@tempoxyz/id 0.0.0-pr-704.sha-6a3fa61 → 0.0.0-pr-705.sha-e7637a1

package/dist/{Connections-ONCDPK23.js → Connections-7J5I4L3Q.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-U2KJB64X.js";
-import "./chunk-IBZUNV2Y.js";
+} from "./chunk-JJT3ITRO.js";
+import "./chunk-YDYAVOWG.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-2L465IRV.js → Sheet-PTAFRAX2.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-IBZUNV2Y.js";
+} from "./chunk-YDYAVOWG.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-FU2TDVJS.js → chunk-FDHRRJQI.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-IBZUNV2Y.js";
+} from "./chunk-YDYAVOWG.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/{chunk-U2KJB64X.js → chunk-JJT3ITRO.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-IBZUNV2Y.js";
+} from "./chunk-YDYAVOWG.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/{chunk-IBZUNV2Y.js → chunk-YDYAVOWG.js}

@@ -19,6 +19,7 @@ import {
 var Accounts_exports = {};
 __export(Accounts_exports, {
   ChainUnavailableError: () => ChainUnavailableError,
+  ChallengeWithoutKeyError: () => ChallengeWithoutKeyError,
   ClientIdRequiredError: () => ClientIdRequiredError,
   ConnectionsRequiredError: () => ConnectionsRequiredError,
   EverywhereNotAllowedError: () => EverywhereNotAllowedError,
@@ -232,15 +233,10 @@ function authorization(body, options) {
   return {
     ...tokens_,
     accessKey: toAccount(key, { accessKey: accessKey2 }),
-    ...challengeSignature(body),
     key,
     user: user(tokens_)
   };
 }
-function challengeSignature(body) {
-  if (!body.account || !body.challenge_signature) return {};
-  return { address: body.account, challengeSignature: body.challenge_signature };
-}
 async function json(response) {
   const body = await response.json().catch(() => ({}));
   if (!response.ok) throw error(body, { status: response.status });
@@ -479,7 +475,7 @@ function signedIn(error3, options = {}) {
 }
 function withoutKey(body) {
   const tokens_ = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
-  return { ...tokens_, ...challengeSignature(body), user: user(tokens_) };
+  return { ...tokens_, user: user(tokens_) };
 }
 
 // ../../accounts/src/actions/account.ts
@@ -945,6 +941,8 @@ function seconds(options) {
 var base64url = { pad: false, url: true };
 async function authorizeUrl(auth, options) {
   const { accessKey: accessKey2 } = options;
+  if (!accessKey2 && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const pending = from2({
@@ -961,7 +959,6 @@ async function authorizeUrl(auth, options) {
   }) : void 0;
   const url = new URL("/oauth2/authorize", auth.url);
   const parameters = new URLSearchParams({
-    ...options.challenge !== void 0 && !accessKey2 ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     client_id: auth.clientId,
     // In the web message mode, Tempo ID sets the challenge and redeems the code itself.
@@ -999,8 +996,6 @@ async function authorizeUrl(auth, options) {
 function request(auth, options) {
   const { accessKey: accessKey2, challenge } = options;
   return {
-    // A challenge without an access key names the instance's chain, whose view of the account signs it.
-    ...challenge !== void 0 && !accessKey2 ? { chain_id: auth.chainId } : {},
     ...challenge === void 0 ? {} : { challenge },
     client_id: auth.clientId,
     ...accessKey2 ? {
@@ -1175,7 +1170,7 @@ async function sign(auth, options) {
   });
 }
 function steps(json2, options) {
-  if (!json2.key_authorization && json2.challenge === void 0) return false;
+  if (!json2.key_authorization) return false;
   return options.getFn !== void 0 || globalThis.navigator?.credentials !== void 0;
 }
 function redemption(auth) {
@@ -1221,12 +1216,12 @@ async function sendCode(auth, options) {
 }
 async function signIn(auth, options) {
   const { challenge, code, email, userIp } = options;
+  if (!options.accessKey && challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   authenticated(auth);
   const { accessKey: accessKey2 } = options;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const body = await token(auth, {
-    // A challenge without an access key names the instance's chain, whose view of the account signs it.
-    ...challenge !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
     ...challenge === void 0 ? {} : { challenge },
     code,
     email,
@@ -1246,15 +1241,10 @@ async function signIn(auth, options) {
   });
   const tokens3 = tokens(body);
   if (!key)
-    return {
-      ...tokens3,
-      ...challengeSignature(body),
-      user: user(tokens3)
-    };
+    return { ...tokens3, user: user(tokens3) };
   return authorization(
     {
       account: body.account,
-      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: tokens3
     },
@@ -1338,11 +1328,8 @@ __export(device_exports, {
 });
 import { Base64 as Base646 } from "ox";
 async function authorize2(auth, options) {
-  const { accessKey: accessKey2 } = options;
-  const key = accessKey2 ? await resolve(accessKey2) : void 0;
+  const key = await resolve(options.accessKey);
   const body = new URLSearchParams({
-    // A challenge without an access key names the instance's chain, whose view of the account signs it.
-    ...options.challenge !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     // The instance's app is the device app that the CLI signs in to, such as `tempo-cli`.
     client_id: auth.clientId,
@@ -1350,16 +1337,14 @@ async function authorize2(auth, options) {
     ...options.funding?.currency === void 0 ? {} : { funding_currency: options.funding.currency },
     ...options.funding ? { funding_hint: options.funding.amount } : {},
     ...options.funding?.token === void 0 ? {} : { funding_token: options.funding.token },
-    ...key && accessKey2 ? {
-      key_authorization: Base646.fromString(
-        JSON.stringify(
-          keyAuthorization(auth, {
-            accessKey: { ...accessKey2, account: key.accessKey }
-          })
-        ),
-        { pad: false, url: true }
-      )
-    } : {}
+    key_authorization: Base646.fromString(
+      JSON.stringify(
+        keyAuthorization(auth, {
+          accessKey: { ...options.accessKey, account: key.accessKey }
+        })
+      ),
+      { pad: false, url: true }
+    )
   });
   for (const resource of resources(auth, options))
     body.append("resource", resource);
@@ -1426,11 +1411,6 @@ async function authorize2(auth, options) {
 }
 async function poll(auth, options) {
   const { deviceCode } = options;
-  if (options.accessKey === false)
-    return request2(auth, {
-      deviceCode,
-      key: void 0
-    });
   const accessKey2 = own(options.accessKey);
   if (!accessKey2) throw new AccessKeyRequiredError();
   return request2(auth, {
@@ -1457,17 +1437,15 @@ async function request2(auth, options) {
   });
   if (typeof body === "string")
     return { slowDown: body === "slow_down", status: "pending" };
-  const authorization2 = key ? authorization(
-    {
-      account: body.account,
-      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
-      key_authorization: body.key_authorization,
-      tokens: tokens(body)
-    },
-    key
-  ) : withoutKey({ ...body, tokens: tokens(body) });
   return {
-    authorization: authorization2,
+    authorization: authorization(
+      {
+        account: body.account,
+        key_authorization: body.key_authorization,
+        tokens: tokens(body)
+      },
+      key
+    ),
     status: "approved"
   };
 }
@@ -1734,7 +1712,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-2L465IRV.js");
+    const Sheet = await import("./Sheet-PTAFRAX2.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1785,7 +1763,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-2L465IRV.js").then(
+        void import("./Sheet-PTAFRAX2.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1850,7 +1828,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-2L465IRV.js");
+  const Sheet = await import("./Sheet-PTAFRAX2.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -2116,11 +2094,7 @@ function finish(options) {
   } = options.pending;
   if (key === false) {
     const tokens3 = tokens(body);
-    return {
-      ...tokens3,
-      ...challengeSignature(body),
-      user: user(tokens3)
-    };
+    return { ...tokens3, user: user(tokens3) };
   }
   if (!body.account || !body.key_authorization)
     throw new RequestError({
@@ -2132,7 +2106,6 @@ function finish(options) {
   return authorization(
     {
       account: body.account,
-      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: body
     },
@@ -2673,10 +2646,6 @@ function toSession(result) {
   return from4({
     accessToken: result.accessToken,
     ...result.account ? { account: result.account } : {},
-    ...result.address && result.challengeSignature ? {
-      address: result.address,
-      challengeSignature: result.challengeSignature
-    } : {},
     expiresAt: result.expiresAt,
     ...result.idToken !== void 0 ? { idToken: result.idToken } : {},
     ...result.key ? { key: withLifetime(result.key) } : {},
@@ -2722,6 +2691,8 @@ async function sendCode2(auth, options) {
 }
 async function signIn3(auth, options) {
   const { code, email, getFn, link } = options;
+  if (!options.accessKey && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const prepared = await prepare(auth, options);
   const assertion = await (async () => {
     if (!link) return void 0;
@@ -3014,27 +2985,10 @@ async function register(auth, options = {}) {
     signed,
     headless.key
   );
-  const challenged = options.challenge === void 0 ? {} : await (async () => {
-    try {
-      return challengeSignature(
-        await json(
-          await post2(auth, {
-            getFn,
-            json: request(auth, { challenge: options.challenge })
-          })
-        )
-      );
-    } catch (error3) {
-      return signedIn(error3, {
-        message: "Challenge signature failed after the registration, with no response from Tempo ID. The passkey is registered, so sign in with it and the challenge."
-      });
-    }
-  })();
   return {
     ...result,
     authorization: {
       ...authorization2,
-      ...challenged,
       upgradeAvailable: signed.upgrade_available === true
     }
   };
@@ -3063,6 +3017,8 @@ function refused(error3) {
 }
 async function requestOptions(auth, options) {
   const { credentialId, mediation, select } = options;
+  if (!options.accessKey && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const { authorize: authorize6, key } = await prepare(auth, options);
   const requestedAt = Date.now();
   const requested = await json(
@@ -3147,6 +3103,8 @@ async function list(auth) {
 // ../../accounts/src/internal/Actions.ts
 async function authorize4(auth, options = {}) {
   const { accessKey: accessKey2 } = options;
+  if (!accessKey2 && options.challenge !== void 0)
+    throw new ChallengeWithoutKeyError();
   const [session2, generated] = await Promise.all([
     (async () => json(
       await (auth.fetch ?? globalThis.fetch)(
@@ -3453,7 +3411,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-4KIVDDJQ.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-7DSDKEHU.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -4408,6 +4366,14 @@ var ChainUnavailableError = class extends Error {
     );
   }
 };
+var ChallengeWithoutKeyError = class extends Error {
+  name = "Accounts.ChallengeWithoutKeyError";
+  constructor() {
+    super(
+      "A challenge rides in the key authorization, so a sign-in without `accessKey` takes none. Remove `challenge`, or pass `accessKey` to request an access key."
+    );
+  }
+};
 var ClientIdRequiredError = class extends Error {
   name = "Accounts.ClientIdRequiredError";
   constructor() {
@@ -4665,7 +4631,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-ONCDPK23.js").then(
+    attached ??= import("./Connections-7J5I4L3Q.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-FU2TDVJS.js";
-import "../chunk-U2KJB64X.js";
-import "../chunk-IBZUNV2Y.js";
+} from "../chunk-FDHRRJQI.js";
+import "../chunk-JJT3ITRO.js";
+import "../chunk-YDYAVOWG.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-FU2TDVJS.js";
-import "../chunk-U2KJB64X.js";
-import "../chunk-IBZUNV2Y.js";
+} from "../chunk-FDHRRJQI.js";
+import "../chunk-JJT3ITRO.js";
+import "../chunk-YDYAVOWG.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-FU2TDVJS.js";
-import "../chunk-U2KJB64X.js";
-import "../chunk-IBZUNV2Y.js";
+} from "../chunk-FDHRRJQI.js";
+import "../chunk-JJT3ITRO.js";
+import "../chunk-YDYAVOWG.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-4KIVDDJQ.js → dialog-7DSDKEHU.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-IBZUNV2Y.js";
+} from "./chunk-YDYAVOWG.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-704.sha-6a3fa61",
+  "version": "0.0.0-pr-705.sha-e7637a1",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {