions,
-            }),
+            authorize: request(auth, { accessKey: key.accessKey, permissions }),
             code,
             email,
             ...(link ? { link } : {}),

package/dist/actions/passkey.d.ts

@@ -11,8 +11,7 @@ import type { Permissions } from '../Permissions.ts';
 /**
  * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
  * for a wallet.tempo passkey whose account has no email: the app signs the user in with
- * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`, which this call does not authorize. Throws a `RequestError` with reason
+ * `Actions.email.signIn`, passing the step's `link`, which links the passkey. Throws a `RequestError` with reason
  * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
  * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
  * the user is already signed in.
@@ -31,12 +30,6 @@ export declare namespace signIn {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /**
          * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
          * module. Its assertion must report a web origin on the relying party's domain that the app

package/dist/actions/passkey.js

@@ -10,8 +10,7 @@ import { request } from '../internal/request.js';
 /**
  * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
  * for a wallet.tempo passkey whose account has no email: the app signs the user in with
- * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`, which this call does not authorize. Throws a `RequestError` with reason
+ * `Actions.email.signIn`, passing the step's `link`, which links the passkey. Throws a `RequestError` with reason
  * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
  * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
  * the user is already signed in.
@@ -23,7 +22,7 @@ import { request } from '../internal/request.js';
  * ```
  */
 export async function signIn(auth, options = {}) {
-    const { challenge, getFn, permissions } = options;
+    const { getFn, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
     const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', { json: {} }));
     const deserialized = Authentication.deserializeOptions(requested.options);
@@ -33,11 +32,7 @@ export async function signIn(auth, options = {}) {
     const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
         json: {
             assertion,
-            authorize: request(auth, {
-                accessKey: key.accessKey,
-                challenge,
-                permissions,
-            }),
+            authorize: request(auth, { accessKey: key.accessKey, permissions }),
         },
     }));
     if ('step' in body)

package/dist/actions/redirect.d.ts

@@ -45,12 +45,6 @@ export declare namespace createUrl {
          * defaults to the user's first. Defaults to a new key, whose material `pending` keeps.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** What the key may do. Tempo Auth's pages show it, and the headless ceiling fills what it leaves out. */
         permissions?: Permissions | undefined;
         /** Where Tempo Auth redirects back to. Defaults to the instance's `redirectUri`. */
@@ -103,12 +97,6 @@ export declare namespace start {
          * key, which `storage` keeps until the browser returns.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** What the key may do. Tempo Auth's pages show it, and the headless ceiling fills what it leaves out. */
         permissions?: Permissions | undefined;
     };

package/dist/actions/redirect.js

@@ -75,9 +75,6 @@ export async function createUrl(auth, options = {}) {
     });
     const url = new URL('/authorize', auth.url);
     url.search = new URLSearchParams({
-        ...(options.challenge === undefined
-            ? {}
-            : { challenge: options.challenge }),
         client_id,
         code_challenge: Base64.fromBytes(Hash.sha256(Bytes.fromString(pending.verifier)), base64url),
         key_authorization: Base64.fromString(JSON.stringify(key_authorization), base64url),

package/dist/internal/request.d.ts

@@ -7,11 +7,8 @@ import type { Permissions } from '../Permissions.ts';
  */
 export declare function request(auth: Auth, options: {
     accessKey: Account.Account;
-    /** A message the key's witness binds. */
-    challenge?: string | undefined;
     permissions?: Permissions | undefined;
 }): {
-    challenge?: string;
     client_id: string;
     key_authorization: {
         account?: `0x${string}`;

package/dist/internal/request.js

@@ -9,9 +9,8 @@ import { Hex } from 'ox';
  * key account names its Tempo Account through `access`, and a plain key leaves it to Tempo Auth.
  */
 export function request(auth, options) {
-    const { accessKey, challenge, permissions = {} } = options;
+    const { accessKey, permissions = {} } = options;
     return {
-        ...(challenge === undefined ? {} : { challenge }),
         client_id: auth.clientId,
         key_authorization: {
             ...(accessKey.accessKeyAddress ? { account: accessKey.address } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-73.sha-b3def8a",
+  "version": "0.0.0-pr-71.sha-b89841e",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {