feat(wallet): add keycard support for public tx for auth-transfer (#451)

* feat: add basic commands for communicating with keycard

* initialize changes

* reorganization

* add script file for easier wallet access

* update commands

* fixes

* fixed load for non continuous run

* Updates for signatures with keycard

* fix BIP-340 signatures for fixed sized messages

* fmt

* refactor and add pin support to program facades

* fix unit test

* fixes

* Revert "fixes"

This reverts commit 41f34f4ff4.

* fixes

* fixes

* Removed privacy keycard calls

* Revert "Removed privacy keycard calls"

This reverts commit d70ef505a1.

* Add domain separators

* Removed privacy txs for keycard

* CI fixes

* CI fixes

* addressed some comments

* fix ci

* ci fixes

* fix integration test issue and updated keycard firmware

* addressed more comments

* fixed deny

* remove keycard-py

* fixed from earlier merge

* add hash_message tests

* add test

* fix deny

* CI fixes

* fixed integration tests

* Update public.rs

* update artifacts

* ci and comments

* addressed comments

* comment fixes

* fixes from merging main

* first round of comments

* Revert "Merge branch 'main' into marvin/keycard-commands"

This reverts commit 3fce53f663, reversing
changes made to e7b42a5177.

* python comments

* addressed comments

* compile error fixed

* fix artifacts

* fix main merge error

* adjust signer logic workflow

* fmt

* merge main and shift keycard tests

* deny fix

* artifacts fix

* remove keycard scripts from root

* tps fix

* fmt

integration_tests/tests/tps.rs

@@ -11,7 +11,7 @@
 
 use std::time::{Duration, Instant};
 
-use anyhow::Result;
+use anyhow::{Context as _, Result};
 use bytesize::ByteSize;
 use common::transaction::NSSATransaction;
 use integration_tests::{TestContext, config::SequencerPartialConfig};
@@ -66,7 +66,64 @@ impl TpsTestManager {
         Duration::from_secs_f64(number_transactions as f64 / self.target_tps as f64)
     }
 
+    /// Claim funds from each account's vault PDA into the account itself.
+    ///
+    /// `GenesisAction::SupplyAccount` funds vault PDAs (not accounts directly), so this step is
+    /// required before sending `authenticated_transfer` transactions from these accounts.
+    /// All claim transactions are submitted at once and then confirmed sequentially.
+    /// After this call every account has nonce 1, so `build_public_txs` must be called after it.
+    pub async fn claim_vault_funds(
+        &self,
+        sequencer_client: &sequencer_service_rpc::SequencerClient,
+    ) -> Result<()> {
+        let vault_program_id = Program::vault().id();
+
+        let mut tx_hashes = Vec::with_capacity(self.public_keypairs.len());
+        for (private_key, account_id) in &self.public_keypairs {
+            let owner_vault_id =
+                vault_core::compute_vault_account_id(vault_program_id, *account_id);
+            let message = putx::Message::try_new(
+                vault_program_id,
+                vec![*account_id, owner_vault_id],
+                vec![Nonce(0_u128)],
+                vault_core::Instruction::Claim { amount: 10 },
+            )
+            .context("Failed to build vault claim message")?;
+            let witness_set =
+                nssa::public_transaction::WitnessSet::for_message(&message, &[private_key]);
+            let tx = PublicTransaction::new(message, witness_set);
+            let hash = sequencer_client
+                .send_transaction(NSSATransaction::Public(tx))
+                .await
+                .context("Failed to submit vault claim")?;
+            tx_hashes.push(hash);
+        }
+
+        let deadline = Instant::now() + Duration::from_secs(300);
+        for (i, tx_hash) in tx_hashes.iter().enumerate() {
+            loop {
+                anyhow::ensure!(
+                    Instant::now() < deadline,
+                    "Vault claims timed out after 5 minutes ({i}/{} confirmed)",
+                    tx_hashes.len()
+                );
+                let found = sequencer_client
+                    .get_transaction(*tx_hash)
+                    .await
+                    .ok()
+                    .flatten()
+                    .is_some();
+                if found {
+                    break;
+                }
+            }
+        }
+        Ok(())
+    }
+
     /// Build a batch of public transactions to submit to the node.
+    ///
+    /// Must be called after `claim_vault_funds`, which sets each account's nonce to 1.
     pub fn build_public_txs(&self) -> Vec<PublicTransaction> {
         // Create valid public transactions
         let program = Program::authenticated_transfer_program();
@@ -78,7 +135,7 @@ impl TpsTestManager {
                 let message = putx::Message::try_new(
                     program.id(),
                     [pair[0].1, pair[1].1].to_vec(),
-                    [Nonce(0_u128)].to_vec(),
+                    [Nonce(1_u128)].to_vec(),
                     authenticated_transfer_core::Instruction::Transfer { amount },
                 )
                 .unwrap();
@@ -127,6 +184,12 @@ pub async fn tps_test() -> Result<()> {
         .build()
         .await?;
 
+    // Genesis funds vault PDAs, not accounts directly. Claim into accounts before measuring.
+    tps_test
+        .claim_vault_funds(ctx.sequencer_client())
+        .await
+        .context("Failed to claim vault funds for TPS accounts")?;
+
     let target_time = tps_test.target_time();
     info!(
         "TPS test begin. Target time is {target_time:?} for {num_transactions} transactions ({target_tps} TPS)"