fn owner(env: soroban_sdk::Env) -> soroban_sdk::AddressOwner revocation (immediate).
fn revoke_key(
env: soroban_sdk::Env,
key_hash: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>fn get_pending(
env: soroban_sdk::Env,
key_hash: soroban_sdk::BytesN<32>,
) -> OptionOperator path: stage a key for activation after the delay. Proposing
an already-active key just refreshes its TTLs via activate_key
being unnecessary — the proposal is recorded regardless so the
rotation worker's flow stays simple.
fn propose_key(
env: soroban_sdk::Env,
kid: soroban_sdk::String,
pubkey_limbs: soroban_sdk::Vec>,
) -> Result, soroban_sdk::Error> Permissionless: once the delay has elapsed, anyone may flip the pending key active. The delay — not the caller — is the control.
fn activate_key(
env: soroban_sdk::Env,
key_hash: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>fn get_operator(env: soroban_sdk::Env) -> Optionfn is_valid_key(
env: soroban_sdk::Env,
pubkey_limbs: soroban_sdk::Vec>,
) -> Result Owner-only immediate registration. This is the emergency path and it sits behind the owner's full signature threshold by design.
fn register_key(
env: soroban_sdk::Env,
kid: soroban_sdk::String,
pubkey_limbs: soroban_sdk::Vec>,
) -> Result, soroban_sdk::Error> fn set_operator(env: soroban_sdk::Env, operator: soroban_sdk::Address)fn __constructor(
env: soroban_sdk::Env,
owner: soroban_sdk::Address,
activation_delay_secs: u64,
) -> Result<(), soroban_sdk::Error>fn pending_owner(env: soroban_sdk::Env) -> OptionStep 1 of a two-step ownership handover: the current owner nominates a
successor. Nothing changes until the nominee calls accept_ownership,
so a fat-fingered or uncontrolled address can never brick the registry
— the trust root for every campaign. Re-proposing overwrites the
pending nominee; the owner can abort via cancel_ownership_transfer.
fn propose_owner(env: soroban_sdk::Env, new_owner: soroban_sdk::Address)Owner veto for the monitoring window.
fn cancel_pending(
env: soroban_sdk::Env,
key_hash: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>fn get_pending_at(
env: soroban_sdk::Env,
index: u32,
) -> Result, soroban_sdk::Error> Step 2: the nominated successor accepts, proving it controls the address. Only then does ownership actually move.
fn accept_ownership(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>fn compute_key_hash(
env: soroban_sdk::Env,
pubkey_limbs: soroban_sdk::Vec>,
) -> Result, soroban_sdk::Error> fn get_pending_count(env: soroban_sdk::Env) -> u32fn is_kid_registered(env: soroban_sdk::Env, kid: soroban_sdk::String) -> boolfn is_valid_key_hash(env: soroban_sdk::Env, key_hash: soroban_sdk::BytesN<32>) -> boolfn get_registered_key(
env: soroban_sdk::Env,
index: u32,
) -> Result, soroban_sdk::Error> Operator revocation (immediate). Fail-safe direction: the hot key can only ever disable keys, never enable them ahead of the delay.
Bounded by MIN_ACTIVE_KEYS: "fail-safe" only holds while at least a
working keyset survives. Revoking the last keys is not a safe
direction, it is a protocol-wide claim outage, so the operator is
stopped at the floor and the owner multisig must take over.
fn operator_revoke_key(
env: soroban_sdk::Env,
key_hash: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>fn get_activation_delay(env: soroban_sdk::Env) -> u64Number of enumerated keys currently valid. Backs the MIN_ACTIVE_KEYS
floor and lets the rotation worker read the same number the contract
enforces instead of recomputing it from get_registered_key*.
fn get_active_key_count(env: soroban_sdk::Env) -> u32fn get_registered_key_count(env: soroban_sdk::Env) -> u32The current owner aborts a pending handover before it is accepted.
fn cancel_ownership_transfer(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>