Repository navigation
Expand file tree
/
Copy pathdocs.html
More file actions
330 lines (298 loc) · 30.7 KB
/
Copy pathdocs.html
File metadata and controls
330 lines (298 loc) · 30.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Docs — Soroban DevKit</title>
<meta name="description" content="Install, inspect, audit, diff, and fuzz Soroban contracts. Every command verified against the current CLI.">
<meta name="theme-color" content="#0B0F19">
<meta property="og:url" content="https://soroban-devkit.xyz/docs.html">
<meta property="og:title" content="Docs — Soroban DevKit">
<meta property="og:description" content="Everything you need to build, test, and secure your Soroban smart contracts.">
<link rel="canonical" href="https://soroban-devkit.xyz/docs.html">
<meta property="og:type" content="website">
<link rel="icon" type="image/svg+xml" href="logo.svg">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet">
<script src="https://cdn.tailwindcss.com"></script>
<script>tailwind.config={theme:{extend:{colors:{ink:'#010713',panel:'#000815',accent:'#22D3EE',electric:'#3B82F6'},fontFamily:{sans:['Inter','ui-sans-serif','system-ui','sans-serif'],mono:['"JetBrains Mono"','ui-monospace','SFMono-Regular','monospace']},boxShadow:{glow:'0 0 60px -12px rgba(0,176,247,.45)'}}}}</script>
</head>
<body class="bg-ink font-sans text-slate-300 antialiased selection:bg-accent/30">
<div class="pointer-events-none absolute top-0 left-0 h-[600px] w-full bg-[radial-gradient(ellipse_at_top,_var(--tw-gradient-stops))] from-cyan-800/25 via-ink/0 to-transparent -z-10" aria-hidden="true"></div>
<a class="sr-only focus:not-sr-only focus:absolute focus:left-4 focus:top-4 focus:z-[60] focus:rounded-lg focus:bg-accent focus:px-4 focus:py-2 focus:text-[#04121F]" href="#main">Skip to content</a>
<header class="sticky top-0 z-50 border-b border-[#060D16] bg-ink/80 backdrop-blur-xl">
<div class="mx-auto flex h-16 max-w-7xl flex-wrap items-center justify-between gap-x-6 gap-y-1 px-6">
<a href="index.html" class="flex items-center gap-2.5" aria-label="Soroban DevKit home">
<img src="logo.svg" alt="Soroban DevKit" class="h-9 w-9" aria-hidden="true">
<span class="font-semibold text-white">Soroban DevKit</span>
</a>
<nav class="flex flex-wrap items-center justify-end gap-x-6 gap-y-1 text-sm md:gap-x-7" aria-label="Primary">
<a href="index.html" class="text-slate-400 transition hover:text-white">Home</a>
<a href="features.html" class="text-slate-400 transition hover:text-white">Features</a>
<a href="docs.html" class="text-accent">Docs</a>
<a href="examples.html" class="text-slate-400 transition hover:text-white">Examples</a>
<a href="blog.html" class="text-slate-400 transition hover:text-white">Blog</a>
<a href="#install" class="rounded-lg bg-gradient-to-r from-accent to-electric px-4 py-2 font-semibold text-[#04121F] shadow-glow transition hover:brightness-110">Get Started</a>
</nav>
</div>
</header>
<main id="main" class="relative mx-auto max-w-7xl px-6 pb-24">
<!-- HERO -->
<section id="top" class="pt-12 lg:pt-16">
<p class="inline-flex items-center gap-2 rounded-full border border-accent/30 bg-accent/10 px-3 py-1 font-mono text-[11px] font-semibold uppercase tracking-[0.14em] text-accent">Documentation</p>
<h1 class="mt-4 max-w-3xl text-4xl font-extrabold leading-[1.08] tracking-tight text-white md:text-5xl">Install, verify, and <span class="bg-gradient-to-r from-cyan-400 to-blue-500 bg-clip-text text-transparent">ship with confidence.</span></h1>
<p class="mt-5 max-w-2xl text-lg text-slate-400">Everything runs offline unless a command is explicitly network-aware. Commands below are copy-pasteable and match the CLI source.</p>
<div class="mt-7 flex flex-wrap gap-3">
<a href="#install" class="rounded-lg bg-gradient-to-r from-accent to-electric px-5 py-2.5 font-semibold text-[#04121F] shadow-glow transition hover:brightness-110">Install <span aria-hidden="true">→</span></a>
<a href="https://github.com/SaboLabs/soroban-devkit/blob/main/docs/reference/cli.md" rel="noopener" class="rounded-lg border border-[#0A1A2E] bg-[#000815] px-5 py-2.5 font-medium text-white backdrop-blur-md transition hover:bg-[#001020]">Full CLI reference <span aria-hidden="true">→</span></a>
</div>
</section>
<!-- BODY: sidebar + content -->
<div class="mt-12 grid gap-10 lg:grid-cols-[220px_1fr] lg:items-start">
<aside class="rounded-2xl border border-[#0A1A2E] bg-[#000815] p-5 backdrop-blur-md lg:sticky lg:top-24" aria-label="Documentation sections">
<nav class="flex flex-col gap-0.5 lg:gap-1">
<p class="px-2 pb-2 font-mono text-[9px] uppercase tracking-[0.16em] text-slate-600">Getting started</p>
<a href="#install" class="rounded-md bg-accent/10 px-2 py-1.5 text-sm text-accent">Install</a>
<a href="#quickstart" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">Quick start</a>
<a href="#first-contract" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">First contract</a>
<p class="px-2 pb-2 pt-5 font-mono text-[9px] uppercase tracking-[0.16em] text-slate-600">Guides</p>
<a href="#fuzzing" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">Fuzzing</a>
<a href="#upgrade-safety" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">Upgrade safety</a>
<a href="#release-assurance" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">Release assurance</a>
<a href="#ci-cd" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">CI/CD</a>
<p class="px-2 pb-2 pt-5 font-mono text-[9px] uppercase tracking-[0.16em] text-slate-600">Reference</p>
<a href="#cli-tree" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">CLI tree</a>
<a href="#exit-codes" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">Exit codes</a>
<a href="#audit-rules" class="rounded-md px-2 py-1.5 text-sm text-slate-400 transition hover:bg-white/5 hover:text-white">Audit rules</a>
</nav>
</aside>
<div class="min-w-0 space-y-16">
<!-- INSTALL -->
<section id="install" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Install</h2>
<p class="mt-3 text-slate-400">Three paths. Pick one. All produce a <code class="text-accent">sdkt</code> binary that reports a version.</p>
<div class="mt-6 space-y-5">
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">A · install script (no Rust toolchain)</span><span class="rounded border border-accent/30 bg-accent/10 px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-accent">recommended</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code><span class="text-slate-600"># downloads the release binary for your OS/arch,</span>
<span class="text-slate-600"># verifies its SHA-256 checksum, installs to ~/.local/bin</span>
curl -fsSL https://raw.githubusercontent.com/SaboLabs/soroban-devkit/main/install.sh | bash
<span class="text-slate-600"># pin a version</span>
SDKT_VERSION=v2.7.0 curl -fsSL \
https://raw.githubusercontent.com/SaboLabs/soroban-devkit/main/install.sh | bash</code></pre>
</div>
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">B · crates.io (Rust 1.88.0+)</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">v2.7.0</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>cargo install sdkt-cli
sdkt --version
<span class="text-slate-600"># -> sdkt 2.7.0</span></code></pre>
</div>
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">C · build from source</span><span class="rounded border border-accent/30 bg-accent/10 px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-accent">main</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>git clone https://github.com/SaboLabs/soroban-devkit
cd soroban-devkit
cargo build --release
./target/release/sdkt --version</code></pre>
</div>
</div>
<p class="mt-5 rounded-xl border border-accent/20 bg-accent/[0.06] px-4 py-3 text-sm text-slate-400">Fuzzing (<code class="text-accent">sdkt fuzz</code>) and artifact security (<code class="text-accent">sdkt security</code>) are on <code class="text-accent">main</code> and are not in the v2.7.0 release binary or on crates.io. Use path C to run them.</p>
</section>
<!-- QUICKSTART -->
<section id="quickstart" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Quick start</h2>
<p class="mt-3 text-slate-400">Four offline steps, no RPC and no account. Every command was run against the current CLI before being written here.</p>
<div class="mt-6 space-y-5">
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">1 · inspect a contract WASM</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">offline</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code><span class="text-slate-600"># the repo ships two tiny fixture contracts</span>
sdkt wasm inspect crates/sdkt-cli/tests/fixtures/us_old.wasm
<span class="text-slate-600"># reports size, SHA-256, custom sections, exports, and the contract spec</span></code></pre>
</div>
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">2 · audit contract source</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">offline</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>sdkt audit examples/sample_token/src/lib.rs
<span class="text-slate-600"># -> [critical] AUTH-001 [SampleToken::admin_action]:</span>
<span class="text-slate-600"># Function `SampleToken::admin_action` looks privileged but does not call require_auth()</span></code></pre>
</div>
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">3 · diff an upgrade for breaking changes</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">offline</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>sdkt diff \
--old-wasm crates/sdkt-cli/tests/fixtures/us_old.wasm \
--new-wasm crates/sdkt-cli/tests/fixtures/us_new.wasm \
--upgrade-safety
<span class="text-slate-600"># -> Compatible: NO</span>
<span class="text-slate-600"># Breaking: removed mint(), transfer(), event Transfer, type Point</span></code></pre>
</div>
<div class="overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">4 · first fuzz campaign</span><span class="rounded border border-accent/30 bg-accent/10 px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-accent">main</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>sdkt fuzz campaign crates/sdkt-cli/tests/fixtures/us_new.wasm \
--seed 42 --cases 4 --expect-error hello:Auth:6 \
--artifact-dir ./artifacts
<span class="text-slate-600"># -> executed=4 passed=2 expected_errors=0 findings=2 skipped=0</span>
<span class="text-slate-600"># FINDING case0000 hello RETURN_MISMATCH (minimized_complexity=10)</span>
<span class="text-slate-600"># evidence: completed=true findings=2 minimized=2 deterministic=true</span></code></pre>
</div>
</div>
</section>
<!-- FIRST CONTRACT -->
<section id="first-contract" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">First contract</h2>
<p class="mt-3 text-slate-400">The repository ships <code class="text-accent">examples/sample_token/src/lib.rs</code> — a minimal Soroban contract with one deliberately unguarded entrypoint so <code class="text-accent">sdkt audit</code> produces a deterministic AUTH-001 finding. It is analyzed as Rust source only; it does not need to be compiled.</p>
<p class="mt-3 text-slate-400">Also included: <code class="text-accent">examples/sample_scval.b64</code>, a single valid base64 <code class="text-accent">ScVal</code> for <code class="text-accent">sdkt decode --type ScVal</code> without needing a network.</p>
</section>
<!-- FUZZING -->
<section id="fuzzing" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Fuzzing</h2>
<p class="mt-3 text-slate-400">Deterministic campaigns in an isolated in-memory Soroban host (<code class="text-accent">soroban-env-host</code> 28.0.2). Your compiled WASM never leaves your machine — no RPC, no ledger, no signing, no telemetry.</p>
<p class="mt-3 text-slate-400">Declare expectations with <code class="text-accent">--expect-success</code> / <code class="text-accent">--expect-error</code>; violations become findings. Every finding is minimized and written as a canonical artifact that re-executes byte-identically in a separate process.</p>
<div class="mt-6 overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">replay a recorded finding</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">offline</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>sdkt fuzz replay ./artifacts/finding-case0000-return_mismatch.json \
--wasm crates/sdkt-cli/tests/fixtures/us_new.wasm
<span class="text-slate-600"># -> REPRODUCED reason=RETURN_MISMATCH artifact_hash=6f54856da0f2bd…</span></code></pre>
</div>
<p class="mt-5 rounded-xl border border-accent/20 bg-accent/[0.06] px-4 py-3 text-sm text-slate-400">A finding is evidence of a declaration mismatch, not a vulnerability claim. Pilot totals (45/45, 12/12, 11/11 REPRODUCED) come from three specific external contracts, not a universal guarantee. Method: <a class="text-accent hover:underline" href="https://github.com/SaboLabs/soroban-devkit/blob/main/docs/reference/fuzz-real-contract-evidence.md" rel="noopener">fuzz-real-contract-evidence.md</a>.</p>
</section>
<!-- UPGRADE SAFETY -->
<section id="upgrade-safety" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Upgrade safety</h2>
<p class="mt-3 text-slate-400">Offline WASM-to-WASM diff with a breaking-change verdict, plus operator-supplied size and growth policies (<code class="text-accent">--max-size-bytes</code>, <code class="text-accent">--max-growth-pct</code>). No Stellar network limit is hardcoded, and passing a threshold does not assert network-limit compliance.</p>
</section>
<!-- RELEASE ASSURANCE -->
<section id="release-assurance" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Release assurance</h2>
<p class="mt-3 text-slate-400">Artifact, security audit, upgrade safety, deployed verification, and contract health aggregated into one read-only <code class="text-accent">PASS</code> / <code class="text-accent">REVIEW</code> / <code class="text-accent">FAIL</code> verdict. A skipped section is never flattened into <code class="text-accent">PASS</code>.</p>
<div class="mt-6 overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">aggregated release decision</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">read-only</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>sdkt release-assurance --wasm crates/sdkt-cli/tests/fixtures/us_old.wasm
<span class="text-slate-600"># -> Artifact PASS · Security SKIPPED · Upgrade Safety SKIPPED</span>
<span class="text-slate-600"># Verification SKIPPED · Contract Health SKIPPED</span>
<span class="text-[#F59E0B]"># RELEASE STATUS REVIEW</span></code></pre>
</div>
<p class="mt-5 rounded-xl border border-accent/20 bg-accent/[0.06] px-4 py-3 text-sm text-slate-400"><code class="text-accent">REVIEW</code> here, not <code class="text-accent">PASS</code>: four on-chain sections are <code class="text-accent">SKIPPED</code> because <code class="text-accent">--contract</code> was omitted. Pass <code class="text-accent">--contract</code> (read-only) to run deployed verification and health.</p>
</section>
<!-- CI/CD -->
<section id="ci-cd" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">CI/CD</h2>
<p class="mt-3 text-slate-400">The same release-assurance engine ships as a reusable GitHub Action. It accepts <code class="text-accent">wasm</code>, optional <code class="text-accent">audit</code>, <code class="text-accent">contract</code>, and the size-policy inputs, and fails the step on <code class="text-accent">FAIL</code> or any non-zero CLI exit.</p>
<div class="mt-6 overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">.github/workflows/release.yml</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">yaml</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>- uses: SaboLabs/soroban-devkit@main
with:
command: release-assurance
wasm: target/wasm32v1-none/release/my_contract.wasm
audit: crates/my-contract/src/lib.rs
max-size-bytes: "131072"</code></pre>
</div>
<p class="mt-5 text-sm text-slate-400">Full guide: <a class="text-accent hover:underline" href="https://github.com/SaboLabs/soroban-devkit/blob/main/docs/compatibility/ci-cd.md" rel="noopener">docs/compatibility/ci-cd.md</a>.</p>
</section>
<!-- CLI TREE -->
<section id="cli-tree" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">CLI tree</h2>
<p class="mt-3 text-slate-400">32 top-level commands. The full tree with every flag lives in <a class="text-accent hover:underline" href="https://github.com/SaboLabs/soroban-devkit/blob/main/docs/reference/cli.md" rel="noopener">docs/reference/cli.md</a>, kept in step with the clap definitions.</p>
<div class="mt-6 overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="flex items-center justify-between border-b border-[#060D16] bg-[#010916] px-4 py-2 font-mono text-[11px]"><span class="text-slate-300">sdkt — top-level commands</span><span class="rounded border border-[#0A1A2E] px-1.5 py-0.5 text-[9px] uppercase tracking-wider text-slate-400">v2.7.0 + main</span></div>
<pre class="overflow-x-auto p-4 font-mono text-[11px] leading-7 text-slate-300"><code>decode encode storage inspect verify health tx events
account fee wasm diff audit identity network deployment-verify
init deploy build call invoke lock package project plugin
release-assurance completions doctor
<span class="text-slate-600"># on main only:</span>
security fuzz generate</code></pre>
</div>
</section>
<!-- EXIT CODES -->
<section id="exit-codes" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Exit codes</h2>
