@tempoxyz/auth 0.0.0-pr-91.sha-6314f05 → 0.0.0-pr-87.sha-acd2cc7

package/dist/Actions.d.ts

@@ -32,9 +32,14 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
+        /**
+         * The address of the user's Tempo Account the key acts for, such as the one the user chose from
+         * a sign-in's account step. Takes the place of `accessKey`'s `access`.
+         */
+        account?: `0x${string}` | undefined;
         /**
          * A message the owner's signature binds, such as a sign-in challenge the app's backend issued.
          * Tempo Auth binds its EIP-191 hash as the key authorization's `witness`. Only an app with the

package/dist/Actions.js

@@ -30,6 +30,7 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', {
         json: request(auth, {
             accessKey: key.accessKey,
+            account: options.account,
             challenge: options.challenge,
             permissions: options.permissions,
         }),

package/dist/Auth.d.ts

@@ -87,7 +87,7 @@ export declare namespace RequestError {
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */
-    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
+    type Reason = 'already_decided' | 'approval_pending' | 'body_too_large' | 'challenge_not_permitted' | 'cross_site_request' | 'device_code_expired' | 'duplicate_limit' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'invalid_chain' | 'invalid_code' | 'invalid_expiry' | 'invalid_field' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'limit_exceeds_maximum' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_recipients' | 'passkey_not_permitted' | 'polling_too_fast' | 'rate_limited' | 'rejected' | 'request_denied' | 'scope_without_limit' | 'session_required' | 'unexpected' | 'unknown_code' | 'unknown_endpoint' | 'unsupported_call' | 'unsupported_step' | 'unsupported_token' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
 }
 /** A client's {@link Account} read before a sign-in set it, or after sign-out emptied it. */
 export declare class SignedOutError extends Error {

package/dist/Step.d.ts

@@ -2,8 +2,20 @@
  * A step a sign-in needs before it finishes, such as the SSO connection an address requires.
  * @module
  */
-/** A step a sign-in needs before it finishes, such as the SSO connection an address requires. */
+import type { TempoAccount } from './TempoAccount.ts';
+/**
+ * A step a sign-in needs before it finishes: the SSO connection an address requires, or the choice
+ * of account for a user with more than one Tempo Account.
+ */
 export type Step = {
+    /** The user's Tempo Accounts: the one the browser selected before first, then oldest first. */
+    accounts: readonly TempoAccount[];
+    /**
+     * The kind of step. The user is signed in, and chooses an account, whose `address`
+     * `Actions.authorize` takes as `account`.
+     */
+    type: 'account';
+} | {
     /** The kind of step. */
     type: 'sso';
     /** Where `Actions.provider.signIn` sends the browser to take the step. */

package/dist/TempoAccount.d.ts

@@ -12,13 +12,25 @@ export type TempoAccount = {
      * that may refuse a key authorization.
      */
     owner: 'privy' | 'webAuthn' | (string & {});
+    /**
+     * The realm the account belongs to: `default`, or one the app's settings name, such as
+     * `tempo-cash`, with its display name. An app reaches only the accounts of its realms.
+     */
+    realm: {
+        id: string;
+        name: string;
+    };
 };
 /**
  * Instantiates a {@link TempoAccount}.
  *
  * @example
  * ```ts
- * const tempoAccount = TempoAccount.from({ address: '0x…', owner: 'privy' })
+ * const tempoAccount = TempoAccount.from({
+ *   address: '0x…',
+ *   owner: 'privy',
+ *   realm: { id: 'default', name: 'Tempo' },
+ * })
  * ```
  */
 export declare function from(value: TempoAccount): TempoAccount;

package/dist/TempoAccount.js

@@ -3,7 +3,11 @@
  *
  * @example
  * ```ts
- * const tempoAccount = TempoAccount.from({ address: '0x…', owner: 'privy' })
+ * const tempoAccount = TempoAccount.from({
+ *   address: '0x…',
+ *   owner: 'privy',
+ *   realm: { id: 'default', name: 'Tempo' },
+ * })
  * ```
  */
 export function from(value) {

package/dist/actions/device.d.ts

@@ -18,7 +18,7 @@ export declare namespace authorize {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/email.d.ts

@@ -24,12 +24,15 @@ export declare namespace sendCode {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
+ * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
+ * as `account`.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result && result.step.type === 'sso')
+ *   Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export declare function signIn<const chainId extends number = number>(auth: Auth, options: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
@@ -37,7 +40,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -60,7 +63,7 @@ export declare namespace signIn {
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };
-    /** The authorization, or the step the address requires first. */
+    /** The authorization, or the step the address or the user's accounts require first. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
         step: Step;
     };

package/dist/actions/email.js

@@ -15,12 +15,15 @@ export async function sendCode(auth, options) {
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
- * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues.
+ * Returns a {@link Step} when the address requires SSO, which `Actions.provider.signIn` continues,
+ * or when the user has more than one Tempo Account, whose chosen `address` `Actions.authorize` takes
+ * as `account`.
  *
  * @example
  * ```ts
  * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result) Actions.provider.signIn(auth, { url: result.step.url })
+ * if ('step' in result && result.step.type === 'sso')
+ *   Actions.provider.signIn(auth, { url: result.step.url })
  * ```
  */
 export async function signIn(auth, options) {
@@ -46,9 +49,17 @@ export async function signIn(auth, options) {
     // rather than discard the authorization.
     if (kept && link)
         await Link.release(auth, { link }).catch(() => undefined);
-    if ('step' in body)
+    if ('step' in body) {
+        if (body.step.type === 'account')
+            return {
+                step: {
+                    accounts: body.step.accounts.map(Api.tempoAccount),
+                    type: 'account',
+                },
+            };
         return {
             step: { ...body.step, url: new URL(body.step.url, auth.url).href },
         };
+    }
     return Api.authorization(body.authorization, key);
 }

package/dist/actions/passkey.d.ts

@@ -9,6 +9,7 @@ import type { Account } from 'viem/tempo';
 import type { Auth } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import type { Permissions } from '../Permissions.ts';
+import type { Step } from '../Step.ts';
 /**
  * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
  * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
@@ -33,7 +34,7 @@ export declare namespace signIn {
     type Options<chainId extends number = number> = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key.
          */
         accessKey?: Account.Account | undefined;
         /**
@@ -74,8 +75,14 @@ export declare namespace signIn {
         /** The kind of step. */
         type: 'email';
     };
-    /** The authorization, or the email step. */
+    /**
+     * The authorization, the email step, or the account step of a user with more than one Tempo
+     * Account. A passkey that owns one of the user's accounts selects it, so only a passkey that owns
+     * none returns the account step.
+     */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
-        step: EmailStep;
+        step: EmailStep | Extract<Step, {
+            type: 'account';
+        }>;
     };
 }

package/dist/actions/passkey.js

@@ -54,6 +54,13 @@ export async function signIn(auth, options = {}) {
         json: native ? { assertion, authorize } : { assertion },
     }));
     if ('step' in body) {
+        if (body.step.type === 'account')
+            return {
+                step: {
+                    accounts: body.step.accounts.map(Api.tempoAccount),
+                    type: 'account',
+                },
+            };
         // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
         // library generated waits for it in `storage`.
         if (body.step.signed && !options.accessKey)

package/dist/actions/redirect.d.ts

@@ -42,7 +42,7 @@ export declare namespace createUrl {
     type Options = {
         /**
          * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
-         * defaults to the user's first. Defaults to a new key, whose material `pending` keeps.
+         * defaults to the one the user selected at sign-in, or their oldest. Defaults to a new key, whose material `pending` keeps.
          */
         accessKey?: Account.Account | undefined;
         /**

package/dist/actions/tempoAccount.d.ts

@@ -5,8 +5,8 @@
 import type { Auth } from '../Auth.ts';
 import type { TempoAccount } from '../TempoAccount.ts';
 /**
- * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as the
- * `access` of an access key to authorize keys on it.
+ * Creates another Tempo Account for the signed-in user with the app's settings, and returns it. Pass
+ * its `address` as the `access` of an access key to authorize keys on it.
  *
  * @example
  * ```ts
@@ -22,7 +22,8 @@ export declare namespace create {
     type ReturnType = TempoAccount;
 }
 /**
- * Lists the signed-in user's Tempo Accounts, their default first.
+ * Lists the signed-in user's Tempo Accounts that the app's settings include, their default first: the
+ * one they selected at sign-in, or else their oldest.
  *
  * @example
  * ```ts

package/dist/actions/tempoAccount.js

@@ -1,7 +1,7 @@
 import * as Api from '../internal/api.js';
 /**
- * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as the
- * `access` of an access key to authorize keys on it.
+ * Creates another Tempo Account for the signed-in user with the app's settings, and returns it. Pass
+ * its `address` as the `access` of an access key to authorize keys on it.
  *
  * @example
  * ```ts
@@ -12,10 +12,11 @@ import * as Api from '../internal/api.js';
  * ```
  */
 export async function create(auth) {
-    return toTempoAccount(await Api.json(await Api.post(auth, '/v1/account/tempo', { json: {} })));
+    return Api.tempoAccount(await Api.json(await Api.post(auth, `/v1/account/tempo?${new URLSearchParams({ client_id: auth.clientId })}`, { json: {} })));
 }
 /**
- * Lists the signed-in user's Tempo Accounts, their default first.
+ * Lists the signed-in user's Tempo Accounts that the app's settings include, their default first: the
+ * one they selected at sign-in, or else their oldest.
  *
  * @example
  * ```ts
@@ -23,15 +24,6 @@ export async function create(auth) {
  * ```
  */
 export async function list(auth) {
-    const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/account', auth.url), {
-        credentials: 'include',
-    }));
-    return tempo.map(toTempoAccount);
-}
-/** Reads the account's address and the type of its owner, which the API lists first. */
-function toTempoAccount(account) {
-    return {
-        address: account.address,
-        owner: account.config.owners[0].type,
-    };
+    const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL(`/v1/account?${new URLSearchParams({ client_id: auth.clientId })}`, auth.url), { credentials: 'include' }));
+    return tempo.map(Api.tempoAccount);
 }

package/dist/internal/api.d.ts

@@ -3,6 +3,7 @@ import type { Account } from 'viem/tempo';
 import { type Auth, RequestError } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import * as Key from '../Key.ts';
+import type { TempoAccount } from '../TempoAccount.ts';
 import type { Tokens } from '../Tokens.ts';
 /**
  * Builds an authorization from what Tempo Auth returned and the sign-in's key: the material the
@@ -13,6 +14,14 @@ export declare function authorization<chainId extends number = number>(body: Hea
     accessKey?: Account.Account | undefined;
     material: Key.Material;
 }): Authorization<chainId>;
+/**
+ * A sign-in's account step as the API returns it: the accounts of a user with more than one, who
+ * selects one before a key is authorized.
+ */
+export type AccountStep = {
+    accounts: readonly TempoAccountResponse[];
+    type: 'account';
+};
 /** What the headless API returns for an authorization. */
 export type Headless = {
     account: Key.Key['account'];
@@ -43,6 +52,23 @@ export declare function post(auth: Auth, path: string, options: {
  * OAuth form posts to WorkOS.
  */
 export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
+/** Reads the account's address, the type of its owner, which the API lists first, and its realm. */
+export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
+/** A Tempo Account as the API returns it, with the fields the package reads. */
+export type TempoAccountResponse = {
+    address: `0x${string}`;
+    config: {
+        owners: readonly [{
+            type: string;
+        }, ...{
+            type: string;
+        }[]];
+    };
+    realm: {
+        id: string;
+        name: string;
+    };
+};
 /** What Tempo Auth's token endpoint returns. Redeeming a redirect's code adds its key authorization. */
 export type TokenResponse = {
     access_token: string;

package/dist/internal/api.js

@@ -71,6 +71,14 @@ export async function token(auth, body) {
         method: 'POST',
     }));
 }
+/** Reads the account's address, the type of its owner, which the API lists first, and its realm. */
+export function tempoAccount(account) {
+    return {
+        address: account.address,
+        owner: account.config.owners[0].type,
+        realm: { id: account.realm.id, name: account.realm.name },
+    };
+}
 /** Reads a token response into `Tokens`. */
 export function tokens(response) {
     return {

package/dist/internal/request.d.ts

@@ -7,6 +7,8 @@ import type { Permissions } from '../Permissions.ts';
  */
 export declare function request(auth: Auth, options: {
     accessKey: Account.Account;
+    /** The user's Tempo Account the key acts for, in place of the one `accessKey` names. */
+    account?: `0x${string}` | undefined;
     /** A message the key's witness binds. */
     challenge?: string | undefined;
     permissions?: Permissions | undefined;

package/dist/internal/request.js

@@ -10,11 +10,13 @@ import { Hex } from 'ox';
  */
 export function request(auth, options) {
     const { accessKey, challenge, permissions = {} } = options;
+    const account = options.account ??
+        (accessKey.accessKeyAddress ? accessKey.address : undefined);
     return {
         ...(challenge === undefined ? {} : { challenge }),
         client_id: auth.clientId,
         key_authorization: {
-            ...(accessKey.accessKeyAddress ? { account: accessKey.address } : {}),
+            ...(account ? { account } : {}),
             address: accessKey.accessKeyAddress ?? accessKey.address,
             chainId: Hex.fromNumber(permissions.chainId ?? auth.chainId),
             expiry: permissions.expiry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-91.sha-6314f05",
+  "version": "0.0.0-pr-87.sha-acd2cc7",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {