Pluggable Signing Key Vault Adapter

[Kingsman-99]

Description

The SDK currently only supports in-memory keypairs for transaction signing, which is unsuitable for production environments where private keys must reside in hardware security modules, cloud KMS services, or AES-encrypted keystores. A pluggable vault adapter interface would decouple the signing operation from key storage, enabling callers to inject any backend conforming to a narrow Signer contract without modifying SDK internals.

Technical Context

New interface Signer in src/signing/signer.ts with a single method sign(txHash: Buffer): Promise<Buffer>. Concrete adapters in src/signing/adapters/: KeypairSigner (wraps Keypair from @stellar/stellar-sdk), EncryptedFileSigner (reads an AES-256-GCM encrypted PEM file, decrypts on first use), and a CloudKmsSigner that delegates to an injected KmsClient { sign(keyId: string, digest: Buffer): Promise<Buffer> } interface. StellarSplitClient constructor options in src/client.ts accept signer: Signer.

Acceptance Criteria

• The Signer interface and all three concrete adapters are exported from the SDK's public API surface via src/index.ts
• KeypairSigner.sign produces a 64-byte ed25519 signature verifiable by Keypair.verify on the corresponding public key
• EncryptedFileSigner decrypts the key file on first use, holds the plaintext in a WeakRef to allow GC pressure to clear it, and re-reads the file on the next sign call if the ref has been collected
• CloudKmsSigner accepts any object conforming to the KmsClient interface, enabling easy test mocking without touching real KMS credentials
• Tests cover KeypairSigner round-trip signing, EncryptedFileSigner with a test-generated AES key (including the re-read-after-GC path via explicit null), and a mock CloudKmsSigner
• All CI checks (npm test, npm run build, ESLint/TypeScript) pass and the branch has no merge conflicts

---

[NoahJoseph-ux]

@NoahJoseph-ux has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello Maintainer, I’ve thoroughly read through the requirements and understand the expected outcome. I’d be happy to take this on if you can assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @NoahJoseph-ux to this issue.

[boss572]

@boss572 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello maintainer please I will like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @boss572 to this issue.

[OkeQueen]

@OkeQueen has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Good morning, Chief Maintainer,

I am an experienced software developer with a background in open-source contributions. I would like to work on this issue and contribute a clean, well-structured, and maintainable solution.

If possible, I would appreciate the opportunity to take it on. I’m ready to follow any contribution guidelines and provide timely updates.

Thank you for your consideration.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OkeQueen to this issue.

[drips-wave]

Congratulations, @boss572! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @boss572: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