@cavos/kit 0.0.3 → 0.0.4

package/dist/{Cavos-BH2_tOQ2.d.mts → Cavos-x9qFpOvJ.d.mts}

@@ -209,6 +209,8 @@ declare class SolanaAdapter {
      */
     buildAddSignerViaPasskey(account: string, newSigner: DevicePublicKey, passkey: DevicePublicKey, leaves: Uint8Array[], leafIndex: number, assertion: PasskeyAssertion): TransactionInstruction[];
     /** Read whether `passkey` is a registered approver. */
+    /** True if the account has at least one passkey registered as an approver. */
+    hasPasskeyApprover(account: string): Promise<boolean>;
     isApprover(account: string, passkey: DevicePublicKey): Promise<boolean>;
     /** Read the current passkey-approval nonce. */
     passkeyNonce(account: string): Promise<bigint>;
@@ -413,6 +415,8 @@ declare class CavosSolana {
     private readonly feePayer?;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     readonly chain: "solana";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    isNewAccount: boolean;
     private constructor();
     get publicKey(): DevicePublicKey;
     static connect(opts: ConnectSolanaOptions): Promise<CavosSolana>;
@@ -431,6 +435,12 @@ declare class CavosSolana {
     addApprover(pubkey: DevicePublicKey): Promise<{
         transactionHash?: string;
     }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Used to poll for readiness after a passkey approval before it's indexed. */
+    isReady(): Promise<boolean>;
     /**
      * From a fresh browser (status `needs-device-approval`), approve adding THIS
      * device with the user's synced passkey. Gasless via the relayer — the bundle
@@ -613,6 +623,8 @@ declare class CavosStellar {
     private readonly sourceKeypair?;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     readonly chain: "stellar";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    isNewAccount: boolean;
     private constructor();
     get publicKey(): DevicePublicKey;
     static connect(opts: ConnectStellarOptions): Promise<CavosStellar>;
@@ -631,6 +643,12 @@ declare class CavosStellar {
     addApprover(pubkey: DevicePublicKey): Promise<{
         transactionHash?: string;
     }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Used to poll for readiness after a passkey approval before it's indexed. */
+    isReady(): Promise<boolean>;
     /**
      * From a fresh browser (status `needs-device-approval`), approve adding THIS
      * device using the user's synced passkey. Gasless via the relayer — the call
@@ -863,6 +881,9 @@ declare class Cavos {
     readonly chain: "starknet";
     /** Request id of the pending device-addition, when status is needs-device-approval. */
     pendingRequestId: string | null;
+    /** True when this connect just created & deployed a brand-new account (first
+     * sign-up), so the UI can offer a one-time "secure your account" step. */
+    isNewAccount: boolean;
     private constructor();
     /**
      * Unified entry point. Pick a `chain` and an `network` environment; the kit
@@ -906,6 +927,13 @@ declare class Cavos {
     addApprover(pubkey: DevicePublicKey): Promise<{
         transactionHash?: string;
     }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Cheap and side-effect free — used to poll for readiness after a passkey /
+     * device approval submits, before the new signer is indexed. */
+    isReady(): Promise<boolean>;
     /**
      * From a brand-new browser (status `needs-device-approval`), use the user's
      * synced passkey to authorize adding THIS device — no trip back to an already-
@@ -988,7 +1016,8 @@ interface PasskeyApprovable {
  */
 declare function approveDeviceEverywhere(wallets: PasskeyApprovable[], passkey: PasskeySigner): Promise<{
     chain: string;
-    transactionHash: string;
+    transactionHash?: string;
+    error?: string;
 }[]>;
 
 export { batchChallenge as $, type AuthProvider as A, type RecoverStellarOptions as B, type ChainAdapter as C, type DevicePublicKey as D, type EnrolledPasskey as E, FACTORY_CONTRACT_ID as F, type RecoveryOptions as G, SECP256R1_PROGRAM_ID as H, type Identity as I, SOLANA_NETWORKS as J, STELLAR_NETWORKS as K, SolanaAdapter as L, type SolanaAdapterOptions as M, NATIVE_SAC_ID as N, type SolanaNetwork as O, type PendingDeviceRequest as P, SolanaRelayer as Q, type RegisteredWallet as R, type StellarNetwork as S, type SolanaRelayerOptions as T, StaticIdentity as U, StellarRelayer as V, type WalletRegistry as W, type StellarRelayerOptions as X, anchorDiscriminator as Y, approveDeviceEverywhere as Z, base64urlEncode as _, type RecoveryClient as a, buildSecp256r1Instruction as a0, compressedPubkey as a1, encodeLowSSignature as a2, lowS as a3, recoverCandidatePublicKeys as a4, serializeInstructions as a5, webauthnDigest as a6, type DeviceSigner as b, type DeviceSignature as c, type ComputeAddressParams as d, type ChainCall as e, type PasskeyAssertion as f, Cavos as g, CavosSolana as h, CavosStellar as i, type CavosWallet as j, type Chain as k, type ConnectOptions as l, type ConnectSolanaOptions as m, type ConnectStatus as n, type ConnectStellarOptions as o, DEVICE_ACCOUNT_PROGRAM_ID as p, DEVICE_ACCOUNT_WASM_HASH as q, InMemoryWalletRegistry as r, type InstructionAccount as s, type InstructionData as t, type NetworkEnv as u, type PasskeyApprovable as v, type PasskeyEnrollParams as w, PasskeySigner as x, type PasskeySignerOptions as y, type RecoverSolanaOptions as z };

package/dist/{Cavos-BH2_tOQ2.d.ts → Cavos-x9qFpOvJ.d.ts}

@@ -209,6 +209,8 @@ declare class SolanaAdapter {
      */
     buildAddSignerViaPasskey(account: string, newSigner: DevicePublicKey, passkey: DevicePublicKey, leaves: Uint8Array[], leafIndex: number, assertion: PasskeyAssertion): TransactionInstruction[];
     /** Read whether `passkey` is a registered approver. */
+    /** True if the account has at least one passkey registered as an approver. */
+    hasPasskeyApprover(account: string): Promise<boolean>;
     isApprover(account: string, passkey: DevicePublicKey): Promise<boolean>;
     /** Read the current passkey-approval nonce. */
     passkeyNonce(account: string): Promise<bigint>;
@@ -413,6 +415,8 @@ declare class CavosSolana {
     private readonly feePayer?;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     readonly chain: "solana";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    isNewAccount: boolean;
     private constructor();
     get publicKey(): DevicePublicKey;
     static connect(opts: ConnectSolanaOptions): Promise<CavosSolana>;
@@ -431,6 +435,12 @@ declare class CavosSolana {
     addApprover(pubkey: DevicePublicKey): Promise<{
         transactionHash?: string;
     }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Used to poll for readiness after a passkey approval before it's indexed. */
+    isReady(): Promise<boolean>;
     /**
      * From a fresh browser (status `needs-device-approval`), approve adding THIS
      * device with the user's synced passkey. Gasless via the relayer — the bundle
@@ -613,6 +623,8 @@ declare class CavosStellar {
     private readonly sourceKeypair?;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     readonly chain: "stellar";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    isNewAccount: boolean;
     private constructor();
     get publicKey(): DevicePublicKey;
     static connect(opts: ConnectStellarOptions): Promise<CavosStellar>;
@@ -631,6 +643,12 @@ declare class CavosStellar {
     addApprover(pubkey: DevicePublicKey): Promise<{
         transactionHash?: string;
     }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Used to poll for readiness after a passkey approval before it's indexed. */
+    isReady(): Promise<boolean>;
     /**
      * From a fresh browser (status `needs-device-approval`), approve adding THIS
      * device using the user's synced passkey. Gasless via the relayer — the call
@@ -863,6 +881,9 @@ declare class Cavos {
     readonly chain: "starknet";
     /** Request id of the pending device-addition, when status is needs-device-approval. */
     pendingRequestId: string | null;
+    /** True when this connect just created & deployed a brand-new account (first
+     * sign-up), so the UI can offer a one-time "secure your account" step. */
+    isNewAccount: boolean;
     private constructor();
     /**
      * Unified entry point. Pick a `chain` and an `network` environment; the kit
@@ -906,6 +927,13 @@ declare class Cavos {
     addApprover(pubkey: DevicePublicKey): Promise<{
         transactionHash?: string;
     }>;
+    /** True if this account already has a passkey enrolled as an approver, so a
+     * new device can be approved with the passkey instead of the email flow. */
+    hasPasskey(): Promise<boolean>;
+    /** Re-read (from chain) whether THIS device is now an authorized signer.
+     * Cheap and side-effect free — used to poll for readiness after a passkey /
+     * device approval submits, before the new signer is indexed. */
+    isReady(): Promise<boolean>;
     /**
      * From a brand-new browser (status `needs-device-approval`), use the user's
      * synced passkey to authorize adding THIS device — no trip back to an already-
@@ -988,7 +1016,8 @@ interface PasskeyApprovable {
  */
 declare function approveDeviceEverywhere(wallets: PasskeyApprovable[], passkey: PasskeySigner): Promise<{
     chain: string;
-    transactionHash: string;
+    transactionHash?: string;
+    error?: string;
 }[]>;
 
 export { batchChallenge as $, type AuthProvider as A, type RecoverStellarOptions as B, type ChainAdapter as C, type DevicePublicKey as D, type EnrolledPasskey as E, FACTORY_CONTRACT_ID as F, type RecoveryOptions as G, SECP256R1_PROGRAM_ID as H, type Identity as I, SOLANA_NETWORKS as J, STELLAR_NETWORKS as K, SolanaAdapter as L, type SolanaAdapterOptions as M, NATIVE_SAC_ID as N, type SolanaNetwork as O, type PendingDeviceRequest as P, SolanaRelayer as Q, type RegisteredWallet as R, type StellarNetwork as S, type SolanaRelayerOptions as T, StaticIdentity as U, StellarRelayer as V, type WalletRegistry as W, type StellarRelayerOptions as X, anchorDiscriminator as Y, approveDeviceEverywhere as Z, base64urlEncode as _, type RecoveryClient as a, buildSecp256r1Instruction as a0, compressedPubkey as a1, encodeLowSSignature as a2, lowS as a3, recoverCandidatePublicKeys as a4, serializeInstructions as a5, webauthnDigest as a6, type DeviceSigner as b, type DeviceSignature as c, type ComputeAddressParams as d, type ChainCall as e, type PasskeyAssertion as f, Cavos as g, CavosSolana as h, CavosStellar as i, type CavosWallet as j, type Chain as k, type ConnectOptions as l, type ConnectSolanaOptions as m, type ConnectStatus as n, type ConnectStellarOptions as o, DEVICE_ACCOUNT_PROGRAM_ID as p, DEVICE_ACCOUNT_WASM_HASH as q, InMemoryWalletRegistry as r, type InstructionAccount as s, type InstructionData as t, type NetworkEnv as u, type PasskeyApprovable as v, type PasskeyEnrollParams as w, PasskeySigner as x, type PasskeySignerOptions as y, type RecoverSolanaOptions as z };

package/dist/{chunk-BNGLH3Q3.mjs → chunk-F2J25XSL.mjs}

@@ -254,6 +254,17 @@ var StarknetAdapter = class {
     });
     return BigInt(res[0] ?? 0) !== 0n;
   }
+  /** True if the account has at least one passkey registered as an approver.
+   * Lets the UI decide whether to offer passkey approval before prompting. */
+  async hasPasskeyApprover(accountAddress) {
+    if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
+    const res = await this.opts.provider.callContract({
+      contractAddress: accountAddress,
+      entrypoint: "get_approver_count",
+      calldata: []
+    });
+    return BigInt(res[0] ?? 0) > 0n;
+  }
   async getPasskeyNonce(accountAddress) {
     if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
     const res = await this.opts.provider.callContract({
@@ -590,6 +601,11 @@ var SolanaAdapter = class {
     return [precompileIx, ix];
   }
   /** Read whether `passkey` is a registered approver. */
+  /** True if the account has at least one passkey registered as an approver. */
+  async hasPasskeyApprover(account) {
+    const approvers = await this.fetchApprovers(new PublicKey(account));
+    return approvers.length > 0;
+  }
   async isApprover(account, passkey) {
     const approvers = await this.fetchApprovers(new PublicKey(account));
     const target = Buffer.from(compressedPubkey(passkey)).toString("hex");
@@ -808,8 +824,8 @@ function u64le(n) {
   new DataView(b.buffer, b.byteOffset, 8).setBigUint64(0, BigInt(n), true);
   return b;
 }
-function readU64le(buf, offset) {
-  return new DataView(buf.buffer, buf.byteOffset, buf.length).getBigUint64(
+function readU64le(buf2, offset) {
+  return new DataView(buf2.buffer, buf2.byteOffset, buf2.length).getBigUint64(
     offset,
     true
   );
@@ -1280,6 +1296,8 @@ var CavosSolana = class _CavosSolana {
     this.feePayer = feePayer;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     this.chain = "solana";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    this.isNewAccount = false;
   }
   get publicKey() {
     return this.devicePubkey;
@@ -1330,7 +1348,7 @@ var CavosSolana = class _CavosSolana {
     }
     await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
     const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey);
-    return new _CavosSolana(
+    const wallet = new _CavosSolana(
       identity,
       address,
       isSigner ? "ready" : "needs-device-approval",
@@ -1340,6 +1358,8 @@ var CavosSolana = class _CavosSolana {
       relayer,
       opts.feePayer
     );
+    wallet.isNewAccount = !deployed && isSigner;
+    return wallet;
   }
   /** Authorize an additional device signer (device-signed via precompile). */
   async addSigner(pubkey) {
@@ -1366,6 +1386,16 @@ var CavosSolana = class _CavosSolana {
     const transactionHash = await this.send(ixs);
     return { transactionHash };
   }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    return this.adapter.hasPasskeyApprover(this.address);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Used to poll for readiness after a passkey approval before it's indexed. */
+  async isReady() {
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey);
+  }
   /**
    * From a fresh browser (status `needs-device-approval`), approve adding THIS
    * device with the user's synced passkey. Gasless via the relayer — the bundle
@@ -1655,6 +1685,25 @@ var StellarAdapter = class {
     ]);
   }
   /** Read whether `passkey` is a registered approver (read-only simulation). */
+  /** True if the account has at least one passkey registered as an approver.
+   * Reads the contract's `approvers` view and checks the list is non-empty. */
+  async hasPasskeyApprover(accountAddress, readSource) {
+    if (!await this.isDeployed(accountAddress)) return false;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = Operation.invokeHostFunction({
+      func: invokeFunc(accountAddress, "approvers", []),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: approvers simulation failed: ${sim.error}`);
+    }
+    if (!sim.result?.retval) return false;
+    const list = scValToNative(sim.result.retval);
+    return Array.isArray(list) && list.length > 0;
+  }
   async isApprover(accountAddress, passkey, readSource) {
     if (!await this.isDeployed(accountAddress)) return false;
     const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
@@ -1857,6 +1906,8 @@ var CavosStellar = class _CavosStellar {
     this.sourceKeypair = sourceKeypair;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     this.chain = "stellar";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    this.isNewAccount = false;
   }
   get publicKey() {
     return this.devicePubkey;
@@ -1885,13 +1936,16 @@ var CavosStellar = class _CavosStellar {
       return build(existing.address, isSigner2 ? "ready" : "needs-device-approval");
     }
     const address = adapter.computeAddress(addressSeed, devicePubkey);
-    if (!await adapter.isDeployed(address)) {
+    const wasDeployed = await adapter.isDeployed(address);
+    if (!wasDeployed) {
       const func = adapter.buildDeploy(addressSeed, devicePubkey);
       await self.submitHostFunction(func, void 0);
     }
     await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
     const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey, readSource);
-    return build(address, isSigner ? "ready" : "needs-device-approval");
+    const wallet = build(address, isSigner ? "ready" : "needs-device-approval");
+    wallet.isNewAccount = !wasDeployed && isSigner;
+    return wallet;
   }
   /** Authorize an additional device signer (device-signed via `__check_auth`). */
   async addSigner(pubkey) {
@@ -1919,6 +1973,18 @@ var CavosStellar = class _CavosStellar {
     const transactionHash = await this.submitHostFunction(func, this.address);
     return { transactionHash };
   }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    const readSource = await this.resolveSource();
+    return this.adapter.hasPasskeyApprover(this.address, readSource);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Used to poll for readiness after a passkey approval before it's indexed. */
+  async isReady() {
+    const readSource = await this.resolveSource();
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey, readSource);
+  }
   /**
    * From a fresh browser (status `needs-device-approval`), approve adding THIS
    * device using the user's synced passkey. Gasless via the relayer — the call
@@ -2226,6 +2292,9 @@ var Cavos = class _Cavos {
     this.chain = "starknet";
     /** Request id of the pending device-addition, when status is needs-device-approval. */
     this.pendingRequestId = null;
+    /** True when this connect just created & deployed a brand-new account (first
+     * sign-up), so the UI can offer a one-time "secure your account" step. */
+    this.isNewAccount = false;
   }
   /**
    * Unified entry point. Pick a `chain` and an `network` environment; the kit
@@ -2321,7 +2390,7 @@ var Cavos = class _Cavos {
     if (existing) {
       const account2 = makeAccount(existing.address);
       const isSigner2 = await adapter.isAuthorizedSigner(existing.address, devicePubkey);
-      const cavos = new _Cavos(
+      const cavos2 = new _Cavos(
         identity,
         existing.address,
         isSigner2 ? "ready" : "needs-device-approval",
@@ -2335,7 +2404,7 @@ var Cavos = class _Cavos {
         const fresh = dedup && Date.now() - dedup.requestedAt < DEVICE_REQUEST_DEDUP_MS;
         try {
           if (fresh) {
-            cavos.pendingRequestId = dedup.requestId;
+            cavos2.pendingRequestId = dedup.requestId;
           } else {
             const { requestId } = await recovery.requestDeviceAddition({
               userId: identity.userId,
@@ -2343,14 +2412,14 @@ var Cavos = class _Cavos {
               newSigner: devicePubkey,
               ...identity.email ? { email: identity.email } : {}
             });
-            cavos.pendingRequestId = requestId;
+            cavos2.pendingRequestId = requestId;
             lastDeviceRequest.set(identity.userId, { requestId, requestedAt: Date.now() });
           }
         } catch (e) {
           console.warn("[Cavos] requestDeviceAddition failed:", e);
         }
       }
-      return cavos;
+      return cavos2;
     }
     const address = adapter.computeAddress({ addressSeed, initialSigner: devicePubkey });
     const account = makeAccount(address);
@@ -2381,7 +2450,7 @@ var Cavos = class _Cavos {
       console.warn("[Cavos] isAuthorizedSigner read failed:", e);
       isSigner = !alreadyDeployed;
     }
-    return new _Cavos(
+    const cavos = new _Cavos(
       identity,
       address,
       isSigner ? "ready" : "needs-device-approval",
@@ -2390,6 +2459,8 @@ var Cavos = class _Cavos {
       devicePubkey,
       paymasterConfig
     );
+    cavos.isNewAccount = !alreadyDeployed && isSigner;
+    return cavos;
   }
   /** This device's public key (e.g. to request addition to an existing wallet). */
   get publicKey() {
@@ -2435,8 +2506,24 @@ var Cavos = class _Cavos {
     const { transactionHash } = await this.execute([
       this.adapter.buildAddApprover(this.address, pubkey)
     ]);
+    try {
+      await this.account.waitForTransaction(transactionHash);
+    } catch (e) {
+      console.warn("[Cavos] add_approver receipt wait failed:", e);
+    }
     return { transactionHash };
   }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    return this.adapter.hasPasskeyApprover(this.address);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Cheap and side-effect free — used to poll for readiness after a passkey /
+   * device approval submits, before the new signer is indexed. */
+  async isReady() {
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey);
+  }
   /**
    * From a brand-new browser (status `needs-device-approval`), use the user's
    * synced passkey to authorize adding THIS device — no trip back to an already-
@@ -2588,17 +2675,15 @@ async function approveDeviceEverywhere(wallets, passkey) {
   const infos = await Promise.all(targets.map((w) => w.passkeyLeafForThisDevice()));
   const leaves = infos.map((i) => i.leaf);
   const assertion = await passkey.assert(batchChallenge(leaves));
-  const out = [];
-  for (let i = 0; i < targets.length; i++) {
-    const { transactionHash } = await targets[i].submitPasskeyApproval(
-      assertion,
-      leaves,
-      i,
-      infos[i].nonce
-    );
-    out.push({ chain: targets[i].chain, transactionHash });
-  }
-  return out;
+  const settled = await Promise.allSettled(
+    targets.map((w, i) => w.submitPasskeyApproval(assertion, leaves, i, infos[i].nonce))
+  );
+  return settled.map(
+    (r, i) => r.status === "fulfilled" ? { chain: targets[i].chain, transactionHash: r.value.transactionHash } : {
+      chain: targets[i].chain,
+      error: r.reason instanceof Error ? r.reason.message : String(r.reason)
+    }
+  );
 }
 async function paymasterExecuteDirect(paymaster, userAddress, call) {
   const body = {
@@ -2771,7 +2856,91 @@ function bytesToChunks(bytes) {
   for (const b of bytes.subarray(0, 31)) w = w << 8n | BigInt(b);
   return w;
 }
+var PasskeySigner = class {
+  constructor(opts = {}) {
+    if (typeof window === "undefined" || !navigator.credentials) {
+      throw new Error("kit/passkey: WebAuthn is only available in a browser");
+    }
+    this.rpId = opts.rpId ?? window.location.hostname;
+    this.rpName = opts.rpName ?? this.rpId;
+    if (isIpAddress(this.rpId)) {
+      throw new Error(
+        `kit/passkey: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) \u2014 or pass an explicit \`rpId\`. (The silent device key works over an IP; passkeys don't.)`
+      );
+    }
+  }
+  /** True if this platform advertises a usable passkey (platform authenticator). */
+  static async isSupported() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) return false;
+    try {
+      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    } catch {
+      return false;
+    }
+  }
+  /** Create a new synced passkey and return its P-256 public key. */
+  async enroll(params) {
+    const challenge = crypto.getRandomValues(new Uint8Array(32));
+    const cred = await navigator.credentials.create({
+      publicKey: {
+        challenge: buf(challenge),
+        rp: { id: this.rpId, name: this.rpName },
+        user: {
+          id: buf(userHandle(params.userId)),
+          name: params.userName,
+          displayName: params.displayName ?? params.userName
+        },
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        // ES256 (P-256)
+        authenticatorSelection: {
+          residentKey: "required",
+          requireResidentKey: true,
+          userVerification: "preferred"
+        },
+        attestation: "none"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: enrollment cancelled");
+    const response = cred.response;
+    const spki = new Uint8Array(response.getPublicKey());
+    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };
+  }
+  /**
+   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller
+   * derives from the signer being added + the on-chain nonce). Uses discoverable
+   * credentials — no `allowCredentials` — so it works on a brand-new browser.
+   */
+  async assert(challenge) {
+    const cred = await navigator.credentials.get({
+      publicKey: {
+        challenge: buf(challenge),
+        rpId: this.rpId,
+        allowCredentials: [],
+        userVerification: "preferred"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: assertion cancelled");
+    const response = cred.response;
+    const authenticatorData = new Uint8Array(response.authenticatorData);
+    const clientDataJSON = new Uint8Array(response.clientDataJSON);
+    const { r, s } = derToRs(new Uint8Array(response.signature));
+    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));
+    return { authenticatorData, clientDataJSON, r, s, challengeOffset };
+  }
+};
+function isIpAddress(host) {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.includes(":")) return true;
+  return false;
+}
+function userHandle(userId) {
+  const bytes = new TextEncoder().encode(userId);
+  return bytes.length <= 64 ? bytes : sha256(bytes);
+}
+function buf(bytes) {
+  return bytes.slice();
+}
 
-export { BackupSigner, Cavos, CavosAuth, CavosSolana, CavosStellar, DEVICE_ACCOUNT_CLASS_HASH, DEVICE_ACCOUNT_PROGRAM_ID, DEVICE_ACCOUNT_WASM_HASH, FACTORY_CONTRACT_ID, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, NATIVE_SAC_ID, SECP256R1_PROGRAM_ID, SOLANA_NETWORKS, STARKNET_NETWORKS, STELLAR_NETWORKS, SolanaAdapter, SolanaRelayer, StarknetAdapter, StarknetDeviceSigner, StellarAdapter, StellarRelayer, UDC_ADDRESS, WebCryptoSigner, anchorDiscriminator, approveDeviceEverywhere, base64urlEncode, batchChallenge, bigIntTo32Bytes, buildSecp256r1Instruction, bytesToBigInt, bytesToHex, challengeOffsetOf, compressedPubkey, derToRs, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, deviceSignatureScVal, encodeLowSSignature, encodeLowSSignature2, generateRecoveryCode, hexToBytes, lowS, recoverCandidatePublicKeys, recoverYParity, sec1Pubkey, serializeInstructions, signatureToFelts, spkiToPublicKey, u256ToFelts, webauthnDigest };
-//# sourceMappingURL=chunk-BNGLH3Q3.mjs.map
-//# sourceMappingURL=chunk-BNGLH3Q3.mjs.map
+export { BackupSigner, Cavos, CavosAuth, CavosSolana, CavosStellar, DEVICE_ACCOUNT_CLASS_HASH, DEVICE_ACCOUNT_PROGRAM_ID, DEVICE_ACCOUNT_WASM_HASH, FACTORY_CONTRACT_ID, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, NATIVE_SAC_ID, PasskeySigner, SECP256R1_PROGRAM_ID, SOLANA_NETWORKS, STARKNET_NETWORKS, STELLAR_NETWORKS, SolanaAdapter, SolanaRelayer, StarknetAdapter, StarknetDeviceSigner, StellarAdapter, StellarRelayer, UDC_ADDRESS, WebCryptoSigner, anchorDiscriminator, approveDeviceEverywhere, base64urlEncode, batchChallenge, bigIntTo32Bytes, buildSecp256r1Instruction, bytesToBigInt, bytesToHex, compressedPubkey, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, deviceSignatureScVal, encodeLowSSignature, encodeLowSSignature2, generateRecoveryCode, hexToBytes, lowS, recoverCandidatePublicKeys, recoverYParity, sec1Pubkey, serializeInstructions, signatureToFelts, u256ToFelts, webauthnDigest };
+//# sourceMappingURL=chunk-F2J25XSL.mjs.map
+//# sourceMappingURL=chunk-F2J25XSL.mjs.map