@cavos/kit 0.0.4 → 0.0.5

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { A as AuthProvider, I as Identity, W as WalletRegistry, R as RegisteredWallet, D as DevicePublicKey, a as RecoveryClient, P as PendingDeviceRequest, b as DeviceSigner, c as DeviceSignature, C as ChainAdapter, d as ComputeAddressParams, e as ChainCall, f as PasskeyAssertion, S as StellarNetwork } from './Cavos-x9qFpOvJ.mjs';
-export { g as Cavos, h as CavosSolana, i as CavosStellar, j as CavosWallet, k as Chain, l as ConnectOptions, m as ConnectSolanaOptions, n as ConnectStatus, o as ConnectStellarOptions, p as DEVICE_ACCOUNT_PROGRAM_ID, q as DEVICE_ACCOUNT_WASM_HASH, E as EnrolledPasskey, F as FACTORY_CONTRACT_ID, r as InMemoryWalletRegistry, s as InstructionAccount, t as InstructionData, N as NATIVE_SAC_ID, u as NetworkEnv, v as PasskeyApprovable, w as PasskeyEnrollParams, x as PasskeySigner, y as PasskeySignerOptions, z as RecoverSolanaOptions, B as RecoverStellarOptions, G as RecoveryOptions, H as SECP256R1_PROGRAM_ID, J as SOLANA_NETWORKS, K as STELLAR_NETWORKS, L as SolanaAdapter, M as SolanaAdapterOptions, O as SolanaNetwork, Q as SolanaRelayer, T as SolanaRelayerOptions, U as StaticIdentity, V as StellarRelayer, X as StellarRelayerOptions, Y as anchorDiscriminator, Z as approveDeviceEverywhere, _ as base64urlEncode, $ as batchChallenge, a0 as buildSecp256r1Instruction, a1 as compressedPubkey, a2 as encodeLowSSignature, a3 as lowS, a4 as recoverCandidatePublicKeys, a5 as serializeInstructions, a6 as webauthnDigest } from './Cavos-x9qFpOvJ.mjs';
+import { A as AuthProvider, I as Identity, W as WalletRegistry, R as RegisteredWallet, D as DevicePublicKey, a as RecoveryClient, P as PendingDeviceRequest, b as DeviceSigner, c as DeviceSignature, C as ChainAdapter, d as ComputeAddressParams, e as ChainCall, f as PasskeyAssertion, S as StellarNetwork, g as DeviceUnwrapKey } from './Cavos-D20EtgOK.mjs';
+export { h as Cavos, i as CavosSolana, j as CavosStellar, k as CavosWallet, l as Chain, m as ConnectOptions, n as ConnectSolanaOptions, o as ConnectStatus, p as ConnectStellarOptions, q as DEVICE_ACCOUNT_PROGRAM_ID, E as EnrolledPasskey, r as ExecuteOptions, H as HORIZON_URL, s as InMemoryWalletRegistry, t as InstructionAccount, u as InstructionData, L as LocalDeviceUnwrapKey, N as NetworkEnv, v as PasskeyApprovable, w as PasskeyEnrollParams, x as PasskeySigner, y as PasskeySignerOptions, z as RecoverSolanaOptions, B as RecoveryOptions, F as SECP256R1_PROGRAM_ID, G as SOLANA_NETWORKS, J as STELLAR_NETWORKS, K as SolanaAdapter, M as SolanaAdapterOptions, O as SolanaNetwork, Q as SolanaRelayer, T as SolanaRelayerOptions, U as StaticIdentity, V as StellarConnectStatus, X as StellarRelayKind, Y as StellarRelayer, Z as StellarRelayerOptions, _ as XLM_DECIMALS, $ as anchorDiscriminator, a0 as approveDeviceEverywhere, a1 as base64urlEncode, a2 as batchChallenge, a3 as buildSecp256r1Instruction, a4 as compressedPubkey, a5 as deviceSlotId, a6 as encodeLowSSignature, a7 as lowS, a8 as recoverCandidatePublicKeys, a9 as serializeInstructions, aa as webauthnDigest } from './Cavos-D20EtgOK.mjs';
 import { Signer, ArraySignatureType } from 'starknet';
-import { rpc, xdr } from '@stellar/stellar-sdk';
+import { Horizon, Transaction, FeeBumpTransaction, Account, Keypair } from '@stellar/stellar-sdk';
 import '@solana/web3.js';
 
 interface CavosAuthOptions {
@@ -246,13 +246,33 @@ declare class StarknetAdapter implements ChainAdapter {
     private readonly opts;
     readonly chain: "starknet";
     constructor(opts: StarknetAdapterOptions);
-    computeAddress({ addressSeed, initialSigner, salt }: ComputeAddressParams): string;
-    /** Single UDC deploy; the constructor registers the first device signer, so
-     * the account is ready the moment it is deployed (fits the paymaster's
-     * deploy + execute_from_outside bundle). */
+    /**
+     * Deterministic address = f(addressSeed) ONLY. The device pubkey is NOT
+     * part of the derivation — anti-squatting is the integrator's responsibility
+     * (keep `appSalt` secret; deploy on first login). This makes the address
+     * recomputable by the user from (userId, appSalt) alone, even after losing
+     * every device.
+     *
+     * `initialSigner` in `ComputeAddressParams` is IGNORED on Starknet (kept in
+     * the shared type for Solana/Stellar, which still include it).
+     */
+    computeAddress({ addressSeed, salt }: ComputeAddressParams): string;
+    /**
+     * UDC deploy call. The constructor takes ONLY the seed — no device pubkey —
+     * so the account is born with no signers. The caller MUST follow up with
+     * `buildInitialize` in the same multicall (or a separate tx) to register the
+     * first device signer; otherwise the account is unusable.
+     */
     buildDeploy(params: ComputeAddressParams): ChainCall[];
-    /** Constructor calldata: [address_seed, pub_x_low, pub_x_high, pub_y_low, pub_y_high]. */
-    constructorCalldata(addressSeed: bigint, initialSigner: DevicePublicKey): string[];
+    /** Constructor calldata: [address_seed]. Device pubkey is registered post-deploy via initialize. */
+    constructorCalldata(addressSeed: bigint): string[];
+    /**
+     * `initialize` call: registers the first device signer. Callable only while
+     * the account has no signers (one-shot). In production this is bundled with
+     * the UDC deploy in a single sponsored multicall — see `connectStarknet`.
+     * Anti-squatting is NOT enforced on-chain.
+     */
+    buildInitialize(accountAddress: string, devicePubkey: DevicePublicKey): ChainCall;
     buildAddSigner(accountAddress: string, signer: DevicePublicKey): ChainCall;
     buildRemoveSigner(accountAddress: string, signer: DevicePublicKey): ChainCall;
     isAuthorizedSigner(accountAddress: string, signer: DevicePublicKey): Promise<boolean>;
@@ -313,113 +333,291 @@ declare const UDC_ADDRESS = "0x041a78e741e5af2fec34b695679bc6891742439f7afb8484e
  * DeviceAccount class hash, per network. Populated from
  * `account-contracts/starknet/deployments/<network>.json` after declaring.
  *
- * Sepolia re-declared 2026-07-01 with the passkey-approval surface + BATCHED
- * multi-chain challenge (one passkey prompt approves a device on all chains).
- * Mainnet still runs the prior class (no passkey) until it is re-declared.
+ * Sepolia re-declared 2026-07-04:
+ *   - Deploy attestation REMOVED — `initialize` takes only the device pubkey.
+ *   - `is_valid_signature` returns VALIDATED pre-init so the SNIP-9 outside-
+ *     execution path (used by the paymaster's `deploy_and_invoke`) can carry
+ *     the `initialize` call before any signer is registered. `__execute__`
+ *     still enforces that ONLY `initialize` runs in that state.
+ * Mainnet still runs the prior class (with attestation) until it is re-declared.
  */
 declare const DEVICE_ACCOUNT_CLASS_HASH: Record<StarknetNetwork, string>;
 
+/** In-memory shape of the account's control-key envelope. */
+interface AccountEnvelope {
+    /** Sealed control seed (`sealControlSeed` output). */
+    ct: Uint8Array;
+    /** Per-device ECIES DEK-wraps, keyed by device slot id. */
+    deviceWraps: Record<string, Uint8Array>;
+    /** Passkey-PRF DEK-wrap, if a passkey factor is enrolled. */
+    passkeyWrap?: Uint8Array;
+    /** Recovery-code DEK-wrap, if the user set one up. */
+    recoveryWrap?: Uint8Array;
+}
+/** Serialize an envelope into `MANAGE_DATA` name→value entries (raw bytes). */
+declare function toDataEntries(env: AccountEnvelope): Record<string, Uint8Array>;
+/** Reconstruct an envelope from an account's data entries (name→bytes). */
+declare function fromDataEntries(entries: Record<string, Uint8Array>): AccountEnvelope;
+
 interface StellarAdapterOptions {
     network: StellarNetwork;
-    /** RPC override (else the network default). */
-    rpcUrl?: string;
-    /** Factory contract id override (else the per-network default). */
-    factoryId?: string;
-    /** The device signer that authorizes account operations. */
-    signer: DeviceSigner;
+    /** Horizon URL override (else the per-network default). */
+    horizonUrl?: string;
 }
 /**
- * Stellar / Soroban implementation of the Cavos device-account surface. Unlike
- * Starknet (`buildSignature(txHash: bigint)`) the Soroban signing unit is a
- * 32-byte Soroban *auth-entry* preimage, so — as the Solana adapter did for its
- * own model — this adapter exposes chain-native methods rather than the generic
- * `ChainAdapter` shape. Its job:
- *   - derive the deterministic account address off-chain (matches the factory),
- *   - build the factory/account/token invocations as host functions, and
- *   - sign a Soroban authorization entry with the silent P-256 device key,
- *     producing the `Vec<DeviceSignature>` ScVal that the contract's
- *     `__check_auth` verifies.
+ * Classic-Stellar (`G…`) multisig account adapter.
+ *
+ * Unlike the Soroban `StellarAdapter` (contract `C…` accounts authorized by a
+ * `__check_auth` device signature) this operates on a *classic* account whose
+ * signing is ordinary ed25519 multisig:
+ *
+ *   - the **master** key (deterministic from identity) names the `G…` address and
+ *     is set to weight 0 at creation — powerless afterwards;
+ *   - the **control** key (random, weight 1, thresholds 1) is the real signer,
+ *     recovered by decrypting the on-chain envelope (see `envelope.ts`).
+ *
+ * The adapter builds/read classic transactions and account state via Horizon; it
+ * never holds a secret — callers pass in the `Keypair`s to sign with. Gasless
+ * submission is a fee-bump whose fee source is the relayer (Phase 3).
  */
 declare class StellarAdapter {
     readonly chain: "stellar";
     readonly network: StellarNetwork;
     readonly passphrase: string;
-    private readonly rpcUrl;
-    private readonly factoryId;
-    private readonly signer;
+    private readonly horizonUrl;
     private _server?;
     constructor(opts: StellarAdapterOptions);
-    server(): rpc.Server;
-    private networkId;
+    server(): Horizon.Server;
+    /** Whether the classic account already exists on-chain. */
+    isDeployed(address: string): Promise<boolean>;
+    /** Read the account's `MANAGE_DATA` entries as raw bytes (name → value). */
+    loadDataEntries(address: string): Promise<Record<string, Uint8Array>>;
+    /** Native XLM balance in stroops. Returns 0n if the account doesn't exist. */
+    balance(address: string): Promise<bigint>;
     /**
-     * Deterministic account address for `(addressSeed, initialSigner)` — computed
-     * off-chain, byte-identical to the factory's on-chain `account_address`.
-     * `contractId = sha256(HashIdPreimage(networkId, factory, salt))` with
-     * `salt = sha256(addressSeed || sec1(initialSigner))`.
+     * Build the account-creation transaction (source = funder, the relayer or a
+     * self-funded keypair):
+     *   1. `createAccount` funds the deterministic `G…` master address,
+     *   2. `manageData` writes the control-key envelope entries (authorized by the
+     *      still-weight-1 master),
+     *   3. `setOptions` adds the control signer (weight 1), sets all thresholds to
+     *      1, and zeroes the master weight — after this the master can never sign.
+     *
+     * The returned tx must be signed by BOTH the master keypair (for the account's
+     * own ops) and the funder (source + fee). Sponsorship of reserves is layered on
+     * in Phase 3.
      */
-    computeAddress(addressSeed: Uint8Array, initialSigner: DevicePublicKey): string;
-    /** `salt = sha256(addressSeed(32) || sec1(initialSigner)(65))` — matches the factory. */
-    accountSalt(addressSeed: Uint8Array, initialSigner: DevicePublicKey): Buffer;
-    /** Host function: `factory.deploy(address_seed, initial_signer)`. */
-    buildDeploy(addressSeed: Uint8Array, initialSigner: DevicePublicKey): xdr.HostFunction;
-    /** Host function: `account.add_signer(new_signer)` (requires device auth). */
-    buildAddSigner(accountAddress: string, signer: DevicePublicKey): xdr.HostFunction;
-    /** Host function: `account.remove_signer(signer)` (requires device auth). */
-    buildRemoveSigner(accountAddress: string, signer: DevicePublicKey): xdr.HostFunction;
-    /** Host function: `account.add_approver(passkey)` (requires device auth). */
-    buildAddApprover(accountAddress: string, passkey: DevicePublicKey): xdr.HostFunction;
-    /** Host function: `account.remove_approver(passkey)` (requires device auth). */
-    buildRemoveApprover(accountAddress: string, passkey: DevicePublicKey): xdr.HostFunction;
-    /** This chain's leaf for approving `add_signer(newSigner)` at `nonce`:
-     * `sha256(sec1(new_signer) || nonce_be8)`. The batch challenge the passkey signs
-     * is `sha256(concat(leaves))` across chains. */
-    passkeyLeaf(newSigner: DevicePublicKey, nonce: bigint): Uint8Array;
-    /** Host function: passkey-authorized `add_signer_via_passkey` (no device auth —
-     * authorized by the embedded WebAuthn assertion, so any relayer can submit).
-     * `leaves`/`leafIndex` place this chain's leaf in the multi-chain batch. */
-    buildAddSignerViaPasskey(accountAddress: string, newSigner: DevicePublicKey, passkey: DevicePublicKey, nonce: bigint, leaves: Uint8Array[], leafIndex: number, assertion: PasskeyAssertion): xdr.HostFunction;
-    /** Read whether `passkey` is a registered approver (read-only simulation). */
-    /** True if the account has at least one passkey registered as an approver.
-     * Reads the contract's `approvers` view and checks the list is non-empty. */
-    hasPasskeyApprover(accountAddress: string, readSource: string): Promise<boolean>;
-    isApprover(accountAddress: string, passkey: DevicePublicKey, readSource: string): Promise<boolean>;
-    /** Read the current passkey-approval nonce (read-only simulation). */
-    passkeyNonce(accountAddress: string, readSource: string): Promise<bigint>;
-    /** Host function: SEP-41 `token.transfer(from=account, to, amount)` (device auth). */
-    buildTransfer(tokenId: string, accountAddress: string, destination: string, amount: bigint): xdr.HostFunction;
+    buildCreateTx(params: {
+        funder: string;
+        masterAddress: string;
+        controlAddress: string;
+        envelope: AccountEnvelope;
+        /** Starting balance in stroops (must cover base reserve + entries). */
+        startingBalance: bigint;
+    }): Promise<Transaction>;
+    /**
+     * Build a **sponsored** account-creation transaction whose source is the
+     * relayer. Wraps the account setup in `beginSponsoringFutureReserves` /
+     * `endSponsoringFutureReserves`, so the relayer (not the user) pays every
+     * reserve — the account is created with a 0 starting balance and holds no
+     * locked XLM of the user's. Ops:
+     *   0. beginSponsoringFutureReserves(G)          source = relayer
+     *   1. createAccount(G, 0)                        source = relayer
+     *   2. manageData(cv:… envelope)                  source = G (master-signed)
+     *   3. setOptions(control signer, master → 0)     source = G
+     *   4. endSponsoringFutureReserves()              source = G
+     *
+     * Signed by the master (for the G ops, while it's still weight 1); the relayer
+     * co-signs (source + fee + sponsorship) before submitting.
+     */
+    buildSponsoredCreateTx(params: {
+        relayer: string;
+        masterAddress: string;
+        controlAddress: string;
+        envelope: AccountEnvelope;
+    }): Promise<Transaction>;
+    /**
+     * Build a classic native-XLM payment as an *inner* transaction whose source is
+     * the account itself (`G…`), signed by the control key. Wrap it in a fee-bump
+     * (see `wrapFeeBump`) so the relayer pays the fee — gasless.
+     */
+    buildPaymentTx(params: {
+        from: string;
+        to: string;
+        /** Amount in stroops. */
+        amount: bigint;
+    }): Promise<Transaction>;
     /**
-     * Sign a Soroban authorization entry with the silent device key, producing the
-     * `Vec<DeviceSignature>` the account's `__check_auth` verifies. The device
-     * signs `sha256(preimage)` (WebCrypto hashes once more internally), which is
-     * exactly what the contract recomputes. Mutates + returns the entry.
+     * Build a data-entry write (e.g. re-wrapping the DEK for a newly approved
+     * device) as an inner tx sourced by the account, signed by the control key.
      */
-    signAuthEntry(entry: xdr.SorobanAuthorizationEntry, validUntilLedger: number): Promise<xdr.SorobanAuthorizationEntry>;
+    buildDataTx(params: {
+        account: string;
+        entries: Record<string, Uint8Array>;
+    }): Promise<Transaction>;
+    /**
+     * Build a **sponsored** data-entry write whose source is the relayer, so the
+     * relayer (not the 0-balance account) pays the reserve of any NEW subentry.
+     * Adding a factor (passkey / recovery) or a device slot creates a data entry
+     * that needs ~0.5 XLM of reserve; a sponsored account holds no XLM, so — like
+     * account creation — the write must be wrapped in begin/endSponsoringFuture
+     * reserves with the relayer as sponsor. Ops:
+     *   0. beginSponsoringFutureReserves(account)   source = relayer
+     *   1..n. manageData(cv:…)                       source = account (control-signed)
+     *   last. endSponsoringFutureReserves()          source = account
+     *
+     * Signed by the control key (account ops) + the relayer (source + fee + sponsor).
+     */
+    buildSponsoredDataTx(params: {
+        relayer: string;
+        account: string;
+        entries: Record<string, Uint8Array>;
+    }): Promise<Transaction>;
+    /** Wrap a control-signed inner tx in a fee-bump whose fee source is `feeSource`
+     *  (the relayer). The inner tx pays nothing; the relayer pays all fees. */
+    wrapFeeBump(inner: Transaction, feeSource: string): FeeBumpTransaction;
+    /** Submit a fully-signed classic transaction and return its hash. Throws with
+     *  the Horizon result codes on failure. */
+    submit(tx: Transaction | FeeBumpTransaction): Promise<string>;
+    /** Build an `Account` handle for a known address + sequence (avoids a Horizon
+     *  round-trip when the caller already has the sequence). */
+    accountAt(address: string, sequence: string): Account;
+}
+
+interface WebCryptoUnwrapKeyOptions {
+    /** Storage key for this device's unwrap key (e.g. `${userId}:${appSalt}`). One
+     *  ECDH key per (this value, browser profile). */
+    keyId: string;
+}
+/**
+ * Browser `DeviceUnwrapKey`: a non-extractable P-256 **ECDH** key generated with
+ * WebCrypto and persisted in IndexedDB. Distinct from `WebCryptoSigner` (an ECDSA
+ * signing key) — a signing key can't do ECDH, so the classic-G envelope needs its
+ * own key here. The private key never leaves WebCrypto: the account DEK is
+ * unwrapped via `deriveBits` (raw ECDH), then AES-GCM in `@noble` on the derived
+ * KEK. Per-device, non-syncable → losing the device loses only this convenience
+ * factor, never the account (the passkey / recovery factors survive).
+ */
+declare class WebCryptoDeviceUnwrapKey implements DeviceUnwrapKey {
+    private readonly privateKey;
+    private readonly publicRaw;
+    readonly keyId: string;
+    private constructor();
+    /** Create a fresh device unwrap key and persist it. */
+    static create(opts: WebCryptoUnwrapKeyOptions): Promise<WebCryptoDeviceUnwrapKey>;
+    /** Load an existing device unwrap key, or null if none exists yet. */
+    static load(opts: WebCryptoUnwrapKeyOptions): Promise<WebCryptoDeviceUnwrapKey | null>;
+    /** Load the device unwrap key, creating one on first use. */
+    static loadOrCreate(opts: WebCryptoUnwrapKeyOptions): Promise<WebCryptoDeviceUnwrapKey>;
+    publicKeySec1(): Uint8Array;
+    slotId(): string;
+    unwrap(blob: Uint8Array): Promise<Uint8Array>;
+}
+
+/**
+ * WebAuthn **PRF** factor for the classic-G envelope.
+ *
+ * Unlike the Soroban passkey path (which needs an on-chain-verifiable *assertion
+ * signature*), the classic-G account only needs a stable 32-byte secret to wrap
+ * the DEK — exactly what the WebAuthn PRF extension provides: for a given
+ * credential + input salt the authenticator returns the same 32 bytes on every
+ * device the passkey syncs to (iCloud Keychain / Google Password Manager), and
+ * that secret is derived inside the authenticator and never derivable by Cavos or
+ * OAuth. That makes it the ideal synced anchor to approve a new device or recover.
+ *
+ * `getSecret()` returns the raw PRF output; callers pass it to
+ * `derivePasskeyKEK` (via `CavosStellar.enrollPasskey` /
+ * `approveThisDeviceWithPasskey`). Keeping this class free of any DEK/KEK logic
+ * lets the account class stay runtime-agnostic and unit-testable.
+ */
+interface PasskeyPrfOptions {
+    /** Relying-Party id (usually the eTLD+1). Defaults to `window.location.hostname`. */
+    rpId?: string;
+    /** Human-readable RP name shown in the OS passkey UI. */
+    rpName?: string;
+}
+interface PasskeyPrfEnrollParams {
+    /** Stable user handle for the credential (e.g. the account address or userId). */
+    userId: string;
+    /** Account name shown in the OS passkey UI (e.g. an email). */
+    userName: string;
+    displayName?: string;
+}
+declare class PasskeyPrf {
+    private readonly rpId;
+    private readonly rpName;
+    constructor(opts?: PasskeyPrfOptions);
+    /** True if this platform advertises a usable passkey (platform authenticator). */
+    static isSupported(): Promise<boolean>;
     /**
-     * Read a SEP-41 token balance of `account` via a read-only simulation of
-     * `token.balance(account)`. Returns 0 when the account isn't deployed or holds
-     * none. `readSource` is any funded G-account (used only for the simulation).
+     * Create a new synced, discoverable passkey with the PRF extension enabled, then
+     * immediately read its PRF secret. Returns the credential id and the 32-byte
+     * secret so the caller can enroll the passkey factor in one step. Some
+     * authenticators don't return PRF results on create — in that case `secret` is
+     * undefined and the caller should follow up with `getSecret()`.
      */
-    readBalance(tokenId: string, account: string, readSource: string): Promise<bigint>;
-    /** Whether the account contract instance exists on-chain (is deployed). */
-    isDeployed(accountAddress: string): Promise<boolean>;
+    enroll(params: PasskeyPrfEnrollParams): Promise<{
+        credentialId: Uint8Array;
+        secret?: Uint8Array;
+    }>;
     /**
-     * Read whether `signer` is a currently-authorized signer of the account, via a
-     * read-only simulation of `account.is_authorized(signer)`. `readSource` is any
-     * funded G-account (used only for the simulation's source/sequence).
+     * Get the passkey's 32-byte PRF secret. Uses discoverable credentials (no
+     * `allowCredentials`), so it works from a brand-new browser — the OS shows the
+     * synced passkey picker. Throws if the authenticator doesn't support PRF.
      */
-    isAuthorizedSigner(accountAddress: string, signer: DevicePublicKey, readSource: string): Promise<boolean>;
+    getSecret(): Promise<Uint8Array>;
 }
-/** SEC-1 uncompressed P-256 public key (65 bytes: 0x04 || X || Y). */
-declare function sec1Pubkey(pk: DevicePublicKey): Uint8Array;
-/** Raw 64-byte `r || s`, normalized to low-S (secp256r1_verify requires it). */
-declare function encodeLowSSignature(sig: DeviceSignature): Uint8Array;
+
+/**
+ * The account's master `Keypair`. Its public key IS the classic `G…` address of
+ * the account. Deterministic: same identity → same keypair on every device.
+ * Set to weight 0 at creation, so this keypair can never actually authorize a
+ * transaction — it only names the account.
+ */
+declare function deriveStellarMasterKeypair(identity: IdentityInput): Keypair;
+/**
+ * The deterministic `G…` address for an identity, derivable offline from login
+ * alone — no chain read, no registry. This is what makes the account
+ * self-custodial and backend-free: the address is a pure function of identity.
+ */
+declare function deriveStellarAddress(identity: IdentityInput): string;
+/** A freshly generated control key: the real (weight-1) signer of the account.
+ *  Returns both the `Keypair` and its raw 32-byte seed (the secret that the
+ *  envelope encrypts). Generated once at account creation, then only ever
+ *  recovered by decrypting the on-chain envelope. */
+declare function generateControlKey(): {
+    keypair: Keypair;
+    seed: Uint8Array;
+};
+
+/** A DEK-wrap blob: `nonce || AES-GCM(kek, dek)`. Self-contained (nonce inline). */
+type WrappedDEK = Uint8Array;
+/** Fresh 256-bit data-encryption key. One per account, generated at creation. */
+declare function generateDEK(): Uint8Array;
+/** Encrypt the control seed under the DEK → `nonce || ct`. */
+declare function sealControlSeed(controlSeed: Uint8Array, dek: Uint8Array): Uint8Array;
+/** Decrypt the control seed (`nonce || ct`) under the DEK. Throws on tamper. */
+declare function openControlSeed(sealed: Uint8Array, dek: Uint8Array): Uint8Array;
+/** Wrap the DEK under a raw 32-byte KEK → `nonce || AES-GCM(kek, dek)`. */
+declare function wrapDEK(dek: Uint8Array, kek: Uint8Array): WrappedDEK;
+/** Unwrap the DEK from a `nonce || ct` blob under a raw 32-byte KEK. */
+declare function unwrapDEK(wrapped: WrappedDEK, kek: Uint8Array): Uint8Array;
+/** KEK from a human recovery code (PBKDF2-stretched, then HKDF-scoped). The same
+ *  normalised code yields the same KEK on any device. */
+declare function deriveRecoveryKEK(code: string): Uint8Array;
+/** KEK from a WebAuthn PRF output (32 bytes the authenticator returns for our
+ *  fixed PRF salt). HKDF-scoped so the raw PRF secret is never used directly. */
+declare function derivePasskeyKEK(prfOutput: Uint8Array): Uint8Array;
 /**
- * The `Vec<DeviceSignature>` ScVal the contract's `__check_auth` decodes. Each
- * element is a struct `{ public_key: BytesN<65>, signature: BytesN<64> }`.
- * Soroban serializes a struct as a symbol-keyed map sorted by key; `public_key`
- * precedes `signature`, so `nativeToScVal` (which sorts) yields the exact layout.
+ * ECIES-wrap the DEK to a device's P-256 public key (SEC1 uncompressed, 65
+ * bytes). Returns `ephPubCompressed(33) || nonce(12) || ct` — self-contained.
+ * An ephemeral keypair makes each wrap use a fresh shared secret; the device
+ * unwraps with its private scalar. The ephemeral public key is bound into the
+ * KEK via the HKDF salt so it can't be swapped.
  */
-declare function deviceSignatureScVal(pubkey: DevicePublicKey, sig: DeviceSignature): xdr.ScVal;
+declare function eciesWrapDEK(dek: Uint8Array, recipientPubSec1: Uint8Array): Uint8Array;
+/** ECIES-unwrap the DEK with the device's private scalar (32 bytes). */
+declare function eciesUnwrapDEK(blob: Uint8Array, recipientPrivScalar: Uint8Array): Uint8Array;
 
 /**
  * Serialize a device signature to the felt array for `tx_info.signature`:
@@ -446,4 +644,4 @@ declare function hexToBytes(hex: string): Uint8Array;
 /** A felt/bigint -> 32-byte big-endian Uint8Array (the tx-hash width). */
 declare function bigIntTo32Bytes(value: bigint): Uint8Array;
 
-export { AuthProvider, BackupSigner, CavosAuth, type CavosAuthOptions, ChainAdapter, ChainCall, ComputeAddressParams, DEVICE_ACCOUNT_CLASS_HASH, DevicePublicKey, DeviceSignature, DeviceSigner, HttpRecoveryClient, type HttpRecoveryClientOptions, HttpWalletRegistry, type HttpWalletRegistryOptions, Identity, type IdentityInput, PasskeyAssertion, PendingDeviceRequest, RecoveryClient, RegisteredWallet, STARKNET_NETWORKS, StarknetAdapter, type StarknetAdapterOptions, StarknetDeviceSigner, type StarknetNetwork, StellarAdapter, type StellarAdapterOptions, StellarNetwork, UDC_ADDRESS, WalletRegistry, WebCryptoSigner, type WebCryptoSignerOptions, bigIntTo32Bytes, bytesToBigInt, bytesToHex, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, deviceSignatureScVal, encodeLowSSignature as encodeStellarLowSSignature, generateRecoveryCode, hexToBytes, recoverYParity, sec1Pubkey, signatureToFelts, u256ToFelts };
+export { type AccountEnvelope, AuthProvider, BackupSigner, CavosAuth, type CavosAuthOptions, ChainAdapter, ChainCall, ComputeAddressParams, DEVICE_ACCOUNT_CLASS_HASH, DevicePublicKey, DeviceSignature, DeviceSigner, DeviceUnwrapKey, HttpRecoveryClient, type HttpRecoveryClientOptions, HttpWalletRegistry, type HttpWalletRegistryOptions, Identity, type IdentityInput, PasskeyAssertion, PasskeyPrf, type PasskeyPrfEnrollParams, type PasskeyPrfOptions, PendingDeviceRequest, RecoveryClient, RegisteredWallet, STARKNET_NETWORKS, StarknetAdapter, type StarknetAdapterOptions, StarknetDeviceSigner, type StarknetNetwork, StellarAdapter, type StellarAdapterOptions, StellarNetwork, UDC_ADDRESS, WalletRegistry, WebCryptoDeviceUnwrapKey, WebCryptoSigner, type WebCryptoSignerOptions, type WebCryptoUnwrapKeyOptions, bigIntTo32Bytes, bytesToBigInt, bytesToHex, deriveAddressSeed, deriveAddressSeedSolana, deriveAddressSeedStellar, deriveBackupKey, derivePasskeyKEK, deriveRecoveryKEK, deriveStellarAddress, deriveStellarMasterKeypair, eciesUnwrapDEK, eciesWrapDEK, fromDataEntries, generateControlKey, generateDEK, generateRecoveryCode, hexToBytes, openControlSeed, recoverYParity, sealControlSeed, signatureToFelts, toDataEntries, u256ToFelts, unwrapDEK, wrapDEK };