@stellar/typescript-wallet-sdk 3.0.3 → 4.0.0-beta.1786560120405

package/lib/walletSdk/Horizon/Transaction/TransactionBuilder.d.ts

@@ -1,4 +1,4 @@
-import { Account as StellarAccount, Transaction, Horizon, Memo, xdr } from "@stellar/stellar-sdk";
+import { TransactionSource, Transaction, Horizon, Memo, xdr } from "@stellar/stellar-sdk";
 import { Config } from "../../";
 import { AccountKeypair } from "../Account";
 import { StellarAssetId } from "../../Asset";
@@ -17,12 +17,12 @@ export declare class TransactionBuilder extends CommonTransactionBuilder<Transac
      * Creates a new instance of the TransactionBuilder class for constructing Stellar transactions.
      * @constructor
      * @param {Config} cfg - Configuration object for Stellar operations.
-     * @param {StellarAccount} sourceAccount - The source account for the transaction.
+     * @param {TransactionSource} sourceAccount - The source account for the transaction.
      * @param {number} [baseFee] - The base fee for the transaction. If not given will use the config base fee.
      * @param {Memo} [memo] - The memo for the transaction.
      * @param {Horizon.Server.Timebounds} [timebounds] - The timebounds for the transaction. If not given will use the config timebounds.
      */
-    constructor(cfg: Config, sourceAccount: StellarAccount, baseFee?: number, memo?: Memo, timebounds?: Horizon.Server.Timebounds);
+    constructor(cfg: Config, sourceAccount: TransactionSource, baseFee?: number, memo?: Memo, timebounds?: Horizon.Server.Timebounds);
     /**
      * Sponsoring a transaction.
      * @param {AccountKeypair} sponsorAccount - The account doing the sponsoring.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@stellar/typescript-wallet-sdk",
-  "version": "3.0.3",
+  "version": "4.0.0-beta.1786560120405",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "browser": "./lib/bundle_browser.js",
   "main": "./lib/bundle.js",
@@ -35,6 +35,7 @@
     "pretty-quick": "^2.0.1",
     "process": "^0.11.10",
     "sinon": "^15.1.0",
+    "smol-toml": "^1.7.1",
     "stream-browserify": "^3.0.0",
     "ts-jest": "^29.0.5",
     "ts-loader": "^9.4.2",
@@ -47,7 +48,7 @@
   "dependencies": {
     "@stablelib/base64": "^2.0.0",
     "@stablelib/utf8": "^2.0.0",
-    "@stellar/stellar-sdk": "15.0.1",
+    "@stellar/stellar-sdk": "16.2.0",
     "axios": "^1.4.0",
     "base64url": "^3.0.1",
     "https-browserify": "^1.0.0",
@@ -75,4 +76,4 @@
     "example:sep24": "ts-node examples/sep24/sep24.ts",
     "example:sep12": "ts-node examples/sep12/sep12.ts"
   }
-}
+}

package/src/shims/eventsource.js

@@ -0,0 +1,45 @@
+/**
+ * Lazy `eventsource` facade.
+ *
+ * eventsource v4 subclasses the DOM globals `Event`/`EventTarget` at module
+ * scope, which React Native's Hermes does not provide. Horizon's CallBuilder
+ * requires this module eagerly but only reads it inside `stream()`, so deferring
+ * evaluation to first property access keeps imports working everywhere while
+ * leaving streaming intact wherever those globals exist.
+ *
+ * Aliased in webpack.config.js: `eventsource$` resolves here, `eventsource-real$`
+ * to the real package.
+ */
+let realModule;
+
+const load = () => {
+  if (!realModule) {
+    try {
+      // eslint-disable-next-line global-require
+      realModule = require("eventsource-real");
+    } catch (cause) {
+      // CallBuilder.stream() catches this and retries on a timer, so make the
+      // error it reports to onerror self-explanatory.
+      throw new Error(
+        "Horizon streaming needs the DOM Event/EventTarget globals and a " +
+          "streaming fetch body, which React Native does not provide. Alias " +
+          '"eventsource" to a native SSE client (e.g. react-native-sse) to use ' +
+          `CallBuilder.stream(). Original error: ${cause.message}`,
+      );
+    }
+  }
+
+  return realModule;
+};
+
+Object.defineProperty(exports, "EventSource", {
+  enumerable: true,
+  configurable: true,
+  get: () => load().EventSource,
+});
+
+Object.defineProperty(exports, "ErrorEvent", {
+  enumerable: true,
+  configurable: true,
+  get: () => load().ErrorEvent,
+});

package/src/walletSdk/Horizon/AccountService.ts

@@ -96,13 +96,20 @@ export class AccountService {
       throw new OperationsLimitExceededError(HORIZON_LIMIT_MAX);
     }
 
-    return this.server
+    let builder = this.server
       .operations()
       .forAccount(accountAddress)
       .limit(limit)
       .order(order)
-      .cursor(cursor)
-      .includeFailed(includeFailed)
-      .call();
+      .includeFailed(includeFailed);
+
+    // Only set the cursor when provided. In stellar-sdk v16 the call builder
+    // serializes query params via URLSearchParams, so passing an undefined
+    // cursor would send the literal "cursor=undefined" and Horizon returns 400.
+    if (cursor) {
+      builder = builder.cursor(cursor);
+    }
+
+    return builder.call();
   }
 }

package/src/walletSdk/Horizon/Stellar.ts

@@ -1,5 +1,5 @@
 import {
-  Account as StellarAccount,
+  TransactionSource,
   Horizon,
   Transaction,
   TransactionBuilder as StellarTransactionBuilder,
@@ -75,7 +75,7 @@ export class Stellar {
     memo,
     timebounds,
   }: TransactionParams): Promise<TransactionBuilder> {
-    let sourceAccount: StellarAccount;
+    let sourceAccount: TransactionSource;
     try {
       sourceAccount = await this.cfg.stellar.server.loadAccount(
         sourceAddress.publicKey,

package/src/walletSdk/Horizon/Transaction/TransactionBuilder.ts

@@ -1,7 +1,7 @@
 import {
   Operation,
   TransactionBuilder as StellarTransactionBuilder,
-  Account as StellarAccount,
+  TransactionSource,
   Transaction,
   Horizon,
   Memo,
@@ -40,14 +40,14 @@ export class TransactionBuilder extends CommonTransactionBuilder<TransactionBuil
    * Creates a new instance of the TransactionBuilder class for constructing Stellar transactions.
    * @constructor
    * @param {Config} cfg - Configuration object for Stellar operations.
-   * @param {StellarAccount} sourceAccount - The source account for the transaction.
+   * @param {TransactionSource} sourceAccount - The source account for the transaction.
    * @param {number} [baseFee] - The base fee for the transaction. If not given will use the config base fee.
    * @param {Memo} [memo] - The memo for the transaction.
    * @param {Horizon.Server.Timebounds} [timebounds] - The timebounds for the transaction. If not given will use the config timebounds.
    */
   constructor(
     cfg: Config,
-    sourceAccount: StellarAccount,
+    sourceAccount: TransactionSource,
     baseFee?: number,
     memo?: Memo,
     timebounds?: Horizon.Server.Timebounds,
@@ -266,18 +266,21 @@ export class TransactionBuilder extends CommonTransactionBuilder<TransactionBuil
       throw new WithdrawalTxMissingMemoError();
     }
 
-    if (transaction.withdraw_memo_type === "hash") {
-      try {
+    // The memo type/value come from the anchor (untrusted input). stellar-sdk
+    // validates them when the Memo is constructed and throws on anything
+    // malformed, so map any failure to a domain WithdrawalTxMemoError for both
+    // the hash and non-hash paths rather than leaking the raw SDK error.
+    try {
+      if (transaction.withdraw_memo_type === "hash") {
         const buffer = Buffer.from(transaction.withdraw_memo, "base64");
-        const memo = Memo.hash(buffer.toString("hex"));
-        this.setMemo(memo);
-      } catch {
-        throw new WithdrawalTxMemoError();
+        this.setMemo(Memo.hash(buffer.toString("hex")));
+      } else {
+        this.setMemo(
+          new Memo(transaction.withdraw_memo_type, transaction.withdraw_memo),
+        );
       }
-    } else {
-      this.setMemo(
-        new Memo(transaction.withdraw_memo_type, transaction.withdraw_memo),
-      );
+    } catch {
+      throw new WithdrawalTxMemoError();
     }
 
     return this.transfer(

package/test/accountService.test.ts

@@ -1,8 +1,9 @@
 import axios from "axios";
 import { Horizon } from "@stellar/stellar-sdk";
+import sinon from "sinon";
 
 import { AccountService, SigningKeypair, Wallet } from "../src";
-import { HORIZON_ORDER } from "../src/walletSdk/Types";
+import { HORIZON_ORDER, HORIZON_LIMIT_DEFAULT } from "../src/walletSdk/Types";
 import { IssuedAssetId } from "../src/walletSdk/Asset";
 
 let accountService: AccountService;
@@ -97,3 +98,58 @@ describe("Horizon", () => {
     ).toBeTruthy();
   });
 });
+
+// Hermetic (no network) — kept out of the "Horizon" describe so its
+// friendbot/loadAccount beforeAll does not run.
+describe("AccountService.getHistory cursor handling", () => {
+  const accountAddress =
+    "GBBM6BKZPEHWYO3E3YKREDPQXMS4VK35YLNU7NFBRI26RAN7GI5POFBB";
+  let service: AccountService;
+  let fakeBuilder: Record<string, sinon.SinonStub>;
+
+  beforeEach(() => {
+    service = Wallet.TestNet().stellar().account();
+    fakeBuilder = {
+      forAccount: sinon.stub(),
+      limit: sinon.stub(),
+      order: sinon.stub(),
+      includeFailed: sinon.stub(),
+      cursor: sinon.stub(),
+      call: sinon.stub().resolves({ records: [] }),
+    };
+    // Every chained method returns the builder itself.
+    ["forAccount", "limit", "order", "includeFailed", "cursor"].forEach((m) =>
+      fakeBuilder[m].returns(fakeBuilder),
+    );
+    sinon
+      .stub(
+        service["server"] as unknown as { operations: () => unknown },
+        "operations",
+      )
+      .returns(fakeBuilder);
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  // Regression guard for the v16 URLSearchParams change: passing an undefined
+  // cursor into the call builder would serialize "cursor=undefined" and Horizon
+  // responds 400, so getHistory must omit .cursor() when none is provided.
+  it("omits .cursor() when no cursor is provided", async () => {
+    await service.getHistory({ accountAddress });
+
+    expect(fakeBuilder.cursor.called).toBe(false);
+    expect(fakeBuilder.call.calledOnce).toBe(true);
+    expect(fakeBuilder.limit.calledWith(HORIZON_LIMIT_DEFAULT)).toBe(true);
+    expect(fakeBuilder.order.calledWith(HORIZON_ORDER.DESC)).toBe(true);
+    expect(fakeBuilder.includeFailed.calledWith(false)).toBe(true);
+  });
+
+  it("applies .cursor(value) when a cursor is provided", async () => {
+    await service.getHistory({ accountAddress, cursor: "abc123" });
+
+    expect(fakeBuilder.cursor.calledOnceWithExactly("abc123")).toBe(true);
+    expect(fakeBuilder.call.calledOnce).toBe(true);
+  });
+});

package/test/stellar.test.ts

@@ -1,4 +1,5 @@
 import {
+  Account,
   Keypair,
   Memo,
   MemoText,
@@ -22,6 +23,7 @@ import {
 import { TransactionStatus, WithdrawTransaction } from "../src/walletSdk/Types";
 import {
   TransactionSubmitWithFeeIncreaseFailedError,
+  WithdrawalTxMemoError,
   WithdrawalTxMissingDestinationError,
   WithdrawalTxMissingMemoError,
   WithdrawalTxNotPendingUserTransferStartError,
@@ -753,3 +755,66 @@ describe("Account Modifying", () => {
     expect(parseInt(accResp.balances[0].balance)).toBeGreaterThan(19998);
   }, 30000);
 });
+
+// Hermetic (no network): stellar-sdk v16 tightened Memo validation, so a
+// malformed anchor-supplied withdrawal memo now throws when the Memo is
+// constructed. transferWithdrawalTransaction must map that to the domain
+// WithdrawalTxMemoError for every memo type, not just "hash".
+describe("transferWithdrawalTransaction memo validation", () => {
+  const localKp = SigningKeypair.fromSecret(
+    "SAS372GXRG6U7FW6W2PRVELKPOJG2FZZUADCIELWU2U3A45TNWXEQUV5",
+  );
+  let stellarLocal: Stellar;
+
+  beforeEach(() => {
+    stellarLocal = Wallet.TestNet().stellar();
+    sinon
+      .stub(stellarLocal.server, "loadAccount")
+      .resolves(new Account(localKp.publicKey, "1") as any);
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+
+  const buildWithdrawal = (memoType: string, memo: string) =>
+    ({
+      status: TransactionStatus.pending_user_transfer_start,
+      withdraw_anchor_account: localKp.publicKey,
+      withdraw_memo_type: memoType,
+      withdraw_memo: memo,
+      amount_in: "10",
+    } as unknown as WithdrawTransaction);
+
+  const usdc = () => new IssuedAssetId("USDC", localKp.publicKey);
+
+  it("maps a malformed hash memo to WithdrawalTxMemoError", async () => {
+    const builder = await stellarLocal.transaction({ sourceAddress: localKp });
+    expect(() =>
+      builder.transferWithdrawalTransaction(
+        buildWithdrawal("hash", "not-a-valid-hash"),
+        usdc(),
+      ),
+    ).toThrow(WithdrawalTxMemoError);
+  });
+
+  it("maps a malformed id memo to WithdrawalTxMemoError", async () => {
+    const builder = await stellarLocal.transaction({ sourceAddress: localKp });
+    expect(() =>
+      builder.transferWithdrawalTransaction(
+        buildWithdrawal("id", "not-a-number"),
+        usdc(),
+      ),
+    ).toThrow(WithdrawalTxMemoError);
+  });
+
+  it("maps an over-long text memo to WithdrawalTxMemoError", async () => {
+    const builder = await stellarLocal.transaction({ sourceAddress: localKp });
+    expect(() =>
+      builder.transferWithdrawalTransaction(
+        buildWithdrawal("text", "x".repeat(29)),
+        usdc(),
+      ),
+    ).toThrow(WithdrawalTxMemoError);
+  });
+});

package/test/toml.test.ts

@@ -0,0 +1,102 @@
+import { StellarToml } from "@stellar/stellar-sdk";
+import { parse } from "smol-toml";
+
+import { parseToml } from "../src/walletSdk/Utils/toml";
+
+// Hermetic coverage for the SEP-1 TOML path. stellar-sdk v16's
+// StellarToml.Resolver.resolve() fetches the raw text and returns
+// `smol-toml`.parse(text) verbatim (no post-processing), so parsing a fixture
+// string with the same parser here is a faithful, network-free stand-in for
+// the whole pipeline: it exercises v16's strict TOML 1.0 parser and our
+// TomlInfo mapping together.
+const parseTomlString = (toml: string) =>
+  parseToml(parse(toml) as unknown as StellarToml.Api.StellarToml);
+
+describe("parseToml", () => {
+  it("parses and maps a fully populated stellar.toml", () => {
+    const toml = `
+VERSION = "2.0.0"
+NETWORK_PASSPHRASE = "Test SDF Network ; September 2015"
+SIGNING_KEY = "GBBM6BKZPEHWYO3E3YKREDPQXMS4VK35YLNU7NFBRI26RAN7GI5POFBB"
+WEB_AUTH_ENDPOINT = "https://auth.example.com/auth"
+TRANSFER_SERVER = "https://anchor.example.com/sep6"
+TRANSFER_SERVER_SEP0024 = "https://anchor.example.com/sep24"
+KYC_SERVER = "https://anchor.example.com/kyc"
+HORIZON_URL = "https://horizon.example.com"
+ACCOUNTS = ["GBBM6BKZPEHWYO3E3YKREDPQXMS4VK35YLNU7NFBRI26RAN7GI5POFBB"]
+
+[DOCUMENTATION]
+ORG_NAME = "Example Anchor"
+ORG_URL = "https://example.com"
+
+[[CURRENCIES]]
+code = "USDC"
+issuer = "GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335X2KGX3IHOJAPP5RE34K4KZVN"
+display_decimals = 2
+is_asset_anchored = true
+anchor_asset_type = "fiat"
+collateral_addresses = ["GADDR1"]
+
+[[PRINCIPALS]]
+name = "Jane Doe"
+email = "jane@example.com"
+id_photo_hash = "abc123"
+
+[[VALIDATORS]]
+PUBLIC_KEY = "GDVALIDATORXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+HOST = "core.example.com:11625"
+`;
+
+    const info = parseTomlString(toml);
+
+    expect(info.version).toBe("2.0.0");
+    expect(info.networkPassphrase).toBe("Test SDF Network ; September 2015");
+    expect(info.webAuthEndpoint).toBe("https://auth.example.com/auth");
+    expect(info.transferServer).toBe("https://anchor.example.com/sep6");
+    expect(info.transferServerSep24).toBe("https://anchor.example.com/sep24");
+    expect(info.signingKey).toBe(
+      "GBBM6BKZPEHWYO3E3YKREDPQXMS4VK35YLNU7NFBRI26RAN7GI5POFBB",
+    );
+    expect(info.horizonUrl).toBe("https://horizon.example.com");
+
+    expect(info.documentation.orgName).toBe("Example Anchor");
+    expect(info.documentation.orgUrl).toBe("https://example.com");
+
+    expect(info.currencies).toHaveLength(1);
+    expect(info.currencies[0].code).toBe("USDC");
+    // display_decimals is a TOML integer; the mapping preserves the number.
+    expect(info.currencies[0].displayDecimals).toBe(2);
+    expect(info.currencies[0].isAssetAnchored).toBe(true);
+    expect(info.currencies[0].anchorAssetType).toBe("fiat");
+    expect(info.currencies[0].collateralAddresses).toEqual(["GADDR1"]);
+
+    expect(info.principals).toHaveLength(1);
+    expect(info.principals[0].name).toBe("Jane Doe");
+    expect(info.principals[0].idPhotoHash).toBe("abc123");
+
+    expect(info.validators).toHaveLength(1);
+    expect(info.validators[0].host).toBe("core.example.com:11625");
+    expect(info.validators[0].publicKey).toBe(
+      "GDVALIDATORXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
+    );
+  });
+
+  it("defaults optional array sections to [] when absent", () => {
+    const info = parseTomlString(`
+[DOCUMENTATION]
+ORG_NAME = "Example Anchor"
+`);
+
+    expect(info.principals).toEqual([]);
+    expect(info.currencies).toEqual([]);
+    expect(info.validators).toEqual([]);
+  });
+
+  it("rejects malformed TOML (v16 smol-toml strict parsing)", () => {
+    // Duplicate keys are invalid under TOML 1.0; smol-toml throws where the
+    // previous lenient parser may not have.
+    expect(() =>
+      parseTomlString(`VERSION = "1"\nVERSION = "2"\n[DOCUMENTATION]\n`),
+    ).toThrow();
+  });
+});

package/tsconfig.json

@@ -1,6 +1,7 @@
 {
   "compilerOptions": {
     "esModuleInterop": true,
+    "skipLibCheck": true,
     "baseUrl": "src/",
     "outDir": "lib",
     "declaration": true,

package/webpack.config.js

@@ -19,6 +19,17 @@ module.exports = (env = { NODE: false }) => {
     },
     resolve: {
       extensions: [".js", ".json", ".ts"],
+      alias: {
+        // eventsource v4, reached via stellar-sdk's Horizon CallBuilder,
+        // subclasses the DOM globals Event and EventTarget at module scope, so
+        // importing this package threw "Property 'Event' doesn't exist" on React
+        // Native. Unlike the km and soroban packages, this one exposes
+        // Horizon.Server publicly, so stubbing eventsource out would break
+        // .stream() on web and Node. Defer its evaluation to first use instead.
+        eventsource$: path.resolve(__dirname, "src/shims/eventsource.js"),
+        // The facade's load target; "eventsource" would resolve back to itself.
+        "eventsource-real$": require.resolve("eventsource"),
+      },
       fallback: isBrowser
         ? {
             crypto: require.resolve("crypto-browserify"),