> For the complete documentation index, see [llms.txt](https://argon-4.gitbook.io/argon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://argon-4.gitbook.io/argon-docs/developers/build.md).

# Build from source

Build Enclave and SureSign from source: prerequisites, the kernel build, the extension build, tests, and the gallery.

Everything needed to build Enclave is in the repository and pinned. A build on one machine matches a build on another; see [Verify a release](/argon-docs/developers/verify-a-release.md) for the reproducible path.

## Prerequisites

| Tool                            | Version           | Notes                                                                                                                                      |
| ------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Rust                            | `1.91.0`          | Installed automatically by `rustup` from `rust-toolchain.toml`.                                                                            |
| `wasm32-unknown-unknown` target | matching          | `rustup target add wasm32-unknown-unknown` (the kernel script does this).                                                                  |
| `wasm-bindgen-cli`              | `0.2.100`         | `cargo install wasm-bindgen-cli --version 0.2.100`. Must match the crate's `wasm-bindgen` version exactly.                                 |
| A clang that targets wasm32     | LLVM              | On macOS, Homebrew LLVM (`brew install llvm`); Apple's clang cannot target wasm32. The script finds it or set `CC_wasm32_unknown_unknown`. |
| Node                            | `22.22.1` exactly | Pinned in `extension/package.json` `engines`; the release script refuses any other.                                                        |
| Python 3                        | any recent        | Used by the build scripts for small tasks (zip packing, target lookup).                                                                    |

## Build the kernel

```bash
scripts/build-kernel-wasm.sh
```

This compiles `suresign` for `wasm32-unknown-unknown` with the `wasm` feature in release mode and emits the module and its JavaScript glue into `extension/public/wasm/` (`suresign.js`, `suresign_bg.wasm`, type definitions). The extension checks the module's ABI marker (`abi_version()`) against its own constant on load and refuses a mismatch.

The built module is committed so that a contributor working only on the interface can build the extension without a Rust toolchain. Any change under `core/` must be followed by rebuilding and committing the module.

## Build the extension

```bash
cd extension
npm ci
npm run build          # production build → .output/chrome-mv3
```

Load `.output/chrome-mv3` unpacked at `chrome://extensions` with Developer mode on. `npm run dev` gives a hot-reloading development build. The store zip is not produced by the bundler; `scripts/release.sh` packs it with sorted entries and commit-time stamps so it is reproducible.

## Tests

```bash
# kernel — CI runs exactly these; formatting and clippy are gates, not advice
cargo fmt -p suresign --check
cargo clippy -p suresign --locked --lib --tests -- -D warnings
cargo clippy -p suresign --locked --lib --tests --features wasm -- -D warnings
cargo test -p suresign --locked
cargo test -p suresign --locked --features wasm

# extension
cd extension
npm run typecheck
npm test
```

Kernel tests include the golden vectors, adversarial fixtures, fuzzing baseline, and live-network fixtures described under [SureSign → Verification](/argon-docs/suresign/verification.md). Extension tests run under Node's built-in test runner and include the design-law tests that read the source.

Continuous integration runs the same commands plus `npm audit --omit=dev --audit-level=high` and `cargo deny check`.

## The gallery

```bash
cd extension
npm run gallery        # builds with ENCLAVE_GALLERY=1 and serves .output/chrome-mv3 on :4173
```

The gallery renders every screen of Compact and Studio against fixture data (balances, tokens, vaults, deals, review plans in all three seal states) without a wallet or a node. It is the fastest way to review a visual change across both shells, and it is what the screenshot tooling drives.

## Environment

The extension reads no secrets from the environment. The only build-time variable it uses is `GITHUB_SHA` (set by `release.sh`), which stamps the commit into the build for the About page and the release manifest. There are no API keys anywhere in the build: every remote service Enclave talks to is public.

## Common problems

| Symptom                                                           | Cause                                                                                                     |
| ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| `kernel ABI … does not match host …; rebuild public/wasm` on load | `extension/public/wasm` was built from a different `core/`; run `scripts/build-kernel-wasm.sh`.           |
| `wasm-bindgen` version error                                      | The CLI must be exactly the version the crate depends on (`0.2.100`).                                     |
| `no wasm32-capable clang`                                         | Install LLVM and let the script find it, or export `CC_wasm32_unknown_unknown`.                           |
| `node must be exactly the pinned engines.node`                    | Use a version manager to select `22.22.1`.                                                                |
| Tests pass, build differs from the release                        | You built from a dirty tree or a different commit; the release path requires a clean checkout at the tag. |