@caatinga/core 0.2.1 → 0.2.2

package/dist/index.cjs

@@ -63,6 +63,7 @@ __export(index_exports, {
   runCommand: () => runCommand,
   toCaatingaError: () => toCaatingaError,
   updateArtifact: () => updateArtifact,
+  validateSourceShape: () => validateSourceShape,
   writeArtifacts: () => writeArtifacts
 });
 module.exports = __toCommonJS(index_exports);
@@ -92,6 +93,7 @@ var CaatingaErrorCode = {
   CONTRACT_DEPENDENCY_NOT_FOUND: "CAATINGA_CONTRACT_DEPENDENCY_NOT_FOUND",
   CONTRACT_DEPENDENCY_CYCLE: "CAATINGA_CONTRACT_DEPENDENCY_CYCLE",
   CONTRACT_DEPENDENCY_ARTIFACT_NOT_FOUND: "CAATINGA_CONTRACT_DEPENDENCY_ARTIFACT_NOT_FOUND",
+  DEPENDENCY_CONTRACT_NOT_FOUND: "CAATINGA_DEPENDENCY_CONTRACT_NOT_FOUND",
   DEPLOY_ARG_PLACEHOLDER_INVALID: "CAATINGA_DEPLOY_ARG_PLACEHOLDER_INVALID",
   DEPLOY_ARG_PLACEHOLDER_UNRESOLVED: "CAATINGA_DEPLOY_ARG_PLACEHOLDER_UNRESOLVED",
   BINDING_CLIENT_NOT_FOUND: "CAATINGA_BINDING_CLIENT_NOT_FOUND",
@@ -102,13 +104,18 @@ var CaatingaErrorCode = {
   XDR_SUBMIT_FAILED: "CAATINGA_XDR_SUBMIT_FAILED",
   XDR_RESULT_FAILED: "CAATINGA_XDR_RESULT_FAILED",
   WALLET_NOT_CONNECTED: "CAATINGA_WALLET_NOT_CONNECTED",
+  WALLET_TIMEOUT: "CAATINGA_WALLET_TIMEOUT",
   SOURCE_ACCOUNT_REQUIRED: "CAATINGA_SOURCE_ACCOUNT_REQUIRED",
+  SOURCE_IS_SECRET_KEY: "CAATINGA_SOURCE_IS_SECRET_KEY",
+  SOURCE_IS_SEED_PHRASE: "CAATINGA_SOURCE_IS_SEED_PHRASE",
+  SOURCE_IS_PUBLIC_KEY: "CAATINGA_SOURCE_IS_PUBLIC_KEY",
   UNSAFE_SOURCE_ACCOUNT: "CAATINGA_UNSAFE_SOURCE_ACCOUNT",
   INVOKE_TARGET_INVALID: "CAATINGA_INVOKE_TARGET_INVALID",
   TEMPLATE_NOT_FOUND: "CAATINGA_TEMPLATE_NOT_FOUND",
   INVALID_TEMPLATE_MANIFEST: "CAATINGA_INVALID_TEMPLATE_MANIFEST",
   TEMPLATE_MANIFEST_NOT_FOUND: "CAATINGA_TEMPLATE_MANIFEST_NOT_FOUND",
-  TEMPLATE_INCOMPATIBLE: "CAATINGA_TEMPLATE_INCOMPATIBLE"
+  TEMPLATE_INCOMPATIBLE: "CAATINGA_TEMPLATE_INCOMPATIBLE",
+  DOCTOR_PARTIAL_DEPLOY: "CAATINGA_DOCTOR_PARTIAL_DEPLOY"
 };
 
 // src/errors/CaatingaError.ts
@@ -135,7 +142,7 @@ function toCaatingaError(error) {
 }
 
 // src/version.ts
-var CAATINGA_CORE_VERSION = "0.2.1";
+var CAATINGA_CORE_VERSION = "0.2.2";
 
 // src/config/config.schema.ts
 var import_zod = require("zod");
@@ -323,7 +330,7 @@ var import_execa = require("execa");
 
 // src/stellar-cli/version.ts
 var import_semver = __toESM(require("semver"), 1);
-var STELLAR_CLI_MIN_VERSION = "22.0.0";
+var STELLAR_CLI_MIN_VERSION = "23.0.0";
 var STELLAR_CLI_TESTED_MAX_VERSION = "25.2.0";
 var STELLAR_CLI_SEMVER_REGEX = /\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?)\b/;
 function parseStellarCliVersion(output) {
@@ -456,6 +463,146 @@ function parseContractId(output) {
   return match[0];
 }
 
+// src/stellar-cli/build-stellar-network-args.ts
+function matchesWellKnownNetwork(name, config) {
+  const known = WELL_KNOWN_NETWORKS[name];
+  if (!known) {
+    return false;
+  }
+  return known.rpcUrl === config.rpcUrl && known.networkPassphrase === config.networkPassphrase;
+}
+function buildRpcNetworkArgs(config) {
+  return [
+    "--rpc-url",
+    config.rpcUrl,
+    "--network-passphrase",
+    config.networkPassphrase
+  ];
+}
+function buildStellarNetworkArgsFromConfig(config) {
+  for (const [name, known] of Object.entries(WELL_KNOWN_NETWORKS)) {
+    if (known.rpcUrl === config.rpcUrl && known.networkPassphrase === config.networkPassphrase) {
+      return ["--network", name];
+    }
+  }
+  return buildRpcNetworkArgs(config);
+}
+function buildStellarNetworkArgs(network) {
+  if (matchesWellKnownNetwork(network.name, network.config)) {
+    return ["--network", network.name];
+  }
+  return buildStellarNetworkArgsFromConfig(network.config);
+}
+
+// src/stellar-cli/recover-deploy-contract-id.ts
+var TX_HASH_REGEX = /Transaction hash is ([a-f0-9]{64})/i;
+var DEPLOY_SIGNING_FAILURE_REGEX = /xdr processing error: xdr value invalid/i;
+var HORIZON_URL_BY_PASSPHRASE = {
+  "Test SDF Network ; September 2015": "https://horizon-testnet.stellar.org",
+  "Public Global Stellar Network ; September 2015": "https://horizon.stellar.org"
+};
+function isLikelyPublicKeySource(source) {
+  return /^G[A-Z2-7]{55}$/.test(source);
+}
+function decimalSaltToHex(salt) {
+  return BigInt(salt).toString(16).padStart(64, "0");
+}
+function resolveHorizonUrl(network) {
+  const horizonUrl = HORIZON_URL_BY_PASSPHRASE[network.networkPassphrase];
+  if (!horizonUrl) {
+    throw new CaatingaError(
+      `No Horizon URL mapping for network passphrase "${network.networkPassphrase}".`,
+      CaatingaErrorCode.NETWORK_NOT_FOUND,
+      "Use testnet or mainnet, or extend Caatinga network metadata."
+    );
+  }
+  return horizonUrl;
+}
+async function fetchCreateContractSalt(horizonUrl, transactionHash, fetchImpl = fetch) {
+  const response = await fetchImpl(`${horizonUrl}/transactions/${transactionHash}/operations`);
+  if (!response.ok) {
+    return null;
+  }
+  const body = await response.json();
+  const operation = body._embedded?.records?.find(
+    (record) => record.transaction_successful === true && record.type === "invoke_host_function" && record.function === "HostFunctionTypeHostFunctionTypeCreateContract" && typeof record.salt === "string"
+  );
+  return operation?.salt ?? null;
+}
+async function resolveContractIdFromDeploySalt(options) {
+  const saltHex = decimalSaltToHex(options.salt);
+  const result = await runCommand("stellar", [
+    "contract",
+    "id",
+    "wasm",
