@dexterai/connect 0.14.0 → 0.16.0

package/dist/{chunk-IUZBHWTP.js → chunk-Y22JFT53.js}

@@ -124,57 +124,8 @@ function onStorageEvent(e) {
 }
 var ACTIVE_WALLET_STORAGE_KEY = ACTIVE_HANDLE_KEY;
 
-// src/base64.ts
-function base64ToBytes(s) {
-  const bin = atob(s);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
-  return out;
-}
-function base64urlToBytes(s) {
-  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
-  return base64ToBytes(b64);
-}
-function bytesToBase64(bytes) {
-  let bin = "";
-  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
-  return btoa(bin);
-}
-function bytesToBase64url(bytes) {
-  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function compactSignatureToDer(compact) {
-  if (compact.length !== 64) {
-    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
-  }
-  const r = derInteger(compact.subarray(0, 32));
-  const s = derInteger(compact.subarray(32, 64));
-  const body = new Uint8Array(r.length + s.length);
-  body.set(r, 0);
-  body.set(s, r.length);
-  const out = new Uint8Array(2 + body.length);
-  out[0] = 48;
-  out[1] = body.length;
-  out.set(body, 2);
-  return out;
-}
-function derInteger(component) {
-  let start = 0;
-  while (start < component.length - 1 && component[start] === 0) start += 1;
-  let content = component.subarray(start);
-  if (content[0] & 128) {
-    const padded = new Uint8Array(content.length + 1);
-    padded[0] = 0;
-    padded.set(content, 1);
-    content = padded;
-  }
-  const out = new Uint8Array(2 + content.length);
-  out[0] = 2;
-  out[1] = content.length;
-  out.set(content, 2);
-  return out;
-}
+// src/enroll.ts
+import { startRegistration } from "@simplewebauthn/browser";
 
 // src/popup.ts
 var DEFAULT_CONNECT_HOST = "https://dexter.cash/connect";
@@ -282,9 +233,19 @@ async function createWallet(config = {}) {
   config.onPhase?.("challenge");
   const options = await fetchEnrollChallenge(apiBase);
   config.onPhase?.("passkey");
-  const credential = await createCredential(options, name, rpId);
+  const optionsJSON = {
+    ...options,
+    rp: { ...options.rp, id: options.rp.id ?? rpId, name: "Dexter" },
+    user: { ...options.user, name, displayName: name }
+  };
+  let regResponse;
+  try {
+    regResponse = await startRegistration({ optionsJSON });
+  } catch (err) {
+    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
+  }
   config.onPhase?.("verifying");
-  const enrolled = await submitEnrollComplete(apiBase, credential);
+  const enrolled = await submitEnrollComplete(apiBase, regResponse);
   config.onPhase?.("finalizing");
   const init = await initializeVault(apiBase, enrolled.userHandle, enrolled.credentialId);
   setActiveHandle(enrolled.userHandle, name, enrolled.credentialId);
@@ -318,38 +279,11 @@ async function fetchEnrollChallenge(apiBase) {
   }
   return data.options;
 }
-async function createCredential(options, name, rpId) {
-  let credential;
-  try {
-    credential = await navigator.credentials.create({
-      publicKey: buildCreationOptions(options, name, rpId)
-    });
-  } catch (err) {
-    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
-  }
-  if (!credential || credential.type !== "public-key") {
-    throw new ConnectError("no_credential", "authenticator returned no credential");
-  }
-  return credential;
-}
-async function submitEnrollComplete(apiBase, credential) {
-  const attestation = credential.response;
-  const credentialJson = {
-    id: credential.id,
-    rawId: bytesToBase64url(new Uint8Array(credential.rawId)),
-    type: credential.type,
-    response: {
-      attestationObject: bytesToBase64url(new Uint8Array(attestation.attestationObject)),
-      clientDataJSON: bytesToBase64url(new Uint8Array(attestation.clientDataJSON)),
-      transports: typeof attestation.getTransports === "function" ? attestation.getTransports() : []
-    },
-    clientExtensionResults: credential.getClientExtensionResults?.() ?? {},
-    authenticatorAttachment: credential.authenticatorAttachment ?? null
-  };
+async function submitEnrollComplete(apiBase, response) {
   const res = await fetch(`${apiBase}/api/passkey-anon/enroll/complete`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ credential: credentialJson })
+    body: JSON.stringify({ credential: response })
   });
   if (!res.ok) throw new ConnectError(await readErrorCode(res), `enroll/complete ${res.status}`);
   return await res.json();
@@ -363,32 +297,6 @@ async function initializeVault(apiBase, userHandle, credentialId) {
   if (!res.ok) throw new ConnectError(await readErrorCode(res), `initialize ${res.status}`);
   return await res.json();
 }
-function toBuf(b64url) {
-  return base64urlToBytes(b64url).buffer.slice(0);
-}
-function buildCreationOptions(o, name, rpId) {
-  return {
-    // rp.name = the site shown in the keychain; user.name/displayName = the
-    // wallet label the user sees. We override the server's user.name (a raw,
-    // unreadable handle) with the chosen wallet name.
-    rp: { id: o.rp.id ?? rpId, name: "Dexter" },
-    user: {
-      id: toBuf(o.user.id),
-      name,
-      displayName: name
-    },
-    challenge: toBuf(o.challenge),
-    pubKeyCredParams: o.pubKeyCredParams,
-    timeout: o.timeout,
-    excludeCredentials: o.excludeCredentials?.map((c) => ({
-      id: toBuf(c.id),
-      type: c.type,
-      transports: c.transports
-    })),
-    authenticatorSelection: o.authenticatorSelection,
-    attestation: o.attestation
-  };
-}
 async function readErrorCode(res) {
   try {
     const body = await res.json();
@@ -399,6 +307,7 @@ async function readErrorCode(res) {
 }
 
 // src/relay.ts
+import { startAuthentication, browserSupportsWebAuthn } from "@simplewebauthn/browser";
 var DEFAULT_API_BASE2 = "https://api.dexter.cash";
 var ANON_SIGN_BASE = "/api/passkey-anon/sign";
 async function passkeyLogin(config = {}, onPhase) {
@@ -408,13 +317,21 @@ async function passkeyLogin(config = {}, onPhase) {
       apiBase: config.apiBase
     });
   }
+  if (!browserSupportsWebAuthn()) {
+    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
+  }
   const apiBase = (config.apiBase ?? DEFAULT_API_BASE2).replace(/\/$/, "");
   onPhase?.("challenge");
   const options = await fetchLoginChallenge(apiBase);
   onPhase?.("passkey");
-  const credential = await getAssertion(options);
+  let response;
+  try {
+    response = await startAuthentication({ optionsJSON: options });
+  } catch (err) {
+    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
+  }
   onPhase?.("verifying");
-  return submitLogin(apiBase, credential);
+  return submitLogin(apiBase, response);
 }
 async function continueWithDexter(config = {}, onPhase) {
   if (shouldUsePopup(config.transport)) {
@@ -446,47 +363,11 @@ async function fetchLoginChallenge(apiBase) {
   }
   return data.options;
 }
-async function getAssertion(options) {
-  if (typeof navigator === "undefined" || !navigator.credentials) {
-    throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
-  }
-  let credential;
-  try {
-    credential = await navigator.credentials.get({
-      publicKey: {
-        challenge: base64urlToBytes(options.challenge).buffer.slice(0),
-        rpId: options.rpId,
-        timeout: options.timeout ?? 6e4,
-        userVerification: options.userVerification ?? "required"
-        // No allowCredentials — discoverable resident-key login.
-      }
-    });
-  } catch (err) {
-    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
-  }
-  if (!credential || credential.type !== "public-key") {
-    throw new ConnectError("no_credential", "WebAuthn returned no credential");
-  }
-  return credential;
-}
-async function submitLogin(apiBase, credential) {
-  const assertion = credential.response;
-  const credentialJson = {
-    id: credential.id,
-    rawId: bytesToBase64url(new Uint8Array(credential.rawId)),
-    type: credential.type,
-    response: {
-      clientDataJSON: bytesToBase64url(new Uint8Array(assertion.clientDataJSON)),
-      authenticatorData: bytesToBase64url(new Uint8Array(assertion.authenticatorData)),
-      signature: bytesToBase64url(new Uint8Array(assertion.signature)),
-      userHandle: assertion.userHandle ? bytesToBase64url(new Uint8Array(assertion.userHandle)) : null
-    },
-    clientExtensionResults: credential.getClientExtensionResults?.() ?? {}
-  };
+async function submitLogin(apiBase, response) {
   const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/passkey-login`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ credential: credentialJson })
+    body: JSON.stringify({ credential: response })
   });
   if (!res.ok) {
     throw new ConnectError(await readErrorCode2(res), `passkey-login ${res.status}`);
@@ -510,6 +391,62 @@ async function readErrorCode2(res) {
   return `http_${res.status}`;
 }
 
