refactor(cli): generate contracts with @cartesi/wagmi-plugin

[brunomenezes]

Summary

Code changes that replace the use of @sunodo/wagmi-plugin-hardhat-deploy + @cartesi/devnet package in favour of @cartesi/wagmi-plugin from rollups-ts repository.

export default defineConfig({
    out: "src/contracts.ts",
    plugins: [
        rollupsContracts(),
        // rollupsPrtContracts(),   // waiting on cartesi/rollups-ts#162
    ],
});

apps/cli no longer depends on @cartesi/devnet at all.

Important

This PR does not build yet and is opened for review of the direction. bun run --cwd apps/cli compile fails with 4 tsc errors in src/ plus one in tests/, all from the missing PRT contracts. See the checklist.

Changes

file	change
apps/cli/wagmi.config.ts	hardhatDeploy({ directory: … }) → rollupsContracts(); rollupsPrtContracts() left commented out
apps/cli/package.json	drop @cartesi/devnet and @sunodo/wagmi-plugin-hardhat-deploy, add @cartesi/wagmi-plugin@1.0.0-alpha.4
apps/cli/src/base.ts	surface three contracts the new codegen provides in cartesi address-book

@cartesi/wagmi-plugin is pinned exactly, as @cartesi/devnet was — the plugin version determines codegen output. 1.0.0-alpha.4 is the newest published version. (Its README says to install @alpha, but that dist-tag currently points at 1.0.0-alpha.0, hence the explicit pin.)

What the generated file looks like now

rollupsContracts() with no options defaults to rollups-contracts v3.0.0-alpha.9, and — since plugin 1.0.0-alpha.4 — reads the release's anvil tarball too, so chain 31337 is covered out of the box.

• 40 contracts generated, 18 of them with addresses (was 23 / 23 via @cartesi/devnet).
• src/contracts.ts is 5,694 lines, up from 3,446. The artifacts tarball also carries the dependency tree the contracts are compiled against; an include list on rollupsContracts() would trim it if the bundle growth matters.
• Every address is identical on all supported chains including 31337, so each one generates as a plain string rather than a chain-id record.
• New symbols that @cartesi/devnet did not provide: refundOutputBuilder*, testUsdc*, plus ABIs for the interfaces and dependencies.

Warning

Every contract address changes. @cartesi/devnet builds from rollups-contracts v3.0.0-alpha.6; the plugin now defaults to v3.0.0-alpha.9. For example inputBoxAddress goes 0x346B3df038FE9f8380071eC6514D5a83aD143939 → 0x45daF6f9aA5fc563aB59481FDa36A281e5dB3812. This is the point of blocker 2 below: the generated addresses and the Anvil state the SDK image loads have to be bumped together.

Address book additions

Three contracts the release now provides are added to cartesi address-book:

entry	where	notes
TestUsdc	devnet only	a devnet test token new in alpha.9, alongside the existing TestToken / TestNFT / TestMultiToken
RefundOutputBuilder	devnet and live chains	new in rollups-contracts between alpha.6 and alpha.9, so @cartesi/devnet never had it
UsdWithdrawalOutputBuilderFactory	devnet and live chains	already generated before, just never surfaced in the address book — it is the factory behind the existing TestUsdWithdrawalOutputBuilder entry

Only five contracts in alpha.9 are genuinely devnet-only — TestFungibleToken, TestMultiToken, TestNonFungibleToken, TestUsdc and TestUsdWithdrawalOutputBuilder. The other two above are deployed at the same address on all nine chains, which is why they go in commonContracts.

This changes cartesi address-book output: 14 devnet rows become 17, and the fork output gains 2.

Merge blockers

1. The PRT contracts are not generated yet

rollupsPrtContracts is added by cartesi/rollups-ts#162, still an open draft (now rebased onto prerelease/v2-alpha; its dependency #151 is merged and shipped in plugin 1.0.0-alpha.4). Until #162 lands, daveAppFactoryAbi and daveAppFactoryAddress do not exist.

Breaks src/base.ts:18, src/validations.ts:11-12, src/compose/node.ts:4 and tests/unit/validations.test.ts:4 — the only remaining build failures.

Uncommenting the rollupsPrtContracts() line fixes all of them. daveAppFactoryAddress has 6 distinct values across the 8 public chains, so the plugin will keep it as a chain-id record and the daveAppFactoryAddress[chainId] lookups keep compiling.

2. Version alignment with the SDK image

The devnet Anvil state the CLI actually talks to is baked into the SDK image, and it is built from dave v3.0.0-alpha.3, i.e. rollups-contracts v3.0.0-alpha.6. Codegen now emits v3.0.0-alpha.9 addresses. Until the image catches up, cartesi run on devnet would talk to addresses that hold no code.

#515 is the other half: it moves the SDK image off @cartesi/devnet too, pulling anvil_state.json straight from the dave release (CARTESI_PRT_VERSION = 3.0.0-alpha.4, FOUNDRY_VERSION = 1.5.1), and it stops shipping /usr/share/cartesi/deployments and printing the address list from the devnet script — "use cartesi address-book". It depends on dave v3.0.0-alpha.4, which is not released yet (alpha.3 is the newest).

So this PR and #515 must land together, with DEFAULT_SDK_VERSION in src/config.ts:93 bumped to the resulting image, and the generated 31337 addresses re-checked against deployments/31337/ in the dave anvil tarball that image loads. That check also confirms dave alpha.4 is built against rollups-contracts alpha.9 rather than an earlier release — the matching anvil version (1.5.1 in both) is suggestive but not proof.

Worth knowing: after #515, this generated file is the only place devnet addresses are printed, so a codegen mistake is no longer cross-checkable at runtime.

Resolved by @cartesi/wagmi-plugin@1.0.0-alpha.4

Two blockers listed in earlier revisions of this description are gone, both closed by the plugin release rather than by changes here:

• Chain 31337 / the devnet-only test tokens. The release's *-deployment-addresses.tar.gz covers only the live chains; 31337 ships in a separate *-anvil-*.tar.gz asset. The plugin now reads it through a new anvil option that defaults to the same release's tarball (DEFAULT_ANVIL, DEFAULT_ANVIL_VERSION), so testFungibleTokenAddress, testMultiTokenAddress, testNonFungibleTokenAddress and testUsdWithdrawalOutputBuilderAddress all generate. Pass anvil: false for livenet-only output.
• TestUsdWithdrawalOutputBuilder had no build artifact. The release publishes no artifact for the concrete contract the factory instantiates; the plugin now aliases its ABI to IUsdWithdrawalOutputBuilder.

Checklist before merge

• cartesi/rollups-ts lands #162 and publishes a version exporting rollupsPrtContracts
• Bump the @cartesi/wagmi-plugin pin and uncomment rollupsPrtContracts()
• dave releases v3.0.0-alpha.4, #515 merges, and an SDK image ships
• Bump DEFAULT_SDK_VERSION in apps/cli/src/config.ts to that image
• Confirm dave v3.0.0-alpha.4 is built against rollups-contracts v3.0.0-alpha.9, and that the generated 31337 addresses match deployments/31337/ in its anvil tarball
• bun run --cwd apps/cli codegen && bun run --cwd apps/cli compile clean
• bun test apps/cli/ green — the expected addresses in tests/unit/validations.test.ts and tests/unit/compose/node.test.ts need updating for alpha.9
• bun lint clean
• Smoke test against the new SDK image: cartesi run, cartesi address-book (devnet and --fork on a public chain, checking the three new entries resolve), cartesi run --prt, cartesi deposit erc20 against TestFungibleToken

Follow-up (separate PR)

Once this and #515 are both in, nothing consumes packages/devnet any more. It can be deleted outright, along with .github/workflows/devnet.yaml, its workspace entry, and its row in CLAUDE.md. That is the endpoint this branch is named for.

Notes for reviewers

• Codegen now needs network access. The plugin downloads and hash-verifies three tarballs (artifacts, deployment addresses, anvil) on every run and keeps nothing between runs, by design. Offline builds of apps/cli will fail; CI is unaffected.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1f8e52f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cartesi/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cartesi/​wagmi-plugin@​1.0.0-alpha.4
	modern-tar@​0.7.7

View full report