@tempoxyz/id 0.0.0-pr-704.sha-0cbffe0 → 0.0.0-pr-708.sha-71fd6da

package/dist/{Connections-D5RJSFJP.js → Connections-7J5I4L3Q.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-USONPD4G.js";
-import "./chunk-PA3AETBC.js";
+} from "./chunk-JJT3ITRO.js";
+import "./chunk-YDYAVOWG.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-FH4KRDI7.js → Sheet-PTAFRAX2.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-PA3AETBC.js";
+} from "./chunk-YDYAVOWG.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-LUSCUHII.js → chunk-FDHRRJQI.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-PA3AETBC.js";
+} from "./chunk-YDYAVOWG.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/{chunk-USONPD4G.js → chunk-JJT3ITRO.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-PA3AETBC.js";
+} from "./chunk-YDYAVOWG.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/{chunk-PA3AETBC.js → chunk-YDYAVOWG.js}

@@ -19,6 +19,7 @@ import {
 var Accounts_exports = {};
 __export(Accounts_exports, {
   ChainUnavailableError: () => ChainUnavailableError,
+  ChallengeWithoutKeyError: () => ChallengeWithoutKeyError,
   ClientIdRequiredError: () => ClientIdRequiredError,
   ConnectionsRequiredError: () => ConnectionsRequiredError,
   EverywhereNotAllowedError: () => EverywhereNotAllowedError,
@@ -232,26 +233,10 @@ function authorization(body, options) {
   return {
     ...tokens_,
     accessKey: toAccount(key, { accessKey: accessKey2 }),
-    ...challengeSignature(body, { challenged: options.challenged }),
     key,
     user: user(tokens_)
   };
 }
-function challengeSignature(body, options = {}) {
-  if (body.account && body.challenge_signature)
-    return {
-      address: body.account,
-      challengeSignature: body.challenge_signature
-    };
-  if (options.challenged)
-    throw new RequestError({
-      code: "server_error",
-      message: "Missing challenge signature in the response to a request with a challenge. Update Tempo ID, or sign in without the challenge.",
-      signedIn: true,
-      status: 200
-    });
-  return {};
-}
 async function json(response) {
   const body = await response.json().catch(() => ({}));
   if (!response.ok) throw error(body, { status: response.status });
@@ -488,13 +473,9 @@ function signedIn(error3, options = {}) {
     uri: error3.uri
   });
 }
-function withoutKey(body, options = {}) {
+function withoutKey(body) {
   const tokens_ = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
-  return {
-    ...tokens_,
-    ...challengeSignature(body, options),
-    user: user(tokens_)
-  };
+  return { ...tokens_, user: user(tokens_) };
 }
 
 // ../../accounts/src/actions/account.ts
@@ -960,12 +941,13 @@ function seconds(options) {
 var base64url = { pad: false, url: true };
 async function authorizeUrl(auth, options) {
   const { accessKey: accessKey2 } = options;
+  if (!accessKey2 && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const pending = from2({
     ...key ? key.material : { key: false },
     chainId: auth.chainId,
-    ...options.challenge !== void 0 ? { challenge: true } : {},
     clientId: auth.clientId,
     redirectUri,
     // `Bytes.random` needs only `crypto.getRandomValues`, which React Native polyfills.
@@ -977,7 +959,6 @@ async function authorizeUrl(auth, options) {
   }) : void 0;
   const url = new URL("/oauth2/authorize", auth.url);
   const parameters = new URLSearchParams({
-    ...options.challenge !== void 0 && !accessKey2 ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     client_id: auth.clientId,
     // In the web message mode, Tempo ID sets the challenge and redeems the code itself.
@@ -1013,15 +994,9 @@ async function authorizeUrl(auth, options) {
   return { pending, url: url.href };
 }
 function request(auth, options) {
-  const { accessKey: accessKey2, challenge: challenge2 } = options;
+  const { accessKey: accessKey2, challenge } = options;
   return {
-    // A challenge without an access key names the instance's chain, whose view of the account signs
-    // it, and any account that signs it in place of the selected one.
