@tempoxyz/auth 0.0.0-pr-74.sha-ed340bf → 0.0.0-pr-67.sha-3bbf6f1

package/dist/Actions.d.ts

@@ -12,7 +12,6 @@ import type { Tokens } from './Tokens.ts';
 export * as device from './actions/device.ts';
 export * as email from './actions/email.ts';
 export * as oauth from './actions/oauth.ts';
-export * as passkey from './actions/passkey.ts';
 export * as provider from './actions/provider.ts';
 export * as redirect from './actions/redirect.ts';
 export * as tempoAccount from './actions/tempoAccount.ts';
@@ -35,12 +34,6 @@ export declare namespace authorize {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/Actions.js

@@ -4,7 +4,6 @@ import { request } from './internal/request.js';
 export * as device from './actions/device.js';
 export * as email from './actions/email.js';
 export * as oauth from './actions/oauth.js';
-export * as passkey from './actions/passkey.js';
 export * as provider from './actions/provider.js';
 export * as redirect from './actions/redirect.js';
 export * as tempoAccount from './actions/tempoAccount.js';
@@ -30,7 +29,6 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', {
         json: request(auth, {
             accessKey: key.accessKey,
-            challenge: options.challenge,
             permissions: options.permissions,
         }),
     });

package/dist/Auth.d.ts

@@ -51,9 +51,8 @@ export type Auth = {
     /** The scopes the app's tokens carry. */
     scope: string;
     /**
-     * Where `Actions.redirect.start` keeps its state until Tempo Auth redirects back, and
-     * `Actions.passkey.signIn` keeps a new key its email step signed. It must keep objects as they
-     * are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
+     * Where `Actions.redirect.start` keeps its state until Tempo Auth redirects back. It must keep
+     * objects as they are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
      */
     storage?: Storage | undefined;
     /** Where Tempo Auth runs, such as `https://auth.tempo.xyz`. */
@@ -87,7 +86,7 @@ export declare namespace RequestError {
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */
-    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected';
 }
 /** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
 export declare class SignedOutError extends Error {

package/dist/Decorator.d.ts

@@ -82,10 +82,7 @@ export declare namespace tempoAuth {
             email: {
                 /** `Actions.email.sendCode`. */
                 sendCode: (options: Actions.email.sendCode.Options) => Promise<void>;
-                /**
-                 * `Actions.email.signIn`, which sets the client's account unless it returns a step. A step
-                 * that another sign-in or a sign-out overtook throws {@link SupersededError}.
-                 */
+                /** `Actions.email.signIn`, which sets the client's account unless it returns a step. */
                 signIn: <const id extends number = chainId>(options: Actions.email.signIn.Options<id>) => Promise<Actions.email.signIn.ReturnType<id>>;
             };
             /** The instance the members call `Actions` with. */
@@ -98,13 +95,6 @@ export declare namespace tempoAuth {
                 /** `Actions.oauth.userInfo`. */
                 userInfo: (options: Actions.oauth.userInfo.Options) => Promise<User>;
             };
-            passkey: {
-                /**
-                 * `Actions.passkey.signIn`, which sets the client's account unless it returns a step. A step
-                 * that another sign-in or a sign-out overtook throws {@link SupersededError}.
-                 */
-                signIn: <const id extends number = chainId>(options?: Actions.passkey.signIn.Options<id>) => Promise<Actions.passkey.signIn.ReturnType<id>>;
-            };
             provider: {
                 /** `Actions.provider.list`. */
                 list: () => Promise<Actions.provider.list.ReturnType>;

