@dexterai/connect 0.17.0 → 0.19.0

package/README.md

@@ -5,7 +5,7 @@
 <h1 align="center">@dexterai/connect</h1>
 
 <p align="center">
-  <strong>Sign in with Dexter — passkey sign-in for any app. Tap your face, you're in: a non-custodial Dexter Wallet and its live USD balance, in one component.</strong>
+  <strong>Sign in with Dexter. One passkey tap gives any website a non-custodial Dexter Wallet, and gives any server an offline-verifiable session.</strong>
 </p>
 
 <p align="center">
@@ -18,23 +18,31 @@
 
 ## What this is
 
-A React connector that adds **"Sign in with Dexter"** to any app. One
-`<SignInWithDexter/>` button runs a discoverable passkey ceremony — the user
-taps their face and you get back a session plus their non-custodial **Dexter
-Wallet** (address + live USD balance). No password, no seed phrase, no
-extension.
+A `<SignInWithDexter/>` button runs a discoverable passkey ceremony. The user
+taps their face, and your app gets back a session plus their **Dexter
+Wallet**: address, live USD balance, and the rails for an agent to spend from
+it under on-chain limits. The user holds their own keys; only their passkey
+moves funds, enforced on-chain. Composes
+[`@dexterai/vault`](https://www.npmjs.com/package/@dexterai/vault).
 
-The user holds their own keys. Nothing here is custodial — only the user's
-passkey moves funds, enforced on-chain. Composes
-[`@dexterai/vault`](https://www.npmjs.com/package/@dexterai/vault); the only
-peer is React.
+Four entry points cover the whole flow:
+
+| Entry point | Runs in | What it gives you |
+|---|---|---|
+| `@dexterai/connect` | browser | framework-free core: `passkeyLogin`, `createWallet`, `continueWithDexter`, the wallet store, agent-spend controls |
+| `@dexterai/connect/react` | browser | `<SignInWithDexter/>`, the branded wallet kit, hooks |
+| `@dexterai/connect/server` | Node 18+, Workers, Vercel edge | `verifyDexterSession`: offline session verification |
+| `@dexterai/connect/worldid` | browser | `<VerifyPersonhood/>` World ID proof-of-personhood button |
 
 ## Install
 
 ```bash
-npm install @dexterai/connect react
+npm install @dexterai/connect @dexterai/vault react
 ```
 
+`@solana/web3.js` and `@worldcoin/idkit` are optional peers: the first for
+agent-spend signing, the second only if you use the World ID button.
+
 ## Quick start
 
 ```tsx
@@ -52,39 +60,128 @@ function Header() {
 }
 ```
 
-Signed out, it renders a **Sign in with Dexter** button. On success it becomes
-a compact chip — the Dexter Wallet address + **"$X.XX available."**
+Signed out, it renders a **Sign in with Dexter** button. Connected, it becomes
+the wallet chip: address plus **"$X.XX available."**
 
-## Hook (full control)
+## Works on any website
+
+The ceremony is not limited to dexter.cash. On a foreign origin, `passkeyLogin`
+opens a hosted popup on `dexter.cash/connect`, runs the ceremony there, and
+posts the result back to your page (origin-checked and nonce-bound on both
+sides). The default `transport: 'auto'` picks the right mode; `'popup'` and
+`'inline'` force it.
+
+```ts
+import { passkeyLogin } from '@dexterai/connect';
+
+const { session, vault } = await passkeyLogin({ transport: 'auto' });
+```
 
-For your own UI, use the hook directly:
+## Verify the session on your server
+
+```ts
+import { createDexterClient } from '@dexterai/connect/server';
+
+const dexter = createDexterClient(); // parameterized on (iss, jwksUrl); defaults to Dexter's issuer
+
+export async function handler(req: Request) {
+  const auth = await dexter.authenticateRequest(req);
+  if (!auth.isSignedIn) return new Response('unauthorized', { status: 401 });
+  auth.sub;          // stable user id
+  auth.vaultAddress; // the Dexter Wallet address, from the signed dexter claim
+  auth.claims;       // full verified JWT payload
+}
+```
+
+Verification is a local ES256 signature check against a cached JWKS. The first
+call fetches the key set; every later call is pure local crypto with zero
+network (measured at ~0.6ms). The algorithm list is pinned to ES256, and
+issuer plus audience are always checked. `verifyDexterSession(token, options)`
+does the same for a bare token string, and `jwtKey` accepts a public JWK for
+fully networkless deployments.
+
+## Hook (full control)
 
 ```tsx
 import { useSignInWithDexter } from '@dexterai/connect/react';
 
 const c = useSignInWithDexter();
 await c.signIn();        // run the passkey ceremony
-c.status;                // idle → pending → done → error
+c.status;                // idle -> pending -> done -> error
 c.vaultAddress;          // the Dexter Wallet address (base58)
 c.usdcBalance;           // USD available (via Dexter's RPC), or null
 c.disconnect();
 ```
 
-## What `useSignInWithDexter()` gives you
-
 | Field | What it is |
 |---|---|
 | `signIn()` / `disconnect()` | run the passkey ceremony / clear state |
-| `status` / `isVaultConnected` | `idle→pending→done→error` / connected flag |
+| `status` / `isVaultConnected` | `idle->pending->done->error` / connected flag |
 | `session` | auth session tokens (camelCase) |
 | `vaultAddress` / `vaultPda` | the Dexter Wallet address / PDA |
 | `usdcBalance` / `refreshBalance()` | USD available, best-effort via Dexter's RPC |
 | `vault` / `credentialId` / `error` | raw vault payload / credential id / typed error |
 
-## Exports
+## The wallet kit
+
+Branded, presentational pieces that share one implementation across every
+Dexter surface, themed with `--dx-*` CSS variables: `DexterButton` (and
+`DexterMark`) for any action that should look like Dexter, `DexterWalletChip`
+as the header trigger, `DexterWalletMenu` for manage / save / start-fresh, and
+the `useDexterWallet` + `useIdentity` hooks to drive them.
+
+## Agent spend
+
+The control surface for letting an agent spend from the connected wallet:
+
+```ts
+import {
+  assembleAgentSpendStatus, // honest two-mode status read
+  enableAgentSpend,         // the on switch
+  revokeAgentSpend,         // the off switch
+  createPasskeySigner,      // @dexterai/vault guest signer for x402 / tab flows
+} from '@dexterai/connect';
+```
+
+The verbs are framework-free and take `apiOrigin` as a parameter; the SDK
+reads no environment variables.
+
+## World ID
+
+```tsx
+import { VerifyPersonhood } from '@dexterai/connect/worldid';
+
+<VerifyPersonhood onSuccess={(proof) => sendToYourVerifier(proof)} />
+```
 
-- `@dexterai/connect` — framework-free: `passkeyLogin()`, `ConnectError`, types.
-- `@dexterai/connect/react` — `<SignInWithDexter/>`, `useSignInWithDexter()`.
+`useVerifyPersonhood` is the headless version. Requires the optional
+`@worldcoin/idkit` peer.
+
+## Wallet lifecycle
+
+- `createWallet` mints a brand-new named passkey + vault; `passkeyLogin` signs
+  an existing one in; `continueWithDexter` resumes a known wallet.
+- The **wallet store** (`getActiveHandle`, `listWallets`, `switchWallet`,
+  `ejectActiveWallet`, `forgetWallet`, `subscribeWallet`) is the canonical
+  owner of the active-wallet handle. Read and write through it rather than
+  touching localStorage.
+- The **WebAuthn Signal API** helpers (`renamePasskey`, `prunePasskey`,
+  `syncAcceptedPasskeys`, `passkeySignalSupport`) keep the OS keychain in sync
+  where the browser supports it.
+- `resolveIdentity` combines the wallet handle with whatever account token you
+  pass in; `ceremonyPhaseLabel` gives shared copy for connecting-step UI;
+  `createAnonServerPolicy` builds the anonymous server policy for the signer.
+
+## Peer dependencies
+
+| Peer | Required | Why |
+|---|---|---|
+| `react` >=18 | yes | the `/react` and `/worldid` surfaces |
+| `@dexterai/vault` >=0.30 | yes | signer + agent-spend message builders (0.30 matches the deployed program's account layout) |
+| `@solana/web3.js` | optional | agent-spend signing paths |
+| `@worldcoin/idkit` | optional | only for `/worldid` |
+
+The `/server` entry has none of these peers; it depends only on `jose`.
 
 ## License
 

package/dist/{chunk-Y22JFT53.js → chunk-2QZ5QLGI.js}

@@ -124,6 +124,24 @@ function onStorageEvent(e) {
 }
 var ACTIVE_WALLET_STORAGE_KEY = ACTIVE_HANDLE_KEY;
 
+// src/policy.ts
+var SESSION_TTL_30D = "2592000";
+function usdToAtomic(input) {
+  const cleaned = input.trim().replace(/^\$/, "").replace(/,/g, "");
+  if (!/^\d+(\.\d{1,6})?$/.test(cleaned)) return null;
+  const [whole, frac = ""] = cleaned.split(".");
+  try {
+    return BigInt(whole) * 1000000n + BigInt((frac + "000000").slice(0, 6));
+  } catch {
+    return null;
+  }
+}
+function authoredPolicy(usdInput) {
+  const atomic = usdToAtomic(usdInput);
+  if (atomic === null || atomic <= 0n) return null;
+  return { spendLimitAtomic: atomic.toString(), sessionTtlSeconds: SESSION_TTL_30D };
+}
+
 // src/enroll.ts
 import { startRegistration } from "@simplewebauthn/browser";
 
@@ -218,11 +236,13 @@ var DEFAULT_RP_ID = "dexter.cash";
 var DEFAULT_WALLET_NAME = "Dexter Wallet";
 async function createWallet(config = {}) {
   if (shouldUsePopup(config.transport)) {
-    return openCeremonyPopup("create", {
+    const result = await openCeremonyPopup("create", {
       connectHost: config.connectHost,
       name: config.name,
       apiBase: config.apiBase
     });
+    setActiveHandle(result.handle, config.name, result.credentialId);
+    return result;
   }
   if (typeof navigator === "undefined" || !navigator.credentials) {
     throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
@@ -247,7 +267,12 @@ async function createWallet(config = {}) {
   config.onPhase?.("verifying");
   const enrolled = await submitEnrollComplete(apiBase, regResponse);
   config.onPhase?.("finalizing");
-  const init = await initializeVault(apiBase, enrolled.userHandle, enrolled.credentialId);
+  const init = await initializeVault(
+    apiBase,
+    enrolled.userHandle,
+    enrolled.credentialId,
+    config.spendPolicy
+  );
   setActiveHandle(enrolled.userHandle, name, enrolled.credentialId);
   return {
     handle: enrolled.userHandle,
@@ -288,11 +313,16 @@ async function submitEnrollComplete(apiBase, response) {
   if (!res.ok) throw new ConnectError(await readErrorCode(res), `enroll/complete ${res.status}`);
   return await res.json();
 }
-async function initializeVault(apiBase, userHandle, credentialId) {
+async function initializeVault(apiBase, userHandle, credentialId, spendPolicy) {
+  const body = { userHandle, credentialId, coolingOffSeconds: 0 };
+  if (spendPolicy) {
+    body.spendLimitAtomic = spendPolicy.spendLimitAtomic;
+    body.sessionTtlSeconds = SESSION_TTL_30D;
+  }
   const res = await fetch(`${apiBase}/api/passkey-vault-anon/initialize`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ userHandle, credentialId, coolingOffSeconds: 0 })
+    body: JSON.stringify(body)
   });
   if (!res.ok) throw new ConnectError(await readErrorCode(res), `initialize ${res.status}`);
   return await res.json();
@@ -312,10 +342,14 @@ var DEFAULT_API_BASE2 = "https://api.dexter.cash";
 var ANON_SIGN_BASE = "/api/passkey-anon/sign";
 async function passkeyLogin(config = {}, onPhase) {
   if (shouldUsePopup(config.transport)) {
-    return openCeremonyPopup("signin", {
+    const result2 = await openCeremonyPopup("signin", {
       connectHost: config.connectHost,
       apiBase: config.apiBase
     });
+    if (result2.vault) {
+      setActiveHandle(result2.vault.userHandle, void 0, result2.vault.credentialId);
+    }
+    return result2;
   }
   if (!browserSupportsWebAuthn()) {
     throw new ConnectError("webauthn_unsupported", "WebAuthn unavailable in this environment");
@@ -331,15 +365,25 @@ async function passkeyLogin(config = {}, onPhase) {
     throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
   }
   onPhase?.("verifying");
-  return submitLogin(apiBase, response);
+  const result = await submitLogin(apiBase, response);
+  if (result.vault) {
+    setActiveHandle(result.vault.userHandle, void 0, result.vault.credentialId);
+  }
+  return result;
 }
 async function continueWithDexter(config = {}, onPhase) {
   if (shouldUsePopup(config.transport)) {
-    return openCeremonyPopup("continue", {
+    const result2 = await openCeremonyPopup("continue", {
       connectHost: config.connectHost,
       name: config.name,
       apiBase: config.apiBase
     });
+    if (result2.kind === "create") {
+      setActiveHandle(result2.handle, config.name, result2.credentialId);
+    } else if (result2.vault) {
+      setActiveHandle(result2.vault.userHandle, void 0, result2.vault.credentialId);
+    }
+    return result2;
   }
   if (getActiveHandle()) {
     const result2 = await passkeyLogin(config, onPhase);
@@ -623,6 +667,9 @@ export {
   forgetWallet,
   subscribe,
   ACTIVE_WALLET_STORAGE_KEY,
+  SESSION_TTL_30D,
+  usdToAtomic,
+  authoredPolicy,
   createWallet,
   passkeyLogin,
   continueWithDexter,

package/dist/index.d.ts

@@ -1,33 +1,7 @@
-import { C as ConnectVault, D as DexterConnectConfig, a as CeremonyPhase, S as SignInResult, I as IdentityKind } from './signals-BaXobUfB.js';
-export { A as ACTIVE_WALLET_STORAGE_KEY, b as ConnectError, c as IdentityInput, P as PasskeyLoginTokens, d as PasskeySignalSupport, R as ResolvedIdentity, e as StoredWallet, f as ejectActiveWallet, g as forgetWallet, h as getActiveHandle, i as getCredentialId, l as listWallets, p as passkeySignalSupport, j as prunePasskey, r as renamePasskey, k as resolveIdentity, s as setActiveHandle, m as subscribeWallet, n as switchWallet, o as syncAcceptedPasskeys } from './signals-BaXobUfB.js';
+import { S as SignInResult, C as CreateWalletResult, a as CreateWalletConfig, b as CeremonyPhase, D as DexterConnectConfig, c as ConnectVault, I as IdentityKind } from './signals-qc4rDyQ6.js';
+export { A as ACTIVE_WALLET_STORAGE_KEY, d as ConnectError, e as IdentityInput, P as PasskeyLoginTokens, f as PasskeySignalSupport, R as ResolvedIdentity, g as SESSION_TTL_30D, h as SpendPolicy, i as StoredWallet, j as authoredPolicy, k as createWallet, l as ejectActiveWallet, m as forgetWallet, n as getActiveHandle, o as getCredentialId, p as listWallets, q as passkeySignalSupport, r as prunePasskey, s as renamePasskey, t as resolveIdentity, u as setActiveHandle, v as subscribeWallet, w as switchWallet, x as syncAcceptedPasskeys, y as usdToAtomic } from './signals-qc4rDyQ6.js';
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
 
-interface CreateWalletConfig extends DexterConnectConfig {
-    /** Label for the passkey in the OS keychain AND the wallet roster. Set at
-     *  creation — the only moment naming is guaranteed to stick. Default "Dexter Wallet". */
-    name?: string;
-    /** RP id for the new credential. Default "dexter.cash". */
-    rpId?: string;
-    /** Called as the ceremony progresses, for live "connecting steps" UI:
-     *  challenge → passkey → verifying → finalizing. */
-    onPhase?: (phase: CeremonyPhase) => void;
-}
-interface CreateWalletResult {
-    /** Server-minted 16-byte user handle, base64url — the vault identity. */
-    handle: string;
-    /** base64url credential id of the new passkey. */
-    credentialId: string;
-    /** The freshly initialized vault (swig not yet deployed; deploys lazily). */
-    vault: ConnectVault;
-}
-/**
- * Mint a brand-new Dexter wallet (passkey + vault) and make it the active wallet.
- *
- * One passkey approval. Throws ConnectError on any failed leg (the `code` is the
- * server's error string, or webauthn_failed / no_credential for the ceremony).
- */
-declare function createWallet(config?: CreateWalletConfig): Promise<CreateWalletResult>;
-
 /**
  * "Sign in with Dexter" — the discoverable-credential login ceremony.
  *
@@ -247,4 +221,4 @@ interface EnableAgentSpendResult {
  */
 declare function enableAgentSpend(id: AgentSpendIdentity, vaultPda: string, apiOrigin: string, credentialId?: string | null): Promise<EnableAgentSpendResult>;
 
-export { AgentSpendError, type AgentSpendIdentity, type AgentSpendStatus, type AgentSpendTab, type AnonChallengeResult, type AnonServerPolicy, type AutomaticAgentSpend, CeremonyPhase, ConnectVault, type ContinueResult, type CreateWalletConfig, type CreateWalletResult, DexterConnectConfig, type EnableAgentSpendResult, IdentityKind, type RawAgentSpendSession, type RawAgentSpendStatus, type RevokeAgentSpendResult, SignInResult, assembleAgentSpendStatus, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, createWallet, describeAgentSpendError, enableAgentSpend, passkeyLogin, revokeAgentSpend };
+export { AgentSpendError, type AgentSpendIdentity, type AgentSpendStatus, type AgentSpendTab, type AnonChallengeResult, type AnonServerPolicy, type AutomaticAgentSpend, CeremonyPhase, ConnectVault, type ContinueResult, CreateWalletConfig, CreateWalletResult, DexterConnectConfig, type EnableAgentSpendResult, IdentityKind, type RawAgentSpendSession, type RawAgentSpendStatus, type RevokeAgentSpendResult, SignInResult, assembleAgentSpendStatus, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, describeAgentSpendError, enableAgentSpend, passkeyLogin, revokeAgentSpend };

package/dist/index.js

@@ -1,6 +1,8 @@
 import {
   ACTIVE_WALLET_STORAGE_KEY,
   ConnectError,
+  SESSION_TTL_30D,
+  authoredPolicy,
   base64urlToBase64,
   bytesToBase64url,
   ceremonyPhaseLabel,
@@ -21,8 +23,9 @@ import {
   setActiveHandle,
   subscribe,
   switchWallet,
-  syncAcceptedPasskeys
-} from "./chunk-Y22JFT53.js";
+  syncAcceptedPasskeys,
+  usdToAtomic
+} from "./chunk-2QZ5QLGI.js";
 
 // src/agentSpend.ts
 import { PublicKey } from "@solana/web3.js";
@@ -175,7 +178,9 @@ export {
   ACTIVE_WALLET_STORAGE_KEY,
   AgentSpendError,
   ConnectError,
+  SESSION_TTL_30D,
   assembleAgentSpendStatus,
+  authoredPolicy,
   ceremonyPhaseLabel,
   continueWithDexter,
   createAnonServerPolicy,
@@ -197,5 +202,6 @@ export {
   setActiveHandle,
   subscribe as subscribeWallet,
   switchWallet,
-  syncAcceptedPasskeys
+  syncAcceptedPasskeys,
+  usdToAtomic
 };

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
-import { a as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, C as ConnectVault, b as ConnectError, e as StoredWallet, d as PasskeySignalSupport, R as ResolvedIdentity } from './signals-BaXobUfB.js';
+import { b as CeremonyPhase, S as SignInResult, P as PasskeyLoginTokens, c as ConnectVault, d as ConnectError, i as StoredWallet, f as PasskeySignalSupport, R as ResolvedIdentity, C as CreateWalletResult } from './signals-qc4rDyQ6.js';
 import { ReactElement, ReactNode } from 'react';
 
 type ConnectStatus = 'idle' | 'pending' | 'done' | 'error';
@@ -168,4 +168,34 @@ interface UseIdentityConfig {
 }
 declare function useIdentity({ accountToken }: UseIdentityConfig): ResolvedIdentity;
 
-export { type ConnectStatus, DexterButton, type DexterButtonProps, DexterMark, DexterWalletChip, type DexterWalletChipProps, DexterWalletMenu, type DexterWalletMenuProps, SignInWithDexter, type SignInWithDexterProps, type UseDexterWallet, type UseIdentityConfig, type UseSignInWithDexter, type UseSignInWithDexterConfig, useDexterWallet, useIdentity, useSignInWithDexter };
+interface AllowanceChipsProps {
+    /** The authored USD amount as a raw string, or null when nothing is chosen.
+     *  NONE selected initially → pass null. Preset chips echo '5' / '20' / '50';
+     *  Custom echoes whatever the user types. */
+    value: string | null;
+    /** Fired with the raw USD string (or null when Custom is opened empty). */
+    onChange: (usd: string | null) => void;
+    /** Extra className composed after the brand classes. */
+    className?: string;
+}
+/** The consent-at-birth allowance chips. */
+declare function AllowanceChips(props: AllowanceChipsProps): ReactElement;
+
+interface CreateWalletPanelProps {
+    /** Fired with the minted wallet the moment creation succeeds. */
+    onCreated?: (result: CreateWalletResult) => void;
+    /** Fired with the typed error if the ceremony fails. */
+    onError?: (error: ConnectError) => void;
+    /** dexter-api base. Default https://api.dexter.cash (createWallet's default). */
+    apiBase?: string;
+    /** Where the WebAuthn ceremony runs. Default 'auto' (createWallet's default). */
+    transport?: 'auto' | 'popup' | 'inline';
+    /** Render the optional "Name your wallet" field. Default true. */
+    showName?: boolean;
+    /** Extra className composed after the brand classes. */
+    className?: string;
+}
+/** The turnkey consent-at-birth create panel. */
+declare function CreateWalletPanel(props: CreateWalletPanelProps): ReactElement;
+
+export { AllowanceChips, type AllowanceChipsProps, type ConnectStatus, CreateWalletPanel, type CreateWalletPanelProps, DexterButton, type DexterButtonProps, DexterMark, DexterWalletChip, type DexterWalletChipProps, DexterWalletMenu, type DexterWalletMenuProps, SignInWithDexter, type SignInWithDexterProps, type UseDexterWallet, type UseIdentityConfig, type UseSignInWithDexter, type UseSignInWithDexterConfig, useDexterWallet, useIdentity, useSignInWithDexter };

package/dist/react.js

@@ -1,7 +1,9 @@
 import {
   ConnectError,
+  authoredPolicy,
   ceremonyPhaseLabel,
   createPasskeySigner,
+  createWallet,
   ejectActiveWallet,
   getActiveHandle,
   getCredentialId,
@@ -14,7 +16,7 @@ import {
   setActiveHandle,
   subscribe,
   switchWallet
-} from "./chunk-Y22JFT53.js";
+} from "./chunk-2QZ5QLGI.js";
 import {
   DexterButton,
   DexterMark,
@@ -368,7 +370,223 @@ function useIdentity({ accountToken }) {
     [accountToken, activeHandle]
   );
 }
+
+// src/AllowanceChips.tsx
+import { useEffect as useEffect6, useState as useState4 } from "react";
+
+// src/consentStyles.ts
+var STYLE_ID2 = "dexter-connect-consent-styles";
+var CONSENT_CSS = `
+.dx-allow{
+  --dx-ember:#f26c18; --dx-ember-2:#ba3a00; --dx-fg:#fff4ea; --dx-radius:0px;
+  display:flex; flex-wrap:wrap; gap:8px; align-items:center;
+}
+.dx-allow__chip{
+  display:inline-flex; align-items:center; justify-content:center; padding:9px 15px;
+  font:inherit; font-weight:600; font-size:.78rem; letter-spacing:.12em; text-transform:uppercase;
+  font-variant-numeric:tabular-nums; cursor:pointer; background:transparent; color:inherit;
+  border:1px solid color-mix(in srgb,var(--dx-ember) 45%,transparent);
+  border-radius:var(--dx-radius,0px); -webkit-tap-highlight-color:transparent;
+  transition:filter .16s ease, box-shadow .16s ease, border-color .16s ease, background .16s ease, color .16s ease;
+}
+.dx-allow__chip:hover{ border-color:color-mix(in srgb,var(--dx-ember) 70%,transparent); filter:brightness(1.05); }
+.dx-allow__chip:focus-visible{ outline:none; box-shadow:0 0 0 3px color-mix(in srgb,var(--dx-ember) 34%,transparent); }
+.dx-allow__chip--active{
+  background:linear-gradient(135deg,var(--dx-ember,#f26c18),var(--dx-ember-2,#ba3a00));
+  color:var(--dx-fg,#fff4ea); border-color:color-mix(in srgb,var(--dx-ember) 55%,transparent);
+  box-shadow:0 10px 22px color-mix(in srgb,var(--dx-ember) 22%,transparent);
+}
+.dx-allow__input{
+  flex:1 1 130px; min-width:120px; padding:9px 13px; font:inherit; font-size:.9rem;
+  font-variant-numeric:tabular-nums; color:inherit; background:transparent;
+  border:1px solid color-mix(in srgb,var(--dx-ember) 45%,transparent);
+  border-radius:var(--dx-radius,0px); -webkit-tap-highlight-color:transparent;
+  transition:border-color .16s ease, box-shadow .16s ease;
+}
+.dx-allow__input:focus, .dx-allow__input:focus-visible{
+  outline:none; border-color:color-mix(in srgb,var(--dx-ember) 70%,transparent);
+  box-shadow:0 0 0 3px color-mix(in srgb,var(--dx-ember) 30%,transparent);
+}
+.dx-allow__input::placeholder{ color:currentColor; opacity:.5; letter-spacing:.02em; text-transform:none; }
+
+.dx-cwp{
+  --dx-ember:#f26c18; --dx-ember-2:#ba3a00; --dx-fg:#fff4ea; --dx-radius:0px;
+  display:flex; flex-direction:column; gap:16px; font:inherit;
+}
+.dx-cwp__field{ display:flex; flex-direction:column; gap:8px; }
+.dx-cwp__label{ font-size:.7rem; font-weight:700; letter-spacing:.14em; text-transform:uppercase; opacity:.62; }
+.dx-cwp__name{
+  padding:10px 13px; font:inherit; font-size:.95rem; color:inherit; background:transparent;
+  border:1px solid color-mix(in srgb,currentColor 22%,transparent); border-radius:var(--dx-radius,0px);
+  -webkit-tap-highlight-color:transparent; transition:border-color .16s ease, box-shadow .16s ease;
+}
+.dx-cwp__name:focus, .dx-cwp__name:focus-visible{
+  outline:none; border-color:color-mix(in srgb,var(--dx-ember) 60%,transparent);
+  box-shadow:0 0 0 3px color-mix(in srgb,var(--dx-ember) 26%,transparent);
+}
+.dx-cwp__name::placeholder{ color:currentColor; opacity:.42; }
+.dx-cwp__fine{ font-size:.76rem; line-height:1.5; opacity:.66; }
+.dx-cwp__err{ font-size:.78rem; line-height:1.45; color:#e5552e; }
+`;
+function ensureConsentStyles() {
+  if (typeof document === "undefined") return;
+  if (document.getElementById(STYLE_ID2)) return;
+  const el = document.createElement("style");
+  el.id = STYLE_ID2;
+  el.textContent = CONSENT_CSS;
+  document.head.appendChild(el);
+}
+ensureConsentStyles();
+
+// src/AllowanceChips.tsx
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+var PRESETS = [
+  { label: "$5", num: "5" },
+  { label: "$20", num: "20" },
+  { label: "$50", num: "50" }
+];
+var PRESET_NUMS = PRESETS.map((p) => p.num);
+var isPreset = (v) => v !== null && PRESET_NUMS.includes(v);
+function AllowanceChips(props) {
+  const { value, onChange, className } = props;
+  useEffect6(ensureConsentStyles, []);
+  const [customOpen, setCustomOpen] = useState4(false);
+  const customActive = customOpen || value !== null && !isPreset(value);
+  const selectPreset = (num) => {
+    setCustomOpen(false);
+    onChange(num);
+  };
+  const selectCustom = () => {
+    setCustomOpen(true);
+    onChange(isPreset(value) ? null : value);
+  };
+  const onChipKeyDown = (e, select) => {
+    if (e.key === "Enter" || e.key === " " || e.key === "Spacebar") {
+      e.preventDefault();
+      select();
+    }
+  };
+  return /* @__PURE__ */ jsxs4("div", { className: cx("dx-allow", className), role: "radiogroup", "aria-label": "Monthly agent allowance", children: [
+    PRESETS.map(({ label, num }) => {
+      const checked = !customActive && value === num;
+      return /* @__PURE__ */ jsx4(
+        "div",
+        {
+          role: "radio",
+          "aria-checked": checked,
+          tabIndex: 0,
+          className: cx("dx-allow__chip", checked && "dx-allow__chip--active"),
+          onClick: () => selectPreset(num),
+          onKeyDown: (e) => onChipKeyDown(e, () => selectPreset(num)),
+          children: label
+        },
+        num
+      );
+    }),
+    /* @__PURE__ */ jsx4(
+      "div",
+      {
+        role: "radio",
+        "aria-checked": customActive,
+        tabIndex: 0,
+        className: cx("dx-allow__chip", customActive && "dx-allow__chip--active"),
+        onClick: selectCustom,
+        onKeyDown: (e) => onChipKeyDown(e, selectCustom),
+        children: "Custom"
+      }
+    ),
+    customActive && /* @__PURE__ */ jsx4(
+      "input",
+      {
+        className: "dx-allow__input",
+        inputMode: "decimal",
+        placeholder: "$ amount",
+        "aria-label": "Custom monthly allowance in USD",
+        value: value ?? "",
+        autoFocus: true,
+        onChange: (e) => onChange(e.target.value)
+      }
+    )
+  ] });
+}
+
+// src/CreateWalletPanel.tsx
+import { useEffect as useEffect7, useState as useState5 } from "react";
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+var FINE_PRINT = "Your number, your tap. Agents can never spend past it, and you can revoke any time.";
+function CreateWalletPanel(props) {
+  const { onCreated, onError, apiBase, transport, showName = true, className } = props;
+  useEffect7(ensureConsentStyles, []);
+  useEffect7(ensureDexterButtonStyles, []);
+  const [name, setName] = useState5("");
+  const [value, setValue] = useState5(null);
+  const [running, setRunning] = useState5(false);
+  const [phase, setPhase] = useState5(null);
+  const [error, setError] = useState5(null);
+  const policy = authoredPolicy(value ?? "");
+  const handleCreate = async () => {
+    if (running) return;
+    if (!policy) return;
+    setError(null);
+    setRunning(true);
+    setPhase(null);
+    try {
+      const result = await createWallet({
+        name: name.trim() || "Dexter Wallet",
+        spendPolicy: policy,
+        apiBase,
+        transport,
+        onPhase: setPhase
+      });
+      onCreated?.(result);
+    } catch (e) {
+      const err = e instanceof ConnectError ? e : new ConnectError("create_failed", e instanceof Error ? e.message : String(e));
+      setError(err);
+      onError?.(err);
+    } finally {
+      setRunning(false);
+      setPhase(null);
+    }
+  };
+  return /* @__PURE__ */ jsxs5("div", { className: cx("dx-cwp", className), children: [
+    showName && /* @__PURE__ */ jsxs5("div", { className: "dx-cwp__field", children: [
+      /* @__PURE__ */ jsx5("label", { className: "dx-cwp__label", htmlFor: "dx-cwp-name", children: "Name your wallet" }),
+      /* @__PURE__ */ jsx5(
+        "input",
+        {
+          id: "dx-cwp-name",
+          className: "dx-cwp__name",
+          maxLength: 40,
+          placeholder: "Dexter Wallet",
+          value: name,
+          disabled: running,
+          onChange: (e) => setName(e.target.value)
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs5("div", { className: "dx-cwp__field", children: [
+      /* @__PURE__ */ jsx5("span", { className: "dx-cwp__label", children: "What agents may spend, per 30 days" }),
+      /* @__PURE__ */ jsx5(AllowanceChips, { value, onChange: setValue })
+    ] }),
+    /* @__PURE__ */ jsx5("p", { className: "dx-cwp__fine", children: FINE_PRINT }),
+    error && /* @__PURE__ */ jsx5("div", { className: "dx-cwp__err", role: "alert", children: error.message || error.code }),
+    /* @__PURE__ */ jsx5(
+      DexterButton,
+      {
+        block: true,
+        className: "dx-cwp__cta",
+        loading: running,
+        loadingLabel: phase ? ceremonyPhaseLabel(phase) : "Creating\u2026",
+        disabled: !policy,
+        onClick: handleCreate,
+        children: error ? "Retry" : "Create your Dexter Wallet"
+      }
+    )
+  ] });
+}
 export {
+  AllowanceChips,
+  CreateWalletPanel,
   DexterButton,
   DexterMark,
   DexterWalletChip,

package/dist/server.d.ts

@@ -0,0 +1,72 @@
+import { JWTPayload, JWK, JSONWebKeySet } from 'jose';
+
+/**
+ * @dexterai/connect/server — offline Dexter session verification.
+ *
+ * The server half of Sign in with Dexter (CONTRACT-dexter-session-token.md):
+ * a local ES256 signature check against the published JWKS — no call to
+ * Supabase or dexter-api on the hot path, so it runs on Node and edge
+ * runtimes alike. Pre-hook tokens (no `dexter` claim) verify as signed-in
+ * with `vaultAddress: null`; once the access-token hook is enabled the
+ * claim appears with no code change here.
+ *
+ * Phase 1 issuer is Supabase (CONTRACT §3); everything is parameterized on
+ * (iss, jwksUrl) so the Phase-2 sovereign cutover is a config flip.
+ */
+
+declare const DEFAULT_ISS = "https://qdgumpoqnthrjfmqziwm.supabase.co/auth/v1";
+declare const DEFAULT_AUDIENCE = "authenticated";
+/** The namespaced claim sealed into the token by the access-token hook. */
+interface DexterClaim {
+    ver: number;
+    /** Swig state address (base58) — the canonical Dexter Wallet identity. */
+    vault: string;
+    /** 16-byte passkey handle, base64url; absent on rows without one. */
+    userHandle?: string;
+    agentGrant?: unknown;
+}
+type VerifyFailureReason = 'no_token' | 'invalid' | 'expired' | 'issuer_mismatch' | 'audience_mismatch';
+type DexterSession = {
+    isSignedIn: true;
+    sub: string;
+    vaultAddress: string | null;
+    userHandle: string | null;
+    agentGrant: unknown;
+    sessionId: string | null;
+    aal: string | null;
+    claims: JWTPayload & {
+        dexter?: DexterClaim;
+    };
+} | {
+    isSignedIn: false;
+    reason: VerifyFailureReason;
+};
+interface VerifyOptions {
+    /** Expected issuer. Phase 1 default: the Dexter Supabase project. */
+    iss?: string;
+    /** JWKS location; defaults to `${iss}/.well-known/jwks.json`. */
+    jwksUrl?: string;
+    /**
+     * Public key(s) for fully networkless verification (a JWK or a JWKS).
+     * When omitted, the JWKS is fetched once and cached in-instance.
+     */
+    jwtKey?: JWK | JSONWebKeySet;
+    /** Expected audience. Default: Supabase's `authenticated`. */
+    audience?: string;
+}
+/** A fetch-API Request or anything with a node-style headers bag. */
+type RequestLike = Request | {
+    headers: Record<string, string | string[] | undefined>;
+};
+interface DexterClient {
+    verifyDexterSession(token: string): Promise<DexterSession>;
+    authenticateRequest(req: RequestLike): Promise<DexterSession>;
+}
+declare function createDexterClient(options?: VerifyOptions): DexterClient;
+/**
+ * One-off verification. For servers verifying many requests against a
+ * remote JWKS, create a client once instead so the key set caches.
+ */
+declare function verifyDexterSession(token: string, options?: VerifyOptions): Promise<DexterSession>;
+
+export { DEFAULT_AUDIENCE, DEFAULT_ISS, type DexterClaim, type DexterClient, type DexterSession, type RequestLike, type VerifyFailureReason, type VerifyOptions, createDexterClient, verifyDexterSession };

package/dist/server.js

@@ -0,0 +1,90 @@
+// src/server.ts
+import {
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  jwtVerify,
+  errors as joseErrors
+} from "jose";
+var DEFAULT_ISS = "https://qdgumpoqnthrjfmqziwm.supabase.co/auth/v1";
+var DEFAULT_AUDIENCE = "authenticated";
+function buildGetKey(opts) {
+  if (opts.jwtKey) {
+    const set = "keys" in opts.jwtKey ? opts.jwtKey : { keys: [opts.jwtKey] };
+    return createLocalJWKSet(set);
+  }
+  const iss = opts.iss ?? DEFAULT_ISS;
+  const url = new URL(opts.jwksUrl ?? `${iss}/.well-known/jwks.json`);
+  return createRemoteJWKSet(url, {
+    cacheMaxAge: 6e5,
+    cooldownDuration: 3e4,
+    timeoutDuration: 5e3
+  });
+}
+function failureReason(err) {
+  if (err instanceof joseErrors.JWTExpired) return "expired";
+  if (err instanceof joseErrors.JWTClaimValidationFailed) {
+    if (err.claim === "iss") return "issuer_mismatch";
+    if (err.claim === "aud") return "audience_mismatch";
+    if (err.claim === "exp") return "expired";
+  }
+  return "invalid";
+}
+function bearerFrom(req) {
+  let raw;
+  const headers = req.headers;
+  if (headers && typeof headers.get === "function") {
+    raw = headers.get("authorization");
+  } else {
+    const bag = headers;
+    raw = bag.authorization ?? bag.Authorization;
+  }
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (!value) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(value);
+  return match ? match[1] : null;
+}
+function createDexterClient(options = {}) {
+  const iss = options.iss ?? DEFAULT_ISS;
+  const audience = options.audience ?? DEFAULT_AUDIENCE;
+  const getKey = buildGetKey(options);
+  async function verify(token) {
+    try {
+      const { payload } = await jwtVerify(token, getKey, {
+        issuer: iss,
+        audience,
+        algorithms: ["ES256"]
+        // pinned — defeats alg-confusion / alg:none
+      });
+      const dexter = payload.dexter;
+      return {
+        isSignedIn: true,
+        sub: payload.sub ?? "",
+        vaultAddress: dexter?.vault ?? null,
+        userHandle: dexter?.userHandle ?? null,
+        agentGrant: dexter?.agentGrant ?? null,
+        sessionId: payload.session_id ?? null,
+        aal: payload.aal ?? null,
+        claims: payload
+      };
+    } catch (err) {
+      return { isSignedIn: false, reason: failureReason(err) };
+    }
+  }
+  return {
+    verifyDexterSession: verify,
+    async authenticateRequest(req) {
+      const token = bearerFrom(req);
+      if (!token) return { isSignedIn: false, reason: "no_token" };
+      return verify(token);
+    }
+  };
+}
+function verifyDexterSession(token, options = {}) {
+  return createDexterClient(options).verifyDexterSession(token);
+}
+export {
+  DEFAULT_AUDIENCE,
+  DEFAULT_ISS,
+  createDexterClient,
+  verifyDexterSession
+};

package/dist/{signals-BaXobUfB.d.ts → signals-qc4rDyQ6.d.ts}

@@ -60,6 +60,55 @@ declare class ConnectError extends Error {
     constructor(code: string, message?: string);
 }
 
+/** Consent-at-birth allowance (Branch rulings 2026-07-02/03).
+ *  The user authors the number; zero is not consent; TTL is fixed 30d and
+ *  never user-editable; no caller may invent a default. */
+declare const SESSION_TTL_30D = "2592000";
+interface SpendPolicy {
+    /** Role-2 allowance, atomic USDC (6dp), decimal string. User-authored. */
+    spendLimitAtomic: string;
+    /** Fixed 30d. Present for wire compatibility; always SESSION_TTL_30D. */
+    sessionTtlSeconds: string;
+}
+/** Parse user-entered USD ("5", "$20", "1,000", "20.5") to atomic USDC.
+ *  Null on anything invalid — callers must not invent a fallback. */
+declare function usdToAtomic(input: string): bigint | null;
+/** Null when invalid or zero (zero is not consent). */
+declare function authoredPolicy(usdInput: string): SpendPolicy | null;
+
+interface CreateWalletConfig extends DexterConnectConfig {
+    /** Label for the passkey in the OS keychain AND the wallet roster. Set at
+     *  creation — the only moment naming is guaranteed to stick. Default "Dexter Wallet". */
+    name?: string;
+    /** RP id for the new credential. Default "dexter.cash". */
+    rpId?: string;
+    /** Consent-at-birth allowance the user authored at creation (chips $5/$20/$50
+     *  or Custom; zero is not consent; build it with authoredPolicy()). When
+     *  present it rides the /initialize body so the number becomes the server-side
+     *  write-once consent record. The TTL is ruled fixed 30d — whatever the object
+     *  carries, the wire always sends SESSION_TTL_30D. Absent → no policy authored
+     *  (the vault initializes without one; nothing invents a default). */
+    spendPolicy?: SpendPolicy;
+    /** Called as the ceremony progresses, for live "connecting steps" UI:
+     *  challenge → passkey → verifying → finalizing. */
+    onPhase?: (phase: CeremonyPhase) => void;
+}
+interface CreateWalletResult {
+    /** Server-minted 16-byte user handle, base64url — the vault identity. */
+    handle: string;
+    /** base64url credential id of the new passkey. */
+    credentialId: string;
+    /** The freshly initialized vault (swig not yet deployed; deploys lazily). */
+    vault: ConnectVault;
+}
+/**
+ * Mint a brand-new Dexter wallet (passkey + vault) and make it the active wallet.
+ *
+ * One passkey approval. Throws ConnectError on any failed leg (the `code` is the
+ * server's error string, or webauthn_failed / no_credential for the ceremony).
+ */
+declare function createWallet(config?: CreateWalletConfig): Promise<CreateWalletResult>;
+
 type IdentityKind = 'passkey-vault' | 'account' | 'none';
 interface IdentityInput {
     /** An account session token (e.g. Supabase access_token) when present, else null. */
@@ -180,4 +229,4 @@ declare function syncAcceptedPasskeys(args: {
     rpId?: string;
 }): Promise<boolean>;
 
-export { ACTIVE_WALLET_STORAGE_KEY as A, type ConnectVault as C, type DexterConnectConfig as D, type IdentityKind as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CeremonyPhase as a, ConnectError as b, type IdentityInput as c, type PasskeySignalSupport as d, type StoredWallet as e, ejectActiveWallet as f, forgetWallet as g, getActiveHandle as h, getCredentialId as i, prunePasskey as j, resolveIdentity as k, listWallets as l, subscribe as m, switchWallet as n, syncAcceptedPasskeys as o, passkeySignalSupport as p, renamePasskey as r, setActiveHandle as s };
+export { ACTIVE_WALLET_STORAGE_KEY as A, type CreateWalletResult as C, type DexterConnectConfig as D, type IdentityKind as I, type PasskeyLoginTokens as P, type ResolvedIdentity as R, type SignInResult as S, type CreateWalletConfig as a, type CeremonyPhase as b, type ConnectVault as c, ConnectError as d, type IdentityInput as e, type PasskeySignalSupport as f, SESSION_TTL_30D as g, type SpendPolicy as h, type StoredWallet as i, authoredPolicy as j, createWallet as k, ejectActiveWallet as l, forgetWallet as m, getActiveHandle as n, getCredentialId as o, listWallets as p, passkeySignalSupport as q, prunePasskey as r, renamePasskey as s, resolveIdentity as t, setActiveHandle as u, subscribe as v, switchWallet as w, syncAcceptedPasskeys as x, usdToAtomic as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {
@@ -15,6 +15,10 @@
     "./worldid": {
       "types": "./dist/worldid.d.ts",
       "import": "./dist/worldid.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
     }
   },
   "files": [
@@ -26,7 +30,7 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@dexterai/vault": ">=0.22",
+    "@dexterai/vault": ">=0.30.0",
     "@solana/web3.js": "^1.98.0",
     "@worldcoin/idkit": "^4.1.8",
     "react": ">=18"
@@ -40,16 +44,19 @@
     }
   },
   "devDependencies": {
-    "@dexterai/vault": "^0.24.0",
+    "@dexterai/vault": "^0.30.0",
     "@solana/web3.js": "^1.98.4",
     "@types/react": "^19.1.12",
+    "@types/react-dom": "^19.2.3",
     "@worldcoin/idkit": "^4.1.8",
+    "happy-dom": "^15.11.7",
     "react": "^19.2.5",
     "tsup": "^8.5.0",
     "typescript": "^5.6.2",
     "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@simplewebauthn/browser": "^13.3.0"
+    "@simplewebauthn/browser": "^13.3.0",
+    "jose": "^6.2.3"
   }
 }