<p class="mt-3 text-slate-400">Most commands exit <code class="text-accent">0</code> on success and <code class="text-accent">1</code> on a genuine input or transport error. Two gates are deliberate:</p>
<ul class="mt-4 space-y-2 text-sm text-slate-400" role="list">
<li class="flex gap-3"><span class="mt-1.5 h-1.5 w-1.5 shrink-0 rounded-full bg-accent"></span><span><strong class="text-white">release-assurance</strong> — exit <code class="text-accent">1</code> only when <code class="text-accent">release_status</code> is <code class="text-accent">FAIL</code>; <code class="text-accent">REVIEW</code> exits <code class="text-accent">0</code>.</span></li>
<li class="flex gap-3"><span class="mt-1.5 h-1.5 w-1.5 shrink-0 rounded-full bg-accent"></span><span><strong class="text-white">health</strong> — exit non-zero on a <code class="text-accent">critical</code> verdict; <code class="text-accent">at_risk</code> stays <code class="text-accent">0</code>.</span></li>
</ul>
<p class="mt-5 rounded-xl border border-accent/20 bg-accent/[0.06] px-4 py-3 text-sm text-slate-400"><code class="text-accent">sdkt audit</code> exits <code class="text-accent">0</code> even when it reports <code class="text-accent">critical</code> findings — the CLI does not encode severity into its exit status. Gate on <code class="text-accent">summary.critical</code> from <code class="text-accent">--format json</code>, or the Action's <code class="text-accent">severity-threshold</code> input.</p>
</section>
<!-- AUDIT RULES -->
<section id="audit-rules" class="scroll-mt-24">
<h2 class="text-2xl font-bold tracking-tight text-white">Audit rules</h2>
<div class="mt-6 overflow-hidden rounded-2xl border border-[#0A1A2E] bg-[#000815]">
<div class="overflow-x-auto">
<table class="w-full min-w-[640px] text-left text-sm">
<thead>
<tr class="border-b border-[#060D16] font-mono text-[10px] uppercase tracking-[0.14em] text-slate-500">
<th class="px-6 py-3 font-medium">Rule</th>
<th class="px-6 py-3 font-medium">Severity</th>
<th class="px-6 py-3 font-medium">Detects</th>
</tr>
</thead>
<tbody class="divide-y divide-white/5">
<tr><td class="px-6 py-3 font-mono text-white">AUTH-001</td><td class="px-6 py-3"><span class="rounded-full border border-[#FB7185]/40 bg-[#FB7185]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#FB7185]">critical</span></td><td class="px-6 py-3 text-slate-400">Missing <code class="text-accent">require_auth()</code> on a privileged/admin function</td></tr>
<tr><td class="px-6 py-3 font-mono text-white">AUTH-002</td><td class="px-6 py-3"><span class="rounded-full border border-[#FB7185]/40 bg-[#FB7185]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#FB7185]">critical</span></td><td class="px-6 py-3 text-slate-400"><code class="text-accent">invoke_contract()</code> without <code class="text-accent">require_auth()</code> in the same function</td></tr>
<tr><td class="px-6 py-3 font-mono text-white">AUTH-003</td><td class="px-6 py-3"><span class="rounded-full border border-[#F59E0B]/40 bg-[#F59E0B]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#F59E0B]">warning</span></td><td class="px-6 py-3 text-slate-400">Unguarded <code class="text-accent">initialize()</code> entrypoint</td></tr>
<tr><td class="px-6 py-3 font-mono text-white">AUTH-004</td><td class="px-6 py-3"><span class="rounded-full border border-[#FB7185]/40 bg-[#FB7185]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#FB7185]">critical</span></td><td class="px-6 py-3 text-slate-400">Token transfer without <code class="text-accent">require_auth()</code> on source/destination</td></tr>
<tr><td class="px-6 py-3 font-mono text-white">MOVE-001</td><td class="px-6 py-3"><span class="rounded-full border border-[#F59E0B]/40 bg-[#F59E0B]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#F59E0B]">warning</span></td><td class="px-6 py-3 text-slate-400">Suspicious move-after-use heuristic</td></tr>
<tr><td class="px-6 py-3 font-mono text-white">MATH-001</td><td class="px-6 py-3"><span class="rounded-full border border-[#F59E0B]/40 bg-[#F59E0B]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#F59E0B]">warning</span></td><td class="px-6 py-3 text-slate-400">Division before multiplication can truncate precision</td></tr>
<tr><td class="px-6 py-3 font-mono text-white">CEI-001</td><td class="px-6 py-3"><span class="rounded-full border border-[#F59E0B]/40 bg-[#F59E0B]/10 px-2.5 py-0.5 font-mono text-[10px] font-bold text-[#F59E0B]">warning</span></td><td class="px-6 py-3 text-slate-400">External call precedes state write (Checks-Effects-Interactions hazard)</td></tr>
</tbody>
</table>
</div>
</div>
<p class="mt-5 text-sm text-slate-400">Extensible via sandboxed WASM or native plugin rules — see <a class="text-accent hover:underline" href="https://github.com/SaboLabs/soroban-devkit/blob/main/docs/plugins/plugin-authoring.md" rel="noopener">plugin-authoring.md</a>.</p>
</section>
<!-- HELP CTA -->
<section class="rounded-3xl border border-[#0A1A2E] bg-gradient-to-br from-accent/10 via-transparent to-electric/5 p-10 text-center backdrop-blur-md">
<h2 class="text-2xl font-bold tracking-tight text-white">Need the full reference?</h2>
<p class="mx-auto mt-3 max-w-xl text-slate-400">The complete CLI reference, architecture notes, compatibility matrix, and plugin authoring guide live in the repository.</p>
<div class="mt-7 flex flex-wrap justify-center gap-3">
<a href="https://github.com/SaboLabs/soroban-devkit/blob/main/docs/reference/cli.md" rel="noopener" class="rounded-lg bg-gradient-to-r from-accent to-electric px-5 py-2.5 font-semibold text-[#04121F] shadow-glow transition hover:brightness-110">CLI reference <span aria-hidden="true">→</span></a>
<a href="https://github.com/SaboLabs/soroban-devkit/issues" rel="noopener" class="rounded-lg border border-[#0A1A2E] bg-[#000815] px-5 py-2.5 font-medium text-white transition hover:bg-[#001020]">Open an issue <span aria-hidden="true">→</span></a>
</div>
</section>
</div>
</div>
</main>
<footer class="border-t border-[#060D16] bg-[#010916]">
<div class="mx-auto max-w-7xl px-6 py-10">
<div class="grid gap-8 md:grid-cols-[1.5fr_1fr_1fr_1fr]">
<div>
<div class="flex items-center gap-2.5">
<img src="logo.svg" alt="Soroban DevKit" class="h-8 w-8" aria-hidden="true">
<span class="font-semibold text-white">Soroban DevKit</span>
</div>
<p class="mt-3 max-w-xs text-sm text-slate-500">Release assurance for Stellar Soroban smart contracts.</p>
</div>
<div>
<h4 class="font-mono text-[10px] uppercase tracking-[0.14em] text-slate-500">Project</h4>
<ul class="mt-3 space-y-2 text-sm">
<li><a href="https://github.com/SaboLabs/soroban-devkit" rel="noopener" class="text-slate-400 transition hover:text-accent">GitHub</a></li>
<li><a href="https://github.com/SaboLabs/soroban-devkit/releases" rel="noopener" class="text-slate-400 transition hover:text-accent">Releases</a></li>
<li><a href="https://github.com/SaboLabs/soroban-devkit/blob/main/CHANGELOG.md" rel="noopener" class="text-slate-400 transition hover:text-accent">Changelog</a></li>
<li><a href="https://github.com/SaboLabs/soroban-devkit/blob/main/LICENSE" rel="noopener" class="text-slate-400 transition hover:text-accent">License (MIT)</a></li>
</ul>
</div>
<div>
<h4 class="font-mono text-[10px] uppercase tracking-[0.14em] text-slate-500">Documentation</h4>
<ul class="mt-3 space-y-2 text-sm">
<li><a href="index.html" class="text-slate-400 transition hover:text-accent">Home</a></li>
<li><a href="features.html" class="text-slate-400 transition hover:text-accent">Features</a></li>
<li><a href="examples.html" class="text-slate-400 transition hover:text-accent">Examples</a></li>
<li><a href="blog.html" class="text-slate-400 transition hover:text-accent">Blog</a></li>
<li><a href="playground/" class="text-slate-400 transition hover:text-accent">Web Playground</a></li>
</ul>
</div>
<div>
<h4 class="font-mono text-[10px] uppercase tracking-[0.14em] text-slate-500">Community</h4>
<ul class="mt-3 space-y-2 text-sm">
<li><a href="https://github.com/SaboLabs/soroban-devkit/issues" rel="noopener" class="text-slate-400 transition hover:text-accent">Issues</a></li>
<li><a href="https://github.com/SaboLabs/soroban-devkit/blob/main/CONTRIBUTING.md" rel="noopener" class="text-slate-400 transition hover:text-accent">Contributing</a></li>
<li><a href="https://github.com/SaboLabs/soroban-devkit/blob/main/SECURITY.md" rel="noopener" class="text-slate-400 transition hover:text-accent">Security Policy</a></li>
</ul>
</div>
</div>
<div class="mt-10 flex flex-col gap-2 border-t border-[#060D16] pt-6 font-mono text-[11px] text-slate-600 md:flex-row md:items-center md:justify-between">
<span>Soroban DevKit v2.7.0 · MIT License</span>
<span>Not affiliated with the Stellar Development Foundation.</span>
</div>
</div>
</footer>
</body>
</html>