[adrianvrj]

Stellar mainnet proof, @cavos/kit 0.5.2: account, create tx sponsored by the Cavos relayer, USDC trustline tx.

Adds Cavos to the Community Built skills, as suggested on #112.

• Skill: https://raw.githubusercontent.com/cavos-labs/kit/main/skills/cavos-stellar/SKILL.md (raw URL, returns 200)
• Appended to the end of ECOSYSTEM_CARD_SOURCES; ECOSYSTEM_CARDS sorts it.
• The skill scopes key storage per runtime: browser vault (non-extractable WebCrypto), React Native OS keystore, Node caller-supplied. It names the enclave as part of the restore trust model and states that the enclave does not sign.

[stellar-triage-bot]

🤖 Automated message from the Stellar Triage Bot.

👀 Picked this up — a review will follow shortly.

[stellar-triage-bot]

🤖 Automated message from the Stellar Triage Bot.

Thanks for coming back with a community card, @adrianvrj. The skill reads well, and the trust-model table, with its "what it cannot do" column, is a real help to readers.

What I checked:

• The card entry matches its neighbours and merges cleanly. Every link resolves. The docs.cavos.xyz pages send our runner a Cloudflare challenge, but llms.txt lists all of them.
• The API in SKILL.md matches the @cavos/kit 0.5.2 source: provider config, useCavos, wallet statuses, execute, addTrustline, invokeContract, signXdr, signMessage, and the HKDF info string.
• The mainnet proof checks out on Horizon: a sponsored create with 0 XLM, then a sponsored trustline to Circle's USDC.

One item remains before I merge. The first execute on a new sponsored account cannot succeed:

1. buildSponsoredCreateTx creates the account with startingBalance: "0". Your proof account also holds 0 XLM.
2. _createAndExecute then sends a native XLM payment from that account. With 0 XLM, the payment fails with op_underfunded.
3. So "The first execute creates it (sponsored), then runs the payment" and the execute(10_000_000n, …) example throw for every new user. The account still gets created and turns ready.
4. A USDC-only app has no other way to reach ready, because only execute creates the account.

Could you tell readers what really happens on that first call, and how a trustline-first app should create the account? A kit change, such as a create-only call, would also solve it. Your "A sponsored account holds 0 XLM" gotcha is correct. It only needs to connect to the first-execute text.

[adrianvrj]

Thanks, fixed in the kit rather than only in the text: cavos-labs/kit#53 (@cavos/kit 0.5.3).

• New wallet.create() creates the account without sending anything, sponsored when appId is set. It is a no-op once the account is ready.
• addTrustline and invokeContract on an undeployed account now say "Call create() first."
• The skill now spells out the first call on a new account: create() sends nothing; execute() creates the account, then the XLM payment fails with op_underfunded at 0 XLM while the account is still created; trustline-first apps call create() first.

Updated skill: https://raw.githubusercontent.com/cavos-labs/kit/main/skills/cavos-stellar/SKILL.md

[stellar-triage-bot]

🤖 Automated message from the Stellar Triage Bot.

Thanks, @adrianvrj. Fixing this in the kit was the right call. create() in cavos-labs/kit#53 does what the skill says. The new "On a new account" list is clear.

What I checked:

• create() returns early on ready and otherwise calls _createAccount, the same path execute uses.
• addTrustline and invokeContract now throw "Call create() first." on an undeployed account.
• The execute text and the 0 XLM gotcha now match what happens on chain.

One item blocks the merge. @cavos/kit 0.5.3 is not on npm yet:

1. npm latest is still 0.5.2. The registry has no 0.5.3.
2. The "Publish to npm" job on main failed: npm error 404 Not Found - PUT https://registry.npmjs.org/@cavos%2fkit (run 43245255118). This error usually means the publish token cannot write to the package.
3. So npm install @cavos/kit installs 0.5.2. Then wallet.create() is not a function, and a trustline-first app is still stuck.

Could you publish 0.5.3 and reply here? I will recheck the registry and merge. No change to this PR is needed.

[adrianvrj]

Sorry, our CI failed to publish, it is up now!

[stellar-triage-bot]

🤖 Automated message from the Stellar Triage Bot.

Thanks for publishing so fast, @adrianvrj. The last item is now resolved.

What I checked:

• npm latest for @cavos/kit is now 0.5.3. Its gitHead is the Add create() to Stellar wallets (0.5.3) cavos-labs/kit#53 merge commit.
• The published build has create() and the "Call create() first." errors in addTrustline and invokeContract.
• The skill has not changed since my last review. The card URLs resolve, and the card merges cleanly with main.

Merging now. Welcome to the community skills!

[stellar-triage-bot]

🤖 Automated message from the Stellar Triage Bot.

Verified end to end. See the comment above.