fn admin(env: soroban_sdk::Env) -> soroban_sdk::Addressfn upgrade(env: soroban_sdk::Env, wasm_hash: soroban_sdk::BytesN<32>)Initiate a two-step transfer of the admin (owner) role to new_admin.
live_until_ledger is the ledger up to which new_admin may accept_admin. Pass
current_ledger + N, where N is the acceptance window in ledgers. The standard window
for a real ownership handover is 3 days = current_ledger + 3 * DAY_IN_LEDGERS
(51_840 ledgers); the sensible range is 24h (17_280) to 7d (120_960). There is deliberately
no default — every call states its window explicitly.
A non-zero window beyond the in-contract ceiling of 7 days (MAX_ACCEPTANCE_WINDOW =
120_960 ledgers past the current ledger) panics [MoonlightError::AcceptanceWindowTooLong].
live_until_ledger == 0 is exempt from the ceiling and cancels a pending transfer (the
library requires the cancel call to name the current pending address).
fn set_admin(
env: soroban_sdk::Env,
new_admin: soroban_sdk::Address,
live_until_ledger: u32,
)fn is_provider(env: soroban_sdk::Env, provider: soroban_sdk::Address) -> boolfn __check_auth(
env: soroban_sdk::Env,
payload: soroban_sdk::BytesN<32>,
signatures: Signatures,
contexts: soroban_sdk::Vec,
) -> Result<(), MoonlightError> fn accept_admin(env: soroban_sdk::Env)Registers a provider. Only an Ed25519 account address can be registered: the provider
check in require_provider matches exclusively addresses derived from SignerKey:: Provider Ed25519 keys, so any other address kind (e.g. a contract address) would be
registered — and reported registered by is_provider — yet could never authorize
anything (RV audit B7).
NotEd25519AccountAddress if provider is a contract address.fn add_provider(env: soroban_sdk::Env, provider: soroban_sdk::Address)fn __constructor(env: soroban_sdk::Env, admin: soroban_sdk::Address)Enable an asset channel for service. Also used to RE-ENABLE a previously disabled
channel — both resume full service, so both emit ChannelStateChanged { enabled: true }.
The channel lifecycle is advisory. This function only emits
ChannelStateChanged, signalling the council's intended channel state; the
contract intentionally stores no channel/asset state, and no on-chain code path
reads the event. Enforcement lives provider-side: providers treat a disabled
channel as withdraw-only (new deposits and sends rejected, withdrawals served).
The sole on-chain way to stop a channel is a contract upgrade.
An on-chain enabled-flag with transact gating (e.g. block new deposits while
still allowing withdrawals) is deferred future work.
fn enable_channel(
env: soroban_sdk::Env,
channel: soroban_sdk::Address,
asset: soroban_sdk::Address,
)Disable an asset channel. The channel becomes withdraw-only (new deposits/sends rejected);
that enforcement lives provider-side. Emits ChannelStateChanged { enabled: false }.
The channel lifecycle is advisory. This function does NOT stop the channel
on-chain: it only emits ChannelStateChanged, signalling the council's
intended channel state. The contract intentionally stores no channel/asset
state, and transact on the privacy channel remains fully functional after this
call. Enforcement lives provider-side: providers treat a disabled channel as
withdraw-only. The sole on-chain way to stop a channel is a contract upgrade.
An on-chain enabled-flag with transact gating (e.g. block new deposits while
still allowing withdrawals) is deferred future work.
fn disable_channel(
env: soroban_sdk::Env,
channel: soroban_sdk::Address,
asset: soroban_sdk::Address,
)fn remove_provider(env: soroban_sdk::Env, provider: soroban_sdk::Address)