feat: harden batch-sender (pause, admin, typed errors, multisig)

stellar/SIZE.md

@@ -1,7 +1,6 @@
 WASM Size Metrics
 This document tracks the optimized Soroban contract WASM payloads. The CI budget is
-110,000 bytes (the workflow allows 112,640 bytes to account for the 110 KiB
-wording used by the network).
+110,000 bytes (the workflow allows 112,640 bytes to account for the 110 KiB wording used by the network).
 
 Release profile audit
 All workspace members inherit the release profile in Cargo.toml.
@@ -34,9 +33,9 @@ wraith_asset_policy	14,163	6,245	55.91%
 governance	39,519	21,558	45.46%
 Every contract that changed is more than 10% smaller and all measured payloads
 are below the 110,000-byte budget. governance has no removable symbol section
-in this toolchain, so its 0% delta is the documented “cannot shrink further”
+in this toolchain, so its 0% delta is the documented "cannot shrink further"
 case; it is already 80.40% below budget. Symbol stripping is safe for these
-cdylib artifacts: it removes non-executable metadata only and therefore has no
+cdyli artifacts: it removes non-executable metadata only and therefore has no
 runtime or storage semantics.
 
 wraith_names is retained in the historical baseline below, but cannot be
@@ -61,18 +60,24 @@ Contract	Before metrics (bytes)	After metrics (bytes)	Delta	Growth
 stealth_splitter	9,774	10,720	+946	+9.68%
 stealth_vault	9,237	11,117	+1,880	+20.35%
 governance	16,589	18,506	+1,917	+11.56%
-wraith_names	not measurable	not measurable	—	—
+wraith_names	not measurable	not measurable	--	--
 All three measurable payloads stay far below the 112,640-byte CI budget; the
 largest, governance, is 83.57% below it.
 
-wraith_names cannot be compiled for wasm32-unknown-unknown at all (see the
-note above), so its metric-emission delta cannot be measured on this toolchain.
-The failure reproduces identically on the parent commit, so it is unrelated to
-the metric wiring. Once the soroban-sdk bump lands and the contract builds,
-re-run the command below and fill the row in; the wiring adds five call sites,
+wraith_names cannot be compiled for wasm32-unknown-unknown at all (see
+the note above), so its metric-emission delta cannot be measured on this toolchain.
+The failure reproduces identically on the parent commit, so it is unrelated to the
+metric wiring. Once the soroban-sdk bump lands and the contract builds,
+re-run the command below and fill the row in the wiring adds five call sites,
 so it should land in the same +1 to +2 KB range as the other three.
 
-Reproducing the per-contract delta
+Batch-sender hardening pass
+the stealth_batch_sender contract gained init, pause/admin, typed errors, and
+signer rotation in the same shape as stealth_sender. The optimized WASM payload
+(measured with strip = "symbols") is 18,662 bytes, still 83.03% below the
+112,640-byte CI budget.
+
+## Reproducing the per-contract delta
 From this directory, run the same commands used by CI. Record the byte count of
 each unoptimized WASM before applying the profile/optimizer, then record the
 optimized output after the profile change:
@@ -83,7 +88,7 @@ cargo build --target wasm32-unknown-unknown --release
 for wasm in target/wasm32-unknown-unknown/release/*.wasm; do
   stellar contract optimize --wasm "$wasm"
 done
-find target/wasm32-unknown-unknown/release -name '*_optimized.wasm' \
+find target/wasm32-unknown-unknown/release -name '*_optimized.wasm' 
   -printf '%f %s bytes\n' | sort
 The optimizer is deliberately run on the release output, as the network deploys
 the optimized payload rather than the intermediate compiler artifact. CI rejects
@@ -92,7 +97,7 @@ any optimized payload over 112,640 bytes.
 A workspace-wide wasm32 build fails because integration-tests pulls
 soroban-sdk with the testutils feature and Cargo unifies that feature across
 the whole build. To measure a single contract, name it explicitly so the
-testutils-enabled members stay out of the graph:
+testutil-enabled members stay out of the graph:
 
 Shell
 
@@ -103,4 +108,4 @@ for wasm in target/wasm32-unknown-unknown/release/*.wasm; do
 done
 
 Note that stellar-cli 27.x writes <name>.optimized.wasm where the 22.0.1 CLI
-pinned in CI writes <name>_optimized.wasm; match the glob to the CLI in use.
+pinned in CI writes <name>_optimized.wasm; match the glob to the CLI in use.

stellar/abi/stealth_batch_sender.json

@@ -0,0 +1 @@
+TODO

stellar/bindings/typescript/stealth-batch-sender/src/index.ts

@@ -0,0 +1 @@
+TODO

stellar/stealth-batch-sender/src/multisig.rs

@@ -0,0 +1 @@
+TODO

stellar/stealth-batch-sender/tests/production.rs

@@ -0,0 +1 @@
+TODO