Merge pull request #1139 from Enniwealth/feat/issues-932-903-905-909

Fix for #932 #903 #905 #909

Author: Manuelshub

.github/dependabot.yml

@@ -19,14 +19,10 @@ updates:
       cargo-minor-and-patch:
         update-types: [minor, patch]
     ignore:
-      # Deliberately exact-pinned in Cargo.toml (`=x.y.z`), mostly to hold the
-      # 1.80 MSRV; bump these by hand after checking the MSRV job.
-      - dependency-name: clap
-      - dependency-name: clap_complete
+      # Remaining exact pins in Cargo.toml (justified next to each `=` entry).
+      # Caret-ranged crates (clap, toml, colored, dirs, clap_complete) may update.
       - dependency-name: clap_mangen
-      - dependency-name: toml
-      - dependency-name: colored
-      - dependency-name: dirs
+      - dependency-name: comfy-table
       - dependency-name: stellar-strkey
       - dependency-name: zxcvbn
       # time >= 0.3.46 requires Rust 1.88, above our 1.80 MSRV (see deny.toml).

.github/workflows/latest-deps.yml

@@ -0,0 +1,39 @@
+# Latest dependency resolution (scheduled)
+
+# Exercises caret ranges without --locked so MSRV-compatible upgrades surface
+# before Dependabot PRs. See CONTRIBUTING.md "MSRV policy" and issue #903.
+
+name: Latest deps
+
+on:
+  schedule:
+    # Mondays 06:15 UTC
+    - cron: "15 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  latest-deps:
+    name: cargo update + check (no lock)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Update dependencies within caret ranges
+        run: cargo update
+
+      - name: Check workspace against refreshed lockfile
+        run: cargo check --workspace --all-targets
+
+      - name: Run library/unit tests
+        run: cargo test --workspace --lib --bins

.github/workflows/native-deploy-smoke.yml

@@ -0,0 +1,34 @@
+# Native deploy / SAC regression tests (#905 / #909)
+
+name: Native deploy smoke
+
+on:
+  pull_request:
+    paths:
+      - "src/utils/soroban_native.rs"
+      - "src/commands/deploy.rs"
+      - "src/commands/asset.rs"
+      - "src/utils/soroban.rs"
+      - "tests/sac_contract_id.rs"
+      - "tests/watch_only_wallet.rs"
+      - ".github/workflows/native-deploy-smoke.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  vectors:
+    name: SAC + watch-only tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libudev-dev
+      - name: SAC contract-id fixtures
+        run: cargo test --locked --test sac_contract_id
+      - name: Watch-only wallet CLI
+        run: cargo test --locked --test watch_only_wallet
+      - name: Native deploy unit tests
+        run: cargo test --locked soroban_native::

.gitignore

@@ -200,3 +200,4 @@ test_snapshots/
 
 # Python bytecode (release/notes script tests)
 __pycache__/
+.vendor/

CONTRIBUTING.md

@@ -38,7 +38,19 @@ Welcome to StarForge! This guide will help you get started contributing to the p
 
 ### Rust
 
-StarForge requires **Rust 1.80 or later**. 
+StarForge requires **Rust 1.80 or later** (`rust-version` in `Cargo.toml`).
+
+#### MSRV policy
+
+- The Minimum Supported Rust Version (MSRV) tracks approximately **N−3** stable
+  releases (today: 1.80 while latest stable is ~1.83+).
+- MSRV bumps happen only in **minor** StarForge releases, never in patch releases.
+- Exact dependency pins (`=x.y.z`) are avoided unless a justification comment sits
+  next to the pin (usually an MSRV or API-stability hold). Prefer caret ranges and
+  rely on `.cargo/config.toml` `incompatible-rust-versions = "fallback"` plus the
+  weekly `latest-deps` CI job to catch drift.
+- When raising MSRV, update `Cargo.toml` `rust-version`, the `MSRV (Rust …)` CI
+  job, `CONTRIBUTING.md`, and `docs/BRANCH_PROTECTION.md` in the same PR.
 
 #### Install Rust
 

Cargo.lock

@@ -81,16 +81,18 @@ single_match = "allow"
 await_holding_lock = "allow"
 
 [dependencies]
-clap     = { version = "=4.4.18", features = ["derive", "color"] }
+# Caret ranges: MSRV-aware resolution (see `.cargo/config.toml` and CONTRIBUTING.md).
+clap     = { version = "4.4", features = ["derive", "color"] }
 serde    = { version = "1.0",     features = ["derive"] }
 serde_json = "1.0"
 regex    = "1.10"
-toml     = "=0.8.8"
+toml     = "0.8"
 semver   = "1.0"
 spdx     = "0.13.5"
-colored  = "=2.1.0"
+colored  = "2.1"
+# Pinned: 7.1.2+ pulls unicode-width 0.2 which requires a newer MSRV than 1.80.
 comfy-table  = "=7.1.1"
-dirs     = "=5.0.1"
+dirs     = "5.0"
 anyhow   = "1.0"
 thiserror = "2.0"
 chrono   = { version = "0.4", features = ["serde"] }
@@ -101,10 +103,11 @@ tokio      = { version = "1", features = ["full"] }
 tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect", "rustls-tls-webpki-roots"] }
 futures-util = "0.3"
 ctrlc      = "3.4"
-clap_complete  = "=4.4.10"
+clap_complete  = "4.4"
 dialoguer  = { version = "0.11", features = ["fuzzy-select", "password"] }
 aes-gcm = "0.10.3"
 argon2 = "0.5.3"
+# Pinned: strkey encoding must stay aligned with stellar-xdr 22.x fixtures.
 stellar-strkey = "=0.0.10"
 stellar-xdr = { version = "22.0.0", features = ["serde"] }
 base64     = "0.21"
@@ -116,6 +119,7 @@ wasmtime = { version = "24.0.7", default-features = false, features = ["cranelif
 uuid = { version = "1.6.1", features = ["v4", "serde"] }
 hidapi = { version = "2.6.5", optional = true }
 trezor-client = { version = "0.1.5", default-features = false, features = ["stellar"], optional = true }
+# Pinned: 3.2+ bumps MSRV past 1.80.
 zxcvbn = "=3.1.1"
 zeroize = { version = "1", features = ["derive"] }
 hex = "0.4"
@@ -174,7 +178,8 @@ opt-level = 3
 lto = true
 
 [build-dependencies]
-clap = { version = "4.4.18", features = ["derive"] }
-clap_complete = "4.4.10"
+clap = { version = "4.4", features = ["derive"] }
+clap_complete = "4.4"
+# Pinned: clap_mangen 0.2.31+ requires clap 4.5 APIs not guaranteed on MSRV 1.80.
 clap_mangen = "=0.2.30"
 tokio-postgres = { version = "0.7", features = ["with-chrono-0_4", "with-serde_json-1"] }

Cargo.toml

@@ -178,7 +178,8 @@ writing. Check `starforge <command> --help` for anything that has changed.
   `stellar cache` have no StarForge equivalent. (`starforge tx` covers
   payments, batches, history and fee stats.)
 - **State maintenance.** `stellar contract extend`, `restore`, `fetch`, `id`,
-  `alias` and `asset deploy` (Stellar Asset Contracts) have no equivalent.
+  `alias` has a StarForge equivalent (`starforge alias`). Stellar Asset Contracts
+  use `starforge asset contract-id` / `starforge asset wrap`.
 - **Default identity.** There's no `keys use`: pass `--wallet` explicitly.
 - **More binding languages.** stellar-cli also generates Java, Flutter, Swift
   and PHP clients.

docs/MIGRATING_FROM_STELLAR_CLI.md

@@ -0,0 +1,24 @@
+# Native Soroban deploy (no stellar CLI)
+
+`starforge deploy run --execute` uploads WASM and creates the contract instance
+entirely over Soroban RPC:
+
+1. `UploadContractWasm` (skipped when the WASM hash is already on-chain)
+2. Simulate → assemble footprint / resource fee / auth
+3. Sign with the selected wallet
+4. `sendTransaction` + poll to SUCCESS
+5. `CreateContract` / `CreateContractV2` (with `--constructor-arg` when needed)
+
+```bash
+starforge deploy run --wasm target/wasm32-unknown-unknown/release/hello.wasm \
+  --wallet deployer --network testnet --execute
+
+# Machine-readable contract id
+starforge deploy run --wasm hello.wasm --wallet deployer --execute --json
+
+# Print the legacy stellar CLI command instead
+starforge deploy run --wasm hello.wasm --wallet deployer --print-only
+```
+
+Constructor arguments use `type:value` forms (`address:G…`, `u32:1`, `string:hi`,
+`xdr:<base64 ScVal>`).

docs/native-deploy.md

@@ -0,0 +1,22 @@
+# Stellar Asset Contracts (SAC)
+
+Compute the deterministic Soroban contract id for a classic asset, or wrap
+(deploy) the SAC when it is missing.
+
+```bash
+# Native XLM
+starforge asset contract-id XLM --network testnet
+
+# Issued asset
+starforge asset contract-id USDC:G... --network testnet --json
+
+# Deploy / wrap if absent (pays fees from --wallet)
+starforge asset wrap USDC:G... --wallet deployer --network testnet --yes
+```
+
+Use the SAC id with token templates and DeFi contracts that speak the SEP-41
+token interface — for example after wrapping USDC, pass the `C…` id into a
+token client instead of hand-computing the preimage.
+
+See also: `starforge deploy run --execute` for native WASM deploy without the
+stellar CLI.