@layerzerolabs/vm-tooling-stellar 1.2.89 → 1.2.92

package/dist/{PY5UWW6H.js → UHZE5AHI.js}

@@ -1,5 +1,5 @@
-import { createStellarScopedWorkspacePruner } from './Z66N4WL7.js';
 import { syncToolchain } from './PFRVJTS7.js';
+import { createStellarScopedWorkspacePruner } from './Z66N4WL7.js';
 import { DockerRegistryMirror } from '@layerzerolabs/vm-tooling';
 
 var scopedWorkspacePruner = createStellarScopedWorkspacePruner();
@@ -109,5 +109,5 @@ var versionCombinations = [
 ];
 
 export { images, tools, versionCombinations };
-//# sourceMappingURL=PY5UWW6H.js.map
-//# sourceMappingURL=PY5UWW6H.js.map
+//# sourceMappingURL=UHZE5AHI.js.map
+//# sourceMappingURL=UHZE5AHI.js.map

package/dist/{PY5UWW6H.js.map → UHZE5AHI.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"names":["scopedWorkspacePruner","createStellarScopedWorkspacePruner","tools","name","preExecute","syncToolchain","dockerPlatform","defaultVolumes","type","containerPath","shared","hostPath","defaultEnv","value","images","versions","stellar","patch","mirrorRegistries","DockerRegistryMirror","PUBLIC_GAR","dependencies","rust","versionCombinations","description","stable"],"mappings":";;;;AAUA,IAAMA,wBAAwBC,kCAAAA,EAAAA;AAEvB,IAAMC,KAAAA,GAAoC;AAC7C,EAAA;IACIC,IAAAA,EAAM,SAAA;IACNC,UAAAA,EAAYC,aAAAA;IACZC,cAAAA,EAAgB,aAAA;AAChBN,IAAAA,qBAAAA;IACAO,cAAAA,EAAgB;;;AAGZ,MAAA;QACIC,IAAAA,EAAM,SAAA;QACNC,aAAAA,EAAe,gBAAA;QACfN,IAAAA,EAAM,gBAAA;QACNO,MAAAA,EAAQ;AACZ,OAAA;;AAEA,MAAA;QACIF,IAAAA,EAAM,SAAA;QACNC,aAAAA,EAAe,cAAA;QACfN,IAAAA,EAAM,eAAA;QACNO,MAAAA,EAAQ;AACZ,OAAA;;;AAGA,MAAA;QACIF,IAAAA,EAAM,SAAA;QACNC,aAAAA,EAAe,eAAA;QACfN,IAAAA,EAAM,gBAAA;QACNO,MAAAA,EAAQ;AACZ,OAAA;;AAEA,MAAA;QACIF,IAAAA,EAAM,MAAA;QACNC,aAAAA,EAAe,gBAAA;QACfE,QAAAA,EAAU;AACd;;IAEJC,UAAAA,EAAY;;AAER,MAAA;QAAET,IAAAA,EAAM,eAAA;QAAiBU,KAAAA,EAAO;AAAyB,OAAA;;AAEzD,MAAA;QAAEV,IAAAA,EAAM,8CAAA;QAAgDU,KAAAA,EAAO;AAAQ,OAAA;AACvE,MAAA;QAAEV,IAAAA,EAAM,+CAAA;QAAiDU,KAAAA,EAAO;AAAQ,OAAA;AACxE,MAAA;QACIV,IAAAA,EAAM,iDAAA;QACNU,KAAAA,EAAO;AACX,OAAA;AACA,MAAA;QACIV,IAAAA,EAAM,kDAAA;QACNU,KAAAA,EAAO;AACX;;AAER;;AAGG,IAAMC,MAAAA,GAAS;AAClB,EAAA,CAAC,gCAAA,GAAmC;IAChCX,IAAAA,EAAM,SAAA;IACNY,QAAAA,EAAU;MACNC,OAAAA,EAAS;AACb,KAAA;IACAC,KAAAA,EAAO,CAAA;IACPC,gBAAAA,EAAkB;MAACC,oBAAAA,CAAqBC;;AAC5C,GAAA;AACA,EAAA,CAAC,gCAAA,GAAmC;IAChCjB,IAAAA,EAAM,SAAA;IACNY,QAAAA,EAAU;MACNC,OAAAA,EAAS;AACb,KAAA;IACAC,KAAAA,EAAO,CAAA;IACPI,YAAAA,EAAc;MACVC,IAAAA,EAAM;AACV,KAAA;IACAJ,gBAAAA,EAAkB;MAACC,oBAAAA,CAAqBC;;AAC5C;AACJ;AAIO,IAAMG,mBAAAA,GACT;AACI,EAAA;IACIT,MAAAA,EAAQ;MACJE,OAAAA,EAAS;AACb,KAAA;IACAQ,WAAAA,EAAa,uBAAA;IACbC,MAAAA,EAAQ;AACZ,GAAA;AACA,EAAA;IACIX,MAAAA,EAAQ;MACJE,OAAAA,EAAS;AACb,KAAA;IACAQ,WAAAA,EAAa,gBAAA;IACbC,MAAAA,EAAQ;AACZ","file":"PY5UWW6H.js","sourcesContent":["import {\n    DockerRegistryMirror,\n    type Image,\n    type Tool,\n    type VersionCombination,\n} from '@layerzerolabs/vm-tooling';\n\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { createStellarScopedWorkspacePruner } from './scoped-workspace-pruner';\n\nconst scopedWorkspacePruner = createStellarScopedWorkspacePruner();\n\nexport const tools: readonly [Tool, ...Tool[]] = [\n    {\n        name: 'stellar',\n        preExecute: syncToolchain,\n        dockerPlatform: 'linux/amd64',\n        scopedWorkspacePruner,\n        defaultVolumes: [\n            // NOTE: for configuration commands, you should never put it in your package.json#build or #test, since the config is locked for parallel builds\n            // while common commands like contract build and binding generation are allowed since they are not writing to the config files\n            {\n                type: 'isolate',\n                containerPath: '/cache/stellar',\n                name: 'stellar-config',\n                shared: true,\n            },\n            // safe to be unlocked as it is POSIX lock guarded\n            {\n                type: 'isolate',\n                containerPath: '/cache/cargo',\n                name: 'stellar-cargo',\n                shared: true,\n            },\n            // shared across packages — toolchain is pre-synced via `sync-toolchain` (locked)\n            // so concurrent reads from build/test/lint are safe\n            {\n                type: 'isolate',\n                containerPath: '/cache/rustup',\n                name: 'stellar-rustup',\n                shared: true,\n            },\n            // safe as the worst case of corruption is cache miss, since it is key-based cache, concurrent writes will produce identical content\n            {\n                type: 'host',\n                containerPath: '/cache/sccache',\n                hostPath: '~/.sccache',\n            },\n        ],\n        defaultEnv: [\n            // sccache configuration\n            { name: 'RUSTC_WRAPPER', value: '/usr/local/bin/sccache' },\n            // mold linker for faster linking\n            { name: 'CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER', value: 'clang' },\n            { name: 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER', value: 'clang' },\n            {\n                name: 'CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS',\n                value: '-C link-arg=-fuse-ld=mold',\n            },\n            {\n                name: 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS',\n                value: '-C link-arg=-fuse-ld=mold',\n            },\n        ],\n    },\n];\n\nexport const images = {\n    ['stellar:stellar-25.1.0-patch-2']: {\n        name: 'stellar',\n        versions: {\n            stellar: '25.1.0',\n        },\n        patch: 2,\n        mirrorRegistries: [DockerRegistryMirror.PUBLIC_GAR],\n    },\n    ['stellar:stellar-25.2.0-patch-1']: {\n        name: 'stellar',\n        versions: {\n            stellar: '25.2.0',\n        },\n        patch: 1,\n        dependencies: {\n            rust: '1.91.0',\n        },\n        mirrorRegistries: [DockerRegistryMirror.PUBLIC_GAR],\n    },\n} satisfies Record<string, Image>;\n\nexport type ImageId = keyof typeof images;\n\nexport const versionCombinations: [VersionCombination<ImageId>, ...VersionCombination<ImageId>[]] =\n    [\n        {\n            images: {\n                stellar: 'stellar:stellar-25.1.0-patch-2',\n            },\n            description: 'Latest stable release',\n            stable: true,\n        },\n        {\n            images: {\n                stellar: 'stellar:stellar-25.2.0-patch-1',\n            },\n            description: 'Stellar 25.2.0',\n            stable: true,\n        },\n    ];\n"]}
+{"version":3,"sources":["../src/config.ts"],"names":["scopedWorkspacePruner","createStellarScopedWorkspacePruner","tools","name","preExecute","syncToolchain","dockerPlatform","defaultVolumes","type","containerPath","shared","hostPath","defaultEnv","value","images","versions","stellar","patch","mirrorRegistries","DockerRegistryMirror","PUBLIC_GAR","dependencies","rust","versionCombinations","description","stable"],"mappings":";;;;AAUA,IAAMA,wBAAwBC,kCAAAA,EAAAA;AAEvB,IAAMC,KAAAA,GAAoC;AAC7C,EAAA;IACIC,IAAAA,EAAM,SAAA;IACNC,UAAAA,EAAYC,aAAAA;IACZC,cAAAA,EAAgB,aAAA;AAChBN,IAAAA,qBAAAA;IACAO,cAAAA,EAAgB;;;AAGZ,MAAA;QACIC,IAAAA,EAAM,SAAA;QACNC,aAAAA,EAAe,gBAAA;QACfN,IAAAA,EAAM,gBAAA;QACNO,MAAAA,EAAQ;AACZ,OAAA;;AAEA,MAAA;QACIF,IAAAA,EAAM,SAAA;QACNC,aAAAA,EAAe,cAAA;QACfN,IAAAA,EAAM,eAAA;QACNO,MAAAA,EAAQ;AACZ,OAAA;;;AAGA,MAAA;QACIF,IAAAA,EAAM,SAAA;QACNC,aAAAA,EAAe,eAAA;QACfN,IAAAA,EAAM,gBAAA;QACNO,MAAAA,EAAQ;AACZ,OAAA;;AAEA,MAAA;QACIF,IAAAA,EAAM,MAAA;QACNC,aAAAA,EAAe,gBAAA;QACfE,QAAAA,EAAU;AACd;;IAEJC,UAAAA,EAAY;;AAER,MAAA;QAAET,IAAAA,EAAM,eAAA;QAAiBU,KAAAA,EAAO;AAAyB,OAAA;;AAEzD,MAAA;QAAEV,IAAAA,EAAM,8CAAA;QAAgDU,KAAAA,EAAO;AAAQ,OAAA;AACvE,MAAA;QAAEV,IAAAA,EAAM,+CAAA;QAAiDU,KAAAA,EAAO;AAAQ,OAAA;AACxE,MAAA;QACIV,IAAAA,EAAM,iDAAA;QACNU,KAAAA,EAAO;AACX,OAAA;AACA,MAAA;QACIV,IAAAA,EAAM,kDAAA;QACNU,KAAAA,EAAO;AACX;;AAER;;AAGG,IAAMC,MAAAA,GAAS;AAClB,EAAA,CAAC,gCAAA,GAAmC;IAChCX,IAAAA,EAAM,SAAA;IACNY,QAAAA,EAAU;MACNC,OAAAA,EAAS;AACb,KAAA;IACAC,KAAAA,EAAO,CAAA;IACPC,gBAAAA,EAAkB;MAACC,oBAAAA,CAAqBC;;AAC5C,GAAA;AACA,EAAA,CAAC,gCAAA,GAAmC;IAChCjB,IAAAA,EAAM,SAAA;IACNY,QAAAA,EAAU;MACNC,OAAAA,EAAS;AACb,KAAA;IACAC,KAAAA,EAAO,CAAA;IACPI,YAAAA,EAAc;MACVC,IAAAA,EAAM;AACV,KAAA;IACAJ,gBAAAA,EAAkB;MAACC,oBAAAA,CAAqBC;;AAC5C;AACJ;AAIO,IAAMG,mBAAAA,GACT;AACI,EAAA;IACIT,MAAAA,EAAQ;MACJE,OAAAA,EAAS;AACb,KAAA;IACAQ,WAAAA,EAAa,uBAAA;IACbC,MAAAA,EAAQ;AACZ,GAAA;AACA,EAAA;IACIX,MAAAA,EAAQ;MACJE,OAAAA,EAAS;AACb,KAAA;IACAQ,WAAAA,EAAa,gBAAA;IACbC,MAAAA,EAAQ;AACZ","file":"UHZE5AHI.js","sourcesContent":["import {\n    DockerRegistryMirror,\n    type Image,\n    type Tool,\n    type VersionCombination,\n} from '@layerzerolabs/vm-tooling';\n\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { createStellarScopedWorkspacePruner } from './scoped-workspace-pruner';\n\nconst scopedWorkspacePruner = createStellarScopedWorkspacePruner();\n\nexport const tools: readonly [Tool, ...Tool[]] = [\n    {\n        name: 'stellar',\n        preExecute: syncToolchain,\n        dockerPlatform: 'linux/amd64',\n        scopedWorkspacePruner,\n        defaultVolumes: [\n            // NOTE: for configuration commands, you should never put it in your package.json#build or #test, since the config is locked for parallel builds\n            // while common commands like contract build and binding generation are allowed since they are not writing to the config files\n            {\n                type: 'isolate',\n                containerPath: '/cache/stellar',\n                name: 'stellar-config',\n                shared: true,\n            },\n            // safe to be unlocked as it is POSIX lock guarded\n            {\n                type: 'isolate',\n                containerPath: '/cache/cargo',\n                name: 'stellar-cargo',\n                shared: true,\n            },\n            // shared across packages — toolchain is pre-synced via `sync-toolchain` (locked)\n            // so concurrent reads from build/test/lint are safe\n            {\n                type: 'isolate',\n                containerPath: '/cache/rustup',\n                name: 'stellar-rustup',\n                shared: true,\n            },\n            // safe as the worst case of corruption is cache miss, since it is key-based cache, concurrent writes will produce identical content\n            {\n                type: 'host',\n                containerPath: '/cache/sccache',\n                hostPath: '~/.sccache',\n            },\n        ],\n        defaultEnv: [\n            // sccache configuration\n            { name: 'RUSTC_WRAPPER', value: '/usr/local/bin/sccache' },\n            // mold linker for faster linking\n            { name: 'CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER', value: 'clang' },\n            { name: 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER', value: 'clang' },\n            {\n                name: 'CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS',\n                value: '-C link-arg=-fuse-ld=mold',\n            },\n            {\n                name: 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS',\n                value: '-C link-arg=-fuse-ld=mold',\n            },\n        ],\n    },\n];\n\nexport const images = {\n    ['stellar:stellar-25.1.0-patch-2']: {\n        name: 'stellar',\n        versions: {\n            stellar: '25.1.0',\n        },\n        patch: 2,\n        mirrorRegistries: [DockerRegistryMirror.PUBLIC_GAR],\n    },\n    ['stellar:stellar-25.2.0-patch-1']: {\n        name: 'stellar',\n        versions: {\n            stellar: '25.2.0',\n        },\n        patch: 1,\n        dependencies: {\n            rust: '1.91.0',\n        },\n        mirrorRegistries: [DockerRegistryMirror.PUBLIC_GAR],\n    },\n} satisfies Record<string, Image>;\n\nexport type ImageId = keyof typeof images;\n\nexport const versionCombinations: [VersionCombination<ImageId>, ...VersionCombination<ImageId>[]] =\n    [\n        {\n            images: {\n                stellar: 'stellar:stellar-25.1.0-patch-2',\n            },\n            description: 'Latest stable release',\n            stable: true,\n        },\n        {\n            images: {\n                stellar: 'stellar:stellar-25.2.0-patch-1',\n            },\n            description: 'Stellar 25.2.0',\n            stable: true,\n        },\n    ];\n"]}

package/dist/{D25LP26W.js → WS6TQMPT.js}

@@ -7,6 +7,7 @@ import { tmpdir } from 'os';
 import path from 'path';
 import { promisify } from 'util';
 import { parse } from 'toml';
+import { parseImageIndexPlatforms } from '@layerzerolabs/vm-tooling';
 
 var execFileAsync = promisify(execFile);
 var SOURCE_ARCHIVE_NAME = "contracts-source.zip";
@@ -17,11 +18,11 @@ var OFFICIAL_IMAGE_REPO = "stellar/stellar-cli";
 var META_FLAG = "--meta";
 var officialImageTagRef = /* @__PURE__ */ __name((stellarVersion, rustVersion) => `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`, "officialImageTagRef");
 var parseAmd64Digest = /* @__PURE__ */ __name((manifestInspectJson) => {
-  const { manifests } = JSON.parse(manifestInspectJson);
-  if (!Array.isArray(manifests)) {
+  const platforms = parseImageIndexPlatforms(JSON.parse(manifestInspectJson));
+  if (!platforms) {
     throw new Error("`docker manifest inspect` did not return a multi-arch index (no `manifests` array)");
   }
-  const digest = manifests.find(({ platform }) => platform?.os === "linux" && platform?.architecture === "amd64")?.digest;
+  const digest = platforms.find(({ platform }) => platform === VERIFIABLE_BUILD_PLATFORM)?.digest;
   if (typeof digest !== "string" || !digest.startsWith("sha256:")) {
     throw new Error("No linux/amd64 manifest digest found in `docker manifest inspect` output");
   }
@@ -433,5 +434,5 @@ var runVerifiableBuildFromArchive = /* @__PURE__ */ __name(async ({ archive, pac
 }, "runVerifiableBuildFromArchive");
 
 export { VerifiableBuildWrapper, buildArchiveContractArgs, buildPermissionRepairDockerArgs, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, copyFileWithPermissionRepair, officialImageTagRef, parseAmd64Digest, parsePackageSpec, resolveBuildDir, resolveRustVersion, runVerifiableBuildFromArchive, wasmArtifactName };
-//# sourceMappingURL=D25LP26W.js.map
-//# sourceMappingURL=D25LP26W.js.map
+//# sourceMappingURL=WS6TQMPT.js.map
+//# sourceMappingURL=WS6TQMPT.js.map

package/dist/WS6TQMPT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/verifiable-build.ts"],"names":["execFileAsync","promisify","execFile","SOURCE_ARCHIVE_NAME","WASM_TARGET_DIR","path","join","SOURCE_MOUNT","VERIFIABLE_BUILD_PLATFORM","OFFICIAL_IMAGE_REPO","META_FLAG","officialImageTagRef","stellarVersion","rustVersion","parseAmd64Digest","manifestInspectJson","platforms","parseImageIndexPlatforms","JSON","parse","Error","digest","find","platform","startsWith","resolveAmd64Digest","imageTagRef","stdout","maxBuffer","timeout","cause","metaKey","entry","eq","indexOf","slice","canonicalizeMetaArgs","buildArgs","injectedMeta","reservedKeys","Set","map","metas","passthrough","addCallerMeta","value","has","push","i","length","arg","undefined","sort","flatMap","meta","buildVerifiableBuildDockerArgs","imageRef","sourceDir","bldimg","resolveBuildDir","cwd","resolve","runDocker","dockerArgs","Promise","reject","child","spawn","stdio","on","error","code","signal","VerifiableBuildWrapper","imagesByTag","Map","resolveDigest","resolveImage","tagRef","existing","get","resolved","then","set","run","args","versions","buildDir","stat","isDirectory","chmod","console","info","parsePackageSpec","spec","colon","stringify","packageName","manifestPath","wasmArtifactName","replaceAll","validatePackageSpecs","packages","artifactNames","artifactName","add","resolveRustVersion","rustVersionFlag","toolchainPath","contents","readFile","parsed","channel","toolchain","buildArchiveContractArgs","sourceSha256","pathExists","filePath","readArchiveBytes","archive","bytes","Uint8Array","extractZip","destDir","expectedRootDirName","files","unzipSync","destRoot","expectedRoot","expectedRootPrefix","relPath","content","Object","entries","outPath","sep","endsWith","mkdir","dirname","recursive","writeFile","persistSourceArchive","archiveBytes","stagingDir","copyFileWithPermissionRepair","source","destination","repairPermissions","copy","copyFile","persistWasm","buildRoot","wasmName","builtPath","publishArtifacts","outputDir","parentDir","outputBase","basename","nextDir","mkdtemp","backupDir","readdir","rename","rm","force","catch","warn","buildPermissionRepairDockerArgs","dir","relaxDockerOwnedPermissions","removeTempDir","tempDir","runVerifiableBuildFromArchive","createHash","update","tmpdir","extractionDir","wrapper","rootDirName","packageSpec"],"mappings":";;;;;;;;;;;AAuBA,IAAMA,aAAAA,GAAgBC,UAAUC,QAAAA,CAAAA;AAEhC,IAAMC,mBAAAA,GAAsB,sBAAA;AAC5B,IAAMC,eAAAA,GAAkBC,IAAAA,CAAKC,IAAAA,CAAK,QAAA,EAAU,iBAAiB,SAAA,CAAA;AAI7D,IAAMC,YAAAA,GAAe,SAAA;AAIrB,IAAMC,yBAAAA,GAA4B,aAAA;AAElC,IAAMC,mBAAAA,GAAsB,qBAAA;AAE5B,IAAMC,SAAAA,GAAY,QAAA;AAqCX,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,cAAAA,EAAwBC,WAAAA,KACxD,CAAA,EAAGJ,mBAAAA,CAAAA,CAAAA,EAAuBG,cAAAA,CAAAA,KAAAA,EAAsBC,WAAAA,CAAAA,cAAAA,CAAAA,EADjB,qBAAA;AAO5B,IAAMC,gBAAAA,2BAAoBC,mBAAAA,KAAAA;AAC7B,EAAA,MAAMC,SAAAA,GAAYC,wBAAAA,CAAyBC,IAAAA,CAAKC,KAAAA,CAAMJ,mBAAAA,CAAAA,CAAAA;AAEtD,EAAA,IAAI,CAACC,SAAAA,EAAW;AACZ,IAAA,MAAM,IAAII,MACN,oFAAA,CAAA;AAER,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASL,UAAUM,IAAAA,CAAK,CAAC,EAAEC,QAAAA,EAAQ,KAAOA,QAAAA,KAAaf,yBAAAA,CAAAA,EAA4Ba,MAAAA;AAEzF,EAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,CAACA,MAAAA,CAAOG,UAAAA,CAAW,SAAA,CAAA,EAAY;AAC7D,IAAA,MAAM,IAAIJ,MAAM,0EAAA,CAAA;AACpB,EAAA;AAEA,EAAA,OAAOC,MAAAA;AACX,CAAA,EAhBgC,kBAAA;AAuBhC,IAAMI,kBAAAA,iCAA4BC,WAAAA,KAAAA;AAC9B,EAAA,IAAI;AACA,IAAA,MAAM,EAAEC,MAAAA,EAAM,GAAK,MAAM3B,cAAc,QAAA,EAAU;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW0B,MAAAA;AAAc,KAAA,EAAA;AACnFE,MAAAA,SAAAA,EAAW,KAAK,IAAA,GAAO,IAAA;MACvBC,OAAAA,EAAS;KACb,CAAA;AACA,IAAA,OAAOf,iBAAiBa,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIV,KAAAA,CACN,CAAA,4CAAA,EAA+CM,WAAAA,CAAAA,8BAAAA,CAAAA,EAC/C;AAAEI,MAAAA;KAAM,CAAA;AAEhB,EAAA;AACJ,CAAA,EAb2B,oBAAA,CAAA;AAgB3B,IAAMC,OAAAA,2BAAWC,KAAAA,KAAAA;AACb,EAAA,MAAMC,EAAAA,GAAKD,KAAAA,CAAME,OAAAA,CAAQ,GAAA,CAAA;AACzB,EAAA,OAAOD,OAAO,EAAA,GAAKD,KAAAA,GAAQA,KAAAA,CAAMG,KAAAA,CAAM,GAAGF,EAAAA,CAAAA;AAC9C,CAAA,EAHgB,SAAA,CAAA;AAeT,IAAMG,oBAAAA,mBAAuB,MAAA,CAAA,CAACC,SAAAA,EAAqBC,YAAAA,KAAAA;AACtD,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIF,YAAAA,CAAaG,GAAAA,CAAIV,OAAAA,CAAAA,CAAAA;AAC9C,EAAA,MAAMW,KAAAA,GAAQ;AAAIJ,IAAAA,GAAAA;;AAClB,EAAA,MAAMK,cAAwB,EAAA;AAE9B,EAAA,MAAMC,aAAAA,2BAAiBC,KAAAA,KAAAA;AACnB,IAAA,IAAI,CAACN,aAAaO,GAAAA,CAAIf,OAAAA,CAAQc,KAAAA,CAAAA,CAAAA,EAASH,KAAAA,CAAMK,IAAAA,CAAKF,KAAAA,CAAAA;EACtD,CAAA,EAFsB,eAAA,CAAA;AAItB,EAAA,KAAA,IAASG,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIX,SAAAA,CAAUY,QAAQD,CAAAA,EAAAA,EAAK;AACvC,IAAA,MAAME,GAAAA,GAAMb,UAAUW,CAAAA,CAAAA;AACtB,IAAA,IAAIE,QAAQC,MAAAA,EAAW;AACvB,IAAA,IAAID,QAAQxC,SAAAA,EAAW;AACnB,MAAA,MAAMmC,KAAAA,GAAQR,SAAAA,CAAUW,CAAAA,GAAI,CAAA,CAAA;AAC5B,MAAA,IAAIH,UAAUM,MAAAA,IAAa,CAACN,KAAAA,CAAMrB,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChDoB,QAAAA,aAAAA,CAAcC,KAAAA,CAAAA;AACdG,QAAAA,CAAAA,IAAK,CAAA;AACT,MAAA;AACJ,IAAA,CAAA,MAAA,IAAWE,GAAAA,CAAI1B,UAAAA,CAAW,CAAA,EAAGd,SAAAA,GAAY,CAAA,EAAG;AACxCkC,MAAAA,aAAAA,CAAcM,GAAAA,CAAIf,KAAAA,CAAMzB,SAAAA,CAAUuC,MAAAA,GAAS,CAAA,CAAA,CAAA;IAC/C,CAAA,MAAO;AACHN,MAAAA,WAAAA,CAAYI,KAAKG,GAAAA,CAAAA;AACrB,IAAA;AACJ,EAAA;AAEAR,EAAAA,KAAAA,CAAMU,IAAAA,EAAI;AACV,EAAA,OAAO;AAAIT,IAAAA,GAAAA,WAAAA;OAAgBD,KAAAA,CAAMW,OAAAA,CAAQ,CAACC,IAAAA,KAAS;AAAC5C,MAAAA,SAAAA;AAAW4C,MAAAA;AAAK,KAAA;;AACxE,CAAA,EA3BoC,sBAAA;AAiC7B,IAAMC,iDAAiC,MAAA,CAAA,CAAC,EAC3CC,UACAC,SAAAA,EACApB,SAAAA,EACAqB,QAAM,KAMM;AACZ,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACAlD,EAAAA,yBAAAA;AACA,EAAA,IAAA;EACA,CAAA,EAAGiD,SAAAA,IAAalD,YAAAA,CAAAA,CAAAA;AAChB,EAAA,IAAA;AACAA,EAAAA,YAAAA;AACAiD,EAAAA,QAAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;AACGpB,EAAAA,GAAAA,oBAAAA,CAAqBC,SAAAA,EAAW;AAAC,IAAA,CAAA,OAAA,EAAUqB,MAAAA,CAAAA;AAAS,GAAA;AAtBb,CAAA,EAAA,gCAAA;AA6BvC,IAAMC,eAAAA,2BAAmBC,GAAAA,EAAaH,SAAAA,KACzCpD,KAAKwD,OAAAA,CAAQD,GAAAA,EAAKH,SAAAA,IAAa,GAAA,CAAA,EADJ,iBAAA;AAG/B,IAAMK,4BAAY,MAAA,CAAA,CAACC,UAAAA,KACf,IAAIC,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,KAAAA,GAAQC,KAAAA,CAAM,QAAA,EAAUJ,UAAAA,EAAY;IAAEK,KAAAA,EAAO;GAAU,CAAA;AAC7DF,EAAAA,KAAAA,CAAMG,GAAG,OAAA,EAAS,CAACC,UACfL,MAAAA,CAAO,IAAI7C,MAAM,iDAAA,EAAmD;IAAEU,KAAAA,EAAOwC;AAAM,GAAA,CAAA,CAAA,CAAA;AAEvFJ,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,EAAMC,MAAAA,KAAAA;AACrB,IAAA,IAAID,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CACI,IAAI7C,KAAAA,CACA,CAAA,4CAAA,EACIoD,MAAAA,GAAS,CAAA,OAAA,EAAUA,MAAAA,CAAAA,CAAAA,GAAW,CAAA,KAAA,EAAQD,IAAAA,CAAAA,CAAM,CAAA,CAC9C,CAAA,CAAA;AAGd,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAnBc,WAAA,CAAA;AAyBX,IAAME,yBAAN,MAAMA;EAlOb;;;;AAmOqBC,EAAAA,WAAAA,uBAAkBC,GAAAA,EAAAA;AAEnC,EAAA,WAAA,CACqBC,gBAEMnD,kBAAAA,EACzB;SAHmBmD,aAAAA,GAAAA,aAAAA;AAGlB,EAAA;EAEIC,YAAAA,CAAa,EAChBjE,cAAAA,EACAC,WAAAA,EAAW,EACoD;AAC/D,IAAA,MAAMiE,MAAAA,GAASnE,mBAAAA,CAAoBC,cAAAA,EAAgBC,WAAAA,CAAAA;AACnD,IAAA,MAAMkE,QAAAA,GAAW,IAAA,CAAKL,WAAAA,CAAYM,GAAAA,CAAIF,MAAAA,CAAAA;AACtC,IAAA,IAAIC,aAAa5B,MAAAA,EAAW;AACxB,MAAA,OAAO4B,QAAAA;AACX,IAAA;AAEA,IAAA,MAAME,WAAW,IAAA,CAAKL,aAAAA,CAAcE,MAAAA,CAAAA,CAAQI,IAAAA,CAAK,CAAC7D,MAAAA,MAAY;MAC1DmC,QAAAA,EAAU,CAAA,EAAG/C,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;MACpCqC,MAAAA,EAAQ,CAAA,UAAA,EAAajD,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAC5CyD,MAAAA;KACJ,CAAA,CAAA;AACA,IAAA,IAAA,CAAKJ,WAAAA,CAAYS,GAAAA,CAAIL,MAAAA,EAAQG,QAAAA,CAAAA;AAC7B,IAAA,OAAOA,QAAAA;AACX,EAAA;AAEA,EAAA,MAAaG,IACTC,IAAAA,EACAC,QAAAA,EACA,EAAE1B,GAAAA,IACFH,SAAAA,EACa;AACb,IAAA,MAAM8B,QAAAA,GAAW5B,eAAAA,CAAgBC,GAAAA,EAAKH,SAAAA,CAAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,EAAE,MAAM+B,IAAAA,CAAKD,QAAAA,CAAAA,EAAWE,aAAW,EAAI;AACvC,QAAA,MAAM,IAAIrE,MAAM,iBAAA,CAAA;AACpB,MAAA;AACJ,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACZ,MAAA,MAAM,IAAIV,KAAAA,CACN,CAAA,gEAAA,EAAmEmE,QAAAA,CAAAA,CAAAA,EACnE;AAAEzD,QAAAA;OAAM,CAAA;AAEhB,IAAA;AAMA,IAAA,IAAI2B,cAAcN,MAAAA,EAAW;AACzB,MAAA,MAAMuC,KAAAA,CAAMH,UAAU,GAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,MAAM,EAAE/B,UAAUE,MAAAA,EAAQoB,MAAAA,KAAW,MAAM,IAAA,CAAKD,aAAaS,QAAAA,CAAAA;AAE7D,IAAA,MAAMvB,aAAaR,8BAAAA,CAA+B;AAC9CC,MAAAA,QAAAA;MACAC,SAAAA,EAAW8B,QAAAA;MACXlD,SAAAA,EAAWgD,IAAAA;AACX3B,MAAAA;KACJ,CAAA;AAEAiC,IAAAA,OAAAA,CAAQC,KAAK,gFAAA,CAAA;AACbD,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAcL,QAAAA,CAAAA,CAAU,CAAA;AACrCI,IAAAA,OAAAA,CAAQC,KAAK,CAAA,WAAA,EAAcpC,QAAAA,KAAahD,yBAAAA,CAAAA,WAAAA,EAAuCsE,MAAAA,CAAAA,CAAAA,CAAS,CAAA;AACxFa,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAclC,MAAAA,CAAAA,CAAQ,CAAA;AACnCiC,IAAAA,OAAAA,CAAQC,KAAK,CAAA,UAAA,EAAa7B,UAAAA,CAAWzD,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAM,CAAA;AAEhD,IAAA,MAAMwD,UAAUC,UAAAA,CAAAA;AACpB,EAAA;AACJ;AAKO,IAAM8B,gBAAAA,2BAAoBC,IAAAA,KAAAA;AAC7B,EAAA,MAAMC,KAAAA,GAAQD,IAAAA,CAAK5D,OAAAA,CAAQ,GAAA,CAAA;AAC3B,EAAA,IAAI6D,KAAAA,IAAS,CAAA,IAAKA,KAAAA,KAAUD,IAAAA,CAAK7C,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI7B,KAAAA,CACN,CAAA,uBAAA,EAA0BF,KAAK8E,SAAAA,CAAUF,IAAAA,CAAAA,CAAAA,iCAAAA,CAAwC,CAAA;AAEzF,EAAA;AAEA,EAAA,OAAO;IACHG,WAAAA,EAAaH,IAAAA,CAAK3D,KAAAA,CAAM,CAAA,EAAG4D,KAAAA,CAAAA;IAC3BG,YAAAA,EAAcJ,IAAAA,CAAK3D,KAAAA,CAAM4D,KAAAA,GAAQ,CAAA;AACrC,GAAA;AACJ,CAAA,EAZgC,kBAAA;AAezB,IAAMI,gBAAAA,2BAAoBF,WAAAA,KAC7B,CAAA,EAAGA,YAAYG,UAAAA,CAAW,GAAA,EAAK,GAAA,CAAA,CAAA,KAAA,CAAA,EADH,kBAAA;AAGhC,IAAMC,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAC1B,EAAA,MAAMC,aAAAA,uBAAoB/D,GAAAA,EAAAA;AAC1B,EAAA,KAAA,MAAW,EAAEyD,WAAAA,EAAW,IAAMK,QAAAA,EAAU;AACpC,IAAA,MAAME,YAAAA,GAAeL,iBAAiBF,WAAAA,CAAAA;AACtC,IAAA,IAAIM,aAAAA,CAAczD,GAAAA,CAAI0D,YAAAA,CAAAA,EAAe;AACjC,MAAA,MAAM,IAAIpF,KAAAA,CAAM,CAAA,wBAAA,EAA2BoF,YAAAA,CAAAA,uBAAAA,CAAqC,CAAA;AACpF,IAAA;AACAD,IAAAA,aAAAA,CAAcE,IAAID,YAAAA,CAAAA;AACtB,EAAA;AACJ,CAAA,EAT6B,sBAAA,CAAA;AAetB,IAAME,kBAAAA,mBAAqB,MAAA,CAAA,OAC9BjD,SAAAA,EACAkD,eAAAA,KAAAA;AAEA,EAAA,IAAIA,oBAAoBxD,MAAAA,EAAW;AAC/B,IAAA,OAAOwD,eAAAA;AACX,EAAA;AAEA,EAAA,MAAMC,aAAAA,GAAgBvG,IAAAA,CAAKC,IAAAA,CAAKmD,SAAAA,EAAW,qBAAA,CAAA;AAC3C,EAAA,IAAIoD,QAAAA;AACJ,EAAA,IAAI;AACAA,IAAAA,QAAAA,GAAW,MAAMC,QAAAA,CAASF,aAAAA,EAAe,OAAA,CAAA;AAC7C,EAAA,CAAA,CAAA,OAAS9E,KAAAA,EAAO;AACZ,IAAA,IAAKA,KAAAA,CAA4ByC,SAAS,QAAA,EAAU;AAChD,MAAA,MAAM,IAAInD,KAAAA,CACN,CAAA,+BAAA,EAAkCqC,SAAAA,CAAAA,mCAAAA,CAAAA,EAClC;AAAE3B,QAAAA;OAAM,CAAA;AAEhB,IAAA;AACA,IAAA,MAAMA,KAAAA;AACV,EAAA;AAEA,EAAA,MAAMiF,MAAAA,GAAS5F,MAAM0F,QAAAA,CAAAA;AACrB,EAAA,MAAMG,OAAAA,GAAUD,OAAOE,SAAAA,EAAWD,OAAAA;AAClC,EAAA,IAAI,OAAOA,OAAAA,KAAY,QAAA,IAAYA,OAAAA,CAAQ/D,WAAW,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI7B,KAAAA,CAAM,CAAA,+BAAA,EAAkCwF,aAAAA,CAAAA,CAAe,CAAA;AACrE,EAAA;AAEA,EAAA,OAAOI,OAAAA;AACX,CAAA,EA7BkC,oBAAA;AAoC3B,IAAME,2CAA2B,MAAA,CAAA,CACpC,EAAEjB,WAAAA,EAAaC,YAAAA,IACfiB,YAAAA,KACW;AACX,EAAA,iBAAA;AACAjB,EAAAA,YAAAA;AACA,EAAA,WAAA;AACAD,EAAAA,WAAAA;AACA,EAAA,YAAA;AACA,EAAA,QAAA;AACA,EAAA,CAAA,uBAAA,EAA0BC,YAAAA,CAAAA,CAAAA;AAC1B,EAAA,QAAA;AACA,EAAA,CAAA,iBAAA,EAAoBD,WAAAA,CAAAA,CAAAA;AACpB,EAAA,QAAA;AACA,EAAA,mBAAA;AACA,EAAA,QAAA;AACA,EAAA,CAAA,cAAA,EAAiBkB,YAAAA,CAAAA;AAhBmB,CAAA,EAAA,0BAAA;AAmBxC,IAAMC,UAAAA,iCAAoBC,QAAAA,KAAAA;AACtB,EAAA,IAAI;AACA,IAAA,MAAM7B,KAAK6B,QAAAA,CAAAA;AACX,IAAA,OAAO,IAAA;AACX,EAAA,CAAA,CAAA,OAAS/C,KAAAA,EAAO;AACZ,IAAA,IAAKA,KAAAA,CAA4BC,SAAS,QAAA,EAAU;AAChD,MAAA,OAAO,KAAA;AACX,IAAA;AACA,IAAA,MAAMD,KAAAA;AACV,EAAA;AACJ,CAAA,EAVmB,YAAA,CAAA;AAYnB,IAAMgD,gBAAAA,iCAA0BC,OAAAA,KAAAA;AAC5B,EAAA,IAAIC,KAAAA;AACJ,EAAA,IAAI;AACAA,IAAAA,KAAAA,GAAQ,IAAIC,UAAAA,CAAW,MAAMX,QAAAA,CAASS,OAAAA,CAAAA,CAAAA;AAC1C,EAAA,CAAA,CAAA,OAASzF,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIV,KAAAA,CAAM,CAAA,iCAAA,EAAoCmG,OAAAA,CAAAA,CAAAA,EAAW;AAAEzF,MAAAA;KAAM,CAAA;AAC3E,EAAA;AAEA,EAAA,IAAI0F,KAAAA,CAAMvE,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI7B,KAAAA,CAAM,CAAA,kBAAA,EAAqBmG,OAAAA,CAAAA,CAAS,CAAA;AAClD,EAAA;AAEA,EAAA,OAAOC,KAAAA;AACX,CAAA,EAbyB,kBAAA,CAAA;AAezB,IAAME,UAAAA,mBAAa,MAAA,CAAA,OACfF,KAAAA,EACAG,OAAAA,EACAC,mBAAAA,KAAAA;AAEA,EAAA,MAAMC,KAAAA,GAAQC,UAAUN,KAAAA,CAAAA;AACxB,EAAA,MAAMO,QAAAA,GAAW1H,IAAAA,CAAKwD,OAAAA,CAAQ8D,OAAAA,CAAAA;AAC9B,EAAA,MAAMK,YAAAA,GAAe3H,IAAAA,CAAKC,IAAAA,CAAKyH,QAAAA,EAAUH,mBAAAA,CAAAA;AACzC,EAAA,MAAMK,kBAAAA,GAAqB,GAAGL,mBAAAA,CAAAA,CAAAA,CAAAA;AAE9B,EAAA,KAAA,MAAW,CAACM,OAAAA,EAASC,OAAAA,KAAYC,MAAAA,CAAOC,OAAAA,CAAQR,KAAAA,CAAAA,EAAQ;AACpD,IAAA,MAAMS,OAAAA,GAAUjI,IAAAA,CAAKwD,OAAAA,CAAQkE,QAAAA,EAAUG,OAAAA,CAAAA;AACvC,IAAA,IAAII,OAAAA,KAAYP,YAAY,CAACO,OAAAA,CAAQ9G,WAAWuG,QAAAA,GAAW1H,IAAAA,CAAKkI,GAAG,CAAA,EAAG;AAClE,MAAA,MAAM,IAAInH,KAAAA,CAAM,CAAA,+BAAA,EAAkC8G,OAAAA,CAAAA,CAAS,CAAA;AAC/D,IAAA;AACA,IAAA,IAAII,OAAAA,KAAYN,gBAAgB,CAACM,OAAAA,CAAQ9G,WAAWwG,YAAAA,GAAe3H,IAAAA,CAAKkI,GAAG,CAAA,EAAG;AAC1E,MAAA,MAAM,IAAInH,KAAAA,CACN,CAAA,wCAAA,EAA2C6G,kBAAAA,CAAAA,EAAAA,EAAuBC,OAAAA,CAAAA,CAAS,CAAA;AAEnF,IAAA;AACA,IAAA,IAAIA,OAAAA,CAAQM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAE3B,IAAA,MAAMC,KAAAA,CAAMpI,IAAAA,CAAKqI,OAAAA,CAAQJ,OAAAA,CAAAA,EAAU;MAAEK,SAAAA,EAAW;KAAK,CAAA;AACrD,IAAA,MAAMC,SAAAA,CAAUN,SAASH,OAAAA,CAAAA;AAC7B,EAAA;AACJ,CAAA,EAzBmB,YAAA,CAAA;AA2BnB,IAAMU,oBAAAA,mBAAuB,MAAA,CAAA,OACzBC,YAAAA,EACAC,UAAAA,KAAAA;AAEA,EAAA,MAAMN,MAAMM,UAAAA,EAAY;IAAEJ,SAAAA,EAAW;GAAK,CAAA;AAC1C,EAAA,MAAMC,UAAUvI,IAAAA,CAAKC,IAAAA,CAAKyI,UAAAA,EAAY5I,mBAAAA,GAAsB2I,YAAAA,CAAAA;AAChE,CAAA,EAN6B,sBAAA,CAAA;AAQtB,IAAME,+CAA+B,MAAA,CAAA,OACxCC,MAAAA,EACAC,WAAAA,EACAC,iBAAAA,EACAC,OAA+DC,QAAAA,KAAQ;AAEvE,EAAA,IAAI;AACA,IAAA,MAAMD,IAAAA,CAAKH,QAAQC,WAAAA,CAAAA;AACvB,EAAA,CAAA,CAAA,OAAS5E,KAAAA,EAAO;AACZ,IAAA,MAAMC,OAAQD,KAAAA,CAA4BC,IAAAA;AAC1C,IAAA,IAAIA,IAAAA,KAAS,QAAA,IAAYA,IAAAA,KAAS,OAAA,EAAS;AACvC,MAAA,MAAMD,KAAAA;AACV,IAAA;AAEA,IAAA,MAAM6E,iBAAAA,EAAAA;AACN,IAAA,MAAMC,IAAAA,CAAKH,QAAQC,WAAAA,CAAAA;AACvB,EAAA;AACJ,CAAA,EAjB4C,8BAAA;AAmB5C,IAAMI,8BAAc,MAAA,CAAA,OAChBC,SAAAA,EACAR,YACA,EAAE9C,WAAAA,IACFkD,iBAAAA,KAAAA;AAEA,EAAA,MAAMK,QAAAA,GAAWrD,iBAAiBF,WAAAA,CAAAA;AAClC,EAAA,MAAMwD,SAAAA,GAAYpJ,IAAAA,CAAKC,IAAAA,CAAKiJ,SAAAA,EAAWnJ,iBAAiBoJ,QAAAA,CAAAA;AACxD,EAAA,IAAI,CAAE,MAAMpC,UAAAA,CAAWqC,SAAAA,CAAAA,EAAa;AAChC,IAAA,MAAM,IAAIrI,KAAAA,CAAM,CAAA,qCAAA,EAAwCqI,SAAAA,CAAAA,CAAW,CAAA;AACvE,EAAA;AAEA,EAAA,MAAMhB,MAAMM,UAAAA,EAAY;IAAEJ,SAAAA,EAAW;GAAK,CAAA;AAC1C,EAAA,MAAMK,6BACFS,SAAAA,EACApJ,IAAAA,CAAKC,KAAKyI,UAAAA,EAAYS,QAAAA,GACtBL,iBAAAA,CAAAA;AAER,CAAA,EAlBoB,aAAA,CAAA;AAwBpB,IAAMO,gBAAAA,mBAAmB,MAAA,CAAA,OAAOX,UAAAA,EAAoBY,SAAAA,KAAAA;AAChD,EAAA,MAAMC,SAAAA,GAAYvJ,IAAAA,CAAKqI,OAAAA,CAAQiB,SAAAA,CAAAA;AAC/B,EAAA,MAAME,UAAAA,GAAaxJ,IAAAA,CAAKyJ,QAAAA,CAASH,SAAAA,CAAAA;AACjC,EAAA,MAAMlB,MAAMmB,SAAAA,EAAW;IAAEjB,SAAAA,EAAW;GAAK,CAAA;AAEzC,EAAA,MAAMoB,OAAAA,GAAU,MAAMC,OAAAA,CAAQ3J,IAAAA,CAAKC,KAAKsJ,SAAAA,EAAW,CAAA,EAAGC,UAAAA,CAAAA,MAAAA,CAAkB,CAAA,CAAA;AACxE,EAAA,MAAMI,YAAY5J,IAAAA,CAAKC,IAAAA,CAAKsJ,SAAAA,EAAW,CAAA,EAAGC,UAAAA,CAAAA,KAAAA,CAAiB,CAAA;AAC3D,EAAA,MAAMxB,OAAAA,GAAU,MAAM6B,OAAAA,CAAQnB,UAAAA,CAAAA;AAE9B,EAAA,IAAI;AACA,IAAA,KAAA,MAAW/G,SAASqG,OAAAA,EAAS;AACzB,MAAA,MAAMgB,QAAAA,CAAShJ,IAAAA,CAAKC,IAAAA,CAAKyI,UAAAA,EAAY/G,KAAAA,GAAQ3B,IAAAA,CAAKC,IAAAA,CAAKyJ,OAAAA,EAAS/H,KAAAA,CAAAA,CAAAA;AACpE,IAAA;AAEA,IAAA,IAAI,CAAE,MAAMoF,UAAAA,CAAWuC,SAAAA,KAAgB,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAa;AACjE,MAAA,MAAME,MAAAA,CAAOF,WAAWN,SAAAA,CAAAA;IAC5B,CAAA,MAAA,IAAW,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAY;AACpC,MAAA,MAAMG,GAAGH,SAAAA,EAAW;QAAEtB,SAAAA,EAAW,IAAA;QAAM0B,KAAAA,EAAO;OAAK,CAAA;AACvD,IAAA;AAEA,IAAA,IAAI,MAAMjD,UAAAA,CAAWuC,SAAAA,CAAAA,EAAY;AAC7B,MAAA,MAAMQ,MAAAA,CAAOR,WAAWM,SAAAA,CAAAA;AAC5B,IAAA;AACA,IAAA,MAAME,MAAAA,CAAOJ,SAASJ,SAAAA,CAAAA;AACtB,IAAA,MAAMS,GAAGH,SAAAA,EAAW;MAAEtB,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA,CAAGC,KAAAA,CAAM,CAAChG,KAAAA,KAAAA;AACzDqB,MAAAA,OAAAA,CAAQ4E,IAAAA,CAAK,CAAA,0BAAA,EAA6BN,SAAAA,CAAAA,eAAAA,CAAAA,EAA4B3F,KAAAA,CAAAA;IAC1E,CAAA,CAAA;AACJ,EAAA,CAAA,CAAA,OAASA,KAAAA,EAAO;AACZ,IAAA,MAAM8F,GAAGL,OAAAA,EAAS;MAAEpB,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA,CAAGC,KAAAA,CAAM,MAAMnH,MAAAA,CAAAA;AAChE,IAAA,IAAI,CAAE,MAAMiE,UAAAA,CAAWuC,SAAAA,KAAgB,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAa;AACjE,MAAA,MAAME,OAAOF,SAAAA,EAAWN,SAAAA,CAAAA,CAAWW,KAAAA,CAAM,MAAMnH,MAAAA,CAAAA;AACnD,IAAA;AACA,IAAA,MAAMmB,KAAAA;AACV,EAAA;AACJ,CAAA,EAlCyB,kBAAA,CAAA;AAoClB,IAAMkG,+BAAAA,mBAAkC,MAAA,CAAA,CAACC,GAAAA,EAAajH,QAAAA,KAA+B;AACxF,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACAhD,EAAAA,yBAAAA;AACA,EAAA,QAAA;AACA,EAAA,KAAA;AACA,EAAA,cAAA;AACA,EAAA,OAAA;AACA,EAAA,IAAA;AACA,EAAA,CAAA,EAAGiK,GAAAA,CAAAA,SAAAA,CAAAA;AACHjH,EAAAA,QAAAA;AACA,EAAA,IAAA;AACA,EAAA,OAAA;AACA,EAAA;AAd2C,CAAA,EAAA,iCAAA;AAiB/C,IAAMkH,2BAAAA,2BAA+BD,GAAAA,EAAajH,QAAAA,KAC9C,IAAIQ,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,QAAQC,KAAAA,CAAM,QAAA,EAAUqG,+BAAAA,CAAgCC,GAAAA,EAAKjH,QAAAA,CAAAA,EAAW;IAC1EY,KAAAA,EAAO;GACX,CAAA;AACAF,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,SAASJ,MAAAA,CAAAA;AAClBC,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,KAAAA;AACf,IAAA,IAAIA,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CAAO,IAAI7C,KAAAA,CAAM,CAAA,0CAAA,EAA6CmD,IAAAA,IAAQ,CAAA,GAAI,CAAA,CAAA;AAC9E,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAbgC,6BAAA,CAAA;AAepC,IAAMoG,aAAAA,mBAAgB,MAAA,CAAA,OAClBC,OAAAA,EACA/F,YAAAA,KAAAA;AAEA,EAAA,IAAI;AACA,IAAA,MAAMuF,GAAGQ,OAAAA,EAAS;MAAEjC,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA;AACrD,EAAA,CAAA,CAAA,OAAS/F,KAAAA,EAAO;AACZ,IAAA,MAAMC,OAAQD,KAAAA,CAA4BC,IAAAA;AAC1C,IAAA,IAAIA,IAAAA,KAAS,QAAA,IAAYA,IAAAA,KAAS,OAAA,EAAS;AACvC,MAAA,MAAMD,KAAAA;AACV,IAAA;AACA,IAAA,IAAIO,iBAAiB1B,MAAAA,EAAW;AAC5B,MAAA,MAAMmB,KAAAA;AACV,IAAA;AAEA,IAAA,MAAM,EAAEd,QAAAA,EAAQ,GAAK,MAAMqB,YAAAA,EAAAA;AAC3B,IAAA,MAAM6F,2BAAAA,CAA4BE,SAASpH,QAAAA,CAAAA;AAC3C,IAAA,MAAM4G,GAAGQ,OAAAA,EAAS;MAAEjC,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA;AACrD,EAAA;AACJ,CAAA,EAnBsB,eAAA,CAAA;AA2Bf,IAAMQ,6BAAAA,mBAAgC,MAAA,CAAA,OACzC,EACItD,OAAAA,EACAjB,QAAAA,EACAqD,SAAAA,EACA/I,cAAAA,EACAC,WAAAA,EAAW,EAEf,EAAE+C,GAAAA,EAAG,KAA4C;AAEjD,EAAA,IAAI0C,QAAAA,CAASrD,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI7B,MAAM,yEAAA,CAAA;AACpB,EAAA;AACAiF,EAAAA,oBAAAA,CAAqBC,QAAAA,CAAAA;AAErB,EAAA,MAAMwC,YAAAA,GAAe,MAAMxB,gBAAAA,CAAiBC,OAAAA,CAAAA;AAC5C,EAAA,MAAMJ,YAAAA,GAAe2D,WAAW,QAAA,CAAA,CAAUC,OAAOjC,YAAAA,CAAAA,CAAczH,OAAO,KAAA,CAAA;AACtE,EAAA,MAAMuJ,OAAAA,GAAU,MAAMZ,OAAAA,CAAQ3J,IAAAA,CAAKC,KAAK0K,MAAAA,EAAAA,EAAU,2BAAA,CAAA,CAAA;AAClD,EAAA,MAAMC,aAAAA,GAAgB5K,IAAAA,CAAKC,IAAAA,CAAKsK,OAAAA,EAAS,QAAA,CAAA;AACzC,EAAA,MAAM7B,UAAAA,GAAa1I,IAAAA,CAAKC,IAAAA,CAAKsK,OAAAA,EAAS,SAAA,CAAA;AACtC,EAAA,IAAItF,QAAAA;AACJ,EAAA,MAAM4F,OAAAA,GAAU,IAAIzG,sBAAAA,EAAAA;AAEpB,EAAA,IAAI;AACA,IAAA,MAAM0G,WAAAA,GAAc9K,IAAAA,CAAKyJ,QAAAA,CAASlG,GAAAA,CAAAA;AAClC,IAAA,MAAM8D,UAAAA,CAAWoB,YAAAA,EAAcmC,aAAAA,EAAeE,WAAAA,CAAAA;AAE9C,IAAA,MAAM5B,SAAAA,GAAYlJ,IAAAA,CAAKC,IAAAA,CAAK2K,aAAAA,EAAeE,WAAAA,CAAAA;AAC3C,IAAA,IAAI,CAAE,MAAM/D,UAAAA,CAAWmC,SAAAA,CAAAA,IAAe,CAAA,CAAE,MAAM/D,IAAAA,CAAK+D,SAAAA,CAAAA,EAAY9D,WAAAA,EAAW,EAAI;AAC1E,MAAA,MAAM,IAAIrE,KAAAA,CACN,CAAA,mBAAA,EAAsB+J,WAAAA,CAAAA,sCAAAA,CAAmD,CAAA;AAEjF,IAAA;AAEA7F,IAAAA,QAAAA,GAAW;AACP1E,MAAAA,cAAAA;MACAC,WAAAA,EAAa,MAAM6F,kBAAAA,CAAmB6C,SAAAA,EAAW1I,WAAAA;AACrD,KAAA;AACA,IAAA,MAAMgI,oBAAAA,CAAqBC,cAAcC,UAAAA,CAAAA;AAEzC,IAAA,KAAA,MAAWqC,eAAe9E,QAAAA,EAAU;AAChC,MAAA,MAAM4E,QAAQ9F,GAAAA,CACV8B,wBAAAA,CAAyBkE,WAAAA,EAAajE,YAAAA,GACtC7B,QAAAA,EACA;AAAE1B,QAAAA;AAAI,OAAA,EACN2F,SAAAA,CAAAA;AAEJ,MAAA,MAAMD,WAAAA,CAAYC,SAAAA,EAAWR,UAAAA,EAAYqC,WAAAA,EAAa,YAAA;AAClD,QAAA,MAAM,EAAE5H,QAAAA,EAAQ,GAAK,MAAM0H,OAAAA,CAAQrG,aAAaS,QAAAA,CAAAA;AAChD,QAAA,MAAMoF,2BAAAA,CAA4BnB,WAAW/F,QAAAA,CAAAA;MACjD,CAAA,CAAA;AACJ,IAAA;AAEA,IAAA,MAAMkG,gBAAAA,CAAiBX,YAAYY,SAAAA,CAAAA;EACvC,CAAA,SAAA;AACI,IAAA,MAAMgB,aAAAA,CACFC,OAAAA,EACAtF,QAAAA,KAAanC,MAAAA,GAAYA,MAAAA,GAAY,MAAM+H,OAAAA,CAAQrG,YAAAA,CAAaS,QAAAA,CAAAA,CAAAA,CAClEgF,KAAAA,CAAM,CAAChG,KAAAA,KAAAA;AACLqB,MAAAA,OAAAA,CAAQ4E,IAAAA,CAAK,CAAA,kDAAA,EAAqDK,OAAAA,CAAAA,CAAAA,EAAWtG,KAAAA,CAAAA;IACjF,CAAA,CAAA;AACJ,EAAA;AACJ,CAAA,EA9D6C,+BAAA","file":"WS6TQMPT.js","sourcesContent":["import { unzipSync } from 'fflate';\nimport { execFile, spawn } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n    chmod,\n    copyFile,\n    mkdir,\n    mkdtemp,\n    readdir,\n    readFile,\n    rename,\n    rm,\n    stat,\n    writeFile,\n} from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport path from 'node:path';\nimport { promisify } from 'node:util';\nimport { parse } from 'toml';\n\nimport type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';\nimport { parseImageIndexPlatforms } from '@layerzerolabs/vm-tooling';\n\nconst execFileAsync = promisify(execFile);\n\nconst SOURCE_ARCHIVE_NAME = 'contracts-source.zip';\nconst WASM_TARGET_DIR = path.join('target', 'wasm32v1-none', 'release');\n\n// The self-contained source is mounted here and built in place. The official image's WORKDIR is\n// already /source; we set it explicitly for clarity.\nconst SOURCE_MOUNT = '/source';\n\n// Canonical reproducible platform. External verifiers reproduce the amd64 artifact, so we always\n// run the amd64 image regardless of the host arch (the daemon emulates it when needed).\nconst VERIFIABLE_BUILD_PLATFORM = 'linux/amd64';\n\nconst OFFICIAL_IMAGE_REPO = 'stellar/stellar-cli';\n\nconst META_FLAG = '--meta';\n\ninterface RustToolchainToml {\n    toolchain?: {\n        channel?: string;\n    };\n}\n\nexport interface PackageSpec {\n    packageName: string;\n    manifestPath: string;\n}\n\nexport interface VerifiableBuildVersions {\n    stellarVersion: string;\n    rustVersion: string;\n}\n\nexport interface ResolvedVerifiableBuildImage {\n    imageRef: string;\n    bldimg: string;\n    tagRef: string;\n}\n\nexport interface RunVerifiableBuildFromArchiveOptions {\n    archive: string;\n    packages: PackageSpec[];\n    outputDir: string;\n    stellarVersion: string;\n    rustVersion?: string;\n}\n\n/**\n * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.\n * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the\n * only image the tool builds against.\n */\nexport const officialImageTagRef = (stellarVersion: string, rustVersion: string): string =>\n    `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`;\n\n/**\n * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so\n * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.\n */\nexport const parseAmd64Digest = (manifestInspectJson: string): string => {\n    const platforms = parseImageIndexPlatforms(JSON.parse(manifestInspectJson));\n\n    if (!platforms) {\n        throw new Error(\n            '`docker manifest inspect` did not return a multi-arch index (no `manifests` array)',\n        );\n    }\n\n    const digest = platforms.find(({ platform }) => platform === VERIFIABLE_BUILD_PLATFORM)?.digest;\n\n    if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {\n        throw new Error('No linux/amd64 manifest digest found in `docker manifest inspect` output');\n    }\n\n    return digest;\n};\n\n/**\n * Resolve the immutable linux/amd64 digest of a `stellar/stellar-cli` tag via a daemon-less\n * registry query (`docker manifest inspect`). This is the reproducible reference an external\n * verifier pins to (SEP-58).\n */\nconst resolveAmd64Digest = async (imageTagRef: string): Promise<string> => {\n    try {\n        const { stdout } = await execFileAsync('docker', ['manifest', 'inspect', imageTagRef], {\n            maxBuffer: 16 * 1024 * 1024,\n            timeout: 30_000,\n        });\n        return parseAmd64Digest(stdout);\n    } catch (cause) {\n        throw new Error(\n            `Failed to resolve the linux/amd64 digest of ${imageTagRef} (\\`docker manifest inspect\\`)`,\n            { cause },\n        );\n    }\n};\n\n/** The `key` of a `key=value` meta entry (the whole string when there is no `=`). */\nconst metaKey = (entry: string): string => {\n    const eq = entry.indexOf('=');\n    return eq === -1 ? entry : entry.slice(0, eq);\n};\n\n/**\n * Canonicalize `stellar contract build` args so the embedded metadata order is stable.\n *\n * Soroban stores contract metadata as an ORDERED sequence, so the order of `--meta key=value`\n * flags changes the WASM bytes. To keep the build reproducible, every meta entry — the caller's\n * plus the tool-injected ones — is pulled out, merged, and re-emitted in sorted order.\n *\n * Injected keys (e.g. `bldimg`) are tool-controlled and RESERVED: any caller `--meta` reusing an\n * injected key is dropped.\n */\nexport const canonicalizeMetaArgs = (buildArgs: string[], injectedMeta: string[]): string[] => {\n    const reservedKeys = new Set(injectedMeta.map(metaKey));\n    const metas = [...injectedMeta];\n    const passthrough: string[] = [];\n\n    const addCallerMeta = (value: string): void => {\n        if (!reservedKeys.has(metaKey(value))) metas.push(value);\n    };\n\n    for (let i = 0; i < buildArgs.length; i++) {\n        const arg = buildArgs[i];\n        if (arg === undefined) continue;\n        if (arg === META_FLAG) {\n            const value = buildArgs[i + 1];\n            if (value !== undefined && !value.startsWith('--')) {\n                addCallerMeta(value);\n                i += 1;\n            }\n        } else if (arg.startsWith(`${META_FLAG}=`)) {\n            addCallerMeta(arg.slice(META_FLAG.length + 1));\n        } else {\n            passthrough.push(arg);\n        }\n    }\n\n    metas.sort();\n    return [...passthrough, ...metas.flatMap((meta) => [META_FLAG, meta])];\n};\n\n/**\n * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /\n * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.\n */\nexport const buildVerifiableBuildDockerArgs = ({\n    imageRef,\n    sourceDir,\n    buildArgs,\n    bldimg,\n}: {\n    imageRef: string;\n    sourceDir: string;\n    buildArgs: string[];\n    bldimg: string;\n}): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '-v',\n    `${sourceDir}:${SOURCE_MOUNT}`,\n    '-w',\n    SOURCE_MOUNT,\n    imageRef,\n    'contract',\n    'build',\n    ...canonicalizeMetaArgs(buildArgs, [`bldimg=${bldimg}`]),\n];\n\n/**\n * Resolve the directory to build. An explicit `sourceDir` that is relative resolves against the\n * cwd; an absolute one is used as-is; omitting it falls back to the cwd.\n */\nexport const resolveBuildDir = (cwd: string, sourceDir?: string): string =>\n    path.resolve(cwd, sourceDir ?? '.');\n\nconst runDocker = (dockerArgs: string[]): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', dockerArgs, { stdio: 'inherit' });\n        child.on('error', (error) =>\n            reject(new Error('Failed to spawn docker for the verifiable build', { cause: error })),\n        );\n        child.on('close', (code, signal) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(\n                    new Error(\n                        `Verifiable build failed: docker exited with ${\n                            signal ? `signal ${signal}` : `code ${code}`\n                        }`,\n                    ),\n                );\n            }\n        });\n    });\n\n/**\n * Reproducible `stellar contract build` inside the official `stellar/stellar-cli` image.\n * Used by the archive orchestrator for each `--package`.\n */\nexport class VerifiableBuildWrapper {\n    private readonly imagesByTag = new Map<string, Promise<ResolvedVerifiableBuildImage>>();\n\n    public constructor(\n        private readonly resolveDigest: (\n            imageTagRef: string,\n        ) => Promise<string> = resolveAmd64Digest,\n    ) {}\n\n    public resolveImage({\n        stellarVersion,\n        rustVersion,\n    }: VerifiableBuildVersions): Promise<ResolvedVerifiableBuildImage> {\n        const tagRef = officialImageTagRef(stellarVersion, rustVersion);\n        const existing = this.imagesByTag.get(tagRef);\n        if (existing !== undefined) {\n            return existing;\n        }\n\n        const resolved = this.resolveDigest(tagRef).then((digest) => ({\n            imageRef: `${OFFICIAL_IMAGE_REPO}@${digest}`,\n            bldimg: `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`,\n            tagRef,\n        }));\n        this.imagesByTag.set(tagRef, resolved);\n        return resolved;\n    }\n\n    public async run(\n        args: string[],\n        versions: VerifiableBuildVersions,\n        { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>,\n        sourceDir?: string,\n    ): Promise<void> {\n        const buildDir = resolveBuildDir(cwd, sourceDir);\n        try {\n            if (!(await stat(buildDir)).isDirectory()) {\n                throw new Error('not a directory');\n            }\n        } catch (cause) {\n            throw new Error(\n                `Verifiable build source directory is not an existing directory: ${buildDir}`,\n                { cause },\n            );\n        }\n\n        // The official stellar-cli image runs as a non-host UID and must create cargo target\n        // dirs under the bind-mounted source. Do not pass --user (that would diverge from what\n        // external verifiers run). Only chmod when a sourceDir is passed (typically a\n        // throwaway extract dir); never world-write the process cwd.\n        if (sourceDir !== undefined) {\n            await chmod(buildDir, 0o777);\n        }\n\n        const { imageRef, bldimg, tagRef } = await this.resolveImage(versions);\n\n        const dockerArgs = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: buildDir,\n            buildArgs: args,\n            bldimg,\n        });\n\n        console.info('🔒 Verifiable build (official stellar/stellar-cli image, run from host)');\n        console.info(`   source: ${buildDir}`);\n        console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);\n        console.info(`   bldimg: ${bldimg}`);\n        console.info(`   docker ${dockerArgs.join(' ')}`);\n\n        await runDocker(dockerArgs);\n    }\n}\n\n/**\n * Parse a `--package <name>:<manifest-path>` pair. Both sides must be non-empty.\n */\nexport const parsePackageSpec = (spec: string): PackageSpec => {\n    const colon = spec.indexOf(':');\n    if (colon <= 0 || colon === spec.length - 1) {\n        throw new Error(\n            `Invalid --package spec ${JSON.stringify(spec)}: expected <name>:<manifest-path>`,\n        );\n    }\n\n    return {\n        packageName: spec.slice(0, colon),\n        manifestPath: spec.slice(colon + 1),\n    };\n};\n\n/** Soroban wasm artifact basename: hyphens in the package name become underscores. */\nexport const wasmArtifactName = (packageName: string): string =>\n    `${packageName.replaceAll('-', '_')}.wasm`;\n\nconst validatePackageSpecs = (packages: PackageSpec[]): void => {\n    const artifactNames = new Set<string>();\n    for (const { packageName } of packages) {\n        const artifactName = wasmArtifactName(packageName);\n        if (artifactNames.has(artifactName)) {\n            throw new Error(`Duplicate WASM artifact ${artifactName} from --package options`);\n        }\n        artifactNames.add(artifactName);\n    }\n};\n\n/**\n * Resolve the Rust toolchain version for the verifiable build image tag. An explicit\n * `--rust-version` wins; otherwise read the pinned channel from the supplied source directory.\n */\nexport const resolveRustVersion = async (\n    sourceDir: string,\n    rustVersionFlag?: string,\n): Promise<string> => {\n    if (rustVersionFlag !== undefined) {\n        return rustVersionFlag;\n    }\n\n    const toolchainPath = path.join(sourceDir, 'rust-toolchain.toml');\n    let contents: string;\n    try {\n        contents = await readFile(toolchainPath, 'utf-8');\n    } catch (cause) {\n        if ((cause as { code?: string }).code === 'ENOENT') {\n            throw new Error(\n                `Missing rust-toolchain.toml in ${sourceDir} and no --rust-version was provided`,\n                { cause },\n            );\n        }\n        throw cause;\n    }\n\n    const parsed = parse(contents) as RustToolchainToml;\n    const channel = parsed.toolchain?.channel;\n    if (typeof channel !== 'string' || channel.length === 0) {\n        throw new Error(`Missing 'toolchain.channel' in ${toolchainPath}`);\n    }\n\n    return channel;\n};\n\n/**\n * Build `stellar contract build` args for one archive package. Embeds SEP-58 `source_sha256`\n * and replays the build flags as `bldopt=` metas so external verifiers can reproduce the build.\n * `bldimg` is injected separately by the official-image runner.\n */\nexport const buildArchiveContractArgs = (\n    { packageName, manifestPath }: PackageSpec,\n    sourceSha256: string,\n): string[] => [\n    '--manifest-path',\n    manifestPath,\n    '--package',\n    packageName,\n    '--optimize',\n    '--meta',\n    `bldopt=--manifest-path=${manifestPath}`,\n    '--meta',\n    `bldopt=--package=${packageName}`,\n    '--meta',\n    'bldopt=--optimize',\n    '--meta',\n    `source_sha256=${sourceSha256}`,\n];\n\nconst pathExists = async (filePath: string): Promise<boolean> => {\n    try {\n        await stat(filePath);\n        return true;\n    } catch (error) {\n        if ((error as { code?: string }).code === 'ENOENT') {\n            return false;\n        }\n        throw error;\n    }\n};\n\nconst readArchiveBytes = async (archive: string): Promise<Uint8Array> => {\n    let bytes: Uint8Array;\n    try {\n        bytes = new Uint8Array(await readFile(archive));\n    } catch (cause) {\n        throw new Error(`Archive not found or unreadable: ${archive}`, { cause });\n    }\n\n    if (bytes.length === 0) {\n        throw new Error(`Archive is empty: ${archive}`);\n    }\n\n    return bytes;\n};\n\nconst extractZip = async (\n    bytes: Uint8Array,\n    destDir: string,\n    expectedRootDirName: string,\n): Promise<void> => {\n    const files = unzipSync(bytes);\n    const destRoot = path.resolve(destDir);\n    const expectedRoot = path.join(destRoot, expectedRootDirName);\n    const expectedRootPrefix = `${expectedRootDirName}/`;\n\n    for (const [relPath, content] of Object.entries(files)) {\n        const outPath = path.resolve(destRoot, relPath);\n        if (outPath !== destRoot && !outPath.startsWith(destRoot + path.sep)) {\n            throw new Error(`Zip entry escapes destination: ${relPath}`);\n        }\n        if (outPath !== expectedRoot && !outPath.startsWith(expectedRoot + path.sep)) {\n            throw new Error(\n                `Zip entry is outside expected top-level ${expectedRootPrefix}: ${relPath}`,\n            );\n        }\n        if (relPath.endsWith('/')) continue;\n\n        await mkdir(path.dirname(outPath), { recursive: true });\n        await writeFile(outPath, content);\n    }\n};\n\nconst persistSourceArchive = async (\n    archiveBytes: Uint8Array,\n    stagingDir: string,\n): Promise<void> => {\n    await mkdir(stagingDir, { recursive: true });\n    await writeFile(path.join(stagingDir, SOURCE_ARCHIVE_NAME), archiveBytes);\n};\n\nexport const copyFileWithPermissionRepair = async (\n    source: string,\n    destination: string,\n    repairPermissions: () => Promise<void>,\n    copy: (source: string, destination: string) => Promise<void> = copyFile,\n): Promise<void> => {\n    try {\n        await copy(source, destination);\n    } catch (error) {\n        const code = (error as { code?: string }).code;\n        if (code !== 'EACCES' && code !== 'EPERM') {\n            throw error;\n        }\n\n        await repairPermissions();\n        await copy(source, destination);\n    }\n};\n\nconst persistWasm = async (\n    buildRoot: string,\n    stagingDir: string,\n    { packageName }: PackageSpec,\n    repairPermissions: () => Promise<void>,\n): Promise<void> => {\n    const wasmName = wasmArtifactName(packageName);\n    const builtPath = path.join(buildRoot, WASM_TARGET_DIR, wasmName);\n    if (!(await pathExists(builtPath))) {\n        throw new Error(`Expected WASM not found after build: ${builtPath}`);\n    }\n\n    await mkdir(stagingDir, { recursive: true });\n    await copyFileWithPermissionRepair(\n        builtPath,\n        path.join(stagingDir, wasmName),\n        repairPermissions,\n    );\n};\n\n/**\n * Atomically replace the output directory with the complete staged artifact set.\n * Mirrors protocol stellar's `.next-` / `.prev` swap so failed builds leave prior output intact.\n */\nconst publishArtifacts = async (stagingDir: string, outputDir: string): Promise<void> => {\n    const parentDir = path.dirname(outputDir);\n    const outputBase = path.basename(outputDir);\n    await mkdir(parentDir, { recursive: true });\n\n    const nextDir = await mkdtemp(path.join(parentDir, `${outputBase}.next-`));\n    const backupDir = path.join(parentDir, `${outputBase}.prev`);\n    const entries = await readdir(stagingDir);\n\n    try {\n        for (const entry of entries) {\n            await copyFile(path.join(stagingDir, entry), path.join(nextDir, entry));\n        }\n\n        if (!(await pathExists(outputDir)) && (await pathExists(backupDir))) {\n            await rename(backupDir, outputDir);\n        } else if (await pathExists(backupDir)) {\n            await rm(backupDir, { recursive: true, force: true });\n        }\n\n        if (await pathExists(outputDir)) {\n            await rename(outputDir, backupDir);\n        }\n        await rename(nextDir, outputDir);\n        await rm(backupDir, { recursive: true, force: true }).catch((error) => {\n            console.warn(`Failed to remove leftover ${backupDir} after publish:`, error);\n        });\n    } catch (error) {\n        await rm(nextDir, { recursive: true, force: true }).catch(() => undefined);\n        if (!(await pathExists(outputDir)) && (await pathExists(backupDir))) {\n            await rename(backupDir, outputDir).catch(() => undefined);\n        }\n        throw error;\n    }\n};\n\nexport const buildPermissionRepairDockerArgs = (dir: string, imageRef: string): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '--user',\n    '0:0',\n    '--entrypoint',\n    'chmod',\n    '-v',\n    `${dir}:/cleanup`,\n    imageRef,\n    '-R',\n    'a+rwX',\n    '/cleanup',\n];\n\nconst relaxDockerOwnedPermissions = (dir: string, imageRef: string): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', buildPermissionRepairDockerArgs(dir, imageRef), {\n            stdio: 'inherit',\n        });\n        child.on('error', reject);\n        child.on('close', (code) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(new Error(`Failed to chmod temp dir via docker (exit ${code ?? 1})`));\n            }\n        });\n    });\n\nconst removeTempDir = async (\n    tempDir: string,\n    resolveImage?: () => Promise<ResolvedVerifiableBuildImage>,\n): Promise<void> => {\n    try {\n        await rm(tempDir, { recursive: true, force: true });\n    } catch (error) {\n        const code = (error as { code?: string }).code;\n        if (code !== 'EACCES' && code !== 'EPERM') {\n            throw error;\n        }\n        if (resolveImage === undefined) {\n            throw error;\n        }\n\n        const { imageRef } = await resolveImage();\n        await relaxDockerOwnedPermissions(tempDir, imageRef);\n        await rm(tempDir, { recursive: true, force: true });\n    }\n};\n\n/**\n * Build one or more Stellar contracts from a self-contained source archive.\n *\n * `packages` is intentionally already parsed: the CLI owns string parsing, while this orchestrator\n * deals only in validated package/manifest pairs.\n */\nexport const runVerifiableBuildFromArchive = async (\n    {\n        archive,\n        packages,\n        outputDir,\n        stellarVersion,\n        rustVersion,\n    }: RunVerifiableBuildFromArchiveOptions,\n    { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>,\n): Promise<void> => {\n    if (packages.length === 0) {\n        throw new Error('verifiable-build requires at least one --package <name>:<manifest-path>');\n    }\n    validatePackageSpecs(packages);\n\n    const archiveBytes = await readArchiveBytes(archive);\n    const sourceSha256 = createHash('sha256').update(archiveBytes).digest('hex');\n    const tempDir = await mkdtemp(path.join(tmpdir(), 'stellar-verifiable-build-'));\n    const extractionDir = path.join(tempDir, 'source');\n    const stagingDir = path.join(tempDir, 'staging');\n    let versions: VerifiableBuildVersions | undefined;\n    const wrapper = new VerifiableBuildWrapper();\n\n    try {\n        const rootDirName = path.basename(cwd);\n        await extractZip(archiveBytes, extractionDir, rootDirName);\n\n        const buildRoot = path.join(extractionDir, rootDirName);\n        if (!(await pathExists(buildRoot)) || !(await stat(buildRoot)).isDirectory()) {\n            throw new Error(\n                `Expected top-level ${rootDirName}/ directory not found after extraction`,\n            );\n        }\n\n        versions = {\n            stellarVersion,\n            rustVersion: await resolveRustVersion(buildRoot, rustVersion),\n        };\n        await persistSourceArchive(archiveBytes, stagingDir);\n\n        for (const packageSpec of packages) {\n            await wrapper.run(\n                buildArchiveContractArgs(packageSpec, sourceSha256),\n                versions,\n                { cwd },\n                buildRoot,\n            );\n            await persistWasm(buildRoot, stagingDir, packageSpec, async () => {\n                const { imageRef } = await wrapper.resolveImage(versions!);\n                await relaxDockerOwnedPermissions(buildRoot, imageRef);\n            });\n        }\n\n        await publishArtifacts(stagingDir, outputDir);\n    } finally {\n        await removeTempDir(\n            tempDir,\n            versions === undefined ? undefined : () => wrapper.resolveImage(versions!),\n        ).catch((error) => {\n            console.warn(`Temp dir cleanup failed (build result unchanged): ${tempDir}`, error);\n        });\n    }\n};\n"]}

package/dist/commands/verifiable-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifiable-build.d.ts","sourceRoot":"","sources":["../../src/commands/verifiable-build.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAkC7E,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,4BAA4B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oCAAoC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,mBAAoB,MAAM,eAAe,MAAM,KAAG,MACH,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wBAAyB,MAAM,KAAG,MAkB9D,CAAC;AA4BF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,cAAe,MAAM,EAAE,gBAAgB,MAAM,EAAE,KAAG,MAAM,EA2BxF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gDAKxC;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAClB,KAAG,MAAM,EAaT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,cAAc,MAAM,KAAG,MAC3B,CAAC;AAuBxC;;;GAGG;AACH,qBAAa,sBAAsB;IAI3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAHlC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4D;IAExF,YACqB,aAAa,GAAE,CAC5B,WAAW,EAAE,MAAM,KAClB,OAAO,CAAC,MAAM,CAAsB,EACzC;IAEG,YAAY,CAAC,EAChB,cAAc,EACd,WAAW,GACd,EAAE,uBAAuB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAcjE;IAEY,GAAG,CACZ,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,EAAE,uBAAuB,EACjC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,EACjD,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAqCf;CACJ;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,WAY/C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,gBAAiB,MAAM,KAAG,MACT,CAAC;AAa/C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,cAChB,MAAM,oBACC,MAAM,KACzB,OAAO,CAAC,MAAM,CA0BhB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,kCACF,WAAW,gBAC5B,MAAM,KACrB,MAAM,EAcR,CAAC;AAgEF,eAAO,MAAM,4BAA4B,WAC7B,MAAM,eACD,MAAM,qBACA,MAAM,OAAO,CAAC,IAAI,CAAC,SAChC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,KAC7D,OAAO,CAAC,IAAI,CAYd,CAAC;AA8DF,eAAO,MAAM,+BAA+B,QAAS,MAAM,YAAY,MAAM,KAAG,MAAM,EAerF,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,mEAOnC,oCAAoC,WAC9B,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,KAClD,OAAO,CAAC,IAAI,CAqDd,CAAC"}
+{"version":3,"file":"verifiable-build.d.ts","sourceRoot":"","sources":["../../src/commands/verifiable-build.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AA0B7E,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,4BAA4B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oCAAoC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,mBAAoB,MAAM,eAAe,MAAM,KAAG,MACH,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wBAAyB,MAAM,KAAG,MAgB9D,CAAC;AA4BF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,cAAe,MAAM,EAAE,gBAAgB,MAAM,EAAE,KAAG,MAAM,EA2BxF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gDAKxC;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAClB,KAAG,MAAM,EAaT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,cAAc,MAAM,KAAG,MAC3B,CAAC;AAuBxC;;;GAGG;AACH,qBAAa,sBAAsB;IAI3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAHlC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4D;IAExF,YACqB,aAAa,GAAE,CAC5B,WAAW,EAAE,MAAM,KAClB,OAAO,CAAC,MAAM,CAAsB,EACzC;IAEG,YAAY,CAAC,EAChB,cAAc,EACd,WAAW,GACd,EAAE,uBAAuB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAcjE;IAEY,GAAG,CACZ,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,EAAE,uBAAuB,EACjC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,EACjD,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAqCf;CACJ;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,WAY/C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,gBAAiB,MAAM,KAAG,MACT,CAAC;AAa/C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,cAChB,MAAM,oBACC,MAAM,KACzB,OAAO,CAAC,MAAM,CA0BhB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,kCACF,WAAW,gBAC5B,MAAM,KACrB,MAAM,EAcR,CAAC;AAgEF,eAAO,MAAM,4BAA4B,WAC7B,MAAM,eACD,MAAM,qBACA,MAAM,OAAO,CAAC,IAAI,CAAC,SAChC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,KAC7D,OAAO,CAAC,IAAI,CAYd,CAAC;AA8DF,eAAO,MAAM,+BAA+B,QAAS,MAAM,YAAY,MAAM,KAAG,MAAM,EAerF,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,mEAOnC,oCAAoC,WAC9B,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,KAClD,OAAO,CAAC,IAAI,CAqDd,CAAC"}

package/dist/commands/verifiable-build.js

@@ -1,4 +1,4 @@
-export { VerifiableBuildWrapper, buildArchiveContractArgs, buildPermissionRepairDockerArgs, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, copyFileWithPermissionRepair, officialImageTagRef, parseAmd64Digest, parsePackageSpec, resolveBuildDir, resolveRustVersion, runVerifiableBuildFromArchive, wasmArtifactName } from '../D25LP26W.js';
+export { VerifiableBuildWrapper, buildArchiveContractArgs, buildPermissionRepairDockerArgs, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, copyFileWithPermissionRepair, officialImageTagRef, parseAmd64Digest, parsePackageSpec, resolveBuildDir, resolveRustVersion, runVerifiableBuildFromArchive, wasmArtifactName } from '../WS6TQMPT.js';
 import '../VUOMXK5T.js';
 //# sourceMappingURL=verifiable-build.js.map
 //# sourceMappingURL=verifiable-build.js.map

package/dist/config.js

@@ -1,6 +1,6 @@
-export { images, tools, versionCombinations } from './PY5UWW6H.js';
-import './Z66N4WL7.js';
+export { images, tools, versionCombinations } from './UHZE5AHI.js';
 import './PFRVJTS7.js';
+import './Z66N4WL7.js';
 import './VUOMXK5T.js';
 //# sourceMappingURL=config.js.map
 //# sourceMappingURL=config.js.map

package/dist/index.js

@@ -1,8 +1,8 @@
 import { packageSource } from './LCHYL2IQ.js';
-import { runVerifiableBuildFromArchive, parsePackageSpec } from './D25LP26W.js';
-import { versionCombinations, images, tools } from './PY5UWW6H.js';
-export { createStellarScopedWorkspacePruner } from './Z66N4WL7.js';
+import { runVerifiableBuildFromArchive, parsePackageSpec } from './WS6TQMPT.js';
+import { versionCombinations, images, tools } from './UHZE5AHI.js';
 import { syncToolchain } from './PFRVJTS7.js';
+export { createStellarScopedWorkspacePruner } from './Z66N4WL7.js';
 import { __name } from './VUOMXK5T.js';
 import path from 'path';
 import { runCli } from '@layerzerolabs/vm-tooling';

package/dist/scripts/generate-github-matrix.js

@@ -1,6 +1,6 @@
-import { images, versionCombinations } from '../PY5UWW6H.js';
-import '../Z66N4WL7.js';
+import { images, versionCombinations } from '../UHZE5AHI.js';
 import '../PFRVJTS7.js';
+import '../Z66N4WL7.js';
 import '../VUOMXK5T.js';
 import { runGithubMatrixGenerator } from '@layerzerolabs/vm-tooling';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layerzerolabs/vm-tooling-stellar",
-  "version": "1.2.89",
+  "version": "1.2.92",
   "private": false,
   "license": "MIT",
   "type": "module",
@@ -20,17 +20,17 @@
     "bin/**/*"
   ],
   "dependencies": {
-    "@layerzerolabs/common-node-utils": "1.2.89",
-    "@layerzerolabs/deterministic-zip": "1.2.89",
-    "@layerzerolabs/vm-tooling": "1.2.89",
+    "@layerzerolabs/common-node-utils": "1.2.92",
+    "@layerzerolabs/deterministic-zip": "1.2.92",
+    "@layerzerolabs/vm-tooling": "1.2.92",
     "fflate": "^0.8.3",
     "p-limit": "^6.1.0",
     "toml": "^3.0.0"
   },
   "devDependencies": {
-    "@layerzerolabs/tsup-configuration": "1.2.89",
-    "@layerzerolabs/typescript-configuration": "1.2.89",
-    "@layerzerolabs/vitest-configuration": "1.2.89",
+    "@layerzerolabs/tsup-configuration": "1.2.92",
+    "@layerzerolabs/typescript-configuration": "1.2.92",
+    "@layerzerolabs/vitest-configuration": "1.2.92",
     "@types/node": "^24.13.3",
     "tsup": "^8.4.0",
     "tsx": "^4.21.0",

package/dist/D25LP26W.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/verifiable-build.ts"],"names":["execFileAsync","promisify","execFile","SOURCE_ARCHIVE_NAME","WASM_TARGET_DIR","path","join","SOURCE_MOUNT","VERIFIABLE_BUILD_PLATFORM","OFFICIAL_IMAGE_REPO","META_FLAG","officialImageTagRef","stellarVersion","rustVersion","parseAmd64Digest","manifestInspectJson","manifests","JSON","parse","Array","isArray","Error","digest","find","platform","os","architecture","startsWith","resolveAmd64Digest","imageTagRef","stdout","maxBuffer","timeout","cause","metaKey","entry","eq","indexOf","slice","canonicalizeMetaArgs","buildArgs","injectedMeta","reservedKeys","Set","map","metas","passthrough","addCallerMeta","value","has","push","i","length","arg","undefined","sort","flatMap","meta","buildVerifiableBuildDockerArgs","imageRef","sourceDir","bldimg","resolveBuildDir","cwd","resolve","runDocker","dockerArgs","Promise","reject","child","spawn","stdio","on","error","code","signal","VerifiableBuildWrapper","imagesByTag","Map","resolveDigest","resolveImage","tagRef","existing","get","resolved","then","set","run","args","versions","buildDir","stat","isDirectory","chmod","console","info","parsePackageSpec","spec","colon","stringify","packageName","manifestPath","wasmArtifactName","replaceAll","validatePackageSpecs","packages","artifactNames","artifactName","add","resolveRustVersion","rustVersionFlag","toolchainPath","contents","readFile","parsed","channel","toolchain","buildArchiveContractArgs","sourceSha256","pathExists","filePath","readArchiveBytes","archive","bytes","Uint8Array","extractZip","destDir","expectedRootDirName","files","unzipSync","destRoot","expectedRoot","expectedRootPrefix","relPath","content","Object","entries","outPath","sep","endsWith","mkdir","dirname","recursive","writeFile","persistSourceArchive","archiveBytes","stagingDir","copyFileWithPermissionRepair","source","destination","repairPermissions","copy","copyFile","persistWasm","buildRoot","wasmName","builtPath","publishArtifacts","outputDir","parentDir","outputBase","basename","nextDir","mkdtemp","backupDir","readdir","rename","rm","force","catch","warn","buildPermissionRepairDockerArgs","dir","relaxDockerOwnedPermissions","removeTempDir","tempDir","runVerifiableBuildFromArchive","createHash","update","tmpdir","extractionDir","wrapper","rootDirName","packageSpec"],"mappings":";;;;;;;;;;AAsBA,IAAMA,aAAAA,GAAgBC,UAAUC,QAAAA,CAAAA;AAEhC,IAAMC,mBAAAA,GAAsB,sBAAA;AAC5B,IAAMC,eAAAA,GAAkBC,IAAAA,CAAKC,IAAAA,CAAK,QAAA,EAAU,iBAAiB,SAAA,CAAA;AAI7D,IAAMC,YAAAA,GAAe,SAAA;AAIrB,IAAMC,yBAAAA,GAA4B,aAAA;AAElC,IAAMC,mBAAAA,GAAsB,qBAAA;AAE5B,IAAMC,SAAAA,GAAY,QAAA;AA8CX,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,cAAAA,EAAwBC,WAAAA,KACxD,CAAA,EAAGJ,mBAAAA,CAAAA,CAAAA,EAAuBG,cAAAA,CAAAA,KAAAA,EAAsBC,WAAAA,CAAAA,cAAAA,CAAAA,EADjB,qBAAA;AAO5B,IAAMC,gBAAAA,2BAAoBC,mBAAAA,KAAAA;AAC7B,EAAA,MAAM,EAAEC,SAAAA,EAAS,GAAKC,IAAAA,CAAKC,MAAMH,mBAAAA,CAAAA;AAEjC,EAAA,IAAI,CAACI,KAAAA,CAAMC,OAAAA,CAAQJ,SAAAA,CAAAA,EAAY;AAC3B,IAAA,MAAM,IAAIK,MACN,oFAAA,CAAA;AAER,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,SAAAA,CAAUO,IAAAA,CACrB,CAAC,EAAEC,QAAAA,EAAQ,KAAOA,QAAAA,EAAUC,EAAAA,KAAO,OAAA,IAAWD,QAAAA,EAAUE,YAAAA,KAAiB,OAAA,CAAA,EAC1EJ,MAAAA;AAEH,EAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,CAACA,MAAAA,CAAOK,UAAAA,CAAW,SAAA,CAAA,EAAY;AAC7D,IAAA,MAAM,IAAIN,MAAM,0EAAA,CAAA;AACpB,EAAA;AAEA,EAAA,OAAOC,MAAAA;AACX,CAAA,EAlBgC,kBAAA;AAyBhC,IAAMM,kBAAAA,iCAA4BC,WAAAA,KAAAA;AAC9B,EAAA,IAAI;AACA,IAAA,MAAM,EAAEC,MAAAA,EAAM,GAAK,MAAM9B,cAAc,QAAA,EAAU;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW6B,MAAAA;AAAc,KAAA,EAAA;AACnFE,MAAAA,SAAAA,EAAW,KAAK,IAAA,GAAO,IAAA;MACvBC,OAAAA,EAAS;KACb,CAAA;AACA,IAAA,OAAOlB,iBAAiBgB,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIZ,KAAAA,CACN,CAAA,4CAAA,EAA+CQ,WAAAA,CAAAA,8BAAAA,CAAAA,EAC/C;AAAEI,MAAAA;KAAM,CAAA;AAEhB,EAAA;AACJ,CAAA,EAb2B,oBAAA,CAAA;AAgB3B,IAAMC,OAAAA,2BAAWC,KAAAA,KAAAA;AACb,EAAA,MAAMC,EAAAA,GAAKD,KAAAA,CAAME,OAAAA,CAAQ,GAAA,CAAA;AACzB,EAAA,OAAOD,OAAO,EAAA,GAAKD,KAAAA,GAAQA,KAAAA,CAAMG,KAAAA,CAAM,GAAGF,EAAAA,CAAAA;AAC9C,CAAA,EAHgB,SAAA,CAAA;AAeT,IAAMG,oBAAAA,mBAAuB,MAAA,CAAA,CAACC,SAAAA,EAAqBC,YAAAA,KAAAA;AACtD,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIF,YAAAA,CAAaG,GAAAA,CAAIV,OAAAA,CAAAA,CAAAA;AAC9C,EAAA,MAAMW,KAAAA,GAAQ;AAAIJ,IAAAA,GAAAA;;AAClB,EAAA,MAAMK,cAAwB,EAAA;AAE9B,EAAA,MAAMC,aAAAA,2BAAiBC,KAAAA,KAAAA;AACnB,IAAA,IAAI,CAACN,aAAaO,GAAAA,CAAIf,OAAAA,CAAQc,KAAAA,CAAAA,CAAAA,EAASH,KAAAA,CAAMK,IAAAA,CAAKF,KAAAA,CAAAA;EACtD,CAAA,EAFsB,eAAA,CAAA;AAItB,EAAA,KAAA,IAASG,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIX,SAAAA,CAAUY,QAAQD,CAAAA,EAAAA,EAAK;AACvC,IAAA,MAAME,GAAAA,GAAMb,UAAUW,CAAAA,CAAAA;AACtB,IAAA,IAAIE,QAAQC,MAAAA,EAAW;AACvB,IAAA,IAAID,QAAQ3C,SAAAA,EAAW;AACnB,MAAA,MAAMsC,KAAAA,GAAQR,SAAAA,CAAUW,CAAAA,GAAI,CAAA,CAAA;AAC5B,MAAA,IAAIH,UAAUM,MAAAA,IAAa,CAACN,KAAAA,CAAMrB,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChDoB,QAAAA,aAAAA,CAAcC,KAAAA,CAAAA;AACdG,QAAAA,CAAAA,IAAK,CAAA;AACT,MAAA;AACJ,IAAA,CAAA,MAAA,IAAWE,GAAAA,CAAI1B,UAAAA,CAAW,CAAA,EAAGjB,SAAAA,GAAY,CAAA,EAAG;AACxCqC,MAAAA,aAAAA,CAAcM,GAAAA,CAAIf,KAAAA,CAAM5B,SAAAA,CAAU0C,MAAAA,GAAS,CAAA,CAAA,CAAA;IAC/C,CAAA,MAAO;AACHN,MAAAA,WAAAA,CAAYI,KAAKG,GAAAA,CAAAA;AACrB,IAAA;AACJ,EAAA;AAEAR,EAAAA,KAAAA,CAAMU,IAAAA,EAAI;AACV,EAAA,OAAO;AAAIT,IAAAA,GAAAA,WAAAA;OAAgBD,KAAAA,CAAMW,OAAAA,CAAQ,CAACC,IAAAA,KAAS;AAAC/C,MAAAA,SAAAA;AAAW+C,MAAAA;AAAK,KAAA;;AACxE,CAAA,EA3BoC,sBAAA;AAiC7B,IAAMC,iDAAiC,MAAA,CAAA,CAAC,EAC3CC,UACAC,SAAAA,EACApB,SAAAA,EACAqB,QAAM,KAMM;AACZ,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACArD,EAAAA,yBAAAA;AACA,EAAA,IAAA;EACA,CAAA,EAAGoD,SAAAA,IAAarD,YAAAA,CAAAA,CAAAA;AAChB,EAAA,IAAA;AACAA,EAAAA,YAAAA;AACAoD,EAAAA,QAAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;AACGpB,EAAAA,GAAAA,oBAAAA,CAAqBC,SAAAA,EAAW;AAAC,IAAA,CAAA,OAAA,EAAUqB,MAAAA,CAAAA;AAAS,GAAA;AAtBb,CAAA,EAAA,gCAAA;AA6BvC,IAAMC,eAAAA,2BAAmBC,GAAAA,EAAaH,SAAAA,KACzCvD,KAAK2D,OAAAA,CAAQD,GAAAA,EAAKH,SAAAA,IAAa,GAAA,CAAA,EADJ,iBAAA;AAG/B,IAAMK,4BAAY,MAAA,CAAA,CAACC,UAAAA,KACf,IAAIC,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,KAAAA,GAAQC,KAAAA,CAAM,QAAA,EAAUJ,UAAAA,EAAY;IAAEK,KAAAA,EAAO;GAAU,CAAA;AAC7DF,EAAAA,KAAAA,CAAMG,GAAG,OAAA,EAAS,CAACC,UACfL,MAAAA,CAAO,IAAI/C,MAAM,iDAAA,EAAmD;IAAEY,KAAAA,EAAOwC;AAAM,GAAA,CAAA,CAAA,CAAA;AAEvFJ,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,EAAMC,MAAAA,KAAAA;AACrB,IAAA,IAAID,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CACI,IAAI/C,KAAAA,CACA,CAAA,4CAAA,EACIsD,MAAAA,GAAS,CAAA,OAAA,EAAUA,MAAAA,CAAAA,CAAAA,GAAW,CAAA,KAAA,EAAQD,IAAAA,CAAAA,CAAM,CAAA,CAC9C,CAAA,CAAA;AAGd,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAnBc,WAAA,CAAA;AAyBX,IAAME,yBAAN,MAAMA;EA5Ob;;;;AA6OqBC,EAAAA,WAAAA,uBAAkBC,GAAAA,EAAAA;AAEnC,EAAA,WAAA,CACqBC,gBAEMnD,kBAAAA,EACzB;SAHmBmD,aAAAA,GAAAA,aAAAA;AAGlB,EAAA;EAEIC,YAAAA,CAAa,EAChBpE,cAAAA,EACAC,WAAAA,EAAW,EACoD;AAC/D,IAAA,MAAMoE,MAAAA,GAAStE,mBAAAA,CAAoBC,cAAAA,EAAgBC,WAAAA,CAAAA;AACnD,IAAA,MAAMqE,QAAAA,GAAW,IAAA,CAAKL,WAAAA,CAAYM,GAAAA,CAAIF,MAAAA,CAAAA;AACtC,IAAA,IAAIC,aAAa5B,MAAAA,EAAW;AACxB,MAAA,OAAO4B,QAAAA;AACX,IAAA;AAEA,IAAA,MAAME,WAAW,IAAA,CAAKL,aAAAA,CAAcE,MAAAA,CAAAA,CAAQI,IAAAA,CAAK,CAAC/D,MAAAA,MAAY;MAC1DqC,QAAAA,EAAU,CAAA,EAAGlD,mBAAAA,CAAAA,CAAAA,EAAuBa,MAAAA,CAAAA,CAAAA;MACpCuC,MAAAA,EAAQ,CAAA,UAAA,EAAapD,mBAAAA,CAAAA,CAAAA,EAAuBa,MAAAA,CAAAA,CAAAA;AAC5C2D,MAAAA;KACJ,CAAA,CAAA;AACA,IAAA,IAAA,CAAKJ,WAAAA,CAAYS,GAAAA,CAAIL,MAAAA,EAAQG,QAAAA,CAAAA;AAC7B,IAAA,OAAOA,QAAAA;AACX,EAAA;AAEA,EAAA,MAAaG,IACTC,IAAAA,EACAC,QAAAA,EACA,EAAE1B,GAAAA,IACFH,SAAAA,EACa;AACb,IAAA,MAAM8B,QAAAA,GAAW5B,eAAAA,CAAgBC,GAAAA,EAAKH,SAAAA,CAAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,EAAE,MAAM+B,IAAAA,CAAKD,QAAAA,CAAAA,EAAWE,aAAW,EAAI;AACvC,QAAA,MAAM,IAAIvE,MAAM,iBAAA,CAAA;AACpB,MAAA;AACJ,IAAA,CAAA,CAAA,OAASY,KAAAA,EAAO;AACZ,MAAA,MAAM,IAAIZ,KAAAA,CACN,CAAA,gEAAA,EAAmEqE,QAAAA,CAAAA,CAAAA,EACnE;AAAEzD,QAAAA;OAAM,CAAA;AAEhB,IAAA;AAMA,IAAA,IAAI2B,cAAcN,MAAAA,EAAW;AACzB,MAAA,MAAMuC,KAAAA,CAAMH,UAAU,GAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,MAAM,EAAE/B,UAAUE,MAAAA,EAAQoB,MAAAA,KAAW,MAAM,IAAA,CAAKD,aAAaS,QAAAA,CAAAA;AAE7D,IAAA,MAAMvB,aAAaR,8BAAAA,CAA+B;AAC9CC,MAAAA,QAAAA;MACAC,SAAAA,EAAW8B,QAAAA;MACXlD,SAAAA,EAAWgD,IAAAA;AACX3B,MAAAA;KACJ,CAAA;AAEAiC,IAAAA,OAAAA,CAAQC,KAAK,gFAAA,CAAA;AACbD,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAcL,QAAAA,CAAAA,CAAU,CAAA;AACrCI,IAAAA,OAAAA,CAAQC,KAAK,CAAA,WAAA,EAAcpC,QAAAA,KAAanD,yBAAAA,CAAAA,WAAAA,EAAuCyE,MAAAA,CAAAA,CAAAA,CAAS,CAAA;AACxFa,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAclC,MAAAA,CAAAA,CAAQ,CAAA;AACnCiC,IAAAA,OAAAA,CAAQC,KAAK,CAAA,UAAA,EAAa7B,UAAAA,CAAW5D,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAM,CAAA;AAEhD,IAAA,MAAM2D,UAAUC,UAAAA,CAAAA;AACpB,EAAA;AACJ;AAKO,IAAM8B,gBAAAA,2BAAoBC,IAAAA,KAAAA;AAC7B,EAAA,MAAMC,KAAAA,GAAQD,IAAAA,CAAK5D,OAAAA,CAAQ,GAAA,CAAA;AAC3B,EAAA,IAAI6D,KAAAA,IAAS,CAAA,IAAKA,KAAAA,KAAUD,IAAAA,CAAK7C,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI/B,KAAAA,CACN,CAAA,uBAAA,EAA0BJ,KAAKkF,SAAAA,CAAUF,IAAAA,CAAAA,CAAAA,iCAAAA,CAAwC,CAAA;AAEzF,EAAA;AAEA,EAAA,OAAO;IACHG,WAAAA,EAAaH,IAAAA,CAAK3D,KAAAA,CAAM,CAAA,EAAG4D,KAAAA,CAAAA;IAC3BG,YAAAA,EAAcJ,IAAAA,CAAK3D,KAAAA,CAAM4D,KAAAA,GAAQ,CAAA;AACrC,GAAA;AACJ,CAAA,EAZgC,kBAAA;AAezB,IAAMI,gBAAAA,2BAAoBF,WAAAA,KAC7B,CAAA,EAAGA,YAAYG,UAAAA,CAAW,GAAA,EAAK,GAAA,CAAA,CAAA,KAAA,CAAA,EADH,kBAAA;AAGhC,IAAMC,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAC1B,EAAA,MAAMC,aAAAA,uBAAoB/D,GAAAA,EAAAA;AAC1B,EAAA,KAAA,MAAW,EAAEyD,WAAAA,EAAW,IAAMK,QAAAA,EAAU;AACpC,IAAA,MAAME,YAAAA,GAAeL,iBAAiBF,WAAAA,CAAAA;AACtC,IAAA,IAAIM,aAAAA,CAAczD,GAAAA,CAAI0D,YAAAA,CAAAA,EAAe;AACjC,MAAA,MAAM,IAAItF,KAAAA,CAAM,CAAA,wBAAA,EAA2BsF,YAAAA,CAAAA,uBAAAA,CAAqC,CAAA;AACpF,IAAA;AACAD,IAAAA,aAAAA,CAAcE,IAAID,YAAAA,CAAAA;AACtB,EAAA;AACJ,CAAA,EAT6B,sBAAA,CAAA;AAetB,IAAME,kBAAAA,mBAAqB,MAAA,CAAA,OAC9BjD,SAAAA,EACAkD,eAAAA,KAAAA;AAEA,EAAA,IAAIA,oBAAoBxD,MAAAA,EAAW;AAC/B,IAAA,OAAOwD,eAAAA;AACX,EAAA;AAEA,EAAA,MAAMC,aAAAA,GAAgB1G,IAAAA,CAAKC,IAAAA,CAAKsD,SAAAA,EAAW,qBAAA,CAAA;AAC3C,EAAA,IAAIoD,QAAAA;AACJ,EAAA,IAAI;AACAA,IAAAA,QAAAA,GAAW,MAAMC,QAAAA,CAASF,aAAAA,EAAe,OAAA,CAAA;AAC7C,EAAA,CAAA,CAAA,OAAS9E,KAAAA,EAAO;AACZ,IAAA,IAAKA,KAAAA,CAA4ByC,SAAS,QAAA,EAAU;AAChD,MAAA,MAAM,IAAIrD,KAAAA,CACN,CAAA,+BAAA,EAAkCuC,SAAAA,CAAAA,mCAAAA,CAAAA,EAClC;AAAE3B,QAAAA;OAAM,CAAA;AAEhB,IAAA;AACA,IAAA,MAAMA,KAAAA;AACV,EAAA;AAEA,EAAA,MAAMiF,MAAAA,GAAShG,MAAM8F,QAAAA,CAAAA;AACrB,EAAA,MAAMG,OAAAA,GAAUD,OAAOE,SAAAA,EAAWD,OAAAA;AAClC,EAAA,IAAI,OAAOA,OAAAA,KAAY,QAAA,IAAYA,OAAAA,CAAQ/D,WAAW,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI/B,KAAAA,CAAM,CAAA,+BAAA,EAAkC0F,aAAAA,CAAAA,CAAe,CAAA;AACrE,EAAA;AAEA,EAAA,OAAOI,OAAAA;AACX,CAAA,EA7BkC,oBAAA;AAoC3B,IAAME,2CAA2B,MAAA,CAAA,CACpC,EAAEjB,WAAAA,EAAaC,YAAAA,IACfiB,YAAAA,KACW;AACX,EAAA,iBAAA;AACAjB,EAAAA,YAAAA;AACA,EAAA,WAAA;AACAD,EAAAA,WAAAA;AACA,EAAA,YAAA;AACA,EAAA,QAAA;AACA,EAAA,CAAA,uBAAA,EAA0BC,YAAAA,CAAAA,CAAAA;AAC1B,EAAA,QAAA;AACA,EAAA,CAAA,iBAAA,EAAoBD,WAAAA,CAAAA,CAAAA;AACpB,EAAA,QAAA;AACA,EAAA,mBAAA;AACA,EAAA,QAAA;AACA,EAAA,CAAA,cAAA,EAAiBkB,YAAAA,CAAAA;AAhBmB,CAAA,EAAA,0BAAA;AAmBxC,IAAMC,UAAAA,iCAAoBC,QAAAA,KAAAA;AACtB,EAAA,IAAI;AACA,IAAA,MAAM7B,KAAK6B,QAAAA,CAAAA;AACX,IAAA,OAAO,IAAA;AACX,EAAA,CAAA,CAAA,OAAS/C,KAAAA,EAAO;AACZ,IAAA,IAAKA,KAAAA,CAA4BC,SAAS,QAAA,EAAU;AAChD,MAAA,OAAO,KAAA;AACX,IAAA;AACA,IAAA,MAAMD,KAAAA;AACV,EAAA;AACJ,CAAA,EAVmB,YAAA,CAAA;AAYnB,IAAMgD,gBAAAA,iCAA0BC,OAAAA,KAAAA;AAC5B,EAAA,IAAIC,KAAAA;AACJ,EAAA,IAAI;AACAA,IAAAA,KAAAA,GAAQ,IAAIC,UAAAA,CAAW,MAAMX,QAAAA,CAASS,OAAAA,CAAAA,CAAAA;AAC1C,EAAA,CAAA,CAAA,OAASzF,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIZ,KAAAA,CAAM,CAAA,iCAAA,EAAoCqG,OAAAA,CAAAA,CAAAA,EAAW;AAAEzF,MAAAA;KAAM,CAAA;AAC3E,EAAA;AAEA,EAAA,IAAI0F,KAAAA,CAAMvE,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI/B,KAAAA,CAAM,CAAA,kBAAA,EAAqBqG,OAAAA,CAAAA,CAAS,CAAA;AAClD,EAAA;AAEA,EAAA,OAAOC,KAAAA;AACX,CAAA,EAbyB,kBAAA,CAAA;AAezB,IAAME,UAAAA,mBAAa,MAAA,CAAA,OACfF,KAAAA,EACAG,OAAAA,EACAC,mBAAAA,KAAAA;AAEA,EAAA,MAAMC,KAAAA,GAAQC,UAAUN,KAAAA,CAAAA;AACxB,EAAA,MAAMO,QAAAA,GAAW7H,IAAAA,CAAK2D,OAAAA,CAAQ8D,OAAAA,CAAAA;AAC9B,EAAA,MAAMK,YAAAA,GAAe9H,IAAAA,CAAKC,IAAAA,CAAK4H,QAAAA,EAAUH,mBAAAA,CAAAA;AACzC,EAAA,MAAMK,kBAAAA,GAAqB,GAAGL,mBAAAA,CAAAA,CAAAA,CAAAA;AAE9B,EAAA,KAAA,MAAW,CAACM,OAAAA,EAASC,OAAAA,KAAYC,MAAAA,CAAOC,OAAAA,CAAQR,KAAAA,CAAAA,EAAQ;AACpD,IAAA,MAAMS,OAAAA,GAAUpI,IAAAA,CAAK2D,OAAAA,CAAQkE,QAAAA,EAAUG,OAAAA,CAAAA;AACvC,IAAA,IAAII,OAAAA,KAAYP,YAAY,CAACO,OAAAA,CAAQ9G,WAAWuG,QAAAA,GAAW7H,IAAAA,CAAKqI,GAAG,CAAA,EAAG;AAClE,MAAA,MAAM,IAAIrH,KAAAA,CAAM,CAAA,+BAAA,EAAkCgH,OAAAA,CAAAA,CAAS,CAAA;AAC/D,IAAA;AACA,IAAA,IAAII,OAAAA,KAAYN,gBAAgB,CAACM,OAAAA,CAAQ9G,WAAWwG,YAAAA,GAAe9H,IAAAA,CAAKqI,GAAG,CAAA,EAAG;AAC1E,MAAA,MAAM,IAAIrH,KAAAA,CACN,CAAA,wCAAA,EAA2C+G,kBAAAA,CAAAA,EAAAA,EAAuBC,OAAAA,CAAAA,CAAS,CAAA;AAEnF,IAAA;AACA,IAAA,IAAIA,OAAAA,CAAQM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAE3B,IAAA,MAAMC,KAAAA,CAAMvI,IAAAA,CAAKwI,OAAAA,CAAQJ,OAAAA,CAAAA,EAAU;MAAEK,SAAAA,EAAW;KAAK,CAAA;AACrD,IAAA,MAAMC,SAAAA,CAAUN,SAASH,OAAAA,CAAAA;AAC7B,EAAA;AACJ,CAAA,EAzBmB,YAAA,CAAA;AA2BnB,IAAMU,oBAAAA,mBAAuB,MAAA,CAAA,OACzBC,YAAAA,EACAC,UAAAA,KAAAA;AAEA,EAAA,MAAMN,MAAMM,UAAAA,EAAY;IAAEJ,SAAAA,EAAW;GAAK,CAAA;AAC1C,EAAA,MAAMC,UAAU1I,IAAAA,CAAKC,IAAAA,CAAK4I,UAAAA,EAAY/I,mBAAAA,GAAsB8I,YAAAA,CAAAA;AAChE,CAAA,EAN6B,sBAAA,CAAA;AAQtB,IAAME,+CAA+B,MAAA,CAAA,OACxCC,MAAAA,EACAC,WAAAA,EACAC,iBAAAA,EACAC,OAA+DC,QAAAA,KAAQ;AAEvE,EAAA,IAAI;AACA,IAAA,MAAMD,IAAAA,CAAKH,QAAQC,WAAAA,CAAAA;AACvB,EAAA,CAAA,CAAA,OAAS5E,KAAAA,EAAO;AACZ,IAAA,MAAMC,OAAQD,KAAAA,CAA4BC,IAAAA;AAC1C,IAAA,IAAIA,IAAAA,KAAS,QAAA,IAAYA,IAAAA,KAAS,OAAA,EAAS;AACvC,MAAA,MAAMD,KAAAA;AACV,IAAA;AAEA,IAAA,MAAM6E,iBAAAA,EAAAA;AACN,IAAA,MAAMC,IAAAA,CAAKH,QAAQC,WAAAA,CAAAA;AACvB,EAAA;AACJ,CAAA,EAjB4C,8BAAA;AAmB5C,IAAMI,8BAAc,MAAA,CAAA,OAChBC,SAAAA,EACAR,YACA,EAAE9C,WAAAA,IACFkD,iBAAAA,KAAAA;AAEA,EAAA,MAAMK,QAAAA,GAAWrD,iBAAiBF,WAAAA,CAAAA;AAClC,EAAA,MAAMwD,SAAAA,GAAYvJ,IAAAA,CAAKC,IAAAA,CAAKoJ,SAAAA,EAAWtJ,iBAAiBuJ,QAAAA,CAAAA;AACxD,EAAA,IAAI,CAAE,MAAMpC,UAAAA,CAAWqC,SAAAA,CAAAA,EAAa;AAChC,IAAA,MAAM,IAAIvI,KAAAA,CAAM,CAAA,qCAAA,EAAwCuI,SAAAA,CAAAA,CAAW,CAAA;AACvE,EAAA;AAEA,EAAA,MAAMhB,MAAMM,UAAAA,EAAY;IAAEJ,SAAAA,EAAW;GAAK,CAAA;AAC1C,EAAA,MAAMK,6BACFS,SAAAA,EACAvJ,IAAAA,CAAKC,KAAK4I,UAAAA,EAAYS,QAAAA,GACtBL,iBAAAA,CAAAA;AAER,CAAA,EAlBoB,aAAA,CAAA;AAwBpB,IAAMO,gBAAAA,mBAAmB,MAAA,CAAA,OAAOX,UAAAA,EAAoBY,SAAAA,KAAAA;AAChD,EAAA,MAAMC,SAAAA,GAAY1J,IAAAA,CAAKwI,OAAAA,CAAQiB,SAAAA,CAAAA;AAC/B,EAAA,MAAME,UAAAA,GAAa3J,IAAAA,CAAK4J,QAAAA,CAASH,SAAAA,CAAAA;AACjC,EAAA,MAAMlB,MAAMmB,SAAAA,EAAW;IAAEjB,SAAAA,EAAW;GAAK,CAAA;AAEzC,EAAA,MAAMoB,OAAAA,GAAU,MAAMC,OAAAA,CAAQ9J,IAAAA,CAAKC,KAAKyJ,SAAAA,EAAW,CAAA,EAAGC,UAAAA,CAAAA,MAAAA,CAAkB,CAAA,CAAA;AACxE,EAAA,MAAMI,YAAY/J,IAAAA,CAAKC,IAAAA,CAAKyJ,SAAAA,EAAW,CAAA,EAAGC,UAAAA,CAAAA,KAAAA,CAAiB,CAAA;AAC3D,EAAA,MAAMxB,OAAAA,GAAU,MAAM6B,OAAAA,CAAQnB,UAAAA,CAAAA;AAE9B,EAAA,IAAI;AACA,IAAA,KAAA,MAAW/G,SAASqG,OAAAA,EAAS;AACzB,MAAA,MAAMgB,QAAAA,CAASnJ,IAAAA,CAAKC,IAAAA,CAAK4I,UAAAA,EAAY/G,KAAAA,GAAQ9B,IAAAA,CAAKC,IAAAA,CAAK4J,OAAAA,EAAS/H,KAAAA,CAAAA,CAAAA;AACpE,IAAA;AAEA,IAAA,IAAI,CAAE,MAAMoF,UAAAA,CAAWuC,SAAAA,KAAgB,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAa;AACjE,MAAA,MAAME,MAAAA,CAAOF,WAAWN,SAAAA,CAAAA;IAC5B,CAAA,MAAA,IAAW,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAY;AACpC,MAAA,MAAMG,GAAGH,SAAAA,EAAW;QAAEtB,SAAAA,EAAW,IAAA;QAAM0B,KAAAA,EAAO;OAAK,CAAA;AACvD,IAAA;AAEA,IAAA,IAAI,MAAMjD,UAAAA,CAAWuC,SAAAA,CAAAA,EAAY;AAC7B,MAAA,MAAMQ,MAAAA,CAAOR,WAAWM,SAAAA,CAAAA;AAC5B,IAAA;AACA,IAAA,MAAME,MAAAA,CAAOJ,SAASJ,SAAAA,CAAAA;AACtB,IAAA,MAAMS,GAAGH,SAAAA,EAAW;MAAEtB,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA,CAAGC,KAAAA,CAAM,CAAChG,KAAAA,KAAAA;AACzDqB,MAAAA,OAAAA,CAAQ4E,IAAAA,CAAK,CAAA,0BAAA,EAA6BN,SAAAA,CAAAA,eAAAA,CAAAA,EAA4B3F,KAAAA,CAAAA;IAC1E,CAAA,CAAA;AACJ,EAAA,CAAA,CAAA,OAASA,KAAAA,EAAO;AACZ,IAAA,MAAM8F,GAAGL,OAAAA,EAAS;MAAEpB,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA,CAAGC,KAAAA,CAAM,MAAMnH,MAAAA,CAAAA;AAChE,IAAA,IAAI,CAAE,MAAMiE,UAAAA,CAAWuC,SAAAA,KAAgB,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAa;AACjE,MAAA,MAAME,OAAOF,SAAAA,EAAWN,SAAAA,CAAAA,CAAWW,KAAAA,CAAM,MAAMnH,MAAAA,CAAAA;AACnD,IAAA;AACA,IAAA,MAAMmB,KAAAA;AACV,EAAA;AACJ,CAAA,EAlCyB,kBAAA,CAAA;AAoClB,IAAMkG,+BAAAA,mBAAkC,MAAA,CAAA,CAACC,GAAAA,EAAajH,QAAAA,KAA+B;AACxF,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACAnD,EAAAA,yBAAAA;AACA,EAAA,QAAA;AACA,EAAA,KAAA;AACA,EAAA,cAAA;AACA,EAAA,OAAA;AACA,EAAA,IAAA;AACA,EAAA,CAAA,EAAGoK,GAAAA,CAAAA,SAAAA,CAAAA;AACHjH,EAAAA,QAAAA;AACA,EAAA,IAAA;AACA,EAAA,OAAA;AACA,EAAA;AAd2C,CAAA,EAAA,iCAAA;AAiB/C,IAAMkH,2BAAAA,2BAA+BD,GAAAA,EAAajH,QAAAA,KAC9C,IAAIQ,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,QAAQC,KAAAA,CAAM,QAAA,EAAUqG,+BAAAA,CAAgCC,GAAAA,EAAKjH,QAAAA,CAAAA,EAAW;IAC1EY,KAAAA,EAAO;GACX,CAAA;AACAF,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,SAASJ,MAAAA,CAAAA;AAClBC,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,KAAAA;AACf,IAAA,IAAIA,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CAAO,IAAI/C,KAAAA,CAAM,CAAA,0CAAA,EAA6CqD,IAAAA,IAAQ,CAAA,GAAI,CAAA,CAAA;AAC9E,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAbgC,6BAAA,CAAA;AAepC,IAAMoG,aAAAA,mBAAgB,MAAA,CAAA,OAClBC,OAAAA,EACA/F,YAAAA,KAAAA;AAEA,EAAA,IAAI;AACA,IAAA,MAAMuF,GAAGQ,OAAAA,EAAS;MAAEjC,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA;AACrD,EAAA,CAAA,CAAA,OAAS/F,KAAAA,EAAO;AACZ,IAAA,MAAMC,OAAQD,KAAAA,CAA4BC,IAAAA;AAC1C,IAAA,IAAIA,IAAAA,KAAS,QAAA,IAAYA,IAAAA,KAAS,OAAA,EAAS;AACvC,MAAA,MAAMD,KAAAA;AACV,IAAA;AACA,IAAA,IAAIO,iBAAiB1B,MAAAA,EAAW;AAC5B,MAAA,MAAMmB,KAAAA;AACV,IAAA;AAEA,IAAA,MAAM,EAAEd,QAAAA,EAAQ,GAAK,MAAMqB,YAAAA,EAAAA;AAC3B,IAAA,MAAM6F,2BAAAA,CAA4BE,SAASpH,QAAAA,CAAAA;AAC3C,IAAA,MAAM4G,GAAGQ,OAAAA,EAAS;MAAEjC,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA;AACrD,EAAA;AACJ,CAAA,EAnBsB,eAAA,CAAA;AA2Bf,IAAMQ,6BAAAA,mBAAgC,MAAA,CAAA,OACzC,EACItD,OAAAA,EACAjB,QAAAA,EACAqD,SAAAA,EACAlJ,cAAAA,EACAC,WAAAA,EAAW,EAEf,EAAEkD,GAAAA,EAAG,KAA4C;AAEjD,EAAA,IAAI0C,QAAAA,CAASrD,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI/B,MAAM,yEAAA,CAAA;AACpB,EAAA;AACAmF,EAAAA,oBAAAA,CAAqBC,QAAAA,CAAAA;AAErB,EAAA,MAAMwC,YAAAA,GAAe,MAAMxB,gBAAAA,CAAiBC,OAAAA,CAAAA;AAC5C,EAAA,MAAMJ,YAAAA,GAAe2D,WAAW,QAAA,CAAA,CAAUC,OAAOjC,YAAAA,CAAAA,CAAc3H,OAAO,KAAA,CAAA;AACtE,EAAA,MAAMyJ,OAAAA,GAAU,MAAMZ,OAAAA,CAAQ9J,IAAAA,CAAKC,KAAK6K,MAAAA,EAAAA,EAAU,2BAAA,CAAA,CAAA;AAClD,EAAA,MAAMC,aAAAA,GAAgB/K,IAAAA,CAAKC,IAAAA,CAAKyK,OAAAA,EAAS,QAAA,CAAA;AACzC,EAAA,MAAM7B,UAAAA,GAAa7I,IAAAA,CAAKC,IAAAA,CAAKyK,OAAAA,EAAS,SAAA,CAAA;AACtC,EAAA,IAAItF,QAAAA;AACJ,EAAA,MAAM4F,OAAAA,GAAU,IAAIzG,sBAAAA,EAAAA;AAEpB,EAAA,IAAI;AACA,IAAA,MAAM0G,WAAAA,GAAcjL,IAAAA,CAAK4J,QAAAA,CAASlG,GAAAA,CAAAA;AAClC,IAAA,MAAM8D,UAAAA,CAAWoB,YAAAA,EAAcmC,aAAAA,EAAeE,WAAAA,CAAAA;AAE9C,IAAA,MAAM5B,SAAAA,GAAYrJ,IAAAA,CAAKC,IAAAA,CAAK8K,aAAAA,EAAeE,WAAAA,CAAAA;AAC3C,IAAA,IAAI,CAAE,MAAM/D,UAAAA,CAAWmC,SAAAA,CAAAA,IAAe,CAAA,CAAE,MAAM/D,IAAAA,CAAK+D,SAAAA,CAAAA,EAAY9D,WAAAA,EAAW,EAAI;AAC1E,MAAA,MAAM,IAAIvE,KAAAA,CACN,CAAA,mBAAA,EAAsBiK,WAAAA,CAAAA,sCAAAA,CAAmD,CAAA;AAEjF,IAAA;AAEA7F,IAAAA,QAAAA,GAAW;AACP7E,MAAAA,cAAAA;MACAC,WAAAA,EAAa,MAAMgG,kBAAAA,CAAmB6C,SAAAA,EAAW7I,WAAAA;AACrD,KAAA;AACA,IAAA,MAAMmI,oBAAAA,CAAqBC,cAAcC,UAAAA,CAAAA;AAEzC,IAAA,KAAA,MAAWqC,eAAe9E,QAAAA,EAAU;AAChC,MAAA,MAAM4E,QAAQ9F,GAAAA,CACV8B,wBAAAA,CAAyBkE,WAAAA,EAAajE,YAAAA,GACtC7B,QAAAA,EACA;AAAE1B,QAAAA;AAAI,OAAA,EACN2F,SAAAA,CAAAA;AAEJ,MAAA,MAAMD,WAAAA,CAAYC,SAAAA,EAAWR,UAAAA,EAAYqC,WAAAA,EAAa,YAAA;AAClD,QAAA,MAAM,EAAE5H,QAAAA,EAAQ,GAAK,MAAM0H,OAAAA,CAAQrG,aAAaS,QAAAA,CAAAA;AAChD,QAAA,MAAMoF,2BAAAA,CAA4BnB,WAAW/F,QAAAA,CAAAA;MACjD,CAAA,CAAA;AACJ,IAAA;AAEA,IAAA,MAAMkG,gBAAAA,CAAiBX,YAAYY,SAAAA,CAAAA;EACvC,CAAA,SAAA;AACI,IAAA,MAAMgB,aAAAA,CACFC,OAAAA,EACAtF,QAAAA,KAAanC,MAAAA,GAAYA,MAAAA,GAAY,MAAM+H,OAAAA,CAAQrG,YAAAA,CAAaS,QAAAA,CAAAA,CAAAA,CAClEgF,KAAAA,CAAM,CAAChG,KAAAA,KAAAA;AACLqB,MAAAA,OAAAA,CAAQ4E,IAAAA,CAAK,CAAA,kDAAA,EAAqDK,OAAAA,CAAAA,CAAAA,EAAWtG,KAAAA,CAAAA;IACjF,CAAA,CAAA;AACJ,EAAA;AACJ,CAAA,EA9D6C,+BAAA","file":"D25LP26W.js","sourcesContent":["import { unzipSync } from 'fflate';\nimport { execFile, spawn } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n    chmod,\n    copyFile,\n    mkdir,\n    mkdtemp,\n    readdir,\n    readFile,\n    rename,\n    rm,\n    stat,\n    writeFile,\n} from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport path from 'node:path';\nimport { promisify } from 'node:util';\nimport { parse } from 'toml';\n\nimport type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';\n\nconst execFileAsync = promisify(execFile);\n\nconst SOURCE_ARCHIVE_NAME = 'contracts-source.zip';\nconst WASM_TARGET_DIR = path.join('target', 'wasm32v1-none', 'release');\n\n// The self-contained source is mounted here and built in place. The official image's WORKDIR is\n// already /source; we set it explicitly for clarity.\nconst SOURCE_MOUNT = '/source';\n\n// Canonical reproducible platform. External verifiers reproduce the amd64 artifact, so we always\n// run the amd64 image regardless of the host arch (the daemon emulates it when needed).\nconst VERIFIABLE_BUILD_PLATFORM = 'linux/amd64';\n\nconst OFFICIAL_IMAGE_REPO = 'stellar/stellar-cli';\n\nconst META_FLAG = '--meta';\n\ninterface RustToolchainToml {\n    toolchain?: {\n        channel?: string;\n    };\n}\n\n// The subset of `docker manifest inspect` output (an OCI image index) that we read.\ninterface ManifestDescriptor {\n    digest?: string;\n    platform?: { os?: string; architecture?: string };\n}\ninterface ManifestIndex {\n    manifests?: ManifestDescriptor[];\n}\n\nexport interface PackageSpec {\n    packageName: string;\n    manifestPath: string;\n}\n\nexport interface VerifiableBuildVersions {\n    stellarVersion: string;\n    rustVersion: string;\n}\n\nexport interface ResolvedVerifiableBuildImage {\n    imageRef: string;\n    bldimg: string;\n    tagRef: string;\n}\n\nexport interface RunVerifiableBuildFromArchiveOptions {\n    archive: string;\n    packages: PackageSpec[];\n    outputDir: string;\n    stellarVersion: string;\n    rustVersion?: string;\n}\n\n/**\n * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.\n * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the\n * only image the tool builds against.\n */\nexport const officialImageTagRef = (stellarVersion: string, rustVersion: string): string =>\n    `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`;\n\n/**\n * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so\n * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.\n */\nexport const parseAmd64Digest = (manifestInspectJson: string): string => {\n    const { manifests } = JSON.parse(manifestInspectJson) as ManifestIndex;\n\n    if (!Array.isArray(manifests)) {\n        throw new Error(\n            '`docker manifest inspect` did not return a multi-arch index (no `manifests` array)',\n        );\n    }\n\n    const digest = manifests.find(\n        ({ platform }) => platform?.os === 'linux' && platform?.architecture === 'amd64',\n    )?.digest;\n\n    if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {\n        throw new Error('No linux/amd64 manifest digest found in `docker manifest inspect` output');\n    }\n\n    return digest;\n};\n\n/**\n * Resolve the immutable linux/amd64 digest of a `stellar/stellar-cli` tag via a daemon-less\n * registry query (`docker manifest inspect`). This is the reproducible reference an external\n * verifier pins to (SEP-58).\n */\nconst resolveAmd64Digest = async (imageTagRef: string): Promise<string> => {\n    try {\n        const { stdout } = await execFileAsync('docker', ['manifest', 'inspect', imageTagRef], {\n            maxBuffer: 16 * 1024 * 1024,\n            timeout: 30_000,\n        });\n        return parseAmd64Digest(stdout);\n    } catch (cause) {\n        throw new Error(\n            `Failed to resolve the linux/amd64 digest of ${imageTagRef} (\\`docker manifest inspect\\`)`,\n            { cause },\n        );\n    }\n};\n\n/** The `key` of a `key=value` meta entry (the whole string when there is no `=`). */\nconst metaKey = (entry: string): string => {\n    const eq = entry.indexOf('=');\n    return eq === -1 ? entry : entry.slice(0, eq);\n};\n\n/**\n * Canonicalize `stellar contract build` args so the embedded metadata order is stable.\n *\n * Soroban stores contract metadata as an ORDERED sequence, so the order of `--meta key=value`\n * flags changes the WASM bytes. To keep the build reproducible, every meta entry — the caller's\n * plus the tool-injected ones — is pulled out, merged, and re-emitted in sorted order.\n *\n * Injected keys (e.g. `bldimg`) are tool-controlled and RESERVED: any caller `--meta` reusing an\n * injected key is dropped.\n */\nexport const canonicalizeMetaArgs = (buildArgs: string[], injectedMeta: string[]): string[] => {\n    const reservedKeys = new Set(injectedMeta.map(metaKey));\n    const metas = [...injectedMeta];\n    const passthrough: string[] = [];\n\n    const addCallerMeta = (value: string): void => {\n        if (!reservedKeys.has(metaKey(value))) metas.push(value);\n    };\n\n    for (let i = 0; i < buildArgs.length; i++) {\n        const arg = buildArgs[i];\n        if (arg === undefined) continue;\n        if (arg === META_FLAG) {\n            const value = buildArgs[i + 1];\n            if (value !== undefined && !value.startsWith('--')) {\n                addCallerMeta(value);\n                i += 1;\n            }\n        } else if (arg.startsWith(`${META_FLAG}=`)) {\n            addCallerMeta(arg.slice(META_FLAG.length + 1));\n        } else {\n            passthrough.push(arg);\n        }\n    }\n\n    metas.sort();\n    return [...passthrough, ...metas.flatMap((meta) => [META_FLAG, meta])];\n};\n\n/**\n * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /\n * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.\n */\nexport const buildVerifiableBuildDockerArgs = ({\n    imageRef,\n    sourceDir,\n    buildArgs,\n    bldimg,\n}: {\n    imageRef: string;\n    sourceDir: string;\n    buildArgs: string[];\n    bldimg: string;\n}): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '-v',\n    `${sourceDir}:${SOURCE_MOUNT}`,\n    '-w',\n    SOURCE_MOUNT,\n    imageRef,\n    'contract',\n    'build',\n    ...canonicalizeMetaArgs(buildArgs, [`bldimg=${bldimg}`]),\n];\n\n/**\n * Resolve the directory to build. An explicit `sourceDir` that is relative resolves against the\n * cwd; an absolute one is used as-is; omitting it falls back to the cwd.\n */\nexport const resolveBuildDir = (cwd: string, sourceDir?: string): string =>\n    path.resolve(cwd, sourceDir ?? '.');\n\nconst runDocker = (dockerArgs: string[]): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', dockerArgs, { stdio: 'inherit' });\n        child.on('error', (error) =>\n            reject(new Error('Failed to spawn docker for the verifiable build', { cause: error })),\n        );\n        child.on('close', (code, signal) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(\n                    new Error(\n                        `Verifiable build failed: docker exited with ${\n                            signal ? `signal ${signal}` : `code ${code}`\n                        }`,\n                    ),\n                );\n            }\n        });\n    });\n\n/**\n * Reproducible `stellar contract build` inside the official `stellar/stellar-cli` image.\n * Used by the archive orchestrator for each `--package`.\n */\nexport class VerifiableBuildWrapper {\n    private readonly imagesByTag = new Map<string, Promise<ResolvedVerifiableBuildImage>>();\n\n    public constructor(\n        private readonly resolveDigest: (\n            imageTagRef: string,\n        ) => Promise<string> = resolveAmd64Digest,\n    ) {}\n\n    public resolveImage({\n        stellarVersion,\n        rustVersion,\n    }: VerifiableBuildVersions): Promise<ResolvedVerifiableBuildImage> {\n        const tagRef = officialImageTagRef(stellarVersion, rustVersion);\n        const existing = this.imagesByTag.get(tagRef);\n        if (existing !== undefined) {\n            return existing;\n        }\n\n        const resolved = this.resolveDigest(tagRef).then((digest) => ({\n            imageRef: `${OFFICIAL_IMAGE_REPO}@${digest}`,\n            bldimg: `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`,\n            tagRef,\n        }));\n        this.imagesByTag.set(tagRef, resolved);\n        return resolved;\n    }\n\n    public async run(\n        args: string[],\n        versions: VerifiableBuildVersions,\n        { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>,\n        sourceDir?: string,\n    ): Promise<void> {\n        const buildDir = resolveBuildDir(cwd, sourceDir);\n        try {\n            if (!(await stat(buildDir)).isDirectory()) {\n                throw new Error('not a directory');\n            }\n        } catch (cause) {\n            throw new Error(\n                `Verifiable build source directory is not an existing directory: ${buildDir}`,\n                { cause },\n            );\n        }\n\n        // The official stellar-cli image runs as a non-host UID and must create cargo target\n        // dirs under the bind-mounted source. Do not pass --user (that would diverge from what\n        // external verifiers run). Only chmod when a sourceDir is passed (typically a\n        // throwaway extract dir); never world-write the process cwd.\n        if (sourceDir !== undefined) {\n            await chmod(buildDir, 0o777);\n        }\n\n        const { imageRef, bldimg, tagRef } = await this.resolveImage(versions);\n\n        const dockerArgs = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: buildDir,\n            buildArgs: args,\n            bldimg,\n        });\n\n        console.info('🔒 Verifiable build (official stellar/stellar-cli image, run from host)');\n        console.info(`   source: ${buildDir}`);\n        console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);\n        console.info(`   bldimg: ${bldimg}`);\n        console.info(`   docker ${dockerArgs.join(' ')}`);\n\n        await runDocker(dockerArgs);\n    }\n}\n\n/**\n * Parse a `--package <name>:<manifest-path>` pair. Both sides must be non-empty.\n */\nexport const parsePackageSpec = (spec: string): PackageSpec => {\n    const colon = spec.indexOf(':');\n    if (colon <= 0 || colon === spec.length - 1) {\n        throw new Error(\n            `Invalid --package spec ${JSON.stringify(spec)}: expected <name>:<manifest-path>`,\n        );\n    }\n\n    return {\n        packageName: spec.slice(0, colon),\n        manifestPath: spec.slice(colon + 1),\n    };\n};\n\n/** Soroban wasm artifact basename: hyphens in the package name become underscores. */\nexport const wasmArtifactName = (packageName: string): string =>\n    `${packageName.replaceAll('-', '_')}.wasm`;\n\nconst validatePackageSpecs = (packages: PackageSpec[]): void => {\n    const artifactNames = new Set<string>();\n    for (const { packageName } of packages) {\n        const artifactName = wasmArtifactName(packageName);\n        if (artifactNames.has(artifactName)) {\n            throw new Error(`Duplicate WASM artifact ${artifactName} from --package options`);\n        }\n        artifactNames.add(artifactName);\n    }\n};\n\n/**\n * Resolve the Rust toolchain version for the verifiable build image tag. An explicit\n * `--rust-version` wins; otherwise read the pinned channel from the supplied source directory.\n */\nexport const resolveRustVersion = async (\n    sourceDir: string,\n    rustVersionFlag?: string,\n): Promise<string> => {\n    if (rustVersionFlag !== undefined) {\n        return rustVersionFlag;\n    }\n\n    const toolchainPath = path.join(sourceDir, 'rust-toolchain.toml');\n    let contents: string;\n    try {\n        contents = await readFile(toolchainPath, 'utf-8');\n    } catch (cause) {\n        if ((cause as { code?: string }).code === 'ENOENT') {\n            throw new Error(\n                `Missing rust-toolchain.toml in ${sourceDir} and no --rust-version was provided`,\n                { cause },\n            );\n        }\n        throw cause;\n    }\n\n    const parsed = parse(contents) as RustToolchainToml;\n    const channel = parsed.toolchain?.channel;\n    if (typeof channel !== 'string' || channel.length === 0) {\n        throw new Error(`Missing 'toolchain.channel' in ${toolchainPath}`);\n    }\n\n    return channel;\n};\n\n/**\n * Build `stellar contract build` args for one archive package. Embeds SEP-58 `source_sha256`\n * and replays the build flags as `bldopt=` metas so external verifiers can reproduce the build.\n * `bldimg` is injected separately by the official-image runner.\n */\nexport const buildArchiveContractArgs = (\n    { packageName, manifestPath }: PackageSpec,\n    sourceSha256: string,\n): string[] => [\n    '--manifest-path',\n    manifestPath,\n    '--package',\n    packageName,\n    '--optimize',\n    '--meta',\n    `bldopt=--manifest-path=${manifestPath}`,\n    '--meta',\n    `bldopt=--package=${packageName}`,\n    '--meta',\n    'bldopt=--optimize',\n    '--meta',\n    `source_sha256=${sourceSha256}`,\n];\n\nconst pathExists = async (filePath: string): Promise<boolean> => {\n    try {\n        await stat(filePath);\n        return true;\n    } catch (error) {\n        if ((error as { code?: string }).code === 'ENOENT') {\n            return false;\n        }\n        throw error;\n    }\n};\n\nconst readArchiveBytes = async (archive: string): Promise<Uint8Array> => {\n    let bytes: Uint8Array;\n    try {\n        bytes = new Uint8Array(await readFile(archive));\n    } catch (cause) {\n        throw new Error(`Archive not found or unreadable: ${archive}`, { cause });\n    }\n\n    if (bytes.length === 0) {\n        throw new Error(`Archive is empty: ${archive}`);\n    }\n\n    return bytes;\n};\n\nconst extractZip = async (\n    bytes: Uint8Array,\n    destDir: string,\n    expectedRootDirName: string,\n): Promise<void> => {\n    const files = unzipSync(bytes);\n    const destRoot = path.resolve(destDir);\n    const expectedRoot = path.join(destRoot, expectedRootDirName);\n    const expectedRootPrefix = `${expectedRootDirName}/`;\n\n    for (const [relPath, content] of Object.entries(files)) {\n        const outPath = path.resolve(destRoot, relPath);\n        if (outPath !== destRoot && !outPath.startsWith(destRoot + path.sep)) {\n            throw new Error(`Zip entry escapes destination: ${relPath}`);\n        }\n        if (outPath !== expectedRoot && !outPath.startsWith(expectedRoot + path.sep)) {\n            throw new Error(\n                `Zip entry is outside expected top-level ${expectedRootPrefix}: ${relPath}`,\n            );\n        }\n        if (relPath.endsWith('/')) continue;\n\n        await mkdir(path.dirname(outPath), { recursive: true });\n        await writeFile(outPath, content);\n    }\n};\n\nconst persistSourceArchive = async (\n    archiveBytes: Uint8Array,\n    stagingDir: string,\n): Promise<void> => {\n    await mkdir(stagingDir, { recursive: true });\n    await writeFile(path.join(stagingDir, SOURCE_ARCHIVE_NAME), archiveBytes);\n};\n\nexport const copyFileWithPermissionRepair = async (\n    source: string,\n    destination: string,\n    repairPermissions: () => Promise<void>,\n    copy: (source: string, destination: string) => Promise<void> = copyFile,\n): Promise<void> => {\n    try {\n        await copy(source, destination);\n    } catch (error) {\n        const code = (error as { code?: string }).code;\n        if (code !== 'EACCES' && code !== 'EPERM') {\n            throw error;\n        }\n\n        await repairPermissions();\n        await copy(source, destination);\n    }\n};\n\nconst persistWasm = async (\n    buildRoot: string,\n    stagingDir: string,\n    { packageName }: PackageSpec,\n    repairPermissions: () => Promise<void>,\n): Promise<void> => {\n    const wasmName = wasmArtifactName(packageName);\n    const builtPath = path.join(buildRoot, WASM_TARGET_DIR, wasmName);\n    if (!(await pathExists(builtPath))) {\n        throw new Error(`Expected WASM not found after build: ${builtPath}`);\n    }\n\n    await mkdir(stagingDir, { recursive: true });\n    await copyFileWithPermissionRepair(\n        builtPath,\n        path.join(stagingDir, wasmName),\n        repairPermissions,\n    );\n};\n\n/**\n * Atomically replace the output directory with the complete staged artifact set.\n * Mirrors protocol stellar's `.next-` / `.prev` swap so failed builds leave prior output intact.\n */\nconst publishArtifacts = async (stagingDir: string, outputDir: string): Promise<void> => {\n    const parentDir = path.dirname(outputDir);\n    const outputBase = path.basename(outputDir);\n    await mkdir(parentDir, { recursive: true });\n\n    const nextDir = await mkdtemp(path.join(parentDir, `${outputBase}.next-`));\n    const backupDir = path.join(parentDir, `${outputBase}.prev`);\n    const entries = await readdir(stagingDir);\n\n    try {\n        for (const entry of entries) {\n            await copyFile(path.join(stagingDir, entry), path.join(nextDir, entry));\n        }\n\n        if (!(await pathExists(outputDir)) && (await pathExists(backupDir))) {\n            await rename(backupDir, outputDir);\n        } else if (await pathExists(backupDir)) {\n            await rm(backupDir, { recursive: true, force: true });\n        }\n\n        if (await pathExists(outputDir)) {\n            await rename(outputDir, backupDir);\n        }\n        await rename(nextDir, outputDir);\n        await rm(backupDir, { recursive: true, force: true }).catch((error) => {\n            console.warn(`Failed to remove leftover ${backupDir} after publish:`, error);\n        });\n    } catch (error) {\n        await rm(nextDir, { recursive: true, force: true }).catch(() => undefined);\n        if (!(await pathExists(outputDir)) && (await pathExists(backupDir))) {\n            await rename(backupDir, outputDir).catch(() => undefined);\n        }\n        throw error;\n    }\n};\n\nexport const buildPermissionRepairDockerArgs = (dir: string, imageRef: string): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '--user',\n    '0:0',\n    '--entrypoint',\n    'chmod',\n    '-v',\n    `${dir}:/cleanup`,\n    imageRef,\n    '-R',\n    'a+rwX',\n    '/cleanup',\n];\n\nconst relaxDockerOwnedPermissions = (dir: string, imageRef: string): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', buildPermissionRepairDockerArgs(dir, imageRef), {\n            stdio: 'inherit',\n        });\n        child.on('error', reject);\n        child.on('close', (code) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(new Error(`Failed to chmod temp dir via docker (exit ${code ?? 1})`));\n            }\n        });\n    });\n\nconst removeTempDir = async (\n    tempDir: string,\n    resolveImage?: () => Promise<ResolvedVerifiableBuildImage>,\n): Promise<void> => {\n    try {\n        await rm(tempDir, { recursive: true, force: true });\n    } catch (error) {\n        const code = (error as { code?: string }).code;\n        if (code !== 'EACCES' && code !== 'EPERM') {\n            throw error;\n        }\n        if (resolveImage === undefined) {\n            throw error;\n        }\n\n        const { imageRef } = await resolveImage();\n        await relaxDockerOwnedPermissions(tempDir, imageRef);\n        await rm(tempDir, { recursive: true, force: true });\n    }\n};\n\n/**\n * Build one or more Stellar contracts from a self-contained source archive.\n *\n * `packages` is intentionally already parsed: the CLI owns string parsing, while this orchestrator\n * deals only in validated package/manifest pairs.\n */\nexport const runVerifiableBuildFromArchive = async (\n    {\n        archive,\n        packages,\n        outputDir,\n        stellarVersion,\n        rustVersion,\n    }: RunVerifiableBuildFromArchiveOptions,\n    { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>,\n): Promise<void> => {\n    if (packages.length === 0) {\n        throw new Error('verifiable-build requires at least one --package <name>:<manifest-path>');\n    }\n    validatePackageSpecs(packages);\n\n    const archiveBytes = await readArchiveBytes(archive);\n    const sourceSha256 = createHash('sha256').update(archiveBytes).digest('hex');\n    const tempDir = await mkdtemp(path.join(tmpdir(), 'stellar-verifiable-build-'));\n    const extractionDir = path.join(tempDir, 'source');\n    const stagingDir = path.join(tempDir, 'staging');\n    let versions: VerifiableBuildVersions | undefined;\n    const wrapper = new VerifiableBuildWrapper();\n\n    try {\n        const rootDirName = path.basename(cwd);\n        await extractZip(archiveBytes, extractionDir, rootDirName);\n\n        const buildRoot = path.join(extractionDir, rootDirName);\n        if (!(await pathExists(buildRoot)) || !(await stat(buildRoot)).isDirectory()) {\n            throw new Error(\n                `Expected top-level ${rootDirName}/ directory not found after extraction`,\n            );\n        }\n\n        versions = {\n            stellarVersion,\n            rustVersion: await resolveRustVersion(buildRoot, rustVersion),\n        };\n        await persistSourceArchive(archiveBytes, stagingDir);\n\n        for (const packageSpec of packages) {\n            await wrapper.run(\n                buildArchiveContractArgs(packageSpec, sourceSha256),\n                versions,\n                { cwd },\n                buildRoot,\n            );\n            await persistWasm(buildRoot, stagingDir, packageSpec, async () => {\n                const { imageRef } = await wrapper.resolveImage(versions!);\n                await relaxDockerOwnedPermissions(buildRoot, imageRef);\n            });\n        }\n\n        await publishArtifacts(stagingDir, outputDir);\n    } finally {\n        await removeTempDir(\n            tempDir,\n            versions === undefined ? undefined : () => wrapper.resolveImage(versions!),\n        ).catch((error) => {\n            console.warn(`Temp dir cleanup failed (build result unchanged): ${tempDir}`, error);\n        });\n    }\n};\n"]}