@oaath/cli 0.3.0

package/dist/deploy-BtvOPlub.mjs

@@ -0,0 +1,161 @@
+import { n as components, r as kernelDeployment, t as doctor } from "./cli.mjs";
+import { createWalletClient, custom, keccak256 } from "viem";
+//#region src/deploy.ts
+var DeploymentError = class extends Error {
+	code;
+	constructor(code) {
+		super(code);
+		this.code = code;
+	}
+};
+/** The core ECDSA set plus the passkey-session modules; never other optional rows. */
+function deploys(row) {
+	return row.required || row.passkeySession;
+}
+function validateReadiness(report) {
+	if (report.error || report.components.some((row) => deploys(row) && (row.status === "mismatch" || row.status === "unreadable"))) throw new DeploymentError("deployment_evidence_invalid");
+	for (const id of ["entryPoint", "create2Deployer"]) if (report.components.find((row) => row.id === id)?.status !== "verified") throw new DeploymentError("deployment_prerequisite_missing");
+	if (report.components.find((row) => row.id === "kernelFactory")?.status === "verified" && report.factoryBinding !== "verified") throw new DeploymentError("deployment_evidence_invalid");
+}
+function recordObject(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new DeploymentError("deployment_evidence_invalid");
+	return value;
+}
+function quantity(value) {
+	if (typeof value !== "string" || !/^0x(?:0|[1-9a-f][0-9a-f]*)$/u.test(value) || value.length > 66) throw new DeploymentError("deployment_evidence_invalid");
+	return BigInt(value);
+}
+function hash(value) {
+	if (typeof value !== "string" || !/^0x[0-9a-f]{64}$/u.test(value)) throw new DeploymentError("deployment_evidence_invalid");
+	return value;
+}
+/** Only canonical finalized evidence releases an attempted transaction's lane. */
+async function observe(record, manifest, rpc, journal, attempts) {
+	const component = manifest.find((row) => row.id === record.component);
+	if (!component?.deploymentInput || record.address !== component.address || record.inputHash !== keccak256(component.deploymentInput)) throw new DeploymentError("deployment_journal_conflict");
+	if (record.state === "confirmed") return true;
+	if (record.state === "reverted") throw new DeploymentError("deployment_reverted");
+	const deployer = kernelDeployment({ chainId: record.chainId }).create2Deployer;
+	for (let count = 0; count < attempts; count += 1) {
+		if (count > 0) await new Promise((resolve) => setTimeout(resolve, 1e3));
+		try {
+			const value = await rpc.request("eth_getTransactionReceipt", [record.transactionHash]);
+			if (value === null) continue;
+			const receipt = recordObject(value);
+			if (hash(receipt.transactionHash) !== record.transactionHash || receipt.from !== record.wallet || receipt.to !== deployer || receipt.status !== "0x1" && receipt.status !== "0x0") throw new DeploymentError("deployment_evidence_invalid");
+			const blockNumber = quantity(receipt.blockNumber);
+			const blockHash = hash(receipt.blockHash);
+			const finalized = recordObject(await rpc.request("eth_getBlockByNumber", ["finalized", false]));
+			const finalizedHash = hash(finalized.hash);
+			if (quantity(finalized.number) < blockNumber) continue;
+			const finalizedCanonical = recordObject(await rpc.request("eth_getBlockByNumber", [finalized.number, false]));
+			if (hash(finalizedCanonical.hash) !== finalizedHash || quantity(finalizedCanonical.number) !== quantity(finalized.number)) throw new DeploymentError("deployment_evidence_invalid");
+			const canonical = recordObject(await rpc.request("eth_getBlockByNumber", [receipt.blockNumber, false]));
+			if (hash(canonical.hash) !== blockHash || quantity(canonical.number) !== blockNumber) throw new DeploymentError("deployment_evidence_invalid");
+			const transaction = recordObject(await rpc.request("eth_getTransactionByHash", [record.transactionHash]));
+			if (hash(transaction.hash) !== record.transactionHash || transaction.from !== record.wallet || transaction.to !== deployer || transaction.input !== component.deploymentInput || quantity(transaction.nonce) !== BigInt(record.nonce) || quantity(transaction.value) !== 0n || quantity(transaction.chainId) !== BigInt(record.chainId) || hash(transaction.blockHash) !== blockHash || quantity(transaction.blockNumber) !== blockNumber) throw new DeploymentError("deployment_evidence_invalid");
+			if (receipt.status === "0x0") {
+				journal.finish(record, "reverted");
+				throw new DeploymentError("deployment_reverted");
+			}
+			const code = await rpc.request("eth_getCode", [component.address, receipt.blockNumber]);
+			if (typeof code !== "string" || !/^0x(?:[0-9a-f]{2})+$/u.test(code) || code.length > 131074 || component.runtimeCodeHash !== null && keccak256(code) !== component.runtimeCodeHash) throw new DeploymentError("deployment_evidence_invalid");
+			journal.finish(record, "confirmed");
+			return true;
+		} catch (error) {
+			if (error instanceof DeploymentError) throw error;
+			return false;
+		}
+	}
+	return false;
+}
+async function deployRuntime(input) {
+	const { chainId, rpc, journal } = input;
+	const manifest = components(chainId);
+	const deployer = kernelDeployment({ chainId }).create2Deployer;
+	let report = await doctor(chainId, rpc);
+	validateReadiness(report);
+	const result = (status, transactionHash = null) => ({
+		version: "oaath.runtime-deployment/v1",
+		chainId,
+		status,
+		missing: report.components.filter((row) => deploys(row) && row.status === "missing").map((row) => row.id),
+		transactionHash,
+		readiness: report
+	});
+	if (input.dryRun) return result("planned");
+	const pending = journal.pending(chainId);
+	if (pending && !await observe(pending, manifest, rpc, journal, input.observationAttempts ?? 30)) return result("pending", pending.transactionHash);
+	const wallet = () => createWalletClient({
+		account: input.account(),
+		transport: custom({ request: ({ method, params }) => rpc.request(method, params) }, { retryCount: 0 })
+	});
+	for (const component of manifest.filter((row) => deploys(row) && row.deploymentInput)) {
+		const code = await rpc.request("eth_getCode", [component.address, "latest"]);
+		if (code !== "0x") {
+			if (typeof code !== "string" || !/^0x(?:[0-9a-f]{2})+$/u.test(code) || component.runtimeCodeHash !== null && keccak256(code) !== component.runtimeCodeHash) throw new DeploymentError("deployment_evidence_invalid");
+			continue;
+		}
+		const retained = journal.get(chainId, component.id);
+		if (retained) {
+			if (retained.state === "confirmed") throw new DeploymentError("deployment_evidence_invalid");
+			if (!await observe(retained, manifest, rpc, journal, input.observationAttempts ?? 30)) return result("pending", retained.transactionHash);
+			continue;
+		}
+		const client = wallet();
+		const request = await client.prepareTransactionRequest({
+			account: client.account,
+			chain: null,
+			to: deployer,
+			data: component.deploymentInput,
+			value: 0n
+		});
+		if (request.chainId !== chainId || !Number.isSafeInteger(request.nonce) || request.nonce < 0 || request.gas <= 0n || request.gas > 10000000n) throw new DeploymentError("deployment_transaction_invalid");
+		const transaction = {
+			chainId,
+			nonce: request.nonce,
+			gas: request.gas,
+			to: deployer,
+			data: component.deploymentInput,
+			value: 0n
+		};
+		let signed;
+		if (request.type === "eip1559" && typeof request.maxFeePerGas === "bigint" && typeof request.maxPriorityFeePerGas === "bigint") signed = await client.account.signTransaction({
+			...transaction,
+			type: "eip1559",
+			maxFeePerGas: request.maxFeePerGas,
+			maxPriorityFeePerGas: request.maxPriorityFeePerGas
+		});
+		else if (request.type === "legacy" && typeof request.gasPrice === "bigint") signed = await client.account.signTransaction({
+			...transaction,
+			type: "legacy",
+			gasPrice: request.gasPrice
+		});
+		else throw new DeploymentError("deployment_transaction_invalid");
+		const attempt = {
+			chainId,
+			component: component.id,
+			address: component.address,
+			wallet: client.account.address.toLowerCase(),
+			inputHash: keccak256(component.deploymentInput),
+			transactionHash: keccak256(signed),
+			nonce: request.nonce,
+			state: "attempted"
+		};
+		const reservation = journal.reserve(attempt);
+		if (reservation.inserted) try {
+			await rpc.request("eth_sendRawTransaction", [signed]);
+		} catch {}
+		if (!await observe(reservation.record, manifest, rpc, journal, input.observationAttempts ?? 30)) return result("pending", reservation.record.transactionHash);
+		if (reservation.record.component !== component.id) {
+			report = await doctor(chainId, rpc);
+			return result(report.ready && report.passkeySessionsReady ? "ready" : "planned");
+		}
+	}
+	report = await doctor(chainId, rpc);
+	validateReadiness(report);
+	if (!report.ready || !report.passkeySessionsReady) throw new DeploymentError("deployment_evidence_invalid");
+	return result("ready");
+}
+//#endregion
+export { DeploymentError, deployRuntime };

package/dist/journal-DkNIXY4X.mjs

@@ -0,0 +1,92 @@
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+//#region src/journal.ts
+function capture(row) {
+	if (row === void 0) return null;
+	if (!row || typeof row !== "object") throw new Error("deployment_journal_invalid");
+	const value = row;
+	if (!Number.isSafeInteger(value.chainId) || Number(value.chainId) < 1 || !Number.isSafeInteger(value.nonce) || Number(value.nonce) < 0 || typeof value.component !== "string" || !/^[a-zA-Z][a-zA-Z0-9]{0,39}$/u.test(value.component) || ![
+		"attempted",
+		"confirmed",
+		"reverted"
+	].includes(String(value.state))) throw new Error("deployment_journal_invalid");
+	for (const field of ["address", "wallet"]) if (typeof value[field] !== "string" || !/^0x[0-9a-f]{40}$/u.test(value[field])) throw new Error("deployment_journal_invalid");
+	for (const field of ["inputHash", "transactionHash"]) if (typeof value[field] !== "string" || !/^0x[0-9a-f]{64}$/u.test(value[field])) throw new Error("deployment_journal_invalid");
+	return Object.freeze({ ...value });
+}
+/** Public attempt metadata only: never a private key or a signed transaction. */
+var DeploymentJournal = class {
+	#db;
+	#closed = false;
+	constructor(path) {
+		mkdirSync(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		this.#db = new DatabaseSync(path);
+		try {
+			this.#db.exec("PRAGMA busy_timeout=5000; PRAGMA synchronous=FULL; BEGIN IMMEDIATE");
+			const version = this.#db.prepare("PRAGMA user_version").get()?.user_version;
+			if (version === 0) {
+				if (this.#db.prepare("SELECT name FROM sqlite_master WHERE type='table'").get()) throw new Error("deployment_journal_schema_invalid");
+				this.#db.exec(`CREATE TABLE deployments (
+          chainId INTEGER NOT NULL, component TEXT NOT NULL, address TEXT NOT NULL,
+          wallet TEXT NOT NULL, inputHash TEXT NOT NULL, transactionHash TEXT NOT NULL,
+          nonce INTEGER NOT NULL, state TEXT NOT NULL CHECK(state IN ('attempted','confirmed','reverted')),
+          PRIMARY KEY(chainId, component)
+        );
+        CREATE UNIQUE INDEX active_chain ON deployments(chainId) WHERE state='attempted';
+        PRAGMA application_id=1329676628;
+        PRAGMA user_version=1;`);
+			} else if (version !== 1 || this.#db.prepare("PRAGMA application_id").get()?.application_id !== 1329676628) throw new Error("deployment_journal_schema_invalid");
+			this.#db.exec("COMMIT");
+		} catch (error) {
+			this.#db.close();
+			throw error;
+		}
+	}
+	pending(chainId) {
+		return capture(this.#db.prepare("SELECT * FROM deployments WHERE chainId=? AND state='attempted'").get(chainId));
+	}
+	get(chainId, component) {
+		return capture(this.#db.prepare("SELECT * FROM deployments WHERE chainId=? AND component=?").get(chainId, component));
+	}
+	reserve(attempt) {
+		if (capture(attempt)?.state !== "attempted") throw new Error("deployment_journal_invalid");
+		this.#db.exec("BEGIN IMMEDIATE");
+		try {
+			const existing = this.pending(attempt.chainId) ?? this.get(attempt.chainId, attempt.component);
+			if (existing) {
+				this.#db.exec("COMMIT");
+				return {
+					inserted: false,
+					record: existing
+				};
+			}
+			this.#db.prepare("INSERT INTO deployments VALUES (?,?,?,?,?,?,?,?)").run(attempt.chainId, attempt.component, attempt.address, attempt.wallet, attempt.inputHash, attempt.transactionHash, attempt.nonce, attempt.state);
+			this.#db.exec("COMMIT");
+			return {
+				inserted: true,
+				record: attempt
+			};
+		} catch (error) {
+			this.#db.exec("ROLLBACK");
+			throw error;
+		}
+	}
+	finish(record, state) {
+		if (this.#db.prepare("UPDATE deployments SET state=? WHERE chainId=? AND component=? AND transactionHash=? AND state='attempted'").run(state, record.chainId, record.component, record.transactionHash).changes !== 1) {
+			const existing = this.get(record.chainId, record.component);
+			if (existing?.state !== state || existing.transactionHash !== record.transactionHash) throw new Error("deployment_journal_conflict");
+		}
+	}
+	close() {
+		if (!this.#closed) {
+			this.#db.close();
+			this.#closed = true;
+		}
+	}
+};
+//#endregion
+export { DeploymentJournal };

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@oaath/cli",
+  "version": "0.3.0",
+  "description": "OAAth runtime deployment and readiness commands.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "author": "taek <leekt216@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/leekt/oaath.git",
+    "directory": "packages/cli"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "bin": {
+    "oaath": "./dist/cli.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsdown",
+    "prepack": "bun run build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:anvil": "OAATH_REQUIRE_ANVIL=1 vitest run test/doctor.anvil.test.ts test/deploy.anvil.test.ts",
+    "release:publish": "bun publish --access public --tolerate-republish",
+    "release:check": "bun pm pack --dry-run"
+  },
+  "dependencies": {
+    "@oaath/sdk": "0.3.0",
+    "viem": "2.55.8"
+  },
+  "devDependencies": {
+    "@types/node": "22.13.0",
+    "@account-abstraction/contracts": "0.7.0"
+  }
+}