Merge main into v17-feature-branch

[Ryang-21]

What

Merges main (21 commits, v16.1.0 and v16.2.0) into v17-feature-branch, then ports everything main added to the class-XDR API.

The merge itself touched 16 conflicted files with ~150 hunks, 127 of them in generated docs. Four conflicts needed real judgment:

• src/base/auth.ts — two independent redesigns of authorizeEntry collided. main (Extend authorizeEntry signing callbacks: payload argument and custom signature ScVals #1549) added the payload second argument to SigningCallback and the { signatureScVal, address? } return variant for smart-wallet signers, selecting target nodes by mutation. The branch had replaced that mutation with applyExpirationAndSignature, which rebuilds the credential tree immutably because class-XDR values are readonly. Resolution keeps the immutable helper and grafts main's callback contract onto it, feeding targetAddress into the helper's forAddress parameter.
• src/bindings/types.ts — took main's ~187 lines of typed event-interface generation (feat(bindings): generate typed event interfaces and filter helpers #1556, Support duplicate event names in generated bindings #1572) and migrated them to the branch's string-discriminant dispatch.
• src/contract/assembled_transaction.ts — took main's inspectAuthEntry-based rewrite of needsNonInvokerSigningBy, including the "empty scvVec counts as unsigned" fix.
• src/contract/spec.ts — took main's scSpecTypeVal early-out (fix(contract): handle scSpecTypeVal in Spec.scValToNative #1551), rewritten against the branch's switch (scv.type).

The larger job was invisible to git. 44 files that main touched and the branch did not merged without a single conflict marker, and 20 of them are written against XDR APIs this branch deleted. toXDR/fromXDR have no compat alias here, so each one is a hard type error. Notably src/base/auth.ts took ~200 lines of inspectAuthEntry/checkAuthEntryReadiness in legacy form, and src/contract/event_spec.ts arrived entirely legacy. Those are migrated in refactor(xdr): and test(xdr): commits kept separate from the merge commit so the mechanical work reads apart from the judgment calls.

Generated artifacts — reference docs and the e2e bindings snapshot — were regenerated rather than hand-merged, in their own commits.

Three follow-up commits fix review findings: a duplicate base/index key in rollup.config.mjs left by conflict resolution, a CHANGELOG heading that had swallowed the v17 breaking changes into the v16.2.0 section, and a doc claim that require(esm) works on every supported Node version (it needs a flag below 22.12.0).

Review notes

Read the commits in order. The merge commit shows the judgment calls, the two xdr migration commits are mechanical translation, and the chore(docs)/chore(e2e) commits are generated output you can skip.

Two known issues were deliberately left alone, both inherited from main and neither caused by this merge:

• scvSortedMap sorts by decoded JS value rather than canonical ScVal ordering, so a Map with mixed key types can be ordered in a way the host rejects, and 1 / 1n encode to duplicate keys.
• HorizonApi.TransactionFailedExtras.result_xdr is typed as required, but getTransactionResult() handles it being absent. The neighboring operations field has the same problem with an existing TODO(next major).

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @img/sharp-libvips-darwin-arm64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-darwin-arm64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-darwin-arm64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-darwin-x64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-darwin-x64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-darwin-x64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-arm under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linux-arm@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-arm@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-arm64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linux-arm64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-arm64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-ppc64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linux-ppc64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-ppc64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-riscv64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linux-riscv64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-riscv64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-s390x under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linux-s390x@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-s390x@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-x64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linux-x64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-x64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linuxmusl-arm64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linuxmusl-arm64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-arm64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linuxmusl-x64 under LGPL-3.0-or-later Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-libvips-linuxmusl-x64@1.3.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-x64@1.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-wasm32 Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-wasm32@0.35.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-win32-arm64 Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-win32-arm64@0.35.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-arm64@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-win32-ia32 Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-win32-ia32@0.35.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-ia32@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-win32-x64 Location: Package overview From: pnpm-lock.yaml → npm/astro@7.1.0 → npm/@img/sharp-win32-x64@0.35.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-x64@0.35.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/astro@7.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Merges broad v16.1/v16.2 SDK, documentation, testing, and CI updates into the v17 feature branch.

Changes:

• Adds contract events, flexible signers, upgraded auth, Map ScVals, and structured HTTP errors.
• Introduces executable documentation snippets and guide validation.
• Updates packaging, dependencies, generated references, and GitHub Actions.

Reviewed changes

Copilot reviewed 82 out of 86 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/unit/server/soroban/simulate_transaction.test.ts	Tests upgraded-auth RPC forwarding.
test/unit/server/soroban/assembled_transaction.test.ts	Tests signer and auth behavior.
test/unit/server_transaction.test.ts	Tests submission error wrapping.
test/unit/guide-snippets.test.ts	Tests snippet parsing and expansion.
test/unit/federation_server.test.ts	Tests federation HTTP errors.
test/unit/contract/signer.test.ts	Tests signer normalization.
test/unit/bindings/collisions.test.ts	Tests generated-name collisions.
test/unit/base/scval.test.ts	Tests Map conversion.
test/tsconfig.json	Adjusts test path resolution.
test/integration/bindings.test.ts	Tests event binding generation.
test/guides/vite-env.d.ts	Types import.meta.glob.
test/guides/tsconfig.json	Configures guide typechecking.
test/guides/snippets.test.ts	Executes guide snippets.
test/e2e/src/use-upgraded-auth.test.ts	Verifies CAP-71 simulation.
test/e2e/src/non-sim-sac-transfer.test.ts	Handles existing native SAC.
src/rpc/server.ts	Adds upgraded-auth simulation option.
src/horizon/server.ts	Wraps transaction submission errors.
src/horizon/horizon_api.ts	Expands transaction failure codes.
src/federation/server.ts	Wraps federation HTTP errors.
src/errors/wrap_http_error.ts	Adds HTTP-error normalization.
src/errors/transaction_failed.ts	Adds transaction failure accessors.
src/errors/index.ts	Exports the new error.
src/contract/types.ts	Broadens signer options.
src/contract/spec.ts	Adds event and generic Val support.
src/contract/signer.ts	Implements signer abstractions.
src/contract/index.ts	Exports signer and event APIs.
src/contract/event_spec.ts	Implements event parsing/filtering.
src/contract/basic_node_signer.ts	Reuses KeypairSigner.
src/contract/assembled_transaction.ts	Integrates signers and upgraded auth.
src/content.config.ts	Loads expanded documentation.
src/cli/util.ts	Returns generated bindings.
src/cli/index.ts	Reports generation diagnostics.
src/bindings/utils.ts	Adds case conversion helpers.
src/bindings/types.ts	Generates typed event interfaces.
src/bindings/generator.ts	Produces event diagnostics.
src/bindings/client.ts	Generates event client helpers.
src/base/transaction_builder.ts	Accepts structural transaction sources.
src/base/scval.ts	Adds Map-to-ScVal conversion.
src/base/index.ts	Exports auth inspection APIs.
scripts/check-snippets.ts	Validates guide markers.
scripts/build-md-siblings.ts	Expands snippets in Markdown output.
scripts/build-llms.ts	Expands snippets in LLM bundles.
rollup.config.mjs	Adds the base build entry.
README.md	Documents base imports and Jest.
package.json	Updates release, scripts, and dependencies.
examples/guides/send-a-payment.ts	Adds executable payment examples.
examples/guides/README.md	Documents snippet authoring.
examples/guides/connect-and-fund.ts	Adds executable account examples.
docs/reference/seps-federation.md	Refreshes generated references.
docs/reference/network-rpc.md	Documents upgraded-auth simulation.
docs/reference/errors.md	Documents transaction failures.
docs/reference/contracts-bindings.md	Refreshes binding references.
docs/index.md	Mirrors package usage guidance.
docs/guides/02-send-a-payment.md	Uses tested payment snippets.
docs/guides/01-connect-and-fund.md	Uses tested account snippets.
CONTRIBUTING.md	Documents the snippet workflow.
config/vitest.config.ts	Excludes networked guide tests.
config/vitest.config.guides.ts	Configures guide execution.
config/vitest.config.browser.ts	Excludes Node-only snippet tests.
config/snippets.ts	Implements snippet expansion.
config/guides-local-setup.ts	Redirects guides to Quickstart.
CHANGELOG.md	Merges release notes.
astro.config.mjs	Integrates expanded documentation.
.gitignore	Ignores generated working data.
.github/workflows/update-completed-sprint-on-issue-closed.yml	Updates token action.
.github/workflows/tests.yml	Updates actions and snippet checks.
.github/workflows/socket-scan.yml	Adds scheduled Socket scanning.
.github/workflows/npm_publish.yml	Updates publishing actions.
.github/workflows/guides_pr.yml	Adds local guide CI.
.github/workflows/format.yml	Updates formatting actions.
.github/workflows/e2e.yml	Updates protocol and tooling.
.github/workflows/docs_deploy.yml	Updates deployment actions.
.github/workflows/docs_build.yml	Adds snippet validation.
.github/workflows/codeql-analysis.yml	Updates CodeQL actions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​noble/​curves@​2.2.0
	@​astrojs/​starlight@​0.41.3
	astro@​7.1.0
	lint-staged@​17.0.8

View full report