+// src/base64.ts
+function base64ToBytes(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function base64urlToBytes(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  return base64ToBytes(b64);
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function bytesToBase64url(bytes) {
+  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlToBase64(s) {
+  const t = s.replace(/-/g, "+").replace(/_/g, "/");
+  return t + "=".repeat((4 - t.length % 4) % 4);
+}
+function compactSignatureToDer(compact) {
+  if (compact.length !== 64) {
+    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
+  }
+  const r = derInteger(compact.subarray(0, 32));
+  const s = derInteger(compact.subarray(32, 64));
+  const body = new Uint8Array(r.length + s.length);
+  body.set(r, 0);
+  body.set(s, r.length);
+  const out = new Uint8Array(2 + body.length);
+  out[0] = 48;
+  out[1] = body.length;
+  out.set(body, 2);
+  return out;
+}
+function derInteger(component) {
+  let start = 0;
+  while (start < component.length - 1 && component[start] === 0) start += 1;
+  let content = component.subarray(start);
+  if (content[0] & 128) {
+    const padded = new Uint8Array(content.length + 1);
+    padded[0] = 0;
+    padded.set(content, 1);
+    content = padded;
+  }
+  const out = new Uint8Array(2 + content.length);
+  out[0] = 2;
+  out[1] = content.length;
+  out.set(content, 2);
+  return out;
+}
+
 // src/anon-policy.ts
 var DEFAULT_API_BASE3 = "https://api.dexter.cash";
 var ANON_SIGN_BASE2 = "/api/passkey-anon/sign";
@@ -689,6 +626,8 @@ export {
   createWallet,
   passkeyLogin,
   continueWithDexter,
+  bytesToBase64url,
+  base64urlToBase64,
   createAnonServerPolicy,
   createPasskeySigner,
   resolveIdentity,

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as ConnectVault, D as DexterConnectConfig, a as CeremonyPhase, S as SignInResult } from './signals-BuP-7inZ.js';
-export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, I as IdentityInput, c as IdentityKind, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-BuP-7inZ.js';
+import { C as ConnectVault, D as DexterConnectConfig, a as CeremonyPhase, S as SignInResult, I as IdentityKind } from './signals-BaXobUfB.js';
+export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, c as IdentityInput, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-BaXobUfB.js';
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
 
 interface CreateWalletConfig extends DexterConnectConfig {
@@ -116,4 +116,135 @@ declare function createPasskeySigner(vault: ConnectVault, apiBase?: string, opts
  */
 declare function ceremonyPhaseLabel(phase: CeremonyPhase): string;
 
