@tempoxyz/id 0.0.0-pr-707.sha-3bb0aa5 → 0.0.0-pr-704.sha-0cbffe0

package/dist/{Connections-7J5I4L3Q.js → Connections-D5RJSFJP.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-JJT3ITRO.js";
-import "./chunk-YDYAVOWG.js";
+} from "./chunk-USONPD4G.js";
+import "./chunk-PA3AETBC.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-PTAFRAX2.js → Sheet-FH4KRDI7.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-PA3AETBC.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-FDHRRJQI.js → chunk-LUSCUHII.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-PA3AETBC.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/{chunk-YDYAVOWG.js → chunk-PA3AETBC.js}

@@ -19,7 +19,6 @@ import {
 var Accounts_exports = {};
 __export(Accounts_exports, {
   ChainUnavailableError: () => ChainUnavailableError,
-  ChallengeWithoutKeyError: () => ChallengeWithoutKeyError,
   ClientIdRequiredError: () => ClientIdRequiredError,
   ConnectionsRequiredError: () => ConnectionsRequiredError,
   EverywhereNotAllowedError: () => EverywhereNotAllowedError,
@@ -233,10 +232,26 @@ function authorization(body, options) {
   return {
     ...tokens_,
     accessKey: toAccount(key, { accessKey: accessKey2 }),
+    ...challengeSignature(body, { challenged: options.challenged }),
     key,
     user: user(tokens_)
   };
 }
+function challengeSignature(body, options = {}) {
+  if (body.account && body.challenge_signature)
+    return {
+      address: body.account,
+      challengeSignature: body.challenge_signature
+    };
+  if (options.challenged)
+    throw new RequestError({
+      code: "server_error",
+      message: "Missing challenge signature in the response to a request with a challenge. Update Tempo ID, or sign in without the challenge.",
+      signedIn: true,
+      status: 200
+    });
+  return {};
+}
 async function json(response) {
   const body = await response.json().catch(() => ({}));
   if (!response.ok) throw error(body, { status: response.status });
@@ -473,9 +488,13 @@ function signedIn(error3, options = {}) {
     uri: error3.uri
   });
 }
-function withoutKey(body) {
+function withoutKey(body, options = {}) {
   const tokens_ = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
-  return { ...tokens_, user: user(tokens_) };
+  return {
+    ...tokens_,
+    ...challengeSignature(body, options),
+    user: user(tokens_)
+  };
 }
 
 // ../../accounts/src/actions/account.ts
@@ -941,13 +960,12 @@ function seconds(options) {
 var base64url = { pad: false, url: true };
 async function authorizeUrl(auth, options) {
   const { accessKey: accessKey2 } = options;
-  if (!accessKey2 && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const pending = from2({
     ...key ? key.material : { key: false },
     chainId: auth.chainId,
+    ...options.challenge !== void 0 ? { challenge: true } : {},
     clientId: auth.clientId,
     redirectUri,
     // `Bytes.random` needs only `crypto.getRandomValues`, which React Native polyfills.
@@ -959,6 +977,7 @@ async function authorizeUrl(auth, options) {
   }) : void 0;
   const url = new URL("/oauth2/authorize", auth.url);
   const parameters = new URLSearchParams({
+    ...options.challenge !== void 0 && !accessKey2 ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     client_id: auth.clientId,
     // In the web message mode, Tempo ID sets the challenge and redeems the code itself.
@@ -994,9 +1013,15 @@ async function authorizeUrl(auth, options) {
   return { pending, url: url.href };
 }
 function request(auth, options) {
-  const { accessKey: accessKey2, challenge } = options;
+  const { accessKey: accessKey2, challenge: challenge2 } = options;
   return {
-    ...challenge === void 0 ? {} : { challenge },
+    // A challenge without an access key names the instance's chain, whose view of the account signs
+    // it, and any account that signs it in place of the selected one.
+    ...challenge2 !== void 0 && !accessKey2 ? {
+      ...options.account ? { account: options.account } : {},
+      chain_id: auth.chainId
+    } : {},
+    ...challenge2 === void 0 ? {} : { challenge: challenge2 },
     client_id: auth.clientId,
     ...accessKey2 ? {
       key_authorization: keyAuthorization(auth, {
@@ -1051,7 +1076,7 @@ function pushes(auth) {
 
 // ../../accounts/src/internal/Headless.ts
 async function authorize(auth, options) {
-  const { accessKey: accessKey2, challenge, getFn } = options;
+  const { accessKey: accessKey2, challenge: challenge2, getFn } = options;
   try {
     const key = accessKey2 ? await resolve(accessKey2) : void 0;
     if (key)
@@ -1065,11 +1090,11 @@ async function authorize(auth, options) {
         getFn,
         json: request(auth, {
           accessKey: key && accessKey2 && { ...accessKey2, account: key.accessKey },
-          challenge
+          challenge: challenge2
         })
       })
     );
-    const authorization2 = key ? authorization(body, key) : withoutKey(body);
+    const authorization2 = key ? authorization(body, { ...key, challenged: challenge2 !== void 0 }) : withoutKey(body, { challenged: challenge2 !== void 0 });
     if (authorization2.user.id !== options.userId) throw sessionChanged();
     return {
       ...authorization2,
@@ -1091,7 +1116,12 @@ async function complete(auth, options) {
         step: body.authorization
       })
     ) : body.authorization;
-    const authorization2 = key ? authorization(signed, key) : withoutKey(signed);
+    const authorization2 = key ? authorization(signed, {
+      ...key,
+      challenged: options.request.challenge !== void 0
+    }) : withoutKey(signed, {
+      challenged: options.request.challenge !== void 0
+    });
     if (authorization2.user.id !== body.user.id) throw sessionChanged();
     return {
       ...authorization2,
@@ -1170,7 +1200,7 @@ async function sign(auth, options) {
   });
 }
 function steps(json2, options) {
-  if (!json2.key_authorization) return false;
+  if (!json2.key_authorization && json2.challenge === void 0) return false;
   return options.getFn !== void 0 || globalThis.navigator?.credentials !== void 0;
 }
 function redemption(auth) {
@@ -1215,14 +1245,14 @@ async function sendCode(auth, options) {
   );
 }
 async function signIn(auth, options) {
-  const { challenge, code, email, userIp } = options;
-  if (!options.accessKey && challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
+  const { challenge: challenge2, code, email, userIp } = options;
   authenticated(auth);
   const { accessKey: accessKey2 } = options;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const body = await token(auth, {
-    ...challenge === void 0 ? {} : { challenge },
+    // A challenge without an access key names the instance's chain, whose view of the account signs it.
+    ...challenge2 !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
+    ...challenge2 === void 0 ? {} : { challenge: challenge2 },
     code,
     email,
     grant_type: grantType,
@@ -1241,14 +1271,19 @@ async function signIn(auth, options) {
   });
   const tokens3 = tokens(body);
   if (!key)
-    return { ...tokens3, user: user(tokens3) };
+    return {
+      ...tokens3,
+      ...challengeSignature(body, { challenged: challenge2 !== void 0 }),
+      user: user(tokens3)
+    };
   return authorization(
     {
       account: body.account,
+      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: tokens3
     },
-    key
+    { ...key, challenged: challenge2 !== void 0 }
   );
 }
 function authenticated(auth) {
@@ -1328,8 +1363,11 @@ __export(device_exports, {
 });
 import { Base64 as Base646 } from "ox";
 async function authorize2(auth, options) {
-  const key = await resolve(options.accessKey);
+  const { accessKey: accessKey2 } = options;
+  const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const body = new URLSearchParams({
+    // A challenge without an access key names the instance's chain, whose view of the account signs it.
+    ...options.challenge !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     // The instance's app is the device app that the CLI signs in to, such as `tempo-cli`.
     client_id: auth.clientId,
@@ -1337,14 +1375,16 @@ async function authorize2(auth, options) {
     ...options.funding?.currency === void 0 ? {} : { funding_currency: options.funding.currency },
     ...options.funding ? { funding_hint: options.funding.amount } : {},
     ...options.funding?.token === void 0 ? {} : { funding_token: options.funding.token },
-    key_authorization: Base646.fromString(
-      JSON.stringify(
-        keyAuthorization(auth, {
-          accessKey: { ...options.accessKey, account: key.accessKey }
-        })
-      ),
-      { pad: false, url: true }
-    )
+    ...key && accessKey2 ? {
+      key_authorization: Base646.fromString(
+        JSON.stringify(
+          keyAuthorization(auth, {
+            accessKey: { ...accessKey2, account: key.accessKey }
+          })
+        ),
+        { pad: false, url: true }
+      )
+    } : {}
   });
   for (const resource of resources(auth, options))
     body.append("resource", resource);
@@ -1379,6 +1419,7 @@ async function authorize2(auth, options) {
       );
       failure = void 0;
       const result = await request2(poll2, {
+        challenged: options.challenge !== void 0,
         deviceCode: code.device_code,
         key
       }).catch((error3) => {
@@ -1411,9 +1452,17 @@ async function authorize2(auth, options) {
 }
 async function poll(auth, options) {
   const { deviceCode } = options;
+  const challenged = options.challenged ?? options.accessKey === false;
+  if (options.accessKey === false)
+    return request2(auth, {
+      challenged,
+      deviceCode,
+      key: void 0
+    });
   const accessKey2 = own(options.accessKey);
   if (!accessKey2) throw new AccessKeyRequiredError();
   return request2(auth, {
+    challenged,
     deviceCode,
     key: { accessKey: accessKey2, material: {} }
   });
@@ -1437,15 +1486,20 @@ async function request2(auth, options) {
   });
   if (typeof body === "string")
     return { slowDown: body === "slow_down", status: "pending" };
+  const authorization2 = key ? authorization(
+    {
+      account: body.account,
+      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
+      key_authorization: body.key_authorization,
+      tokens: tokens(body)
+    },
+    { ...key, challenged: options.challenged }
+  ) : withoutKey(
+    { ...body, tokens: tokens(body) },
+    { challenged: options.challenged }
+  );
   return {
-    authorization: authorization(
-      {
-        account: body.account,
-        key_authorization: body.key_authorization,
-        tokens: tokens(body)
-      },
-      key
-    ),
+    authorization: authorization2,
     status: "approved"
   };
 }
@@ -1712,7 +1766,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-PTAFRAX2.js");
+    const Sheet = await import("./Sheet-FH4KRDI7.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1763,7 +1817,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-PTAFRAX2.js").then(
+        void import("./Sheet-FH4KRDI7.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1828,7 +1882,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-PTAFRAX2.js");
+  const Sheet = await import("./Sheet-FH4KRDI7.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -2086,6 +2140,7 @@ function finish(options) {
   const {
     key,
     chainId: _chainId,
+    challenge: challenged,
     clientId: _clientId,
     redirectUri: _redirectUri,
     state: _state,
@@ -2094,7 +2149,11 @@ function finish(options) {
   } = options.pending;
   if (key === false) {
     const tokens3 = tokens(body);
-    return { ...tokens3, user: user(tokens3) };
+    return {
+      ...tokens3,
+      ...challengeSignature(body, { challenged }),
+      user: user(tokens3)
+    };
   }
   if (!body.account || !body.key_authorization)
     throw new RequestError({
@@ -2106,10 +2165,11 @@ function finish(options) {
   return authorization(
     {
       account: body.account,
+      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: body
     },
-    { accessKey: options.accessKey, material }
+    { accessKey: options.accessKey, challenged, material }
   );
 }
 async function prefetch(auth) {
@@ -2646,6 +2706,10 @@ function toSession(result) {
   return from4({
     accessToken: result.accessToken,
     ...result.account ? { account: result.account } : {},
+    ...result.address && result.challengeSignature ? {
+      address: result.address,
+      challengeSignature: result.challengeSignature
+    } : {},
     expiresAt: result.expiresAt,
     ...result.idToken !== void 0 ? { idToken: result.idToken } : {},
     ...result.key ? { key: withLifetime(result.key) } : {},
@@ -2691,8 +2755,6 @@ async function sendCode2(auth, options) {
 }
 async function signIn3(auth, options) {
   const { code, email, getFn, link } = options;
-  if (!options.accessKey && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const prepared = await prepare(auth, options);
   const assertion = await (async () => {
     if (!link) return void 0;
@@ -2894,6 +2956,13 @@ function prepare2(auth, options = {}) {
 }
 async function register(auth, options = {}) {
   const { createFn, getFn, key } = options;
+  if (options.challenge !== void 0 && !options.accessKey)
+    throw new RequestError({
+      code: "invalid_request",
+      field: "challenge",
+      message: "Invalid options: `challenge` signs as the new passkey's account, which only a registration with `accessKey` selects. Pass `accessKey`, or sign in with the challenge.",
+      status: 0
+    });
   const chain = options.chain ?? options.chainId;
   if (options.accessKey && (key || options.account !== void 0 || chain !== void 0))
     throw new RequestError({
@@ -2985,14 +3054,60 @@ async function register(auth, options = {}) {
     signed,
     headless.key
   );
+  const challenged = options.challenge === void 0 ? {} : await challenge(
+    { ...auth, chainId: Number(authorization2.key.chainId) },
+    {
+      account: registered.address,
+      challenge: options.challenge,
+      getFn,
+      userId: authorization2.user.id
+    }
+  );
   return {
     ...result,
     authorization: {
       ...authorization2,
+      ..."challengeError" in challenged ? {} : challenged,
       upgradeAvailable: signed.upgrade_available === true
-    }
+    },
+    ..."challengeError" in challenged ? { challengeError: challenged.challengeError } : {}
   };
 }
+async function challenge(auth, options) {
+  try {
+    const body = await json(
+      await post2(auth, {
+        getFn: options.getFn,
+        json: request(auth, {
+          account: options.account,
+          challenge: options.challenge
+        })
+      })
+    );
+    const tokens3 = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
+    if (tokens3.refreshToken)
+      await revoke(auth, { refreshToken: tokens3.refreshToken }).catch(
+        () => void 0
+      );
+    const signed = challengeSignature(body, { challenged: true });
+    if (user(tokens3).id !== options.userId || !Address3.isEqual(signed.address, options.account))
+      throw new RequestError({
+        code: "server_error",
+        message: "Account mismatch: Tempo ID signed the challenge as another account or user than the new passkey's. The passkey is registered, so sign in with it and the challenge.",
+        status: 200
+      });
+    return signed;
+  } catch (error3) {
+    return {
+      challengeError: error3 instanceof RequestError ? error3 : new RequestError({
+        cause: error3,
+        code: "server_error",
+        message: "Challenge signature failed after the registration, with no response from Tempo ID. The passkey is registered, so sign in with it and the challenge.",
+        status: 0
+      })
+    };
+  }
+}
 async function signIn4(auth, options = {}) {
   const prepared = await requestOptions(auth, options);
   const assertion = await sign2(prepared, options);
@@ -3017,8 +3132,6 @@ function refused(error3) {
 }
 async function requestOptions(auth, options) {
   const { credentialId, mediation, select } = options;
-  if (!options.accessKey && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const { authorize: authorize6, key } = await prepare(auth, options);
   const requestedAt = Date.now();
   const requested = await json(
@@ -3103,8 +3216,6 @@ async function list(auth) {
 // ../../accounts/src/internal/Actions.ts
 async function authorize4(auth, options = {}) {
   const { accessKey: accessKey2 } = options;
-  if (!accessKey2 && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const [session2, generated] = await Promise.all([
     (async () => json(
       await (auth.fetch ?? globalThis.fetch)(
@@ -3138,7 +3249,10 @@ async function authorize4(auth, options = {}) {
   const body = await json(response);
   const [first] = body.tempo ?? [];
   const result = {
-    ...key ? authorization(body, key) : withoutKey(body),
+    ...key ? authorization(body, {
+      ...key,
+      challenged: options.challenge !== void 0
+    }) : withoutKey(body, { challenged: options.challenge !== void 0 }),
     // The response lists the access key's account first, so the app reads no `GET /v1/account`.
     // An account that the client cannot rebuild stays absent, so the session holds the access key alone.
     ...key && first ? (() => {
@@ -3411,7 +3525,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-7DSDKEHU.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-RR4ETIE7.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -4366,14 +4480,6 @@ var ChainUnavailableError = class extends Error {
     );
   }
 };
-var ChallengeWithoutKeyError = class extends Error {
-  name = "Accounts.ChallengeWithoutKeyError";
-  constructor() {
-    super(
-      "A challenge rides in the key authorization, so a sign-in without `accessKey` takes none. Remove `challenge`, or pass `accessKey` to request an access key."
-    );
-  }
-};
 var ClientIdRequiredError = class extends Error {
   name = "Accounts.ClientIdRequiredError";
   constructor() {
@@ -4631,7 +4737,7 @@ function create4(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-7J5I4L3Q.js").then(
+    attached ??= import("./Connections-D5RJSFJP.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;

package/dist/{chunk-JJT3ITRO.js → chunk-USONPD4G.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-PA3AETBC.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-FDHRRJQI.js";
-import "../chunk-JJT3ITRO.js";
-import "../chunk-YDYAVOWG.js";
+} from "../chunk-LUSCUHII.js";
+import "../chunk-USONPD4G.js";
+import "../chunk-PA3AETBC.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-FDHRRJQI.js";
-import "../chunk-JJT3ITRO.js";
-import "../chunk-YDYAVOWG.js";
+} from "../chunk-LUSCUHII.js";
+import "../chunk-USONPD4G.js";
+import "../chunk-PA3AETBC.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-FDHRRJQI.js";
-import "../chunk-JJT3ITRO.js";
-import "../chunk-YDYAVOWG.js";
+} from "../chunk-LUSCUHII.js";
+import "../chunk-USONPD4G.js";
+import "../chunk-PA3AETBC.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-7DSDKEHU.js → dialog-RR4ETIE7.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-YDYAVOWG.js";
+} from "./chunk-PA3AETBC.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-707.sha-3bb0aa5",
+  "version": "0.0.0-pr-704.sha-0cbffe0",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {