@evergreen-stellar/cli 0.1.0

package/dist/evergreen.mjs

@@ -0,0 +1,2051 @@
+#!/usr/bin/env node
+
+// src/bin.ts
+import process from "node:process";
+import console from "node:console";
+import { readFile } from "node:fs/promises";
+import { rpc as rpc5, Networks as Networks4 } from "@stellar/stellar-sdk";
+
+// ../core/dist/format.js
+var EVIDENCE_LOCALE = "en-US";
+function formatCount(value) {
+  return value.toLocaleString(EVIDENCE_LOCALE);
+}
+
+// ../core/dist/ttl.js
+var SECONDS_PER_LEDGER = 5;
+function observeTTL(args) {
+  if (args.liveUntilLedgerSeq === void 0)
+    return { status: "unavailable" };
+  return {
+    status: "known",
+    endsAtLedger: args.liveUntilLedgerSeq,
+    remainingLedgers: args.liveUntilLedgerSeq - args.observedAtLedger
+  };
+}
+function hasExpired(remainingLedgers) {
+  return remainingLedgers < 0;
+}
+function isLive(ttl) {
+  if (ttl.status === "unavailable")
+    return void 0;
+  return !hasExpired(ttl.remainingLedgers);
+}
+function isValidThreshold(thresholdLedgers) {
+  return Number.isInteger(thresholdLedgers) && thresholdLedgers >= 0;
+}
+function needsAction(remainingLedgers, thresholdLedgers) {
+  return remainingLedgers <= thresholdLedgers;
+}
+function estimateEndsAt(ttl, now) {
+  if (ttl.status === "unavailable")
+    return void 0;
+  return new Date(now.getTime() + ttl.remainingLedgers * SECONDS_PER_LEDGER * 1e3);
+}
+
+// ../core/dist/rpc.js
+import { Contract, Networks, rpc, xdr } from "@stellar/stellar-sdk";
+var NotTestnetError = class extends Error {
+  constructor(actual) {
+    super(`Refusing to run: RPC network is "${actual}", not Stellar testnet.`);
+    this.name = "NotTestnetError";
+  }
+};
+function isValidContractId(contractId) {
+  try {
+    new Contract(contractId);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function instanceKey(contractId) {
+  return new Contract(contractId).getFootprint().toXDR("base64");
+}
+function codeKey(wasmHash) {
+  return xdr.LedgerKey.contractCode(new xdr.LedgerKeyContractCode({ hash: wasmHash })).toXDR("base64");
+}
+function createRpcReader(server) {
+  return {
+    async read(keys) {
+      const res = await server.getLedgerEntries(...keys.map((k) => xdr.LedgerKey.fromXDR(k, "base64")));
+      return {
+        latestLedger: res.latestLedger,
+        entries: res.entries.map((e) => ({
+          key: e.key.toXDR("base64"),
+          entryXdr: e.val.toXDR("base64"),
+          liveUntilLedgerSeq: e.liveUntilLedgerSeq
+        }))
+      };
+    }
+  };
+}
+async function connectTestnet(rpcUrl) {
+  const server = new rpc.Server(rpcUrl);
+  const { passphrase } = await server.getNetwork();
+  if (passphrase !== Networks.TESTNET)
+    throw new NotTestnetError(passphrase);
+  return createRpcReader(server);
+}
+
+// ../core/dist/temporary-policy.js
+import { Address, xdr as xdr2 } from "@stellar/stellar-sdk";
+
+// ../core/dist/health.js
+var DEFAULT_WARN_LEDGERS = 120960;
+function assertHealthThresholds(thresholds) {
+  if (!Number.isSafeInteger(thresholds.criticalBelowLedgers) || !isValidThreshold(thresholds.criticalBelowLedgers)) {
+    throw new Error("criticalBelowLedgers must be a non-negative safe integer of ledgers");
+  }
+  if (!Number.isSafeInteger(thresholds.warnBelowLedgers) || !isValidThreshold(thresholds.warnBelowLedgers)) {
+    throw new Error("warnBelowLedgers must be a non-negative safe integer of ledgers");
+  }
+  if (!needsAction(thresholds.criticalBelowLedgers, thresholds.warnBelowLedgers)) {
+    throw new Error("warnBelowLedgers must be at least the action threshold (bumpWhenRemainingLedgersBelow)");
+  }
+}
+function resolveHealthThresholds(defaults, overrides = {}) {
+  const criticalBelowLedgers = overrides.bumpWhenRemainingLedgersBelow ?? defaults.bumpWhenRemainingLedgersBelow;
+  const warnBelowLedgers = overrides.warnBelowLedgers ?? defaults.warnBelowLedgers ?? Math.max(DEFAULT_WARN_LEDGERS, criticalBelowLedgers);
+  const resolved = { warnBelowLedgers, criticalBelowLedgers };
+  assertHealthThresholds(resolved);
+  return resolved;
+}
+function assessEntryWithThresholds(entry, thresholds) {
+  assertHealthThresholds(thresholds);
+  const assessment = assessEntry(entry, thresholds.warnBelowLedgers);
+  if (entry.ttl.status === "unavailable" || assessment.isExpired)
+    return assessment;
+  if (needsAction(entry.ttl.remainingLedgers, thresholds.criticalBelowLedgers)) {
+    return {
+      ...assessment,
+      health: "critical",
+      needsAction: true,
+      reason: `At or below action threshold (${thresholds.criticalBelowLedgers} ledgers). ${assessment.reason}`
+    };
+  }
+  if (assessment.health === "healthy")
+    return assessment;
+  return {
+    ...assessment,
+    needsAction: false,
+    reason: `${assessment.reason} Above action threshold (${thresholds.criticalBelowLedgers} ledgers); warning only, no bump needed.`
+  };
+}
+function assessEntry(entry, thresholdLedgers) {
+  if (!isValidThreshold(thresholdLedgers)) {
+    throw new Error("thresholdLedgers must be a non-negative integer of ledgers");
+  }
+  const observedContractCount = entry.contracts.length;
+  const sharingStatus = observedContractCount > 1 ? "shared" : entry.kind === "code" ? "undetermined" : "exclusive";
+  const shared = sharingStatus === "shared";
+  if (entry.ttl.status === "unavailable") {
+    return {
+      health: "unknown",
+      needsAction: false,
+      isExpired: false,
+      observedContractCount,
+      blastRadiusAtLeast: observedContractCount,
+      sharingStatus,
+      reason: "No TTL metadata was returned, so this entry\u2019s health is unread \u2014 not healthy."
+    };
+  }
+  const { remainingLedgers } = entry.ttl;
+  const isExpired = hasExpired(remainingLedgers);
+  const act = needsAction(remainingLedgers, thresholdLedgers);
+  if (isExpired) {
+    return {
+      health: "critical",
+      needsAction: true,
+      isExpired: true,
+      observedContractCount,
+      blastRadiusAtLeast: observedContractCount,
+      sharingStatus,
+      reason: entry.endBehavior === "deleted" ? "Already deleted. Temporary entries are not recoverable." : "Already archived. Restore it with RestoreFootprintOp \u2014 extendTTL cannot reach it."
+    };
+  }
+  if (!act) {
+    return {
+      health: "healthy",
+      needsAction: false,
+      isExpired: false,
+      observedContractCount,
+      blastRadiusAtLeast: observedContractCount,
+      sharingStatus,
+      reason: "Above threshold."
+    };
+  }
+  if (entry.endBehavior === "deleted") {
+    return {
+      health: "critical",
+      needsAction: true,
+      isExpired: false,
+      observedContractCount,
+      blastRadiusAtLeast: observedContractCount,
+      sharingStatus,
+      reason: "Low, and temporary \u2014 this data is DELETED at expiry, not archived. Unrecoverable."
+    };
+  }
+  if (shared) {
+    return {
+      health: "critical",
+      needsAction: true,
+      isExpired: false,
+      observedContractCount,
+      blastRadiusAtLeast: observedContractCount,
+      sharingStatus,
+      reason: `Low, and shared by ${observedContractCount} contracts \u2014 every one of them fails together.`
+    };
+  }
+  return {
+    health: "warning",
+    needsAction: true,
+    isExpired: false,
+    observedContractCount,
+    blastRadiusAtLeast: observedContractCount,
+    sharingStatus,
+    reason: sharingStatus === "undetermined" ? "Low. This scan saw one contract on it, but a code entry may serve others it cannot see." : "Low, recoverable, and affects only this contract."
+  };
+}
+var HEALTH_RANK = {
+  critical: 0,
+  unknown: 1,
+  warning: 2,
+  healthy: 3
+};
+function worstHealth(assessments) {
+  if (assessments.length === 0)
+    return void 0;
+  return assessments.reduce((worst, a) => HEALTH_RANK[a.health] < HEALTH_RANK[worst] ? a.health : worst, "healthy");
+}
+function coverageIssues(scan) {
+  const issues = [];
+  for (const [entryKey, entry] of Object.entries(scan.entries)) {
+    if (assessEntry(entry, 0).sharingStatus !== "undetermined")
+      continue;
+    issues.push({
+      kind: "sharing-undetermined",
+      contracts: entry.contracts,
+      entryKey,
+      observedAtLedger: entry.observedAtLedger,
+      message: `Code entries are shared by every contract built from the same Wasm. This scan saw ${entry.contracts.length}. Whether others depend on this entry cannot be determined from a single-contract scan \u2014 pass them together to see the real blast radius.`
+    });
+  }
+  const supplied = scan.coverage?.dataKeysSuppliedByContract ?? {};
+  for (const [contract, count] of Object.entries(supplied)) {
+    if (count > 0)
+      continue;
+    if (scan.coverage?.noDataKeysDeclaredByContract?.[contract] === true)
+      continue;
+    issues.push({
+      kind: "coverage-limited",
+      contracts: [contract],
+      message: "No data keys were supplied, so any further entries are unread. A clean result covers only what was asked for, never the whole contract."
+    });
+  }
+  return issues;
+}
+
+// ../core/dist/ed25519-signer.js
+import { Keypair, Networks as Networks2, StrKey, Transaction, TransactionBuilder } from "@stellar/stellar-sdk";
+
+// ../core/dist/extend.js
+import { Address as Address2, xdr as xdr4 } from "@stellar/stellar-sdk";
+
+// ../core/dist/network-config.js
+import { xdr as xdr3, rpc as rpc2 } from "@stellar/stellar-sdk";
+var STATE_ARCHIVAL_CONFIG_KEY = "AAAACAAAAAo=";
+function field(source, name) {
+  if (source === null || typeof source !== "object")
+    return void 0;
+  const value = source[name];
+  return typeof value === "function" ? value.call(source) : value;
+}
+function firstNumber(source, ...names) {
+  for (const name of names) {
+    const value = field(source, name);
+    if (typeof value === "number")
+      return value;
+    if (typeof value === "bigint")
+      return Number(value);
+  }
+  return void 0;
+}
+function parseStateArchivalSettings(entryXdr, observedAtLedger) {
+  const data = xdr3.LedgerEntryData.fromXDR(entryXdr, "base64");
+  const configSetting = field(data, "configSetting");
+  const settings = field(configSetting, "stateArchivalSettings");
+  const maxEntryTtl = firstNumber(settings, "max_entry_ttl", "maxEntryTtl");
+  if (maxEntryTtl === void 0) {
+    throw new Error("Entry is not a STATE_ARCHIVAL config setting");
+  }
+  const persistentDenominator = field(settings, "persistent_rent_rate_denominator") ?? field(settings, "persistentRentRateDenominator");
+  const temporaryDenominator = field(settings, "temp_rent_rate_denominator") ?? field(settings, "tempRentRateDenominator");
+  return {
+    maxEntryTtl,
+    minTemporaryTtl: firstNumber(settings, "min_temporary_ttl", "minTemporaryTtl") ?? 0,
+    minPersistentTtl: firstNumber(settings, "min_persistent_ttl", "minPersistentTtl") ?? 0,
+    persistentRentRateDenominator: String(persistentDenominator),
+    temporaryRentRateDenominator: String(temporaryDenominator),
+    observedAtLedger
+  };
+}
+async function readStateArchivalSettings(server) {
+  const response = await server.getLedgerEntries(xdr3.LedgerKey.fromXDR(STATE_ARCHIVAL_CONFIG_KEY, "base64"));
+  const entry = response.entries[0];
+  if (!entry)
+    throw new Error("Network returned no state-archival config entry");
+  return parseStateArchivalSettings(entry.val.toXDR("base64"), response.latestLedger);
+}
+function resolveExtendTarget(args) {
+  const { currentRemainingLedgers, additionalLedgers, maxEntryTtl } = args;
+  if (!Number.isInteger(additionalLedgers) || additionalLedgers <= 0) {
+    throw new Error("--ledgers must be a positive integer of ledgers");
+  }
+  if (!Number.isInteger(maxEntryTtl) || maxEntryTtl <= 0) {
+    throw new Error("maxEntryTtl must come from the network and be a positive integer");
+  }
+  const base = Math.max(0, currentRemainingLedgers);
+  const requested = base + additionalLedgers;
+  const capped = Math.min(requested, maxEntryTtl - 1);
+  return {
+    extendToLedgers: capped,
+    wasCapped: capped < requested,
+    requestedLedgers: requested
+  };
+}
+
+// ../core/dist/write-guard.js
+var PROTECTED_ENTRIES = [
+  {
+    contractId: "CCYGO7KQ6FCAZBZAUWAPCAX4RBDIPZK4BJR2KGKISEIGARTJPB7KLTTQ",
+    label: "guinea-pig B",
+    alertThresholdOn: "2026-09-20",
+    expiresOn: "2026-09-21",
+    why: "Natural-decay proof. Extending it moves the crossing past the sprint and the ageing cannot be recreated."
+  },
+  {
+    contractId: "CCLW55OIEDHKS5DHDGEA3B2F2ZVOTRXZIOPO36SCMHNQV3VQEGRR33FL",
+    label: "guinea-pig C",
+    alertThresholdOn: "2026-09-25",
+    expiresOn: "2026-09-26",
+    why: "Backup natural-decay proof, the only second shot if B is missed."
+  }
+];
+var SHARED_CODE_ENTRY_KEY = "AAAAB8flXwrYnvsGALwVBIsVUJn6TZfO4WRm+hJEs9y86Yv7";
+var SHARED_CODE_UNTIL = "2026-09-26";
+var ProtectedEntryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProtectedEntryError";
+  }
+};
+function assertWriteAllowed(args) {
+  const acknowledged = new Set(args.options?.acknowledgeProtected ?? []);
+  const touched = /* @__PURE__ */ new Set([args.contractId]);
+  for (const entryKey of args.entryKeys) {
+    for (const consumer of args.scan.entries[entryKey]?.contracts ?? []) {
+      touched.add(consumer);
+    }
+  }
+  if (args.entryKeys.includes(SHARED_CODE_ENTRY_KEY) && !acknowledged.has(SHARED_CODE_ENTRY_KEY)) {
+    throw new ProtectedEntryError(`Refusing to write: this would extend the SHARED ContractCode entry.
+  Guinea-pigs A, B and C are built from one Wasm and share this single entry,
+  so extending it extends all three \u2014 including both natural-decay proofs,
+  which cross on 2026-09-20 and 2026-09-25 and cannot be re-armed.
+  A scan of one contract CANNOT show you this: it reports one consumer,
+  because the chain does not index reverse dependencies from one query.
+
+  It is scheduled for extension at W3-D18-02d, after ${SHARED_CODE_UNTIL}.
+  To override: --acknowledge-protected ${SHARED_CODE_ENTRY_KEY}`);
+  }
+  for (const subject of PROTECTED_ENTRIES) {
+    if (!touched.has(subject.contractId))
+      continue;
+    if (acknowledged.has(subject.contractId))
+      continue;
+    const viaShared = args.contractId !== subject.contractId;
+    throw new ProtectedEntryError(`Refusing to write: this would touch ${subject.label} (${subject.contractId}).
+` + (viaShared ? `  It is not the contract you named \u2014 it is reached through a SHARED ENTRY.
+  A, B and C are built from one Wasm, so extending code extends all three.
+` : "") + `  ${subject.why}
+  It crosses the alert threshold on ${subject.alertThresholdOn} and EXPIRES on
+  ${subject.expiresOn} \u2014 be present for the second one, that is the unrepeatable
+  event. Extending it now
+  moves that crossing past the sprint, and the ageing cannot be recreated.
+
+  If you genuinely intend this, pass the contract explicitly:
+    --acknowledge-protected ${subject.contractId}
+  The shared code entry is due to be extended at W3-D18-02d, after ${SHARED_CODE_UNTIL}.`);
+  }
+}
+
+// ../core/dist/extend.js
+function extensionKey(text) {
+  if (!text || Buffer.from(text, "base64").toString("base64") !== text)
+    throw new Error("Invalid extension ledger key");
+  const key = xdr4.LedgerKey.fromXDR(text, "base64");
+  if (key.toXDR("base64") !== text)
+    throw new Error("Invalid extension ledger key");
+  return key;
+}
+function planExtension(scan, options) {
+  const { contractId, additionalLedgers, maxEntryTtl } = options;
+  if (scan.network !== "testnet" || !isValidContractId(contractId))
+    throw new Error("Extension requires a valid Testnet contract");
+  if (!Number.isSafeInteger(additionalLedgers) || additionalLedgers <= 0 || !Number.isSafeInteger(maxEntryTtl) || maxEntryTtl <= 0 || maxEntryTtl > 4294967295)
+    throw new Error("Invalid extension increment or network ceiling");
+  const keys = /* @__PURE__ */ new Map([[instanceKey(contractId), "instance"]]);
+  for (const supplied of options.dataKeys ?? []) {
+    const text = supplied.trim();
+    const key = extensionKey(text);
+    if (key.type !== "contractData" || Address2.fromScAddress(key.contractData.contract).toString() !== contractId || key.contractData.key.type === "scvLedgerKeyContractInstance")
+      throw new Error("Expected a data key belonging to this contract");
+    keys.set(text, key.contractData.durability.name === "temporary" ? "temporary" : "persistent");
+  }
+  if (options.includeCode) {
+    const code = Object.entries(scan.entries).filter(([, e]) => e.kind === "code" && e.contracts.includes(contractId));
+    if (code.length !== 1)
+      throw new Error("Cannot identify the selected code entry");
+    const key = code[0][0];
+    if (extensionKey(key).type !== "contractCode")
+      throw new Error("Invalid code entry");
+    keys.set(key, "code");
+  }
+  assertWriteAllowed({
+    contractId,
+    entryKeys: [...keys.keys()],
+    scan,
+    ...options.acknowledgeProtected === void 0 ? {} : { options: { acknowledgeProtected: options.acknowledgeProtected } }
+  });
+  const entries = [...keys].map(([entryKey, kind]) => {
+    const entry = scan.entries[entryKey];
+    if (!entry || entry.kind !== kind || !entry.contracts.includes(contractId) || entry.ttl.status !== "known" || scan.issues.some((i) => i.kind !== "coverage-limited" && i.kind !== "sharing-undetermined" && (i.entryKey === entryKey || !i.entryKey && i.contracts.includes(contractId))))
+      throw new Error("A selected entry is missing or unreadable");
+    const { endsAtLedger, remainingLedgers } = entry.ttl;
+    if (!Number.isSafeInteger(entry.observedAtLedger) || entry.observedAtLedger < 0 || !Number.isSafeInteger(endsAtLedger) || endsAtLedger > 4294967295 || remainingLedgers !== endsAtLedger - entry.observedAtLedger || hasExpired(remainingLedgers) || !Number.isSafeInteger(remainingLedgers + additionalLedgers))
+      throw new Error("A selected entry is expired or has invalid TTL metadata");
+    const target = resolveExtendTarget({
+      currentRemainingLedgers: remainingLedgers,
+      additionalLedgers,
+      maxEntryTtl
+    });
+    return {
+      entryKey,
+      kind,
+      contracts: [...new Set(entry.contracts)],
+      before: { observedAtLedger: entry.observedAtLedger, endsAtLedger },
+      extendToLedgers: target.extendToLedgers,
+      wasCapped: target.wasCapped,
+      skip: !needsAction(remainingLedgers, target.extendToLedgers - 1)
+    };
+  });
+  return {
+    contractId,
+    additionalLedgers,
+    entries,
+    warnings: [
+      "Only selected keys are extended; storage is not enumerated and whole-contract protection is not established.",
+      ...options.includeCode ? ["Code can serve other contracts outside this scan; extending it affects all consumers."] : [],
+      ...entries.some((e) => e.wasCapped) ? ["The network ceiling limits the requested additional lifetime."] : []
+    ]
+  };
+}
+function executeExtensions(plan, options, deps) {
+  return executeExtensionEntries(plan.entries, options, deps);
+}
+async function executeExtensionEntries(entries, options, deps) {
+  const live = options.submit === true;
+  if (!options.payer || options.maxFeeStroops !== void 0 && !/^[1-9]\d*$/.test(options.maxFeeStroops) || live && options.maxFeeStroops === void 0) {
+    throw new Error("Live extension needs an explicit payer and fee budget");
+  }
+  if (new Set(entries.map((e) => e.entryKey)).size !== entries.length) {
+    throw new Error("Duplicate execution entry keys");
+  }
+  const budget = options.maxFeeStroops === void 0 ? void 0 : BigInt(options.maxFeeStroops);
+  let committed = 0n;
+  const records = [];
+  const skipped = [];
+  const visited = /* @__PURE__ */ new Set();
+  let ok = true;
+  for (const original of entries) {
+    visited.add(original.entryKey);
+    if (original.skip) {
+      skipped.push(original.entryKey);
+      continue;
+    }
+    let entry = original;
+    const recordedAt = deps.now().toISOString();
+    const base = () => ({
+      entryKey: entry.entryKey,
+      contracts: entry.contracts,
+      payer: options.payer,
+      before: entry.before,
+      extendToLedgers: entry.extendToLedgers,
+      recordedAt,
+      reason: options.reason ?? "Explicit manual extension"
+    });
+    let sent;
+    let knownSigner;
+    let confirmed = false;
+    try {
+      if (deps.refresh) {
+        const fresh = await deps.refresh(original);
+        if (fresh.entryKey !== original.entryKey || fresh.kind !== original.kind || fresh.contracts.join("\0") !== original.contracts.join("\0")) {
+          throw new Error("Refresh changed execution scope");
+        }
+        entry = fresh;
+        if (entry.skip) {
+          skipped.push(entry.entryKey);
+          continue;
+        }
+      }
+      const prepared = await deps.prepare(entry);
+      if (prepared.entry.entryKey !== entry.entryKey || prepared.entry.extendToLedgers !== entry.extendToLedgers || !/^\d+$/.test(prepared.feeStroops) || budget !== void 0 && committed + BigInt(prepared.feeStroops) > budget) {
+        throw new Error("Prepared selection or fee budget mismatch");
+      }
+      await deps.preview(prepared);
+      if (!live) {
+        records.push({ ...base(), mode: "dry-run", outcome: "simulated" });
+        committed += BigInt(prepared.feeStroops);
+        continue;
+      }
+      const signer = deps.signer(prepared, (budget - committed).toString());
+      if (signer.payer !== options.payer || signer.identity.account !== prepared.sourceAccount) {
+        throw new Error("Signer identity mismatch");
+      }
+      knownSigner = signer.identity;
+      const signed = await signer.signExtendTTL({
+        networkPassphrase: "Test SDF Network ; September 2015",
+        transactionXdr: prepared.transactionXdr
+      });
+      await deps.beforeSubmit?.(prepared, signer.identity);
+      sent = { hash: prepared.transactionHash, signer: signer.identity };
+      committed += BigInt(prepared.feeStroops);
+      const response = await deps.submit(prepared, signed);
+      if (response.hash !== sent.hash)
+        throw new Error("Submission hash mismatch");
+      if (response.status === "ERROR") {
+        confirmed = true;
+        throw new Error("Submission rejected");
+      }
+      if (!["PENDING", "DUPLICATE"].includes(response.status))
+        throw new Error("Submission uncertain");
+      const confirmation = await deps.confirm(sent.hash);
+      if (confirmation.status === "unconfirmed")
+        throw new Error("Confirmation pending");
+      confirmed = true;
+      if (confirmation.status !== "confirmed")
+        throw new Error("Transaction failed");
+      const after = await deps.readAfter(entry.entryKey);
+      if (!Number.isSafeInteger(after.observedAtLedger) || after.observedAtLedger < confirmation.ledger || !Number.isSafeInteger(after.endsAtLedger) || after.endsAtLedger <= entry.before.endsAtLedger || after.endsAtLedger < confirmation.ledger + entry.extendToLedgers) {
+        throw new Error("TTL increase could not be verified");
+      }
+      records.push({
+        ...base(),
+        mode: "live",
+        outcome: "succeeded",
+        transactionHash: sent.hash,
+        signer: sent.signer,
+        after
+      });
+    } catch {
+      ok = false;
+      if (sent && !confirmed) {
+        records.push({
+          ...base(),
+          mode: "live",
+          outcome: "submitted",
+          transactionHash: sent.hash,
+          signer: sent.signer
+        });
+      } else if (live) {
+        records.push({
+          ...base(),
+          outcome: "failed",
+          mode: "live",
+          ...sent ? { transactionHash: sent.hash } : {},
+          ...knownSigner ? { signer: knownSigner } : {},
+          error: {
+            code: "EXTENSION_FAILED",
+            message: "Extension rejected or post-state unverified. No replacement was submitted."
+          }
+        });
+      } else {
+        records.push({
+          ...base(),
+          outcome: "failed",
+          mode: "dry-run",
+          error: {
+            code: "SIMULATION_FAILED",
+            message: "Extension preparation or fee validation failed. Nothing was submitted."
+          }
+        });
+      }
+      break;
+    }
+  }
+  return {
+    ok,
+    mode: live ? "live" : "dry-run",
+    records,
+    skipped,
+    unattempted: entries.filter((e) => !visited.has(e.entryKey)).map((e) => e.entryKey),
+    committedFeeStroops: live ? committed.toString() : "0",
+    estimatedFeeStroops: committed.toString()
+  };
+}
+
+// ../core/dist/ed25519-signer.js
+function isValidPayerAccount(value) {
+  return StrKey.isValidEd25519PublicKey(value);
+}
+function stroopBudget(value) {
+  if (!/^[1-9]\d*$/.test(value))
+    throw new Error("Fee budget must be positive integer stroops");
+  return BigInt(value);
+}
+function validateExtensionEnvelope(transactionXdr, policy) {
+  const tx = TransactionBuilder.fromXDR(transactionXdr, Networks2.TESTNET);
+  if (!(tx instanceof Transaction) || !StrKey.isValidEd25519PublicKey(policy.sourceAccount) || tx.source !== policy.sourceAccount || tx.signatures.length !== 0 || tx.operations.length !== 1 || tx.memo.type !== "none" || Buffer.from(tx.hash()).toString("hex") !== policy.expectedHash)
+    throw new Error("Extension envelope does not match its approved identity");
+  const op = tx.operations[0];
+  const envelope = tx.toEnvelope();
+  if (op.type !== "extendFootprintTtl" || op.source !== void 0 || op.extendTo !== policy.extendToLedgers || !Number.isSafeInteger(op.extendTo) || op.extendTo <= 0 || envelope.type !== "envelopeTypeTx" || envelope.value.tx.ext.type !== "sorobanData")
+    throw new Error("Only the selected TTL extension is permitted");
+  const data = envelope.value.tx.ext.value;
+  const footprint = data.resources.footprint;
+  const key = extensionKey(policy.entryKey);
+  if (!["contractData", "contractCode"].includes(key.type) || footprint.readWrite.length !== 0 || footprint.readOnly.length !== 1 || footprint.readOnly[0].toXDR("base64") !== policy.entryKey || data.resourceFee < 0n || BigInt(tx.fee) < data.resourceFee + 100n || BigInt(tx.fee) > stroopBudget(policy.maxFeeStroops))
+    throw new Error("Extension footprint or fee is outside policy");
+  const now = Math.floor((policy.now ?? (() => Date.now() / 1e3))());
+  if (!tx.timeBounds || BigInt(tx.timeBounds.maxTime) <= BigInt(now) || BigInt(tx.timeBounds.maxTime) > BigInt(now + 60) || BigInt(tx.timeBounds.minTime) > BigInt(now) || tx.extraSigners?.length || tx.minAccountSequence !== void 0 || tx.ledgerBounds !== void 0)
+    throw new Error("Extension validity bounds are outside policy");
+  return tx;
+}
+function createEd25519Signer(options) {
+  return {
+    payer: options.payer,
+    identity: { kind: "ed25519", account: options.sourceAccount },
+    async signExtendTTL(request) {
+      if (request.networkPassphrase !== Networks2.TESTNET)
+        throw new Error("Only Testnet signing is permitted");
+      const tx = validateExtensionEnvelope(request.transactionXdr, options);
+      let accountMismatch = false;
+      try {
+        const key = Keypair.fromSecret(options.readSecret());
+        if (key.publicKey() !== options.sourceAccount) {
+          accountMismatch = true;
+          throw new Error("Wrong key");
+        }
+        tx.sign(key);
+        return tx.toXDR();
+      } catch {
+        throw new Error(accountMismatch ? "Unable to sign the validated extension: the secret does not match the expected source account" : "Unable to sign the validated extension");
+      }
+    }
+  };
+}
+
+// ../core/dist/config.js
+var MIN_ACTION_RUNS_IN_WINDOW = 4;
+var ACTION_WINDOW_GAP_BASIS_MINUTES = 331;
+var MIN_SAFE_ACTION_WINDOW_LEDGERS = Math.ceil(ACTION_WINDOW_GAP_BASIS_MINUTES * MIN_ACTION_RUNS_IN_WINDOW * 60 / SECONDS_PER_LEDGER);
+
+// ../core/dist/rent.js
+function assertStroops(value, entryKey) {
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`Quote for ${entryKey} is not a non-negative integer of stroops: ${value}`);
+  }
+  return value;
+}
+async function estimateRent(scan, args, quoter) {
+  const uniform = typeof args.extendToLedgers === "number" ? args.extendToLedgers : void 0;
+  const perEntry = typeof args.extendToLedgers === "number" ? void 0 : args.extendToLedgers;
+  const targetFor = (entryKey) => uniform ?? perEntry?.[entryKey];
+  if (uniform !== void 0 && (!Number.isInteger(uniform) || uniform <= 0)) {
+    throw new Error("extendToLedgers must be a positive integer of ledgers");
+  }
+  const excluded = [];
+  const quotable = [];
+  let estimatedAtLedger = 0;
+  for (const [entryKey, entry] of Object.entries(scan.entries)) {
+    estimatedAtLedger = Math.max(estimatedAtLedger, entry.observedAtLedger);
+    if (entry.ttl.status === "known" && hasExpired(entry.ttl.remainingLedgers)) {
+      excluded.push({
+        entryKey,
+        reason: "already-expired",
+        detail: "Already past its final live ledger \u2014 needs RestoreFootprintOp, not an extend."
+      });
+      continue;
+    }
+    quotable.push(entryKey);
+  }
+  const byTarget = /* @__PURE__ */ new Map();
+  for (const entryKey of quotable) {
+    const target = targetFor(entryKey);
+    if (target === void 0 || !Number.isInteger(target) || target <= 0) {
+      throw new Error(`No positive extend target supplied for ${entryKey}`);
+    }
+    const group = byTarget.get(target);
+    if (group)
+      group.push(entryKey);
+    else
+      byTarget.set(target, [entryKey]);
+  }
+  const quotes = [];
+  for (const [target, entryKeys] of byTarget) {
+    quotes.push(...await quoter.quote({ entryKeys, extendToLedgers: target }));
+  }
+  const byKey = /* @__PURE__ */ new Map();
+  for (const quote of quotes) {
+    if (!quotable.includes(quote.entryKey)) {
+      throw new Error(`Quoter returned an unrequested entry: ${quote.entryKey}`);
+    }
+    if (byKey.has(quote.entryKey)) {
+      throw new Error(`Quoter returned two prices for ${quote.entryKey}`);
+    }
+    byKey.set(quote.entryKey, assertStroops(quote.estimatedRentStroops, quote.entryKey));
+  }
+  const estimatedRentStroopsByEntry = {};
+  let total = 0n;
+  for (const entryKey of quotable) {
+    const price = byKey.get(entryKey);
+    if (price === void 0) {
+      excluded.push({
+        entryKey,
+        reason: "no-quote-returned",
+        detail: "The network returned no price for this entry; the total excludes it."
+      });
+      continue;
+    }
+    estimatedRentStroopsByEntry[entryKey] = price;
+    total += BigInt(price);
+  }
+  return {
+    estimate: {
+      estimatedAtLedger,
+      // The shared type carries one number; report the largest target when
+      // they differ, and the per-entry prices below are authoritative.
+      extendToLedgers: uniform ?? Math.max(...byTarget.keys(), 0),
+      estimatedRentStroopsByEntry,
+      totalEstimatedRentStroops: total.toString()
+    },
+    excluded
+  };
+}
+function stroopsToXlm(stroops) {
+  const value = BigInt(stroops);
+  const whole = value / 10000000n;
+  const fraction = (value % 10000000n).toString().padStart(7, "0");
+  return `${whole.toString()}.${fraction}`;
+}
+
+// ../core/dist/rent-quoter.js
+import { Account, Keypair as Keypair2, Operation, SorobanDataBuilder, TransactionBuilder as TransactionBuilder2, rpc as rpc3, xdr as xdr5 } from "@stellar/stellar-sdk";
+var NO_OP_TARGET = 1;
+function createSimulatingQuoter(server, options) {
+  const sourceAccountId = options.sourceAccountId ?? Keypair2.random().publicKey();
+  async function simulateFee(entryKey, extendTo) {
+    const source = new Account(sourceAccountId, "0");
+    const sorobanData = new SorobanDataBuilder().setReadOnly([xdr5.LedgerKey.fromXDR(entryKey, "base64")]).build();
+    const tx = new TransactionBuilder2(source, {
+      fee: "100",
+      networkPassphrase: options.networkPassphrase
+    }).addOperation(Operation.extendFootprintTtl({ extendTo })).setSorobanData(sorobanData).setTimeout(30).build();
+    const simulated = await server.simulateTransaction(tx);
+    if (rpc3.Api.isSimulationError(simulated)) {
+      throw new Error(`Simulation refused to price this entry: ${simulated.error}`);
+    }
+    return BigInt(simulated.minResourceFee ?? "0");
+  }
+  async function quoteOne(entryKey, extendToLedgers) {
+    const baseline = await simulateFee(entryKey, NO_OP_TARGET);
+    const atTarget = await simulateFee(entryKey, extendToLedgers);
+    const rent = atTarget > baseline ? atTarget - baseline : 0n;
+    return {
+      entryKey,
+      estimatedRentStroops: rent.toString(),
+      minResourceFeeStroops: atTarget.toString(),
+      baselineFeeStroops: baseline.toString()
+    };
+  }
+  async function quoteDetailed(args) {
+    const out = [];
+    for (const entryKey of args.entryKeys) {
+      out.push(await quoteOne(entryKey, args.extendToLedgers));
+    }
+    return out;
+  }
+  return {
+    quoteDetailed,
+    quote: (args) => quoteDetailed(args)
+  };
+}
+
+// ../core/dist/scan-contract.js
+import { Address as Address3, xdr as xdr6 } from "@stellar/stellar-sdk";
+var MAX_KEYS_PER_READ = 200;
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function ledger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 4294967295;
+}
+function isCanonicalBase64(text) {
+  try {
+    return btoa(atob(text)) === text;
+  } catch {
+    return false;
+  }
+}
+function parseKey(value) {
+  if (typeof value !== "string")
+    throw new Error("Invalid ledger key");
+  const text = value.trim();
+  if (!text || !isCanonicalBase64(text))
+    throw new Error("Invalid ledger key");
+  const key = xdr6.LedgerKey.fromXDR(text, "base64");
+  if (key.toXDR("base64") !== text)
+    throw new Error("Invalid ledger key");
+  return key;
+}
+function payloadKey(value) {
+  if (value.type === "contractData") {
+    const data = value.contractData;
+    return xdr6.LedgerKey.contractData(new xdr6.LedgerKeyContractData({
+      contract: data.contract,
+      key: data.key,
+      durability: data.durability
+    })).toXDR("base64");
+  }
+  if (value.type === "contractCode")
+    return codeKey(value.contractCode.hash.value);
+  throw new Error("Unsupported entry type");
+}
+function scanContract(reader, contract, dataKeys = [], options = {}) {
+  return scanContracts(reader, [{ contract, dataKeys, ...options }]);
+}
+async function scanContracts(reader, requests) {
+  const entries = {};
+  const issues = [];
+  const supplied = {};
+  const declarations = {};
+  const contracts = /* @__PURE__ */ new Map();
+  const result = {
+    network: "testnet",
+    contracts: [],
+    entries,
+    issues,
+    coverage: { mode: "known-keys", dataKeysSuppliedByContract: supplied }
+  };
+  function issue(kind, message, consumers, key, observedAtLedger) {
+    issues.push({
+      kind,
+      message,
+      contracts: [...new Set(consumers)],
+      ...key === void 0 ? {} : { entryKey: key },
+      ...observedAtLedger === void 0 ? {} : { observedAtLedger }
+    });
+  }
+  const groups = /* @__PURE__ */ new Map();
+  if (!Array.isArray(requests)) {
+    issue("invalid-response", "Scan requests must be an array.", []);
+    return result;
+  }
+  for (const request of requests) {
+    if (!object(request) || !object(request.contract) || typeof request.contract.id !== "string") {
+      issue("invalid-response", "Each scan request must contain a contract ID.", []);
+      continue;
+    }
+    const { contract } = request;
+    const id = request.contract.id;
+    const previous = contracts.get(id);
+    const label = typeof contract.label === "string" ? contract.label : void 0;
+    contracts.set(id, {
+      id,
+      ...previous?.label !== void 0 ? { label: previous.label } : label !== void 0 ? { label } : {}
+    });
+    let instance;
+    try {
+      instance = instanceKey(id);
+    } catch {
+      issue("invalid-response", "Invalid contract ID. Expected a Stellar contract address.", [id]);
+      continue;
+    }
+    let group = groups.get(id);
+    if (!group) {
+      group = { instance, data: /* @__PURE__ */ new Map(), hasData: false, noDataKeys: false, invalid: false };
+      groups.set(id, group);
+    }
+    if (request.noDataKeys !== void 0 && typeof request.noDataKeys !== "boolean") {
+      issue("invalid-response", "noDataKeys must be a boolean caller assertion.", [id]);
+      group.invalid = true;
+    }
+    group.noDataKeys ||= request.noDataKeys === true;
+    const dataKeys = request.dataKeys === void 0 ? [] : request.dataKeys;
+    if (!Array.isArray(dataKeys)) {
+      issue("invalid-response", "dataKeys must be an array of serialized LedgerKeys.", [id]);
+      group.invalid = true;
+      continue;
+    }
+    group.hasData ||= dataKeys.length > 0;
+    for (const input of dataKeys) {
+      try {
+        const key = parseKey(input);
+        if (key.type !== "contractData" || key.contractData.key.type === "scvLedgerKeyContractInstance" || Address3.fromScAddress(key.contractData.contract).toString() !== id)
+          throw new Error("Wrong data key");
+        const durability = key.contractData.durability.name;
+        if (durability !== "persistent" && durability !== "temporary")
+          throw new Error("Wrong durability");
+        group.data.set(key.toXDR("base64"), durability);
+      } catch {
+        issue("invalid-response", "Invalid data key: expected persistent/temporary ContractData for this contract.", [id]);
+      }
+    }
+  }
+  const instances = /* @__PURE__ */ new Map();
+  const data = /* @__PURE__ */ new Map();
+  function expectEntry(target, key, kind, id) {
+    const existing = target.get(key);
+    if (!existing)
+      target.set(key, { kind, contracts: [id] });
+    else if (!existing.contracts.includes(id))
+      existing.contracts.push(id);
+  }
+  for (const [id, group] of groups) {
+    supplied[id] = group.data.size;
+    if (group.noDataKeys)
+      declarations[id] = true;
+    if (group.noDataKeys && group.hasData) {
+      issue("invalid-response", "Cannot declare no data keys while supplying data keys for the same contract.", [id]);
+      group.invalid = true;
+    }
+    if (group.invalid)
+      continue;
+    expectEntry(instances, group.instance, "instance", id);
+    for (const [key, kind] of group.data)
+      expectEntry(data, key, kind, id);
+  }
+  async function read(expected) {
+    const decoded = /* @__PURE__ */ new Map();
+    const keys = [...expected.keys()];
+    for (let start = 0; start < keys.length; start += MAX_KEYS_PER_READ) {
+      const batch = keys.slice(start, start + MAX_KEYS_PER_READ);
+      const consumers = [...new Set(batch.flatMap((key) => expected.get(key).contracts))];
+      let response;
+      try {
+        response = await reader.read(batch);
+      } catch {
+        issue("rpc-error", "RPC read failed for a batch; retry the scan. Successful batches are retained.", consumers);
+        continue;
+      }
+      if (!object(response) || !ledger(response.latestLedger) || !Array.isArray(response.entries)) {
+        issue("invalid-response", "RPC response must contain a valid latestLedger and entries array.", consumers);
+        continue;
+      }
+      const observedAtLedger = response.latestLedger;
+      const seen = /* @__PURE__ */ new Set();
+      const requested = new Set(batch);
+      for (const row of response.entries) {
+        let key;
+        try {
+          if (!object(row))
+            throw new Error("Invalid row");
+          key = parseKey(row.key).toXDR("base64");
+        } catch {
+          issue("invalid-response", "RPC returned a malformed ledger key.", consumers, void 0, observedAtLedger);
+          continue;
+        }
+        if (!requested.has(key)) {
+          issue("invalid-response", "RPC returned an unrequested entry.", consumers, void 0, observedAtLedger);
+          continue;
+        }
+        if (seen.has(key)) {
+          delete entries[key];
+          decoded.delete(key);
+          issue("invalid-response", "RPC returned a duplicate entry; its observation was discarded.", expected.get(key).contracts, key, observedAtLedger);
+          continue;
+        }
+        seen.add(key);
+        try {
+          if (!object(row) || typeof row.entryXdr !== "string" || row.liveUntilLedgerSeq !== void 0 && !ledger(row.liveUntilLedgerSeq))
+            throw new Error("Invalid row");
+          const value = xdr6.LedgerEntryData.fromXDR(row.entryXdr, "base64");
+          if (value.toXDR("base64") !== row.entryXdr || payloadKey(value) !== key)
+            throw new Error("Mismatched payload");
+          const kind = expected.get(key)?.kind;
+          if (kind === void 0)
+            throw new Error("Unexpected key");
+          if (kind === "instance" && (value.type !== "contractData" || value.contractData.val.type !== "scvContractInstance")) {
+            throw new Error("Invalid instance payload");
+          }
+          const lifecycle = kind === "temporary" ? { kind, endBehavior: "deleted" } : {
+            kind,
+            endBehavior: "archived"
+          };
+          entries[key] = {
+            ...lifecycle,
+            contracts: [...expected.get(key).contracts],
+            observedAtLedger,
+            ttl: observeTTL({ liveUntilLedgerSeq: row.liveUntilLedgerSeq, observedAtLedger })
+          };
+          decoded.set(key, value);
+        } catch {
+          issue("invalid-response", "RPC entry payload or TTL is invalid or does not match its requested key.", expected.get(key).contracts, key, observedAtLedger);
+        }
+      }
+      for (const key of batch) {
+        if (!seen.has(key))
+          issue("entry-not-found", "No entry returned. Absence is not proof of archival or deletion.", expected.get(key).contracts, key, observedAtLedger);
+      }
+    }
+    return decoded;
+  }
+  const observed = await read(instances);
+  for (const [instance] of instances) {
+    const instanceValue = observed.get(instance);
+    if (!instanceValue)
+      continue;
+    if (instanceValue.type !== "contractData" || instanceValue.contractData.val.type !== "scvContractInstance")
+      continue;
+    const executable = instanceValue.contractData.val.instance.executable;
+    const consumers = instances.get(instance).contracts;
+    if (executable.type === "contractExecutableWasm") {
+      for (const id of consumers)
+        expectEntry(data, codeKey(executable.wasmHash.value), "code", id);
+    } else {
+      issue("unsupported-executable", "Instance has a non-Wasm executable; this scanner does not discover its code.", consumers, instance, entries[instance]?.observedAtLedger);
+    }
+  }
+  await read(data);
+  return {
+    ...result,
+    contracts: [...contracts.values()],
+    coverage: {
+      mode: "known-keys",
+      dataKeysSuppliedByContract: supplied,
+      ...Object.keys(declarations).length ? { noDataKeysDeclaredByContract: declarations } : {}
+    }
+  };
+}
+
+// ../core/dist/extend-rpc.js
+import { Account as Account2, Networks as Networks3, Operation as Operation2, SorobanDataBuilder as SorobanDataBuilder2, StrKey as StrKey2, Transaction as Transaction2, TransactionBuilder as TransactionBuilder3, rpc as rpc4, xdr as xdr7 } from "@stellar/stellar-sdk";
+async function prepareExtension(server, entry, sourceAccount) {
+  if (!StrKey2.isValidEd25519PublicKey(sourceAccount) || entry.skip)
+    throw new Error("Invalid extension payer or no-op");
+  if ((await server.getNetwork()).passphrase !== Networks3.TESTNET)
+    throw new Error("RPC is not Stellar Testnet");
+  const account = await server.getAccount(sourceAccount);
+  if (account.accountId() !== sourceAccount)
+    throw new Error("RPC returned another payer");
+  const tx = new TransactionBuilder3(new Account2(sourceAccount, account.sequenceNumber()), {
+    fee: "100",
+    networkPassphrase: Networks3.TESTNET
+  }).addOperation(Operation2.extendFootprintTtl({ extendTo: entry.extendToLedgers })).setSorobanData(new SorobanDataBuilder2().setReadOnly([extensionKey(entry.entryKey)]).build()).setTimeout(60).build();
+  const simulation = await server.simulateTransaction(tx);
+  if (!rpc4.Api.isSimulationSuccess(simulation) || "restorePreamble" in simulation || typeof simulation.minResourceFee !== "string" || !/^\d+$/.test(simulation.minResourceFee) || !Number.isSafeInteger(simulation.latestLedger) || simulation.latestLedger < entry.before.observedAtLedger || simulation.latestLedger > entry.before.endsAtLedger || simulation.transactionData.build().resourceFee !== BigInt(simulation.minResourceFee))
+    throw new Error("Extension simulation failed or returned invalid resources");
+  const prepared = rpc4.assembleTransaction(tx, simulation).build();
+  const transactionXdr = prepared.toXDR();
+  const transactionHash = Buffer.from(prepared.hash()).toString("hex");
+  validateExtensionEnvelope(transactionXdr, {
+    sourceAccount,
+    entryKey: entry.entryKey,
+    extendToLedgers: entry.extendToLedgers,
+    expectedHash: transactionHash,
+    maxFeeStroops: prepared.fee
+  });
+  return {
+    entry,
+    sourceAccount,
+    transactionXdr,
+    transactionHash,
+    feeStroops: prepared.fee,
+    simulatedAtLedger: simulation.latestLedger
+  };
+}
+async function confirmExtension(server, hash, options = {}) {
+  const attempts = options.attempts ?? 12;
+  if (!Number.isSafeInteger(attempts) || attempts < 1 || attempts > 60)
+    throw new Error("Invalid confirmation bound");
+  for (let i = 0; i < attempts; i++) {
+    const response = await server.getTransaction(hash);
+    if (response.txHash !== hash)
+      throw new Error("Transaction confirmation hash mismatch");
+    if (response.status === "SUCCESS" || response.status === "FAILED") {
+      if (!response.envelopeXdr)
+        throw new Error("Missing transaction confirmation envelope");
+      const transaction = TransactionBuilder3.fromXDR(response.envelopeXdr.toXDR("base64"), Networks3.TESTNET);
+      if (Buffer.from(transaction.hash()).toString("hex") !== hash)
+        throw new Error("Transaction confirmation envelope hash mismatch");
+    }
+    if (response.status === "FAILED")
+      return { status: "failed" };
+    if (response.status === "SUCCESS") {
+      if (!Number.isSafeInteger(response.ledger) || response.ledger <= 0)
+        throw new Error("Invalid inclusion ledger");
+      return { status: "confirmed", ledger: response.ledger };
+    }
+    if (response.status !== "NOT_FOUND")
+      throw new Error("Unknown transaction status");
+    if (i + 1 < attempts)
+      await (options.sleep ?? (() => new Promise((resolve) => setTimeout(resolve, 1e3))))();
+  }
+  return { status: "unconfirmed" };
+}
+async function submitExtension(server, prepared, signedXdr) {
+  const signed = TransactionBuilder3.fromXDR(signedXdr, Networks3.TESTNET);
+  if (!(signed instanceof Transaction2) || signed.source !== prepared.sourceAccount || Buffer.from(signed.hash()).toString("hex") !== prepared.transactionHash || signed.signatures.length !== 1)
+    throw new Error("Signed envelope differs from the prepared transaction");
+  if ((await server.getNetwork()).passphrase !== Networks3.TESTNET)
+    throw new Error("RPC is not Stellar Testnet");
+  const response = await server.sendTransaction(signed);
+  if (response.hash !== prepared.transactionHash)
+    throw new Error("Submission hash mismatch");
+  return response;
+}
+
+// ../core/dist/optimizer-evidence.js
+var STORAGE_ADVICE_EVIDENCE = {
+  rent: {
+    id: "guinea-pig-a-2026-09-09",
+    recordedAt: "2026-09-09T10:58:52Z",
+    source: "https://github.com/Fatihmaull/evergreen/blob/main/packages/core/test/fixtures/extendTTL-fees-guinea-pig-a.json",
+    persistent: {
+      rentStroops: "103849",
+      totalFeeStroops: "106308",
+      dataBytes: 88,
+      keyBytes: 76,
+      ledgersExtended: 1312937
+    },
+    temporary: {
+      rentStroops: "53196",
+      totalFeeStroops: "55655",
+      dataBytes: 88,
+      keyBytes: 76,
+      ledgersExtended: 1312939
+    },
+    qualification: "Historical measured rent at equal encoded sizes over durations differing by two ledgers; not a quote or savings forecast for this entry."
+  },
+  settings: {
+    recordedOn: "2026-09-05",
+    observedAtLedger: 4519665,
+    minTemporaryTtl: 720,
+    minPersistentTtl: 120960,
+    source: "https://github.com/Fatihmaull/evergreen/blob/main/docs/evidence/2026-09-05-ttl-boundary/state-archival-settings.json"
+  },
+  deletion: {
+    recordedOn: "2026-09-06",
+    subject: "isolated temporary-entry experiment",
+    lastLiveLedger: 4529810,
+    firstAbsentLedger: 4529811,
+    source: "https://github.com/Fatihmaull/evergreen/blob/main/docs/evidence/2026-09-06-ttl-boundary/README.md"
+  }
+};
+
+// ../core/dist/optimizer.js
+function ledger2(value) {
+  return Number.isSafeInteger(value) && value >= 0 && value <= 4294967295;
+}
+function lifetime(value) {
+  return ledger2(value) && value > 0;
+}
+function analyzeStorage(scan, context = {}) {
+  if (scan.network !== "testnet")
+    throw new Error("Storage advice requires Testnet observations");
+  const limitations = [
+    "Only observed keys were analyzed; storage was not enumerated. No size, duplicate-content or global-consumer inference is supported.",
+    "Advice is conditional on application requirements; it does not authorize a transaction or change scan health exits."
+  ];
+  const settings = context.settings;
+  const validSettings = settings != null && lifetime(settings.minTemporaryTtl) && lifetime(settings.minPersistentTtl) && ledger2(settings.observedAtLedger);
+  if (!validSettings)
+    limitations.push("Current minimum lifetimes are unavailable. Historical settings below are a dated reference, not current configuration or this entry's expiry.");
+  const quote = context.quote;
+  const validQuote = quote != null && typeof quote.rentByEntry === "object" && quote.rentByEntry !== null && !Array.isArray(quote.rentByEntry) && ledger2(quote.pricedAtLedger) && Number.isSafeInteger(quote.additionalLedgers) && quote.additionalLedgers > 0;
+  const rents = {};
+  if (validQuote) {
+    for (const [key, entry] of Object.entries(scan.entries)) {
+      const amount = quote.rentByEntry[key];
+      if (typeof amount === "string" && /^(0|[1-9]\d*)$/.test(amount) && quote.pricedAtLedger >= entry.observedAtLedger)
+        rents[key] = amount;
+    }
+  }
+  const cleanContext = {
+    ...validSettings ? {
+      settings: {
+        minTemporaryTtl: settings.minTemporaryTtl,
+        minPersistentTtl: settings.minPersistentTtl,
+        observedAtLedger: settings.observedAtLedger
+      }
+    } : {},
+    ...validQuote ? {
+      quote: {
+        rentByEntry: rents,
+        pricedAtLedger: quote.pricedAtLedger,
+        additionalLedgers: quote.additionalLedgers
+      }
+    } : {}
+  };
+  const findings = [];
+  const readIssues = scan.issues.filter((i) => i.kind !== "coverage-limited" && i.kind !== "sharing-undetermined");
+  let unreadable = readIssues.length > 0;
+  for (const [entryKey, entry] of Object.entries(scan.entries)) {
+    if (entry.ttl.status !== "known" || !ledger2(entry.observedAtLedger) || !ledger2(entry.ttl.endsAtLedger) || !Number.isSafeInteger(entry.ttl.remainingLedgers) || entry.ttl.remainingLedgers !== entry.ttl.endsAtLedger - entry.observedAtLedger || readIssues.some((i) => i.entryKey === entryKey)) {
+      unreadable = true;
+      continue;
+    }
+    if (entry.kind === "instance")
+      continue;
+    const base = {
+      entryKey,
+      knownConsumers: [...new Set(entry.contracts)],
+      observedAtLedger: entry.observedAtLedger,
+      ttl: { ...entry.ttl },
+      currentRent: rents[entryKey] === void 0 ? { status: "unavailable" } : { status: "quoted", stroops: rents[entryKey] }
+    };
+    if (entry.kind === "code") {
+      findings.push({
+        ...base,
+        code: "shared-code-dependency",
+        action: "Monitor this code key once with its known consumers; checking their instances alone does not establish protection.",
+        rationale: "Every contract built from the same Wasm uses this code entry. Other consumers may exist outside this scan; sharing is not duplicated storage or a measured saving."
+      });
+    } else if (entry.kind === "temporary") {
+      findings.push({
+        ...base,
+        code: "temporary-retention",
+        benchmarkId: "guinea-pig-a-2026-09-09",
+        action: "Compare the observed TTL with intended retention. If data must survive expiry, evaluate persistent storage in contract source; otherwise permit deliberate expiry.",
+        rationale: "Temporary state is deleted, not archived or restorable. The isolated 2026-09-06 experiment observed the final live ledger and absence at the next ledger; it does not measure this entry's deletion."
+      });
+    } else if (entry.kind === "persistent") {
+      findings.push({
+        ...base,
+        code: "durability-review",
+        benchmarkId: "guinea-pig-a-2026-09-09",
+        action: "Only if this data is disposable or recomputable, evaluate temporary storage in contract source. Keep balances, required configuration and durable state persistent.",
+        rationale: "Historical A persistent rent was about 1.95 times the temporary rent at equal encoded sizes. This is a measured comparison, not guaranteed savings or evidence of equal contents."
+      });
+    }
+  }
+  if (unreadable)
+    limitations.push("Some requested entries are missing or unreadable; they receive no inferred retention or cost advice.");
+  if (findings.some((f) => f.currentRent.status === "unavailable"))
+    limitations.push("Current rent is unavailable for some findings. Use --cost for quotes where supported; historical benchmark amounts are not per-entry quotes.");
+  if (findings.length === 0)
+    limitations.push("No supported recommendation for these observations; this does not mean the contract is fully optimized.");
+  return {
+    scope: "observed-keys-only",
+    context: cleanContext,
+    findings,
+    limitations,
+    evidence: STORAGE_ADVICE_EVIDENCE
+  };
+}
+
+// ../core/dist/engine-execution-plan.js
+import { Address as Address4 } from "@stellar/stellar-sdk";
+
+// src/extend.ts
+var EXTEND_HELP = `usage: evergreen extend <contract-id> --ledgers N
+  [--source-account G...] [--keys-file path] [--include-code] [--json]
+  [--submit --secret-env NAME --max-fee-stroops N]
+--dry-run              simulate only and say so. This is already the default; the flag
+                       exists so a script can state its own safety rather than rely on
+                       an absence. Mutually exclusive with --submit.
+
+Testnet only. Default: simulate, never sign or submit. Supply a public payer
+with --source-account or EVERGREEN_SOURCE_ACCOUNT; there is no fallback payer.
+--ledgers N adds N ledgers to each selected entry's current remaining TTL.
+The operation target is capped at max_entry_ttl - 1; capping is reported.
+Selects instance by default. A keys file adds explicit data keys:
+{ "dataKeys": ["base64 XDR LedgerKey", ...] }. Storage is not enumerated.
+--include-code explicitly includes Wasm shared with potentially unseen consumers.
+--submit requires an exported secret variable NAME and an aggregate fee cap in
+integer stroops. Never put the secret itself in arguments. No .env auto-loading.
+No automatic restore or funding. No replacement send after uncertain results.
+Exit 0: complete simulation, no-op, or verified live result; 2: error or partial/
+unconfirmed result. Simulation success does not mean TTL changed.`;
+function extensionPreview(p) {
+  return `Selected ${p.entry.kind} ${p.entry.entryKey}
+Known consumers: ${p.entry.contracts.join(", ")}
+Payer: ${p.sourceAccount}
+Prepared hash (not yet sent): ${p.transactionHash}
+Before: ledger ${p.entry.before.observedAtLedger}, live until ${p.entry.before.endsAtLedger}
+Target remaining: ${p.entry.extendToLedgers}${p.entry.wasCapped ? " (CAPPED)" : ""}; prepared fee cap: ${p.feeStroops} stroops
+Selected scope only. Code may have consumers outside this scan.`;
+}
+async function runExtendCli(args, deps) {
+  const fail = (message) => ({ stdout: "", stderr: message, exitCode: 2 });
+  if (args.length === 2 && args[1] === "--help")
+    return { stdout: EXTEND_HELP, stderr: "", exitCode: 0 };
+  const contractId = args[1];
+  if (args[0] !== "extend" || !contractId || !isValidContractId(contractId))
+    return fail("Expected a valid contract ID.\n" + EXTEND_HELP);
+  const values = /* @__PURE__ */ new Map();
+  const flags = /* @__PURE__ */ new Set();
+  const valueOptions = /* @__PURE__ */ new Set([
+    "--ledgers",
+    "--source-account",
+    "--keys-file",
+    "--secret-env",
+    "--max-fee-stroops"
+  ]);
+  for (let i = 2; i < args.length; i++) {
+    const arg = args[i];
+    if (values.has(arg) || flags.has(arg)) return fail("Repeated extend option.");
+    if (valueOptions.has(arg)) {
+      const value = args[++i];
+      if (!value || value.startsWith("-")) return fail("Missing extend option value.");
+      values.set(arg, value);
+    } else if (["--submit", "--dry-run", "--json", "--include-code"].includes(arg)) flags.add(arg);
+    else return fail("Unknown or conflicting extend option.\n" + EXTEND_HELP);
+  }
+  const rawLedgers = values.get("--ledgers") ?? "";
+  const additionalLedgers = Number(rawLedgers);
+  const sourceAccount = values.get("--source-account") ?? deps.sourceAccount;
+  if (flags.has("--submit") && flags.has("--dry-run"))
+    return fail(
+      "--submit and --dry-run are mutually exclusive.\n  Dry-run is already the default; drop --dry-run to submit, or drop --submit to simulate."
+    );
+  const submit = flags.has("--submit");
+  const secretEnv = values.get("--secret-env");
+  const maxFeeStroops = values.get("--max-fee-stroops");
+  if (!/^[1-9]\d*$/.test(rawLedgers) || !Number.isSafeInteger(additionalLedgers))
+    return fail("--ledgers needs a positive safe integer.");
+  if (!sourceAccount || !isValidPayerAccount(sourceAccount))
+    return fail("A valid public payer is required (--source-account or EVERGREEN_SOURCE_ACCOUNT).");
+  if (maxFeeStroops !== void 0 && !/^[1-9]\d*$/.test(maxFeeStroops) || submit && (!secretEnv || !maxFeeStroops) || !submit && secretEnv !== void 0 || secretEnv !== void 0 && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(secretEnv))
+    return fail(
+      "--submit requires --secret-env NAME and --max-fee-stroops N; secret selection is live-only."
+    );
+  let dataKeys = [];
+  const keysPath = values.get("--keys-file");
+  if (keysPath !== void 0) {
+    try {
+      const parsed = JSON.parse(await deps.readKeysFile(keysPath));
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || !("dataKeys" in parsed) || !Array.isArray(parsed.dataKeys) || parsed.dataKeys.some((k) => typeof k !== "string"))
+        return fail("Invalid keys file: expected dataKeys string array.");
+      dataKeys = parsed.dataKeys;
+    } catch {
+      return fail("Unable to read a valid keys file.");
+    }
+  }
+  try {
+    const report = await deps.run(
+      {
+        contractId,
+        additionalLedgers,
+        sourceAccount,
+        dataKeys,
+        includeCode: flags.has("--include-code"),
+        submit,
+        ...secretEnv === void 0 ? {} : { secretEnv },
+        ...maxFeeStroops === void 0 ? {} : { maxFeeStroops }
+      },
+      (text) => deps.preview?.(text)
+    );
+    const stdout = flags.has("--json") ? JSON.stringify(report, null, 2) : [
+      `Mode: ${report.result.mode}. ${report.result.ok ? "Complete" : "Incomplete"}.`,
+      ...report.plan.warnings,
+      ...report.previews.map(extensionPreview),
+      ...report.result.records.map(
+        (r) => `${r.entryKey}: ${r.outcome}${"transactionHash" in r && r.transactionHash ? ` (${r.transactionHash})` : ""}`
+      ),
+      ...report.result.skipped.map((k) => `${k}: no-op (target already satisfied)`),
+      ...report.result.unattempted.map((k) => `${k}: not attempted`),
+      "A submitted/unconfirmed hash must be reconciled before retrying; no automatic replacement was sent."
+    ].join("\n");
+    return {
+      stdout,
+      stderr: report.result.ok ? "" : "Extension incomplete. Inspect per-entry outcomes and reconcile any submitted hash before retrying.",
+      exitCode: report.result.ok ? 0 : 2
+    };
+  } catch (error) {
+    if (error instanceof ProtectedEntryError) return fail(error.message);
+    return fail(
+      "Extension preparation failed. Check Testnet RPC, selected live keys, public payer and network configuration. No raw provider details are printed."
+    );
+  }
+}
+
+// src/optimizer.ts
+function formatStorageAdvice(report) {
+  const lines = ["Storage advice \u2014 observed keys only"];
+  const settings = report.context.settings;
+  if (settings) {
+    lines.push(
+      `Network minimum lifetimes at ledger ${settings.observedAtLedger}: temporary ${settings.minTemporaryTtl}, persistent ${settings.minPersistentTtl} ledgers.`
+    );
+  } else {
+    const old = report.evidence.settings;
+    lines.push(
+      `Historical minimum lifetimes (${old.recordedOn}, ledger ${old.observedAtLedger}; not current configuration): temporary ${old.minTemporaryTtl}, persistent ${old.minPersistentTtl} ledgers.`,
+      `Source: ${old.source}`
+    );
+  }
+  lines.push(
+    "Minimum lifetime includes the current ledger; it is not the expiry of an already-existing entry."
+  );
+  for (const finding of report.findings) {
+    lines.push(
+      "",
+      `${finding.code}: ${finding.entryKey}`,
+      `Known consumers: ${finding.knownConsumers.join(", ")}`,
+      `Action: ${finding.action}`,
+      `Why: ${finding.rationale}`
+    );
+    if (finding.ttl.status === "known")
+      lines.push(
+        `Observed at ledger ${finding.observedAtLedger}: ${finding.ttl.remainingLedgers} remaining; last live ledger ${finding.ttl.endsAtLedger}.`
+      );
+    if (finding.currentRent.status === "quoted") {
+      const quote = report.context.quote;
+      lines.push(
+        `Current rent quote: ${finding.currentRent.stroops} stroops; pricing context ledger ${quote.pricedAtLedger}, requested increment ${quote.additionalLedgers}. Estimate, not a price guarantee; excludes other transaction fees.`
+      );
+    } else lines.push("Current rent: unavailable (not zero).");
+  }
+  if (report.findings.some((f) => f.benchmarkId !== void 0)) {
+    const benchmark = report.evidence.rent;
+    lines.push(
+      "",
+      `Historical A benchmark (${benchmark.recordedAt}): persistent rent ${benchmark.persistent.rentStroops} versus temporary rent ${benchmark.temporary.rentStroops} stroops; about 1.95x.`,
+      benchmark.qualification,
+      `Source: ${benchmark.source}`
+    );
+  }
+  if (report.findings.some((f) => f.code === "temporary-retention")) {
+    const deletion = report.evidence.deletion;
+    lines.push(
+      `Observed deletion reference: ${deletion.subject} (${deletion.recordedOn}); present at ${deletion.lastLiveLedger}, absent at ${deletion.firstAbsentLedger}.`,
+      `Source: ${deletion.source}`
+    );
+  }
+  lines.push("", ...report.limitations.map((note) => `Limit: ${note}`));
+  return lines;
+}
+
+// src/cost.ts
+function approximateXlm(stroops) {
+  const exact = Number(stroopsToXlm(stroops));
+  if (exact === 0) return "0 XLM";
+  const magnitude = Math.floor(Math.log10(Math.abs(exact)));
+  const factor = 10 ** (magnitude - 1);
+  const rounded = Math.round(exact / factor) * factor;
+  const decimals = Math.max(0, 1 - magnitude);
+  return `about ${rounded.toFixed(decimals)} XLM`;
+}
+function formatCost(cost) {
+  const lines = [];
+  const entries = `${cost.entryCount} entr${cost.entryCount === 1 ? "y" : "ies"}`;
+  lines.push(`Cost to extend ${entries} by ${formatCount(cost.additionalLedgers)} more ledgers`);
+  lines.push(
+    `  total   ${approximateXlm(cost.totalStroops)}  (${formatCount(Number(cost.totalStroops))} stroops) \u2014 what leaves the account`
+  );
+  lines.push(
+    `    rent  ${approximateXlm(cost.rentStroops)}  (${formatCount(Number(cost.rentStroops))} stroops)`
+  );
+  lines.push(
+    `    fees  ${approximateXlm(cost.otherStroops)}  (${formatCount(Number(cost.otherStroops))} stroops) \u2014 non-refundable resource + base fee`
+  );
+  const rentEntries = Object.entries(cost.rentByEntry);
+  if (rentEntries.length > 1) {
+    const [topKey, topRent] = rentEntries.reduce((a, b) => BigInt(b[1]) > BigInt(a[1]) ? b : a);
+    const share = Number(BigInt(topRent) * 100n / (BigInt(cost.rentStroops) || 1n));
+    if (share >= 60) {
+      lines.push("");
+      lines.push(
+        `  ${share}% of that rent is one entry (${topKey.slice(0, 10)}\u2026). Code entries hold the`
+      );
+      lines.push(
+        "  Wasm and are usually the expensive one \u2014 and the one shared between contracts."
+      );
+    }
+  }
+  lines.push("");
+  lines.push(
+    `  Priced by simulating against the network at ledger ${formatCount(cost.pricedAtLedger)}.`
+  );
+  lines.push("  Rent pricing varies with network state \u2014 a quote taken on another day has");
+  lines.push("  differed by ~18%. This is an estimate to budget against, not a quoted price.");
+  if (cost.cappedEntryCount > 0) {
+    lines.push("");
+    lines.push(
+      `  \u26A0 ${cost.cappedEntryCount} entr${cost.cappedEntryCount === 1 ? "y was" : "ies were"} CAPPED at the operation maximum of ${formatCount(cost.maxEntryTtl - 1)} ledgers`
+    );
+    lines.push("    (~180 days). Those entries get less than requested; the price above reflects");
+    lines.push("    the capped extension, not the request.");
+  }
+  lines.push("");
+  lines.push("  Targets are computed from TTL read now, and the ledger advances before");
+  lines.push("  submission. Two consequences, in opposite directions:");
+  lines.push("    \xB7 REMAINING TTL, measured after inclusion, lands a few ledgers UNDER target");
+  lines.push("    \xB7 ABSOLUTE EXPIRY moves a few ledgers PAST the request (+N plus the gap)");
+  return lines;
+}
+
+// src/scan.ts
+var ANSI = {
+  healthy: "\x1B[32m",
+  warning: "\x1B[33m",
+  critical: "\x1B[31m",
+  unknown: "\x1B[35m"
+};
+var RESET = "\x1B[0m";
+function paint(health, text, color) {
+  return color ? `${ANSI[health]}${text}${RESET}` : text;
+}
+var LABEL = {
+  healthy: "HEALTHY",
+  warning: "WARNING",
+  critical: "CRITICAL",
+  unknown: "UNKNOWN"
+};
+var EXIT_OK = 0;
+var EXIT_BELOW_THRESHOLD = 1;
+var EXIT_ERROR = 2;
+var EXIT_INCOMPLETE = 3;
+var DEFAULT_THRESHOLD_LEDGERS = 17280;
+function tiers(thresholdLedgers) {
+  return resolveHealthThresholds({ bumpWhenRemainingLedgersBelow: thresholdLedgers });
+}
+function healthReport(result, thresholdLedgers) {
+  const thresholds = tiers(thresholdLedgers);
+  const byEntry = {};
+  for (const [key, entry] of Object.entries(result.entries)) {
+    byEntry[key] = assessEntryWithThresholds(entry, thresholds);
+  }
+  const assessments = Object.values(byEntry);
+  const worst = worstHealth(assessments);
+  return {
+    thresholdLedgers,
+    warnBelowLedgers: thresholds.warnBelowLedgers,
+    ...worst === void 0 ? {} : { worst },
+    sharedEntryCount: assessments.filter((a) => a.sharingStatus === "shared").length,
+    undeterminedSharingCount: assessments.filter((a) => a.sharingStatus === "undetermined").length,
+    byEntry
+  };
+}
+function formatHuman(result, now, options = {}) {
+  const color = options.color === true;
+  const thresholdLedgers = options.thresholdLedgers ?? DEFAULT_THRESHOLD_LEDGERS;
+  const lines = [];
+  const entries = Object.entries(result.entries);
+  const assessments = [];
+  const caveats = coverageIssues(result);
+  if (result.contracts.length > 0) {
+    lines.push(
+      `Scanned ${result.contracts.length} contract(s): ${result.contracts.map((c) => c.id).join(", ")}`
+    );
+  }
+  if (result.coverage) {
+    lines.push("Coverage: known keys only \u2014 contract storage has NOT been fully enumerated.");
+    for (const [contract, count] of Object.entries(result.coverage.dataKeysSuppliedByContract)) {
+      lines.push(`  ${contract}: ${count} explicit data key(s)`);
+      if (result.coverage.noDataKeysDeclaredByContract?.[contract] === true) {
+        lines.push("  No additional data keys declared by caller; not independently verified.");
+      }
+    }
+    for (const caveat of caveats) {
+      if (caveat.kind !== "coverage-limited") continue;
+      lines.push(`  ${caveat.message}`);
+    }
+    lines.push("");
+  } else {
+    lines.push("Coverage: unspecified by producer; health assessment is incomplete.", "");
+  }
+  if (entries.length === 0 && result.issues.length === 0) {
+    return [...lines, "No ledger entries found."].join("\n");
+  }
+  for (const [key, entry] of entries) {
+    const live = isLive(entry.ttl);
+    const assessment = assessEntryWithThresholds(entry, tiers(thresholdLedgers));
+    assessments.push(assessment);
+    const shortKey = `${key.slice(0, 10)}\u2026`;
+    lines.push(
+      `${paint(assessment.health, LABEL[assessment.health], color)}  ${entry.kind}  ${shortKey}`
+    );
+    lines.push(`  contracts:  ${entry.contracts.join(", ")}`);
+    if (assessment.sharingStatus === "shared") {
+      const others = assessment.observedContractCount - 1;
+      lines.push(
+        `  \u26A0 shared:   this ${entry.kind} entry is shared with ${others} other contract${others === 1 ? "" : "s"} \u2014 they fail together`
+      );
+    } else if (assessment.sharingStatus === "undetermined") {
+      lines.push(
+        "  \u26A0 sharing:  code entries are shared by every contract built from the same Wasm."
+      );
+      lines.push(
+        `              This scan saw ${assessment.observedContractCount}. Whether others depend on this entry cannot be`
+      );
+      lines.push("              determined from a single-contract scan \u2014 pass them together.");
+    }
+    if (entry.ttl.status === "unavailable") {
+      lines.push("  ttl:        no TTL metadata returned; health is unknown");
+    } else {
+      const state = live ? "live" : `EXPIRED (${entry.endBehavior})`;
+      lines.push(`  remaining:  ${formatCount(entry.ttl.remainingLedgers)} ledgers \u2014 ${state}`);
+      lines.push(`  ends at:    ledger ${formatCount(entry.ttl.endsAtLedger)}`);
+      const at = estimateEndsAt(entry.ttl, now);
+      if (at) lines.push(`  expires ~:  ${at.toISOString()} (estimate \u2014 ledgers are the truth)`);
+    }
+    lines.push(`  observed:   ledger ${formatCount(entry.observedAtLedger)}`);
+    lines.push(`  health:     ${LABEL[assessment.health]} \u2014 ${assessment.reason}`);
+    lines.push("");
+  }
+  for (const issue of result.issues) {
+    lines.push(`! ${issue.kind}: ${issue.message}`);
+    lines.push(`  contracts: ${issue.contracts.join(", ")}`);
+    if (issue.kind === "entry-not-found") {
+      lines.push("  This means one of two things, and a scan cannot distinguish them:");
+      lines.push("    \xB7 the entry was ARCHIVED \u2014 restore it with RestoreFootprintOp, or");
+      lines.push("    \xB7 it never existed \u2014 check the contract ID and that it is deployed here.");
+    }
+    lines.push("");
+  }
+  const worst = worstHealth(assessments);
+  if (worst !== void 0) {
+    const shared = assessments.filter((a) => a.sharingStatus === "shared").length;
+    lines.push(
+      `Worst entry health: ${paint(worst, LABEL[worst], color)} (warn below ${formatCount(tiers(thresholdLedgers).warnBelowLedgers)} \xB7 act below ${formatCount(thresholdLedgers)} ledgers)` + (shared > 0 ? ` \xB7 ${shared} shared entr${shared === 1 ? "y" : "ies"}` : "")
+    );
+  }
+  if (result.issues.length > 0) {
+    lines.push(`Scan is PARTIAL \u2014 ${result.issues.length} issue(s). Absence is not health.`);
+  }
+  return lines.join("\n").trimEnd();
+}
+function scanIsDegraded(result) {
+  return Object.keys(result.entries).length === 0 || result.issues.some(
+    (i) => i.kind === "entry-not-found" || i.kind === "unsupported-executable"
+  ) || Object.values(result.entries).some((e) => e.ttl.status === "unavailable");
+}
+function scopeIsUndeclared(result) {
+  if (!result.coverage || result.contracts.length === 0) return true;
+  return result.contracts.some((c) => {
+    const count = result.coverage?.dataKeysSuppliedByContract[c.id];
+    const empty = result.coverage?.noDataKeysDeclaredByContract?.[c.id] === true;
+    if (count === void 0 || !Number.isInteger(count) || count < 0) return true;
+    return count === 0 ? !empty : empty;
+  });
+}
+function exitCodeFor(result, thresholdLedgers, options = {}) {
+  if (result.issues.some((i) => i.kind === "rpc-error" || i.kind === "invalid-response"))
+    return EXIT_ERROR;
+  if (scanIsDegraded(result)) return EXIT_INCOMPLETE;
+  if (options.requireDeclaredScope === true && scopeIsUndeclared(result)) return EXIT_INCOMPLETE;
+  for (const entry of Object.values(result.entries)) {
+    if (entry.ttl.status === "unavailable") continue;
+    if (needsAction(entry.ttl.remainingLedgers, thresholdLedgers)) return EXIT_BELOW_THRESHOLD;
+  }
+  return EXIT_OK;
+}
+
+// src/command.ts
+var DEFAULT_EXTEND_LEDGERS = 518400;
+var USAGE = "usage: evergreen scan <contract-id> [<contract-id> ...] [--keys-file <path> | --no-data-keys] [--require-declared-scope] [--threshold N] [--json] [--cost [--ledgers N]] [--optimize]";
+var HELP = `${USAGE}
+
+Reads instance/Wasm and supplied persistent/temporary keys on Stellar Testnet.
+Keys file: { "dataKeys": ["base64 XDR LedgerKey", ...] }
+
+PASS SEVERAL CONTRACTS TOGETHER to see real shared-code blast radius. Contracts
+built from the same Wasm share ONE ContractCode ledger entry, and a scan of one
+contract cannot tell whether others depend on it \u2014 the chain does not index
+reverse dependencies from a single query, so that entry reports "sharing
+undetermined". Naming them together resolves it:
+
+  evergreen scan <A>              code entry: 1 consumer, sharing UNDETERMINED
+  evergreen scan <A> <B> <C>      code entry: 3 consumers, SHARED, they fail together
+
+Every scan prints which contracts it actually scanned, so a mistyped or dropped
+argument is visible rather than inferred. --keys-file takes exactly one contract,
+because data keys belong to a specific contract and the file does not say which.
+
+Exit: 0 everything scanned is healthy; 1 observed low TTL; 2 error;
+      3 the scan came back incomplete (entry missing, TTL unavailable,
+        executable not followable, or nothing observed).
+Precedence: 2 > 3 > 1 > 0. Exit status never authorizes a transaction.
+
+Scanning reads the keys it is given; it cannot enumerate a contract's storage,
+so a clean exit means "everything I was asked to check is healthy" and never
+"this contract is fully healthy". Coverage is printed with every scan.
+
+--threshold N         act-now threshold in LEDGERS, default 17,280 (~1 day).
+                      What evergreen-check sets in CI: a repository that wants
+                      a week of warning fails its build at 120,960, not at ours.
+                      Both health tiers move with it \u2014 WARNING widens as the
+                      action threshold rises, so raising it never silently
+                      narrows the earlier warning. Exit 1 means an entry is at
+                      or below this value; the boundary is inclusive, because
+                      remaining exactly N is already the margin you set out to
+                      keep. Changes what is REPORTED and never what is written.
+
+--no-data-keys        assert this contract has no data keys beyond its instance.
+                      Only its author can know that; it is a caller declaration
+                      and is never independently verified.
+--require-declared-scope
+                      also exit 3 when scope was not declared. Intended for CI on
+                      a contract you own; evergreen-check sets it by default.
+--json                machine-readable output. The human view is a summary; JSON
+                      is the complete record, including every issue.
+--optimize            append conditional storage advice with evidence and scope
+                      limits. Reads network minimum lifetimes; no payer needed.
+                      Add --cost for current rent quotes. No storage is changed.
+--cost [--ledgers N]  estimate what extending every entry by N more ledgers
+                      would cost, priced by simulating against the network.
+                      Default N is 518,400 (~30 days). Nothing is submitted.
+
+                      "--ledgers N" means "give me N MORE ledgers". The protocol
+                      wants an absolute target, so the CLI computes it for you
+                      and caps it at max_entry_ttl - 1, saying so when it does.
+                      Costs are estimates: rent pricing varies with network
+                      state and has differed ~18% between days.
+
+Health states, printed per entry and as a worst-of summary:
+  HEALTHY   above threshold.
+  WARNING   low, recoverable, and affects only this contract.
+  CRITICAL  expired, OR temporary (deleted at expiry, unrecoverable), OR low and
+            SHARED \u2014 a code entry shared by N contracts at 3 days is N contracts
+            at 3 days, not one.
+  UNKNOWN   TTL could not be read. Not healthy; unread.
+
+Colour is added only for an interactive terminal and honours NO_COLOR. The state
+word always prints, so piped output and screenshots lose nothing.`;
+async function runCli(args, dependencies) {
+  if (args[0] === "extend") {
+    if (args[1] === "--help" && args.length === 2)
+      return { stdout: EXTEND_HELP, stderr: "", exitCode: 0 };
+    if (!dependencies.extend)
+      return {
+        stdout: "",
+        stderr: "Extension dependencies are unavailable.",
+        exitCode: EXIT_ERROR
+      };
+    return runExtendCli(args, dependencies.extend);
+  }
+  const fail = (message) => ({
+    stdout: "",
+    stderr: message,
+    exitCode: EXIT_ERROR
+  });
+  if (args.length === 1 && args[0] === "--help" || args.length === 2 && args[0] === "scan" && args[1] === "--help") {
+    return {
+      stdout: HELP + "\n\nManual extension: evergreen extend --help",
+      stderr: "",
+      exitCode: 0
+    };
+  }
+  if (args[0] !== "scan") return fail(USAGE);
+  const contractIds = [];
+  let argIndex = 1;
+  for (; argIndex < args.length && !args[argIndex].startsWith("-"); argIndex++) {
+    contractIds.push(args[argIndex]);
+  }
+  if (contractIds.length === 0) return fail(USAGE);
+  for (const id of contractIds) {
+    if (!isValidContractId(id)) {
+      return fail(
+        `Not a Stellar contract ID: ${id}
+Contract IDs start with C and are 56 characters (StrKey-encoded).
+Check for a truncated paste or an account address (G\u2026) used by mistake.`
+      );
+    }
+  }
+  const duplicate = contractIds.find((id, i) => contractIds.indexOf(id) !== i);
+  if (duplicate !== void 0) return fail(`Repeated contract ID: ${duplicate}`);
+  let asJson = false;
+  let withCost = false;
+  let withOptimize = false;
+  let additionalLedgers = DEFAULT_EXTEND_LEDGERS;
+  let noDataKeys = false;
+  let requireDeclaredScope = false;
+  let keysPath;
+  let thresholdLedgers = DEFAULT_THRESHOLD_LEDGERS;
+  for (let i = argIndex; i < args.length; i++) {
+    if (args[i] === "--json" && !asJson) asJson = true;
+    else if (args[i] === "--cost" && !withCost) withCost = true;
+    else if (args[i] === "--optimize" && !withOptimize) withOptimize = true;
+    else if (args[i] === "--ledgers") {
+      const raw = args[++i];
+      const parsed = Number(raw);
+      if (!raw || !/^\d+$/.test(raw) || !Number.isInteger(parsed) || parsed <= 0) {
+        return fail(`--ledgers needs a positive whole number of ledgers.
+${USAGE}`);
+      }
+      additionalLedgers = parsed;
+    } else if (args[i] === "--threshold") {
+      const raw = args[++i];
+      const parsed = Number(raw);
+      if (!raw || !/^\d+$/.test(raw) || !Number.isInteger(parsed) || parsed <= 0) {
+        return fail(`--threshold needs a positive whole number of ledgers.
+${USAGE}`);
+      }
+      thresholdLedgers = parsed;
+    } else if (args[i] === "--no-data-keys" && !noDataKeys) noDataKeys = true;
+    else if (args[i] === "--require-declared-scope" && !requireDeclaredScope)
+      requireDeclaredScope = true;
+    else if (args[i] === "--keys-file" && keysPath === void 0) {
+      keysPath = args[++i];
+      if (!keysPath || keysPath.startsWith("-")) return fail(`--keys-file needs a path.
+${USAGE}`);
+    } else return fail(`Unknown or repeated argument.
+${USAGE}`);
+  }
+  if (noDataKeys && keysPath !== void 0)
+    return fail("--keys-file and --no-data-keys are mutually exclusive.");
+  if (keysPath !== void 0 && contractIds.length > 1)
+    return fail(
+      "--keys-file applies to exactly one contract.\n  Data keys are owned by a specific contract and the file does not say which,\n  so spreading one list across several would misattribute entries.\n  Scan them together without --keys-file to see shared-code blast radius,\n  or scan one at a time when you need explicit data keys."
+    );
+  let dataKeys = [];
+  if (keysPath !== void 0) {
+    try {
+      const parsed = JSON.parse(await dependencies.readKeysFile(keysPath));
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || !("dataKeys" in parsed) || !Array.isArray(parsed.dataKeys) || !parsed.dataKeys.every((key) => typeof key === "string") || Object.keys(parsed).some((key) => key !== "dataKeys")) {
+        return fail("Keys file must be a JSON object containing only a dataKeys array of strings.");
+      }
+      dataKeys = parsed.dataKeys;
+    } catch {
+      return fail("Could not read keys file as JSON. Check the file path and JSON syntax.");
+    }
+  }
+  let reader;
+  try {
+    reader = await dependencies.connect();
+  } catch (error) {
+    if (error instanceof NotTestnetError) {
+      return fail(
+        `${error.message}
+Evergreen only runs against Stellar Testnet. Point SOROBAN_RPC_URL at a
+testnet endpoint \u2014 the default is https://soroban-testnet.stellar.org.`
+      );
+    }
+    return fail(
+      "Could not reach the Stellar RPC endpoint. Check SOROBAN_RPC_URL, the URL\nsyntax, and your network connection. Nothing was read and nothing was changed."
+    );
+  }
+  const scanned = await scanContracts(
+    reader,
+    contractIds.map((id) => ({ contract: { id }, dataKeys, noDataKeys }))
+  );
+  const result = { ...scanned, issues: [...scanned.issues, ...coverageIssues(scanned)] };
+  let settings;
+  if (withOptimize) {
+    try {
+      settings = await dependencies.readStorageSettings?.();
+    } catch {
+    }
+  }
+  const advice = (priced) => withOptimize ? analyzeStorage(result, {
+    ...settings === void 0 ? {} : { settings },
+    ...priced === void 0 ? {} : {
+      quote: {
+        rentByEntry: priced.rentByEntry,
+        pricedAtLedger: priced.pricedAtLedger,
+        additionalLedgers: priced.additionalLedgers
+      }
+    }
+  }) : void 0;
+  let cost;
+  if (withCost) {
+    if (dependencies.priceExtend === void 0 && !withOptimize) {
+      return fail("--cost is unavailable: no pricing backend was configured.");
+    }
+    try {
+      if (dependencies.priceExtend === void 0) throw new Error("No pricing backend");
+      cost = await dependencies.priceExtend({ scan: result, additionalLedgers });
+    } catch {
+      const optimization2 = advice();
+      return {
+        stdout: asJson ? JSON.stringify(
+          {
+            ...result,
+            health: healthReport(result, thresholdLedgers),
+            ...optimization2 === void 0 ? {} : { optimization: optimization2 }
+          },
+          null,
+          2
+        ) : `${formatHuman(result, dependencies.now(), {
+          color: dependencies.color === true,
+          thresholdLedgers
+        })}
+
+! Could not price an extend: the network declined to simulate it.
+  The TTL results above are unaffected.${optimization2 === void 0 ? "" : `
+
+${formatStorageAdvice(optimization2).join("\n")}`}`,
+        stderr: "",
+        exitCode: exitCodeFor(result, thresholdLedgers, { requireDeclaredScope })
+      };
+    }
+  }
+  const optimization = advice(cost);
+  return {
+    stdout: asJson ? (
+      // Additive envelope: every existing key of ScanResult is untouched, so
+      // a consumer reading `entries` or `issues` is unaffected by `health`.
+      JSON.stringify(
+        {
+          ...result,
+          health: healthReport(result, thresholdLedgers),
+          ...cost === void 0 ? {} : { cost },
+          ...optimization === void 0 ? {} : { optimization }
+        },
+        null,
+        2
+      )
+    ) : formatHuman(result, dependencies.now(), {
+      color: dependencies.color === true,
+      thresholdLedgers
+    }) + (cost === void 0 ? "" : `
+
+${formatCost(cost).join("\n")}`) + (optimization === void 0 ? "" : `
+
+${formatStorageAdvice(optimization).join("\n")}`),
+    stderr: "",
+    // Same constant the display grades against, so the printed health and the
+    // exit code can never describe different thresholds.
+    exitCode: exitCodeFor(result, thresholdLedgers, { requireDeclaredScope })
+  };
+}
+
+// src/bin.ts
+var DEFAULT_RPC = "https://soroban-testnet.stellar.org";
+var BASE_FEE_STROOPS = 100n;
+async function priceExtend(rpcUrl, sourceAccountId, args) {
+  const server = new rpc5.Server(rpcUrl);
+  const settings = await readStateArchivalSettings(server);
+  const quoter = createSimulatingQuoter(server, {
+    ...sourceAccountId === void 0 ? {} : { sourceAccountId },
+    networkPassphrase: Networks4.TESTNET
+  });
+  let cappedEntryCount = 0;
+  const targets = {};
+  for (const [entryKey, entry] of Object.entries(args.scan.entries)) {
+    if (entry.ttl.status !== "known") continue;
+    const resolved = resolveExtendTarget({
+      currentRemainingLedgers: entry.ttl.remainingLedgers,
+      additionalLedgers: args.additionalLedgers,
+      maxEntryTtl: settings.maxEntryTtl
+    });
+    if (resolved.wasCapped) cappedEntryCount += 1;
+    targets[entryKey] = resolved.extendToLedgers;
+  }
+  const { estimate } = await estimateRent(args.scan, { extendToLedgers: targets }, quoter);
+  const priced = Object.keys(estimate.estimatedRentStroopsByEntry);
+  let resourceTotal = 0n;
+  for (const entryKey of priced) {
+    const [q] = await quoter.quoteDetailed({
+      entryKeys: [entryKey],
+      extendToLedgers: targets[entryKey]
+    });
+    resourceTotal += BigInt(q.minResourceFeeStroops);
+  }
+  const rent = BigInt(estimate.totalEstimatedRentStroops);
+  const total = resourceTotal + BASE_FEE_STROOPS * BigInt(priced.length);
+  return {
+    totalStroops: total.toString(),
+    rentStroops: rent.toString(),
+    otherStroops: (total - rent).toString(),
+    entryCount: priced.length,
+    additionalLedgers: args.additionalLedgers,
+    cappedEntryCount,
+    maxEntryTtl: settings.maxEntryTtl,
+    pricedAtLedger: settings.observedAtLedger,
+    rentByEntry: estimate.estimatedRentStroopsByEntry
+  };
+}
+async function main() {
+  const rpcUrl = process.env.SOROBAN_RPC_URL ?? DEFAULT_RPC;
+  const color = process.stdout.isTTY === true && process.env.NO_COLOR === void 0;
+  const output = await runCli(process.argv.slice(2), {
+    extend: {
+      ...process.env.EVERGREEN_SOURCE_ACCOUNT ? { sourceAccount: process.env.EVERGREEN_SOURCE_ACCOUNT } : {},
+      readKeysFile: (path) => readFile(path, "utf8"),
+      preview: (text) => console.error(text),
+      run: (request, preview) => runExtension(rpcUrl, request, preview)
+    },
+    connect: () => connectTestnet(rpcUrl),
+    readStorageSettings: () => readStateArchivalSettings(new rpc5.Server(rpcUrl, { timeout: 1e4 })),
+    readKeysFile: (path) => readFile(path, "utf8"),
+    now: () => /* @__PURE__ */ new Date(),
+    color,
+    // Public key only; simulation never signs. Falls back to the well-known
+    // testnet identity so `--cost` works without configuration.
+    // No account is passed: simulation neither signs nor needs one to exist.
+    // EVERGREEN_SOURCE_ACCOUNT stays available for anyone who wants a specific
+    // identity in their own RPC logs.
+    priceExtend: (args) => priceExtend(rpcUrl, process.env.EVERGREEN_SOURCE_ACCOUNT, args)
+  });
+  if (output.stdout) console.log(output.stdout);
+  if (output.stderr) console.error(output.stderr);
+  return output.exitCode;
+}
+main().then((code) => process.exit(code)).catch(() => {
+  console.error("\n\u2716 Unexpected command failure.");
+  process.exit(EXIT_ERROR);
+});
+async function runExtension(rpcUrl, request, preview) {
+  const server = new rpc5.Server(rpcUrl, { timeout: 1e4 });
+  if ((await server.getNetwork()).passphrase !== Networks4.TESTNET)
+    throw new Error("RPC is not Testnet");
+  const reader = createRpcReader(server);
+  const scan = await scanContract(reader, { id: request.contractId }, request.dataKeys);
+  const settings = await readStateArchivalSettings(server);
+  const plan = planExtension(scan, {
+    contractId: request.contractId,
+    additionalLedgers: request.additionalLedgers,
+    maxEntryTtl: settings.maxEntryTtl,
+    dataKeys: request.dataKeys,
+    includeCode: request.includeCode
+  });
+  const previews = [];
+  const result = await executeExtensions(
+    plan,
+    {
+      payer: request.sourceAccount,
+      submit: request.submit,
+      ...request.maxFeeStroops === void 0 ? {} : { maxFeeStroops: request.maxFeeStroops }
+    },
+    {
+      prepare: (entry) => prepareExtension(server, entry, request.sourceAccount),
+      signer: (prepared, remainingFeeStroops) => createEd25519Signer({
+        payer: request.sourceAccount,
+        sourceAccount: request.sourceAccount,
+        entryKey: prepared.entry.entryKey,
+        extendToLedgers: prepared.entry.extendToLedgers,
+        expectedHash: prepared.transactionHash,
+        maxFeeStroops: remainingFeeStroops,
+        readSecret: () => {
+          const secret = request.secretEnv ? process.env[request.secretEnv] : void 0;
+          if (!secret) throw new Error("Signing key is unavailable");
+          return secret;
+        }
+      }),
+      submit: (prepared, signed) => submitExtension(server, prepared, signed),
+      confirm: (hash) => confirmExtension(server, hash),
+      readAfter: async (entryKey) => {
+        const after = await scanContract(reader, { id: request.contractId }, request.dataKeys);
+        const entry = after.entries[entryKey];
+        if (!entry || entry.ttl.status !== "known" || after.issues.some((i) => i.entryKey === entryKey))
+          throw new Error("Post-read incomplete");
+        return { observedAtLedger: entry.observedAtLedger, endsAtLedger: entry.ttl.endsAtLedger };
+      },
+      preview: async (prepared) => {
+        previews.push(prepared);
+        preview(
+          `Mode: ${request.submit ? "live (explicit submit)" : "dry-run"}; requested increment: ${request.additionalLedgers}; aggregate budget: ${request.maxFeeStroops ?? "not supplied (simulation only)"}
+${extensionPreview(prepared)}`
+        );
+      },
+      now: () => /* @__PURE__ */ new Date()
+    }
+  );
+  return { plan, result, previews };
+}
+//# sourceMappingURL=evergreen.mjs.map