-export { type AnonChallengeResult, type AnonServerPolicy, CeremonyPhase, ConnectVault, type ContinueResult, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, SignInResult, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, createWallet, passkeyLogin };
+/** The automatic role-2 agent-spend rail. */
+interface AutomaticAgentSpend {
+    /** true = agent-spend is ON (not revoked). Derived from revokedAt === null. */
+    active: boolean;
+    /** ISO timestamp the rail was revoked, or null when active. */
+    revokedAt: string | null;
+    /**
+     * On-chain role-2 arm state, decoded from authority.signer by the backend:
+     *   true  = armed (the rail is live and can spend)
+     *   false = dormant (granted but not yet armed — arms on first pay)
+     *   null  = indeterminate (vault not activated, or a transient chain read failed)
+     * NEVER derived from liveSessionCount (that counts the wrong session model).
+     */
+    armed: boolean | null;
+    spentTodayAtomic?: string;
+    dailyCapAtomic?: string;
+    perCallCapAtomic?: string;
+    lifetimeSpentAtomic?: string;
+}
+/** One explicit user-opened Tab (a V6 per-counterparty session). */
+interface AgentSpendTab {
+    /** The session pubkey — the handle a Tab revoke targets. */
+    id: string;
+    /** The counterparty (agent/app) address this Tab authorizes. */
+    counterparty: string;
+    /** Display label: the Dexter-verified app name, else a shortened address. */
+    label: string;
+    /** Whether the Tab is currently live (not expired/spent-out/revoked). */
+    live: boolean;
+    /** Spent so far against this Tab's cap, atomic USDC (6dp) string. */
+    spentAtomic: string;
+    /** This Tab's spending cap, atomic USDC (6dp) string. */
+    capAtomic: string;
+    /** Unix seconds when the Tab expires. */
+    expiresAt: number;
+}
+/** The honest two-mode status: one balance, two separately-accounted rails. */
+interface AgentSpendStatus {
+    /** Vault USDC balance, atomic (6dp) string — the ONE pool both rails draw. */
+    balanceAtomic: string | null;
+    /** The automatic role-2 rail. */
+    automatic: AutomaticAgentSpend;
+    /** The explicit Tabs. */
+    tabs: AgentSpendTab[];
+}
+/** The fields of GET /status the two-mode read consumes. */
+interface RawAgentSpendStatus {
+    /** ISO timestamp when revoked, null when active. Top-level on /status. */
+    agentSpendRevokedAt?: string | null;
+    /** On-chain armed read (authority.signer). true/false/null. Top-level on /status. */
+    agentSpendArmed?: boolean | null;
+    /** On-chain block; usdcAtomic is the vault balance. */
+    onchain?: {
+        usdcAtomic?: string | null;
+        /** Present but DELIBERATELY UNUSED here — counts the wrong session model. */
+        liveSessionCount?: number;
+    } | null;
+    agentSpendDaily?: {
+        spentTodayAtomic?: string;
+        dailyCapAtomic?: string;
+        perCallCapAtomic?: string;
+        lifetimeSpentAtomic?: string;
+    } | null;
+}
+/** The fields of one GET /sessions row the Tabs rail consumes. */
+interface RawAgentSpendSession {
+    sessionPubkey: string;
+    counterparty: string;
+    appName?: string | null;
+    live: boolean;
+    spent: string;
+    maxAmount: string;
+    expiresAt: number;
+}
+/**
+ * Assemble the honest two-mode agent-spend status from the raw /status response
+ * and the raw /sessions rows. Pure: no fetch, no clock, no I/O.
+ */
+declare function assembleAgentSpendStatus(status: RawAgentSpendStatus, sessions?: RawAgentSpendSession[]): AgentSpendStatus;
+/**
+ * The minimal identity the off/on switch needs: WHO is active + the wallet
+ * handle the anon router keys on. Structurally satisfied by connect's
+ * ResolvedIdentity (pass it straight through), or hand-build `{ kind, userHandle }`.
+ */
+interface AgentSpendIdentity {
+    /** Passkey-vault-first identity axis. Agent-spend is Dexter-Wallet-only. */
+    kind: IdentityKind;
+    /** The passkey-vault user handle the anon router addresses, or null. */
+    userHandle: string | null;
+}
+/** Typed error whose `code` is the server's snake_case error string. */
+declare class AgentSpendError extends Error {
+    readonly code: string;
+    constructor(code: string, message?: string);
+}
+/** Map an AgentSpendError.code to plain, user-facing copy. */
+declare function describeAgentSpendError(code: string): string;
+interface RevokeAgentSpendResult {
+    revoked: boolean;
+}
+/**
+ * Revoke the AUTOMATIC role-2 agent-spend rail — the off-switch. Takes effect on
+ * the very next agent payment (the spend path reads agent_spend_revoked_at fresh
+ * per spend). Dexter-Wallet (anon-vault) only; `credentialId` (base64url) targets
+ * the biometric prompt.
+ *
+ * @param id            WHO is active — must be the passkey-vault (Dexter Wallet).
+ * @param vaultPda      The vault PDA, base58 string. Becomes the signed message.
+ * @param apiOrigin     The dexter-api origin (e.g. https://api.dexter.cash). The
+ *                      caller owns env; connect reads none.
+ * @param credentialId  The wallet's passkey credential id (base64url), to make
+ *                      the assertion a direct biometric, not an account picker.
+ */
+declare function revokeAgentSpend(id: AgentSpendIdentity, vaultPda: string, apiOrigin: string, credentialId?: string | null): Promise<RevokeAgentSpendResult>;
+interface EnableAgentSpendResult {
+    enabled: boolean;
+}
+/**
+ * Re-enable the AUTOMATIC role-2 agent-spend rail — the ON switch. Turning spend
+ * back ON is the dangerous direction, so it is a two-step, replay-protected nonce
+ * flow: fetch a server-minted nonce+expiry (inert until redeemed), sign
+ * enableAgentSpendMessage over those EXACT values as the WebAuthn challenge,
+ * submit. Dexter-Wallet (anon-vault) only.
+ *
+ * @param id            WHO is active — must be the passkey-vault (Dexter Wallet).
+ * @param vaultPda      The vault PDA, base58 string.
+ * @param apiOrigin     The dexter-api origin (e.g. https://api.dexter.cash).
+ * @param credentialId  The wallet's passkey credential id (base64url).
+ */
+declare function enableAgentSpend(id: AgentSpendIdentity, vaultPda: string, apiOrigin: string, credentialId?: string | null): Promise<EnableAgentSpendResult>;
+
+export { AgentSpendError, type AgentSpendIdentity, type AgentSpendStatus, type AgentSpendTab, type AnonChallengeResult, type AnonServerPolicy, type AutomaticAgentSpend, CeremonyPhase, ConnectVault, type ContinueResult, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, type EnableAgentSpendResult, IdentityKind, type RawAgentSpendSession, type RawAgentSpendStatus, type RevokeAgentSpendResult, SignInResult, assembleAgentSpendStatus, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, createWallet, describeAgentSpendError, enableAgentSpend, passkeyLogin, revokeAgentSpend };

package/dist/index.js

@@ -1,6 +1,8 @@
 import {
   ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
+  base64urlToBase64,
+  bytesToBase64url,
   ceremonyPhaseLabel,
   continueWithDexter,
   createAnonServerPolicy,
@@ -20,16 +22,168 @@ import {
   subscribe,
   switchWallet,
   syncAcceptedPasskeys
-} from "./chunk-IUZBHWTP.js";
+} from "./chunk-Y22JFT53.js";
+
+// src/agentSpend.ts
+import { PublicKey } from "@solana/web3.js";
+import { startAuthentication } from "@simplewebauthn/browser";
+import { revokeAgentSpendMessage, enableAgentSpendMessage } from "@dexterai/vault/messages";
+import { DEXTER_VAULT_PROGRAM_ID } from "@dexterai/vault/constants";
+function shortCounterparty(a) {
+  return a.length > 12 ? `${a.slice(0, 4)}\u2026${a.slice(-4)}` : a;
+}
+function assembleAgentSpendStatus(status, sessions = []) {
+  const revokedAt = status.agentSpendRevokedAt ?? null;
+  const daily = status.agentSpendDaily ?? null;
+  const automatic = {
+    active: revokedAt === null,
+    revokedAt,
+    // THE honest read: the dedicated armed field, never liveSessionCount.
+    armed: status.agentSpendArmed ?? null
+  };
+  if (daily) {
+    if (daily.spentTodayAtomic !== void 0) automatic.spentTodayAtomic = daily.spentTodayAtomic;
+    if (daily.dailyCapAtomic !== void 0) automatic.dailyCapAtomic = daily.dailyCapAtomic;
+    if (daily.perCallCapAtomic !== void 0) automatic.perCallCapAtomic = daily.perCallCapAtomic;
+    if (daily.lifetimeSpentAtomic !== void 0) automatic.lifetimeSpentAtomic = daily.lifetimeSpentAtomic;
+  }
+  return {
+    balanceAtomic: status.onchain?.usdcAtomic ?? null,
+    automatic,
+    tabs: sessions.map((s) => ({
+      id: s.sessionPubkey,
+      counterparty: s.counterparty,
+      label: s.appName?.trim() || shortCounterparty(s.counterparty),
+      live: s.live,
+      spentAtomic: s.spent,
+      capAtomic: s.maxAmount,
+      expiresAt: s.expiresAt
+    }))
+  };
+}
+var AgentSpendError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+    this.name = "AgentSpendError";
+  }
+};
+function describeAgentSpendError(code) {
+  switch (code) {
+    case "verification_failed":
+      return "That passkey didn't verify \u2014 try again.";
+    case "missing_fields":
+      return "The request was incomplete \u2014 try again.";
+    case "vault_not_found":
+      return "No wallet found for this passkey.";
+    case "nonce_not_found":
+    case "nonce_already_used":
+      return "That confirmation expired \u2014 tap again to retry.";
+    case "revoke_failed":
+    case "enable_failed":
+      return "The server couldn't complete it \u2014 try again shortly.";
+    case "not_guest":
+      return "This control is only available on a Dexter Wallet.";
+    default:
+      return code;
+  }
+}
+async function agentSpendError(res) {
+  let code = `http_${res.status}`;
+  try {
+    const body = await res.json();
+    if (body?.error) code = String(body.error);
+  } catch {
+  }
+  return new AgentSpendError(code, `agent-spend ${res.status}: ${code}`);
+}
+function assertDexterWallet(id) {
+  if (id.kind !== "passkey-vault") {
+    throw new AgentSpendError("not_guest", "agent-spend off/on switch is Dexter Wallet only");
+  }
+}
+function normalizeOrigin(apiOrigin) {
+  return apiOrigin.trim().replace(/\/$/, "");
+}
+function rpId() {
+  return typeof window !== "undefined" ? window.location.hostname : "dexter.cash";
+}
+async function assertOverMessage(messageBytes, credentialId) {
+  const resp = await startAuthentication({
+    optionsJSON: {
+      challenge: bytesToBase64url(messageBytes),
+      rpId: rpId(),
+      userVerification: "required",
+      ...credentialId ? { allowCredentials: [{ id: credentialId, type: "public-key" }] } : {}
+    }
+  });
+  return {
+    clientDataJSON: base64urlToBase64(resp.response.clientDataJSON),
+    authenticatorData: base64urlToBase64(resp.response.authenticatorData),
+    signature: base64urlToBase64(resp.response.signature)
+  };
+}
+async function revokeAgentSpend(id, vaultPda, apiOrigin, credentialId) {
+  assertDexterWallet(id);
+  const origin = normalizeOrigin(apiOrigin);
+  const message = revokeAgentSpendMessage({
+    programId: DEXTER_VAULT_PROGRAM_ID,
+    vaultPda: new PublicKey(vaultPda)
+  });
+  const signed = await assertOverMessage(message, credentialId);
+  const res = await fetch(`${origin}/api/passkey-vault-anon/revoke-agent-spend`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ userHandle: id.userHandle, signedPasskeyPayload: signed })
+  });
+  if (!res.ok) throw await agentSpendError(res);
+  return await res.json();
+}
+async function enableAgentSpend(id, vaultPda, apiOrigin, credentialId) {
+  assertDexterWallet(id);
+  const origin = normalizeOrigin(apiOrigin);
+  const challengeRes = await fetch(
+    `${origin}/api/passkey-vault-anon/enable-agent-spend/challenge`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ userHandle: id.userHandle })
+    }
+  );
+  if (!challengeRes.ok) throw await agentSpendError(challengeRes);
+  const { nonce, expiry } = await challengeRes.json();
+  const message = enableAgentSpendMessage({
+    programId: DEXTER_VAULT_PROGRAM_ID,
+    vaultPda: new PublicKey(vaultPda),
+    nonce: BigInt(nonce),
+    expiry: BigInt(expiry)
+  });
+  const signed = await assertOverMessage(message, credentialId);
+  const verifyRes = await fetch(
+    `${origin}/api/passkey-vault-anon/enable-agent-spend/verify`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ userHandle: id.userHandle, nonce, signedPasskeyPayload: signed })
+    }
+  );
+  if (!verifyRes.ok) throw await agentSpendError(verifyRes);
+  return await verifyRes.json();
+}
 export {
   ACTIVE_WALLET_STORAGE_KEY,
+  AgentSpendError,
   ConnectError,
+  assembleAgentSpendStatus,
   ceremonyPhaseLabel,
   continueWithDexter,
   createAnonServerPolicy,
   createPasskeySigner,
   createWallet,
+  describeAgentSpendError,
   ejectActiveWallet,
+  enableAgentSpend,
   forgetWallet,
   getActiveHandle,
   getCredentialId,
@@ -39,6 +193,7 @@ export {
   prunePasskey,
   renamePasskey,
   resolveIdentity,
+  revokeAgentSpend,
   setActiveHandle,
   subscribe as subscribeWallet,
   switchWallet,

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
-import { a as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-BuP-7inZ.js';
+import { a as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-BaXobUfB.js';
 import { ReactElement, ReactNode } from 'react';
 
 type ConnectStatus = 'idle' | 'pending' | 'done' | 'error';

package/dist/react.js

@@ -14,7 +14,7 @@ import {
   setActiveHandle,
   subscribe,
   switchWallet
-} from "./chunk-IUZBHWTP.js";
+} from "./chunk-Y22JFT53.js";
 
 // src/useSignInWithDexter.ts
 import { useCallback, useEffect, useMemo, useState } from "react";

package/dist/{signals-BuP-7inZ.d.ts → signals-BaXobUfB.d.ts}

@@ -180,4 +180,4 @@ declare function syncAcceptedPasskeys(args: {
     rpId?: string;
 }): Promise<boolean>;
 
-export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type IdentityInput as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CeremonyPhase as a, ConnectError as b, type IdentityKind as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };
+export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type IdentityKind as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CeremonyPhase as a, ConnectError as b, type IdentityInput as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {
@@ -22,15 +22,25 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@dexterai/vault": ">=0.19",
+    "@dexterai/vault": ">=0.22",
+    "@solana/web3.js": "^1.98.0",
     "react": ">=18"
   },
+  "peerDependenciesMeta": {
+    "@solana/web3.js": {
+      "optional": true
+    }
+  },
   "devDependencies": {
-    "@dexterai/vault": "^0.19.0",
+    "@dexterai/vault": "^0.24.0",
+    "@solana/web3.js": "^1.98.4",
     "@types/react": "^19.1.12",
     "react": "^19.2.5",
     "tsup": "^8.5.0",
     "typescript": "^5.6.2",
     "vitest": "^4.1.9"
+  },
+  "dependencies": {
+    "@simplewebauthn/browser": "^13.3.0"
   }
 }