package/dist/Decorator.js

@@ -54,58 +54,42 @@ export function tempoAuth(options) {
         // sign-in or sign-out completed after it began, so a stale result never replaces a newer one,
         // and a sign-in still pending at sign-out never signs the client back in.
         let version = 0;
-        // The version the latest sign-out produced, while no change has followed it.
-        let signedOut;
         /**
-         * Begins an operation that changes the client's account. `apply` applies its result: the
-         * account to sign with, or `undefined` to stop signing. `check` accepts a result that changes
-         * no account, such as a step. Applying an account, or checking a step, that a newer change
-         * overtook throws {@link SupersededError}, so the caller never holds a result the client's
-         * newer state contradicts.
+         * Begins an operation that changes the client's account, and returns the function that applies
+         * its result: the account to sign with, or `undefined` to stop signing. Applying an account that
+         * a newer change overtook throws {@link SupersededError}, so the caller never holds an
+         * authorization the client does not sign with.
          */
         const begin = () => {
             const started = version;
-            // A sign-in that finishes after sign-out may have set a new server session, so it ends that
-            // session again, unless a newer change already followed the sign-out.
-            const superseded = async () => {
-                if (signedOut === version)
-                    await Actions.signOut(auth);
-                return new SupersededError();
-            };
-            return {
-                async apply(account) {
-                    if (version !== started) {
-                        if (account)
-                            throw await superseded();
-                        return;
-                    }
-                    state.account = account;
-                    version++;
-                },
-                async check() {
-                    if (version !== started)
-                        throw await superseded();
-                },
+            return (account) => {
+                if (version !== started) {
+                    if (account)
+                        throw new SupersededError();
+                    return;
+                }
+                state.account = account;
+                version++;
             };
         };
         return {
             auth: {
                 async authorize(options = {}) {
-                    const change = begin();
+                    const apply = begin();
                     const authorization = await Actions.authorize(auth, options);
                     // Without a session, the client stops signing as the user it last authorized.
-                    await change.apply(authorization?.account);
+                    apply(authorization?.account);
                     return authorization;
                 },
                 device: {
                     async authorize(options = {}) {
-                        const change = begin();
+                        const apply = begin();
                         const device = await Actions.device.authorize(auth, options);
                         return {
                             ...device,
                             async wait() {
                                 const authorization = await device.wait();
-                                await change.apply(authorization.account);
+                                apply(authorization.account);
                                 return authorization;
                             },
                         };
@@ -114,12 +98,10 @@ export function tempoAuth(options) {
                 email: {
                     sendCode: (options) => Actions.email.sendCode(auth, options),
                     async signIn(options) {
-                        const change = begin();
+                        const apply = begin();
                         const result = await Actions.email.signIn(auth, options);
-                        if ('step' in result)
-                            await change.check();
-                        else
-                            await change.apply(result.account);
+                        if (!('step' in result))
+                            apply(result.account);
                         return result;
                     },
                 },
@@ -129,35 +111,24 @@ export function tempoAuth(options) {
                     jwks: () => Actions.oauth.jwks(auth),
                     userInfo: (options) => Actions.oauth.userInfo(auth, options),
                 },
-                passkey: {
-                    async signIn(options = {}) {
-                        const change = begin();
-                        const result = await Actions.passkey.signIn(auth, options);
-                        if ('step' in result)
-                            await change.check();
-                        else
-                            await change.apply(result.account);
-                        return result;
-                    },
-                },
                 provider: {
                     list: () => Actions.provider.list(auth),
                     signIn: (options) => Actions.provider.signIn(auth, options),
                 },
                 redirect: {
                     async complete(options = {}) {
-                        const change = begin();
+                        const apply = begin();
                         const authorization = await Actions.redirect.complete(auth, options);
                         // `undefined` means the page is not a callback, which says nothing about the session.
                         if (authorization)
-                            await change.apply(authorization.account);
+                            apply(authorization.account);
                         return authorization;
                     },
                     createUrl: (options = {}) => Actions.redirect.createUrl(auth, options),
                     async handleCallback(options) {
-                        const change = begin();
+                        const apply = begin();
                         const authorization = await Actions.redirect.handleCallback(auth, options);
-                        await change.apply(authorization.account);
+                        apply(authorization.account);
                         return authorization;
                     },
                     start: (options = {}) => Actions.redirect.start(auth, options),
@@ -167,8 +138,7 @@ export function tempoAuth(options) {
                     // A sign-in stored before `Key.chainId` existed gains it here.
                     const key = Key.from(authorization.key);
                     const account = Key.toAccount(key, options);
-                    state.account = account;
-                    version++;
+                    begin()(account);
                     return { ...authorization, account, key };
                 },
                 async signOut() {
@@ -176,7 +146,6 @@ export function tempoAuth(options) {
                     // pending is discarded, since the user asked to leave.
                     state.account = undefined;
                     version++;
-                    signedOut = version;
                     await Actions.signOut(auth);
                 },
                 tempoAccount: {

package/dist/TempoAccount.d.ts

@@ -6,19 +6,13 @@
 export type TempoAccount = {
     /** The account's address, the same on every Tempo chain. */
     address: `0x${string}`;
-    /**
-     * Who holds the account's owner key: a Privy wallet, which Tempo Auth signs with (`privy`), or a
-     * passkey, which signs only on a Tempo Auth page (`webAuthn`). Treat another value as an owner
-     * that may refuse a key authorization.
-     */
-    owner: 'privy' | 'webAuthn' | (string & {});
 };
 /**
  * Instantiates a {@link TempoAccount}.
  *
  * @example
  * ```ts
- * const tempoAccount = TempoAccount.from({ address: '0x…', owner: 'privy' })
+ * const tempoAccount = TempoAccount.from({ address: '0x…' })
  * ```
  */
 export declare function from(value: TempoAccount): TempoAccount;

package/dist/TempoAccount.js

@@ -3,7 +3,7 @@
  *
  * @example
  * ```ts
- * const tempoAccount = TempoAccount.from({ address: '0x…', owner: 'privy' })
+ * const tempoAccount = TempoAccount.from({ address: '0x…' })
  * ```
  */
 export function from(value) {

package/dist/actions/device.d.ts

@@ -21,12 +21,6 @@ export declare namespace authorize {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /**
          * The name the approval page shows. Defaults to the machine's hostname in Node, Bun, and Deno,
          * and to `Unknown device` elsewhere.

package/dist/actions/device.js

@@ -17,9 +17,6 @@ export async function authorize(auth, options = {}) {
     const key = await AccessKey.resolve(options.accessKey);
     const code = await Api.json(await Api.post(auth, '/v1/device/authorize', {
         json: {
-            ...(options.challenge === undefined
-                ? {}
-                : { challenge: options.challenge }),
             device: options.device ?? hostname(),
             key_authorization: request(auth, {
                 accessKey: key.accessKey,

package/dist/actions/email.d.ts

@@ -40,23 +40,10 @@ export declare namespace signIn {
          * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** The 6-digit code the user was emailed. */
         code: string;
         /** The address the code was sent to. */
         email: string;
-        /**
-         * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
-         * to the user. When the step is `signed`, the call returns the key that passkey sign-in
-         * authorized with its assertion, given the same `accessKey`, `challenge`, and `permissions`.
-         * Another `accessKey` replaces the key that sign-in generated.
-         */
-        link?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/actions/email.js

