@dexterai/connect 0.24.3 → 0.25.0

package/dist/{chunk-P3ZBIO7N.js → chunk-VGERNAQ3.js}

@@ -345,8 +345,127 @@ async function initializeVault(apiBase, userHandle, credentialId, spendPolicy, l
 
 // src/relay.ts
 import { startAuthentication, browserSupportsWebAuthn } from "@simplewebauthn/browser";
+
+// src/base64.ts
+function base64ToBytes(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function base64urlToBytes(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  return base64ToBytes(b64);
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+function bytesToBase64url(bytes) {
+  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlToBase64(s) {
+  const t = s.replace(/-/g, "+").replace(/_/g, "/");
+  return t + "=".repeat((4 - t.length % 4) % 4);
+}
+function compactSignatureToDer(compact) {
+  if (compact.length !== 64) {
+    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
+  }
+  const r = derInteger(compact.subarray(0, 32));
+  const s = derInteger(compact.subarray(32, 64));
+  const body = new Uint8Array(r.length + s.length);
+  body.set(r, 0);
+  body.set(s, r.length);
+  const out = new Uint8Array(2 + body.length);
+  out[0] = 48;
+  out[1] = body.length;
+  out.set(body, 2);
+  return out;
+}
+function derInteger(component) {
+  let start = 0;
+  while (start < component.length - 1 && component[start] === 0) start += 1;
+  let content = component.subarray(start);
+  if (content[0] & 128) {
+    const padded = new Uint8Array(content.length + 1);
+    padded[0] = 0;
+    padded.set(content, 1);
+    content = padded;
+  }
+  const out = new Uint8Array(2 + content.length);
+  out[0] = 2;
+  out[1] = content.length;
+  out.set(content, 2);
+  return out;
+}
+
+// src/immediate.ts
+var immediateCapPromise = null;
+function immediateGetSupported() {
+  if (!immediateCapPromise) {
+    immediateCapPromise = (async () => {
+      try {
+        if (typeof window === "undefined") return false;
+        const pkc2 = window.PublicKeyCredential;
+        if (!pkc2 || typeof pkc2.getClientCapabilities !== "function") return false;
+        const caps = await pkc2.getClientCapabilities.call(pkc2);
+        return caps?.immediateGet === true;
+      } catch {
+        return false;
+      }
+    })();
+  }
+  return immediateCapPromise;
+}
+function primeImmediateSupport() {
+  void immediateGetSupported();
+}
+async function immediateAuthentication(options) {
+  const getOptions = {
+    publicKey: {
+      challenge: base64urlToBytes(options.challenge),
+      rpId: options.rpId,
+      timeout: options.timeout,
+      userVerification: options.userVerification,
+      allowCredentials: options.allowCredentials?.map((c) => ({
+        id: base64urlToBytes(c.id),
+        type: c.type,
+        transports: c.transports
+      }))
+    }
+  };
+  getOptions.uiMode = "immediate";
+  const cred = await navigator.credentials.get(getOptions);
+  if (!cred) throw new DOMException("no credential", "NotAllowedError");
+  const a = cred.response;
+  return {
+    id: cred.id,
+    rawId: bytesToBase64url(new Uint8Array(cred.rawId)),
+    response: {
+      clientDataJSON: bytesToBase64url(new Uint8Array(a.clientDataJSON)),
+      authenticatorData: bytesToBase64url(new Uint8Array(a.authenticatorData)),
+      signature: bytesToBase64url(new Uint8Array(a.signature)),
+      userHandle: a.userHandle ? bytesToBase64url(new Uint8Array(a.userHandle)) : void 0
+    },
+    clientExtensionResults: cred.getClientExtensionResults?.() ?? {},
+    type: "public-key",
+    authenticatorAttachment: cred.authenticatorAttachment ?? void 0
+  };
+}
+function classifyWebAuthnRejection(err) {
+  const e = err;
+  if (!e) return false;
+  const blob = [e.name, e.cause?.name, typeof e.code === "string" ? e.code : "", e.message].filter(Boolean).join(" ").toLowerCase();
+  return /notallowed|not ?allowed|abort|cancel|timed out|timeout|denied|ceremony/.test(blob);
+}
+
+// src/relay.ts
 var DEFAULT_API_BASE2 = "https://api.dexter.cash";
 var ANON_SIGN_BASE = "/api/passkey-anon/sign";
+primeImmediateSupport();
 async function passkeyLogin(config = {}, onPhase) {
   if (shouldUsePopup(config.transport)) {
     const result2 = await openCeremonyPopup("signin", {
@@ -380,24 +499,56 @@ async function passkeyLogin(config = {}, onPhase) {
 }
 async function continueWithDexter(config = {}, onPhase) {
   if (shouldUsePopup(config.transport)) {
-    const result2 = await openCeremonyPopup("continue", {
+    const result = await openCeremonyPopup("continue", {
       connectHost: config.connectHost,
       name: config.name,
       apiBase: config.apiBase
     });
-    if (result2.kind === "create") {
-      setActiveHandle(result2.handle, result2.label ?? config.name, result2.credentialId);
-    } else if (result2.vault) {
-      setActiveHandle(result2.vault.userHandle, result2.vault.walletLabel ?? void 0, result2.vault.credentialId);
+    if (result.kind === "create") {
+      setActiveHandle(result.handle, result.label ?? config.name, result.credentialId);
+    } else if (result.kind === "signin" && result.vault) {
+      setActiveHandle(result.vault.userHandle, result.vault.walletLabel ?? void 0, result.vault.credentialId);
     }
-    return result2;
+    return result;
+  }
+  if (await immediateGetSupported()) {
+    const probe = await immediatePasskeyLogin(config, onPhase);
+    if (probe.outcome === "signin") return { kind: "signin", ...probe.result };
+    if (probe.outcome === "cancelled") return { kind: "cancelled" };
+    if (!config.spendPolicy) return { kind: "needs_create" };
+    const created = await createWallet({ ...config, onPhase });
+    return { kind: "create", ...created };
   }
   if (getActiveHandle()) {
-    const result2 = await passkeyLogin(config, onPhase);
-    return { kind: "signin", ...result2 };
+    const result = await passkeyLogin(config, onPhase);
+    return { kind: "signin", ...result };
+  }
+  return { kind: "needs_choice" };
+}
+async function immediatePasskeyLogin(config, onPhase) {
+  const apiBase = (config.apiBase ?? DEFAULT_API_BASE2).replace(/\/$/, "");
+  onPhase?.("challenge");
+  const options = await fetchLoginChallenge(apiBase);
+  onPhase?.("passkey");
+  let response;
+  try {
+    response = await immediateAuthentication(options);
+  } catch (err) {
+    if (classifyWebAuthnRejection(err)) {
+      return { outcome: "no_credential" };
+    }
+    throw new ConnectError("webauthn_failed", err instanceof Error ? err.message : String(err));
+  }
+  onPhase?.("verifying");
+  const result = await submitLogin(apiBase, response);
+  if (result.vault) {
+    setActiveHandle(
+      result.vault.userHandle,
+      result.vault.walletLabel ?? void 0,
+      result.vault.credentialId
+    );
   }
-  const result = await createWallet({ ...config, onPhase });
-  return { kind: "create", ...result };
+  return { outcome: "signin", result };
 }
 async function fetchLoginChallenge(apiBase) {
   const res = await fetch(`${apiBase}${ANON_SIGN_BASE}/login-challenge`, {
@@ -434,62 +585,6 @@ async function submitLogin(apiBase, response) {
   return data.vault ? { session, vault: data.vault } : { session };
 }
 
-// src/base64.ts
-function base64ToBytes(s) {
-  const bin = atob(s);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i += 1) out[i] = bin.charCodeAt(i);
-  return out;
-}
-function base64urlToBytes(s) {
-  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
-  return base64ToBytes(b64);
-}
-function bytesToBase64(bytes) {
-  let bin = "";
-  for (let i = 0; i < bytes.length; i += 1) bin += String.fromCharCode(bytes[i]);
-  return btoa(bin);
-}
-function bytesToBase64url(bytes) {
-  return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64urlToBase64(s) {
-  const t = s.replace(/-/g, "+").replace(/_/g, "/");
-  return t + "=".repeat((4 - t.length % 4) % 4);
-}
-function compactSignatureToDer(compact) {
-  if (compact.length !== 64) {
-    throw new Error(`expected 64-byte compact signature, got ${compact.length}`);
-  }
-  const r = derInteger(compact.subarray(0, 32));
-  const s = derInteger(compact.subarray(32, 64));
-  const body = new Uint8Array(r.length + s.length);
-  body.set(r, 0);
-  body.set(s, r.length);
-  const out = new Uint8Array(2 + body.length);
-  out[0] = 48;
-  out[1] = body.length;
-  out.set(body, 2);
-  return out;
-}
-function derInteger(component) {
-  let start = 0;
-  while (start < component.length - 1 && component[start] === 0) start += 1;
-  let content = component.subarray(start);
-  if (content[0] & 128) {
-    const padded = new Uint8Array(content.length + 1);
-    padded[0] = 0;
-    padded.set(content, 1);
-    content = padded;
-  }
-  const out = new Uint8Array(2 + content.length);
-  out[0] = 2;
-  out[1] = content.length;
-  out.set(content, 2);
-  return out;
-}
-
 // src/anon-policy.ts
 var DEFAULT_API_BASE3 = "https://api.dexter.cash";
 var ANON_SIGN_BASE2 = "/api/passkey-anon/sign";
@@ -579,68 +674,6 @@ function resolveIdentity(input) {
 
 // src/recover.ts
 import { startAuthentication as startAuthentication2, browserSupportsWebAuthn as browserSupportsWebAuthn2 } from "@simplewebauthn/browser";
-
-// src/immediate.ts
-var immediateCapPromise = null;
-function immediateGetSupported() {
-  if (!immediateCapPromise) {
-    immediateCapPromise = (async () => {
-      try {
-        if (typeof window === "undefined") return false;
-        const pkc2 = window.PublicKeyCredential;
-        if (!pkc2 || typeof pkc2.getClientCapabilities !== "function") return false;
-        const caps = await pkc2.getClientCapabilities.call(pkc2);
-        return caps?.immediateGet === true;
-      } catch {
-        return false;
-      }
-    })();
-  }
-  return immediateCapPromise;
-}
-function primeImmediateSupport() {
-  void immediateGetSupported();
-}
-async function immediateAuthentication(options) {
-  const getOptions = {
-    publicKey: {
-      challenge: base64urlToBytes(options.challenge),
-      rpId: options.rpId,
-      timeout: options.timeout,
-      userVerification: options.userVerification,
-      allowCredentials: options.allowCredentials?.map((c) => ({
-        id: base64urlToBytes(c.id),
-        type: c.type,
-        transports: c.transports
-      }))
-    }
-  };
-  getOptions.uiMode = "immediate";
-  const cred = await navigator.credentials.get(getOptions);
-  if (!cred) throw new DOMException("no credential", "NotAllowedError");
-  const a = cred.response;
-  return {
-    id: cred.id,
-    rawId: bytesToBase64url(new Uint8Array(cred.rawId)),
-    response: {
-      clientDataJSON: bytesToBase64url(new Uint8Array(a.clientDataJSON)),
-      authenticatorData: bytesToBase64url(new Uint8Array(a.authenticatorData)),
-      signature: bytesToBase64url(new Uint8Array(a.signature)),
-      userHandle: a.userHandle ? bytesToBase64url(new Uint8Array(a.userHandle)) : void 0
-    },
-    clientExtensionResults: cred.getClientExtensionResults?.() ?? {},
-    type: "public-key",
-    authenticatorAttachment: cred.authenticatorAttachment ?? void 0
-  };
-}
-function classifyWebAuthnRejection(err) {
-  const e = err;
-  if (!e) return false;
-  const blob = [e.name, e.cause?.name, typeof e.code === "string" ? e.code : "", e.message].filter(Boolean).join(" ").toLowerCase();
-  return /notallowed|not ?allowed|abort|cancel|timed out|timeout|denied|ceremony/.test(blob);
-}
-
-// src/recover.ts
 var DEFAULT_API_BASE4 = "https://api.dexter.cash";
 var ANON_SIGN_BASE3 = "/api/passkey-anon/sign";
 primeImmediateSupport();
@@ -838,10 +871,10 @@ export {
   usdToAtomic,
   authoredPolicy,
   createWallet,
-  passkeyLogin,
-  continueWithDexter,
   bytesToBase64url,
   base64urlToBase64,
+  passkeyLogin,
+  continueWithDexter,
   createAnonServerPolicy,
   createPasskeySigner,
   resolveIdentity,

package/dist/index.d.ts

@@ -1,28 +1,7 @@
-import { S as SignInResult, C as CreateWalletResult, a as CreateWalletConfig, b as CeremonyPhase, D as DexterConnectConfig, c as ConnectVault, R as RecoverWalletConfig, d as RecoverOutcome, I as IdentityKind } from './signals-C05rIVey.js';
-export { A as ACTIVE_WALLET_STORAGE_KEY, e as ConnectError, f as IdentityInput, P as PasskeyLoginTokens, g as PasskeySignalSupport, h as RecoverVault, i as ResolvedIdentity, j as SESSION_TTL_30D, k as SpendPolicy, l as StoredWallet, m as authoredPolicy, n as createWallet, o as ejectActiveWallet, p as forgetWallet, q as getActiveHandle, r as getCredentialId, s as listWallets, t as passkeySignalSupport, u as prunePasskey, v as renamePasskey, w as resolveIdentity, x as setActiveHandle, y as subscribeWallet, z as switchWallet, B as syncAcceptedPasskeys, E as usdToAtomic } from './signals-C05rIVey.js';
+import { C as ConnectVault, R as RecoverWalletConfig, a as RecoverOutcome, b as CeremonyPhase, I as IdentityKind } from './signals-C4JSE_4X.js';
+export { A as ACTIVE_WALLET_STORAGE_KEY, c as ConnectError, d as ContinueResult, e as CreateWalletConfig, f as CreateWalletResult, D as DexterConnectConfig, g as IdentityInput, P as PasskeyLoginTokens, h as PasskeySignalSupport, i as RecoverVault, j as ResolvedIdentity, S as SESSION_TTL_30D, k as SignInResult, l as SpendPolicy, m as StoredWallet, n as authoredPolicy, o as continueWithDexter, p as createWallet, q as ejectActiveWallet, r as forgetWallet, s as getActiveHandle, t as getCredentialId, u as listWallets, v as passkeyLogin, w as passkeySignalSupport, x as prunePasskey, y as renamePasskey, z as resolveIdentity, B as setActiveHandle, E as subscribeWallet, F as switchWallet, G as syncAcceptedPasskeys, H as usdToAtomic } from './signals-C4JSE_4X.js';
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
 
-/**
- * "Sign in with Dexter" — the discoverable-credential login ceremony.
- *
- *   1. POST /login-challenge  → a server-issued challenge (no allow-list:
- *      the resident passkey itself identifies the user)
- *   2. navigator.credentials.get over that challenge (no allowCredentials)
- *   3. POST /passkey-login    → the server resolves the credential + vault,
- *      verifies the assertion, and returns a Supabase session (+ the vault
- *      payload once vault-review ships the dexter-api change — ASK 1)
- *
- * Relays to dexter-api's ANON router — a first-time third-party user has no
- * Supabase session, so the Supabase-gated router would 401.
- */
-declare function passkeyLogin(config?: DexterConnectConfig, onPhase?: (phase: CeremonyPhase) => void): Promise<SignInResult>;
-type ContinueResult = ({
-    kind: 'signin';
-} & SignInResult) | ({
-    kind: 'create';
-} & CreateWalletResult);
-declare function continueWithDexter(config?: CreateWalletConfig, onPhase?: (phase: CeremonyPhase) => void): Promise<ContinueResult>;
-
 /** What `issueChallenge` returns to the SDK signer. */
 interface AnonChallengeResult {
     /** Server-issued WebAuthn challenge (=== the supplied operationHash). */
@@ -223,4 +202,4 @@ interface EnableAgentSpendResult {
  */
 declare function enableAgentSpend(id: AgentSpendIdentity, vaultPda: string, apiOrigin: string, credentialId?: string | null): Promise<EnableAgentSpendResult>;
 
-export { AgentSpendError, type AgentSpendIdentity, type AgentSpendStatus, type AgentSpendTab, type AnonChallengeResult, type AnonServerPolicy, type AutomaticAgentSpend, CeremonyPhase, ConnectVault, type ContinueResult, CreateWalletConfig, CreateWalletResult, DexterConnectConfig, type EnableAgentSpendResult, IdentityKind, type RawAgentSpendSession, type RawAgentSpendStatus, RecoverOutcome, RecoverWalletConfig, type RevokeAgentSpendResult, SignInResult, assembleAgentSpendStatus, ceremonyPhaseLabel, continueWithDexter, createAnonServerPolicy, createPasskeySigner, describeAgentSpendError, enableAgentSpend, passkeyLogin, recoverWallet, revokeAgentSpend };
+export { AgentSpendError, type AgentSpendIdentity, type AgentSpendStatus, type AgentSpendTab, type AnonChallengeResult, type AnonServerPolicy, type AutomaticAgentSpend, CeremonyPhase, ConnectVault, type EnableAgentSpendResult, IdentityKind, type RawAgentSpendSession, type RawAgentSpendStatus, RecoverOutcome, RecoverWalletConfig, type RevokeAgentSpendResult, assembleAgentSpendStatus, ceremonyPhaseLabel, createAnonServerPolicy, createPasskeySigner, describeAgentSpendError, enableAgentSpend, recoverWallet, revokeAgentSpend };

package/dist/index.js

@@ -26,7 +26,7 @@ import {
   switchWallet,
   syncAcceptedPasskeys,
   usdToAtomic
-} from "./chunk-P3ZBIO7N.js";
+} from "./chunk-VGERNAQ3.js";
 
 // src/agentSpend.ts
 import { PublicKey } from "@solana/web3.js";

package/dist/react.d.ts

@@ -1,6 +1,6 @@
 import { DexterApiBrowserPasskeySigner } from '@dexterai/vault/signers/browser';
-import { b as CeremonyPhase, S as SignInResult, d as RecoverOutcome, P as PasskeyLoginTokens, c as ConnectVault, e as ConnectError, l as StoredWallet, g as PasskeySignalSupport, i as ResolvedIdentity, C as CreateWalletResult } from './signals-C05rIVey.js';
-export { h as RecoverVault } from './signals-C05rIVey.js';
+import { b as CeremonyPhase, k as SignInResult, a as RecoverOutcome, d as ContinueResult, P as PasskeyLoginTokens, C as ConnectVault, c as ConnectError, m as StoredWallet, h as PasskeySignalSupport, j as ResolvedIdentity, f as CreateWalletResult } from './signals-C4JSE_4X.js';
+export { i as RecoverVault } from './signals-C4JSE_4X.js';
 import { ReactElement, ButtonHTMLAttributes, ReactNode } from 'react';
 
 type ConnectStatus = 'idle' | 'pending' | 'done' | 'error';
@@ -35,6 +35,10 @@ interface UseSignInWithDexter {
      *  light up via the wallet store; `session`/`vault` here stay null. Fire on
      *  tap only — never on mount (iOS gesture rule). */
     recover: () => Promise<RecoverOutcome>;
+    /** One-button register-or-sign-in (keychain-first; see continueWithDexter).
+     *  Terminal kinds update session/vault state; needs_create / needs_choice /
+     *  cancelled return with status back at idle for the caller to route. */
+    continueWith: () => Promise<ContinueResult>;
     /** Last recover outcome; null until recover() settles. */
     recovered: RecoverOutcome | null;
     disconnect: () => void;
@@ -68,14 +72,21 @@ interface SignInWithDexterProps extends UseSignInWithDexterConfig {
      *  'recover' = wallet-only: re-points this browser at an existing wallet and
      *  mints NOTHING else (the wallet IS the sign-in). After a successful
      *  recover the element renders null — identity display belongs to
-     *  DexterWalletChip/useIdentity, which light up via the wallet store. */
-    mode?: 'signin' | 'recover';
+     *  DexterWalletChip/useIdentity, which light up via the wallet store.
+     *  'continue' = the one-button register-or-sign-in (keychain-first): the
+     *  hosted popup decides sign-in vs create; every settled outcome fires
+     *  onContinue. */
+    mode?: 'signin' | 'recover' | 'continue';
     /** Fired with the result the moment sign-in completes. */
     onSuccess?: (result: SignInResult) => void;
     /** Recover mode: fired with EVERY settled outcome (ok, no_credential,
      *  cancelled, error) — the single channel; onError is not used in this mode.
      *  Branch on `reason`: no_credential → offer create; cancelled → stay silent. */
     onRecovered?: (outcome: RecoverOutcome) => void;
+    /** Continue mode: fired with EVERY settled ContinueResult (signin, create,
+     *  needs_create, needs_choice, cancelled) — the single channel for routing.
+     *  Real ceremony failures still go to onError. */
+    onContinue?: (result: ContinueResult) => void;
     /** Fired with the typed error if the ceremony fails. */
     onError?: (error: ConnectError) => void;
     /** Button label when signed out. Default "Sign in with Dexter". */

package/dist/react.js

@@ -2,6 +2,7 @@ import {
   ConnectError,
   authoredPolicy,
   ceremonyPhaseLabel,
+  continueWithDexter,
   createPasskeySigner,
   createWallet,
   ejectActiveWallet,
@@ -17,7 +18,7 @@ import {
   setActiveHandle,
   subscribe,
   switchWallet
-} from "./chunk-P3ZBIO7N.js";
+} from "./chunk-VGERNAQ3.js";
 import {
   DexterButton,
   DexterMark,
@@ -130,6 +131,39 @@ function useSignInWithDexter(config = {}) {
     }
     return outcome;
   }, [apiBase, transport, connectHost, preferImmediate]);
+  const continueWith = useCallback(async () => {
+    setError(null);
+    setPhase(null);
+    setStatus("pending");
+    try {
+      const result = await continueWithDexter(
+        {
+          ...apiBase ? { apiBase } : {},
+          ...transport ? { transport } : {},
+          ...connectHost ? { connectHost } : {}
+        },
+        setPhase
+      );
+      setPhase(null);
+      if (result.kind === "signin") {
+        setSession(result.session);
+        setVault(result.vault ?? null);
+        setStatus("done");
+      } else if (result.kind === "create") {
+        setVault(result.vault);
+        setStatus("done");
+      } else {
+        setStatus("idle");
+      }
+      return result;
+    } catch (err) {
+      const e = err instanceof ConnectError ? err : new ConnectError("continue_failed", String(err));
+      setError(e);
+      setStatus("error");
+      setPhase(null);
+      throw e;
+    }
+  }, [apiBase, transport, connectHost]);
   const disconnect = useCallback(() => {
     setSession(null);
     setVault(null);
@@ -151,6 +185,7 @@ function useSignInWithDexter(config = {}) {
     isVaultConnected: status === "done" && vault !== null,
     signIn,
     recover,
+    continueWith,
     recovered,
     disconnect,
     session,
@@ -180,6 +215,7 @@ function SignInWithDexter(props) {
     onSuccess,
     onError,
     onRecovered,
+    onContinue,
     label = "Sign in with Dexter",
     variant = "primary",
     block = false,
@@ -195,6 +231,14 @@ function SignInWithDexter(props) {
       onRecovered?.(await c.recover());
       return;
     }
+    if (mode === "continue") {
+      try {
+        onContinue?.(await c.continueWith());
+      } catch (err) {
+        onError?.(err);
+      }
+      return;
+    }
     try {
       onSuccess?.(await c.signIn());
     } catch (err) {
@@ -687,7 +731,7 @@ function vscodeInstallUrl(name, mcpUrl) {
   return `vscode:mcp/install?${encodeURIComponent(JSON.stringify({ name, type: "http", url: mcpUrl }))}`;
 }
 function hermesInstallCommand(name, mcpUrl) {
-  return `hermes mcp add ${name} --url ${mcpUrl} --auth oauth`;
+  return `hermes mcp add ${name} --url ${mcpUrl}`;
 }
 function claudeCodeInstallCommand(name, mcpUrl) {
   return `claude mcp add --transport http ${name} ${mcpUrl}`;

package/dist/{signals-C05rIVey.d.ts → signals-C4JSE_4X.d.ts}

@@ -159,6 +159,42 @@ interface CreateWalletResult {
  */
 declare function createWallet(config?: CreateWalletConfig): Promise<CreateWalletResult>;
 
+/**
+ * "Sign in with Dexter" — the discoverable-credential login ceremony.
+ *
+ *   1. POST /login-challenge  → a server-issued challenge (no allow-list:
+ *      the resident passkey itself identifies the user)
+ *   2. navigator.credentials.get over that challenge (no allowCredentials)
+ *   3. POST /passkey-login    → the server resolves the credential + vault,
+ *      verifies the assertion, and returns a Supabase session (+ the vault
+ *      payload once vault-review ships the dexter-api change — ASK 1)
+ *
+ * Relays to dexter-api's ANON router — a first-time third-party user has no
+ * Supabase session, so the Supabase-gated router would 401.
+ */
+declare function passkeyLogin(config?: DexterConnectConfig, onPhase?: (phase: CeremonyPhase) => void): Promise<SignInResult>;
+type ContinueResult = ({
+    kind: 'signin';
+} & SignInResult) | ({
+    kind: 'create';
+} & CreateWalletResult)
+/** This device has no passkey (proven by an immediate fast-fail) but the
+ *  caller supplied no authored spendPolicy — collect name + allowance,
+ *  then call createWallet. */
+ | {
+    kind: 'needs_create';
+}
+/** Cannot silently probe (no immediate support, no local handle): render an
+ *  explicit "Sign in" / "I'm new" choice. Never guess. */
+ | {
+    kind: 'needs_choice';
+}
+/** The user dismissed the passkey sheet. Not an error — stay quiet. */
+ | {
+    kind: 'cancelled';
+};
+declare function continueWithDexter(config?: CreateWalletConfig, onPhase?: (phase: CeremonyPhase) => void): Promise<ContinueResult>;
+
 type IdentityKind = 'passkey-vault' | 'account' | 'none';
 interface IdentityInput {
     /** An account session token (e.g. Supabase access_token) when present, else null. */
@@ -286,4 +322,4 @@ declare function syncAcceptedPasskeys(args: {
     rpId?: string;
 }): Promise<boolean>;
 
-export { ACTIVE_WALLET_STORAGE_KEY as A, syncAcceptedPasskeys as B, type CreateWalletResult as C, type DexterConnectConfig as D, usdToAtomic as E, type IdentityKind as I, type PasskeyLoginTokens as P, type RecoverWalletConfig as R, type SignInResult as S, type CreateWalletConfig as a, type CeremonyPhase as b, type ConnectVault as c, type RecoverOutcome as d, ConnectError as e, type IdentityInput as f, type PasskeySignalSupport as g, type RecoverVault as h, type ResolvedIdentity as i, SESSION_TTL_30D as j, type SpendPolicy as k, type StoredWallet as l, authoredPolicy as m, createWallet as n, ejectActiveWallet as o, forgetWallet as p, getActiveHandle as q, getCredentialId as r, listWallets as s, passkeySignalSupport as t, prunePasskey as u, renamePasskey as v, resolveIdentity as w, setActiveHandle as x, subscribe as y, switchWallet as z };
+export { ACTIVE_WALLET_STORAGE_KEY as A, setActiveHandle as B, type ConnectVault as C, type DexterConnectConfig as D, subscribe as E, switchWallet as F, syncAcceptedPasskeys as G, usdToAtomic as H, type IdentityKind as I, type PasskeyLoginTokens as P, type RecoverWalletConfig as R, SESSION_TTL_30D as S, type RecoverOutcome as a, type CeremonyPhase as b, ConnectError as c, type ContinueResult as d, type CreateWalletConfig as e, type CreateWalletResult as f, type IdentityInput as g, type PasskeySignalSupport as h, type RecoverVault as i, type ResolvedIdentity as j, type SignInResult as k, type SpendPolicy as l, type StoredWallet as m, authoredPolicy as n, continueWithDexter as o, createWallet as p, ejectActiveWallet as q, forgetWallet as r, getActiveHandle as s, getCredentialId as t, listWallets as u, passkeyLogin as v, passkeySignalSupport as w, prunePasskey as x, renamePasskey as y, resolveIdentity as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexterai/connect",
-  "version": "0.24.3",
+  "version": "0.25.0",
   "description": "Sign in with Dexter — passkey connector. Composes @dexterai/vault.",
   "type": "module",
   "exports": {