@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/Passkey.d.ts

@@ -0,0 +1,901 @@
+import { Hex } from 'ox';
+import { z } from 'zod';
+import * as Schema from '../app/db/schema.js';
+import type * as Apps from './Apps.js';
+import * as Authorize from './Authorize.js';
+import * as ErrorResponse from './ErrorResponse.js';
+import * as Owner from './Owner.js';
+import type * as Realm from './Realm.js';
+declare const LimitError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "access_denied";
+            reason: "passkey_limit";
+        };
+    };
+    readonly reason: "passkey_limit";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/** The user holds {@link registrationLimit} registered passkeys, so Tempo ID registers no other. */
+export declare class LimitError extends LimitError_base {
+    readonly name = "Passkey.LimitError";
+    constructor();
+}
+declare const LinkExpiredError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "invalid_request";
+            reason: "passkey_link_expired";
+        };
+    };
+    readonly reason: "passkey_link_expired";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * The email step's link to a wallet.tempo passkey expired, or the browser holds no link cookie for it.
+ * The refusal comes before the code is checked, so the code stays valid for a sign-in without the
+ * passkey.
+ */
+export declare class LinkExpiredError extends LinkExpiredError_base {
+    readonly name = "Passkey.LinkExpiredError";
+    constructor();
+}
+declare const NotPermittedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "unauthorized_client";
+            reason: "passkey_not_permitted";
+        };
+    };
+    readonly reason: "passkey_not_permitted";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * A passkey sign-in names an app, or reaches a realm, that holds no passkeys for Tempo ID, or no
+ * passkeys whose relying party covers the app's page.
+ */
+export declare class NotPermittedError extends NotPermittedError_base {
+    readonly name = "Passkey.NotPermittedError";
+    constructor(options?: NotPermittedError.Options);
+}
+export declare namespace NotPermittedError {
+    type Options = {
+        /** The client ID of the app the sign-in names, if any. */
+        clientId?: string | undefined;
+        /** The origin of the app's page that runs the ceremony, or absent for Tempo ID's own page. */
+        origin?: string | undefined;
+    };
+}
+declare const ReauthenticationRequiredError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "login_required";
+            reason: "reauthentication_required";
+        };
+    };
+    readonly reason: "reauthentication_required";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * A passkey registration comes from a session that signed in more than {@link registrationFreshness}
+ * seconds before. A session alone, such as one left open in a shared browser, thus adds no passkey.
+ */
+export declare class ReauthenticationRequiredError extends ReauthenticationRequiredError_base {
+    readonly name = "Passkey.ReauthenticationRequiredError";
+    constructor();
+}
+declare const WebAuthnRejectedError_base: {
+    new (options: ErrorResponse.define.Options): {
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        readonly res?: Response;
+        readonly status: import("hono/utils/http-status").ContentfulStatusCode;
+        getResponse(): Response;
+        readonly name: string;
+        readonly response: Omit<{
+            error: string;
+            error_description: string;
+            error_uri: string;
+            field?: string | undefined;
+            meta?: Readonly<Record<string, string | number>> | undefined;
+            reason: string;
+            request_id?: string | undefined;
+        }, "error" | "reason"> & {
+            error: "access_denied";
+            reason: "webauthn_rejected";
+        };
+    };
+    readonly reason: "webauthn_rejected";
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+};
+/**
+ * A passkey ceremony failed: its challenge is unknown, spent, or expired, or the response does not
+ * verify. One refusal covers every case, so it reveals neither which check failed nor whether a
+ * credential exists.
+ */
+export declare class WebAuthnRejectedError extends WebAuthnRejectedError_base {
+    readonly name = "Passkey.WebAuthnRejectedError";
+    constructor();
+}
+/** A passkey assertion, as `webauthx/client`'s `Authentication.sign` serializes it. */
+export type Assertion = z.output<typeof schema.assertion>;
+/** A challenge that Tempo ID issued, as `take` returns it once spent. */
+export type Challenge = {
+    /**
+     * The headless authorization request of a sign-in with key signature on an app's page, as the
+     * page sent it with its key's expiry filled, or `undefined` for none. The sign-in runs it.
+     */
+    authorize: unknown;
+    /** The challenge, as hex. */
+    challenge: Hex.Hex;
+    /** The client ID of the app the sign-in named, or `null` for none. */
+    clientId: string | null;
+    /**
+     * The SHA-256 digest of the email step's link that the challenge confirms, as hex, or `undefined`
+     * for a sign-in challenge.
+     */
+    link: string | undefined;
+    /**
+     * The origin of the app's page that the ceremony runs at, or `undefined` for Tempo ID's own page.
+     */
+    origin: string | undefined;
+    /**
+     * The realm whose relying party the challenge was issued for, or `undefined` when the stored
+     * challenge names none, which skips the wallet.tempo lookup.
+     */
+    realmId: string | undefined;
+    /** The relying party the challenge was issued for. */
+    rpId: string;
+    /**
+     * The witness that a key challenge's key authorization digest binds, or `undefined` for a
+     * random challenge.
+     */
+    witness: Hex.Hex | undefined;
+};
+/** A registration credential, as `webauthx/client`'s `Registration.create` serializes it. */
+export type Credential = z.output<typeof schema.credential>;
+/** A row of the `keys` table. */
+export type Key = typeof Schema.keys.$inferSelect;
+/** A verified wallet.tempo passkey that waits for an emailed code to name its user. */
+export type Link = z.output<typeof schema.link>;
+/**
+ * A challenge for the new passkey's proof that it holds its private key, as `takeProof` returns it
+ * once spent.
+ */
+export type ProofChallenge = {
+    /** The challenge, as hex. */
+    challenge: Hex.Hex;
+    /** The credential ID of the new passkey, base64url. */
+    id: string;
+    /** The public key that the attestation holds, which the proof must verify against. */
+    publicKey: Hex.Hex;
+    /** The relying party of the `default` realm, which the new passkey belongs to. */
+    rpId: string;
+};
+/** A registration challenge that Tempo ID issued, as `takeRegistration` returns it once spent. */
+export type RegistrationChallenge = {
+    /** The challenge, as hex. */
+    challenge: Hex.Hex;
+    /** The relying party of the `default` realm, which the new passkey must belong to. */
+    rpId: string;
+};
+/**
+ * A challenge for a passkey's signature of a key authorization, as `takeSignature` returns it once
+ * spent. The challenge is the key authorization's digest.
+ */
+export type SignatureChallenge = {
+    /** The address of the Tempo Account that the key acts for, lowercase. */
+    account: string;
+    /** The client ID of the app that requests the key. */
+    clientId: string;
+    /** The passkey that must sign. */
+    credential: Owner.Credential;
+    /** The digest of the key authorization, as hex. */
+    digest: Hex.Hex;
+};
+/** Seconds a challenge lasts. */
+export declare const lifetime: number;
+/** Seconds a deferred link lasts. */
+export declare const linkLifetime: number;
+/**
+ * Seconds after its sign-in that a session can register a passkey. A later registration requires a
+ * new sign-in.
+ */
+export declare const registrationFreshness: number;
+/**
+ * The most passkeys that a user registers. Each owns an account that every account read lists, so
+ * the limit bounds the reads.
+ */
+export declare const registrationLimit = 10;
+/** Zod schemas for passkey ceremonies. */
+export declare namespace schema {
+    /**
+     * A credential ID in canonical unpadded base64url, of at most 1,023 bytes, as WebAuthn bounds it:
+     * 1,364 characters.
+     */
+    const credentialId: z.ZodString;
+    /** A passkey assertion, as `webauthx/client`'s `Authentication.sign` serializes it. */
+    const assertion: z.ZodObject<{
+        id: z.ZodString;
+        metadata: z.ZodObject<{
+            authenticatorData: z.ZodTemplateLiteral<`0x${string}`>;
+            challengeIndex: z.ZodOptional<z.ZodNumber>;
+            clientDataJSON: z.ZodString;
+            typeIndex: z.ZodOptional<z.ZodNumber>;
+            userVerificationRequired: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+        raw: z.ZodObject<{
+            authenticatorAttachment: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            id: z.ZodString;
+            rawId: z.ZodString;
+            response: z.ZodObject<{
+                clientDataJSON: z.ZodString;
+            }, z.core.$strip>;
+            type: z.ZodString;
+        }, z.core.$strip>;
+        signature: z.ZodTemplateLiteral<`0x${string}`>;
+    }, z.core.$strip>;
+    /** The client data fields that `take` and `verify` read. */
+    const clientData: z.ZodObject<{
+        challenge: z.ZodString;
+        crossOrigin: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+    /** A registration credential, as `webauthx/client`'s `Registration.create` serializes it. */
+    const credential: z.ZodObject<{
+        attestationObject: z.ZodString;
+        clientDataJSON: z.ZodString;
+        id: z.ZodString;
+        publicKey: z.ZodTemplateLiteral<`0x${string}`>;
+        raw: z.ZodObject<{
+            authenticatorAttachment: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            id: z.ZodString;
+            rawId: z.ZodString;
+            response: z.ZodObject<{
+                clientDataJSON: z.ZodString;
+            }, z.core.$strip>;
+            type: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    /** A deferred link, as `seal` encrypts it. */
+    const link: z.ZodObject<{
+        address: z.ZodString;
+        createdAt: z.ZodNullable<z.ZodNumber>;
+        expiresAt: z.ZodNumber;
+        host: z.ZodString;
+        id: z.ZodString;
+        nonce: z.ZodString;
+        publicKey: z.ZodTemplateLiteral<`0x${string}`>;
+        rpId: z.ZodString;
+    }, z.core.$strip>;
+    /** A proof challenge's `verification` value. */
+    const proof: z.ZodObject<{
+        id: z.ZodString;
+        publicKey: z.ZodTemplateLiteral<`0x${string}`>;
+        rpId: z.ZodString;
+    }, z.core.$strip>;
+    /** A registration challenge's `verification` value. */
+    const registration: z.ZodObject<{
+        rpId: z.ZodString;
+    }, z.core.$strip>;
+    /** A signature challenge's `verification` value. */
+    const signature: z.ZodObject<{
+        account: z.ZodString;
+        clientId: z.ZodString;
+        credential: z.ZodObject<{
+            id: z.ZodString;
+            publicKey: z.ZodTemplateLiteral<`0x${string}`>;
+            rpId: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    /** The passkey step, which an approval of a key for a passkey-owned account returns. */
+    const step: z.ZodObject<{
+        step: z.ZodObject<{
+            options: z.ZodObject<{
+                publicKey: z.ZodObject<{
+                    allowCredentials: z.ZodArray<z.ZodObject<{
+                        id: z.ZodString;
+                        type: z.ZodLiteral<"public-key">;
+                    }, z.core.$strip>>;
+                    challenge: z.ZodTemplateLiteral<`0x${string}`>;
+                    rpId: z.ZodString;
+                    userVerification: z.ZodLiteral<"required">;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            type: z.ZodLiteral<"passkey">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    /** The passkey step of a headless authorization, which the app's page signs on its own origin. */
+    const headlessStep: z.ZodObject<{
+        expiry: z.ZodNumber;
+        step: z.ZodObject<{
+            options: z.ZodObject<{
+                publicKey: z.ZodObject<{
+                    allowCredentials: z.ZodArray<z.ZodObject<{
+                        id: z.ZodString;
+                        type: z.ZodLiteral<"public-key">;
+                    }, z.core.$strip>>;
+                    challenge: z.ZodTemplateLiteral<`0x${string}`>;
+                    rpId: z.ZodString;
+                    userVerification: z.ZodLiteral<"required">;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            type: z.ZodLiteral<"passkey">;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    /** A `user` row that the plugin's endpoint signs in, as `takeWithKey` reads it. */
+    const user: z.ZodObject<{
+        createdAt: z.ZodDate;
+        email: z.ZodString;
+        emailVerified: z.ZodBoolean;
+        id: z.ZodString;
+        image: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        updatedAt: z.ZodDate;
+    }, z.core.$strip>;
+    /** A challenge's `verification` value. */
+    const value: z.ZodObject<{
+        authorize: z.ZodOptional<z.ZodUnknown>;
+        clientId: z.ZodNullable<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        origin: z.ZodOptional<z.ZodString>;
+        realmId: z.ZodOptional<z.ZodString>;
+        rpId: z.ZodString;
+        witness: z.ZodOptional<z.ZodTemplateLiteral<`0x${string}`>>;
+    }, z.core.$strip>;
+}
+/**
+ * Issues a challenge for a sign-in at `rpId`, stores it until it expires, and returns it as hex.
+ * The challenge is random, or the digest of a key authorization for a sign-in with key signature,
+ * which stores its witness beside it. Returns `undefined` for a key challenge that a pending
+ * challenge already holds, since an app's challenge can repeat a digest, and one assertion must
+ * select exactly one request.
+ */
+export declare function challenge(db: Realm.Database, options: challenge.Options): Promise<`0x${string}` | undefined>;
+export declare namespace challenge {
+    type Options = {
+        /**
+         * The headless authorization request that a sign-in with key signature on an app's page runs,
+         * as the page sent it with its key's expiry filled. Absent for any other sign-in.
+         */
+        authorize?: unknown;
+        /** The client ID of the app the sign-in names, or `null` for none. */
+        clientId: string | null;
+        /**
+         * The digest of the key authorization that a sign-in with key signature signs, and the witness
+         * that the digest binds. The digest takes the place of a random challenge. Absent for a plain
+         * sign-in.
+         */
+        keyChallenge?: {
+            /** The key authorization's digest, as hex. */
+            digest: Hex.Hex;
+            /** The witness that the digest binds. */
+            witness: Hex.Hex;
+        } | undefined;
+        /**
+         * The SHA-256 digest of the email step's link that the challenge confirms, as hex. Absent for a
+         * sign-in challenge.
+         */
+        link?: string | undefined;
+        /**
+         * The origin of the app's page that the ceremony runs at. Absent for Tempo ID's own page. Only
+         * an assertion that reports it, from a request that page sends, spends the challenge.
+         */
+        origin?: string | undefined;
+        /** The realm whose relying party the sign-in uses. */
+        realmId: string;
+        /** The relying party ID the passkey must belong to. */
+        rpId: string;
+    };
+}
+/**
+ * Returns why Tempo ID refuses a passkey ceremony on an app's page, or `undefined` when the page may
+ * run one. Tempo ID verifies the assertion for the page's origin, so only a first-party web app's
+ * page, at the origin of one of its redirect URIs, runs a ceremony:
+ *
+ * - A page sends the app's `client_id`, and the app must exist, be enabled, and be first-party.
+ * - A native app's request proves no app, so it signs in through an authentication sheet.
+ * - The request's `Origin` must be the origin of one of the app's redirect URIs.
+ */
+export declare function checkPage(options: checkPage.Options): ErrorResponse.Instance<typeof checkPage.errors> | undefined;
+export declare namespace checkPage {
+    type Options = {
+        /** The app that `clientId` names, or `undefined` when no enabled app has it. */
+        app: Pick<Apps.App, 'firstParty' | 'redirectUris' | 'type'> | undefined;
+        /** The client ID that the request sends, if any. */
+        clientId: string | undefined;
+        /** The request's `Origin`, if any. */
+        origin: string | undefined;
+    };
+    /** The refusals `checkPage` returns. Its return type admits no other. */
+    const errors: readonly [typeof Authorize.InvalidOriginError, typeof Authorize.RejectedError];
+}
+/**
+ * Returns the passkey with the credential `id` that belongs to `rpId`, or `undefined` when Tempo ID
+ * stores none.
+ */
+export declare function get(db: Realm.Database, options: get.Options): Promise<{
+    address: string | null;
+    createdAt: Date;
+    id: string;
+    publicKey: string;
+    rpId: string;
+    source: string;
+    type: string;
+    userId: string;
+} | undefined>;
+export declare namespace get {
+    type Options = {
+        /** The credential ID, base64url. */
+        id: string;
+        /** The relying party ID the passkey must belong to. */
+        rpId: string;
+    };
+}
+/**
+ * Stores a verified wallet.tempo passkey for `userId`, and returns the user the passkey's row names.
+ * A concurrent first sign-in of the same passkey can store the row first, so the row decides.
+ * Returns `undefined` when another passkey holds the address.
+ */
+export declare function link(db: Realm.Database, options: link.Options): Promise<string | undefined>;
+export declare namespace link {
+    type Options = {
+        /** The passkey that wallet.tempo returned, which the assertion verified. */
+        credential: {
+            /** The address that the public key derives. */
+            address: string;
+            /** When wallet.tempo created the passkey, in milliseconds, or `null` when it has no time. */
+            createdAt: number | null;
+            /** The uncompressed P256 public key, hex. */
+            publicKey: Hex.Hex;
+        };
+        /** The credential ID, base64url. */
+        id: string;
+        /** The relying party of the passkey: the `default` realm's, which wallet.tempo shares. */
+        rpId: string;
+        /** The user the passkey links to. */
+        userId: string;
+    };
+}
+/**
+ * Returns the passkeys that the user with `userId` holds, of every relying party, oldest first. Each
+ * entry marks whether it counts toward {@link registrationLimit}, as {@link registered} counts it, so
+ * one read serves both the limit and the passkeys that a new registration excludes.
+ */
+export declare function list(db: Realm.Database, options: list.Options): Promise<{
+    id: string;
+    registered: boolean;
+    rpId: string;
+}[]>;
+export declare namespace list {
+    type Options = {
+        /** The user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Instantiates a passkey sign-in plugin for Better Auth. Its server-only `signInPasskey` endpoint
+ * creates a session for a user whose assertion a route verified, and sets the session cookie. Like
+ * every sign-in, it continues an app's authorization that `oauth_query` names.
+ */
+export declare function plugin(): {
+    endpoints: {
+        signInPasskey: import("better-auth").StrictEndpoint<string, {
+            body: z.ZodObject<{
+                oauth_query: z.ZodOptional<z.ZodString>;
+                user: z.ZodOptional<z.ZodObject<{
+                    createdAt: z.ZodDate;
+                    email: z.ZodString;
+                    emailVerified: z.ZodBoolean;
+                    id: z.ZodString;
+                    image: z.ZodNullable<z.ZodString>;
+                    name: z.ZodString;
+                    updatedAt: z.ZodDate;
+                }, z.core.$strip>>;
+                userId: z.ZodString;
+            }, z.core.$strip>;
+            method: "POST";
+        }, {
+            user: {
+                email: string;
+                id: string;
+            };
+        }>;
+    };
+    id: "tempo-id-passkey";
+};
+/**
+ * Returns how many passkeys the user with `userId` registered, of {@link registrationLimit} at most.
+ */
+export declare function registered(db: Realm.Database, options: registered.Options): Promise<number>;
+export declare namespace registered {
+    type Options = {
+        /** The user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Stores a passkey that the user with `userId` registered, once `verifyRegistration` accepted its
+ * credential and `verify` its proof. Like a linked wallet.tempo passkey, it signs in, and owns the
+ * Tempo Account at the address that its public key derives. It never replaces a stored row. Returns:
+ *
+ * - `stored` once it stores the passkey.
+ * - `held` when Tempo ID already stores the credential ID or the address.
+ * - `limit` when the user holds {@link registrationLimit} registered passkeys.
+ * - `stale` when the `default` realm's relying party is no longer the challenge's.
+ */
+export declare function register(db: Realm.Database, options: register.Options): Promise<'held' | 'limit' | 'stale' | 'stored'>;
+export declare namespace register {
+    type Options = {
+        /** The credential ID, base64url. */
+        id: string;
+        /** The uncompressed P256 public key that the attestation holds, and the proof verified, hex. */
+        publicKey: Hex.Hex;
+        /** The relying party of the `default` realm, which the challenge was issued for. */
+        rpId: string;
+        /** The user who registers the passkey. */
+        userId: string;
+    };
+}
+/**
+ * Returns the first of `realms` that holds passkeys which can sign in at `origin`, and at `page`
+ * when given, with its relying party ID, or `undefined` when none can. A WebAuthn ceremony runs
+ * only at an origin whose host is the relying party ID or one of its subdomains.
+ */
+export declare function relyingParty(realms: readonly Realm.Realm[], options: relyingParty.Options): {
+    realmId: string;
+    rpId: string;
+} | undefined;
+export declare namespace relyingParty {
+    type Options = {
+        /** Tempo ID's own origin. */
+        origin: string;
+        /**
+         * The origin of the app's page that runs the ceremony, if any. The relying party must cover it
+         * and Tempo ID's origin both, so the page shares a site with Tempo ID, and the browser sends the
+         * session cookie on the page's requests after the sign-in.
+         */
+        page?: string | undefined;
+    };
+}
+/**
+ * Issues a random challenge for the new passkey `credential` to sign, stores it with the passkey
+ * until it expires, and returns it as hex. Only the user with `userId` spends it. The attestation
+ * of format `none` carries no signature, so only this assertion proves that the user holds the
+ * passkey's private key.
+ */
+export declare function requestProof(db: Realm.Database, options: requestProof.Options): Promise<`0x${string}`>;
+export declare namespace requestProof {
+    type Options = {
+        /** The new passkey, as `verifyRegistration` returned it. */
+        credential: {
+            /** The credential ID, base64url. */
+            id: string;
+            /** The uncompressed P256 public key that the attestation holds, hex. */
+            publicKey: Hex.Hex;
+        };
+        /** The relying party of the `default` realm, which the new passkey belongs to. */
+        rpId: string;
+        /** The signed-in user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Issues a random challenge for the registration of a passkey of `rpId` by the user with `userId`,
+ * stores it until it expires, and returns it as hex. Only that user spends it.
+ */
+export declare function requestRegistration(db: Realm.Database, options: requestRegistration.Options): Promise<`0x${string}`>;
+export declare namespace requestRegistration {
+    type Options = {
+        /** The relying party of the `default` realm, which the new passkey must belong to. */
+        rpId: string;
+        /** The signed-in user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Stores the digest of a key authorization as the challenge of a signature by `credential`, until it
+ * expires. Only the user with `userId` spends it, for the same account, app, and passkey.
+ */
+export declare function requestSignature(db: Realm.Database, options: requestSignature.Options): Promise<void>;
+export declare namespace requestSignature {
+    type Options = {
+        /** The address of the Tempo Account that the key acts for. */
+        account: string;
+        /** The client ID of the app that requests the key. */
+        clientId: string;
+        /** The passkey that must sign: the account's owner. */
+        credential: Owner.Credential;
+        /** The digest of the key authorization, as hex. */
+        digest: Hex.Hex;
+        /** The signed-in user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Encrypts a deferred link with a key derived from `secret`, for the link cookie. The cookie cannot
+ * be read, changed, or forged without the secret.
+ */
+export declare function seal(value: Link, options: seal.Options): Promise<string>;
+export declare namespace seal {
+    type Options = {
+        /** The `SECRET` variable. */
+        secret: string;
+    };
+}
+/**
+ * Spends the challenge that `clientDataJSON` names, and returns it, or `undefined` when it is
+ * unknown, spent, or expired. One statement deletes and returns the row, so two concurrent
+ * assertions over one challenge cannot both spend it.
+ */
+export declare function take(db: Realm.Database, options: take.Options): Promise<Challenge | undefined>;
+export declare namespace take {
+    type Options = {
+        /** The assertion's client data, as the JSON string the browser collected. */
+        clientDataJSON: string;
+    };
+}
+/**
+ * Spends the challenge that `clientDataJSON` names, as {@link take} does, and returns it with the
+ * passkey with the credential `id` at the challenge's relying party and that passkey's user, in one
+ * statement. The challenge is spent whether or not the passkey exists. Returns `undefined` when the
+ * challenge is unknown, spent, or expired, and no `key` when Tempo ID stores no such passkey.
+ */
+export declare function takeWithKey(db: Realm.Database, options: takeWithKey.Options): Promise<takeWithKey.ReturnType | undefined>;
+export declare namespace takeWithKey {
+    type Options = take.Options & {
+        /** The credential ID of the passkey that signed the assertion, base64url. */
+        id: string;
+    };
+    type ReturnType = {
+        /** The spent challenge. */
+        challenge: Challenge;
+        /**
+         * The passkey with the credential ID at the challenge's relying party, with its user, or
+         * `undefined` when Tempo ID stores none.
+         */
+        key: {
+            /** The credential ID, base64url. */
+            id: string;
+            /** The uncompressed P256 public key, hex. */
+            publicKey: string;
+            /** The user that the passkey signs in. */
+            user: typeof Schema.user.$inferSelect;
+            /** The ID of that user. */
+            userId: string;
+        } | undefined;
+    };
+}
+/**
+ * Spends the proof challenge that `clientDataJSON` names for the user with `userId`, and returns it
+ * with the new passkey, or `undefined` when it is unknown, spent, expired, or another user's. One
+ * statement deletes and returns the row, so two concurrent proofs cannot both spend it.
+ */
+export declare function takeProof(db: Realm.Database, options: takeProof.Options): Promise<ProofChallenge | undefined>;
+export declare namespace takeProof {
+    type Options = {
+        /** The assertion's client data, as the JSON string the browser collected. */
+        clientDataJSON: string;
+        /** The signed-in user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Spends the registration challenge that `clientDataJSON` names for the user with `userId`, and
+ * returns it, or `undefined` when it is unknown, spent, expired, or another user's. One statement
+ * deletes and returns the row, so two concurrent registrations over one challenge cannot both
+ * spend it.
+ */
+export declare function takeRegistration(db: Realm.Database, options: takeRegistration.Options): Promise<RegistrationChallenge | undefined>;
+export declare namespace takeRegistration {
+    type Options = {
+        /** The credential's client data, base64url, as the browser collected it. */
+        clientDataJSON: string;
+        /** The signed-in user's ID. */
+        userId: string;
+    };
+}
+/**
+ * Records the assertion of a sign-in with key signature on an app's page as spent until `expiry`, once it
+ * verified, and returns whether neither a sign-in nor a signature spent it before. The assertion
+ * becomes public once its key reaches the chain, and an app's challenge can repeat its digest, so
+ * the record holds whatever signs the key, and also when the authorization fails.
+ */
+export declare function spendSignIn(db: Realm.Database, options: spendSignIn.Options): Promise<boolean>;
+export declare namespace spendSignIn {
+    type Options = {
+        /** The assertion's authenticator data, as hex. */
+        authenticatorData: Hex.Hex;
+        /**
+         * When the key that the assertion signs expires, in Unix seconds. The record lasts until then,
+         * for a year at most.
+         */
+        expiry: number;
+        /** The assertion's signature, as hex. */
+        signature: Hex.Hex;
+    };
+}
+/**
+ * Records the assertion of a sign-in with key signature as a spent signature until `expiry`, for a year at
+ * most, and returns whether no signature spent it before. The sign-in's challenge was the key's
+ * digest, so no signature challenge precedes it, and the caller verifies the assertion over that
+ * digest first. It takes the lock of {@link takeSignature}, so an approval that repeats the
+ * assertion records it once.
+ */
+export declare function spendSignature(db: Realm.Database, options: spendSignature.Options): Promise<boolean>;
+export declare namespace spendSignature {
+    type Options = spendSignIn.Options;
+}
+/**
+ * Spends the signature challenge that `clientDataJSON` names, for the user, app, account, and
+ * passkey of `options`, and returns it, or `undefined` when it is unknown, spent, or expired. One
+ * statement deletes and returns the rows, so two concurrent assertions over one challenge cannot
+ * both spend it, and an approval for another app, account, or passkey spends none of its rows.
+ *
+ * Returns the challenge only when `verify` accepts it with the assertion. Every step for the same
+ * key issues the same digest, so the transaction then records the assertion as spent until
+ * `expiry`, for a year at most, and returns `undefined` for an assertion that it recorded before. A captured assertion
+ * thus signs no second approval, and an assertion that does not verify leaves no record.
+ */
+export declare function takeSignature(db: Realm.Database, options: takeSignature.Options): Promise<SignatureChallenge | undefined>;
+export declare namespace takeSignature {
+    type Options = {
+        /** The address of the Tempo Account that the key acts for. */
+        account: string;
+        /** The assertion's authenticator data, as hex. */
+        authenticatorData: Hex.Hex;
+        /** The client ID of the app that requests the key. */
+        clientId: string;
+        /** The assertion's client data, as the JSON string the browser collected. */
+        clientDataJSON: string;
+        /** The credential ID of the passkey that signed, base64url. */
+        credentialId: string;
+        /**
+         * When the key expires, in Unix seconds. The spent assertion stays recorded until then, for a
+         * year at most.
+         */
+        expiry: number;
+        /** The assertion's signature, as hex. */
+        signature: Hex.Hex;
+        /** The signed-in user's ID. */
+        userId: string;
+        /**
+         * Returns whether the assertion verifies over the spent challenge, for the account, app, and
+         * passkey that it names. It runs in the transaction, so it performs no I/O.
+         */
+        verify: (challenge: SignatureChallenge) => boolean;
+    };
+}
+/**
+ * Decrypts the link cookie's value, and returns the deferred link, or `undefined` when the value
+ * does not decrypt with `secret`, has another shape, came from another host, or expired.
+ */
+export declare function unseal(sealed: string, options: unseal.Options): Promise<{
+    address: string;
+    createdAt: number | null;
+    expiresAt: number;
+    host: string;
+    id: string;
+    nonce: string;
+    publicKey: `0x${string}`;
+    rpId: string;
+} | undefined>;
+export declare namespace unseal {
+    type Options = {
+        /** The host that serves the request, which must be the one that sealed the link. */
+        host: string;
+        /** The `SECRET` variable. */
+        secret: string;
+    };
+}
+/**
+ * Returns whether `assertion` signs `challenge` with `publicKey`, at `origin`, for `rpId`, with the
+ * user present and verified, outside a cross-origin iframe. The client cannot waive user
+ * verification.
+ */
+export declare function verify(assertion: Assertion, options: verify.Options): boolean;
+export declare namespace verify {
+    type Options = {
+        /** The challenge that Tempo ID issued, as hex. */
+        challenge: Hex.Hex;
+        /** The origin the ceremony must report: Tempo ID's own, or the app's page that the challenge names. */
+        origin: string;
+        /** The passkey's uncompressed P256 public key, hex. */
+        publicKey: Hex.Hex;
+        /** The relying party ID the challenge was issued for. */
+        rpId: string;
+    };
+}
+/**
+ * Returns the credential ID and public key of the passkey that `credential` creates, or `undefined`
+ * when it does not create one over `challenge`, at `origin`, for `rpId`, with the user present and
+ * verified, outside a cross-origin iframe. The public key comes from the attestation object. An
+ * attestation of format `none` passes, as most authenticators return no other. It proves nothing
+ * about the private key, so the passkey must then sign a proof challenge from `requestProof`.
+ */
+export declare function verifyRegistration(credential: Credential, options: verifyRegistration.Options): {
+    id: string;
+    publicKey: `0x${string}`;
+} | undefined;
+export declare namespace verifyRegistration {
+    type Options = {
+        /** The registration challenge that Tempo ID issued, as hex. */
+        challenge: Hex.Hex;
+        /** The origin the ceremony must report: Tempo ID's own. */
+        origin: string;
+        /** The relying party ID the challenge was issued for. */
+        rpId: string;
+    };
+}
+export {};
+//# sourceMappingURL=Passkey.d.ts.map