@tempoxyz/auth 0.0.0-pr-97.sha-b7eeea0 → 0.0.0-pr-99.sha-709eecc

package/dist/Actions.js

@@ -7,6 +7,7 @@
 import { Authentication } from 'ox/webauthn';
 import * as AccessKey from './internal/accessKey.js';
 import * as Api from './internal/api.js';
+import * as Link from './internal/link.js';
 import { request } from './internal/request.js';
 export * as account from './actions/account.js';
 export * as device from './actions/device.js';
@@ -39,7 +40,12 @@ export async function authorize(auth, options = {}) {
     }));
     if (!session.user)
         return undefined;
-    const key = await AccessKey.resolve(options.accessKey);
+    // A passkey sign-in's account step kept the key its assertion signed, which Tempo Auth
+    // authorizes with no second assertion when the passkey's account is chosen.
+    const kept = options.accessKey
+        ? undefined
+        : await Link.get(auth, { link: Link.account });
+    const key = kept ?? (await AccessKey.resolve(options.accessKey));
     const json = request(auth, {
         accessKey: key.accessKey,
         account: options.account,
@@ -49,6 +55,9 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', { json });
     if (response.status === 401)
         return undefined;
+    // A failed removal keeps the stale key, which the next account step replaces.
+    if (kept)
+        await Link.release(auth, { link: Link.account }).catch(() => undefined);
     const body = await Api.json(response);
     if (!('step' in body))
         return Api.authorization(body, key);

package/dist/Auth.d.ts

@@ -78,12 +78,19 @@ export declare class RequestError extends Error {
 }
 export declare namespace RequestError {
     type Options = {
+        /** The OAuth error code, such as `invalid_authorization_details`. */
         code: string;
+        /** The request field at fault, as a dotted path. */
         field?: string | undefined;
+        /** The fault and its fix, from `error_description`. */
         message: string;
+        /** The values the refusal compared, such as `limit` and `maximum`. Base units are decimal strings. */
         meta?: Readonly<Record<string, number | string>> | undefined;
+        /** A stable name for the refusal, to branch on. Absent from the issuer's own errors. */
         reason?: Reason | undefined;
+        /** The HTTP status of Tempo Auth's response. */
         status: number;
+        /** The page that explains the error, from `error_uri`. */
         uri?: string | undefined;
     };
     /** Each refusal's stable name. `docs/errors.md` explains each one. */

package/dist/Decorator.d.ts

@@ -70,6 +70,7 @@ export declare namespace tempoAuth {
     type Decorator<chainId extends number> = {
         /** Tempo Auth's actions, with the extension's instance. */
         auth: {
+            /** Actions for the user's Tempo Account. */
             account: {
                 /** `Actions.account.get`. */
                 get: () => Promise<Actions.account.get.ReturnType>;
@@ -79,10 +80,12 @@ export declare namespace tempoAuth {
              * session.
              */
             authorize: <const id extends number = chainId>(options?: Actions.authorize.Options<id>) => Promise<Actions.authorize.ReturnType<id>>;
+            /** Actions for device authorization grants. */
             device: {
                 /** `Actions.device.authorize`, whose `wait` sets the client's account. */
                 authorize: <const id extends number = chainId>(options?: Actions.device.authorize.Options<id>) => Promise<Actions.device.authorize.ReturnType<id>>;
             };
+            /** Actions for sign-in with an emailed code. */
             email: {
                 /** `Actions.email.sendCode`. */
                 sendCode: (options: Actions.email.sendCode.Options) => Promise<void>;
@@ -94,6 +97,7 @@ export declare namespace tempoAuth {
             };
             /** The instance the members call `Actions` with. */
             instance: Auth.Auth;
+            /** Actions for the issuer's OAuth endpoints. */
             oauth: {
                 /** `Actions.oauth.introspect`. */
                 introspect: (options: Actions.oauth.introspect.Options) => Promise<Actions.oauth.introspect.ReturnType>;
@@ -102,6 +106,7 @@ export declare namespace tempoAuth {
                 /** `Actions.oauth.userInfo`. */
                 userInfo: (options: Actions.oauth.userInfo.Options) => Promise<User>;
             };
+            /** Actions for sign-in with a passkey. */
             passkey: {
                 /**
                  * `Actions.passkey.signIn`, which sets the client's account unless it returns a step. A step
@@ -109,16 +114,19 @@ export declare namespace tempoAuth {
                  */
                 signIn: <const id extends number = chainId>(options?: Actions.passkey.signIn.Options<id>) => Promise<Actions.passkey.signIn.ReturnType<id>>;
             };
+            /** Actions for sign-in with an identity provider, such as Google or SSO. */
             provider: {
                 /** `Actions.provider.list`. */
                 list: () => Promise<Actions.provider.list.ReturnType>;
                 /** `Actions.provider.signIn`. */
                 signIn: (options: Actions.provider.signIn.Options) => void;
             };
+            /** Actions for the realms the app reaches. */
             realm: {
                 /** `Actions.realm.list`. */
                 list: () => Promise<Actions.realm.list.ReturnType>;
             };
+            /** Actions for sign-in through a redirect to Tempo Auth's pages. */
             redirect: {
                 /** `Actions.redirect.complete`, which sets the client's account. */
                 complete: (options?: Actions.redirect.complete.Options) => Promise<Actions.redirect.complete.ReturnType>;

package/dist/TempoAccount.d.ts

@@ -17,7 +17,9 @@ export type TempoAccount = {
      * `tempo-cash`, with its display name. An app reaches only the accounts of its realms.
      */
     realm: {
+        /** The realm ID: `default`, or one an app's settings name, such as `tempo-cash`. */
         id: string;
+        /** The realm's display name, such as `Tempo Cash`. */
         name: string;
     };
 };

package/dist/actions/email.d.ts

@@ -65,6 +65,7 @@ export declare namespace signIn {
     };
     /** The authorization, or the step the address or the user's accounts require first. */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
+        /** The step to complete before the authorization. */
         step: Step;
     };
 }

package/dist/actions/passkey.d.ts

@@ -84,6 +84,7 @@ export declare namespace signIn {
      * none returns the account step.
      */
     type ReturnType<chainId extends number = number> = Authorization<chainId> | {
+        /** The email step, or the account step to complete before the authorization. */
         step: EmailStep | Extract<Step, {
             type: 'account';
         }>;

package/dist/actions/passkey.js

@@ -57,13 +57,18 @@ export async function signIn(auth, options = {}) {
         json: native ? { assertion, authorize } : { assertion },
     }));
     if ('step' in body) {
-        if (body.step.type === 'account')
+        if (body.step.type === 'account') {
+            // Choosing the passkey's account authorizes the key its assertion already signed, once
+            // `Actions.authorize` sends that key again.
+            if (!native && !options.accessKey)
+                await Link.keep(auth, { link: Link.account, material: key.material });
             return {
                 step: {
                     accounts: body.step.accounts.map(Api.tempoAccount),
                     type: 'account',
                 },
             };
+        }
         // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
         // library generated waits for it in `storage`.
         if (body.step.signed && !options.accessKey)

package/dist/internal/api.d.ts

@@ -19,24 +19,35 @@ export declare function authorization<chainId extends number = number>(body: Hea
  * one, who selects one before the key is authorized.
  */
 export type AccountStep = {
+    /** The user's Tempo Accounts, to select one from. */
     accounts: readonly TempoAccountResponse[];
+    /** The kind of step. */
     type: 'account';
 };
 /** What the headless API returns for an authorization. */
 export type Headless = {
+    /** The Tempo Account the key acts for. */
     account: Key.Key['account'];
+    /** The signed key authorization, in the node's RPC format. */
     key_authorization: KeyAuthorization.Rpc;
+    /** The tokens the sign-in issued, as the token endpoint returns them or already read into `Tokens`. */
     tokens: TokenResponse | Tokens;
 };
 /** Reads a JSON response, and throws a {@link RequestError} for a refused request. */
 export declare function json<value = unknown>(response: Response): Promise<value>;
 /** An OAuth error response, with Tempo Auth's extension members. */
 export type ErrorBody = {
+    /** The OAuth error code, which `reason` determines. */
     error: string;
+    /** The fault and its fix. Its wording may change. */
     error_description?: string | undefined;
+    /** The errors page, at the refusal's `reason`. */
     error_uri?: string | undefined;
+    /** The request field at fault, as a dotted path. */
     field?: string | undefined;
+    /** The values the refusal compared. Base units are decimal strings. */
     meta?: Readonly<Record<string, number | string>> | undefined;
+    /** A stable name for the refusal. The issuer's own errors carry none. */
     reason?: RequestError.Reason | undefined;
 };
 /** A {@link RequestError} from an OAuth error response, or from a refusal with no body. */
@@ -56,26 +67,38 @@ export declare function token(auth: Auth, body: Record<string, string>): Promise
 export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
 /** A Tempo Account as the API returns it, with the fields the package reads. */
 export type TempoAccountResponse = {
+    /** The account's address, the same on every Tempo chain. */
     address: `0x${string}`;
+    /** The account's configuration, whose owners the API lists in order. */
     config: {
+        /** The account's owners, each with the kind of key that holds it, such as `privy` or `webAuthn`. */
         owners: readonly [{
             type: string;
         }, ...{
             type: string;
         }[]];
     };
+    /** The realm the account belongs to, with its display name. */
     realm: {
+        /** The realm ID: `default`, or one an app's settings name, such as `tempo-cash`. */
         id: string;
+        /** The realm's display name, such as `Tempo Cash`. */
         name: string;
     };
 };
 /** What Tempo Auth's token endpoint returns. Redeeming a redirect's code adds its key authorization. */
 export type TokenResponse = {
+    /** The access token, which authorizes the app's requests to its APIs. */
     access_token: string;
+    /** The Tempo Account the key acts for, present with `key_authorization`. */
     account?: Key.Key['account'] | undefined;
+    /** The access token's lifetime, in seconds. */
     expires_in: number;
+    /** The OIDC ID token, which names the user. A refresh may omit it. */
     id_token?: string | undefined;
+    /** The signed key authorization that the user approved with the code, if any. */
     key_authorization?: KeyAuthorization.Rpc | undefined;
+    /** Exchanges for new tokens through `Actions.refresh`. It rotates on every refresh. */
     refresh_token?: string | undefined;
 };
 /** Reads a token response into `Tokens`. */

package/dist/internal/link.d.ts

@@ -1,6 +1,8 @@
 import type { Auth } from '../Auth.ts';
 import type * as Key from '../Key.ts';
 import * as AccessKey from './accessKey.ts';
+/** The `link` a key waits under after an account step, which names no link of its own. */
+export declare const account = "account";
 /**
  * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the
  * link's digest is stored, since the link links the passkey for whoever sends it with a code.

package/dist/internal/link.js

@@ -1,12 +1,15 @@
 /**
  * Keeps a new key that a one-tap passkey sign-in signed, until the emailed-code sign-in that sends
- * its email step's `link` returns the key's authorization.
+ * its email step's `link`, or the `Actions.authorize` after its account step, returns the key's
+ * authorization.
  * @module
  */
 import { Bytes, Hash } from 'ox';
 import * as AccessKey from './accessKey.js';
 import * as Store from './store.js';
-/** Where the key waits in `storage`. A later email step replaces it. */
+/** The `link` a key waits under after an account step, which names no link of its own. */
+export const account = 'account';
+/** Where the key waits in `storage`. A later email or account step replaces it. */
 const storageKey = 'tempo-auth:passkey-link';
 /**
  * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-97.sha-b7eeea0",
+  "version": "0.0.0-pr-99.sha-709eecc",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {