@dexterai/connect 0.1.0 → 0.3.0

package/README.md

@@ -1,16 +1,91 @@
-# @dexterai/connect
+<p align="center">
+  <img src="https://raw.githubusercontent.com/Dexter-DAO/dexter-x402-sdk/main/assets/dexter-wordmark.svg" alt="Dexter" width="360">
+</p>
 
-**Sign in with Dexter** — a passkey connector. Tap your face, you're in.
+<h1 align="center">@dexterai/connect</h1>
 
-Composes [`@dexterai/vault`](https://www.npmjs.com/package/@dexterai/vault). Two entry points:
+<p align="center">
+  <strong>Sign in with Dexter — passkey sign-in for any app. Tap your face, you're in: a non-custodial Dexter Wallet and its live USD balance, in one component.</strong>
+</p>
 
-- `@dexterai/connect` — framework-free relay client + types
-- `@dexterai/connect/react` — `<SignInWithDexter/>` + `useSignInWithDexter()`
+<p align="center">
+  <a href="https://www.npmjs.com/package/@dexterai/connect"><img src="https://img.shields.io/npm/v/@dexterai/connect.svg" alt="npm"></a>
+  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/react-%3E=18-brightgreen.svg" alt="React"></a>
+  <a href="https://www.w3.org/TR/webauthn-2/"><img src="https://img.shields.io/badge/auth-passkey-00FF88" alt="Passkey"></a>
+</p>
 
-Dependencies: `@dexterai/vault` + `react` (peer) **only**. No payment-layer peers — a
-sign-in button must not inherit a payment graph.
+---
 
-## Status
+## What this is
 
-Scaffolding — Milestone 1. Build plan + frozen contracts:
-`dexter-fe/docs/superpowers/plans/2026-06-20-signin-with-dexter-connect.md`.
+A React connector that adds **"Sign in with Dexter"** to any app. One
+`<SignInWithDexter/>` button runs a discoverable passkey ceremony — the user
+taps their face and you get back a session plus their non-custodial **Dexter
+Wallet** (address + live USD balance). No password, no seed phrase, no
+extension.
+
+The user holds their own keys. Nothing here is custodial — only the user's
+passkey moves funds, enforced on-chain. Composes
+[`@dexterai/vault`](https://www.npmjs.com/package/@dexterai/vault); the only
+peer is React.
+
+## Install
+
+```bash
+npm install @dexterai/connect react
+```
+
+## Quick start
+
+```tsx
+import { SignInWithDexter } from '@dexterai/connect/react';
+
+function Header() {
+  return (
+    <SignInWithDexter
+      onSuccess={({ session, vault }) => {
+        // session = auth tokens (camelCase); vault = the Dexter Wallet
+        seatYourSession(session);
+      }}
+    />
+  );
+}
+```
+
+Signed out, it renders a **Sign in with Dexter** button. On success it becomes
+a compact chip — the Dexter Wallet address + **"$X.XX available."**
+
+## Hook (full control)
+
+For your own UI, use the hook directly:
+
+```tsx
+import { useSignInWithDexter } from '@dexterai/connect/react';
+
+const c = useSignInWithDexter();
+await c.signIn();        // run the passkey ceremony
+c.status;                // idle → pending → done → error
+c.vaultAddress;          // the Dexter Wallet address (base58)
+c.usdcBalance;           // USD available (via Dexter's RPC), or null
+c.disconnect();
+```
+
+## What `useSignInWithDexter()` gives you
+
+| Field | What it is |
+|---|---|
+| `signIn()` / `disconnect()` | run the passkey ceremony / clear state |
+| `status` / `isVaultConnected` | `idle→pending→done→error` / connected flag |
+| `session` | auth session tokens (camelCase) |
+| `vaultAddress` / `vaultPda` | the Dexter Wallet address / PDA |
+| `usdcBalance` / `refreshBalance()` | USD available, best-effort via Dexter's RPC |
+| `vault` / `credentialId` / `error` | raw vault payload / credential id / typed error |
+
+## Exports
+
+- `@dexterai/connect` — framework-free: `passkeyLogin()`, `ConnectError`, types.
+- `@dexterai/connect/react` — `<SignInWithDexter/>`, `useSignInWithDexter()`.
+
+## License
+
+MIT

package/dist/chunk-HFG2GUFX.js

@@ -0,0 +1,356 @@
+// src/types.ts
+var ConnectError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+    this.name = "ConnectError";
+  }
+};
+
+// src/base64.ts
+function base64ToBytes(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function base64urlToBytes(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  return base64ToBytes(b64);
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function bytesToBase64url(bytes) {
+  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function compactSignatureToDer(compact) {
+  if (compact.length !== 64) {
+    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
+  }
+  const r = derInteger(compact.subarray(0, 32));
+  const s = derInteger(compact.subarray(32, 64));
+  const body = new Uint8Array(r.length + s.length);
+  body.set(r, 0);
+  body.set(s, r.length);
+  const out = new Uint8Array(2 + body.length);
+  out[0] = 48;
+  out[1] = body.length;
+  out.set(body, 2);
+  return out;
+}
+function derInteger(component) {
+  let start = 0;
+  while (start < component.length - 1 && component[start] === 0) start += 1;
+  let content = component.subarray(start);
+  if (content[0] & 128) {
+    const padded = new Uint8Array(content.length + 1);
+    padded[0] = 0;
+    padded.set(content, 1);
+    content = padded;
+  }
+  const out = new Uint8Array(2 + content.length);
+  out[0] = 2;
+  out[1] = content.length;
+  out.set(content, 2);
+  return out;
+}
+
+// src/relay.ts
+var DEFAULT_API_BASE = "https://api.dexter.cash";
+var ANON_SIGN_BASE = "/api/passkey-anon/sign";
+async function passkeyLogin(config = {}) {
+  const apiBase = (config.apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
+  const options = await fetchLoginChallenge(apiBase);
+  const credential = await getAssertion(options);
+  return submitLogin(apiBase, credential);
+}
+async function fetchLoginChallenge(apiBase) {
+  const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/login-challenge`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: "{}"
+  });
+  if (!res.ok) {
+    throw new ConnectError("login_challenge_failed", `login-challenge ${res.status}`);
+  }
+  const data = await res.json();
+  if (!data?.options?.challenge) {
+    throw new ConnectError("login_challenge_malformed", "no challenge in response");
+  }
+  return data.options;
+}
+async function getAssertion(options) {
+  if (typeof navigator === "undefined" || !navigator.credentials) {
+    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
+  }
+  let credential;
+  try {
+    credential = await navigator.credentials.get({
+      publicKey: {
+        challenge: base64urlToBytes(options.challenge).buffer.slice(0),
+        rpId: options.rpId,
+        timeout: options.timeout ?? 6e4,
+        userVerification: options.userVerification ?? "required"
+        // No allowCredentials — discoverable resident-key login.
+      }
+    });
+  } catch (err) {
+    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
+  }
+  if (!credential || credential.type !== "public-key") {
+    throw new ConnectError("no_credential", "WebAuthn returned no credential");
+  }
+  return credential;
+}
+async function submitLogin(apiBase, credential) {
+  const assertion = credential.response;
+  const credentialJson = {
+    id: credential.id,
+    rawId: bytesToBase64url(new Uint8Array(credential.rawId)),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64url(new Uint8Array(assertion.clientDataJSON)),
+      authenticatorData: bytesToBase64url(new Uint8Array(assertion.authenticatorData)),
+      signature: bytesToBase64url(new Uint8Array(assertion.signature)),
+      userHandle: assertion.userHandle ? bytesToBase64url(new Uint8Array(assertion.userHandle)) : null
+    },
+    clientExtensionResults: credential.getClientExtensionResults?.() ?? {}
+  };
+  const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/passkey-login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ credential: credentialJson })
+  });
+  if (!res.ok) {
+    throw new ConnectError(await readErrorCode(res), `passkey-login ${res.status}`);
+  }
+  const data = await res.json();
+  const session = {
+    accessToken: data.accessToken,
+    refreshToken: data.refreshToken,
+    expiresAt: data.expiresAt,
+    expiresIn: data.expiresIn,
+    tokenType: data.tokenType
+  };
+  return data.vault ? { session, vault: data.vault } : { session };
+}
+async function readErrorCode(res) {
+  try {
+    const body = await res.json();
+    if (body?.error) return body.error;
+  } catch {
+  }
+  return `http_${res.status}`;
+}
+
+// src/anon-policy.ts
+var DEFAULT_API_BASE2 = "https://api.dexter.cash";
+var ANON_SIGN_BASE2 = "/api/passkey-anon/sign";
+function createAnonServerPolicy(apiBase = DEFAULT_API_BASE2) {
+  const base = apiBase.replace(/\/$/, "");
+  return {
+    async issueChallenge({ userHandle, operationHash }) {
+      const res = await fetch(`${base}${ANON_SIGN_BASE2}/challenge`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          userHandle: bytesToBase64url(userHandle),
+          operationHash: bytesToBase64url(operationHash)
+        })
+      });
+      if (!res.ok) throw new ConnectError(await readErrorCode2(res), `challenge ${res.status}`);
+      const data = await res.json();
+      const options = data?.options;
+      if (!options?.challenge) {
+        throw new ConnectError("challenge_malformed", "no challenge in response");
+      }
+      const cred = options.allowCredentials?.[0];
+      if (!cred?.id) {
+        throw new ConnectError("no_credential", "no allow-listed credential for this userHandle");
+      }
+      return {
+        challenge: base64urlToBytes(options.challenge),
+        credentialId: base64urlToBytes(cred.id),
+        rpId: options.rpId,
+        transports: cred.transports
+      };
+    },
+    async verify({ userHandle, credentialId, signature, clientDataJSON, authenticatorData }) {
+      const credential = {
+        id: bytesToBase64url(credentialId),
+        rawId: bytesToBase64url(credentialId),
+        type: "public-key",
+        response: {
+          clientDataJSON: bytesToBase64url(clientDataJSON),
+          authenticatorData: bytesToBase64url(authenticatorData),
+          // SDK 0.19 passes the COMPACT sig; dexter-api's verifier wants DER.
+          signature: bytesToBase64url(compactSignatureToDer(signature)),
+          userHandle: null
+        },
+        clientExtensionResults: {},
+        authenticatorAttachment: null
+      };
+      const res = await fetch(`${base}${ANON_SIGN_BASE2}/verify`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ credential, userHandle: bytesToBase64url(userHandle) })
+      });
+      if (!res.ok) throw new ConnectError(await readErrorCode2(res), `verify ${res.status}`);
+      const data = await res.json();
+      if (data?.verified === false) {
+        throw new ConnectError("verification_failed", "server returned verified=false");
+      }
+    }
+  };
+}
+async function readErrorCode2(res) {
+  try {
+    const body = await res.json();
+    if (body?.error) return body.error;
+  } catch {
+  }
+  return `http_${res.status}`;
+}
+
+// src/signer.ts
+import { DexterApiBrowserPasskeySigner } from "@dexterai/vault/signers/browser";
+function createPasskeySigner(vault, apiBase, opts = {}) {
+  return new DexterApiBrowserPasskeySigner({
+    identity: { kind: "guest", userHandle: base64urlToBytes(vault.userHandle) },
+    publicKey: base64ToBytes(vault.publicKey),
+    anonPolicy: createAnonServerPolicy(apiBase),
+    ...opts.__assertion ? { __assertion: opts.__assertion } : {}
+  });
+}
+
+// src/walletStore.ts
+var ACTIVE_HANDLE_KEY = "dexter:passkey:userHandle";
+var ROSTER_KEY = "dexter:passkey:wallets";
+var listeners = /* @__PURE__ */ new Set();
+function hasStorage() {
+  try {
+    return typeof window !== "undefined" && !!window.localStorage;
+  } catch {
+    return false;
+  }
+}
+function readRoster() {
+  if (!hasStorage()) return [];
+  try {
+    const raw = window.localStorage.getItem(ROSTER_KEY);
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter(
+      (w) => !!w && typeof w === "object" && typeof w.handle === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+function writeRoster(wallets) {
+  if (!hasStorage()) return;
+  try {
+    window.localStorage.setItem(ROSTER_KEY, JSON.stringify(wallets));
+  } catch {
+  }
+}
+function emit() {
+  for (const l of listeners) {
+    try {
+      l();
+    } catch {
+    }
+  }
+}
+function getActiveHandle() {
+  if (!hasStorage()) return null;
+  try {
+    return window.localStorage.getItem(ACTIVE_HANDLE_KEY);
+  } catch {
+    return null;
+  }
+}
+function setActiveHandle(handle, label) {
+  if (!hasStorage() || !handle) return;
+  try {
+    window.localStorage.setItem(ACTIVE_HANDLE_KEY, handle);
+  } catch {
+    return;
+  }
+  const roster = readRoster();
+  const existing = roster.find((w) => w.handle === handle);
+  const now = Date.now();
+  if (existing) {
+    existing.lastUsedAt = now;
+    if (label !== void 0) existing.label = label;
+  } else {
+    roster.push({ handle, label, lastUsedAt: now });
+  }
+  writeRoster(roster);
+  emit();
+}
+function ejectActiveWallet(opts) {
+  if (!hasStorage()) return;
+  const current = getActiveHandle();
+  try {
+    window.localStorage.removeItem(ACTIVE_HANDLE_KEY);
+  } catch {
+  }
+  if (opts?.forget && current) {
+    writeRoster(readRoster().filter((w) => w.handle !== current));
+  }
+  emit();
+}
+function listWallets() {
+  return readRoster().sort((a, b) => (b.lastUsedAt ?? 0) - (a.lastUsedAt ?? 0));
+}
+function switchWallet(handle) {
+  if (!readRoster().some((w) => w.handle === handle)) return false;
+  setActiveHandle(handle);
+  return true;
+}
+function forgetWallet(handle) {
+  if (getActiveHandle() === handle) {
+    ejectActiveWallet({ forget: true });
+    return;
+  }
+  writeRoster(readRoster().filter((w) => w.handle !== handle));
+  emit();
+}
+function subscribe(listener) {
+  listeners.add(listener);
+  if (hasStorage() && listeners.size === 1) {
+    window.addEventListener("storage", onStorageEvent);
+  }
+  return () => {
+    listeners.delete(listener);
+    if (hasStorage() && listeners.size === 0) {
+      window.removeEventListener("storage", onStorageEvent);
+    }
+  };
+}
+function onStorageEvent(e) {
+  if (e.key === ACTIVE_HANDLE_KEY || e.key === ROSTER_KEY || e.key === null) emit();
+}
+var ACTIVE_WALLET_STORAGE_KEY = ACTIVE_HANDLE_KEY;
+
+export {
+  ConnectError,
+  passkeyLogin,
+  createAnonServerPolicy,
+  createPasskeySigner,
+  getActiveHandle,
+  setActiveHandle,
+  ejectActiveWallet,
+  listWallets,
+  switchWallet,
+  forgetWallet,
+  subscribe,
+  ACTIVE_WALLET_STORAGE_KEY
+};

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { D as DexterConnectConfig, S as SignInResult } from './types-DT3KPBOE.js';
-export { C as ConnectError, a as ConnectVault, P as PasskeyLoginTokens } from './types-DT3KPBOE.js';
+import { D as DexterConnectConfig, S as SignInResult, C as ConnectVault } from './walletStore-CWXhXuzK.js';
+export { A as ACTIVE_WALLET_STORAGE_KEY, a as ConnectError, P as PasskeyLoginTokens, b as StoredWallet, e as ejectActiveWallet, f as forgetWallet, g as getActiveHandle, l as listWallets, s as setActiveHandle, c as subscribeWallet, d as switchWallet } from './walletStore-CWXhXuzK.js';
+import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
 
 /**
  * "Sign in with Dexter" — the discoverable-credential login ceremony.
@@ -16,4 +17,63 @@ export { C as ConnectError, a as ConnectVault, P as PasskeyLoginTokens } from '.
  */
 declare function passkeyLogin(config?: DexterConnectConfig): Promise<SignInResult>;
 
-export { DexterConnectConfig, SignInResult, passkeyLogin };
+/** What `issueChallenge` returns to the SDK signer. */
+interface AnonChallengeResult {
+    /** Server-issued WebAuthn challenge (=== the supplied operationHash). */
+    challenge: Uint8Array;
+    /** Credential id the server resolved from the userHandle (allowCredentials[0]). */
+    credentialId: Uint8Array;
+    rpId?: string;
+    transports?: AuthenticatorTransport[];
+}
+/** The policy the SDK's guest `DexterApiBrowserPasskeySigner` consumes. */
+interface AnonServerPolicy {
+    issueChallenge(args: {
+        userHandle: Uint8Array;
+        operationHash: Uint8Array;
+    }): Promise<AnonChallengeResult>;
+    verify(args: {
+        userHandle: Uint8Array;
+        credentialId: Uint8Array;
+        signature: Uint8Array;
+        clientDataJSON: Uint8Array;
+        authenticatorData: Uint8Array;
+    }): Promise<void>;
+}
+/**
+ * Build the anon ServerPolicy for a given dexter-api base.
+ *
+ * `issueChallenge` → POST /challenge { userHandle, operationHash } (both base64url).
+ *   The server uses operationHash AS the WebAuthn challenge (replay binding +
+ *   the on-chain webauthn.rs law: clientDataJSON.challenge === sha256(op)) and
+ *   resolves the credential into options.allowCredentials[0].
+ * `verify` → POST /verify { credential, userHandle }. NOTE: the SDK hands us the
+ *   COMPACT 64-byte signature; dexter-api's WebAuthn verifier wants DER, so we
+ *   re-encode compact → DER here (compactSignatureToDer).
+ */
+declare function createAnonServerPolicy(apiBase?: string): AnonServerPolicy;
+
+/** Test seam mirroring the SDK's injected-assertion shape (production omits it). */
+type AssertionLike = {
+    credentialId: Uint8Array;
+    assertOver(challenge: Uint8Array): Promise<{
+        signature: Uint8Array;
+        clientDataJSON: Uint8Array;
+        authenticatorData: Uint8Array;
+    }>;
+};
+/**
+ * Construct the guest signer from a connected `ConnectVault`.
+ *
+ * `vault.publicKey` is base64 (33-byte SEC1 compressed P-256); `vault.userHandle`
+ * is base64url (server-minted). Both are decoded to the Uint8Arrays the SDK wants.
+ *
+ * @param vault    the connected vault from useSignInWithDexter()
+ * @param apiBase  dexter-api base (defaults to https://api.dexter.cash via the policy)
+ * @param opts.__assertion  test-only injected assertion (skips real WebAuthn)
+ */
+declare function createPasskeySigner(vault: ConnectVault, apiBase?: string, opts?: {
+    __assertion?: AssertionLike;
+}): DexterApiBrowserPasskeySigner;
+
+export { type AnonChallengeResult, type AnonServerPolicy, ConnectVault, DexterConnectConfig, SignInResult, createAnonServerPolicy, createPasskeySigner, passkeyLogin };

package/dist/index.js

@@ -1,8 +1,28 @@
 import {
+  ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
-  passkeyLogin
-} from "./chunk-65VT7AU2.js";
+  createAnonServerPolicy,
+  createPasskeySigner,
+  ejectActiveWallet,
+  forgetWallet,
+  getActiveHandle,
+  listWallets,
+  passkeyLogin,
+  setActiveHandle,
+  subscribe,
+  switchWallet
+} from "./chunk-HFG2GUFX.js";
 export {
+  ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
-  passkeyLogin
+  createAnonServerPolicy,
+  createPasskeySigner,
+  ejectActiveWallet,
+  forgetWallet,
+  getActiveHandle,
+  listWallets,
+  passkeyLogin,
+  setActiveHandle,
+  subscribe as subscribeWallet,
+  switchWallet
 };

package/dist/react.d.ts

@@ -1,4 +1,5 @@
-import { S as SignInResult, P as PasskeyLoginTokens, a as ConnectVault, C as ConnectError } from './types-DT3KPBOE.js';
+import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
+import { S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, a as ConnectError, b as StoredWallet } from './walletStore-CWXhXuzK.js';
 import { ReactElement } from 'react';
 
 type ConnectStatus = 'idle' | 'pending' | 'done' | 'error';
@@ -21,6 +22,9 @@ interface UseSignInWithDexter {
     vaultAddress: string | null;
     vaultPda: string | null;
     credentialId: string | null;
+    /** Guest passkey signer for authorizing spends / opening x402 tabs. null until
+     *  a vault is connected. Drive it via `passkeySigner.signOperation(op)`. */
+    passkeySigner: DexterApiBrowserPasskeySigner | null;
     /** USD available. number once read; null = unknown → chip shows wallet only. */
     usdcBalance: number | null;
     refreshBalance: () => Promise<void>;
@@ -60,4 +64,25 @@ interface SignInWithDexterProps extends UseSignInWithDexterConfig {
  */
 declare function SignInWithDexter(props: SignInWithDexterProps): ReactElement | null;
 
-export { type ConnectStatus, SignInWithDexter, type SignInWithDexterProps, type UseSignInWithDexter, type UseSignInWithDexterConfig, useSignInWithDexter };
+interface UseDexterWallet {
+    /** Active wallet handle, or null if this browser has no active wallet. */
+    activeHandle: string | null;
+    /** Known wallets on this browser, most-recently-used first. */
+    wallets: StoredWallet[];
+    /**
+     * Eject the active wallet — "switch / start fresh / sign out of this wallet".
+     * The browser is no longer bound to it; the next enroll/recover starts clean.
+     * Pass `{ forget: true }` to also drop it from the roster.
+     */
+    eject: (opts?: {
+        forget?: boolean;
+    }) => void;
+    /** Switch the active wallet to a known handle. No-op if unknown. */
+    switchTo: (handle: string) => boolean;
+    /** Record/activate a handle (after enroll or recover). Prefer this over
+     *  hand-writing localStorage so the roster + subscribers stay correct. */
+    setActive: (handle: string, label?: string) => void;
+}
+declare function useDexterWallet(): UseDexterWallet;
+
+export { type ConnectStatus, SignInWithDexter, type SignInWithDexterProps, type UseDexterWallet, type UseSignInWithDexter, type UseSignInWithDexterConfig, useDexterWallet, useSignInWithDexter };

package/dist/react.js

@@ -1,10 +1,17 @@
 import {
   ConnectError,
-  passkeyLogin
-} from "./chunk-65VT7AU2.js";
+  createPasskeySigner,
+  ejectActiveWallet,
+  getActiveHandle,
+  listWallets,
+  passkeyLogin,
+  setActiveHandle,
+  subscribe,
+  switchWallet
+} from "./chunk-HFG2GUFX.js";
 
 // src/useSignInWithDexter.ts
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 
 // src/balance.ts
 async function fetchUsdcBalance(rpcUrl, usdcAta) {
@@ -80,6 +87,10 @@ function useSignInWithDexter(config = {}) {
     setError(null);
     setStatus("idle");
   }, []);
+  const passkeySigner = useMemo(
+    () => vault ? createPasskeySigner(vault, apiBase) : null,
+    [vault, apiBase]
+  );
   useEffect(() => {
     void refreshBalance();
   }, [refreshBalance]);
@@ -93,6 +104,7 @@ function useSignInWithDexter(config = {}) {
     vaultAddress: vault?.swigAddress ?? null,
     vaultPda: vault?.vaultPda ?? null,
     credentialId: vault?.credentialId ?? null,
+    passkeySigner,
     usdcBalance,
     refreshBalance,
     error
@@ -192,7 +204,30 @@ var DISCONNECT = {
   lineHeight: 1,
   opacity: 0.6
 };
+
+// src/useDexterWallet.ts
+import { useCallback as useCallback2, useEffect as useEffect2, useState as useState2 } from "react";
+function useDexterWallet() {
+  const [activeHandle, setHandle] = useState2(() => getActiveHandle());
+  const [wallets, setWallets] = useState2(() => listWallets());
+  useEffect2(() => {
+    const sync = () => {
+      setHandle(getActiveHandle());
+      setWallets(listWallets());
+    };
+    sync();
+    return subscribe(sync);
+  }, []);
+  return {
+    activeHandle,
+    wallets,
+    eject: useCallback2((opts) => ejectActiveWallet(opts), []),
+    switchTo: useCallback2((handle) => switchWallet(handle), []),
+    setActive: useCallback2((handle, label) => setActiveHandle(handle, label), [])
+  };
+}
 export {
   SignInWithDexter,
+  useDexterWallet,
   useSignInWithDexter
 };

package/dist/walletStore-CWXhXuzK.d.ts

@@ -0,0 +1,92 @@
+/** Supabase session tokens returned by dexter-api's passkey-login (camelCase). */
+interface PasskeyLoginTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    expiresIn: number;
+    tokenType: string;
+}
+/**
+ * Vault identity, returned ALONGSIDE the session by passkey-login once
+ * vault-review ships the dexter-api change (ASK 1). Optional until then —
+ * the connector degrades to session-only. Consumers that open x402 tabs
+ * (dexter-agents) need `vaultPda` + `publicKey` to build a passkey signer.
+ */
+interface ConnectVault {
+    vaultPda: string;
+    /** Swig state address, base58 — the user-facing Dexter Wallet address. */
+    swigAddress: string;
+    /** v2 swig wallet PDA (deposit address); null until the swig is deployed. */
+    receiveAddress: string | null;
+    /** Swig wallet's USDC ATA, base58 (for the connected-chip balance read);
+     *  null until the swig is deployed. Server-resolved (off-curve-safe). */
+    usdcAta: string | null;
+    /** base64 33-byte SEC1 compressed P-256 authority pubkey (for the signer). */
+    publicKey: string;
+    userHandle: string;
+    credentialId: string;
+}
+/** Result of a completed "Sign in with Dexter" ceremony. */
+interface SignInResult {
+    session: PasskeyLoginTokens;
+    /** Present once vault-review ships the vault-in-login change. */
+    vault?: ConnectVault;
+}
+interface DexterConnectConfig {
+    /** dexter-api base. Default https://api.dexter.cash. */
+    apiBase?: string;
+}
+/** Typed error whose `code` is the server's snake_case error string. */
+declare class ConnectError extends Error {
+    readonly code: string;
+    constructor(code: string, message?: string);
+}
+
+/** A wallet this browser knows about. `handle` is the identity; the rest is UX. */
+interface StoredWallet {
+    /** base64url 16-byte user handle — the vault identity. */
+    handle: string;
+    /** Human label for switch UIs (e.g. an email, or "Dexter Wallet"). */
+    label?: string;
+    /** Epoch ms of last activation — for ordering the switcher. */
+    lastUsedAt?: number;
+}
+type Listener = () => void;
+/** The active wallet handle, or null if this browser has no active wallet. */
+declare function getActiveHandle(): string | null;
+/**
+ * Set the active wallet handle (e.g. after enroll or recover), upserting it into
+ * the roster with a fresh `lastUsedAt`. Idempotent. Fires subscribers.
+ */
+declare function setActiveHandle(handle: string, label?: string): void;
+/**
+ * EJECT — clear the active wallet so the browser is no longer bound to it. This
+ * is "switch / start fresh / sign out of this wallet". The wallet stays in the
+ * roster (so the user can switch back) unless `forget` is true. After eject,
+ * `getActiveHandle()` is null and the next enroll/recover starts clean. Fires
+ * subscribers. This is the function whose absence WAS the welded-wallet bug.
+ */
+declare function ejectActiveWallet(opts?: {
+    forget?: boolean;
+}): void;
+/** Every wallet this browser knows about, most-recently-used first. */
+declare function listWallets(): StoredWallet[];
+/**
+ * Switch the active wallet to a handle ALREADY in the roster. Returns false (and
+ * does nothing) if the handle is unknown — switching is only ever to a wallet
+ * this browser has seen, never to an arbitrary string.
+ */
+declare function switchWallet(handle: string): boolean;
+/** Remove a wallet from the roster entirely; clears active if it was active. */
+declare function forgetWallet(handle: string): void;
+/**
+ * Subscribe to active-wallet/roster changes. Returns an unsubscribe fn. Also
+ * wires the cross-tab `storage` event once, so ejecting in one tab updates the
+ * others. The React hook (`useDexterWallet`) is a thin wrapper over this.
+ */
+declare function subscribe(listener: Listener): () => void;
+/** Exposed for consumers that must reference the canonical key (migrations,
+ *  tests). Prefer the accessors above — do NOT read localStorage by hand. */
+declare const ACTIVE_WALLET_STORAGE_KEY = "dexter:passkey:userHandle";
+
+export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type PasskeyLoginTokens as P, type SignInResult as S, ConnectError as a, type StoredWallet as b, subscribe as c, switchWallet as d, ejectActiveWallet as e, forgetWallet as f, getActiveHandle as g, listWallets as l, setActiveHandle as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {
@@ -21,13 +21,12 @@
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   },
-  "dependencies": {
-    "@dexterai/vault": "^0.14.1"
-  },
   "peerDependencies": {
+    "@dexterai/vault": ">=0.19",
     "react": ">=18"
   },
   "devDependencies": {
+    "@dexterai/vault": "^0.19.0",
     "@types/react": "^19.1.12",
     "react": "^19.2.5",
     "tsup": "^8.5.0",

package/dist/chunk-65VT7AU2.js

@@ -1,118 +0,0 @@
-// src/types.ts
-var ConnectError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message ?? code);
-    this.code = code;
-    this.name = "ConnectError";
-  }
-};
-
-// src/relay.ts
-var DEFAULT_API_BASE = "https://api.dexter.cash";
-var ANON_SIGN_BASE = "/api/passkey-anon/sign";
-async function passkeyLogin(config = {}) {
-  const apiBase = (config.apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
-  const options = await fetchLoginChallenge(apiBase);
-  const credential = await getAssertion(options);
-  return submitLogin(apiBase, credential);
-}
-async function fetchLoginChallenge(apiBase) {
-  const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/login-challenge`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: "{}"
-  });
-  if (!res.ok) {
-    throw new ConnectError("login_challenge_failed", `login-challenge ${res.status}`);
-  }
-  const data = await res.json();
-  if (!data?.options?.challenge) {
-    throw new ConnectError("login_challenge_malformed", "no challenge in response");
-  }
-  return data.options;
-}
-async function getAssertion(options) {
-  if (typeof navigator === "undefined" || !navigator.credentials) {
-    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
-  }
-  let credential;
-  try {
-    credential = await navigator.credentials.get({
-      publicKey: {
-        challenge: base64urlToBytes(options.challenge).buffer.slice(0),
-        rpId: options.rpId,
-        timeout: options.timeout ?? 6e4,
-        userVerification: options.userVerification ?? "required"
-        // No allowCredentials — discoverable resident-key login.
-      }
-    });
-  } catch (err) {
-    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
-  }
-  if (!credential || credential.type !== "public-key") {
-    throw new ConnectError("no_credential", "WebAuthn returned no credential");
-  }
-  return credential;
-}
-async function submitLogin(apiBase, credential) {
-  const assertion = credential.response;
-  const credentialJson = {
-    id: credential.id,
-    rawId: bytesToBase64url(new Uint8Array(credential.rawId)),
-    type: credential.type,
-    response: {
-      clientDataJSON: bytesToBase64url(new Uint8Array(assertion.clientDataJSON)),
-      authenticatorData: bytesToBase64url(new Uint8Array(assertion.authenticatorData)),
-      signature: bytesToBase64url(new Uint8Array(assertion.signature)),
-      userHandle: assertion.userHandle ? bytesToBase64url(new Uint8Array(assertion.userHandle)) : null
-    },
-    clientExtensionResults: credential.getClientExtensionResults?.() ?? {}
-  };
-  const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/passkey-login`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ credential: credentialJson })
-  });
-  if (!res.ok) {
-    throw new ConnectError(await readErrorCode(res), `passkey-login ${res.status}`);
-  }
-  const data = await res.json();
-  const session = {
-    accessToken: data.accessToken,
-    refreshToken: data.refreshToken,
-    expiresAt: data.expiresAt,
-    expiresIn: data.expiresIn,
-    tokenType: data.tokenType
-  };
-  return data.vault ? { session, vault: data.vault } : { session };
-}
-async function readErrorCode(res) {
-  try {
-    const body = await res.json();
-    if (body?.error) return body.error;
-  } catch {
-  }
-  return `http_${res.status}`;
-}
-function base64ToBytes(s) {
-  const bin = atob(s);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
-  return out;
-}
-function base64urlToBytes(s) {
-  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
-  return base64ToBytes(b64);
-}
-function bytesToBase64url(bytes) {
-  let bin = "";
-  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
-  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-export {
-  ConnectError,
-  passkeyLogin
-};

package/dist/types-DT3KPBOE.d.ts

@@ -1,45 +0,0 @@
-/** Supabase session tokens returned by dexter-api's passkey-login (camelCase). */
-interface PasskeyLoginTokens {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: number;
-    expiresIn: number;
-    tokenType: string;
-}
-/**
- * Vault identity, returned ALONGSIDE the session by passkey-login once
- * vault-review ships the dexter-api change (ASK 1). Optional until then —
- * the connector degrades to session-only. Consumers that open x402 tabs
- * (dexter-agents) need `vaultPda` + `publicKey` to build a passkey signer.
- */
-interface ConnectVault {
-    vaultPda: string;
-    /** Swig state address, base58 — the user-facing Dexter Wallet address. */
-    swigAddress: string;
-    /** v2 swig wallet PDA (deposit address); null until the swig is deployed. */
-    receiveAddress: string | null;
-    /** Swig wallet's USDC ATA, base58 (for the connected-chip balance read);
-     *  null until the swig is deployed. Server-resolved (off-curve-safe). */
-    usdcAta: string | null;
-    /** base64 33-byte SEC1 compressed P-256 authority pubkey (for the signer). */
-    publicKey: string;
-    userHandle: string;
-    credentialId: string;
-}
-/** Result of a completed "Sign in with Dexter" ceremony. */
-interface SignInResult {
-    session: PasskeyLoginTokens;
-    /** Present once vault-review ships the vault-in-login change. */
-    vault?: ConnectVault;
-}
-interface DexterConnectConfig {
-    /** dexter-api base. Default https://api.dexter.cash. */
-    apiBase?: string;
-}
-/** Typed error whose `code` is the server's snake_case error string. */
-declare class ConnectError extends Error {
-    readonly code: string;
-    constructor(code: string, message?: string);
-}
-
-export { ConnectError as C, type DexterConnectConfig as D, type PasskeyLoginTokens as P, type SignInResult as S, type ConnectVault as a };