@layerzerolabs/vm-tooling-stellar 0.2.114 → 0.2.116

package/dist/commands/verifiable-build.d.ts

@@ -0,0 +1,48 @@
+import type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';
+/**
+ * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.
+ * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the
+ * only image the tool builds against.
+ */
+export declare const officialImageTagRef: (stellarVersion: string, rustVersion: string) => string;
+export declare const parseAmd64Digest: (manifestInspectJson: string) => string;
+/**
+ * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /
+ * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.
+ *
+ * The official image's ENTRYPOINT is `stellar`, so the trailing `contract build …` runs under it.
+ * The source directory is assumed self-contained, so it is mounted at /source and built in place —
+ * no surrounding workspace is required.
+ */
+export declare const buildVerifiableBuildDockerArgs: ({ imageRef, sourceDir, buildArgs, bldimg, }: {
+    imageRef: string;
+    sourceDir: string;
+    buildArgs: string[];
+    bldimg: string;
+}) => string[];
+export interface VerifiableBuildVersions {
+    stellarVersion: string;
+    rustVersion: string;
+}
+/**
+ * Reproducible `stellar contract build` that runs inside the OFFICIAL `stellar/stellar-cli` image —
+ * the exact package an external verifier uses — instead of our own dev image (whose sccache/mold
+ * layers could change the WASM).
+ *
+ * The build runs the official image directly from the HOST: our TypeScript CLI already executes on
+ * the host runner, so it can `docker run` the official image itself. This is what an external
+ * verifier's plain `docker run` does, and it means we never bind-mount the host Docker socket into
+ * a container — eliminating the container-escape / secret-leak surface that mounting the socket
+ * would create.
+ *
+ * The image is `stellar/stellar-cli:<stellarVersion>-rust<rustVersion>-slim-bookworm`, pinned by the
+ * caller. For a stable reference we resolve it to its linux/amd64 digest and both RUN that digest
+ * and embed it as the `bldimg` WASM metadata (`docker.io/stellar/stellar-cli@sha256:…`) — the tool
+ * does this automatically so callers never hand-inject `--meta bldimg=…`. The source directory (the
+ * cwd, assumed self-contained) is mounted at /source and built in place, and the official image runs
+ * as its own user/toolchain.
+ */
+export declare class VerifiableBuildWrapper {
+    run(args: string[], { stellarVersion, rustVersion }: VerifiableBuildVersions, options: ToolCommandExecutionOptions): Promise<void>;
+}
+//# sourceMappingURL=verifiable-build.d.ts.map

package/dist/commands/verifiable-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiable-build.d.ts","sourceRoot":"","sources":["../../src/commands/verifiable-build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAc7E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,gBAAgB,MAAM,EAAE,aAAa,MAAM,KAAG,MACH,CAAC;AAehF,eAAO,MAAM,gBAAgB,GAAI,qBAAqB,MAAM,KAAG,MAkB9D,CAAC;AAqBF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAAI,6CAK5C;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAClB,KAAG,MAAM,EAgBT,CAAC;AAuBF,MAAM,WAAW,uBAAuB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,sBAAsB;IAClB,GAAG,CACZ,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,uBAAuB,EACxD,OAAO,EAAE,2BAA2B,GACrC,OAAO,CAAC,IAAI,CAAC;CAoBnB"}

package/dist/commands/verifiable-build.js

@@ -0,0 +1,4 @@
+export { VerifiableBuildWrapper, buildVerifiableBuildDockerArgs, officialImageTagRef, parseAmd64Digest } from '../6YPWRWU3.js';
+import '../2VBLSQAK.js';
+//# sourceMappingURL=verifiable-build.js.map
+//# sourceMappingURL=verifiable-build.js.map

package/dist/commands/verifiable-build.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"verifiable-build.js"}

package/dist/commands/verifiable-build.test.js

@@ -0,0 +1,120 @@
+import { describe, it, globalExpect } from '../ITF544RZ.js';
+import { officialImageTagRef, parseAmd64Digest, buildVerifiableBuildDockerArgs } from '../6YPWRWU3.js';
+import { init_esm_shims } from '../2VBLSQAK.js';
+
+// src/commands/verifiable-build.test.ts
+init_esm_shims();
+var AMD64_DIGEST = "sha256:dd2ec7b637194a357eff45f696ff3e077a5d1070c3bf923fcacd54af5c6d2b4f";
+var MANIFEST_INSPECT_JSON = JSON.stringify({
+  schemaVersion: 2,
+  mediaType: "application/vnd.oci.image.index.v1+json",
+  manifests: [
+    {
+      digest: AMD64_DIGEST,
+      platform: {
+        architecture: "amd64",
+        os: "linux"
+      }
+    },
+    {
+      digest: "sha256:aaaa",
+      platform: {
+        architecture: "arm64",
+        os: "linux"
+      }
+    },
+    {
+      digest: "sha256:bbbb",
+      platform: {
+        architecture: "unknown",
+        os: "unknown"
+      }
+    },
+    {
+      digest: "sha256:cccc",
+      platform: {
+        architecture: "unknown",
+        os: "unknown"
+      }
+    }
+  ]
+});
+describe("officialImageTagRef", () => {
+  it("builds the <stellar>-rust<rust>-slim-bookworm tag from the pinned versions", () => {
+    globalExpect(officialImageTagRef("25.1.0", "1.90.0")).toBe("stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm");
+  });
+});
+describe("parseAmd64Digest", () => {
+  it("selects the linux/amd64 manifest digest", () => {
+    globalExpect(parseAmd64Digest(MANIFEST_INSPECT_JSON)).toBe(AMD64_DIGEST);
+  });
+  it("throws when there is no linux/amd64 manifest", () => {
+    const json = JSON.stringify({
+      manifests: [
+        {
+          digest: "sha256:aaaa",
+          platform: {
+            architecture: "arm64",
+            os: "linux"
+          }
+        }
+      ]
+    });
+    globalExpect(() => parseAmd64Digest(json)).toThrow(/No linux\/amd64 manifest digest/);
+  });
+  it("throws when the output is not a multi-arch index", () => {
+    globalExpect(() => parseAmd64Digest(JSON.stringify({
+      mediaType: "single"
+    }))).toThrow(/multi-arch index/);
+  });
+});
+describe("buildVerifiableBuildDockerArgs", () => {
+  const imageRef = `stellar/stellar-cli@${AMD64_DIGEST}`;
+  const bldimg = `docker.io/stellar/stellar-cli@${AMD64_DIGEST}`;
+  it("mounts the self-contained source at /source and embeds the bldimg meta", () => {
+    const args = buildVerifiableBuildDockerArgs({
+      imageRef,
+      sourceDir: "/tmp/extracted-source",
+      buildArgs: [
+        "--package",
+        "ethena-oft-oft",
+        "--optimize"
+      ],
+      bldimg
+    });
+    globalExpect(args).toEqual([
+      "run",
+      "--rm",
+      "--platform",
+      "linux/amd64",
+      "-v",
+      "/tmp/extracted-source:/source",
+      "-w",
+      "/source",
+      imageRef,
+      "contract",
+      "build",
+      "--package",
+      "ethena-oft-oft",
+      "--optimize",
+      "--meta",
+      `bldimg=${bldimg}`
+    ]);
+  });
+  it("runs the image by digest and always appends the tool-injected bldimg meta", () => {
+    const args = buildVerifiableBuildDockerArgs({
+      imageRef,
+      sourceDir: "/src",
+      buildArgs: [],
+      bldimg
+    });
+    globalExpect(args).toContain(imageRef);
+    globalExpect(imageRef).toContain("@sha256:");
+    globalExpect(args.slice(-2)).toEqual([
+      "--meta",
+      `bldimg=${bldimg}`
+    ]);
+  });
+});
+//# sourceMappingURL=verifiable-build.test.js.map
+//# sourceMappingURL=verifiable-build.test.js.map

package/dist/commands/verifiable-build.test.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/commands/verifiable-build.test.ts"],"names":["AMD64_DIGEST","MANIFEST_INSPECT_JSON","JSON","stringify","schemaVersion","mediaType","manifests","digest","platform","architecture","os","describe","it","expect","officialImageTagRef","toBe","parseAmd64Digest","json","toThrow","imageRef","bldimg","args","buildVerifiableBuildDockerArgs","sourceDir","buildArgs","toEqual","toContain","slice"],"mappings":";;;;;AAAA,cAAA,EAAA;AAQA,IAAMA,YAAAA,GAAe,yEAAA;AAIrB,IAAMC,qBAAAA,GAAwBC,KAAKC,SAAAA,CAAU;EACzCC,aAAAA,EAAe,CAAA;EACfC,SAAAA,EAAW,yCAAA;EACXC,SAAAA,EAAW;AACP,IAAA;MAAEC,MAAAA,EAAQP,YAAAA;MAAcQ,QAAAA,EAAU;QAAEC,YAAAA,EAAc,OAAA;QAASC,EAAAA,EAAI;AAAQ;AAAE,KAAA;AACzE,IAAA;MAAEH,MAAAA,EAAQ,aAAA;MAAeC,QAAAA,EAAU;QAAEC,YAAAA,EAAc,OAAA;QAASC,EAAAA,EAAI;AAAQ;AAAE,KAAA;AAC1E,IAAA;MAAEH,MAAAA,EAAQ,aAAA;MAAeC,QAAAA,EAAU;QAAEC,YAAAA,EAAc,SAAA;QAAWC,EAAAA,EAAI;AAAU;AAAE,KAAA;AAC9E,IAAA;MAAEH,MAAAA,EAAQ,aAAA;MAAeC,QAAAA,EAAU;QAAEC,YAAAA,EAAc,SAAA;QAAWC,EAAAA,EAAI;AAAU;AAAE;;AAEtF,CAAA,CAAA;AAEAC,QAAAA,CAAS,uBAAuB,MAAA;AAC5BC,EAAAA,EAAAA,CAAG,8EAA8E,MAAA;AAC7EC,IAAAA,YAAAA,CAAOC,oBAAoB,QAAA,EAAU,QAAA,CAAA,CAAA,CAAWC,KAC5C,qDAAA,CAAA;EAER,CAAA,CAAA;AACJ,CAAA,CAAA;AAEAJ,QAAAA,CAAS,oBAAoB,MAAA;AACzBC,EAAAA,EAAAA,CAAG,2CAA2C,MAAA;AAC1CC,IAAAA,YAAAA,CAAOG,gBAAAA,CAAiBf,qBAAAA,CAAAA,CAAAA,CAAwBc,KAAKf,YAAAA,CAAAA;EACzD,CAAA,CAAA;AAEAY,EAAAA,EAAAA,CAAG,gDAAgD,MAAA;AAC/C,IAAA,MAAMK,IAAAA,GAAOf,KAAKC,SAAAA,CAAU;MACxBG,SAAAA,EAAW;AACP,QAAA;UAAEC,MAAAA,EAAQ,aAAA;UAAeC,QAAAA,EAAU;YAAEC,YAAAA,EAAc,OAAA;YAASC,EAAAA,EAAI;AAAQ;AAAE;;KAElF,CAAA;AACAG,IAAAA,YAAAA,CAAO,MAAMG,gBAAAA,CAAiBC,IAAAA,CAAAA,CAAAA,CAAOC,QAAQ,iCAAA,CAAA;EACjD,CAAA,CAAA;AAEAN,EAAAA,EAAAA,CAAG,oDAAoD,MAAA;AACnDC,IAAAA,YAAAA,CAAO,MAAMG,gBAAAA,CAAiBd,IAAAA,CAAKC,SAAAA,CAAU;MAAEE,SAAAA,EAAW;AAAS,KAAA,CAAA,CAAA,CAAA,CAAKa,OAAAA,CACpE,kBAAA,CAAA;EAER,CAAA,CAAA;AACJ,CAAA,CAAA;AAEAP,QAAAA,CAAS,kCAAkC,MAAA;AACvC,EAAA,MAAMQ,QAAAA,GAAW,uBAAuBnB,YAAAA,CAAAA,CAAAA;AACxC,EAAA,MAAMoB,MAAAA,GAAS,iCAAiCpB,YAAAA,CAAAA,CAAAA;AAEhDY,EAAAA,EAAAA,CAAG,0EAA0E,MAAA;AACzE,IAAA,MAAMS,OAAOC,8BAAAA,CAA+B;AACxCH,MAAAA,QAAAA;MACAI,SAAAA,EAAW,uBAAA;MACXC,SAAAA,EAAW;AAAC,QAAA,WAAA;AAAa,QAAA,gBAAA;AAAkB,QAAA;;AAC3CJ,MAAAA;KACJ,CAAA;AAEAP,IAAAA,YAAAA,CAAOQ,IAAAA,EAAMI,OAAAA,CAAQ;AACjB,MAAA,KAAA;AACA,MAAA,MAAA;AACA,MAAA,YAAA;AACA,MAAA,aAAA;AACA,MAAA,IAAA;AACA,MAAA,+BAAA;AACA,MAAA,IAAA;AACA,MAAA,SAAA;AACAN,MAAAA,QAAAA;AACA,MAAA,UAAA;AACA,MAAA,OAAA;AACA,MAAA,WAAA;AACA,MAAA,gBAAA;AACA,MAAA,YAAA;AACA,MAAA,QAAA;AACA,MAAA,CAAA,OAAA,EAAUC,MAAAA,CAAAA;AACb,KAAA,CAAA;EACL,CAAA,CAAA;AAEAR,EAAAA,EAAAA,CAAG,6EAA6E,MAAA;AAC5E,IAAA,MAAMS,OAAOC,8BAAAA,CAA+B;AACxCH,MAAAA,QAAAA;MACAI,SAAAA,EAAW,MAAA;AACXC,MAAAA,SAAAA,EAAW,EAAA;AACXJ,MAAAA;KACJ,CAAA;AAGAP,IAAAA,YAAAA,CAAOQ,IAAAA,CAAAA,CAAMK,SAAAA,CAAUP,QAAAA,CAAAA;AACvBN,IAAAA,YAAAA,CAAOM,QAAAA,CAAAA,CAAUO,SAAAA,CAAU,UAAA,CAAA;AAE3Bb,IAAAA,YAAAA,CAAOQ,IAAAA,CAAKM,KAAAA,CAAM,EAAC,CAAA,EAAIF,OAAAA,CAAQ;AAAC,MAAA,QAAA;AAAU,MAAA,CAAA,OAAA,EAAUL,MAAAA,CAAAA;AAAS,KAAA,CAAA;EACjE,CAAA,CAAA;AACJ,CAAA,CAAA","file":"verifiable-build.test.js","sourcesContent":["import { describe, expect, it } from 'vitest';\n\nimport {\n    buildVerifiableBuildDockerArgs,\n    officialImageTagRef,\n    parseAmd64Digest,\n} from './verifiable-build';\n\nconst AMD64_DIGEST = 'sha256:dd2ec7b637194a357eff45f696ff3e077a5d1070c3bf923fcacd54af5c6d2b4f';\n\n// Shape of `docker manifest inspect <multi-arch tag>`: amd64 + arm64 plus the two unknown/unknown\n// attestation entries that must be ignored.\nconst MANIFEST_INSPECT_JSON = JSON.stringify({\n    schemaVersion: 2,\n    mediaType: 'application/vnd.oci.image.index.v1+json',\n    manifests: [\n        { digest: AMD64_DIGEST, platform: { architecture: 'amd64', os: 'linux' } },\n        { digest: 'sha256:aaaa', platform: { architecture: 'arm64', os: 'linux' } },\n        { digest: 'sha256:bbbb', platform: { architecture: 'unknown', os: 'unknown' } },\n        { digest: 'sha256:cccc', platform: { architecture: 'unknown', os: 'unknown' } },\n    ],\n});\n\ndescribe('officialImageTagRef', () => {\n    it('builds the <stellar>-rust<rust>-slim-bookworm tag from the pinned versions', () => {\n        expect(officialImageTagRef('25.1.0', '1.90.0')).toBe(\n            'stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm',\n        );\n    });\n});\n\ndescribe('parseAmd64Digest', () => {\n    it('selects the linux/amd64 manifest digest', () => {\n        expect(parseAmd64Digest(MANIFEST_INSPECT_JSON)).toBe(AMD64_DIGEST);\n    });\n\n    it('throws when there is no linux/amd64 manifest', () => {\n        const json = JSON.stringify({\n            manifests: [\n                { digest: 'sha256:aaaa', platform: { architecture: 'arm64', os: 'linux' } },\n            ],\n        });\n        expect(() => parseAmd64Digest(json)).toThrow(/No linux\\/amd64 manifest digest/);\n    });\n\n    it('throws when the output is not a multi-arch index', () => {\n        expect(() => parseAmd64Digest(JSON.stringify({ mediaType: 'single' }))).toThrow(\n            /multi-arch index/,\n        );\n    });\n});\n\ndescribe('buildVerifiableBuildDockerArgs', () => {\n    const imageRef = `stellar/stellar-cli@${AMD64_DIGEST}`;\n    const bldimg = `docker.io/stellar/stellar-cli@${AMD64_DIGEST}`;\n\n    it('mounts the self-contained source at /source and embeds the bldimg meta', () => {\n        const args = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: '/tmp/extracted-source',\n            buildArgs: ['--package', 'ethena-oft-oft', '--optimize'],\n            bldimg,\n        });\n\n        expect(args).toEqual([\n            'run',\n            '--rm',\n            '--platform',\n            'linux/amd64',\n            '-v',\n            '/tmp/extracted-source:/source',\n            '-w',\n            '/source',\n            imageRef,\n            'contract',\n            'build',\n            '--package',\n            'ethena-oft-oft',\n            '--optimize',\n            '--meta',\n            `bldimg=${bldimg}`,\n        ]);\n    });\n\n    it('runs the image by digest and always appends the tool-injected bldimg meta', () => {\n        const args = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: '/src',\n            buildArgs: [],\n            bldimg,\n        });\n\n        // Image reference is pinned by digest, not a mutable tag.\n        expect(args).toContain(imageRef);\n        expect(imageRef).toContain('@sha256:');\n        // bldimg is the last meta appended, regardless of user args.\n        expect(args.slice(-2)).toEqual(['--meta', `bldimg=${bldimg}`]);\n    });\n});\n"]}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,IAAI,QAAO,OAAO,CAAC,IAAI,CAQ9B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,IAAI,QAAO,OAAO,CAAC,IAAI,CAkD9B,CAAC"}

package/dist/index.js

@@ -1,3 +1,4 @@
+import { VerifiableBuildWrapper } from './6YPWRWU3.js';
 import { versionCombinations, images, tools } from './PT2VYI7I.js';
 import { syncToolchain } from './K7N3LKMZ.js';
 import { init_esm_shims, __name } from './2VBLSQAK.js';
@@ -10,8 +11,15 @@ var context = {
   images,
   versionCombinations
 };
+var verifiableBuildWrapper = new VerifiableBuildWrapper();
 var main = /* @__PURE__ */ __name(() => runCli(context, (program, parseGlobalOptions) => {
   program.command("sync-toolchain").description("Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock").action(async () => syncToolchain(context, await parseGlobalOptions(program)));
+  const extra = program.command("extra").description("Extra commands for VM tooling");
+  const stellar = extra.command("stellar");
+  stellar.command("verifiable-build").description("Reproducible `stellar contract build` of the self-contained source in the cwd, inside the official stellar/stellar-cli:<stellar>-rust<rust>-slim-bookworm image pinned by its linux/amd64 digest (run from the host, no Docker socket; embeds the bldimg WASM meta automatically)").requiredOption("--stellar-version <version>", "Stellar CLI version of the official reproducible image (e.g. 25.1.0)").requiredOption("--rust-version <version>", "Rust version of the official reproducible image (e.g. 1.90.0)").argument("[args...]", "Arguments for `stellar contract build`, after `--` (e.g. -- --package <crate>)").passThroughOptions(true).allowUnknownOption().action(async (args, { stellarVersion, rustVersion }) => verifiableBuildWrapper.run(args, {
+    stellarVersion,
+    rustVersion
+  }, await parseGlobalOptions(program)));
 }), "main");
 
 export { main };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["context","tools","images","versionCombinations","main","runCli","program","parseGlobalOptions","command","description","action","syncToolchain"],"mappings":";;;;;;AAAA,cAAA,EAAA;AAKA,IAAMA,OAAAA,GAAU;AAAEC,EAAAA,KAAAA;AAAOC,EAAAA,MAAAA;AAAQC,EAAAA;AAAoB,CAAA;AAE9C,IAAMC,uBAAO,MAAA,CAAA,MAChBC,MAAAA,CAAOL,OAAAA,EAAS,CAACM,SAASC,kBAAAA,KAAAA;AACtBD,EAAAA,OAAAA,CACKE,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,+EAAA,CAAA,CAEHC,MAAAA,CAAO,YAAYC,aAAAA,CAAcX,OAAAA,EAAS,MAAMO,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAC5E,CAAA,CAAA,EARgB,MAAA","file":"index.js","sourcesContent":["import { runCli } from '@layerzerolabs/vm-tooling';\n\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { images, tools, versionCombinations } from './config';\n\nconst context = { tools, images, versionCombinations };\n\nexport const main = (): Promise<void> =>\n    runCli(context, (program, parseGlobalOptions) => {\n        program\n            .command('sync-toolchain')\n            .description(\n                'Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock',\n            )\n            .action(async () => syncToolchain(context, await parseGlobalOptions(program)));\n    });\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["context","tools","images","versionCombinations","verifiableBuildWrapper","VerifiableBuildWrapper","main","runCli","program","parseGlobalOptions","command","description","action","syncToolchain","extra","stellar","requiredOption","argument","passThroughOptions","allowUnknownOption","args","stellarVersion","rustVersion","run"],"mappings":";;;;;;;AACA,cAAA,EAAA;AAMA,IAAMA,OAAAA,GAAiC;AAAEC,EAAAA,KAAAA;AAAOC,EAAAA,MAAAA;AAAQC,EAAAA;AAAoB,CAAA;AAE5E,IAAMC,sBAAAA,GAAyB,IAAIC,sBAAAA,EAAAA;AAE5B,IAAMC,uBAAO,MAAA,CAAA,MAChBC,MAAAA,CAAOP,OAAAA,EAAS,CAACQ,SAASC,kBAAAA,KAAAA;AACtBD,EAAAA,OAAAA,CACKE,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,+EAAA,CAAA,CAEHC,MAAAA,CAAO,YAAYC,aAAAA,CAAcb,OAAAA,EAAS,MAAMS,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAIxE,EAAA,MAAMM,QAAQN,OAAAA,CAAQE,OAAAA,CAAQ,OAAA,CAAA,CAASC,YAAY,+BAAA,CAAA;AACnD,EAAA,MAAMI,OAAAA,GAAUD,KAAAA,CAAMJ,OAAAA,CAAQ,SAAA,CAAA;AAE9BK,EAAAA,OAAAA,CACKL,OAAAA,CAAQ,kBAAA,CAAA,CACRC,WAAAA,CACG,mRAGI,CAAA,CAEPK,cAAAA,CACG,6BAAA,EACA,sEAAA,CAAA,CAEHA,cAAAA,CACG,0BAAA,EACA,+DAAA,EAEHC,QAAAA,CACG,WAAA,EACA,gFAAA,CAAA,CAEHC,kBAAAA,CAAmB,IAAA,CAAA,CACnBC,kBAAAA,GACAP,MAAAA,CACG,OACIQ,IAAAA,EACA,EACIC,cAAAA,EACAC,WAAAA,EAAW,KAGflB,sBAAAA,CAAuBmB,IACnBH,IAAAA,EACA;AAAEC,IAAAA,cAAAA;AAAgBC,IAAAA;AAAY,GAAA,EAC9B,MAAMb,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAG7C,CAAA,CAAA,EAlDgB,MAAA","file":"index.js","sourcesContent":["import type { ChainContext } from '@layerzerolabs/vm-tooling';\nimport { runCli } from '@layerzerolabs/vm-tooling';\n\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { VerifiableBuildWrapper } from './commands/verifiable-build';\nimport { type ImageId, images, tools, versionCombinations } from './config';\n\nconst context: ChainContext<ImageId> = { tools, images, versionCombinations };\n\nconst verifiableBuildWrapper = new VerifiableBuildWrapper();\n\nexport const main = (): Promise<void> =>\n    runCli(context, (program, parseGlobalOptions) => {\n        program\n            .command('sync-toolchain')\n            .description(\n                'Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock',\n            )\n            .action(async () => syncToolchain(context, await parseGlobalOptions(program)));\n\n        // Extra (non-passthrough) commands, namespaced under `extra <tool>` like vm-tooling-sui:\n        //   lz-tool extra stellar verifiable-build [args...]\n        const extra = program.command('extra').description('Extra commands for VM tooling');\n        const stellar = extra.command('stellar');\n\n        stellar\n            .command('verifiable-build')\n            .description(\n                'Reproducible `stellar contract build` of the self-contained source in the cwd, ' +\n                    'inside the official stellar/stellar-cli:<stellar>-rust<rust>-slim-bookworm image ' +\n                    'pinned by its linux/amd64 digest (run from the host, no Docker socket; embeds ' +\n                    'the bldimg WASM meta automatically)',\n            )\n            .requiredOption(\n                '--stellar-version <version>',\n                'Stellar CLI version of the official reproducible image (e.g. 25.1.0)',\n            )\n            .requiredOption(\n                '--rust-version <version>',\n                'Rust version of the official reproducible image (e.g. 1.90.0)',\n            )\n            .argument(\n                '[args...]',\n                'Arguments for `stellar contract build`, after `--` (e.g. -- --package <crate>)',\n            )\n            .passThroughOptions(true)\n            .allowUnknownOption()\n            .action(\n                async (\n                    args: string[],\n                    {\n                        stellarVersion,\n                        rustVersion,\n                    }: { stellarVersion: string; rustVersion: string },\n                ) =>\n                    verifiableBuildWrapper.run(\n                        args,\n                        { stellarVersion, rustVersion },\n                        await parseGlobalOptions(program),\n                    ),\n            );\n    });\n"]}