@@ -1,6 +1,5 @@
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
-import * as Link from '../internal/link.js';
 import { request } from '../internal/request.js';
 /**
  * Emails the user a sign-in code. The response is the same for every address.
@@ -24,26 +23,15 @@ export async function sendCode(auth, options) {
  * ```
  */
 export async function signIn(auth, options) {
-    const { challenge, code, email, link, permissions } = options;
-    // A one-tap passkey sign-in's email step already signed the key it generated, which Tempo Auth
-    // returns once this request names it again. A key the app supplies replaces it.
-    const kept = link && !options.accessKey ? await Link.get(auth, { link }) : undefined;
-    const key = kept ?? (await AccessKey.resolve(options.accessKey));
+    const { code, email, permissions } = options;
+    const key = await AccessKey.resolve(options.accessKey);
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {
-            authorize: request(auth, {
-                accessKey: key.accessKey,
-                challenge,
-                permissions,
-            }),
+            authorize: request(auth, { accessKey: key.accessKey, permissions }),
             code,
             email,
-            ...(link ? { link } : {}),
         },
     }));
-    // A refusal throws above, which keeps the key for a retry with a new code.
-    if (kept)
-        await Link.release(auth);
     if ('step' in body)
         return {
             step: { ...body.step, url: new URL(body.step.url, auth.url).href },

package/dist/actions/redirect.d.ts

@@ -45,12 +45,6 @@ export declare namespace createUrl {
          * defaults to the user's first. Defaults to a new key, whose material `pending` keeps.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** What the key may do. Tempo Auth's pages show it, and the headless ceiling fills what it leaves out. */
         permissions?: Permissions | undefined;
         /** Where Tempo Auth redirects back to. Defaults to the instance's `redirectUri`. */
@@ -103,12 +97,6 @@ export declare namespace start {
          * key, which `storage` keeps until the browser returns.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
         /** What the key may do. Tempo Auth's pages show it, and the headless ceiling fills what it leaves out. */
         permissions?: Permissions | undefined;
     };

package/dist/actions/redirect.js

@@ -8,8 +8,8 @@ import { Base64, Bytes, Hash } from 'ox';
 import { RequestError } from '../Auth.js';
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
+import * as IndexedDb from '../internal/indexedDb.js';
 import { request } from '../internal/request.js';
-import * as Store from '../internal/store.js';
 import * as Pending from '../Pending.js';
 /**
  * Finishes a {@link start} when the page loads with Tempo Auth's callback, and returns `undefined`
@@ -24,8 +24,8 @@ import * as Pending from '../Pending.js';
  */
 export function complete(auth, options = {}) {
     completed ??= (async () => {
-        const stored = (await Store.get(auth).getItem(storageKey));
-        await Store.get(auth).removeItem(storageKey);
+        const stored = (await storage(auth).getItem(storageKey));
+        await storage(auth).removeItem(storageKey);
         const url = new URL(window.location.href);
         if (!url.searchParams.has('code'))
             return undefined;
@@ -75,9 +75,6 @@ export async function createUrl(auth, options = {}) {
     });
     const url = new URL('/authorize', auth.url);
     url.search = new URLSearchParams({
-        ...(options.challenge === undefined
-            ? {}
-            : { challenge: options.challenge }),
         client_id,
         code_challenge: Base64.fromBytes(Hash.sha256(Bytes.fromString(pending.verifier)), base64url),
         key_authorization: Base64.fromString(JSON.stringify(key_authorization), base64url),
@@ -148,12 +145,18 @@ export async function handleCallback(auth, options) {
  */
 export async function start(auth, options = {}) {
     const { pending, url } = await createUrl(auth, options);
-    await Store.get(auth).setItem(storageKey, pending);
+    await storage(auth).setItem(storageKey, pending);
     window.location.assign(url);
 }
 /** Unpadded URL-safe Base64, as PKCE and `key_authorization` use. */
 const base64url = { pad: false, url: true };
 /** The redirect this page load returns from, so its code is redeemed once. */
 let completed;
+/** The default `storage`, opened on first use. */
+let indexedDb;
 /** Where a redirect keeps its state in `storage`. */
 const storageKey = 'tempo-auth:redirect';
+/** Where a redirect keeps its state: the instance's `storage`, or IndexedDB. */
+function storage(auth) {
+    return auth.storage ?? (indexedDb ??= IndexedDb.create());
+}

package/dist/actions/tempoAccount.js

@@ -12,7 +12,8 @@ import * as Api from '../internal/api.js';
  * ```
  */
 export async function create(auth) {
-    return toTempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
+    const { address } = await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} }));
+    return { address };
 }
 /**
  * Lists the signed-in user's Tempo Accounts, their default first.
@@ -26,12 +27,5 @@ export async function list(auth) {
     const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
         credentials: 'include',
     }));
-    return tempo.map(toTempoAccount);
-}
-/** Reads the account's address and the type of its owner, which the API lists first. */
-function toTempoAccount(account) {
-    return {
-        address: account.address,
-        owner: account.config.owners[0].type,
-    };
+    return tempo.map(({ address }) => ({ address }));
 }

package/dist/internal/accessKey.d.ts

@@ -5,11 +5,6 @@ import type * as Key from '../Key.ts';
  * a `CryptoKey` across page loads. Elsewhere a CLI or native app must store the key as a string.
  */
 export declare function resolve(accessKey: Account.Account | undefined): Promise<resolve.ReturnType>;
-/**
- * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
- * empty material of a key the app supplied.
- */
-export declare function restore(material: Key.Material): resolve.ReturnType | undefined;
 export declare namespace resolve {
     type ReturnType = {
         /** The key, as a Viem account that signs with it. */

package/dist/internal/accessKey.js

@@ -24,14 +24,3 @@ export async function resolve(accessKey) {
         material: { privateKey },
     };
 }
-/**
- * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
- * empty material of a key the app supplied.
- */
-export function restore(material) {
-    if (material.keyPair)
-        return { accessKey: Account.fromWebCryptoP256(material.keyPair), material };
-    if (material.privateKey)
-        return { accessKey: Account.fromSecp256k1(material.privateKey), material };
-    return undefined;
-}

package/dist/internal/request.d.ts

@@ -7,11 +7,8 @@ import type { Permissions } from '../Permissions.ts';
  */
 export declare function request(auth: Auth, options: {
     accessKey: Account.Account;
-    /** A message the key's witness binds. */
-    challenge?: string | undefined;
     permissions?: Permissions | undefined;
 }): {
-    challenge?: string;
     client_id: string;
     key_authorization: {
         account?: `0x${string}`;

package/dist/internal/request.js

@@ -9,9 +9,8 @@ import { Hex } from 'ox';
  * key account names its Tempo Account through `access`, and a plain key leaves it to Tempo Auth.
  */
 export function request(auth, options) {
-    const { accessKey, challenge, permissions = {} } = options;
+    const { accessKey, permissions = {} } = options;
     return {
-        ...(challenge === undefined ? {} : { challenge }),
         client_id: auth.clientId,
         key_authorization: {
             ...(accessKey.accessKeyAddress ? { account: accessKey.address } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-74.sha-ed340bf",
+  "version": "0.0.0-pr-67.sha-3bbf6f1",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {

package/dist/actions/passkey.d.ts

@@ -1,70 +0,0 @@
-/**
- * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
- * email first.
- * @module
- */
-import { Authentication } from 'ox/webauthn';
-import type { Account } from 'viem/tempo';
-import type { Auth } from '../Auth.ts';
-import type { Authorization } from '../Authorization.ts';
-import type { Permissions } from '../Permissions.ts';
-/**
- * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
- * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
- * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
- * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a
- * wallet.tempo passkey whose account has no email: the app signs the user in with
- * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`. A `signed` step's assertion already signed the key,
- * which that call returns without another tap, so a new key waits in the instance's `storage`.
- * Throws a `RequestError` with reason `webauthn_required` when another passkey owns
- * the account, which signs only on Tempo Auth's pages, where `Actions.redirect.start` authorizes it
- * for the signed-in user.
- *
- * @example
- * ```ts
- * const result = await Actions.passkey.signIn(auth)
- * if ('step' in result) showEmailForm()
- * ```
- */
-export declare function signIn<const chainId extends number = number>(auth: Auth, options?: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
-export declare namespace signIn {
-    type Options<chainId extends number = number> = {
-        /**
-         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
-         */
-        accessKey?: Account.Account | undefined;
-        /**
-         * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
-         * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the
-         * `tempo-auth:sign` scope may send one.
-         */
-        challenge?: string | undefined;
-        /**
-         * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
-         * module. Its assertion must report a web origin on the relying party's domain that the app
-         * registered, so an Android app's facet origin is refused.
-         */
-        getFn?: Authentication.sign.Options['getFn'] | undefined;
-        /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
-        permissions?: Permissions<chainId> | undefined;
-    };
-    /** The step a wallet.tempo passkey without an email needs: an emailed code, which links it. */
-    type EmailStep = {
-        /** Passed as `link` to `Actions.email.signIn`, which links the passkey to that user. */
-        link: string;
-        /**
-         * Whether the assertion already signed the key, which `Actions.email.signIn` returns with
-         * `link`. Otherwise that call authorizes the key itself.
-         */
-        signed: boolean;
-        /** The kind of step. */
-        type: 'email';
-    };
-    /** The authorization, or the email step. */
-    type ReturnType<chainId extends number = number> = Authorization<chainId> | {
-        step: EmailStep;
-    };
-}

