@layerzerolabs/vm-tooling-stellar 0.2.122 → 0.2.124

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["context","tools","images","versionCombinations","verifiableBuildWrapper","VerifiableBuildWrapper","main","runCli","program","parseGlobalOptions","command","description","action","syncToolchain","extra","stellar","requiredOption","argument","passThroughOptions","allowUnknownOption","args","stellarVersion","rustVersion","run"],"mappings":";;;;;;;AACA,cAAA,EAAA;AAMA,IAAMA,OAAAA,GAAiC;AAAEC,EAAAA,KAAAA;AAAOC,EAAAA,MAAAA;AAAQC,EAAAA;AAAoB,CAAA;AAE5E,IAAMC,sBAAAA,GAAyB,IAAIC,sBAAAA,EAAAA;AAE5B,IAAMC,uBAAO,MAAA,CAAA,MAChBC,MAAAA,CAAOP,OAAAA,EAAS,CAACQ,SAASC,kBAAAA,KAAAA;AACtBD,EAAAA,OAAAA,CACKE,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,+EAAA,CAAA,CAEHC,MAAAA,CAAO,YAAYC,aAAAA,CAAcb,OAAAA,EAAS,MAAMS,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAIxE,EAAA,MAAMM,QAAQN,OAAAA,CAAQE,OAAAA,CAAQ,OAAA,CAAA,CAASC,YAAY,+BAAA,CAAA;AACnD,EAAA,MAAMI,OAAAA,GAAUD,KAAAA,CAAMJ,OAAAA,CAAQ,SAAA,CAAA;AAE9BK,EAAAA,OAAAA,CACKL,OAAAA,CAAQ,kBAAA,CAAA,CACRC,WAAAA,CACG,mRAGI,CAAA,CAEPK,cAAAA,CACG,6BAAA,EACA,sEAAA,CAAA,CAEHA,cAAAA,CACG,0BAAA,EACA,+DAAA,EAEHC,QAAAA,CACG,WAAA,EACA,gFAAA,CAAA,CAEHC,kBAAAA,CAAmB,IAAA,CAAA,CACnBC,kBAAAA,GACAP,MAAAA,CACG,OACIQ,IAAAA,EACA,EACIC,cAAAA,EACAC,WAAAA,EAAW,KAGflB,sBAAAA,CAAuBmB,IACnBH,IAAAA,EACA;AAAEC,IAAAA,cAAAA;AAAgBC,IAAAA;AAAY,GAAA,EAC9B,MAAMb,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAG7C,CAAA,CAAA,EAlDgB,MAAA","file":"index.js","sourcesContent":["import type { ChainContext } from '@layerzerolabs/vm-tooling';\nimport { runCli } from '@layerzerolabs/vm-tooling';\n\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { VerifiableBuildWrapper } from './commands/verifiable-build';\nimport { type ImageId, images, tools, versionCombinations } from './config';\n\nconst context: ChainContext<ImageId> = { tools, images, versionCombinations };\n\nconst verifiableBuildWrapper = new VerifiableBuildWrapper();\n\nexport const main = (): Promise<void> =>\n    runCli(context, (program, parseGlobalOptions) => {\n        program\n            .command('sync-toolchain')\n            .description(\n                'Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock',\n            )\n            .action(async () => syncToolchain(context, await parseGlobalOptions(program)));\n\n        // Extra (non-passthrough) commands, namespaced under `extra <tool>` like vm-tooling-sui:\n        //   lz-tool extra stellar verifiable-build [args...]\n        const extra = program.command('extra').description('Extra commands for VM tooling');\n        const stellar = extra.command('stellar');\n\n        stellar\n            .command('verifiable-build')\n            .description(\n                'Reproducible `stellar contract build` of the self-contained source in the cwd, ' +\n                    'inside the official stellar/stellar-cli:<stellar>-rust<rust>-slim-bookworm image ' +\n                    'pinned by its linux/amd64 digest (run from the host, no Docker socket; embeds ' +\n                    'the bldimg WASM meta automatically)',\n            )\n            .requiredOption(\n                '--stellar-version <version>',\n                'Stellar CLI version of the official reproducible image (e.g. 25.1.0)',\n            )\n            .requiredOption(\n                '--rust-version <version>',\n                'Rust version of the official reproducible image (e.g. 1.90.0)',\n            )\n            .argument(\n                '[args...]',\n                'Arguments for `stellar contract build`, after `--` (e.g. -- --package <crate>)',\n            )\n            .passThroughOptions(true)\n            .allowUnknownOption()\n            .action(\n                async (\n                    args: string[],\n                    {\n                        stellarVersion,\n                        rustVersion,\n                    }: { stellarVersion: string; rustVersion: string },\n                ) =>\n                    verifiableBuildWrapper.run(\n                        args,\n                        { stellarVersion, rustVersion },\n                        await parseGlobalOptions(program),\n                    ),\n            );\n    });\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["context","tools","images","versionCombinations","verifiableBuildWrapper","VerifiableBuildWrapper","main","runCli","program","parseGlobalOptions","command","description","action","syncToolchain","extra","stellar","requiredOption","option","argument","passThroughOptions","allowUnknownOption","args","stellarVersion","rustVersion","sourceDir","run","output","include","exclude","packageSource"],"mappings":";;;;;;;AAQA,IAAMA,OAAAA,GAAiC;AAAEC,EAAAA,KAAAA;AAAOC,EAAAA,MAAAA;AAAQC,EAAAA;AAAoB,CAAA;AAE5E,IAAMC,sBAAAA,GAAyB,IAAIC,sBAAAA,EAAAA;AAE5B,IAAMC,uBAAO,MAAA,CAAA,MAChBC,MAAAA,CAAOP,OAAAA,EAAS,CAACQ,SAASC,kBAAAA,KAAAA;AACtBD,EAAAA,OAAAA,CACKE,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,+EAAA,CAAA,CAEHC,MAAAA,CAAO,YAAYC,aAAAA,CAAcb,OAAAA,EAAS,MAAMS,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAIxE,EAAA,MAAMM,QAAQN,OAAAA,CAAQE,OAAAA,CAAQ,OAAA,CAAA,CAASC,YAAY,+BAAA,CAAA;AACnD,EAAA,MAAMI,OAAAA,GAAUD,KAAAA,CAAMJ,OAAAA,CAAQ,SAAA,CAAA;AAE9BK,EAAAA,OAAAA,CACKL,QAAQ,kBAAA,CAAA,CACRC,WAAAA,CACG,8RAGI,EAEPK,cAAAA,CACG,6BAAA,EACA,sEAAA,CAAA,CAEHA,eACG,0BAAA,EACA,+DAAA,CAAA,CAEHC,MAAAA,CACG,uBACA,gIACI,CAAA,CAEPC,QAAAA,CACG,WAAA,EACA,gFAAA,CAAA,CAEHC,kBAAAA,CAAmB,IAAA,CAAA,CACnBC,oBAAkB,CAClBR,MAAAA,CACG,OACIS,IAAAA,EACA,EACIC,cAAAA,EACAC,WAAAA,EACAC,WAAS,KAGbpB,sBAAAA,CAAuBqB,IACnBJ,IAAAA,EACA;AAAEC,IAAAA,cAAAA;AAAgBC,IAAAA;AAAY,GAAA,EAC9B,MAAMd,kBAAAA,CAAmBD,OAAAA,CAAAA,EACzBgB,SAAAA,CAAAA,CAAAA;AAIhBT,EAAAA,OAAAA,CACKL,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,gYAII,CAAA,CAEPM,MAAAA,CACG,iBAAA,EACA,oEAAA,CAAA,CAEHA,MAAAA,CACG,wBAAA,EACA,2EAAA,EACA,EAAE,CAAA,CAELA,MAAAA,CACG,wBAAA,EACA,sFAAA,EACA,EAAE,CAAA,CAELL,MAAAA,CACG,OAAO,EACHc,MAAAA,EACAC,OAAAA,EACAC,OAAAA,OAMAC,aAAAA,CAAc;AAAEH,IAAAA,MAAAA;AAAQC,IAAAA,OAAAA;AAASC,IAAAA;AAAQ,GAAA,EAAG,MAAMnB,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAErF,CAAA,CAAA,EA7FgB,MAAA","file":"index.js","sourcesContent":["import type { ChainContext } from '@layerzerolabs/vm-tooling';\nimport { runCli } from '@layerzerolabs/vm-tooling';\n\nimport { packageSource } from './commands/package-source';\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { VerifiableBuildWrapper } from './commands/verifiable-build';\nimport { type ImageId, images, tools, versionCombinations } from './config';\n\nconst context: ChainContext<ImageId> = { tools, images, versionCombinations };\n\nconst verifiableBuildWrapper = new VerifiableBuildWrapper();\n\nexport const main = (): Promise<void> =>\n    runCli(context, (program, parseGlobalOptions) => {\n        program\n            .command('sync-toolchain')\n            .description(\n                'Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock',\n            )\n            .action(async () => syncToolchain(context, await parseGlobalOptions(program)));\n\n        // Extra (non-passthrough) commands, namespaced under `extra <tool>` like vm-tooling-sui:\n        //   lz-tool extra stellar verifiable-build [args...]\n        const extra = program.command('extra').description('Extra commands for VM tooling');\n        const stellar = extra.command('stellar');\n\n        stellar\n            .command('verifiable-build')\n            .description(\n                'Reproducible `stellar contract build` of the self-contained source in the cwd by ' +\n                    'default, inside the official stellar/stellar-cli:<stellar>-rust<rust>-slim-bookworm ' +\n                    'image pinned by its linux/amd64 digest (run from the host, no Docker socket; embeds ' +\n                    'the bldimg WASM meta automatically)',\n            )\n            .requiredOption(\n                '--stellar-version <version>',\n                'Stellar CLI version of the official reproducible image (e.g. 25.1.0)',\n            )\n            .requiredOption(\n                '--rust-version <version>',\n                'Rust version of the official reproducible image (e.g. 1.90.0)',\n            )\n            .option(\n                '--source-dir <path>',\n                'Directory to build — the self-contained/decompressed source. Relative paths ' +\n                    'resolve against the cwd; defaults to the cwd.',\n            )\n            .argument(\n                '[args...]',\n                'Arguments for `stellar contract build`, after `--` (e.g. -- --package <crate>)',\n            )\n            .passThroughOptions(true)\n            .allowUnknownOption()\n            .action(\n                async (\n                    args: string[],\n                    {\n                        stellarVersion,\n                        rustVersion,\n                        sourceDir,\n                    }: { stellarVersion: string; rustVersion: string; sourceDir?: string },\n                ) =>\n                    verifiableBuildWrapper.run(\n                        args,\n                        { stellarVersion, rustVersion },\n                        await parseGlobalOptions(program),\n                        sourceDir,\n                    ),\n            );\n\n        stellar\n            .command('package-source')\n            .description(\n                'Package the self-contained crate in the cwd into a byte-deterministic source ' +\n                    '.zip under .artifacts/ (for the SEP-58 verifiable build) and print its ' +\n                    'source_sha256. Include-only: packages source files (.rs/.lock, Cargo.toml, ' +\n                    'rust-toolchain.toml, rustfmt.toml, clippy.toml) plus any --include entries; ' +\n                    '--exclude always wins. Skips non-source directories (target, node_modules, …).',\n            )\n            .option(\n                '--output <path>',\n                'Output .zip path (default: <cwd>/.artifacts/<basename>-source.zip)',\n            )\n            .option(\n                '--include <pattern...>',\n                'Native Node glob patterns to include beyond the default source extensions',\n                [],\n            )\n            .option(\n                '--exclude <pattern...>',\n                'Native Node glob patterns to exclude (always wins over the allow-list and --include)',\n                [],\n            )\n            .action(\n                async ({\n                    output,\n                    include,\n                    exclude,\n                }: {\n                    output?: string;\n                    include?: string[];\n                    exclude?: string[];\n                }) =>\n                    packageSource({ output, include, exclude }, await parseGlobalOptions(program)),\n            );\n    });\n"]}

package/dist/scripts/generate-github-matrix.js

@@ -1,10 +1,8 @@
-import { images, versionCombinations } from '../PT2VYI7I.js';
-import '../K7N3LKMZ.js';
-import { init_esm_shims } from '../2VBLSQAK.js';
+import { images, versionCombinations } from '../AY7HGKNR.js';
+import '../P6KJGYNA.js';
+import '../VUOMXK5T.js';
 import { runGithubMatrixGenerator } from '@layerzerolabs/vm-tooling';
 
-// src/scripts/generate-github-matrix.ts
-init_esm_shims();
 runGithubMatrixGenerator(images, "tools/vm-tooling/vm-tooling-stellar", versionCombinations).catch((error) => {
   console.error(error);
   process.exit(1);

package/dist/scripts/generate-github-matrix.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/scripts/generate-github-matrix.ts"],"names":["runGithubMatrixGenerator","images","versionCombinations","catch","error","console","process","exit"],"mappings":";;;;;;AAAA,cAAA,EAAA;AAIAA,wBAAAA,CAAyBC,QAAQ,qCAAA,EAAuCC,mBAAAA,CAAAA,CAAqBC,KAAAA,CACzF,CAACC,KAAAA,KAAAA;AACGC,EAAAA,OAAAA,CAAQD,MAAMA,KAAAA,CAAAA;AACdE,EAAAA,OAAAA,CAAQC,KAAK,CAAA,CAAA;AACjB,CAAA,CAAA","file":"generate-github-matrix.js","sourcesContent":["import { runGithubMatrixGenerator } from '@layerzerolabs/vm-tooling';\n\nimport { images, versionCombinations } from '../config';\n\nrunGithubMatrixGenerator(images, 'tools/vm-tooling/vm-tooling-stellar', versionCombinations).catch(\n    (error: unknown) => {\n        console.error(error);\n        process.exit(1);\n    },\n);\n"]}
+{"version":3,"sources":["../../src/scripts/generate-github-matrix.ts"],"names":["runGithubMatrixGenerator","images","versionCombinations","catch","error","console","process","exit"],"mappings":";;;;;AAIAA,wBAAAA,CAAyBC,QAAQ,qCAAA,EAAuCC,mBAAAA,CAAAA,CAAqBC,KAAAA,CACzF,CAACC,KAAAA,KAAAA;AACGC,EAAAA,OAAAA,CAAQD,MAAMA,KAAAA,CAAAA;AACdE,EAAAA,OAAAA,CAAQC,KAAK,CAAA,CAAA;AACjB,CAAA,CAAA","file":"generate-github-matrix.js","sourcesContent":["import { runGithubMatrixGenerator } from '@layerzerolabs/vm-tooling';\n\nimport { images, versionCombinations } from '../config';\n\nrunGithubMatrixGenerator(images, 'tools/vm-tooling/vm-tooling-stellar', versionCombinations).catch(\n    (error: unknown) => {\n        console.error(error);\n        process.exit(1);\n    },\n);\n"]}

package/package.json

@@ -20,16 +20,18 @@
   ],
   "dependencies": {
     "toml": "^3.0.0",
-    "@layerzerolabs/vm-tooling": "0.2.122"
+    "@layerzerolabs/deterministic-zip": "0.2.124",
+    "@layerzerolabs/vm-tooling": "0.2.124"
   },
   "devDependencies": {
+    "fflate": "^0.8.3",
     "tsup": "^8.4.0",
     "tsx": "^4.21.0",
     "typescript": "^5.8.2",
     "vitest": "^3.2.6",
-    "@layerzerolabs/tsup-configuration": "0.2.122",
-    "@layerzerolabs/typescript-configuration": "0.2.122",
-    "@layerzerolabs/vitest-configuration": "0.2.122"
+    "@layerzerolabs/tsup-configuration": "0.2.124",
+    "@layerzerolabs/typescript-configuration": "0.2.124",
+    "@layerzerolabs/vitest-configuration": "0.2.124"
   },
   "publishConfig": {
     "access": "public",
@@ -43,7 +45,7 @@
       "onesig-client"
     ]
   },
-  "version": "0.2.122",
+  "version": "0.2.124",
   "scripts": {
     "build": "tsup",
     "generate-github-matrix": "tsx src/scripts/generate-github-matrix.ts",

package/dist/2VBLSQAK.js

@@ -1,44 +0,0 @@
-import 'path';
-import 'url';
-
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var init_esm_shims = __esm({
-  "../../../node_modules/.pnpm/tsup@8.5.1_@swc+core@1.15.2_@swc+helpers@0.5.17__jiti@2.6.1_postcss@8.5.6_tsx@4.21.0_typescript@5.8.2_yaml@2.8.2/node_modules/tsup/assets/esm_shims.js"() {
-  }
-});
-
-export { __commonJS, __export, __name, __toESM, init_esm_shims };
-//# sourceMappingURL=2VBLSQAK.js.map
-//# sourceMappingURL=2VBLSQAK.js.map

package/dist/2VBLSQAK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../node_modules/.pnpm/tsup@8.5.1_@swc+core@1.15.2_@swc+helpers@0.5.17__jiti@2.6.1_postcss@8.5.6_tsx@4.21.0_typescript@5.8.2_yaml@2.8.2/node_modules/tsup/assets/esm_shims.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAA,cAAA,GAAA,KAAA,CAAA","file":"2VBLSQAK.js","sourcesContent":["// Shim globals in esm bundle\nimport path from 'node:path'\nimport { fileURLToPath } from 'node:url'\n\nconst getFilename = () => fileURLToPath(import.meta.url)\nconst getDirname = () => path.dirname(getFilename())\n\nexport const __dirname = /* @__PURE__ */ getDirname()\nexport const __filename = /* @__PURE__ */ getFilename()\n"]}

package/dist/6YPWRWU3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/verifiable-build.ts"],"names":["execFileAsync","promisify","execFile","SOURCE_MOUNT","VERIFIABLE_BUILD_PLATFORM","OFFICIAL_IMAGE_REPO","officialImageTagRef","stellarVersion","rustVersion","parseAmd64Digest","manifestInspectJson","manifests","JSON","parse","Array","isArray","Error","digest","find","platform","os","architecture","startsWith","resolveAmd64Digest","imageTagRef","stdout","maxBuffer","cause","buildVerifiableBuildDockerArgs","imageRef","sourceDir","buildArgs","bldimg","runDocker","dockerArgs","Promise","resolve","reject","child","spawn","stdio","on","error","code","signal","VerifiableBuildWrapper","run","args","options","tagRef","cwd","console","info","join"],"mappings":";;;;;AAAA,cAAA,EAAA;AAKA,IAAMA,aAAAA,GAAgBC,UAAUC,QAAAA,CAAAA;AAIhC,IAAMC,YAAAA,GAAe,SAAA;AAIrB,IAAMC,yBAAAA,GAA4B,aAAA;AAElC,IAAMC,mBAAAA,GAAsB,qBAAA;AAOrB,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,cAAAA,EAAwBC,WAAAA,KACxD,CAAA,EAAGH,mBAAAA,CAAAA,CAAAA,EAAuBE,cAAAA,CAAAA,KAAAA,EAAsBC,WAAAA,CAAAA,cAAAA,CAAAA,EADjB,qBAAA;AAgB5B,IAAMC,gBAAAA,2BAAoBC,mBAAAA,KAAAA;AAC7B,EAAA,MAAM,EAAEC,SAAAA,EAAS,GAAKC,IAAAA,CAAKC,MAAMH,mBAAAA,CAAAA;AAEjC,EAAA,IAAI,CAACI,KAAAA,CAAMC,OAAAA,CAAQJ,SAAAA,CAAAA,EAAY;AAC3B,IAAA,MAAM,IAAIK,MACN,oFAAA,CAAA;AAER,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,SAAAA,CAAUO,IAAAA,CACrB,CAAC,EAAEC,QAAAA,EAAQ,KAAOA,QAAAA,EAAUC,EAAAA,KAAO,OAAA,IAAWD,QAAAA,EAAUE,YAAAA,KAAiB,OAAA,CAAA,EAC1EJ,MAAAA;AAEH,EAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,CAACA,MAAAA,CAAOK,UAAAA,CAAW,SAAA,CAAA,EAAY;AAC7D,IAAA,MAAM,IAAIN,MAAM,0EAAA,CAAA;AACpB,EAAA;AAEA,EAAA,OAAOC,MAAAA;AACX,CAAA,EAlBgC,kBAAA;AAyBhC,IAAMM,kBAAAA,iCAA4BC,WAAAA,KAAAA;AAC9B,EAAA,IAAI;AACA,IAAA,MAAM,EAAEC,MAAAA,EAAM,GAAK,MAAMzB,cAAc,QAAA,EAAU;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAWwB,MAAAA;AAAc,KAAA,EAAA;AACnFE,MAAAA,SAAAA,EAAW,KAAK,IAAA,GAAO;KAC3B,CAAA;AACA,IAAA,OAAOjB,iBAAiBgB,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAASE,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIX,KAAAA,CACN,CAAA,4CAAA,EAA+CQ,WAAAA,CAAAA,8BAAAA,CAAAA,EAC/C;AAAEG,MAAAA;KAAM,CAAA;AAEhB,EAAA;AACJ,CAAA,EAZ2B,oBAAA,CAAA;AAsBpB,IAAMC,iDAAiC,MAAA,CAAA,CAAC,EAC3CC,UACAC,SAAAA,EACAC,SAAAA,EACAC,QAAM,KAMM;AACZ,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACA5B,EAAAA,yBAAAA;AACA,EAAA,IAAA;EACA,CAAA,EAAG0B,SAAAA,IAAa3B,YAAAA,CAAAA,CAAAA;AAChB,EAAA,IAAA;AACAA,EAAAA,YAAAA;AACA0B,EAAAA,QAAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;AACGE,EAAAA,GAAAA,SAAAA;;AAEH,EAAA,QAAA;AACA,EAAA,CAAA,OAAA,EAAUC,MAAAA,CAAAA;AAzBgC,CAAA,EAAA,gCAAA;AA4B9C,IAAMC,4BAAY,MAAA,CAAA,CAACC,UAAAA,KACf,IAAIC,OAAAA,CAAQ,CAACC,SAASC,MAAAA,KAAAA;AAClB,EAAA,MAAMC,KAAAA,GAAQC,KAAAA,CAAM,QAAA,EAAUL,UAAAA,EAAY;IAAEM,KAAAA,EAAO;GAAU,CAAA;AAC7DF,EAAAA,KAAAA,CAAMG,GAAG,OAAA,EAAS,CAACC,UACfL,MAAAA,CAAO,IAAIrB,MAAM,iDAAA,EAAmD;IAAEW,KAAAA,EAAOe;AAAM,GAAA,CAAA,CAAA,CAAA;AAEvFJ,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,EAAMC,MAAAA,KAAAA;AACrB,IAAA,IAAID,SAAS,CAAA,EAAG;AACZP,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHC,MAAAA,MAAAA,CACI,IAAIrB,KAAAA,CACA,CAAA,4CAAA,EACI4B,MAAAA,GAAS,CAAA,OAAA,EAAUA,MAAAA,CAAAA,CAAAA,GAAW,CAAA,KAAA,EAAQD,IAAAA,CAAAA,CAAM,CAAA,CAC9C,CAAA,CAAA;AAGd,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAnBc,WAAA,CAAA;AA4CX,IAAME,yBAAN,MAAMA;EA7Jb;;;AA8JI,EAAA,MAAaC,IACTC,IAAAA,EACA,EAAExC,cAAAA,EAAgBC,WAAAA,IAClBwC,OAAAA,EACa;AACb,IAAA,MAAMC,MAAAA,GAAS3C,mBAAAA,CAAoBC,cAAAA,EAAgBC,WAAAA,CAAAA;AACnD,IAAA,MAAMS,MAAAA,GAAS,MAAMM,kBAAAA,CAAmB0B,MAAAA,CAAAA;AACxC,IAAA,MAAMpB,QAAAA,GAAW,CAAA,EAAGxB,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAC3C,IAAA,MAAMe,MAAAA,GAAS,CAAA,UAAA,EAAa3B,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAEnD,IAAA,MAAMiB,aAAaN,8BAAAA,CAA+B;AAC9CC,MAAAA,QAAAA;AACAC,MAAAA,SAAAA,EAAWkB,OAAAA,CAAQE,GAAAA;MACnBnB,SAAAA,EAAWgB,IAAAA;AACXf,MAAAA;KACJ,CAAA;AAEAmB,IAAAA,OAAAA,CAAQC,KAAK,gFAAA,CAAA;AACbD,IAAAA,OAAAA,CAAQC,KAAK,CAAA,WAAA,EAAcvB,QAAAA,KAAazB,yBAAAA,CAAAA,WAAAA,EAAuC6C,MAAAA,CAAAA,CAAAA,CAAS,CAAA;AACxFE,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAcpB,MAAAA,CAAAA,CAAQ,CAAA;AACnCmB,IAAAA,OAAAA,CAAQC,KAAK,CAAA,UAAA,EAAalB,UAAAA,CAAWmB,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAM,CAAA;AAEhD,IAAA,MAAMpB,UAAUC,UAAAA,CAAAA;AACpB,EAAA;AACJ","file":"6YPWRWU3.js","sourcesContent":["import { execFile, spawn } from 'node:child_process';\nimport { promisify } from 'node:util';\n\nimport type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';\n\nconst execFileAsync = promisify(execFile);\n\n// The self-contained source is mounted here and built in place. The official image's WORKDIR is\n// already /source; we set it explicitly for clarity.\nconst SOURCE_MOUNT = '/source';\n\n// Canonical reproducible platform. External verifiers reproduce the amd64 artifact, so we always\n// run the amd64 image regardless of the host arch (the daemon emulates it when needed).\nconst VERIFIABLE_BUILD_PLATFORM = 'linux/amd64';\n\nconst OFFICIAL_IMAGE_REPO = 'stellar/stellar-cli';\n\n/**\n * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.\n * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the\n * only image the tool builds against.\n */\nexport const officialImageTagRef = (stellarVersion: string, rustVersion: string): string =>\n    `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`;\n\n/**\n * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so\n * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.\n */\n// The subset of `docker manifest inspect` output (an OCI image index) that we read.\ninterface ManifestDescriptor {\n    digest?: string;\n    platform?: { os?: string; architecture?: string };\n}\ninterface ManifestIndex {\n    manifests?: ManifestDescriptor[];\n}\n\nexport const parseAmd64Digest = (manifestInspectJson: string): string => {\n    const { manifests } = JSON.parse(manifestInspectJson) as ManifestIndex;\n\n    if (!Array.isArray(manifests)) {\n        throw new Error(\n            '`docker manifest inspect` did not return a multi-arch index (no `manifests` array)',\n        );\n    }\n\n    const digest = manifests.find(\n        ({ platform }) => platform?.os === 'linux' && platform?.architecture === 'amd64',\n    )?.digest;\n\n    if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {\n        throw new Error('No linux/amd64 manifest digest found in `docker manifest inspect` output');\n    }\n\n    return digest;\n};\n\n/**\n * Resolve the immutable linux/amd64 digest of a `stellar/stellar-cli` tag via a daemon-less\n * registry query (`docker manifest inspect`). This is the reproducible reference an external\n * verifier pins to (SEP-58).\n */\nconst resolveAmd64Digest = async (imageTagRef: string): Promise<string> => {\n    try {\n        const { stdout } = await execFileAsync('docker', ['manifest', 'inspect', imageTagRef], {\n            maxBuffer: 16 * 1024 * 1024,\n        });\n        return parseAmd64Digest(stdout);\n    } catch (cause) {\n        throw new Error(\n            `Failed to resolve the linux/amd64 digest of ${imageTagRef} (\\`docker manifest inspect\\`)`,\n            { cause },\n        );\n    }\n};\n\n/**\n * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /\n * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.\n *\n * The official image's ENTRYPOINT is `stellar`, so the trailing `contract build …` runs under it.\n * The source directory is assumed self-contained, so it is mounted at /source and built in place —\n * no surrounding workspace is required.