@tempoxyz/auth 0.0.0-pr-74.sha-aa4f4e2 → 0.0.0-pr-87.sha-7bb5600

package/dist/Actions.d.ts

@@ -32,9 +32,14 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
+        /**
+         * The address of the user's Tempo Account the key acts for, such as the one the user chose from
+         * a sign-in's account step. Takes the place of `accessKey`'s `access`.
+         */
+        account?: `0x${string}` | undefined;
         /**
          * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
          * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the

package/dist/Actions.js

@@ -30,6 +30,7 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', {
         json: request(auth, {
             accessKey: key.accessKey,
+            account: options.account,
             challenge: options.challenge,
             permissions: options.permissions,
         }),

package/dist/Step.d.ts

@@ -2,8 +2,20 @@
  * A step a sign-in needs before it finishes, such as the SSO connection an address requires.
  * @module
  */
-/** A step a sign-in needs before it finishes, such as the SSO connection an address requires. */
+import type { TempoAccount } from './TempoAccount.ts';
+/**
+ * A step a sign-in needs before it finishes: the SSO connection an address requires, or the choice
+ * of account for a user with more than one Tempo Account.
+ */
 export type Step = {
+    /** The user's Tempo Accounts: the one the browser selected before first, then oldest first. */
+    accounts: readonly TempoAccount[];
+    /**
+     * The kind of step. The user is signed in, and chooses an account, whose `address`
+     * `Actions.authorize` takes as `account`.
+     */
+    type: 'account';
+} | {
     /** The kind of step. */
     type: 'sso';
     /** Where `Actions.provider.signIn` sends the browser to take the step. */

package/dist/actions/device.d.ts

@@ -18,7 +18,7 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/email.d.ts

@@ -24,12 +24,15 @@ export declare namespace sendCode {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
+ * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
+ * as `account`.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result && result.step.type === 'sso')
+ *   Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export declare function signIn<const chainId extends number = number>(auth: Auth, options: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
@@ -37,7 +40,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -60,7 +63,7 @@ export declare namespace signIn {
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
-    /** The authorization, or the step the address requires first. */
+    /** The authorization, or the step the address or the user's accounts require first. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
         step: Step;
     };

package/dist/actions/email.js

@@ -15,12 +15,15 @@ export async function sendCode(auth, options) {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
+ * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
+ * as `account`.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result && result.step.type === 'sso')
+ *   Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export async function signIn(auth, options) {
@@ -46,9 +49,17 @@ export async function signIn(auth, options) {
     // rather than discard the authorization.
     if (kept && link)
         await Link.release(auth, { link }).catch(() => undefined);
-    if ('step' in body)
+    if ('step' in body) {
+        if (body.step.type === 'account')
+            return {
+                step: {
+                    accounts: body.step.accounts.map(Api.tempoAccount),
+                    type: 'account',
+                },
+            };
         return {
             step: { ...body.step, url: new URL(body.step.url, auth.url).href },
         };
+    }
     return Api.authorization(body.authorization, key);
 }

package/dist/actions/passkey.d.ts

@@ -1,7 +1,7 @@
 /**
  * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
- * email first.
+ * same assertion. By default the browser offers every passkey it holds for Tempo's domain, so the
+ * app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
@@ -9,6 +9,7 @@ import type { Account } from 'viem/tempo';
 import type { Auth } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import type { Permissions } from '../Permissions.ts';
+import type { Step } from '../Step.ts';
 /**
  * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
  * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
@@ -33,7 +34,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -42,6 +43,13 @@ export declare namespace signIn {
          * `tempo-auth:sign` scope may send one.
          */
         challenge?: string | undefined;
+        /**
+         * The credential ID, or up to 16 IDs, the browser offers. Each is unpadded base64url, as
+         * `PublicKeyCredential.id` reports it, of 1 to 1,023 bytes. A padded or otherwise non-canonical
+         * encoding throws a `RequestError` with reason `invalid_field`. Defaults to every passkey the
+         * browser holds for Tempo's domain, as an empty list does.
+         */
+        credentialId?: readonly string[] | string | undefined;
         /**
          * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
          * module. Its assertion must report a web origin on the relying party's domain that the app
@@ -50,6 +58,8 @@ export declare namespace signIn {
          * `Actions.redirect.createUrl` in the system browser, where the user signs in again.
          */
         getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** How the browser mediates the ceremony, such as `conditional` for passkey autofill. Defaults to the browser's own mediation. */
+        mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
@@ -65,8 +75,14 @@ export declare namespace signIn {
         /** The kind of step. */
         type: 'email';
     };
-    /** The authorization, or the email step. */
+    /**
+     * The authorization, the email step, or the account step of a user with more than one Tempo
+     * Account. A passkey that owns one of the user's accounts selects it, so only a passkey that owns
+     * none returns the account step.
+     */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
-        step: EmailStep;
+        step: EmailStep | Extract<Step, {
+            type: 'account';
+        }>;
     };
 }

package/dist/actions/passkey.js

@@ -1,7 +1,7 @@
 /**
  * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
- * email first.
+ * same assertion. By default the browser offers every passkey it holds for Tempo's domain, so the
+ * app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
@@ -29,7 +29,7 @@ import { request } from '../internal/request.js';
  * ```
  */
 export async function signIn(auth, options = {}) {
-    const { challenge, getFn, permissions } = options;
+    const { challenge, credentialId, getFn, mediation, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
     const authorize = request(auth, {
         accessKey: key.accessKey,
@@ -40,7 +40,11 @@ export async function signIn(auth, options = {}) {
     // sends no `Origin` to bind one-tap to, so it sends the request with the assertion instead.
     const native = !/^https?:/i.test(authorize.redirect_uri);
     const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
-        json: native ? {} : { authorize },
+        json: {
+            ...(native ? {} : { authorize }),
+            ...(credentialId === undefined ? {} : { credentialId }),
+            ...(mediation === undefined ? {} : { mediation }),
+        },
     }));
     const deserialized = Authentication.deserializeOptions(requested.options);
     const assertion = Authentication.serializeResponse(await Authentication.sign(
@@ -50,6 +54,13 @@ export async function signIn(auth, options = {}) {
         json: native ? { assertion, authorize } : { assertion },
     }));
     if ('step' in body) {
+        if (body.step.type === 'account')
+            return {
+                step: {
+                    accounts: body.step.accounts.map(Api.tempoAccount),
+                    type: 'account',
+                },
+            };
         // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
         // library generated waits for it in `storage`.
         if (body.step.signed && !options.accessKey)

package/dist/actions/redirect.d.ts

@@ -42,7 +42,7 @@ export declare namespace createUrl {
     type Options = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key, whose material `pending` keeps.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key, whose material `pending` keeps.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/tempoAccount.d.ts

@@ -22,7 +22,8 @@ export declare namespace create {
     type ReturnType = TempoAccount;
 }
 /**
- * Lists the signed-in user's Tempo Accounts, their default first.
+ * Lists the signed-in user's Tempo Accounts, their default first: the one they selected at sign-in,
+ * or else their oldest.
  *
  * @example
  * ```ts

package/dist/actions/tempoAccount.js

@@ -12,10 +12,11 @@ import * as Api from '../internal/api.js';
  * ```
  */
 export async function create(auth) {
-    return toTempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
+    return Api.tempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
 }
 /**
- * Lists the signed-in user's Tempo Accounts, their default first.
+ * Lists the signed-in user's Tempo Accounts, their default first: the one they selected at sign-in,
+ * or else their oldest.
  *
  * @example
  * ```ts
@@ -26,12 +27,5 @@ export async function list(auth) {
     const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
         credentials: 'include',
     }));
-    return tempo.map(toTempoAccount);
-}
-/** Reads the account's address and the type of its owner, which the API lists first. */
-function toTempoAccount(account) {
-    return {
-        address: account.address,
-        owner: account.config.owners[0].type,
-    };
+    return tempo.map(Api.tempoAccount);
 }

package/dist/internal/api.d.ts

@@ -3,6 +3,7 @@ import type { Account } from 'viem/tempo';
 import { type Auth, RequestError } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import * as Key from '../Key.ts';
+import type { TempoAccount } from '../TempoAccount.ts';
 import type { Tokens } from '../Tokens.ts';
 /**
  * Builds an authorization from what Tempo Auth returned and the sign-in's key: the material the
@@ -13,6 +14,14 @@ export declare function authorization<chainId extends number = number>(body: Hea
     accessKey?: Account.Account | undefined;
     material: Key.Material;
 }): Authorization<chainId>;
+/**
+ * A sign-in's account step as the API returns it: the accounts of a user with more than one, who
+ * selects one before a key is authorized.
+ */
+export type AccountStep = {
+    accounts: readonly TempoAccountResponse[];
+    type: 'account';
+};
 /** What the headless API returns for an authorization. */
 export type Headless = {
     account: Key.Key['account'];
@@ -43,6 +52,19 @@ export declare function post(auth: Auth, path: string, options: {
  * OAuth form posts to WorkOS.
  */
 export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
+/** Reads the account's address and the type of its owner, which the API lists first. */
+export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
+/** A Tempo Account as the API returns it, with the fields the package reads. */
+export type TempoAccountResponse = {
+    address: `0x${string}`;
+    config: {
+        owners: readonly [{
+            type: string;
+        }, ...{
+            type: string;
+        }[]];
+    };
+};
 /** What Tempo Auth's token endpoint returns. Redeeming a redirect's code adds its key authorization. */
 export type TokenResponse = {
     access_token: string;

package/dist/internal/api.js

@@ -71,6 +71,13 @@ export async function token(auth, body) {
         method: 'POST',
     }));
 }
+/** Reads the account's address and the type of its owner, which the API lists first. */
+export function tempoAccount(account) {
+    return {
+        address: account.address,
+        owner: account.config.owners[0].type,
+    };
+}
 /** Reads a token response into `Tokens`. */
 export function tokens(response) {
     return {

package/dist/internal/request.d.ts

@@ -7,6 +7,8 @@ import type { Permissions } from '../Permissions.ts';
  */
 export declare function request(auth: Auth, options: {
     accessKey: Account.Account;
+    /** The user's Tempo Account the key acts for, in place of the one `accessKey` names. */
+    account?: `0x${string}` | undefined;
     /** A message the key's witness binds. */
     challenge?: string | undefined;
     permissions?: Permissions | undefined;

package/dist/internal/request.js

@@ -10,11 +10,13 @@ import { Hex } from 'ox';
  */
 export function request(auth, options) {
     const { accessKey, challenge, permissions = {} } = options;
+    const account = options.account ??
+        (accessKey.accessKeyAddress ? accessKey.address : undefined);
     return {
         ...(challenge === undefined ? {} : { challenge }),
         client_id: auth.clientId,
         key_authorization: {
-            ...(accessKey.accessKeyAddress ? { account: accessKey.address } : {}),
+            ...(account ? { account } : {}),
             address: accessKey.accessKeyAddress ?? accessKey.address,
             chainId: Hex.fromNumber(permissions.chainId ?? auth.chainId),
             expiry: permissions.expiry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-74.sha-aa4f4e2",
+  "version": "0.0.0-pr-87.sha-7bb5600",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {