From fc1c1b945885e1114b77fdf680edbd028b08d5d7 Mon Sep 17 00:00:00 2001 From: adr!an <111903096+adrianvrj@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:27:19 +0000 Subject: [PATCH 1/4] Add Cavos under Smart Account & Authentication --- skills/standards/ecosystem.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/skills/standards/ecosystem.md b/skills/standards/ecosystem.md index 5403ab3..7d9c646 100644 --- a/skills/standards/ecosystem.md +++ b/skills/standards/ecosystem.md @@ -187,6 +187,20 @@ Comprehensive TypeScript SDK for OpenZeppelin Smart Accounts on Stellar. - Built-in indexer for contract discovery - Multiple signer types (passkeys, Ed25519, policies) +#### Cavos +Embedded self-custodial wallet SDK. A device-bound P-256 key never leaves the device; an encrypted ed25519 control seed is sealed into the account's on-chain data entries (`cv:ct`) and signs classic `G…` transactions. +- **Website**: https://cavos.xyz +- **Docs**: https://docs.cavos.xyz +- **llms.txt**: https://docs.cavos.xyz/llms-full.txt +- **Demo**: https://demo.cavos.xyz +- **GitHub**: https://github.com/cavos-labs/kit +- **Use Case**: In-app wallets with social login +- **Features**: + - Classic Stellar `G…` account (can invoke Soroban contracts) + - Passkeys enroll devices; they do not sign transactions + - Optional AWS Nitro enclave recovery: users get a new device by signing in again; the enclave cannot move funds + - Optional pass-through gas sponsorship + #### Passkey Kit TypeScript SDK for passkey-based smart wallets. Sibling to Smart Account Kit, with a different authorization model — the two are not drop-in compatible. - **GitHub**: https://github.com/stellar/passkey-kit From 555b33c1d2f28d63602621b8f3d35332a3e65235 Mon Sep 17 00:00:00 2001 From: adr!an <111903096+adrianvrj@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:42:42 +0000 Subject: [PATCH 2/4] Clarify Cavos docs links and Stellar enclave trust model --- skills/standards/ecosystem.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/skills/standards/ecosystem.md b/skills/standards/ecosystem.md index 7d9c646..c00f248 100644 --- a/skills/standards/ecosystem.md +++ b/skills/standards/ecosystem.md @@ -190,15 +190,14 @@ Comprehensive TypeScript SDK for OpenZeppelin Smart Accounts on Stellar. #### Cavos Embedded self-custodial wallet SDK. A device-bound P-256 key never leaves the device; an encrypted ed25519 control seed is sealed into the account's on-chain data entries (`cv:ct`) and signs classic `G…` transactions. - **Website**: https://cavos.xyz -- **Docs**: https://docs.cavos.xyz -- **llms.txt**: https://docs.cavos.xyz/llms-full.txt +- **Docs**: https://docs.cavos.xyz — [llms.txt](https://docs.cavos.xyz/llms.txt) and full corpus [llms-full.txt](https://docs.cavos.xyz/llms-full.txt) - **Demo**: https://demo.cavos.xyz - **GitHub**: https://github.com/cavos-labs/kit - **Use Case**: In-app wallets with social login - **Features**: - Classic Stellar `G…` account (can invoke Soroban contracts) - Passkeys enroll devices; they do not sign transactions - - Optional AWS Nitro enclave recovery: users get a new device by signing in again; the enclave cannot move funds + - Optional AWS Nitro enclave recovery: new device by signing in again. Intended flow rewraps the DEK to the new device and does not sign; on Stellar the measured enclave and KMS stay in the trust model - Optional pass-through gas sponsorship #### Passkey Kit From 04996297a3e1f70f8bef5ab6011b6d7c9b47ef65 Mon Sep 17 00:00:00 2001 From: adr!an <111903096+adrianvrj@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:50:24 +0000 Subject: [PATCH 3/4] Qualify Cavos device-key and enclave signing claims --- skills/standards/ecosystem.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/skills/standards/ecosystem.md b/skills/standards/ecosystem.md index c00f248..1bd633a 100644 --- a/skills/standards/ecosystem.md +++ b/skills/standards/ecosystem.md @@ -188,7 +188,7 @@ Comprehensive TypeScript SDK for OpenZeppelin Smart Accounts on Stellar. - Multiple signer types (passkeys, Ed25519, policies) #### Cavos -Embedded self-custodial wallet SDK. A device-bound P-256 key never leaves the device; an encrypted ed25519 control seed is sealed into the account's on-chain data entries (`cv:ct`) and signs classic `G…` transactions. +Embedded self-custodial wallet SDK. The P-256 unwrap key is local: non-extractable in the browser, secure-storage bytes on Node and React Native. An encrypted ed25519 control seed is sealed into the account's on-chain data entries (`cv:ct`) and signs classic `G…` transactions. - **Website**: https://cavos.xyz - **Docs**: https://docs.cavos.xyz — [llms.txt](https://docs.cavos.xyz/llms.txt) and full corpus [llms-full.txt](https://docs.cavos.xyz/llms-full.txt) - **Demo**: https://demo.cavos.xyz @@ -197,7 +197,7 @@ Embedded self-custodial wallet SDK. A device-bound P-256 key never leaves the de - **Features**: - Classic Stellar `G…` account (can invoke Soroban contracts) - Passkeys enroll devices; they do not sign transactions - - Optional AWS Nitro enclave recovery: new device by signing in again. Intended flow rewraps the DEK to the new device and does not sign; on Stellar the measured enclave and KMS stay in the trust model + - Optional AWS Nitro enclave recovery: new device by signing in again. Intended flow rewraps the DEK to the new device; the enclave does not sign. On Stellar the measured enclave and KMS stay in the trust model - Optional pass-through gas sponsorship #### Passkey Kit From 7f744b9fc6eae70baa1a62cd1794187c23355b92 Mon Sep 17 00:00:00 2001 From: adr!an <111903096+adrianvrj@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:56:48 +0000 Subject: [PATCH 4/4] Distinguish Cavos unwrap-key storage by runtime --- skills/standards/ecosystem.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/standards/ecosystem.md b/skills/standards/ecosystem.md index 1bd633a..dac4718 100644 --- a/skills/standards/ecosystem.md +++ b/skills/standards/ecosystem.md @@ -188,7 +188,7 @@ Comprehensive TypeScript SDK for OpenZeppelin Smart Accounts on Stellar. - Multiple signer types (passkeys, Ed25519, policies) #### Cavos -Embedded self-custodial wallet SDK. The P-256 unwrap key is local: non-extractable in the browser, secure-storage bytes on Node and React Native. An encrypted ed25519 control seed is sealed into the account's on-chain data entries (`cv:ct`) and signs classic `G…` transactions. +Embedded self-custodial wallet SDK. The P-256 unwrap key is local: non-extractable in the browser and on React Native (OS keystore); on Node you supply the key and persist the raw scalar yourself. An encrypted ed25519 control seed is sealed into the account's on-chain data entries (`cv:ct`) and signs classic `G…` transactions. - **Website**: https://cavos.xyz - **Docs**: https://docs.cavos.xyz — [llms.txt](https://docs.cavos.xyz/llms.txt) and full corpus [llms-full.txt](https://docs.cavos.xyz/llms-full.txt) - **Demo**: https://demo.cavos.xyz