@dexterai/connect 0.16.0 → 0.18.0

package/README.md

@@ -5,7 +5,7 @@
 <h1 align="center">@dexterai/connect</h1>
 
 <p align="center">
-  <strong>Sign in with Dexter — passkey sign-in for any app. Tap your face, you're in: a non-custodial Dexter Wallet and its live USD balance, in one component.</strong>
+  <strong>Sign in with Dexter. One passkey tap gives any website a non-custodial Dexter Wallet, and gives any server an offline-verifiable session.</strong>
 </p>
 
 <p align="center">
@@ -18,23 +18,31 @@
 
 ## What this is
 
-A React connector that adds **"Sign in with Dexter"** to any app. One
-`<SignInWithDexter/>` button runs a discoverable passkey ceremony — the user
-taps their face and you get back a session plus their non-custodial **Dexter
-Wallet** (address + live USD balance). No password, no seed phrase, no
-extension.
+A `<SignInWithDexter/>` button runs a discoverable passkey ceremony. The user
+taps their face, and your app gets back a session plus their **Dexter
+Wallet**: address, live USD balance, and the rails for an agent to spend from
+it under on-chain limits. The user holds their own keys; only their passkey
+moves funds, enforced on-chain. Composes
+[`@dexterai/vault`](https://www.npmjs.com/package/@dexterai/vault).
 
-The user holds their own keys. Nothing here is custodial — only the user's
-passkey moves funds, enforced on-chain. Composes
-[`@dexterai/vault`](https://www.npmjs.com/package/@dexterai/vault); the only
-peer is React.
+Four entry points cover the whole flow:
+
+| Entry point | Runs in | What it gives you |
+|---|---|---|
+| `@dexterai/connect` | browser | framework-free core: `passkeyLogin`, `createWallet`, `continueWithDexter`, the wallet store, agent-spend controls |
+| `@dexterai/connect/react` | browser | `<SignInWithDexter/>`, the branded wallet kit, hooks |
+| `@dexterai/connect/server` | Node 18+, Workers, Vercel edge | `verifyDexterSession`: offline session verification |
+| `@dexterai/connect/worldid` | browser | `<VerifyPersonhood/>` World ID proof-of-personhood button |
 
 ## Install
 
 ```bash
-npm install @dexterai/connect react
+npm install @dexterai/connect @dexterai/vault react
 ```
 
+`@solana/web3.js` and `@worldcoin/idkit` are optional peers: the first for
+agent-spend signing, the second only if you use the World ID button.
+
 ## Quick start
 
 ```tsx
@@ -52,39 +60,128 @@ function Header() {
 }
 ```
 
-Signed out, it renders a **Sign in with Dexter** button. On success it becomes
-a compact chip — the Dexter Wallet address + **"$X.XX available."**
+Signed out, it renders a **Sign in with Dexter** button. Connected, it becomes
+the wallet chip: address plus **"$X.XX available."**
 
-## Hook (full control)
+## Works on any website
+
+The ceremony is not limited to dexter.cash. On a foreign origin, `passkeyLogin`
+opens a hosted popup on `dexter.cash/connect`, runs the ceremony there, and
+posts the result back to your page (origin-checked and nonce-bound on both
+sides). The default `transport: 'auto'` picks the right mode; `'popup'` and
+`'inline'` force it.
+
+```ts
+import { passkeyLogin } from '@dexterai/connect';
+
+const { session, vault } = await passkeyLogin({ transport: 'auto' });
+```
 
-For your own UI, use the hook directly:
+## Verify the session on your server
+
+```ts
+import { createDexterClient } from '@dexterai/connect/server';
+
+const dexter = createDexterClient(); // parameterized on (iss, jwksUrl); defaults to Dexter's issuer
+
+export async function handler(req: Request) {
+  const auth = await dexter.authenticateRequest(req);
+  if (!auth.isSignedIn) return new Response('unauthorized', { status: 401 });
+  auth.sub;          // stable user id
+  auth.vaultAddress; // the Dexter Wallet address, from the signed dexter claim
+  auth.claims;       // full verified JWT payload
+}
+```
+
+Verification is a local ES256 signature check against a cached JWKS. The first
+call fetches the key set; every later call is pure local crypto with zero
+network (measured at ~0.6ms). The algorithm list is pinned to ES256, and
+issuer plus audience are always checked. `verifyDexterSession(token, options)`
+does the same for a bare token string, and `jwtKey` accepts a public JWK for
+fully networkless deployments.
+
+## Hook (full control)
 
 ```tsx
 import { useSignInWithDexter } from '@dexterai/connect/react';
 
 const c = useSignInWithDexter();
 await c.signIn();        // run the passkey ceremony
-c.status;                // idle → pending → done → error
+c.status;                // idle -> pending -> done -> error
 c.vaultAddress;          // the Dexter Wallet address (base58)
 c.usdcBalance;           // USD available (via Dexter's RPC), or null
 c.disconnect();
 ```
 
-## What `useSignInWithDexter()` gives you
-
 | Field | What it is |
 |---|---|
 | `signIn()` / `disconnect()` | run the passkey ceremony / clear state |
-| `status` / `isVaultConnected` | `idle→pending→done→error` / connected flag |
+| `status` / `isVaultConnected` | `idle->pending->done->error` / connected flag |
 | `session` | auth session tokens (camelCase) |
 | `vaultAddress` / `vaultPda` | the Dexter Wallet address / PDA |
 | `usdcBalance` / `refreshBalance()` | USD available, best-effort via Dexter's RPC |
 | `vault` / `credentialId` / `error` | raw vault payload / credential id / typed error |
 
-## Exports
+## The wallet kit
+
+Branded, presentational pieces that share one implementation across every
+Dexter surface, themed with `--dx-*` CSS variables: `DexterButton` (and
+`DexterMark`) for any action that should look like Dexter, `DexterWalletChip`
+as the header trigger, `DexterWalletMenu` for manage / save / start-fresh, and
+the `useDexterWallet` + `useIdentity` hooks to drive them.
+
+## Agent spend
+
+The control surface for letting an agent spend from the connected wallet:
+
+```ts
+import {
+  assembleAgentSpendStatus, // honest two-mode status read
+  enableAgentSpend,         // the on switch
+  revokeAgentSpend,         // the off switch
+  createPasskeySigner,      // @dexterai/vault guest signer for x402 / tab flows
+} from '@dexterai/connect';
+```
+
+The verbs are framework-free and take `apiOrigin` as a parameter; the SDK
+reads no environment variables.
+
+## World ID
+
+```tsx
+import { VerifyPersonhood } from '@dexterai/connect/worldid';
+
+<VerifyPersonhood onSuccess={(proof) => sendToYourVerifier(proof)} />
+```
 
-- `@dexterai/connect` — framework-free: `passkeyLogin()`, `ConnectError`, types.
-- `@dexterai/connect/react` — `<SignInWithDexter/>`, `useSignInWithDexter()`.
+`useVerifyPersonhood` is the headless version. Requires the optional
+`@worldcoin/idkit` peer.
+
+## Wallet lifecycle
+
+- `createWallet` mints a brand-new named passkey + vault; `passkeyLogin` signs
+  an existing one in; `continueWithDexter` resumes a known wallet.
+- The **wallet store** (`getActiveHandle`, `listWallets`, `switchWallet`,
+  `ejectActiveWallet`, `forgetWallet`, `subscribeWallet`) is the canonical
+  owner of the active-wallet handle. Read and write through it rather than
+  touching localStorage.
+- The **WebAuthn Signal API** helpers (`renamePasskey`, `prunePasskey`,
+  `syncAcceptedPasskeys`, `passkeySignalSupport`) keep the OS keychain in sync
+  where the browser supports it.
+- `resolveIdentity` combines the wallet handle with whatever account token you
+  pass in; `ceremonyPhaseLabel` gives shared copy for connecting-step UI;
+  `createAnonServerPolicy` builds the anonymous server policy for the signer.
+
+## Peer dependencies
+
+| Peer | Required | Why |
+|---|---|---|
+| `react` >=18 | yes | the `/react` and `/worldid` surfaces |
+| `@dexterai/vault` >=0.30 | yes | signer + agent-spend message builders (0.30 matches the deployed program's account layout) |
+| `@solana/web3.js` | optional | agent-spend signing paths |
+| `@worldcoin/idkit` | optional | only for `/worldid` |
+
+The `/server` entry has none of these peers; it depends only on `jose`.
 
 ## License
 

package/dist/chunk-S7G2ZZOO.js

@@ -0,0 +1,107 @@
+// src/DexterButton.tsx
+import { useEffect } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var STYLE_ID = "dexter-connect-button-styles";
+var BUTTON_CSS = `
+@keyframes dx-spin { to { transform: rotate(360deg); } }
+@keyframes dx-pulse { 0%,100% { opacity: 1; } 50% { opacity: .6; } }
+.dx-btn{
+  --dx-ember:#f26c18; --dx-ember-2:#ba3a00; --dx-fg:#fff4ea; --dx-radius:0px;
+  position:relative; display:inline-flex; align-items:center; justify-content:center; gap:10px;
+  padding:11px 22px; border:1px solid color-mix(in srgb,var(--dx-ember) 55%,transparent);
+  border-radius:var(--dx-radius);
+  background:linear-gradient(135deg,var(--dx-ember),var(--dx-ember-2));
+  color:var(--dx-fg); font:inherit; font-weight:600; font-size:.78rem; letter-spacing:.12em;
+  text-transform:uppercase; cursor:pointer; -webkit-tap-highlight-color:transparent;
+  box-shadow:0 14px 26px color-mix(in srgb,var(--dx-ember) 24%,transparent);
+  transition:transform .16s ease, box-shadow .16s ease, filter .16s ease, background .16s ease;
+}
+.dx-btn:hover{ transform:translateY(-1px); filter:brightness(1.07); box-shadow:0 20px 34px color-mix(in srgb,var(--dx-ember) 32%,transparent); }
+.dx-btn:active{ transform:translateY(0); filter:brightness(.97); box-shadow:0 8px 16px color-mix(in srgb,var(--dx-ember) 22%,transparent); }
+.dx-btn:focus-visible{ outline:none; box-shadow:0 0 0 3px color-mix(in srgb,var(--dx-ember) 38%,transparent); }
+.dx-btn:disabled{ cursor:default; filter:saturate(.85) brightness(.98); }
+.dx-btn--secondary{ background:transparent; color:var(--dx-ember); box-shadow:none; border-color:color-mix(in srgb,var(--dx-ember) 45%,transparent); }
+.dx-btn--secondary:hover{ background:color-mix(in srgb,var(--dx-ember) 9%,transparent); filter:none; box-shadow:none; }
+.dx-btn--block{ width:100%; }
+.dx-btn__mark{ flex-shrink:0; }
+.dx-btn__spin{ width:15px; height:15px; flex-shrink:0; border-radius:50%;
+  border:2px solid color-mix(in srgb,currentColor 30%,transparent); border-top-color:currentColor;
+  animation:dx-spin .7s linear infinite; }
+.dx-btn__doing{ animation:dx-pulse 1.4s ease-in-out infinite; }
+.dx-chip{ display:inline-flex; align-items:center; gap:8px; padding:6px 10px; font:inherit;
+  font-variant-numeric:tabular-nums; border-radius:var(--dx-radius,0);
+  border:1px solid color-mix(in srgb,var(--dx-ember,#f26c18) 35%,transparent); }
+.dx-chip__dot{ width:7px; height:7px; border-radius:50%; background:var(--dx-ember,#f26c18); }
+.dx-chip__bal{ font-weight:600; opacity:.85; }
+.dx-chip__x{ margin-left:2px; border:none; background:transparent; color:inherit; cursor:pointer; font-size:16px; line-height:1; opacity:.6; }
+.dx-chip__x:hover{ opacity:1; }
+`;
+function ensureDexterButtonStyles() {
+  if (typeof document === "undefined") return;
+  if (document.getElementById(STYLE_ID)) return;
+  const el = document.createElement("style");
+  el.id = STYLE_ID;
+  el.textContent = BUTTON_CSS;
+  document.head.appendChild(el);
+}
+ensureDexterButtonStyles();
+function cx(...parts) {
+  return parts.filter(Boolean).join(" ");
+}
+function DexterMark() {
+  return /* @__PURE__ */ jsxs(
+    "svg",
+    {
+      className: "dx-btn__mark",
+      width: "18",
+      height: "18",
+      viewBox: "0 0 300 300",
+      fill: "currentColor",
+      "aria-hidden": "true",
+      children: [
+        /* @__PURE__ */ jsx("path", { d: "M143.18,22.65c35.41,7.66,68.19,23.6,94.89,48.28,5.22,4.86,11.17,10.45,15.18,16.1,1.38,1.93,1.94,3.6.99,5.23-1.08,1.92-4.22,3.41-6.56,4.17-28.39,9.43-61.55,8.26-88.62-4.69-13.81-7.66-17.02-5.76-31.67-3.48-21.89,2.38-46.67.37-65.06-12.31-6.07-4.99-9.33-12.71-8.8-20.52-.16-9.4,4.25-18.12,11.47-24.06,21.29-17.85,52.64-14.45,78-8.77l.18.04h0Z" }),
+        /* @__PURE__ */ jsx("path", { d: "M46.08,129.98c1.06-1.03,3.52-1.07,5.29-1.04,48.98-.05,98.1-.06,146.83-.1,17.53.14,35.01-.31,52.49.18,2.13.18,3.89.74,4.73,2.05,1.46,2.38.35,6.09-1.98,7.6-3.66,2.05-8.62,1.33-12.86,1.74-2.85.12-5.45.13-7.02,2.02-.91,1.07-1.28,2.56-1.56,3.95-.57,3.23-1.16,6.52-1.89,9.62-2.81,12.43-8.68,24.65-19.76,31.56-9.49,5.59-20.42,6.86-31.2,5.75-11.88-1.69-22.15-8.81-29.11-18.28-3.51-4.81-4.92-10.5-5.8-16.29-.47-2.56-.51-5.87-1.35-8-1.16-3.38-6.14-2.59-9.25-1.92-4.21.95-4.39,5.7-5.14,9.19-2.25,11.18-6.84,20.68-16.15,27.65-1.31,1.05-2.91,2.03-2.12,3.66,2.5,3.21,6.65,4.49,10.44,5.97,3.26,1.17,6.86,2.41,7.18,6.06.05,8.18-11.97,3.46-16.32,1.85-3.95-1.55-7.4-4.27-10.42-7.26-3.92-4.28-9.66-4.5-15.16-4.45-3.45-.07-6.99-.19-10.45-.82-21.29-4-31.08-21.3-30.9-42.01-.08-4.63.03-9.32.09-13.91.04-1.69.07-3.46,1.28-4.67l.1-.09h0Z" }),
+        /* @__PURE__ */ jsx("path", { d: "M173.06,203.11c9.24-.06,21.6,4.49,22.85,14.84.3,2.12-.67,4.34-2.92,4.73-1.38.29-2.88-.05-4.09-.75-1.64-.9-2.97-2.86-4.19-3.05-1.33-.2-1.99.81-2.93,1.94-10.27,13.34-28.04,20.92-44.83,20.42-15.41-.33-31.89-5.95-43.53-17.34-3.15-3.39-1.55-9.88,3.61-9.19,1.83.32,3.29,1.45,4.76,2.65,10.49,10.12,24.85,14.04,39.12,13.03,10.55-1.23,20.38-5.47,28.74-11.92,1.11-1.06,4.45-3.63,3.5-5.12-.76-.85-4.31-.47-5.92-2.01-2.25-1.92-1.39-6.22,1.16-7.36,1.36-.65,2.96-.81,4.47-.86h.2,0Z" })
+      ]
+    }
+  );
+}
+function DexterButton(props) {
+  const {
+    children,
+    loading = false,
+    loadingLabel = "Connecting\u2026",
+    variant = "primary",
+    block = false,
+    withMark = true,
+    onClick,
+    disabled = false,
+    className,
+    type = "button"
+  } = props;
+  useEffect(ensureDexterButtonStyles, []);
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      type,
+      className: cx("dx-btn", variant === "secondary" && "dx-btn--secondary", block && "dx-btn--block", className),
+      onClick,
+      disabled: disabled || loading,
+      "aria-busy": loading,
+      children: loading ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx("span", { className: "dx-btn__spin", "aria-hidden": true }),
+        /* @__PURE__ */ jsx("span", { className: "dx-btn__doing", children: loadingLabel })
+      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        withMark && /* @__PURE__ */ jsx(DexterMark, {}),
+        children
+      ] })
+    }
+  );
+}
+
+export {
+  ensureDexterButtonStyles,
+  cx,
+  DexterMark,
+  DexterButton
+};

package/dist/react.js

@@ -15,6 +15,12 @@ import {
   subscribe,
   switchWallet
 } from "./chunk-Y22JFT53.js";
+import {
+  DexterButton,
+  DexterMark,
+  cx,
+  ensureDexterButtonStyles
+} from "./chunk-S7G2ZZOO.js";
 
 // src/useSignInWithDexter.ts
 import { useCallback, useEffect, useMemo, useState } from "react";
@@ -123,111 +129,8 @@ function useSignInWithDexter(config = {}) {
 }
 
 // src/SignInWithDexter.tsx
-import { useEffect as useEffect3 } from "react";
-
-// src/DexterButton.tsx
 import { useEffect as useEffect2 } from "react";
-import { Fragment, jsx, jsxs } from "react/jsx-runtime";
-var STYLE_ID = "dexter-connect-button-styles";
-var BUTTON_CSS = `
-@keyframes dx-spin { to { transform: rotate(360deg); } }
-@keyframes dx-pulse { 0%,100% { opacity: 1; } 50% { opacity: .6; } }
-.dx-btn{
-  --dx-ember:#f26c18; --dx-ember-2:#ba3a00; --dx-fg:#fff4ea; --dx-radius:0px;
-  position:relative; display:inline-flex; align-items:center; justify-content:center; gap:10px;
-  padding:11px 22px; border:1px solid color-mix(in srgb,var(--dx-ember) 55%,transparent);
-  border-radius:var(--dx-radius);
-  background:linear-gradient(135deg,var(--dx-ember),var(--dx-ember-2));
-  color:var(--dx-fg); font:inherit; font-weight:600; font-size:.78rem; letter-spacing:.12em;
-  text-transform:uppercase; cursor:pointer; -webkit-tap-highlight-color:transparent;
-  box-shadow:0 14px 26px color-mix(in srgb,var(--dx-ember) 24%,transparent);
-  transition:transform .16s ease, box-shadow .16s ease, filter .16s ease, background .16s ease;
-}
-.dx-btn:hover{ transform:translateY(-1px); filter:brightness(1.07); box-shadow:0 20px 34px color-mix(in srgb,var(--dx-ember) 32%,transparent); }
-.dx-btn:active{ transform:translateY(0); filter:brightness(.97); box-shadow:0 8px 16px color-mix(in srgb,var(--dx-ember) 22%,transparent); }
-.dx-btn:focus-visible{ outline:none; box-shadow:0 0 0 3px color-mix(in srgb,var(--dx-ember) 38%,transparent); }
-.dx-btn:disabled{ cursor:default; filter:saturate(.85) brightness(.98); }
-.dx-btn--secondary{ background:transparent; color:var(--dx-ember); box-shadow:none; border-color:color-mix(in srgb,var(--dx-ember) 45%,transparent); }
-.dx-btn--secondary:hover{ background:color-mix(in srgb,var(--dx-ember) 9%,transparent); filter:none; box-shadow:none; }
-.dx-btn--block{ width:100%; }
-.dx-btn__mark{ flex-shrink:0; }
-.dx-btn__spin{ width:15px; height:15px; flex-shrink:0; border-radius:50%;
-  border:2px solid color-mix(in srgb,currentColor 30%,transparent); border-top-color:currentColor;
-  animation:dx-spin .7s linear infinite; }
-.dx-btn__doing{ animation:dx-pulse 1.4s ease-in-out infinite; }
-.dx-chip{ display:inline-flex; align-items:center; gap:8px; padding:6px 10px; font:inherit;
-  font-variant-numeric:tabular-nums; border-radius:var(--dx-radius,0);
-  border:1px solid color-mix(in srgb,var(--dx-ember,#f26c18) 35%,transparent); }
-.dx-chip__dot{ width:7px; height:7px; border-radius:50%; background:var(--dx-ember,#f26c18); }
-.dx-chip__bal{ font-weight:600; opacity:.85; }
-.dx-chip__x{ margin-left:2px; border:none; background:transparent; color:inherit; cursor:pointer; font-size:16px; line-height:1; opacity:.6; }
-.dx-chip__x:hover{ opacity:1; }
-`;
-function ensureDexterButtonStyles() {
-  if (typeof document === "undefined") return;
-  if (document.getElementById(STYLE_ID)) return;
-  const el = document.createElement("style");
-  el.id = STYLE_ID;
-  el.textContent = BUTTON_CSS;
-  document.head.appendChild(el);
-}
-ensureDexterButtonStyles();
-function cx(...parts) {
-  return parts.filter(Boolean).join(" ");
-}
-function DexterMark() {
-  return /* @__PURE__ */ jsxs(
-    "svg",
-    {
-      className: "dx-btn__mark",
-      width: "18",
-      height: "18",
-      viewBox: "0 0 300 300",
-      fill: "currentColor",
-      "aria-hidden": "true",
-      children: [
-        /* @__PURE__ */ jsx("path", { d: "M143.18,22.65c35.41,7.66,68.19,23.6,94.89,48.28,5.22,4.86,11.17,10.45,15.18,16.1,1.38,1.93,1.94,3.6.99,5.23-1.08,1.92-4.22,3.41-6.56,4.17-28.39,9.43-61.55,8.26-88.62-4.69-13.81-7.66-17.02-5.76-31.67-3.48-21.89,2.38-46.67.37-65.06-12.31-6.07-4.99-9.33-12.71-8.8-20.52-.16-9.4,4.25-18.12,11.47-24.06,21.29-17.85,52.64-14.45,78-8.77l.18.04h0Z" }),
-        /* @__PURE__ */ jsx("path", { d: "M46.08,129.98c1.06-1.03,3.52-1.07,5.29-1.04,48.98-.05,98.1-.06,146.83-.1,17.53.14,35.01-.31,52.49.18,2.13.18,3.89.74,4.73,2.05,1.46,2.38.35,6.09-1.98,7.6-3.66,2.05-8.62,1.33-12.86,1.74-2.85.12-5.45.13-7.02,2.02-.91,1.07-1.28,2.56-1.56,3.95-.57,3.23-1.16,6.52-1.89,9.62-2.81,12.43-8.68,24.65-19.76,31.56-9.49,5.59-20.42,6.86-31.2,5.75-11.88-1.69-22.15-8.81-29.11-18.28-3.51-4.81-4.92-10.5-5.8-16.29-.47-2.56-.51-5.87-1.35-8-1.16-3.38-6.14-2.59-9.25-1.92-4.21.95-4.39,5.7-5.14,9.19-2.25,11.18-6.84,20.68-16.15,27.65-1.31,1.05-2.91,2.03-2.12,3.66,2.5,3.21,6.65,4.49,10.44,5.97,3.26,1.17,6.86,2.41,7.18,6.06.05,8.18-11.97,3.46-16.32,1.85-3.95-1.55-7.4-4.27-10.42-7.26-3.92-4.28-9.66-4.5-15.16-4.45-3.45-.07-6.99-.19-10.45-.82-21.29-4-31.08-21.3-30.9-42.01-.08-4.63.03-9.32.09-13.91.04-1.69.07-3.46,1.28-4.67l.1-.09h0Z" }),
-        /* @__PURE__ */ jsx("path", { d: "M173.06,203.11c9.24-.06,21.6,4.49,22.85,14.84.3,2.12-.67,4.34-2.92,4.73-1.38.29-2.88-.05-4.09-.75-1.64-.9-2.97-2.86-4.19-3.05-1.33-.2-1.99.81-2.93,1.94-10.27,13.34-28.04,20.92-44.83,20.42-15.41-.33-31.89-5.95-43.53-17.34-3.15-3.39-1.55-9.88,3.61-9.19,1.83.32,3.29,1.45,4.76,2.65,10.49,10.12,24.85,14.04,39.12,13.03,10.55-1.23,20.38-5.47,28.74-11.92,1.11-1.06,4.45-3.63,3.5-5.12-.76-.85-4.31-.47-5.92-2.01-2.25-1.92-1.39-6.22,1.16-7.36,1.36-.65,2.96-.81,4.47-.86h.2,0Z" })
-      ]
-    }
-  );
-}
-function DexterButton(props) {
-  const {
-    children,
-    loading = false,
-    loadingLabel = "Connecting\u2026",
-    variant = "primary",
-    block = false,
-    withMark = true,
-    onClick,
-    disabled = false,
-    className,
-    type = "button"
-  } = props;
-  useEffect2(ensureDexterButtonStyles, []);
-  return /* @__PURE__ */ jsx(
-    "button",
-    {
-      type,
-      className: cx("dx-btn", variant === "secondary" && "dx-btn--secondary", block && "dx-btn--block", className),
-      onClick,
-      disabled: disabled || loading,
-      "aria-busy": loading,
-      children: loading ? /* @__PURE__ */ jsxs(Fragment, { children: [
-        /* @__PURE__ */ jsx("span", { className: "dx-btn__spin", "aria-hidden": true }),
-        /* @__PURE__ */ jsx("span", { className: "dx-btn__doing", children: loadingLabel })
-      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-        withMark && /* @__PURE__ */ jsx(DexterMark, {}),
-        children
-      ] })
-    }
-  );
-}
-
-// src/SignInWithDexter.tsx
-import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+import { jsx, jsxs } from "react/jsx-runtime";
 function shortAddress(addr) {
   return addr.length > 10 ? `${addr.slice(0, 4)}\u2026${addr.slice(-4)}` : addr;
 }
@@ -245,7 +148,7 @@ function SignInWithDexter(props) {
     showConnectedChip = true,
     ...config
   } = props;
-  useEffect3(ensureDexterButtonStyles, []);
+  useEffect2(ensureDexterButtonStyles, []);
   const c = useSignInWithDexter(config);
   const handleClick = async () => {
     try {
@@ -256,17 +159,17 @@ function SignInWithDexter(props) {
   };
   if (c.isVaultConnected) {
     if (!showConnectedChip) return null;
-    return /* @__PURE__ */ jsxs2("span", { className: cx("dx-chip", className), children: [
-      /* @__PURE__ */ jsx2("span", { className: "dx-chip__dot", "aria-hidden": true }),
-      /* @__PURE__ */ jsx2("span", { children: c.vaultAddress ? shortAddress(c.vaultAddress) : "Connected" }),
-      c.usdcBalance !== null && /* @__PURE__ */ jsxs2("span", { className: "dx-chip__bal", children: [
+    return /* @__PURE__ */ jsxs("span", { className: cx("dx-chip", className), children: [
+      /* @__PURE__ */ jsx("span", { className: "dx-chip__dot", "aria-hidden": true }),
+      /* @__PURE__ */ jsx("span", { children: c.vaultAddress ? shortAddress(c.vaultAddress) : "Connected" }),
+      c.usdcBalance !== null && /* @__PURE__ */ jsxs("span", { className: "dx-chip__bal", children: [
         formatUsd(c.usdcBalance),
         " available"
       ] }),
-      /* @__PURE__ */ jsx2("button", { type: "button", className: "dx-chip__x", onClick: c.disconnect, "aria-label": "Disconnect", children: "\xD7" })
+      /* @__PURE__ */ jsx("button", { type: "button", className: "dx-chip__x", onClick: c.disconnect, "aria-label": "Disconnect", children: "\xD7" })
     ] });
   }
-  return /* @__PURE__ */ jsx2(
+  return /* @__PURE__ */ jsx(
     DexterButton,
     {
       loading: c.status === "pending",
@@ -281,13 +184,13 @@ function SignInWithDexter(props) {
 }
 
 // src/useDexterWallet.ts
-import { useCallback as useCallback2, useEffect as useEffect4, useState as useState2 } from "react";
+import { useCallback as useCallback2, useEffect as useEffect3, useState as useState2 } from "react";
 var NO_SUPPORT = { rename: false, prune: false, syncAccepted: false };
 function useDexterWallet() {
   const [activeHandle, setHandle] = useState2(() => getActiveHandle());
   const [wallets, setWallets] = useState2(() => listWallets());
   const [support, setSupport] = useState2(NO_SUPPORT);
-  useEffect4(() => {
+  useEffect3(() => {
     const sync = () => {
       setHandle(getActiveHandle());
       setWallets(listWallets());
@@ -324,10 +227,10 @@ function useDexterWallet() {
 }
 
 // src/DexterWalletChip.tsx
-import { useEffect as useEffect5 } from "react";
+import { useEffect as useEffect4 } from "react";
 
 // src/walletKitStyles.ts
-var STYLE_ID2 = "dexter-connect-wallet-kit-styles";
+var STYLE_ID = "dexter-connect-wallet-kit-styles";
 var WALLET_KIT_CSS = `
 .dx-wchip{
   --dx-ember:#f26c18; --dx-ember-2:#ba3a00; --dx-fg:#fff4ea; --dx-radius:0px;
@@ -366,21 +269,21 @@ var WALLET_KIT_CSS = `
 `;
 function ensureWalletKitStyles() {
   if (typeof document === "undefined") return;
-  if (document.getElementById(STYLE_ID2)) return;
+  if (document.getElementById(STYLE_ID)) return;
   const el = document.createElement("style");
-  el.id = STYLE_ID2;
+  el.id = STYLE_ID;
   el.textContent = WALLET_KIT_CSS;
   document.head.appendChild(el);
 }
 ensureWalletKitStyles();
 
 // src/DexterWalletChip.tsx
-import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 function DexterWalletChip(props) {
   const { connected, label, avatarUrl, avatarInitial, onClick, className, ariaExpanded } = props;
-  useEffect5(ensureWalletKitStyles, []);
+  useEffect4(ensureWalletKitStyles, []);
   const initial = (avatarInitial ?? label.trim().charAt(0) ?? "D").toUpperCase();
-  return /* @__PURE__ */ jsxs3(
+  return /* @__PURE__ */ jsxs2(
     "button",
     {
       type: "button",
@@ -388,64 +291,64 @@ function DexterWalletChip(props) {
       onClick,
       "aria-expanded": ariaExpanded,
       children: [
-        connected ? /* @__PURE__ */ jsx3("span", { className: "dx-wchip__avatar", "aria-hidden": "true", children: avatarUrl ? /* @__PURE__ */ jsx3("img", { src: avatarUrl, alt: "" }) : initial }) : null,
-        /* @__PURE__ */ jsx3("span", { className: "dx-wchip__label", children: label })
+        connected ? /* @__PURE__ */ jsx2("span", { className: "dx-wchip__avatar", "aria-hidden": "true", children: avatarUrl ? /* @__PURE__ */ jsx2("img", { src: avatarUrl, alt: "" }) : initial }) : null,
+        /* @__PURE__ */ jsx2("span", { className: "dx-wchip__label", children: label })
       ]
     }
   );
 }
 
 // src/DexterWalletMenu.tsx
-import { useEffect as useEffect6, useState as useState3 } from "react";
-import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+import { useEffect as useEffect5, useState as useState3 } from "react";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
 function DexterWalletMenu(props) {
   const { walletLabel, avatarInitial, onManageWallet, onStartFresh, saveSlot, saveHint, className } = props;
-  useEffect6(ensureWalletKitStyles, []);
+  useEffect5(ensureWalletKitStyles, []);
   const [showSave, setShowSave] = useState3(false);
   const initial = (avatarInitial ?? walletLabel.trim().charAt(0) ?? "D").toUpperCase();
   if (showSave && saveSlot) {
-    return /* @__PURE__ */ jsxs4("div", { className: cx("dx-wmenu", className), children: [
-      /* @__PURE__ */ jsx4(
+    return /* @__PURE__ */ jsxs3("div", { className: cx("dx-wmenu", className), children: [
+      /* @__PURE__ */ jsx3(
         "button",
         {
           type: "button",
           className: "dx-wmenu__item dx-wmenu__back",
           onClick: () => setShowSave(false),
-          children: /* @__PURE__ */ jsx4("span", { children: "\u2190 Back to wallet" })
+          children: /* @__PURE__ */ jsx3("span", { children: "\u2190 Back to wallet" })
         }
       ),
-      /* @__PURE__ */ jsxs4("div", { className: "dx-wmenu__save", children: [
-        saveHint ? /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__savehint", children: saveHint }) : null,
+      /* @__PURE__ */ jsxs3("div", { className: "dx-wmenu__save", children: [
+        saveHint ? /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__savehint", children: saveHint }) : null,
         saveSlot
       ] })
     ] });
   }
-  return /* @__PURE__ */ jsxs4("div", { className: cx("dx-wmenu", className), children: [
-    /* @__PURE__ */ jsxs4("div", { className: "dx-wmenu__id", children: [
-      /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__avatar", "aria-hidden": "true", children: initial }),
-      /* @__PURE__ */ jsxs4("span", { className: "dx-wmenu__meta", children: [
-        /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__name", children: walletLabel }),
-        /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__sub", children: "Your Dexter Wallet" })
+  return /* @__PURE__ */ jsxs3("div", { className: cx("dx-wmenu", className), children: [
+    /* @__PURE__ */ jsxs3("div", { className: "dx-wmenu__id", children: [
+      /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__avatar", "aria-hidden": "true", children: initial }),
+      /* @__PURE__ */ jsxs3("span", { className: "dx-wmenu__meta", children: [
+        /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__name", children: walletLabel }),
+        /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__sub", children: "Your Dexter Wallet" })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs4("div", { className: "dx-wmenu__list", children: [
-      onManageWallet ? /* @__PURE__ */ jsxs4("button", { type: "button", className: "dx-wmenu__item", onClick: onManageWallet, children: [
-        /* @__PURE__ */ jsx4("span", { children: "Manage wallet" }),
-        /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__icon", "aria-hidden": "true", children: "\u2197" })
+    /* @__PURE__ */ jsxs3("div", { className: "dx-wmenu__list", children: [
+      onManageWallet ? /* @__PURE__ */ jsxs3("button", { type: "button", className: "dx-wmenu__item", onClick: onManageWallet, children: [
+        /* @__PURE__ */ jsx3("span", { children: "Manage wallet" }),
+        /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__icon", "aria-hidden": "true", children: "\u2197" })
       ] }) : null,
-      saveSlot ? /* @__PURE__ */ jsxs4("button", { type: "button", className: "dx-wmenu__item", onClick: () => setShowSave(true), children: [
-        /* @__PURE__ */ jsx4("span", { children: "Save your wallet" }),
-        /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__icon", "aria-hidden": "true", children: "\u2197" })
+      saveSlot ? /* @__PURE__ */ jsxs3("button", { type: "button", className: "dx-wmenu__item", onClick: () => setShowSave(true), children: [
+        /* @__PURE__ */ jsx3("span", { children: "Save your wallet" }),
+        /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__icon", "aria-hidden": "true", children: "\u2197" })
       ] }) : null,
-      onStartFresh ? /* @__PURE__ */ jsxs4(
+      onStartFresh ? /* @__PURE__ */ jsxs3(
         "button",
         {
           type: "button",
           className: "dx-wmenu__item dx-wmenu__item--danger",
           onClick: onStartFresh,
           children: [
-            /* @__PURE__ */ jsx4("span", { children: "Start fresh" }),
-            /* @__PURE__ */ jsx4("span", { className: "dx-wmenu__icon", "aria-hidden": "true", children: "\u27F5" })
+            /* @__PURE__ */ jsx3("span", { children: "Start fresh" }),
+            /* @__PURE__ */ jsx3("span", { className: "dx-wmenu__icon", "aria-hidden": "true", children: "\u27F5" })
           ]
         }
       ) : null

package/dist/server.d.ts

@@ -0,0 +1,72 @@
+import { JWTPayload, JWK, JSONWebKeySet } from 'jose';
+
+/**
+ * @dexterai/connect/server — offline Dexter session verification.
+ *
+ * The server half of Sign in with Dexter (CONTRACT-dexter-session-token.md):
+ * a local ES256 signature check against the published JWKS — no call to
+ * Supabase or dexter-api on the hot path, so it runs on Node and edge
+ * runtimes alike. Pre-hook tokens (no `dexter` claim) verify as signed-in
+ * with `vaultAddress: null`; once the access-token hook is enabled the
+ * claim appears with no code change here.
+ *
+ * Phase 1 issuer is Supabase (CONTRACT §3); everything is parameterized on
+ * (iss, jwksUrl) so the Phase-2 sovereign cutover is a config flip.
+ */
+
+declare const DEFAULT_ISS = "https://qdgumpoqnthrjfmqziwm.supabase.co/auth/v1";
+declare const DEFAULT_AUDIENCE = "authenticated";
+/** The namespaced claim sealed into the token by the access-token hook. */
+interface DexterClaim {
+    ver: number;
+    /** Swig state address (base58) — the canonical Dexter Wallet identity. */
+    vault: string;
+    /** 16-byte passkey handle, base64url; absent on rows without one. */
+    userHandle?: string;
+    agentGrant?: unknown;
+}
+type VerifyFailureReason = 'no_token' | 'invalid' | 'expired' | 'issuer_mismatch' | 'audience_mismatch';
+type DexterSession = {
+    isSignedIn: true;
+    sub: string;
+    vaultAddress: string | null;
+    userHandle: string | null;
+    agentGrant: unknown;
+    sessionId: string | null;
+    aal: string | null;
+    claims: JWTPayload & {
+        dexter?: DexterClaim;
+    };
+} | {
+    isSignedIn: false;
+    reason: VerifyFailureReason;
+};
+interface VerifyOptions {
+    /** Expected issuer. Phase 1 default: the Dexter Supabase project. */
+    iss?: string;
+    /** JWKS location; defaults to `${iss}/.well-known/jwks.json`. */
+    jwksUrl?: string;
+    /**
+     * Public key(s) for fully networkless verification (a JWK or a JWKS).
+     * When omitted, the JWKS is fetched once and cached in-instance.
+     */
+    jwtKey?: JWK | JSONWebKeySet;
+    /** Expected audience. Default: Supabase's `authenticated`. */
+    audience?: string;
+}
+/** A fetch-API Request or anything with a node-style headers bag. */
+type RequestLike = Request | {
+    headers: Record<string, string | string[] | undefined>;
+};
+interface DexterClient {
+    verifyDexterSession(token: string): Promise<DexterSession>;
+    authenticateRequest(req: RequestLike): Promise<DexterSession>;
+}
+declare function createDexterClient(options?: VerifyOptions): DexterClient;
+/**
+ * One-off verification. For servers verifying many requests against a
+ * remote JWKS, create a client once instead so the key set caches.
+ */
+declare function verifyDexterSession(token: string, options?: VerifyOptions): Promise<DexterSession>;
+
+export { DEFAULT_AUDIENCE, DEFAULT_ISS, type DexterClaim, type DexterClient, type DexterSession, type RequestLike, type VerifyFailureReason, type VerifyOptions, createDexterClient, verifyDexterSession };

package/dist/server.js

@@ -0,0 +1,90 @@
+// src/server.ts
+import {
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  jwtVerify,
+  errors as joseErrors
+} from "jose";
+var DEFAULT_ISS = "https://qdgumpoqnthrjfmqziwm.supabase.co/auth/v1";
+var DEFAULT_AUDIENCE = "authenticated";
+function buildGetKey(opts) {
+  if (opts.jwtKey) {
+    const set = "keys" in opts.jwtKey ? opts.jwtKey : { keys: [opts.jwtKey] };
+    return createLocalJWKSet(set);
+  }
+  const iss = opts.iss ?? DEFAULT_ISS;
+  const url = new URL(opts.jwksUrl ?? `${iss}/.well-known/jwks.json`);
+  return createRemoteJWKSet(url, {
+    cacheMaxAge: 6e5,
+    cooldownDuration: 3e4,
+    timeoutDuration: 5e3
+  });
+}
+function failureReason(err) {
+  if (err instanceof joseErrors.JWTExpired) return "expired";
+  if (err instanceof joseErrors.JWTClaimValidationFailed) {
+    if (err.claim === "iss") return "issuer_mismatch";
+    if (err.claim === "aud") return "audience_mismatch";
+    if (err.claim === "exp") return "expired";
+  }
+  return "invalid";
+}
+function bearerFrom(req) {
+  let raw;
+  const headers = req.headers;
+  if (headers && typeof headers.get === "function") {
+    raw = headers.get("authorization");
+  } else {
+    const bag = headers;
+    raw = bag.authorization ?? bag.Authorization;
+  }
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (!value) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(value);
+  return match ? match[1] : null;
+}
+function createDexterClient(options = {}) {
+  const iss = options.iss ?? DEFAULT_ISS;
+  const audience = options.audience ?? DEFAULT_AUDIENCE;
+  const getKey = buildGetKey(options);
+  async function verify(token) {
+    try {
+      const { payload } = await jwtVerify(token, getKey, {
+        issuer: iss,
+        audience,
+        algorithms: ["ES256"]
+        // pinned — defeats alg-confusion / alg:none
+      });
+      const dexter = payload.dexter;
+      return {
+        isSignedIn: true,
+        sub: payload.sub ?? "",
+        vaultAddress: dexter?.vault ?? null,
+        userHandle: dexter?.userHandle ?? null,
+        agentGrant: dexter?.agentGrant ?? null,
+        sessionId: payload.session_id ?? null,
+        aal: payload.aal ?? null,
+        claims: payload
+      };
+    } catch (err) {
+      return { isSignedIn: false, reason: failureReason(err) };
+    }
+  }
+  return {
+    verifyDexterSession: verify,
+    async authenticateRequest(req) {
+      const token = bearerFrom(req);
+      if (!token) return { isSignedIn: false, reason: "no_token" };
+      return verify(token);
+    }
+  };
+}
+function verifyDexterSession(token, options = {}) {
+  return createDexterClient(options).verifyDexterSession(token);
+}
+export {
+  DEFAULT_AUDIENCE,
+  DEFAULT_ISS,
+  createDexterClient,
+  verifyDexterSession
+};

package/dist/worldid.d.ts

@@ -0,0 +1,61 @@
+import { ReactElement } from 'react';
+import { IDKitResult } from '@worldcoin/idkit';
+
+type VerifyPersonhoodPhase = 'loading' | 'ready' | 'rp_error' | 'verified';
+interface VerifyPersonhoodConfig {
+    /** World ID app id (`app_…`), from the developer portal. */
+    appId: `app_${string}`;
+    /** The registered action (e.g. `dexter-credit-root-v2`) — pins the nullifier namespace. */
+    action: string;
+    /** `production` | `staging`. Default `production`. */
+    environment?: 'production' | 'staging';
+    /**
+     * URL that returns the SERVER-SIGNED RP context as `{ rp_context: RpContext }`.
+     * The RP signing key is server-side only (never the browser), so the consumer
+     * exposes an endpoint that signs the request and returns just the signed
+     * context. Mirrors the capture rig's `/api/rp-context`.
+     */
+    rpContextUrl: string;
+    /** Optional `fetch` init for the RP-context request (auth headers, etc.). */
+    rpContextInit?: RequestInit;
+}
+interface UseVerifyPersonhood {
+    phase: VerifyPersonhoodPhase;
+    error: string | null;
+    result: IDKitResult | null;
+    /** Open the World App verification sheet. No-op until phase is 'ready'/'verified'. */
+    open: () => void;
+    /** The IDKitRequestWidget element to render (null until the RP context loads). */
+    widget: ReactElement | null;
+}
+/**
+ * Headless hook: manages the RP-context fetch + IDKit lifecycle and hands back
+ * the raw proof. Render `widget` and call `open()` from your own UI, or use the
+ * turnkey <VerifyPersonhood> below.
+ */
+declare function useVerifyPersonhood(config: VerifyPersonhoodConfig, onProof?: (result: IDKitResult) => void, onError?: (error: Error) => void): UseVerifyPersonhood;
+interface VerifyPersonhoodProps extends VerifyPersonhoodConfig {
+    /** Fired with the raw World ID v4 proof the moment verification completes. */
+    onProof?: (result: IDKitResult) => void;
+    /** Fired with the typed error if RP signing or verification fails. */
+    onError?: (error: Error) => void;
+    /** Button label when armed. Default "Verify your personhood". */
+    label?: string;
+    /** Label after a proof is captured. Default "Verify again". */
+    verifiedLabel?: string;
+    /** 'primary' = filled ember (default), 'secondary' = outline. */
+    variant?: 'primary' | 'secondary';
+    /** Full-width button. */
+    block?: boolean;
+    /** Extra className composed after the brand classes. */
+    className?: string;
+}
+/**
+ * Turnkey "Verify your personhood" element — the personhood sibling of
+ * <SignInWithDexter>. Renders the branded DexterButton (loading while the RP
+ * context signs server-side) that opens World App; on success hands the raw
+ * IDKitResult to `onProof`. Brand voice: no emojis. Themeable via --dx-* vars.
+ */
+declare function VerifyPersonhood(props: VerifyPersonhoodProps): ReactElement;
+
+export { type UseVerifyPersonhood, VerifyPersonhood, type VerifyPersonhoodConfig, type VerifyPersonhoodPhase, type VerifyPersonhoodProps, useVerifyPersonhood };

package/dist/worldid.js

@@ -0,0 +1,108 @@
+import {
+  DexterButton,
+  ensureDexterButtonStyles
+} from "./chunk-S7G2ZZOO.js";
+
+// src/worldid.tsx
+import { useEffect, useState } from "react";
+import {
+  IDKitRequestWidget,
+  proofOfHuman
+} from "@worldcoin/idkit";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function useVerifyPersonhood(config, onProof, onError) {
+  const { appId, action, environment = "production", rpContextUrl, rpContextInit } = config;
+  const [phase, setPhase] = useState("loading");
+  const [error, setError] = useState(null);
+  const [rpContext, setRpContext] = useState(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const [result, setResult] = useState(null);
+  useEffect(() => {
+    let cancelled = false;
+    void (async () => {
+      try {
+        const res = await fetch(rpContextUrl, { cache: "no-store", ...rpContextInit });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data?.message ?? `RP context fetch failed (HTTP ${res.status})`);
+        if (cancelled) return;
+        setRpContext(data.rp_context);
+        setPhase("ready");
+      } catch (e) {
+        if (cancelled) return;
+        const err = e instanceof Error ? e : new Error(String(e));
+        setError(err.message);
+        setPhase("rp_error");
+        onError?.(err);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [rpContextUrl]);
+  const widget = rpContext ? /* @__PURE__ */ jsx(
+    IDKitRequestWidget,
+    {
+      app_id: appId,
+      action,
+      rp_context: rpContext,
+      preset: proofOfHuman(),
+      allow_legacy_proofs: false,
+      environment,
+      open: isOpen,
+      onOpenChange: setIsOpen,
+      onSuccess: (res) => {
+        setResult(res);
+        setPhase("verified");
+        onProof?.(res);
+      },
+      onError: (code) => {
+        const err = new Error(`World App error: ${code}`);
+        setError(err.message);
+        onError?.(err);
+      }
+    }
+  ) : null;
+  return {
+    phase,
+    error,
+    result,
+    open: () => {
+      if (phase === "ready" || phase === "verified") setIsOpen(true);
+    },
+    widget
+  };
+}
+function VerifyPersonhood(props) {
+  const {
+    onProof,
+    onError,
+    label = "Verify your personhood",
+    verifiedLabel = "Verify again",
+    variant = "primary",
+    block = false,
+    className,
+    ...config
+  } = props;
+  useEffect(ensureDexterButtonStyles, []);
+  const v = useVerifyPersonhood(config, onProof, onError);
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx(
+      DexterButton,
+      {
+        onClick: v.open,
+        loading: v.phase === "loading",
+        loadingLabel: "Preparing\u2026",
+        variant,
+        block,
+        className,
+        disabled: v.phase === "rp_error",
+        children: v.phase === "verified" ? verifiedLabel : label
+      }
+    ),
+    v.widget
+  ] });
+}
+export {
+  VerifyPersonhood,
+  useVerifyPersonhood
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {
@@ -11,6 +11,14 @@
     "./react": {
       "types": "./dist/react.d.ts",
       "import": "./dist/react.js"
+    },
+    "./worldid": {
+      "types": "./dist/worldid.d.ts",
+      "import": "./dist/worldid.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
     }
   },
   "files": [
@@ -22,25 +30,31 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@dexterai/vault": ">=0.22",
+    "@dexterai/vault": ">=0.30.0",
     "@solana/web3.js": "^1.98.0",
+    "@worldcoin/idkit": "^4.1.8",
     "react": ">=18"
   },
   "peerDependenciesMeta": {
     "@solana/web3.js": {
       "optional": true
+    },
+    "@worldcoin/idkit": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@dexterai/vault": "^0.24.0",
+    "@dexterai/vault": "^0.30.0",
     "@solana/web3.js": "^1.98.4",
     "@types/react": "^19.1.12",
+    "@worldcoin/idkit": "^4.1.8",
     "react": "^19.2.5",
     "tsup": "^8.5.0",
     "typescript": "^5.6.2",
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@simplewebauthn/browser": "^13.3.0"
+    "@simplewebauthn/browser": "^13.3.0",
+    "jose": "^6.2.3"
   }
 }