@cavos/kit 0.0.2 → 0.0.4

package/dist/{Cavos-C2KHZxxu.d.mts → Cavos-x9qFpOvJ.d.mts}

@@ -1,5 +1,6 @@
 import { Account } from 'starknet';
 import { PublicKey, Connection, TransactionInstruction, Keypair } from '@solana/web3.js';
+import { Keypair as Keypair$1 } from '@stellar/stellar-sdk';
 
 /**
  * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a
@@ -114,6 +115,39 @@ declare class InMemoryWalletRegistry implements WalletRegistry {
     }): Promise<void>;
 }
 
+/** A parsed passkey assertion, chain-agnostic. */
+interface PasskeyAssertion {
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** ECDSA signature components (raw, as returned by the authenticator). */
+    r: bigint;
+    s: bigint;
+    /** Byte index where the base64url challenge starts inside clientDataJSON. */
+    challengeOffset: number;
+}
+/** base64url (no padding) of a byte array. */
+declare function base64urlEncode(bytes: Uint8Array): string;
+/**
+ * Batch challenge over ordered per-chain leaves: `sha256(leaf_0 ‖ … ‖ leaf_n)`.
+ * A single passkey assertion over this challenge authorizes `add_signer` on every
+ * chain in the batch (each chain verifies only its own leaf sits at its index).
+ * For a single chain the batch is one leaf, so the challenge is `sha256(leaf)`.
+ */
+declare function batchChallenge(leaves: Uint8Array[]): Uint8Array;
+/** The WebAuthn signed digest: `sha256(authenticatorData || sha256(clientDataJSON))`. */
+declare function webauthnDigest(authenticatorData: Uint8Array, clientDataJSON: Uint8Array): Uint8Array;
+/** Both candidate public keys recoverable from `(r, s)` over `digest`, tagged
+ * with their y-parity. On a fresh browser the assertion does not carry the
+ * pubkey, so the caller identifies the real one via the on-chain `is_approver`
+ * view. */
+declare function recoverCandidatePublicKeys(r: bigint, s: bigint, digest: Uint8Array): {
+    publicKey: DevicePublicKey;
+    yParity: boolean;
+}[];
+/** Normalize `s` to the low half of the curve order (required by the Stellar
+ * and Solana verifiers, which do not normalize on-chain). */
+declare function lowS(s: bigint): bigint;
+
 /** An account meta candidate for a CPI instruction inside `execute`. Mirrors the
  *  on-chain `AccountMetaCandidate` (Borsh). */
 interface InstructionAccount {
@@ -159,6 +193,27 @@ declare class SolanaAdapter {
     buildAddSigner(account: string, newSigner: DevicePublicKey): Promise<TransactionInstruction[]>;
     /** `[precompile, remove_signer]` bundle, authorized by an existing device signer. */
     buildRemoveSigner(account: string, signer: DevicePublicKey): Promise<TransactionInstruction[]>;
+    /** `[precompile, add_approver]` bundle enrolling a passkey approver (device-signed). */
+    buildAddApprover(account: string, passkey: DevicePublicKey): Promise<TransactionInstruction[]>;
+    /** `[precompile, remove_approver]` bundle (device-signed). */
+    buildRemoveApprover(account: string, passkey: DevicePublicKey): Promise<TransactionInstruction[]>;
+    /** This chain's leaf for approving `add_signer(newSigner)` at `nonce`:
+     * `sha256(compressed(new_signer) || passkey_nonce_le8)`. The batch challenge the
+     * passkey signs is `sha256(concat(leaves))` across chains. */
+    passkeyLeaf(newSigner: DevicePublicKey, nonce: bigint): Uint8Array;
+    /**
+     * `[precompile(passkey), add_signer_via_passkey]` bundle. The precompile ix
+     * verifies the PASSKEY's WebAuthn assertion over `authData || sha256(clientDataJSON)`;
+     * the program ix binds the challenge to `newSigner` + the passkey nonce and adds
+     * the signer. No device signature — a gasless relayer can submit it.
+     */
+    buildAddSignerViaPasskey(account: string, newSigner: DevicePublicKey, passkey: DevicePublicKey, leaves: Uint8Array[], leafIndex: number, assertion: PasskeyAssertion): TransactionInstruction[];
+    /** Read whether `passkey` is a registered approver. */
+    /** True if the account has at least one passkey registered as an approver. */
+    hasPasskeyApprover(account: string): Promise<boolean>;
+    isApprover(account: string, passkey: DevicePublicKey): Promise<boolean>;
+    /** Read the current passkey-approval nonce. */
+    passkeyNonce(account: string): Promise<bigint>;
     /** `[precompile, execute_transfer]` bundle moving lamports out of the account. */
     buildExecuteTransfer(account: string, destination: string, amount: bigint): Promise<TransactionInstruction[]>;
     /**
@@ -179,6 +234,7 @@ declare class SolanaAdapter {
     private signToPrecompile;
     private fetchNonce;
     private fetchSigners;
+    private fetchApprovers;
     private requireConnection;
 }
 /** Compressed SEC1 P-256 pubkey (33 bytes) from {x, y}. */
@@ -234,6 +290,49 @@ declare class SolanaRelayer {
     send(instructions: TransactionInstruction[]): Promise<string>;
 }
 
+interface PasskeySignerOptions {
+    /** Relying-Party id (usually the eTLD+1). Defaults to `window.location.hostname`. */
+    rpId?: string;
+    /** Human-readable RP name shown in the OS passkey UI. */
+    rpName?: string;
+}
+interface PasskeyEnrollParams {
+    /** Stable user handle for the credential (e.g. the account address or userId). */
+    userId: string;
+    /** Account name shown in the OS passkey UI (e.g. an email). */
+    userName: string;
+    displayName?: string;
+}
+interface EnrolledPasskey {
+    publicKey: DevicePublicKey;
+    credentialId: Uint8Array;
+}
+/**
+ * Browser passkey signer. Creates a discoverable (resident) secp256r1 credential
+ * that syncs across the user's devices (iCloud Keychain / Google Password
+ * Manager), and produces WebAuthn assertions used to authorize `add_signer`.
+ *
+ * This is a step-up primitive: the app decides WHEN to enroll (e.g. after
+ * onboarding, as a "turn on device approvals" / 2FA moment). Enrollment
+ * registers the passkey on-chain as an approver; later, from any browser, an
+ * assertion approves adding that browser's new device key.
+ */
+declare class PasskeySigner {
+    private readonly rpId;
+    private readonly rpName;
+    constructor(opts?: PasskeySignerOptions);
+    /** True if this platform advertises a usable passkey (platform authenticator). */
+    static isSupported(): Promise<boolean>;
+    /** Create a new synced passkey and return its P-256 public key. */
+    enroll(params: PasskeyEnrollParams): Promise<EnrolledPasskey>;
+    /**
+     * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller
+     * derives from the signer being added + the on-chain nonce). Uses discoverable
+     * credentials — no `allowCredentials` — so it works on a brand-new browser.
+     */
+    assert(challenge: Uint8Array): Promise<PasskeyAssertion>;
+}
+
 interface ConnectSolanaOptions {
     network: SolanaNetwork;
     /** Authenticated user (pass `identity` directly, or an `auth` provider). */
@@ -263,7 +362,7 @@ interface ConnectSolanaOptions {
      */
     feePayer?: Keypair;
 }
-type ConnectStatus$1 = "ready" | "needs-device-approval";
+type ConnectStatus$2 = "ready" | "needs-device-approval";
 /**
  * Options for recovering a Solana account after losing every device signer.
  * Mirrors `RecoveryOptions` (Starknet), adapted to the Solana path: the backup
@@ -308,7 +407,7 @@ interface RecoverSolanaOptions {
 declare class CavosSolana {
     readonly identity: Identity;
     readonly address: string;
-    readonly status: ConnectStatus$1;
+    readonly status: ConnectStatus$2;
     readonly connection: Connection;
     private readonly adapter;
     private readonly devicePubkey;
@@ -316,11 +415,48 @@ declare class CavosSolana {
     private readonly feePayer?;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     readonly chain: "solana";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    isNewAccount: boolean;
     private constructor();
     get publicKey(): DevicePublicKey;
     static connect(opts: ConnectSolanaOptions): Promise<CavosSolana>;
     /** Authorize an additional device signer (device-signed via precompile). */
     addSigner(pubkey: DevicePublicKey): Promise<string>;
+    /**
+     * Enroll a passkey as an approver (2FA-style step-up). Device-signed + gasless;
+     * requires a ready device. Idempotent. Returns the passkey pubkey + tx hash.
+     */
+    enrollPasskey(passkey: PasskeySigner, params: PasskeyEnrollParams): Promise<{
+        publicKey: DevicePublicKey;
+        transactionHash?: string;
+    }>;
+    /** Register an already-enrolled passkey pubkey as an approver (gasless).
+     * Idempotent. Lets one passkey be registered across chains without re-prompting. */
+    addApprover(pubkey: DevicePublicKey): Promise<{
+        transactionHash?: string;
+    }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Used to poll for readiness after a passkey approval before it's indexed. */
+    isReady(): Promise<boolean>;
+    /**
+     * From a fresh browser (status `needs-device-approval`), approve adding THIS
+     * device with the user's synced passkey. Gasless via the relayer — the bundle
+     * carries the passkey's WebAuthn assertion, so no device signature is needed.
+     */
+    approveThisDeviceWithPasskey(passkey: PasskeySigner): Promise<string>;
+    /** This device's leaf + passkey nonce for a (possibly multi-chain) batch. */
+    passkeyLeafForThisDevice(): Promise<{
+        leaf: Uint8Array;
+        nonce: bigint;
+    }>;
+    /** Submit `add_signer_via_passkey` given a shared assertion + batch position.
+     * Used by `approveThisDeviceWithPasskey` and `approveDeviceEverywhere`. */
+    submitPasskeyApproval(assertion: PasskeyAssertion, leaves: Uint8Array[], leafIndex: number, _nonce: bigint): Promise<{
+        transactionHash: string;
+    }>;
     /** Move `amount` lamports out of the account to `destination` (device-signed). */
     execute(amount: bigint, destination: string): Promise<string>;
     /**
@@ -362,6 +498,204 @@ declare class CavosSolana {
     private send;
 }
 
+/** Cavos device-account primitives on Stellar / Soroban. */
+/**
+ * Deployed `cavos-account-factory` contract id per network (see
+ * account-contracts/stellar/deployments). The factory is the fixed deployer that
+ * makes account addresses a deterministic function of (identity, device pubkey).
+ */
+declare const FACTORY_CONTRACT_ID: {
+    readonly "stellar-testnet": "CBCJIODXIEBOXXD66KCUCF7ZDYJARKI4ZIVQOVWPULOBH5XGNCDP6W3I";
+    readonly "stellar-mainnet": "";
+};
+/** Uploaded Wasm hash of `cavos-device-account` (informational / verification). */
+declare const DEVICE_ACCOUNT_WASM_HASH: {
+    readonly "stellar-testnet": "2671b085578e59a385ef5a5664e42f0450322fe3249539f588e1263ed5a31dce";
+    readonly "stellar-mainnet": "";
+};
+declare const STELLAR_NETWORKS: {
+    readonly "stellar-testnet": {
+        readonly rpcUrl: "https://soroban-testnet.stellar.org";
+        readonly passphrase: "Test SDF Network ; September 2015";
+    };
+    readonly "stellar-mainnet": {
+        readonly rpcUrl: "https://soroban-rpc.mainnet.stellar.gateway.fm";
+        readonly passphrase: "Public Global Stellar Network ; September 2015";
+    };
+};
+type StellarNetwork = keyof typeof STELLAR_NETWORKS;
+/** Native XLM Stellar Asset Contract (SAC) id per network — the token the demo
+ *  moves. Any SEP-41 token contract works; this is a convenience default. */
+declare const NATIVE_SAC_ID: {
+    readonly "stellar-testnet": "CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC";
+    readonly "stellar-mainnet": "CAS3J7GYLGXMF6TDJBBYYSE3HQ6BBSMLNUQ34T6TZMYMW2EVH34XOWMA";
+};
+
+interface StellarRelayerOptions {
+    /** Base URL of the Cavos backend exposing /api/stellar/relay. */
+    baseUrl: string;
+    /** Cavos App ID (authorizes the sponsored request). */
+    appId: string;
+    network: StellarNetwork;
+}
+/**
+ * Client for the Cavos Stellar sponsoring relayer. On Stellar the account is a
+ * *contract*, which cannot be a transaction source — so the relayer's own
+ * G-account is the transaction source AND fee payer. The user's silent device
+ * key never pays: it only signs the Soroban *authorization entry* (verified by
+ * the account's `__check_auth`), which is independent of who submits or pays.
+ * That gives a seedless, gasless experience with no fee-payer keypair on the
+ * integrator side — the same "relayer pays, device authorizes" split as Solana.
+ *
+ * The SDK builds the fully-assembled transaction (source = relayer, Soroban auth
+ * entries already device-signed) and hands its unsigned XDR to the relayer, which
+ * validates it against its allowlist, signs the envelope and submits.
+ */
+declare class StellarRelayer {
+    private readonly opts;
+    private source?;
+    constructor(opts: StellarRelayerOptions);
+    /** The relayer's source/fee-payer G-account (fetched + cached from the backend). */
+    getSource(): Promise<string>;
+    /**
+     * POST the assembled, device-authorized transaction XDR to the relayer to sign
+     * the envelope + submit. Returns the confirmed transaction hash.
+     */
+    submit(transactionXdr: string): Promise<string>;
+}
+
+interface ConnectStellarOptions {
+    network: StellarNetwork;
+    /** Authenticated user (pass `identity` directly, or an `auth` provider). */
+    auth?: AuthProvider;
+    identity?: Identity;
+    appSalt: string;
+    appId?: string;
+    backendUrl?: string;
+    registry?: WalletRegistry;
+    /** RPC override (else the network default). */
+    rpcUrl?: string;
+    /** Factory contract id override (else the per-network default). */
+    factoryId?: string;
+    /** Override the device signer factory (native / tests); default WebCrypto. */
+    createSigner?: (keyId: string) => Promise<DeviceSigner>;
+    /**
+     * Gasless sponsorship via the Cavos relayer. When set (or when `appId` +
+     * `backendUrl` are given) the relayer is the transaction source + fee payer, so
+     * the integrator needs NO Stellar keypair — the silent device key (which holds
+     * no XLM) gets a seedless, gasless experience.
+     */
+    relayer?: StellarRelayer;
+    /**
+     * Self-funded fallback: a Stellar `Keypair` that is the transaction source +
+     * fee payer. Used only when no `relayer` is configured (tests / advanced).
+     */
+    sourceKeypair?: Keypair$1;
+}
+interface RecoverStellarOptions extends Omit<ConnectStellarOptions, "auth"> {
+    /** The recovery code the user stored when they ran setupRecovery. */
+    code: string;
+    /** Authenticated identity (same user who owns the account). */
+    identity: Identity;
+}
+type ConnectStatus$1 = "ready" | "needs-device-approval";
+/**
+ * High-level Stellar entry — the Soroban analogue of `Cavos.connect` /
+ * `CavosSolana.connect`. One call derives the deterministic device-bound account,
+ * deploys it via the factory if needed, registers it for cross-device
+ * recognition, and returns a ready handle whose silent P-256 device key
+ * authorizes every action through the account's `__check_auth`.
+ *
+ *   const cavos = await CavosStellar.connect({ network: "stellar-testnet", identity, appSalt, relayer });
+ *   if (cavos.status === "ready") await cavos.execute(10_000_000n, dest); // 1 XLM
+ *
+ * Gasless by default: with an `appId` the Cavos relayer is the tx source + fee
+ * payer. `sourceKeypair` is the self-funded fallback.
+ */
+declare class CavosStellar {
+    readonly identity: Identity;
+    readonly address: string;
+    readonly status: ConnectStatus$1;
+    readonly network: StellarNetwork;
+    private readonly adapter;
+    private readonly devicePubkey;
+    private readonly relayer?;
+    private readonly sourceKeypair?;
+    /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
+    readonly chain: "stellar";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    isNewAccount: boolean;
+    private constructor();
+    get publicKey(): DevicePublicKey;
+    static connect(opts: ConnectStellarOptions): Promise<CavosStellar>;
+    /** Authorize an additional device signer (device-signed via `__check_auth`). */
+    addSigner(pubkey: DevicePublicKey): Promise<string>;
+    /**
+     * Enroll a passkey as an approver (2FA-style step-up). Device-signed + gasless;
+     * requires a ready device. Idempotent. Returns the passkey pubkey + tx hash.
+     */
+    enrollPasskey(passkey: PasskeySigner, params: PasskeyEnrollParams): Promise<{
+        publicKey: DevicePublicKey;
+        transactionHash?: string;
+    }>;
+    /** Register an already-enrolled passkey pubkey as an approver (gasless).
+     * Idempotent. Lets one passkey be registered across chains without re-prompting. */
+    addApprover(pubkey: DevicePublicKey): Promise<{
+        transactionHash?: string;
+    }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Used to poll for readiness after a passkey approval before it's indexed. */
+    isReady(): Promise<boolean>;
+    /**
+     * From a fresh browser (status `needs-device-approval`), approve adding THIS
+     * device using the user's synced passkey. Gasless via the relayer — the call
+     * carries the WebAuthn assertion, so no device signature is needed. Returns the
+     * tx hash. No trip back to an already-authorized device.
+     */
+    approveThisDeviceWithPasskey(passkey: PasskeySigner): Promise<string>;
+    /** This device's leaf + passkey nonce for a (possibly multi-chain) batch. */
+    passkeyLeafForThisDevice(): Promise<{
+        leaf: Uint8Array;
+        nonce: bigint;
+    }>;
+    /** Submit `add_signer_via_passkey` given a shared assertion + batch position.
+     * No device auth entry — authorized purely by the passkey assertion. */
+    submitPasskeyApproval(assertion: PasskeyAssertion, leaves: Uint8Array[], leafIndex: number, nonce: bigint): Promise<{
+        transactionHash: string;
+    }>;
+    /** Move `amount` stroops of native XLM to `destination` (device-signed). */
+    execute(amount: bigint, destination: string): Promise<string>;
+    /** Read this account's balance of `tokenId` (defaults to native XLM), in stroops. */
+    balance(tokenId?: string): Promise<bigint>;
+    /** Transfer `amount` of any SEP-41 token out of the account (device-signed). */
+    executeTransfer(tokenId: string, amount: bigint, destination: string): Promise<string>;
+    /**
+     * Register the backup signer derived from `code` as an authorized signer of
+     * this account (device-signed). Idempotent. The code never leaves the device —
+     * only the derived public key travels on-chain. Mirrors the other chains.
+     */
+    setupRecovery(code: string): Promise<string | undefined>;
+    /**
+     * Recover an account after losing every device signer: derive the backup key
+     * from `code`, use it (not the new device) to authorize `add_signer(newDevice)`,
+     * and return a ready handle bound to the new device. The address is unchanged.
+     */
+    static recover(opts: RecoverStellarOptions): Promise<CavosStellar>;
+    /** The transaction source/fee-payer G-address (relayer or self-funded). */
+    private resolveSource;
+    /**
+     * Build → simulate → device-sign auth → assemble → submit an invoke-contract
+     * host function. `authAccount` is the account whose `__check_auth` must sign the
+     * operation's Soroban auth entry (undefined for a plain factory deploy).
+     */
+    private submitHostFunction;
+    /** Submit a signed tx via RPC and poll to confirmation. Returns the hash. */
+    private sendAndConfirm;
+}
+
 /** A chain-native contract call (Starknet `Call`-shaped; generic for portability). */
 interface ChainCall {
     contractAddress: string;
@@ -445,14 +779,14 @@ interface PendingDeviceRequest {
 }
 
 /** The chains the unified `Cavos.connect` can target. */
-type Chain = "starknet" | "solana";
+type Chain = "starknet" | "solana" | "stellar";
 /**
  * Environment selector. `Cavos.connect` resolves it to the chain's concrete
  * network: starknet → sepolia/mainnet, solana → solana-devnet/solana-mainnet.
  */
 type NetworkEnv = "mainnet" | "testnet";
 /** A connected wallet: discriminated by `chain`, so `execute()` stays native. */
-type CavosWallet = Cavos | CavosSolana;
+type CavosWallet = Cavos | CavosSolana | CavosStellar;
 interface ConnectOptions {
     /** Target chain. The returned wallet is discriminated by this same value. */
     chain: Chain;
@@ -493,6 +827,12 @@ interface ConnectOptions {
     relayer?: SolanaRelayer;
     /** Self-funded fee-payer fallback when no relayer is configured. */
     feePayer?: Keypair;
+    /** Gasless sponsorship relayer (defaults to the hosted one when `appId` set). */
+    stellarRelayer?: StellarRelayer;
+    /** Self-funded source/fee-payer Stellar keypair when no relayer is configured. */
+    stellarSourceKeypair?: Keypair$1;
+    /** Factory contract id override (else the per-network default). */
+    factoryId?: string;
 }
 /** Whether this device can already operate the wallet, or needs to be added. */
 type ConnectStatus = "ready" | "needs-device-approval";
@@ -535,10 +875,15 @@ declare class Cavos {
     readonly account: Account;
     private readonly adapter;
     private readonly devicePubkey;
+    /** Paymaster URL + API key, for the sponsored passkey-approval path. */
+    private readonly paymaster?;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     readonly chain: "starknet";
     /** Request id of the pending device-addition, when status is needs-device-approval. */
     pendingRequestId: string | null;
+    /** True when this connect just created & deployed a brand-new account (first
+     * sign-up), so the UI can offer a one-time "secure your account" step. */
+    isNewAccount: boolean;
     private constructor();
     /**
      * Unified entry point. Pick a `chain` and an `network` environment; the kit
@@ -562,6 +907,67 @@ declare class Cavos {
     addSigner(pubkey: DevicePublicKey): Promise<{
         transactionHash: string;
     }>;
+    /**
+     * Enroll a passkey as an APPROVER so the user can later add devices from any
+     * browser (2FA-style step-up). Requires a ready device (the enrollment call is
+     * device-signed and gasless). Idempotent: a no-op if the passkey is already an
+     * approver. Call this whenever the app decides to prompt "turn on device
+     * approvals". Returns the passkey's public key + the enrollment tx hash.
+     */
+    enrollPasskey(passkey: PasskeySigner, params: PasskeyEnrollParams): Promise<{
+        publicKey: DevicePublicKey;
+        transactionHash?: string;
+    }>;
+    /**
+     * Register an ALREADY-enrolled passkey public key as an approver (gasless,
+     * device-signed). Idempotent. Use this to register ONE passkey across multiple
+     * chains without re-prompting `passkey.enroll()` on each: enroll once, then
+     * call `addApprover(pubkey)` on each chain's wallet.
+     */
+    addApprover(pubkey: DevicePublicKey): Promise<{
+        transactionHash?: string;
+    }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Cheap and side-effect free — used to poll for readiness after a passkey /
+     * device approval submits, before the new signer is indexed. */
+    isReady(): Promise<boolean>;
+    /**
+     * From a brand-new browser (status `needs-device-approval`), use the user's
+     * synced passkey to authorize adding THIS device — no trip back to an already-
+     * authorized device.
+     *
+     * `add_signer_via_passkey` is a public external authorized by the embedded
+     * WebAuthn assertion (no device signature), so by default we sponsor it through
+     * the Cavos paymaster's `paymaster_executeDirectTransaction` (the forwarder's
+     * `execute_sponsored` runs a generic call — it does NOT require SNIP-9). Pass a
+     * custom `submit` to route it through your own relayer instead. Returns the tx.
+     */
+    approveThisDeviceWithPasskey(opts: {
+        passkey: PasskeySigner;
+        submit?: (call: ChainCall) => Promise<{
+            transactionHash: string;
+        }>;
+    }): Promise<{
+        transactionHash: string;
+    }>;
+    /** This device's leaf + the current passkey nonce, for a (possibly multi-chain)
+     * passkey approval batch. See `approveDeviceEverywhere`. */
+    passkeyLeafForThisDevice(): Promise<{
+        leaf: Uint8Array;
+        nonce: bigint;
+    }>;
+    /** Submit `add_signer_via_passkey` given a (shared) assertion + this chain's
+     * position in the batch. The assertion doesn't carry the passkey pubkey, so we
+     * recover both candidates and pick the enrolled approver via the on-chain view
+     * (no backend). Defaults to sponsoring through the paymaster. */
+    submitPasskeyApproval(assertion: PasskeyAssertion, leaves: Uint8Array[], leafIndex: number, nonce: bigint, submit?: (call: ChainCall) => Promise<{
+        transactionHash: string;
+    }>): Promise<{
+        transactionHash: string;
+    }>;
     /**
      * Register a self-custodial backup signer derived from `code`, so the account
      * can be recovered after the user loses every device. Idempotent: if the
@@ -586,5 +992,32 @@ declare class Cavos {
      */
     static recover(opts: RecoveryOptions): Promise<Cavos>;
 }
+/** A chain wallet that can approve THIS device via a passkey (implemented by
+ * `Cavos`, `CavosSolana`, `CavosStellar`). */
+interface PasskeyApprovable {
+    readonly chain: string;
+    readonly status: string;
+    passkeyLeafForThisDevice(): Promise<{
+        leaf: Uint8Array;
+        nonce: bigint;
+    }>;
+    submitPasskeyApproval(assertion: PasskeyAssertion, leaves: Uint8Array[], leafIndex: number, nonce: bigint): Promise<{
+        transactionHash: string;
+    }>;
+}
+/**
+ * Approve THIS device across several chains with a SINGLE passkey prompt. Each
+ * chain is a separate account, so the device must be added per chain — but one
+ * WebAuthn assertion over the batch challenge (`sha256(concat(leaves))`) suffices
+ * for all of them. Only wallets whose status is `needs-device-approval` are
+ * touched. Returns the per-chain tx hashes.
+ *
+ *   await approveDeviceEverywhere([starknet, solana, stellar], passkey);
+ */
+declare function approveDeviceEverywhere(wallets: PasskeyApprovable[], passkey: PasskeySigner): Promise<{
+    chain: string;
+    transactionHash?: string;
+    error?: string;
+}[]>;
 
-export { type AuthProvider as A, buildSecp256r1Instruction as B, type ChainAdapter as C, type DevicePublicKey as D, compressedPubkey as E, encodeLowSSignature as F, serializeInstructions as G, type Identity as I, type NetworkEnv as N, type PendingDeviceRequest as P, type RegisteredWallet as R, SECP256R1_PROGRAM_ID as S, type WalletRegistry as W, type RecoveryClient as a, type DeviceSigner as b, type DeviceSignature as c, type ComputeAddressParams as d, type ChainCall as e, Cavos as f, CavosSolana as g, type CavosWallet as h, type Chain as i, type ConnectOptions as j, type ConnectSolanaOptions as k, type ConnectStatus as l, DEVICE_ACCOUNT_PROGRAM_ID as m, InMemoryWalletRegistry as n, type InstructionAccount as o, type InstructionData as p, type RecoverSolanaOptions as q, type RecoveryOptions as r, SOLANA_NETWORKS as s, SolanaAdapter as t, type SolanaAdapterOptions as u, type SolanaNetwork as v, SolanaRelayer as w, type SolanaRelayerOptions as x, StaticIdentity as y, anchorDiscriminator as z };
+export { batchChallenge as $, type AuthProvider as A, type RecoverStellarOptions as B, type ChainAdapter as C, type DevicePublicKey as D, type EnrolledPasskey as E, FACTORY_CONTRACT_ID as F, type RecoveryOptions as G, SECP256R1_PROGRAM_ID as H, type Identity as I, SOLANA_NETWORKS as J, STELLAR_NETWORKS as K, SolanaAdapter as L, type SolanaAdapterOptions as M, NATIVE_SAC_ID as N, type SolanaNetwork as O, type PendingDeviceRequest as P, SolanaRelayer as Q, type RegisteredWallet as R, type StellarNetwork as S, type SolanaRelayerOptions as T, StaticIdentity as U, StellarRelayer as V, type WalletRegistry as W, type StellarRelayerOptions as X, anchorDiscriminator as Y, approveDeviceEverywhere as Z, base64urlEncode as _, type RecoveryClient as a, buildSecp256r1Instruction as a0, compressedPubkey as a1, encodeLowSSignature as a2, lowS as a3, recoverCandidatePublicKeys as a4, serializeInstructions as a5, webauthnDigest as a6, type DeviceSigner as b, type DeviceSignature as c, type ComputeAddressParams as d, type ChainCall as e, type PasskeyAssertion as f, Cavos as g, CavosSolana as h, CavosStellar as i, type CavosWallet as j, type Chain as k, type ConnectOptions as l, type ConnectSolanaOptions as m, type ConnectStatus as n, type ConnectStellarOptions as o, DEVICE_ACCOUNT_PROGRAM_ID as p, DEVICE_ACCOUNT_WASM_HASH as q, InMemoryWalletRegistry as r, type InstructionAccount as s, type InstructionData as t, type NetworkEnv as u, type PasskeyApprovable as v, type PasskeyEnrollParams as w, PasskeySigner as x, type PasskeySignerOptions as y, type RecoverSolanaOptions as z };