feat: deploy from wasm by chadoh · Pull Request #23 · stellar-registry/ui

chadoh · 2026-07-06T22:18:18Z

Closes #37

From Q2 deliverable 5:

A "deploy this Wasm" button that initiates a Registry deploy from the UI

Adds a "Deploy a contract using this Wasm" to the wasm overview page. In doing so, this PR also adds Stellar Wallets Kit and Stellar SDK as dependencies, as we need to connect a wallet in order to deploy.

Video demo:

deploy-from-wasm-demo-sm.mov

Replaces the stub button from #23 with a working "Deploy a contract using this Wasm" flow on the wasm overview page: - Connects a wallet via @creit.tech/stellar-wallets-kit (Freighter, xBull, Albedo, Lobstr, Hana, Ledger, WalletConnect, etc.) - Fetches the wasm's constructor spec from the indexer's existing GET /wasms/{wasm_hash}/deploy-spec endpoint - Renders a typed form for primitive constructor args (address, string, symbol, integers, bool, bytes); wasms with unsupported arg types (vec, map, option, tuple, udt — the endpoint can't describe their shape) show a clear "not supported yet" message instead of a broken form - Builds, simulates, signs, and submits a `deploy_unnamed` invocation against the Registry contract via @stellar/stellar-sdk, then polls for the result and shows the new contract's address Also adds: - REGISTRY_RPC_URL env var (wrangler.jsonc/.dev.vars.example/workers/app.ts), network-dependent like REGISTRY_API_URL — testnet defaults to the public SDF RPC; the mainnet value is a placeholder that needs a real provider URL before this works in the mainnet environment - app/lib/network.ts: network passphrase + Registry contract ID constants (stable, deterministically-deployed addresses per network) - app/components/dialog.tsx: generic Radix-based modal primitive - vite-plugin-node-polyfills for the Buffer global stellar-sdk needs client-side Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

From Q2 deliverable 5: > A "deploy this Wasm" button that initiates a Registry deploy from the UI This should call `deploy_unnamed` on the Registry contract. It first needs to figure out what constructor args to use with the contract, and provide a form for filling these in.

Replaces the stub button from #23 with a working "Deploy a contract using this Wasm" flow on the wasm overview page: - Connects a wallet via @creit.tech/stellar-wallets-kit (Freighter, xBull, Albedo, Lobstr, Hana, Ledger, WalletConnect, etc.) - Fetches the wasm's constructor spec from the indexer's existing GET /wasms/{wasm_hash}/deploy-spec endpoint - Renders a typed form for primitive constructor args (address, string, symbol, integers, bool, bytes); wasms with unsupported arg types (vec, map, option, tuple, udt — the endpoint can't describe their shape) show a clear "not supported yet" message instead of a broken form - Builds, simulates, signs, and submits a `deploy_unnamed` invocation against the Registry contract via @stellar/stellar-sdk, then polls for the result and shows the new contract's address Also adds: - REGISTRY_RPC_URL env var (wrangler.jsonc/.dev.vars.example/workers/app.ts), network-dependent like REGISTRY_API_URL — testnet defaults to the public SDF RPC; the mainnet value is a placeholder that needs a real provider URL before this works in the mainnet environment - app/lib/network.ts: network passphrase + Registry contract ID constants (stable, deterministically-deployed addresses per network) - app/components/dialog.tsx: generic Radix-based modal primitive - vite-plugin-node-polyfills for the Buffer global stellar-sdk needs client-side Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

socket-security · 2026-08-19T14:54:59Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	buffer@6.0.3
	@creit.tech/stellar-wallets-kit@2.5.0
	vite-plugin-node-polyfills@0.28.0
	@stellar/stellar-sdk@16.2.0

View full report

socket-security · 2026-08-19T14:55:01Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@hot-wallet/sdk` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/@hot-wallet/sdk@1.0.11` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@hot-wallet/sdk@1.0.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@protobufjs/float` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@protobufjs/float@1.0.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@protobufjs/float@1.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@solana-program/system` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/@solana-program/system@0.10.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solana-program/system@0.10.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@walletconnect/sign-client` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/@walletconnect/sign-client@2.23.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning CVE: GHSA-gcfj-64vw-6mp9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning (HIGH) Affected versions: >= 0.31.1 < 0.33.0; >= 1.15.2 < 1.18.0 Patched version: 1.18.0 From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/axios@1.16.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `protobufjs`: Denial of service through unbounded Any expansion during JSON conversion CVE: GHSA-wcpc-wj8m-hjx6 protobufjs: Denial of service through unbounded Any expansion during JSON conversion (HIGH) Affected versions: < 7.6.1; >= 8.0.0 < 8.4.1 Patched version: 7.6.1 From: package-lock.json → `npm/protobufjs@7.5.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@7.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: protobuf.js: Code injection through bytes field defaults in generated toObject code in npm `protobufjs` CVE: GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code (HIGH) Affected versions: < 7.5.6; >= 8.0.0 < 8.0.2 Patched version: 7.5.6 From: package-lock.json → `npm/protobufjs@7.5.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@7.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: protobuf.js: Process-wide denial of service through unsafe option paths in npm `protobufjs` CVE: GHSA-jvwf-75h9-cwgg protobuf.js: Process-wide denial of service through unsafe option paths (HIGH) Affected versions: < 7.5.6; >= 8.0.0 < 8.0.2 Patched version: 7.5.6 From: package-lock.json → `npm/protobufjs@7.5.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@7.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: protobuf.js: Denial of service through unbounded protobuf recursion in npm `protobufjs` CVE: GHSA-685m-2w69-288q protobuf.js: Denial of service through unbounded protobuf recursion (HIGH) Affected versions: < 7.5.6; >= 8.0.0 < 8.0.2 Patched version: 7.5.6 From: package-lock.json → `npm/protobufjs@7.5.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@7.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: protobuf.js: Code generation gadget after prototype pollution in npm `protobufjs` CVE: GHSA-75px-5xx7-5xc7 protobuf.js: Code generation gadget after prototype pollution (HIGH) Affected versions: < 7.5.6; >= 8.0.0 < 8.0.2 Patched version: 7.5.6 From: package-lock.json → `npm/protobufjs@7.5.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/protobufjs@7.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `stream-json` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/stream-json@1.9.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/stream-json@1.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `vite-plugin-node-polyfills` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/vite-plugin-node-polyfills@0.28.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite-plugin-node-polyfills@0.28.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `@safe-global/safe-gateway-typescript-sdk` Reason: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/@safe-global/safe-gateway-typescript-sdk@3.23.1` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@safe-global/safe-gateway-typescript-sdk@3.23.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `@stellar/stellar-base` Reason: This package is now rolled into @stellar/stellar-sdk. Please use @stellar/stellar-sdk to continue receiving updates and support. From: package-lock.json → `npm/@stellar/stellar-base@14.1.0` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@stellar/stellar-base@14.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `uuid` Reason: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). From: package-lock.json → `npm/@creit.tech/stellar-wallets-kit@2.5.0` → `npm/uuid@8.3.2` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/uuid@8.3.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Replaces the stub button from #23 with a working "Deploy a contract using this Wasm" flow on the wasm overview page: - Connects a wallet via @creit.tech/stellar-wallets-kit (Freighter, xBull, Albedo, Lobstr, Hana, Ledger, WalletConnect, etc.) - Fetches the wasm's constructor spec from the indexer's existing GET /wasms/{wasm_hash}/deploy-spec endpoint - Renders a typed form for primitive constructor args (address, string, symbol, integers, bool, bytes); wasms with unsupported arg types (vec, map, option, tuple, udt — the endpoint can't describe their shape) show a clear "not supported yet" message instead of a broken form - Builds, simulates, signs, and submits a `deploy_unnamed` invocation against the Registry contract via @stellar/stellar-sdk, then polls for the result and shows the new contract's address Also adds: - REGISTRY_RPC_URL env var (wrangler.jsonc/.dev.vars.example/workers/app.ts), network-dependent like REGISTRY_API_URL — testnet defaults to the public SDF RPC; the mainnet value is a placeholder that needs a real provider URL before this works in the mainnet environment - app/lib/network.ts: network passphrase + Registry contract ID constants (stable, deterministically-deployed addresses per network) - app/components/dialog.tsx: generic Radix-based modal primitive - vite-plugin-node-polyfills for the Buffer global stellar-sdk needs client-side - an npm "overrides" pin forcing protobufjs to 7.5.5 everywhere in the tree: @creit.tech/stellar-wallets-kit's Trezor hardware-wallet support (@trezor/connect-plugin-stellar -> ... -> @trezor/protobuf) transitively pulled in protobufjs@7.4.0, hit by a critical arbitrary-code-execution CVE (GHSA-xq3m-2v4x-88gg, patched in 7.5.5) that Socket's PR check correctly blocked on. Filed the real fix upstream at trezor/trezor-suite#31421 (their already-published @trezor/protobuf@1.5.3 has the same bump but it never landed on the connect-v9 branch/line this depends on); this override keeps us unblocked in the meantime and can be dropped once that's merged and republished. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

restoreAddress() ran on every deploy dialog open (useEffect keyed on `open` in wasmOverview.tsx), and kit.getAddress() fans out to every configured wallet-connector module. At least one connector's SDK attaches a `close` listener per probe without cleanup, so repeatedly opening the dialog accumulated listeners past the default cap: MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 close listeners added. Cache the restore probe per kit lifetime (reset alongside the existing initializedFor guard on network change) so it runs once per session instead of once per dialog open.

Addresses review feedback on #23 (deploy.ts:120): build the deploy_unnamed call through a generated Registry contract client instead of hand-built TransactionBuilder/Operation/polling code. - Add clients/registry-client, generated TypeScript bindings for the Registry contract (via `stellar registry download` + `stellar contract bindings typescript`), wired in as an npm workspace (clients/*) rather than hand-copied. `npm run generate:registry-client` regenerates it. - Rewrite deployFromWasm to build/sign/send through registry-client's Client + AssembledTransaction. deployFromWasm's external signature is unchanged, so wasmOverview.tsx and wallet.ts need no changes. - Errors now surface from the contract's own Result<Address, Error> via .unwrap() instead of generic status-polling messages. - Ignore clients/ in eslint (generated code). - Document the registry-client generation flow in the README.

… wallets, that the app will update to the new address that is connected

chadoh · 2026-08-24T15:09:12Z

    "format": "prettier . --write",
-    "prepare": "husky"
+    "prepare": "husky",
+    "generate:registry-client": "stellar registry download registry -o /tmp/registry.wasm --network testnet -s me && stellar contract bindings typescript --wasm /tmp/registry.wasm --output-dir clients/registry-client --overwrite"


I would rather we do this with stellar-scaffold machinery. An environments.toml with a [staging] section that points at testnet and, once it's there, refers to registry by name (might need to use the id for now), and a [production] section that points at mainnet and again uses it by name/id.

Dog food as much as possible.

chadoh · 2026-08-24T15:14:42Z

+	const init = constructorArgs
+		? constructorArgs.map((arg) => {
+				const value = parseArgValue(arg.type, arg.rawValue)
+				// "bool" isn't a valid nativeToScVal type hint — a JS boolean
+				// converts to scvBool unambiguously without one.
+				return arg.type === "bool"
+					? nativeToScVal(value)
+					: nativeToScVal(value, { type: arg.type })
+			})
+		: undefined


Did you try passing just constructorArgs to init? I would hope that the contract.Client / AssembledTransaction logic already prepares the argument correctly, though this is a bit of a special case.

chadoh · 2026-08-24T15:16:54Z

+	const registry = new RegistryClient({
+		contractId: registryContractId,
+		networkPassphrase,
+		rpcUrl,
+		allowHttp: true,
+		publicKey: deployerAddress,
+		// registry-client's ClientOptions expects the Freighter-shaped signer
+		// (xdr, opts) => Promise<{ signedTxXdr }>; wallet.ts's signTransaction is
+		// the simpler (xdr) => Promise<string> shape used throughout the deploy
+		// dialog, so adapt it here rather than changing that call site.
+		signTransaction: async (xdr) => ({
+			signedTxXdr: await signTransaction(xdr),
+		}),
+	})


This is another place where I think I would prefer we follow the Stellar Scaffold pattern, initializing this at app startup with publicKey and signTransaction both initially undefined, then setting them later when we actually call signTransaction. I suspect we may be able to simplify this logic enough that we do not need a separate lib/deploy.ts — it will be so little code that we can inline it in the component.

chadoh · 2026-08-24T15:21:40Z

+	let tx
+	try {
+		tx = await registry.deploy_unnamed({
+			wasm_name: wasmName,
+			version: wasmVersion,
+			init,
+			salt: Buffer.from(salt),
+			deployer: deployerAddress,
+		})
+	} catch (e) {
+		throw new Error(
+			`Failed to prepare the deploy transaction: ${e instanceof Error ? e.message : String(e)}`,
+		)
+	}
+
+	let sent
+	try {
+		sent = await tx.signAndSend()
+	} catch (e) {
+		const message = e instanceof Error ? e.message : String(e)
+		// txBadAuth almost always means the connected wallet's account changed
+		// (in the extension, out of band) between building and submitting the
+		// transaction — surface that instead of the raw RPC failure JSON.
+		if (message.includes("txBadAuth")) {
+			throw new Error(
+				"The network rejected the transaction's signature (txBadAuth) — this usually means the connected wallet account changed. Disconnect and reconnect your wallet, then try deploying again.",
+			)
+		}
+		throw new Error(`Failed to send the deploy transaction: ${message}`)
+	}


AssembledTransaction.Errors and SentTransaction.Errors are both fairly extensive. Do we need to add custom error handling beyond what is already provided in Stellar SDK? It's possible it already deals with these edge cases and the AI just cargo-culted unnecessary patterns from stale examples in the wild.

If Stellar SDK is in fact missing these cases, then I'd prefer we send an upstream PR to add the error handling in AssembledTransaction and SentTransaction, so that the entire Stellar ecosystem benefits from them, rather than complicating our specific app with these workarounds.

chadoh assigned zachfedor and b4sen Jul 6, 2026

chadoh marked this pull request as draft July 6, 2026 22:24

willemneal mentioned this pull request Jul 6, 2026

PG Award Proposal: Stellar Registry SCF-Public-Goods-Maintenance/scf-public-goods-maintenance.github.io#111

Closed

1 task

github-actions Bot mentioned this pull request Jul 7, 2026

PG Award Proposal: Stellar Registry SCF-Public-Goods-Maintenance/scf-public-goods-maintenance.github.io#117

Merged

1 task

chadoh mentioned this pull request Jul 16, 2026

Extract transformed contract meta and contract interface to own table stellar-registry/indexer#30

Closed

chadoh unassigned zachfedor and b4sen Aug 6, 2026

github-actions Bot mentioned this pull request Aug 11, 2026

Q3 tracking; Q4 prep SCF-Public-Goods-Maintenance/scf-public-goods-maintenance.github.io#130

Closed

1 task

pselle force-pushed the feat/deploy-from-wasm branch from e06efca to 051d9bf Compare August 19, 2026 14:53

pselle force-pushed the feat/deploy-from-wasm branch from 051d9bf to a324284 Compare August 19, 2026 15:46

pselle force-pushed the feat/deploy-from-wasm branch from a324284 to 1ca395c Compare August 19, 2026 20:18

pselle force-pushed the feat/deploy-from-wasm branch from 1ca395c to 0112ea5 Compare August 19, 2026 20:35

pselle added 2 commits August 21, 2026 04:56

Style tweak for copy dialog

687895a

pselle marked this pull request as ready for review August 21, 2026 16:36

pselle added 2 commits August 21, 2026 12:43

Update mainnet URLs

7323ba1

Correct comment to be more accurate

746c250

pselle requested a review from zachfedor August 21, 2026 17:32

chadoh commented Aug 21, 2026

View reviewed changes

Comment thread app/lib/deploy.ts Outdated

pselle added 2 commits August 21, 2026 17:31

Adjust so that we can disconnect a connected wallet, and if we change…

875d01f

… wallets, that the app will update to the new address that is connected

Fixup modal overlay issue again

ac9055d

chadoh commented Aug 24, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat: deploy from wasm - #23

feat: deploy from wasm#23
chadoh wants to merge 9 commits into
mainfrom
feat/deploy-from-wasm

chadoh commented Jul 6, 2026 •

edited by pselle

Loading

Uh oh!

socket-security Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

chadoh Aug 24, 2026

Uh oh!

chadoh Aug 24, 2026

Uh oh!

chadoh Aug 24, 2026

Uh oh!

chadoh Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

chadoh commented Jul 6, 2026 • edited by pselle Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

chadoh Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

chadoh Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

chadoh Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

chadoh Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chadoh commented Jul 6, 2026 •

edited by pselle

Loading

socket-security Bot commented Aug 19, 2026 •

edited

Loading

socket-security Bot commented Aug 19, 2026 •

edited

Loading