@cavos/kit 0.0.2 → 0.0.4

package/dist/react/index.js

@@ -8,6 +8,7 @@ var web3_js = require('@solana/web3.js');
 var hkdf = require('@noble/hashes/hkdf');
 var pbkdf2 = require('@noble/hashes/pbkdf2');
 var utils = require('@noble/hashes/utils');
+var stellarSdk = require('@stellar/stellar-sdk');
 var jsxRuntime = require('react/jsx-runtime');
 
 // src/react/CavosProvider.tsx
@@ -22,6 +23,18 @@ function bytesToBigInt(bytes) {
   for (const b of bytes) out = out << 8n | BigInt(b);
   return out;
 }
+function bytesToByteArrayCalldata(bytes) {
+  const CHUNK = 31;
+  const fullCount = Math.floor(bytes.length / CHUNK);
+  const out = [String(fullCount)];
+  for (let i = 0; i < fullCount; i++) {
+    out.push("0x" + bytesToBigInt(bytes.subarray(i * CHUNK, i * CHUNK + CHUNK)).toString(16));
+  }
+  const rem = bytes.subarray(fullCount * CHUNK);
+  out.push("0x" + (rem.length ? bytesToBigInt(rem).toString(16) : "0"));
+  out.push(String(rem.length));
+  return out;
+}
 function bigIntTo32Bytes(value) {
   const out = new Uint8Array(32);
   let v = value;
@@ -159,7 +172,7 @@ var CAVOS_PAYMASTER_URL = {
   mainnet: "https://paymaster.cavos.xyz"
 };
 var DEVICE_ACCOUNT_CLASS_HASH = {
-  sepolia: "0x1840aded59e8a0d2b440a134cb9079a7fc11b06c77f58ed189ab436a034ca6a",
+  sepolia: "0x25cbc5423e8ee895febb0ef2c3945b408da44d0039d915fbdd681fe6b6ba66b",
   mainnet: "0x1840aded59e8a0d2b440a134cb9079a7fc11b06c77f58ed189ab436a034ca6a"
 };
 
@@ -223,6 +236,84 @@ var StarknetAdapter = class {
     const sig = await this.opts.signer.sign(bigIntTo32Bytes(txHash));
     return signatureToFelts(sig).map((f) => starknet.num.toHex(f));
   }
+  // --- passkey approvers ---
+  buildAddApprover(accountAddress, passkey) {
+    return { contractAddress: accountAddress, entrypoint: "add_approver", calldata: pubkeyCalldata(passkey) };
+  }
+  buildRemoveApprover(accountAddress, passkey) {
+    return { contractAddress: accountAddress, entrypoint: "remove_approver", calldata: pubkeyCalldata(passkey) };
+  }
+  async isApprover(accountAddress, passkey) {
+    if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
+    const res = await this.opts.provider.callContract({
+      contractAddress: accountAddress,
+      entrypoint: "is_approver",
+      calldata: pubkeyCalldata(passkey)
+    });
+    return BigInt(res[0] ?? 0) !== 0n;
+  }
+  /** True if the account has at least one passkey registered as an approver.
+   * Lets the UI decide whether to offer passkey approval before prompting. */
+  async hasPasskeyApprover(accountAddress) {
+    if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
+    const res = await this.opts.provider.callContract({
+      contractAddress: accountAddress,
+      entrypoint: "get_approver_count",
+      calldata: []
+    });
+    return BigInt(res[0] ?? 0) > 0n;
+  }
+  async getPasskeyNonce(accountAddress) {
+    if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
+    const res = await this.opts.provider.callContract({
+      contractAddress: accountAddress,
+      entrypoint: "get_passkey_nonce",
+      calldata: []
+    });
+    return BigInt(res[0] ?? 0);
+  }
+  /** This chain's leaf for approving `add_signer(newSigner)` at `nonce`:
+   * `sha256(new_x || new_y || nonce)` (coords 32B BE, nonce 16B BE). The batch
+   * challenge the passkey signs is `sha256(concat(leaves))` across chains. */
+  passkeyLeaf(newSigner, nonce) {
+    const msg = new Uint8Array(32 + 32 + 16);
+    msg.set(bigIntTo32Bytes(newSigner.x), 0);
+    msg.set(bigIntTo32Bytes(newSigner.y), 32);
+    msg.set(bigIntTo32Bytes(nonce).subarray(16), 64);
+    return sha256.sha256(msg);
+  }
+  /** Passkey-authorized `add_signer` call. `leaves`/`leafIndex` place this chain's
+   * leaf in the multi-chain batch (single chain → `[leaf]`, index 0). `yParity`
+   * matches the raw `(r, s)` — the contract normalizes high-S internally. */
+  buildAddSignerViaPasskey(accountAddress, newSigner, nonce, leaves, leafIndex, assertion, yParity) {
+    const [rl, rh] = u256ToFelts(assertion.r);
+    const [sl, sh] = u256ToFelts(assertion.s);
+    const leavesCalldata = [String(leaves.length)];
+    for (const leaf of leaves) {
+      const [lo, hi] = u256ToFelts(bytesToBigInt(leaf));
+      leavesCalldata.push(starknet.num.toHex(lo), starknet.num.toHex(hi));
+    }
+    return {
+      contractAddress: accountAddress,
+      entrypoint: "add_signer_via_passkey",
+      calldata: [
+        ...pubkeyCalldata(newSigner),
+        // new_x, new_y (u256 pairs)
+        starknet.num.toHex(nonce),
+        ...leavesCalldata,
+        // Array<u256> leaves
+        String(leafIndex),
+        ...bytesToByteArrayCalldata(assertion.authenticatorData),
+        ...bytesToByteArrayCalldata(assertion.clientDataJSON),
+        String(assertion.challengeOffset),
+        starknet.num.toHex(rl),
+        starknet.num.toHex(rh),
+        starknet.num.toHex(sl),
+        starknet.num.toHex(sh),
+        yParity ? "0x1" : "0x0"
+      ]
+    };
+  }
 };
 function pubkeyCalldata(pk) {
   const [xl, xh] = u256ToFelts(pk.x);
@@ -316,6 +407,9 @@ function deriveAddressSeed({ userId, appSalt }) {
 function deriveAddressSeedSolana({ userId, appSalt }) {
   return sha256.sha256(new TextEncoder().encode(`cavos:solana:v1:${userId}:${appSalt}`));
 }
+function deriveAddressSeedStellar({ userId, appSalt }) {
+  return sha256.sha256(new TextEncoder().encode(`cavos:stellar:v1:${userId}:${appSalt}`));
+}
 function feltFromString(s) {
   const bytes = new TextEncoder().encode(s);
   const chunks = [];
@@ -337,6 +431,8 @@ var DOMAIN_ADD = "cavos:add_signer:v1";
 var DOMAIN_REMOVE = "cavos:remove_signer:v1";
 var DOMAIN_TRANSFER = "cavos:transfer:v1";
 var DOMAIN_EXECUTE = "cavos:execute:v1";
+var DOMAIN_ADD_APPROVER = "cavos:add_approver:v1";
+var DOMAIN_REMOVE_APPROVER = "cavos:remove_approver:v1";
 var SECP256R1_N = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
 var SOLANA_NETWORKS = {
   "solana-devnet": "https://api.devnet.solana.com",
@@ -429,6 +525,104 @@ var SolanaAdapter = class {
     });
     return [precompileIx, ix];
   }
+  /** `[precompile, add_approver]` bundle enrolling a passkey approver (device-signed). */
+  async buildAddApprover(account, passkey) {
+    const accountPk = new web3_js.PublicKey(account);
+    const compressed = compressedPubkey(passkey);
+    const nonce = await this.fetchNonce(accountPk);
+    const message = concatBytes(
+      Buffer.from(DOMAIN_ADD_APPROVER),
+      accountPk.toBuffer(),
+      compressed,
+      u64le(nonce)
+    );
+    const { precompileIx } = await this.signToPrecompile(message);
+    const ix = new web3_js.TransactionInstruction({
+      programId: this.programId,
+      keys: this.guardedKeys(accountPk),
+      data: Buffer.concat([anchorDiscriminator("add_approver"), Buffer.from(compressed)])
+    });
+    return [precompileIx, ix];
+  }
+  /** `[precompile, remove_approver]` bundle (device-signed). */
+  async buildRemoveApprover(account, passkey) {
+    const accountPk = new web3_js.PublicKey(account);
+    const compressed = compressedPubkey(passkey);
+    const nonce = await this.fetchNonce(accountPk);
+    const message = concatBytes(
+      Buffer.from(DOMAIN_REMOVE_APPROVER),
+      accountPk.toBuffer(),
+      compressed,
+      u64le(nonce)
+    );
+    const { precompileIx } = await this.signToPrecompile(message);
+    const ix = new web3_js.TransactionInstruction({
+      programId: this.programId,
+      keys: this.guardedKeys(accountPk),
+      data: Buffer.concat([anchorDiscriminator("remove_approver"), Buffer.from(compressed)])
+    });
+    return [precompileIx, ix];
+  }
+  /** This chain's leaf for approving `add_signer(newSigner)` at `nonce`:
+   * `sha256(compressed(new_signer) || passkey_nonce_le8)`. The batch challenge the
+   * passkey signs is `sha256(concat(leaves))` across chains. */
+  passkeyLeaf(newSigner, nonce) {
+    return sha256.sha256(concatBytes(compressedPubkey(newSigner), u64le(nonce)));
+  }
+  /**
+   * `[precompile(passkey), add_signer_via_passkey]` bundle. The precompile ix
+   * verifies the PASSKEY's WebAuthn assertion over `authData || sha256(clientDataJSON)`;
+   * the program ix binds the challenge to `newSigner` + the passkey nonce and adds
+   * the signer. No device signature — a gasless relayer can submit it.
+   */
+  buildAddSignerViaPasskey(account, newSigner, passkey, leaves, leafIndex, assertion) {
+    const accountPk = new web3_js.PublicKey(account);
+    const newCompressed = compressedPubkey(newSigner);
+    const passkeyCompressed = compressedPubkey(passkey);
+    const clientHash = sha256.sha256(assertion.clientDataJSON);
+    const message = concatBytes(assertion.authenticatorData, clientHash);
+    const signature = encodeLowSSignature(assertion.r, assertion.s);
+    const precompileIx = buildSecp256r1Instruction(passkeyCompressed, signature, message);
+    const leavesBlob = Buffer.concat([u32le(leaves.length), ...leaves.map((l) => Buffer.from(l))]);
+    const data = Buffer.concat([
+      anchorDiscriminator("add_signer_via_passkey"),
+      Buffer.from(newCompressed),
+      leavesBlob,
+      u32le(leafIndex),
+      serializeVecU8(assertion.authenticatorData),
+      serializeVecU8(assertion.clientDataJSON),
+      u32le(assertion.challengeOffset)
+    ]);
+    const ix = new web3_js.TransactionInstruction({
+      programId: this.programId,
+      keys: this.guardedKeys(accountPk),
+      data
+    });
+    return [precompileIx, ix];
+  }
+  /** Read whether `passkey` is a registered approver. */
+  /** True if the account has at least one passkey registered as an approver. */
+  async hasPasskeyApprover(account) {
+    const approvers = await this.fetchApprovers(new web3_js.PublicKey(account));
+    return approvers.length > 0;
+  }
+  async isApprover(account, passkey) {
+    const approvers = await this.fetchApprovers(new web3_js.PublicKey(account));
+    const target = Buffer.from(compressedPubkey(passkey)).toString("hex");
+    return approvers.some((a) => Buffer.from(a).toString("hex") === target);
+  }
+  /** Read the current passkey-approval nonce. */
+  async passkeyNonce(account) {
+    const info = await this.requireConnection().getAccountInfo(new web3_js.PublicKey(account));
+    if (!info) return 0n;
+    const d = info.data;
+    const signersLenOff = 8 + 32 + 1 + 8 + COMPRESSED_PUBKEY_SIZE;
+    const signerCount = d.readUInt32LE(signersLenOff);
+    const approversLenOff = signersLenOff + 4 + signerCount * COMPRESSED_PUBKEY_SIZE;
+    const approverCount = d.readUInt32LE(approversLenOff);
+    const passkeyNonceOff = approversLenOff + 4 + approverCount * COMPRESSED_PUBKEY_SIZE;
+    return readU64le(d, passkeyNonceOff);
+  }
   /** `[precompile, execute_transfer]` bundle moving lamports out of the account. */
   async buildExecuteTransfer(account, destination, amount) {
     const accountPk = new web3_js.PublicKey(account);
@@ -550,6 +744,22 @@ var SolanaAdapter = class {
     }
     return out;
   }
+  async fetchApprovers(account) {
+    const info = await this.requireConnection().getAccountInfo(account);
+    if (!info) return [];
+    const d = info.data;
+    const signersLenOff = 8 + 32 + 1 + 8 + COMPRESSED_PUBKEY_SIZE;
+    const signerCount = d.readUInt32LE(signersLenOff);
+    const approversLenOff = signersLenOff + 4 + signerCount * COMPRESSED_PUBKEY_SIZE;
+    const count = d.readUInt32LE(approversLenOff);
+    const out = [];
+    let off = approversLenOff + 4;
+    for (let i = 0; i < count; i++) {
+      out.push(Uint8Array.from(d.subarray(off, off + COMPRESSED_PUBKEY_SIZE)));
+      off += COMPRESSED_PUBKEY_SIZE;
+    }
+    return out;
+  }
   requireConnection() {
     if (!this.opts.connection) throw new Error("kit/solana: connection required for reads");
     return this.opts.connection;
@@ -604,13 +814,18 @@ function buildSecp256r1Instruction(compressed, signature, message) {
 function anchorDiscriminator(name) {
   return Buffer.from(sha256.sha256(`global:${name}`).slice(0, 8));
 }
+function u32le(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n);
+  return b;
+}
 function u64le(n) {
   const b = Buffer.alloc(8);
   new DataView(b.buffer, b.byteOffset, 8).setBigUint64(0, BigInt(n), true);
   return b;
 }
-function readU64le(buf, offset) {
-  return new DataView(buf.buffer, buf.byteOffset, buf.length).getBigUint64(
+function readU64le(buf2, offset) {
+  return new DataView(buf2.buffer, buf2.byteOffset, buf2.length).getBigUint64(
     offset,
     true
   );
@@ -998,6 +1213,73 @@ var WORDLIST = [
   "beach",
   "dusk"
 ];
+function base64urlEncode(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  const b64 = typeof btoa !== "undefined" ? btoa(bin) : Buffer.from(bytes).toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function derToRs(der) {
+  let i = 0;
+  if (der[i++] !== 48) throw new Error("kit/webauthn: bad DER (no SEQUENCE)");
+  if (der[i] & 128) i += 1 + (der[i] & 127);
+  else i += 1;
+  if (der[i++] !== 2) throw new Error("kit/webauthn: bad DER (no r INTEGER)");
+  const rlen = der[i++];
+  const r = bytesToBigInt(der.subarray(i, i + rlen));
+  i += rlen;
+  if (der[i++] !== 2) throw new Error("kit/webauthn: bad DER (no s INTEGER)");
+  const slen = der[i++];
+  const s = bytesToBigInt(der.subarray(i, i + slen));
+  return { r, s };
+}
+function spkiToPublicKey(spki) {
+  const idx = spki.lastIndexOf(4, spki.length - 65);
+  const start = spki.length - 65;
+  const prefix = spki[start];
+  if (prefix !== 4) {
+    if (idx < 0) throw new Error("kit/webauthn: no uncompressed EC point in SPKI");
+    return { x: bytesToBigInt(spki.subarray(idx + 1, idx + 33)), y: bytesToBigInt(spki.subarray(idx + 33, idx + 65)) };
+  }
+  return {
+    x: bytesToBigInt(spki.subarray(start + 1, start + 33)),
+    y: bytesToBigInt(spki.subarray(start + 33, start + 65))
+  };
+}
+function batchChallenge(leaves) {
+  const total = leaves.reduce((n, l) => n + l.length, 0);
+  const cat = new Uint8Array(total);
+  let o = 0;
+  for (const l of leaves) {
+    cat.set(l, o);
+    o += l.length;
+  }
+  return sha256.sha256(cat);
+}
+function webauthnDigest(authenticatorData, clientDataJSON) {
+  const clientHash = sha256.sha256(clientDataJSON);
+  const msg = new Uint8Array(authenticatorData.length + clientHash.length);
+  msg.set(authenticatorData, 0);
+  msg.set(clientHash, authenticatorData.length);
+  return sha256.sha256(msg);
+}
+function recoverCandidatePublicKeys(r, s, digest) {
+  const out = [];
+  for (const bit of [0, 1]) {
+    try {
+      const point = new p256.p256.Signature(r, s).addRecoveryBit(bit).recoverPublicKey(digest).toAffine();
+      out.push({ publicKey: { x: point.x, y: point.y }, yParity: bit === 1 });
+    } catch {
+    }
+  }
+  return out;
+}
+function challengeOffsetOf(clientDataJSON, challengeB64) {
+  const text = new TextDecoder().decode(clientDataJSON);
+  const idx = text.indexOf(challengeB64);
+  if (idx < 0) throw new Error("kit/webauthn: challenge not found in clientDataJSON");
+  return idx;
+}
 
 // src/chains/solana/CavosSolana.ts
 var CavosSolana = class _CavosSolana {
@@ -1012,6 +1294,8 @@ var CavosSolana = class _CavosSolana {
     this.feePayer = feePayer;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     this.chain = "solana";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    this.isNewAccount = false;
   }
   get publicKey() {
     return this.devicePubkey;
@@ -1062,7 +1346,7 @@ var CavosSolana = class _CavosSolana {
     }
     await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
     const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey);
-    return new _CavosSolana(
+    const wallet = new _CavosSolana(
       identity,
       address,
       isSigner ? "ready" : "needs-device-approval",
@@ -1072,12 +1356,87 @@ var CavosSolana = class _CavosSolana {
       relayer,
       opts.feePayer
     );
+    wallet.isNewAccount = !deployed && isSigner;
+    return wallet;
   }
   /** Authorize an additional device signer (device-signed via precompile). */
   async addSigner(pubkey) {
     const ixs = await this.adapter.buildAddSigner(this.address, pubkey);
     return this.send(ixs);
   }
+  /**
+   * Enroll a passkey as an approver (2FA-style step-up). Device-signed + gasless;
+   * requires a ready device. Idempotent. Returns the passkey pubkey + tx hash.
+   */
+  async enrollPasskey(passkey, params) {
+    const enrolled = await passkey.enroll(params);
+    const { transactionHash } = await this.addApprover(enrolled.publicKey);
+    return { publicKey: enrolled.publicKey, transactionHash };
+  }
+  /** Register an already-enrolled passkey pubkey as an approver (gasless).
+   * Idempotent. Lets one passkey be registered across chains without re-prompting. */
+  async addApprover(pubkey) {
+    if (this.status !== "ready") {
+      throw new Error("kit/solana: addApprover requires a ready, authorized device");
+    }
+    if (await this.adapter.isApprover(this.address, pubkey)) return {};
+    const ixs = await this.adapter.buildAddApprover(this.address, pubkey);
+    const transactionHash = await this.send(ixs);
+    return { transactionHash };
+  }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    return this.adapter.hasPasskeyApprover(this.address);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Used to poll for readiness after a passkey approval before it's indexed. */
+  async isReady() {
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey);
+  }
+  /**
+   * From a fresh browser (status `needs-device-approval`), approve adding THIS
+   * device with the user's synced passkey. Gasless via the relayer — the bundle
+   * carries the passkey's WebAuthn assertion, so no device signature is needed.
+   */
+  async approveThisDeviceWithPasskey(passkey) {
+    if (this.status === "ready") {
+      throw new Error("kit/solana: this device is already an authorized signer");
+    }
+    const { leaf, nonce } = await this.passkeyLeafForThisDevice();
+    const leaves = [leaf];
+    const assertion = await passkey.assert(batchChallenge(leaves));
+    const { transactionHash } = await this.submitPasskeyApproval(assertion, leaves, 0, nonce);
+    return transactionHash;
+  }
+  /** This device's leaf + passkey nonce for a (possibly multi-chain) batch. */
+  async passkeyLeafForThisDevice() {
+    const nonce = await this.adapter.passkeyNonce(this.address);
+    return { leaf: this.adapter.passkeyLeaf(this.devicePubkey, nonce), nonce };
+  }
+  /** Submit `add_signer_via_passkey` given a shared assertion + batch position.
+   * Used by `approveThisDeviceWithPasskey` and `approveDeviceEverywhere`. */
+  async submitPasskeyApproval(assertion, leaves, leafIndex, _nonce) {
+    const digest = webauthnDigest(assertion.authenticatorData, assertion.clientDataJSON);
+    const candidates = recoverCandidatePublicKeys(assertion.r, assertion.s, digest);
+    let approver = null;
+    for (const cand of candidates) {
+      if (await this.adapter.isApprover(this.address, cand.publicKey)) {
+        approver = cand.publicKey;
+        break;
+      }
+    }
+    if (!approver) throw new Error("kit/solana: this passkey is not a registered approver");
+    const ixs = this.adapter.buildAddSignerViaPasskey(
+      this.address,
+      this.devicePubkey,
+      approver,
+      leaves,
+      leafIndex,
+      assertion
+    );
+    return { transactionHash: await this.send(ixs) };
+  }
   /** Move `amount` lamports out of the account to `destination` (device-signed). */
   async execute(amount, destination) {
     if (this.status !== "ready") {
@@ -1190,6 +1549,651 @@ var CavosSolana = class _CavosSolana {
 };
 var defaultRegistry = new InMemoryWalletRegistry();
 
+// src/chains/stellar/constants.ts
+var FACTORY_CONTRACT_ID = {
+  // Re-deployed 2026-07-01 with the passkey-approval device-account wasm (batched
+  // multi-chain challenge). The factory pins the wasm hash immutably, so a new
+  // wasm needs a new factory → new account addresses; testnet has no prod wallets.
+  "stellar-testnet": "CBCJIODXIEBOXXD66KCUCF7ZDYJARKI4ZIVQOVWPULOBH5XGNCDP6W3I",
+  // Set once the factory is deployed to mainnet (its address differs — network id
+  // is part of contract-address derivation).
+  "stellar-mainnet": ""
+};
+var STELLAR_NETWORKS = {
+  "stellar-testnet": {
+    rpcUrl: "https://soroban-testnet.stellar.org",
+    passphrase: "Test SDF Network ; September 2015"
+  },
+  "stellar-mainnet": {
+    rpcUrl: "https://soroban-rpc.mainnet.stellar.gateway.fm",
+    passphrase: "Public Global Stellar Network ; September 2015"
+  }
+};
+var NATIVE_SAC_ID = {
+  "stellar-testnet": "CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC",
+  "stellar-mainnet": "CAS3J7GYLGXMF6TDJBBYYSE3HQ6BBSMLNUQ34T6TZMYMW2EVH34XOWMA"
+};
+
+// src/chains/stellar/StellarAdapter.ts
+var SECP256R1_N2 = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+var StellarAdapter = class {
+  constructor(opts) {
+    this.chain = "stellar";
+    this.network = opts.network;
+    this.passphrase = STELLAR_NETWORKS[opts.network].passphrase;
+    this.rpcUrl = opts.rpcUrl ?? STELLAR_NETWORKS[opts.network].rpcUrl;
+    this.factoryId = opts.factoryId ?? FACTORY_CONTRACT_ID[opts.network];
+    if (!this.factoryId) {
+      throw new Error(`kit/stellar: no factory contract id configured for ${opts.network}`);
+    }
+    this.signer = opts.signer;
+  }
+  server() {
+    if (!this._server) {
+      this._server = new stellarSdk.rpc.Server(this.rpcUrl, {
+        allowHttp: this.rpcUrl.startsWith("http://")
+      });
+    }
+    return this._server;
+  }
+  networkId() {
+    return stellarSdk.hash(Buffer.from(this.passphrase));
+  }
+  /**
+   * Deterministic account address for `(addressSeed, initialSigner)` — computed
+   * off-chain, byte-identical to the factory's on-chain `account_address`.
+   * `contractId = sha256(HashIdPreimage(networkId, factory, salt))` with
+   * `salt = sha256(addressSeed || sec1(initialSigner))`.
+   */
+  computeAddress(addressSeed, initialSigner) {
+    const salt = this.accountSalt(addressSeed, initialSigner);
+    const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeContractId(
+      new stellarSdk.xdr.HashIdPreimageContractId({
+        networkId: this.networkId(),
+        contractIdPreimage: stellarSdk.xdr.ContractIdPreimage.contractIdPreimageFromAddress(
+          new stellarSdk.xdr.ContractIdPreimageFromAddress({
+            address: new stellarSdk.Address(this.factoryId).toScAddress(),
+            salt
+          })
+        )
+      })
+    );
+    return stellarSdk.StrKey.encodeContract(stellarSdk.hash(preimage.toXDR()));
+  }
+  /** `salt = sha256(addressSeed(32) || sec1(initialSigner)(65))` — matches the factory. */
+  accountSalt(addressSeed, initialSigner) {
+    return stellarSdk.hash(Buffer.concat([Buffer.from(addressSeed), Buffer.from(sec1Pubkey(initialSigner))]));
+  }
+  /** Host function: `factory.deploy(address_seed, initial_signer)`. */
+  buildDeploy(addressSeed, initialSigner) {
+    return invokeFunc(this.factoryId, "deploy", [
+      bytesScVal(addressSeed),
+      bytesScVal(sec1Pubkey(initialSigner))
+    ]);
+  }
+  /** Host function: `account.add_signer(new_signer)` (requires device auth). */
+  buildAddSigner(accountAddress, signer) {
+    return invokeFunc(accountAddress, "add_signer", [bytesScVal(sec1Pubkey(signer))]);
+  }
+  /** Host function: `account.remove_signer(signer)` (requires device auth). */
+  buildRemoveSigner(accountAddress, signer) {
+    return invokeFunc(accountAddress, "remove_signer", [bytesScVal(sec1Pubkey(signer))]);
+  }
+  /** Host function: `account.add_approver(passkey)` (requires device auth). */
+  buildAddApprover(accountAddress, passkey) {
+    return invokeFunc(accountAddress, "add_approver", [bytesScVal(sec1Pubkey(passkey))]);
+  }
+  /** Host function: `account.remove_approver(passkey)` (requires device auth). */
+  buildRemoveApprover(accountAddress, passkey) {
+    return invokeFunc(accountAddress, "remove_approver", [bytesScVal(sec1Pubkey(passkey))]);
+  }
+  /** This chain's leaf for approving `add_signer(newSigner)` at `nonce`:
+   * `sha256(sec1(new_signer) || nonce_be8)`. The batch challenge the passkey signs
+   * is `sha256(concat(leaves))` across chains. */
+  passkeyLeaf(newSigner, nonce) {
+    const msg = new Uint8Array(65 + 8);
+    msg.set(sec1Pubkey(newSigner), 0);
+    const n = new Uint8Array(8);
+    let v = nonce;
+    for (let i = 7; i >= 0; i--) {
+      n[i] = Number(v & 0xffn);
+      v >>= 8n;
+    }
+    msg.set(n, 65);
+    return sha256.sha256(msg);
+  }
+  /** Host function: passkey-authorized `add_signer_via_passkey` (no device auth —
+   * authorized by the embedded WebAuthn assertion, so any relayer can submit).
+   * `leaves`/`leafIndex` place this chain's leaf in the multi-chain batch. */
+  buildAddSignerViaPasskey(accountAddress, newSigner, passkey, nonce, leaves, leafIndex, assertion) {
+    const sig = encodeLowSSignature2({ r: assertion.r, s: assertion.s});
+    const leavesScVal = stellarSdk.xdr.ScVal.scvVec(leaves.map((l) => bytesScVal(l)));
+    return invokeFunc(accountAddress, "add_signer_via_passkey", [
+      bytesScVal(sec1Pubkey(newSigner)),
+      bytesScVal(sec1Pubkey(passkey)),
+      stellarSdk.nativeToScVal(nonce, { type: "u64" }),
+      leavesScVal,
+      stellarSdk.nativeToScVal(leafIndex, { type: "u32" }),
+      bytesScVal(assertion.authenticatorData),
+      bytesScVal(assertion.clientDataJSON),
+      stellarSdk.nativeToScVal(assertion.challengeOffset, { type: "u32" }),
+      bytesScVal(sig)
+    ]);
+  }
+  /** Read whether `passkey` is a registered approver (read-only simulation). */
+  /** True if the account has at least one passkey registered as an approver.
+   * Reads the contract's `approvers` view and checks the list is non-empty. */
+  async hasPasskeyApprover(accountAddress, readSource) {
+    if (!await this.isDeployed(accountAddress)) return false;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = stellarSdk.Operation.invokeHostFunction({
+      func: invokeFunc(accountAddress, "approvers", []),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: approvers simulation failed: ${sim.error}`);
+    }
+    if (!sim.result?.retval) return false;
+    const list = stellarSdk.scValToNative(sim.result.retval);
+    return Array.isArray(list) && list.length > 0;
+  }
+  async isApprover(accountAddress, passkey, readSource) {
+    if (!await this.isDeployed(accountAddress)) return false;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = stellarSdk.Operation.invokeHostFunction({
+      func: invokeFunc(accountAddress, "is_approver", [bytesScVal(sec1Pubkey(passkey))]),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: is_approver simulation failed: ${sim.error}`);
+    }
+    if (!sim.result?.retval) return false;
+    return stellarSdk.scValToNative(sim.result.retval) === true;
+  }
+  /** Read the current passkey-approval nonce (read-only simulation). */
+  async passkeyNonce(accountAddress, readSource) {
+    if (!await this.isDeployed(accountAddress)) return 0n;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = stellarSdk.Operation.invokeHostFunction({
+      func: invokeFunc(accountAddress, "passkey_nonce", []),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: passkey_nonce simulation failed: ${sim.error}`);
+    }
+    if (!sim.result?.retval) return 0n;
+    return BigInt(stellarSdk.scValToNative(sim.result.retval));
+  }
+  /** Host function: SEP-41 `token.transfer(from=account, to, amount)` (device auth). */
+  buildTransfer(tokenId, accountAddress, destination, amount) {
+    return invokeFunc(tokenId, "transfer", [
+      new stellarSdk.Address(accountAddress).toScVal(),
+      new stellarSdk.Address(destination).toScVal(),
+      stellarSdk.nativeToScVal(amount, { type: "i128" })
+    ]);
+  }
+  /**
+   * Sign a Soroban authorization entry with the silent device key, producing the
+   * `Vec<DeviceSignature>` the account's `__check_auth` verifies. The device
+   * signs `sha256(preimage)` (WebCrypto hashes once more internally), which is
+   * exactly what the contract recomputes. Mutates + returns the entry.
+   */
+  async signAuthEntry(entry, validUntilLedger) {
+    const addrCreds = entry.credentials().address();
+    addrCreds.signatureExpirationLedger(validUntilLedger);
+    const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
+      new stellarSdk.xdr.HashIdPreimageSorobanAuthorization({
+        networkId: this.networkId(),
+        nonce: addrCreds.nonce(),
+        signatureExpirationLedger: validUntilLedger,
+        invocation: entry.rootInvocation()
+      })
+    );
+    const payload = stellarSdk.hash(preimage.toXDR());
+    const sig = await this.signer.sign(new Uint8Array(payload));
+    const pubkey = await this.signer.getPublicKey();
+    addrCreds.signature(deviceSignatureScVal(pubkey, sig));
+    return entry;
+  }
+  /**
+   * Read a SEP-41 token balance of `account` via a read-only simulation of
+   * `token.balance(account)`. Returns 0 when the account isn't deployed or holds
+   * none. `readSource` is any funded G-account (used only for the simulation).
+   */
+  async readBalance(tokenId, account, readSource) {
+    if (!await this.isDeployed(account)) return 0n;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = stellarSdk.Operation.invokeHostFunction({
+      func: invokeFunc(tokenId, "balance", [new stellarSdk.Address(account).toScVal()]),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (stellarSdk.rpc.Api.isSimulationError(sim) || !sim.result?.retval) return 0n;
+    return BigInt(stellarSdk.scValToNative(sim.result.retval));
+  }
+  /** Whether the account contract instance exists on-chain (is deployed). */
+  async isDeployed(accountAddress) {
+    try {
+      const res = await this.server().getContractData(
+        accountAddress,
+        stellarSdk.xdr.ScVal.scvLedgerKeyContractInstance(),
+        stellarSdk.rpc.Durability.Persistent
+      );
+      return !!res;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Read whether `signer` is a currently-authorized signer of the account, via a
+   * read-only simulation of `account.is_authorized(signer)`. `readSource` is any
+   * funded G-account (used only for the simulation's source/sequence).
+   */
+  async isAuthorizedSigner(accountAddress, signer, readSource) {
+    if (!await this.isDeployed(accountAddress)) return false;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = stellarSdk.Operation.invokeHostFunction({
+      func: invokeFunc(accountAddress, "is_authorized", [bytesScVal(sec1Pubkey(signer))]),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: is_authorized simulation failed: ${sim.error}`);
+    }
+    if (!sim.result?.retval) return false;
+    return stellarSdk.scValToNative(sim.result.retval) === true;
+  }
+};
+function sec1Pubkey(pk) {
+  const out = new Uint8Array(65);
+  out[0] = 4;
+  out.set(bigIntTo32Bytes(pk.x), 1);
+  out.set(bigIntTo32Bytes(pk.y), 33);
+  return out;
+}
+function encodeLowSSignature2(sig) {
+  const lowS = sig.s > SECP256R1_N2 / 2n ? SECP256R1_N2 - sig.s : sig.s;
+  const out = new Uint8Array(64);
+  out.set(bigIntTo32Bytes(sig.r), 0);
+  out.set(bigIntTo32Bytes(lowS), 32);
+  return out;
+}
+function deviceSignatureScVal(pubkey, sig) {
+  const element = stellarSdk.nativeToScVal(
+    {
+      public_key: Buffer.from(sec1Pubkey(pubkey)),
+      signature: Buffer.from(encodeLowSSignature2(sig))
+    },
+    { type: { public_key: ["symbol", "bytes"], signature: ["symbol", "bytes"] } }
+  );
+  return stellarSdk.xdr.ScVal.scvVec([element]);
+}
+function invokeFunc(contractId, method, args) {
+  return stellarSdk.xdr.HostFunction.hostFunctionTypeInvokeContract(
+    new stellarSdk.xdr.InvokeContractArgs({
+      contractAddress: new stellarSdk.Address(contractId).toScAddress(),
+      functionName: method,
+      args
+    })
+  );
+}
+function bytesScVal(bytes) {
+  return stellarSdk.xdr.ScVal.scvBytes(Buffer.from(bytes));
+}
+
+// src/chains/stellar/StellarRelayer.ts
+var StellarRelayer = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  /** The relayer's source/fee-payer G-account (fetched + cached from the backend). */
+  async getSource() {
+    if (this.source) return this.source;
+    const res = await fetch(`${this.opts.baseUrl}/api/stellar/relay?network=${this.opts.network}`);
+    if (!res.ok) throw new Error(`kit/stellar: relayer source lookup failed (${res.status})`);
+    const { fee_payer } = await res.json();
+    this.source = fee_payer;
+    return this.source;
+  }
+  /**
+   * POST the assembled, device-authorized transaction XDR to the relayer to sign
+   * the envelope + submit. Returns the confirmed transaction hash.
+   */
+  async submit(transactionXdr) {
+    const res = await fetch(`${this.opts.baseUrl}/api/stellar/relay`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        app_id: this.opts.appId,
+        network: this.opts.network,
+        transaction: transactionXdr
+      })
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(`kit/stellar: relay failed (${res.status}) ${detail}`);
+    }
+    const { hash: hash6 } = await res.json();
+    return hash6;
+  }
+};
+
+// src/chains/stellar/CavosStellar.ts
+var CavosStellar = class _CavosStellar {
+  constructor(identity, address, status, network, adapter, devicePubkey, relayer, sourceKeypair) {
+    this.identity = identity;
+    this.address = address;
+    this.status = status;
+    this.network = network;
+    this.adapter = adapter;
+    this.devicePubkey = devicePubkey;
+    this.relayer = relayer;
+    this.sourceKeypair = sourceKeypair;
+    /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
+    this.chain = "stellar";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    this.isNewAccount = false;
+  }
+  get publicKey() {
+    return this.devicePubkey;
+  }
+  static async connect(opts) {
+    const identity = opts.identity ?? await opts.auth?.authenticate();
+    if (!identity) throw new Error("kit/stellar: connect requires `identity` or `auth`");
+    const signer = opts.createSigner ? await opts.createSigner(`${identity.userId}:${opts.appSalt}`) : await WebCryptoSigner.loadOrCreate({ keyId: `${identity.userId}:${opts.appSalt}` });
+    const devicePubkey = await signer.getPublicKey();
+    const adapter = new StellarAdapter({
+      network: opts.network,
+      rpcUrl: opts.rpcUrl,
+      factoryId: opts.factoryId,
+      signer
+    });
+    const addressSeed = deriveAddressSeedStellar({ userId: identity.userId, appSalt: opts.appSalt });
+    const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
+    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry2);
+    const relayer = opts.relayer ?? (opts.appId ? new StellarRelayer({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : void 0);
+    const build = (address2, status) => new _CavosStellar(identity, address2, status, opts.network, adapter, devicePubkey, relayer, opts.sourceKeypair);
+    const self = build("", "needs-device-approval");
+    const readSource = await self.resolveSource();
+    const existing = await registry.lookup(identity.userId);
+    if (existing) {
+      const isSigner2 = await adapter.isAuthorizedSigner(existing.address, devicePubkey, readSource);
+      return build(existing.address, isSigner2 ? "ready" : "needs-device-approval");
+    }
+    const address = adapter.computeAddress(addressSeed, devicePubkey);
+    const wasDeployed = await adapter.isDeployed(address);
+    if (!wasDeployed) {
+      const func = adapter.buildDeploy(addressSeed, devicePubkey);
+      await self.submitHostFunction(func, void 0);
+    }
+    await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
+    const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey, readSource);
+    const wallet = build(address, isSigner ? "ready" : "needs-device-approval");
+    wallet.isNewAccount = !wasDeployed && isSigner;
+    return wallet;
+  }
+  /** Authorize an additional device signer (device-signed via `__check_auth`). */
+  async addSigner(pubkey) {
+    const func = this.adapter.buildAddSigner(this.address, pubkey);
+    return this.submitHostFunction(func, this.address);
+  }
+  /**
+   * Enroll a passkey as an approver (2FA-style step-up). Device-signed + gasless;
+   * requires a ready device. Idempotent. Returns the passkey pubkey + tx hash.
+   */
+  async enrollPasskey(passkey, params) {
+    const enrolled = await passkey.enroll(params);
+    const { transactionHash } = await this.addApprover(enrolled.publicKey);
+    return { publicKey: enrolled.publicKey, transactionHash };
+  }
+  /** Register an already-enrolled passkey pubkey as an approver (gasless).
+   * Idempotent. Lets one passkey be registered across chains without re-prompting. */
+  async addApprover(pubkey) {
+    if (this.status !== "ready") {
+      throw new Error("kit/stellar: addApprover requires a ready, authorized device");
+    }
+    const readSource = await this.resolveSource();
+    if (await this.adapter.isApprover(this.address, pubkey, readSource)) return {};
+    const func = this.adapter.buildAddApprover(this.address, pubkey);
+    const transactionHash = await this.submitHostFunction(func, this.address);
+    return { transactionHash };
+  }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    const readSource = await this.resolveSource();
+    return this.adapter.hasPasskeyApprover(this.address, readSource);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Used to poll for readiness after a passkey approval before it's indexed. */
+  async isReady() {
+    const readSource = await this.resolveSource();
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey, readSource);
+  }
+  /**
+   * From a fresh browser (status `needs-device-approval`), approve adding THIS
+   * device using the user's synced passkey. Gasless via the relayer — the call
+   * carries the WebAuthn assertion, so no device signature is needed. Returns the
+   * tx hash. No trip back to an already-authorized device.
+   */
+  async approveThisDeviceWithPasskey(passkey) {
+    if (this.status === "ready") {
+      throw new Error("kit/stellar: this device is already an authorized signer");
+    }
+    const { leaf, nonce } = await this.passkeyLeafForThisDevice();
+    const leaves = [leaf];
+    const assertion = await passkey.assert(batchChallenge(leaves));
+    const { transactionHash } = await this.submitPasskeyApproval(assertion, leaves, 0, nonce);
+    return transactionHash;
+  }
+  /** This device's leaf + passkey nonce for a (possibly multi-chain) batch. */
+  async passkeyLeafForThisDevice() {
+    const readSource = await this.resolveSource();
+    const nonce = await this.adapter.passkeyNonce(this.address, readSource);
+    return { leaf: this.adapter.passkeyLeaf(this.devicePubkey, nonce), nonce };
+  }
+  /** Submit `add_signer_via_passkey` given a shared assertion + batch position.
+   * No device auth entry — authorized purely by the passkey assertion. */
+  async submitPasskeyApproval(assertion, leaves, leafIndex, nonce) {
+    const readSource = await this.resolveSource();
+    const digest = webauthnDigest(assertion.authenticatorData, assertion.clientDataJSON);
+    const candidates = recoverCandidatePublicKeys(assertion.r, assertion.s, digest);
+    let approver = null;
+    for (const cand of candidates) {
+      if (await this.adapter.isApprover(this.address, cand.publicKey, readSource)) {
+        approver = cand.publicKey;
+        break;
+      }
+    }
+    if (!approver) throw new Error("kit/stellar: this passkey is not a registered approver");
+    const func = this.adapter.buildAddSignerViaPasskey(
+      this.address,
+      this.devicePubkey,
+      approver,
+      nonce,
+      leaves,
+      leafIndex,
+      assertion
+    );
+    return { transactionHash: await this.submitHostFunction(func, void 0) };
+  }
+  /** Move `amount` stroops of native XLM to `destination` (device-signed). */
+  async execute(amount, destination) {
+    return this.executeTransfer(NATIVE_SAC_ID[this.network], amount, destination);
+  }
+  /** Read this account's balance of `tokenId` (defaults to native XLM), in stroops. */
+  async balance(tokenId = NATIVE_SAC_ID[this.network]) {
+    const readSource = await this.resolveSource();
+    return this.adapter.readBalance(tokenId, this.address, readSource);
+  }
+  /** Transfer `amount` of any SEP-41 token out of the account (device-signed). */
+  async executeTransfer(tokenId, amount, destination) {
+    if (this.status !== "ready") {
+      throw new Error("kit/stellar: this device is not yet an authorized signer of the wallet");
+    }
+    const func = this.adapter.buildTransfer(tokenId, this.address, destination, amount);
+    return this.submitHostFunction(func, this.address);
+  }
+  /**
+   * Register the backup signer derived from `code` as an authorized signer of
+   * this account (device-signed). Idempotent. The code never leaves the device —
+   * only the derived public key travels on-chain. Mirrors the other chains.
+   */
+  async setupRecovery(code) {
+    if (this.status !== "ready") {
+      throw new Error("kit/stellar: setupRecovery requires a ready, registered device");
+    }
+    const { publicKey: backupPubkey } = deriveBackupKey(code);
+    const readSource = await this.resolveSource();
+    if (await this.adapter.isAuthorizedSigner(this.address, backupPubkey, readSource)) return void 0;
+    return this.addSigner(backupPubkey);
+  }
+  /**
+   * Recover an account after losing every device signer: derive the backup key
+   * from `code`, use it (not the new device) to authorize `add_signer(newDevice)`,
+   * and return a ready handle bound to the new device. The address is unchanged.
+   */
+  static async recover(opts) {
+    const signer = opts.createSigner ? await opts.createSigner(`${opts.identity.userId}:${opts.appSalt}`) : await WebCryptoSigner.loadOrCreate({ keyId: `${opts.identity.userId}:${opts.appSalt}` });
+    const devicePubkey = await signer.getPublicKey();
+    const backup = BackupSigner.fromCode(opts.code);
+    const backupAdapter = new StellarAdapter({
+      network: opts.network,
+      rpcUrl: opts.rpcUrl,
+      factoryId: opts.factoryId,
+      signer: backup
+    });
+    const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
+    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry2);
+    const existing = await registry.lookup(opts.identity.userId);
+    if (!existing) {
+      throw new Error("kit/stellar: no account found for this identity \u2014 nothing to recover");
+    }
+    const relayer = opts.relayer ?? (opts.appId ? new StellarRelayer({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : void 0);
+    const backupHandle = new _CavosStellar(
+      opts.identity,
+      existing.address,
+      "ready",
+      opts.network,
+      backupAdapter,
+      devicePubkey,
+      relayer,
+      opts.sourceKeypair
+    );
+    const readSource = await backupHandle.resolveSource();
+    if (!await backupAdapter.isAuthorizedSigner(existing.address, devicePubkey, readSource)) {
+      await backupHandle.addSigner(devicePubkey);
+    }
+    const adapter = new StellarAdapter({
+      network: opts.network,
+      rpcUrl: opts.rpcUrl,
+      factoryId: opts.factoryId,
+      signer
+    });
+    return new _CavosStellar(
+      opts.identity,
+      existing.address,
+      "ready",
+      opts.network,
+      adapter,
+      devicePubkey,
+      relayer,
+      opts.sourceKeypair
+    );
+  }
+  /** The transaction source/fee-payer G-address (relayer or self-funded). */
+  async resolveSource() {
+    if (this.relayer) return this.relayer.getSource();
+    if (this.sourceKeypair) return this.sourceKeypair.publicKey();
+    throw new Error("kit/stellar: a relayer (appId) or sourceKeypair is required");
+  }
+  /**
+   * Build → simulate → device-sign auth → assemble → submit an invoke-contract
+   * host function. `authAccount` is the account whose `__check_auth` must sign the
+   * operation's Soroban auth entry (undefined for a plain factory deploy).
+   */
+  async submitHostFunction(func, authAccount) {
+    const server = this.adapter.server();
+    const sourceAddr = await this.resolveSource();
+    const simSource = new stellarSdk.Account(sourceAddr, "0");
+    const unsignedOp = stellarSdk.Operation.invokeHostFunction({ func, auth: [] });
+    const simTx = new stellarSdk.TransactionBuilder(simSource, {
+      fee: stellarSdk.BASE_FEE,
+      networkPassphrase: this.adapter.passphrase
+    }).addOperation(unsignedOp).setTimeout(180).build();
+    const sim = await server.simulateTransaction(simTx);
+    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: simulation failed: ${sim.error}`);
+    }
+    const validUntil = (await server.getLatestLedger()).sequence + 100;
+    const entries = sim.result?.auth ?? [];
+    const signedAuth = [];
+    for (const entry of entries) {
+      if (authAccount && isAddressCredentialFor(entry, authAccount)) {
+        signedAuth.push(await this.adapter.signAuthEntry(entry, validUntil));
+      } else {
+        signedAuth.push(entry);
+      }
+    }
+    const account = await server.getAccount(sourceAddr);
+    const finalOp = stellarSdk.Operation.invokeHostFunction({ func, auth: signedAuth });
+    const built = new stellarSdk.TransactionBuilder(account, {
+      fee: stellarSdk.BASE_FEE,
+      networkPassphrase: this.adapter.passphrase
+    }).addOperation(finalOp).setTimeout(180).build();
+    const authSim = await server.simulateTransaction(built);
+    if (stellarSdk.rpc.Api.isSimulationError(authSim)) {
+      throw new Error(`kit/stellar: auth simulation failed: ${authSim.error}`);
+    }
+    const assembled = stellarSdk.rpc.assembleTransaction(built, authSim).build();
+    if (this.relayer) {
+      return this.relayer.submit(assembled.toXDR());
+    }
+    if (this.sourceKeypair) {
+      assembled.sign(this.sourceKeypair);
+      return this.sendAndConfirm(assembled);
+    }
+    throw new Error("kit/stellar: no relayer or sourceKeypair configured to submit");
+  }
+  /** Submit a signed tx via RPC and poll to confirmation. Returns the hash. */
+  async sendAndConfirm(tx2) {
+    const server = this.adapter.server();
+    const sent = await server.sendTransaction(tx2);
+    if (sent.status === "ERROR") {
+      throw new Error(`kit/stellar: submit rejected: ${JSON.stringify(sent.errorResult)}`);
+    }
+    const hash6 = sent.hash;
+    for (let i = 0; i < 30; i++) {
+      const got = await server.getTransaction(hash6);
+      if (got.status === stellarSdk.rpc.Api.GetTransactionStatus.SUCCESS) return hash6;
+      if (got.status === stellarSdk.rpc.Api.GetTransactionStatus.FAILED) {
+        throw new Error(`kit/stellar: tx ${hash6} failed`);
+      }
+      await new Promise((r) => setTimeout(r, 1e3));
+    }
+    throw new Error(`kit/stellar: tx ${hash6} not confirmed in time`);
+  }
+};
+function isAddressCredentialFor(entry, accountAddress) {
+  const creds = entry.credentials();
+  if (creds.switch() !== stellarSdk.xdr.SorobanCredentialsType.sorobanCredentialsAddress()) return false;
+  return stellarSdk.Address.fromScAddress(creds.address().address()).toString() === accountAddress;
+}
+var defaultRegistry2 = new InMemoryWalletRegistry();
+
 // src/recovery/HttpRecoveryClient.ts
 function toHex2(n) {
   return "0x" + n.toString(16);
@@ -1271,18 +2275,26 @@ var SOLANA_ENV = {
   mainnet: "solana-mainnet",
   testnet: "solana-devnet"
 };
+var STELLAR_ENV = {
+  mainnet: "stellar-mainnet",
+  testnet: "stellar-testnet"
+};
 var Cavos = class _Cavos {
-  constructor(identity, address, status, account, adapter, devicePubkey) {
+  constructor(identity, address, status, account, adapter, devicePubkey, paymaster) {
     this.identity = identity;
     this.address = address;
     this.status = status;
     this.account = account;
     this.adapter = adapter;
     this.devicePubkey = devicePubkey;
+    this.paymaster = paymaster;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     this.chain = "starknet";
     /** Request id of the pending device-addition, when status is needs-device-approval. */
     this.pendingRequestId = null;
+    /** True when this connect just created & deployed a brand-new account (first
+     * sign-up), so the UI can offer a one-time "secure your account" step. */
+    this.isNewAccount = false;
   }
   /**
    * Unified entry point. Pick a `chain` and an `network` environment; the kit
@@ -1311,6 +2323,22 @@ var Cavos = class _Cavos {
         ...opts.feePayer ? { feePayer: opts.feePayer } : {}
       });
     }
+    if (opts.chain === "stellar") {
+      return CavosStellar.connect({
+        network: STELLAR_ENV[opts.network],
+        ...opts.auth ? { auth: opts.auth } : {},
+        ...opts.identity ? { identity: opts.identity } : {},
+        appSalt: opts.appSalt,
+        ...opts.appId ? { appId: opts.appId } : {},
+        ...opts.backendUrl ? { backendUrl: opts.backendUrl } : {},
+        ...opts.registry ? { registry: opts.registry } : {},
+        ...opts.rpcUrl ? { rpcUrl: opts.rpcUrl } : {},
+        ...opts.factoryId ? { factoryId: opts.factoryId } : {},
+        ...opts.createSigner ? { createSigner: opts.createSigner } : {},
+        ...opts.stellarRelayer ? { relayer: opts.stellarRelayer } : {},
+        ...opts.stellarSourceKeypair ? { sourceKeypair: opts.stellarSourceKeypair } : {}
+      });
+    }
     if (!opts.paymasterApiKey) {
       throw new Error("kit: `paymasterApiKey` is required for Starknet connections");
     }
@@ -1338,8 +2366,10 @@ var Cavos = class _Cavos {
     const provider = new starknet.RpcProvider({
       nodeUrl: opts.rpcUrl ?? STARKNET_NETWORKS[opts.network].rpcUrl
     });
+    const paymasterUrl = opts.paymasterUrl ?? CAVOS_PAYMASTER_URL[opts.network];
+    const paymasterConfig = { url: paymasterUrl, apiKey: opts.paymasterApiKey };
     const paymaster = new starknet.PaymasterRpc({
-      nodeUrl: opts.paymasterUrl ?? CAVOS_PAYMASTER_URL[opts.network],
+      nodeUrl: paymasterUrl,
       headers: { "x-paymaster-api-key": opts.paymasterApiKey }
     });
     const addressSeed = deriveAddressSeed({ userId: identity.userId, appSalt: opts.appSalt });
@@ -1354,26 +2384,27 @@ var Cavos = class _Cavos {
       cairoVersion: "1"
     });
     const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
-    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry2);
+    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry3);
     const recovery = opts.recovery ?? (opts.appId ? new HttpRecoveryClient({ baseUrl: backendUrl, appId: opts.appId }) : null);
     const existing = await registry.lookup(identity.userId);
     if (existing) {
       const account2 = makeAccount(existing.address);
       const isSigner2 = await adapter.isAuthorizedSigner(existing.address, devicePubkey);
-      const cavos = new _Cavos(
+      const cavos2 = new _Cavos(
         identity,
         existing.address,
         isSigner2 ? "ready" : "needs-device-approval",
         account2,
         adapter,
-        devicePubkey
+        devicePubkey,
+        paymasterConfig
       );
       if (!isSigner2 && recovery) {
         const dedup = lastDeviceRequest.get(identity.userId);
         const fresh = dedup && Date.now() - dedup.requestedAt < DEVICE_REQUEST_DEDUP_MS;
         try {
           if (fresh) {
-            cavos.pendingRequestId = dedup.requestId;
+            cavos2.pendingRequestId = dedup.requestId;
           } else {
             const { requestId } = await recovery.requestDeviceAddition({
               userId: identity.userId,
@@ -1381,14 +2412,14 @@ var Cavos = class _Cavos {
               newSigner: devicePubkey,
               ...identity.email ? { email: identity.email } : {}
             });
-            cavos.pendingRequestId = requestId;
+            cavos2.pendingRequestId = requestId;
             lastDeviceRequest.set(identity.userId, { requestId, requestedAt: Date.now() });
           }
         } catch (e) {
           console.warn("[Cavos] requestDeviceAddition failed:", e);
         }
       }
-      return cavos;
+      return cavos2;
     }
     const address = adapter.computeAddress({ addressSeed, initialSigner: devicePubkey });
     const account = makeAccount(address);
@@ -1419,14 +2450,17 @@ var Cavos = class _Cavos {
       console.warn("[Cavos] isAuthorizedSigner read failed:", e);
       isSigner = !alreadyDeployed;
     }
-    return new _Cavos(
+    const cavos = new _Cavos(
       identity,
       address,
       isSigner ? "ready" : "needs-device-approval",
       account,
       adapter,
-      devicePubkey
+      devicePubkey,
+      paymasterConfig
     );
+    cavos.isNewAccount = !alreadyDeployed && isSigner;
+    return cavos;
   }
   /** This device's public key (e.g. to request addition to an existing wallet). */
   get publicKey() {
@@ -1446,6 +2480,108 @@ var Cavos = class _Cavos {
   async addSigner(pubkey) {
     return this.execute([this.adapter.buildAddSigner(this.address, pubkey)]);
   }
+  /**
+   * Enroll a passkey as an APPROVER so the user can later add devices from any
+   * browser (2FA-style step-up). Requires a ready device (the enrollment call is
+   * device-signed and gasless). Idempotent: a no-op if the passkey is already an
+   * approver. Call this whenever the app decides to prompt "turn on device
+   * approvals". Returns the passkey's public key + the enrollment tx hash.
+   */
+  async enrollPasskey(passkey, params) {
+    const enrolled = await passkey.enroll(params);
+    const { transactionHash } = await this.addApprover(enrolled.publicKey);
+    return { publicKey: enrolled.publicKey, transactionHash };
+  }
+  /**
+   * Register an ALREADY-enrolled passkey public key as an approver (gasless,
+   * device-signed). Idempotent. Use this to register ONE passkey across multiple
+   * chains without re-prompting `passkey.enroll()` on each: enroll once, then
+   * call `addApprover(pubkey)` on each chain's wallet.
+   */
+  async addApprover(pubkey) {
+    if (this.status !== "ready") {
+      throw new Error("kit: addApprover requires a ready, authorized device");
+    }
+    if (await this.adapter.isApprover(this.address, pubkey)) return {};
+    const { transactionHash } = await this.execute([
+      this.adapter.buildAddApprover(this.address, pubkey)
+    ]);
+    try {
+      await this.account.waitForTransaction(transactionHash);
+    } catch (e) {
+      console.warn("[Cavos] add_approver receipt wait failed:", e);
+    }
+    return { transactionHash };
+  }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    return this.adapter.hasPasskeyApprover(this.address);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Cheap and side-effect free — used to poll for readiness after a passkey /
+   * device approval submits, before the new signer is indexed. */
+  async isReady() {
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey);
+  }
+  /**
+   * From a brand-new browser (status `needs-device-approval`), use the user's
+   * synced passkey to authorize adding THIS device — no trip back to an already-
+   * authorized device.
+   *
+   * `add_signer_via_passkey` is a public external authorized by the embedded
+   * WebAuthn assertion (no device signature), so by default we sponsor it through
+   * the Cavos paymaster's `paymaster_executeDirectTransaction` (the forwarder's
+   * `execute_sponsored` runs a generic call — it does NOT require SNIP-9). Pass a
+   * custom `submit` to route it through your own relayer instead. Returns the tx.
+   */
+  async approveThisDeviceWithPasskey(opts) {
+    if (this.status === "ready") {
+      throw new Error("kit: this device is already an authorized signer");
+    }
+    const { leaf, nonce } = await this.passkeyLeafForThisDevice();
+    const leaves = [leaf];
+    const assertion = await opts.passkey.assert(batchChallenge(leaves));
+    return this.submitPasskeyApproval(assertion, leaves, 0, nonce, opts.submit);
+  }
+  /** This device's leaf + the current passkey nonce, for a (possibly multi-chain)
+   * passkey approval batch. See `approveDeviceEverywhere`. */
+  async passkeyLeafForThisDevice() {
+    const nonce = await this.adapter.getPasskeyNonce(this.address);
+    return { leaf: this.adapter.passkeyLeaf(this.devicePubkey, nonce), nonce };
+  }
+  /** Submit `add_signer_via_passkey` given a (shared) assertion + this chain's
+   * position in the batch. The assertion doesn't carry the passkey pubkey, so we
+   * recover both candidates and pick the enrolled approver via the on-chain view
+   * (no backend). Defaults to sponsoring through the paymaster. */
+  async submitPasskeyApproval(assertion, leaves, leafIndex, nonce, submit) {
+    const digest = webauthnDigest(assertion.authenticatorData, assertion.clientDataJSON);
+    const candidates = recoverCandidatePublicKeys(assertion.r, assertion.s, digest);
+    let yParity = null;
+    for (const cand of candidates) {
+      if (await this.adapter.isApprover(this.address, cand.publicKey)) {
+        yParity = cand.yParity;
+        break;
+      }
+    }
+    if (yParity === null) {
+      throw new Error("kit: this passkey is not a registered approver of the wallet");
+    }
+    const call = this.adapter.buildAddSignerViaPasskey(
+      this.address,
+      this.devicePubkey,
+      nonce,
+      leaves,
+      leafIndex,
+      assertion,
+      yParity
+    );
+    if (submit) return submit(call);
+    if (!this.paymaster) {
+      throw new Error("kit: no paymaster configured \u2014 pass a `submit` relayer to approveThisDeviceWithPasskey");
+    }
+    return paymasterExecuteDirect(this.paymaster, this.address, call);
+  }
   /**
    * Register a self-custodial backup signer derived from `code`, so the account
    * can be recovered after the user loses every device. Idempotent: if the
@@ -1487,7 +2623,7 @@ var Cavos = class _Cavos {
     const backup = BackupSigner.fromCode(opts.code);
     const backupAdapter = new StarknetAdapter({ classHash, signer: backup, provider });
     const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
-    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network }) : defaultRegistry2);
+    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network }) : defaultRegistry3);
     const existing = await registry.lookup(opts.identity.userId);
     if (!existing) {
       throw new Error("kit: no account found for this identity \u2014 nothing to recover");
@@ -1522,7 +2658,7 @@ var Cavos = class _Cavos {
     return new _Cavos(opts.identity, existing.address, "ready", account, adapter, devicePubkey);
   }
 };
-var defaultRegistry2 = new InMemoryWalletRegistry();
+var defaultRegistry3 = new InMemoryWalletRegistry();
 var DEVICE_REQUEST_DEDUP_MS = 5 * 60 * 1e3;
 var lastDeviceRequest = /* @__PURE__ */ new Map();
 async function isDeployed(provider, address) {
@@ -1533,6 +2669,40 @@ async function isDeployed(provider, address) {
     return false;
   }
 }
+async function paymasterExecuteDirect(paymaster, userAddress, call) {
+  const body = {
+    jsonrpc: "2.0",
+    id: 1,
+    method: "paymaster_executeDirectTransaction",
+    params: {
+      transaction: {
+        type: "invoke",
+        invoke: {
+          user_address: userAddress,
+          execute_from_outside_call: {
+            to: call.contractAddress,
+            selector: starknet.hash.getSelectorFromName(call.entrypoint),
+            calldata: call.calldata.map((c) => starknet.num.toHex(c))
+          }
+        }
+      },
+      parameters: { version: "0x1", fee_mode: { mode: "sponsored" } }
+    }
+  };
+  const res = await fetch(paymaster.url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...paymaster.apiKey ? { "x-paymaster-api-key": paymaster.apiKey } : {}
+    },
+    body: JSON.stringify(body)
+  });
+  const json = await res.json();
+  if (json.error) {
+    throw new Error(`kit: paymaster passkey approval failed: ${JSON.stringify(json.error)}`);
+  }
+  return { transactionHash: json.result?.transaction_hash ?? json.result?.tracking_id };
+}
 var CavosAuth = class {
   constructor(opts = {}) {
     this.opts = opts;
@@ -1670,6 +2840,90 @@ function bytesToChunks(bytes) {
   for (const b of bytes.subarray(0, 31)) w = w << 8n | BigInt(b);
   return w;
 }
+var PasskeySigner = class {
+  constructor(opts = {}) {
+    if (typeof window === "undefined" || !navigator.credentials) {
+      throw new Error("kit/passkey: WebAuthn is only available in a browser");
+    }
+    this.rpId = opts.rpId ?? window.location.hostname;
+    this.rpName = opts.rpName ?? this.rpId;
+    if (isIpAddress(this.rpId)) {
+      throw new Error(
+        `kit/passkey: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) \u2014 or pass an explicit \`rpId\`. (The silent device key works over an IP; passkeys don't.)`
+      );
+    }
+  }
+  /** True if this platform advertises a usable passkey (platform authenticator). */
+  static async isSupported() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) return false;
+    try {
+      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    } catch {
+      return false;
+    }
+  }
+  /** Create a new synced passkey and return its P-256 public key. */
+  async enroll(params) {
+    const challenge = crypto.getRandomValues(new Uint8Array(32));
+    const cred = await navigator.credentials.create({
+      publicKey: {
+        challenge: buf(challenge),
+        rp: { id: this.rpId, name: this.rpName },
+        user: {
+          id: buf(userHandle(params.userId)),
+          name: params.userName,
+          displayName: params.displayName ?? params.userName
+        },
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        // ES256 (P-256)
+        authenticatorSelection: {
+          residentKey: "required",
+          requireResidentKey: true,
+          userVerification: "preferred"
+        },
+        attestation: "none"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: enrollment cancelled");
+    const response = cred.response;
+    const spki = new Uint8Array(response.getPublicKey());
+    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };
+  }
+  /**
+   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller
+   * derives from the signer being added + the on-chain nonce). Uses discoverable
+   * credentials — no `allowCredentials` — so it works on a brand-new browser.
+   */
+  async assert(challenge) {
+    const cred = await navigator.credentials.get({
+      publicKey: {
+        challenge: buf(challenge),
+        rpId: this.rpId,
+        allowCredentials: [],
+        userVerification: "preferred"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: assertion cancelled");
+    const response = cred.response;
+    const authenticatorData = new Uint8Array(response.authenticatorData);
+    const clientDataJSON = new Uint8Array(response.clientDataJSON);
+    const { r, s } = derToRs(new Uint8Array(response.signature));
+    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));
+    return { authenticatorData, clientDataJSON, r, s, challengeOffset };
+  }
+};
+function isIpAddress(host) {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.includes(":")) return true;
+  return false;
+}
+function userHandle(userId) {
+  const bytes = new TextEncoder().encode(userId);
+  return bytes.length <= 64 ? bytes : sha256.sha256(bytes);
+}
+function buf(bytes) {
+  return bytes.slice();
+}
 var cavosLogoBase64 = "iVBORw0KGgoAAAANSUhEUgAAADMAAAA/CAYAAABNY/BRAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAlZSURBVHgB7VpbaCRZGf6r6lR3VV+STieZTBKCmZlO59LDisZBR2Q3D8v6MMrCgswirIqi4LI+7OKyIDp4YUAUXWFdxBurIIw+rcIgroMsKqvoMATdzSbpJEwmM8nk0rn3pbrrVJ39T3X3TE/S6a5TXVn2Yb88hKquc/nPOd/3X6oAjgfK4ODA47FY7AO1N9vb20/395+8wH+HY4AM/kOJx+PhcLjtjzs7O5naHyRJ2orFOq/29PRoeEnAZ/htDJ+g1dvbu8mYDWjUAztg27bM73d1da7jJQWfDfLTGN4XHR4aulE0siDhXz3g7oBRyAWHh5P/gbJBvs3Br474zO2hoTM/YGB9CJhEGj8sKcyi5xKJ05fwkoFP8MsY5dTAwMOKrDxvW7aryeGRYyoh3xkYOPkR8EkQ/DBGQUIH9Wjk79Qsihwb2TRN2haN/7evry+I1yq0iFaNcQjf1dW1VTLyaIgkRmjGSNHI0Y6O2BpemdCiILRiDOcJ5UQuGnlZ2JD73RAUBB37eQNaFASvDR2pQuX6LrOtc3yFoQU4gmDT88OJxAvQgiB4NUbp7+//mCTL37Ityxc14sIhK/L3sd8PgkdB8GIMSSQSSizW/i9qGn76CZlSk8ba2ycHBwe5GAjvtuhE+AA0GAzs4jmn3nlSH6wiCOGwvgpl/gjtkIgxFcIPv1EyCorksyE1wxAjX4jgOK/jhQUCc3T7oEP4kWTiG8w2P85aJHzTwSTggjCRTJx+FgQEwa0xysDAwDhI8mUkqg3vAlBYbELUH+O4KXDJHzfGkPHxcaktGrlOqZCHh62trXzt9d7eXl5AeOWSWaJtbdE3K2M2NajZxBzCF4vGtsE9PHPPE9u2SlAmcS0MBswEt8DjbOSzNJVKuRKERsZUCD/0ulHIB0UJbzN2F+rOj22BACRJJsVCrm1kZPg1aCIIDXcGCf8cMHvCi4e3aGmy3n3DMCZBHIptmY8lk4mnGz10lDHE8cSS8iOLWsKEV4gC2dzelXq/FQrGH2RZ3M9y4SGK8jIGtUNwBH/q9UomJiYAPfwkpd48vKIQ3AH7rwCH081CofAnEgiCB8ilokEx3ZipzvPQAweuHcJnMhsbRj5niRC+Bjxcu4PFjB2o4yN2d3e3mc02+XMgDO5Q92lqbKyuINQa4xB+JJm8hoSPYK7uKdhTFEXOZ7PPw9E7Ku/u7b0gKbIEHsAFAZW1A+d5FQ4IwgMDjowkn2GMPuo9pGeUBDT79srK76GB515ZWfl1IKBR/jx4AK4Cr/JcSCROfan2ftUYnvqexf8vWR49PM7cVtQA2d3cPA/l7T/KGN6/sr29M4HcIeDpuOGWWNQOqIFfnThx4hRU+FP1rAxV4v+0VPREePQdVlDTsJ38+J3V1esuJmjh7vwbV/diIKjhKjMvBjmC0N3dNV8ZT3HO7djY2AaG9B2yCE8kpwbG1IAmMQZv5nK5R5aWlvYqHbsJWvjYEp6Iro6O9ms49kOmWUK7mCSSazKwqaZHtqam3u6RRkaGrimy+gnsWiCCtqlZMueyueyVXM74OVcoKB8tC8ThtItEIifa26NfDunhJwMBNQHlhXVnFq5msWS8Vu2sFXhSpWPo5zjq5u/jfRyE1Nt74pOlkrXDPbebBqg2Cs3nd9u7u+cWFxcNqKgSePQXFfCxOdkZqlu4WCwmQqFAhFJ3fWLgit7RjhFJIp09PZ1/wZAd3ELpjGMGLcPIcHLdpMVfLizc+nbNzyJGyRUDdF1XL+l69Cso9zFgFqYQplMMcDUfRYWt7c3POE8nk0OvYL7wOVwbUUVAUQSm6SGZlgqXZ+dufhPKBXA32aTzzdCZMz9Ug8GvY626KsNCqoa7YkuK8ovZ2bmv8obcAHt0dHSxZOT6eSAH4rCxGol9Bm5Mz8ycq/bZ4HnHt6RSo/8rGoWzFW/iKfIgajA9m06P8fbVQcn09PSgFopyQ9zn6PchY/IkmSXjw5gNvgTNnZ2VTCZ/UzGEz8GDj2BUC0WUiiFOjFftxHm/iCnIQEDTVCw6eCWzhOWhZ5ADoQYTlPEtdEwl8ufREE+OEudnBTSdrK2t9UF5l53ou3ZAury8vFIq0aeIQqrqIgqpVCwwXI8XG7S3u7vjLxtGgS+YF2MYUQNKMVd4IpPJ8Be990KoQ6s3Pz//O0lRX2VeXy1gq0i47Slo0B5zmSclt1J1ANiKx6JXFm7dehUO8PKgMU4oPTMz8wQqVAYjcy/Jk2RjIMs/YIDDKy9hQJnCXEQGD7tiO4TXbqfT6c/Cfd90D/XONd82FUPqvrIgiGeD1DQhFNIuwuHdYRgZX3R8iDAY1ZHwqJaDUJb1Q7w+iqR8NGl7e21EDerC2SCeA9D10IV6v4VC4U8xW/gE25jEkY2NjQSUCV93NRpJIl1ZycxZlvk12WWoUwtN00br3VdV9RQIQiEqOuXiF9bX129Cg5yp6STT6YWfoh/9Gy62qFy31bvphCsC4DzBsf+cXlj8LTQRpWbGOIIwOzv7qB7S90X4U6lNawduh0U0Eg2x9VB4Oz03V/0SqiVjOPi2kmyucDKohQlI7g2Kx+OB2utoNKq51jCJEz4s89weKt8bNGvilgsUw30zu7MzjrGQ5/IQL4C4fNRWiUZ2dzcfgkpx0k0jEWJbt1ZWJlGpLskeq5FuwXMrrPE+e+fO2lsgUCQRVSkJQ+3vYQ50ncdHcBzA48Uk5R+z8/M/AdF0AMTgRNgYqX4UHVjRa3n1KOAZxGJixEQP/whUImGR9l7KM06Evbq6hoIQEhIEhzNHsgZDej3EFYtL971IWARea0342iOTzxeyDxPiCIIrYvOsEOprAOPCkslsnp+amuK74ekIt1I4s27evP1Pm9kvYoQg0OwwDVBQMINilzE/4Z86euZiq1VAOZ2ef46QwDSv+YInMCrL5Mbs3ByvH3BL3/WvmqrgR0J9e3o6pelREBcERoN6BGZm07xu4Nl/VeFHfdb5gg/fADiCwIsM7pqhIRhRYI2sEzwS/iD8KjbT/f397b3dvU+rgaCb6j3jL6b2s9nHMLPlX3H44rP8rJyzpeXlq6i9r0CzgNApCsk/w928Bj4Z4vQL/oEbIGOE8EVM6JaOdidYWyJkGiPxp6FO6vteg1NETKVSWHbFkP9BRPn92uf8xHG8oHHez9+9e/esacbjtT9gShBbXV0drYzrayjE8Q6F7uAm3ZgyLQAAAABJRU5ErkJggg==";
 var STYLE_ID = "cavos-modal-styles-v2";
 function injectStyles() {
@@ -1773,6 +3027,17 @@ var EmailIcon = () => /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: "16", heig
   /* @__PURE__ */ jsxRuntime.jsx("rect", { x: "2", y: "4", width: "20", height: "16", rx: "2" }),
   /* @__PURE__ */ jsxRuntime.jsx("path", { d: "m22 7-8.97 5.7a1.94 1.94 0 01-2.06 0L2 7" })
 ] });
+var FingerprintIcon = ({ size = 22, color = "currentColor" }) => /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", stroke: color, strokeWidth: "1.7", strokeLinecap: "round", strokeLinejoin: "round", children: [
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M2 12C2 6.5 6.5 2 12 2a10 10 0 0 1 8 4" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M5 19.5C5.5 18 6 15 6 12c0-.7.12-1.37.34-2" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M17.29 21.02c.12-.6.43-2.3.5-3.02" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 10a2 2 0 0 0-2 2c0 1.02-.1 2.51-.26 4" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M8.65 22c.21-.66.45-1.32.57-2" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M14 13.12c0 2.38 0 6.38-1 8.88" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M2 16h.01" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M21.8 16c.2-2 .131-5.354 0-6" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M9 6.8a6 6 0 0 1 9 5.2c0 .47 0 1.17-.02 2" })
+] });
 var CavosLogo = ({ invert }) => /* @__PURE__ */ jsxRuntime.jsx("img", { src: `data:image/png;base64,${cavosLogoBase64}`, alt: "Cavos", style: { width: "auto", height: "16px", objectFit: "contain", opacity: 0.55, flexShrink: 0, filter: invert ? "invert(1)" : "none" } });
 function Spinner({ size = 16, color = "#888" }) {
   return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -1923,7 +3188,11 @@ function CavosAuthModal({
     authError,
     clearAuthError,
     resendDeviceApproval,
-    recover
+    recover,
+    passkeySupported,
+    enrollPasskeyDefault,
+    approveDeviceWithPasskey,
+    setupRecovery
   } = useCavos();
   const isMobile = useIsMobile();
   const isLight = theme !== "dark";
@@ -1951,7 +3220,12 @@ function CavosAuthModal({
   const [deviceResendBusy, setDeviceResendBusy] = react.useState(false);
   const [recoverCode, setRecoverCode] = react.useState("");
   const [recoverBusy, setRecoverBusy] = react.useState(false);
+  const [pkBusy, setPkBusy] = react.useState(false);
+  const [pkError, setPkError] = react.useState("");
+  const [savedRecoveryCode, setSavedRecoveryCode] = react.useState("");
+  const [copied, setCopied] = react.useState(false);
   const doneHandledRef = react.useRef(false);
+  const secureHandledRef = react.useRef(false);
   const closeTimerRef = react.useRef(null);
   const otpBoxRefs = react.useRef([null, null, null, null, null, null]);
   const setOtpDigit = (i, raw) => {
@@ -2012,6 +3286,7 @@ function CavosAuthModal({
       setOtpCode("");
       setError("");
       doneHandledRef.current = false;
+      secureHandledRef.current = false;
     }, 1600);
   }, [onClose]);
   react.useEffect(() => {
@@ -2022,13 +3297,26 @@ function CavosAuthModal({
       doneHandledRef.current = false;
     }
     if (isAuthenticated && address && walletStatus.isReady) {
-      triggerDone(address);
+      if (walletStatus.isNewAccount && !secureHandledRef.current) {
+        if (screen !== "secure-account" && screen !== "recovery-code" && !doneHandledRef.current) {
+          setScreen("secure-account");
+        }
+      } else {
+        triggerDone(address);
+      }
     }
-    if (walletStatus.awaitingApproval && screen !== "device-approval" && screen !== "recover") {
-      setScreen("device-approval");
-      doneHandledRef.current = false;
+    if (walletStatus.needsDeviceApproval && // A deploy in progress owns the screen; never fight the deploying branch
+    // above (both flags true would oscillate deploying ↔ approval → loop).
+    !walletStatus.isDeploying && screen !== "recover" && screen !== "device-approval" && screen !== "passkey-approval") {
+      if (walletStatus.hasPasskey && passkeySupported) {
+        setScreen("passkey-approval");
+        doneHandledRef.current = false;
+      } else if (walletStatus.awaitingApproval) {
+        setScreen("device-approval");
+        doneHandledRef.current = false;
+      }
     }
-  }, [open, isAuthenticated, address, walletStatus.isReady, walletStatus.isDeploying, walletStatus.awaitingApproval, screen, triggerDone]);
+  }, [open, isAuthenticated, address, walletStatus.isReady, walletStatus.isDeploying, walletStatus.awaitingApproval, walletStatus.needsDeviceApproval, walletStatus.hasPasskey, walletStatus.isNewAccount, passkeySupported, screen, triggerDone]);
   react.useEffect(() => () => {
     if (closeTimerRef.current) clearTimeout(closeTimerRef.current);
   }, []);
@@ -2038,9 +3326,61 @@ function CavosAuthModal({
     setEmail("");
     setOtpCode("");
     setError("");
+    setPkError("");
+    setSavedRecoveryCode("");
+    setCopied(false);
     doneHandledRef.current = false;
+    secureHandledRef.current = false;
     onClose();
   };
+  const finishSecureStep = () => {
+    secureHandledRef.current = true;
+    if (address) triggerDone(address);
+  };
+  const handleSetupPasskey = async () => {
+    setPkBusy(true);
+    setPkError("");
+    try {
+      await enrollPasskeyDefault();
+      finishSecureStep();
+    } catch (e) {
+      setPkError(e instanceof Error ? e.message : "We couldn't set up your passkey. Try again.");
+    } finally {
+      setPkBusy(false);
+    }
+  };
+  const handleSaveRecovery = async () => {
+    setPkBusy(true);
+    setPkError("");
+    try {
+      const code = await setupRecovery();
+      setSavedRecoveryCode(code);
+      setScreen("recovery-code");
+    } catch (e) {
+      setPkError(e instanceof Error ? e.message : "We couldn't create your recovery phrase. Try again.");
+    } finally {
+      setPkBusy(false);
+    }
+  };
+  const handleCopyRecovery = async () => {
+    try {
+      await navigator.clipboard.writeText(savedRecoveryCode);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2e3);
+    } catch {
+    }
+  };
+  const handlePasskeyApprove = async () => {
+    setPkBusy(true);
+    setPkError("");
+    try {
+      await approveDeviceWithPasskey();
+      setPkBusy(false);
+    } catch (e) {
+      setPkError(e instanceof Error ? e.message : "We couldn't verify your passkey. Try again or use email.");
+      setPkBusy(false);
+    }
+  };
   const handleOAuth = async (provider) => {
     setError("");
     setBusy(true);
@@ -2131,6 +3471,85 @@ function CavosAuthModal({
       setDeviceResendBusy(false);
     }
   };
+  if (screen === "secure-account") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
+      isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { padding: isMobile ? "28px 24px 28px" : "44px 24px 28px", textAlign: "center" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { width: 48, height: 48, borderRadius: "50%", margin: "0 auto 16px", background: isLight ? "rgba(0,0,0,0.04)" : "rgba(255,255,255,0.06)", border: `1px solid ${isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)"}`, display: "flex", alignItems: "center", justifyContent: "center" }, children: /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: textColor, strokeWidth: "1.7", strokeLinecap: "round", strokeLinejoin: "round", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" }),
+          /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M9 12l2 2 4-4" })
+        ] }) }),
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { style: { margin: "0 0 8px", fontSize: "17px", fontWeight: 600, color: textColor, letterSpacing: "-0.02em" }, children: "Keep your account safe" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "0 0 24px", fontSize: "13px", color: subTextColor, lineHeight: 1.55 }, children: "Set up a passkey so you can sign in on a new phone or computer in one tap. It takes a few seconds." }),
+        pkError && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { background: errBg, border: `1px solid ${errBorder}`, borderRadius: "10px", padding: "9px 13px", fontSize: "13px", color: errColor, marginBottom: "14px", textAlign: "left" }, children: pkError }),
+        passkeySupported ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsxs("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "13px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 600, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", display: "flex", alignItems: "center", justifyContent: "center", gap: "9px", opacity: pkBusy ? 0.65 : 1, transition: "opacity 0.15s, transform 0.1s" }, onClick: handleSetupPasskey, disabled: pkBusy, children: [
+            pkBusy ? /* @__PURE__ */ jsxRuntime.jsx(Spinner, { size: 16, color: "#fff" }) : /* @__PURE__ */ jsxRuntime.jsx(FingerprintIcon, { size: 18, color: "#fff" }),
+            pkBusy ? "Setting up\u2026" : "Set up a passkey"
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "10px 0 0", fontSize: "12px", color: subTextColor, lineHeight: 1.5 }, children: "Uses Face ID, Touch ID, or your device PIN." }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { display: "flex", alignItems: "center", gap: "12px", margin: "18px 0" }, children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "cavos-divider-line", style: { background: isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)" } }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { style: { fontSize: "11px", color: subTextColor, textTransform: "uppercase", letterSpacing: "0.06em" }, children: "or" }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "cavos-divider-line", style: { background: isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)" } })
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-submit-btn", style: { width: "100%", padding: "12px", borderRadius: "12px", border: inputBorder, background: "transparent", color: textColor, fontSize: "14px", fontWeight: 500, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", transition: "background 0.15s", opacity: pkBusy ? 0.6 : 1 }, onClick: handleSaveRecovery, disabled: pkBusy, children: "Save a recovery phrase instead" })
+        ] }) : /* @__PURE__ */ jsxRuntime.jsxs("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "13px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 600, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", display: "flex", alignItems: "center", justifyContent: "center", gap: "9px", opacity: pkBusy ? 0.65 : 1, transition: "opacity 0.15s" }, onClick: handleSaveRecovery, disabled: pkBusy, children: [
+          pkBusy && /* @__PURE__ */ jsxRuntime.jsx(Spinner, { size: 16, color: "#fff" }),
+          pkBusy ? "Setting up\u2026" : "Save a recovery phrase"
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-sub-btn", style: { background: "none", border: "none", cursor: pkBusy ? "default" : "pointer", fontSize: "13px", color: subTextColor, width: "100%", textAlign: "center", padding: "18px 0 0", fontFamily: "inherit", transition: "color 0.15s", opacity: pkBusy ? 0.6 : 1 }, onClick: finishSecureStep, disabled: pkBusy, children: "Skip for now" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: footer, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(CavosLogo, { invert: !isLight }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Secured by Cavos" })
+      ] })
+    ] }) });
+  }
+  if (screen === "recovery-code") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
+      isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { padding: isMobile ? "28px 24px 28px" : "44px 24px 28px", textAlign: "center" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { style: { margin: "0 0 8px", fontSize: "17px", fontWeight: 600, color: textColor, letterSpacing: "-0.02em" }, children: "Save your recovery phrase" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "0 0 18px", fontSize: "13px", color: subTextColor, lineHeight: 1.55 }, children: "Write this down and keep it somewhere safe. It's the only way to get back in if you lose your devices, and we can't recover it for you." }),
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { background: isLight ? "rgba(0,0,0,0.03)" : "rgba(255,255,255,0.05)", border: `1px solid ${isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)"}`, borderRadius: "12px", padding: "16px", marginBottom: "12px", fontSize: "14px", fontWeight: 500, color: textColor, wordBreak: "break-word", lineHeight: 1.6, fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace", textAlign: "center" }, children: savedRecoveryCode }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-provider", style: { ...pBtn, marginBottom: "10px" }, onClick: handleCopyRecovery, children: /* @__PURE__ */ jsxRuntime.jsx("span", { children: copied ? "Copied \u2713" : "Copy to clipboard" }) }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "12px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 500, cursor: "pointer", fontFamily: "inherit", transition: "opacity 0.15s" }, onClick: finishSecureStep, children: "I've saved it" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: footer, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(CavosLogo, { invert: !isLight }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Secured by Cavos" })
+      ] })
+    ] }) });
+  }
+  if (screen === "passkey-approval") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
+      isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-close", style: close, onClick: handleClose, "aria-label": "Close", children: /* @__PURE__ */ jsxRuntime.jsx(CloseX, {}) }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { padding: isMobile ? "28px 24px 32px" : "48px 24px 32px", textAlign: "center" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { width: 48, height: 48, borderRadius: "50%", margin: "0 auto 16px", background: isLight ? "rgba(0,0,0,0.04)" : "rgba(255,255,255,0.06)", border: `1px solid ${isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)"}`, display: "flex", alignItems: "center", justifyContent: "center" }, children: /* @__PURE__ */ jsxRuntime.jsx(FingerprintIcon, { size: 24, color: textColor }) }),
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { style: { margin: "0 0 8px", fontSize: "17px", fontWeight: 600, color: textColor, letterSpacing: "-0.02em" }, children: "Verify it's you" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "0 0 20px", fontSize: "13px", color: subTextColor, lineHeight: 1.55 }, children: "Confirm with Face ID, Touch ID, or your device PIN to add this device to your account." }),
+        pkError && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { background: errBg, border: `1px solid ${errBorder}`, borderRadius: "10px", padding: "9px 13px", fontSize: "13px", color: errColor, marginBottom: "14px" }, children: pkError }),
+        /* @__PURE__ */ jsxRuntime.jsxs("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "12px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 500, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", display: "flex", alignItems: "center", justifyContent: "center", gap: "8px", opacity: pkBusy ? 0.65 : 1 }, onClick: handlePasskeyApprove, disabled: pkBusy, children: [
+          pkBusy && /* @__PURE__ */ jsxRuntime.jsx(Spinner, { size: 15, color: "#fff" }),
+          pkBusy ? "Verifying\u2026" : "Continue with passkey"
+        ] }),
+        walletStatus.awaitingApproval && /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-sub-btn", style: { background: "none", border: "none", cursor: "pointer", fontSize: "13px", color: subTextColor, width: "100%", textAlign: "center", padding: "16px 0 0", fontFamily: "inherit", transition: "color 0.15s" }, onClick: () => {
+          setScreen("device-approval");
+          setPkError("");
+        }, children: "Approve by email instead" }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-sub-btn", style: { background: "none", border: "none", cursor: "pointer", fontSize: "13px", color: subTextColor, width: "100%", textAlign: "center", padding: `${walletStatus.awaitingApproval ? "10px" : "16px"} 0 0`, fontFamily: "inherit", transition: "color 0.15s" }, onClick: () => {
+          setScreen("recover");
+          setPkError("");
+        }, children: "Use a recovery phrase" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: footer, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(CavosLogo, { invert: !isLight }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Secured by Cavos" })
+      ] })
+    ] }) });
+  }
   if (screen === "device-approval") {
     const expired = walletStatus.awaitingApproval && !walletStatus.pendingRequestId;
     return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
@@ -2190,7 +3609,7 @@ function CavosAuthModal({
     }, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
       isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
       /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-close", style: { ...close, left: "16px", right: "auto" }, onClick: () => {
-        setScreen("device-approval");
+        setScreen(walletStatus.hasPasskey && passkeySupported ? "passkey-approval" : "device-approval");
         setError("");
         setRecoverCode("");
       }, "aria-label": "Back", children: /* @__PURE__ */ jsxRuntime.jsx("svg", { width: "14", height: "14", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2.5", strokeLinecap: "round", strokeLinejoin: "round", children: /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M19 12H5M12 5l-7 7 7 7" }) }) }),
@@ -2429,23 +3848,36 @@ var INITIAL_STATUS = {
   isReady: false,
   needsDeviceApproval: false,
   awaitingApproval: false,
-  pendingRequestId: null
+  pendingRequestId: null,
+  hasPasskey: false,
+  isNewAccount: false
 };
 function CavosProvider({ config, modal, children }) {
   const [auth] = react.useState(
     () => new CavosAuth({ appId: config.appId, backendUrl: config.authBackendUrl })
   );
-  const [cavos, setCavos] = react.useState(null);
+  const [wallet, setWallet] = react.useState(null);
   const [identity, setIdentity] = react.useState(null);
   const [walletStatus, setWalletStatus] = react.useState(INITIAL_STATUS);
   const [isLoading, setIsLoading] = react.useState(false);
   const [authError, setAuthError] = react.useState(null);
   const [modalOpen, setModalOpen] = react.useState(false);
+  const [passkeySupported, setPasskeySupported] = react.useState(false);
   const [branding, setBranding] = react.useState({});
+  react.useEffect(() => {
+    let cancelled = false;
+    PasskeySigner.isSupported().then((ok) => {
+      if (!cancelled) setPasskeySupported(ok);
+    }).catch(() => {
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
   const configRef = react.useRef(config);
   react.useEffect(() => {
     configRef.current = config;
-  }, [config]);
+  });
   react.useEffect(() => {
     if (!config.appId || typeof window === "undefined") return;
     const base = config.authBackendUrl ?? "https://cavos.xyz";
@@ -2459,41 +3891,52 @@ function CavosProvider({ config, modal, children }) {
   const closeModal = react.useCallback(() => setModalOpen(false), []);
   const clearAuthError = react.useCallback(() => setAuthError(null), []);
   const resendDeviceApproval = react.useCallback(async () => {
-    if (!identity || !cavos || cavos.chain !== "starknet" || !cavos.pendingRequestId) return;
-    const backendUrl = configRef.current.authBackendUrl ?? "https://cavos.xyz";
-    if (!configRef.current.appId) return;
-    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: configRef.current.appId });
+    const cfg = configRef.current;
+    if (!identity || !wallet || wallet.chain !== "starknet" || !wallet.pendingRequestId) return;
+    const backendUrl = cfg.authBackendUrl ?? "https://cavos.xyz";
+    if (!cfg.appId) return;
+    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: cfg.appId });
     await recovery.requestDeviceAddition({
       userId: identity.userId,
-      accountAddress: cavos.address,
-      newSigner: cavos.publicKey,
+      accountAddress: wallet.address,
+      newSigner: wallet.publicKey,
       ...identity.email ? { email: identity.email } : {}
     });
-  }, [identity, cavos]);
-  const connect = react.useCallback(async (id) => {
-    setWalletStatus({ ...INITIAL_STATUS, isDeploying: true });
-    const c = await Cavos.connect({
-      chain: configRef.current.chain ?? "starknet",
-      network: configRef.current.network,
+  }, [identity, wallet]);
+  const connect = react.useCallback(async (id, opts) => {
+    const cfg = configRef.current;
+    if (!opts?.silent) setWalletStatus({ ...INITIAL_STATUS, isDeploying: true });
+    const w = await Cavos.connect({
+      chain: cfg.chain ?? "starknet",
+      network: cfg.network,
       identity: id,
-      appSalt: configRef.current.appSalt,
-      ...configRef.current.paymasterApiKey ? { paymasterApiKey: configRef.current.paymasterApiKey } : {},
-      ...configRef.current.appId ? { appId: configRef.current.appId } : {},
-      ...configRef.current.authBackendUrl ? { backendUrl: configRef.current.authBackendUrl } : {},
-      ...configRef.current.rpcUrl ? { rpcUrl: configRef.current.rpcUrl } : {}
+      appSalt: cfg.appSalt,
+      ...cfg.paymasterApiKey ? { paymasterApiKey: cfg.paymasterApiKey } : {},
+      ...cfg.appId ? { appId: cfg.appId } : {},
+      ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+      ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
     });
-    setCavos(c);
+    setWallet(w);
     setIdentity(id);
-    const pendingRequestId = c.chain === "starknet" ? c.pendingRequestId : null;
+    const pendingRequestId = w.chain === "starknet" ? w.pendingRequestId : null;
+    let hasPasskey = false;
+    if (w.status === "needs-device-approval") {
+      try {
+        hasPasskey = await w.hasPasskey();
+      } catch {
+      }
+    }
     setWalletStatus({
       isDeploying: false,
-      isReady: c.status === "ready",
-      needsDeviceApproval: c.status === "needs-device-approval",
-      awaitingApproval: c.status === "needs-device-approval" && !!pendingRequestId,
-      pendingRequestId
+      isReady: w.status === "ready",
+      needsDeviceApproval: w.status === "needs-device-approval",
+      awaitingApproval: w.status === "needs-device-approval" && !!pendingRequestId,
+      pendingRequestId,
+      hasPasskey,
+      isNewAccount: w.isNewAccount
     });
-    modal?.onSuccess?.(c.address);
-    return c;
+    modal?.onSuccess?.(w.address);
+    return w;
   }, [modal]);
   react.useEffect(() => {
     if (typeof window === "undefined") return;
@@ -2545,57 +3988,122 @@ function CavosProvider({ config, modal, children }) {
     await connect(id);
   }, [auth, connect]);
   const execute = react.useCallback(async (calls) => {
-    if (!cavos) throw new Error("Not logged in");
-    if (cavos.chain !== "starknet") {
+    if (!wallet) throw new Error("Not logged in");
+    if (wallet.chain !== "starknet") {
       throw new Error(
-        "kit: useCavos().execute(calls) is Starknet-only. On Solana use the `wallet` handle: wallet.execute(amount, dest)."
+        "kit: useCavos().execute(calls) is Starknet-only. On Solana/Stellar use the `wallet` handle: wallet.execute(amount, dest)."
       );
     }
-    return cavos.execute(calls);
-  }, [cavos]);
+    return wallet.execute(calls);
+  }, [wallet]);
   const addSigner = react.useCallback(
     async (pubkey) => {
-      if (!cavos) throw new Error("Not logged in");
-      if (cavos.chain !== "starknet") {
-        throw new Error("kit: addSigner via useCavos() is Starknet-only; use the `wallet` handle on Solana.");
+      if (!wallet) throw new Error("Not logged in");
+      if (wallet.chain !== "starknet") {
+        throw new Error("kit: addSigner via useCavos() is Starknet-only; use the `wallet` handle on other chains.");
       }
-      return cavos.addSigner(pubkey);
+      return wallet.addSigner(pubkey);
     },
-    [cavos]
+    [wallet]
   );
+  const enrollPasskey = react.useCallback(
+    async (passkey, params) => {
+      if (!wallet) throw new Error("Not logged in");
+      return wallet.enrollPasskey(passkey, params);
+    },
+    [wallet]
+  );
+  const rpName = branding.appName ?? modal?.appName ?? "Cavos";
+  const enrollPasskeyDefault = react.useCallback(async () => {
+    if (!wallet || !identity) throw new Error("Not logged in");
+    if (wallet.status !== "ready") throw new Error("kit: no ready device to enroll a passkey on");
+    const passkey = new PasskeySigner({ rpName });
+    await wallet.enrollPasskey(passkey, {
+      userId: identity.userId,
+      userName: identity.email ?? identity.userId,
+      ...identity.email ? { displayName: identity.email } : {}
+    });
+  }, [wallet, identity, rpName]);
+  const approveDeviceWithPasskey = react.useCallback(async () => {
+    if (!wallet || !identity) throw new Error("Not logged in");
+    if (wallet.status !== "needs-device-approval") {
+      await connect(identity);
+      return;
+    }
+    const passkey = new PasskeySigner({ rpName });
+    if (wallet.chain === "starknet") {
+      await wallet.approveThisDeviceWithPasskey({ passkey });
+    } else {
+      await wallet.approveThisDeviceWithPasskey(passkey);
+    }
+    setWalletStatus((s) => ({ ...s, isDeploying: true, needsDeviceApproval: false, awaitingApproval: false }));
+    const deadline = Date.now() + 6e4;
+    for (; ; ) {
+      let ready = false;
+      try {
+        ready = await wallet.isReady();
+      } catch {
+      }
+      if (ready) break;
+      if (Date.now() > deadline) {
+        setWalletStatus((s) => ({ ...s, isDeploying: false, needsDeviceApproval: true }));
+        throw new Error(
+          "Your device is being added, but it's taking longer than usual. Please try again in a moment."
+        );
+      }
+      await new Promise((r) => setTimeout(r, 3e3));
+    }
+    await connect(identity, { silent: true });
+  }, [wallet, identity, rpName, connect]);
   const setupRecovery = react.useCallback(async () => {
-    if (!cavos) throw new Error("Not logged in");
+    if (!wallet) throw new Error("Not logged in");
     const code = generateRecoveryCode();
-    await cavos.setupRecovery(code);
+    await wallet.setupRecovery(code);
     return code;
-  }, [cavos]);
+  }, [wallet]);
   const recover = react.useCallback(async (code) => {
     if (!identity) throw new Error("Sign in first so we know which account to recover.");
+    const cfg = configRef.current;
     setAuthError(null);
     setWalletStatus({ ...INITIAL_STATUS, isDeploying: true });
     try {
-      const chain = configRef.current.chain ?? "starknet";
-      const c = chain === "solana" ? await CavosSolana.recover({
-        code,
-        identity,
-        network: configRef.current.network === "mainnet" ? "solana-mainnet" : "solana-devnet",
-        appSalt: configRef.current.appSalt,
-        ...configRef.current.appId ? { appId: configRef.current.appId } : {},
-        ...configRef.current.authBackendUrl ? { backendUrl: configRef.current.authBackendUrl } : {},
-        ...configRef.current.rpcUrl ? { rpcUrl: configRef.current.rpcUrl } : {}
-      }) : await Cavos.recover({
-        code,
-        identity,
-        network: configRef.current.network,
-        appSalt: configRef.current.appSalt,
-        paymasterApiKey: configRef.current.paymasterApiKey ?? "",
-        ...configRef.current.appId ? { appId: configRef.current.appId } : {},
-        ...configRef.current.authBackendUrl ? { backendUrl: configRef.current.authBackendUrl } : {},
-        ...configRef.current.rpcUrl ? { rpcUrl: configRef.current.rpcUrl } : {}
-      });
-      setCavos(c);
+      const chain = cfg.chain ?? "starknet";
+      let w;
+      if (chain === "solana") {
+        w = await CavosSolana.recover({
+          code,
+          identity,
+          network: cfg.network === "mainnet" ? "solana-mainnet" : "solana-devnet",
+          appSalt: cfg.appSalt,
+          ...cfg.appId ? { appId: cfg.appId } : {},
+          ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+          ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
+        });
+      } else if (chain === "stellar") {
+        w = await CavosStellar.recover({
+          code,
+          identity,
+          network: cfg.network === "mainnet" ? "stellar-mainnet" : "stellar-testnet",
+          appSalt: cfg.appSalt,
+          ...cfg.appId ? { appId: cfg.appId } : {},
+          ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+          ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
+        });
+      } else {
+        w = await Cavos.recover({
+          code,
+          identity,
+          network: cfg.network,
+          appSalt: cfg.appSalt,
+          paymasterApiKey: cfg.paymasterApiKey ?? "",
+          ...cfg.appId ? { appId: cfg.appId } : {},
+          ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+          ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
+        });
+      }
+      setWallet(w);
       setWalletStatus({ ...INITIAL_STATUS, isReady: true });
-      modal?.onSuccess?.(c.address);
+      modal?.onSuccess?.(w.address);
     } catch (e) {
       const msg = e instanceof Error ? e.message : "Recovery failed. Check your code and try again.";
       setAuthError(msg);
@@ -2605,9 +4113,10 @@ function CavosProvider({ config, modal, children }) {
   }, [identity, modal]);
   react.useEffect(() => {
     if (!walletStatus.awaitingApproval || !walletStatus.pendingRequestId || !identity) return;
-    if (!configRef.current.appId) return;
-    const backendUrl = configRef.current.authBackendUrl ?? "https://cavos.xyz";
-    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: configRef.current.appId });
+    const cfg = configRef.current;
+    if (!cfg.appId) return;
+    const backendUrl = cfg.authBackendUrl ?? "https://cavos.xyz";
+    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: cfg.appId });
     const requestId = walletStatus.pendingRequestId;
     let cancelled = false;
     const tick = async () => {
@@ -2631,7 +4140,7 @@ function CavosProvider({ config, modal, children }) {
     };
   }, [walletStatus.awaitingApproval, walletStatus.pendingRequestId, identity, connect]);
   const logout = react.useCallback(() => {
-    setCavos(null);
+    setWallet(null);
     setIdentity(null);
     setWalletStatus(INITIAL_STATUS);
     setAuthError(null);
@@ -2639,11 +4148,11 @@ function CavosProvider({ config, modal, children }) {
   const value = {
     openModal,
     closeModal,
-    isAuthenticated: !!cavos,
+    isAuthenticated: !!wallet,
     user: identity ? { userId: identity.userId, email: identity.email, provider: identity.provider } : null,
     chain: config.chain ?? "starknet",
-    wallet: cavos,
-    address: cavos?.address ?? null,
+    wallet,
+    address: wallet?.address ?? null,
     walletStatus,
     isLoading,
     authError,
@@ -2655,6 +4164,10 @@ function CavosProvider({ config, modal, children }) {
     handleCallback,
     execute,
     addSigner,
+    enrollPasskey,
+    passkeySupported,
+    enrollPasskeyDefault,
+    approveDeviceWithPasskey,
     resendDeviceApproval,
     setupRecovery,
     recover,