[kalepail]

Summary

• Harden passkey auth signing for Protocol 27 address-bound Soroban credentials.
• Use the SDK's canonical buildAuthorizationEntryPreimage() helper when available and fail closed on unsupported address-bound credential surfaces.
• Upgrade the package, generated SDKs, and demo from the stale v16 RC to stable @stellar/stellar-sdk@^16.0.1.
• Migrate removed @stellar/stellar-sdk/minimal* imports to the v16 public package entrypoints.
• Regenerate sac-sdk from the live Protocol 27 Testnet SAC spec, including trust and current muxed-transfer event specs.
• Add focused legacy, ADDRESS_V2, and ADDRESS_WITH_DELEGATES payload coverage.
• Prepare releases as passkey-kit@0.13.0, passkey-kit-sdk@0.8.0, and sac-sdk@0.5.0.
• Add the repository's first pull-request CI workflow and refresh semver-compatible lockfile dependencies.

Protocol 27 behavior

• Legacy SOROBAN_CREDENTIALS_ADDRESS continues to use the legacy authorization preimage.
• SOROBAN_CREDENTIALS_ADDRESS_V2 uses the address-bound preimage.
• SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES is detected but passkey signing fails closed because delegate-tree signing is not implemented in this legacy kit.
• Invalid signature-expiration ledgers fail before mutating an authorization entry.

This is a client/SDK signing and generated-binding change. It does not change the smart-wallet contract ABI or WASM, and existing deployments do not require an on-chain upgrade for Protocol 27.

Breaking changes

• Node.js 22.18 or newer is required.
• Consumers should use @stellar/stellar-sdk@^16.0.1.
• The removed v16 /minimal subpaths have been replaced with @stellar/stellar-sdk, /contract, and /rpc.
• The new package versions reflect the Node and Stellar SDK major-version requirements.

Validation

Validated on head 18ea7931bd2b8860c2ce262d6bfc17b1ac0b78fb:

• GitHub Actions CI / sdk
• pnpm install --frozen-lockfile
• pnpm run build
• pnpm exec tsc --noEmit --pretty false
• pnpm run test:p27-auth
• pnpm --dir demo install --frozen-lockfile
• pnpm --dir demo run check
• pnpm --dir demo run build
• pnpm audit --json — 0 workspace findings
• pnpm pack --recursive --dry-run --json
• git diff --check
• cargo test --workspace --locked — 4 smart-wallet tests passed after building the sample-policy fixture
• stellar contract build with Stellar CLI 27.0.0

The audit was independently split across Solo Claude, Codex, OpenCode, and Grok reviewers.

Follow-up debt

• Delegate-tree passkey signing remains unsupported and is explicitly rejected.
• The demo still reports the pre-existing relayer crypto externalization and large-bundle warnings.
• The separate Svelte 4/Vite 5 demo toolchain has development-only audit findings that require a major frontend migration.
• Contract source still pins soroban-sdk = "23.0". Existing WASM remains valid, but a separate SDK 27/toolchain upgrade should be completed before the next contract release.

[kalepail]

Related implementation reconciliation:

Compared this change against the related smart-account-kit Protocol 27 auth-signing work and ported the applicable hardening into passkey-kit:

• ADDRESS_V2 and ADDRESS_WITH_DELEGATES now emit explicit SDK-support errors when the expected accessors are unavailable.
• buildSignaturePayload no longer mutates signatureExpirationLedger until after Protocol 27 address-bound preimage support has been confirmed.
• ADDRESS_WITH_DELEGATES fails closed in signAuthEntry rather than attempting to place a passkey signature into a delegate credential shape this kit does not yet implement.

The smart-account-kit-only multi-signer and funding flows do not exist in passkey-kit, so there was nothing equivalent to port for those paths.

Validation after reconciliation:

• pnpm exec tsc --noEmit
• pnpm run build
• git diff --check

[kalepail]

Review follow-up:

A final adversarial review pass checked this PR against the Protocol 27 / CAP-0071 auth changes:

• Legacy SOROBAN_CREDENTIALS_ADDRESS remains on the legacy auth preimage path.
• ADDRESS_V2 and ADDRESS_WITH_DELEGATES select address-bound preimage behavior.
• ADDRESS_WITH_DELEGATES fails closed in signAuthEntry because this kit does not yet implement delegate-tree signing.
• SDK-lag paths fail closed instead of silently signing legacy bytes.
• Expiration mutation ordering is safe.

Two follow-up changes were made:

• Added a uint32 integer guard for signature expiration ledgers so invalid values fail before mutating auth entries.
• Added focused Bun coverage for legacy payload parity, Protocol 27 fail-closed behavior, missing SDK accessors, no mutation on failed Protocol 27 signing, and expiration ledger boundaries.

Validation after fixes:

• pnpm run test:p27-auth
• pnpm exec tsc --noEmit
• pnpm run build
• git diff --check

[kalepail]

Final RC readiness update:

• Added commit 4cdbd07 (fix: prepare stellar sdk v16 rc support).
• Pinned root, generated SDK packages, and demo to @stellar/stellar-sdk@16.0.0-rc.1.
• Migrated removed @stellar/stellar-sdk/minimal* imports to the v16 public SDK entrypoints.
• Updated buildSignaturePayload() to prefer buildAuthorizationEntryPreimage() and expanded Protocol 27 auth payload coverage for legacy, ADDRESS_V2, and ADDRESS_WITH_DELEGATES.
• Added Node engine metadata matching the upgraded dependency graph.

Final adversarial review:

• Spawned Solo Claude and Codex reviewers with permission-bypass flags.
• Codex found no remaining blockers on the current tree after rerunning targeted and full validation.

Validation:

• pnpm exec tsc --noEmit --pretty false
• pnpm run test:p27-auth
• pnpm run build
• pnpm run build:demo
• git diff --check

Residual non-blocking gaps: no end-to-end RPC/contract signing test for delegated auth; demo build still has existing Vite warnings for browser-externalized crypto and bundle size.