Add inspectAuthEntry and checkAuthEntryReadiness for decoding Soroban auth entries

[Ryang-21]

What

Adds a read-side decoding API for Soroban authorization entries in src/base/auth.ts, the complement to the existing authorizeEntry/authorizeInvocation write path:

• inspectAuthEntry(entry) decodes a xdr.SorobanAuthorizationEntry into a typed AuthEntryInfo: the credential type (sourceAccount / address / addressV2 / addressWithDelegates), authorizing address, nonce, signatureExpirationLedger, the invocation tree, and a signers list covering the top-level credentials plus any CAP-71 delegates, depth-first. Each AuthEntrySigner reports its address, whether a signature payload is present, the parsed {publicKey, signature} pairs when the payload uses the SDK's standard ed25519 vec-of-maps format, and the raw ScVal otherwise — so signer-defined payloads from custom accounts (e.g. WebAuthn/passkey wallets) remain accessible even though they can't be structurally parsed or verified client-side.
• checkAuthEntryReadiness(entry, currentLedgerSeq) answers "is this ready to submit?", returning { ready, expired, unsignedBy }. Expiration is compared exclusively against a caller-supplied current ledger sequence rather than fetched internally, keeping the function a pure decode with no network dependency (and leaving the choice of a trusted ledger source to the caller). Source-account entries are always ready, since they're covered by the transaction envelope signature.

AssembledTransaction.needsNonInvokerSigningBy is rewired onto the new decoder, which also fixes a latent inconsistency: an empty scvVec signature — the exact placeholder authorizeInvocation writes on unsigned entries — was treated as signed (only scvVoid counted as unsigned), so such entries were wrongly omitted from the needs-to-sign list. A regression test covers this, alongside new unit tests for both functions across all four credential variants, nested delegates, and non-standard signature payloads.

Why

Smart-account authorization entries are opaque XDR today: an app receiving one (from simulation, or from a counterparty in a multi-party signing flow) can't tell which signers it requires, whether it's already signed, or when it expires without reaching into raw XDR union accessors. That's exactly what an agent operating under scoped, time-limited, revocable authority needs to reason about before submitting. The SDK already had all the pieces internally — getAddressCredentials, delegate-node traversal, the ed25519 signature map format — but only on the write path or as private helpers; this exposes them as a small, typed, public read API.

Closes #1468

[Copilot]

Pull request overview

Adds public APIs for inspecting Soroban authorization entries and evaluating submission readiness.

Changes:

• Adds typed auth-entry decoding and readiness checks.
• Reuses decoding in AssembledTransaction.
• Adds tests, generated reference documentation, and changelog entries.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/base/auth.ts	Implements inspection and readiness APIs.
src/base/index.ts	Exports the new APIs and types.
src/contract/assembled_transaction.ts	Integrates auth inspection with signing detection.
test/unit/base/auth.test.ts	Tests credential variants, delegates, and readiness.
test/unit/server/soroban/assembled_transaction.test.ts	Tests empty-signature detection.
docs/reference/core-soroban-primitives.md	Documents the new public APIs.
docs/reference/contracts-client.md	Updates generated source references.
CHANGELOG.md	Records the additions and signing fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.