@dexterai/connect 0.13.0 → 0.15.0

package/dist/{chunk-6NIGGPVI.js → chunk-RLVMYLHC.js}

@@ -8,57 +8,124 @@ var ConnectError = class extends Error {
   }
 };
 
-// src/base64.ts
-function base64ToBytes(s) {
-  const bin = atob(s);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
-  return out;
+// src/walletStore.ts
+var ACTIVE_HANDLE_KEY = "dexter:passkey:userHandle";
+var ROSTER_KEY = "dexter:passkey:wallets";
+var listeners = /* @__PURE__ */ new Set();
+function hasStorage() {
+  try {
+    return typeof window !== "undefined" && !!window.localStorage;
+  } catch {
+    return false;
+  }
 }
-function base64urlToBytes(s) {
-  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
-  return base64ToBytes(b64);
+function readRoster() {
+  if (!hasStorage()) return [];
+  try {
+    const raw = window.localStorage.getItem(ROSTER_KEY);
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter(
+      (w) => !!w && typeof w === "object" && typeof w.handle === "string"
+    );
+  } catch {
+    return [];
+  }
 }
-function bytesToBase64(bytes) {
-  let bin = "";
-  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
-  return btoa(bin);
+function writeRoster(wallets) {
+  if (!hasStorage()) return;
+  try {
+    window.localStorage.setItem(ROSTER_KEY, JSON.stringify(wallets));
+  } catch {
+  }
 }
-function bytesToBase64url(bytes) {
-  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function emit() {
+  for (const l of listeners) {
+    try {
+      l();
+    } catch {
+    }
+  }
 }
-function compactSignatureToDer(compact) {
-  if (compact.length !== 64) {
-    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
+function getActiveHandle() {
+  if (!hasStorage()) return null;
+  try {
+    return window.localStorage.getItem(ACTIVE_HANDLE_KEY);
+  } catch {
+    return null;
   }
-  const r = derInteger(compact.subarray(0, 32));
-  const s = derInteger(compact.subarray(32, 64));
-  const body = new Uint8Array(r.length + s.length);
-  body.set(r, 0);
-  body.set(s, r.length);
-  const out = new Uint8Array(2 + body.length);
-  out[0] = 48;
-  out[1] = body.length;
-  out.set(body, 2);
-  return out;
 }
-function derInteger(component) {
-  let start = 0;
-  while (start < component.length - 1 && component[start] === 0) start += 1;
-  let content = component.subarray(start);
-  if (content[0] & 128) {
-    const padded = new Uint8Array(content.length + 1);
-    padded[0] = 0;
-    padded.set(content, 1);
-    content = padded;
+function setActiveHandle(handle, label, credentialId) {
+  if (!hasStorage() || !handle) return;
+  try {
+    window.localStorage.setItem(ACTIVE_HANDLE_KEY, handle);
+  } catch {
+    return;
   }
-  const out = new Uint8Array(2 + content.length);
-  out[0] = 2;
-  out[1] = content.length;
-  out.set(content, 2);
-  return out;
+  const roster = readRoster();
+  const existing = roster.find((w) => w.handle === handle);
+  const now = Date.now();
+  if (existing) {
+    existing.lastUsedAt = now;
+    if (label !== void 0) existing.label = label;
+    if (credentialId !== void 0) existing.credentialId = credentialId;
+  } else {
+    roster.push({ handle, label, credentialId, lastUsedAt: now });
+  }
+  writeRoster(roster);
+  emit();
+}
+function getCredentialId(handle) {
+  return readRoster().find((w) => w.handle === handle)?.credentialId;
+}
+function ejectActiveWallet(opts) {
+  if (!hasStorage()) return;
+  const current = getActiveHandle();
+  try {
+    window.localStorage.removeItem(ACTIVE_HANDLE_KEY);
+  } catch {
+  }
+  if (opts?.forget && current) {
+    writeRoster(readRoster().filter((w) => w.handle !== current));
+  }
+  emit();
+}
+function listWallets() {
+  return readRoster().sort((a, b) => (b.lastUsedAt ?? 0) - (a.lastUsedAt ?? 0));
 }
+function switchWallet(handle) {
+  if (!readRoster().some((w) => w.handle === handle)) return false;
+  setActiveHandle(handle);
+  return true;
+}
+function forgetWallet(handle) {
+  if (getActiveHandle() === handle) {
+    ejectActiveWallet({ forget: true });
+    return;
+  }
+  writeRoster(readRoster().filter((w) => w.handle !== handle));
+  emit();
+}
+function subscribe(listener) {
+  listeners.add(listener);
+  if (hasStorage() && listeners.size === 1) {
+    window.addEventListener("storage", onStorageEvent);
+  }
+  return () => {
+    listeners.delete(listener);
+    if (hasStorage() && listeners.size === 0) {
+      window.removeEventListener("storage", onStorageEvent);
+    }
+  };
+}
+function onStorageEvent(e) {
+  if (e.key === ACTIVE_HANDLE_KEY || e.key === ROSTER_KEY || e.key === null) emit();
+}
+var ACTIVE_WALLET_STORAGE_KEY = ACTIVE_HANDLE_KEY;
+
+// src/enroll.ts
+import { startRegistration } from "@simplewebauthn/browser";
 
 // src/popup.ts
 var DEFAULT_CONNECT_HOST = "https://dexter.cash/connect";
@@ -145,8 +212,103 @@ function makeNonce() {
   return `rid-${new URL(location.href).searchParams.get("v") ?? ""}-${typeof performance !== "undefined" ? performance.now() : 0}`;
 }
 
-// src/relay.ts
+// src/enroll.ts
 var DEFAULT_API_BASE = "https://api.dexter.cash";
+var DEFAULT_RP_ID = "dexter.cash";
+var DEFAULT_WALLET_NAME = "Dexter Wallet";
+async function createWallet(config = {}) {
+  if (shouldUsePopup(config.transport)) {
+    return openCeremonyPopup("create", {
+      connectHost: config.connectHost,
+      name: config.name,
+      apiBase: config.apiBase
+    });
+  }
+  if (typeof navigator === "undefined" || !navigator.credentials) {
+    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
+  }
+  const apiBase = (config.apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
+  const rpId = config.rpId ?? DEFAULT_RP_ID;
+  const name = config.name && config.name.trim() || DEFAULT_WALLET_NAME;
+  config.onPhase?.("challenge");
+  const options = await fetchEnrollChallenge(apiBase);
+  config.onPhase?.("passkey");
+  const optionsJSON = {
+    ...options,
+    rp: { ...options.rp, id: options.rp.id ?? rpId, name: "Dexter" },
+    user: { ...options.user, name, displayName: name }
+  };
+  let regResponse;
+  try {
+    regResponse = await startRegistration({ optionsJSON });
+  } catch (err) {
+    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
+  }
+  config.onPhase?.("verifying");
+  const enrolled = await submitEnrollComplete(apiBase, regResponse);
+  config.onPhase?.("finalizing");
+  const init = await initializeVault(apiBase, enrolled.userHandle, enrolled.credentialId);
+  setActiveHandle(enrolled.userHandle, name, enrolled.credentialId);
+  return {
+    handle: enrolled.userHandle,
+    credentialId: enrolled.credentialId,
+    vault: {
+      vaultPda: init.vaultPda,
+      swigAddress: init.swigStateAddress,
+      // FAIL SAFE: never invent a receive address — null until the server returns
+      // one (depositing to the config PDA would strand funds).
+      receiveAddress: init.receiveAddress ?? null,
+      usdcAta: null,
+      // swig not deployed yet (counterfactual pattern)
+      publicKey: enrolled.publicKey,
+      userHandle: enrolled.userHandle,
+      credentialId: enrolled.credentialId
+    }
+  };
+}
+async function fetchEnrollChallenge(apiBase) {
+  const res = await fetch(`${apiBase}/api/passkey-anon/enroll/challenge`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: "{}"
+  });
+  if (!res.ok) throw new ConnectError("enroll_challenge_failed", `enroll/challenge ${res.status}`);
+  const data = await res.json();
+  if (!data?.options?.challenge) {
+    throw new ConnectError("enroll_challenge_malformed", "no creation options in response");
+  }
+  return data.options;
+}
+async function submitEnrollComplete(apiBase, response) {
+  const res = await fetch(`${apiBase}/api/passkey-anon/enroll/complete`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ credential: response })
+  });
+  if (!res.ok) throw new ConnectError(await readErrorCode(res), `enroll/complete ${res.status}`);
+  return await res.json();
+}
+async function initializeVault(apiBase, userHandle, credentialId) {
+  const res = await fetch(`${apiBase}/api/passkey-vault-anon/initialize`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ userHandle, credentialId, coolingOffSeconds: 0 })
+  });
+  if (!res.ok) throw new ConnectError(await readErrorCode(res), `initialize ${res.status}`);
+  return await res.json();
+}
+async function readErrorCode(res) {
+  try {
+    const body = await res.json();
+    if (body?.error) return body.error;
+  } catch {
+  }
+  return `http_${res.status}`;
+}
+
+// src/relay.ts
+import { startAuthentication, browserSupportsWebAuthn } from "@simplewebauthn/browser";
+var DEFAULT_API_BASE2 = "https://api.dexter.cash";
 var ANON_SIGN_BASE = "/api/passkey-anon/sign";
 async function passkeyLogin(config = {}, onPhase) {
   if (shouldUsePopup(config.transport)) {
@@ -155,13 +317,36 @@ async function passkeyLogin(config = {}, onPhase) {
       apiBase: config.apiBase
     });
   }
-  const apiBase = (config.apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
+  if (!browserSupportsWebAuthn()) {
+    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
+  }
+  const apiBase = (config.apiBase ?? DEFAULT_API_BASE2).replace(/\/$/, "");
   onPhase?.("challenge");
   const options = await fetchLoginChallenge(apiBase);
   onPhase?.("passkey");
-  const credential = await getAssertion(options);
+  let response;
+  try {
+    response = await startAuthentication({ optionsJSON: options });
+  } catch (err) {
+    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
+  }
   onPhase?.("verifying");
-  return submitLogin(apiBase, credential);
+  return submitLogin(apiBase, response);
+}
+async function continueWithDexter(config = {}, onPhase) {
+  if (shouldUsePopup(config.transport)) {
+    return openCeremonyPopup("continue", {
+      connectHost: config.connectHost,
+      name: config.name,
+      apiBase: config.apiBase
+    });
+  }
+  if (getActiveHandle()) {
+    const result2 = await passkeyLogin(config, onPhase);
+    return { kind: "signin", ...result2 };
+  }
+  const result = await createWallet({ ...config, onPhase });
+  return { kind: "create", ...result };
 }
 async function fetchLoginChallenge(apiBase) {
   const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/login-challenge`, {
@@ -178,50 +363,14 @@ async function fetchLoginChallenge(apiBase) {
   }
   return data.options;
 }
-async function getAssertion(options) {
-  if (typeof navigator === "undefined" || !navigator.credentials) {
-    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
-  }
-  let credential;
-  try {
-    credential = await navigator.credentials.get({
-      publicKey: {
-        challenge: base64urlToBytes(options.challenge).buffer.slice(0),
-        rpId: options.rpId,
-        timeout: options.timeout ?? 6e4,
-        userVerification: options.userVerification ?? "required"
-        // No allowCredentials — discoverable resident-key login.
-      }
-    });
-  } catch (err) {
-    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
-  }
-  if (!credential || credential.type !== "public-key") {
-    throw new ConnectError("no_credential", "WebAuthn returned no credential");
-  }
-  return credential;
-}
-async function submitLogin(apiBase, credential) {
-  const assertion = credential.response;
-  const credentialJson = {
-    id: credential.id,
-    rawId: bytesToBase64url(new Uint8Array(credential.rawId)),
-    type: credential.type,
-    response: {
-      clientDataJSON: bytesToBase64url(new Uint8Array(assertion.clientDataJSON)),
-      authenticatorData: bytesToBase64url(new Uint8Array(assertion.authenticatorData)),
-      signature: bytesToBase64url(new Uint8Array(assertion.signature)),
-      userHandle: assertion.userHandle ? bytesToBase64url(new Uint8Array(assertion.userHandle)) : null
-    },
-    clientExtensionResults: credential.getClientExtensionResults?.() ?? {}
-  };
+async function submitLogin(apiBase, response) {
   const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/passkey-login`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ credential: credentialJson })
+    body: JSON.stringify({ credential: response })
   });
   if (!res.ok) {
-    throw new ConnectError(await readErrorCode(res), `passkey-login ${res.status}`);
+    throw new ConnectError(await readErrorCode2(res), `passkey-login ${res.status}`);
   }
   const data = await res.json();
   const session = {
@@ -233,7 +382,7 @@ async function submitLogin(apiBase, credential) {
   };
   return data.vault ? { session, vault: data.vault } : { session };
 }
-async function readErrorCode(res) {
+async function readErrorCode2(res) {
   try {
     const body = await res.json();
     if (body?.error) return body.error;
@@ -242,10 +391,62 @@ async function readErrorCode(res) {
   return `http_${res.status}`;
 }
 
+// src/base64.ts
+function base64ToBytes(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function base64urlToBytes(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  return base64ToBytes(b64);
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function bytesToBase64url(bytes) {
+  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function compactSignatureToDer(compact) {
+  if (compact.length !== 64) {
+    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
+  }
+  const r = derInteger(compact.subarray(0, 32));
+  const s = derInteger(compact.subarray(32, 64));
+  const body = new Uint8Array(r.length + s.length);
+  body.set(r, 0);
+  body.set(s, r.length);
+  const out = new Uint8Array(2 + body.length);
+  out[0] = 48;
+  out[1] = body.length;
+  out.set(body, 2);
+  return out;
+}
+function derInteger(component) {
+  let start = 0;
+  while (start < component.length - 1 && component[start] === 0) start += 1;
+  let content = component.subarray(start);
+  if (content[0] & 128) {
+    const padded = new Uint8Array(content.length + 1);
+    padded[0] = 0;
+    padded.set(content, 1);
+    content = padded;
+  }
+  const out = new Uint8Array(2 + content.length);
+  out[0] = 2;
+  out[1] = content.length;
+  out.set(content, 2);
+  return out;
+}
+
 // src/anon-policy.ts
-var DEFAULT_API_BASE2 = "https://api.dexter.cash";
+var DEFAULT_API_BASE3 = "https://api.dexter.cash";
 var ANON_SIGN_BASE2 = "/api/passkey-anon/sign";
-function createAnonServerPolicy(apiBase = DEFAULT_API_BASE2) {
+function createAnonServerPolicy(apiBase = DEFAULT_API_BASE3) {
   const base = apiBase.replace(/\/$/, "");
   return {
     async issueChallenge({ userHandle, operationHash }) {
@@ -257,7 +458,7 @@ function createAnonServerPolicy(apiBase = DEFAULT_API_BASE2) {
           operationHash: bytesToBase64url(operationHash)
         })
       });
-      if (!res.ok) throw new ConnectError(await readErrorCode2(res), `challenge ${res.status}`);
+      if (!res.ok) throw new ConnectError(await readErrorCode3(res), `challenge ${res.status}`);
       const data = await res.json();
       const options = data?.options;
       if (!options?.challenge) {
@@ -294,7 +495,7 @@ function createAnonServerPolicy(apiBase = DEFAULT_API_BASE2) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ credential, userHandle: bytesToBase64url(userHandle) })
       });
-      if (!res.ok) throw new ConnectError(await readErrorCode2(res), `verify ${res.status}`);
+      if (!res.ok) throw new ConnectError(await readErrorCode3(res), `verify ${res.status}`);
       const data = await res.json();
       if (data?.verified === false) {
         throw new ConnectError("verification_failed", "server returned verified=false");
@@ -302,7 +503,7 @@ function createAnonServerPolicy(apiBase = DEFAULT_API_BASE2) {
     }
   };
 }
-async function readErrorCode2(res) {
+async function readErrorCode3(res) {
   try {
     const body = await res.json();
     if (body?.error) return body.error;
@@ -336,122 +537,6 @@ function resolveIdentity(input) {
   return { kind, userHandle, accountToken, hasPasskeyVault, hasAccount, hasWallet };
 }
 
-// src/walletStore.ts
-var ACTIVE_HANDLE_KEY = "dexter:passkey:userHandle";
-var ROSTER_KEY = "dexter:passkey:wallets";
-var listeners = /* @__PURE__ */ new Set();
-function hasStorage() {
-  try {
-    return typeof window !== "undefined" && !!window.localStorage;
-  } catch {
-    return false;
-  }
-}
-function readRoster() {
-  if (!hasStorage()) return [];
-  try {
-    const raw = window.localStorage.getItem(ROSTER_KEY);
-    if (!raw) return [];
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter(
-      (w) => !!w && typeof w === "object" && typeof w.handle === "string"
-    );
-  } catch {
-    return [];
-  }
-}
-function writeRoster(wallets) {
-  if (!hasStorage()) return;
-  try {
-    window.localStorage.setItem(ROSTER_KEY, JSON.stringify(wallets));
-  } catch {
-  }
-}
-function emit() {
-  for (const l of listeners) {
-    try {
-      l();
-    } catch {
-    }
-  }
-}
-function getActiveHandle() {
-  if (!hasStorage()) return null;
-  try {
-    return window.localStorage.getItem(ACTIVE_HANDLE_KEY);
-  } catch {
-    return null;
-  }
-}
-function setActiveHandle(handle, label, credentialId) {
-  if (!hasStorage() || !handle) return;
-  try {
-    window.localStorage.setItem(ACTIVE_HANDLE_KEY, handle);
-  } catch {
-    return;
-  }
-  const roster = readRoster();
-  const existing = roster.find((w) => w.handle === handle);
-  const now = Date.now();
-  if (existing) {
-    existing.lastUsedAt = now;
-    if (label !== void 0) existing.label = label;
-    if (credentialId !== void 0) existing.credentialId = credentialId;
-  } else {
-    roster.push({ handle, label, credentialId, lastUsedAt: now });
-  }
-  writeRoster(roster);
-  emit();
-}
-function getCredentialId(handle) {
-  return readRoster().find((w) => w.handle === handle)?.credentialId;
-}
-function ejectActiveWallet(opts) {
-  if (!hasStorage()) return;
-  const current = getActiveHandle();
-  try {
-    window.localStorage.removeItem(ACTIVE_HANDLE_KEY);
-  } catch {
-  }
-  if (opts?.forget && current) {
-    writeRoster(readRoster().filter((w) => w.handle !== current));
-  }
-  emit();
-}
-function listWallets() {
-  return readRoster().sort((a, b) => (b.lastUsedAt ?? 0) - (a.lastUsedAt ?? 0));
-}
-function switchWallet(handle) {
-  if (!readRoster().some((w) => w.handle === handle)) return false;
-  setActiveHandle(handle);
-  return true;
-}
-function forgetWallet(handle) {
-  if (getActiveHandle() === handle) {
-    ejectActiveWallet({ forget: true });
-    return;
-  }
-  writeRoster(readRoster().filter((w) => w.handle !== handle));
-  emit();
-}
-function subscribe(listener) {
-  listeners.add(listener);
-  if (hasStorage() && listeners.size === 1) {
-    window.addEventListener("storage", onStorageEvent);
-  }
-  return () => {
-    listeners.delete(listener);
-    if (hasStorage() && listeners.size === 0) {
-      window.removeEventListener("storage", onStorageEvent);
-    }
-  };
-}
-function onStorageEvent(e) {
-  if (e.key === ACTIVE_HANDLE_KEY || e.key === ROSTER_KEY || e.key === null) emit();
-}
-var ACTIVE_WALLET_STORAGE_KEY = ACTIVE_HANDLE_KEY;
-
 // src/phase.ts
 var PHASE_LABEL = {
   challenge: "Preparing\u2026",
@@ -525,14 +610,6 @@ async function syncAcceptedPasskeys(args) {
 
 export {
   ConnectError,
-  base64urlToBytes,
-  bytesToBase64url,
-  shouldUsePopup,
-  openCeremonyPopup,
-  passkeyLogin,
-  createAnonServerPolicy,
-  createPasskeySigner,
-  resolveIdentity,
   getActiveHandle,
   setActiveHandle,
   getCredentialId,
@@ -542,6 +619,12 @@ export {
   forgetWallet,
   subscribe,
   ACTIVE_WALLET_STORAGE_KEY,
+  createWallet,
+  passkeyLogin,
+  continueWithDexter,
+  createAnonServerPolicy,
+  createPasskeySigner,
+  resolveIdentity,
   ceremonyPhaseLabel,
   passkeySignalSupport,
   renamePasskey,

package/dist/index.d.ts

@@ -1,7 +1,33 @@
-import { D as DexterConnectConfig, C as CeremonyPhase, S as SignInResult, a as ConnectVault } from './signals-DM7IQdq6.js';
-export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, I as IdentityInput, c as IdentityKind, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-DM7IQdq6.js';
+import { C as ConnectVault, D as DexterConnectConfig, a as CeremonyPhase, S as SignInResult } from './signals-BuP-7inZ.js';
+export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, I as IdentityInput, c as IdentityKind, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-BuP-7inZ.js';
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
 
+interface CreateWalletConfig extends DexterConnectConfig {
+    /** Label for the passkey in the OS keychain AND the wallet roster. Set at
+     *  creation — the only moment naming is guaranteed to stick. Default "Dexter Wallet". */
+    name?: string;
+    /** RP id for the new credential. Default "dexter.cash". */
+    rpId?: string;
+    /** Called as the ceremony progresses, for live "connecting steps" UI:
+     *  challenge → passkey → verifying → finalizing. */
+    onPhase?: (phase: CeremonyPhase) => void;
+}
+interface CreateWalletResult {
+    /** Server-minted 16-byte user handle, base64url — the vault identity. */
+    handle: string;
+    /** base64url credential id of the new passkey. */
+    credentialId: string;
+    /** The freshly initialized vault (swig not yet deployed; deploys lazily). */
+    vault: ConnectVault;
+}
+/**
+ * Mint a brand-new Dexter wallet (passkey + vault) and make it the active wallet.
+ *
+ * One passkey approval. Throws ConnectError on any failed leg (the `code` is the
+ * server's error string, or webauthn_failed / no_credential for the ceremony).
+ */
+declare function createWallet(config?: CreateWalletConfig): Promise<CreateWalletResult>;
+
 /**
  * "Sign in with Dexter" — the discoverable-credential login ceremony.
  *
@@ -16,6 +42,12 @@ import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
  * Supabase session, so the Supabase-gated router would 401.
  */
 declare function passkeyLogin(config?: DexterConnectConfig, onPhase?: (phase: CeremonyPhase) => void): Promise<SignInResult>;
+type ContinueResult = ({
+    kind: 'signin';
+} & SignInResult) | ({
+    kind: 'create';
+} & CreateWalletResult);
+declare function continueWithDexter(config?: CreateWalletConfig, onPhase?: (phase: CeremonyPhase) => void): Promise<ContinueResult>;
 
 /** What `issueChallenge` returns to the SDK signer. */
 interface AnonChallengeResult {
@@ -76,32 +108,6 @@ declare function createPasskeySigner(vault: ConnectVault, apiBase?: string, opts
     __assertion?: AssertionLike;
 }): DexterApiBrowserPasskeySigner;
 
-interface CreateWalletConfig extends DexterConnectConfig {
-    /** Label for the passkey in the OS keychain AND the wallet roster. Set at
-     *  creation — the only moment naming is guaranteed to stick. Default "Dexter Wallet". */
-    name?: string;
-    /** RP id for the new credential. Default "dexter.cash". */
-    rpId?: string;
-    /** Called as the ceremony progresses, for live "connecting steps" UI:
-     *  challenge → passkey → verifying → finalizing. */
-    onPhase?: (phase: CeremonyPhase) => void;
-}
-interface CreateWalletResult {
-    /** Server-minted 16-byte user handle, base64url — the vault identity. */
-    handle: string;
-    /** base64url credential id of the new passkey. */
-    credentialId: string;
-    /** The freshly initialized vault (swig not yet deployed; deploys lazily). */
-    vault: ConnectVault;
-}
-/**
- * Mint a brand-new Dexter wallet (passkey + vault) and make it the active wallet.
- *
- * One passkey approval. Throws ConnectError on any failed leg (the `code` is the
- * server's error string, or webauthn_failed / no_credential for the ceremony).
- */
-declare function createWallet(config?: CreateWalletConfig): Promise<CreateWalletResult>;
-
 /**
  * Human-readable label for a ceremony phase — the live "connecting step" copy.
  * ONE source of truth so sign-in (SignInWithDexter) and create (consumer setup
@@ -110,4 +116,4 @@ declare function createWallet(config?: CreateWalletConfig): Promise<CreateWallet
  */
 declare function ceremonyPhaseLabel(phase: CeremonyPhase): string;
 
-export { type AnonChallengeResult, type AnonServerPolicy, CeremonyPhase, ConnectVault, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, SignInResult, ceremonyPhaseLabel, createAnonServerPolicy, createPasskeySigner, createWallet, passkeyLogin };
+export { type AnonChallengeResult, type AnonServerPolicy, CeremonyPhase, ConnectVault, type ContinueResult, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, SignInResult, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, createWallet, passkeyLogin };

package/dist/index.js

@@ -1,169 +1,31 @@
 import {
   ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
-  base64urlToBytes,
-  bytesToBase64url,
   ceremonyPhaseLabel,
+  continueWithDexter,
   createAnonServerPolicy,
   createPasskeySigner,
+  createWallet,
   ejectActiveWallet,
   forgetWallet,
   getActiveHandle,
   getCredentialId,
   listWallets,
-  openCeremonyPopup,
   passkeyLogin,
   passkeySignalSupport,
   prunePasskey,
   renamePasskey,
   resolveIdentity,
   setActiveHandle,
-  shouldUsePopup,
   subscribe,
   switchWallet,
   syncAcceptedPasskeys
-} from "./chunk-6NIGGPVI.js";
-
-// src/enroll.ts
-var DEFAULT_API_BASE = "https://api.dexter.cash";
-var DEFAULT_RP_ID = "dexter.cash";
-var DEFAULT_WALLET_NAME = "Dexter Wallet";
-async function createWallet(config = {}) {
-  if (shouldUsePopup(config.transport)) {
-    return openCeremonyPopup("create", {
-      connectHost: config.connectHost,
-      name: config.name,
-      apiBase: config.apiBase
-    });
-  }
-  if (typeof navigator === "undefined" || !navigator.credentials) {
-    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
-  }
-  const apiBase = (config.apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
-  const rpId = config.rpId ?? DEFAULT_RP_ID;
-  const name = config.name && config.name.trim() || DEFAULT_WALLET_NAME;
-  config.onPhase?.("challenge");
-  const options = await fetchEnrollChallenge(apiBase);
-  config.onPhase?.("passkey");
-  const credential = await createCredential(options, name, rpId);
-  config.onPhase?.("verifying");
-  const enrolled = await submitEnrollComplete(apiBase, credential);
-  config.onPhase?.("finalizing");
-  const init = await initializeVault(apiBase, enrolled.userHandle, enrolled.credentialId);
-  setActiveHandle(enrolled.userHandle, name, enrolled.credentialId);
-  return {
-    handle: enrolled.userHandle,
-    credentialId: enrolled.credentialId,
-    vault: {
-      vaultPda: init.vaultPda,
-      swigAddress: init.swigStateAddress,
-      // FAIL SAFE: never invent a receive address — null until the server returns
-      // one (depositing to the config PDA would strand funds).
-      receiveAddress: init.receiveAddress ?? null,
-      usdcAta: null,
-      // swig not deployed yet (counterfactual pattern)
-      publicKey: enrolled.publicKey,
-      userHandle: enrolled.userHandle,
-      credentialId: enrolled.credentialId
-    }
-  };
-}
-async function fetchEnrollChallenge(apiBase) {
-  const res = await fetch(`${apiBase}/api/passkey-anon/enroll/challenge`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: "{}"
-  });
-  if (!res.ok) throw new ConnectError("enroll_challenge_failed", `enroll/challenge ${res.status}`);
-  const data = await res.json();
-  if (!data?.options?.challenge) {
-    throw new ConnectError("enroll_challenge_malformed", "no creation options in response");
-  }
-  return data.options;
-}
-async function createCredential(options, name, rpId) {
-  let credential;
-  try {
-    credential = await navigator.credentials.create({
-      publicKey: buildCreationOptions(options, name, rpId)
-    });
-  } catch (err) {
-    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
-  }
-  if (!credential || credential.type !== "public-key") {
-    throw new ConnectError("no_credential", "authenticator returned no credential");
-  }
-  return credential;
-}
-async function submitEnrollComplete(apiBase, credential) {
-  const attestation = credential.response;
-  const credentialJson = {
-    id: credential.id,
-    rawId: bytesToBase64url(new Uint8Array(credential.rawId)),
-    type: credential.type,
-    response: {
-      attestationObject: bytesToBase64url(new Uint8Array(attestation.attestationObject)),
-      clientDataJSON: bytesToBase64url(new Uint8Array(attestation.clientDataJSON)),
-      transports: typeof attestation.getTransports === "function" ? attestation.getTransports() : []
-    },
-    clientExtensionResults: credential.getClientExtensionResults?.() ?? {},
-    authenticatorAttachment: credential.authenticatorAttachment ?? null
-  };
-  const res = await fetch(`${apiBase}/api/passkey-anon/enroll/complete`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ credential: credentialJson })
-  });
-  if (!res.ok) throw new ConnectError(await readErrorCode(res), `enroll/complete ${res.status}`);
-  return await res.json();
-}
-async function initializeVault(apiBase, userHandle, credentialId) {
-  const res = await fetch(`${apiBase}/api/passkey-vault-anon/initialize`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ userHandle, credentialId, coolingOffSeconds: 0 })
-  });
-  if (!res.ok) throw new ConnectError(await readErrorCode(res), `initialize ${res.status}`);
-  return await res.json();
-}
-function toBuf(b64url) {
-  return base64urlToBytes(b64url).buffer.slice(0);
-}
-function buildCreationOptions(o, name, rpId) {
-  return {
-    // rp.name = the site shown in the keychain; user.name/displayName = the
-    // wallet label the user sees. We override the server's user.name (a raw,
-    // unreadable handle) with the chosen wallet name.
-    rp: { id: o.rp.id ?? rpId, name: "Dexter" },
-    user: {
-      id: toBuf(o.user.id),
-      name,
-      displayName: name
-    },
-    challenge: toBuf(o.challenge),
-    pubKeyCredParams: o.pubKeyCredParams,
-    timeout: o.timeout,
-    excludeCredentials: o.excludeCredentials?.map((c) => ({
-      id: toBuf(c.id),
-      type: c.type,
-      transports: c.transports
-    })),
-    authenticatorSelection: o.authenticatorSelection,
-    attestation: o.attestation
-  };
-}
-async function readErrorCode(res) {
-  try {
-    const body = await res.json();
-    if (body?.error) return body.error;
-  } catch {
-  }
-  return `http_${res.status}`;
-}
+} from "./chunk-RLVMYLHC.js";
 export {
   ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
   ceremonyPhaseLabel,
+  continueWithDexter,
   createAnonServerPolicy,
   createPasskeySigner,
   createWallet,

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
-import { C as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, a as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-DM7IQdq6.js';
+import { a as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-BuP-7inZ.js';
 import { ReactElement, ReactNode } from 'react';
 
 type ConnectStatus = 'idle' | 'pending' | 'done' | 'error';

package/dist/react.js

@@ -14,7 +14,7 @@ import {
   setActiveHandle,
   subscribe,
   switchWallet
-} from "./chunk-6NIGGPVI.js";
+} from "./chunk-RLVMYLHC.js";
 
 // src/useSignInWithDexter.ts
 import { useCallback, useEffect, useMemo, useState } from "react";

package/dist/{signals-DM7IQdq6.d.ts → signals-BuP-7inZ.d.ts}

@@ -180,4 +180,4 @@ declare function syncAcceptedPasskeys(args: {
     rpId?: string;
 }): Promise<boolean>;
 
-export { ACTIVE_WALLET_STORAGE_KEY as A, type CeremonyPhase as C, type DexterConnectConfig as D, type IdentityInput as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type ConnectVault as a, ConnectError as b, type IdentityKind as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };
+export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type IdentityInput as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CeremonyPhase as a, ConnectError as b, type IdentityKind as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {
@@ -32,5 +32,8 @@
     "tsup": "^8.5.0",
     "typescript": "^5.6.2",
     "vitest": "^4.1.9"
+  },
+  "dependencies": {
+    "@simplewebauthn/browser": "^13.3.0"
   }
 }