@tempoxyz/auth 0.0.0-pr-87.sha-cf6fb2e → 0.0.0-pr-91.sha-bdc606a

package/dist/Actions.d.ts

@@ -14,7 +14,6 @@ export * as email from './actions/email.ts';
 export * as oauth from './actions/oauth.ts';
 export * as passkey from './actions/passkey.ts';
 export * as provider from './actions/provider.ts';
-export * as realm from './actions/realm.ts';
 export * as redirect from './actions/redirect.ts';
 export * as tempoAccount from './actions/tempoAccount.ts';
 /**
@@ -33,14 +32,9 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
-        /**
-         * The address of the user's Tempo Account the key acts for, such as the one the user chose from
-         * a sign-in's account step. Takes the place of `accessKey`'s `access`.
-         */
-        account?: `0x${string}` | undefined;
         /**
          * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
          * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the

package/dist/Actions.js

@@ -6,7 +6,6 @@ export * as email from './actions/email.js';
 export * as oauth from './actions/oauth.js';
 export * as passkey from './actions/passkey.js';
 export * as provider from './actions/provider.js';
-export * as realm from './actions/realm.js';
 export * as redirect from './actions/redirect.js';
 export * as tempoAccount from './actions/tempoAccount.js';
 /**
@@ -31,7 +30,6 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', {
         json: request(auth, {
             accessKey: key.accessKey,
-            account: options.account,
             challenge: options.challenge,
             permissions: options.permissions,
         }),

package/dist/Auth.d.ts

@@ -87,7 +87,7 @@ export declare namespace RequestError {
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */
-    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'passkey_not_permitted' | 'polling_too_fast' | 'rate_limited' | 'realm_not_permitted' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
 }
 /** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
 export declare class SignedOutError extends Error {

package/dist/Decorator.d.ts

@@ -111,10 +111,6 @@ export declare namespace tempoAuth {
                 /** `Actions.provider.signIn`. */
                 signIn: (options: Actions.provider.signIn.Options) => void;
             };
-            realm: {
-                /** `Actions.realm.list`. */
-                list: () => Promise<Actions.realm.list.ReturnType>;
-            };
             redirect: {
                 /** `Actions.redirect.complete`, which sets the client's account. */
                 complete: (options?: Actions.redirect.complete.Options) => Promise<Actions.redirect.complete.ReturnType>;
@@ -144,7 +140,7 @@ export declare namespace tempoAuth {
             signOut: () => Promise<void>;
             tempoAccount: {
                 /** `Actions.tempoAccount.create`. */
-                create: (options?: Actions.tempoAccount.create.Options) => Promise<Actions.tempoAccount.create.ReturnType>;
+                create: () => Promise<Actions.tempoAccount.create.ReturnType>;
                 /** `Actions.tempoAccount.list`. */
                 list: () => Promise<Actions.tempoAccount.list.ReturnType>;
             };

package/dist/Decorator.js

@@ -156,9 +156,6 @@ export function tempoAuth(options) {
                     list: () => Actions.provider.list(auth),
                     signIn: (options) => Actions.provider.signIn(auth, options),
                 },
-                realm: {
-                    list: () => Actions.realm.list(auth),
-                },
                 redirect: {
                     async complete(options = {}) {
                         const change = begin();
@@ -195,7 +192,7 @@ export function tempoAuth(options) {
                     await Actions.signOut(auth);
                 },
                 tempoAccount: {
-                    create: (options) => Actions.tempoAccount.create(auth, options),
+                    create: () => Actions.tempoAccount.create(auth),
                     list: () => Actions.tempoAccount.list(auth),
                 },
             },

package/dist/Step.d.ts

@@ -2,20 +2,8 @@
  * A step a sign-in needs before it finishes, such as the SSO connection an address requires.
  * @module
  */
-import type { TempoAccount } from './TempoAccount.ts';
-/**
- * A step a sign-in needs before it finishes: the SSO connection an address requires, or the choice
- * of account for a user with more than one Tempo Account.
- */
+/** A step a sign-in needs before it finishes, such as the SSO connection an address requires. */
 export type Step = {
-    /** The user's Tempo Accounts: the one the browser selected before first, then oldest first. */
-    accounts: readonly TempoAccount[];
-    /**
-     * The kind of step. The user is signed in, and chooses an account, whose `address`
-     * `Actions.authorize` takes as `account`.
-     */
-    type: 'account';
-} | {
     /** The kind of step. */
     type: 'sso';
     /** Where `Actions.provider.signIn` sends the browser to take the step. */

package/dist/TempoAccount.d.ts

@@ -12,25 +12,13 @@ export type TempoAccount = {
      * that may refuse a key authorization.
      */
     owner: 'privy' | 'webAuthn' | (string & {});
-    /**
-     * The realm the account belongs to: `default`, or one the app's settings name, such as
-     * `tempo-cash`, with its display name. An app reaches only the accounts of its realms.
-     */
-    realm: {
-        id: string;
-        name: string;
-    };
 };
 /**
  * Instantiates a {@link TempoAccount}.
  *
  * @example
  * ```ts
- * const tempoAccount = TempoAccount.from({
- *   address: '0x…',
- *   owner: 'privy',
- *   realm: { id: 'default', name: 'Tempo' },
- * })
+ * const tempoAccount = TempoAccount.from({ address: '0x…', owner: 'privy' })
  * ```
  */
 export declare function from(value: TempoAccount): TempoAccount;

package/dist/TempoAccount.js

@@ -3,11 +3,7 @@
  *
  * @example
  * ```ts
- * const tempoAccount = TempoAccount.from({
- *   address: '0x…',
- *   owner: 'privy',
- *   realm: { id: 'default', name: 'Tempo' },
- * })
+ * const tempoAccount = TempoAccount.from({ address: '0x…', owner: 'privy' })
  * ```
  */
 export function from(value) {

package/dist/actions/device.d.ts

@@ -18,7 +18,7 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/email.d.ts

@@ -24,15 +24,12 @@ export declare namespace sendCode {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
- * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
- * as `account`.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result && result.step.type === 'sso')
- *   Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export declare function signIn<const chainId extends number = number>(auth: Auth, options: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
@@ -40,7 +37,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -63,7 +60,7 @@ export declare namespace signIn {
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
-    /** The authorization, or the step the address or the user's accounts require first. */
+    /** The authorization, or the step the address requires first. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
         step: Step;
     };

package/dist/actions/email.js

@@ -15,15 +15,12 @@ export async function sendCode(auth, options) {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
- * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
- * as `account`.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result && result.step.type === 'sso')
- *   Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export async function signIn(auth, options) {
@@ -49,17 +46,9 @@ export async function signIn(auth, options) {
     // rather than discard the authorization.
     if (kept && link)
         await Link.release(auth, { link }).catch(() => undefined);
-    if ('step' in body) {
-        if (body.step.type === 'account')
-            return {
-                step: {
-                    accounts: body.step.accounts.map(Api.tempoAccount),
-                    type: 'account',
-                },
-            };
+    if ('step' in body)
         return {
             step: { ...body.step, url: new URL(body.step.url, auth.url).href },
         };
-    }
     return Api.authorization(body.authorization, key);
 }

package/dist/actions/passkey.d.ts

@@ -9,7 +9,6 @@ import type { Account } from 'viem/tempo';
 import type { Auth } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import type { Permissions } from '../Permissions.ts';
-import type { Step } from '../Step.ts';
 /**
  * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
  * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
@@ -34,7 +33,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
+         * defaults to the user's first. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -75,14 +74,8 @@ export declare namespace signIn {
         /** The kind of step. */
         type: 'email';
     };
-    /**
-     * The authorization, the email step, or the account step of a user with more than one Tempo
-     * Account. A passkey that owns one of the user's accounts selects it, so only a passkey that owns
-     * none returns the account step.
-     */
+    /** The authorization, or the email step. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
-        step: EmailStep | Extract<Step, {
-            type: 'account';
-        }>;
+        step: EmailStep;
     };
 }

package/dist/actions/passkey.js

@@ -54,13 +54,6 @@ export async function signIn(auth, options = {}) {
         json: native ? { assertion, authorize } : { assertion },
     }));
     if ('step' in body) {
-        if (body.step.type === 'account')
-            return {
-                step: {
-                    accounts: body.step.accounts.map(Api.tempoAccount),
-                    type: 'account',
-                },
-            };
         // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
         // library generated waits for it in `storage`.
         if (body.step.signed && !options.accessKey)

package/dist/actions/redirect.d.ts

@@ -42,7 +42,7 @@ export declare namespace createUrl {
     type Options = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key, whose material `pending` keeps.
+         * defaults to the user's first. Defaults to a new key, whose material `pending` keeps.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/tempoAccount.d.ts

@@ -5,32 +5,24 @@
 import type { Auth } from '../Auth.ts';
 import type { TempoAccount } from '../TempoAccount.ts';
 /**
- * Creates another Tempo Account for the signed-in user, in `realm` or the app's first realm, and
- * returns it. Pass its `address` as the `access` of an access key to authorize keys on it.
+ * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as the
+ * `access` of an access key to authorize keys on it.
  *
  * @example
  * ```ts
- * const tempoAccount = await Actions.tempoAccount.create(auth, { realm: 'tempo-cash' })
+ * const tempoAccount = await Actions.tempoAccount.create(auth)
  * await Actions.authorize(auth, {
  *   accessKey: { ...accessKey, account: tempoAccount.address },
  * })
  * ```
  */
-export declare function create(auth: Auth, options?: create.Options): Promise<create.ReturnType>;
+export declare function create(auth: Auth): Promise<create.ReturnType>;
 export declare namespace create {
-    type Options = {
-        /**
-         * The realm that holds the account, one that `Actions.realm.list` returns. Defaults to the app's
-         * first realm.
-         */
-        realm?: string | undefined;
-    };
     /** The new account. */
     type ReturnType = TempoAccount;
 }
 /**
- * Lists the signed-in user's Tempo Accounts that the app's settings include, their default first: the
- * one they selected at sign-in, or else their oldest.
+ * Lists the signed-in user's Tempo Accounts, their default first.
  *
  * @example
  * ```ts

package/dist/actions/tempoAccount.js

@@ -1,22 +1,21 @@
 import * as Api from '../internal/api.js';
 /**
- * Creates another Tempo Account for the signed-in user, in `realm` or the app's first realm, and
- * returns it. Pass its `address` as the `access` of an access key to authorize keys on it.
+ * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as the
+ * `access` of an access key to authorize keys on it.
  *
  * @example
  * ```ts
- * const tempoAccount = await Actions.tempoAccount.create(auth, { realm: 'tempo-cash' })
+ * const tempoAccount = await Actions.tempoAccount.create(auth)
  * await Actions.authorize(auth, {
  *   accessKey: { ...accessKey, account: tempoAccount.address },
  * })
  * ```
  */
-export async function create(auth, options = {}) {
-    return Api.tempoAccount(await Api.json(await Api.post(auth, `/v1/account/tempo?${new URLSearchParams({ client_id: auth.clientId })}`, { json: options.realm ? { realm: options.realm } : {} })));
+export async function create(auth) {
+    return toTempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
 }
 /**
- * Lists the signed-in user's Tempo Accounts that the app's settings include, their default first: the
- * one they selected at sign-in, or else their oldest.
+ * Lists the signed-in user's Tempo Accounts, their default first.
  *
  * @example
  * ```ts
@@ -24,6 +23,15 @@ export async function create(auth, options = {}) {
  * ```
  */
 export async function list(auth) {
-    const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/account?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url), { credentials: 'include' }));
-    return tempo.map(Api.tempoAccount);
+    const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
+        credentials: 'include',
+    }));
+    return tempo.map(toTempoAccount);
+}
+/** Reads the account's address and the type of its owner, which the API lists first. */
+function toTempoAccount(account) {
+    return {
+        address: account.address,
+        owner: account.config.owners[0].type,
+    };
 }

package/dist/internal/api.d.ts

@@ -3,7 +3,6 @@ import type { Account } from 'viem/tempo';
 import { type Auth, RequestError } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import * as Key from '../Key.ts';
-import type { TempoAccount } from '../TempoAccount.ts';
 import type { Tokens } from '../Tokens.ts';
 /**
  * Builds an authorization from what Tempo Auth returned and the sign-in's key: the material the
@@ -14,14 +13,6 @@ export declare function authorization<chainId extends number = number>(body: Hea
     accessKey?: Account.Account | undefined;
     material: Key.Material;
 }): Authorization<chainId>;
-/**
- * A sign-in's account step as the API returns it: the accounts of a user with more than one, who
- * selects one before a key is authorized.
- */
-export type AccountStep = {
-    accounts: readonly TempoAccountResponse[];
-    type: 'account';
-};
 /** What the headless API returns for an authorization. */
 export type Headless = {
     account: Key.Key['account'];
@@ -52,23 +43,6 @@ export declare function post(auth: Auth, path: string, options: {
  * OAuth form posts to WorkOS.
  */
 export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
-/** Reads the account's address, the type of its owner, which the API lists first, and its realm. */
-export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
-/** A Tempo Account as the API returns it, with the fields the package reads. */
-export type TempoAccountResponse = {
-    address: `0x${string}`;
-    config: {
-        owners: readonly [{
-            type: string;
-        }, ...{
-            type: string;
-        }[]];
-    };
-    realm: {
-        id: string;
-        name: string;
-    };
-};
 /** What Tempo Auth's token endpoint returns. Redeeming a redirect's code adds its key authorization. */
 export type TokenResponse = {
     access_token: string;

package/dist/internal/api.js

@@ -71,14 +71,6 @@ export async function token(auth, body) {
         method: 'POST',
     }));
 }
-/** Reads the account's address, the type of its owner, which the API lists first, and its realm. */
-export function tempoAccount(account) {
-    return {
-        address: account.address,
-        owner: account.config.owners[0].type,
-        realm: { id: account.realm.id, name: account.realm.name },
-    };
-}
 /** Reads a token response into `Tokens`. */
 export function tokens(response) {
     return {

package/dist/internal/request.d.ts

@@ -7,8 +7,6 @@ import type { Permissions } from '../Permissions.ts';
  */
 export declare function request(auth: Auth, options: {
     accessKey: Account.Account;
-    /** The user's Tempo Account the key acts for, in place of the one `accessKey` names. */
-    account?: `0x${string}` | undefined;
     /** A message the key's witness binds. */
     challenge?: string | undefined;
     permissions?: Permissions | undefined;

package/dist/internal/request.js

@@ -10,13 +10,11 @@ import { Hex } from 'ox';
  */
 export function request(auth, options) {
     const { accessKey, challenge, permissions = {} } = options;
-    const account = options.account ??
-        (accessKey.accessKeyAddress ? accessKey.address : undefined);
     return {
         ...(challenge === undefined ? {} : { challenge }),
         client_id: auth.clientId,
         key_authorization: {
-            ...(account ? { account } : {}),
+            ...(accessKey.accessKeyAddress ? { account: accessKey.address } : {}),
             address: accessKey.accessKeyAddress ?? accessKey.address,
             chainId: Hex.fromNumber(permissions.chainId ?? auth.chainId),
             expiry: permissions.expiry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-87.sha-cf6fb2e",
+  "version": "0.0.0-pr-91.sha-bdc606a",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {

package/dist/actions/realm.d.ts

@@ -1,26 +0,0 @@
-/**
- * Lists the realms the app reaches: the sets of Tempo Accounts its settings name.
- * @module
- */
-import type { Auth } from '../Auth.ts';
-/**
- * Lists the realms the app reaches, in its settings' order. The first holds the accounts
- * `Actions.tempoAccount.create` adds unless it names another.
- *
- * @example
- * ```ts
- * const realms = await Actions.realm.list(auth)
- * // [{ id: 'default', name: 'Tempo', passkeys: true }]
- * ```
- */
-export declare function list(auth: Auth): Promise<list.ReturnType>;
-export declare namespace list {
-    type ReturnType = readonly {
-        /** The realm ID, such as `default` or `tempo-cash`, which `Actions.tempoAccount.create` takes. */
-        id: string;
-        /** The realm's display name, such as `Tempo Cash`. */
-        name: string;
-        /** Whether passkeys own accounts in the realm. Only the default realm holds them. */
-        passkeys: boolean;
-    }[];
-}

package/dist/actions/realm.js

@@ -1,15 +0,0 @@
-import * as Api from '../internal/api.js';
-/**
- * Lists the realms the app reaches, in its settings' order. The first holds the accounts
- * `Actions.tempoAccount.create` adds unless it names another.
- *
- * @example
- * ```ts
- * const realms = await Actions.realm.list(auth)
- * // [{ id: 'default', name: 'Tempo', passkeys: true }]
- * ```
- */
-export async function list(auth) {
-    const { realms } = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/realms?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url)));
-    return realms;
-}