- Introduced TopAssetsResponse model for top assets highlights.
- Added Trade model to represent trade details.
- Implemented TradePagedResult model for paginated trade results.
- Created TxState enum for transaction states.
- Developed AggregatedPoolService for managing aggregated pool data.
- Added AssetService for asset management and retrieval.
- Implemented AssetStatService for fetching asset statistics.
- Created AssetTimeseriesService for 7-day asset timeseries data.
- Developed GossipService for managing gossip relay statuses.
- Added IndexerService for retrieving indexer status.
- Implemented LiquidityService for managing liquidity updates.
- Created OhlcService for handling OHLC data requests.
- Developed PoolService for managing pool data and statistics.
- Added SearchService for searching assets and pools.
- Implemented SignalRTestService for testing SignalR connections.
- Created StatsService for fetching DEX statistics.
- Added TopAssetsService for retrieving top assets data.
- Implemented TradeService for managing trade data retrieval.

The real logic is already covered by the old tests we migrated

Adds @algorandfoundation/provider-migrations, a storage-agnostic engine that
lets packages ship a versioned, tracked, idempotent migration alongside a
breaking change instead of hand-rolling a startup fix-up pass.

WithMigrations is placed first in the extensions array, so provider.migrations
exists for every later extension, and the run is scheduled as a microtask so
the registry is complete before the first revision executes. Opted-in packages
import only `type { Migration }` and carry no runtime dependency on the engine.

- Storage-agnostic: each module declares its own opaque context type, so
  IndexedDB, MMKV and a sealed file all work without a shared interface.
- Ledger written per revision, never batched, so a killed run resumes exactly
  where it stopped.
- Forward-only and always from revision zero; migrations tolerate empty data.
- Per-module failure isolation: a failing revision halts only its own module,
  other modules still run, then `ready` rejects with an aggregate error.
- A ledger ahead of the installed code is reported and warned about, not
  thrown, since bricking an app on a downgrade is worse.
- Run-scoped SecretScratch for key material in flight: bytes only, zeroed in a
  finally, use-after-wipe throws, non-serializable. Hook payloads carry
  { module, revision } only.

react-native-keystore is the first adopter, with migrateLegacyPasskeys tracked
as revision 0001, and the react-native example wallet is wired up.

BREAKING CHANGE: legacy passkey flagging no longer runs automatically on engine
start. It is now revision 0001 of the package's migration manifest and requires
WithMigrations from @algorandfoundation/provider-migrations to be installed on
the provider. Applications that do not add it will never flag legacy passkeys.

AUDIT_READINESS.md:172 points an auditor at `sdk/ci/ci.yml` as the repo's CI
definition. That file does not exist:

  git ls-files sdk/ci/  ->  release.yml, verify_pinned_digest.py

scripts/verify_all.sh:10 makes the same reference, claiming to "mirror the
sdk/ci/ci.yml signature-kat job recipe EXACTLY". Both now point at
.github/workflows/ci.yml, which is the file that actually runs. An auditor
following the readiness doc hits a 404 on its first CI citation.

sdk/ci/release.yml is deleted. GitHub Actions only executes YAML under
.github/workflows/, so it never ran, and it had drifted into being the WORSE
copy: ad20b42 SHA-pinned every action in the live workflow while this one kept
floating tags -

  actions/checkout@v5                vs  @fbc6f39... # v5.0.1
  actions/setup-python@v6            vs  @ece7cb0... # v6.0.0
  actions/upload-artifact@v4         vs  @ea165f8... # v4.6.2
  actions/download-artifact@v4       vs  @d3f86a1... # v4.3.0
  sigstore/cosign-installer@v4.1.0   vs  @ba7bc0a... # v4.1.0
  softprops/action-gh-release@v2.6.2 vs  @3bb1273... # v2.6.2

19 differing lines, all pins. An inert file is harmless right until someone
copies it back - and this is the release workflow, the one that signs
artifacts and publishes them.

Also gitignores .venv-contracts/, the local virtualenv the contract suite
needs. It was untracked and unignored, which is how a `git add -A` in this
directory sweeps 1757 site-packages files into a commit.

Nothing references the deleted file; verify_all.sh still parses (bash -n).

Found by an adversarial claim-vs-enforcement sweep (TCE-15).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The contract suite has never run in CI. It is the only thing that exercises
inscription.py at all - falcon_verify on-chain, the C1 ownership conjunction,
write-once, cross-cell replay, the update_owner guards - and the only record
that it passed was a hand-run note in LOCALNET_VALIDATION_2026-06-01.md, dated
two weeks BEFORE 2ec798e changed the contract.

So the flagship's on-chain logic has had no automated coverage of any kind,
and the drift in 2ec798e went unnoticed partly for that reason.

It was never wired up because it needs three things at once:

  1. a LocalNet (algod on :4001)   - without it: 22x urllib.error.URLError
  2. the Falcon C library          - without it: 19x "Could not load Falcon
                                     shared library at './libfalcondet1024.so'"
  3. the committed typed client    - already in the repo

Both failure modes above were reproduced locally before writing this job, so
the recipe is derived from what actually breaks, not from guesswork. The
pinned compile venv (puyapy) is deliberately NOT needed: these tests deploy
the committed client, they do not rebuild the contract.

The library is built from the pinned tarball behind the same digest + FPEMU
gate signature-kat uses. These tests produce REAL det1024 signatures that the
AVM's falcon_verify opcode must accept, so the signer has to be the pinned
build for exactly the reason that job states.

Two guards, both from failures seen elsewhere in this workflow:

  * LocalNet health is polled before the suite runs. A half-started sandbox
    fails with connection errors that read like test failures, destroying the
    signal this job exists to provide.
  * The run asserts 20+ tests actually EXECUTED. pytest exits 5 on "no tests
    collected", but a suite that silently shrank to a handful still exits 0 -
    and "green meaning nothing ran" is the precise defect this job is here to
    end.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Reject unexpected word counts before decode so a Pera Universal
Wallet 24-word phrase gets an actionable error instead of the
generic failed-to-decode message.

Fixes #1064

C1 is a conjunction - inscribe requires that the sender (a) currently holds
the Cell ASA AND (b) is the controlling owner recorded at mint - but only (b)
had coverage.

test_flash_custody_rejected builds a holder who is not the owner. Every other
test mints with mint_cell(algorand, admin, admin), so the sender is always
both, and mint_cell's transfer branch is itself dead. The state in which
`assert exists and balance == UInt64(1)` is the DECIDING assert - recorded
owner, no longer holding - was never constructed.

It is not a hypothetical. update_owner is a separate, voluntary call, so a
seller who transfers the Cell ASA on a secondary market stays the recorded
controlling owner until someone calls it. Without (a) that seller can inscribe
the buyer's cell; C2 makes inscription write-once and update_owner is blocked
afterwards, so the buyer's cell is PERMANENTLY consumed with the seller's
artifact. That is the exact inverse of the flash-custody vector the suite does
cover.

The test also asserts WHICH conjunct fired. A bare pytest.raises(Exception) -
the pattern every other negative test here uses - would pass if the rejection
came from (b) or from anything unrelated, leaving (a) untested while looking
covered.

MUTATION PROOF, end to end rather than by inspection:
  - deleted the C1(a) assert from inscription.py
  - recompiled with the pinned puyapy 5.8.1 and regenerated the typed client
  - confirmed the string is gone from the TEAL and the client
  - ran the suite against a LocalNet deployment of the mutated contract

    1 failed, 22 passed
    test_recorded_owner_who_no_longer_holds_is_rejected: DID NOT RAISE

The 22 pre-existing tests stayed green, exactly as predicted, and the failure
mode is the vulnerability itself: the inscribe SUCCEEDED. Restored and
re-verified: 23 passed.

Reproducing this needs LocalNet, a built Falcon library, and the pinned
compile venv; see the PR for the build notes.

Found by an adversarial claim-vs-enforcement sweep (TCE-14).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>