fix(deps): unify @stellar/stellar-sdk on one major and make it a peer dep of the SDK

.changeset/stellar-sdk-17-peer-dependency.md

@@ -0,0 +1,9 @@
+---
+"invisible-wallet-sdk": minor
+---
+
+`@stellar/stellar-sdk` moves from `dependencies` to `peerDependencies` (`^17.0.1`),
+so an app using the SDK installs one copy of the XDR tables instead of two. Apps must
+now depend on `@stellar/stellar-sdk` 17 themselves — `npm install @stellar/stellar-sdk`
+alongside the SDK. The passkey authorisation path was rebuilt for protocol 23's
+CAP-71 `ADDRESS_V2` credential arm and verified with a real spend on testnet.

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: package-lock.json
       # The repo root is its own small npm project (release tooling + the smoke
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: package-lock.json
       - run: npm ci
@@ -108,7 +108,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: sdk/package-lock.json
       # sdk/ is a standalone npm project with its own lockfile — the repo root
@@ -141,7 +141,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: sdk/package-lock.json
       - name: Install dependencies
@@ -198,7 +198,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: frontend/wallet/package-lock.json
       - run: npm ci || { echo "::warning::npm ci failed; falling back to npm install"; npm install; }
@@ -223,7 +223,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: packages/agent/package-lock.json
       - run: npm ci || { echo "::warning::npm ci failed; falling back to npm install"; npm install; }
@@ -240,7 +240,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: frontend/mobile/package-lock.json
       - run: npm ci
@@ -264,7 +264,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: frontend/wallet/package-lock.json
       - run: npm ci || { echo "::warning::npm ci failed; falling back to npm install"; npm install; }

.github/workflows/memory-leak-nightly.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
           cache-dependency-path: frontend/wallet/package-lock.json
 

.github/workflows/mobile-apk.yml

@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: frontend/mobile/package-lock.json
 

.github/workflows/mobile-e2e.yml

@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: frontend/mobile/package-lock.json
 

.github/workflows/mobile.yml

@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: frontend/mobile/package-lock.json
       # frontend/mobile is not a workspace member and keeps its own lockfile, so

.github/workflows/mutation.yml

@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: sdk/package-lock.json
 

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
       # The repo root is not an npm workspace (#670): it installs only the

.github/workflows/storybook.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: npm
           cache-dependency-path: sdk/package-lock.json
       - run: npm ci || { echo "::warning::npm ci failed; falling back to npm install"; npm install; }

.github/workflows/testnet-smoke.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
 
       # ── Install the Stellar CLI (used for friendbot funding) ───────────────
       - name: Install Stellar CLI

.github/workflows/uptime.yml

@@ -48,7 +48,7 @@ jobs:
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Probe public endpoints
         id: probe

.github/workflows/wallet-e2e.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
           cache-dependency-path: frontend/wallet/package-lock.json
 

CONTRIBUTING.md

@@ -44,11 +44,14 @@ You install the one you are working on, in its own directory. There is no
 top-level install that pulls in everything, and there is no hoisted
 `node_modules` at the repo root.
 
-That is deliberate. The packages disagree on major versions on purpose (the SDK
-builds against `@stellar/stellar-sdk` 15 and TypeScript 6, the root smoke test
-against 14 and TypeScript 5), the SDK's Jest config maps modules through
-`<rootDir>/node_modules`, and Dependabot and every CI job are wired per package
-lockfile. A root `workspaces` field flattened all of that into one tree and
+That is deliberate. The packages are not all on the same toolchain: the SDK
+builds with TypeScript 6 and declares `@stellar/stellar-sdk` 17 as a peer
+dependency so the host app owns the single copy, the root smoke test runs
+TypeScript 5, and the `examples/*` apps are still on older
+`@stellar/stellar-sdk` majors. On top of that, the SDK's Jest config maps
+modules through `<rootDir>/node_modules`, and Dependabot and every CI job are
+wired per package lockfile. A root `workspaces` field flattened all of that
+into one tree and
 rewrote the root lockfile from ~950 to ~21,000 lines on every fresh clone
 ([#670](https://github.com/Miracle656/veil/issues/670)), so it was removed.
 

README.md

@@ -231,7 +231,7 @@ All transactions built by the agent are returned unsigned to the frontend, where
 | -------------- | ----------------------------------------------------------------- |
 | Smart contract | Rust, Soroban SDK, p256 crate (ECDSA), sha2                       |
 | Authentication | WebAuthn / FIDO2 (ES256 / P-256)                                  |
-| Client SDK     | TypeScript, React hooks, @stellar/stellar-sdk v15, Web Crypto API |
+| Client SDK     | TypeScript, React hooks, @stellar/stellar-sdk v17, Web Crypto API |
 | Wallet app     | Next.js 14 App Router, next-pwa                                   |
 | AI Agent       | Node.js, Claude claude-sonnet-4-6, Anthropic SDK, WebSocket       |
 | Price oracle   | Fastify, Prisma, Postgres (Supabase), x402 micropayments          |

frontend/mobile/components/QuickActions.tsx

@@ -4,7 +4,7 @@ import { useRouter, type Href } from 'expo-router';
 
 import { useTheme } from '../hooks/useTheme';
 import type { ThemeColors } from '../lib/theme';
-import { fontFamily } from '../theme/typography';
+import { fontFamily } from '../theme/fontFamily';
 import { BuyIcon, ReceiveIcon, SendIcon, SwapIcon, type IconProps } from './icons';
 
 export interface QuickActionItem {

frontend/mobile/components/__tests__/QuickActions.test.tsx

@@ -1,3 +1,7 @@
+jest.mock('expo-router', () => ({
+  useRouter: () => ({ push: jest.fn() }),
+}));
+
 import { QUICK_ACTIONS, QuickActionItem } from "../QuickActions";
 
 describe("QuickActions component definitions", () => {

frontend/mobile/jest.config.js

@@ -5,7 +5,8 @@ const expoPreset = require('jest-expo/jest-preset');
  *
  * `jest-expo` supplies the React Native transform, module mocks, and test
  * environment. The only change is the transform allow-list: `@noble/ciphers`,
- * `@noble/hashes` and the `@walletconnect` packages ship ESM only, and Jest
+ * `@noble/hashes`, the `@walletconnect` packages, and — since stellar-sdk 17 —
+ * `@exodus/bytes`, `uint8array-extras`, and `smol-toml` ship ESM only, and Jest
  * cannot `require` them untransformed. Metro handles them natively, so this
  * affects tests alone. `@walletconnect` is on the list because `walletStore`
  * imports the WalletConnect session-key constant from its owner; that already
@@ -21,7 +22,7 @@ module.exports = {
   modulePaths: ['<rootDir>/node_modules'],
   transformIgnorePatterns: expoPreset.transformIgnorePatterns.map((pattern) =>
     pattern.startsWith('/node_modules/(?!(')
-      ? pattern.replace('(?!(', '(?!(@noble|@walletconnect|')
+      ? pattern.replace('(?!(', '(?!(@noble|@exodus|uint8array-extras|smol-toml|@walletconnect|')
       : pattern
   ),
   moduleNameMapper: {

frontend/mobile/lib/__tests__/recovery.test.ts

@@ -321,7 +321,7 @@ describe('attachRecoverySignatures', () => {
 
     const unsigned = tx.toXDR();
     tx.sign(keypair);
-    const signature = tx.signatures[0]!.signature().toString('base64');
+    const signature = Buffer.from(tx.signatures[0]!.signature.toBytes()).toString('base64');
 
     return { xdr: unsigned, signerKey: keypair.publicKey(), signature };
   }