@layerzerolabs/vm-tooling-stellar 1.2.9 → 1.2.10

package/dist/D25LP26W.js

@@ -0,0 +1,437 @@
+import { __name } from './VUOMXK5T.js';
+import { unzipSync } from 'fflate';
+import { execFile, spawn } from 'child_process';
+import { createHash } from 'crypto';
+import { stat, chmod, readFile, copyFile, mkdtemp, mkdir, writeFile, readdir, rename, rm } from 'fs/promises';
+import { tmpdir } from 'os';
+import path from 'path';
+import { promisify } from 'util';
+import { parse } from 'toml';
+
+var execFileAsync = promisify(execFile);
+var SOURCE_ARCHIVE_NAME = "contracts-source.zip";
+var WASM_TARGET_DIR = path.join("target", "wasm32v1-none", "release");
+var SOURCE_MOUNT = "/source";
+var VERIFIABLE_BUILD_PLATFORM = "linux/amd64";
+var OFFICIAL_IMAGE_REPO = "stellar/stellar-cli";
+var META_FLAG = "--meta";
+var officialImageTagRef = /* @__PURE__ */ __name((stellarVersion, rustVersion) => `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`, "officialImageTagRef");
+var parseAmd64Digest = /* @__PURE__ */ __name((manifestInspectJson) => {
+  const { manifests } = JSON.parse(manifestInspectJson);
+  if (!Array.isArray(manifests)) {
+    throw new Error("`docker manifest inspect` did not return a multi-arch index (no `manifests` array)");
+  }
+  const digest = manifests.find(({ platform }) => platform?.os === "linux" && platform?.architecture === "amd64")?.digest;
+  if (typeof digest !== "string" || !digest.startsWith("sha256:")) {
+    throw new Error("No linux/amd64 manifest digest found in `docker manifest inspect` output");
+  }
+  return digest;
+}, "parseAmd64Digest");
+var resolveAmd64Digest = /* @__PURE__ */ __name(async (imageTagRef) => {
+  try {
+    const { stdout } = await execFileAsync("docker", [
+      "manifest",
+      "inspect",
+      imageTagRef
+    ], {
+      maxBuffer: 16 * 1024 * 1024,
+      timeout: 3e4
+    });
+    return parseAmd64Digest(stdout);
+  } catch (cause) {
+    throw new Error(`Failed to resolve the linux/amd64 digest of ${imageTagRef} (\`docker manifest inspect\`)`, {
+      cause
+    });
+  }
+}, "resolveAmd64Digest");
+var metaKey = /* @__PURE__ */ __name((entry) => {
+  const eq = entry.indexOf("=");
+  return eq === -1 ? entry : entry.slice(0, eq);
+}, "metaKey");
+var canonicalizeMetaArgs = /* @__PURE__ */ __name((buildArgs, injectedMeta) => {
+  const reservedKeys = new Set(injectedMeta.map(metaKey));
+  const metas = [
+    ...injectedMeta
+  ];
+  const passthrough = [];
+  const addCallerMeta = /* @__PURE__ */ __name((value) => {
+    if (!reservedKeys.has(metaKey(value))) metas.push(value);
+  }, "addCallerMeta");
+  for (let i = 0; i < buildArgs.length; i++) {
+    const arg = buildArgs[i];
+    if (arg === void 0) continue;
+    if (arg === META_FLAG) {
+      const value = buildArgs[i + 1];
+      if (value !== void 0 && !value.startsWith("--")) {
+        addCallerMeta(value);
+        i += 1;
+      }
+    } else if (arg.startsWith(`${META_FLAG}=`)) {
+      addCallerMeta(arg.slice(META_FLAG.length + 1));
+    } else {
+      passthrough.push(arg);
+    }
+  }
+  metas.sort();
+  return [
+    ...passthrough,
+    ...metas.flatMap((meta) => [
+      META_FLAG,
+      meta
+    ])
+  ];
+}, "canonicalizeMetaArgs");
+var buildVerifiableBuildDockerArgs = /* @__PURE__ */ __name(({ imageRef, sourceDir, buildArgs, bldimg }) => [
+  "run",
+  "--rm",
+  "--platform",
+  VERIFIABLE_BUILD_PLATFORM,
+  "-v",
+  `${sourceDir}:${SOURCE_MOUNT}`,
+  "-w",
+  SOURCE_MOUNT,
+  imageRef,
+  "contract",
+  "build",
+  ...canonicalizeMetaArgs(buildArgs, [
+    `bldimg=${bldimg}`
+  ])
+], "buildVerifiableBuildDockerArgs");
+var resolveBuildDir = /* @__PURE__ */ __name((cwd, sourceDir) => path.resolve(cwd, sourceDir ?? "."), "resolveBuildDir");
+var runDocker = /* @__PURE__ */ __name((dockerArgs) => new Promise((resolve, reject) => {
+  const child = spawn("docker", dockerArgs, {
+    stdio: "inherit"
+  });
+  child.on("error", (error) => reject(new Error("Failed to spawn docker for the verifiable build", {
+    cause: error
+  })));
+  child.on("close", (code, signal) => {
+    if (code === 0) {
+      resolve();
+    } else {
+      reject(new Error(`Verifiable build failed: docker exited with ${signal ? `signal ${signal}` : `code ${code}`}`));
+    }
+  });
+}), "runDocker");
+var VerifiableBuildWrapper = class {
+  static {
+    __name(this, "VerifiableBuildWrapper");
+  }
+  resolveDigest;
+  imagesByTag = /* @__PURE__ */ new Map();
+  constructor(resolveDigest = resolveAmd64Digest) {
+    this.resolveDigest = resolveDigest;
+  }
+  resolveImage({ stellarVersion, rustVersion }) {
+    const tagRef = officialImageTagRef(stellarVersion, rustVersion);
+    const existing = this.imagesByTag.get(tagRef);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const resolved = this.resolveDigest(tagRef).then((digest) => ({
+      imageRef: `${OFFICIAL_IMAGE_REPO}@${digest}`,
+      bldimg: `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`,
+      tagRef
+    }));
+    this.imagesByTag.set(tagRef, resolved);
+    return resolved;
+  }
+  async run(args, versions, { cwd }, sourceDir) {
+    const buildDir = resolveBuildDir(cwd, sourceDir);
+    try {
+      if (!(await stat(buildDir)).isDirectory()) {
+        throw new Error("not a directory");
+      }
+    } catch (cause) {
+      throw new Error(`Verifiable build source directory is not an existing directory: ${buildDir}`, {
+        cause
+      });
+    }
+    if (sourceDir !== void 0) {
+      await chmod(buildDir, 511);
+    }
+    const { imageRef, bldimg, tagRef } = await this.resolveImage(versions);
+    const dockerArgs = buildVerifiableBuildDockerArgs({
+      imageRef,
+      sourceDir: buildDir,
+      buildArgs: args,
+      bldimg
+    });
+    console.info("\u{1F512} Verifiable build (official stellar/stellar-cli image, run from host)");
+    console.info(`   source: ${buildDir}`);
+    console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);
+    console.info(`   bldimg: ${bldimg}`);
+    console.info(`   docker ${dockerArgs.join(" ")}`);
+    await runDocker(dockerArgs);
+  }
+};
+var parsePackageSpec = /* @__PURE__ */ __name((spec) => {
+  const colon = spec.indexOf(":");
+  if (colon <= 0 || colon === spec.length - 1) {
+    throw new Error(`Invalid --package spec ${JSON.stringify(spec)}: expected <name>:<manifest-path>`);
+  }
+  return {
+    packageName: spec.slice(0, colon),
+    manifestPath: spec.slice(colon + 1)
+  };
+}, "parsePackageSpec");
+var wasmArtifactName = /* @__PURE__ */ __name((packageName) => `${packageName.replaceAll("-", "_")}.wasm`, "wasmArtifactName");
+var validatePackageSpecs = /* @__PURE__ */ __name((packages) => {
+  const artifactNames = /* @__PURE__ */ new Set();
+  for (const { packageName } of packages) {
+    const artifactName = wasmArtifactName(packageName);
+    if (artifactNames.has(artifactName)) {
+      throw new Error(`Duplicate WASM artifact ${artifactName} from --package options`);
+    }
+    artifactNames.add(artifactName);
+  }
+}, "validatePackageSpecs");
+var resolveRustVersion = /* @__PURE__ */ __name(async (sourceDir, rustVersionFlag) => {
+  if (rustVersionFlag !== void 0) {
+    return rustVersionFlag;
+  }
+  const toolchainPath = path.join(sourceDir, "rust-toolchain.toml");
+  let contents;
+  try {
+    contents = await readFile(toolchainPath, "utf-8");
+  } catch (cause) {
+    if (cause.code === "ENOENT") {
+      throw new Error(`Missing rust-toolchain.toml in ${sourceDir} and no --rust-version was provided`, {
+        cause
+      });
+    }
+    throw cause;
+  }
+  const parsed = parse(contents);
+  const channel = parsed.toolchain?.channel;
+  if (typeof channel !== "string" || channel.length === 0) {
+    throw new Error(`Missing 'toolchain.channel' in ${toolchainPath}`);
+  }
+  return channel;
+}, "resolveRustVersion");
+var buildArchiveContractArgs = /* @__PURE__ */ __name(({ packageName, manifestPath }, sourceSha256) => [
+  "--manifest-path",
+  manifestPath,
+  "--package",
+  packageName,
+  "--optimize",
+  "--meta",
+  `bldopt=--manifest-path=${manifestPath}`,
+  "--meta",
+  `bldopt=--package=${packageName}`,
+  "--meta",
+  "bldopt=--optimize",
+  "--meta",
+  `source_sha256=${sourceSha256}`
+], "buildArchiveContractArgs");
+var pathExists = /* @__PURE__ */ __name(async (filePath) => {
+  try {
+    await stat(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}, "pathExists");
+var readArchiveBytes = /* @__PURE__ */ __name(async (archive) => {
+  let bytes;
+  try {
+    bytes = new Uint8Array(await readFile(archive));
+  } catch (cause) {
+    throw new Error(`Archive not found or unreadable: ${archive}`, {
+      cause
+    });
+  }
+  if (bytes.length === 0) {
+    throw new Error(`Archive is empty: ${archive}`);
+  }
+  return bytes;
+}, "readArchiveBytes");
+var extractZip = /* @__PURE__ */ __name(async (bytes, destDir, expectedRootDirName) => {
+  const files = unzipSync(bytes);
+  const destRoot = path.resolve(destDir);
+  const expectedRoot = path.join(destRoot, expectedRootDirName);
+  const expectedRootPrefix = `${expectedRootDirName}/`;
+  for (const [relPath, content] of Object.entries(files)) {
+    const outPath = path.resolve(destRoot, relPath);
+    if (outPath !== destRoot && !outPath.startsWith(destRoot + path.sep)) {
+      throw new Error(`Zip entry escapes destination: ${relPath}`);
+    }
+    if (outPath !== expectedRoot && !outPath.startsWith(expectedRoot + path.sep)) {
+      throw new Error(`Zip entry is outside expected top-level ${expectedRootPrefix}: ${relPath}`);
+    }
+    if (relPath.endsWith("/")) continue;
+    await mkdir(path.dirname(outPath), {
+      recursive: true
+    });
+    await writeFile(outPath, content);
+  }
+}, "extractZip");
+var persistSourceArchive = /* @__PURE__ */ __name(async (archiveBytes, stagingDir) => {
+  await mkdir(stagingDir, {
+    recursive: true
+  });
+  await writeFile(path.join(stagingDir, SOURCE_ARCHIVE_NAME), archiveBytes);
+}, "persistSourceArchive");
+var copyFileWithPermissionRepair = /* @__PURE__ */ __name(async (source, destination, repairPermissions, copy = copyFile) => {
+  try {
+    await copy(source, destination);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EACCES" && code !== "EPERM") {
+      throw error;
+    }
+    await repairPermissions();
+    await copy(source, destination);
+  }
+}, "copyFileWithPermissionRepair");
+var persistWasm = /* @__PURE__ */ __name(async (buildRoot, stagingDir, { packageName }, repairPermissions) => {
+  const wasmName = wasmArtifactName(packageName);
+  const builtPath = path.join(buildRoot, WASM_TARGET_DIR, wasmName);
+  if (!await pathExists(builtPath)) {
+    throw new Error(`Expected WASM not found after build: ${builtPath}`);
+  }
+  await mkdir(stagingDir, {
+    recursive: true
+  });
+  await copyFileWithPermissionRepair(builtPath, path.join(stagingDir, wasmName), repairPermissions);
+}, "persistWasm");
+var publishArtifacts = /* @__PURE__ */ __name(async (stagingDir, outputDir) => {
+  const parentDir = path.dirname(outputDir);
+  const outputBase = path.basename(outputDir);
+  await mkdir(parentDir, {
+    recursive: true
+  });
+  const nextDir = await mkdtemp(path.join(parentDir, `${outputBase}.next-`));
+  const backupDir = path.join(parentDir, `${outputBase}.prev`);
+  const entries = await readdir(stagingDir);
+  try {
+    for (const entry of entries) {
+      await copyFile(path.join(stagingDir, entry), path.join(nextDir, entry));
+    }
+    if (!await pathExists(outputDir) && await pathExists(backupDir)) {
+      await rename(backupDir, outputDir);
+    } else if (await pathExists(backupDir)) {
+      await rm(backupDir, {
+        recursive: true,
+        force: true
+      });
+    }
+    if (await pathExists(outputDir)) {
+      await rename(outputDir, backupDir);
+    }
+    await rename(nextDir, outputDir);
+    await rm(backupDir, {
+      recursive: true,
+      force: true
+    }).catch((error) => {
+      console.warn(`Failed to remove leftover ${backupDir} after publish:`, error);
+    });
+  } catch (error) {
+    await rm(nextDir, {
+      recursive: true,
+      force: true
+    }).catch(() => void 0);
+    if (!await pathExists(outputDir) && await pathExists(backupDir)) {
+      await rename(backupDir, outputDir).catch(() => void 0);
+    }
+    throw error;
+  }
+}, "publishArtifacts");
+var buildPermissionRepairDockerArgs = /* @__PURE__ */ __name((dir, imageRef) => [
+  "run",
+  "--rm",
+  "--platform",
+  VERIFIABLE_BUILD_PLATFORM,
+  "--user",
+  "0:0",
+  "--entrypoint",
+  "chmod",
+  "-v",
+  `${dir}:/cleanup`,
+  imageRef,
+  "-R",
+  "a+rwX",
+  "/cleanup"
+], "buildPermissionRepairDockerArgs");
+var relaxDockerOwnedPermissions = /* @__PURE__ */ __name((dir, imageRef) => new Promise((resolve, reject) => {
+  const child = spawn("docker", buildPermissionRepairDockerArgs(dir, imageRef), {
+    stdio: "inherit"
+  });
+  child.on("error", reject);
+  child.on("close", (code) => {
+    if (code === 0) {
+      resolve();
+    } else {
+      reject(new Error(`Failed to chmod temp dir via docker (exit ${code ?? 1})`));
+    }
+  });
+}), "relaxDockerOwnedPermissions");
+var removeTempDir = /* @__PURE__ */ __name(async (tempDir, resolveImage) => {
+  try {
+    await rm(tempDir, {
+      recursive: true,
+      force: true
+    });
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EACCES" && code !== "EPERM") {
+      throw error;
+    }
+    if (resolveImage === void 0) {
+      throw error;
+    }
+    const { imageRef } = await resolveImage();
+    await relaxDockerOwnedPermissions(tempDir, imageRef);
+    await rm(tempDir, {
+      recursive: true,
+      force: true
+    });
+  }
+}, "removeTempDir");
+var runVerifiableBuildFromArchive = /* @__PURE__ */ __name(async ({ archive, packages, outputDir, stellarVersion, rustVersion }, { cwd }) => {
+  if (packages.length === 0) {
+    throw new Error("verifiable-build requires at least one --package <name>:<manifest-path>");
+  }
+  validatePackageSpecs(packages);
+  const archiveBytes = await readArchiveBytes(archive);
+  const sourceSha256 = createHash("sha256").update(archiveBytes).digest("hex");
+  const tempDir = await mkdtemp(path.join(tmpdir(), "stellar-verifiable-build-"));
+  const extractionDir = path.join(tempDir, "source");
+  const stagingDir = path.join(tempDir, "staging");
+  let versions;
+  const wrapper = new VerifiableBuildWrapper();
+  try {
+    const rootDirName = path.basename(cwd);
+    await extractZip(archiveBytes, extractionDir, rootDirName);
+    const buildRoot = path.join(extractionDir, rootDirName);
+    if (!await pathExists(buildRoot) || !(await stat(buildRoot)).isDirectory()) {
+      throw new Error(`Expected top-level ${rootDirName}/ directory not found after extraction`);
+    }
+    versions = {
+      stellarVersion,
+      rustVersion: await resolveRustVersion(buildRoot, rustVersion)
+    };
+    await persistSourceArchive(archiveBytes, stagingDir);
+    for (const packageSpec of packages) {
+      await wrapper.run(buildArchiveContractArgs(packageSpec, sourceSha256), versions, {
+        cwd
+      }, buildRoot);
+      await persistWasm(buildRoot, stagingDir, packageSpec, async () => {
+        const { imageRef } = await wrapper.resolveImage(versions);
+        await relaxDockerOwnedPermissions(buildRoot, imageRef);
+      });
+    }
+    await publishArtifacts(stagingDir, outputDir);
+  } finally {
+    await removeTempDir(tempDir, versions === void 0 ? void 0 : () => wrapper.resolveImage(versions)).catch((error) => {
+      console.warn(`Temp dir cleanup failed (build result unchanged): ${tempDir}`, error);
+    });
+  }
+}, "runVerifiableBuildFromArchive");
+
+export { VerifiableBuildWrapper, buildArchiveContractArgs, buildPermissionRepairDockerArgs, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, copyFileWithPermissionRepair, officialImageTagRef, parseAmd64Digest, parsePackageSpec, resolveBuildDir, resolveRustVersion, runVerifiableBuildFromArchive, wasmArtifactName };
+//# sourceMappingURL=D25LP26W.js.map
+//# sourceMappingURL=D25LP26W.js.map

package/dist/D25LP26W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/verifiable-build.ts"],"names":["execFileAsync","promisify","execFile","SOURCE_ARCHIVE_NAME","WASM_TARGET_DIR","path","join","SOURCE_MOUNT","VERIFIABLE_BUILD_PLATFORM","OFFICIAL_IMAGE_REPO","META_FLAG","officialImageTagRef","stellarVersion","rustVersion","parseAmd64Digest","manifestInspectJson","manifests","JSON","parse","Array","isArray","Error","digest","find","platform","os","architecture","startsWith","resolveAmd64Digest","imageTagRef","stdout","maxBuffer","timeout","cause","metaKey","entry","eq","indexOf","slice","canonicalizeMetaArgs","buildArgs","injectedMeta","reservedKeys","Set","map","metas","passthrough","addCallerMeta","value","has","push","i","length","arg","undefined","sort","flatMap","meta","buildVerifiableBuildDockerArgs","imageRef","sourceDir","bldimg","resolveBuildDir","cwd","resolve","runDocker","dockerArgs","Promise","reject","child","spawn","stdio","on","error","code","signal","VerifiableBuildWrapper","imagesByTag","Map","resolveDigest","resolveImage","tagRef","existing","get","resolved","then","set","run","args","versions","buildDir","stat","isDirectory","chmod","console","info","parsePackageSpec","spec","colon","stringify","packageName","manifestPath","wasmArtifactName","replaceAll","validatePackageSpecs","packages","artifactNames","artifactName","add","resolveRustVersion","rustVersionFlag","toolchainPath","contents","readFile","parsed","channel","toolchain","buildArchiveContractArgs","sourceSha256","pathExists","filePath","readArchiveBytes","archive","bytes","Uint8Array","extractZip","destDir","expectedRootDirName","files","unzipSync","destRoot","expectedRoot","expectedRootPrefix","relPath","content","Object","entries","outPath","sep","endsWith","mkdir","dirname","recursive","writeFile","persistSourceArchive","archiveBytes","stagingDir","copyFileWithPermissionRepair","source","destination","repairPermissions","copy","copyFile","persistWasm","buildRoot","wasmName","builtPath","publishArtifacts","outputDir","parentDir","outputBase","basename","nextDir","mkdtemp","backupDir","readdir","rename","rm","force","catch","warn","buildPermissionRepairDockerArgs","dir","relaxDockerOwnedPermissions","removeTempDir","tempDir","runVerifiableBuildFromArchive","createHash","update","tmpdir","extractionDir","wrapper","rootDirName","packageSpec"],"mappings":";;;;;;;;;;AAsBA,IAAMA,aAAAA,GAAgBC,UAAUC,QAAAA,CAAAA;AAEhC,IAAMC,mBAAAA,GAAsB,sBAAA;AAC5B,IAAMC,eAAAA,GAAkBC,IAAAA,CAAKC,IAAAA,CAAK,QAAA,EAAU,iBAAiB,SAAA,CAAA;AAI7D,IAAMC,YAAAA,GAAe,SAAA;AAIrB,IAAMC,yBAAAA,GAA4B,aAAA;AAElC,IAAMC,mBAAAA,GAAsB,qBAAA;AAE5B,IAAMC,SAAAA,GAAY,QAAA;AA8CX,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,cAAAA,EAAwBC,WAAAA,KACxD,CAAA,EAAGJ,mBAAAA,CAAAA,CAAAA,EAAuBG,cAAAA,CAAAA,KAAAA,EAAsBC,WAAAA,CAAAA,cAAAA,CAAAA,EADjB,qBAAA;AAO5B,IAAMC,gBAAAA,2BAAoBC,mBAAAA,KAAAA;AAC7B,EAAA,MAAM,EAAEC,SAAAA,EAAS,GAAKC,IAAAA,CAAKC,MAAMH,mBAAAA,CAAAA;AAEjC,EAAA,IAAI,CAACI,KAAAA,CAAMC,OAAAA,CAAQJ,SAAAA,CAAAA,EAAY;AAC3B,IAAA,MAAM,IAAIK,MACN,oFAAA,CAAA;AAER,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,SAAAA,CAAUO,IAAAA,CACrB,CAAC,EAAEC,QAAAA,EAAQ,KAAOA,QAAAA,EAAUC,EAAAA,KAAO,OAAA,IAAWD,QAAAA,EAAUE,YAAAA,KAAiB,OAAA,CAAA,EAC1EJ,MAAAA;AAEH,EAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,CAACA,MAAAA,CAAOK,UAAAA,CAAW,SAAA,CAAA,EAAY;AAC7D,IAAA,MAAM,IAAIN,MAAM,0EAAA,CAAA;AACpB,EAAA;AAEA,EAAA,OAAOC,MAAAA;AACX,CAAA,EAlBgC,kBAAA;AAyBhC,IAAMM,kBAAAA,iCAA4BC,WAAAA,KAAAA;AAC9B,EAAA,IAAI;AACA,IAAA,MAAM,EAAEC,MAAAA,EAAM,GAAK,MAAM9B,cAAc,QAAA,EAAU;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW6B,MAAAA;AAAc,KAAA,EAAA;AACnFE,MAAAA,SAAAA,EAAW,KAAK,IAAA,GAAO,IAAA;MACvBC,OAAAA,EAAS;KACb,CAAA;AACA,IAAA,OAAOlB,iBAAiBgB,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIZ,KAAAA,CACN,CAAA,4CAAA,EAA+CQ,WAAAA,CAAAA,8BAAAA,CAAAA,EAC/C;AAAEI,MAAAA;KAAM,CAAA;AAEhB,EAAA;AACJ,CAAA,EAb2B,oBAAA,CAAA;AAgB3B,IAAMC,OAAAA,2BAAWC,KAAAA,KAAAA;AACb,EAAA,MAAMC,EAAAA,GAAKD,KAAAA,CAAME,OAAAA,CAAQ,GAAA,CAAA;AACzB,EAAA,OAAOD,OAAO,EAAA,GAAKD,KAAAA,GAAQA,KAAAA,CAAMG,KAAAA,CAAM,GAAGF,EAAAA,CAAAA;AAC9C,CAAA,EAHgB,SAAA,CAAA;AAeT,IAAMG,oBAAAA,mBAAuB,MAAA,CAAA,CAACC,SAAAA,EAAqBC,YAAAA,KAAAA;AACtD,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIF,YAAAA,CAAaG,GAAAA,CAAIV,OAAAA,CAAAA,CAAAA;AAC9C,EAAA,MAAMW,KAAAA,GAAQ;AAAIJ,IAAAA,GAAAA;;AAClB,EAAA,MAAMK,cAAwB,EAAA;AAE9B,EAAA,MAAMC,aAAAA,2BAAiBC,KAAAA,KAAAA;AACnB,IAAA,IAAI,CAACN,aAAaO,GAAAA,CAAIf,OAAAA,CAAQc,KAAAA,CAAAA,CAAAA,EAASH,KAAAA,CAAMK,IAAAA,CAAKF,KAAAA,CAAAA;EACtD,CAAA,EAFsB,eAAA,CAAA;AAItB,EAAA,KAAA,IAASG,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIX,SAAAA,CAAUY,QAAQD,CAAAA,EAAAA,EAAK;AACvC,IAAA,MAAME,GAAAA,GAAMb,UAAUW,CAAAA,CAAAA;AACtB,IAAA,IAAIE,QAAQC,MAAAA,EAAW;AACvB,IAAA,IAAID,QAAQ3C,SAAAA,EAAW;AACnB,MAAA,MAAMsC,KAAAA,GAAQR,SAAAA,CAAUW,CAAAA,GAAI,CAAA,CAAA;AAC5B,MAAA,IAAIH,UAAUM,MAAAA,IAAa,CAACN,KAAAA,CAAMrB,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChDoB,QAAAA,aAAAA,CAAcC,KAAAA,CAAAA;AACdG,QAAAA,CAAAA,IAAK,CAAA;AACT,MAAA;AACJ,IAAA,CAAA,MAAA,IAAWE,GAAAA,CAAI1B,UAAAA,CAAW,CAAA,EAAGjB,SAAAA,GAAY,CAAA,EAAG;AACxCqC,MAAAA,aAAAA,CAAcM,GAAAA,CAAIf,KAAAA,CAAM5B,SAAAA,CAAU0C,MAAAA,GAAS,CAAA,CAAA,CAAA;IAC/C,CAAA,MAAO;AACHN,MAAAA,WAAAA,CAAYI,KAAKG,GAAAA,CAAAA;AACrB,IAAA;AACJ,EAAA;AAEAR,EAAAA,KAAAA,CAAMU,IAAAA,EAAI;AACV,EAAA,OAAO;AAAIT,IAAAA,GAAAA,WAAAA;OAAgBD,KAAAA,CAAMW,OAAAA,CAAQ,CAACC,IAAAA,KAAS;AAAC/C,MAAAA,SAAAA;AAAW+C,MAAAA;AAAK,KAAA;;AACxE,CAAA,EA3BoC,sBAAA;AAiC7B,IAAMC,iDAAiC,MAAA,CAAA,CAAC,EAC3CC,UACAC,SAAAA,EACApB,SAAAA,EACAqB,QAAM,KAMM;AACZ,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACArD,EAAAA,yBAAAA;AACA,EAAA,IAAA;EACA,CAAA,EAAGoD,SAAAA,IAAarD,YAAAA,CAAAA,CAAAA;AAChB,EAAA,IAAA;AACAA,EAAAA,YAAAA;AACAoD,EAAAA,QAAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;AACGpB,EAAAA,GAAAA,oBAAAA,CAAqBC,SAAAA,EAAW;AAAC,IAAA,CAAA,OAAA,EAAUqB,MAAAA,CAAAA;AAAS,GAAA;AAtBb,CAAA,EAAA,gCAAA;AA6BvC,IAAMC,eAAAA,2BAAmBC,GAAAA,EAAaH,SAAAA,KACzCvD,KAAK2D,OAAAA,CAAQD,GAAAA,EAAKH,SAAAA,IAAa,GAAA,CAAA,EADJ,iBAAA;AAG/B,IAAMK,4BAAY,MAAA,CAAA,CAACC,UAAAA,KACf,IAAIC,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,KAAAA,GAAQC,KAAAA,CAAM,QAAA,EAAUJ,UAAAA,EAAY;IAAEK,KAAAA,EAAO;GAAU,CAAA;AAC7DF,EAAAA,KAAAA,CAAMG,GAAG,OAAA,EAAS,CAACC,UACfL,MAAAA,CAAO,IAAI/C,MAAM,iDAAA,EAAmD;IAAEY,KAAAA,EAAOwC;AAAM,GAAA,CAAA,CAAA,CAAA;AAEvFJ,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,EAAMC,MAAAA,KAAAA;AACrB,IAAA,IAAID,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CACI,IAAI/C,KAAAA,CACA,CAAA,4CAAA,EACIsD,MAAAA,GAAS,CAAA,OAAA,EAAUA,MAAAA,CAAAA,CAAAA,GAAW,CAAA,KAAA,EAAQD,IAAAA,CAAAA,CAAM,CAAA,CAC9C,CAAA,CAAA;AAGd,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAnBc,WAAA,CAAA;AAyBX,IAAME,yBAAN,MAAMA;EA5Ob;;;;AA6OqBC,EAAAA,WAAAA,uBAAkBC,GAAAA,EAAAA;AAEnC,EAAA,WAAA,CACqBC,gBAEMnD,kBAAAA,EACzB;SAHmBmD,aAAAA,GAAAA,aAAAA;AAGlB,EAAA;EAEIC,YAAAA,CAAa,EAChBpE,cAAAA,EACAC,WAAAA,EAAW,EACoD;AAC/D,IAAA,MAAMoE,MAAAA,GAAStE,mBAAAA,CAAoBC,cAAAA,EAAgBC,WAAAA,CAAAA;AACnD,IAAA,MAAMqE,QAAAA,GAAW,IAAA,CAAKL,WAAAA,CAAYM,GAAAA,CAAIF,MAAAA,CAAAA;AACtC,IAAA,IAAIC,aAAa5B,MAAAA,EAAW;AACxB,MAAA,OAAO4B,QAAAA;AACX,IAAA;AAEA,IAAA,MAAME,WAAW,IAAA,CAAKL,aAAAA,CAAcE,MAAAA,CAAAA,CAAQI,IAAAA,CAAK,CAAC/D,MAAAA,MAAY;MAC1DqC,QAAAA,EAAU,CAAA,EAAGlD,mBAAAA,CAAAA,CAAAA,EAAuBa,MAAAA,CAAAA,CAAAA;MACpCuC,MAAAA,EAAQ,CAAA,UAAA,EAAapD,mBAAAA,CAAAA,CAAAA,EAAuBa,MAAAA,CAAAA,CAAAA;AAC5C2D,MAAAA;KACJ,CAAA,CAAA;AACA,IAAA,IAAA,CAAKJ,WAAAA,CAAYS,GAAAA,CAAIL,MAAAA,EAAQG,QAAAA,CAAAA;AAC7B,IAAA,OAAOA,QAAAA;AACX,EAAA;AAEA,EAAA,MAAaG,IACTC,IAAAA,EACAC,QAAAA,EACA,EAAE1B,GAAAA,IACFH,SAAAA,EACa;AACb,IAAA,MAAM8B,QAAAA,GAAW5B,eAAAA,CAAgBC,GAAAA,EAAKH,SAAAA,CAAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,EAAE,MAAM+B,IAAAA,CAAKD,QAAAA,CAAAA,EAAWE,aAAW,EAAI;AACvC,QAAA,MAAM,IAAIvE,MAAM,iBAAA,CAAA;AACpB,MAAA;AACJ,IAAA,CAAA,CAAA,OAASY,KAAAA,EAAO;AACZ,MAAA,MAAM,IAAIZ,KAAAA,CACN,CAAA,gEAAA,EAAmEqE,QAAAA,CAAAA,CAAAA,EACnE;AAAEzD,QAAAA;OAAM,CAAA;AAEhB,IAAA;AAMA,IAAA,IAAI2B,cAAcN,MAAAA,EAAW;AACzB,MAAA,MAAMuC,KAAAA,CAAMH,UAAU,GAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,MAAM,EAAE/B,UAAUE,MAAAA,EAAQoB,MAAAA,KAAW,MAAM,IAAA,CAAKD,aAAaS,QAAAA,CAAAA;AAE7D,IAAA,MAAMvB,aAAaR,8BAAAA,CAA+B;AAC9CC,MAAAA,QAAAA;MACAC,SAAAA,EAAW8B,QAAAA;MACXlD,SAAAA,EAAWgD,IAAAA;AACX3B,MAAAA;KACJ,CAAA;AAEAiC,IAAAA,OAAAA,CAAQC,KAAK,gFAAA,CAAA;AACbD,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAcL,QAAAA,CAAAA,CAAU,CAAA;AACrCI,IAAAA,OAAAA,CAAQC,KAAK,CAAA,WAAA,EAAcpC,QAAAA,KAAanD,yBAAAA,CAAAA,WAAAA,EAAuCyE,MAAAA,CAAAA,CAAAA,CAAS,CAAA;AACxFa,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAclC,MAAAA,CAAAA,CAAQ,CAAA;AACnCiC,IAAAA,OAAAA,CAAQC,KAAK,CAAA,UAAA,EAAa7B,UAAAA,CAAW5D,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAM,CAAA;AAEhD,IAAA,MAAM2D,UAAUC,UAAAA,CAAAA;AACpB,EAAA;AACJ;AAKO,IAAM8B,gBAAAA,2BAAoBC,IAAAA,KAAAA;AAC7B,EAAA,MAAMC,KAAAA,GAAQD,IAAAA,CAAK5D,OAAAA,CAAQ,GAAA,CAAA;AAC3B,EAAA,IAAI6D,KAAAA,IAAS,CAAA,IAAKA,KAAAA,KAAUD,IAAAA,CAAK7C,SAAS,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI/B,KAAAA,CACN,CAAA,uBAAA,EAA0BJ,KAAKkF,SAAAA,CAAUF,IAAAA,CAAAA,CAAAA,iCAAAA,CAAwC,CAAA;AAEzF,EAAA;AAEA,EAAA,OAAO;IACHG,WAAAA,EAAaH,IAAAA,CAAK3D,KAAAA,CAAM,CAAA,EAAG4D,KAAAA,CAAAA;IAC3BG,YAAAA,EAAcJ,IAAAA,CAAK3D,KAAAA,CAAM4D,KAAAA,GAAQ,CAAA;AACrC,GAAA;AACJ,CAAA,EAZgC,kBAAA;AAezB,IAAMI,gBAAAA,2BAAoBF,WAAAA,KAC7B,CAAA,EAAGA,YAAYG,UAAAA,CAAW,GAAA,EAAK,GAAA,CAAA,CAAA,KAAA,CAAA,EADH,kBAAA;AAGhC,IAAMC,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAC1B,EAAA,MAAMC,aAAAA,uBAAoB/D,GAAAA,EAAAA;AAC1B,EAAA,KAAA,MAAW,EAAEyD,WAAAA,EAAW,IAAMK,QAAAA,EAAU;AACpC,IAAA,MAAME,YAAAA,GAAeL,iBAAiBF,WAAAA,CAAAA;AACtC,IAAA,IAAIM,aAAAA,CAAczD,GAAAA,CAAI0D,YAAAA,CAAAA,EAAe;AACjC,MAAA,MAAM,IAAItF,KAAAA,CAAM,CAAA,wBAAA,EAA2BsF,YAAAA,CAAAA,uBAAAA,CAAqC,CAAA;AACpF,IAAA;AACAD,IAAAA,aAAAA,CAAcE,IAAID,YAAAA,CAAAA;AACtB,EAAA;AACJ,CAAA,EAT6B,sBAAA,CAAA;AAetB,IAAME,kBAAAA,mBAAqB,MAAA,CAAA,OAC9BjD,SAAAA,EACAkD,eAAAA,KAAAA;AAEA,EAAA,IAAIA,oBAAoBxD,MAAAA,EAAW;AAC/B,IAAA,OAAOwD,eAAAA;AACX,EAAA;AAEA,EAAA,MAAMC,aAAAA,GAAgB1G,IAAAA,CAAKC,IAAAA,CAAKsD,SAAAA,EAAW,qBAAA,CAAA;AAC3C,EAAA,IAAIoD,QAAAA;AACJ,EAAA,IAAI;AACAA,IAAAA,QAAAA,GAAW,MAAMC,QAAAA,CAASF,aAAAA,EAAe,OAAA,CAAA;AAC7C,EAAA,CAAA,CAAA,OAAS9E,KAAAA,EAAO;AACZ,IAAA,IAAKA,KAAAA,CAA4ByC,SAAS,QAAA,EAAU;AAChD,MAAA,MAAM,IAAIrD,KAAAA,CACN,CAAA,+BAAA,EAAkCuC,SAAAA,CAAAA,mCAAAA,CAAAA,EAClC;AAAE3B,QAAAA;OAAM,CAAA;AAEhB,IAAA;AACA,IAAA,MAAMA,KAAAA;AACV,EAAA;AAEA,EAAA,MAAMiF,MAAAA,GAAShG,MAAM8F,QAAAA,CAAAA;AACrB,EAAA,MAAMG,OAAAA,GAAUD,OAAOE,SAAAA,EAAWD,OAAAA;AAClC,EAAA,IAAI,OAAOA,OAAAA,KAAY,QAAA,IAAYA,OAAAA,CAAQ/D,WAAW,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI/B,KAAAA,CAAM,CAAA,+BAAA,EAAkC0F,aAAAA,CAAAA,CAAe,CAAA;AACrE,EAAA;AAEA,EAAA,OAAOI,OAAAA;AACX,CAAA,EA7BkC,oBAAA;AAoC3B,IAAME,2CAA2B,MAAA,CAAA,CACpC,EAAEjB,WAAAA,EAAaC,YAAAA,IACfiB,YAAAA,KACW;AACX,EAAA,iBAAA;AACAjB,EAAAA,YAAAA;AACA,EAAA,WAAA;AACAD,EAAAA,WAAAA;AACA,EAAA,YAAA;AACA,EAAA,QAAA;AACA,EAAA,CAAA,uBAAA,EAA0BC,YAAAA,CAAAA,CAAAA;AAC1B,EAAA,QAAA;AACA,EAAA,CAAA,iBAAA,EAAoBD,WAAAA,CAAAA,CAAAA;AACpB,EAAA,QAAA;AACA,EAAA,mBAAA;AACA,EAAA,QAAA;AACA,EAAA,CAAA,cAAA,EAAiBkB,YAAAA,CAAAA;AAhBmB,CAAA,EAAA,0BAAA;AAmBxC,IAAMC,UAAAA,iCAAoBC,QAAAA,KAAAA;AACtB,EAAA,IAAI;AACA,IAAA,MAAM7B,KAAK6B,QAAAA,CAAAA;AACX,IAAA,OAAO,IAAA;AACX,EAAA,CAAA,CAAA,OAAS/C,KAAAA,EAAO;AACZ,IAAA,IAAKA,KAAAA,CAA4BC,SAAS,QAAA,EAAU;AAChD,MAAA,OAAO,KAAA;AACX,IAAA;AACA,IAAA,MAAMD,KAAAA;AACV,EAAA;AACJ,CAAA,EAVmB,YAAA,CAAA;AAYnB,IAAMgD,gBAAAA,iCAA0BC,OAAAA,KAAAA;AAC5B,EAAA,IAAIC,KAAAA;AACJ,EAAA,IAAI;AACAA,IAAAA,KAAAA,GAAQ,IAAIC,UAAAA,CAAW,MAAMX,QAAAA,CAASS,OAAAA,CAAAA,CAAAA;AAC1C,EAAA,CAAA,CAAA,OAASzF,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIZ,KAAAA,CAAM,CAAA,iCAAA,EAAoCqG,OAAAA,CAAAA,CAAAA,EAAW;AAAEzF,MAAAA;KAAM,CAAA;AAC3E,EAAA;AAEA,EAAA,IAAI0F,KAAAA,CAAMvE,WAAW,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI/B,KAAAA,CAAM,CAAA,kBAAA,EAAqBqG,OAAAA,CAAAA,CAAS,CAAA;AAClD,EAAA;AAEA,EAAA,OAAOC,KAAAA;AACX,CAAA,EAbyB,kBAAA,CAAA;AAezB,IAAME,UAAAA,mBAAa,MAAA,CAAA,OACfF,KAAAA,EACAG,OAAAA,EACAC,mBAAAA,KAAAA;AAEA,EAAA,MAAMC,KAAAA,GAAQC,UAAUN,KAAAA,CAAAA;AACxB,EAAA,MAAMO,QAAAA,GAAW7H,IAAAA,CAAK2D,OAAAA,CAAQ8D,OAAAA,CAAAA;AAC9B,EAAA,MAAMK,YAAAA,GAAe9H,IAAAA,CAAKC,IAAAA,CAAK4H,QAAAA,EAAUH,mBAAAA,CAAAA;AACzC,EAAA,MAAMK,kBAAAA,GAAqB,GAAGL,mBAAAA,CAAAA,CAAAA,CAAAA;AAE9B,EAAA,KAAA,MAAW,CAACM,OAAAA,EAASC,OAAAA,KAAYC,MAAAA,CAAOC,OAAAA,CAAQR,KAAAA,CAAAA,EAAQ;AACpD,IAAA,MAAMS,OAAAA,GAAUpI,IAAAA,CAAK2D,OAAAA,CAAQkE,QAAAA,EAAUG,OAAAA,CAAAA;AACvC,IAAA,IAAII,OAAAA,KAAYP,YAAY,CAACO,OAAAA,CAAQ9G,WAAWuG,QAAAA,GAAW7H,IAAAA,CAAKqI,GAAG,CAAA,EAAG;AAClE,MAAA,MAAM,IAAIrH,KAAAA,CAAM,CAAA,+BAAA,EAAkCgH,OAAAA,CAAAA,CAAS,CAAA;AAC/D,IAAA;AACA,IAAA,IAAII,OAAAA,KAAYN,gBAAgB,CAACM,OAAAA,CAAQ9G,WAAWwG,YAAAA,GAAe9H,IAAAA,CAAKqI,GAAG,CAAA,EAAG;AAC1E,MAAA,MAAM,IAAIrH,KAAAA,CACN,CAAA,wCAAA,EAA2C+G,kBAAAA,CAAAA,EAAAA,EAAuBC,OAAAA,CAAAA,CAAS,CAAA;AAEnF,IAAA;AACA,IAAA,IAAIA,OAAAA,CAAQM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAE3B,IAAA,MAAMC,KAAAA,CAAMvI,IAAAA,CAAKwI,OAAAA,CAAQJ,OAAAA,CAAAA,EAAU;MAAEK,SAAAA,EAAW;KAAK,CAAA;AACrD,IAAA,MAAMC,SAAAA,CAAUN,SAASH,OAAAA,CAAAA;AAC7B,EAAA;AACJ,CAAA,EAzBmB,YAAA,CAAA;AA2BnB,IAAMU,oBAAAA,mBAAuB,MAAA,CAAA,OACzBC,YAAAA,EACAC,UAAAA,KAAAA;AAEA,EAAA,MAAMN,MAAMM,UAAAA,EAAY;IAAEJ,SAAAA,EAAW;GAAK,CAAA;AAC1C,EAAA,MAAMC,UAAU1I,IAAAA,CAAKC,IAAAA,CAAK4I,UAAAA,EAAY/I,mBAAAA,GAAsB8I,YAAAA,CAAAA;AAChE,CAAA,EAN6B,sBAAA,CAAA;AAQtB,IAAME,+CAA+B,MAAA,CAAA,OACxCC,MAAAA,EACAC,WAAAA,EACAC,iBAAAA,EACAC,OAA+DC,QAAAA,KAAQ;AAEvE,EAAA,IAAI;AACA,IAAA,MAAMD,IAAAA,CAAKH,QAAQC,WAAAA,CAAAA;AACvB,EAAA,CAAA,CAAA,OAAS5E,KAAAA,EAAO;AACZ,IAAA,MAAMC,OAAQD,KAAAA,CAA4BC,IAAAA;AAC1C,IAAA,IAAIA,IAAAA,KAAS,QAAA,IAAYA,IAAAA,KAAS,OAAA,EAAS;AACvC,MAAA,MAAMD,KAAAA;AACV,IAAA;AAEA,IAAA,MAAM6E,iBAAAA,EAAAA;AACN,IAAA,MAAMC,IAAAA,CAAKH,QAAQC,WAAAA,CAAAA;AACvB,EAAA;AACJ,CAAA,EAjB4C,8BAAA;AAmB5C,IAAMI,8BAAc,MAAA,CAAA,OAChBC,SAAAA,EACAR,YACA,EAAE9C,WAAAA,IACFkD,iBAAAA,KAAAA;AAEA,EAAA,MAAMK,QAAAA,GAAWrD,iBAAiBF,WAAAA,CAAAA;AAClC,EAAA,MAAMwD,SAAAA,GAAYvJ,IAAAA,CAAKC,IAAAA,CAAKoJ,SAAAA,EAAWtJ,iBAAiBuJ,QAAAA,CAAAA;AACxD,EAAA,IAAI,CAAE,MAAMpC,UAAAA,CAAWqC,SAAAA,CAAAA,EAAa;AAChC,IAAA,MAAM,IAAIvI,KAAAA,CAAM,CAAA,qCAAA,EAAwCuI,SAAAA,CAAAA,CAAW,CAAA;AACvE,EAAA;AAEA,EAAA,MAAMhB,MAAMM,UAAAA,EAAY;IAAEJ,SAAAA,EAAW;GAAK,CAAA;AAC1C,EAAA,MAAMK,6BACFS,SAAAA,EACAvJ,IAAAA,CAAKC,KAAK4I,UAAAA,EAAYS,QAAAA,GACtBL,iBAAAA,CAAAA;AAER,CAAA,EAlBoB,aAAA,CAAA;AAwBpB,IAAMO,gBAAAA,mBAAmB,MAAA,CAAA,OAAOX,UAAAA,EAAoBY,SAAAA,KAAAA;AAChD,EAAA,MAAMC,SAAAA,GAAY1J,IAAAA,CAAKwI,OAAAA,CAAQiB,SAAAA,CAAAA;AAC/B,EAAA,MAAME,UAAAA,GAAa3J,IAAAA,CAAK4J,QAAAA,CAASH,SAAAA,CAAAA;AACjC,EAAA,MAAMlB,MAAMmB,SAAAA,EAAW;IAAEjB,SAAAA,EAAW;GAAK,CAAA;AAEzC,EAAA,MAAMoB,OAAAA,GAAU,MAAMC,OAAAA,CAAQ9J,IAAAA,CAAKC,KAAKyJ,SAAAA,EAAW,CAAA,EAAGC,UAAAA,CAAAA,MAAAA,CAAkB,CAAA,CAAA;AACxE,EAAA,MAAMI,YAAY/J,IAAAA,CAAKC,IAAAA,CAAKyJ,SAAAA,EAAW,CAAA,EAAGC,UAAAA,CAAAA,KAAAA,CAAiB,CAAA;AAC3D,EAAA,MAAMxB,OAAAA,GAAU,MAAM6B,OAAAA,CAAQnB,UAAAA,CAAAA;AAE9B,EAAA,IAAI;AACA,IAAA,KAAA,MAAW/G,SAASqG,OAAAA,EAAS;AACzB,MAAA,MAAMgB,QAAAA,CAASnJ,IAAAA,CAAKC,IAAAA,CAAK4I,UAAAA,EAAY/G,KAAAA,GAAQ9B,IAAAA,CAAKC,IAAAA,CAAK4J,OAAAA,EAAS/H,KAAAA,CAAAA,CAAAA;AACpE,IAAA;AAEA,IAAA,IAAI,CAAE,MAAMoF,UAAAA,CAAWuC,SAAAA,KAAgB,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAa;AACjE,MAAA,MAAME,MAAAA,CAAOF,WAAWN,SAAAA,CAAAA;IAC5B,CAAA,MAAA,IAAW,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAY;AACpC,MAAA,MAAMG,GAAGH,SAAAA,EAAW;QAAEtB,SAAAA,EAAW,IAAA;QAAM0B,KAAAA,EAAO;OAAK,CAAA;AACvD,IAAA;AAEA,IAAA,IAAI,MAAMjD,UAAAA,CAAWuC,SAAAA,CAAAA,EAAY;AAC7B,MAAA,MAAMQ,MAAAA,CAAOR,WAAWM,SAAAA,CAAAA;AAC5B,IAAA;AACA,IAAA,MAAME,MAAAA,CAAOJ,SAASJ,SAAAA,CAAAA;AACtB,IAAA,MAAMS,GAAGH,SAAAA,EAAW;MAAEtB,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA,CAAGC,KAAAA,CAAM,CAAChG,KAAAA,KAAAA;AACzDqB,MAAAA,OAAAA,CAAQ4E,IAAAA,CAAK,CAAA,0BAAA,EAA6BN,SAAAA,CAAAA,eAAAA,CAAAA,EAA4B3F,KAAAA,CAAAA;IAC1E,CAAA,CAAA;AACJ,EAAA,CAAA,CAAA,OAASA,KAAAA,EAAO;AACZ,IAAA,MAAM8F,GAAGL,OAAAA,EAAS;MAAEpB,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA,CAAGC,KAAAA,CAAM,MAAMnH,MAAAA,CAAAA;AAChE,IAAA,IAAI,CAAE,MAAMiE,UAAAA,CAAWuC,SAAAA,KAAgB,MAAMvC,UAAAA,CAAW6C,SAAAA,CAAAA,EAAa;AACjE,MAAA,MAAME,OAAOF,SAAAA,EAAWN,SAAAA,CAAAA,CAAWW,KAAAA,CAAM,MAAMnH,MAAAA,CAAAA;AACnD,IAAA;AACA,IAAA,MAAMmB,KAAAA;AACV,EAAA;AACJ,CAAA,EAlCyB,kBAAA,CAAA;AAoClB,IAAMkG,+BAAAA,mBAAkC,MAAA,CAAA,CAACC,GAAAA,EAAajH,QAAAA,KAA+B;AACxF,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACAnD,EAAAA,yBAAAA;AACA,EAAA,QAAA;AACA,EAAA,KAAA;AACA,EAAA,cAAA;AACA,EAAA,OAAA;AACA,EAAA,IAAA;AACA,EAAA,CAAA,EAAGoK,GAAAA,CAAAA,SAAAA,CAAAA;AACHjH,EAAAA,QAAAA;AACA,EAAA,IAAA;AACA,EAAA,OAAA;AACA,EAAA;AAd2C,CAAA,EAAA,iCAAA;AAiB/C,IAAMkH,2BAAAA,2BAA+BD,GAAAA,EAAajH,QAAAA,KAC9C,IAAIQ,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,QAAQC,KAAAA,CAAM,QAAA,EAAUqG,+BAAAA,CAAgCC,GAAAA,EAAKjH,QAAAA,CAAAA,EAAW;IAC1EY,KAAAA,EAAO;GACX,CAAA;AACAF,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,SAASJ,MAAAA,CAAAA;AAClBC,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,KAAAA;AACf,IAAA,IAAIA,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CAAO,IAAI/C,KAAAA,CAAM,CAAA,0CAAA,EAA6CqD,IAAAA,IAAQ,CAAA,GAAI,CAAA,CAAA;AAC9E,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAbgC,6BAAA,CAAA;AAepC,IAAMoG,aAAAA,mBAAgB,MAAA,CAAA,OAClBC,OAAAA,EACA/F,YAAAA,KAAAA;AAEA,EAAA,IAAI;AACA,IAAA,MAAMuF,GAAGQ,OAAAA,EAAS;MAAEjC,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA;AACrD,EAAA,CAAA,CAAA,OAAS/F,KAAAA,EAAO;AACZ,IAAA,MAAMC,OAAQD,KAAAA,CAA4BC,IAAAA;AAC1C,IAAA,IAAIA,IAAAA,KAAS,QAAA,IAAYA,IAAAA,KAAS,OAAA,EAAS;AACvC,MAAA,MAAMD,KAAAA;AACV,IAAA;AACA,IAAA,IAAIO,iBAAiB1B,MAAAA,EAAW;AAC5B,MAAA,MAAMmB,KAAAA;AACV,IAAA;AAEA,IAAA,MAAM,EAAEd,QAAAA,EAAQ,GAAK,MAAMqB,YAAAA,EAAAA;AAC3B,IAAA,MAAM6F,2BAAAA,CAA4BE,SAASpH,QAAAA,CAAAA;AAC3C,IAAA,MAAM4G,GAAGQ,OAAAA,EAAS;MAAEjC,SAAAA,EAAW,IAAA;MAAM0B,KAAAA,EAAO;KAAK,CAAA;AACrD,EAAA;AACJ,CAAA,EAnBsB,eAAA,CAAA;AA2Bf,IAAMQ,6BAAAA,mBAAgC,MAAA,CAAA,OACzC,EACItD,OAAAA,EACAjB,QAAAA,EACAqD,SAAAA,EACAlJ,cAAAA,EACAC,WAAAA,EAAW,EAEf,EAAEkD,GAAAA,EAAG,KAA4C;AAEjD,EAAA,IAAI0C,QAAAA,CAASrD,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI/B,MAAM,yEAAA,CAAA;AACpB,EAAA;AACAmF,EAAAA,oBAAAA,CAAqBC,QAAAA,CAAAA;AAErB,EAAA,MAAMwC,YAAAA,GAAe,MAAMxB,gBAAAA,CAAiBC,OAAAA,CAAAA;AAC5C,EAAA,MAAMJ,YAAAA,GAAe2D,WAAW,QAAA,CAAA,CAAUC,OAAOjC,YAAAA,CAAAA,CAAc3H,OAAO,KAAA,CAAA;AACtE,EAAA,MAAMyJ,OAAAA,GAAU,MAAMZ,OAAAA,CAAQ9J,IAAAA,CAAKC,KAAK6K,MAAAA,EAAAA,EAAU,2BAAA,CAAA,CAAA;AAClD,EAAA,MAAMC,aAAAA,GAAgB/K,IAAAA,CAAKC,IAAAA,CAAKyK,OAAAA,EAAS,QAAA,CAAA;AACzC,EAAA,MAAM7B,UAAAA,GAAa7I,IAAAA,CAAKC,IAAAA,CAAKyK,OAAAA,EAAS,SAAA,CAAA;AACtC,EAAA,IAAItF,QAAAA;AACJ,EAAA,MAAM4F,OAAAA,GAAU,IAAIzG,sBAAAA,EAAAA;AAEpB,EAAA,IAAI;AACA,IAAA,MAAM0G,WAAAA,GAAcjL,IAAAA,CAAK4J,QAAAA,CAASlG,GAAAA,CAAAA;AAClC,IAAA,MAAM8D,UAAAA,CAAWoB,YAAAA,EAAcmC,aAAAA,EAAeE,WAAAA,CAAAA;AAE9C,IAAA,MAAM5B,SAAAA,GAAYrJ,IAAAA,CAAKC,IAAAA,CAAK8K,aAAAA,EAAeE,WAAAA,CAAAA;AAC3C,IAAA,IAAI,CAAE,MAAM/D,UAAAA,CAAWmC,SAAAA,CAAAA,IAAe,CAAA,CAAE,MAAM/D,IAAAA,CAAK+D,SAAAA,CAAAA,EAAY9D,WAAAA,EAAW,EAAI;AAC1E,MAAA,MAAM,IAAIvE,KAAAA,CACN,CAAA,mBAAA,EAAsBiK,WAAAA,CAAAA,sCAAAA,CAAmD,CAAA;AAEjF,IAAA;AAEA7F,IAAAA,QAAAA,GAAW;AACP7E,MAAAA,cAAAA;MACAC,WAAAA,EAAa,MAAMgG,kBAAAA,CAAmB6C,SAAAA,EAAW7I,WAAAA;AACrD,KAAA;AACA,IAAA,MAAMmI,oBAAAA,CAAqBC,cAAcC,UAAAA,CAAAA;AAEzC,IAAA,KAAA,MAAWqC,eAAe9E,QAAAA,EAAU;AAChC,MAAA,MAAM4E,QAAQ9F,GAAAA,CACV8B,wBAAAA,CAAyBkE,WAAAA,EAAajE,YAAAA,GACtC7B,QAAAA,EACA;AAAE1B,QAAAA;AAAI,OAAA,EACN2F,SAAAA,CAAAA;AAEJ,MAAA,MAAMD,WAAAA,CAAYC,SAAAA,EAAWR,UAAAA,EAAYqC,WAAAA,EAAa,YAAA;AAClD,QAAA,MAAM,EAAE5H,QAAAA,EAAQ,GAAK,MAAM0H,OAAAA,CAAQrG,aAAaS,QAAAA,CAAAA;AAChD,QAAA,MAAMoF,2BAAAA,CAA4BnB,WAAW/F,QAAAA,CAAAA;MACjD,CAAA,CAAA;AACJ,IAAA;AAEA,IAAA,MAAMkG,gBAAAA,CAAiBX,YAAYY,SAAAA,CAAAA;EACvC,CAAA,SAAA;AACI,IAAA,MAAMgB,aAAAA,CACFC,OAAAA,EACAtF,QAAAA,KAAanC,MAAAA,GAAYA,MAAAA,GAAY,MAAM+H,OAAAA,CAAQrG,YAAAA,CAAaS,QAAAA,CAAAA,CAAAA,CAClEgF,KAAAA,CAAM,CAAChG,KAAAA,KAAAA;AACLqB,MAAAA,OAAAA,CAAQ4E,IAAAA,CAAK,CAAA,kDAAA,EAAqDK,OAAAA,CAAAA,CAAAA,EAAWtG,KAAAA,CAAAA;IACjF,CAAA,CAAA;AACJ,EAAA;AACJ,CAAA,EA9D6C,+BAAA","file":"D25LP26W.js","sourcesContent":["import { unzipSync } from 'fflate';\nimport { execFile, spawn } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport {\n    chmod,\n    copyFile,\n    mkdir,\n    mkdtemp,\n    readdir,\n    readFile,\n    rename,\n    rm,\n    stat,\n    writeFile,\n} from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport path from 'node:path';\nimport { promisify } from 'node:util';\nimport { parse } from 'toml';\n\nimport type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';\n\nconst execFileAsync = promisify(execFile);\n\nconst SOURCE_ARCHIVE_NAME = 'contracts-source.zip';\nconst WASM_TARGET_DIR = path.join('target', 'wasm32v1-none', 'release');\n\n// The self-contained source is mounted here and built in place. The official image's WORKDIR is\n// already /source; we set it explicitly for clarity.\nconst SOURCE_MOUNT = '/source';\n\n// Canonical reproducible platform. External verifiers reproduce the amd64 artifact, so we always\n// run the amd64 image regardless of the host arch (the daemon emulates it when needed).\nconst VERIFIABLE_BUILD_PLATFORM = 'linux/amd64';\n\nconst OFFICIAL_IMAGE_REPO = 'stellar/stellar-cli';\n\nconst META_FLAG = '--meta';\n\ninterface RustToolchainToml {\n    toolchain?: {\n        channel?: string;\n    };\n}\n\n// The subset of `docker manifest inspect` output (an OCI image index) that we read.\ninterface ManifestDescriptor {\n    digest?: string;\n    platform?: { os?: string; architecture?: string };\n}\ninterface ManifestIndex {\n    manifests?: ManifestDescriptor[];\n}\n\nexport interface PackageSpec {\n    packageName: string;\n    manifestPath: string;\n}\n\nexport interface VerifiableBuildVersions {\n    stellarVersion: string;\n    rustVersion: string;\n}\n\nexport interface ResolvedVerifiableBuildImage {\n    imageRef: string;\n    bldimg: string;\n    tagRef: string;\n}\n\nexport interface RunVerifiableBuildFromArchiveOptions {\n    archive: string;\n    packages: PackageSpec[];\n    outputDir: string;\n    stellarVersion: string;\n    rustVersion?: string;\n}\n\n/**\n * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.\n * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the\n * only image the tool builds against.\n */\nexport const officialImageTagRef = (stellarVersion: string, rustVersion: string): string =>\n    `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`;\n\n/**\n * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so\n * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.\n */\nexport const parseAmd64Digest = (manifestInspectJson: string): string => {\n    const { manifests } = JSON.parse(manifestInspectJson) as ManifestIndex;\n\n    if (!Array.isArray(manifests)) {\n        throw new Error(\n            '`docker manifest inspect` did not return a multi-arch index (no `manifests` array)',\n        );\n    }\n\n    const digest = manifests.find(\n        ({ platform }) => platform?.os === 'linux' && platform?.architecture === 'amd64',\n    )?.digest;\n\n    if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {\n        throw new Error('No linux/amd64 manifest digest found in `docker manifest inspect` output');\n    }\n\n    return digest;\n};\n\n/**\n * Resolve the immutable linux/amd64 digest of a `stellar/stellar-cli` tag via a daemon-less\n * registry query (`docker manifest inspect`). This is the reproducible reference an external\n * verifier pins to (SEP-58).\n */\nconst resolveAmd64Digest = async (imageTagRef: string): Promise<string> => {\n    try {\n        const { stdout } = await execFileAsync('docker', ['manifest', 'inspect', imageTagRef], {\n            maxBuffer: 16 * 1024 * 1024,\n            timeout: 30_000,\n        });\n        return parseAmd64Digest(stdout);\n    } catch (cause) {\n        throw new Error(\n            `Failed to resolve the linux/amd64 digest of ${imageTagRef} (\\`docker manifest inspect\\`)`,\n            { cause },\n        );\n    }\n};\n\n/** The `key` of a `key=value` meta entry (the whole string when there is no `=`). */\nconst metaKey = (entry: string): string => {\n    const eq = entry.indexOf('=');\n    return eq === -1 ? entry : entry.slice(0, eq);\n};\n\n/**\n * Canonicalize `stellar contract build` args so the embedded metadata order is stable.\n *\n * Soroban stores contract metadata as an ORDERED sequence, so the order of `--meta key=value`\n * flags changes the WASM bytes. To keep the build reproducible, every meta entry — the caller's\n * plus the tool-injected ones — is pulled out, merged, and re-emitted in sorted order.\n *\n * Injected keys (e.g. `bldimg`) are tool-controlled and RESERVED: any caller `--meta` reusing an\n * injected key is dropped.\n */\nexport const canonicalizeMetaArgs = (buildArgs: string[], injectedMeta: string[]): string[] => {\n    const reservedKeys = new Set(injectedMeta.map(metaKey));\n    const metas = [...injectedMeta];\n    const passthrough: string[] = [];\n\n    const addCallerMeta = (value: string): void => {\n        if (!reservedKeys.has(metaKey(value))) metas.push(value);\n    };\n\n    for (let i = 0; i < buildArgs.length; i++) {\n        const arg = buildArgs[i];\n        if (arg === undefined) continue;\n        if (arg === META_FLAG) {\n            const value = buildArgs[i + 1];\n            if (value !== undefined && !value.startsWith('--')) {\n                addCallerMeta(value);\n                i += 1;\n            }\n        } else if (arg.startsWith(`${META_FLAG}=`)) {\n            addCallerMeta(arg.slice(META_FLAG.length + 1));\n        } else {\n            passthrough.push(arg);\n        }\n    }\n\n    metas.sort();\n    return [...passthrough, ...metas.flatMap((meta) => [META_FLAG, meta])];\n};\n\n/**\n * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /\n * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.\n */\nexport const buildVerifiableBuildDockerArgs = ({\n    imageRef,\n    sourceDir,\n    buildArgs,\n    bldimg,\n}: {\n    imageRef: string;\n    sourceDir: string;\n    buildArgs: string[];\n    bldimg: string;\n}): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '-v',\n    `${sourceDir}:${SOURCE_MOUNT}`,\n    '-w',\n    SOURCE_MOUNT,\n    imageRef,\n    'contract',\n    'build',\n    ...canonicalizeMetaArgs(buildArgs, [`bldimg=${bldimg}`]),\n];\n\n/**\n * Resolve the directory to build. An explicit `sourceDir` that is relative resolves against the\n * cwd; an absolute one is used as-is; omitting it falls back to the cwd.\n */\nexport const resolveBuildDir = (cwd: string, sourceDir?: string): string =>\n    path.resolve(cwd, sourceDir ?? '.');\n\nconst runDocker = (dockerArgs: string[]): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', dockerArgs, { stdio: 'inherit' });\n        child.on('error', (error) =>\n            reject(new Error('Failed to spawn docker for the verifiable build', { cause: error })),\n        );\n        child.on('close', (code, signal) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(\n                    new Error(\n                        `Verifiable build failed: docker exited with ${\n                            signal ? `signal ${signal}` : `code ${code}`\n                        }`,\n                    ),\n                );\n            }\n        });\n    });\n\n/**\n * Reproducible `stellar contract build` inside the official `stellar/stellar-cli` image.\n * Used by the archive orchestrator for each `--package`.\n */\nexport class VerifiableBuildWrapper {\n    private readonly imagesByTag = new Map<string, Promise<ResolvedVerifiableBuildImage>>();\n\n    public constructor(\n        private readonly resolveDigest: (\n            imageTagRef: string,\n        ) => Promise<string> = resolveAmd64Digest,\n    ) {}\n\n    public resolveImage({\n        stellarVersion,\n        rustVersion,\n    }: VerifiableBuildVersions): Promise<ResolvedVerifiableBuildImage> {\n        const tagRef = officialImageTagRef(stellarVersion, rustVersion);\n        const existing = this.imagesByTag.get(tagRef);\n        if (existing !== undefined) {\n            return existing;\n        }\n\n        const resolved = this.resolveDigest(tagRef).then((digest) => ({\n            imageRef: `${OFFICIAL_IMAGE_REPO}@${digest}`,\n            bldimg: `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`,\n            tagRef,\n        }));\n        this.imagesByTag.set(tagRef, resolved);\n        return resolved;\n    }\n\n    public async run(\n        args: string[],\n        versions: VerifiableBuildVersions,\n        { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>,\n        sourceDir?: string,\n    ): Promise<void> {\n        const buildDir = resolveBuildDir(cwd, sourceDir);\n        try {\n            if (!(await stat(buildDir)).isDirectory()) {\n                throw new Error('not a directory');\n            }\n        } catch (cause) {\n            throw new Error(\n                `Verifiable build source directory is not an existing directory: ${buildDir}`,\n                { cause },\n            );\n        }\n\n        // The official stellar-cli image runs as a non-host UID and must create cargo target\n        // dirs under the bind-mounted source. Do not pass --user (that would diverge from what\n        // external verifiers run). Only chmod when a sourceDir is passed (typically a\n        // throwaway extract dir); never world-write the process cwd.\n        if (sourceDir !== undefined) {\n            await chmod(buildDir, 0o777);\n        }\n\n        const { imageRef, bldimg, tagRef } = await this.resolveImage(versions);\n\n        const dockerArgs = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: buildDir,\n            buildArgs: args,\n            bldimg,\n        });\n\n        console.info('🔒 Verifiable build (official stellar/stellar-cli image, run from host)');\n        console.info(`   source: ${buildDir}`);\n        console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);\n        console.info(`   bldimg: ${bldimg}`);\n        console.info(`   docker ${dockerArgs.join(' ')}`);\n\n        await runDocker(dockerArgs);\n    }\n}\n\n/**\n * Parse a `--package <name>:<manifest-path>` pair. Both sides must be non-empty.\n */\nexport const parsePackageSpec = (spec: string): PackageSpec => {\n    const colon = spec.indexOf(':');\n    if (colon <= 0 || colon === spec.length - 1) {\n        throw new Error(\n            `Invalid --package spec ${JSON.stringify(spec)}: expected <name>:<manifest-path>`,\n        );\n    }\n\n    return {\n        packageName: spec.slice(0, colon),\n        manifestPath: spec.slice(colon + 1),\n    };\n};\n\n/** Soroban wasm artifact basename: hyphens in the package name become underscores. */\nexport const wasmArtifactName = (packageName: string): string =>\n    `${packageName.replaceAll('-', '_')}.wasm`;\n\nconst validatePackageSpecs = (packages: PackageSpec[]): void => {\n    const artifactNames = new Set<string>();\n    for (const { packageName } of packages) {\n        const artifactName = wasmArtifactName(packageName);\n        if (artifactNames.has(artifactName)) {\n            throw new Error(`Duplicate WASM artifact ${artifactName} from --package options`);\n        }\n        artifactNames.add(artifactName);\n    }\n};\n\n/**\n * Resolve the Rust toolchain version for the verifiable build image tag. An explicit\n * `--rust-version` wins; otherwise read the pinned channel from the supplied source directory.\n */\nexport const resolveRustVersion = async (\n    sourceDir: string,\n    rustVersionFlag?: string,\n): Promise<string> => {\n    if (rustVersionFlag !== undefined) {\n        return rustVersionFlag;\n    }\n\n    const toolchainPath = path.join(sourceDir, 'rust-toolchain.toml');\n    let contents: string;\n    try {\n        contents = await readFile(toolchainPath, 'utf-8');\n    } catch (cause) {\n        if ((cause as { code?: string }).code === 'ENOENT') {\n            throw new Error(\n                `Missing rust-toolchain.toml in ${sourceDir} and no --rust-version was provided`,\n                { cause },\n            );\n        }\n        throw cause;\n    }\n\n    const parsed = parse(contents) as RustToolchainToml;\n    const channel = parsed.toolchain?.channel;\n    if (typeof channel !== 'string' || channel.length === 0) {\n        throw new Error(`Missing 'toolchain.channel' in ${toolchainPath}`);\n    }\n\n    return channel;\n};\n\n/**\n * Build `stellar contract build` args for one archive package. Embeds SEP-58 `source_sha256`\n * and replays the build flags as `bldopt=` metas so external verifiers can reproduce the build.\n * `bldimg` is injected separately by the official-image runner.\n */\nexport const buildArchiveContractArgs = (\n    { packageName, manifestPath }: PackageSpec,\n    sourceSha256: string,\n): string[] => [\n    '--manifest-path',\n    manifestPath,\n    '--package',\n    packageName,\n    '--optimize',\n    '--meta',\n    `bldopt=--manifest-path=${manifestPath}`,\n    '--meta',\n    `bldopt=--package=${packageName}`,\n    '--meta',\n    'bldopt=--optimize',\n    '--meta',\n    `source_sha256=${sourceSha256}`,\n];\n\nconst pathExists = async (filePath: string): Promise<boolean> => {\n    try {\n        await stat(filePath);\n        return true;\n    } catch (error) {\n        if ((error as { code?: string }).code === 'ENOENT') {\n            return false;\n        }\n        throw error;\n    }\n};\n\nconst readArchiveBytes = async (archive: string): Promise<Uint8Array> => {\n    let bytes: Uint8Array;\n    try {\n        bytes = new Uint8Array(await readFile(archive));\n    } catch (cause) {\n        throw new Error(`Archive not found or unreadable: ${archive}`, { cause });\n    }\n\n    if (bytes.length === 0) {\n        throw new Error(`Archive is empty: ${archive}`);\n    }\n\n    return bytes;\n};\n\nconst extractZip = async (\n    bytes: Uint8Array,\n    destDir: string,\n    expectedRootDirName: string,\n): Promise<void> => {\n    const files = unzipSync(bytes);\n    const destRoot = path.resolve(destDir);\n    const expectedRoot = path.join(destRoot, expectedRootDirName);\n    const expectedRootPrefix = `${expectedRootDirName}/`;\n\n    for (const [relPath, content] of Object.entries(files)) {\n        const outPath = path.resolve(destRoot, relPath);\n        if (outPath !== destRoot && !outPath.startsWith(destRoot + path.sep)) {\n            throw new Error(`Zip entry escapes destination: ${relPath}`);\n        }\n        if (outPath !== expectedRoot && !outPath.startsWith(expectedRoot + path.sep)) {\n            throw new Error(\n                `Zip entry is outside expected top-level ${expectedRootPrefix}: ${relPath}`,\n            );\n        }\n        if (relPath.endsWith('/')) continue;\n\n        await mkdir(path.dirname(outPath), { recursive: true });\n        await writeFile(outPath, content);\n    }\n};\n\nconst persistSourceArchive = async (\n    archiveBytes: Uint8Array,\n    stagingDir: string,\n): Promise<void> => {\n    await mkdir(stagingDir, { recursive: true });\n    await writeFile(path.join(stagingDir, SOURCE_ARCHIVE_NAME), archiveBytes);\n};\n\nexport const copyFileWithPermissionRepair = async (\n    source: string,\n    destination: string,\n    repairPermissions: () => Promise<void>,\n    copy: (source: string, destination: string) => Promise<void> = copyFile,\n): Promise<void> => {\n    try {\n        await copy(source, destination);\n    } catch (error) {\n        const code = (error as { code?: string }).code;\n        if (code !== 'EACCES' && code !== 'EPERM') {\n            throw error;\n        }\n\n        await repairPermissions();\n        await copy(source, destination);\n    }\n};\n\nconst persistWasm = async (\n    buildRoot: string,\n    stagingDir: string,\n    { packageName }: PackageSpec,\n    repairPermissions: () => Promise<void>,\n): Promise<void> => {\n    const wasmName = wasmArtifactName(packageName);\n    const builtPath = path.join(buildRoot, WASM_TARGET_DIR, wasmName);\n    if (!(await pathExists(builtPath))) {\n        throw new Error(`Expected WASM not found after build: ${builtPath}`);\n    }\n\n    await mkdir(stagingDir, { recursive: true });\n    await copyFileWithPermissionRepair(\n        builtPath,\n        path.join(stagingDir, wasmName),\n        repairPermissions,\n    );\n};\n\n/**\n * Atomically replace the output directory with the complete staged artifact set.\n * Mirrors protocol stellar's `.next-` / `.prev` swap so failed builds leave prior output intact.\n */\nconst publishArtifacts = async (stagingDir: string, outputDir: string): Promise<void> => {\n    const parentDir = path.dirname(outputDir);\n    const outputBase = path.basename(outputDir);\n    await mkdir(parentDir, { recursive: true });\n\n    const nextDir = await mkdtemp(path.join(parentDir, `${outputBase}.next-`));\n    const backupDir = path.join(parentDir, `${outputBase}.prev`);\n    const entries = await readdir(stagingDir);\n\n    try {\n        for (const entry of entries) {\n            await copyFile(path.join(stagingDir, entry), path.join(nextDir, entry));\n        }\n\n        if (!(await pathExists(outputDir)) && (await pathExists(backupDir))) {\n            await rename(backupDir, outputDir);\n        } else if (await pathExists(backupDir)) {\n            await rm(backupDir, { recursive: true, force: true });\n        }\n\n        if (await pathExists(outputDir)) {\n            await rename(outputDir, backupDir);\n        }\n        await rename(nextDir, outputDir);\n        await rm(backupDir, { recursive: true, force: true }).catch((error) => {\n            console.warn(`Failed to remove leftover ${backupDir} after publish:`, error);\n        });\n    } catch (error) {\n        await rm(nextDir, { recursive: true, force: true }).catch(() => undefined);\n        if (!(await pathExists(outputDir)) && (await pathExists(backupDir))) {\n            await rename(backupDir, outputDir).catch(() => undefined);\n        }\n        throw error;\n    }\n};\n\nexport const buildPermissionRepairDockerArgs = (dir: string, imageRef: string): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '--user',\n    '0:0',\n    '--entrypoint',\n    'chmod',\n    '-v',\n    `${dir}:/cleanup`,\n    imageRef,\n    '-R',\n    'a+rwX',\n    '/cleanup',\n];\n\nconst relaxDockerOwnedPermissions = (dir: string, imageRef: string): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', buildPermissionRepairDockerArgs(dir, imageRef), {\n            stdio: 'inherit',\n        });\n        child.on('error', reject);\n        child.on('close', (code) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(new Error(`Failed to chmod temp dir via docker (exit ${code ?? 1})`));\n            }\n        });\n    });\n\nconst removeTempDir = async (\n    tempDir: string,\n    resolveImage?: () => Promise<ResolvedVerifiableBuildImage>,\n): Promise<void> => {\n    try {\n        await rm(tempDir, { recursive: true, force: true });\n    } catch (error) {\n        const code = (error as { code?: string }).code;\n        if (code !== 'EACCES' && code !== 'EPERM') {\n            throw error;\n        }\n        if (resolveImage === undefined) {\n            throw error;\n        }\n\n        const { imageRef } = await resolveImage();\n        await relaxDockerOwnedPermissions(tempDir, imageRef);\n        await rm(tempDir, { recursive: true, force: true });\n    }\n};\n\n/**\n * Build one or more Stellar contracts from a self-contained source archive.\n *\n * `packages` is intentionally already parsed: the CLI owns string parsing, while this orchestrator\n * deals only in validated package/manifest pairs.\n */\nexport const runVerifiableBuildFromArchive = async (\n    {\n        archive,\n        packages,\n        outputDir,\n        stellarVersion,\n        rustVersion,\n    }: RunVerifiableBuildFromArchiveOptions,\n    { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>,\n): Promise<void> => {\n    if (packages.length === 0) {\n        throw new Error('verifiable-build requires at least one --package <name>:<manifest-path>');\n    }\n    validatePackageSpecs(packages);\n\n    const archiveBytes = await readArchiveBytes(archive);\n    const sourceSha256 = createHash('sha256').update(archiveBytes).digest('hex');\n    const tempDir = await mkdtemp(path.join(tmpdir(), 'stellar-verifiable-build-'));\n    const extractionDir = path.join(tempDir, 'source');\n    const stagingDir = path.join(tempDir, 'staging');\n    let versions: VerifiableBuildVersions | undefined;\n    const wrapper = new VerifiableBuildWrapper();\n\n    try {\n        const rootDirName = path.basename(cwd);\n        await extractZip(archiveBytes, extractionDir, rootDirName);\n\n        const buildRoot = path.join(extractionDir, rootDirName);\n        if (!(await pathExists(buildRoot)) || !(await stat(buildRoot)).isDirectory()) {\n            throw new Error(\n                `Expected top-level ${rootDirName}/ directory not found after extraction`,\n            );\n        }\n\n        versions = {\n            stellarVersion,\n            rustVersion: await resolveRustVersion(buildRoot, rustVersion),\n        };\n        await persistSourceArchive(archiveBytes, stagingDir);\n\n        for (const packageSpec of packages) {\n            await wrapper.run(\n                buildArchiveContractArgs(packageSpec, sourceSha256),\n                versions,\n                { cwd },\n                buildRoot,\n            );\n            await persistWasm(buildRoot, stagingDir, packageSpec, async () => {\n                const { imageRef } = await wrapper.resolveImage(versions!);\n                await relaxDockerOwnedPermissions(buildRoot, imageRef);\n            });\n        }\n\n        await publishArtifacts(stagingDir, outputDir);\n    } finally {\n        await removeTempDir(\n            tempDir,\n            versions === undefined ? undefined : () => wrapper.resolveImage(versions!),\n        ).catch((error) => {\n            console.warn(`Temp dir cleanup failed (build result unchanged): ${tempDir}`, error);\n        });\n    }\n};\n"]}

package/dist/commands/verifiable-build.d.ts

@@ -1,36 +1,49 @@
 import type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';
+export interface PackageSpec {
+    packageName: string;
+    manifestPath: string;
+}
+export interface VerifiableBuildVersions {
+    stellarVersion: string;
+    rustVersion: string;
+}
+export interface ResolvedVerifiableBuildImage {
+    imageRef: string;
+    bldimg: string;
+    tagRef: string;
+}
+export interface RunVerifiableBuildFromArchiveOptions {
+    archive: string;
+    packages: PackageSpec[];
+    outputDir: string;
+    stellarVersion: string;
+    rustVersion?: string;
+}
 /**
  * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.
  * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the
  * only image the tool builds against.
  */
 export declare const officialImageTagRef: (stellarVersion: string, rustVersion: string) => string;
+/**
+ * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so
+ * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.
+ */
 export declare const parseAmd64Digest: (manifestInspectJson: string) => string;
 /**
  * Canonicalize `stellar contract build` args so the embedded metadata order is stable.
  *
  * Soroban stores contract metadata as an ORDERED sequence, so the order of `--meta key=value`
- * flags changes the WASM bytes (verified: swapping two `--meta` flags yields a different WASM
- * hash). To keep the build reproducible regardless of the order the caller passed `--meta`, every
- * meta entry — the caller's plus the tool-injected ones — is pulled out, merged, and re-emitted in
- * sorted order. Non-meta args keep their original relative order and precede the sorted metas.
+ * flags changes the WASM bytes. To keep the build reproducible, every meta entry — the caller's
+ * plus the tool-injected ones — is pulled out, merged, and re-emitted in sorted order.
  *
  * Injected keys (e.g. `bldimg`) are tool-controlled and RESERVED: any caller `--meta` reusing an
- * injected key is dropped, so a caller can never override the recorded build image by key
- * collision (before sorting, the injected entry was always appended last and won on its own).
- *
- * Both `--meta k=v` and `--meta=k=v` forms are recognized; a dangling `--meta` with no value (or
- * one followed by another flag) is dropped.
+ * injected key is dropped.
  */
 export declare const canonicalizeMetaArgs: (buildArgs: string[], injectedMeta: string[]) => string[];
 /**
  * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /
  * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.
- *
- * The official image's ENTRYPOINT is `stellar`, so the trailing `contract build …` runs under it.
- * The source directory is assumed self-contained, so it is mounted at /source and built in place —
- * no surrounding workspace is required. All `--meta` flags (the caller's plus the injected
- * `bldimg`) are sorted into a canonical order so the WASM hash is independent of `--meta` ordering.
  */
 export declare const buildVerifiableBuildDockerArgs: ({ imageRef, sourceDir, buildArgs, bldimg, }: {
     imageRef: string;
@@ -40,36 +53,44 @@ export declare const buildVerifiableBuildDockerArgs: ({ imageRef, sourceDir, bui
 }) => string[];
 /**
  * Resolve the directory to build. An explicit `sourceDir` that is relative resolves against the
- * cwd; an absolute one is used as-is; omitting it falls back to the cwd. Kept pure/synchronous so
- * the cwd-vs-explicit-folder precedence is unit-testable without Docker.
- *
- * This is what lets the pipeline decompress a packaged source archive into a scratch directory and
- * build that, instead of always building the process cwd.
+ * cwd; an absolute one is used as-is; omitting it falls back to the cwd.
  */
 export declare const resolveBuildDir: (cwd: string, sourceDir?: string) => string;
-export interface VerifiableBuildVersions {
-    stellarVersion: string;
-    rustVersion: string;
-}
 /**
- * Reproducible `stellar contract build` that runs inside the OFFICIAL `stellar/stellar-cli` image —
- * the exact package an external verifier uses — instead of our own dev image (whose sccache/mold
- * layers could change the WASM).
- *
- * The build runs the official image directly from the HOST: our TypeScript CLI already executes on
- * the host runner, so it can `docker run` the official image itself. This is what an external
- * verifier's plain `docker run` does, and it means we never bind-mount the host Docker socket into
- * a container — eliminating the container-escape / secret-leak surface that mounting the socket
- * would create.
- *
- * The image is `stellar/stellar-cli:<stellarVersion>-rust<rustVersion>-slim-bookworm`, pinned by the
- * caller. For a stable reference we resolve it to its linux/amd64 digest and both RUN that digest
- * and embed it as the `bldimg` WASM metadata (`docker.io/stellar/stellar-cli@sha256:…`) — the tool
- * does this automatically so callers never hand-inject `--meta bldimg=…`. The source directory (the
- * cwd, assumed self-contained) is mounted at /source and built in place, and the official image runs
- * as its own user/toolchain.
+ * Reproducible `stellar contract build` inside the official `stellar/stellar-cli` image.
+ * Used by the archive orchestrator for each `--package`.
  */
 export declare class VerifiableBuildWrapper {
-    run(args: string[], { stellarVersion, rustVersion }: VerifiableBuildVersions, options: ToolCommandExecutionOptions, sourceDir?: string): Promise<void>;
+    private readonly resolveDigest;
+    private readonly imagesByTag;
+    constructor(resolveDigest?: (imageTagRef: string) => Promise<string>);
+    resolveImage({ stellarVersion, rustVersion, }: VerifiableBuildVersions): Promise<ResolvedVerifiableBuildImage>;
+    run(args: string[], versions: VerifiableBuildVersions, { cwd }: Pick<ToolCommandExecutionOptions, 'cwd'>, sourceDir?: string): Promise<void>;
 }
+/**
+ * Parse a `--package <name>:<manifest-path>` pair. Both sides must be non-empty.
+ */
+export declare const parsePackageSpec: (spec: string) => PackageSpec;
+/** Soroban wasm artifact basename: hyphens in the package name become underscores. */
+export declare const wasmArtifactName: (packageName: string) => string;
+/**
+ * Resolve the Rust toolchain version for the verifiable build image tag. An explicit
+ * `--rust-version` wins; otherwise read the pinned channel from the supplied source directory.
+ */
+export declare const resolveRustVersion: (sourceDir: string, rustVersionFlag?: string) => Promise<string>;
+/**
+ * Build `stellar contract build` args for one archive package. Embeds SEP-58 `source_sha256`
+ * and replays the build flags as `bldopt=` metas so external verifiers can reproduce the build.
+ * `bldimg` is injected separately by the official-image runner.
+ */
+export declare const buildArchiveContractArgs: ({ packageName, manifestPath }: PackageSpec, sourceSha256: string) => string[];
+export declare const copyFileWithPermissionRepair: (source: string, destination: string, repairPermissions: () => Promise<void>, copy?: (source: string, destination: string) => Promise<void>) => Promise<void>;
+export declare const buildPermissionRepairDockerArgs: (dir: string, imageRef: string) => string[];
+/**
+ * Build one or more Stellar contracts from a self-contained source archive.
+ *
+ * `packages` is intentionally already parsed: the CLI owns string parsing, while this orchestrator
+ * deals only in validated package/manifest pairs.
+ */
+export declare const runVerifiableBuildFromArchive: ({ archive, packages, outputDir, stellarVersion, rustVersion, }: RunVerifiableBuildFromArchiveOptions, { cwd }: Pick<ToolCommandExecutionOptions, "cwd">) => Promise<void>;
 //# sourceMappingURL=verifiable-build.d.ts.map

package/dist/commands/verifiable-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifiable-build.d.ts","sourceRoot":"","sources":["../../src/commands/verifiable-build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAc7E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,gBAAgB,MAAM,EAAE,aAAa,MAAM,KAAG,MACH,CAAC;AAehF,eAAO,MAAM,gBAAgB,GAAI,qBAAqB,MAAM,KAAG,MAkB9D,CAAC;AA8BF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,WAAW,MAAM,EAAE,EAAE,cAAc,MAAM,EAAE,KAAG,MAAM,EA8BxF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAAI,6CAK5C;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAClB,KAAG,MAAM,EAeT,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,KAAG,MAC3B,CAAC;AAuBxC,MAAM,WAAW,uBAAuB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,sBAAsB;IAClB,GAAG,CACZ,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,uBAAuB,EACxD,OAAO,EAAE,2BAA2B,EACpC,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;CAyCnB"}
+{"version":3,"file":"verifiable-build.d.ts","sourceRoot":"","sources":["../../src/commands/verifiable-build.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAkC7E,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,4BAA4B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oCAAoC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,gBAAgB,MAAM,EAAE,aAAa,MAAM,KAAG,MACH,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,qBAAqB,MAAM,KAAG,MAkB9D,CAAC;AA4BF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAI,WAAW,MAAM,EAAE,EAAE,cAAc,MAAM,EAAE,KAAG,MAAM,EA2BxF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,GAAI,6CAK5C;IACC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAClB,KAAG,MAAM,EAaT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,KAAG,MAC3B,CAAC;AAuBxC;;;GAGG;AACH,qBAAa,sBAAsB;IAI3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAHlC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4D;gBAGnE,aAAa,GAAE,CAC5B,WAAW,EAAE,MAAM,KAClB,OAAO,CAAC,MAAM,CAAsB;IAGtC,YAAY,CAAC,EAChB,cAAc,EACd,WAAW,GACd,EAAE,uBAAuB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAgBrD,GAAG,CACZ,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,EAAE,uBAAuB,EACjC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,EACjD,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;CAsCnB;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,WAY/C,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,KAAG,MACT,CAAC;AAa/C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC3B,WAAW,MAAM,EACjB,kBAAkB,MAAM,KACzB,OAAO,CAAC,MAAM,CA0BhB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACjC,+BAA+B,WAAW,EAC1C,cAAc,MAAM,KACrB,MAAM,EAcR,CAAC;AAgEF,eAAO,MAAM,4BAA4B,GACrC,QAAQ,MAAM,EACd,aAAa,MAAM,EACnB,mBAAmB,MAAM,OAAO,CAAC,IAAI,CAAC,EACtC,OAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAY,KACxE,OAAO,CAAC,IAAI,CAYd,CAAC;AA8DF,eAAO,MAAM,+BAA+B,GAAI,KAAK,MAAM,EAAE,UAAU,MAAM,KAAG,MAAM,EAerF,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GACtC,gEAMG,oCAAoC,EACvC,SAAS,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,KAClD,OAAO,CAAC,IAAI,CAqDd,CAAC"}

package/dist/commands/verifiable-build.js

@@ -1,4 +1,4 @@
-export { VerifiableBuildWrapper, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, officialImageTagRef, parseAmd64Digest, resolveBuildDir } from '../WMMRXU3O.js';
+export { VerifiableBuildWrapper, buildArchiveContractArgs, buildPermissionRepairDockerArgs, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, copyFileWithPermissionRepair, officialImageTagRef, parseAmd64Digest, parsePackageSpec, resolveBuildDir, resolveRustVersion, runVerifiableBuildFromArchive, wasmArtifactName } from '../D25LP26W.js';
 import '../VUOMXK5T.js';
 //# sourceMappingURL=verifiable-build.js.map
 //# sourceMappingURL=verifiable-build.js.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,IAAI,QAAO,OAAO,CAAC,IAAI,CA6F9B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,IAAI,QAAO,OAAO,CAAC,IAAI,CA4G9B,CAAC"}

package/dist/index.js

@@ -1,24 +1,37 @@
 import { packageSource } from './LCHYL2IQ.js';
-import { VerifiableBuildWrapper } from './WMMRXU3O.js';
+import { runVerifiableBuildFromArchive, parsePackageSpec } from './D25LP26W.js';
 import { versionCombinations, images, tools } from './AY7HGKNR.js';
 import { syncToolchain } from './P6KJGYNA.js';
 import { __name } from './VUOMXK5T.js';
+import path from 'path';
 import { runCli } from '@layerzerolabs/vm-tooling';
 
+var DEFAULT_OUTPUT_DIR = ".artifacts";
 var context = {
   tools,
   images,
   versionCombinations
 };
-var verifiableBuildWrapper = new VerifiableBuildWrapper();
+var collectPackageSpecs = /* @__PURE__ */ __name((value, previous) => [
+  ...previous,
+  value
+], "collectPackageSpecs");
 var main = /* @__PURE__ */ __name(() => runCli(context, (program, parseGlobalOptions) => {
   program.command("sync-toolchain").description("Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock").action(async () => syncToolchain(context, await parseGlobalOptions(program)));
   const extra = program.command("extra").description("Extra commands for VM tooling");
   const stellar = extra.command("stellar");
-  stellar.command("verifiable-build").description("Reproducible `stellar contract build` of the self-contained source in the cwd by default, inside the official stellar/stellar-cli:<stellar>-rust<rust>-slim-bookworm image pinned by its linux/amd64 digest (run from the host, no Docker socket; embeds the bldimg WASM meta automatically)").requiredOption("--stellar-version <version>", "Stellar CLI version of the official reproducible image (e.g. 25.1.0)").requiredOption("--rust-version <version>", "Rust version of the official reproducible image (e.g. 1.90.0)").option("--source-dir <path>", "Directory to build \u2014 the self-contained/decompressed source. Relative paths resolve against the cwd; defaults to the cwd.").argument("[args...]", "Arguments for `stellar contract build`, after `--` (e.g. -- --package <crate>)").passThroughOptions(true).allowUnknownOption().action(async (args, { stellarVersion, rustVersion, sourceDir }) => verifiableBuildWrapper.run(args, {
-    stellarVersion,
-    rustVersion
-  }, await parseGlobalOptions(program), sourceDir));
+  stellar.command("verifiable-build").description("Build one or more Stellar contracts reproducibly from a source archive: extract \u2192 hash \u2192 build each --package in the official stellar/stellar-cli image \u2192 atomically publish contracts-source.zip and *.wasm.").requiredOption("--stellar-version <version>", "Stellar CLI version of the official reproducible image (e.g. 25.1.0)").option("--rust-version <version>", "Rust version of the official reproducible image (e.g. 1.90.0); defaults to the archive's rust-toolchain.toml channel").requiredOption("--archive <path>", "Self-contained source .zip for the SEP-58 verifiable build").option("--package <name:manifest>", "Package to build as <name>:<manifest-path> (repeatable; required at least once)", collectPackageSpecs, []).option("--output-dir <path>", "Directory for contracts-source.zip and *.wasm", DEFAULT_OUTPUT_DIR).action(async ({ stellarVersion, rustVersion, archive, package: packageSpecs, outputDir }) => {
+    const options = await parseGlobalOptions(program);
+    await runVerifiableBuildFromArchive({
+      archive: path.resolve(options.cwd, archive),
+      packages: packageSpecs.map(parsePackageSpec),
+      outputDir: path.resolve(options.cwd, outputDir),
+      stellarVersion,
+      rustVersion
+    }, {
+      cwd: options.cwd
+    });
+  });
   stellar.command("package-source").description("Package the self-contained crate in the cwd into a byte-deterministic source .zip under .artifacts/ (for the SEP-58 verifiable build) and print its source_sha256. Include-only: packages source files (.rs/.lock, Cargo.toml, rust-toolchain.toml, rustfmt.toml, clippy.toml) plus any --include entries; --exclude always wins. Skips non-source directories (target, node_modules, \u2026).").option("--output <path>", "Output .zip path (default: <cwd>/.artifacts/<basename>-source.zip)").option("--include <pattern...>", "Native Node glob patterns to include beyond the default source extensions", []).option("--exclude <pattern...>", "Native Node glob patterns to exclude (always wins over the allow-list and --include)", []).action(async ({ output, include, exclude }) => packageSource({
     output,
     include,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["context","tools","images","versionCombinations","verifiableBuildWrapper","VerifiableBuildWrapper","main","runCli","program","parseGlobalOptions","command","description","action","syncToolchain","extra","stellar","requiredOption","option","argument","passThroughOptions","allowUnknownOption","args","stellarVersion","rustVersion","sourceDir","run","output","include","exclude","packageSource"],"mappings":";;;;;;;AAQA,IAAMA,OAAAA,GAAiC;AAAEC,EAAAA,KAAAA;AAAOC,EAAAA,MAAAA;AAAQC,EAAAA;AAAoB,CAAA;AAE5E,IAAMC,sBAAAA,GAAyB,IAAIC,sBAAAA,EAAAA;AAE5B,IAAMC,uBAAO,MAAA,CAAA,MAChBC,MAAAA,CAAOP,OAAAA,EAAS,CAACQ,SAASC,kBAAAA,KAAAA;AACtBD,EAAAA,OAAAA,CACKE,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,+EAAA,CAAA,CAEHC,MAAAA,CAAO,YAAYC,aAAAA,CAAcb,OAAAA,EAAS,MAAMS,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAIxE,EAAA,MAAMM,QAAQN,OAAAA,CAAQE,OAAAA,CAAQ,OAAA,CAAA,CAASC,YAAY,+BAAA,CAAA;AACnD,EAAA,MAAMI,OAAAA,GAAUD,KAAAA,CAAMJ,OAAAA,CAAQ,SAAA,CAAA;AAE9BK,EAAAA,OAAAA,CACKL,QAAQ,kBAAA,CAAA,CACRC,WAAAA,CACG,8RAGI,EAEPK,cAAAA,CACG,6BAAA,EACA,sEAAA,CAAA,CAEHA,eACG,0BAAA,EACA,+DAAA,CAAA,CAEHC,MAAAA,CACG,uBACA,gIACI,CAAA,CAEPC,QAAAA,CACG,WAAA,EACA,gFAAA,CAAA,CAEHC,kBAAAA,CAAmB,IAAA,CAAA,CACnBC,oBAAkB,CAClBR,MAAAA,CACG,OACIS,IAAAA,EACA,EACIC,cAAAA,EACAC,WAAAA,EACAC,WAAS,KAGbpB,sBAAAA,CAAuBqB,IACnBJ,IAAAA,EACA;AAAEC,IAAAA,cAAAA;AAAgBC,IAAAA;AAAY,GAAA,EAC9B,MAAMd,kBAAAA,CAAmBD,OAAAA,CAAAA,EACzBgB,SAAAA,CAAAA,CAAAA;AAIhBT,EAAAA,OAAAA,CACKL,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,gYAII,CAAA,CAEPM,MAAAA,CACG,iBAAA,EACA,oEAAA,CAAA,CAEHA,MAAAA,CACG,wBAAA,EACA,2EAAA,EACA,EAAE,CAAA,CAELA,MAAAA,CACG,wBAAA,EACA,sFAAA,EACA,EAAE,CAAA,CAELL,MAAAA,CACG,OAAO,EACHc,MAAAA,EACAC,OAAAA,EACAC,OAAAA,OAMAC,aAAAA,CAAc;AAAEH,IAAAA,MAAAA;AAAQC,IAAAA,OAAAA;AAASC,IAAAA;AAAQ,GAAA,EAAG,MAAMnB,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAErF,CAAA,CAAA,EA7FgB,MAAA","file":"index.js","sourcesContent":["import type { ChainContext } from '@layerzerolabs/vm-tooling';\nimport { runCli } from '@layerzerolabs/vm-tooling';\n\nimport { packageSource } from './commands/package-source';\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { VerifiableBuildWrapper } from './commands/verifiable-build';\nimport { type ImageId, images, tools, versionCombinations } from './config';\n\nconst context: ChainContext<ImageId> = { tools, images, versionCombinations };\n\nconst verifiableBuildWrapper = new VerifiableBuildWrapper();\n\nexport const main = (): Promise<void> =>\n    runCli(context, (program, parseGlobalOptions) => {\n        program\n            .command('sync-toolchain')\n            .description(\n                'Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock',\n            )\n            .action(async () => syncToolchain(context, await parseGlobalOptions(program)));\n\n        // Extra (non-passthrough) commands, namespaced under `extra <tool>` like vm-tooling-sui:\n        //   lz-tool extra stellar verifiable-build [args...]\n        const extra = program.command('extra').description('Extra commands for VM tooling');\n        const stellar = extra.command('stellar');\n\n        stellar\n            .command('verifiable-build')\n            .description(\n                'Reproducible `stellar contract build` of the self-contained source in the cwd by ' +\n                    'default, inside the official stellar/stellar-cli:<stellar>-rust<rust>-slim-bookworm ' +\n                    'image pinned by its linux/amd64 digest (run from the host, no Docker socket; embeds ' +\n                    'the bldimg WASM meta automatically)',\n            )\n            .requiredOption(\n                '--stellar-version <version>',\n                'Stellar CLI version of the official reproducible image (e.g. 25.1.0)',\n            )\n            .requiredOption(\n                '--rust-version <version>',\n                'Rust version of the official reproducible image (e.g. 1.90.0)',\n            )\n            .option(\n                '--source-dir <path>',\n                'Directory to build — the self-contained/decompressed source. Relative paths ' +\n                    'resolve against the cwd; defaults to the cwd.',\n            )\n            .argument(\n                '[args...]',\n                'Arguments for `stellar contract build`, after `--` (e.g. -- --package <crate>)',\n            )\n            .passThroughOptions(true)\n            .allowUnknownOption()\n            .action(\n                async (\n                    args: string[],\n                    {\n                        stellarVersion,\n                        rustVersion,\n                        sourceDir,\n                    }: { stellarVersion: string; rustVersion: string; sourceDir?: string },\n                ) =>\n                    verifiableBuildWrapper.run(\n                        args,\n                        { stellarVersion, rustVersion },\n                        await parseGlobalOptions(program),\n                        sourceDir,\n                    ),\n            );\n\n        stellar\n            .command('package-source')\n            .description(\n                'Package the self-contained crate in the cwd into a byte-deterministic source ' +\n                    '.zip under .artifacts/ (for the SEP-58 verifiable build) and print its ' +\n                    'source_sha256. Include-only: packages source files (.rs/.lock, Cargo.toml, ' +\n                    'rust-toolchain.toml, rustfmt.toml, clippy.toml) plus any --include entries; ' +\n                    '--exclude always wins. Skips non-source directories (target, node_modules, …).',\n            )\n            .option(\n                '--output <path>',\n                'Output .zip path (default: <cwd>/.artifacts/<basename>-source.zip)',\n            )\n            .option(\n                '--include <pattern...>',\n                'Native Node glob patterns to include beyond the default source extensions',\n                [],\n            )\n            .option(\n                '--exclude <pattern...>',\n                'Native Node glob patterns to exclude (always wins over the allow-list and --include)',\n                [],\n            )\n            .action(\n                async ({\n                    output,\n                    include,\n                    exclude,\n                }: {\n                    output?: string;\n                    include?: string[];\n                    exclude?: string[];\n                }) =>\n                    packageSource({ output, include, exclude }, await parseGlobalOptions(program)),\n            );\n    });\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["DEFAULT_OUTPUT_DIR","context","tools","images","versionCombinations","collectPackageSpecs","value","previous","main","runCli","program","parseGlobalOptions","command","description","action","syncToolchain","extra","stellar","requiredOption","option","stellarVersion","rustVersion","archive","package","packageSpecs","outputDir","options","runVerifiableBuildFromArchive","path","resolve","cwd","packages","map","parsePackageSpec","output","include","exclude","packageSource"],"mappings":";;;;;;;;AAUA,IAAMA,kBAAAA,GAAqB,YAAA;AAE3B,IAAMC,OAAAA,GAAiC;AAAEC,EAAAA,KAAAA;AAAOC,EAAAA,MAAAA;AAAQC,EAAAA;AAAoB,CAAA;AAE5E,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,KAAAA,EAAeC,QAAAA,KAAiC;AAAIA,EAAAA,GAAAA,QAAAA;AAAUD,EAAAA;AAA/D,CAAA,EAAA,qBAAA,CAAA;AAErB,IAAME,uBAAO,MAAA,CAAA,MAChBC,MAAAA,CAAOR,OAAAA,EAAS,CAACS,SAASC,kBAAAA,KAAAA;AACtBD,EAAAA,OAAAA,CACKE,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,+EAAA,CAAA,CAEHC,MAAAA,CAAO,YAAYC,aAAAA,CAAcd,OAAAA,EAAS,MAAMU,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAIxE,EAAA,MAAMM,QAAQN,OAAAA,CAAQE,OAAAA,CAAQ,OAAA,CAAA,CAASC,YAAY,+BAAA,CAAA;AACnD,EAAA,MAAMI,OAAAA,GAAUD,KAAAA,CAAMJ,OAAAA,CAAQ,SAAA,CAAA;AAE9BK,EAAAA,OAAAA,CACKL,QAAQ,kBAAA,CAAA,CACRC,WAAAA,CACG,8NAEI,EAEPK,cAAAA,CACG,6BAAA,EACA,sEAAA,CAAA,CAEHC,OACG,0BAAA,EACA,sHACI,EAEPD,cAAAA,CACG,kBAAA,EACA,4DAAA,CAAA,CAEHC,MAAAA,CACG,2BAAA,EACA,iFAAA,EACAd,qBACA,EAAE,EAELc,MAAAA,CACG,qBAAA,EACA,iDACAnB,kBAAAA,CAAAA,CAEHc,MAAAA,CACG,OAAO,EACHM,cAAAA,EACAC,WAAAA,EACAC,SACAC,OAAAA,EAASC,YAAAA,EACTC,WAAS,KAOZ;AACG,IAAA,MAAMC,OAAAA,GAAU,MAAMf,kBAAAA,CAAmBD,OAAAA,CAAAA;AACzC,IAAA,MAAMiB,6BAAAA,CACF;AACIL,MAAAA,OAAAA,EAASM,IAAAA,CAAKC,OAAAA,CAAQH,OAAAA,CAAQI,GAAAA,EAAKR,OAAAA,CAAAA;MACnCS,QAAAA,EAAUP,YAAAA,CAAaQ,IAAIC,gBAAAA,CAAAA;AAC3BR,MAAAA,SAAAA,EAAWG,IAAAA,CAAKC,OAAAA,CAAQH,OAAAA,CAAQI,GAAAA,EAAKL,SAAAA,CAAAA;AACrCL,MAAAA,cAAAA;AACAC,MAAAA;KACJ,EACA;AAAES,MAAAA,GAAAA,EAAKJ,OAAAA,CAAQI;KAAI,CAAA;EAE3B,CAAA,CAAA;AAGRb,EAAAA,OAAAA,CACKL,OAAAA,CAAQ,gBAAA,CAAA,CACRC,WAAAA,CACG,gYAII,CAAA,CAEPM,MAAAA,CACG,iBAAA,EACA,oEAAA,CAAA,CAEHA,MAAAA,CACG,wBAAA,EACA,2EAAA,EACA,EAAE,CAAA,CAELA,MAAAA,CACG,wBAAA,EACA,sFAAA,EACA,EAAE,CAAA,CAELL,MAAAA,CACG,OAAO,EACHoB,MAAAA,EACAC,OAAAA,EACAC,OAAAA,OAMAC,aAAAA,CAAc;AAAEH,IAAAA,MAAAA;AAAQC,IAAAA,OAAAA;AAASC,IAAAA;AAAQ,GAAA,EAAG,MAAMzB,kBAAAA,CAAmBD,OAAAA,CAAAA,CAAAA,CAAAA;AAErF,CAAA,CAAA,EA5GgB,MAAA","file":"index.js","sourcesContent":["import path from 'node:path';\n\nimport type { ChainContext } from '@layerzerolabs/vm-tooling';\nimport { runCli } from '@layerzerolabs/vm-tooling';\n\nimport { packageSource } from './commands/package-source';\nimport { syncToolchain } from './commands/sync-toolchain';\nimport { parsePackageSpec, runVerifiableBuildFromArchive } from './commands/verifiable-build';\nimport { type ImageId, images, tools, versionCombinations } from './config';\n\nconst DEFAULT_OUTPUT_DIR = '.artifacts';\n\nconst context: ChainContext<ImageId> = { tools, images, versionCombinations };\n\nconst collectPackageSpecs = (value: string, previous: string[]): string[] => [...previous, value];\n\nexport const main = (): Promise<void> =>\n    runCli(context, (program, parseGlobalOptions) => {\n        program\n            .command('sync-toolchain')\n            .description(\n                'Pre-download the Rust toolchain specified in rust-toolchain.toml under a lock',\n            )\n            .action(async () => syncToolchain(context, await parseGlobalOptions(program)));\n\n        // Extra (non-passthrough) commands, namespaced under `extra <tool>` like vm-tooling-sui:\n        //   lz-tool extra stellar verifiable-build [options]\n        const extra = program.command('extra').description('Extra commands for VM tooling');\n        const stellar = extra.command('stellar');\n\n        stellar\n            .command('verifiable-build')\n            .description(\n                'Build one or more Stellar contracts reproducibly from a source archive: ' +\n                    'extract → hash → build each --package in the official stellar/stellar-cli ' +\n                    'image → atomically publish contracts-source.zip and *.wasm.',\n            )\n            .requiredOption(\n                '--stellar-version <version>',\n                'Stellar CLI version of the official reproducible image (e.g. 25.1.0)',\n            )\n            .option(\n                '--rust-version <version>',\n                'Rust version of the official reproducible image (e.g. 1.90.0); defaults to ' +\n                    \"the archive's rust-toolchain.toml channel\",\n            )\n            .requiredOption(\n                '--archive <path>',\n                'Self-contained source .zip for the SEP-58 verifiable build',\n            )\n            .option(\n                '--package <name:manifest>',\n                'Package to build as <name>:<manifest-path> (repeatable; required at least once)',\n                collectPackageSpecs,\n                [] as string[],\n            )\n            .option(\n                '--output-dir <path>',\n                'Directory for contracts-source.zip and *.wasm',\n                DEFAULT_OUTPUT_DIR,\n            )\n            .action(\n                async ({\n                    stellarVersion,\n                    rustVersion,\n                    archive,\n                    package: packageSpecs,\n                    outputDir,\n                }: {\n                    stellarVersion: string;\n                    rustVersion?: string;\n                    archive: string;\n                    package: string[];\n                    outputDir: string;\n                }) => {\n                    const options = await parseGlobalOptions(program);\n                    await runVerifiableBuildFromArchive(\n                        {\n                            archive: path.resolve(options.cwd, archive),\n                            packages: packageSpecs.map(parsePackageSpec),\n                            outputDir: path.resolve(options.cwd, outputDir),\n                            stellarVersion,\n                            rustVersion,\n                        },\n                        { cwd: options.cwd },\n                    );\n                },\n            );\n\n        stellar\n            .command('package-source')\n            .description(\n                'Package the self-contained crate in the cwd into a byte-deterministic source ' +\n                    '.zip under .artifacts/ (for the SEP-58 verifiable build) and print its ' +\n                    'source_sha256. Include-only: packages source files (.rs/.lock, Cargo.toml, ' +\n                    'rust-toolchain.toml, rustfmt.toml, clippy.toml) plus any --include entries; ' +\n                    '--exclude always wins. Skips non-source directories (target, node_modules, …).',\n            )\n            .option(\n                '--output <path>',\n                'Output .zip path (default: <cwd>/.artifacts/<basename>-source.zip)',\n            )\n            .option(\n                '--include <pattern...>',\n                'Native Node glob patterns to include beyond the default source extensions',\n                [],\n            )\n            .option(\n                '--exclude <pattern...>',\n                'Native Node glob patterns to exclude (always wins over the allow-list and --include)',\n                [],\n            )\n            .action(\n                async ({\n                    output,\n                    include,\n                    exclude,\n                }: {\n                    output?: string;\n                    include?: string[];\n                    exclude?: string[];\n                }) =>\n                    packageSource({ output, include, exclude }, await parseGlobalOptions(program)),\n            );\n    });\n"]}

package/package.json

@@ -19,19 +19,19 @@
     "bin/**/*"
   ],
   "dependencies": {
+    "fflate": "^0.8.3",
     "toml": "^3.0.0",
-    "@layerzerolabs/deterministic-zip": "1.2.9",
-    "@layerzerolabs/vm-tooling": "1.2.9"
+    "@layerzerolabs/vm-tooling": "1.2.10",
+    "@layerzerolabs/deterministic-zip": "1.2.10"
   },
   "devDependencies": {
-    "fflate": "^0.8.3",
     "tsup": "^8.4.0",
     "tsx": "^4.21.0",
     "typescript": "^5.8.2",
     "vitest": "^3.2.6",
-    "@layerzerolabs/tsup-configuration": "1.2.9",
-    "@layerzerolabs/typescript-configuration": "1.2.9",
-    "@layerzerolabs/vitest-configuration": "1.2.9"
+    "@layerzerolabs/tsup-configuration": "1.2.10",
+    "@layerzerolabs/vitest-configuration": "1.2.10",
+    "@layerzerolabs/typescript-configuration": "1.2.10"
   },
   "publishConfig": {
     "access": "public",
@@ -45,7 +45,7 @@
       "onesig-client"
     ]
   },
-  "version": "1.2.9",
+  "version": "1.2.10",
   "scripts": {
     "build": "tsup",
     "generate-github-matrix": "tsx src/scripts/generate-github-matrix.ts",

package/dist/WMMRXU3O.js

@@ -1,151 +0,0 @@
-import { __name } from './VUOMXK5T.js';
-import { execFile, spawn } from 'child_process';
-import { stat, chmod } from 'fs/promises';
-import path from 'path';
-import { promisify } from 'util';
-
-var execFileAsync = promisify(execFile);
-var SOURCE_MOUNT = "/source";
-var VERIFIABLE_BUILD_PLATFORM = "linux/amd64";
-var OFFICIAL_IMAGE_REPO = "stellar/stellar-cli";
-var officialImageTagRef = /* @__PURE__ */ __name((stellarVersion, rustVersion) => `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`, "officialImageTagRef");
-var parseAmd64Digest = /* @__PURE__ */ __name((manifestInspectJson) => {
-  const { manifests } = JSON.parse(manifestInspectJson);
-  if (!Array.isArray(manifests)) {
-    throw new Error("`docker manifest inspect` did not return a multi-arch index (no `manifests` array)");
-  }
-  const digest = manifests.find(({ platform }) => platform?.os === "linux" && platform?.architecture === "amd64")?.digest;
-  if (typeof digest !== "string" || !digest.startsWith("sha256:")) {
-    throw new Error("No linux/amd64 manifest digest found in `docker manifest inspect` output");
-  }
-  return digest;
-}, "parseAmd64Digest");
-var resolveAmd64Digest = /* @__PURE__ */ __name(async (imageTagRef) => {
-  try {
-    const { stdout } = await execFileAsync("docker", [
-      "manifest",
-      "inspect",
-      imageTagRef
-    ], {
-      maxBuffer: 16 * 1024 * 1024,
-      timeout: 3e4
-    });
-    return parseAmd64Digest(stdout);
-  } catch (cause) {
-    throw new Error(`Failed to resolve the linux/amd64 digest of ${imageTagRef} (\`docker manifest inspect\`)`, {
-      cause
-    });
-  }
-}, "resolveAmd64Digest");
-var META_FLAG = "--meta";
-var metaKey = /* @__PURE__ */ __name((entry) => {
-  const eq = entry.indexOf("=");
-  return eq === -1 ? entry : entry.slice(0, eq);
-}, "metaKey");
-var canonicalizeMetaArgs = /* @__PURE__ */ __name((buildArgs, injectedMeta) => {
-  const reservedKeys = new Set(injectedMeta.map(metaKey));
-  const metas = [
-    ...injectedMeta
-  ];
-  const passthrough = [];
-  const addCallerMeta = /* @__PURE__ */ __name((value) => {
-    if (!reservedKeys.has(metaKey(value))) metas.push(value);
-  }, "addCallerMeta");
-  for (let i = 0; i < buildArgs.length; i++) {
-    const arg = buildArgs[i];
-    if (arg === void 0) continue;
-    if (arg === META_FLAG) {
-      const value = buildArgs[i + 1];
-      if (value !== void 0 && !value.startsWith("--")) {
-        addCallerMeta(value);
-        i += 1;
-      }
-    } else if (arg.startsWith(`${META_FLAG}=`)) {
-      addCallerMeta(arg.slice(META_FLAG.length + 1));
-    } else {
-      passthrough.push(arg);
-    }
-  }
-  metas.sort();
-  return [
-    ...passthrough,
-    ...metas.flatMap((meta) => [
-      META_FLAG,
-      meta
-    ])
-  ];
-}, "canonicalizeMetaArgs");
-var buildVerifiableBuildDockerArgs = /* @__PURE__ */ __name(({ imageRef, sourceDir, buildArgs, bldimg }) => [
-  "run",
-  "--rm",
-  "--platform",
-  VERIFIABLE_BUILD_PLATFORM,
-  "-v",
-  `${sourceDir}:${SOURCE_MOUNT}`,
-  "-w",
-  SOURCE_MOUNT,
-  imageRef,
-  "contract",
-  "build",
-  // `bldimg` is injected by us (not the caller): the exact build image, so the WASM records what
-  // produced it. It joins the caller's --meta flags in the canonical sorted order.
-  ...canonicalizeMetaArgs(buildArgs, [
-    `bldimg=${bldimg}`
-  ])
-], "buildVerifiableBuildDockerArgs");
-var resolveBuildDir = /* @__PURE__ */ __name((cwd, sourceDir) => path.resolve(cwd, sourceDir ?? "."), "resolveBuildDir");
-var runDocker = /* @__PURE__ */ __name((dockerArgs) => new Promise((resolve, reject) => {
-  const child = spawn("docker", dockerArgs, {
-    stdio: "inherit"
-  });
-  child.on("error", (error) => reject(new Error("Failed to spawn docker for the verifiable build", {
-    cause: error
-  })));
-  child.on("close", (code, signal) => {
-    if (code === 0) {
-      resolve();
-    } else {
-      reject(new Error(`Verifiable build failed: docker exited with ${signal ? `signal ${signal}` : `code ${code}`}`));
-    }
-  });
-}), "runDocker");
-var VerifiableBuildWrapper = class {
-  static {
-    __name(this, "VerifiableBuildWrapper");
-  }
-  async run(args, { stellarVersion, rustVersion }, options, sourceDir) {
-    const buildDir = resolveBuildDir(options.cwd, sourceDir);
-    try {
-      if (!(await stat(buildDir)).isDirectory()) {
-        throw new Error("not a directory");
-      }
-    } catch (cause) {
-      throw new Error(`Verifiable build source directory is not an existing directory: ${buildDir}`, {
-        cause
-      });
-    }
-    if (sourceDir !== void 0) {
-      await chmod(buildDir, 511);
-    }
-    const tagRef = officialImageTagRef(stellarVersion, rustVersion);
-    const digest = await resolveAmd64Digest(tagRef);
-    const imageRef = `${OFFICIAL_IMAGE_REPO}@${digest}`;
-    const bldimg = `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`;
-    const dockerArgs = buildVerifiableBuildDockerArgs({
-      imageRef,
-      sourceDir: buildDir,
-      buildArgs: args,
-      bldimg
-    });
-    console.info("\u{1F512} Verifiable build (official stellar/stellar-cli image, run from host)");
-    console.info(`   source: ${buildDir}`);
-    console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);
-    console.info(`   bldimg: ${bldimg}`);
-    console.info(`   docker ${dockerArgs.join(" ")}`);
-    await runDocker(dockerArgs);
-  }
-};
-
-export { VerifiableBuildWrapper, buildVerifiableBuildDockerArgs, canonicalizeMetaArgs, officialImageTagRef, parseAmd64Digest, resolveBuildDir };
-//# sourceMappingURL=WMMRXU3O.js.map
-//# sourceMappingURL=WMMRXU3O.js.map

package/dist/WMMRXU3O.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/verifiable-build.ts"],"names":["execFileAsync","promisify","execFile","SOURCE_MOUNT","VERIFIABLE_BUILD_PLATFORM","OFFICIAL_IMAGE_REPO","officialImageTagRef","stellarVersion","rustVersion","parseAmd64Digest","manifestInspectJson","manifests","JSON","parse","Array","isArray","Error","digest","find","platform","os","architecture","startsWith","resolveAmd64Digest","imageTagRef","stdout","maxBuffer","timeout","cause","META_FLAG","metaKey","entry","eq","indexOf","slice","canonicalizeMetaArgs","buildArgs","injectedMeta","reservedKeys","Set","map","metas","passthrough","addCallerMeta","value","has","push","i","length","arg","undefined","sort","flatMap","meta","buildVerifiableBuildDockerArgs","imageRef","sourceDir","bldimg","resolveBuildDir","cwd","path","resolve","runDocker","dockerArgs","Promise","reject","child","spawn","stdio","on","error","code","signal","VerifiableBuildWrapper","run","args","options","buildDir","stat","isDirectory","chmod","tagRef","console","info","join"],"mappings":";;;;;;AAOA,IAAMA,aAAAA,GAAgBC,UAAUC,QAAAA,CAAAA;AAIhC,IAAMC,YAAAA,GAAe,SAAA;AAIrB,IAAMC,yBAAAA,GAA4B,aAAA;AAElC,IAAMC,mBAAAA,GAAsB,qBAAA;AAOrB,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACC,cAAAA,EAAwBC,WAAAA,KACxD,CAAA,EAAGH,mBAAAA,CAAAA,CAAAA,EAAuBE,cAAAA,CAAAA,KAAAA,EAAsBC,WAAAA,CAAAA,cAAAA,CAAAA,EADjB,qBAAA;AAgB5B,IAAMC,gBAAAA,2BAAoBC,mBAAAA,KAAAA;AAC7B,EAAA,MAAM,EAAEC,SAAAA,EAAS,GAAKC,IAAAA,CAAKC,MAAMH,mBAAAA,CAAAA;AAEjC,EAAA,IAAI,CAACI,KAAAA,CAAMC,OAAAA,CAAQJ,SAAAA,CAAAA,EAAY;AAC3B,IAAA,MAAM,IAAIK,MACN,oFAAA,CAAA;AAER,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,SAAAA,CAAUO,IAAAA,CACrB,CAAC,EAAEC,QAAAA,EAAQ,KAAOA,QAAAA,EAAUC,EAAAA,KAAO,OAAA,IAAWD,QAAAA,EAAUE,YAAAA,KAAiB,OAAA,CAAA,EAC1EJ,MAAAA;AAEH,EAAA,IAAI,OAAOA,MAAAA,KAAW,QAAA,IAAY,CAACA,MAAAA,CAAOK,UAAAA,CAAW,SAAA,CAAA,EAAY;AAC7D,IAAA,MAAM,IAAIN,MAAM,0EAAA,CAAA;AACpB,EAAA;AAEA,EAAA,OAAOC,MAAAA;AACX,CAAA,EAlBgC,kBAAA;AAyBhC,IAAMM,kBAAAA,iCAA4BC,WAAAA,KAAAA;AAC9B,EAAA,IAAI;AACA,IAAA,MAAM,EAAEC,MAAAA,EAAM,GAAK,MAAMzB,cAAc,QAAA,EAAU;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAWwB,MAAAA;AAAc,KAAA,EAAA;AACnFE,MAAAA,SAAAA,EAAW,KAAK,IAAA,GAAO,IAAA;MACvBC,OAAAA,EAAS;KACb,CAAA;AACA,IAAA,OAAOlB,iBAAiBgB,MAAAA,CAAAA;AAC5B,EAAA,CAAA,CAAA,OAASG,KAAAA,EAAO;AACZ,IAAA,MAAM,IAAIZ,KAAAA,CACN,CAAA,4CAAA,EAA+CQ,WAAAA,CAAAA,8BAAAA,CAAAA,EAC/C;AAAEI,MAAAA;KAAM,CAAA;AAEhB,EAAA;AACJ,CAAA,EAb2B,oBAAA,CAAA;AAe3B,IAAMC,SAAAA,GAAY,QAAA;AAGlB,IAAMC,OAAAA,2BAAWC,KAAAA,KAAAA;AACb,EAAA,MAAMC,EAAAA,GAAKD,KAAAA,CAAME,OAAAA,CAAQ,GAAA,CAAA;AACzB,EAAA,OAAOD,OAAO,EAAA,GAAKD,KAAAA,GAAQA,KAAAA,CAAMG,KAAAA,CAAM,GAAGF,EAAAA,CAAAA;AAC9C,CAAA,EAHgB,SAAA,CAAA;AAqBT,IAAMG,oBAAAA,mBAAuB,MAAA,CAAA,CAACC,SAAAA,EAAqBC,YAAAA,KAAAA;AACtD,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIF,YAAAA,CAAaG,GAAAA,CAAIV,OAAAA,CAAAA,CAAAA;AAC9C,EAAA,MAAMW,KAAAA,GAAQ;AAAIJ,IAAAA,GAAAA;;AAClB,EAAA,MAAMK,cAAwB,EAAA;AAG9B,EAAA,MAAMC,aAAAA,2BAAiBC,KAAAA,KAAAA;AACnB,IAAA,IAAI,CAACN,aAAaO,GAAAA,CAAIf,OAAAA,CAAQc,KAAAA,CAAAA,CAAAA,EAASH,KAAAA,CAAMK,IAAAA,CAAKF,KAAAA,CAAAA;EACtD,CAAA,EAFsB,eAAA,CAAA;AAItB,EAAA,KAAA,IAASG,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAIX,SAAAA,CAAUY,QAAQD,CAAAA,EAAAA,EAAK;AACvC,IAAA,MAAME,GAAAA,GAAMb,UAAUW,CAAAA,CAAAA;AACtB,IAAA,IAAIE,QAAQC,MAAAA,EAAW;AACvB,IAAA,IAAID,QAAQpB,SAAAA,EAAW;AACnB,MAAA,MAAMe,KAAAA,GAAQR,SAAAA,CAAUW,CAAAA,GAAI,CAAA,CAAA;AAG5B,MAAA,IAAIH,UAAUM,MAAAA,IAAa,CAACN,KAAAA,CAAMtB,UAAAA,CAAW,IAAA,CAAA,EAAO;AAChDqB,QAAAA,aAAAA,CAAcC,KAAAA,CAAAA;AACdG,QAAAA,CAAAA,IAAK,CAAA;AACT,MAAA;AACJ,IAAA,CAAA,MAAA,IAAWE,GAAAA,CAAI3B,UAAAA,CAAW,CAAA,EAAGO,SAAAA,GAAY,CAAA,EAAG;AACxCc,MAAAA,aAAAA,CAAcM,GAAAA,CAAIf,KAAAA,CAAML,SAAAA,CAAUmB,MAAAA,GAAS,CAAA,CAAA,CAAA;IAC/C,CAAA,MAAO;AACHN,MAAAA,WAAAA,CAAYI,KAAKG,GAAAA,CAAAA;AACrB,IAAA;AACJ,EAAA;AAEAR,EAAAA,KAAAA,CAAMU,IAAAA,EAAI;AACV,EAAA,OAAO;AAAIT,IAAAA,GAAAA,WAAAA;OAAgBD,KAAAA,CAAMW,OAAAA,CAAQ,CAACC,IAAAA,KAAS;AAACxB,MAAAA,SAAAA;AAAWwB,MAAAA;AAAK,KAAA;;AACxE,CAAA,EA9BoC,sBAAA;AAyC7B,IAAMC,iDAAiC,MAAA,CAAA,CAAC,EAC3CC,UACAC,SAAAA,EACApB,SAAAA,EACAqB,QAAM,KAMM;AACZ,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACArD,EAAAA,yBAAAA;AACA,EAAA,IAAA;EACA,CAAA,EAAGoD,SAAAA,IAAarD,YAAAA,CAAAA,CAAAA;AAChB,EAAA,IAAA;AACAA,EAAAA,YAAAA;AACAoD,EAAAA,QAAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;;;AAGGpB,EAAAA,GAAAA,oBAAAA,CAAqBC,SAAAA,EAAW;AAAC,IAAA,CAAA,OAAA,EAAUqB,MAAAA,CAAAA;AAAS,GAAA;AAxBb,CAAA,EAAA,gCAAA;AAmCvC,IAAMC,eAAAA,2BAAmBC,GAAAA,EAAaH,SAAAA,KACzCI,KAAKC,OAAAA,CAAQF,GAAAA,EAAKH,SAAAA,IAAa,GAAA,CAAA,EADJ,iBAAA;AAG/B,IAAMM,4BAAY,MAAA,CAAA,CAACC,UAAAA,KACf,IAAIC,OAAAA,CAAQ,CAACH,SAASI,MAAAA,KAAAA;AAClB,EAAA,MAAMC,KAAAA,GAAQC,KAAAA,CAAM,QAAA,EAAUJ,UAAAA,EAAY;IAAEK,KAAAA,EAAO;GAAU,CAAA;AAC7DF,EAAAA,KAAAA,CAAMG,GAAG,OAAA,EAAS,CAACC,UACfL,MAAAA,CAAO,IAAIjD,MAAM,iDAAA,EAAmD;IAAEY,KAAAA,EAAO0C;AAAM,GAAA,CAAA,CAAA,CAAA;AAEvFJ,EAAAA,KAAAA,CAAMG,EAAAA,CAAG,OAAA,EAAS,CAACE,IAAAA,EAAMC,MAAAA,KAAAA;AACrB,IAAA,IAAID,SAAS,CAAA,EAAG;AACZV,MAAAA,OAAAA,EAAAA;IACJ,CAAA,MAAO;AACHI,MAAAA,MAAAA,CACI,IAAIjD,KAAAA,CACA,CAAA,4CAAA,EACIwD,MAAAA,GAAS,CAAA,OAAA,EAAUA,MAAAA,CAAAA,CAAAA,GAAW,CAAA,KAAA,EAAQD,IAAAA,CAAAA,CAAM,CAAA,CAC9C,CAAA,CAAA;AAGd,IAAA;EACJ,CAAA,CAAA;AACJ,CAAA,CAAA,EAnBc,WAAA,CAAA;AA4CX,IAAME,yBAAN,MAAMA;EAnOb;;;AAoOI,EAAA,MAAaC,IACTC,IAAAA,EACA,EAAEpE,gBAAgBC,WAAAA,EAAW,EAC7BoE,SACApB,SAAAA,EACa;AACb,IAAA,MAAMqB,QAAAA,GAAWnB,eAAAA,CAAgBkB,OAAAA,CAAQjB,GAAAA,EAAKH,SAAAA,CAAAA;AAC9C,IAAA,IAAI;AACA,MAAA,IAAI,EAAE,MAAMsB,IAAAA,CAAKD,QAAAA,CAAAA,EAAWE,aAAW,EAAI;AACvC,QAAA,MAAM,IAAI/D,MAAM,iBAAA,CAAA;AACpB,MAAA;AACJ,IAAA,CAAA,CAAA,OAASY,KAAAA,EAAO;AACZ,MAAA,MAAM,IAAIZ,KAAAA,CACN,CAAA,gEAAA,EAAmE6D,QAAAA,CAAAA,CAAAA,EACnE;AAAEjD,QAAAA;OAAM,CAAA;AAEhB,IAAA;AAMA,IAAA,IAAI4B,cAAcN,MAAAA,EAAW;AACzB,MAAA,MAAM8B,KAAAA,CAAMH,UAAU,GAAA,CAAA;AAC1B,IAAA;AAEA,IAAA,MAAMI,MAAAA,GAAS3E,mBAAAA,CAAoBC,cAAAA,EAAgBC,WAAAA,CAAAA;AACnD,IAAA,MAAMS,MAAAA,GAAS,MAAMM,kBAAAA,CAAmB0D,MAAAA,CAAAA;AACxC,IAAA,MAAM1B,QAAAA,GAAW,CAAA,EAAGlD,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAC3C,IAAA,MAAMwC,MAAAA,GAAS,CAAA,UAAA,EAAapD,mBAAAA,CAAAA,CAAAA,EAAuBY,MAAAA,CAAAA,CAAAA;AAEnD,IAAA,MAAM8C,aAAaT,8BAAAA,CAA+B;AAC9CC,MAAAA,QAAAA;MACAC,SAAAA,EAAWqB,QAAAA;MACXzC,SAAAA,EAAWuC,IAAAA;AACXlB,MAAAA;KACJ,CAAA;AAEAyB,IAAAA,OAAAA,CAAQC,KAAK,gFAAA,CAAA;AACbD,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAcN,QAAAA,CAAAA,CAAU,CAAA;AACrCK,IAAAA,OAAAA,CAAQC,KAAK,CAAA,WAAA,EAAc5B,QAAAA,KAAanD,yBAAAA,CAAAA,WAAAA,EAAuC6E,MAAAA,CAAAA,CAAAA,CAAS,CAAA;AACxFC,IAAAA,OAAAA,CAAQC,IAAAA,CAAK,CAAA,WAAA,EAAc1B,MAAAA,CAAAA,CAAQ,CAAA;AACnCyB,IAAAA,OAAAA,CAAQC,KAAK,CAAA,UAAA,EAAapB,UAAAA,CAAWqB,IAAAA,CAAK,GAAA,CAAA,CAAA,CAAM,CAAA;AAEhD,IAAA,MAAMtB,UAAUC,UAAAA,CAAAA;AACpB,EAAA;AACJ","file":"WMMRXU3O.js","sourcesContent":["import { execFile, spawn } from 'node:child_process';\nimport { chmod, stat } from 'node:fs/promises';\nimport path from 'node:path';\nimport { promisify } from 'node:util';\n\nimport type { ToolCommandExecutionOptions } from '@layerzerolabs/vm-tooling';\n\nconst execFileAsync = promisify(execFile);\n\n// The self-contained source is mounted here and built in place. The official image's WORKDIR is\n// already /source; we set it explicitly for clarity.\nconst SOURCE_MOUNT = '/source';\n\n// Canonical reproducible platform. External verifiers reproduce the amd64 artifact, so we always\n// run the amd64 image regardless of the host arch (the daemon emulates it when needed).\nconst VERIFIABLE_BUILD_PLATFORM = 'linux/amd64';\n\nconst OFFICIAL_IMAGE_REPO = 'stellar/stellar-cli';\n\n/**\n * The official reproducible image reference for a (Stellar CLI, Rust) version pair, e.g.\n * `stellar/stellar-cli:25.1.0-rust1.90.0-slim-bookworm`. The caller pins both versions; this is the\n * only image the tool builds against.\n */\nexport const officialImageTagRef = (stellarVersion: string, rustVersion: string): string =>\n    `${OFFICIAL_IMAGE_REPO}:${stellarVersion}-rust${rustVersion}-slim-bookworm`;\n\n/**\n * Pick the linux/amd64 manifest digest out of `docker manifest inspect` output. Pure/synchronous so\n * the selection (skip the arm64 and the unknown/unknown attestation entries) is unit-testable.\n */\n// The subset of `docker manifest inspect` output (an OCI image index) that we read.\ninterface ManifestDescriptor {\n    digest?: string;\n    platform?: { os?: string; architecture?: string };\n}\ninterface ManifestIndex {\n    manifests?: ManifestDescriptor[];\n}\n\nexport const parseAmd64Digest = (manifestInspectJson: string): string => {\n    const { manifests } = JSON.parse(manifestInspectJson) as ManifestIndex;\n\n    if (!Array.isArray(manifests)) {\n        throw new Error(\n            '`docker manifest inspect` did not return a multi-arch index (no `manifests` array)',\n        );\n    }\n\n    const digest = manifests.find(\n        ({ platform }) => platform?.os === 'linux' && platform?.architecture === 'amd64',\n    )?.digest;\n\n    if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {\n        throw new Error('No linux/amd64 manifest digest found in `docker manifest inspect` output');\n    }\n\n    return digest;\n};\n\n/**\n * Resolve the immutable linux/amd64 digest of a `stellar/stellar-cli` tag via a daemon-less\n * registry query (`docker manifest inspect`). This is the reproducible reference an external\n * verifier pins to (SEP-58).\n */\nconst resolveAmd64Digest = async (imageTagRef: string): Promise<string> => {\n    try {\n        const { stdout } = await execFileAsync('docker', ['manifest', 'inspect', imageTagRef], {\n            maxBuffer: 16 * 1024 * 1024,\n            timeout: 30_000,\n        });\n        return parseAmd64Digest(stdout);\n    } catch (cause) {\n        throw new Error(\n            `Failed to resolve the linux/amd64 digest of ${imageTagRef} (\\`docker manifest inspect\\`)`,\n            { cause },\n        );\n    }\n};\n\nconst META_FLAG = '--meta';\n\n/** The `key` of a `key=value` meta entry (the whole string when there is no `=`). */\nconst metaKey = (entry: string): string => {\n    const eq = entry.indexOf('=');\n    return eq === -1 ? entry : entry.slice(0, eq);\n};\n\n/**\n * Canonicalize `stellar contract build` args so the embedded metadata order is stable.\n *\n * Soroban stores contract metadata as an ORDERED sequence, so the order of `--meta key=value`\n * flags changes the WASM bytes (verified: swapping two `--meta` flags yields a different WASM\n * hash). To keep the build reproducible regardless of the order the caller passed `--meta`, every\n * meta entry — the caller's plus the tool-injected ones — is pulled out, merged, and re-emitted in\n * sorted order. Non-meta args keep their original relative order and precede the sorted metas.\n *\n * Injected keys (e.g. `bldimg`) are tool-controlled and RESERVED: any caller `--meta` reusing an\n * injected key is dropped, so a caller can never override the recorded build image by key\n * collision (before sorting, the injected entry was always appended last and won on its own).\n *\n * Both `--meta k=v` and `--meta=k=v` forms are recognized; a dangling `--meta` with no value (or\n * one followed by another flag) is dropped.\n */\nexport const canonicalizeMetaArgs = (buildArgs: string[], injectedMeta: string[]): string[] => {\n    const reservedKeys = new Set(injectedMeta.map(metaKey));\n    const metas = [...injectedMeta];\n    const passthrough: string[] = [];\n\n    // Keep a caller meta unless it collides with a reserved (injected) key.\n    const addCallerMeta = (value: string): void => {\n        if (!reservedKeys.has(metaKey(value))) metas.push(value);\n    };\n\n    for (let i = 0; i < buildArgs.length; i++) {\n        const arg = buildArgs[i];\n        if (arg === undefined) continue;\n        if (arg === META_FLAG) {\n            const value = buildArgs[i + 1];\n            // A meta value is `key=value`; anything starting with `--` is the next flag, so treat\n            // this `--meta` as dangling and drop it.\n            if (value !== undefined && !value.startsWith('--')) {\n                addCallerMeta(value);\n                i += 1;\n            }\n        } else if (arg.startsWith(`${META_FLAG}=`)) {\n            addCallerMeta(arg.slice(META_FLAG.length + 1));\n        } else {\n            passthrough.push(arg);\n        }\n    }\n\n    metas.sort();\n    return [...passthrough, ...metas.flatMap((meta) => [META_FLAG, meta])];\n};\n\n/**\n * Assemble the `docker run` argv for a verifiable build. Kept pure and synchronous so the mount /\n * workdir layout and the tool-injected `--meta bldimg=…` are unit-testable without Docker.\n *\n * The official image's ENTRYPOINT is `stellar`, so the trailing `contract build …` runs under it.\n * The source directory is assumed self-contained, so it is mounted at /source and built in place —\n * no surrounding workspace is required. All `--meta` flags (the caller's plus the injected\n * `bldimg`) are sorted into a canonical order so the WASM hash is independent of `--meta` ordering.\n */\nexport const buildVerifiableBuildDockerArgs = ({\n    imageRef,\n    sourceDir,\n    buildArgs,\n    bldimg,\n}: {\n    imageRef: string;\n    sourceDir: string;\n    buildArgs: string[];\n    bldimg: string;\n}): string[] => [\n    'run',\n    '--rm',\n    '--platform',\n    VERIFIABLE_BUILD_PLATFORM,\n    '-v',\n    `${sourceDir}:${SOURCE_MOUNT}`,\n    '-w',\n    SOURCE_MOUNT,\n    imageRef,\n    'contract',\n    'build',\n    // `bldimg` is injected by us (not the caller): the exact build image, so the WASM records what\n    // produced it. It joins the caller's --meta flags in the canonical sorted order.\n    ...canonicalizeMetaArgs(buildArgs, [`bldimg=${bldimg}`]),\n];\n\n/**\n * Resolve the directory to build. An explicit `sourceDir` that is relative resolves against the\n * cwd; an absolute one is used as-is; omitting it falls back to the cwd. Kept pure/synchronous so\n * the cwd-vs-explicit-folder precedence is unit-testable without Docker.\n *\n * This is what lets the pipeline decompress a packaged source archive into a scratch directory and\n * build that, instead of always building the process cwd.\n */\nexport const resolveBuildDir = (cwd: string, sourceDir?: string): string =>\n    path.resolve(cwd, sourceDir ?? '.');\n\nconst runDocker = (dockerArgs: string[]): Promise<void> =>\n    new Promise((resolve, reject) => {\n        const child = spawn('docker', dockerArgs, { stdio: 'inherit' });\n        child.on('error', (error) =>\n            reject(new Error('Failed to spawn docker for the verifiable build', { cause: error })),\n        );\n        child.on('close', (code, signal) => {\n            if (code === 0) {\n                resolve();\n            } else {\n                reject(\n                    new Error(\n                        `Verifiable build failed: docker exited with ${\n                            signal ? `signal ${signal}` : `code ${code}`\n                        }`,\n                    ),\n                );\n            }\n        });\n    });\n\nexport interface VerifiableBuildVersions {\n    stellarVersion: string;\n    rustVersion: string;\n}\n\n/**\n * Reproducible `stellar contract build` that runs inside the OFFICIAL `stellar/stellar-cli` image —\n * the exact package an external verifier uses — instead of our own dev image (whose sccache/mold\n * layers could change the WASM).\n *\n * The build runs the official image directly from the HOST: our TypeScript CLI already executes on\n * the host runner, so it can `docker run` the official image itself. This is what an external\n * verifier's plain `docker run` does, and it means we never bind-mount the host Docker socket into\n * a container — eliminating the container-escape / secret-leak surface that mounting the socket\n * would create.\n *\n * The image is `stellar/stellar-cli:<stellarVersion>-rust<rustVersion>-slim-bookworm`, pinned by the\n * caller. For a stable reference we resolve it to its linux/amd64 digest and both RUN that digest\n * and embed it as the `bldimg` WASM metadata (`docker.io/stellar/stellar-cli@sha256:…`) — the tool\n * does this automatically so callers never hand-inject `--meta bldimg=…`. The source directory (the\n * cwd, assumed self-contained) is mounted at /source and built in place, and the official image runs\n * as its own user/toolchain.\n */\nexport class VerifiableBuildWrapper {\n    public async run(\n        args: string[],\n        { stellarVersion, rustVersion }: VerifiableBuildVersions,\n        options: ToolCommandExecutionOptions,\n        sourceDir?: string,\n    ): Promise<void> {\n        const buildDir = resolveBuildDir(options.cwd, sourceDir);\n        try {\n            if (!(await stat(buildDir)).isDirectory()) {\n                throw new Error('not a directory');\n            }\n        } catch (cause) {\n            throw new Error(\n                `Verifiable build source directory is not an existing directory: ${buildDir}`,\n                { cause },\n            );\n        }\n\n        // The official stellar-cli image runs as a non-host UID and must create cargo target\n        // dirs under the bind-mounted source. Do not pass --user (that would diverge from what\n        // external verifiers run). Only chmod when --source-dir is explicit (typically a\n        // throwaway extract dir); never world-write the process cwd.\n        if (sourceDir !== undefined) {\n            await chmod(buildDir, 0o777);\n        }\n\n        const tagRef = officialImageTagRef(stellarVersion, rustVersion);\n        const digest = await resolveAmd64Digest(tagRef);\n        const imageRef = `${OFFICIAL_IMAGE_REPO}@${digest}`;\n        const bldimg = `docker.io/${OFFICIAL_IMAGE_REPO}@${digest}`;\n\n        const dockerArgs = buildVerifiableBuildDockerArgs({\n            imageRef,\n            sourceDir: buildDir,\n            buildArgs: args,\n            bldimg,\n        });\n\n        console.info('🔒 Verifiable build (official stellar/stellar-cli image, run from host)');\n        console.info(`   source: ${buildDir}`);\n        console.info(`   image:  ${imageRef} (${VERIFIABLE_BUILD_PLATFORM}, from tag ${tagRef})`);\n        console.info(`   bldimg: ${bldimg}`);\n        console.info(`   docker ${dockerArgs.join(' ')}`);\n\n        await runDocker(dockerArgs);\n    }\n}\n"]}