gate-evm-tools 1.0.25 → 1.0.27

package/runtime/workflow/lib/zksyncForkRunner.ts

@@ -0,0 +1,505 @@
+import { createRequire } from "node:module";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { promisify } from "node:util";
+import type { ForkSnapshotV1 } from "./forkSnapshot";
+import {
+  resolveZkSyncForkCapability,
+  resolveZkSyncForkRunnerArtifact,
+  ZKSYNC_FORK_RUNNER,
+} from "./zksyncForkCapability";
+
+export const ANVIL_ZKSYNC_SOURCE_PATH_SUFFIX = "/anvil-zksync";
+const ANVIL_ZKSYNC_REPOSITORY = "https://github.com/matter-labs/anvil-zksync";
+const MAX_ANVIL_ZKSYNC_ARCHIVE_BYTES = 128 * 1024 * 1024;
+const execFileAsync = promisify(execFile);
+
+interface RpcServer {
+  listen(args?: string[], blockProcess?: boolean): Promise<void>;
+  stop(): Promise<void>;
+}
+
+interface StartedServer {
+  port: number;
+  commandArgs: string[];
+  server: RpcServer;
+}
+
+interface StartServerInput {
+  version: string;
+  options: {
+    fork: string;
+    forkBlockNumber: number;
+    chainId: number;
+    protocolVersion: number;
+    host: "127.0.0.1";
+    autoImpersonate: boolean;
+    cache: "memory";
+    quiet: boolean;
+  };
+}
+
+interface PinnedAnvilZkSyncServerDependencies {
+  startServer(
+    version?: string,
+    binaryPath?: string,
+    force?: boolean,
+    options?: StartServerInput["options"],
+  ): Promise<StartedServer>;
+  downloadBinary(version: string): Promise<StagedAnvilZkSyncBinary>;
+}
+
+export interface StagedAnvilZkSyncBinary {
+  path: string;
+  cleanup(): Promise<void>;
+}
+
+export interface ZkSyncForkRunnerDependencies {
+  startServer(input: StartServerInput): Promise<StartedServer>;
+  waitForReady(port: number): Promise<void>;
+  rpcRequest(url: string, method: string, params: unknown[]): Promise<unknown>;
+}
+
+export interface RunningZkSyncFork {
+  rpcUrl: string;
+  version: string;
+  stop(): Promise<void>;
+}
+
+const loopbackUrl = (value: string, requireTokenPath: boolean): string => {
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error("zkSync fork URL is invalid");
+  }
+  if (
+    parsed.protocol !== "http:"
+    || parsed.hostname !== "127.0.0.1"
+    || !parsed.port
+    || (requireTokenPath && parsed.pathname === "/")
+    || parsed.username
+    || parsed.password
+    || parsed.search
+    || parsed.hash
+  ) {
+    throw new Error("zkSync fork URL must be loopback-only");
+  }
+  return parsed.toString().replace(/\/$/, requireTokenPath ? "" : "");
+};
+
+export const zkSyncForkRunnerProtocolVersion = (
+  sourceProtocolVersion: number,
+): number => (
+  resolveZkSyncForkCapability(sourceProtocolVersion)?.runnerProtocolVersion
+  ?? sourceProtocolVersion
+);
+
+export const zkSyncForkRunnerSourceUrl = (
+  sourceProxyUrl: string,
+  sourceProtocolVersion: number,
+): string => {
+  const canonicalUrl = loopbackUrl(sourceProxyUrl, true);
+  if (zkSyncForkRunnerProtocolVersion(sourceProtocolVersion) === sourceProtocolVersion) {
+    return canonicalUrl;
+  }
+  const runnerUrl = new URL(canonicalUrl);
+  runnerUrl.pathname = `${runnerUrl.pathname}${ANVIL_ZKSYNC_SOURCE_PATH_SUFFIX}`;
+  return loopbackUrl(runnerUrl.toString(), true);
+};
+
+export const rewriteZkSyncForkRunnerRpcResult = (
+  method: string,
+  result: unknown,
+  sourceProtocolVersion: number,
+): unknown => {
+  const runnerProtocolVersion = zkSyncForkRunnerProtocolVersion(sourceProtocolVersion);
+  if (
+    method !== "zks_getBlockDetails"
+    || runnerProtocolVersion === sourceProtocolVersion
+    || result === null
+    || typeof result !== "object"
+    || Array.isArray(result)
+  ) {
+    return result;
+  }
+  return {
+    ...(result as Record<string, unknown>),
+    protocolVersion: `Version${runnerProtocolVersion}`,
+  };
+};
+
+const defaultRpcRequest = async (
+  url: string,
+  method: string,
+  params: unknown[],
+): Promise<unknown> => {
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    });
+  } catch {
+    throw new Error(`Local EraVM RPC ${method} request failed`);
+  }
+  if (!response.ok) throw new Error(`Local EraVM RPC ${method} request failed`);
+  const body = await response.json() as { result?: unknown; error?: unknown };
+  if (body.error !== undefined || body.result === undefined) {
+    throw new Error(`Local EraVM RPC ${method} failed`);
+  }
+  return body.result;
+};
+
+export const assertZkSyncForkArtifactDigest = (
+  bytes: Uint8Array,
+  expectedSha256: string,
+  label: string,
+): void => {
+  const actual = createHash("sha256").update(bytes).digest("hex");
+  if (actual !== expectedSha256) {
+    throw new Error(`${label} integrity verification failed`);
+  }
+};
+
+export const stageVerifiedAnvilZkSyncBinary = async (
+  sourcePath: string,
+  expectedSha256: string,
+): Promise<StagedAnvilZkSyncBinary> => {
+  const source = await lstat(sourcePath);
+  if (!source.isFile() || source.isSymbolicLink()) {
+    throw new Error("Cached anvil-zksync binary must be a regular file");
+  }
+  const bytes = await readFile(sourcePath);
+  assertZkSyncForkArtifactDigest(
+    bytes,
+    expectedSha256,
+    "Cached anvil-zksync binary",
+  );
+
+  const executionDirectory = await mkdtemp(join(tmpdir(), "gate-anvil-zksync-exec-"));
+  const executionPath = join(executionDirectory, "anvil-zksync");
+  let ready = false;
+  try {
+    await writeFile(executionPath, bytes, { flag: "wx", mode: 0o700 });
+    const staged = await lstat(executionPath);
+    if (!staged.isFile() || staged.isSymbolicLink()) {
+      throw new Error("Staged anvil-zksync binary must be a regular file");
+    }
+    assertZkSyncForkArtifactDigest(
+      await readFile(executionPath),
+      expectedSha256,
+      "Staged anvil-zksync binary",
+    );
+    ready = true;
+    let cleaned = false;
+    return {
+      path: executionPath,
+      cleanup: async () => {
+        if (cleaned) return;
+        await rm(executionDirectory, { recursive: true, force: true });
+        cleaned = true;
+      },
+    };
+  } finally {
+    if (!ready) {
+      await rm(executionDirectory, { recursive: true, force: true });
+    }
+  }
+};
+
+export const resolveZkSyncForkRunner = (
+  protocolVersion: number,
+): { kind: "anvil-zksync"; version: string } | undefined => (
+  resolveZkSyncForkCapability(protocolVersion)?.runner
+);
+
+const pinnedAnvilZkSyncBinary = async (
+  version: string,
+): Promise<StagedAnvilZkSyncBinary> => {
+  if (version !== ZKSYNC_FORK_RUNNER.version) {
+    throw new Error(`anvil-zksync fallback requires version ${ZKSYNC_FORK_RUNNER.version}`);
+  }
+  const artifact = resolveZkSyncForkRunnerArtifact();
+  if (!artifact) {
+    throw new Error("Pinned anvil-zksync is unavailable for this platform");
+  }
+  const utilities = createRequire(join(process.cwd(), "package.json"))("@matterlabs/hardhat-zksync-node/dist/utils") as {
+    getRPCServerBinariesDir(): Promise<string>;
+    getNodeUrl(repository: string, release: string): Promise<string>;
+  };
+  const binaryDirectory = await utilities.getRPCServerBinariesDir();
+  const binaryPath = join(binaryDirectory, version);
+  try {
+    return await stageVerifiedAnvilZkSyncBinary(binaryPath, artifact.binarySha256);
+  } catch (error) {
+    if (!error || typeof error !== "object" || (error as NodeJS.ErrnoException).code !== "ENOENT") {
+      throw error;
+    }
+  }
+
+  const assetUrl = await utilities.getNodeUrl(ANVIL_ZKSYNC_REPOSITORY, version);
+  const source = new URL(assetUrl);
+  if (
+    source.protocol !== "https:"
+    || source.hostname !== "github.com"
+    || source.pathname !== `/matter-labs/anvil-zksync/releases/download/v${version}/${artifact.assetName}`
+  ) {
+    throw new Error("Pinned anvil-zksync release URL is invalid for this platform");
+  }
+
+  const response = await fetch(source, { redirect: "follow" });
+  const finalUrl = new URL(response.url);
+  if (
+    !response.ok
+    || finalUrl.protocol !== "https:"
+    || !(
+      finalUrl.hostname === "github.com"
+      || finalUrl.hostname.endsWith(".githubusercontent.com")
+    )
+  ) {
+    throw new Error(`Pinned anvil-zksync ${version} download failed`);
+  }
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (
+    Number.isFinite(declaredLength)
+    && (declaredLength < 1 || declaredLength > MAX_ANVIL_ZKSYNC_ARCHIVE_BYTES)
+  ) {
+    throw new Error("Pinned anvil-zksync archive size is invalid");
+  }
+  const archive = Buffer.from(await response.arrayBuffer());
+  if (archive.length < 1 || archive.length > MAX_ANVIL_ZKSYNC_ARCHIVE_BYTES) {
+    throw new Error("Pinned anvil-zksync archive size is invalid");
+  }
+  assertZkSyncForkArtifactDigest(
+    archive,
+    artifact.archiveSha256,
+    "Pinned anvil-zksync archive",
+  );
+
+  const temporaryDirectory = await mkdtemp(join(tmpdir(), "gate-anvil-zksync-"));
+  try {
+    const archivePath = join(temporaryDirectory, "anvil-zksync.tar.gz");
+    await writeFile(archivePath, archive, { mode: 0o600 });
+    const listing = await execFileAsync("tar", ["-tzf", archivePath], {
+      maxBuffer: 1024 * 1024,
+    });
+    const entries = String(listing.stdout)
+      .split(/\r?\n/)
+      .map((entry) => entry.replace(/^\.\//, "").trim())
+      .filter(Boolean);
+    if (
+      entries.length !== 1
+      || entries[0] !== basename(entries[0])
+      || entries[0] === "."
+      || entries[0] === ".."
+    ) {
+      throw new Error("Pinned anvil-zksync archive must contain one regular file");
+    }
+    const extractionDirectory = join(temporaryDirectory, "extract");
+    await mkdir(extractionDirectory, { recursive: true });
+    await execFileAsync("tar", ["-xzf", archivePath, "-C", extractionDirectory]);
+    const extractedPath = join(extractionDirectory, entries[0]);
+    const extracted = await lstat(extractedPath);
+    if (!extracted.isFile() || extracted.isSymbolicLink()) {
+      throw new Error("Pinned anvil-zksync archive must contain one regular file");
+    }
+    assertZkSyncForkArtifactDigest(
+      await readFile(extractedPath),
+      artifact.binarySha256,
+      "Extracted anvil-zksync binary",
+    );
+    return await stageVerifiedAnvilZkSyncBinary(extractedPath, artifact.binarySha256);
+  } finally {
+    await rm(temporaryDirectory, { recursive: true, force: true });
+  }
+};
+
+export const startPinnedAnvilZkSyncServer = async (
+  input: StartServerInput,
+  dependencies: PinnedAnvilZkSyncServerDependencies,
+): Promise<StartedServer> => {
+  if (input.version !== ZKSYNC_FORK_RUNNER.version) {
+    throw new Error(`Unsupported anvil-zksync runner version ${input.version}`);
+  }
+  const stagedBinary = await dependencies.downloadBinary(input.version);
+  let started: StartedServer;
+  try {
+    started = await dependencies.startServer(
+      input.version,
+      stagedBinary.path,
+      false,
+      input.options,
+    );
+  } catch (error) {
+    try {
+      await stagedBinary.cleanup();
+    } catch {
+      // Preserve the plugin construction error; the private directory is best-effort cleanup here.
+    }
+    throw error;
+  }
+
+  const server = started.server;
+  let cleanupPromise: Promise<void> | undefined;
+  const cleanup = (): Promise<void> => {
+    cleanupPromise ??= stagedBinary.cleanup();
+    return cleanupPromise;
+  };
+  return {
+    ...started,
+    server: {
+      listen: async (args, blockProcess) => {
+        try {
+          await server.listen(args, blockProcess);
+        } catch (error) {
+          try {
+            await cleanup();
+          } catch {
+            // Preserve the process startup error.
+          }
+          throw error;
+        }
+      },
+      stop: async () => {
+        try {
+          await server.stop();
+        } finally {
+          await cleanup();
+        }
+      },
+    },
+  };
+};
+
+const defaultDependencies = (): ZkSyncForkRunnerDependencies => {
+  const utilities = createRequire(join(process.cwd(), "package.json"))("@matterlabs/hardhat-zksync-node/dist/utils") as {
+    startServer(
+      version?: string,
+      binaryPath?: string,
+      force?: boolean,
+      options?: StartServerInput["options"],
+    ): Promise<StartedServer>;
+    waitForNodeToBeReady(port: number): Promise<void>;
+  };
+  return {
+    startServer: async (input) => startPinnedAnvilZkSyncServer(input, {
+      startServer: utilities.startServer,
+      downloadBinary: pinnedAnvilZkSyncBinary,
+    }),
+    waitForReady: (port) => utilities.waitForNodeToBeReady(port),
+    rpcRequest: defaultRpcRequest,
+  };
+};
+
+const blockTag = (blockNumber: number): string => `0x${blockNumber.toString(16)}`;
+
+export const startZkSyncForkRunner = async (
+  input: {
+    sourceProxyUrl: string;
+    snapshot: ForkSnapshotV1;
+  },
+  dependencies: ZkSyncForkRunnerDependencies = defaultDependencies(),
+): Promise<RunningZkSyncFork> => {
+  if (
+    input.snapshot.runner.kind !== "anvil-zksync"
+    || !("protocolVersion" in input.snapshot)
+    || !Number.isSafeInteger(input.snapshot.protocolVersion)
+  ) {
+    throw new Error(
+      `zkSync fork snapshot must use an approved anvil-zksync runner`,
+    );
+  }
+  const approvedRunner = resolveZkSyncForkRunner(input.snapshot.protocolVersion);
+  if (!approvedRunner) {
+    throw new Error(
+      `zkSync protocol ${input.snapshot.protocolVersion} is unsupported by the approved anvil-zksync runners`,
+    );
+  }
+  if (input.snapshot.runner.version !== approvedRunner.version) {
+    throw new Error(
+      `zkSync protocol ${input.snapshot.protocolVersion} requires anvil-zksync ${approvedRunner.version}`,
+    );
+  }
+  const capability = resolveZkSyncForkCapability(input.snapshot.protocolVersion);
+  if (!capability) {
+    throw new Error(
+      `zkSync protocol ${input.snapshot.protocolVersion} is unsupported by the approved anvil-zksync runners`,
+    );
+  }
+  const sourceProxyUrl = zkSyncForkRunnerSourceUrl(
+    input.sourceProxyUrl,
+    input.snapshot.protocolVersion,
+  );
+  let started: StartedServer | undefined;
+  let stopped = false;
+  const stop = async (): Promise<void> => {
+    if (!started || stopped) return;
+    stopped = true;
+    await started.server.stop();
+  };
+  try {
+    started = await dependencies.startServer({
+      version: input.snapshot.runner.version,
+      options: {
+        fork: sourceProxyUrl,
+        forkBlockNumber: input.snapshot.blockNumber,
+        chainId: input.snapshot.chainId,
+        protocolVersion: capability.runnerProtocolVersion,
+        host: "127.0.0.1",
+        autoImpersonate: true,
+        cache: "memory",
+        quiet: true,
+      },
+    });
+    if (!Number.isSafeInteger(started.port) || started.port < 1 || started.port > 65_535) {
+      throw new Error("anvil-zksync selected an invalid local port");
+    }
+    await started.server.listen(started.commandArgs, false);
+    await dependencies.waitForReady(started.port);
+    const rpcUrl = loopbackUrl(`http://127.0.0.1:${started.port}`, false);
+    const [chainId, forkBlock] = await Promise.all([
+      dependencies.rpcRequest(rpcUrl, "eth_chainId", []),
+      dependencies.rpcRequest(
+        rpcUrl,
+        "eth_getBlockByNumber",
+        [blockTag(input.snapshot.blockNumber), false],
+      ),
+    ]);
+    if (
+      typeof chainId !== "string"
+      || !/^0x[0-9a-fA-F]+$/.test(chainId)
+      || BigInt(chainId) !== BigInt(input.snapshot.chainId)
+    ) {
+      throw new Error(`EraVM fork chainId does not match target chainId ${input.snapshot.chainId}`);
+    }
+    const hash = forkBlock && typeof forkBlock === "object" && !Array.isArray(forkBlock)
+      ? (forkBlock as { hash?: unknown }).hash
+      : undefined;
+    if (
+      typeof hash !== "string"
+      || hash.toLowerCase() !== input.snapshot.blockHash.toLowerCase()
+    ) {
+      throw new Error(`EraVM fork block hash mismatch at ${input.snapshot.blockNumber}`);
+    }
+    return {
+      rpcUrl,
+      version: input.snapshot.runner.version,
+      stop,
+    };
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+};

package/runtime/workflow/reconcileExternal.ts

@@ -0,0 +1,86 @@
+import { spawnSync } from "child_process";
+import path from "path";
+import { openZeppelinProcessEnvironment } from "../config/openzeppelin";
+import { resolveCliTool } from "./lib/cliTool";
+import { validateExecutionId } from "./lib/executionId";
+
+const RECONCILIATION_INPUT_ENV = "WORKFLOW_RECONCILE_EXTERNAL_INPUT_JSON";
+
+const parseArgs = (argv: string[]): Record<string, string> => {
+  const args: Record<string, string> = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (!item.startsWith("--")) continue;
+    const key = item.slice(2);
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) throw new Error(`--${key} requires a value`);
+    if (args[key] !== undefined) throw new Error(`--${key} may be provided only once`);
+    args[key] = value;
+    index += 1;
+  }
+  return args;
+};
+
+const required = (args: Record<string, string>, key: string): string => {
+  const value = args[key]?.trim();
+  if (!value) throw new Error(`--${key} is required`);
+  return value;
+};
+
+const main = (): void => {
+  const args = parseArgs(process.argv.slice(2));
+  const root = path.resolve(args.root || process.cwd());
+  const network = required(args, "network");
+  const executionId = validateExecutionId(required(args, "executionId"));
+  const batchSize = args.batchSize === undefined ? undefined : Number(args.batchSize);
+  if (
+    batchSize !== undefined
+    && (!Number.isInteger(batchSize) || batchSize < 1 || batchSize > 1000)
+  ) {
+    throw new Error("--batchSize must be an integer between 1 and 1000");
+  }
+  const input = {
+    version: 1,
+    root,
+    taskId: required(args, "task"),
+    network,
+    executionId,
+    ...(batchSize === undefined ? {} : { batchSize }),
+  };
+  const manifestEnv = openZeppelinProcessEnvironment({
+    root,
+    network,
+    mode: "execute",
+    target: network,
+    env: process.env,
+  });
+  const hardhat = resolveCliTool({ root, binary: "hardhat" });
+  const result = spawnSync(
+    hardhat.command,
+    [
+      ...hardhat.argsPrefix,
+      "run",
+      path.join(__dirname, "reconcileExternalRun.js"),
+      "--network",
+      network,
+      "--no-compile",
+    ],
+    {
+      cwd: root,
+      env: {
+        ...manifestEnv,
+        [RECONCILIATION_INPUT_ENV]: JSON.stringify(input),
+      },
+      stdio: "inherit",
+    },
+  );
+  if (result.error) throw result.error;
+  process.exitCode = result.status ?? 1;
+};
+
+try {
+  main();
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}

package/runtime/workflow/reconcileExternalRun.ts

@@ -0,0 +1,88 @@
+import path from "path";
+import hardhat from "../projectHardhat";
+import type { JsonRpcProvider } from "ethers";
+import { reconcileExternalExecution } from "./lib/externalExecutionScanner";
+
+interface ReconciliationInput {
+  version: 1;
+  root: string;
+  taskId: string;
+  network: string;
+  executionId: string;
+  batchSize?: number;
+}
+
+const RECONCILIATION_INPUT_ENV = "WORKFLOW_RECONCILE_EXTERNAL_INPUT_JSON";
+
+const nonEmptyString = (value: unknown, label: string): string => {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  return value;
+};
+
+const loadInput = (): ReconciliationInput => {
+  const raw = process.env[RECONCILIATION_INPUT_ENV];
+  if (!raw) throw new Error(`${RECONCILIATION_INPUT_ENV} is required`);
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw) as unknown;
+  } catch (error) {
+    throw new Error(
+      `Cannot parse ${RECONCILIATION_INPUT_ENV}: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${RECONCILIATION_INPUT_ENV} must contain an object`);
+  }
+  const input = parsed as Record<string, unknown>;
+  if (input.version !== 1) throw new Error("External reconciliation input version must be 1");
+  const batchSize = input.batchSize;
+  if (
+    batchSize !== undefined
+    && (!Number.isInteger(batchSize) || Number(batchSize) < 1 || Number(batchSize) > 1000)
+  ) {
+    throw new Error("External reconciliation batchSize must be between 1 and 1000");
+  }
+  return {
+    version: 1,
+    root: nonEmptyString(input.root, "External reconciliation root"),
+    taskId: nonEmptyString(input.taskId, "External reconciliation taskId"),
+    network: nonEmptyString(input.network, "External reconciliation network"),
+    executionId: nonEmptyString(input.executionId, "External reconciliation executionId"),
+    ...(batchSize === undefined ? {} : { batchSize: Number(batchSize) }),
+  };
+};
+
+const main = async (): Promise<void> => {
+  const input = loadInput();
+  if (hardhat.network.name !== input.network) {
+    throw new Error(
+      `External reconciliation target ${input.network} does not match Hardhat network ${hardhat.network.name}`,
+    );
+  }
+  if (path.resolve(hardhat.config.paths.root) !== path.resolve(input.root)) {
+    throw new Error("External reconciliation root does not match the Hardhat project root");
+  }
+  const report = await reconcileExternalExecution({
+    root: path.resolve(input.root),
+    taskId: input.taskId,
+    network: input.network,
+    executionId: input.executionId,
+    provider: hardhat.ethers.provider as unknown as JsonRpcProvider,
+    batchSize: input.batchSize,
+    gateToolSyncHre: hardhat,
+  });
+  console.log(JSON.stringify({
+    status: report.status,
+    reportPath: report.reportPath,
+    nextBlock: report.segments?.at(-1)?.nextBlock,
+    finalizedBlock: report.finalizedBlock,
+  }));
+  if (report.status === "failed") process.exitCode = 1;
+};
+
+void main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

package/runtime/workflow/releaseFinalize.ts

@@ -0,0 +1,8 @@
+import { runReleaseFinalizeCli } from "./lib/releaseFinalize";
+
+try {
+  console.log(JSON.stringify(runReleaseFinalizeCli(process.argv.slice(2))));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}