smart-account-kit v0.10.0

This release keeps smart-account-kit-bindings@0.5.0 unchanged. Redeploy the relayer proxy to get
its changes; the proxy does not ship in the npm package. See #29 for the review and audit notes.

Breaking changes

• The kit now needs @stellar/stellar-sdk ^16.4.1. 16.4.0 adds the protocol 30 XDR, and 16.4.1
  fixes an axios advisory.
• @stellar/stellar-sdk is no longer a peer dependency. The kit installs its own 16.x copy. Before,
  pnpm linked an app's SDK 17 into the kit, and every kit call failed. An app on SDK 16 should use
  ^16.4.1, so that the app and the kit share one copy. An app on an older 16.x gets a second copy
  without a warning, and TypeScript then rejects SDK objects that the app passes to the kit. Check
  with npm ls @stellar/stellar-sdk or pnpm why @stellar/stellar-sdk.
• ReturnType<typeof signAuthEntryWithSigners> and ReturnType<SmartAccountKit["signAuthEntry"]>
  now resolve to string | xdr.SorobanAuthorizationEntry. Calls with an object or an any value
  keep the old return type.
• The signing paths throw ValidationError (INVALID_INPUT) for an address type that the SDK
  cannot convert, such as a CAP-84 muxed contract address (W…). Before, they threw a plain
  Error.

Added

• Apps on Stellar SDK 17 can use the kit. signAuthEntry, signAuthEntryWithSigners, and
  computeEntryAuthDigest accept a base64 SorobanAuthorizationEntry XDR string. A string input
  returns a string. The kit also re-decodes an auth entry object from another SDK copy. The string
  must be canonical base64. See "Using the kit from an app on Stellar SDK 17" in the README.
• Custom policy installParams can be an xdr.ScVal from another @stellar/stellar-sdk copy. The
  kit re-decodes it through its bytes.
• The new AuthEntryInput type.

Security

• The relayer proxy simulates signed xdr deployments before it reads the API key. It refuses a
  failed or restore-needed simulation (400) and a fee above the ceiling (413). It also compares
  the declared Soroban data with the simulation: the footprint must cover every simulated key, and
  the declared resource fee must be at most 2 * minResourceFee + 10000 stroops. The proxy does
  not compare instruction or byte counts, because they change between simulations.
  MAX_TOTAL_FEE_STROOPS and the rate limits still bound the loss from an envelope that declares
  too little.
• The relayer proxy refuses a deployment whose verifier or policy keys are not contract addresses
  (403). An xdr deployment must have exactly one source-account auth entry that matches the
  operation. With SDK 16.4.1, these inputs could carry CAP-84 muxed contract addresses that the
  constructor rejects on chain after the sponsor pays.
• The relayer proxy returns 403, not 500, for an unsupported address type. A sponsored token
  transfer must come from a contract (403). Before, a G… source got a 503 that clients could
  retry forever.

smart-account-kit v0.9.1

Changes

• fundWallet() submits through RPC by default, also when a relayer is configured. The temporary Friendbot account pays its own fee (#26).

Relayer proxy fixes, already deployed to the testnet relayer:

• Add ALLOWED_DEPLOY_WASM_HASHES. The default sponsors only stellar-accounts v0.8.0 wallet births (#24).
• Fix the ALLOWED_ORIGINS default to https://smart-account-kit.pages.dev (#24).
• Use a Workers-safe fetch cache mode for Channels submissions (#25).
• Accept V1 and V2 address credentials for wallet auth, as RPC simulation returns V1 (#27).

smart-account-kit-bindings@0.5.0 is unchanged.

smart-account-kit v0.9.0

Changes

• Support the stellar-accounts v0.7.3 and v0.8.0 account builds, including the v0.8.0 preimage-v1 auth digest. Refuse delegated contract signers (GHSA-jpg9-m7w4-c7wc).
• Add signAuthEntryWithSigners for sign-only Ed25519, delegated, and passkey signing without submission (#13).
• Require caller-supplied context rule IDs. Never take them from a supplied auth payload.
• Gate raw upgrade calls on the admin signing path to accepted WASM hashes, with the wallet as operator.
• Restrict direct relayer transfers to Stellar Asset Contracts or listed custom tokens (relayer proxy).
• Default the demos and the relayer proxy to the v0.8.0 account build and the v0.8.0 policies. See docs/deployments-stellar-accounts-0.8-2026-10-25.md for testnet and mainnet IDs.
• Dependency audit fixes.

This release includes breaking security changes. It requires smart-account-kit-bindings@0.5.0. Read CHANGELOG.md before updating.

smart-account-kit v0.8.0

Changes

• Release the accumulated breaking security hardening for signing, WebAuthn, wallet provenance, and relayer validation.
• Add explicit admin signing APIs and bind every admin authorization root to the exact transaction host function.
• Remove the relayer client ReDoS path and obsolete relayer lockfile.
• Pin CI actions and add relayer type checking and secret scanning.

The contracts and smart-account-kit-bindings@0.4.0 remain unchanged. Read CHANGELOG.md before updating.

smart-account-kit v0.7.1

Changes

• The SDK adds typed schema-2 incomplete reasons.
• Collision validation handles derived and non-derived candidates together.
• The SDK adds the historical signer-data label.

The bindings, contracts, and deployed services remain unchanged.

v0.6.2

Changes

• Improved browser compatibility for authorization nonce generation.
• Hardened the indexer demo rendering for external metadata.
• Added an explicit security status and a mainnet value warning.
• Reduced unnecessary security details in public documentation and comments.
• Released smart-account-kit-bindings 0.4.0 for Stellar SDK 16.0.0 or later.

Security notice

This project has not completed a public production audit. Use it at your own risk, especially with mainnet value.