[Izebby]

Summary

Adds four read-only inspection commands covering SEP-5 derivation paths, SEP-17 metadata (unpublished spec), Soroban argument structure, and Horizon/Soroban RPC authentication configuration.

Command	Issue	Notes
sep5-derivation-audit	Closes #190	SEP-5 real spec. Validates BIP-44 path syntax; optional wallet-profile comparison. Never derives, requests, or echoes key material.
sep17-metadata-inspect	Closes #191	SEP-17 has no published schema. Always emits SEP17_UNPUBLISHED_SPEC (inconclusive) and redirects to SEP-1 / SEP-41.
soroban-arg-audit	Closes #192	Complements (does not duplicate) soroban-arg-validator and simulate-tx. Reports nested ScVal structure only.
auth-config-audit	Closes #193	Reads env vars, validates URL syntax, detects embedded credentials, reports source conflicts. Never makes a network request or echoes secret values.

Closes #193
Closes #192
Closes #191
Closes #190

---

Files

New (17):

• src/services/sep5-derivation-path-audit.ts
• src/services/sep17-metadata-audit.ts
• src/services/soroban-arg-flow-audit.ts
• src/services/auth-config-audit.ts
• src/output/sep5-derivation-path-audit-report.ts
• src/output/sep17-metadata-audit-report.ts
• src/output/soroban-arg-flow-audit-report.ts
• src/output/auth-config-audit-report.ts
• src/cli/commands/sep-compliance-3.ts
• tests/sep5-derivation-path-audit.test.ts
• tests/sep17-metadata-audit.test.ts
• tests/soroban-arg-flow-audit.test.ts
• tests/auth-config-audit.test.ts
• docs/sep5-derivation-path-audit.md
• docs/sep17-metadata-audit.md
• docs/soroban-arg-flow-audit.md
• docs/auth-config-audit.md

Modified (1):

• src/cli/index.ts — 2-line addition (import + registerSepCompliance3Commands(program)).

---

Design decisions worth highlighting

1. SEP-5 derivation audit — no key material processed

The service operates only on the supplied path STRING. It emits NO_KEY_MATERIAL_PROCESSED (info) on every run to make this explicit, and the test suite asserts that the serialized output contains no private_key, mnemonic, seed phrase, or secret substrings.

Wallet compatibility is always reported as WALLET_COMPATIBILITY_NOT_VERIFIED (inconclusive) — a valid path does not prove that any wallet can derive or access a specific account.

2. SEP-17 — same pattern as SEP-3, SEP-11, SEP-13, SEP-14

SEP-17 has no published schema. The command exists, runs, performs structural sanity, and emits a top-level SEP17_UNPUBLISHED_SPEC inconclusive finding on every invocation. It redirects users to the two actual specs that cover the intent:

• SEP-1 stellar.toml [[CURRENCIES]] → asset-metadata-audit
• SEP-41 Soroban token interface → contract-spec-audit

ASSET_AUTHENTICITY_NOT_VERIFIED is always emitted as inconclusive. The test suite asserts the output does not contain "compliant":true, "trustworthy":true, or "authorized":true.

3. Soroban arg-flow audit — explicit non-duplication

The service does not re-implement any of soroban-arg-validator's logic (type checks, missing/extra argument findings, encoding failures). It reports nested ScVal structure only and emits TYPE_VALIDATION_DELEGATED (inconclusive) on every run to make the delegation explicit. The docs and the PR description both spell out the delegation boundary.

Only one RPC call is made (via contract-spec-audit → getLedgerEntries), and only when --contract-id + --function-name are supplied.

4. Auth config audit — no network, no credential echo

The service reads env vars (default process.env) and optional CLI overrides. It never calls fetch. Embedded URL credentials are detected via new URL(...).username/.password and only their PRESENCE is reported; the values are never included in any finding, and the test suite asserts the raw values don't appear in the serialized output.

Under --policy production (the default), HTTP endpoints and embedded credentials are error. Under --policy development, they are warning. A missing credential is never treated as a misconfiguration — many Horizon and Soroban RPC deployments are public. AUTH_REQUIREMENT_UNKNOWN is always emitted as inconclusive.

---

Testing

npm run typecheck
npm run lint
npm test
npm run build

[drips-wave]

@Izebby Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits