@tempoxyz/id 0.0.0-pr-733.sha-e545d6e → 0.0.0-pr-704.sha-337c895

package/dist/{Connections-FMSXLTDQ.js → Connections-J72AA66Q.js}

@@ -4,8 +4,8 @@ import {
   name,
   parseName,
   pending
-} from "./chunk-IVSEEABZ.js";
-import "./chunk-OWN434NG.js";
+} from "./chunk-HWWXK3KQ.js";
+import "./chunk-7LJN5HAQ.js";
 import "./chunk-YW5DUQT3.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{Sheet-NWJMJ4Y6.js → Sheet-LRIER3ST.js}

@@ -4,7 +4,7 @@ import {
   machines,
   prompt,
   waiting
-} from "./chunk-OWN434NG.js";
+} from "./chunk-7LJN5HAQ.js";
 import "./chunk-MLKGABMK.js";
 export {
   create,

package/dist/{chunk-OWN434NG.js → chunk-7LJN5HAQ.js}

@@ -20,7 +20,6 @@ var Accounts_exports = {};
 __export(Accounts_exports, {
   ChainInvalidError: () => ChainInvalidError,
   ChainUnavailableError: () => ChainUnavailableError,
-  ChallengeWithoutKeyError: () => ChallengeWithoutKeyError,
   ClientIdRequiredError: () => ClientIdRequiredError,
   ConnectionsRequiredError: () => ConnectionsRequiredError,
   EverywhereNotAllowedError: () => EverywhereNotAllowedError,
@@ -234,10 +233,26 @@ function authorization(body, options) {
   return {
     ...tokens_,
     accessKey: toAccount(key, { accessKey: accessKey2 }),
+    ...challengeSignature(body, { challenged: options.challenged }),
     key,
     user: user(tokens_)
   };
 }
+function challengeSignature(body, options = {}) {
+  if (body.account && body.challenge_signature)
+    return {
+      address: body.account,
+      challengeSignature: body.challenge_signature
+    };
+  if (options.challenged)
+    throw new RequestError({
+      code: "server_error",
+      message: "Missing challenge signature in the response to a request with a challenge. Update Tempo ID, or sign in without the challenge.",
+      signedIn: true,
+      status: 200
+    });
+  return {};
+}
 async function json(response) {
   if (response.type === "opaqueredirect" || Math.trunc(response.status / 100) === 3) {
     await response.body?.cancel().catch(() => void 0);
@@ -549,9 +564,13 @@ function signedIn(error3, options = {}) {
     uri: error3.uri
   });
 }
-function withoutKey(body) {
+function withoutKey(body, options = {}) {
   const tokens_ = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
-  return { ...tokens_, user: user(tokens_) };
+  return {
+    ...tokens_,
+    ...challengeSignature(body, options),
+    user: user(tokens_)
+  };
 }
 
 // ../../accounts/src/actions/account.ts
@@ -1023,13 +1042,12 @@ function seconds(options) {
 var base64url = { pad: false, url: true };
 async function authorizeUrl(auth, options) {
   const { accessKey: accessKey2 } = options;
-  if (!accessKey2 && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const pending = from2({
     ...key ? key.material : { key: false },
     chainId: auth.chainId,
+    ...options.challenge !== void 0 ? { challenge: true } : {},
     clientId: auth.clientId,
     redirectUri,
     // `Bytes.random` needs only `crypto.getRandomValues`, which React Native polyfills.
@@ -1041,6 +1059,7 @@ async function authorizeUrl(auth, options) {
   }) : void 0;
   const url = new URL("/oauth2/authorize", auth.url);
   const parameters = new URLSearchParams({
+    ...options.challenge !== void 0 && !accessKey2 ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     client_id: auth.clientId,
     // In the web message mode, Tempo ID sets the challenge and redeems the code itself.
@@ -1077,9 +1096,15 @@ async function authorizeUrl(auth, options) {
   return { pending, url: url.href };
 }
 function request(auth, options) {
-  const { accessKey: accessKey2, challenge } = options;
+  const { accessKey: accessKey2, challenge: challenge2 } = options;
   return {
-    ...challenge === void 0 ? {} : { challenge },
+    // A challenge without an access key names the instance's chain, whose view of the account signs
+    // it, and any account that signs it in place of the selected one.
+    ...challenge2 !== void 0 && !accessKey2 ? {
+      ...options.account ? { account: options.account } : {},
+      chain_id: auth.chainId
+    } : {},
+    ...challenge2 === void 0 ? {} : { challenge: challenge2 },
     client_id: auth.clientId,
     ...accessKey2 ? {
       key_authorization: keyAuthorization(auth, {
@@ -1134,7 +1159,7 @@ function pushes(auth) {
 
 // ../../accounts/src/internal/Headless.ts
 async function authorize(auth, options) {
-  const { accessKey: accessKey2, challenge, getFn } = options;
+  const { accessKey: accessKey2, challenge: challenge2, getFn } = options;
   try {
     const key = accessKey2 ? await resolve(accessKey2) : void 0;
     if (key)
@@ -1148,11 +1173,11 @@ async function authorize(auth, options) {
         getFn,
         json: request(auth, {
           accessKey: key && accessKey2 && { ...accessKey2, account: key.accessKey },
-          challenge
+          challenge: challenge2
         })
       })
     );
-    const authorization2 = key ? authorization(body, key) : withoutKey(body);
+    const authorization2 = key ? authorization(body, { ...key, challenged: challenge2 !== void 0 }) : withoutKey(body, { challenged: challenge2 !== void 0 });
     if (authorization2.user.id !== options.userId) throw sessionChanged();
     return {
       ...authorization2,
@@ -1174,7 +1199,12 @@ async function complete(auth, options) {
         step: body.authorization
       })
     ) : body.authorization;
-    const authorization2 = key ? authorization(signed, key) : withoutKey(signed);
+    const authorization2 = key ? authorization(signed, {
+      ...key,
+      challenged: options.request.challenge !== void 0
+    }) : withoutKey(signed, {
+      challenged: options.request.challenge !== void 0
+    });
     if (authorization2.user.id !== body.user.id) throw sessionChanged();
     return {
       ...authorization2,
@@ -1253,7 +1283,7 @@ async function sign(auth, options) {
   });
 }
 function steps(json2, options) {
-  if (!json2.key_authorization) return false;
+  if (!json2.key_authorization && json2.challenge === void 0) return false;
   return options.getFn !== void 0 || globalThis.navigator?.credentials !== void 0;
 }
 function redemption(auth) {
@@ -1300,14 +1330,14 @@ async function sendCode(auth, options) {
   );
 }
 async function signIn(auth, options) {
-  const { challenge, code, email, userIp } = options;
-  if (!options.accessKey && challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
+  const { challenge: challenge2, code, email, userIp } = options;
   authenticated(auth);
   const { accessKey: accessKey2 } = options;
   const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const body = await token(auth, {
-    ...challenge === void 0 ? {} : { challenge },
+    // A challenge without an access key names the instance's chain, whose view of the account signs it.
+    ...challenge2 !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
+    ...challenge2 === void 0 ? {} : { challenge: challenge2 },
     code,
     email,
     grant_type: grantType,
@@ -1326,14 +1356,19 @@ async function signIn(auth, options) {
   });
   const tokens3 = tokens(body);
   if (!key)
-    return { ...tokens3, user: user(tokens3) };
+    return {
+      ...tokens3,
+      ...challengeSignature(body, { challenged: challenge2 !== void 0 }),
+      user: user(tokens3)
+    };
   return authorization(
     {
       account: body.account,
+      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: tokens3
     },
-    key
+    { ...key, challenged: challenge2 !== void 0 }
   );
 }
 function authenticated(auth) {
@@ -1413,8 +1448,11 @@ __export(device_exports, {
 });
 import { Base64 as Base646 } from "ox";
 async function authorize2(auth, options) {
-  const key = await resolve(options.accessKey);
+  const { accessKey: accessKey2 } = options;
+  const key = accessKey2 ? await resolve(accessKey2) : void 0;
   const body = new URLSearchParams({
+    // A challenge without an access key names the instance's chain, whose view of the account signs it.
+    ...options.challenge !== void 0 && !key ? { chain_id: String(auth.chainId) } : {},
     ...options.challenge === void 0 ? {} : { challenge: options.challenge },
     // The instance's app is the device app that the CLI signs in to, such as `tempo-cli`.
     client_id: auth.clientId,
@@ -1422,14 +1460,16 @@ async function authorize2(auth, options) {
     ...options.funding?.currency === void 0 ? {} : { funding_currency: options.funding.currency },
     ...options.funding ? { funding_hint: options.funding.amount } : {},
     ...options.funding?.token === void 0 ? {} : { funding_token: options.funding.token },
-    key_authorization: Base646.fromString(
-      JSON.stringify(
-        keyAuthorization(auth, {
-          accessKey: { ...options.accessKey, account: key.accessKey }
-        })
-      ),
-      { pad: false, url: true }
-    )
+    ...key && accessKey2 ? {
+      key_authorization: Base646.fromString(
+        JSON.stringify(
+          keyAuthorization(auth, {
+            accessKey: { ...accessKey2, account: key.accessKey }
+          })
+        ),
+        { pad: false, url: true }
+      )
+    } : {}
   });
   for (const resource of resources(auth, options))
     body.append("resource", resource);
@@ -1464,6 +1504,7 @@ async function authorize2(auth, options) {
       );
       failure = void 0;
       const result = await request2(poll2, {
+        challenged: options.challenge !== void 0,
         deviceCode: code.device_code,
         key
       }).catch((error3) => {
@@ -1496,9 +1537,17 @@ async function authorize2(auth, options) {
 }
 async function poll(auth, options) {
   const { deviceCode } = options;
+  const challenged = options.challenged ?? options.accessKey === false;
+  if (options.accessKey === false)
+    return request2(auth, {
+      challenged,
+      deviceCode,
+      key: void 0
+    });
   const accessKey2 = own(options.accessKey);
   if (!accessKey2) throw new AccessKeyRequiredError();
   return request2(auth, {
+    challenged,
     deviceCode,
     key: { accessKey: accessKey2, material: {} }
   });
@@ -1522,15 +1571,20 @@ async function request2(auth, options) {
   });
   if (typeof body === "string")
     return { slowDown: body === "slow_down", status: "pending" };
+  const authorization2 = key ? authorization(
+    {
+      account: body.account,
+      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
+      key_authorization: body.key_authorization,
+      tokens: tokens(body)
+    },
+    { ...key, challenged: options.challenged }
+  ) : withoutKey(
+    { ...body, tokens: tokens(body) },
+    { challenged: options.challenged }
+  );
   return {
-    authorization: authorization(
-      {
-        account: body.account,
-        key_authorization: body.key_authorization,
-        tokens: tokens(body)
-      },
-      key
-    ),
+    authorization: authorization2,
     status: "approved"
   };
 }
@@ -1800,7 +1854,7 @@ async function open(auth, options) {
     throw new OriginError({ origin: window.location.origin, redirectUri });
   if (mode === "popup" && options.mode !== "popup" && !activated()) {
     const address2 = await abortable(read2(), { signal });
-    const Sheet = await import("./Sheet-NWJMJ4Y6.js");
+    const Sheet = await import("./Sheet-LRIER3ST.js");
     return await new Promise((resolve3, reject) => {
       const abort = () => {
         close();
@@ -1851,7 +1905,7 @@ async function watch(auth, options) {
   try {
     return await new Promise(
       (resolve3, reject) => {
-        void import("./Sheet-NWJMJ4Y6.js").then(
+        void import("./Sheet-LRIER3ST.js").then(
           (Sheet) => {
             if (settled) return;
             unblock = Sheet.waiting({
@@ -1916,7 +1970,7 @@ function parse(url, options) {
 async function frame(auth, options) {
   const { redirectUri, signal, toUrl } = options;
   const address2 = await abortable(options.address, { signal });
-  const Sheet = await import("./Sheet-NWJMJ4Y6.js");
+  const Sheet = await import("./Sheet-LRIER3ST.js");
   signal?.throwIfAborted();
   let close;
   let abort;
@@ -2187,6 +2241,7 @@ function finish(options) {
   const {
     key,
     chainId: _chainId,
+    challenge: challenged,
     clientId: _clientId,
     redirectUri: _redirectUri,
     state: _state,
@@ -2195,7 +2250,11 @@ function finish(options) {
   } = options.pending;
   if (key === false) {
     const tokens3 = tokens(body);
-    return { ...tokens3, user: user(tokens3) };
+    return {
+      ...tokens3,
+      ...challengeSignature(body, { challenged }),
+      user: user(tokens3)
+    };
   }
   if (!body.account || !body.key_authorization)
     throw new RequestError({
@@ -2207,10 +2266,11 @@ function finish(options) {
   return authorization(
     {
       account: body.account,
+      ...body.challenge_signature ? { challenge_signature: body.challenge_signature } : {},
       key_authorization: body.key_authorization,
       tokens: body
     },
-    { accessKey: options.accessKey, material }
+    { accessKey: options.accessKey, challenged, material }
   );
 }
 async function prefetch(auth) {
@@ -2762,6 +2822,10 @@ function toSession(result) {
   return from4({
     accessToken: result.accessToken,
     ...result.account ? { account: result.account } : {},
+    ...result.address && result.challengeSignature ? {
+      address: result.address,
+      challengeSignature: result.challengeSignature
+    } : {},
     expiresAt: result.expiresAt,
     ...result.idToken !== void 0 ? { idToken: result.idToken } : {},
     ...result.key ? { key: withLifetime(result.key) } : {},
@@ -2810,8 +2874,6 @@ async function sendCode2(auth, options) {
 }
 async function signIn3(auth, options) {
   const { code, email, getFn, link } = options;
-  if (!options.accessKey && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const prepared = await prepare(auth, options);
   const offline = answered(auth, {
     message: "The sign-in received no response. Check the connection, and sign in again. If the code is refused, request a new code."
@@ -3031,6 +3093,13 @@ function prepare2(auth, options = {}) {
 }
 async function register(auth, options = {}) {
   const { createFn, getFn, key } = options;
+  if (options.challenge !== void 0 && !options.accessKey)
+    throw new RequestError({
+      code: "invalid_request",
+      field: "challenge",
+      message: "Invalid options: `challenge` signs as the new passkey's account, which only a registration with `accessKey` selects. Pass `accessKey`, or sign in with the challenge.",
+      status: 0
+    });
   const chain = options.chain ?? options.chainId;
   if (options.accessKey && (key || options.account !== void 0 || chain !== void 0))
     throw new RequestError({
@@ -3122,14 +3191,60 @@ async function register(auth, options = {}) {
     signed,
     headless.key
   );
+  const challenged = options.challenge === void 0 ? {} : await challenge(
+    { ...auth, chainId: Number(authorization2.key.chainId) },
+    {
+      account: registered.address,
+      challenge: options.challenge,
+      getFn,
+      userId: authorization2.user.id
+    }
+  );
   return {
     ...result,
     authorization: {
       ...authorization2,
+      ..."challengeError" in challenged ? {} : challenged,
       upgradeAvailable: signed.upgrade_available === true
-    }
+    },
+    ..."challengeError" in challenged ? { challengeError: challenged.challengeError } : {}
   };
 }
+async function challenge(auth, options) {
+  try {
+    const body = await json(
+      await post2(auth, {
+        getFn: options.getFn,
+        json: request(auth, {
+          account: options.account,
+          challenge: options.challenge
+        })
+      })
+    );
+    const tokens3 = "accessToken" in body.tokens ? body.tokens : tokens(body.tokens);
+    if (tokens3.refreshToken)
+      await revoke(auth, { refreshToken: tokens3.refreshToken }).catch(
+        () => void 0
+      );
+    const signed = challengeSignature(body, { challenged: true });
+    if (user(tokens3).id !== options.userId || !Address3.isEqual(signed.address, options.account))
+      throw new RequestError({
+        code: "server_error",
+        message: "Account mismatch: Tempo ID signed the challenge as another account or user than the new passkey's. The passkey is registered, so sign in with it and the challenge.",
+        status: 200
+      });
+    return signed;
+  } catch (error3) {
+    return {
+      challengeError: error3 instanceof RequestError ? error3 : new RequestError({
+        cause: error3,
+        code: "server_error",
+        message: "Challenge signature failed after the registration, with no response from Tempo ID. The passkey is registered, so sign in with it and the challenge.",
+        status: 0
+      })
+    };
+  }
+}
 async function signIn4(auth, options = {}) {
   const prepared = await requestOptions(auth, options);
   const assertion = await sign2(prepared, options);
@@ -3154,8 +3269,6 @@ function refused(error3) {
 }
 async function requestOptions(auth, options) {
   const { credentialId, mediation, select } = options;
-  if (!options.accessKey && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const { authorize: authorize6, key } = await prepare(auth, options);
   const requestedAt = Date.now();
   const requested = await json(
@@ -3240,8 +3353,6 @@ async function list(auth) {
 // ../../accounts/src/internal/Actions.ts
 async function authorize4(auth, options = {}) {
   const { accessKey: accessKey2 } = options;
-  if (!accessKey2 && options.challenge !== void 0)
-    throw new ChallengeWithoutKeyError();
   const [session2, generated] = await Promise.all([
     options.checked ? { user: true } : (async () => json(
       await (auth.fetch ?? globalThis.fetch)(
@@ -3275,7 +3386,10 @@ async function authorize4(auth, options = {}) {
   const body = await json(response);
   const [first] = body.tempo ?? [];
   const result = {
-    ...key ? authorization(body, key) : withoutKey(body),
+    ...key ? authorization(body, {
+      ...key,
+      challenged: options.challenge !== void 0
+    }) : withoutKey(body, { challenged: options.challenge !== void 0 }),
     // The response lists the access key's account first, so the app reads no `GET /v1/account`.
     // An account that the client cannot rebuild stays absent, so the session holds the access key alone.
     ...key && first ? (() => {
@@ -4936,7 +5050,7 @@ var signInIds = /* @__PURE__ */ new Set([
 function plugin() {
   let loading;
   function load() {
-    loading ??= import("./dialog-YGV3SM4O.js").then((module) => module.dialog()).catch((error3) => {
+    loading ??= import("./dialog-CMISBFX2.js").then((module) => module.dialog()).catch((error3) => {
       loading = void 0;
       throw error3;
     });
@@ -5107,14 +5221,6 @@ var ChainUnavailableError = class extends Error {
     );
   }
 };
-var ChallengeWithoutKeyError = class extends Error {
-  name = "Accounts.ChallengeWithoutKeyError";
-  constructor() {
-    super(
-      "A challenge rides in the key authorization, so a sign-in without `accessKey` takes none. Remove `challenge`, or pass `accessKey` to request an access key."
-    );
-  }
-};
 var ClientIdRequiredError = class extends Error {
   name = "Accounts.ClientIdRequiredError";
   constructor() {
@@ -5433,7 +5539,7 @@ function create5(options = {}) {
   function connections2() {
     if (!connectionsOptions)
       return Promise.reject(new ConnectionsRequiredError());
-    attached ??= import("./Connections-FMSXLTDQ.js").then(
+    attached ??= import("./Connections-J72AA66Q.js").then(
       (module) => module.attach(config, connectionsOptions)
     );
     return attached;
@@ -5486,7 +5592,7 @@ function create5(options = {}) {
           (module) => module.create({
             accessKeys: connectionsOptions ? async () => (await connections2()).keyEndpoint : void 0,
             basePath: handlerOptions.basePath,
-            // The relay checks no caller, so it is served only on request. The `relay` plugin's
+            // The relay spends the fee payer's balance, so it is served only on request. The `relay` plugin's
             // `extend` adds its route to the instance after this object.
             relay: handlerOptions.relay && relaying ? () => instance.relay : void 0
           })

package/dist/{chunk-IVSEEABZ.js → chunk-HWWXK3KQ.js}

@@ -5,7 +5,7 @@ import {
   expired,
   from,
   revokeAccessKey
-} from "./chunk-OWN434NG.js";
+} from "./chunk-7LJN5HAQ.js";
 import {
   from as from2
 } from "./chunk-YW5DUQT3.js";

package/dist/{chunk-SQYUAMGZ.js → chunk-WTA7NVIZ.js}

@@ -2,7 +2,7 @@ import {
   AccessKey_exports,
   Accounts_exports,
   Actions_exports
-} from "./chunk-OWN434NG.js";
+} from "./chunk-7LJN5HAQ.js";
 
 // src/Session.ts
 import * as Fs from "node:fs/promises";

package/dist/commands/login.js

@@ -1,9 +1,9 @@
 import {
   env,
   login
-} from "../chunk-SQYUAMGZ.js";
-import "../chunk-IVSEEABZ.js";
-import "../chunk-OWN434NG.js";
+} from "../chunk-WTA7NVIZ.js";
+import "../chunk-HWWXK3KQ.js";
+import "../chunk-7LJN5HAQ.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/logout.js

@@ -1,9 +1,9 @@
 import {
   env,
   remove
-} from "../chunk-SQYUAMGZ.js";
-import "../chunk-IVSEEABZ.js";
-import "../chunk-OWN434NG.js";
+} from "../chunk-WTA7NVIZ.js";
+import "../chunk-HWWXK3KQ.js";
+import "../chunk-7LJN5HAQ.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/commands/whoami.js

@@ -2,9 +2,9 @@ import {
   env,
   signedOut,
   whoami
-} from "../chunk-SQYUAMGZ.js";
-import "../chunk-IVSEEABZ.js";
-import "../chunk-OWN434NG.js";
+} from "../chunk-WTA7NVIZ.js";
+import "../chunk-HWWXK3KQ.js";
+import "../chunk-7LJN5HAQ.js";
 import "../chunk-YW5DUQT3.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/{dialog-YGV3SM4O.js → dialog-CMISBFX2.js}

@@ -4,7 +4,7 @@ import {
   expired2 as expired,
   from2 as from,
   toSession
-} from "./chunk-OWN434NG.js";
+} from "./chunk-7LJN5HAQ.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../accounts/src/plugins/dialog.ts

package/package.json

@@ -9,7 +9,7 @@
     "node": ">=24.21"
   },
   "name": "@tempoxyz/id",
-  "version": "0.0.0-pr-733.sha-e545d6e",
+  "version": "0.0.0-pr-704.sha-337c895",
   "description": "The tempo-id CLI: sign in to Tempo ID, and call its API and the Admin API.",
   "type": "module",
   "bin": {