@tempoxyz/auth 0.0.0-pr-87.sha-7bb5600 → 0.0.0-pr-73.sha-aff982f

package/dist/Actions.d.ts

@@ -32,14 +32,9 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * The address of the user's Tempo Account the key acts for, such as the one the user chose from
-         * a sign-in's account step. Takes the place of `accessKey`'s `access`.
-         */
-        account?: `0x${string}` | undefined;
         /**
          * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
          * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the

package/dist/Actions.js

@@ -30,7 +30,6 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', {
         json: request(auth, {
             accessKey: key.accessKey,
-            account: options.account,
             challenge: options.challenge,
             permissions: options.permissions,
         }),

package/dist/Auth.d.ts

@@ -51,9 +51,8 @@ export type Auth = {
     /** The scopes the app's tokens carry. */
     scope: string;
     /**
-     * Where `Actions.redirect.start` keeps its state until Tempo Auth redirects back, and
-     * `Actions.passkey.signIn` keeps a new key its email step signed. It must keep objects as they
-     * are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
+     * Where `Actions.redirect.start` keeps its state until Tempo Auth redirects back. It must keep
+     * objects as they are, since a browser key is a `CryptoKey`. Defaults to IndexedDB.
      */
     storage?: Storage | undefined;
     /** Where Tempo Auth runs, such as `https://auth.tempo.xyz`. */

package/dist/Step.d.ts

@@ -2,20 +2,8 @@
  * A step a sign-in needs before it finishes, such as the SSO connection an address requires.
  * @module
  */
-import type { TempoAccount } from './TempoAccount.ts';
-/**
- * A step a sign-in needs before it finishes: the SSO connection an address requires, or the choice
- * of account for a user with more than one Tempo Account.
- */
+/** A step a sign-in needs before it finishes, such as the SSO connection an address requires. */
 export type Step = {
-    /** The user's Tempo Accounts: the one the browser selected before first, then oldest first. */
-    accounts: readonly TempoAccount[];
-    /**
-     * The kind of step. The user is signed in, and chooses an account, whose `address`
-     * `Actions.authorize` takes as `account`.
-     */
-    type: 'account';
-} | {
     /** The kind of step. */
     type: 'sso';
     /** Where `Actions.provider.signIn` sends the browser to take the step. */

package/dist/actions/device.d.ts

@@ -18,7 +18,7 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/email.d.ts

@@ -24,15 +24,12 @@ export declare namespace sendCode {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
- * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
- * as `account`.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result && result.step.type === 'sso')
- *   Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export declare function signIn<const chainId extends number = number>(auth: Auth, options: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
@@ -40,7 +37,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -55,15 +52,13 @@ export declare namespace signIn {
         email: string;
         /**
          * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
-         * to the user. When the step is `signed`, the call returns the key that passkey sign-in
-         * authorized with its assertion, given the same `accessKey`, `challenge`, and `permissions`.
-         * Another `accessKey` replaces the key that sign-in generated.
+         * to the user.
          */
         link?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
-    /** The authorization, or the step the address or the user's accounts require first. */
+    /** The authorization, or the step the address requires first. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
         step: Step;
     };

package/dist/actions/email.js

@@ -1,6 +1,5 @@
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
-import * as Link from '../internal/link.js';
 import { request } from '../internal/request.js';
 /**
  * Emails the user a sign-in code. The response is the same for every address.
@@ -15,23 +14,17 @@ export async function sendCode(auth, options) {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
- * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
- * as `account`.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result && result.step.type === 'sso')
- *   Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export async function signIn(auth, options) {
     const { challenge, code, email, link, permissions } = options;
-    // A one-tap passkey sign-in's email step already signed the key it generated, which Tempo Auth
-    // returns once this request names it again. A key the app supplies replaces it.
-    const kept = link && !options.accessKey ? await Link.get(auth, { link }) : undefined;
-    const key = kept ?? (await AccessKey.resolve(options.accessKey));
+    const key = await AccessKey.resolve(options.accessKey);
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {
             authorize: request(auth, {
@@ -44,22 +37,9 @@ export async function signIn(auth, options) {
             ...(link ? { link } : {}),
         },
     }));
-    // A refusal throws above, which keeps the key for a retry with a new code. Tempo Auth already took
-    // the parked request, so a failed removal keeps the stale key, which the next email step replaces,
-    // rather than discard the authorization.
-    if (kept && link)
-        await Link.release(auth, { link }).catch(() => undefined);
-    if ('step' in body) {
-        if (body.step.type === 'account')
-            return {
-                step: {
-                    accounts: body.step.accounts.map(Api.tempoAccount),
-                    type: 'account',
-                },
-            };
+    if ('step' in body)
         return {
             step: { ...body.step, url: new URL(body.step.url, auth.url).href },
         };
-    }
     return Api.authorization(body.authorization, key);
 }

package/dist/actions/passkey.d.ts

@@ -1,7 +1,6 @@
 /**
- * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. By default the browser offers every passkey it holds for Tempo's domain, so the
- * app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
+ * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
+ * it holds for Tempo's domain, so the app needs no email first.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
@@ -9,19 +8,14 @@ import type { Account } from 'viem/tempo';
 import type { Auth } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import type { Permissions } from '../Permissions.ts';
-import type { Step } from '../Step.ts';
 /**
- * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
- * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
- * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
- * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a
- * wallet.tempo passkey whose account has no email: the app signs the user in with
+ * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
+ * for a wallet.tempo passkey whose account has no email: the app signs the user in with
  * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`. A `signed` step's assertion already signed the key,
- * which that call returns without another tap, so a new key waits in the instance's `storage`.
- * Throws a `RequestError` with reason `webauthn_required` when another passkey owns
- * the account, which signs only on Tempo Auth's pages, where `Actions.redirect.start` authorizes it
- * for the signed-in user.
+ * `accessKey`, `challenge`, and `permissions`, which this call does not authorize. Throws a `RequestError` with reason
+ * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
+ * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
+ * the user is already signed in.
  *
  * @example
  * ```ts
@@ -34,7 +28,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -43,13 +37,6 @@ export declare namespace signIn {
          * `tempo-auth:sign` scope may send one.
          */
         challenge?: string | undefined;
-        /**
-         * The credential ID, or up to 16 IDs, the browser offers. Each is unpadded base64url, as
-         * `PublicKeyCredential.id` reports it, of 1 to 1,023 bytes. A padded or otherwise non-canonical
-         * encoding throws a `RequestError` with reason `invalid_field`. Defaults to every passkey the
-         * browser holds for Tempo's domain, as an empty list does.
-         */
-        credentialId?: readonly string[] | string | undefined;
         /**
          * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
          * module. Its assertion must report a web origin on the relying party's domain that the app
@@ -58,8 +45,6 @@ export declare namespace signIn {
          * `Actions.redirect.createUrl` in the system browser, where the user signs in again.
          */
         getFn?: Authentication.sign.Options['getFn'] | undefined;
-        /** How the browser mediates the ceremony, such as `conditional` for passkey autofill. Defaults to the browser's own mediation. */
-        mediation?: 'conditional' | 'optional' | 'required' | 'silent' | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
@@ -67,22 +52,11 @@ export declare namespace signIn {
     type EmailStep = {
         /** Passed as `link` to `Actions.email.signIn`, which links the passkey to that user. */
         link: string;
-        /**
-         * Whether the assertion already signed the key, which `Actions.email.signIn` returns with
-         * `link`. Otherwise that call authorizes the key itself.
-         */
-        signed: boolean;
         /** The kind of step. */
         type: 'email';
     };
-    /**
-     * The authorization, the email step, or the account step of a user with more than one Tempo
-     * Account. A passkey that owns one of the user's accounts selects it, so only a passkey that owns
-     * none returns the account step.
-     */
+    /** The authorization, or the email step. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
-        step: EmailStep | Extract<Step, {
-            type: 'account';
-        }>;
+        step: EmailStep;
     };
 }

package/dist/actions/passkey.js

@@ -1,26 +1,20 @@
 /**
- * Signs the user in with a passkey from the app's own sign-in form, and signs the app's key with the
- * same assertion. By default the browser offers every passkey it holds for Tempo's domain, so the
- * app needs no email first. A non-empty `credentialId` narrows that to the passkeys it names.
+ * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
+ * it holds for Tempo's domain, so the app needs no email first.
  * @module
  */
 import { Authentication } from 'ox/webauthn';
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
-import * as Link from '../internal/link.js';
 import { request } from '../internal/request.js';
 /**
- * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
- * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
- * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
- * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a
- * wallet.tempo passkey whose account has no email: the app signs the user in with
+ * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
+ * for a wallet.tempo passkey whose account has no email: the app signs the user in with
  * `Actions.email.signIn`, passing the step's `link`, which links the passkey, and the same
- * `accessKey`, `challenge`, and `permissions`. A `signed` step's assertion already signed the key,
- * which that call returns without another tap, so a new key waits in the instance's `storage`.
- * Throws a `RequestError` with reason `webauthn_required` when another passkey owns
- * the account, which signs only on Tempo Auth's pages, where `Actions.redirect.start` authorizes it
- * for the signed-in user.
+ * `accessKey`, `challenge`, and `permissions`, which this call does not authorize. Throws a `RequestError` with reason
+ * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
+ * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
+ * the user is already signed in.
  *
  * @example
  * ```ts
@@ -29,43 +23,24 @@ import { request } from '../internal/request.js';
  * ```
  */
 export async function signIn(auth, options = {}) {
-    const { challenge, credentialId, getFn, mediation, permissions } = options;
+    const { challenge, getFn, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
-    const authorize = request(auth, {
-        accessKey: key.accessKey,
-        challenge,
-        permissions,
-    });
-    // A page sends the request with the options, so the challenge is its key's digest. A native app
-    // sends no `Origin` to bind one-tap to, so it sends the request with the assertion instead.
-    const native = !/^https?:/i.test(authorize.redirect_uri);
-    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
-        json: {
-            ...(native ? {} : { authorize }),
-            ...(credentialId === undefined ? {} : { credentialId }),
-            ...(mediation === undefined ? {} : { mediation }),
-        },
-    }));
+    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', { json: {} }));
     const deserialized = Authentication.deserializeOptions(requested.options);
     const assertion = Authentication.serializeResponse(await Authentication.sign(
     // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
     getFn ? { ...deserialized, getFn } : deserialized));
     const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
-        json: native ? { assertion, authorize } : { assertion },
+        json: {
+            assertion,
+            authorize: request(auth, {
+                accessKey: key.accessKey,
+                challenge,
+                permissions,
+            }),
+        },
     }));
-    if ('step' in body) {
-        if (body.step.type === 'account')
-            return {
-                step: {
-                    accounts: body.step.accounts.map(Api.tempoAccount),
-                    type: 'account',
-                },
-            };
-        // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
-        // library generated waits for it in `storage`.
-        if (body.step.signed && !options.accessKey)
-            await Link.keep(auth, { link: body.step.link, material: key.material });
+    if ('step' in body)
         return { step: body.step };
-    }
     return Api.authorization(body.authorization, key);
 }

package/dist/actions/redirect.d.ts

@@ -42,7 +42,7 @@ export declare namespace createUrl {
     type Options = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key, whose material `pending` keeps.
+         * defaults to the user's first. Defaults to a new key, whose material `pending` keeps.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/redirect.js

@@ -8,8 +8,8 @@ import { Base64, Bytes, Hash } from 'ox';
 import { RequestError } from '../Auth.js';
 import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
+import * as IndexedDb from '../internal/indexedDb.js';
 import { request } from '../internal/request.js';
-import * as Store from '../internal/store.js';
 import * as Pending from '../Pending.js';
 /**
  * Finishes a {@link start} when the page loads with Tempo Auth's callback, and returns `undefined`
@@ -24,8 +24,8 @@ import * as Pending from '../Pending.js';
  */
 export function complete(auth, options = {}) {
     completed ??= (async () => {
-        const stored = (await Store.get(auth).getItem(storageKey));
-        await Store.get(auth).removeItem(storageKey);
+        const stored = (await storage(auth).getItem(storageKey));
+        await storage(auth).removeItem(storageKey);
         const url = new URL(window.location.href);
         if (!url.searchParams.has('code'))
             return undefined;
@@ -148,12 +148,18 @@ export async function handleCallback(auth, options) {
  */
 export async function start(auth, options = {}) {
     const { pending, url } = await createUrl(auth, options);
-    await Store.get(auth).setItem(storageKey, pending);
+    await storage(auth).setItem(storageKey, pending);
     window.location.assign(url);
 }
 /** Unpadded URL-safe Base64, as PKCE and `key_authorization` use. */
 const base64url = { pad: false, url: true };
 /** The redirect this page load returns from, so its code is redeemed once. */
 let completed;
+/** The default `storage`, opened on first use. */
+let indexedDb;
 /** Where a redirect keeps its state in `storage`. */
 const storageKey = 'tempo-auth:redirect';
+/** Where a redirect keeps its state: the instance's `storage`, or IndexedDB. */
+function storage(auth) {
+    return auth.storage ?? (indexedDb ??= IndexedDb.create());
+}

package/dist/actions/tempoAccount.d.ts

@@ -22,8 +22,7 @@ export declare namespace create {
     type ReturnType = TempoAccount;
 }
 /**
- * Lists the signed-in user's Tempo Accounts, their default first: the one they selected at sign-in,
- * or else their oldest.
+ * Lists the signed-in user's Tempo Accounts, their default first.
  *
  * @example
  * ```ts

package/dist/actions/tempoAccount.js

@@ -12,11 +12,10 @@ import * as Api from '../internal/api.js';
  * ```
  */
 export async function create(auth) {
-    return Api.tempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
+    return toTempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
 }
 /**
- * Lists the signed-in user's Tempo Accounts, their default first: the one they selected at sign-in,
- * or else their oldest.
+ * Lists the signed-in user's Tempo Accounts, their default first.
  *
  * @example
  * ```ts
@@ -27,5 +26,12 @@ export async function list(auth) {
     const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
         credentials: 'include',
     }));
-    return tempo.map(Api.tempoAccount);
+    return tempo.map(toTempoAccount);
+}
+/** Reads the account's address and the type of its owner, which the API lists first. */
+function toTempoAccount(account) {
+    return {
+        address: account.address,
+        owner: account.config.owners[0].type,
+    };
 }

package/dist/internal/accessKey.d.ts

@@ -5,11 +5,6 @@ import type * as Key from '../Key.ts';
  * a `CryptoKey` across page loads. Elsewhere a CLI or native app must store the key as a string.
  */
 export declare function resolve(accessKey: Account.Account | undefined): Promise<resolve.ReturnType>;
-/**
- * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
- * empty material of a key the app supplied.
- */
-export declare function restore(material: Key.Material): resolve.ReturnType | undefined;
 export declare namespace resolve {
     type ReturnType = {
         /** The key, as a Viem account that signs with it. */

package/dist/internal/accessKey.js

@@ -24,14 +24,3 @@ export async function resolve(accessKey) {
         material: { privateKey },
     };
 }
-/**
- * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
- * empty material of a key the app supplied.
- */
-export function restore(material) {
-    if (material.keyPair)
-        return { accessKey: Account.fromWebCryptoP256(material.keyPair), material };
-    if (material.privateKey)
-        return { accessKey: Account.fromSecp256k1(material.privateKey), material };
-    return undefined;
-}

package/dist/internal/api.d.ts

@@ -3,7 +3,6 @@ import type { Account } from 'viem/tempo';
 import { type Auth, RequestError } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import * as Key from '../Key.ts';
-import type { TempoAccount } from '../TempoAccount.ts';
 import type { Tokens } from '../Tokens.ts';
 /**
  * Builds an authorization from what Tempo Auth returned and the sign-in's key: the material the
@@ -14,14 +13,6 @@ export declare function authorization<chainId extends number = number>(body: Hea
     accessKey?: Account.Account | undefined;
     material: Key.Material;
 }): Authorization<chainId>;
-/**
- * A sign-in's account step as the API returns it: the accounts of a user with more than one, who
- * selects one before a key is authorized.
- */
-export type AccountStep = {
-    accounts: readonly TempoAccountResponse[];
-    type: 'account';
-};
 /** What the headless API returns for an authorization. */
 export type Headless = {
     account: Key.Key['account'];
@@ -52,19 +43,6 @@ export declare function post(auth: Auth, path: string, options: {
  * OAuth form posts to WorkOS.
  */
 export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
-/** Reads the account's address and the type of its owner, which the API lists first. */
-export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
-/** A Tempo Account as the API returns it, with the fields the package reads. */
-export type TempoAccountResponse = {
-    address: `0x${string}`;
-    config: {
-        owners: readonly [{
-            type: string;
-        }, ...{
-            type: string;
-        }[]];
-    };
-};
 /** What Tempo Auth's token endpoint returns. Redeeming a redirect's code adds its key authorization. */
 export type TokenResponse = {
     access_token: string;

package/dist/internal/api.js

@@ -71,13 +71,6 @@ export async function token(auth, body) {
         method: 'POST',
     }));
 }
-/** Reads the account's address and the type of its owner, which the API lists first. */
-export function tempoAccount(account) {
-    return {
-        address: account.address,
-        owner: account.config.owners[0].type,
-    };
-}
 /** Reads a token response into `Tokens`. */
 export function tokens(response) {
     return {

package/dist/internal/request.d.ts

@@ -7,8 +7,6 @@ import type { Permissions } from '../Permissions.ts';
  */
 export declare function request(auth: Auth, options: {
     accessKey: Account.Account;
-    /** The user's Tempo Account the key acts for, in place of the one `accessKey` names. */
-    account?: `0x${string}` | undefined;
     /** A message the key's witness binds. */
     challenge?: string | undefined;
     permissions?: Permissions | undefined;

package/dist/internal/request.js

@@ -10,13 +10,11 @@ import { Hex } from 'ox';
  */
 export function request(auth, options) {
     const { accessKey, challenge, permissions = {} } = options;
-    const account = options.account ??
-        (accessKey.accessKeyAddress ? accessKey.address : undefined);
     return {
         ...(challenge === undefined ? {} : { challenge }),
         client_id: auth.clientId,
         key_authorization: {
-            ...(account ? { account } : {}),
+            ...(accessKey.accessKeyAddress ? { account: accessKey.address } : {}),
             address: accessKey.accessKeyAddress ?? accessKey.address,
             chainId: Hex.fromNumber(permissions.chainId ?? auth.chainId),
             expiry: permissions.expiry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-87.sha-7bb5600",
+  "version": "0.0.0-pr-73.sha-aff982f",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {

package/dist/internal/link.d.ts

@@ -1,38 +0,0 @@
-import type { Auth } from '../Auth.ts';
-import type * as Key from '../Key.ts';
-import * as AccessKey from './accessKey.ts';
-/**
- * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the
- * link's digest is stored, since the link links the passkey for whoever sends it with a code.
- */
-export declare function keep(auth: Auth, options: keep.Options): Promise<void>;
-export declare namespace keep {
-    type Options = {
-        /** The email step's `link`. */
-        link: string;
-        /** The key `AccessKey.resolve` generated. */
-        material: Key.Material;
-    };
-}
-/**
- * Returns the key kept for `link`, or `undefined` when none is. Leaves it in place, so a refused
- * code retries with the same key, until {@link release} removes it.
- */
-export declare function get(auth: Auth, options: get.Options): Promise<AccessKey.resolve.ReturnType | undefined>;
-export declare namespace get {
-    type Options = {
-        /** The `link` the emailed-code sign-in sends. */
-        link: string;
-    };
-}
-/**
- * Removes the key kept for `link`, once the emailed-code sign-in that used it finished. A key a newer
- * email step kept stays, so a sign-in that finishes late cannot remove it.
- */
-export declare function release(auth: Auth, options: release.Options): Promise<void>;
-export declare namespace release {
-    type Options = {
-        /** The `link` the finished sign-in sent. */
-        link: string;
-    };
-}

package/dist/internal/link.js

@@ -1,44 +0,0 @@
-/**
- * Keeps a new key that a one-tap passkey sign-in signed, until the emailed-code sign-in that sends
- * its email step's `link` returns the key's authorization.
- * @module
- */
-import { Bytes, Hash } from 'ox';
-import * as AccessKey from './accessKey.js';
-import * as Store from './store.js';
-/** Where the key waits in `storage`. A later email step replaces it. */
-const storageKey = 'tempo-auth:passkey-link';
-/**
- * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the
- * link's digest is stored, since the link links the passkey for whoever sends it with a code.
- */
-export async function keep(auth, options) {
-    const kept = {
-        digest: digest(options.link),
-        material: options.material,
-    };
-    await Store.get(auth)?.setItem(storageKey, kept);
-}
-/**
- * Returns the key kept for `link`, or `undefined` when none is. Leaves it in place, so a refused
- * code retries with the same key, until {@link release} removes it.
- */
-export async function get(auth, options) {
-    const kept = (await Store.get(auth)?.getItem(storageKey));
-    if (kept?.digest !== digest(options.link))
-        return undefined;
-    return AccessKey.restore(kept.material);
-}
-/**
- * Removes the key kept for `link`, once the emailed-code sign-in that used it finished. A key a newer
- * email step kept stays, so a sign-in that finishes late cannot remove it.
- */
-export async function release(auth, options) {
-    const store = Store.get(auth);
-    const kept = (await store?.getItem(storageKey));
-    if (kept?.digest === digest(options.link))
-        await store?.removeItem(storageKey);
-}
-function digest(link) {
-    return Hash.sha256(Bytes.fromString(link), { as: 'Hex' });
-}

package/dist/internal/store.d.ts

@@ -1,11 +0,0 @@
-/**
- * Resolves where actions keep state across page loads: the instance's `storage`, or IndexedDB.
- * @module
- */
-import type { Auth } from '../Auth.ts';
-import type { Storage } from '../Storage.ts';
-/**
- * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
- * when the instance names no `storage`.
- */
-export declare function get(auth: Auth): Storage | undefined;

package/dist/internal/store.js

@@ -1,14 +0,0 @@
-import * as IndexedDb from './indexedDb.js';
-/** The default `storage`, opened on first use. */
-let indexedDb;
-/**
- * Returns the instance's `storage`, or the page's IndexedDB. Returns `undefined` outside a browser
- * when the instance names no `storage`.
- */
-export function get(auth) {
-    if (auth.storage)
-        return auth.storage;
-    if (typeof indexedDB === 'undefined')
-        return undefined;
-    return (indexedDb ??= IndexedDb.create());
-}