@cavos/kit 0.0.1 → 0.0.3

package/dist/index.mjs

@@ -1,4 +1,6 @@
-export { BackupSigner, Cavos, CavosAuth, DEVICE_ACCOUNT_CLASS_HASH, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, STARKNET_NETWORKS, StarknetAdapter, StarknetDeviceSigner, UDC_ADDRESS, WebCryptoSigner, bigIntTo32Bytes, bytesToBigInt, bytesToHex, deriveAddressSeed, deriveBackupKey, generateRecoveryCode, hexToBytes, recoverYParity, signatureToFelts, u256ToFelts } from './chunk-XWBX2ZIO.mjs';
+import { spkiToPublicKey, derToRs, challengeOffsetOf, base64urlEncode } from './chunk-BNGLH3Q3.mjs';
+export { BackupSigner, Cavos, CavosAuth, CavosSolana, CavosStellar, DEVICE_ACCOUNT_CLASS_HASH, DEVICE_ACCOUNT_PROGRAM_ID, DEVICE_ACCOUNT_WASM_HASH, FACTORY_CONTRACT_ID, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, NATIVE_SAC_ID, SECP256R1_PROGRAM_ID, SOLANA_NETWORKS, STARKNET_NETWORKS, STELLAR_NETWORKS, SolanaAdapter, SolanaRelayer, StarknetAdapter, StarknetDeviceSigner, StellarAdapter, StellarRelayer, UDC_ADDRESS, WebCryptoSigner, anchorDiscriminator, approveDeviceEverywhere, base64urlEncode, batchChallenge, bigIntTo32Bytes, buildSecp256r1Instruction, bytesToBigInt, bytesToHex, compressedPubkey, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, deviceSignatureScVal, encodeLowSSignature, encodeLowSSignature2 as encodeStellarLowSSignature, generateRecoveryCode, hexToBytes, lowS, recoverCandidatePublicKeys, recoverYParity, sec1Pubkey, serializeInstructions, signatureToFelts, u256ToFelts, webauthnDigest } from './chunk-BNGLH3Q3.mjs';
+import { sha256 } from '@noble/hashes/sha256';
 
 // src/auth/AuthProvider.ts
 var StaticIdentity = class {
@@ -9,7 +11,91 @@ var StaticIdentity = class {
     return this.identity;
   }
 };
+var PasskeySigner = class {
+  constructor(opts = {}) {
+    if (typeof window === "undefined" || !navigator.credentials) {
+      throw new Error("kit/passkey: WebAuthn is only available in a browser");
+    }
+    this.rpId = opts.rpId ?? window.location.hostname;
+    this.rpName = opts.rpName ?? this.rpId;
+    if (isIpAddress(this.rpId)) {
+      throw new Error(
+        `kit/passkey: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) \u2014 or pass an explicit \`rpId\`. (The silent device key works over an IP; passkeys don't.)`
+      );
+    }
+  }
+  /** True if this platform advertises a usable passkey (platform authenticator). */
+  static async isSupported() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) return false;
+    try {
+      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    } catch {
+      return false;
+    }
+  }
+  /** Create a new synced passkey and return its P-256 public key. */
+  async enroll(params) {
+    const challenge = crypto.getRandomValues(new Uint8Array(32));
+    const cred = await navigator.credentials.create({
+      publicKey: {
+        challenge: buf(challenge),
+        rp: { id: this.rpId, name: this.rpName },
+        user: {
+          id: buf(userHandle(params.userId)),
+          name: params.userName,
+          displayName: params.displayName ?? params.userName
+        },
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        // ES256 (P-256)
+        authenticatorSelection: {
+          residentKey: "required",
+          requireResidentKey: true,
+          userVerification: "preferred"
+        },
+        attestation: "none"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: enrollment cancelled");
+    const response = cred.response;
+    const spki = new Uint8Array(response.getPublicKey());
+    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };
+  }
+  /**
+   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller
+   * derives from the signer being added + the on-chain nonce). Uses discoverable
+   * credentials — no `allowCredentials` — so it works on a brand-new browser.
+   */
+  async assert(challenge) {
+    const cred = await navigator.credentials.get({
+      publicKey: {
+        challenge: buf(challenge),
+        rpId: this.rpId,
+        allowCredentials: [],
+        userVerification: "preferred"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: assertion cancelled");
+    const response = cred.response;
+    const authenticatorData = new Uint8Array(response.authenticatorData);
+    const clientDataJSON = new Uint8Array(response.clientDataJSON);
+    const { r, s } = derToRs(new Uint8Array(response.signature));
+    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));
+    return { authenticatorData, clientDataJSON, r, s, challengeOffset };
+  }
+};
+function isIpAddress(host) {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.includes(":")) return true;
+  return false;
+}
+function userHandle(userId) {
+  const bytes = new TextEncoder().encode(userId);
+  return bytes.length <= 64 ? bytes : sha256(bytes);
+}
+function buf(bytes) {
+  return bytes.slice();
+}
 
-export { StaticIdentity };
+export { PasskeySigner, StaticIdentity };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/AuthProvider.ts"],"names":[],"mappings":";;;AA2BO,IAAM,iBAAN,MAA6C;AAAA,EAClD,YAA6B,QAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAqB;AAAA,EAClD,MAAM,YAAA,GAAkC;AACtC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF","file":"index.mjs","sourcesContent":["/**\n * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a\n * stable `userId`; that's all the wallet needs to derive its address. Auth never\n * touches signing — the device key does that, silently.\n *\n * Privy-style UX: the user \"logs in\" and the wallet is provisioned behind the\n * scenes (device key + auto-deployed smart account). The app never handles keys.\n */\nexport interface Identity {\n  /** Stable, backend-managed user identifier. */\n  userId: string;\n  /** Optional metadata (email, provider) for display only. */\n  email?: string;\n  provider?: \"google\" | \"apple\" | \"email\" | \"otp\" | string;\n}\n\n/**\n * Authenticates a user and returns their stable identity. Implementations:\n * - `CavosAuth` (hosted, mirrors `@cavos/react`: Google/Apple/email/OTP via the\n *   Cavos backend) — the default, Privy-like experience.\n * - any custom provider (the app already authenticated the user elsewhere).\n */\nexport interface AuthProvider {\n  authenticate(): Promise<Identity>;\n}\n\n/** Trivial provider when the app already has the user's stable id. */\nexport class StaticIdentity implements AuthProvider {\n  constructor(private readonly identity: Identity) {}\n  async authenticate(): Promise<Identity> {\n    return this.identity;\n  }\n}\n"]}
+{"version":3,"sources":["../src/auth/AuthProvider.ts","../src/signer/PasskeySigner.ts"],"names":[],"mappings":";;;;;AA2BO,IAAM,iBAAN,MAA6C;AAAA,EAClD,YAA6B,QAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAqB;AAAA,EAClD,MAAM,YAAA,GAAkC;AACtC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF;ACQO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,WAAA,CAAY,IAAA,GAA6B,EAAC,EAAG;AAC3C,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,UAAU,WAAA,EAAa;AAC3D,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,QAAA;AACzC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,IAAA;AAIlC,IAAA,IAAI,WAAA,CAAY,IAAA,CAAK,IAAI,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,8DAAA,EAAiE,KAAK,IAAI,CAAA,6KAAA;AAAA,OAG5E;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAa,WAAA,GAAgC;AAC3C,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,MAAA,CAAO,qBAAqB,OAAO,KAAA;AACzE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAA,CAAO,mBAAA,CAAoB,6CAAA,EAA8C;AAAA,IACxF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAO,MAAA,EAAuD;AAClE,IAAA,MAAM,YAAY,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC3D,IAAA,MAAM,IAAA,GAAQ,MAAM,SAAA,CAAU,WAAA,CAAY,MAAA,CAAO;AAAA,MAC/C,SAAA,EAAW;AAAA,QACT,SAAA,EAAW,IAAI,SAAS,CAAA;AAAA,QACxB,IAAI,EAAE,EAAA,EAAI,KAAK,IAAA,EAAM,IAAA,EAAM,KAAK,MAAA,EAAO;AAAA,QACvC,IAAA,EAAM;AAAA,UACJ,EAAA,EAAI,GAAA,CAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,UACjC,MAAM,MAAA,CAAO,QAAA;AAAA,UACb,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO;AAAA,SAC5C;AAAA,QACA,kBAAkB,CAAC,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,IAAI,CAAA;AAAA;AAAA,QAClD,sBAAA,EAAwB;AAAA,UACtB,WAAA,EAAa,UAAA;AAAA,UACb,kBAAA,EAAoB,IAAA;AAAA,UACpB,gBAAA,EAAkB;AAAA,SACpB;AAAA,QACA,WAAA,EAAa;AAAA;AACf,KACD,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAE9D,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,QAAA,CAAS,cAAe,CAAA;AACpD,IAAA,OAAO,EAAE,SAAA,EAAW,eAAA,CAAgB,IAAI,CAAA,EAAG,cAAc,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAE;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,SAAA,EAAkD;AAC7D,IAAA,MAAM,IAAA,GAAQ,MAAM,SAAA,CAAU,WAAA,CAAY,GAAA,CAAI;AAAA,MAC5C,SAAA,EAAW;AAAA,QACT,SAAA,EAAW,IAAI,SAAS,CAAA;AAAA,QACxB,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,kBAAkB,EAAC;AAAA,QACnB,gBAAA,EAAkB;AAAA;AACpB,KACD,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAE7D,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,IAAA,MAAM,iBAAA,GAAoB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB,CAAA;AACnE,IAAA,MAAM,cAAA,GAAiB,IAAI,UAAA,CAAW,QAAA,CAAS,cAAc,CAAA;AAC7D,IAAA,MAAM,EAAE,GAAG,CAAA,EAAE,GAAI,QAAQ,IAAI,UAAA,CAAW,QAAA,CAAS,SAAS,CAAC,CAAA;AAC3D,IAAA,MAAM,eAAA,GAAkB,iBAAA,CAAkB,cAAA,EAAgB,eAAA,CAAgB,SAAS,CAAC,CAAA;AACpF,IAAA,OAAO,EAAE,iBAAA,EAAmB,cAAA,EAAgB,CAAA,EAAG,GAAG,eAAA,EAAgB;AAAA,EACpE;AACF;AAQA,SAAS,YAAY,IAAA,EAAuB;AAC1C,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AACjD,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAW,MAAA,EAA4B;AAC9C,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AAC7C,EAAA,OAAO,KAAA,CAAM,MAAA,IAAU,EAAA,GAAK,KAAA,GAAQ,OAAO,KAAK,CAAA;AAClD;AAIA,SAAS,IAAI,KAAA,EAAiC;AAC5C,EAAA,OAAO,MAAM,KAAA,EAAM;AACrB","file":"index.mjs","sourcesContent":["/**\n * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a\n * stable `userId`; that's all the wallet needs to derive its address. Auth never\n * touches signing — the device key does that, silently.\n *\n * Privy-style UX: the user \"logs in\" and the wallet is provisioned behind the\n * scenes (device key + auto-deployed smart account). The app never handles keys.\n */\nexport interface Identity {\n  /** Stable, backend-managed user identifier. */\n  userId: string;\n  /** Optional metadata (email, provider) for display only. */\n  email?: string;\n  provider?: \"google\" | \"apple\" | \"email\" | \"otp\" | string;\n}\n\n/**\n * Authenticates a user and returns their stable identity. Implementations:\n * - `CavosAuth` (hosted, mirrors `@cavos/react`: Google/Apple/email/OTP via the\n *   Cavos backend) — the default, Privy-like experience.\n * - any custom provider (the app already authenticated the user elsewhere).\n */\nexport interface AuthProvider {\n  authenticate(): Promise<Identity>;\n}\n\n/** Trivial provider when the app already has the user's stable id. */\nexport class StaticIdentity implements AuthProvider {\n  constructor(private readonly identity: Identity) {}\n  async authenticate(): Promise<Identity> {\n    return this.identity;\n  }\n}\n","import { sha256 } from \"@noble/hashes/sha256\";\nimport type { DevicePublicKey } from \"./DeviceSigner\";\nimport {\n  base64urlEncode,\n  challengeOffsetOf,\n  derToRs,\n  spkiToPublicKey,\n  type PasskeyAssertion,\n} from \"../crypto/webauthn\";\n\nexport interface PasskeySignerOptions {\n  /** Relying-Party id (usually the eTLD+1). Defaults to `window.location.hostname`. */\n  rpId?: string;\n  /** Human-readable RP name shown in the OS passkey UI. */\n  rpName?: string;\n}\n\nexport interface PasskeyEnrollParams {\n  /** Stable user handle for the credential (e.g. the account address or userId). */\n  userId: string;\n  /** Account name shown in the OS passkey UI (e.g. an email). */\n  userName: string;\n  displayName?: string;\n}\n\nexport interface EnrolledPasskey {\n  publicKey: DevicePublicKey;\n  credentialId: Uint8Array;\n}\n\n/**\n * Browser passkey signer. Creates a discoverable (resident) secp256r1 credential\n * that syncs across the user's devices (iCloud Keychain / Google Password\n * Manager), and produces WebAuthn assertions used to authorize `add_signer`.\n *\n * This is a step-up primitive: the app decides WHEN to enroll (e.g. after\n * onboarding, as a \"turn on device approvals\" / 2FA moment). Enrollment\n * registers the passkey on-chain as an approver; later, from any browser, an\n * assertion approves adding that browser's new device key.\n */\nexport class PasskeySigner {\n  private readonly rpId: string;\n  private readonly rpName: string;\n\n  constructor(opts: PasskeySignerOptions = {}) {\n    if (typeof window === \"undefined\" || !navigator.credentials) {\n      throw new Error(\"kit/passkey: WebAuthn is only available in a browser\");\n    }\n    this.rpId = opts.rpId ?? window.location.hostname;\n    this.rpName = opts.rpName ?? this.rpId;\n    // WebAuthn requires the RP ID to be a registrable domain (or \"localhost\").\n    // An IP address always fails with a cryptic \"invalid domain\" — surface an\n    // actionable message instead (common when devs test over a LAN IP).\n    if (isIpAddress(this.rpId)) {\n      throw new Error(\n        `kit/passkey: passkeys can't use an IP address as the domain (\"${this.rpId}\"). ` +\n          \"Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) — \" +\n          \"or pass an explicit `rpId`. (The silent device key works over an IP; passkeys don't.)\",\n      );\n    }\n  }\n\n  /** True if this platform advertises a usable passkey (platform authenticator). */\n  static async isSupported(): Promise<boolean> {\n    if (typeof window === \"undefined\" || !window.PublicKeyCredential) return false;\n    try {\n      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();\n    } catch {\n      return false;\n    }\n  }\n\n  /** Create a new synced passkey and return its P-256 public key. */\n  async enroll(params: PasskeyEnrollParams): Promise<EnrolledPasskey> {\n    const challenge = crypto.getRandomValues(new Uint8Array(32));\n    const cred = (await navigator.credentials.create({\n      publicKey: {\n        challenge: buf(challenge),\n        rp: { id: this.rpId, name: this.rpName },\n        user: {\n          id: buf(userHandle(params.userId)),\n          name: params.userName,\n          displayName: params.displayName ?? params.userName,\n        },\n        pubKeyCredParams: [{ type: \"public-key\", alg: -7 }], // ES256 (P-256)\n        authenticatorSelection: {\n          residentKey: \"required\",\n          requireResidentKey: true,\n          userVerification: \"preferred\",\n        },\n        attestation: \"none\",\n      },\n    })) as PublicKeyCredential | null;\n    if (!cred) throw new Error(\"kit/passkey: enrollment cancelled\");\n\n    const response = cred.response as AuthenticatorAttestationResponse;\n    const spki = new Uint8Array(response.getPublicKey()!);\n    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };\n  }\n\n  /**\n   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller\n   * derives from the signer being added + the on-chain nonce). Uses discoverable\n   * credentials — no `allowCredentials` — so it works on a brand-new browser.\n   */\n  async assert(challenge: Uint8Array): Promise<PasskeyAssertion> {\n    const cred = (await navigator.credentials.get({\n      publicKey: {\n        challenge: buf(challenge),\n        rpId: this.rpId,\n        allowCredentials: [],\n        userVerification: \"preferred\",\n      },\n    })) as PublicKeyCredential | null;\n    if (!cred) throw new Error(\"kit/passkey: assertion cancelled\");\n\n    const response = cred.response as AuthenticatorAssertionResponse;\n    const authenticatorData = new Uint8Array(response.authenticatorData);\n    const clientDataJSON = new Uint8Array(response.clientDataJSON);\n    const { r, s } = derToRs(new Uint8Array(response.signature));\n    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));\n    return { authenticatorData, clientDataJSON, r, s, challengeOffset };\n  }\n}\n\n/**\n * WebAuthn requires the user handle to be 1..64 bytes. `userId` may be longer\n * (e.g. a 66-char Starknet address), so hash anything over 64 bytes to a stable\n * 32-byte handle. The handle is opaque — only its stability matters.\n */\n/** True for IPv4/IPv6 literals — WebAuthn rejects these as an RP ID. */\nfunction isIpAddress(host: string): boolean {\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(host)) return true; // IPv4\n  if (host.includes(\":\")) return true; // IPv6 literal\n  return false;\n}\n\nfunction userHandle(userId: string): Uint8Array {\n  const bytes = new TextEncoder().encode(userId);\n  return bytes.length <= 64 ? bytes : sha256(bytes);\n}\n\n/** Coerce a `Uint8Array` to the `BufferSource` the WebAuthn DOM types want\n * (works around the TS5.7 `ArrayBufferLike` vs `ArrayBuffer` mismatch). */\nfunction buf(bytes: Uint8Array): BufferSource {\n  return bytes.slice() as unknown as BufferSource;\n}\n"]}

package/dist/react/index.d.mts

@@ -1,18 +1,24 @@
 import * as react from 'react';
 import react__default, { ReactNode } from 'react';
-import { S as StarknetNetwork, C as ChainCall } from '../constants-C530TZFF.mjs';
+import { k as Chain, u as NetworkEnv, j as CavosWallet, e as ChainCall, x as PasskeySigner, w as PasskeyEnrollParams } from '../Cavos-BH2_tOQ2.mjs';
+import 'starknet';
+import '@solana/web3.js';
+import '@stellar/stellar-sdk';
 
 interface CavosConfig {
     /** Cavos App ID from the dashboard. */
     appId?: string;
-    network: StarknetNetwork;
+    /** Target chain. Defaults to 'starknet'. */
+    chain?: Chain;
+    /** Environment: 'testnet' (sepolia/devnet) or 'mainnet'. */
+    network: NetworkEnv;
     /** Per-app salt so the same user has distinct wallets per app. */
     appSalt: string;
-    /** Cavos paymaster API key (sponsors deploy + execute). */
-    paymasterApiKey: string;
+    /** Cavos paymaster API key (sponsors deploy + execute). Required for Starknet. */
+    paymasterApiKey?: string;
     /** Override the Cavos auth backend (self-hosted / staging). */
     authBackendUrl?: string;
-    /** Override the Starknet RPC. */
+    /** Override the chain RPC. */
     rpcUrl?: string;
 }
 interface CavosModalConfig {
@@ -50,6 +56,14 @@ interface CavosContextValue {
     closeModal: () => void;
     isAuthenticated: boolean;
     user: UserInfo | null;
+    /** The active chain ('starknet' | 'solana'). */
+    chain: Chain;
+    /**
+     * The raw connected wallet, discriminated by `wallet.chain`. Use this for
+     * chain-native calls (e.g. Solana `wallet.execute(amount, dest)`); narrow on
+     * `wallet.chain` first. Null until connected.
+     */
+    wallet: CavosWallet | null;
     address: string | null;
     walletStatus: WalletStatus;
     isLoading: boolean;
@@ -81,6 +95,29 @@ interface CavosContextValue {
     }>;
     /** Re-request the device-approval email for the current pending request. */
     resendDeviceApproval: () => Promise<void>;
+    /**
+     * Enroll a passkey as an approver (2FA-style step-up). Works on every chain.
+     * Call this when you want to let users approve new devices from any browser.
+     * Requires a ready device; returns the passkey's public key.
+     */
+    enrollPasskey: (passkey: PasskeySigner, params: PasskeyEnrollParams) => Promise<{
+        publicKey: {
+            x: bigint;
+            y: bigint;
+        };
+        transactionHash?: string;
+    }>;
+    /**
+     * From a fresh browser (status `needs-device-approval`), approve adding THIS
+     * device using the user's synced passkey. Works on every chain (Starknet
+     * requires a `submit` relayer callback; Solana/Stellar go through the
+     * configured relayer). Returns the tx hash.
+     */
+    approveThisDeviceWithPasskey: (passkey: PasskeySigner, submit?: (call: ChainCall) => Promise<{
+        transactionHash: string;
+    }>) => Promise<{
+        transactionHash: string;
+    }>;
     /**
      * Register a backup signer derived from `code` on the current account
      * (gasless). The code is generated by the kit and shown to the user once.

package/dist/react/index.d.ts

@@ -1,18 +1,24 @@
 import * as react from 'react';
 import react__default, { ReactNode } from 'react';
-import { S as StarknetNetwork, C as ChainCall } from '../constants-C530TZFF.js';
+import { k as Chain, u as NetworkEnv, j as CavosWallet, e as ChainCall, x as PasskeySigner, w as PasskeyEnrollParams } from '../Cavos-BH2_tOQ2.js';
+import 'starknet';
+import '@solana/web3.js';
+import '@stellar/stellar-sdk';
 
 interface CavosConfig {
     /** Cavos App ID from the dashboard. */
     appId?: string;
-    network: StarknetNetwork;
+    /** Target chain. Defaults to 'starknet'. */
+    chain?: Chain;
+    /** Environment: 'testnet' (sepolia/devnet) or 'mainnet'. */
+    network: NetworkEnv;
     /** Per-app salt so the same user has distinct wallets per app. */
     appSalt: string;
-    /** Cavos paymaster API key (sponsors deploy + execute). */
-    paymasterApiKey: string;
+    /** Cavos paymaster API key (sponsors deploy + execute). Required for Starknet. */
+    paymasterApiKey?: string;
     /** Override the Cavos auth backend (self-hosted / staging). */
     authBackendUrl?: string;
-    /** Override the Starknet RPC. */
+    /** Override the chain RPC. */
     rpcUrl?: string;
 }
 interface CavosModalConfig {
@@ -50,6 +56,14 @@ interface CavosContextValue {
     closeModal: () => void;
     isAuthenticated: boolean;
     user: UserInfo | null;
+    /** The active chain ('starknet' | 'solana'). */
+    chain: Chain;
+    /**
+     * The raw connected wallet, discriminated by `wallet.chain`. Use this for
+     * chain-native calls (e.g. Solana `wallet.execute(amount, dest)`); narrow on
+     * `wallet.chain` first. Null until connected.
+     */
+    wallet: CavosWallet | null;
     address: string | null;
     walletStatus: WalletStatus;
     isLoading: boolean;
@@ -81,6 +95,29 @@ interface CavosContextValue {
     }>;
     /** Re-request the device-approval email for the current pending request. */
     resendDeviceApproval: () => Promise<void>;
+    /**
+     * Enroll a passkey as an approver (2FA-style step-up). Works on every chain.
+     * Call this when you want to let users approve new devices from any browser.
+     * Requires a ready device; returns the passkey's public key.
+     */
+    enrollPasskey: (passkey: PasskeySigner, params: PasskeyEnrollParams) => Promise<{
+        publicKey: {
+            x: bigint;
+            y: bigint;
+        };
+        transactionHash?: string;
+    }>;
+    /**
+     * From a fresh browser (status `needs-device-approval`), approve adding THIS
+     * device using the user's synced passkey. Works on every chain (Starknet
+     * requires a `submit` relayer callback; Solana/Stellar go through the
+     * configured relayer). Returns the tx hash.
+     */
+    approveThisDeviceWithPasskey: (passkey: PasskeySigner, submit?: (call: ChainCall) => Promise<{
+        transactionHash: string;
+    }>) => Promise<{
+        transactionHash: string;
+    }>;
     /**
      * Register a backup signer derived from `code` on the current account
      * (gasless). The code is generated by the kit and shown to the user once.