@tempoxyz/auth 0.0.0-pr-74.sha-cefcb96 → 0.0.0-pr-74.sha-232cd9d

package/dist/actions/email.d.ts

@@ -53,7 +53,8 @@ export declare namespace signIn {
         /**
          * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
          * to the user. When the step is `signed`, the call returns the key that passkey sign-in
-         * authorized with its assertion, given the same `accessKey` if the app supplied one.
+         * authorized with its assertion, given the same `accessKey`, `challenge`, and `permissions`.
+         * Another `accessKey` replaces the key that sign-in generated.
          */
         link?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */

package/dist/actions/email.js

@@ -26,8 +26,8 @@ export async function sendCode(auth, options) {
 export async function signIn(auth, options) {
     const { challenge, code, email, link, permissions } = options;
     // A one-tap passkey sign-in's email step already signed the key it generated, which Tempo Auth
-    // returns once this request names it again.
-    const kept = link ? await Link.get(auth, { link }) : undefined;
+    // returns once this request names it again. A key the app supplies replaces it.
+    const kept = link && !options.accessKey ? await Link.get(auth, { link }) : undefined;
     const key = kept ?? (await AccessKey.resolve(options.accessKey));
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-74.sha-cefcb96",
+  "version": "0.0.0-pr-74.sha-232cd9d",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {