@cavos/kit 0.0.3 → 0.0.4

package/dist/react/index.js

@@ -252,6 +252,17 @@ var StarknetAdapter = class {
     });
     return BigInt(res[0] ?? 0) !== 0n;
   }
+  /** True if the account has at least one passkey registered as an approver.
+   * Lets the UI decide whether to offer passkey approval before prompting. */
+  async hasPasskeyApprover(accountAddress) {
+    if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
+    const res = await this.opts.provider.callContract({
+      contractAddress: accountAddress,
+      entrypoint: "get_approver_count",
+      calldata: []
+    });
+    return BigInt(res[0] ?? 0) > 0n;
+  }
   async getPasskeyNonce(accountAddress) {
     if (!this.opts.provider) throw new Error("kit/starknet: provider required for reads");
     const res = await this.opts.provider.callContract({
@@ -590,6 +601,11 @@ var SolanaAdapter = class {
     return [precompileIx, ix];
   }
   /** Read whether `passkey` is a registered approver. */
+  /** True if the account has at least one passkey registered as an approver. */
+  async hasPasskeyApprover(account) {
+    const approvers = await this.fetchApprovers(new web3_js.PublicKey(account));
+    return approvers.length > 0;
+  }
   async isApprover(account, passkey) {
     const approvers = await this.fetchApprovers(new web3_js.PublicKey(account));
     const target = Buffer.from(compressedPubkey(passkey)).toString("hex");
@@ -808,8 +824,8 @@ function u64le(n) {
   new DataView(b.buffer, b.byteOffset, 8).setBigUint64(0, BigInt(n), true);
   return b;
 }
-function readU64le(buf, offset) {
-  return new DataView(buf.buffer, buf.byteOffset, buf.length).getBigUint64(
+function readU64le(buf2, offset) {
+  return new DataView(buf2.buffer, buf2.byteOffset, buf2.length).getBigUint64(
     offset,
     true
   );
@@ -1197,6 +1213,39 @@ var WORDLIST = [
   "beach",
   "dusk"
 ];
+function base64urlEncode(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  const b64 = typeof btoa !== "undefined" ? btoa(bin) : Buffer.from(bytes).toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function derToRs(der) {
+  let i = 0;
+  if (der[i++] !== 48) throw new Error("kit/webauthn: bad DER (no SEQUENCE)");
+  if (der[i] & 128) i += 1 + (der[i] & 127);
+  else i += 1;
+  if (der[i++] !== 2) throw new Error("kit/webauthn: bad DER (no r INTEGER)");
+  const rlen = der[i++];
+  const r = bytesToBigInt(der.subarray(i, i + rlen));
+  i += rlen;
+  if (der[i++] !== 2) throw new Error("kit/webauthn: bad DER (no s INTEGER)");
+  const slen = der[i++];
+  const s = bytesToBigInt(der.subarray(i, i + slen));
+  return { r, s };
+}
+function spkiToPublicKey(spki) {
+  const idx = spki.lastIndexOf(4, spki.length - 65);
+  const start = spki.length - 65;
+  const prefix = spki[start];
+  if (prefix !== 4) {
+    if (idx < 0) throw new Error("kit/webauthn: no uncompressed EC point in SPKI");
+    return { x: bytesToBigInt(spki.subarray(idx + 1, idx + 33)), y: bytesToBigInt(spki.subarray(idx + 33, idx + 65)) };
+  }
+  return {
+    x: bytesToBigInt(spki.subarray(start + 1, start + 33)),
+    y: bytesToBigInt(spki.subarray(start + 33, start + 65))
+  };
+}
 function batchChallenge(leaves) {
   const total = leaves.reduce((n, l) => n + l.length, 0);
   const cat = new Uint8Array(total);
@@ -1225,6 +1274,12 @@ function recoverCandidatePublicKeys(r, s, digest) {
   }
   return out;
 }
+function challengeOffsetOf(clientDataJSON, challengeB64) {
+  const text = new TextDecoder().decode(clientDataJSON);
+  const idx = text.indexOf(challengeB64);
+  if (idx < 0) throw new Error("kit/webauthn: challenge not found in clientDataJSON");
+  return idx;
+}
 
 // src/chains/solana/CavosSolana.ts
 var CavosSolana = class _CavosSolana {
@@ -1239,6 +1294,8 @@ var CavosSolana = class _CavosSolana {
     this.feePayer = feePayer;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     this.chain = "solana";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    this.isNewAccount = false;
   }
   get publicKey() {
     return this.devicePubkey;
@@ -1289,7 +1346,7 @@ var CavosSolana = class _CavosSolana {
     }
     await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
     const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey);
-    return new _CavosSolana(
+    const wallet = new _CavosSolana(
       identity,
       address,
       isSigner ? "ready" : "needs-device-approval",
@@ -1299,6 +1356,8 @@ var CavosSolana = class _CavosSolana {
       relayer,
       opts.feePayer
     );
+    wallet.isNewAccount = !deployed && isSigner;
+    return wallet;
   }
   /** Authorize an additional device signer (device-signed via precompile). */
   async addSigner(pubkey) {
@@ -1325,6 +1384,16 @@ var CavosSolana = class _CavosSolana {
     const transactionHash = await this.send(ixs);
     return { transactionHash };
   }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    return this.adapter.hasPasskeyApprover(this.address);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Used to poll for readiness after a passkey approval before it's indexed. */
+  async isReady() {
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey);
+  }
   /**
    * From a fresh browser (status `needs-device-approval`), approve adding THIS
    * device with the user's synced passkey. Gasless via the relayer — the bundle
@@ -1612,6 +1681,25 @@ var StellarAdapter = class {
     ]);
   }
   /** Read whether `passkey` is a registered approver (read-only simulation). */
+  /** True if the account has at least one passkey registered as an approver.
+   * Reads the contract's `approvers` view and checks the list is non-empty. */
+  async hasPasskeyApprover(accountAddress, readSource) {
+    if (!await this.isDeployed(accountAddress)) return false;
+    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
+    const src = new Account3(readSource, "0");
+    const op = stellarSdk.Operation.invokeHostFunction({
+      func: invokeFunc(accountAddress, "approvers", []),
+      auth: []
+    });
+    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
+    const sim = await this.server().simulateTransaction(tx2);
+    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
+      throw new Error(`kit/stellar: approvers simulation failed: ${sim.error}`);
+    }
+    if (!sim.result?.retval) return false;
+    const list = stellarSdk.scValToNative(sim.result.retval);
+    return Array.isArray(list) && list.length > 0;
+  }
   async isApprover(accountAddress, passkey, readSource) {
     if (!await this.isDeployed(accountAddress)) return false;
     const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
@@ -1816,6 +1904,8 @@ var CavosStellar = class _CavosStellar {
     this.sourceKeypair = sourceKeypair;
     /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
     this.chain = "stellar";
+    /** True when this connect just created a brand-new account (first sign-up). */
+    this.isNewAccount = false;
   }
   get publicKey() {
     return this.devicePubkey;
@@ -1844,13 +1934,16 @@ var CavosStellar = class _CavosStellar {
       return build(existing.address, isSigner2 ? "ready" : "needs-device-approval");
     }
     const address = adapter.computeAddress(addressSeed, devicePubkey);
-    if (!await adapter.isDeployed(address)) {
+    const wasDeployed = await adapter.isDeployed(address);
+    if (!wasDeployed) {
       const func = adapter.buildDeploy(addressSeed, devicePubkey);
       await self.submitHostFunction(func, void 0);
     }
     await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
     const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey, readSource);
-    return build(address, isSigner ? "ready" : "needs-device-approval");
+    const wallet = build(address, isSigner ? "ready" : "needs-device-approval");
+    wallet.isNewAccount = !wasDeployed && isSigner;
+    return wallet;
   }
   /** Authorize an additional device signer (device-signed via `__check_auth`). */
   async addSigner(pubkey) {
@@ -1878,6 +1971,18 @@ var CavosStellar = class _CavosStellar {
     const transactionHash = await this.submitHostFunction(func, this.address);
     return { transactionHash };
   }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    const readSource = await this.resolveSource();
+    return this.adapter.hasPasskeyApprover(this.address, readSource);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Used to poll for readiness after a passkey approval before it's indexed. */
+  async isReady() {
+    const readSource = await this.resolveSource();
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey, readSource);
+  }
   /**
    * From a fresh browser (status `needs-device-approval`), approve adding THIS
    * device using the user's synced passkey. Gasless via the relayer — the call
@@ -2187,6 +2292,9 @@ var Cavos = class _Cavos {
     this.chain = "starknet";
     /** Request id of the pending device-addition, when status is needs-device-approval. */
     this.pendingRequestId = null;
+    /** True when this connect just created & deployed a brand-new account (first
+     * sign-up), so the UI can offer a one-time "secure your account" step. */
+    this.isNewAccount = false;
   }
   /**
    * Unified entry point. Pick a `chain` and an `network` environment; the kit
@@ -2282,7 +2390,7 @@ var Cavos = class _Cavos {
     if (existing) {
       const account2 = makeAccount(existing.address);
       const isSigner2 = await adapter.isAuthorizedSigner(existing.address, devicePubkey);
-      const cavos = new _Cavos(
+      const cavos2 = new _Cavos(
         identity,
         existing.address,
         isSigner2 ? "ready" : "needs-device-approval",
@@ -2296,7 +2404,7 @@ var Cavos = class _Cavos {
         const fresh = dedup && Date.now() - dedup.requestedAt < DEVICE_REQUEST_DEDUP_MS;
         try {
           if (fresh) {
-            cavos.pendingRequestId = dedup.requestId;
+            cavos2.pendingRequestId = dedup.requestId;
           } else {
             const { requestId } = await recovery.requestDeviceAddition({
               userId: identity.userId,
@@ -2304,14 +2412,14 @@ var Cavos = class _Cavos {
               newSigner: devicePubkey,
               ...identity.email ? { email: identity.email } : {}
             });
-            cavos.pendingRequestId = requestId;
+            cavos2.pendingRequestId = requestId;
             lastDeviceRequest.set(identity.userId, { requestId, requestedAt: Date.now() });
           }
         } catch (e) {
           console.warn("[Cavos] requestDeviceAddition failed:", e);
         }
       }
-      return cavos;
+      return cavos2;
     }
     const address = adapter.computeAddress({ addressSeed, initialSigner: devicePubkey });
     const account = makeAccount(address);
@@ -2342,7 +2450,7 @@ var Cavos = class _Cavos {
       console.warn("[Cavos] isAuthorizedSigner read failed:", e);
       isSigner = !alreadyDeployed;
     }
-    return new _Cavos(
+    const cavos = new _Cavos(
       identity,
       address,
       isSigner ? "ready" : "needs-device-approval",
@@ -2351,6 +2459,8 @@ var Cavos = class _Cavos {
       devicePubkey,
       paymasterConfig
     );
+    cavos.isNewAccount = !alreadyDeployed && isSigner;
+    return cavos;
   }
   /** This device's public key (e.g. to request addition to an existing wallet). */
   get publicKey() {
@@ -2396,8 +2506,24 @@ var Cavos = class _Cavos {
     const { transactionHash } = await this.execute([
       this.adapter.buildAddApprover(this.address, pubkey)
     ]);
+    try {
+      await this.account.waitForTransaction(transactionHash);
+    } catch (e) {
+      console.warn("[Cavos] add_approver receipt wait failed:", e);
+    }
     return { transactionHash };
   }
+  /** True if this account already has a passkey enrolled as an approver, so a
+   * new device can be approved with the passkey instead of the email flow. */
+  async hasPasskey() {
+    return this.adapter.hasPasskeyApprover(this.address);
+  }
+  /** Re-read (from chain) whether THIS device is now an authorized signer.
+   * Cheap and side-effect free — used to poll for readiness after a passkey /
+   * device approval submits, before the new signer is indexed. */
+  async isReady() {
+    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey);
+  }
   /**
    * From a brand-new browser (status `needs-device-approval`), use the user's
    * synced passkey to authorize adding THIS device — no trip back to an already-
@@ -2714,6 +2840,90 @@ function bytesToChunks(bytes) {
   for (const b of bytes.subarray(0, 31)) w = w << 8n | BigInt(b);
   return w;
 }
+var PasskeySigner = class {
+  constructor(opts = {}) {
+    if (typeof window === "undefined" || !navigator.credentials) {
+      throw new Error("kit/passkey: WebAuthn is only available in a browser");
+    }
+    this.rpId = opts.rpId ?? window.location.hostname;
+    this.rpName = opts.rpName ?? this.rpId;
+    if (isIpAddress(this.rpId)) {
+      throw new Error(
+        `kit/passkey: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) \u2014 or pass an explicit \`rpId\`. (The silent device key works over an IP; passkeys don't.)`
+      );
+    }
+  }
+  /** True if this platform advertises a usable passkey (platform authenticator). */
+  static async isSupported() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) return false;
+    try {
+      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    } catch {
+      return false;
+    }
+  }
+  /** Create a new synced passkey and return its P-256 public key. */
+  async enroll(params) {
+    const challenge = crypto.getRandomValues(new Uint8Array(32));
+    const cred = await navigator.credentials.create({
+      publicKey: {
+        challenge: buf(challenge),
+        rp: { id: this.rpId, name: this.rpName },
+        user: {
+          id: buf(userHandle(params.userId)),
+          name: params.userName,
+          displayName: params.displayName ?? params.userName
+        },
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        // ES256 (P-256)
+        authenticatorSelection: {
+          residentKey: "required",
+          requireResidentKey: true,
+          userVerification: "preferred"
+        },
+        attestation: "none"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: enrollment cancelled");
+    const response = cred.response;
+    const spki = new Uint8Array(response.getPublicKey());
+    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };
+  }
+  /**
+   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller
+   * derives from the signer being added + the on-chain nonce). Uses discoverable
+   * credentials — no `allowCredentials` — so it works on a brand-new browser.
+   */
+  async assert(challenge) {
+    const cred = await navigator.credentials.get({
+      publicKey: {
+        challenge: buf(challenge),
+        rpId: this.rpId,
+        allowCredentials: [],
+        userVerification: "preferred"
+      }
+    });
+    if (!cred) throw new Error("kit/passkey: assertion cancelled");
+    const response = cred.response;
+    const authenticatorData = new Uint8Array(response.authenticatorData);
+    const clientDataJSON = new Uint8Array(response.clientDataJSON);
+    const { r, s } = derToRs(new Uint8Array(response.signature));
+    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));
+    return { authenticatorData, clientDataJSON, r, s, challengeOffset };
+  }
+};
+function isIpAddress(host) {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.includes(":")) return true;
+  return false;
+}
+function userHandle(userId) {
+  const bytes = new TextEncoder().encode(userId);
+  return bytes.length <= 64 ? bytes : sha256.sha256(bytes);
+}
+function buf(bytes) {
+  return bytes.slice();
+}
 var cavosLogoBase64 = "iVBORw0KGgoAAAANSUhEUgAAADMAAAA/CAYAAABNY/BRAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAlZSURBVHgB7VpbaCRZGf6r6lR3VV+STieZTBKCmZlO59LDisZBR2Q3D8v6MMrCgswirIqi4LI+7OKyIDp4YUAUXWFdxBurIIw+rcIgroMsKqvoMATdzSbpJEwmM8nk0rn3pbrrVJ39T3X3TE/S6a5TXVn2Yb88hKquc/nPOd/3X6oAjgfK4ODA47FY7AO1N9vb20/395+8wH+HY4AM/kOJx+PhcLjtjzs7O5naHyRJ2orFOq/29PRoeEnAZ/htDJ+g1dvbu8mYDWjUAztg27bM73d1da7jJQWfDfLTGN4XHR4aulE0siDhXz3g7oBRyAWHh5P/gbJBvs3Br474zO2hoTM/YGB9CJhEGj8sKcyi5xKJ05fwkoFP8MsY5dTAwMOKrDxvW7aryeGRYyoh3xkYOPkR8EkQ/DBGQUIH9Wjk79Qsihwb2TRN2haN/7evry+I1yq0iFaNcQjf1dW1VTLyaIgkRmjGSNHI0Y6O2BpemdCiILRiDOcJ5UQuGnlZ2JD73RAUBB37eQNaFASvDR2pQuX6LrOtc3yFoQU4gmDT88OJxAvQgiB4NUbp7+//mCTL37Ityxc14sIhK/L3sd8PgkdB8GIMSSQSSizW/i9qGn76CZlSk8ba2ycHBwe5GAjvtuhE+AA0GAzs4jmn3nlSH6wiCOGwvgpl/gjtkIgxFcIPv1EyCorksyE1wxAjX4jgOK/jhQUCc3T7oEP4kWTiG8w2P85aJHzTwSTggjCRTJx+FgQEwa0xysDAwDhI8mUkqg3vAlBYbELUH+O4KXDJHzfGkPHxcaktGrlOqZCHh62trXzt9d7eXl5AeOWSWaJtbdE3K2M2NajZxBzCF4vGtsE9PHPPE9u2SlAmcS0MBswEt8DjbOSzNJVKuRKERsZUCD/0ulHIB0UJbzN2F+rOj22BACRJJsVCrm1kZPg1aCIIDXcGCf8cMHvCi4e3aGmy3n3DMCZBHIptmY8lk4mnGz10lDHE8cSS8iOLWsKEV4gC2dzelXq/FQrGH2RZ3M9y4SGK8jIGtUNwBH/q9UomJiYAPfwkpd48vKIQ3AH7rwCH081CofAnEgiCB8ilokEx3ZipzvPQAweuHcJnMhsbRj5niRC+Bjxcu4PFjB2o4yN2d3e3mc02+XMgDO5Q92lqbKyuINQa4xB+JJm8hoSPYK7uKdhTFEXOZ7PPw9E7Ku/u7b0gKbIEHsAFAZW1A+d5FQ4IwgMDjowkn2GMPuo9pGeUBDT79srK76GB515ZWfl1IKBR/jx4AK4Cr/JcSCROfan2ftUYnvqexf8vWR49PM7cVtQA2d3cPA/l7T/KGN6/sr29M4HcIeDpuOGWWNQOqIFfnThx4hRU+FP1rAxV4v+0VPREePQdVlDTsJ38+J3V1esuJmjh7vwbV/diIKjhKjMvBjmC0N3dNV8ZT3HO7djY2AaG9B2yCE8kpwbG1IAmMQZv5nK5R5aWlvYqHbsJWvjYEp6Iro6O9ms49kOmWUK7mCSSazKwqaZHtqam3u6RRkaGrimy+gnsWiCCtqlZMueyueyVXM74OVcoKB8tC8ThtItEIifa26NfDunhJwMBNQHlhXVnFq5msWS8Vu2sFXhSpWPo5zjq5u/jfRyE1Nt74pOlkrXDPbebBqg2Cs3nd9u7u+cWFxcNqKgSePQXFfCxOdkZqlu4WCwmQqFAhFJ3fWLgit7RjhFJIp09PZ1/wZAd3ELpjGMGLcPIcHLdpMVfLizc+nbNzyJGyRUDdF1XL+l69Cso9zFgFqYQplMMcDUfRYWt7c3POE8nk0OvYL7wOVwbUUVAUQSm6SGZlgqXZ+dufhPKBXA32aTzzdCZMz9Ug8GvY626KsNCqoa7YkuK8ovZ2bmv8obcAHt0dHSxZOT6eSAH4rCxGol9Bm5Mz8ycq/bZ4HnHt6RSo/8rGoWzFW/iKfIgajA9m06P8fbVQcn09PSgFopyQ9zn6PchY/IkmSXjw5gNvgTNnZ2VTCZ/UzGEz8GDj2BUC0WUiiFOjFftxHm/iCnIQEDTVCw6eCWzhOWhZ5ADoQYTlPEtdEwl8ufREE+OEudnBTSdrK2t9UF5l53ou3ZAury8vFIq0aeIQqrqIgqpVCwwXI8XG7S3u7vjLxtGgS+YF2MYUQNKMVd4IpPJ8Be990KoQ6s3Pz//O0lRX2VeXy1gq0i47Slo0B5zmSclt1J1ANiKx6JXFm7dehUO8PKgMU4oPTMz8wQqVAYjcy/Jk2RjIMs/YIDDKy9hQJnCXEQGD7tiO4TXbqfT6c/Cfd90D/XONd82FUPqvrIgiGeD1DQhFNIuwuHdYRgZX3R8iDAY1ZHwqJaDUJb1Q7w+iqR8NGl7e21EDerC2SCeA9D10IV6v4VC4U8xW/gE25jEkY2NjQSUCV93NRpJIl1ZycxZlvk12WWoUwtN00br3VdV9RQIQiEqOuXiF9bX129Cg5yp6STT6YWfoh/9Gy62qFy31bvphCsC4DzBsf+cXlj8LTQRpWbGOIIwOzv7qB7S90X4U6lNawduh0U0Eg2x9VB4Oz03V/0SqiVjOPi2kmyucDKohQlI7g2Kx+OB2utoNKq51jCJEz4s89weKt8bNGvilgsUw30zu7MzjrGQ5/IQL4C4fNRWiUZ2dzcfgkpx0k0jEWJbt1ZWJlGpLskeq5FuwXMrrPE+e+fO2lsgUCQRVSkJQ+3vYQ50ncdHcBzA48Uk5R+z8/M/AdF0AMTgRNgYqX4UHVjRa3n1KOAZxGJixEQP/whUImGR9l7KM06Evbq6hoIQEhIEhzNHsgZDej3EFYtL971IWARea0342iOTzxeyDxPiCIIrYvOsEOprAOPCkslsnp+amuK74ekIt1I4s27evP1Pm9kvYoQg0OwwDVBQMINilzE/4Z86euZiq1VAOZ2ef46QwDSv+YInMCrL5Mbs3ByvH3BL3/WvmqrgR0J9e3o6pelREBcERoN6BGZm07xu4Nl/VeFHfdb5gg/fADiCwIsM7pqhIRhRYI2sEzwS/iD8KjbT/f397b3dvU+rgaCb6j3jL6b2s9nHMLPlX3H44rP8rJyzpeXlq6i9r0CzgNApCsk/w928Bj4Z4vQL/oEbIGOE8EVM6JaOdidYWyJkGiPxp6FO6vteg1NETKVSWHbFkP9BRPn92uf8xHG8oHHez9+9e/esacbjtT9gShBbXV0drYzrayjE8Q6F7uAm3ZgyLQAAAABJRU5ErkJggg==";
 var STYLE_ID = "cavos-modal-styles-v2";
 function injectStyles() {
@@ -2817,6 +3027,17 @@ var EmailIcon = () => /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: "16", heig
   /* @__PURE__ */ jsxRuntime.jsx("rect", { x: "2", y: "4", width: "20", height: "16", rx: "2" }),
   /* @__PURE__ */ jsxRuntime.jsx("path", { d: "m22 7-8.97 5.7a1.94 1.94 0 01-2.06 0L2 7" })
 ] });
+var FingerprintIcon = ({ size = 22, color = "currentColor" }) => /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", stroke: color, strokeWidth: "1.7", strokeLinecap: "round", strokeLinejoin: "round", children: [
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M2 12C2 6.5 6.5 2 12 2a10 10 0 0 1 8 4" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M5 19.5C5.5 18 6 15 6 12c0-.7.12-1.37.34-2" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M17.29 21.02c.12-.6.43-2.3.5-3.02" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 10a2 2 0 0 0-2 2c0 1.02-.1 2.51-.26 4" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M8.65 22c.21-.66.45-1.32.57-2" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M14 13.12c0 2.38 0 6.38-1 8.88" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M2 16h.01" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M21.8 16c.2-2 .131-5.354 0-6" }),
+  /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M9 6.8a6 6 0 0 1 9 5.2c0 .47 0 1.17-.02 2" })
+] });
 var CavosLogo = ({ invert }) => /* @__PURE__ */ jsxRuntime.jsx("img", { src: `data:image/png;base64,${cavosLogoBase64}`, alt: "Cavos", style: { width: "auto", height: "16px", objectFit: "contain", opacity: 0.55, flexShrink: 0, filter: invert ? "invert(1)" : "none" } });
 function Spinner({ size = 16, color = "#888" }) {
   return /* @__PURE__ */ jsxRuntime.jsxs(
@@ -2967,7 +3188,11 @@ function CavosAuthModal({
     authError,
     clearAuthError,
     resendDeviceApproval,
-    recover
+    recover,
+    passkeySupported,
+    enrollPasskeyDefault,
+    approveDeviceWithPasskey,
+    setupRecovery
   } = useCavos();
   const isMobile = useIsMobile();
   const isLight = theme !== "dark";
@@ -2995,7 +3220,12 @@ function CavosAuthModal({
   const [deviceResendBusy, setDeviceResendBusy] = react.useState(false);
   const [recoverCode, setRecoverCode] = react.useState("");
   const [recoverBusy, setRecoverBusy] = react.useState(false);
+  const [pkBusy, setPkBusy] = react.useState(false);
+  const [pkError, setPkError] = react.useState("");
+  const [savedRecoveryCode, setSavedRecoveryCode] = react.useState("");
+  const [copied, setCopied] = react.useState(false);
   const doneHandledRef = react.useRef(false);
+  const secureHandledRef = react.useRef(false);
   const closeTimerRef = react.useRef(null);
   const otpBoxRefs = react.useRef([null, null, null, null, null, null]);
   const setOtpDigit = (i, raw) => {
@@ -3056,6 +3286,7 @@ function CavosAuthModal({
       setOtpCode("");
       setError("");
       doneHandledRef.current = false;
+      secureHandledRef.current = false;
     }, 1600);
   }, [onClose]);
   react.useEffect(() => {
@@ -3066,13 +3297,26 @@ function CavosAuthModal({
       doneHandledRef.current = false;
     }
     if (isAuthenticated && address && walletStatus.isReady) {
-      triggerDone(address);
+      if (walletStatus.isNewAccount && !secureHandledRef.current) {
+        if (screen !== "secure-account" && screen !== "recovery-code" && !doneHandledRef.current) {
+          setScreen("secure-account");
+        }
+      } else {
+        triggerDone(address);
+      }
     }
-    if (walletStatus.awaitingApproval && screen !== "device-approval" && screen !== "recover") {
-      setScreen("device-approval");
-      doneHandledRef.current = false;
+    if (walletStatus.needsDeviceApproval && // A deploy in progress owns the screen; never fight the deploying branch
+    // above (both flags true would oscillate deploying ↔ approval → loop).
+    !walletStatus.isDeploying && screen !== "recover" && screen !== "device-approval" && screen !== "passkey-approval") {
+      if (walletStatus.hasPasskey && passkeySupported) {
+        setScreen("passkey-approval");
+        doneHandledRef.current = false;
+      } else if (walletStatus.awaitingApproval) {
+        setScreen("device-approval");
+        doneHandledRef.current = false;
+      }
     }
-  }, [open, isAuthenticated, address, walletStatus.isReady, walletStatus.isDeploying, walletStatus.awaitingApproval, screen, triggerDone]);
+  }, [open, isAuthenticated, address, walletStatus.isReady, walletStatus.isDeploying, walletStatus.awaitingApproval, walletStatus.needsDeviceApproval, walletStatus.hasPasskey, walletStatus.isNewAccount, passkeySupported, screen, triggerDone]);
   react.useEffect(() => () => {
     if (closeTimerRef.current) clearTimeout(closeTimerRef.current);
   }, []);
@@ -3082,9 +3326,61 @@ function CavosAuthModal({
     setEmail("");
     setOtpCode("");
     setError("");
+    setPkError("");
+    setSavedRecoveryCode("");
+    setCopied(false);
     doneHandledRef.current = false;
+    secureHandledRef.current = false;
     onClose();
   };
+  const finishSecureStep = () => {
+    secureHandledRef.current = true;
+    if (address) triggerDone(address);
+  };
+  const handleSetupPasskey = async () => {
+    setPkBusy(true);
+    setPkError("");
+    try {
+      await enrollPasskeyDefault();
+      finishSecureStep();
+    } catch (e) {
+      setPkError(e instanceof Error ? e.message : "We couldn't set up your passkey. Try again.");
+    } finally {
+      setPkBusy(false);
+    }
+  };
+  const handleSaveRecovery = async () => {
+    setPkBusy(true);
+    setPkError("");
+    try {
+      const code = await setupRecovery();
+      setSavedRecoveryCode(code);
+      setScreen("recovery-code");
+    } catch (e) {
+      setPkError(e instanceof Error ? e.message : "We couldn't create your recovery phrase. Try again.");
+    } finally {
+      setPkBusy(false);
+    }
+  };
+  const handleCopyRecovery = async () => {
+    try {
+      await navigator.clipboard.writeText(savedRecoveryCode);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2e3);
+    } catch {
+    }
+  };
+  const handlePasskeyApprove = async () => {
+    setPkBusy(true);
+    setPkError("");
+    try {
+      await approveDeviceWithPasskey();
+      setPkBusy(false);
+    } catch (e) {
+      setPkError(e instanceof Error ? e.message : "We couldn't verify your passkey. Try again or use email.");
+      setPkBusy(false);
+    }
+  };
   const handleOAuth = async (provider) => {
     setError("");
     setBusy(true);
@@ -3175,6 +3471,85 @@ function CavosAuthModal({
       setDeviceResendBusy(false);
     }
   };
+  if (screen === "secure-account") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
+      isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { padding: isMobile ? "28px 24px 28px" : "44px 24px 28px", textAlign: "center" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { width: 48, height: 48, borderRadius: "50%", margin: "0 auto 16px", background: isLight ? "rgba(0,0,0,0.04)" : "rgba(255,255,255,0.06)", border: `1px solid ${isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)"}`, display: "flex", alignItems: "center", justifyContent: "center" }, children: /* @__PURE__ */ jsxRuntime.jsxs("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: textColor, strokeWidth: "1.7", strokeLinecap: "round", strokeLinejoin: "round", children: [
+          /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" }),
+          /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M9 12l2 2 4-4" })
+        ] }) }),
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { style: { margin: "0 0 8px", fontSize: "17px", fontWeight: 600, color: textColor, letterSpacing: "-0.02em" }, children: "Keep your account safe" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "0 0 24px", fontSize: "13px", color: subTextColor, lineHeight: 1.55 }, children: "Set up a passkey so you can sign in on a new phone or computer in one tap. It takes a few seconds." }),
+        pkError && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { background: errBg, border: `1px solid ${errBorder}`, borderRadius: "10px", padding: "9px 13px", fontSize: "13px", color: errColor, marginBottom: "14px", textAlign: "left" }, children: pkError }),
+        passkeySupported ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsxs("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "13px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 600, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", display: "flex", alignItems: "center", justifyContent: "center", gap: "9px", opacity: pkBusy ? 0.65 : 1, transition: "opacity 0.15s, transform 0.1s" }, onClick: handleSetupPasskey, disabled: pkBusy, children: [
+            pkBusy ? /* @__PURE__ */ jsxRuntime.jsx(Spinner, { size: 16, color: "#fff" }) : /* @__PURE__ */ jsxRuntime.jsx(FingerprintIcon, { size: 18, color: "#fff" }),
+            pkBusy ? "Setting up\u2026" : "Set up a passkey"
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "10px 0 0", fontSize: "12px", color: subTextColor, lineHeight: 1.5 }, children: "Uses Face ID, Touch ID, or your device PIN." }),
+          /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { display: "flex", alignItems: "center", gap: "12px", margin: "18px 0" }, children: [
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "cavos-divider-line", style: { background: isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)" } }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { style: { fontSize: "11px", color: subTextColor, textTransform: "uppercase", letterSpacing: "0.06em" }, children: "or" }),
+            /* @__PURE__ */ jsxRuntime.jsx("span", { className: "cavos-divider-line", style: { background: isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)" } })
+          ] }),
+          /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-submit-btn", style: { width: "100%", padding: "12px", borderRadius: "12px", border: inputBorder, background: "transparent", color: textColor, fontSize: "14px", fontWeight: 500, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", transition: "background 0.15s", opacity: pkBusy ? 0.6 : 1 }, onClick: handleSaveRecovery, disabled: pkBusy, children: "Save a recovery phrase instead" })
+        ] }) : /* @__PURE__ */ jsxRuntime.jsxs("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "13px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 600, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", display: "flex", alignItems: "center", justifyContent: "center", gap: "9px", opacity: pkBusy ? 0.65 : 1, transition: "opacity 0.15s" }, onClick: handleSaveRecovery, disabled: pkBusy, children: [
+          pkBusy && /* @__PURE__ */ jsxRuntime.jsx(Spinner, { size: 16, color: "#fff" }),
+          pkBusy ? "Setting up\u2026" : "Save a recovery phrase"
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-sub-btn", style: { background: "none", border: "none", cursor: pkBusy ? "default" : "pointer", fontSize: "13px", color: subTextColor, width: "100%", textAlign: "center", padding: "18px 0 0", fontFamily: "inherit", transition: "color 0.15s", opacity: pkBusy ? 0.6 : 1 }, onClick: finishSecureStep, disabled: pkBusy, children: "Skip for now" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: footer, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(CavosLogo, { invert: !isLight }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Secured by Cavos" })
+      ] })
+    ] }) });
+  }
+  if (screen === "recovery-code") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
+      isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { padding: isMobile ? "28px 24px 28px" : "44px 24px 28px", textAlign: "center" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { style: { margin: "0 0 8px", fontSize: "17px", fontWeight: 600, color: textColor, letterSpacing: "-0.02em" }, children: "Save your recovery phrase" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "0 0 18px", fontSize: "13px", color: subTextColor, lineHeight: 1.55 }, children: "Write this down and keep it somewhere safe. It's the only way to get back in if you lose your devices, and we can't recover it for you." }),
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { background: isLight ? "rgba(0,0,0,0.03)" : "rgba(255,255,255,0.05)", border: `1px solid ${isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)"}`, borderRadius: "12px", padding: "16px", marginBottom: "12px", fontSize: "14px", fontWeight: 500, color: textColor, wordBreak: "break-word", lineHeight: 1.6, fontFamily: "ui-monospace, SFMono-Regular, Menlo, monospace", textAlign: "center" }, children: savedRecoveryCode }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-provider", style: { ...pBtn, marginBottom: "10px" }, onClick: handleCopyRecovery, children: /* @__PURE__ */ jsxRuntime.jsx("span", { children: copied ? "Copied \u2713" : "Copy to clipboard" }) }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "12px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 500, cursor: "pointer", fontFamily: "inherit", transition: "opacity 0.15s" }, onClick: finishSecureStep, children: "I've saved it" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: footer, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(CavosLogo, { invert: !isLight }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Secured by Cavos" })
+      ] })
+    ] }) });
+  }
+  if (screen === "passkey-approval") {
+    return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
+      isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
+      /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-close", style: close, onClick: handleClose, "aria-label": "Close", children: /* @__PURE__ */ jsxRuntime.jsx(CloseX, {}) }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { padding: isMobile ? "28px 24px 32px" : "48px 24px 32px", textAlign: "center" }, children: [
+        /* @__PURE__ */ jsxRuntime.jsx("div", { style: { width: 48, height: 48, borderRadius: "50%", margin: "0 auto 16px", background: isLight ? "rgba(0,0,0,0.04)" : "rgba(255,255,255,0.06)", border: `1px solid ${isLight ? "rgba(0,0,0,0.08)" : "rgba(255,255,255,0.1)"}`, display: "flex", alignItems: "center", justifyContent: "center" }, children: /* @__PURE__ */ jsxRuntime.jsx(FingerprintIcon, { size: 24, color: textColor }) }),
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { style: { margin: "0 0 8px", fontSize: "17px", fontWeight: 600, color: textColor, letterSpacing: "-0.02em" }, children: "Verify it's you" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { style: { margin: "0 0 20px", fontSize: "13px", color: subTextColor, lineHeight: 1.55 }, children: "Confirm with Face ID, Touch ID, or your device PIN to add this device to your account." }),
+        pkError && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { background: errBg, border: `1px solid ${errBorder}`, borderRadius: "10px", padding: "9px 13px", fontSize: "13px", color: errColor, marginBottom: "14px" }, children: pkError }),
+        /* @__PURE__ */ jsxRuntime.jsxs("button", { className: "cavos-primary-btn", style: { width: "100%", padding: "12px", borderRadius: "12px", border: "none", background: primaryColor, color: "#fff", fontSize: "14px", fontWeight: 500, cursor: pkBusy ? "default" : "pointer", fontFamily: "inherit", display: "flex", alignItems: "center", justifyContent: "center", gap: "8px", opacity: pkBusy ? 0.65 : 1 }, onClick: handlePasskeyApprove, disabled: pkBusy, children: [
+          pkBusy && /* @__PURE__ */ jsxRuntime.jsx(Spinner, { size: 15, color: "#fff" }),
+          pkBusy ? "Verifying\u2026" : "Continue with passkey"
+        ] }),
+        walletStatus.awaitingApproval && /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-sub-btn", style: { background: "none", border: "none", cursor: "pointer", fontSize: "13px", color: subTextColor, width: "100%", textAlign: "center", padding: "16px 0 0", fontFamily: "inherit", transition: "color 0.15s" }, onClick: () => {
+          setScreen("device-approval");
+          setPkError("");
+        }, children: "Approve by email instead" }),
+        /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-sub-btn", style: { background: "none", border: "none", cursor: "pointer", fontSize: "13px", color: subTextColor, width: "100%", textAlign: "center", padding: `${walletStatus.awaitingApproval ? "10px" : "16px"} 0 0`, fontFamily: "inherit", transition: "color 0.15s" }, onClick: () => {
+          setScreen("recover");
+          setPkError("");
+        }, children: "Use a recovery phrase" })
+      ] }),
+      /* @__PURE__ */ jsxRuntime.jsxs("div", { style: footer, children: [
+        /* @__PURE__ */ jsxRuntime.jsx(CavosLogo, { invert: !isLight }),
+        /* @__PURE__ */ jsxRuntime.jsx("span", { children: "Secured by Cavos" })
+      ] })
+    ] }) });
+  }
   if (screen === "device-approval") {
     const expired = walletStatus.awaitingApproval && !walletStatus.pendingRequestId;
     return /* @__PURE__ */ jsxRuntime.jsx("div", { style: overlay, "data-cavos-theme": theme, role: "dialog", "aria-modal": true, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
@@ -3234,7 +3609,7 @@ function CavosAuthModal({
     }, children: /* @__PURE__ */ jsxRuntime.jsxs("div", { style: { ...card, position: "relative" }, children: [
       isMobile && /* @__PURE__ */ jsxRuntime.jsx("div", { style: handle }),
       /* @__PURE__ */ jsxRuntime.jsx("button", { className: "cavos-close", style: { ...close, left: "16px", right: "auto" }, onClick: () => {
-        setScreen("device-approval");
+        setScreen(walletStatus.hasPasskey && passkeySupported ? "passkey-approval" : "device-approval");
         setError("");
         setRecoverCode("");
       }, "aria-label": "Back", children: /* @__PURE__ */ jsxRuntime.jsx("svg", { width: "14", height: "14", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2.5", strokeLinecap: "round", strokeLinejoin: "round", children: /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M19 12H5M12 5l-7 7 7 7" }) }) }),
@@ -3473,23 +3848,36 @@ var INITIAL_STATUS = {
   isReady: false,
   needsDeviceApproval: false,
   awaitingApproval: false,
-  pendingRequestId: null
+  pendingRequestId: null,
+  hasPasskey: false,
+  isNewAccount: false
 };
 function CavosProvider({ config, modal, children }) {
   const [auth] = react.useState(
     () => new CavosAuth({ appId: config.appId, backendUrl: config.authBackendUrl })
   );
-  const [cavos, setCavos] = react.useState(null);
+  const [wallet, setWallet] = react.useState(null);
   const [identity, setIdentity] = react.useState(null);
   const [walletStatus, setWalletStatus] = react.useState(INITIAL_STATUS);
   const [isLoading, setIsLoading] = react.useState(false);
   const [authError, setAuthError] = react.useState(null);
   const [modalOpen, setModalOpen] = react.useState(false);
+  const [passkeySupported, setPasskeySupported] = react.useState(false);
   const [branding, setBranding] = react.useState({});
+  react.useEffect(() => {
+    let cancelled = false;
+    PasskeySigner.isSupported().then((ok) => {
+      if (!cancelled) setPasskeySupported(ok);
+    }).catch(() => {
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
   const configRef = react.useRef(config);
   react.useEffect(() => {
     configRef.current = config;
-  }, [config]);
+  });
   react.useEffect(() => {
     if (!config.appId || typeof window === "undefined") return;
     const base = config.authBackendUrl ?? "https://cavos.xyz";
@@ -3503,41 +3891,52 @@ function CavosProvider({ config, modal, children }) {
   const closeModal = react.useCallback(() => setModalOpen(false), []);
   const clearAuthError = react.useCallback(() => setAuthError(null), []);
   const resendDeviceApproval = react.useCallback(async () => {
-    if (!identity || !cavos || cavos.chain !== "starknet" || !cavos.pendingRequestId) return;
-    const backendUrl = configRef.current.authBackendUrl ?? "https://cavos.xyz";
-    if (!configRef.current.appId) return;
-    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: configRef.current.appId });
+    const cfg = configRef.current;
+    if (!identity || !wallet || wallet.chain !== "starknet" || !wallet.pendingRequestId) return;
+    const backendUrl = cfg.authBackendUrl ?? "https://cavos.xyz";
+    if (!cfg.appId) return;
+    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: cfg.appId });
     await recovery.requestDeviceAddition({
       userId: identity.userId,
-      accountAddress: cavos.address,
-      newSigner: cavos.publicKey,
+      accountAddress: wallet.address,
+      newSigner: wallet.publicKey,
       ...identity.email ? { email: identity.email } : {}
     });
-  }, [identity, cavos]);
-  const connect = react.useCallback(async (id) => {
-    setWalletStatus({ ...INITIAL_STATUS, isDeploying: true });
-    const c = await Cavos.connect({
-      chain: configRef.current.chain ?? "starknet",
-      network: configRef.current.network,
+  }, [identity, wallet]);
+  const connect = react.useCallback(async (id, opts) => {
+    const cfg = configRef.current;
+    if (!opts?.silent) setWalletStatus({ ...INITIAL_STATUS, isDeploying: true });
+    const w = await Cavos.connect({
+      chain: cfg.chain ?? "starknet",
+      network: cfg.network,
       identity: id,
-      appSalt: configRef.current.appSalt,
-      ...configRef.current.paymasterApiKey ? { paymasterApiKey: configRef.current.paymasterApiKey } : {},
-      ...configRef.current.appId ? { appId: configRef.current.appId } : {},
-      ...configRef.current.authBackendUrl ? { backendUrl: configRef.current.authBackendUrl } : {},
-      ...configRef.current.rpcUrl ? { rpcUrl: configRef.current.rpcUrl } : {}
+      appSalt: cfg.appSalt,
+      ...cfg.paymasterApiKey ? { paymasterApiKey: cfg.paymasterApiKey } : {},
+      ...cfg.appId ? { appId: cfg.appId } : {},
+      ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+      ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
     });
-    setCavos(c);
+    setWallet(w);
     setIdentity(id);
-    const pendingRequestId = c.chain === "starknet" ? c.pendingRequestId : null;
+    const pendingRequestId = w.chain === "starknet" ? w.pendingRequestId : null;
+    let hasPasskey = false;
+    if (w.status === "needs-device-approval") {
+      try {
+        hasPasskey = await w.hasPasskey();
+      } catch {
+      }
+    }
     setWalletStatus({
       isDeploying: false,
-      isReady: c.status === "ready",
-      needsDeviceApproval: c.status === "needs-device-approval",
-      awaitingApproval: c.status === "needs-device-approval" && !!pendingRequestId,
-      pendingRequestId
+      isReady: w.status === "ready",
+      needsDeviceApproval: w.status === "needs-device-approval",
+      awaitingApproval: w.status === "needs-device-approval" && !!pendingRequestId,
+      pendingRequestId,
+      hasPasskey,
+      isNewAccount: w.isNewAccount
     });
-    modal?.onSuccess?.(c.address);
-    return c;
+    modal?.onSuccess?.(w.address);
+    return w;
   }, [modal]);
   react.useEffect(() => {
     if (typeof window === "undefined") return;
@@ -3589,75 +3988,122 @@ function CavosProvider({ config, modal, children }) {
     await connect(id);
   }, [auth, connect]);
   const execute = react.useCallback(async (calls) => {
-    if (!cavos) throw new Error("Not logged in");
-    if (cavos.chain !== "starknet") {
+    if (!wallet) throw new Error("Not logged in");
+    if (wallet.chain !== "starknet") {
       throw new Error(
-        "kit: useCavos().execute(calls) is Starknet-only. On Solana use the `wallet` handle: wallet.execute(amount, dest)."
+        "kit: useCavos().execute(calls) is Starknet-only. On Solana/Stellar use the `wallet` handle: wallet.execute(amount, dest)."
       );
     }
-    return cavos.execute(calls);
-  }, [cavos]);
+    return wallet.execute(calls);
+  }, [wallet]);
   const addSigner = react.useCallback(
     async (pubkey) => {
-      if (!cavos) throw new Error("Not logged in");
-      if (cavos.chain !== "starknet") {
-        throw new Error("kit: addSigner via useCavos() is Starknet-only; use the `wallet` handle on Solana.");
+      if (!wallet) throw new Error("Not logged in");
+      if (wallet.chain !== "starknet") {
+        throw new Error("kit: addSigner via useCavos() is Starknet-only; use the `wallet` handle on other chains.");
       }
-      return cavos.addSigner(pubkey);
+      return wallet.addSigner(pubkey);
     },
-    [cavos]
+    [wallet]
   );
   const enrollPasskey = react.useCallback(
     async (passkey, params) => {
-      if (!cavos) throw new Error("Not logged in");
-      return cavos.enrollPasskey(passkey, params);
+      if (!wallet) throw new Error("Not logged in");
+      return wallet.enrollPasskey(passkey, params);
     },
-    [cavos]
+    [wallet]
   );
-  const approveThisDeviceWithPasskey = react.useCallback(
-    async (passkey, submit) => {
-      if (!cavos) throw new Error("Not logged in");
-      if (cavos.chain === "starknet") {
-        return cavos.approveThisDeviceWithPasskey({ passkey, ...submit ? { submit } : {} });
+  const rpName = branding.appName ?? modal?.appName ?? "Cavos";
+  const enrollPasskeyDefault = react.useCallback(async () => {
+    if (!wallet || !identity) throw new Error("Not logged in");
+    if (wallet.status !== "ready") throw new Error("kit: no ready device to enroll a passkey on");
+    const passkey = new PasskeySigner({ rpName });
+    await wallet.enrollPasskey(passkey, {
+      userId: identity.userId,
+      userName: identity.email ?? identity.userId,
+      ...identity.email ? { displayName: identity.email } : {}
+    });
+  }, [wallet, identity, rpName]);
+  const approveDeviceWithPasskey = react.useCallback(async () => {
+    if (!wallet || !identity) throw new Error("Not logged in");
+    if (wallet.status !== "needs-device-approval") {
+      await connect(identity);
+      return;
+    }
+    const passkey = new PasskeySigner({ rpName });
+    if (wallet.chain === "starknet") {
+      await wallet.approveThisDeviceWithPasskey({ passkey });
+    } else {
+      await wallet.approveThisDeviceWithPasskey(passkey);
+    }
+    setWalletStatus((s) => ({ ...s, isDeploying: true, needsDeviceApproval: false, awaitingApproval: false }));
+    const deadline = Date.now() + 6e4;
+    for (; ; ) {
+      let ready = false;
+      try {
+        ready = await wallet.isReady();
+      } catch {
       }
-      const transactionHash = await cavos.approveThisDeviceWithPasskey(passkey);
-      return { transactionHash };
-    },
-    [cavos]
-  );
+      if (ready) break;
+      if (Date.now() > deadline) {
+        setWalletStatus((s) => ({ ...s, isDeploying: false, needsDeviceApproval: true }));
+        throw new Error(
+          "Your device is being added, but it's taking longer than usual. Please try again in a moment."
+        );
+      }
+      await new Promise((r) => setTimeout(r, 3e3));
+    }
+    await connect(identity, { silent: true });
+  }, [wallet, identity, rpName, connect]);
   const setupRecovery = react.useCallback(async () => {
-    if (!cavos) throw new Error("Not logged in");
+    if (!wallet) throw new Error("Not logged in");
     const code = generateRecoveryCode();
-    await cavos.setupRecovery(code);
+    await wallet.setupRecovery(code);
     return code;
-  }, [cavos]);
+  }, [wallet]);
   const recover = react.useCallback(async (code) => {
     if (!identity) throw new Error("Sign in first so we know which account to recover.");
+    const cfg = configRef.current;
     setAuthError(null);
     setWalletStatus({ ...INITIAL_STATUS, isDeploying: true });
     try {
-      const chain = configRef.current.chain ?? "starknet";
-      const c = chain === "solana" ? await CavosSolana.recover({
-        code,
-        identity,
-        network: configRef.current.network === "mainnet" ? "solana-mainnet" : "solana-devnet",
-        appSalt: configRef.current.appSalt,
-        ...configRef.current.appId ? { appId: configRef.current.appId } : {},
-        ...configRef.current.authBackendUrl ? { backendUrl: configRef.current.authBackendUrl } : {},
-        ...configRef.current.rpcUrl ? { rpcUrl: configRef.current.rpcUrl } : {}
-      }) : await Cavos.recover({
-        code,
-        identity,
-        network: configRef.current.network,
-        appSalt: configRef.current.appSalt,
-        paymasterApiKey: configRef.current.paymasterApiKey ?? "",
-        ...configRef.current.appId ? { appId: configRef.current.appId } : {},
-        ...configRef.current.authBackendUrl ? { backendUrl: configRef.current.authBackendUrl } : {},
-        ...configRef.current.rpcUrl ? { rpcUrl: configRef.current.rpcUrl } : {}
-      });
-      setCavos(c);
+      const chain = cfg.chain ?? "starknet";
+      let w;
+      if (chain === "solana") {
+        w = await CavosSolana.recover({
+          code,
+          identity,
+          network: cfg.network === "mainnet" ? "solana-mainnet" : "solana-devnet",
+          appSalt: cfg.appSalt,
+          ...cfg.appId ? { appId: cfg.appId } : {},
+          ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+          ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
+        });
+      } else if (chain === "stellar") {
+        w = await CavosStellar.recover({
+          code,
+          identity,
+          network: cfg.network === "mainnet" ? "stellar-mainnet" : "stellar-testnet",
+          appSalt: cfg.appSalt,
+          ...cfg.appId ? { appId: cfg.appId } : {},
+          ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+          ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
+        });
+      } else {
+        w = await Cavos.recover({
+          code,
+          identity,
+          network: cfg.network,
+          appSalt: cfg.appSalt,
+          paymasterApiKey: cfg.paymasterApiKey ?? "",
+          ...cfg.appId ? { appId: cfg.appId } : {},
+          ...cfg.authBackendUrl ? { backendUrl: cfg.authBackendUrl } : {},
+          ...cfg.rpcUrl ? { rpcUrl: cfg.rpcUrl } : {}
+        });
+      }
+      setWallet(w);
       setWalletStatus({ ...INITIAL_STATUS, isReady: true });
-      modal?.onSuccess?.(c.address);
+      modal?.onSuccess?.(w.address);
     } catch (e) {
       const msg = e instanceof Error ? e.message : "Recovery failed. Check your code and try again.";
       setAuthError(msg);
@@ -3667,9 +4113,10 @@ function CavosProvider({ config, modal, children }) {
   }, [identity, modal]);
   react.useEffect(() => {
     if (!walletStatus.awaitingApproval || !walletStatus.pendingRequestId || !identity) return;
-    if (!configRef.current.appId) return;
-    const backendUrl = configRef.current.authBackendUrl ?? "https://cavos.xyz";
-    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: configRef.current.appId });
+    const cfg = configRef.current;
+    if (!cfg.appId) return;
+    const backendUrl = cfg.authBackendUrl ?? "https://cavos.xyz";
+    const recovery = new HttpRecoveryClient({ baseUrl: backendUrl, appId: cfg.appId });
     const requestId = walletStatus.pendingRequestId;
     let cancelled = false;
     const tick = async () => {
@@ -3693,7 +4140,7 @@ function CavosProvider({ config, modal, children }) {
     };
   }, [walletStatus.awaitingApproval, walletStatus.pendingRequestId, identity, connect]);
   const logout = react.useCallback(() => {
-    setCavos(null);
+    setWallet(null);
     setIdentity(null);
     setWalletStatus(INITIAL_STATUS);
     setAuthError(null);
@@ -3701,11 +4148,11 @@ function CavosProvider({ config, modal, children }) {
   const value = {
     openModal,
     closeModal,
-    isAuthenticated: !!cavos,
+    isAuthenticated: !!wallet,
     user: identity ? { userId: identity.userId, email: identity.email, provider: identity.provider } : null,
     chain: config.chain ?? "starknet",
-    wallet: cavos,
-    address: cavos?.address ?? null,
+    wallet,
+    address: wallet?.address ?? null,
     walletStatus,
     isLoading,
     authError,
@@ -3718,7 +4165,9 @@ function CavosProvider({ config, modal, children }) {
     execute,
     addSigner,
     enrollPasskey,
-    approveThisDeviceWithPasskey,
+    passkeySupported,
+    enrollPasskeyDefault,
+    approveDeviceWithPasskey,
     resendDeviceApproval,
     setupRecovery,
     recover,