\n */\nexport const buildVerifiableBuildDockerArgs = ({\n    imageRef,\n    sourceDir,\n    buildArgs,\n    bldimg,\n}: {\n    imageRef: string;\n    sourceDir: string;\n    buildArgs: string[];\n    bldimg: string;\n}): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '-v',\n    `${sourceDir}:${SOURCE_MOUNT}`,\n    '-w',\n    SOURCE_MOUNT,\n    imageRef,\n    'contract',\n    'build',\n    ...buildArgs,\n    // Embedded by us (not the user): the exact build image, so the WASM records what produced it.\n    '--meta',\n    `bldimg=${bldimg}`,\n];\n\nconst runDocker = (dockerArgs: string[]): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', dockerArgs, { stdio: 'inherit' });\n        child.on('error', (error) =>\n            reject(new Error('Failed to spawn docker for the verifiable build', { cause: error })),\n        );\n        child.on('close', (code, signal) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(\n                    new Error(\n                        `Verifiable build failed: docker exited with ${\n                            signal ? `signal ${signal}` : `code ${code}`\n                        }`,\n                    ),\n                );\n            }\n        });\n    });\n\nexport interface VerifiableBuildVersions {\n    stellarVersion: string;\n    rustVersion: string;\n}\n\n/**\n * Reproducible `stellar contract build` that runs inside the OFFICIAL `stellar/stellar-cli` image —\n * the exact package an external verifier uses — instead of our own dev image (whose sccache/mold\n * layers could change the WASM).\n *\n * The build runs the official image directly from the HOST: our TypeScript CLI already executes on\n * the host runner, so it can `docker run` the official image itself. This is what an external\n * verifier's plain `docker run` does, and it means we never bind-mount the host Docker socket into\n * a container — eliminating the container-escape / secret-leak surface that mounting the socket\n * would create.\n *\n * The image is `stellar/stellar-cli:<stellarVersion>-rust<rustVersion>-slim-bookworm`, pinned by the\n * caller. For a stable reference we resolve it to its linux/amd64 digest and both RUN that digest\n * and embed it as the `bldimg` WASM metadata (`docker.io/stellar/stellar-cli@sha256:…`) — the tool\n * does this automatically so callers never hand-inject `--meta bldimg=…`. The source directory (the\n * cwd, assumed self-contained) is mounted at /source and built in place, and the official image runs\n * as its own user/toolchain.\n */\nexport class VerifiableBuildWrapper {\n    public async run(\n        args: string[],\n        { stellarVersion, rustVersion }: VerifiableBuildVersions,\n        options: ToolCommandExecutionOptions,\n    ): Promise<void> {\n        const tagRef = officialImageTagRef(stellarVersion, rustVersion);\n        const digest = await resolveAmd64Digest(tagRef);\n        const imageRef = `${OFFICIAL_IMAGE_REPO}@${digest}`;\n        const bldimg = `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`;\n\n        const dockerArgs = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: options.cwd,\n            buildArgs: args,\n            bldimg,\n        });\n\n        console.info('🔒 Verifiable build (official stellar/stellar-cli image, run from host)');\n        console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);\n        console.info(`   bldimg: ${bldimg}`);\n        console.info(`   docker ${dockerArgs.join(' ')}`);\n\n        await runDocker(dockerArgs);\n    }\n}\n"]}