[JamesVictor-O]

Summary

This PR implements four assigned issues:

#503 — PR Impact Analyzer for Contract Storage Layout Changes

• GitHub Action workflow (.github/workflows/storage-impact.yml) that triggers on PRs targeting main
• scripts/storage-analyzer/extract-storage.sh — parses Soroban contract source files to extract storage variable declarations (env.storage().instance/persistent/temporary, #[contracttype] structs, storage key enums)
• scripts/storage-analyzer/compare.js — detects new/removed/reordered variables, type changes, breaking changes, and collision risks; generates markdown impact report
• scripts/storage-analyzer/analyze.sh — orchestrates extraction and comparison between base and head refs
• Fails CI on breaking storage changes requiring migration

#504 — Automated Contract ABI Extraction and Versioning

• scripts/abi-extractor/extract.sh — builds contracts and extracts ABI/metadata from compiled WASM artifacts
• scripts/abi-extractor/generate-types.js — generates TypeScript and Rust type definitions from ABI JSON
• scripts/abi-extractor/version.sh — semantic versioning with breaking change detection and changelog generation
• scripts/abi-extractor/ci-check.sh — CI integration for automated ABI validation
• packages/contract-abis/ — npm package (@stellarlend/contract-abis) with TypeScript types and barrel exports

#505 — Local Soroban Devnet with Preconfigured Test Accounts and Contracts

• docker/devnet/docker-compose.yml — full local environment (soroban-devnet, API, oracle, postgres, redis)
• docker/devnet/genesis.sh — creates 7 preconfigured accounts (admin, liquidator, user1-user5) with funds
• docker/devnet/init-devnet.sh — deploys all 16 contracts, initializes oracle feeds, seeds sample data
• docker/devnet/reset-devnet.sh — wipe and redeploy in < 2 minutes
• docker/devnet/healthcheck.sh — verifies all components are ready
• docker/devnet/seed-data/ — accounts, contracts, oracle feeds, sample positions JSON configs
• .devcontainer/devcontainer.json — VS Code Dev Container integration

#506 — Reputation System for Borrowers Based on Repayment History

• stellar-lend/contracts/reputation-system/ — on-chain Soroban contract tracking repayment history
  • ReputationScore (0-1000) with weighted factors: on-time rate (40%), repayment count (30%), no-defaults (30%)
  • Four tiers: Bronze, Silver, Gold, Platinum with increasing benefits (lower rates, higher limits, reduced collateral)
  • Score decay on inactivity, score reset on default, non-transferable
  • 22 comprehensive tests
• api/src/controllers/reputation.controller.ts — REST API handlers (getReputation, getTiers, getLeaderboard)
• api/src/routes/reputation.routes.ts — GET /api/reputation/:address, /tiers, /leaderboard
• Registered in api/src/app.ts

Test Plan

• Verify storage analyzer detects changes between two contract versions
• Verify ABI extractor generates valid TypeScript types from contract artifacts
• Run docker compose -f docker/devnet/docker-compose.yml up and confirm all services start
• Verify reputation contract compiles: cargo build -p stellarlend-reputation
• Verify reputation contract tests pass: cargo test -p stellarlend-reputation
• Verify API starts with reputation routes registered

Closes #503
Closes #504
Closes #505
Closes #506

[vercel]

@JamesVictor-O is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@JamesVictor-O Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[gitguardian]

⚠️ GitGuardian has uncovered 7 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
34253505	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret
34253506	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret
34253507	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret
34253508	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret
34253509	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret
34253510	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret
34253511	Triggered	Generic High Entropy Secret	a8e5914	docker/devnet/seed-data/accounts.json	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}