@gatedpath/preflight 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 gatedpath and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,189 @@
+# @gatedpath/preflight
+
+```
+For agents
+- Run `redbelly-preflight --project . --chain 153 --account <keystore-name> --admin <safe>` before
+  any deploy and read every line. Exit 1 means do not deploy; fix the failing line, run it again.
+- It never takes a key. --account names a Foundry keystore that cast reads; --address is for a
+  read-only run. If you are tempted to pass a hex string, stop.
+- Mainnet (151) refuses an EOA admin and a Safe with threshold below 2. Testnet warns instead.
+- `--json` for CI and for the MCP server. Pins: solc 0.8.30, EVM prague (verified 2026-09-12).
+```
+
+Seven checks, each printed as `pass`, `fail`, `warn` or `skip` with one sentence saying why,
+then a non-zero exit if anything failed. The package also carries `redbelly-doctor` (the machine
+before the first command) and the `redbelly` bin whose subcommands are `preflight`, `doctor`, `gas`
+(gas per function in RBNT and US cents) and `ship` (the mainnet gate that writes its own report);
+each has a section below. This is the gate PLAN.md sections 5.4 and 6 (Deploy)
+describe, corrected by section 15: there is no network-wide verifier address to match, so the
+deployer's `permission.isAllowed` reading replaces it. Node 18 or newer, TypeScript, one
+runtime dependency (`@gatedpath/chains`, by path). Network traffic is JSON-RPC to the
+one RPC you name and nothing else.
+
+## The checks
+
+| id | What passes | What fails |
+|---|---|---|
+| `chain-id` | The chain in `foundry.toml` (`chain_id`), the Hardhat network's `chainId`, or `--chain` equals the RPC's `eth_chainId` | A mismatch, an RPC that is neither 151 nor 153, or an RPC that does not answer. Skips when nothing states an expected chain. |
+| `deployer-verified` | The deployer passes `permission.isAllowed` on the target chain, read through the bootstrap registry | `isAllowed` is false: the wallet has not been through access.redbelly.network. Warns, whatever `isAllowed` says, when the deployer is one of the ten anvil/Hardhat default accounts, whose keys are public and two of which pass `isAllowed` on both networks (RESEARCH.md question 30) |
+| `admin-safe` | `--admin` holds a SafeProxy whose slot 0 is the canonical Safe 1.4.1 singleton or SafeL2 singleton, that singleton's code hashes to the 1.4.1 release, and `getThreshold()` is 2 or more | On 151 an EOA, a non-Safe contract, foreign singleton code or threshold 1 fails; on 153 each of those is a warning |
+| `compiler-pins` | `solc_version` (or `solc`) is 0.8.30 and `evm_version` is prague; Hardhat `solidity.version` and `settings.evmVersion` likewise | Anything else, or no config file |
+| `git-secrets` | No added line anywhere in `git log -p --all` is secret-shaped, and no `.env` is tracked | A bare 64-hex value, a 0x 64-hex value on a line about a key, `PRIVATE_KEY=` with a real value, twelve consecutive BIP-39 words, or a keystore JSON. Skips outside git. |
+| `balance` | Deployer balance covers `--gas` times the latest base fee, priced through the on-chain feed by `gasCostUsd`, plus 25 percent | Short, with the RBNT and USD figures and where to get testnet coins |
+| `slither-report` | `reports/slither.json` or `reports/slither.md` (or `--slither-report`) exists and describes the sources as they are: when a `slither.sources.sha256` sidecar sits beside it, the SHA-256 of every `.sol` under the source directory must equal it; without a sidecar, the report must be newer than every source | Missing, a sidecar that no longer matches, or (with no sidecar) older than a source |
+
+"Newer" inside a git repository means the commit time of the file's last change, or the
+working-tree mtime for a modified or untracked file; a checkout gives every file the same
+mtime, so mtimes alone would say nothing. Outside git, mtimes. The time rule has a hole,
+found on 2026-09-12 while running the prompt cards: a clean project's report has no findings,
+so re-running Slither writes byte-identical JSON, git records no change, and the report can
+never become "newer" than a source that was edited after it. Hence the sidecar: the scaffold's
+`npm run lint:slither` writes `reports/slither.sources.sha256` (SHA-256 over every `.sol`
+under `src/`, sorted by POSIX path, each as `path`, newline, bytes, NUL), and when the sidecar
+exists the check compares hashes and ignores times. `hashSources(dir)` is exported for tools
+that write the sidecar.
+
+The secrets check streams `git log -p --all --unified=0` and looks only at added lines, so a
+key that was committed and later deleted still fails: it is in the history and history is
+what gets cloned. Findings name the file, the commit and the kind of match, never the text.
+Lockfiles, `lib/`, `out/`, `node_modules/` and minified files are skipped; lines that mention
+sha256, keccak, integrity, a tx hash or a JSON `"id"` are treated as hashes.
+
+## redbelly-doctor
+
+The machine before the first command (PLAN.md 18.3). `redbelly-doctor` (also `redbelly doctor`,
+`npm run doctor` in a scaffold, and the MCP server's `doctor` tool) prints one line per check with
+`pass`, `warn` or `fail` and the fix on the same line, and exits 0 only when every required check
+passes; `--json` for agents. The fix text is the failure table's (`@gatedpath/agent-rules`), so
+`explain_failure` says the same thing about a pasted doctor line.
+
+| id | required | What it checks |
+|---|---|---|
+| `node` | yes | Node 22 or later |
+| `git` | yes | git on PATH |
+| `forge`, `anvil`, `cast` | yes | each on PATH and answering `--version` |
+| `foundry-version` | yes | the three report one version |
+| `foundry-exit-code` | yes | each hands its exit code back. The `@foundry-rs` npm packages (1.7.1) install a Node shim that exits 0 whatever the binary returned, so a failed `forge build` reports success; doctor probes with a flag no binary knows (the real ones exit 2, the shim 0), names the shim, and prints the `ln -sf` line to the real binary it found in the platform package beside it |
+| `slither`, `aderyn` | no | on PATH; a warning when missing or not at the version CI pins (0.11.6, 0.6.8) |
+| `env-tracked` | yes | no `.env` or `.env.*` (other than `.env.example`) in `git ls-files` |
+| `vendor` | yes | in a scaffold, each `vendor/redbelly-*/package.json` version equals the record the scaffolder wrote under `redbelly.vendor` in the root `package.json`; a scaffold without the record warns |
+
+```
+redbelly-doctor [--project <dir>] [--json]
+```
+
+## redbelly gas
+
+A gas report in the unit the chain charges in (PLAN.md 18.3). `redbelly gas` (also `npm run gas` in a
+scaffold and the MCP server's `gas_report` tool) reads `.gas-snapshot` when the project has one (one
+row per test; fuzz lines by their mean) or runs `forge test --gas-report --json` (the deployment and
+every function of the contracts in `gas_reports`), prices each row at the latest base fee and the
+on-chain feed price with the same integer arithmetic as `gasCostUsd`, and prints gas, RBNT and US
+cents per row. `--diff <file>` compares against a previous snapshot or report, either format, and
+adds the gas and cents difference and what was added or gone. Two RPC reads, nothing else.
+
+```
+redbelly gas [--project <dir>] [--chain 151|153] [--rpc <url>] [--snapshot <file>] [--report] [--diff <file>] [--json]
+```
+
+Recorded runs against the real feeds, read-only, on 14 September 2026: `reports/gas-153-2026-09-14.md`
+and `reports/gas-151-2026-09-14.md`. On both, 21,000 gas came to 1.000 US cents and the scaffold's
+`GatedERC20` deploys for 1,898,391 gas, 383.7 RBNT, 90.4 cents at a feed price of US$0.002356 per RBNT.
+
+## redbelly ship
+
+The mainnet gate that produces the document you wanted anyway (PLAN.md 18.3). `redbelly ship --chain
+<151|153> --account <keystore-name> [--admin <safe>] [--gas <n>]` (also `npm run ship` in a scaffold
+and the MCP server's `ship_report` tool) runs the gas report first (its deployment row is the gas the
+balance check prices), then pre-flight's seven checks with the keystore's address, checks the verifier
+(`--verifier` or `VERIFIER` in `.env`; required on 151, where a missing one fails and on 153 warns that
+a `ReceptorMock` will be deployed), runs `forge test --json` and counts the suites that inherit
+`GatedTest`, reads the admin (Safe version, singleton, threshold, owners, `isAllowed`) and writes
+`deployments/ship-<chain>-<date>.md`: a header line `status` reads back, every check with its result,
+the deployer and admin readings, the contracts from `deployments/<chain>-*.json` with their
+constructor arguments and the exact `forge verify-contract` command, the gas table, the tests, the
+Slither line, the compiler pins, and the list of what the report does not prove. It refuses to write
+when any check fails and exits 1 with the failing lines. Run it again after the deploy to fill in the
+contract section; the file is dated in UTC.
+
+The scaffold's `RedbellyDeployScript.sol` refuses to broadcast on 151 without `deployments/ship-151-<today>.md`
+(a dry run says so and continues; 153 warns), and the Hardhat deploy script does the same. Tested on
+a local chain 151 with the mocked registry, the real Safe 1.4.1 bytecode and a keystore `cast wallet
+new` created for the test; nothing signs against a real network.
+
+## Usage
+
+```
+redbelly-preflight [--project <dir>] [--profile <name>] [--chain 151|153] [--rpc <url>]
+                   [--account <keystore-name> [--password-file <path>] | --address <0x…>]
+                   [--admin <0x…>] [--gas <units>] [--slither-report <path>]
+                   [--skip <id,id>] [--json]
+```
+
+`--account` runs `cast wallet address --account <name>` in the project directory; cast
+decrypts the keystore, this process sees the address. Foundry looks for the keystore under
+`$HOME/.foundry/keystores`. Without a terminal, give cast the password with
+`--password-file` or `ETH_PASSWORD`. `--address` does the same checks read-only.
+
+Flags you leave out are filled from the project's `.env` (parsed, never executed) or the
+environment, using the names the scaffolder's templates already use: `DEPLOYER` for
+`--address`, `ADMIN_SAFE` for `--admin`, `CHAIN_ID` for `--chain` when the config names no
+chain. So inside a `create-redbelly-dapp` project the whole call is `redbelly-preflight`.
+`--gas` defaults to 3,000,000; pass what `forge script` estimated. With `--json` the whole
+report (below) goes to stdout.
+
+This is the same set of checks the scaffolder's `RedbellyDeployScript.preflight()` makes in
+Solidity at broadcast time and its `scripts/preflight.mjs` makes offline, generalised so any
+Foundry or Hardhat project can run them, with the history scan, the compiler pins, the
+balance margin and the Slither freshness added.
+
+Exit codes: 0 no check failed (warnings allowed), 1 at least one fail, 2 bad arguments. An
+argument that looks like a private key is a bad argument.
+
+```ts
+import { runPreflight, renderText } from '@gatedpath/preflight';
+const report = await runPreflight({ project: '.', chain: 153, address: '0x…', admin: '0x…', gas: 1_200_000 });
+process.stdout.write(renderText(report));
+if (!report.ok) process.exit(1);
+```
+
+The report: `{ tool, version, generatedAt, project, config: { kind, file, profile }, chain:
+{ expected, reported, rpc, network }, deployer, admin, checks: [{ id, status, reason, data }],
+ok }`. `data` carries the numbers (threshold, balances, feed price, findings); it never
+carries a secret.
+
+## Tests
+
+`npm test` builds, then runs `test/unit.test.mjs` (TOML and Hardhat readers, the secret
+scanner, the Safe fixture hashes) and `test/preflight.test.mjs`, which spawns `anvil`
+twice, on chain 151 and on 153, and:
+
+- etches hand-assembled bytecode for the bootstrap registry, the permission contract and the
+  price feed at the addresses `@gatedpath/chains` records (`test/mocks.mjs`), so the
+  real helpers run their real code paths;
+- etches the genuine Safe 1.4.1 runtime code, read from testnet with `eth_getCode` on
+  2026-09-12 and byte-identical on mainnet (`test/fixtures/safe-1.4.1/`), at the canonical
+  addresses, and deploys proxies through the real `SafeProxyFactory.createProxyWithNonce`
+  from an unlocked anvil account, so `getThreshold()` and the singleton reads are answered by
+  Safe's own logic. Etching, not compiling: no Solidity toolchain in the test and the bytes
+  are the ones on chain;
+- builds temporary git repositories with pinned commit dates for the secrets and Slither
+  checks;
+- creates a throwaway keystore with `cast wallet new` for the `--account` path (the key is
+  generated inside cast, encrypted at once and never printed);
+- checks the hardcoded list of anvil default accounts against the spawned anvil's `eth_accounts`.
+
+29 tests. `npm run test:live` runs the read-only checks against the real testnet RPC using
+the known allowed address from `@gatedpath/chains` as both deployer and admin.
+
+## Last verified
+
+2026-09-12. `npm test`: 29 passed (8 unit, 21 against anvil on 151 and 153). `npm run
+test:live`: 1 passed. The live run's output is committed under `reports/` as
+`testnet-153-2026-09-12.txt` and `.json`: chain, deployer, compiler, secrets, balance and
+Slither pass; the admin warns because the known allowed address is an EOA, which is exactly
+what the check is for. 1,000,000 gas cost 195.96 RBNT, US$0.4762 at the feed's US$0.002431,
+which is the fixed-USD gas model in one line.
+
+Anvil's base fee is not Redbelly's, so the balance figures in the anvil tests only prove
+the arithmetic and the margin; the live run proves the price.

package/dist/bip39-words.d.ts

@@ -0,0 +1 @@
+export declare const BIP39_ENGLISH: ReadonlySet<string>;

package/dist/bip39-words.js

@@ -0,0 +1,132 @@
+// BIP-39 English wordlist (2048 words), fetched from github.com/bitcoin/bips/blob/master/bip-0039/english.txt
+// on 2026-09-12. Used only to spot a seed phrase pasted into a file; nothing here generates keys.
+export const BIP39_ENGLISH = new Set([
+    "abandon", "ability", "able", "about", "above", "absent", "absorb", "abstract", "absurd", "abuse", "access", "accident", "account", "accuse", "achieve", "acid",
+    "acoustic", "acquire", "across", "act", "action", "actor", "actress", "actual", "adapt", "add", "addict", "address", "adjust", "admit", "adult", "advance",
+    "advice", "aerobic", "affair", "afford", "afraid", "again", "age", "agent", "agree", "ahead", "aim", "air", "airport", "aisle", "alarm", "album",
+    "alcohol", "alert", "alien", "all", "alley", "allow", "almost", "alone", "alpha", "already", "also", "alter", "always", "amateur", "amazing", "among",
+    "amount", "amused", "analyst", "anchor", "ancient", "anger", "angle", "angry", "animal", "ankle", "announce", "annual", "another", "answer", "antenna", "antique",
+    "anxiety", "any", "apart", "apology", "appear", "apple", "approve", "april", "arch", "arctic", "area", "arena", "argue", "arm", "armed", "armor",
+    "army", "around", "arrange", "arrest", "arrive", "arrow", "art", "artefact", "artist", "artwork", "ask", "aspect", "assault", "asset", "assist", "assume",
+    "asthma", "athlete", "atom", "attack", "attend", "attitude", "attract", "auction", "audit", "august", "aunt", "author", "auto", "autumn", "average", "avocado",
+    "avoid", "awake", "aware", "away", "awesome", "awful", "awkward", "axis", "baby", "bachelor", "bacon", "badge", "bag", "balance", "balcony", "ball",
+    "bamboo", "banana", "banner", "bar", "barely", "bargain", "barrel", "base", "basic", "basket", "battle", "beach", "bean", "beauty", "because", "become",
+    "beef", "before", "begin", "behave", "behind", "believe", "below", "belt", "bench", "benefit", "best", "betray", "better", "between", "beyond", "bicycle",
+    "bid", "bike", "bind", "biology", "bird", "birth", "bitter", "black", "blade", "blame", "blanket", "blast", "bleak", "bless", "blind", "blood",
+    "blossom", "blouse", "blue", "blur", "blush", "board", "boat", "body", "boil", "bomb", "bone", "bonus", "book", "boost", "border", "boring",
+    "borrow", "boss", "bottom", "bounce", "box", "boy", "bracket", "brain", "brand", "brass", "brave", "bread", "breeze", "brick", "bridge", "brief",
+    "bright", "bring", "brisk", "broccoli", "broken", "bronze", "broom", "brother", "brown", "brush", "bubble", "buddy", "budget", "buffalo", "build", "bulb",
+    "bulk", "bullet", "bundle", "bunker", "burden", "burger", "burst", "bus", "business", "busy", "butter", "buyer", "buzz", "cabbage", "cabin", "cable",
+    "cactus", "cage", "cake", "call", "calm", "camera", "camp", "can", "canal", "cancel", "candy", "cannon", "canoe", "canvas", "canyon", "capable",
+    "capital", "captain", "car", "carbon", "card", "cargo", "carpet", "carry", "cart", "case", "cash", "casino", "castle", "casual", "cat", "catalog",
+    "catch", "category", "cattle", "caught", "cause", "caution", "cave", "ceiling", "celery", "cement", "census", "century", "cereal", "certain", "chair", "chalk",
+    "champion", "change", "chaos", "chapter", "charge", "chase", "chat", "cheap", "check", "cheese", "chef", "cherry", "chest", "chicken", "chief", "child",
+    "chimney", "choice", "choose", "chronic", "chuckle", "chunk", "churn", "cigar", "cinnamon", "circle", "citizen", "city", "civil", "claim", "clap", "clarify",