-    ...challenge2 !== void 0 && !accessKey2 ? {
-      ...options.account ? { account: options.account } : {},
-      chain_id: auth.chainId
-    } : {},
-    ...challenge2 === void 0 ? {} : { challenge: challenge2 },
+    ...challenge === void 0 ? {} : { challenge },
     client_id: auth.clientId,
     ...accessKey2 ? {
       key_authorization: keyAuthorization(auth, {
@@ -1076,7 +1051,7 @@ function pushes(auth) {
 
 // ../../accounts/src/internal/Headless.ts
 async function authorize(auth, options) {
-  const { accessKey: accessKey2, challenge: challenge2, getFn } = options;
+  const { accessKey: accessKey2, challenge, getFn } = options;
   try {
     const key = accessKey2 ? await resolve(accessKey2) : void 0;
     if (key)
@@ -1090,11 +1065,11 @@ async function authorize(auth, options) {
         getFn,
         json: request(auth, {
           accessKey: key && accessKey2 && { ...accessKey2, account: key.accessKey },
-          challenge: challenge2
+          challenge
         })
       })
     );
-    const authorization2 = key ? authorization(body, { ...key, challenged: challenge2 !== void 0 }) : withoutKey(body, { challenged: challenge2 !== void 0 });
+    const authorization2 = key ? authorization(body, key) : withoutKey(body);
     if (authorization2.user.id !== options.userId) throw sessionChanged();
     return {
       ...authorization2,
@@ -1116,12 +1091,7 @@ async function complete(auth, options) {
         step: body.authorization
       })
     ) : body.authorization;
-    const authorization2 = key ? authorization(signed, {
-      ...key,
-      challenged: options.request.challenge !== void 0
-    }) : withoutKey(signed, {
-      challenged: options.request.challenge !== void 0
-    });
+    const authorization2 = key ? authorization(signed, key) : withoutKey(signed);
     if (authorization2.user.id !== body.user.id) throw sessionChanged();
     return {
       ...authorization2,
@@ -1200,7 +1170,7 @@ async function sign(auth, options) {
   });
 }
 function steps(json2, options) {
-  if (!json2.key_authorization && json2.challenge === void 0) return false;
+  if (!json2.key_authorization) return false;
   return options.getFn !== void 0 || globalThis.navigator?.credentials !== void 0;
 }
 function redemption(auth) {
@@ -1245,14 +1215,14 @@ async function sendCode(auth, options) {
   );
 }
 async function signIn(auth, options) {
-  const { challenge: challenge2, code, email, userIp } = options;
+  const { challenge, code, email, userIp } = options;
+  if (!options.accessKey && challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   authenticated(auth);
   const { accessKey: accessKey2 } = options;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const body = await token(auth, {
-    // A challenge without an access key names the instance's chain, whose view of the account signs it.
-    ...challenge2 !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
-    ...challenge2 === void 0 ? {} : { challenge: challenge2 },
+    ...challenge === void 0 ? {} : { challenge },
     code,
     email,
     grant_type: grantType,
@@ -1271,19 +1241,14 @@ async function signIn(auth, options) {
   });
   const tokens3 = tokens(body);
   if (!key)
-    return {
-      ...tokens3,
-      ...challengeSignature(body, { challenged: challenge2 !== void 0 }),
-      user: user(tokens3)
-    };
+    return { ...tokens3, user: user(tokens3) };
   return authorization(
     {
       account: body.account,
-      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: tokens3
     },
-    { ...key, challenged: challenge2 !== void 0 }
+    key
   );
 }
 function authenticated(auth) {
@@ -1363,11 +1328,8 @@ __export(device_exports, {
 });
 import { Base64 as Base646 } from "ox";
 async function authorize2(auth, options) {
-  const { accessKey: accessKey2 } = options;
-  const key = accessKey2 ? await resolve(accessKey2) : void 0;
+  const key = await resolve(options.accessKey);
   const body = new URLSearchParams({
-    // A challenge without an access key names the instance's chain, whose view of the account signs it.
-    ...options.challenge !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     // The instance's app is the device app that the CLI signs in to, such as `tempo-cli`.
     client_id: auth.clientId,
@@ -1375,16 +1337,14 @@ async function authorize2(auth, options) {
     ...options.funding?.currency === void 0 ? {} : { funding_currency: options.funding.currency },
     ...options.funding ? { funding_hint: options.funding.amount } : {},
     ...options.funding?.token === void 0 ? {} : { funding_token: options.funding.token },
-    ...key && accessKey2 ? {
-      key_authorization: Base646.fromString(
-        JSON.stringify(
-          keyAuthorization(auth, {
-            accessKey: { ...accessKey2, account: key.accessKey }
-          })
-        ),
-        { pad: false, url: true }
-      )
-    } : {}
+    key_authorization: Base646.fromString(
+      JSON.stringify(
+        keyAuthorization(auth, {
+          accessKey: { ...options.accessKey, account: key.accessKey }
+        })
+      ),
+      { pad: false, url: true }
+    )
   });
   for (const resource of resources(auth, options))
     body.append("resource", resource);
@@ -1419,7 +1379,6 @@ async function authorize2(auth, options) {
       );
       failure = void 0;
       const result = await request2(poll2, {
-        challenged: options.challenge !== void 0,
         deviceCode: code.device_code,
         key
       }).catch((error3) => {
@@ -1452,17 +1411,9 @@ async function authorize2(auth, options) {
 }
 async function poll(auth, options) {
   const { deviceCode } = options;
-  const challenged = options.challenged ?? options.accessKey === false;
-  if (options.accessKey === false)
-    return request2(auth, {
-      challenged,
-      deviceCode,
-      key: void 0
-    });
   const accessKey2 = own(options.accessKey);
   if (!accessKey2) throw new AccessKeyRequiredError();
   return request2(auth, {
-    challenged,
     deviceCode,
     key: { accessKey: accessKey2, material: {} }
   });
@@ -1486,20 +1437,15 @@ async function request2(auth, options) {
   });
   if (typeof body === "string")
     return { slowDown: body === "slow_down", status: "pending" };
-  const authorization2 = key ? authorization(
-    {
-      account: body.account,
-      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
-      key_authorization: body.key_authorization,
-      tokens: tokens(body)
-    },
-    { ...key, challenged: options.challenged }
-  ) : withoutKey(
-    { ...body, tokens: tokens(body) },
-    { challenged: options.challenged }
-  );
   return {
-    authorization: authorization2,
+    authorization: authorization(
+      {
+        account: body.account,
+        key_authorization: body.key_authorization,
+        tokens: tokens(body)
+      },
+      key
+    ),
     status: "approved"
   };
 }
@@ -1766,7 +1712,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-FH4KRDI7.js");
+    const Sheet = await import("./Sheet-PTAFRAX2.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1817,7 +1763,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-FH4KRDI7.js").then(
+        void import("./Sheet-PTAFRAX2.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1882,7 +1828,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-FH4KRDI7.js");
+  const Sheet = await import("./Sheet-PTAFRAX2.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -2140,7 +2086,6 @@ function finish(options) {
   const {
     key,
     chainId: _chainId,
-    challenge: challenged,
     clientId: _clientId,
     redirectUri: _redirectUri,
     state: _state,
@@ -2149,11 +2094,7 @@ function finish(options) {
   } = options.pending;
   if (key === false) {
     const tokens3 = tokens(body);
-    return {
-      ...tokens3,
-      ...challengeSignature(body, { challenged }),
-      user: user(tokens3)
-    };
+    return { ...tokens3, user: user(tokens3) };
   }
   if (!body.account || !body.key_authorization)
     throw new RequestError({
@@ -2165,11 +2106,10 @@ function finish(options) {
   return authorization(
     {
       account: body.account,
-      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: body
     },
-    { accessKey: options.accessKey, challenged, material }
+    { accessKey: options.accessKey, material }
   );
 }
 async function prefetch(auth) {
@@ -2706,10 +2646,6 @@ function toSession(result) {
   return from4({
     accessToken: result.accessToken,
     ...result.account ? { account: result.account } : {},
-    ...result.address && result.challengeSignature ? {
-      address: result.address,
-      challengeSignature: result.challengeSignature
-    } : {},
     expiresAt: result.expiresAt,
     ...result.idToken !== void 0 ? { idToken: result.idToken } : {},
     ...result.key ? { key: withLifetime(result.key) } : {},
@@ -2755,6 +2691,8 @@ async function sendCode2(auth, options) {
 }
 async function signIn3(auth, options) {
   const { code, email, getFn, link } = options;
+  if (!options.accessKey && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const prepared = await prepare(auth, options);
   const assertion = await (async () => {
     if (!link) return void 0;
@@ -2956,13 +2894,6 @@ function prepare2(auth, options = {}) {
 }
 async function register(auth, options = {}) {
   const { createFn, getFn, key } = options;
-  if (options.challenge !== void 0 && !options.accessKey)
-    throw new RequestError({
-      code: "invalid_request",
-      field: "challenge",
-      message: "Invalid options: `challenge` signs as the new passkey's account, which only a registration with `accessKey` selects. Pass `accessKey`, or sign in with the challenge.",
-      status: 0
-    });
   const chain = options.chain ?? options.chainId;
   if (options.accessKey && (key || options.account !== void 0 || chain !== void 0))
     throw new RequestError({
@@ -3054,60 +2985,14 @@ async function register(auth, options = {}) {
     signed,
     headless.key
   );
-  const challenged = options.challenge === void 0 ? {} : await challenge(
-    { ...auth, chainId: Number(authorization2.key.chainId) },
-    {
-      account: registered.address,
-      challenge: options.challenge,
-      getFn,
-      userId: authorization2.user.id
-    }
-  );
   return {
     ...result,
     authorization: {
       ...authorization2,
-      ..."challengeError" in challenged ? {} : challenged,
       upgradeAvailable: signed.upgrade_available === true
-    },
-    ..."challengeError" in challenged ? { challengeError: challenged.challengeError } : {}
+    }
   };
 }
-async function challenge(auth, options) {
-  try {
-    const body = await json(
-      await post2(auth, {
-        getFn: options.getFn,
-        json: request(auth, {
-          account: options.account,
-          challenge: options.challenge
-        })
-      })
-    );
-    const tokens3 = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
-    if (tokens3.refreshToken)
-      await revoke(auth, { refreshToken: tokens3.refreshToken }).catch(
-        () => void 0
-      );
-    const signed = challengeSignature(body, { challenged: true });
-    if (user(tokens3).id !== options.userId || !Address3.isEqual(signed.address, options.account))
-      throw new RequestError({
-        code: "server_error",
-        message: "Account mismatch: Tempo ID signed the challenge as another account or user than the new passkey's. The passkey is registered, so sign in with it and the challenge.",
-        status: 200
-      });
-    return signed;
-  } catch (error3) {
-    return {
-      challengeError: error3 instanceof RequestError ? error3 : new RequestError({
-        cause: error3,
-        code: "server_error",
-        message: "Challenge signature failed after the registration, with no response from Tempo ID. The passkey is registered, so sign in with it and the challenge.",
-        status: 0
-      })
-    };
-  }
-}
 async function signIn4(auth, options = {}) {
   const prepared = await requestOptions(auth, options);
   const assertion = await sign2(prepared, options);
@@ -3132,6 +3017,8 @@ function refused(error3) {
 }
 async function requestOptions(auth, options) {
   const { credentialId, mediation, select } = options;
+  if (!options.accessKey && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const { authorize: authorize6, key } = await prepare(auth, options);
   const requestedAt = Date.now();
   const requested = await json(
@@ -3216,6 +3103,8 @@ async function list(auth) {
 // ../../accounts/src/internal/Actions.ts
 async function authorize4(auth, options = {}) {
   const { accessKey: accessKey2 } = options;
+  if (!accessKey2 && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const [session2, generated] = await Promise.all([
     (async () => json(
       await (auth.fetch ?? globalThis.fetch)(
@@ -3249,10 +3138,7 @@ async function authorize4(auth, options = {}) {
   const body = await json(response);
   const [first] = body.tempo ?? [];
   const result = {
-    ...key ? authorization(body, {
-      ...key,
-      challenged: options.challenge !== void 0
-    }) : withoutKey(body, { challenged: options.challenge !== void 0 }),
+    ...key ? authorization(body, key) : withoutKey(body),
     // The response lists the access key's account first, so the app reads no `GET /v1/account`.
     // An account that the client cannot rebuild stays absent, so the session holds the access key alone.
     ...key && first ? (() => {
@@ -3525,7 +3411,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-RR4ETIE7.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-7DSDKEHU.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -4480,6 +4366,14 @@ var ChainUnavailableError = class extends Error {
     );
   }
 };
+var ChallengeWithoutKeyError = class extends Error {
+  name = "Accounts.ChallengeWithoutKeyError";
+  constructor() {
+    super(
+      "A challenge rides in the key authorization, so a sign-in without `accessKey` takes none. Remove `challenge`, or pass `accessKey` to request an access key."
+    );
+  }
+};
 var ClientIdRequiredError = class extends Error {
   name = "Accounts.ClientIdRequiredError";
   constructor() {
@@ -4737,7 +4631,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-D5RJSFJP.js").then(
+    attached ??= import("./Connections-7J5I4L3Q.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-LUSCUHII.js";
-import "../chunk-USONPD4G.js";
-import "../chunk-PA3AETBC.js";
+} from "../chunk-FDHRRJQI.js";
+import "../chunk-JJT3ITRO.js";
+import "../chunk-YDYAVOWG.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-LUSCUHII.js";
-import "../chunk-USONPD4G.js";
-import "../chunk-PA3AETBC.js";
+} from "../chunk-FDHRRJQI.js";
+import "../chunk-JJT3ITRO.js";
+import "../chunk-YDYAVOWG.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-LUSCUHII.js";
-import "../chunk-USONPD4G.js";
-import "../chunk-PA3AETBC.js";
+} from "../chunk-FDHRRJQI.js";
+import "../chunk-JJT3ITRO.js";
+import "../chunk-YDYAVOWG.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-RR4ETIE7.js → dialog-7DSDKEHU.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-PA3AETBC.js";
+} from "./chunk-YDYAVOWG.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-704.sha-0cbffe0",
+  "version": "0.0.0-pr-708.sha-71fd6da",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {