@tempoxyz/id 0.0.1 → 0.0.2

package/src/api/authorize.ts

@@ -45,17 +45,17 @@ namespace schema {
           .union([
             z.literal(true).meta({
               description:
-                "Requests the passkey step for an account that a passkey owns, in place of `webauthn_required`. The passkey's relying party must cover the page's origin.",
+                "Returns a passkey step for a passkey-owned account, in place of `webauthn_required`. The passkey's relying party must cover the page's origin.",
             }),
             z.object({ assertion: Passkey.schema.assertion }).meta({
               description:
-                "The passkey's assertion over the options of the passkey step. The repeated request signs the key with it.",
+                "The passkey's assertion over the passkey step's challenge, which signs the key.",
             }),
           ])
           .optional()
           .meta({
             description:
-              "Whether the app's page signs the key with the passkey that owns the account. Absent, a passkey-owned account refuses the key with `webauthn_required`.",
+              "Whether the page can sign the key with the account's passkey. Without it, a passkey-owned account returns `webauthn_required`.",
           }),
       }),
     )
@@ -69,7 +69,7 @@ namespace schema {
     export const json = z.object({
       account: TempoAccount.schema.tempoAccount.shape.address.meta({
         description:
-          "The address of the account that the user selects, one of the user's accounts in the app's realms.",
+          "The address of the selected account, one of the user's accounts in the app's realms.",
         examples: ['0x8C3b5d0e2A4f6B1c9D7e3F5a0B2c4D6e8F1a3B5c'],
       }),
       oauth_query: z
@@ -78,7 +78,7 @@ namespace schema {
         .max(8192)
         .meta({
           description:
-            "The account step's query string, which Better Auth signs when it sends the browser there. At most 8,192 characters.",
+            "The signed query string of the account page, which names the app's pending authorization request.",
           examples: [
             'client_id=Qk3vT9xZbLmN2pRw8YcHjF6sDaE4uGtK&response_type=code&exp=1760000000&sig=Gx3kB0',
           ],
@@ -88,7 +88,7 @@ namespace schema {
         .optional()
         .meta({
           description:
-            "The passkey's assertion over the options of the passkey step, which the selection of a passkey-owned account returns. The repeated selection signs the key with it.",
+            "The passkey's assertion over the passkey step's challenge, which signs the key.",
         }),
     })
 
@@ -97,7 +97,7 @@ namespace schema {
         .object({
           redirect: z.string().meta({
             description:
-              "Where the browser continues: the approval page's path on Tempo ID, or the app's `redirect_uri` with an authorization code and `state`.",
+              "The URL to send the browser to next: the approval page, or the app's `redirect_uri` with a code.",
             examples: [
               'https://app.example.com/callback?code=Vb7mQ2xLkP9sTzR4&state=af0ifjsldkj',
             ],
@@ -115,12 +115,12 @@ namespace schema {
     export const json = z.object({
       accept: z.boolean().meta({
         description:
-          'Whether the user approves the request. `false` denies it, and the app receives `access_denied`.',
+          'Whether the user approves the request. `false` returns `access_denied` to the app.',
         examples: [true],
       }),
       account: TempoAccount.schema.tempoAccount.shape.address.optional().meta({
         description:
-          "The Tempo Account that the approval page showed for the request's key authorization, one of the user's accounts in the app's realms. Ignored when the key names its account, and absent for a request without a key.",
+          'The Tempo Account that signs the key, as the approval page showed it. Ignored if the key names its account.',
         examples: ['0x8C3b5d0e2A4f6B1c9D7e3F5a0B2c4D6e8F1a3B5c'],
       }),
       oauth_query: z
@@ -129,7 +129,7 @@ namespace schema {
         .max(8192)
         .meta({
           description:
-            "The approval page's query string, which Better Auth signs when it sends the browser there. At most 8,192 characters.",
+            "The signed query string of the approval page, which names the app's pending authorization request.",
           examples: [
             'client_id=Qk3vT9xZbLmN2pRw8YcHjF6sDaE4uGtK&response_type=code&exp=1760000000&sig=Gx3kB0',
           ],
@@ -139,7 +139,7 @@ namespace schema {
         .optional()
         .meta({
           description:
-            "The passkey's assertion over the options of the passkey step, which a passkey-owned account's approval returns. The repeated approval signs the key with it.",
+            "The passkey's assertion over the passkey step's challenge, which signs the key.",
         }),
       session_id: z
         .string()
@@ -147,7 +147,7 @@ namespace schema {
         .max(256)
         .meta({
           description:
-            'The ID of the session that the approval page showed. The decision applies only while that session is the signed-in one.',
+            'The session ID that the approval page showed. The decision fails if another session signed in since.',
           examples: ['8nVq3kZ0bT5wXy2mLp7sR4dA'],
         }),
       skip_upgrade: z
@@ -155,7 +155,7 @@ namespace schema {
         .optional()
         .meta({
           description:
-            "Whether the approval skips the pending upgrade of a wallet.tempo passkey's wallet on the key's chain, `false` by default. The passkey then signs the key as its own account, and the key stops working on that chain once the wallet upgrades, unless the chain registered it first.",
+            "Whether to sign the key before a pending upgrade of the wallet.tempo passkey's account. The key then stops working after the upgrade, unless the upgrade registers it.",
           examples: [true],
         }),
     })
@@ -167,7 +167,7 @@ namespace schema {
         .object({
           redirect: z.url().meta({
             description:
-              "The app's `redirect_uri`, with an authorization code and `state`, or with `error=access_denied` when the user denied the request.",
+              "The app's `redirect_uri`, with a code, or with `error=access_denied` for a denial.",
             examples: [
               'https://app.example.com/callback?code=Vb7mQ2xLkP9sTzR4&state=af0ifjsldkj',
             ],
@@ -186,7 +186,7 @@ namespace schema {
         .max(8192)
         .meta({
           description:
-            "The approval page's query string, which Better Auth signs when it sends the browser there. At most 8,192 characters.",
+            "The signed query string of the approval page, which names the app's pending authorization request.",
           examples: [
             'client_id=Qk3vT9xZbLmN2pRw8YcHjF6sDaE4uGtK&response_type=code&exp=1760000000&sig=Gx3kB0',
           ],
@@ -198,15 +198,14 @@ namespace schema {
         .object({
           redirect: z.url().meta({
             description:
-              "The app's `redirect_uri`, with the refusal of the request's key as `error` and `error_description`, `state`, and `iss`.",
+              "The app's `redirect_uri`, with the key's refusal as `error` and `error_description`.",
             examples: [
               'https://app.example.com/callback?error=invalid_request&state=af0ifjsldkj',
             ],
           }),
         })
         .meta({
-          description:
-            'A key that Tempo ID refuses, which returns the browser to the app.',
+          description: 'A refused key, which returns the browser to the app.',
         }),
       z
         .object({
@@ -225,16 +224,16 @@ namespace schema {
                 .optional()
                 .meta({
                   description:
-                    "The Tempo Account that the approval applies to: the account that the key names, else the app's selected account, else the user's oldest. Present only when the user holds more than one account in the app's realms.",
+                    "The Tempo Account that the approval applies to. Present only if the user has more than one account in the app's realms.",
                 }),
               app: z.string().meta({
                 description:
-                  "The app's display name, or the host of its redirect URI without one.",
+                  "The app's display name, or the host of its redirect URI if it has none.",
                 examples: ['Tempo Cash'],
               }),
               destination: z.string().meta({
                 description:
-                  "The host of the app's redirect URI, or its scheme for a native app. For a third-party app, the host that serves its metadata document.",
+                  "The host of the app's redirect URI, or its scheme for a native app. For a third-party app, the host of its metadata document.",
                 examples: ['cash.tempo.xyz'],
               }),
               email: z.email().meta({
@@ -255,7 +254,7 @@ namespace schema {
                         }),
                       name: Chain.schema.optional().meta({
                         description:
-                          'The name that `GET /v1/chains` lists for the chain. Absent for a chain that no name lists.',
+                          "The chain's name in `GET /v1/chains`. Absent for an unlisted chain.",
                         examples: ['testnet'],
                       }),
                     })
@@ -265,7 +264,7 @@ namespace schema {
                     .optional()
                     .meta({
                       description:
-                        "The message that the key's witness binds, such as a sign-in challenge from the app. Absent when the request carries none.",
+                        "The message that the key's witness binds, such as a sign-in challenge from the app.",
                       examples: [
                         'Sign in to app.example.com\nNonce: 7f3a9c2e5b1d4f60',
                       ],
@@ -275,7 +274,7 @@ namespace schema {
                 .optional()
                 .meta({
                   description:
-                    'What the key that the request carries may do, and the account that approval signs for. Absent for a request without a key.',
+                    "The requested key's permissions, and the account that signs it. Absent without a key.",
                 }),
               logo: z
                 .string()
@@ -283,24 +282,24 @@ namespace schema {
                 .optional()
                 .meta({
                   description:
-                    "The app's logo as a `data:` URL, which Tempo ID fetched from the origin of its client ID. Present only for an app with an origin client ID whose manifest or page names a logo.",
+                    "The app's logo, as a `data:` URL. Present only for a third-party app whose site names a logo.",
                   examples: ['data:image/png;base64,iVBORw0KGgo='],
                 }),
               session: z.string().meta({
                 description:
-                  'The ID of the signed-in session, which `POST /v1/authorize/consent` names.',
+                  'The ID of the signed-in session, to send to `POST /v1/authorize/consent`.',
                 examples: ['8nVq3kZ0bT5wXy2mLp7sR4dA'],
               }),
               verified: z.boolean().meta({
                 description:
-                  'Whether the app is a registered app, whose name the page marks as verified. A third-party app names itself in its metadata document.',
+                  'Whether the app is a registered app, which the page marks as verified.',
                 examples: [true],
               }),
             })
             .nullable()
             .meta({
               description:
-                'The request that the approval page shows, or `null` for a forged or expired query, or a request without a known app.',
+                'The request, or `null` for an invalid query or an unknown app.',
             }),
         })
         .meta({ description: 'The request that the approval page shows.' }),
@@ -328,7 +327,7 @@ namespace schema {
                 }),
                 balance: Balance.schema.balance.nullable().meta({
                   description:
-                    "The account's holdings of USD tokens on the chain of the request's key, or of Tempo mainnet without one. `null` when the read fails or takes longer than 3 seconds.",
+                    "The account's USD balance on the key's chain, or on Tempo mainnet without a key. `null` if the balance cannot be read.",
                 }),
                 owner:
                   TempoAccount.schema.tempoAccount.shape.config.shape.owners.unwrap()
@@ -356,7 +355,7 @@ namespace schema {
         .nullable()
         .meta({
           description:
-            'The account step, or `null` for a forged or expired query, or a request without a known app.',
+            'The account step, or `null` for an invalid query or an unknown app.',
         }),
     })
   }
@@ -535,7 +534,7 @@ export const authorize = new Hono<Env>()
     '/v1/authorize',
     OpenApi.describeRoute({
       description:
-        "Authorizes the app for the signed-in user without a redirect, from a first-party app's page on the redirect URI's origin. It returns a code with `code_challenge`, or tokens to a public app without one, and signs any key within the headless ceiling. With `passkey: true`, a passkey-owned account returns the passkey step, and the repeated request with `passkey: { assertion }` and the step's `expiry` signs the key.",
+        "Headless authorization: authorizes the app from a first-party app's page without a redirect, and returns a code or tokens with any signed key. With `passkey: true`, a passkey-owned account first returns a passkey step, and the repeat with its assertion signs the key.",
       responses: OpenApi.responses({
         errors: [
           ...Authorize.check.errors,
@@ -614,7 +613,7 @@ export const authorize = new Hono<Env>()
     '/v1/authorize/account',
     OpenApi.describeRoute({
       description:
-        "Selects the account that the app of `oauth_query` uses, and returns the next redirect of the authorization. The selection holds for the app's later authorizations in the session, and `GET /v1/account` lists it first.",
+        "Redirect authorization, account page: selects the Tempo Account that the app uses, and returns the next redirect. The selection holds for the app's later authorizations in the session.",
       responses: OpenApi.responses({
         errors: [
           ...BodyLimit.errors,
@@ -754,7 +753,7 @@ export const authorize = new Hono<Env>()
     '/v1/authorize/consent',
     OpenApi.describeRoute({
       description:
-        "Records the signed-in user's decision on the request in `oauth_query`, stores an approval's consent, and returns the app's redirect. An approval of a key authorization signs the key. If the key names no account and the user holds none, the approval first creates an account.",
+        "Redirect authorization, approval page: records the user's decision, and returns the redirect to the app. An approval stores the consent and signs any key.",
       responses: OpenApi.responses({
         errors: [
           ...Authorize.checkKey.errors,
@@ -891,7 +890,7 @@ export const authorize = new Hono<Env>()
     '/v1/authorize/request',
     OpenApi.describeRoute({
       description:
-        "Reads the authorization request in `oauth_query` as the approval page shows it: the app, the destination, the account, and any key. For a key that Tempo ID refuses, it returns the app's redirect with the refusal.",
+        'Redirect authorization, approval page: returns the app, the Tempo Account, and any key of the request in `oauth_query`. For a refused key, it returns the redirect to the app with the refusal.',
       responses: OpenApi.responses({
         errors: [
           ...OpenApi.validate.errors,
@@ -927,7 +926,7 @@ export const authorize = new Hono<Env>()
     '/i/authorize/request',
     OpenApi.describeRoute({
       description:
-        "Reads the app's authorization request that `oauth_query` carries, as `GET /v1/authorize/request` does, without the account that the approval applies to, the account that approval signs for, or why approval cannot sign the key. The read holds no account, so it does not count against the user's `ACCOUNT_LIMIT`. Internal: only Tempo ID's approval page sends the request, so the public document leaves it out.",
+        "Returns the request in `oauth_query`, as `GET /v1/authorize/request` does, without its accounts. Internal to Tempo ID's approval page.",
       // Internal routes stay out of `/openapi.json` and `/docs`.
       hide: true,
       responses: OpenApi.responses({
@@ -959,7 +958,7 @@ export const authorize = new Hono<Env>()
     '/v1/authorize/accounts',
     OpenApi.describeRoute({
       description:
-        "Reads the account step of the authorization request in `oauth_query`: the app, and the user's accounts in its realms, oldest first. Each account carries its balance on the chain of the request's key, or of Tempo mainnet without a key.",
+        "Redirect authorization, account page: returns the app of the request in `oauth_query`, and the user's Tempo Accounts in its realms with their balances.",
       responses: OpenApi.responses({
         errors: [
           ...AccountStep.accounts.errors,

package/src/api/device.ts

@@ -48,41 +48,39 @@ namespace schema {
             })
             .optional()
             .meta({
-              description:
-                'The app that requested the code. Absent when the app has no display name.',
+              description: 'The app that requested the code.',
             }),
           challenge: z
             .string()
             .optional()
             .meta({
               description:
-                "The message whose EIP-191 hash is the key's witness, which approval signs. Absent when the CLI sent none.",
+                "The message that the key's witness binds, as an EIP-191 message.",
               examples: ['Sign in to app.example.com\nNonce: 7f3a9c2e5b1d4f60'],
             }),
           created_at: z.number().meta({
-            description: 'When the CLI requested the code, in Unix seconds.',
+            description: 'When the device requested the code, in Unix seconds.',
             examples: [1792075800],
           }),
           device: z
             .string()
             .optional()
             .meta({
-              description:
-                'The name that the CLI reported, such as its hostname. Absent for a code from `POST /device/code`.',
+              description: "The device's name, such as its hostname.",
               examples: ['ada-macbook'],
             }),
           ip: z
             .string()
             .optional()
             .meta({
-              description: "The CLI's IP address. Absent when it is unknown.",
+              description: "The device's IP address.",
               examples: ['203.0.113.7'],
             }),
           key_authorization: KeyAuthorization.schema.description
             .extend({
               account: KeyAuthorization.schema.description.shape.account.meta({
                 description:
-                  'The Tempo Account that approval signs for: the one the request names, else the one the user selected for the app, else the oldest. Absent when the request names none and the accounts cannot be read, or the user holds none.',
+                  'The Tempo Account that signs the key. Absent if the user has none, or the accounts cannot be read.',
                 examples: ['0x9a073914db0d149375ac2b7fbb72c68c0780fb5f'],
               }),
               chain: z
@@ -96,40 +94,40 @@ namespace schema {
                     }),
                   name: Chain.schema.optional().meta({
                     description:
-                      'The name that `GET /v1/chains` lists for the chain. Absent for a chain that no name lists.',
+                      "The chain's name in `GET /v1/chains`. Absent for an unlisted chain.",
                     examples: ['testnet'],
                   }),
                 })
                 .optional()
                 .meta({
                   description:
-                    'The chain that the key acts on. Absent once the user decides.',
+                    'The chain that the key acts on. Absent after the user decides.',
                 }),
               refusal: KeySigner.schema.refusal.optional(),
             })
             .optional()
             .meta({
               description:
-                'What the key that the CLI requested may do. Absent when the CLI requested no key.',
+                "The requested key's permissions. Absent without a key.",
             }),
           location: z
             .string()
             .optional()
             .meta({
               description:
-                "The CLI's city and country, from its IP address. Absent when they are unknown.",
+                "The device's city and country, from its IP address.",
               examples: ['Berlin, DE'],
             }),
           status: z.enum(['approved', 'denied', 'pending']).meta({
             description:
-              'Whether the user approved or denied the code. `pending` until the user decides.',
+              'Whether the user approved or denied the code, or `pending`.',
             examples: ['pending'],
           }),
           user_code: z
             .string()
             .meta({ description: 'The user code.', examples: ['WDJB-MJHT'] }),
         })
-        .meta({ description: 'The request that the CLI made with the code.' }),
+        .meta({ description: "The device's request." }),
     })
   }
 
@@ -137,7 +135,7 @@ namespace schema {
     export const json = z.object({
       account: TempoAccount.schema.tempoAccount.shape.address.optional().meta({
         description:
-          "The Tempo Account that the device page showed for the request's key authorization, one of the user's accounts in the app's realms. Ignored when the key names its account, and absent for a request without a key.",
+          'The Tempo Account that signs the key, as the device page showed it. Ignored if the key names its account.',
         examples: ['0x8C3b5d0e2A4f6B1c9D7e3F5a0B2c4D6e8F1a3B5c'],
       }),
       code: z
@@ -149,7 +147,7 @@ namespace schema {
         .optional()
         .meta({
           description:
-            "The passkey's assertion over the options of the passkey step, which a passkey-owned account's approval returns. The repeated approval signs the key with it.",
+            "The passkey's assertion over the passkey step's challenge, which signs the key.",
         }),
     })
 
@@ -160,7 +158,7 @@ namespace schema {
         .object({
           status: z.literal('approved').meta({
             description:
-              'The user approved the code. The CLI receives its tokens, and any signed key, on its next poll.',
+              "The device's next poll returns its tokens and any signed key.",
           }),
         })
         .meta({ description: 'A stored approval.' }),
@@ -173,8 +171,7 @@ namespace schema {
 
     export const response = z.object({
       status: z.literal('denied').meta({
-        description:
-          'The user denied the code. The next poll returns `access_denied`.',
+        description: "The device's next poll returns `access_denied`.",
       }),
     })
   }
@@ -344,7 +341,7 @@ export const device = new Hono<Env>()
     '/v1/device/requests/:code',
     OpenApi.describeRoute({
       description:
-        'Reads the request of a device code for the device page, by its user code. The first signed-in user to read a pending code binds it, so no other user can decide it.',
+        'Device grant, step 2 of 4: returns the request of a user code, as the device page shows it. The first signed-in user to read a pending code binds it.',
       responses: OpenApi.responses({
         errors: [
           ...OpenApi.validate.errors,
@@ -354,7 +351,7 @@ export const device = new Hono<Env>()
           ErrorResponse.CrossSiteRequestError,
         ],
         success: {
-          description: 'What the CLI requested.',
+          description: "The device's request.",
           schema: schema.requests.response,
         },
       }),
@@ -437,7 +434,7 @@ export const device = new Hono<Env>()
     '/v1/device/approve',
     OpenApi.describeRoute({
       description:
-        "Approves a device code for the signed-in user, and the CLI's next poll returns its tokens and any signed key. If the key names no account and the user holds none, the approval first creates an account. Only Tempo ID's device page sends the request.",
+        "Device grant, step 3 of 4: approves the device code, so the device's next poll of `/oauth2/token` returns tokens and any signed key.",
       responses: OpenApi.responses({
         errors: [
           ...BodyLimit.errors,
@@ -485,7 +482,7 @@ export const device = new Hono<Env>()
     '/v1/device/deny',
     OpenApi.describeRoute({
       description:
-        "Denies a device code for the signed-in user, and the CLI's next poll returns `access_denied`. Only Tempo ID's device page sends the request.",
+        "Device grant, step 3 of 4: denies the device code, so the device's next poll of `/oauth2/token` returns `access_denied`.",
       responses: OpenApi.responses({
         errors: [
           ...BodyLimit.errors,

package/src/api/health.ts

@@ -54,8 +54,7 @@ export const health = new Hono<
   .get(
     '/health',
     OpenApi.describeRoute({
-      description:
-        'Responds while the Worker is up, with the version that served the request.',
+      description: 'Returns the version of the Worker that serves the request.',
       responses: OpenApi.responses({
         success: {
           description: 'The Worker is up.',

package/src/api/lib/AccountStep.ts

@@ -71,6 +71,81 @@ export namespace accounts {
   export const errors = TempoAccount.held.errors
 }
 
+/**
+ * Returns every address of the Tempo Accounts that the user holds in the realms of the registered app
+ * with `clientId`, as `TempoAccount.addresses` reads them, for an access token's `tempo_accounts` claim.
+ * It creates no account and never throws for an upstream kind that fails or misses its deadline,
+ * such as Privy during an outage. It logs the failure, and leaves out that kind's addresses.
+ */
+export async function addresses(c: Context<Env>, options: addresses.Options) {
+  // Each Privy read spends the quota that every user shares, so the user's grants count against
+  // `ACCOUNT_LIMIT`, apart from the user's account reads. Only registered apps, which the seeds
+  // list, receive the claim, and each counts on its own, so no other app's loop of refreshes strips
+  // its tokens. Past the limit, the grant leaves out Privy's addresses, and reads Privy no more.
+  const [admitted, reached] = await Promise.all([
+    RateLimit.count(c, {
+      binding: 'ACCOUNT_LIMIT',
+      key: `${options.userId}:${options.clientId}`,
+    }),
+    Timing.measure(c, realms(c, options), 'AccountStep.realms'),
+  ])
+  if (!admitted)
+    Log.warn(c, {
+      fields: { clientId: options.clientId },
+      message:
+        'An access token left out the Privy addresses of a user past the token read limit.',
+    })
+
+  const result = await Timing.measure(
+    c,
+    TempoAccount.addresses(c, {
+      db,
+      env,
+      maxAge: addresses.maxAge,
+      realms: reached,
+      timeout: addresses.timeout,
+      upstream: admitted,
+      userId: options.userId,
+      waitUntil: (promise) => c.executionCtx.waitUntil(promise),
+      warn: (entry) => Log.warn(c, entry),
+    }),
+    'TempoAccount.addresses',
+  )
+  for (const error of result.errors)
+    Log.warn(c, {
+      error,
+      fields: { clientId: options.clientId },
+      message:
+        'An access token left out the addresses of an owner kind that failed to list.',
+    })
+  return result.addresses
+}
+
+export declare namespace addresses {
+  type Options = {
+    /** The app's client ID. */
+    clientId: string
+    /** The user's ID. */
+    userId: string
+  }
+}
+
+export namespace addresses {
+  /**
+   * How old, in seconds, the user's Privy wallets that a grant reads from the data center's cache
+   * may be. A refresh within this time reads Privy no more, and a wallet that Privy creates
+   * elsewhere appears within it.
+   */
+  export const maxAge = 60
+
+  /**
+   * How long each owner kind that reads an upstream service may list, in milliseconds, so a slow
+   * Privy delays no token by more. Privy's own client waits up to 8 seconds for each of two
+   * attempts.
+   */
+  export const timeout = 750
+}
+
 /**
  * Returns whether the first account of a user with `email`, in the realms of the app with
  * `clientId`, waits for the upgrade of a wallet.tempo passkey of the email, as {@link create} reads

package/src/api/lib/Auth.ts

@@ -40,6 +40,12 @@ export const middleware = createMiddleware<Env>(async (c, next) => {
 export function create(c: Context<Env>): core_Auth.Instance {
   return betterAuth(
     core_Auth.options({
+      accounts: (options) =>
+        Timing.measure(
+          c,
+          AccountStep.addresses(c, options),
+          'AccountStep.addresses',
+        ),
       // A request that already chose the account, such as `POST /v1/authorize`, needs no account step.
       // A key names its chain, where each account is listed at its address there, so the step reads
       // the accounts that a selection names.

package/src/api/lib/Cors.ts

@@ -34,6 +34,9 @@ const maxAge = 7200
  */
 const paths = new Set([
   '/v1/account',
+  '/v1/account/passkey',
+  '/v1/account/passkey/options',
+  '/v1/account/passkey/verify',
   '/v1/account/upgrade',
   '/v1/auth/code',
   '/v1/auth/code/verify',

package/src/api/lib/KeySigner.ts

@@ -44,7 +44,7 @@ export namespace schema {
     ])
     .meta({
       description:
-        "Why approval cannot sign the key: the key names another user's account (`foreign_account`), the user holds no account and none can be created (`no_account`), a passkey that this page cannot use owns the account (`passkey`), the accounts could not be read (`unavailable`), or the account must upgrade first (`upgrade`). Absent when approval can sign it.",
+        "Why the approval cannot sign the key: another user's account (`foreign_account`), no account (`no_account`), an unusable passkey (`passkey`), unreadable accounts (`unavailable`), or a pending upgrade (`upgrade`).",
       examples: ['passkey'],
     })
 }