package/dist/actions/passkey.js

@@ -1,60 +0,0 @@
-/**
- * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. The browser offers every passkey it holds for Tempo's domain, so the app needs no
- * email first.
- * @module
- */
-import { Authentication } from 'ox/webauthn';
-import * as AccessKey from '../internal/accessKey.js';
-import * as Api from '../internal/api.js';
-import * as Link from '../internal/link.js';
-import { request } from '../internal/request.js';
-/**
- * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
- * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
- * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
- * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a
- * wallet.tempo passkey whose account has no email: the app signs the user in with
- * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`. A `signed` step's assertion already signed the key,
- * which that call returns without another tap, so a new key waits in the instance's `storage`.
- * Throws a `RequestError` with reason `webauthn_required` when another passkey owns
- * the account, which signs only on Tempo Auth's pages, where `Actions.redirect.start` authorizes it
- * for the signed-in user.
- *
- * @example
- * ```ts
- * const result = await Actions.passkey.signIn(auth)
- * if ('step' in result) showEmailForm()
- * ```
- */
-export async function signIn(auth, options = {}) {
-    const { challenge, getFn, permissions } = options;
-    const key = await AccessKey.resolve(options.accessKey);
-    const authorize = request(auth, {
-        accessKey: key.accessKey,
-        challenge,
-        permissions,
-    });
-    // A page sends the request with the options, so the challenge is its key's digest. A native app
-    // sends no `Origin` to bind one-tap to, so it sends the request with the assertion instead.
-    const native = !/^https?:/i.test(authorize.redirect_uri);
-    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
-        json: native ? {} : { authorize },
-    }));
-    const deserialized = Authentication.deserializeOptions(requested.options);
-    const assertion = Authentication.serializeResponse(await Authentication.sign(
-    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
-    getFn ? { ...deserialized, getFn } : deserialized));
-    const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
-        json: native ? { assertion, authorize } : { assertion },
-    }));
-    if ('step' in body) {
-        // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
-        // library generated waits for it in `storage`.
-        if (body.step.signed && !options.accessKey)
-            await Link.keep(auth, { link: body.step.link, material: key.material });
-        return { step: body.step };
-    }
-    return Api.authorization(body.authorization, key);
-}

package/dist/internal/link.d.ts

@@ -1,31 +0,0 @@
-/**
- * Keeps a new key that a one-tap passkey sign-in signed, until the emailed-code sign-in that sends
- * its email step's `link` returns the key's authorization.
- * @module
- */
-import type { Auth } from '../Auth.ts';
-import type * as Key from '../Key.ts';
-import * as AccessKey from './accessKey.ts';
-/** Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. */
-export declare function keep(auth: Auth, options: keep.Options): Promise<void>;
-export declare namespace keep {
-    type Options = {
-        /** The email step's `link`. */
-        link: string;
-        /** The key `AccessKey.resolve` generated. */
-        material: Key.Material;
-    };
-}
-/**
- * Returns the key kept for `link`, or `undefined` when none is. Leaves it in place, so a refused
- * code retries with the same key, until {@link release} removes it.
- */
-export declare function get(auth: Auth, options: get.Options): Promise<AccessKey.resolve.ReturnType | undefined>;
-export declare namespace get {
-    type Options = {
-        /** The `link` the emailed-code sign-in sends. */
-        link: string;
-    };
-}
-/** Removes the kept key, once the emailed-code sign-in that used it finished. */
-export declare function release(auth: Auth): Promise<void>;

package/dist/internal/link.js

@@ -1,22 +0,0 @@
-import * as AccessKey from './accessKey.js';
-import * as Store from './store.js';
-/** Where the key waits in `storage`. A later email step replaces it. */
-const storageKey = 'tempo-auth:passkey-link';
-/** Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. */
-export async function keep(auth, options) {
-    await Store.get(auth)?.setItem(storageKey, options);
-}
-/**
- * Returns the key kept for `link`, or `undefined` when none is. Leaves it in place, so a refused
- * code retries with the same key, until {@link release} removes it.
- */
-export async function get(auth, options) {
-    const kept = (await Store.get(auth)?.getItem(storageKey));
-    if (kept?.link !== options.link)
-        return undefined;
-    return AccessKey.restore(kept.material);
-}
-/** Removes the kept key, once the emailed-code sign-in that used it finished. */
-export async function release(auth) {
-    await Store.get(auth)?.removeItem(storageKey);
-}

package/dist/internal/store.d.ts

@@ -1,11 +0,0 @@
-/**
- * Resolves where actions keep state across page loads: the instance's `storage`, or IndexedDB.
- * @module
- */
-import type { Auth } from '../Auth.ts';
-import type { Storage } from '../Storage.ts';
-/**
- * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
- * when the instance names no `storage`.
- */
-export declare function get(auth: Auth): Storage | undefined;

package/dist/internal/store.js

@@ -1,14 +0,0 @@
-import * as IndexedDb from './indexedDb.js';
-/** The default `storage`, opened on first use. */
-let indexedDb;
-/**
- * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
- * when the instance names no `storage`.
- */
-export function get(auth) {
-    if (auth.storage)
-        return auth.storage;
-    if (typeof indexedDB === 'undefined')
-        return undefined;
-    return (indexedDb ??= IndexedDb.create());
-}