@tempoxyz/auth 0.0.0-pr-74.sha-e38768f → 0.0.0-pr-75.sha-31e088a

package/dist/actions/passkey.d.ts

@@ -1,7 +1,7 @@
 /**
  * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
- * email first.
+ * same assertion. By default the browser offers every passkey it holds for Tempo's domain, so the
+ * app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
@@ -42,12 +42,21 @@ export declare namespace signIn {
          * `tempo-auth:sign` scope may send one.
          */
         challenge?: string | undefined;
+        /**
+         * The credential ID, or up to 16 IDs, the browser offers. Each is unpadded base64url, as
+         * `PublicKeyCredential.id` reports it, of 1 to 1,023 bytes. A padded or otherwise non-canonical
+         * encoding throws a `RequestError` with reason `invalid_field`. Defaults to every passkey the
+         * browser holds for Tempo's domain, as an empty list does.
+         */
+        credentialId?: readonly string[] | string | undefined;
         /**
          * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
          * module. Its assertion must report a web origin on the relying party's domain that the app
          * registered, so an Android app's facet origin is refused.
          */
         getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** How the browser mediates the ceremony, such as `conditional` for passkey autofill. Defaults to the browser's own mediation. */
+        mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/actions/passkey.js

@@ -1,7 +1,7 @@
 /**
  * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
- * email first.
+ * same assertion. By default the browser offers every passkey it holds for Tempo's domain, so the
+ * app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
@@ -29,7 +29,7 @@ import { request } from '../internal/request.js';
  * ```
  */
 export async function signIn(auth, options = {}) {
-    const { challenge, getFn, permissions } = options;
+    const { challenge, credentialId, getFn, mediation, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
     const authorize = request(auth, {
         accessKey: key.accessKey,
@@ -40,7 +40,11 @@ export async function signIn(auth, options = {}) {
     // sends no `Origin` to bind one-tap to, so it sends the request with the assertion instead.
     const native = !/^https?:/i.test(authorize.redirect_uri);
     const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
-        json: native ? {} : { authorize },
+        json: {
+            ...(native ? {} : { authorize }),
+            ...(credentialId === undefined ? {} : { credentialId }),
+            ...(mediation === undefined ? {} : { mediation }),
+        },
     }));
     const deserialized = Authentication.deserializeOptions(requested.options);
     const assertion = Authentication.serializeResponse(await Authentication.sign(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-74.sha-e38768f",
+  "version": "0.0.0-pr-75.sha-31e088a",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {