@cavos/kit 0.0.3 → 0.0.5

package/dist/index.mjs

@@ -1,6 +1,4 @@
-import { spkiToPublicKey, derToRs, challengeOffsetOf, base64urlEncode } from './chunk-BNGLH3Q3.mjs';
-export { BackupSigner, Cavos, CavosAuth, CavosSolana, CavosStellar, DEVICE_ACCOUNT_CLASS_HASH, DEVICE_ACCOUNT_PROGRAM_ID, DEVICE_ACCOUNT_WASM_HASH, FACTORY_CONTRACT_ID, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, NATIVE_SAC_ID, SECP256R1_PROGRAM_ID, SOLANA_NETWORKS, STARKNET_NETWORKS, STELLAR_NETWORKS, SolanaAdapter, SolanaRelayer, StarknetAdapter, StarknetDeviceSigner, StellarAdapter, StellarRelayer, UDC_ADDRESS, WebCryptoSigner, anchorDiscriminator, approveDeviceEverywhere, base64urlEncode, batchChallenge, bigIntTo32Bytes, buildSecp256r1Instruction, bytesToBigInt, bytesToHex, compressedPubkey, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, deviceSignatureScVal, encodeLowSSignature, encodeLowSSignature2 as encodeStellarLowSSignature, generateRecoveryCode, hexToBytes, lowS, recoverCandidatePublicKeys, recoverYParity, sec1Pubkey, serializeInstructions, signatureToFelts, u256ToFelts, webauthnDigest } from './chunk-BNGLH3Q3.mjs';
-import { sha256 } from '@noble/hashes/sha256';
+export { BackupSigner, Cavos, CavosAuth, CavosSolana, CavosStellar, DEVICE_ACCOUNT_CLASS_HASH, DEVICE_ACCOUNT_PROGRAM_ID, HORIZON_URL, HttpRecoveryClient, HttpWalletRegistry, InMemoryWalletRegistry, LocalDeviceUnwrapKey, PasskeyPrf, PasskeySigner, SECP256R1_PROGRAM_ID, SOLANA_NETWORKS, STARKNET_NETWORKS, STELLAR_NETWORKS, SolanaAdapter, SolanaRelayer, StarknetAdapter, StarknetDeviceSigner, StellarAdapter, StellarRelayer, UDC_ADDRESS, WebCryptoDeviceUnwrapKey, WebCryptoSigner, XLM_DECIMALS, anchorDiscriminator, approveDeviceEverywhere, base64urlEncode, batchChallenge, bigIntTo32Bytes, buildSecp256r1Instruction, bytesToBigInt, bytesToHex, compressedPubkey, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, derivePasskeyKEK, deriveRecoveryKEK, deriveStellarAddress, deriveStellarMasterKeypair, deviceSlotId, eciesUnwrapDEK, eciesWrapDEK, encodeLowSSignature, fromDataEntries, generateControlKey, generateDEK, generateRecoveryCode, hexToBytes, lowS, openControlSeed, recoverCandidatePublicKeys, recoverYParity, sealControlSeed, serializeInstructions, signatureToFelts, toDataEntries, u256ToFelts, unwrapDEK, webauthnDigest, wrapDEK } from './chunk-M5BGBODC.mjs';
 
 // src/auth/AuthProvider.ts
 var StaticIdentity = class {
@@ -11,91 +9,7 @@ var StaticIdentity = class {
     return this.identity;
   }
 };
-var PasskeySigner = class {
-  constructor(opts = {}) {
-    if (typeof window === "undefined" || !navigator.credentials) {
-      throw new Error("kit/passkey: WebAuthn is only available in a browser");
-    }
-    this.rpId = opts.rpId ?? window.location.hostname;
-    this.rpName = opts.rpName ?? this.rpId;
-    if (isIpAddress(this.rpId)) {
-      throw new Error(
-        `kit/passkey: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) \u2014 or pass an explicit \`rpId\`. (The silent device key works over an IP; passkeys don't.)`
-      );
-    }
-  }
-  /** True if this platform advertises a usable passkey (platform authenticator). */
-  static async isSupported() {
-    if (typeof window === "undefined" || !window.PublicKeyCredential) return false;
-    try {
-      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
-    } catch {
-      return false;
-    }
-  }
-  /** Create a new synced passkey and return its P-256 public key. */
-  async enroll(params) {
-    const challenge = crypto.getRandomValues(new Uint8Array(32));
-    const cred = await navigator.credentials.create({
-      publicKey: {
-        challenge: buf(challenge),
-        rp: { id: this.rpId, name: this.rpName },
-        user: {
-          id: buf(userHandle(params.userId)),
-          name: params.userName,
-          displayName: params.displayName ?? params.userName
-        },
-        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
-        // ES256 (P-256)
-        authenticatorSelection: {
-          residentKey: "required",
-          requireResidentKey: true,
-          userVerification: "preferred"
-        },
-        attestation: "none"
-      }
-    });
-    if (!cred) throw new Error("kit/passkey: enrollment cancelled");
-    const response = cred.response;
-    const spki = new Uint8Array(response.getPublicKey());
-    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };
-  }
-  /**
-   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller
-   * derives from the signer being added + the on-chain nonce). Uses discoverable
-   * credentials — no `allowCredentials` — so it works on a brand-new browser.
-   */
-  async assert(challenge) {
-    const cred = await navigator.credentials.get({
-      publicKey: {
-        challenge: buf(challenge),
-        rpId: this.rpId,
-        allowCredentials: [],
-        userVerification: "preferred"
-      }
-    });
-    if (!cred) throw new Error("kit/passkey: assertion cancelled");
-    const response = cred.response;
-    const authenticatorData = new Uint8Array(response.authenticatorData);
-    const clientDataJSON = new Uint8Array(response.clientDataJSON);
-    const { r, s } = derToRs(new Uint8Array(response.signature));
-    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));
-    return { authenticatorData, clientDataJSON, r, s, challengeOffset };
-  }
-};
-function isIpAddress(host) {
-  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
-  if (host.includes(":")) return true;
-  return false;
-}
-function userHandle(userId) {
-  const bytes = new TextEncoder().encode(userId);
-  return bytes.length <= 64 ? bytes : sha256(bytes);
-}
-function buf(bytes) {
-  return bytes.slice();
-}
 
-export { PasskeySigner, StaticIdentity };
+export { StaticIdentity };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/AuthProvider.ts","../src/signer/PasskeySigner.ts"],"names":[],"mappings":";;;;;AA2BO,IAAM,iBAAN,MAA6C;AAAA,EAClD,YAA6B,QAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAqB;AAAA,EAClD,MAAM,YAAA,GAAkC;AACtC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF;ACQO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,WAAA,CAAY,IAAA,GAA6B,EAAC,EAAG;AAC3C,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,UAAU,WAAA,EAAa;AAC3D,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,QAAA;AACzC,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,IAAA;AAIlC,IAAA,IAAI,WAAA,CAAY,IAAA,CAAK,IAAI,CAAA,EAAG;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,8DAAA,EAAiE,KAAK,IAAI,CAAA,6KAAA;AAAA,OAG5E;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAa,WAAA,GAAgC;AAC3C,IAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,MAAA,CAAO,qBAAqB,OAAO,KAAA;AACzE,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAA,CAAO,mBAAA,CAAoB,6CAAA,EAA8C;AAAA,IACxF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAO,MAAA,EAAuD;AAClE,IAAA,MAAM,YAAY,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC3D,IAAA,MAAM,IAAA,GAAQ,MAAM,SAAA,CAAU,WAAA,CAAY,MAAA,CAAO;AAAA,MAC/C,SAAA,EAAW;AAAA,QACT,SAAA,EAAW,IAAI,SAAS,CAAA;AAAA,QACxB,IAAI,EAAE,EAAA,EAAI,KAAK,IAAA,EAAM,IAAA,EAAM,KAAK,MAAA,EAAO;AAAA,QACvC,IAAA,EAAM;AAAA,UACJ,EAAA,EAAI,GAAA,CAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,UACjC,MAAM,MAAA,CAAO,QAAA;AAAA,UACb,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO;AAAA,SAC5C;AAAA,QACA,kBAAkB,CAAC,EAAE,MAAM,YAAA,EAAc,GAAA,EAAK,IAAI,CAAA;AAAA;AAAA,QAClD,sBAAA,EAAwB;AAAA,UACtB,WAAA,EAAa,UAAA;AAAA,UACb,kBAAA,EAAoB,IAAA;AAAA,UACpB,gBAAA,EAAkB;AAAA,SACpB;AAAA,QACA,WAAA,EAAa;AAAA;AACf,KACD,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAE9D,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,QAAA,CAAS,cAAe,CAAA;AACpD,IAAA,OAAO,EAAE,SAAA,EAAW,eAAA,CAAgB,IAAI,CAAA,EAAG,cAAc,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAE;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,SAAA,EAAkD;AAC7D,IAAA,MAAM,IAAA,GAAQ,MAAM,SAAA,CAAU,WAAA,CAAY,GAAA,CAAI;AAAA,MAC5C,SAAA,EAAW;AAAA,QACT,SAAA,EAAW,IAAI,SAAS,CAAA;AAAA,QACxB,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,kBAAkB,EAAC;AAAA,QACnB,gBAAA,EAAkB;AAAA;AACpB,KACD,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAE7D,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,IAAA,MAAM,iBAAA,GAAoB,IAAI,UAAA,CAAW,QAAA,CAAS,iBAAiB,CAAA;AACnE,IAAA,MAAM,cAAA,GAAiB,IAAI,UAAA,CAAW,QAAA,CAAS,cAAc,CAAA;AAC7D,IAAA,MAAM,EAAE,GAAG,CAAA,EAAE,GAAI,QAAQ,IAAI,UAAA,CAAW,QAAA,CAAS,SAAS,CAAC,CAAA;AAC3D,IAAA,MAAM,eAAA,GAAkB,iBAAA,CAAkB,cAAA,EAAgB,eAAA,CAAgB,SAAS,CAAC,CAAA;AACpF,IAAA,OAAO,EAAE,iBAAA,EAAmB,cAAA,EAAgB,CAAA,EAAG,GAAG,eAAA,EAAgB;AAAA,EACpE;AACF;AAQA,SAAS,YAAY,IAAA,EAAuB;AAC1C,EAAA,IAAI,yBAAA,CAA0B,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AACjD,EAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AAC/B,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAW,MAAA,EAA4B;AAC9C,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AAC7C,EAAA,OAAO,KAAA,CAAM,MAAA,IAAU,EAAA,GAAK,KAAA,GAAQ,OAAO,KAAK,CAAA;AAClD;AAIA,SAAS,IAAI,KAAA,EAAiC;AAC5C,EAAA,OAAO,MAAM,KAAA,EAAM;AACrB","file":"index.mjs","sourcesContent":["/**\n * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a\n * stable `userId`; that's all the wallet needs to derive its address. Auth never\n * touches signing — the device key does that, silently.\n *\n * Privy-style UX: the user \"logs in\" and the wallet is provisioned behind the\n * scenes (device key + auto-deployed smart account). The app never handles keys.\n */\nexport interface Identity {\n  /** Stable, backend-managed user identifier. */\n  userId: string;\n  /** Optional metadata (email, provider) for display only. */\n  email?: string;\n  provider?: \"google\" | \"apple\" | \"email\" | \"otp\" | string;\n}\n\n/**\n * Authenticates a user and returns their stable identity. Implementations:\n * - `CavosAuth` (hosted, mirrors `@cavos/react`: Google/Apple/email/OTP via the\n *   Cavos backend) — the default, Privy-like experience.\n * - any custom provider (the app already authenticated the user elsewhere).\n */\nexport interface AuthProvider {\n  authenticate(): Promise<Identity>;\n}\n\n/** Trivial provider when the app already has the user's stable id. */\nexport class StaticIdentity implements AuthProvider {\n  constructor(private readonly identity: Identity) {}\n  async authenticate(): Promise<Identity> {\n    return this.identity;\n  }\n}\n","import { sha256 } from \"@noble/hashes/sha256\";\nimport type { DevicePublicKey } from \"./DeviceSigner\";\nimport {\n  base64urlEncode,\n  challengeOffsetOf,\n  derToRs,\n  spkiToPublicKey,\n  type PasskeyAssertion,\n} from \"../crypto/webauthn\";\n\nexport interface PasskeySignerOptions {\n  /** Relying-Party id (usually the eTLD+1). Defaults to `window.location.hostname`. */\n  rpId?: string;\n  /** Human-readable RP name shown in the OS passkey UI. */\n  rpName?: string;\n}\n\nexport interface PasskeyEnrollParams {\n  /** Stable user handle for the credential (e.g. the account address or userId). */\n  userId: string;\n  /** Account name shown in the OS passkey UI (e.g. an email). */\n  userName: string;\n  displayName?: string;\n}\n\nexport interface EnrolledPasskey {\n  publicKey: DevicePublicKey;\n  credentialId: Uint8Array;\n}\n\n/**\n * Browser passkey signer. Creates a discoverable (resident) secp256r1 credential\n * that syncs across the user's devices (iCloud Keychain / Google Password\n * Manager), and produces WebAuthn assertions used to authorize `add_signer`.\n *\n * This is a step-up primitive: the app decides WHEN to enroll (e.g. after\n * onboarding, as a \"turn on device approvals\" / 2FA moment). Enrollment\n * registers the passkey on-chain as an approver; later, from any browser, an\n * assertion approves adding that browser's new device key.\n */\nexport class PasskeySigner {\n  private readonly rpId: string;\n  private readonly rpName: string;\n\n  constructor(opts: PasskeySignerOptions = {}) {\n    if (typeof window === \"undefined\" || !navigator.credentials) {\n      throw new Error(\"kit/passkey: WebAuthn is only available in a browser\");\n    }\n    this.rpId = opts.rpId ?? window.location.hostname;\n    this.rpName = opts.rpName ?? this.rpId;\n    // WebAuthn requires the RP ID to be a registrable domain (or \"localhost\").\n    // An IP address always fails with a cryptic \"invalid domain\" — surface an\n    // actionable message instead (common when devs test over a LAN IP).\n    if (isIpAddress(this.rpId)) {\n      throw new Error(\n        `kit/passkey: passkeys can't use an IP address as the domain (\"${this.rpId}\"). ` +\n          \"Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) — \" +\n          \"or pass an explicit `rpId`. (The silent device key works over an IP; passkeys don't.)\",\n      );\n    }\n  }\n\n  /** True if this platform advertises a usable passkey (platform authenticator). */\n  static async isSupported(): Promise<boolean> {\n    if (typeof window === \"undefined\" || !window.PublicKeyCredential) return false;\n    try {\n      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();\n    } catch {\n      return false;\n    }\n  }\n\n  /** Create a new synced passkey and return its P-256 public key. */\n  async enroll(params: PasskeyEnrollParams): Promise<EnrolledPasskey> {\n    const challenge = crypto.getRandomValues(new Uint8Array(32));\n    const cred = (await navigator.credentials.create({\n      publicKey: {\n        challenge: buf(challenge),\n        rp: { id: this.rpId, name: this.rpName },\n        user: {\n          id: buf(userHandle(params.userId)),\n          name: params.userName,\n          displayName: params.displayName ?? params.userName,\n        },\n        pubKeyCredParams: [{ type: \"public-key\", alg: -7 }], // ES256 (P-256)\n        authenticatorSelection: {\n          residentKey: \"required\",\n          requireResidentKey: true,\n          userVerification: \"preferred\",\n        },\n        attestation: \"none\",\n      },\n    })) as PublicKeyCredential | null;\n    if (!cred) throw new Error(\"kit/passkey: enrollment cancelled\");\n\n    const response = cred.response as AuthenticatorAttestationResponse;\n    const spki = new Uint8Array(response.getPublicKey()!);\n    return { publicKey: spkiToPublicKey(spki), credentialId: new Uint8Array(cred.rawId) };\n  }\n\n  /**\n   * Produce a WebAuthn assertion over `challenge` (a 32-byte value the caller\n   * derives from the signer being added + the on-chain nonce). Uses discoverable\n   * credentials — no `allowCredentials` — so it works on a brand-new browser.\n   */\n  async assert(challenge: Uint8Array): Promise<PasskeyAssertion> {\n    const cred = (await navigator.credentials.get({\n      publicKey: {\n        challenge: buf(challenge),\n        rpId: this.rpId,\n        allowCredentials: [],\n        userVerification: \"preferred\",\n      },\n    })) as PublicKeyCredential | null;\n    if (!cred) throw new Error(\"kit/passkey: assertion cancelled\");\n\n    const response = cred.response as AuthenticatorAssertionResponse;\n    const authenticatorData = new Uint8Array(response.authenticatorData);\n    const clientDataJSON = new Uint8Array(response.clientDataJSON);\n    const { r, s } = derToRs(new Uint8Array(response.signature));\n    const challengeOffset = challengeOffsetOf(clientDataJSON, base64urlEncode(challenge));\n    return { authenticatorData, clientDataJSON, r, s, challengeOffset };\n  }\n}\n\n/**\n * WebAuthn requires the user handle to be 1..64 bytes. `userId` may be longer\n * (e.g. a 66-char Starknet address), so hash anything over 64 bytes to a stable\n * 32-byte handle. The handle is opaque — only its stability matters.\n */\n/** True for IPv4/IPv6 literals — WebAuthn rejects these as an RP ID. */\nfunction isIpAddress(host: string): boolean {\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(host)) return true; // IPv4\n  if (host.includes(\":\")) return true; // IPv6 literal\n  return false;\n}\n\nfunction userHandle(userId: string): Uint8Array {\n  const bytes = new TextEncoder().encode(userId);\n  return bytes.length <= 64 ? bytes : sha256(bytes);\n}\n\n/** Coerce a `Uint8Array` to the `BufferSource` the WebAuthn DOM types want\n * (works around the TS5.7 `ArrayBufferLike` vs `ArrayBuffer` mismatch). */\nfunction buf(bytes: Uint8Array): BufferSource {\n  return bytes.slice() as unknown as BufferSource;\n}\n"]}
+{"version":3,"sources":["../src/auth/AuthProvider.ts"],"names":[],"mappings":";;;AA2BO,IAAM,iBAAN,MAA6C;AAAA,EAClD,YAA6B,QAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAqB;AAAA,EAClD,MAAM,YAAA,GAAkC;AACtC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF","file":"index.mjs","sourcesContent":["/**\n * Identity for a Cavos wallet. Login (email / social / OTP) only ever produces a\n * stable `userId`; that's all the wallet needs to derive its address. Auth never\n * touches signing — the device key does that, silently.\n *\n * Privy-style UX: the user \"logs in\" and the wallet is provisioned behind the\n * scenes (device key + auto-deployed smart account). The app never handles keys.\n */\nexport interface Identity {\n  /** Stable, backend-managed user identifier. */\n  userId: string;\n  /** Optional metadata (email, provider) for display only. */\n  email?: string;\n  provider?: \"google\" | \"apple\" | \"email\" | \"otp\" | string;\n}\n\n/**\n * Authenticates a user and returns their stable identity. Implementations:\n * - `CavosAuth` (hosted, mirrors `@cavos/react`: Google/Apple/email/OTP via the\n *   Cavos backend) — the default, Privy-like experience.\n * - any custom provider (the app already authenticated the user elsewhere).\n */\nexport interface AuthProvider {\n  authenticate(): Promise<Identity>;\n}\n\n/** Trivial provider when the app already has the user's stable id. */\nexport class StaticIdentity implements AuthProvider {\n  constructor(private readonly identity: Identity) {}\n  async authenticate(): Promise<Identity> {\n    return this.identity;\n  }\n}\n"]}

package/dist/react/index.d.mts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import react__default, { ReactNode } from 'react';
-import { k as Chain, u as NetworkEnv, j as CavosWallet, e as ChainCall, x as PasskeySigner, w as PasskeyEnrollParams } from '../Cavos-BH2_tOQ2.mjs';
+import { l as Chain, N as NetworkEnv, k as CavosWallet, e as ChainCall, r as ExecuteOptions, x as PasskeySigner, w as PasskeyEnrollParams } from '../Cavos-D20EtgOK.mjs';
 import 'starknet';
 import '@solana/web3.js';
 import '@stellar/stellar-sdk';
@@ -44,6 +44,12 @@ interface WalletStatus {
     awaitingApproval: boolean;
     /** The pending device-addition request id, when awaitingApproval. */
     pendingRequestId: string | null;
+    /** True if the account already has a passkey enrolled as an approver, so the
+     * modal can offer passkey approval over email on the new-device path. */
+    hasPasskey: boolean;
+    /** True right after a brand-new account is created (first sign-up), so the UI
+     * can offer a one-time "secure your account" step. Cleared once handled. */
+    isNewAccount: boolean;
 }
 interface UserInfo {
     userId: string;
@@ -56,12 +62,12 @@ interface CavosContextValue {
     closeModal: () => void;
     isAuthenticated: boolean;
     user: UserInfo | null;
-    /** The active chain ('starknet' | 'solana'). */
+    /** The active chain ('starknet' | 'solana' | 'stellar'). */
     chain: Chain;
     /**
-     * The raw connected wallet, discriminated by `wallet.chain`. Use this for
-     * chain-native calls (e.g. Solana `wallet.execute(amount, dest)`); narrow on
-     * `wallet.chain` first. Null until connected.
+     * The connected wallet, discriminated by `wallet.chain`. Narrow on
+     * `wallet.chain` before chain-native calls (e.g. Solana `wallet.execute(amount,
+     * dest)`). Null until connected.
      */
     wallet: CavosWallet | null;
     address: string | null;
@@ -82,8 +88,13 @@ interface CavosContextValue {
     verifyOtp: (email: string, code: string) => Promise<void>;
     /** Resolve identity from an OAuth callback (?auth_data=…) and deploy. */
     handleCallback: (authData: string) => Promise<void>;
-    /** Execute a sponsored (gasless) multicall, signed by the device key. */
-    execute: (calls: ChainCall[]) => Promise<{
+    /**
+     * Execute a multicall signed by the device key (Starknet-only — on Solana /
+     * Stellar call `wallet.execute(...)` directly). Sponsored (gasless) by default;
+     * pass `{ sponsored: false }` to submit directly with the account paying its
+     * own fee.
+     */
+    execute: (calls: ChainCall[], opts?: ExecuteOptions) => Promise<{
         transactionHash: string;
     }>;
     /** Authorize another device signer on this wallet (sponsored add_signer). */
@@ -96,9 +107,8 @@ interface CavosContextValue {
     /** Re-request the device-approval email for the current pending request. */
     resendDeviceApproval: () => Promise<void>;
     /**
-     * Enroll a passkey as an approver (2FA-style step-up). Works on every chain.
-     * Call this when you want to let users approve new devices from any browser.
-     * Requires a ready device; returns the passkey's public key.
+     * Enroll a passkey as an approver (2FA-style step-up). Requires a ready device;
+     * returns the passkey's public key.
      */
     enrollPasskey: (passkey: PasskeySigner, params: PasskeyEnrollParams) => Promise<{
         publicKey: {
@@ -107,46 +117,49 @@ interface CavosContextValue {
         };
         transactionHash?: string;
     }>;
+    /** Whether this device can use a platform passkey (Face ID / Touch ID / PIN). */
+    passkeySupported: boolean;
     /**
-     * From a fresh browser (status `needs-device-approval`), approve adding THIS
-     * device using the user's synced passkey. Works on every chain (Starknet
-     * requires a `submit` relayer callback; Solana/Stellar go through the
-     * configured relayer). Returns the tx hash.
+     * Modal-friendly wrapper: enroll a synced passkey as an approver using the
+     * signed-in user's identity + the app name. Requires a ready device.
      */
-    approveThisDeviceWithPasskey: (passkey: PasskeySigner, submit?: (call: ChainCall) => Promise<{
-        transactionHash: string;
-    }>) => Promise<{
-        transactionHash: string;
-    }>;
+    enrollPasskeyDefault: () => Promise<void>;
+    /**
+     * Modal-friendly wrapper for the new-device flow: prompt the user's synced
+     * passkey to approve THIS device, then refresh to a ready state. Sponsored by
+     * the default paymaster/relayer.
+     */
+    approveDeviceWithPasskey: () => Promise<void>;
     /**
-     * Register a backup signer derived from `code` on the current account
-     * (gasless). The code is generated by the kit and shown to the user once.
-     * Resolves with the code so the caller can display it.
+     * Register a backup signer derived from a generated recovery code (gasless).
+     * Resolves with the code so the caller can display it once.
      */
     setupRecovery: () => Promise<string>;
     /**
-     * Recover access after losing every device. Requires the recovery code. Runs
-     * the full Cavos.recover flow and brings the provider to a ready state.
+     * Recover access after losing every device. Requires the recovery code. Brings
+     * the provider to a ready state.
      */
     recover: (code: string) => Promise<void>;
     logout: () => void;
 }
 interface CavosProviderProps {
+    /** A single chain config. The provider manages exactly one chain. */
     config: CavosConfig;
     modal?: CavosModalConfig;
     children: ReactNode;
 }
 /**
- * Drop-in Cavos provider. Wrap your app once; descendants call `useCavos()`.
+ * Drop-in Cavos provider for ONE chain. Wrap your app once; descendants call
+ * `useCavos()`.
  *
- *   <CavosProvider config={{ network: 'sepolia', appSalt, paymasterApiKey }}
- *                  modal={{ appName: 'My App', theme: 'dark', emailMode: 'otp' }}>
+ *   <CavosProvider config={{ chain: 'solana', network: 'testnet', appId, appSalt }}
+ *                  modal={{ appName: 'My App', theme: 'dark' }}>
  *     <App />
  *   </CavosProvider>
  *
  * Behind the scenes: login (social / email) resolves a stable identity, the kit
- * deploys a device-signer smart account gaslessly, and `execute()` submits
- * gasless multicalls signed silently by the browser's device key.
+ * deploys a device-signer smart account gaslessly, and the wallet handle submits
+ * gasless transactions signed silently by the browser's device key.
  */
 declare function CavosProvider({ config, modal, children }: CavosProviderProps): react.JSX.Element;
 declare function useCavos(): CavosContextValue;

package/dist/react/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import react__default, { ReactNode } from 'react';
-import { k as Chain, u as NetworkEnv, j as CavosWallet, e as ChainCall, x as PasskeySigner, w as PasskeyEnrollParams } from '../Cavos-BH2_tOQ2.js';
+import { l as Chain, N as NetworkEnv, k as CavosWallet, e as ChainCall, r as ExecuteOptions, x as PasskeySigner, w as PasskeyEnrollParams } from '../Cavos-D20EtgOK.js';
 import 'starknet';
 import '@solana/web3.js';
 import '@stellar/stellar-sdk';
@@ -44,6 +44,12 @@ interface WalletStatus {
     awaitingApproval: boolean;
     /** The pending device-addition request id, when awaitingApproval. */
     pendingRequestId: string | null;
+    /** True if the account already has a passkey enrolled as an approver, so the
+     * modal can offer passkey approval over email on the new-device path. */
+    hasPasskey: boolean;
+    /** True right after a brand-new account is created (first sign-up), so the UI
+     * can offer a one-time "secure your account" step. Cleared once handled. */
+    isNewAccount: boolean;
 }
 interface UserInfo {
     userId: string;
@@ -56,12 +62,12 @@ interface CavosContextValue {
     closeModal: () => void;
     isAuthenticated: boolean;
     user: UserInfo | null;
-    /** The active chain ('starknet' | 'solana'). */
+    /** The active chain ('starknet' | 'solana' | 'stellar'). */
     chain: Chain;
     /**
-     * The raw connected wallet, discriminated by `wallet.chain`. Use this for
-     * chain-native calls (e.g. Solana `wallet.execute(amount, dest)`); narrow on
-     * `wallet.chain` first. Null until connected.
+     * The connected wallet, discriminated by `wallet.chain`. Narrow on
+     * `wallet.chain` before chain-native calls (e.g. Solana `wallet.execute(amount,
+     * dest)`). Null until connected.
      */
     wallet: CavosWallet | null;
     address: string | null;
@@ -82,8 +88,13 @@ interface CavosContextValue {
     verifyOtp: (email: string, code: string) => Promise<void>;
     /** Resolve identity from an OAuth callback (?auth_data=…) and deploy. */
     handleCallback: (authData: string) => Promise<void>;
-    /** Execute a sponsored (gasless) multicall, signed by the device key. */
-    execute: (calls: ChainCall[]) => Promise<{
+    /**
+     * Execute a multicall signed by the device key (Starknet-only — on Solana /
+     * Stellar call `wallet.execute(...)` directly). Sponsored (gasless) by default;
+     * pass `{ sponsored: false }` to submit directly with the account paying its
+     * own fee.
+     */
+    execute: (calls: ChainCall[], opts?: ExecuteOptions) => Promise<{
         transactionHash: string;
     }>;
     /** Authorize another device signer on this wallet (sponsored add_signer). */
@@ -96,9 +107,8 @@ interface CavosContextValue {
     /** Re-request the device-approval email for the current pending request. */
     resendDeviceApproval: () => Promise<void>;
     /**
-     * Enroll a passkey as an approver (2FA-style step-up). Works on every chain.
-     * Call this when you want to let users approve new devices from any browser.
-     * Requires a ready device; returns the passkey's public key.
+     * Enroll a passkey as an approver (2FA-style step-up). Requires a ready device;
+     * returns the passkey's public key.
      */
     enrollPasskey: (passkey: PasskeySigner, params: PasskeyEnrollParams) => Promise<{
         publicKey: {
@@ -107,46 +117,49 @@ interface CavosContextValue {
         };
         transactionHash?: string;
     }>;
+    /** Whether this device can use a platform passkey (Face ID / Touch ID / PIN). */
+    passkeySupported: boolean;
     /**
-     * From a fresh browser (status `needs-device-approval`), approve adding THIS
-     * device using the user's synced passkey. Works on every chain (Starknet
-     * requires a `submit` relayer callback; Solana/Stellar go through the
-     * configured relayer). Returns the tx hash.
+     * Modal-friendly wrapper: enroll a synced passkey as an approver using the
+     * signed-in user's identity + the app name. Requires a ready device.
      */
-    approveThisDeviceWithPasskey: (passkey: PasskeySigner, submit?: (call: ChainCall) => Promise<{
-        transactionHash: string;
-    }>) => Promise<{
-        transactionHash: string;
-    }>;
+    enrollPasskeyDefault: () => Promise<void>;
+    /**
+     * Modal-friendly wrapper for the new-device flow: prompt the user's synced
+     * passkey to approve THIS device, then refresh to a ready state. Sponsored by
+     * the default paymaster/relayer.
+     */
+    approveDeviceWithPasskey: () => Promise<void>;
     /**
-     * Register a backup signer derived from `code` on the current account
-     * (gasless). The code is generated by the kit and shown to the user once.
-     * Resolves with the code so the caller can display it.
+     * Register a backup signer derived from a generated recovery code (gasless).
+     * Resolves with the code so the caller can display it once.
      */
     setupRecovery: () => Promise<string>;
     /**
-     * Recover access after losing every device. Requires the recovery code. Runs
-     * the full Cavos.recover flow and brings the provider to a ready state.
+     * Recover access after losing every device. Requires the recovery code. Brings
+     * the provider to a ready state.
      */
     recover: (code: string) => Promise<void>;
     logout: () => void;
 }
 interface CavosProviderProps {
+    /** A single chain config. The provider manages exactly one chain. */
     config: CavosConfig;
     modal?: CavosModalConfig;
     children: ReactNode;
 }
 /**
- * Drop-in Cavos provider. Wrap your app once; descendants call `useCavos()`.
+ * Drop-in Cavos provider for ONE chain. Wrap your app once; descendants call
+ * `useCavos()`.
  *
- *   <CavosProvider config={{ network: 'sepolia', appSalt, paymasterApiKey }}
- *                  modal={{ appName: 'My App', theme: 'dark', emailMode: 'otp' }}>
+ *   <CavosProvider config={{ chain: 'solana', network: 'testnet', appId, appSalt }}
+ *                  modal={{ appName: 'My App', theme: 'dark' }}>
  *     <App />
  *   </CavosProvider>
  *
  * Behind the scenes: login (social / email) resolves a stable identity, the kit
- * deploys a device-signer smart account gaslessly, and `execute()` submits
- * gasless multicalls signed silently by the browser's device key.
+ * deploys a device-signer smart account gaslessly, and the wallet handle submits
+ * gasless transactions signed silently by the browser's device key.
  */
 declare function CavosProvider({ config, modal, children }: CavosProviderProps): react.JSX.Element;
 declare function useCavos(): CavosContextValue;