@cavos/kit 0.0.4 → 0.0.5

package/dist/index.js

@@ -27,8 +27,8 @@ function bytesToHex(bytes) {
   return s;
 }
 function hexToBytes(hex) {
-  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
-  const padded = clean.length % 2 ? "0" + clean : clean;
+  const clean2 = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const padded = clean2.length % 2 ? "0" + clean2 : clean2;
   const out = new Uint8Array(padded.length / 2);
   for (let i = 0; i < out.length; i++) out[i] = parseInt(padded.slice(i * 2, i * 2 + 2), 16);
   return out;
@@ -182,7 +182,7 @@ var CAVOS_PAYMASTER_URL = {
   mainnet: "https://paymaster.cavos.xyz"
 };
 var DEVICE_ACCOUNT_CLASS_HASH = {
-  sepolia: "0x25cbc5423e8ee895febb0ef2c3945b408da44d0039d915fbdd681fe6b6ba66b",
+  sepolia: "0x765f000b7021577aa0d6c206fb3d8ac73571686b3e76b9dc9b6d59a372e8c2c",
   mainnet: "0x1840aded59e8a0d2b440a134cb9079a7fc11b06c77f58ed189ab436a034ca6a"
 };
 
@@ -192,21 +192,34 @@ var StarknetAdapter = class {
     this.opts = opts;
     this.chain = "starknet";
   }
-  computeAddress({ addressSeed, initialSigner, salt }) {
+  /**
+   * Deterministic address = f(addressSeed) ONLY. The device pubkey is NOT
+   * part of the derivation — anti-squatting is the integrator's responsibility
+   * (keep `appSalt` secret; deploy on first login). This makes the address
+   * recomputable by the user from (userId, appSalt) alone, even after losing
+   * every device.
+   *
+   * `initialSigner` in `ComputeAddressParams` is IGNORED on Starknet (kept in
+   * the shared type for Solana/Stellar, which still include it).
+   */
+  computeAddress({ addressSeed, salt }) {
     return starknet.hash.calculateContractAddressFromHash(
       starknet.num.toHex(salt ?? addressSeed),
       this.opts.classHash,
-      this.constructorCalldata(addressSeed, initialSigner),
+      this.constructorCalldata(addressSeed),
       0
       // deployerAddress 0 => deterministic counterfactual address
     );
   }
-  /** Single UDC deploy; the constructor registers the first device signer, so
-   * the account is ready the moment it is deployed (fits the paymaster's
-   * deploy + execute_from_outside bundle). */
+  /**
+   * UDC deploy call. The constructor takes ONLY the seed — no device pubkey —
+   * so the account is born with no signers. The caller MUST follow up with
+   * `buildInitialize` in the same multicall (or a separate tx) to register the
+   * first device signer; otherwise the account is unusable.
+   */
   buildDeploy(params) {
     const salt = params.salt ?? params.addressSeed;
-    const calldata = this.constructorCalldata(params.addressSeed, params.initialSigner);
+    const calldata = this.constructorCalldata(params.addressSeed);
     return [
       {
         contractAddress: UDC_ADDRESS,
@@ -222,9 +235,22 @@ var StarknetAdapter = class {
       }
     ];
   }
-  /** Constructor calldata: [address_seed, pub_x_low, pub_x_high, pub_y_low, pub_y_high]. */
-  constructorCalldata(addressSeed, initialSigner) {
-    return [starknet.num.toHex(addressSeed), ...pubkeyCalldata(initialSigner)];
+  /** Constructor calldata: [address_seed]. Device pubkey is registered post-deploy via initialize. */
+  constructorCalldata(addressSeed) {
+    return [starknet.num.toHex(addressSeed)];
+  }
+  /**
+   * `initialize` call: registers the first device signer. Callable only while
+   * the account has no signers (one-shot). In production this is bundled with
+   * the UDC deploy in a single sponsored multicall — see `connectStarknet`.
+   * Anti-squatting is NOT enforced on-chain.
+   */
+  buildInitialize(accountAddress, devicePubkey) {
+    return {
+      contractAddress: accountAddress,
+      entrypoint: "initialize",
+      calldata: pubkeyCalldata(devicePubkey)
+    };
   }
   buildAddSigner(accountAddress, signer) {
     return { contractAddress: accountAddress, entrypoint: "add_signer", calldata: pubkeyCalldata(signer) };
@@ -460,26 +486,30 @@ var SolanaAdapter = class {
     this.chain = "solana";
     this.programId = new web3_js.PublicKey(opts.programId ?? DEVICE_ACCOUNT_PROGRAM_ID);
   }
-  /** Deterministic account address: PDA of [seed, address_seed, initial_signer_x]. */
-  computeAddress(addressSeed, initialSigner) {
-    return this.pda(addressSeed, compressedPubkey(initialSigner)).toBase58();
+  /**
+   * Deterministic account address: PDA of [ACCOUNT_SEED, addressSeed] — the
+   * device pubkey is NOT part of the seeds, so the address is recomputable
+   * from (userId, appSalt) alone. Anti-squatting is the integrator's
+   * responsibility (keep `appSalt` secret; deploy on first login).
+   */
+  computeAddress(addressSeed) {
+    return this.pda(addressSeed).toBase58();
   }
-  pda(addressSeed, initialCompressed) {
+  pda(addressSeed) {
     const [pda] = web3_js.PublicKey.findProgramAddressSync(
-      [
-        Buffer.from(ACCOUNT_SEED),
-        Buffer.from(addressSeed),
-        Buffer.from(initialCompressed.slice(1, 33))
-        // x-coordinate
-      ],
+      [Buffer.from(ACCOUNT_SEED), Buffer.from(addressSeed)],
       this.programId
     );
     return pda;
   }
-  /** `initialize` instruction creating the account with its first device signer. */
+  /**
+   * `initialize` instruction: creates the account PDA and registers the first
+   * device signer. No attestation is required — anti-squatting is NOT enforced
+   * on-chain.
+   */
   buildInitialize(addressSeed, payer, initialSigner) {
     const initialCompressed = compressedPubkey(initialSigner);
-    const account = this.pda(addressSeed, initialCompressed);
+    const account = this.pda(addressSeed);
     const data = Buffer.concat([
       anchorDiscriminator("initialize"),
       Buffer.from(addressSeed),
@@ -487,7 +517,7 @@ var SolanaAdapter = class {
       Buffer.from(initialCompressed)
       // [u8;33]
     ]);
-    return new web3_js.TransactionInstruction({
+    const programIx = new web3_js.TransactionInstruction({
       programId: this.programId,
       keys: [
         { pubkey: account, isSigner: false, isWritable: true },
@@ -496,6 +526,7 @@ var SolanaAdapter = class {
       ],
       data
     });
+    return [programIx];
   }
   /** `[precompile, add_signer]` bundle, authorized by an existing device signer. */
   async buildAddSigner(account, newSigner) {
@@ -834,8 +865,8 @@ function u64le(n) {
   new DataView(b.buffer, b.byteOffset, 8).setBigUint64(0, BigInt(n), true);
   return b;
 }
-function readU64le(buf2, offset) {
-  return new DataView(buf2.buffer, buf2.byteOffset, buf2.length).getBigUint64(
+function readU64le(buf3, offset) {
+  return new DataView(buf3.buffer, buf3.byteOffset, buf3.length).getBigUint64(
     offset,
     true
   );
@@ -894,11 +925,11 @@ var SolanaRelayer = class {
   async send(instructions) {
     const feePayer = await this.getFeePayer();
     const { blockhash } = await this.opts.connection.getLatestBlockhash("confirmed");
-    const tx2 = new web3_js.Transaction();
-    tx2.feePayer = feePayer;
-    tx2.recentBlockhash = blockhash;
-    tx2.add(...instructions);
-    const serialized = tx2.serialize({ requireAllSignatures: false, verifySignatures: false }).toString("base64");
+    const tx3 = new web3_js.Transaction();
+    tx3.feePayer = feePayer;
+    tx3.recentBlockhash = blockhash;
+    tx3.add(...instructions);
+    const serialized = tx3.serialize({ requireAllSignatures: false, verifySignatures: false }).toString("base64");
     const res = await fetch(`${this.opts.baseUrl}/api/solana/relay`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -1344,16 +1375,16 @@ var CavosSolana = class _CavosSolana {
         opts.feePayer
       );
     }
-    const address = adapter.computeAddress(addressSeed, devicePubkey);
+    const address = adapter.computeAddress(addressSeed);
     const deployed = await connection.getAccountInfo(new web3_js.PublicKey(address)) !== null;
     if (!deployed) {
       if (relayer) {
         const payer = await relayer.getFeePayer();
-        const ix = adapter.buildInitialize(addressSeed, payer.toBase58(), devicePubkey);
-        await relayer.send([ix]);
+        const ixs = adapter.buildInitialize(addressSeed, payer.toBase58(), devicePubkey);
+        await relayer.send(ixs);
       } else if (opts.feePayer) {
-        const ix = adapter.buildInitialize(addressSeed, opts.feePayer.publicKey.toBase58(), devicePubkey);
-        await web3_js.sendAndConfirmTransaction(connection, new web3_js.Transaction().add(ix), [opts.feePayer]);
+        const ixs = adapter.buildInitialize(addressSeed, opts.feePayer.publicKey.toBase58(), devicePubkey);
+        await web3_js.sendAndConfirmTransaction(connection, new web3_js.Transaction().add(...ixs), [opts.feePayer]);
       } else {
         throw new Error("kit/solana: a relayer (appId) or feePayer is required to initialize a new account");
       }
@@ -1452,12 +1483,12 @@ var CavosSolana = class _CavosSolana {
     return { transactionHash: await this.send(ixs) };
   }
   /** Move `amount` lamports out of the account to `destination` (device-signed). */
-  async execute(amount, destination) {
+  async execute(amount, destination, opts) {
     if (this.status !== "ready") {
       throw new Error("kit/solana: this device is not yet an authorized signer of the wallet");
     }
     const ixs = await this.adapter.buildExecuteTransfer(this.address, destination, amount);
-    return this.send(ixs);
+    return this.send(ixs, opts);
   }
   /**
    * Run arbitrary CPI `instructions` with the account PDA as signer (device-
@@ -1467,14 +1498,16 @@ var CavosSolana = class _CavosSolana {
    *
    * What the relayer will sponsor is constrained by the app's Solana program
    * allowlist (configured in the dashboard) — programs outside the allowlist are
-   * rejected before co-signing.
+   * rejected before co-signing. Pass `{ sponsored: false }` to bypass the relayer
+   * and pay the fee from a configured `feePayer` (e.g. for allowlisted programs
+   * the relayer rejects, or to test the device signature end-to-end).
    */
-  async executeInstructions(instructions) {
+  async executeInstructions(instructions, opts) {
     if (this.status !== "ready") {
       throw new Error("kit/solana: this device is not yet an authorized signer of the wallet");
     }
     const ixs = await this.adapter.buildExecute(this.address, instructions);
-    return this.send(ixs);
+    return this.send(ixs, opts);
   }
   /**
    * Register the backup signer derived from `code` as an authorized signer of this
@@ -1553,323 +1586,984 @@ var CavosSolana = class _CavosSolana {
       opts.feePayer
     );
   }
-  async send(ixs) {
-    if (this.relayer) return this.relayer.send(ixs);
+  /**
+   * Submit a built instruction bundle. Sponsored by default (relayer pays the
+   * fee); pass `{ sponsored: false }` to self-fund via the configured `feePayer`.
+   * The device signature is embedded inside the secp256r1 precompile instruction,
+   * NOT applied as a Solana tx signature — so switching only changes who pays,
+   * never the signing identity.
+   */
+  async send(ixs, opts) {
+    const sponsored = opts?.sponsored !== false;
+    if (sponsored && this.relayer) return this.relayer.send(ixs);
     if (this.feePayer) {
       return web3_js.sendAndConfirmTransaction(this.connection, new web3_js.Transaction().add(...ixs), [this.feePayer]);
     }
-    throw new Error("kit/solana: no relayer or feePayer configured to submit transactions");
+    throw new Error(
+      `kit/solana: cannot ${sponsored ? "sponsor" : "self-fund"} \u2014 no ${sponsored ? "relayer" : "feePayer"} configured`
+    );
   }
 };
 var defaultRegistry = new InMemoryWalletRegistry();
 
 // src/chains/stellar/constants.ts
-var FACTORY_CONTRACT_ID = {
-  // Re-deployed 2026-07-01 with the passkey-approval device-account wasm (batched
-  // multi-chain challenge). The factory pins the wasm hash immutably, so a new
-  // wasm needs a new factory → new account addresses; testnet has no prod wallets.
-  "stellar-testnet": "CBCJIODXIEBOXXD66KCUCF7ZDYJARKI4ZIVQOVWPULOBH5XGNCDP6W3I",
-  // Set once the factory is deployed to mainnet (its address differs — network id
-  // is part of contract-address derivation).
-  "stellar-mainnet": ""
-};
-var DEVICE_ACCOUNT_WASM_HASH = {
-  "stellar-testnet": "2671b085578e59a385ef5a5664e42f0450322fe3249539f588e1263ed5a31dce",
-  "stellar-mainnet": ""
-};
 var STELLAR_NETWORKS = {
   "stellar-testnet": {
-    rpcUrl: "https://soroban-testnet.stellar.org",
     passphrase: "Test SDF Network ; September 2015"
   },
   "stellar-mainnet": {
-    rpcUrl: "https://soroban-rpc.mainnet.stellar.gateway.fm",
     passphrase: "Public Global Stellar Network ; September 2015"
   }
 };
-var NATIVE_SAC_ID = {
-  "stellar-testnet": "CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC",
-  "stellar-mainnet": "CAS3J7GYLGXMF6TDJBBYYSE3HQ6BBSMLNUQ34T6TZMYMW2EVH34XOWMA"
+var HORIZON_URL = {
+  "stellar-testnet": "https://horizon-testnet.stellar.org",
+  "stellar-mainnet": "https://horizon.stellar.org"
+};
+var XLM_DECIMALS = 7;
+
+// node_modules/@noble/ciphers/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function u8(arr) {
+  return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function toBytes(data) {
+  if (typeof data === "string")
+    data = utf8ToBytes(data);
+  else if (isBytes(data))
+    data = copyBytes(data);
+  else
+    throw new Error("Uint8Array expected, got " + typeof data);
+  return data;
+}
+function equalBytes(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var wrapCipher = /* @__NO_SIDE_EFFECTS__ */ (params, constructor) => {
+  function wrappedCipher(key, ...args) {
+    abytes(key);
+    if (!isLE)
+      throw new Error("Non little-endian hardware is not yet supported");
+    if (params.nonceLength !== void 0) {
+      const nonce = args[0];
+      if (!nonce)
+        throw new Error("nonce / iv required");
+      if (params.varSizeNonce)
+        abytes(nonce);
+      else
+        abytes(nonce, params.nonceLength);
+    }
+    const tagl = params.tagLength;
+    if (tagl && args[1] !== void 0) {
+      abytes(args[1]);
+    }
+    const cipher = constructor(key, ...args);
+    const checkOutput = (fnLength, output) => {
+      if (output !== void 0) {
+        if (fnLength !== 2)
+          throw new Error("cipher output not supported");
+        abytes(output);
+      }
+    };
+    let called = false;
+    const wrCipher = {
+      encrypt(data, output) {
+        if (called)
+          throw new Error("cannot encrypt() twice with same key + nonce");
+        called = true;
+        abytes(data);
+        checkOutput(cipher.encrypt.length, output);
+        return cipher.encrypt(data, output);
+      },
+      decrypt(data, output) {
+        abytes(data);
+        if (tagl && data.length < tagl)
+          throw new Error("invalid ciphertext length: smaller than tagLength=" + tagl);
+        checkOutput(cipher.decrypt.length, output);
+        return cipher.decrypt(data, output);
+      }
+    };
+    return wrCipher;
+  }
+  Object.assign(wrappedCipher, params);
+  return wrappedCipher;
+};
+function getOutput(expectedLength, out, onlyAligned = true) {
+  if (out === void 0)
+    return new Uint8Array(expectedLength);
+  if (out.length !== expectedLength)
+    throw new Error("invalid output length, expected " + expectedLength + ", got: " + out.length);
+  if (onlyAligned && !isAligned32(out))
+    throw new Error("invalid output, must be aligned");
+  return out;
+}
+function setBigUint64(view, byteOffset, value, isLE2) {
+  if (typeof view.setBigUint64 === "function")
+    return view.setBigUint64(byteOffset, value, isLE2);
+  const _32n = BigInt(32);
+  const _u32_max = BigInt(4294967295);
+  const wh = Number(value >> _32n & _u32_max);
+  const wl = Number(value & _u32_max);
+  const h = 0;
+  const l = 4;
+  view.setUint32(byteOffset + h, wh, isLE2);
+  view.setUint32(byteOffset + l, wl, isLE2);
+}
+function u64Lengths(dataLength, aadLength, isLE2) {
+  const num5 = new Uint8Array(16);
+  const view = createView(num5);
+  setBigUint64(view, 0, BigInt(aadLength), isLE2);
+  setBigUint64(view, 8, BigInt(dataLength), isLE2);
+  return num5;
+}
+function isAligned32(bytes) {
+  return bytes.byteOffset % 4 === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(bytes);
+}
+
+// node_modules/@noble/ciphers/esm/_polyval.js
+var BLOCK_SIZE = 16;
+var ZEROS16 = /* @__PURE__ */ new Uint8Array(16);
+var ZEROS32 = u32(ZEROS16);
+var POLY = 225;
+var mul2 = (s0, s1, s2, s3) => {
+  const hiBit = s3 & 1;
+  return {
+    s3: s2 << 31 | s3 >>> 1,
+    s2: s1 << 31 | s2 >>> 1,
+    s1: s0 << 31 | s1 >>> 1,
+    s0: s0 >>> 1 ^ POLY << 24 & -(hiBit & 1)
+    // reduce % poly
+  };
+};
+var swapLE = (n) => (n >>> 0 & 255) << 24 | (n >>> 8 & 255) << 16 | (n >>> 16 & 255) << 8 | n >>> 24 & 255 | 0;
+function _toGHASHKey(k) {
+  k.reverse();
+  const hiBit = k[15] & 1;
+  let carry = 0;
+  for (let i = 0; i < k.length; i++) {
+    const t = k[i];
+    k[i] = t >>> 1 | carry;
+    carry = (t & 1) << 7;
+  }
+  k[0] ^= -hiBit & 225;
+  return k;
+}
+var estimateWindow = (bytes) => {
+  if (bytes > 64 * 1024)
+    return 8;
+  if (bytes > 1024)
+    return 4;
+  return 2;
+};
+var GHASH = class {
+  // We select bits per window adaptively based on expectedLength
+  constructor(key, expectedLength) {
+    this.blockLen = BLOCK_SIZE;
+    this.outputLen = BLOCK_SIZE;
+    this.s0 = 0;
+    this.s1 = 0;
+    this.s2 = 0;
+    this.s3 = 0;
+    this.finished = false;
+    key = toBytes(key);
+    abytes(key, 16);
+    const kView = createView(key);
+    let k0 = kView.getUint32(0, false);
+    let k1 = kView.getUint32(4, false);
+    let k2 = kView.getUint32(8, false);
+    let k3 = kView.getUint32(12, false);
+    const doubles = [];
+    for (let i = 0; i < 128; i++) {
+      doubles.push({ s0: swapLE(k0), s1: swapLE(k1), s2: swapLE(k2), s3: swapLE(k3) });
+      ({ s0: k0, s1: k1, s2: k2, s3: k3 } = mul2(k0, k1, k2, k3));
+    }
+    const W = estimateWindow(expectedLength || 1024);
+    if (![1, 2, 4, 8].includes(W))
+      throw new Error("ghash: invalid window size, expected 2, 4 or 8");
+    this.W = W;
+    const bits = 128;
+    const windows = bits / W;
+    const windowSize = this.windowSize = 2 ** W;
+    const items = [];
+    for (let w = 0; w < windows; w++) {
+      for (let byte = 0; byte < windowSize; byte++) {
+        let s0 = 0, s1 = 0, s2 = 0, s3 = 0;
+        for (let j = 0; j < W; j++) {
+          const bit = byte >>> W - j - 1 & 1;
+          if (!bit)
+            continue;
+          const { s0: d0, s1: d1, s2: d2, s3: d3 } = doubles[W * w + j];
+          s0 ^= d0, s1 ^= d1, s2 ^= d2, s3 ^= d3;
+        }
+        items.push({ s0, s1, s2, s3 });
+      }
+    }
+    this.t = items;
+  }
+  _updateBlock(s0, s1, s2, s3) {
+    s0 ^= this.s0, s1 ^= this.s1, s2 ^= this.s2, s3 ^= this.s3;
+    const { W, t, windowSize } = this;
+    let o0 = 0, o1 = 0, o2 = 0, o3 = 0;
+    const mask = (1 << W) - 1;
+    let w = 0;
+    for (const num5 of [s0, s1, s2, s3]) {
+      for (let bytePos = 0; bytePos < 4; bytePos++) {
+        const byte = num5 >>> 8 * bytePos & 255;
+        for (let bitPos = 8 / W - 1; bitPos >= 0; bitPos--) {
+          const bit = byte >>> W * bitPos & mask;
+          const { s0: e0, s1: e1, s2: e2, s3: e3 } = t[w * windowSize + bit];
+          o0 ^= e0, o1 ^= e1, o2 ^= e2, o3 ^= e3;
+          w += 1;
+        }
+      }
+    }
+    this.s0 = o0;
+    this.s1 = o1;
+    this.s2 = o2;
+    this.s3 = o3;
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const b32 = u32(data);
+    const blocks = Math.floor(data.length / BLOCK_SIZE);
+    const left = data.length % BLOCK_SIZE;
+    for (let i = 0; i < blocks; i++) {
+      this._updateBlock(b32[i * 4 + 0], b32[i * 4 + 1], b32[i * 4 + 2], b32[i * 4 + 3]);
+    }
+    if (left) {
+      ZEROS16.set(data.subarray(blocks * BLOCK_SIZE));
+      this._updateBlock(ZEROS32[0], ZEROS32[1], ZEROS32[2], ZEROS32[3]);
+      clean(ZEROS32);
+    }
+    return this;
+  }
+  destroy() {
+    const { t } = this;
+    for (const elm of t) {
+      elm.s0 = 0, elm.s1 = 0, elm.s2 = 0, elm.s3 = 0;
+    }
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { s0, s1, s2, s3 } = this;
+    const o32 = u32(out);
+    o32[0] = s0;
+    o32[1] = s1;
+    o32[2] = s2;
+    o32[3] = s3;
+    return out;
+  }
+  digest() {
+    const res = new Uint8Array(BLOCK_SIZE);
+    this.digestInto(res);
+    this.destroy();
+    return res;
+  }
+};
+var Polyval = class extends GHASH {
+  constructor(key, expectedLength) {
+    key = toBytes(key);
+    abytes(key);
+    const ghKey = _toGHASHKey(copyBytes(key));
+    super(ghKey, expectedLength);
+    clean(ghKey);
+  }
+  update(data) {
+    data = toBytes(data);
+    aexists(this);
+    const b32 = u32(data);
+    const left = data.length % BLOCK_SIZE;
+    const blocks = Math.floor(data.length / BLOCK_SIZE);
+    for (let i = 0; i < blocks; i++) {
+      this._updateBlock(swapLE(b32[i * 4 + 3]), swapLE(b32[i * 4 + 2]), swapLE(b32[i * 4 + 1]), swapLE(b32[i * 4 + 0]));
+    }
+    if (left) {
+      ZEROS16.set(data.subarray(blocks * BLOCK_SIZE));
+      this._updateBlock(swapLE(ZEROS32[3]), swapLE(ZEROS32[2]), swapLE(ZEROS32[1]), swapLE(ZEROS32[0]));
+      clean(ZEROS32);
+    }
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { s0, s1, s2, s3 } = this;
+    const o32 = u32(out);
+    o32[0] = s0;
+    o32[1] = s1;
+    o32[2] = s2;
+    o32[3] = s3;
+    return out.reverse();
+  }
 };
+function wrapConstructorWithKey(hashCons) {
+  const hashC = (msg, key) => hashCons(key, msg.length).update(toBytes(msg)).digest();
+  const tmp = hashCons(new Uint8Array(16), 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = (key, expectedLength) => hashCons(key, expectedLength);
+  return hashC;
+}
+var ghash = wrapConstructorWithKey((key, expectedLength) => new GHASH(key, expectedLength));
+wrapConstructorWithKey((key, expectedLength) => new Polyval(key, expectedLength));
+
+// node_modules/@noble/ciphers/esm/aes.js
+var BLOCK_SIZE2 = 16;
+var BLOCK_SIZE32 = 4;
+var EMPTY_BLOCK = /* @__PURE__ */ new Uint8Array(BLOCK_SIZE2);
+var POLY2 = 283;
+function mul22(n) {
+  return n << 1 ^ POLY2 & -(n >> 7);
+}
+function mul(a, b) {
+  let res = 0;
+  for (; b > 0; b >>= 1) {
+    res ^= a & -(b & 1);
+    a = mul22(a);
+  }
+  return res;
+}
+var sbox = /* @__PURE__ */ (() => {
+  const t = new Uint8Array(256);
+  for (let i = 0, x = 1; i < 256; i++, x ^= mul22(x))
+    t[i] = x;
+  const box = new Uint8Array(256);
+  box[0] = 99;
+  for (let i = 0; i < 255; i++) {
+    let x = t[255 - i];
+    x |= x << 8;
+    box[t[i]] = (x ^ x >> 4 ^ x >> 5 ^ x >> 6 ^ x >> 7 ^ 99) & 255;
+  }
+  clean(t);
+  return box;
+})();
+var rotr32_8 = (n) => n << 24 | n >>> 8;
+var rotl32_8 = (n) => n << 8 | n >>> 24;
+function genTtable(sbox2, fn) {
+  if (sbox2.length !== 256)
+    throw new Error("Wrong sbox length");
+  const T0 = new Uint32Array(256).map((_, j) => fn(sbox2[j]));
+  const T1 = T0.map(rotl32_8);
+  const T2 = T1.map(rotl32_8);
+  const T3 = T2.map(rotl32_8);
+  const T01 = new Uint32Array(256 * 256);
+  const T23 = new Uint32Array(256 * 256);
+  const sbox22 = new Uint16Array(256 * 256);
+  for (let i = 0; i < 256; i++) {
+    for (let j = 0; j < 256; j++) {
+      const idx = i * 256 + j;
+      T01[idx] = T0[i] ^ T1[j];
+      T23[idx] = T2[i] ^ T3[j];
+      sbox22[idx] = sbox2[i] << 8 | sbox2[j];
+    }
+  }
+  return { sbox: sbox2, sbox2: sbox22, T0, T1, T2, T3, T01, T23 };
+}
+var tableEncoding = /* @__PURE__ */ genTtable(sbox, (s) => mul(s, 3) << 24 | s << 16 | s << 8 | mul(s, 2));
+var xPowers = /* @__PURE__ */ (() => {
+  const p = new Uint8Array(16);
+  for (let i = 0, x = 1; i < 16; i++, x = mul22(x))
+    p[i] = x;
+  return p;
+})();
+function expandKeyLE(key) {
+  abytes(key);
+  const len = key.length;
+  if (![16, 24, 32].includes(len))
+    throw new Error("aes: invalid key size, should be 16, 24 or 32, got " + len);
+  const { sbox2 } = tableEncoding;
+  const toClean = [];
+  if (!isAligned32(key))
+    toClean.push(key = copyBytes(key));
+  const k32 = u32(key);
+  const Nk = k32.length;
+  const subByte = (n) => applySbox(sbox2, n, n, n, n);
+  const xk = new Uint32Array(len + 28);
+  xk.set(k32);
+  for (let i = Nk; i < xk.length; i++) {
+    let t = xk[i - 1];
+    if (i % Nk === 0)
+      t = subByte(rotr32_8(t)) ^ xPowers[i / Nk - 1];
+    else if (Nk > 6 && i % Nk === 4)
+      t = subByte(t);
+    xk[i] = xk[i - Nk] ^ t;
+  }
+  clean(...toClean);
+  return xk;
+}
+function apply0123(T01, T23, s0, s1, s2, s3) {
+  return T01[s0 << 8 & 65280 | s1 >>> 8 & 255] ^ T23[s2 >>> 8 & 65280 | s3 >>> 24 & 255];
+}
+function applySbox(sbox2, s0, s1, s2, s3) {
+  return sbox2[s0 & 255 | s1 & 65280] | sbox2[s2 >>> 16 & 255 | s3 >>> 16 & 65280] << 16;
+}
+function encrypt(xk, s0, s1, s2, s3) {
+  const { sbox2, T01, T23 } = tableEncoding;
+  let k = 0;
+  s0 ^= xk[k++], s1 ^= xk[k++], s2 ^= xk[k++], s3 ^= xk[k++];
+  const rounds = xk.length / 4 - 2;
+  for (let i = 0; i < rounds; i++) {
+    const t02 = xk[k++] ^ apply0123(T01, T23, s0, s1, s2, s3);
+    const t12 = xk[k++] ^ apply0123(T01, T23, s1, s2, s3, s0);
+    const t22 = xk[k++] ^ apply0123(T01, T23, s2, s3, s0, s1);
+    const t32 = xk[k++] ^ apply0123(T01, T23, s3, s0, s1, s2);
+    s0 = t02, s1 = t12, s2 = t22, s3 = t32;
+  }
+  const t0 = xk[k++] ^ applySbox(sbox2, s0, s1, s2, s3);
+  const t1 = xk[k++] ^ applySbox(sbox2, s1, s2, s3, s0);
+  const t2 = xk[k++] ^ applySbox(sbox2, s2, s3, s0, s1);
+  const t3 = xk[k++] ^ applySbox(sbox2, s3, s0, s1, s2);
+  return { s0: t0, s1: t1, s2: t2, s3: t3 };
+}
+function ctr32(xk, isLE2, nonce, src, dst) {
+  abytes(nonce, BLOCK_SIZE2);
+  abytes(src);
+  dst = getOutput(src.length, dst);
+  const ctr = nonce;
+  const c32 = u32(ctr);
+  const view = createView(ctr);
+  const src32 = u32(src);
+  const dst32 = u32(dst);
+  const ctrPos = 12;
+  const srcLen = src.length;
+  let ctrNum = view.getUint32(ctrPos, isLE2);
+  let { s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]);
+  for (let i = 0; i + 4 <= src32.length; i += 4) {
+    dst32[i + 0] = src32[i + 0] ^ s0;
+    dst32[i + 1] = src32[i + 1] ^ s1;
+    dst32[i + 2] = src32[i + 2] ^ s2;
+    dst32[i + 3] = src32[i + 3] ^ s3;
+    ctrNum = ctrNum + 1 >>> 0;
+    view.setUint32(ctrPos, ctrNum, isLE2);
+    ({ s0, s1, s2, s3 } = encrypt(xk, c32[0], c32[1], c32[2], c32[3]));
+  }
+  const start = BLOCK_SIZE2 * Math.floor(src32.length / BLOCK_SIZE32);
+  if (start < srcLen) {
+    const b32 = new Uint32Array([s0, s1, s2, s3]);
+    const buf3 = u8(b32);
+    for (let i = start, pos = 0; i < srcLen; i++, pos++)
+      dst[i] = src[i] ^ buf3[pos];
+    clean(b32);
+  }
+  return dst;
+}
+function computeTag(fn, isLE2, key, data, AAD) {
+  const aadLength = AAD ? AAD.length : 0;
+  const h = fn.create(key, data.length + aadLength);
+  if (AAD)
+    h.update(AAD);
+  const num5 = u64Lengths(8 * data.length, 8 * aadLength, isLE2);
+  h.update(data);
+  h.update(num5);
+  const res = h.digest();
+  clean(num5);
+  return res;
+}
+var gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength: 16, varSizeNonce: true }, function aesgcm(key, nonce, AAD) {
+  if (nonce.length < 8)
+    throw new Error("aes/gcm: invalid nonce length");
+  const tagLength = 16;
+  function _computeTag(authKey, tagMask, data) {
+    const tag = computeTag(ghash, false, authKey, data, AAD);
+    for (let i = 0; i < tagMask.length; i++)
+      tag[i] ^= tagMask[i];
+    return tag;
+  }
+  function deriveKeys() {
+    const xk = expandKeyLE(key);
+    const authKey = EMPTY_BLOCK.slice();
+    const counter = EMPTY_BLOCK.slice();
+    ctr32(xk, false, counter, counter, authKey);
+    if (nonce.length === 12) {
+      counter.set(nonce);
+    } else {
+      const nonceLen = EMPTY_BLOCK.slice();
+      const view = createView(nonceLen);
+      setBigUint64(view, 8, BigInt(nonce.length * 8), false);
+      const g = ghash.create(authKey).update(nonce).update(nonceLen);
+      g.digestInto(counter);
+      g.destroy();
+    }
+    const tagMask = ctr32(xk, false, counter, EMPTY_BLOCK);
+    return { xk, authKey, counter, tagMask };
+  }
+  return {
+    encrypt(plaintext) {
+      const { xk, authKey, counter, tagMask } = deriveKeys();
+      const out = new Uint8Array(plaintext.length + tagLength);
+      const toClean = [xk, authKey, counter, tagMask];
+      if (!isAligned32(plaintext))
+        toClean.push(plaintext = copyBytes(plaintext));
+      ctr32(xk, false, counter, plaintext, out.subarray(0, plaintext.length));
+      const tag = _computeTag(authKey, tagMask, out.subarray(0, out.length - tagLength));
+      toClean.push(tag);
+      out.set(tag, plaintext.length);
+      clean(...toClean);
+      return out;
+    },
+    decrypt(ciphertext) {
+      const { xk, authKey, counter, tagMask } = deriveKeys();
+      const toClean = [xk, authKey, tagMask, counter];
+      if (!isAligned32(ciphertext))
+        toClean.push(ciphertext = copyBytes(ciphertext));
+      const data = ciphertext.subarray(0, -tagLength);
+      const passedTag = ciphertext.subarray(-tagLength);
+      const tag = _computeTag(authKey, tagMask, data);
+      toClean.push(tag);
+      if (!equalBytes(tag, passedTag))
+        throw new Error("aes/gcm: invalid ghash tag");
+      const out = ctr32(xk, false, counter, data);
+      clean(...toClean);
+      return out;
+    }
+  };
+});
+var NONCE_LEN = 12;
+var RECOVERY_INFO = "cavos-stellar-dek-recovery";
+var PASSKEY_INFO = "cavos-stellar-dek-passkey";
+var ECIES_INFO = "cavos-stellar-dek-ecies";
+var RECOVERY_PBKDF2_ITERATIONS = 21e4;
+var RECOVERY_KDF_SALT = "cavos-stellar-recovery-v1";
+function generateDEK() {
+  return utils.randomBytes(32);
+}
+function sealControlSeed(controlSeed, dek) {
+  const nonce = utils.randomBytes(NONCE_LEN);
+  const ct = gcm(dek, nonce).encrypt(controlSeed);
+  return concat(nonce, ct);
+}
+function openControlSeed(sealed, dek) {
+  const { nonce, ct } = splitNonce(sealed);
+  return gcm(dek, nonce).decrypt(ct);
+}
+function wrapDEK(dek, kek) {
+  const nonce = utils.randomBytes(NONCE_LEN);
+  return concat(nonce, gcm(kek, nonce).encrypt(dek));
+}
+function unwrapDEK(wrapped, kek) {
+  const { nonce, ct } = splitNonce(wrapped);
+  return gcm(kek, nonce).decrypt(ct);
+}
+function deriveRecoveryKEK(code) {
+  const normalised = code.trim().replace(/\s+/g, " ").toLowerCase();
+  if (!normalised) throw new Error("kit/stellar: recovery code is empty");
+  const stretched = pbkdf2.pbkdf2(sha256.sha256, new TextEncoder().encode(normalised), new TextEncoder().encode(RECOVERY_KDF_SALT), {
+    c: RECOVERY_PBKDF2_ITERATIONS,
+    dkLen: 32
+  });
+  return hkdf.hkdf(sha256.sha256, stretched, void 0, RECOVERY_INFO, 32);
+}
+function derivePasskeyKEK(prfOutput) {
+  if (prfOutput.length < 32) throw new Error("kit/stellar: passkey PRF output too short");
+  return hkdf.hkdf(sha256.sha256, prfOutput, void 0, PASSKEY_INFO, 32);
+}
+function eciesWrapDEK(dek, recipientPubSec1) {
+  const ephPriv = p256.p256.utils.randomPrivateKey();
+  const ephPubCompressed = p256.p256.getPublicKey(ephPriv, true);
+  const kek = eciesKEK(p256.p256.getSharedSecret(ephPriv, recipientPubSec1, false), ephPubCompressed);
+  const wrapped = wrapDEK(dek, kek);
+  return concat(ephPubCompressed, wrapped);
+}
+function eciesUnwrapDEK(blob, recipientPrivScalar) {
+  const ephPubCompressed = blob.subarray(0, 33);
+  const wrapped = blob.subarray(33);
+  const kek = eciesKEK(p256.p256.getSharedSecret(recipientPrivScalar, ephPubCompressed, false), ephPubCompressed);
+  return unwrapDEK(wrapped, kek);
+}
+function eciesKEK(sharedUncompressed, ephPubCompressed) {
+  return eciesKEKFromX(sharedUncompressed.subarray(1, 33), ephPubCompressed);
+}
+function eciesKEKFromX(sharedX, ephPubCompressed) {
+  return hkdf.hkdf(sha256.sha256, sharedX, ephPubCompressed, ECIES_INFO, 32);
+}
+var DATA_ENTRY_MAX = 64;
+function chunkTo64(blob) {
+  if (blob.length <= DATA_ENTRY_MAX) return [blob];
+  const chunks = [];
+  for (let i = 0; i < blob.length; i += DATA_ENTRY_MAX) {
+    chunks.push(blob.subarray(i, i + DATA_ENTRY_MAX));
+  }
+  return chunks;
+}
+function unchunk(chunks) {
+  const total = chunks.reduce((n, c) => n + c.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.length;
+  }
+  return out;
+}
+function concat(a, b) {
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a, 0);
+  out.set(b, a.length);
+  return out;
+}
+function splitNonce(blob) {
+  return { nonce: blob.subarray(0, NONCE_LEN), ct: blob.subarray(NONCE_LEN) };
+}
+
+// src/chains/stellar/datamap.ts
+var CT_BASE = "cv:ct";
+var PASSKEY_BASE = "cv:wp";
+var RECOVERY_BASE = "cv:wr";
+var VERSION_KEY = "cv:v";
+var ENVELOPE_VERSION = 1;
+function deviceBase(slot) {
+  return `cv:wd:${slot}`;
+}
+function toDataEntries(env) {
+  const out = {};
+  writeChunked(out, CT_BASE, env.ct);
+  for (const [slot, blob] of Object.entries(env.deviceWraps)) {
+    writeChunked(out, deviceBase(slot), blob);
+  }
+  if (env.passkeyWrap) writeChunked(out, PASSKEY_BASE, env.passkeyWrap);
+  if (env.recoveryWrap) writeChunked(out, RECOVERY_BASE, env.recoveryWrap);
+  out[VERSION_KEY] = Uint8Array.of(ENVELOPE_VERSION);
+  return out;
+}
+function fromDataEntries(entries) {
+  const ct = readChunked(entries, CT_BASE);
+  if (!ct) throw new Error("kit/stellar: account has no control-seed ciphertext (cv:ct)");
+  const deviceWraps = {};
+  const seenSlots = /* @__PURE__ */ new Set();
+  for (const key of Object.keys(entries)) {
+    const m = key.match(/^cv:wd:([^/]+)\/\d+$/);
+    if (m) seenSlots.add(m[1]);
+  }
+  for (const slot of seenSlots) {
+    const blob = readChunked(entries, deviceBase(slot));
+    if (blob) deviceWraps[slot] = blob;
+  }
+  return {
+    ct,
+    deviceWraps,
+    passkeyWrap: readChunked(entries, PASSKEY_BASE),
+    recoveryWrap: readChunked(entries, RECOVERY_BASE)
+  };
+}
+function deviceWrapEntries(slot, blob) {
+  const out = {};
+  writeChunked(out, deviceBase(slot), blob);
+  return out;
+}
+function writeChunked(out, base, blob) {
+  const chunks = chunkTo64(blob);
+  chunks.forEach((chunk, i) => {
+    out[`${base}/${i}`] = chunk;
+  });
+}
+function readChunked(entries, base) {
+  const chunks = [];
+  for (let i = 0; ; i++) {
+    const chunk = entries[`${base}/${i}`];
+    if (!chunk) break;
+    chunks.push(chunk);
+  }
+  return chunks.length ? unchunk(chunks) : void 0;
+}
 
 // src/chains/stellar/StellarAdapter.ts
-var SECP256R1_N2 = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+var TX_TIMEOUT = 180;
 var StellarAdapter = class {
   constructor(opts) {
     this.chain = "stellar";
     this.network = opts.network;
     this.passphrase = STELLAR_NETWORKS[opts.network].passphrase;
-    this.rpcUrl = opts.rpcUrl ?? STELLAR_NETWORKS[opts.network].rpcUrl;
-    this.factoryId = opts.factoryId ?? FACTORY_CONTRACT_ID[opts.network];
-    if (!this.factoryId) {
-      throw new Error(`kit/stellar: no factory contract id configured for ${opts.network}`);
-    }
-    this.signer = opts.signer;
+    this.horizonUrl = opts.horizonUrl ?? HORIZON_URL[opts.network];
   }
   server() {
     if (!this._server) {
-      this._server = new stellarSdk.rpc.Server(this.rpcUrl, {
-        allowHttp: this.rpcUrl.startsWith("http://")
+      this._server = new stellarSdk.Horizon.Server(this.horizonUrl, {
+        allowHttp: this.horizonUrl.startsWith("http://")
       });
     }
     return this._server;
   }
-  networkId() {
-    return stellarSdk.hash(Buffer.from(this.passphrase));
+  /** Whether the classic account already exists on-chain. */
+  async isDeployed(address) {
+    try {
+      await this.server().loadAccount(address);
+      return true;
+    } catch (e) {
+      if (isNotFound(e)) return false;
+      throw e;
+    }
+  }
+  /** Read the account's `MANAGE_DATA` entries as raw bytes (name → value). */
+  async loadDataEntries(address) {
+    const account = await this.server().loadAccount(address);
+    const out = {};
+    for (const [name, b64] of Object.entries(account.data_attr ?? {})) {
+      out[name] = new Uint8Array(Buffer.from(b64, "base64"));
+    }
+    return out;
+  }
+  /** Native XLM balance in stroops. Returns 0n if the account doesn't exist. */
+  async balance(address) {
+    try {
+      const account = await this.server().loadAccount(address);
+      const native = account.balances.find((b) => b.asset_type === "native");
+      return native ? toStroops(native.balance) : 0n;
+    } catch (e) {
+      if (isNotFound(e)) return 0n;
+      throw e;
+    }
   }
   /**
-   * Deterministic account address for `(addressSeed, initialSigner)` — computed
-   * off-chain, byte-identical to the factory's on-chain `account_address`.
-   * `contractId = sha256(HashIdPreimage(networkId, factory, salt))` with
-   * `salt = sha256(addressSeed || sec1(initialSigner))`.
+   * Build the account-creation transaction (source = funder, the relayer or a
+   * self-funded keypair):
+   *   1. `createAccount` funds the deterministic `G…` master address,
+   *   2. `manageData` writes the control-key envelope entries (authorized by the
+   *      still-weight-1 master),
+   *   3. `setOptions` adds the control signer (weight 1), sets all thresholds to
+   *      1, and zeroes the master weight — after this the master can never sign.
+   *
+   * The returned tx must be signed by BOTH the master keypair (for the account's
+   * own ops) and the funder (source + fee). Sponsorship of reserves is layered on
+   * in Phase 3.
    */
-  computeAddress(addressSeed, initialSigner) {
-    const salt = this.accountSalt(addressSeed, initialSigner);
-    const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeContractId(
-      new stellarSdk.xdr.HashIdPreimageContractId({
-        networkId: this.networkId(),
-        contractIdPreimage: stellarSdk.xdr.ContractIdPreimage.contractIdPreimageFromAddress(
-          new stellarSdk.xdr.ContractIdPreimageFromAddress({
-            address: new stellarSdk.Address(this.factoryId).toScAddress(),
-            salt
-          })
-        )
+  async buildCreateTx(params) {
+    const funderAccount = await this.server().loadAccount(params.funder);
+    const builder = new stellarSdk.TransactionBuilder(funderAccount, {
+      fee: stellarSdk.BASE_FEE,
+      networkPassphrase: this.passphrase
+    });
+    builder.addOperation(
+      stellarSdk.Operation.createAccount({
+        destination: params.masterAddress,
+        startingBalance: fromStroops(params.startingBalance)
       })
     );
-    return stellarSdk.StrKey.encodeContract(stellarSdk.hash(preimage.toXDR()));
-  }
-  /** `salt = sha256(addressSeed(32) || sec1(initialSigner)(65))` — matches the factory. */
-  accountSalt(addressSeed, initialSigner) {
-    return stellarSdk.hash(Buffer.concat([Buffer.from(addressSeed), Buffer.from(sec1Pubkey(initialSigner))]));
-  }
-  /** Host function: `factory.deploy(address_seed, initial_signer)`. */
-  buildDeploy(addressSeed, initialSigner) {
-    return invokeFunc(this.factoryId, "deploy", [
-      bytesScVal(addressSeed),
-      bytesScVal(sec1Pubkey(initialSigner))
-    ]);
-  }
-  /** Host function: `account.add_signer(new_signer)` (requires device auth). */
-  buildAddSigner(accountAddress, signer) {
-    return invokeFunc(accountAddress, "add_signer", [bytesScVal(sec1Pubkey(signer))]);
-  }
-  /** Host function: `account.remove_signer(signer)` (requires device auth). */
-  buildRemoveSigner(accountAddress, signer) {
-    return invokeFunc(accountAddress, "remove_signer", [bytesScVal(sec1Pubkey(signer))]);
-  }
-  /** Host function: `account.add_approver(passkey)` (requires device auth). */
-  buildAddApprover(accountAddress, passkey) {
-    return invokeFunc(accountAddress, "add_approver", [bytesScVal(sec1Pubkey(passkey))]);
-  }
-  /** Host function: `account.remove_approver(passkey)` (requires device auth). */
-  buildRemoveApprover(accountAddress, passkey) {
-    return invokeFunc(accountAddress, "remove_approver", [bytesScVal(sec1Pubkey(passkey))]);
-  }
-  /** This chain's leaf for approving `add_signer(newSigner)` at `nonce`:
-   * `sha256(sec1(new_signer) || nonce_be8)`. The batch challenge the passkey signs
-   * is `sha256(concat(leaves))` across chains. */
-  passkeyLeaf(newSigner, nonce) {
-    const msg = new Uint8Array(65 + 8);
-    msg.set(sec1Pubkey(newSigner), 0);
-    const n = new Uint8Array(8);
-    let v = nonce;
-    for (let i = 7; i >= 0; i--) {
-      n[i] = Number(v & 0xffn);
-      v >>= 8n;
-    }
-    msg.set(n, 65);
-    return sha256.sha256(msg);
-  }
-  /** Host function: passkey-authorized `add_signer_via_passkey` (no device auth —
-   * authorized by the embedded WebAuthn assertion, so any relayer can submit).
-   * `leaves`/`leafIndex` place this chain's leaf in the multi-chain batch. */
-  buildAddSignerViaPasskey(accountAddress, newSigner, passkey, nonce, leaves, leafIndex, assertion) {
-    const sig = encodeLowSSignature2({ r: assertion.r, s: assertion.s});
-    const leavesScVal = stellarSdk.xdr.ScVal.scvVec(leaves.map((l) => bytesScVal(l)));
-    return invokeFunc(accountAddress, "add_signer_via_passkey", [
-      bytesScVal(sec1Pubkey(newSigner)),
-      bytesScVal(sec1Pubkey(passkey)),
-      stellarSdk.nativeToScVal(nonce, { type: "u64" }),
-      leavesScVal,
-      stellarSdk.nativeToScVal(leafIndex, { type: "u32" }),
-      bytesScVal(assertion.authenticatorData),
-      bytesScVal(assertion.clientDataJSON),
-      stellarSdk.nativeToScVal(assertion.challengeOffset, { type: "u32" }),
-      bytesScVal(sig)
-    ]);
-  }
-  /** Read whether `passkey` is a registered approver (read-only simulation). */
-  /** True if the account has at least one passkey registered as an approver.
-   * Reads the contract's `approvers` view and checks the list is non-empty. */
-  async hasPasskeyApprover(accountAddress, readSource) {
-    if (!await this.isDeployed(accountAddress)) return false;
-    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
-    const src = new Account3(readSource, "0");
-    const op = stellarSdk.Operation.invokeHostFunction({
-      func: invokeFunc(accountAddress, "approvers", []),
-      auth: []
-    });
-    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
-    const sim = await this.server().simulateTransaction(tx2);
-    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
-      throw new Error(`kit/stellar: approvers simulation failed: ${sim.error}`);
-    }
-    if (!sim.result?.retval) return false;
-    const list = stellarSdk.scValToNative(sim.result.retval);
-    return Array.isArray(list) && list.length > 0;
-  }
-  async isApprover(accountAddress, passkey, readSource) {
-    if (!await this.isDeployed(accountAddress)) return false;
-    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
-    const src = new Account3(readSource, "0");
-    const op = stellarSdk.Operation.invokeHostFunction({
-      func: invokeFunc(accountAddress, "is_approver", [bytesScVal(sec1Pubkey(passkey))]),
-      auth: []
-    });
-    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
-    const sim = await this.server().simulateTransaction(tx2);
-    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
-      throw new Error(`kit/stellar: is_approver simulation failed: ${sim.error}`);
-    }
-    if (!sim.result?.retval) return false;
-    return stellarSdk.scValToNative(sim.result.retval) === true;
-  }
-  /** Read the current passkey-approval nonce (read-only simulation). */
-  async passkeyNonce(accountAddress, readSource) {
-    if (!await this.isDeployed(accountAddress)) return 0n;
-    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
-    const src = new Account3(readSource, "0");
-    const op = stellarSdk.Operation.invokeHostFunction({
-      func: invokeFunc(accountAddress, "passkey_nonce", []),
-      auth: []
-    });
-    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
-    const sim = await this.server().simulateTransaction(tx2);
-    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
-      throw new Error(`kit/stellar: passkey_nonce simulation failed: ${sim.error}`);
-    }
-    if (!sim.result?.retval) return 0n;
-    return BigInt(stellarSdk.scValToNative(sim.result.retval));
-  }
-  /** Host function: SEP-41 `token.transfer(from=account, to, amount)` (device auth). */
-  buildTransfer(tokenId, accountAddress, destination, amount) {
-    return invokeFunc(tokenId, "transfer", [
-      new stellarSdk.Address(accountAddress).toScVal(),
-      new stellarSdk.Address(destination).toScVal(),
-      stellarSdk.nativeToScVal(amount, { type: "i128" })
-    ]);
+    for (const [name, value] of Object.entries(toDataEntries(params.envelope))) {
+      builder.addOperation(
+        stellarSdk.Operation.manageData({ name, value: Buffer.from(value), source: params.masterAddress })
+      );
+    }
+    builder.addOperation(
+      stellarSdk.Operation.setOptions({
+        source: params.masterAddress,
+        masterWeight: 0,
+        lowThreshold: 1,
+        medThreshold: 1,
+        highThreshold: 1,
+        signer: { ed25519PublicKey: params.controlAddress, weight: 1 }
+      })
+    );
+    return builder.setTimeout(TX_TIMEOUT).build();
   }
   /**
-   * Sign a Soroban authorization entry with the silent device key, producing the
-   * `Vec<DeviceSignature>` the account's `__check_auth` verifies. The device
-   * signs `sha256(preimage)` (WebCrypto hashes once more internally), which is
-   * exactly what the contract recomputes. Mutates + returns the entry.
+   * Build a **sponsored** account-creation transaction whose source is the
+   * relayer. Wraps the account setup in `beginSponsoringFutureReserves` /
+   * `endSponsoringFutureReserves`, so the relayer (not the user) pays every
+   * reserve — the account is created with a 0 starting balance and holds no
+   * locked XLM of the user's. Ops:
+   *   0. beginSponsoringFutureReserves(G)          source = relayer
+   *   1. createAccount(G, 0)                        source = relayer
+   *   2. manageData(cv:… envelope)                  source = G (master-signed)
+   *   3. setOptions(control signer, master → 0)     source = G
+   *   4. endSponsoringFutureReserves()              source = G
+   *
+   * Signed by the master (for the G ops, while it's still weight 1); the relayer
+   * co-signs (source + fee + sponsorship) before submitting.
    */
-  async signAuthEntry(entry, validUntilLedger) {
-    const addrCreds = entry.credentials().address();
-    addrCreds.signatureExpirationLedger(validUntilLedger);
-    const preimage = stellarSdk.xdr.HashIdPreimage.envelopeTypeSorobanAuthorization(
-      new stellarSdk.xdr.HashIdPreimageSorobanAuthorization({
-        networkId: this.networkId(),
-        nonce: addrCreds.nonce(),
-        signatureExpirationLedger: validUntilLedger,
-        invocation: entry.rootInvocation()
+  async buildSponsoredCreateTx(params) {
+    const relayerAccount = await this.server().loadAccount(params.relayer);
+    const builder = new stellarSdk.TransactionBuilder(relayerAccount, {
+      fee: stellarSdk.BASE_FEE,
+      networkPassphrase: this.passphrase
+    });
+    builder.addOperation(
+      stellarSdk.Operation.beginSponsoringFutureReserves({ sponsoredId: params.masterAddress, source: params.relayer })
+    );
+    builder.addOperation(
+      stellarSdk.Operation.createAccount({ destination: params.masterAddress, startingBalance: "0", source: params.relayer })
+    );
+    for (const [name, value] of Object.entries(toDataEntries(params.envelope))) {
+      builder.addOperation(
+        stellarSdk.Operation.manageData({ name, value: Buffer.from(value), source: params.masterAddress })
+      );
+    }
+    builder.addOperation(
+      stellarSdk.Operation.setOptions({
+        source: params.masterAddress,
+        masterWeight: 0,
+        lowThreshold: 1,
+        medThreshold: 1,
+        highThreshold: 1,
+        signer: { ed25519PublicKey: params.controlAddress, weight: 1 }
       })
     );
-    const payload = stellarSdk.hash(preimage.toXDR());
-    const sig = await this.signer.sign(new Uint8Array(payload));
-    const pubkey = await this.signer.getPublicKey();
-    addrCreds.signature(deviceSignatureScVal(pubkey, sig));
-    return entry;
+    builder.addOperation(stellarSdk.Operation.endSponsoringFutureReserves({ source: params.masterAddress }));
+    return builder.setTimeout(TX_TIMEOUT).build();
   }
   /**
-   * Read a SEP-41 token balance of `account` via a read-only simulation of
-   * `token.balance(account)`. Returns 0 when the account isn't deployed or holds
-   * none. `readSource` is any funded G-account (used only for the simulation).
+   * Build a classic native-XLM payment as an *inner* transaction whose source is
+   * the account itself (`G…`), signed by the control key. Wrap it in a fee-bump
+   * (see `wrapFeeBump`) so the relayer pays the fee — gasless.
    */
-  async readBalance(tokenId, account, readSource) {
-    if (!await this.isDeployed(account)) return 0n;
-    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
-    const src = new Account3(readSource, "0");
-    const op = stellarSdk.Operation.invokeHostFunction({
-      func: invokeFunc(tokenId, "balance", [new stellarSdk.Address(account).toScVal()]),
-      auth: []
-    });
-    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
-    const sim = await this.server().simulateTransaction(tx2);
-    if (stellarSdk.rpc.Api.isSimulationError(sim) || !sim.result?.retval) return 0n;
-    return BigInt(stellarSdk.scValToNative(sim.result.retval));
+  async buildPaymentTx(params) {
+    const source = await this.server().loadAccount(params.from);
+    return new stellarSdk.TransactionBuilder(source, { fee: stellarSdk.BASE_FEE, networkPassphrase: this.passphrase }).addOperation(
+      stellarSdk.Operation.payment({
+        destination: params.to,
+        asset: stellarSdk.Asset.native(),
+        amount: fromStroops(params.amount)
+      })
+    ).setTimeout(TX_TIMEOUT).build();
   }
-  /** Whether the account contract instance exists on-chain (is deployed). */
-  async isDeployed(accountAddress) {
-    try {
-      const res = await this.server().getContractData(
-        accountAddress,
-        stellarSdk.xdr.ScVal.scvLedgerKeyContractInstance(),
-        stellarSdk.rpc.Durability.Persistent
-      );
-      return !!res;
-    } catch {
-      return false;
+  /**
+   * Build a data-entry write (e.g. re-wrapping the DEK for a newly approved
+   * device) as an inner tx sourced by the account, signed by the control key.
+   */
+  async buildDataTx(params) {
+    const source = await this.server().loadAccount(params.account);
+    const builder = new stellarSdk.TransactionBuilder(source, { fee: stellarSdk.BASE_FEE, networkPassphrase: this.passphrase });
+    for (const [name, value] of Object.entries(params.entries)) {
+      builder.addOperation(stellarSdk.Operation.manageData({ name, value: Buffer.from(value) }));
     }
+    return builder.setTimeout(TX_TIMEOUT).build();
   }
   /**
-   * Read whether `signer` is a currently-authorized signer of the account, via a
-   * read-only simulation of `account.is_authorized(signer)`. `readSource` is any
-   * funded G-account (used only for the simulation's source/sequence).
+   * Build a **sponsored** data-entry write whose source is the relayer, so the
+   * relayer (not the 0-balance account) pays the reserve of any NEW subentry.
+   * Adding a factor (passkey / recovery) or a device slot creates a data entry
+   * that needs ~0.5 XLM of reserve; a sponsored account holds no XLM, so — like
+   * account creation — the write must be wrapped in begin/endSponsoringFuture
+   * reserves with the relayer as sponsor. Ops:
+   *   0. beginSponsoringFutureReserves(account)   source = relayer
+   *   1..n. manageData(cv:…)                       source = account (control-signed)
+   *   last. endSponsoringFutureReserves()          source = account
+   *
+   * Signed by the control key (account ops) + the relayer (source + fee + sponsor).
    */
-  async isAuthorizedSigner(accountAddress, signer, readSource) {
-    if (!await this.isDeployed(accountAddress)) return false;
-    const { Account: Account3, TransactionBuilder: TransactionBuilder2, BASE_FEE: BASE_FEE2 } = await import('@stellar/stellar-sdk');
-    const src = new Account3(readSource, "0");
-    const op = stellarSdk.Operation.invokeHostFunction({
-      func: invokeFunc(accountAddress, "is_authorized", [bytesScVal(sec1Pubkey(signer))]),
-      auth: []
+  async buildSponsoredDataTx(params) {
+    const relayerAccount = await this.server().loadAccount(params.relayer);
+    const builder = new stellarSdk.TransactionBuilder(relayerAccount, {
+      fee: stellarSdk.BASE_FEE,
+      networkPassphrase: this.passphrase
     });
-    const tx2 = new TransactionBuilder2(src, { fee: BASE_FEE2, networkPassphrase: this.passphrase }).addOperation(op).setTimeout(30).build();
-    const sim = await this.server().simulateTransaction(tx2);
-    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
-      throw new Error(`kit/stellar: is_authorized simulation failed: ${sim.error}`);
+    builder.addOperation(
+      stellarSdk.Operation.beginSponsoringFutureReserves({ sponsoredId: params.account, source: params.relayer })
+    );
+    for (const [name, value] of Object.entries(params.entries)) {
+      builder.addOperation(stellarSdk.Operation.manageData({ name, value: Buffer.from(value), source: params.account }));
+    }
+    builder.addOperation(stellarSdk.Operation.endSponsoringFutureReserves({ source: params.account }));
+    return builder.setTimeout(TX_TIMEOUT).build();
+  }
+  /** Wrap a control-signed inner tx in a fee-bump whose fee source is `feeSource`
+   *  (the relayer). The inner tx pays nothing; the relayer pays all fees. */
+  wrapFeeBump(inner, feeSource) {
+    return stellarSdk.TransactionBuilder.buildFeeBumpTransaction(feeSource, stellarSdk.BASE_FEE, inner, this.passphrase);
+  }
+  /** Submit a fully-signed classic transaction and return its hash. Throws with
+   *  the Horizon result codes on failure. */
+  async submit(tx3) {
+    try {
+      const res = await this.server().submitTransaction(tx3);
+      return res.hash;
+    } catch (e) {
+      throw new Error(`kit/stellar: submit failed: ${horizonError(e)}`);
     }
-    if (!sim.result?.retval) return false;
-    return stellarSdk.scValToNative(sim.result.retval) === true;
+  }
+  /** Build an `Account` handle for a known address + sequence (avoids a Horizon
+   *  round-trip when the caller already has the sequence). */
+  accountAt(address, sequence) {
+    return new stellarSdk.Account(address, sequence);
   }
 };
-function sec1Pubkey(pk) {
-  const out = new Uint8Array(65);
-  out[0] = 4;
-  out.set(bigIntTo32Bytes(pk.x), 1);
-  out.set(bigIntTo32Bytes(pk.y), 33);
-  return out;
+function isNotFound(e) {
+  const status = e?.response?.status ?? e?.status;
+  return status === 404;
 }
-function encodeLowSSignature2(sig) {
-  const lowS2 = sig.s > SECP256R1_N2 / 2n ? SECP256R1_N2 - sig.s : sig.s;
-  const out = new Uint8Array(64);
-  out.set(bigIntTo32Bytes(sig.r), 0);
-  out.set(bigIntTo32Bytes(lowS2), 32);
-  return out;
+function horizonError(e) {
+  const codes = e?.response?.data?.extras?.result_codes;
+  return codes ? JSON.stringify(codes) : String(e?.message ?? e);
 }
-function deviceSignatureScVal(pubkey, sig) {
-  const element = stellarSdk.nativeToScVal(
-    {
-      public_key: Buffer.from(sec1Pubkey(pubkey)),
-      signature: Buffer.from(encodeLowSSignature2(sig))
-    },
-    { type: { public_key: ["symbol", "bytes"], signature: ["symbol", "bytes"] } }
-  );
-  return stellarSdk.xdr.ScVal.scvVec([element]);
-}
-function invokeFunc(contractId, method, args) {
-  return stellarSdk.xdr.HostFunction.hostFunctionTypeInvokeContract(
-    new stellarSdk.xdr.InvokeContractArgs({
-      contractAddress: new stellarSdk.Address(contractId).toScAddress(),
-      functionName: method,
-      args
-    })
-  );
+function toStroops(amount) {
+  const [whole, frac = ""] = amount.split(".");
+  const fracPadded = (frac + "0000000").slice(0, 7);
+  return BigInt(whole) * 10000000n + BigInt(fracPadded);
+}
+function fromStroops(stroops) {
+  const neg = stroops < 0n;
+  const abs = neg ? -stroops : stroops;
+  const whole = abs / 10000000n;
+  const frac = (abs % 10000000n).toString().padStart(7, "0");
+  return `${neg ? "-" : ""}${whole}.${frac}`;
+}
+var MASTER_HKDF_INFO = "cavos-stellar-master";
+function deriveStellarMasterSeed(identity) {
+  const ikm = deriveAddressSeedStellar(identity);
+  return hkdf.hkdf(sha256.sha256, ikm, void 0, MASTER_HKDF_INFO, 32);
 }
-function bytesScVal(bytes) {
-  return stellarSdk.xdr.ScVal.scvBytes(Buffer.from(bytes));
+function deriveStellarMasterKeypair(identity) {
+  return stellarSdk.Keypair.fromRawEd25519Seed(Buffer.from(deriveStellarMasterSeed(identity)));
+}
+function deriveStellarAddress(identity) {
+  return deriveStellarMasterKeypair(identity).publicKey();
+}
+function generateControlKey() {
+  const seed = utils.randomBytes(32);
+  return { keypair: stellarSdk.Keypair.fromRawEd25519Seed(Buffer.from(seed)), seed };
+}
+function controlKeypairFromSeed(seed) {
+  if (seed.length !== 32) throw new Error("kit/stellar: control seed must be 32 bytes");
+  return stellarSdk.Keypair.fromRawEd25519Seed(Buffer.from(seed));
 }
 
 // src/chains/stellar/StellarRelayer.ts
@@ -1877,7 +2571,7 @@ var StellarRelayer = class {
   constructor(opts) {
     this.opts = opts;
   }
-  /** The relayer's source/fee-payer G-account (fetched + cached from the backend). */
+  /** The relayer's source/fee-payer/sponsor G-account (fetched + cached). */
   async getSource() {
     if (this.source) return this.source;
     const res = await fetch(`${this.opts.baseUrl}/api/stellar/relay?network=${this.opts.network}`);
@@ -1886,17 +2580,16 @@ var StellarRelayer = class {
     this.source = fee_payer;
     return this.source;
   }
-  /**
-   * POST the assembled, device-authorized transaction XDR to the relayer to sign
-   * the envelope + submit. Returns the confirmed transaction hash.
-   */
-  async submit(transactionXdr) {
+  /** POST a (partially) signed transaction XDR for the relayer to co-sign + submit.
+   *  `kind` selects the validation gate. Returns the confirmed transaction hash. */
+  async submit(kind, transactionXdr) {
     const res = await fetch(`${this.opts.baseUrl}/api/stellar/relay`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         app_id: this.opts.appId,
         network: this.opts.network,
+        kind,
         transaction: transactionXdr
       })
     });
@@ -1904,313 +2597,415 @@ var StellarRelayer = class {
       const detail = await res.text().catch(() => "");
       throw new Error(`kit/stellar: relay failed (${res.status}) ${detail}`);
     }
-    const { hash: hash6 } = await res.json();
-    return hash6;
+    const { hash: hash5 } = await res.json();
+    return hash5;
   }
 };
 
 // src/chains/stellar/CavosStellar.ts
+var DEFAULT_STARTING_BALANCE = 50000000n;
 var CavosStellar = class _CavosStellar {
-  constructor(identity, address, status, network, adapter, devicePubkey, relayer, sourceKeypair) {
+  constructor(identity, address, status, network, adapter, deviceKey, control, dek, relayer) {
     this.identity = identity;
     this.address = address;
-    this.status = status;
     this.network = network;
     this.adapter = adapter;
-    this.devicePubkey = devicePubkey;
+    this.deviceKey = deviceKey;
+    this.control = control;
+    this.dek = dek;
     this.relayer = relayer;
-    this.sourceKeypair = sourceKeypair;
-    /** Discriminant for the `CavosWallet` union — narrows `execute()` per chain. */
+    // Discriminant for the `CavosWallet` union. Classic `G…` IS the Stellar chain
+    // now (the Soroban `C…` path was removed), so this is "stellar".
     this.chain = "stellar";
-    /** True when this connect just created a brand-new account (first sign-up). */
     this.isNewAccount = false;
+    this.statusValue = status;
   }
-  get publicKey() {
-    return this.devicePubkey;
+  get status() {
+    return this.statusValue;
   }
   static async connect(opts) {
     const identity = opts.identity ?? await opts.auth?.authenticate();
     if (!identity) throw new Error("kit/stellar: connect requires `identity` or `auth`");
-    const signer = opts.createSigner ? await opts.createSigner(`${identity.userId}:${opts.appSalt}`) : await WebCryptoSigner.loadOrCreate({ keyId: `${identity.userId}:${opts.appSalt}` });
-    const devicePubkey = await signer.getPublicKey();
-    const adapter = new StellarAdapter({
-      network: opts.network,
-      rpcUrl: opts.rpcUrl,
-      factoryId: opts.factoryId,
-      signer
-    });
-    const addressSeed = deriveAddressSeedStellar({ userId: identity.userId, appSalt: opts.appSalt });
+    const adapter = new StellarAdapter({ network: opts.network, horizonUrl: opts.horizonUrl });
+    const master = deriveStellarMasterKeypair({ userId: identity.userId, appSalt: opts.appSalt });
+    const address = master.publicKey();
+    const startingBalance = opts.startingBalance ?? DEFAULT_STARTING_BALANCE;
     const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
-    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry2);
     const relayer = opts.relayer ?? (opts.appId ? new StellarRelayer({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : void 0);
-    const build = (address2, status) => new _CavosStellar(identity, address2, status, opts.network, adapter, devicePubkey, relayer, opts.sourceKeypair);
-    const self = build("", "needs-device-approval");
-    const readSource = await self.resolveSource();
-    const existing = await registry.lookup(identity.userId);
-    if (existing) {
-      const isSigner2 = await adapter.isAuthorizedSigner(existing.address, devicePubkey, readSource);
-      return build(existing.address, isSigner2 ? "ready" : "needs-device-approval");
-    }
-    const address = adapter.computeAddress(addressSeed, devicePubkey);
-    const wasDeployed = await adapter.isDeployed(address);
-    if (!wasDeployed) {
-      const func = adapter.buildDeploy(addressSeed, devicePubkey);
-      await self.submitHostFunction(func, void 0);
+    const build = (status, unlocked) => new _CavosStellar(
+      identity,
+      address,
+      status,
+      opts.network,
+      adapter,
+      opts.deviceKey,
+      unlocked?.control,
+      unlocked?.dek,
+      relayer
+    );
+    if (await adapter.isDeployed(address)) {
+      const unlocked = await unlockViaDevice(adapter, address, opts.deviceKey);
+      return build(unlocked ? "ready" : "needs-device-approval", unlocked ?? void 0);
+    }
+    if (!relayer && !opts.sourceKeypair) {
+      throw new Error("kit/stellar: a relayer (appId) or sourceKeypair is required to create the account");
+    }
+    const { keypair: control, seed: controlSeed } = generateControlKey();
+    const dek = generateDEK();
+    const envelope = {
+      ct: sealControlSeed(controlSeed, dek),
+      deviceWraps: { [opts.deviceKey.slotId()]: eciesWrapDEK(dek, opts.deviceKey.publicKeySec1()) }
+    };
+    if (relayer) {
+      const relayerSource = await relayer.getSource();
+      const tx3 = await adapter.buildSponsoredCreateTx({
+        relayer: relayerSource,
+        masterAddress: address,
+        controlAddress: control.publicKey(),
+        envelope
+      });
+      tx3.sign(master);
+      await relayer.submit("create", tx3.toXDR());
+    } else {
+      const funder = opts.sourceKeypair;
+      const tx3 = await adapter.buildCreateTx({
+        funder: funder.publicKey(),
+        masterAddress: address,
+        controlAddress: control.publicKey(),
+        envelope,
+        startingBalance
+      });
+      tx3.sign(master, funder);
+      await adapter.submit(tx3);
     }
-    await registry.register({ userId: identity.userId, address, initialSigner: devicePubkey });
-    const isSigner = await adapter.isAuthorizedSigner(address, devicePubkey, readSource);
-    const wallet = build(address, isSigner ? "ready" : "needs-device-approval");
-    wallet.isNewAccount = !wasDeployed && isSigner;
+    const wallet = build("ready", { control, dek });
+    wallet.isNewAccount = true;
     return wallet;
   }
-  /** Authorize an additional device signer (device-signed via `__check_auth`). */
-  async addSigner(pubkey) {
-    const func = this.adapter.buildAddSigner(this.address, pubkey);
-    return this.submitHostFunction(func, this.address);
+  /** Native XLM balance of the account, in stroops. */
+  async balance() {
+    return this.adapter.balance(this.address);
   }
-  /**
-   * Enroll a passkey as an approver (2FA-style step-up). Device-signed + gasless;
-   * requires a ready device. Idempotent. Returns the passkey pubkey + tx hash.
-   */
-  async enrollPasskey(passkey, params) {
-    const enrolled = await passkey.enroll(params);
-    const { transactionHash } = await this.addApprover(enrolled.publicKey);
-    return { publicKey: enrolled.publicKey, transactionHash };
-  }
-  /** Register an already-enrolled passkey pubkey as an approver (gasless).
-   * Idempotent. Lets one passkey be registered across chains without re-prompting. */
-  async addApprover(pubkey) {
-    if (this.status !== "ready") {
-      throw new Error("kit/stellar: addApprover requires a ready, authorized device");
-    }
-    const readSource = await this.resolveSource();
-    if (await this.adapter.isApprover(this.address, pubkey, readSource)) return {};
-    const func = this.adapter.buildAddApprover(this.address, pubkey);
-    const transactionHash = await this.submitHostFunction(func, this.address);
-    return { transactionHash };
-  }
-  /** True if this account already has a passkey enrolled as an approver, so a
-   * new device can be approved with the passkey instead of the email flow. */
+  /** True if the account has a passkey factor enrolled (`cv:wp`), so a new device
+   *  can be approved with the passkey instead of a recovery code. Mirrors the
+   *  other chains' `hasPasskey()` for the React provider. */
   async hasPasskey() {
-    const readSource = await this.resolveSource();
-    return this.adapter.hasPasskeyApprover(this.address, readSource);
+    try {
+      const env = fromDataEntries(await this.adapter.loadDataEntries(this.address));
+      return !!env.passkeyWrap;
+    } catch {
+      return false;
+    }
   }
-  /** Re-read (from chain) whether THIS device is now an authorized signer.
-   * Used to poll for readiness after a passkey approval before it's indexed. */
+  /** Whether the control key is unlocked on this device (status ready). Classic
+   *  approvals land synchronously via Horizon, so this reflects state immediately
+   *  (no indexing delay to poll for). */
   async isReady() {
-    const readSource = await this.resolveSource();
-    return this.adapter.isAuthorizedSigner(this.address, this.devicePubkey, readSource);
+    return this.statusValue === "ready";
   }
   /**
-   * From a fresh browser (status `needs-device-approval`), approve adding THIS
-   * device using the user's synced passkey. Gasless via the relayer — the call
-   * carries the WebAuthn assertion, so no device signature is needed. Returns the
-   * tx hash. No trip back to an already-authorized device.
+   * Move `amount` stroops of native XLM to `destination`, signed by the control
+   * key. Sponsored by default (the relayer fee-bumps and pays the fee); pass
+   * `{ sponsored: false }` to submit directly — the account pays its own (tiny)
+   * fee from its XLM balance. The control key signs identically in both modes;
+   * only the fee payer differs.
    */
-  async approveThisDeviceWithPasskey(passkey) {
-    if (this.status === "ready") {
-      throw new Error("kit/stellar: this device is already an authorized signer");
-    }
-    const { leaf, nonce } = await this.passkeyLeafForThisDevice();
-    const leaves = [leaf];
-    const assertion = await passkey.assert(batchChallenge(leaves));
-    const { transactionHash } = await this.submitPasskeyApproval(assertion, leaves, 0, nonce);
-    return transactionHash;
+  async execute(amount, destination, opts) {
+    const control = this.requireControl();
+    const inner = await this.adapter.buildPaymentTx({ from: this.address, to: destination, amount });
+    return this.submitInner(inner, control, opts);
   }
-  /** This device's leaf + passkey nonce for a (possibly multi-chain) batch. */
-  async passkeyLeafForThisDevice() {
-    const readSource = await this.resolveSource();
-    const nonce = await this.adapter.passkeyNonce(this.address, readSource);
-    return { leaf: this.adapter.passkeyLeaf(this.devicePubkey, nonce), nonce };
+  /**
+   * Enroll a passkey as an unlock factor: wrap the DEK under the passkey's PRF
+   * output and write the `cv:wp` entry. This is the synced anchor used to approve
+   * a new device or recover — it survives device loss. Idempotent-ish: writing it
+   * again just overwrites the wrap of the same DEK. Requires a ready device.
+   */
+  async enrollPasskey(prfOutput) {
+    const { control, dek } = this.requireUnlocked();
+    const wrap = wrapDEK(dek, derivePasskeyKEK(prfOutput));
+    return this.writeFactor(PASSKEY_BASE, wrap, control);
   }
-  /** Submit `add_signer_via_passkey` given a shared assertion + batch position.
-   * No device auth entry — authorized purely by the passkey assertion. */
-  async submitPasskeyApproval(assertion, leaves, leafIndex, nonce) {
-    const readSource = await this.resolveSource();
-    const digest = webauthnDigest(assertion.authenticatorData, assertion.clientDataJSON);
-    const candidates = recoverCandidatePublicKeys(assertion.r, assertion.s, digest);
-    let approver = null;
-    for (const cand of candidates) {
-      if (await this.adapter.isApprover(this.address, cand.publicKey, readSource)) {
-        approver = cand.publicKey;
-        break;
-      }
-    }
-    if (!approver) throw new Error("kit/stellar: this passkey is not a registered approver");
-    const func = this.adapter.buildAddSignerViaPasskey(
-      this.address,
-      this.devicePubkey,
-      approver,
-      nonce,
-      leaves,
-      leafIndex,
-      assertion
-    );
-    return { transactionHash: await this.submitHostFunction(func, void 0) };
+  /**
+   * Set up a recovery code as an unlock factor: wrap the DEK under the code's KEK
+   * and write the `cv:wr` entry. Optional in v1 — the integrating app decides when
+   * to surface it. The code never leaves the device; only the wrap goes on-chain.
+   * Requires a ready device.
+   */
+  async setupRecovery(code) {
+    const { control, dek } = this.requireUnlocked();
+    const wrap = wrapDEK(dek, deriveRecoveryKEK(code));
+    return this.writeFactor(RECOVERY_BASE, wrap, control);
   }
-  /** Move `amount` stroops of native XLM to `destination` (device-signed). */
-  async execute(amount, destination) {
-    return this.executeTransfer(NATIVE_SAC_ID[this.network], amount, destination);
+  /**
+   * From a new browser/device (`needs-device-approval`), approve THIS device using
+   * the user's synced passkey: unlock the DEK via the passkey factor, then wrap it
+   * to this device's slot so future sessions unlock silently. Flips status to
+   * `ready`. No trip back to an already-authorized device.
+   */
+  async approveThisDeviceWithPasskey(prfOutput) {
+    return this.approveThisDevice(
+      await unlockViaPasskey(this.adapter, this.address, prfOutput),
+      "passkey"
+    );
   }
-  /** Read this account's balance of `tokenId` (defaults to native XLM), in stroops. */
-  async balance(tokenId = NATIVE_SAC_ID[this.network]) {
-    const readSource = await this.resolveSource();
-    return this.adapter.readBalance(tokenId, this.address, readSource);
+  /** Approve THIS device using the recovery code (same as the passkey path, for
+   *  the backup factor). */
+  async approveThisDeviceWithRecovery(code) {
+    return this.approveThisDevice(
+      await unlockViaRecovery(this.adapter, this.address, code),
+      "recovery code"
+    );
   }
-  /** Transfer `amount` of any SEP-41 token out of the account (device-signed). */
-  async executeTransfer(tokenId, amount, destination) {
-    if (this.status !== "ready") {
-      throw new Error("kit/stellar: this device is not yet an authorized signer of the wallet");
-    }
-    const func = this.adapter.buildTransfer(tokenId, this.address, destination, amount);
-    return this.submitHostFunction(func, this.address);
+  /** The control key's public G address (the weight-1 real signer), for display. */
+  get controlAddress() {
+    return this.control?.publicKey();
+  }
+  // --- internals ----------------------------------------------------------
+  async approveThisDevice(unlocked, factor) {
+    if (this.statusValue === "ready") {
+      throw new Error("kit/stellar: this device is already authorized");
+    }
+    if (!unlocked) {
+      throw new Error(`kit/stellar: could not unlock the account with the ${factor} \u2014 wrong factor or not enrolled`);
+    }
+    const slot = this.deviceKey.slotId();
+    const wrap = eciesWrapDEK(unlocked.dek, this.deviceKey.publicKeySec1());
+    const hash5 = await this.submitDataWrite(deviceWrapEntries(slot, wrap), unlocked.control);
+    this.control = unlocked.control;
+    this.dek = unlocked.dek;
+    this.statusValue = "ready";
+    return hash5;
+  }
+  /** Write a single-factor wrap (passkey/recovery) into the account data entries,
+   *  signed by the control key. Overwrites cleanly if the base already existed and
+   *  the new blob has the same chunk count. */
+  async writeFactor(base, wrap, control) {
+    const entries = {};
+    chunkTo64(wrap).forEach((chunk, i) => {
+      entries[`${base}/${i}`] = chunk;
+    });
+    return this.submitDataWrite(entries, control);
   }
   /**
-   * Register the backup signer derived from `code` as an authorized signer of
-   * this account (device-signed). Idempotent. The code never leaves the device —
-   * only the derived public key travels on-chain. Mirrors the other chains.
+   * Sign an inner (account-sourced) payment tx with the control key and submit it:
+   *   - sponsored (default) → with a relayer, wrap in a fee-bump (relayer pays
+   *     the fee) and POST; falls back to self-funded if no relayer;
+   *   - `{ sponsored: false }` → submit directly (the account pays its own fee).
+   * Payments add no subentries, so no reserve sponsorship is needed here.
    */
-  async setupRecovery(code) {
-    if (this.status !== "ready") {
-      throw new Error("kit/stellar: setupRecovery requires a ready, registered device");
+  async submitInner(inner, control, opts) {
+    inner.sign(control);
+    const sponsored = opts?.sponsored !== false;
+    if (sponsored && this.relayer) {
+      const feeSource = await this.relayer.getSource();
+      const bump = this.adapter.wrapFeeBump(inner, feeSource);
+      return this.relayer.submit("fee-bump", bump.toXDR());
     }
-    const { publicKey: backupPubkey } = deriveBackupKey(code);
-    const readSource = await this.resolveSource();
-    if (await this.adapter.isAuthorizedSigner(this.address, backupPubkey, readSource)) return void 0;
-    return this.addSigner(backupPubkey);
+    return this.adapter.submit(inner);
   }
   /**
-   * Recover an account after losing every device signer: derive the backup key
-   * from `code`, use it (not the new device) to authorize `add_signer(newDevice)`,
-   * and return a ready handle bound to the new device. The address is unchanged.
+   * Write data entries (add a factor / device slot) — which create NEW subentries
+   * that each need ~0.5 XLM of reserve. A relayer-sponsored account holds no XLM,
+   * so the write must be sponsored by the relayer (source + sponsor), exactly like
+   * account creation — a plain fee-bump would fail with `op_low_reserve`.
+   *   - sponsored (default) → with a relayer, build a sponsored write (relayer
+   *     source + begin/end sponsoring), control-sign the account ops, relay
+   *     co-signs + submits; falls back to self-funded if no relayer;
+   *   - `{ sponsored: false }` → the account writes directly (it must hold its
+   *     own reserve for the new subentries).
    */
-  static async recover(opts) {
-    const signer = opts.createSigner ? await opts.createSigner(`${opts.identity.userId}:${opts.appSalt}`) : await WebCryptoSigner.loadOrCreate({ keyId: `${opts.identity.userId}:${opts.appSalt}` });
-    const devicePubkey = await signer.getPublicKey();
-    const backup = BackupSigner.fromCode(opts.code);
-    const backupAdapter = new StellarAdapter({
-      network: opts.network,
-      rpcUrl: opts.rpcUrl,
-      factoryId: opts.factoryId,
-      signer: backup
-    });
-    const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
-    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry2);
-    const existing = await registry.lookup(opts.identity.userId);
-    if (!existing) {
-      throw new Error("kit/stellar: no account found for this identity \u2014 nothing to recover");
+  async submitDataWrite(entries, control, opts) {
+    const sponsored = opts?.sponsored !== false;
+    if (sponsored && this.relayer) {
+      const relayerSource = await this.relayer.getSource();
+      const tx4 = await this.adapter.buildSponsoredDataTx({
+        relayer: relayerSource,
+        account: this.address,
+        entries
+      });
+      tx4.sign(control);
+      return this.relayer.submit("sponsored-data", tx4.toXDR());
     }
-    const relayer = opts.relayer ?? (opts.appId ? new StellarRelayer({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : void 0);
-    const backupHandle = new _CavosStellar(
-      opts.identity,
-      existing.address,
-      "ready",
-      opts.network,
-      backupAdapter,
-      devicePubkey,
-      relayer,
-      opts.sourceKeypair
-    );
-    const readSource = await backupHandle.resolveSource();
-    if (!await backupAdapter.isAuthorizedSigner(existing.address, devicePubkey, readSource)) {
-      await backupHandle.addSigner(devicePubkey);
+    const tx3 = await this.adapter.buildDataTx({ account: this.address, entries });
+    tx3.sign(control);
+    return this.adapter.submit(tx3);
+  }
+  requireControl() {
+    if (this.statusValue !== "ready" || !this.control) {
+      throw new Error("kit/stellar: control key not unlocked on this device (needs approval)");
     }
-    const adapter = new StellarAdapter({
-      network: opts.network,
-      rpcUrl: opts.rpcUrl,
-      factoryId: opts.factoryId,
-      signer
-    });
-    return new _CavosStellar(
-      opts.identity,
-      existing.address,
-      "ready",
-      opts.network,
-      adapter,
-      devicePubkey,
-      relayer,
-      opts.sourceKeypair
+    return this.control;
+  }
+  requireUnlocked() {
+    const control = this.requireControl();
+    if (!this.dek) throw new Error("kit/stellar: DEK unavailable on this device");
+    return { control, dek: this.dek };
+  }
+};
+async function unlockViaDevice(adapter, address, deviceKey) {
+  const env = await loadEnvelope(adapter, address);
+  const wrap = env.deviceWraps[deviceKey.slotId()];
+  if (!wrap) return null;
+  try {
+    const dek = await deviceKey.unwrap(wrap);
+    return openControl(env, dek);
+  } catch {
+    return null;
+  }
+}
+async function unlockViaPasskey(adapter, address, prfOutput) {
+  const env = await loadEnvelope(adapter, address);
+  if (!env.passkeyWrap) return null;
+  try {
+    const dek = unwrapDEK(env.passkeyWrap, derivePasskeyKEK(prfOutput));
+    return openControl(env, dek);
+  } catch {
+    return null;
+  }
+}
+async function unlockViaRecovery(adapter, address, code) {
+  const env = await loadEnvelope(adapter, address);
+  if (!env.recoveryWrap) return null;
+  try {
+    const dek = unwrapDEK(env.recoveryWrap, deriveRecoveryKEK(code));
+    return openControl(env, dek);
+  } catch {
+    return null;
+  }
+}
+async function loadEnvelope(adapter, address) {
+  return fromDataEntries(await adapter.loadDataEntries(address));
+}
+function openControl(env, dek) {
+  const controlSeed = openControlSeed(env.ct, dek);
+  return { control: controlKeypairFromSeed(controlSeed), dek };
+}
+var LocalDeviceUnwrapKey = class _LocalDeviceUnwrapKey {
+  constructor(scalar) {
+    this.scalar = scalar;
+  }
+  /** Generate a fresh device unwrap key. */
+  static generate() {
+    return new _LocalDeviceUnwrapKey(p256.p256.utils.randomPrivateKey());
+  }
+  /** Rebuild from a persisted 32-byte scalar. */
+  static fromScalar(scalar) {
+    if (scalar.length !== 32) throw new Error("kit/stellar: device unwrap scalar must be 32 bytes");
+    return new _LocalDeviceUnwrapKey(scalar);
+  }
+  /** The raw scalar, for the caller to persist in secure storage. */
+  export() {
+    return this.scalar;
+  }
+  publicKeySec1() {
+    return p256.p256.getPublicKey(this.scalar, false);
+  }
+  slotId() {
+    return deviceSlotId(this.publicKeySec1());
+  }
+  async unwrap(blob) {
+    return eciesUnwrapDEK(blob, this.scalar);
+  }
+};
+function deviceSlotId(publicKeySec1) {
+  const h = sha256.sha256(publicKeySec1);
+  let s = "";
+  for (const b of h.subarray(0, 4)) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+
+// src/chains/stellar/WebCryptoDeviceUnwrapKey.ts
+var IDB_NAME2 = "cavos-kit-stellar";
+var IDB_STORE2 = "unwrap-keys";
+var WebCryptoDeviceUnwrapKey = class _WebCryptoDeviceUnwrapKey {
+  constructor(privateKey, publicRaw, keyId) {
+    this.privateKey = privateKey;
+    this.publicRaw = publicRaw;
+    this.keyId = keyId;
+  }
+  /** Create a fresh device unwrap key and persist it. */
+  static async create(opts) {
+    assertSecureContext2();
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      // private key is NON-extractable
+      ["deriveBits"]
     );
+    const publicRaw = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+    await idbPut2(opts.keyId, { privateKey: pair.privateKey, publicRaw });
+    return new _WebCryptoDeviceUnwrapKey(pair.privateKey, publicRaw, opts.keyId);
   }
-  /** The transaction source/fee-payer G-address (relayer or self-funded). */
-  async resolveSource() {
-    if (this.relayer) return this.relayer.getSource();
-    if (this.sourceKeypair) return this.sourceKeypair.publicKey();
-    throw new Error("kit/stellar: a relayer (appId) or sourceKeypair is required");
+  /** Load an existing device unwrap key, or null if none exists yet. */
+  static async load(opts) {
+    const rec = await idbGet2(opts.keyId);
+    if (!rec) return null;
+    return new _WebCryptoDeviceUnwrapKey(rec.privateKey, rec.publicRaw, opts.keyId);
   }
-  /**
-   * Build → simulate → device-sign auth → assemble → submit an invoke-contract
-   * host function. `authAccount` is the account whose `__check_auth` must sign the
-   * operation's Soroban auth entry (undefined for a plain factory deploy).
-   */
-  async submitHostFunction(func, authAccount) {
-    const server = this.adapter.server();
-    const sourceAddr = await this.resolveSource();
-    const simSource = new stellarSdk.Account(sourceAddr, "0");
-    const unsignedOp = stellarSdk.Operation.invokeHostFunction({ func, auth: [] });
-    const simTx = new stellarSdk.TransactionBuilder(simSource, {
-      fee: stellarSdk.BASE_FEE,
-      networkPassphrase: this.adapter.passphrase
-    }).addOperation(unsignedOp).setTimeout(180).build();
-    const sim = await server.simulateTransaction(simTx);
-    if (stellarSdk.rpc.Api.isSimulationError(sim)) {
-      throw new Error(`kit/stellar: simulation failed: ${sim.error}`);
-    }
-    const validUntil = (await server.getLatestLedger()).sequence + 100;
-    const entries = sim.result?.auth ?? [];
-    const signedAuth = [];
-    for (const entry of entries) {
-      if (authAccount && isAddressCredentialFor(entry, authAccount)) {
-        signedAuth.push(await this.adapter.signAuthEntry(entry, validUntil));
-      } else {
-        signedAuth.push(entry);
-      }
-    }
-    const account = await server.getAccount(sourceAddr);
-    const finalOp = stellarSdk.Operation.invokeHostFunction({ func, auth: signedAuth });
-    const built = new stellarSdk.TransactionBuilder(account, {
-      fee: stellarSdk.BASE_FEE,
-      networkPassphrase: this.adapter.passphrase
-    }).addOperation(finalOp).setTimeout(180).build();
-    const authSim = await server.simulateTransaction(built);
-    if (stellarSdk.rpc.Api.isSimulationError(authSim)) {
-      throw new Error(`kit/stellar: auth simulation failed: ${authSim.error}`);
-    }
-    const assembled = stellarSdk.rpc.assembleTransaction(built, authSim).build();
-    if (this.relayer) {
-      return this.relayer.submit(assembled.toXDR());
-    }
-    if (this.sourceKeypair) {
-      assembled.sign(this.sourceKeypair);
-      return this.sendAndConfirm(assembled);
-    }
-    throw new Error("kit/stellar: no relayer or sourceKeypair configured to submit");
-  }
-  /** Submit a signed tx via RPC and poll to confirmation. Returns the hash. */
-  async sendAndConfirm(tx2) {
-    const server = this.adapter.server();
-    const sent = await server.sendTransaction(tx2);
-    if (sent.status === "ERROR") {
-      throw new Error(`kit/stellar: submit rejected: ${JSON.stringify(sent.errorResult)}`);
-    }
-    const hash6 = sent.hash;
-    for (let i = 0; i < 30; i++) {
-      const got = await server.getTransaction(hash6);
-      if (got.status === stellarSdk.rpc.Api.GetTransactionStatus.SUCCESS) return hash6;
-      if (got.status === stellarSdk.rpc.Api.GetTransactionStatus.FAILED) {
-        throw new Error(`kit/stellar: tx ${hash6} failed`);
-      }
-      await new Promise((r) => setTimeout(r, 1e3));
-    }
-    throw new Error(`kit/stellar: tx ${hash6} not confirmed in time`);
+  /** Load the device unwrap key, creating one on first use. */
+  static async loadOrCreate(opts) {
+    return await _WebCryptoDeviceUnwrapKey.load(opts) ?? await _WebCryptoDeviceUnwrapKey.create(opts);
+  }
+  publicKeySec1() {
+    return this.publicRaw;
+  }
+  slotId() {
+    return deviceSlotId(this.publicRaw);
+  }
+  async unwrap(blob) {
+    const ephPubCompressed = blob.subarray(0, 33);
+    const wrapped = blob.subarray(33);
+    const ephUncompressed = p256.p256.ProjectivePoint.fromHex(ephPubCompressed).toRawBytes(false);
+    const ephKey = await crypto.subtle.importKey(
+      "raw",
+      ephUncompressed,
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+    const sharedX = new Uint8Array(
+      await crypto.subtle.deriveBits({ name: "ECDH", public: ephKey }, this.privateKey, 256)
+    );
+    const kek = eciesKEKFromX(sharedX, ephPubCompressed);
+    return unwrapDEK(wrapped, kek);
   }
 };
-function isAddressCredentialFor(entry, accountAddress) {
-  const creds = entry.credentials();
-  if (creds.switch() !== stellarSdk.xdr.SorobanCredentialsType.sorobanCredentialsAddress()) return false;
-  return stellarSdk.Address.fromScAddress(creds.address().address()).toString() === accountAddress;
+function assertSecureContext2() {
+  const ok = typeof crypto !== "undefined" && typeof crypto.subtle !== "undefined" && (typeof window === "undefined" || window.isSecureContext);
+  if (!ok) {
+    throw new Error(
+      "Cavos: WebCrypto is unavailable. Device keys require a secure context \u2014 use HTTPS, or http://localhost."
+    );
+  }
+}
+function openDb2() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(IDB_NAME2, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(IDB_STORE2);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+async function idbPut2(keyId, value) {
+  const db = await openDb2();
+  await tx2(db, "readwrite", (store) => store.put(value, keyId));
+  db.close();
+}
+async function idbGet2(keyId) {
+  const db = await openDb2();
+  const result = await tx2(db, "readonly", (store) => store.get(keyId));
+  db.close();
+  return result ?? null;
+}
+function tx2(db, mode, run) {
+  return new Promise((resolve, reject) => {
+    const store = db.transaction(IDB_STORE2, mode).objectStore(IDB_STORE2);
+    const req = run(store);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
 }
-var defaultRegistry2 = new InMemoryWalletRegistry();
 
 // src/recovery/HttpRecoveryClient.ts
 function toHex2(n) {
@@ -2342,17 +3137,16 @@ var Cavos = class _Cavos {
       });
     }
     if (opts.chain === "stellar") {
+      const identity = opts.identity ?? (opts.auth ? await opts.auth.authenticate() : void 0);
+      if (!identity) throw new Error("kit: Stellar connect requires `identity` or `auth`");
+      const deviceKey = opts.stellarDeviceKey ?? await WebCryptoDeviceUnwrapKey.loadOrCreate({ keyId: `${identity.userId}:${opts.appSalt}` });
       return CavosStellar.connect({
         network: STELLAR_ENV[opts.network],
-        ...opts.auth ? { auth: opts.auth } : {},
-        ...opts.identity ? { identity: opts.identity } : {},
+        identity,
         appSalt: opts.appSalt,
+        deviceKey,
         ...opts.appId ? { appId: opts.appId } : {},
         ...opts.backendUrl ? { backendUrl: opts.backendUrl } : {},
-        ...opts.registry ? { registry: opts.registry } : {},
-        ...opts.rpcUrl ? { rpcUrl: opts.rpcUrl } : {},
-        ...opts.factoryId ? { factoryId: opts.factoryId } : {},
-        ...opts.createSigner ? { createSigner: opts.createSigner } : {},
         ...opts.stellarRelayer ? { relayer: opts.stellarRelayer } : {},
         ...opts.stellarSourceKeypair ? { sourceKeypair: opts.stellarSourceKeypair } : {}
       });
@@ -2402,7 +3196,7 @@ var Cavos = class _Cavos {
       cairoVersion: "1"
     });
     const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
-    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry3);
+    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network: opts.network }) : defaultRegistry2);
     const recovery = opts.recovery ?? (opts.appId ? new HttpRecoveryClient({ baseUrl: backendUrl, appId: opts.appId }) : null);
     const existing = await registry.lookup(identity.userId);
     if (existing) {
@@ -2439,7 +3233,7 @@ var Cavos = class _Cavos {
       }
       return cavos2;
     }
-    const address = adapter.computeAddress({ addressSeed, initialSigner: devicePubkey });
+    const address = adapter.computeAddress({ addressSeed });
     const account = makeAccount(address);
     const alreadyDeployed = await isDeployed(provider, address);
     if (!alreadyDeployed) {
@@ -2447,10 +3241,11 @@ var Cavos = class _Cavos {
         address,
         class_hash: classHash,
         salt: starknet.num.toHex(addressSeed),
-        calldata: adapter.constructorCalldata(addressSeed, devicePubkey),
+        calldata: adapter.constructorCalldata(addressSeed),
         version: 1
       };
-      const deployRes = await account.executePaymasterTransaction([], {
+      const initCall = adapter.buildInitialize(address, devicePubkey);
+      const deployRes = await account.executePaymasterTransaction([initCall], {
         feeMode: { mode: "sponsored" },
         deploymentData
       });
@@ -2485,18 +3280,25 @@ var Cavos = class _Cavos {
     return this.devicePubkey;
   }
   /** Execute a sponsored (gasless) multicall, signed silently by the device. */
-  async execute(calls) {
+  async execute(calls, opts) {
     if (this.status !== "ready") {
       throw new Error("kit: this device is not yet an authorized signer of the wallet");
     }
+    if (opts?.sponsored === false) {
+      const res2 = await this.account.execute(calls);
+      return { transactionHash: res2.transaction_hash };
+    }
     const res = await this.account.executePaymasterTransaction(calls, {
       feeMode: { mode: "sponsored" }
     });
     return { transactionHash: res.transaction_hash };
   }
-  /** Authorize an additional device signer (sponsored). Self-submitted. */
-  async addSigner(pubkey) {
-    return this.execute([this.adapter.buildAddSigner(this.address, pubkey)]);
+  /**
+   * Authorize an additional device signer. Sponsored by default; pass
+   * `{ sponsored: false }` to pay the fee from the account's own ETH balance.
+   */
+  async addSigner(pubkey, opts) {
+    return this.execute([this.adapter.buildAddSigner(this.address, pubkey)], opts);
   }
   /**
    * Enroll a passkey as an APPROVER so the user can later add devices from any
@@ -2505,25 +3307,27 @@ var Cavos = class _Cavos {
    * approver. Call this whenever the app decides to prompt "turn on device
    * approvals". Returns the passkey's public key + the enrollment tx hash.
    */
-  async enrollPasskey(passkey, params) {
+  async enrollPasskey(passkey, params, opts) {
     const enrolled = await passkey.enroll(params);
-    const { transactionHash } = await this.addApprover(enrolled.publicKey);
+    const { transactionHash } = await this.addApprover(enrolled.publicKey, opts);
     return { publicKey: enrolled.publicKey, transactionHash };
   }
   /**
-   * Register an ALREADY-enrolled passkey public key as an approver (gasless,
-   * device-signed). Idempotent. Use this to register ONE passkey across multiple
-   * chains without re-prompting `passkey.enroll()` on each: enroll once, then
-   * call `addApprover(pubkey)` on each chain's wallet.
+   * Register an ALREADY-enrolled passkey public key as an approver (gasless by
+   * default, device-signed). Idempotent. Use this to register ONE passkey across
+   * multiple chains without re-prompting `passkey.enroll()` on each: enroll once,
+   * then call `addApprover(pubkey)` on each chain's wallet. Pass
+   * `{ sponsored: false }` to pay the fee from the account's own balance.
    */
-  async addApprover(pubkey) {
+  async addApprover(pubkey, opts) {
     if (this.status !== "ready") {
       throw new Error("kit: addApprover requires a ready, authorized device");
     }
     if (await this.adapter.isApprover(this.address, pubkey)) return {};
-    const { transactionHash } = await this.execute([
-      this.adapter.buildAddApprover(this.address, pubkey)
-    ]);
+    const { transactionHash } = await this.execute(
+      [this.adapter.buildAddApprover(this.address, pubkey)],
+      opts
+    );
     try {
       await this.account.waitForTransaction(transactionHash);
     } catch (e) {
@@ -2610,11 +3414,11 @@ var Cavos = class _Cavos {
    * add_signer (gasless). Returns the transaction hash (or undefined when the
    * backup was already set up).
    */
-  async setupRecovery(code) {
+  async setupRecovery(code, opts) {
     const { publicKey: backupPubkey } = deriveBackupKey(code);
     const already = await this.adapter.isAuthorizedSigner(this.address, backupPubkey);
     if (already) return void 0;
-    return this.addSigner(backupPubkey);
+    return this.addSigner(backupPubkey, opts);
   }
   /**
    * Recover an account after losing every device signer. Derives the backup key
@@ -2641,11 +3445,11 @@ var Cavos = class _Cavos {
     const backup = BackupSigner.fromCode(opts.code);
     const backupAdapter = new StarknetAdapter({ classHash, signer: backup, provider });
     const backendUrl = opts.backendUrl ?? "https://cavos.xyz";
-    const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network }) : defaultRegistry3);
-    const existing = await registry.lookup(opts.identity.userId);
-    if (!existing) {
+    const address = opts.address ?? await lookupAddress(opts, backendUrl, network);
+    if (!address) {
       throw new Error("kit: no account found for this identity \u2014 nothing to recover");
     }
+    const existing = { address };
     const backupAccount = new starknet.Account({
       provider,
       address: existing.address,
@@ -2676,7 +3480,7 @@ var Cavos = class _Cavos {
     return new _Cavos(opts.identity, existing.address, "ready", account, adapter, devicePubkey);
   }
 };
-var defaultRegistry3 = new InMemoryWalletRegistry();
+var defaultRegistry2 = new InMemoryWalletRegistry();
 var DEVICE_REQUEST_DEDUP_MS = 5 * 60 * 1e3;
 var lastDeviceRequest = /* @__PURE__ */ new Map();
 async function isDeployed(provider, address) {
@@ -2687,6 +3491,11 @@ async function isDeployed(provider, address) {
     return false;
   }
 }
+async function lookupAddress(opts, backendUrl, network) {
+  const registry = opts.registry ?? (opts.appId ? new HttpWalletRegistry({ baseUrl: backendUrl, appId: opts.appId, network }) : defaultRegistry2);
+  const existing = await registry.lookup(opts.identity.userId);
+  return existing?.address ?? null;
+}
 async function approveDeviceEverywhere(wallets, passkey) {
   const targets = wallets.filter((w) => w.status === "needs-device-approval");
   if (targets.length === 0) return [];
@@ -2884,6 +3693,101 @@ function bytesToChunks(bytes) {
   for (const b of bytes.subarray(0, 31)) w = w << 8n | BigInt(b);
   return w;
 }
+var PRF_SALT = sha256.sha256(new TextEncoder().encode("cavos-stellar-prf-v1"));
+var PasskeyPrf = class {
+  constructor(opts = {}) {
+    if (typeof window === "undefined" || !navigator.credentials) {
+      throw new Error("kit/passkey-prf: WebAuthn is only available in a browser");
+    }
+    this.rpId = opts.rpId ?? window.location.hostname;
+    this.rpName = opts.rpName ?? this.rpId;
+    if (isIpAddress(this.rpId)) {
+      throw new Error(
+        `kit/passkey-prf: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel \u2014 or pass an explicit \`rpId\`.`
+      );
+    }
+  }
+  /** True if this platform advertises a usable passkey (platform authenticator). */
+  static async isSupported() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) return false;
+    try {
+      return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Create a new synced, discoverable passkey with the PRF extension enabled, then
+   * immediately read its PRF secret. Returns the credential id and the 32-byte
+   * secret so the caller can enroll the passkey factor in one step. Some
+   * authenticators don't return PRF results on create — in that case `secret` is
+   * undefined and the caller should follow up with `getSecret()`.
+   */
+  async enroll(params) {
+    const cred = await navigator.credentials.create({
+      publicKey: {
+        challenge: buf(crypto.getRandomValues(new Uint8Array(32))),
+        rp: { id: this.rpId, name: this.rpName },
+        user: {
+          id: buf(userHandle(params.userId)),
+          name: params.userName,
+          displayName: params.displayName ?? params.userName
+        },
+        pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+        // ES256 (P-256)
+        authenticatorSelection: {
+          residentKey: "required",
+          requireResidentKey: true,
+          userVerification: "required"
+        },
+        attestation: "none",
+        extensions: { prf: { eval: { first: buf(PRF_SALT) } } }
+      }
+    });
+    if (!cred) throw new Error("kit/passkey-prf: enrollment cancelled");
+    return { credentialId: new Uint8Array(cred.rawId), secret: readPrf(cred) };
+  }
+  /**
+   * Get the passkey's 32-byte PRF secret. Uses discoverable credentials (no
+   * `allowCredentials`), so it works from a brand-new browser — the OS shows the
+   * synced passkey picker. Throws if the authenticator doesn't support PRF.
+   */
+  async getSecret() {
+    const cred = await navigator.credentials.get({
+      publicKey: {
+        challenge: buf(crypto.getRandomValues(new Uint8Array(32))),
+        rpId: this.rpId,
+        allowCredentials: [],
+        userVerification: "required",
+        extensions: { prf: { eval: { first: buf(PRF_SALT) } } }
+      }
+    });
+    if (!cred) throw new Error("kit/passkey-prf: assertion cancelled");
+    const secret = readPrf(cred);
+    if (!secret) {
+      throw new Error(
+        "kit/passkey-prf: this authenticator did not return a PRF result \u2014 PRF is unsupported here"
+      );
+    }
+    return secret;
+  }
+};
+function readPrf(cred) {
+  const results = cred.getClientExtensionResults().prf?.results?.first;
+  return results ? new Uint8Array(results) : void 0;
+}
+function isIpAddress(host) {
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
+  if (host.includes(":")) return true;
+  return false;
+}
+function userHandle(userId) {
+  const bytes = new TextEncoder().encode(userId);
+  return bytes.length <= 64 ? bytes : sha256.sha256(bytes);
+}
+function buf(bytes) {
+  return bytes.slice();
+}
 var PasskeySigner = class {
   constructor(opts = {}) {
     if (typeof window === "undefined" || !navigator.credentials) {
@@ -2891,7 +3795,7 @@ var PasskeySigner = class {
     }
     this.rpId = opts.rpId ?? window.location.hostname;
     this.rpName = opts.rpName ?? this.rpId;
-    if (isIpAddress(this.rpId)) {
+    if (isIpAddress2(this.rpId)) {
       throw new Error(
         `kit/passkey: passkeys can't use an IP address as the domain ("${this.rpId}"). Use http://localhost, a real HTTPS domain, or a tunnel (cloudflared/ngrok) \u2014 or pass an explicit \`rpId\`. (The silent device key works over an IP; passkeys don't.)`
       );
@@ -2911,10 +3815,10 @@ var PasskeySigner = class {
     const challenge = crypto.getRandomValues(new Uint8Array(32));
     const cred = await navigator.credentials.create({
       publicKey: {
-        challenge: buf(challenge),
+        challenge: buf2(challenge),
         rp: { id: this.rpId, name: this.rpName },
         user: {
-          id: buf(userHandle(params.userId)),
+          id: buf2(userHandle2(params.userId)),
           name: params.userName,
           displayName: params.displayName ?? params.userName
         },
@@ -2941,7 +3845,7 @@ var PasskeySigner = class {
   async assert(challenge) {
     const cred = await navigator.credentials.get({
       publicKey: {
-        challenge: buf(challenge),
+        challenge: buf2(challenge),
         rpId: this.rpId,
         allowCredentials: [],
         userVerification: "preferred"
@@ -2956,18 +3860,23 @@ var PasskeySigner = class {
     return { authenticatorData, clientDataJSON, r, s, challengeOffset };
   }
 };
-function isIpAddress(host) {
+function isIpAddress2(host) {
   if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) return true;
   if (host.includes(":")) return true;
   return false;
 }
-function userHandle(userId) {
+function userHandle2(userId) {
   const bytes = new TextEncoder().encode(userId);
   return bytes.length <= 64 ? bytes : sha256.sha256(bytes);
 }
-function buf(bytes) {
+function buf2(bytes) {
   return bytes.slice();
 }
+/*! Bundled license information:
+
+@noble/ciphers/esm/utils.js:
+  (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
+*/
 
 exports.BackupSigner = BackupSigner;
 exports.Cavos = Cavos;
@@ -2976,12 +3885,12 @@ exports.CavosSolana = CavosSolana;
 exports.CavosStellar = CavosStellar;
 exports.DEVICE_ACCOUNT_CLASS_HASH = DEVICE_ACCOUNT_CLASS_HASH;
 exports.DEVICE_ACCOUNT_PROGRAM_ID = DEVICE_ACCOUNT_PROGRAM_ID;
-exports.DEVICE_ACCOUNT_WASM_HASH = DEVICE_ACCOUNT_WASM_HASH;
-exports.FACTORY_CONTRACT_ID = FACTORY_CONTRACT_ID;
+exports.HORIZON_URL = HORIZON_URL;
 exports.HttpRecoveryClient = HttpRecoveryClient;
 exports.HttpWalletRegistry = HttpWalletRegistry;
 exports.InMemoryWalletRegistry = InMemoryWalletRegistry;
-exports.NATIVE_SAC_ID = NATIVE_SAC_ID;
+exports.LocalDeviceUnwrapKey = LocalDeviceUnwrapKey;
+exports.PasskeyPrf = PasskeyPrf;
 exports.PasskeySigner = PasskeySigner;
 exports.SECP256R1_PROGRAM_ID = SECP256R1_PROGRAM_ID;
 exports.SOLANA_NETWORKS = SOLANA_NETWORKS;
@@ -2995,7 +3904,9 @@ exports.StaticIdentity = StaticIdentity;
 exports.StellarAdapter = StellarAdapter;
 exports.StellarRelayer = StellarRelayer;
 exports.UDC_ADDRESS = UDC_ADDRESS;
+exports.WebCryptoDeviceUnwrapKey = WebCryptoDeviceUnwrapKey;
 exports.WebCryptoSigner = WebCryptoSigner;
+exports.XLM_DECIMALS = XLM_DECIMALS;
 exports.anchorDiscriminator = anchorDiscriminator;
 exports.approveDeviceEverywhere = approveDeviceEverywhere;
 exports.base64urlEncode = base64urlEncode;
@@ -3009,18 +3920,30 @@ exports.deriveAddressSeed = deriveAddressSeed;
 exports.deriveAddressSeedSolana = deriveAddressSeedSolana;
 exports.deriveAddressSeedStellar = deriveAddressSeedStellar;
 exports.deriveBackupKey = deriveBackupKey;
-exports.deviceSignatureScVal = deviceSignatureScVal;
+exports.derivePasskeyKEK = derivePasskeyKEK;
+exports.deriveRecoveryKEK = deriveRecoveryKEK;
+exports.deriveStellarAddress = deriveStellarAddress;
+exports.deriveStellarMasterKeypair = deriveStellarMasterKeypair;
+exports.deviceSlotId = deviceSlotId;
+exports.eciesUnwrapDEK = eciesUnwrapDEK;
+exports.eciesWrapDEK = eciesWrapDEK;
 exports.encodeLowSSignature = encodeLowSSignature;
-exports.encodeStellarLowSSignature = encodeLowSSignature2;
+exports.fromDataEntries = fromDataEntries;
+exports.generateControlKey = generateControlKey;
+exports.generateDEK = generateDEK;
 exports.generateRecoveryCode = generateRecoveryCode;
 exports.hexToBytes = hexToBytes;
 exports.lowS = lowS;
+exports.openControlSeed = openControlSeed;
 exports.recoverCandidatePublicKeys = recoverCandidatePublicKeys;
 exports.recoverYParity = recoverYParity;
-exports.sec1Pubkey = sec1Pubkey;
+exports.sealControlSeed = sealControlSeed;
 exports.serializeInstructions = serializeInstructions;
 exports.signatureToFelts = signatureToFelts;
+exports.toDataEntries = toDataEntries;
 exports.u256ToFelts = u256ToFelts;
+exports.unwrapDEK = unwrapDEK;
 exports.webauthnDigest = webauthnDigest;
+exports.wrapDEK = wrapDEK;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map