+    "--salt",
+    saltHex,
+    "--source-account",
+    options.source,
+    ...buildStellarNetworkArgsFromConfig(options.network)
+  ], {
+    cwd: options.cwd,
+    allowUntestedStellarCli: options.allowUntestedStellarCli,
+    skipStellarVersionCheck: true
+  });
+  return parseContractId(result.all || `${result.stdout}
+${result.stderr}`);
+}
+async function tryRecoverContractIdFromDeployFailure(options) {
+  if (!DEPLOY_SIGNING_FAILURE_REGEX.test(options.output)) {
+    return null;
+  }
+  const hashMatch = options.output.match(TX_HASH_REGEX);
+  if (!hashMatch) {
+    return null;
+  }
+  const horizonUrl = resolveHorizonUrl(options.network);
+  const salt = await fetchCreateContractSalt(horizonUrl, hashMatch[1], options.fetchImpl);
+  if (!salt) {
+    return null;
+  }
+  return resolveContractIdFromDeploySalt({
+    salt,
+    source: options.source,
+    network: options.network,
+    cwd: options.cwd,
+    allowUntestedStellarCli: options.allowUntestedStellarCli
+  });
+}
+
+// src/contracts/validate-source-shape.ts
+function validateSourceShape(source) {
+  if (source.startsWith("S")) {
+    return new CaatingaError(
+      "Refusing to accept a Stellar secret key as --source.",
+      CaatingaErrorCode.SOURCE_IS_SECRET_KEY,
+      "Use a Stellar CLI identity alias instead, for example: --source alice"
+    );
+  }
+  if (source.trim().includes(" ")) {
+    return new CaatingaError(
+      "Refusing to accept a seed phrase as --source.",
+      CaatingaErrorCode.SOURCE_IS_SEED_PHRASE,
+      "Use a Stellar CLI identity alias instead, for example: --source alice"
+    );
+  }
+  if (isLikelyPublicKeySource(source)) {
+    return new CaatingaError(
+      `Public account address cannot sign transactions: ${source}`,
+      CaatingaErrorCode.SOURCE_IS_PUBLIC_KEY,
+      "Use a Stellar CLI identity with a secret key. Example: stellar keys generate alice --fund --network testnet, then --source alice"
+    );
+  }
+  if (source.startsWith("G")) {
+    return new CaatingaError(
+      "Refusing to accept a public account address as --source.",
+      CaatingaErrorCode.UNSAFE_SOURCE_ACCOUNT,
+      "Use a Stellar CLI identity alias, not a public address. Example: --source alice"
+    );
+  }
+  return void 0;
+}
+
 // src/contracts/resolve-contract.ts
 var import_node_path4 = __toESM(require("path"), 1);
 function resolveContract(config, contractName, cwd = process.cwd()) {
@@ -478,24 +625,98 @@ function resolveContract(config, contractName, cwd = process.cwd()) {
 // src/contracts/wasm.ts
 var import_node_crypto = require("crypto");
 var import_promises4 = require("fs/promises");
-async function assertWasmExists(wasmPath) {
+var import_node_path5 = __toESM(require("path"), 1);
+var LEGACY_RUST_WASM_TARGET = "wasm32-unknown-unknown";
+var CURRENT_RUST_WASM_TARGET = "wasm32v1-none";
+function toCurrentWasmTargetPath(wasmPath) {
+  if (!wasmPath.includes(LEGACY_RUST_WASM_TARGET)) {
+    return wasmPath;
+  }
+  return wasmPath.replaceAll(LEGACY_RUST_WASM_TARGET, CURRENT_RUST_WASM_TARGET);
+}
+function wasmNotFoundError(configuredWasmPath, options) {
+  const migratedPath = options?.migratedPath;
+  const hint = migratedPath === void 0 ? "Run caatinga build before deploy or generate." : [
+    "Run caatinga build before deploy or generate.",
+    `Soroban builds use the "${CURRENT_RUST_WASM_TARGET}" target.`,
+    `Update wasm in caatinga.config.ts to "${toConfigRelativeWasmPath(migratedPath)}" or an equivalent path under target/${CURRENT_RUST_WASM_TARGET}/release/.`
+  ].join(" ");
+  return new CaatingaError(
+    `WASM output was not found at ${configuredWasmPath}.`,
+    CaatingaErrorCode.ARTIFACT_NOT_FOUND,
+    hint
+  );
+}
+function toConfigRelativeWasmPath(absoluteWasmPath) {
+  const relative = import_node_path5.default.relative(process.cwd(), absoluteWasmPath);
+  return relative.startsWith("..") ? absoluteWasmPath : `./${relative.split(import_node_path5.default.sep).join("/")}`;
+}
+async function resolveWasmArtifactPath(configuredWasmPath) {
   try {
-    await (0, import_promises4.access)(wasmPath);
+    await (0, import_promises4.access)(configuredWasmPath);
+    return configuredWasmPath;
   } catch {
-    throw new CaatingaError(
-      `WASM output was not found at ${wasmPath}.`,
-      CaatingaErrorCode.ARTIFACT_NOT_FOUND,
-      "Run caatinga build before deploy or generate."
-    );
+    const currentTargetPath = toCurrentWasmTargetPath(configuredWasmPath);
+    if (currentTargetPath === configuredWasmPath) {
+      throw wasmNotFoundError(configuredWasmPath);
+    }
+    try {
+      await (0, import_promises4.access)(currentTargetPath);
+      return currentTargetPath;
+    } catch {
+      throw wasmNotFoundError(configuredWasmPath, { migratedPath: currentTargetPath });
+    }
   }
 }
 async function hashWasm(wasmPath) {
   const bytes = await (0, import_promises4.readFile)(wasmPath);
   return (0, import_node_crypto.createHash)("sha256").update(bytes).digest("hex");
 }
+async function getNewestMtimeInDirectory(directory) {
+  try {
+    await (0, import_promises4.access)(directory);
+  } catch {
+    return void 0;
+  }
+  let newest = 0;
+  async function walk(dir) {
+    const entries = await (0, import_promises4.readdir)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const entryPath = import_node_path5.default.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(entryPath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      const fileStat = await (0, import_promises4.stat)(entryPath);
+      newest = Math.max(newest, fileStat.mtimeMs);
+    }
+  }
+  await walk(directory);
+  return newest > 0 ? newest : void 0;
+}
+async function isWasmOlderThanSources(input) {
+  const srcDir = import_node_path5.default.join(input.contractPath, "src");
+  const newestSourceMtime = await getNewestMtimeInDirectory(srcDir);
+  if (newestSourceMtime === void 0) {
+    return false;
+  }
+  let wasmStat;
+  try {
+    wasmStat = await (0, import_promises4.stat)(input.wasmPath);
+  } catch {
+    return false;
+  }
+  return wasmStat.mtimeMs < newestSourceMtime;
+}
+function formatStaleWasmWarning(contractName) {
+  return `WASM for "${contractName}" may be stale: contract sources under src/ are newer than the WASM file. Run \`caatinga build\` before deploy.`;
+}
 
 // src/contracts/build-contract.ts
-var RUST_WASM_TARGET = "wasm32-unknown-unknown";
+var RUST_WASM_TARGET = "wasm32v1-none";
 var MISSING_WASM_TARGET_HINT_SUBSTRINGS = [
   "not installed",
   "not found",
@@ -537,100 +758,24 @@ async function buildContract(options) {
       throw new CaatingaError(
         `Required Rust wasm target "${RUST_WASM_TARGET}" is missing.`,
         CaatingaErrorCode.RUST_TARGET_NOT_FOUND,
-        `Run \`rustup target add ${RUST_WASM_TARGET}\` and retry the build.`,
+        `Run \`rustup target add ${RUST_WASM_TARGET}\` and retry.`,
         error
       );
     }
     throw error;
   }
-  await assertWasmExists(contract.wasmPath);
+  const wasmPath = await resolveWasmArtifactPath(contract.wasmPath);
   return {
-    contract,
+    contract: {
+      ...contract,
+      wasmPath
+    },
     output: result.all || result.stdout
   };
 }
 
 // src/contracts/deploy-contract.ts
-var import_node_path5 = __toESM(require("path"), 1);
-
-// src/stellar-cli/recover-deploy-contract-id.ts
-var TX_HASH_REGEX = /Transaction hash is ([a-f0-9]{64})/i;
-var DEPLOY_SIGNING_FAILURE_REGEX = /xdr processing error: xdr value invalid/i;
-var HORIZON_URL_BY_PASSPHRASE = {
-  "Test SDF Network ; September 2015": "https://horizon-testnet.stellar.org",
-  "Public Global Stellar Network ; September 2015": "https://horizon.stellar.org"
-};
-function isLikelyPublicKeySource(source) {
-  return /^G[A-Z2-7]{55}$/.test(source);
-}
-function decimalSaltToHex(salt) {
-  return BigInt(salt).toString(16).padStart(64, "0");
-}
-function resolveHorizonUrl(network) {
-  const horizonUrl = HORIZON_URL_BY_PASSPHRASE[network.networkPassphrase];
-  if (!horizonUrl) {
-    throw new CaatingaError(
-      `No Horizon URL mapping for network passphrase "${network.networkPassphrase}".`,
-      CaatingaErrorCode.NETWORK_NOT_FOUND,
-      "Use testnet or mainnet, or extend Caatinga network metadata."
-    );
-  }
-  return horizonUrl;
-}
-async function fetchCreateContractSalt(horizonUrl, transactionHash, fetchImpl = fetch) {
-  const response = await fetchImpl(`${horizonUrl}/transactions/${transactionHash}/operations`);
-  if (!response.ok) {
-    return null;
-  }
-  const body = await response.json();
-  const operation = body._embedded?.records?.find(
-    (record) => record.transaction_successful === true && record.type === "invoke_host_function" && record.function === "HostFunctionTypeHostFunctionTypeCreateContract" && typeof record.salt === "string"
-  );
-  return operation?.salt ?? null;
-}
-async function resolveContractIdFromDeploySalt(options) {
-  const saltHex = decimalSaltToHex(options.salt);
-  const result = await runCommand("stellar", [
-    "contract",
-    "id",
-    "wasm",
-    "--salt",
-    saltHex,
-    "--source-account",
-    options.source,
-    "--rpc-url",
-    options.network.rpcUrl,
-    "--network-passphrase",
-    options.network.networkPassphrase
-  ], {
-    cwd: options.cwd,
-    allowUntestedStellarCli: options.allowUntestedStellarCli,
-    skipStellarVersionCheck: true
-  });
-  return parseContractId(result.all || `${result.stdout}
-${result.stderr}`);
-}
-async function tryRecoverContractIdFromDeployFailure(options) {
-  if (!DEPLOY_SIGNING_FAILURE_REGEX.test(options.output)) {
-    return null;
-  }
-  const hashMatch = options.output.match(TX_HASH_REGEX);
-  if (!hashMatch) {
-    return null;
-  }
-  const horizonUrl = resolveHorizonUrl(options.network);
-  const salt = await fetchCreateContractSalt(horizonUrl, hashMatch[1], options.fetchImpl);
-  if (!salt) {
-    return null;
-  }
-  return resolveContractIdFromDeploySalt({
-    salt,
-    source: options.source,
-    network: options.network,
-    cwd: options.cwd,
-    allowUntestedStellarCli: options.allowUntestedStellarCli
-  });
-}
+var import_node_path6 = __toESM(require("path"), 1);
 
 // src/contracts/dependency-graph.ts
 function buildDependencyGraph(contracts) {
@@ -681,19 +826,9 @@ function assertSafeSourceAccount(source) {
       "Pass a Stellar CLI identity alias, for example: --source alice"
     );
   }
-  if (source.startsWith("S") || source.trim().includes(" ")) {
-    throw new CaatingaError(
-      "Refusing to accept a likely secret key or seed phrase as --source.",
-      CaatingaErrorCode.UNSAFE_SOURCE_ACCOUNT,
-      "Use a Stellar CLI identity alias instead, for example: --source alice"
-    );
-  }
-  if (isLikelyPublicKeySource(source)) {
-    throw new CaatingaError(
-      `Public account address cannot sign transactions: ${source}`,
-      CaatingaErrorCode.UNSAFE_SOURCE_ACCOUNT,
-      "Use a Stellar CLI identity with a secret key. Example: stellar keys generate alice --fund --network testnet, then --source alice"
-    );
+  const unsafeSource = validateSourceShape(source);
+  if (unsafeSource) {
+    throw unsafeSource;
   }
   return source;
 }
@@ -721,17 +856,32 @@ async function deployContract(options) {
   await checkBinary("stellar", "Install Stellar CLI before running caatinga deploy.", {
     allowUntestedStellarCli: options.allowUntestedStellarCli
   });
-  await assertWasmExists(contract.wasmPath);
+  const wasmPath = await resolveWasmArtifactPath(contract.wasmPath);
+  const contractWithWasm = {
+    ...contract,
+    wasmPath
+  };
+  let staleWasmWarning;
+  if (options.checkStaleWasm !== false) {
+    const stale = await isWasmOlderThanSources({
+      wasmPath,
+      contractPath: contract.sourcePath
+    });
+    if (stale) {
+      staleWasmWarning = formatStaleWasmWarning(contract.name);
+    }
+  }
   const artifactsBefore = await readArtifacts(cwd);
   const existing = artifactsBefore.networks[network.name]?.contracts[contract.name];
   if (existing?.contractId && !options.force) {
     return {
-      contract,
+      contract: contractWithWasm,
       network,
       contractId: existing.contractId,
-      artifactsPath: import_node_path5.default.resolve(cwd, "caatinga.artifacts.json"),
+      artifactsPath: import_node_path6.default.resolve(cwd, "caatinga.artifacts.json"),
       output: "",
-      skipped: true
+      skipped: true,
+      staleWasmWarning
     };
   }
   const rawDeployArgs = contract.config.deployArgs;
@@ -762,13 +912,10 @@ async function deployContract(options) {
     "contract",
     "deploy",
     "--wasm",
-    contract.wasmPath,
+    wasmPath,
     "--source-account",
     source,
-    "--rpc-url",
-    network.config.rpcUrl,
-    "--network-passphrase",
-    network.config.networkPassphrase,
+    ...buildStellarNetworkArgs(network),
     ...constructorArgs
   ];
   let output = "";
@@ -804,7 +951,7 @@ ${error.hint ?? ""}`,
       `Contract ID: ${contractId}`
     ].filter(Boolean).join("\n");
   }
-  const wasmHash = await hashWasm(contract.wasmPath);
+  const wasmHash = await hashWasm(wasmPath);
   const dependencyGraph = buildDependencyGraph(options.config.contracts);
   const dependencies = options.dependencies ?? contract.config.dependsOn;
   const nextArtifacts = updateArtifact(
@@ -824,12 +971,13 @@ ${error.hint ?? ""}`,
   );
   const artifactsPath = await writeArtifacts(nextArtifacts, cwd);
   return {
-    contract,
+    contract: contractWithWasm,
     network,
     contractId,
     artifactsPath,
     output,
-    skipped: false
+    skipped: false,
+    staleWasmWarning
   };
 }
 
@@ -884,6 +1032,53 @@ function resolveDeployOrder(input) {
   }
 }
 
+// src/contracts/verify-dependency-contract.ts
+async function verifyDependencyContract(options) {
+  try {
+    await runCommand("stellar", [
+      "contract",
+      "info",
+      "interface",
+      "--contract-id",
+      options.contractId,
+      ...buildStellarNetworkArgs(options.network)
+    ], {
+      cwd: options.cwd,
+      allowUntestedStellarCli: options.allowUntestedStellarCli,
+      failureCode: CaatingaErrorCode.DEPENDENCY_CONTRACT_NOT_FOUND
+    });
+  } catch (error) {
+    if (error instanceof CaatingaError && error.code === CaatingaErrorCode.DEPENDENCY_CONTRACT_NOT_FOUND) {
+      throw new CaatingaError(
+        `Dependency "${options.dependencyName}" is not deployed on "${options.network.name}" (contract ID ${options.contractId}).`,
+        CaatingaErrorCode.DEPENDENCY_CONTRACT_NOT_FOUND,
+        "Deploy the dependency on this network, fix caatinga.artifacts.json, or omit --verify-deps.",
+        error.cause
+      );
+    }
+    throw error;
+  }
+}
+async function verifyDependencyContracts(options) {
+  for (const dependencyName of options.dependencies) {
+    const contractArtifact = options.artifacts.networks[options.network.name]?.contracts[dependencyName];
+    if (!contractArtifact?.contractId) {
+      throw new CaatingaError(
+        `No dependency artifact found for "${dependencyName}" on "${options.network.name}".`,
+        CaatingaErrorCode.CONTRACT_DEPENDENCY_ARTIFACT_NOT_FOUND,
+        "Deploy the dependency first or run deploy without --no-deps."
+      );
+    }
+    await verifyDependencyContract({
+      dependencyName,
+      contractId: contractArtifact.contractId,
+      network: options.network,
+      cwd: options.cwd,
+      allowUntestedStellarCli: options.allowUntestedStellarCli
+    });
+  }
+}
+
 // src/contracts/deploy-contract-graph.ts
 async function deployContractGraph(options) {
   const cwd = options.cwd ?? process.cwd();
@@ -894,17 +1089,33 @@ async function deployContractGraph(options) {
     includeDependencies: options.includeDependencies
   });
   const deployedContracts = [];
+  const skippedContracts = [];
+  const staleWasmWarnings = [];
   for (const contractName of order) {
     const artifacts = await readArtifacts(cwd);
     const existing = artifacts.networks[network.name]?.contracts[contractName];
     const contractConfig = options.config.contracts[contractName];
+    if (options.verifyDeps && contractConfig.dependsOn.length > 0) {
+      await verifyDependencyContracts({
+        dependencies: contractConfig.dependsOn,
+        artifacts,
+        network,
+        cwd,
+        allowUntestedStellarCli: options.allowUntestedStellarCli
+      });
+    }
     const resolvedDeployArgs = resolveDeployArgs({
       deployArgs: contractConfig.deployArgs,
       artifacts,
       network: network.name
     });
     if (existing?.contractId && !options.force) {
-      deployedContracts.push({ name: contractName, contractId: existing.contractId });
+      skippedContracts.push({
+        name: contractName,
+        contractId: existing.contractId,
+        network: network.name,
+        reason: "already-deployed"
+      });
       continue;
     }
     const result = await deployContract({
@@ -915,20 +1126,38 @@ async function deployContractGraph(options) {
       cwd,
       allowUntestedStellarCli: options.allowUntestedStellarCli,
       force: options.force,
+      checkStaleWasm: options.checkStaleWasm,
       resolvedDeployArgs,
       dependencies: contractConfig.dependsOn
     });
-    deployedContracts.push({ name: contractName, contractId: result.contractId });
+    if (result.staleWasmWarning) {
+      staleWasmWarnings.push({
+        contract: contractName,
+        message: result.staleWasmWarning
+      });
+    }
+    if (result.skipped) {
+      skippedContracts.push({
+        name: contractName,
+        contractId: result.contractId,
+        network: network.name,
+        reason: "already-deployed"
+      });
+    } else {
+      deployedContracts.push({ name: contractName, contractId: result.contractId });
+    }
   }
   return {
     network,
-    deployedContracts
+    deployedContracts,
+    skippedContracts,
+    staleWasmWarnings
   };
 }
 
 // src/contracts/generate-bindings.ts
 var import_promises5 = require("fs/promises");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
 async function generateBindings(options) {
   const cwd = options.cwd ?? process.cwd();
   const network = resolveNetwork(options.config, options.networkName);
@@ -944,7 +1173,7 @@ async function generateBindings(options) {
   await checkBinary("stellar", "Install Stellar CLI before running caatinga generate.", {
     allowUntestedStellarCli: options.allowUntestedStellarCli
   });
-  const outputDir = import_node_path6.default.resolve(cwd, options.config.frontend.bindingsOutput, options.contractName);
+  const outputDir = import_node_path7.default.resolve(cwd, options.config.frontend.bindingsOutput, options.contractName);
   await (0, import_promises5.mkdir)(outputDir, { recursive: true });
   const result = await runCommand("stellar", [
     "contract",
@@ -955,10 +1184,7 @@ async function generateBindings(options) {
     "--output-dir",
     outputDir,
     "--overwrite",
-    "--rpc-url",
-    network.config.rpcUrl,
-    "--network-passphrase",
-    network.config.networkPassphrase
+    ...buildStellarNetworkArgs(network)
   ], {
     cwd,
     allowUntestedStellarCli: options.allowUntestedStellarCli,
@@ -973,6 +1199,7 @@ async function generateBindings(options) {
 }
 
 // src/contracts/invoke-contract.ts
+var INVOKE_SIGNING_FAILURE_REGEX = /xdr processing error: xdr value invalid/i;
 function parseInvokeTarget(target) {
   const [contractName, method, extra] = target.split(".");
   if (!contractName || !method || extra) {
@@ -1001,25 +1228,43 @@ async function invokeContract(options) {
   await checkBinary("stellar", "Install Stellar CLI before running caatinga invoke.", {
     allowUntestedStellarCli: options.allowUntestedStellarCli
   });
-  const result = await runCommand("stellar", [
-    "contract",
-    "invoke",
-    "--id",
-    contractArtifact.contractId,
-    "--source-account",
-    source,
-    "--rpc-url",
-    network.config.rpcUrl,
-    "--network-passphrase",
-    network.config.networkPassphrase,
-    "--",
-    target.method,
-    ...options.args ?? []
-  ], {
-    cwd,
-    allowUntestedStellarCli: options.allowUntestedStellarCli,
-    failureCode: CaatingaErrorCode.INVOKE_FAILED
-  });
+  let result;
+  try {
+    result = await runCommand("stellar", [
+      "contract",
+      "invoke",
+      "--id",
+      contractArtifact.contractId,
+      "--source-account",
+      source,
+      ...buildStellarNetworkArgs(network),
+      "--",
+      target.method,
+      ...options.args ?? []
+    ], {
+      cwd,
+      allowUntestedStellarCli: options.allowUntestedStellarCli,
+      failureCode: CaatingaErrorCode.INVOKE_FAILED
+    });
+  } catch (error) {
+    if (error instanceof CaatingaError && error.code === CaatingaErrorCode.INVOKE_FAILED && INVOKE_SIGNING_FAILURE_REGEX.test(`${error.message}
+${error.hint ?? ""}`)) {
+      throw new CaatingaError(
+        error.message,
+        error.code,
+        [
+          "Stellar CLI could not sign the invoke transaction (xdr value invalid).",
+          "Stellar CLI 22.x has a known invoke signing bug; upgrade to 23.0.0 or newer (25.2.0 recommended).",
+          "  stellar --version",
+          "Then retry with a funded identity, for example:",
+          "  stellar keys generate alice --fund --network testnet",
+          "  npx caatinga invoke counter.increment --network testnet --source alice"
+        ].join("\n"),
+        error
+      );
+    }
+    throw error;
+  }
   return {
     target,
     network,
@@ -1029,7 +1274,7 @@ async function invokeContract(options) {
 
 // src/templates/create-project-from-template.ts
 var import_promises6 = require("fs/promises");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_path8 = __toESM(require("path"), 1);
 var import_zod6 = require("zod");
 
 // src/templates/template-manifest.schema.ts
@@ -1099,8 +1344,8 @@ function formatTemplateCompatibilityHint(issue) {
 
 // src/templates/create-project-from-template.ts
 async function createProjectFromTemplate(options) {
-  const targetDir = import_node_path7.default.resolve(options.targetDir);
-  const templateDir = import_node_path7.default.resolve(options.templateDir);
+  const targetDir = import_node_path8.default.resolve(options.targetDir);
+  const templateDir = import_node_path8.default.resolve(options.templateDir);
   try {
     await (0, import_promises6.stat)(templateDir);
   } catch {
@@ -1122,7 +1367,7 @@ async function createProjectFromTemplate(options) {
   return { targetDir, template: manifest };
 }
 async function readTemplateManifest(templateDir) {
-  const manifestPath = import_node_path7.default.join(templateDir, "caatinga.template.json");
+  const manifestPath = import_node_path8.default.join(templateDir, "caatinga.template.json");
   try {
     const rawManifest = await (0, import_promises6.readFile)(manifestPath, "utf8");
     const manifest = TemplateManifestSchema.parse(JSON.parse(rawManifest));
@@ -1159,7 +1404,7 @@ async function readTemplateManifest(templateDir) {
 async function replaceTemplateVariables(dir, projectName) {
   const entries = await (0, import_promises6.readdir)(dir);
   await Promise.all(entries.map(async (entry) => {
-    const entryPath = import_node_path7.default.join(dir, entry);
+    const entryPath = import_node_path8.default.join(dir, entry);
     const entryStat = await (0, import_promises6.stat)(entryPath);
     if (entryStat.isDirectory()) {
       await replaceTemplateVariables(entryPath, projectName);
@@ -1182,7 +1427,7 @@ function isTextTemplateFile(filePath) {
     ".tsx",
     ".css",
     ".html"
-  ].includes(import_node_path7.default.extname(filePath));
+  ].includes(import_node_path8.default.extname(filePath));
 }
 
 // src/ci/is-transient-testnet-smoke-failure.ts
@@ -1241,5 +1486,6 @@ function isTransientTestnetSmokeFailure(logText) {
   runCommand,
   toCaatingaError,
   updateArtifact,
+  validateSourceShape,
   writeArtifacts
 });