+    "claw", "clay", "clean", "clerk", "clever", "click", "client", "cliff", "climb", "clinic", "clip", "clock", "clog", "close", "cloth", "cloud",
+    "clown", "club", "clump", "cluster", "clutch", "coach", "coast", "coconut", "code", "coffee", "coil", "coin", "collect", "color", "column", "combine",
+    "come", "comfort", "comic", "common", "company", "concert", "conduct", "confirm", "congress", "connect", "consider", "control", "convince", "cook", "cool", "copper",
+    "copy", "coral", "core", "corn", "correct", "cost", "cotton", "couch", "country", "couple", "course", "cousin", "cover", "coyote", "crack", "cradle",
+    "craft", "cram", "crane", "crash", "crater", "crawl", "crazy", "cream", "credit", "creek", "crew", "cricket", "crime", "crisp", "critic", "crop",
+    "cross", "crouch", "crowd", "crucial", "cruel", "cruise", "crumble", "crunch", "crush", "cry", "crystal", "cube", "culture", "cup", "cupboard", "curious",
+    "current", "curtain", "curve", "cushion", "custom", "cute", "cycle", "dad", "damage", "damp", "dance", "danger", "daring", "dash", "daughter", "dawn",
+    "day", "deal", "debate", "debris", "decade", "december", "decide", "decline", "decorate", "decrease", "deer", "defense", "define", "defy", "degree", "delay",
+    "deliver", "demand", "demise", "denial", "dentist", "deny", "depart", "depend", "deposit", "depth", "deputy", "derive", "describe", "desert", "design", "desk",
+    "despair", "destroy", "detail", "detect", "develop", "device", "devote", "diagram", "dial", "diamond", "diary", "dice", "diesel", "diet", "differ", "digital",
+    "dignity", "dilemma", "dinner", "dinosaur", "direct", "dirt", "disagree", "discover", "disease", "dish", "dismiss", "disorder", "display", "distance", "divert", "divide",
+    "divorce", "dizzy", "doctor", "document", "dog", "doll", "dolphin", "domain", "donate", "donkey", "donor", "door", "dose", "double", "dove", "draft",
+    "dragon", "drama", "drastic", "draw", "dream", "dress", "drift", "drill", "drink", "drip", "drive", "drop", "drum", "dry", "duck", "dumb",
+    "dune", "during", "dust", "dutch", "duty", "dwarf", "dynamic", "eager", "eagle", "early", "earn", "earth", "easily", "east", "easy", "echo",
+    "ecology", "economy", "edge", "edit", "educate", "effort", "egg", "eight", "either", "elbow", "elder", "electric", "elegant", "element", "elephant", "elevator",
+    "elite", "else", "embark", "embody", "embrace", "emerge", "emotion", "employ", "empower", "empty", "enable", "enact", "end", "endless", "endorse", "enemy",
+    "energy", "enforce", "engage", "engine", "enhance", "enjoy", "enlist", "enough", "enrich", "enroll", "ensure", "enter", "entire", "entry", "envelope", "episode",
+    "equal", "equip", "era", "erase", "erode", "erosion", "error", "erupt", "escape", "essay", "essence", "estate", "eternal", "ethics", "evidence", "evil",
+    "evoke", "evolve", "exact", "example", "excess", "exchange", "excite", "exclude", "excuse", "execute", "exercise", "exhaust", "exhibit", "exile", "exist", "exit",
+    "exotic", "expand", "expect", "expire", "explain", "expose", "express", "extend", "extra", "eye", "eyebrow", "fabric", "face", "faculty", "fade", "faint",
+    "faith", "fall", "false", "fame", "family", "famous", "fan", "fancy", "fantasy", "farm", "fashion", "fat", "fatal", "father", "fatigue", "fault",
+    "favorite", "feature", "february", "federal", "fee", "feed", "feel", "female", "fence", "festival", "fetch", "fever", "few", "fiber", "fiction", "field",
+    "figure", "file", "film", "filter", "final", "find", "fine", "finger", "finish", "fire", "firm", "first", "fiscal", "fish", "fit", "fitness",
+    "fix", "flag", "flame", "flash", "flat", "flavor", "flee", "flight", "flip", "float", "flock", "floor", "flower", "fluid", "flush", "fly",
+    "foam", "focus", "fog", "foil", "fold", "follow", "food", "foot", "force", "forest", "forget", "fork", "fortune", "forum", "forward", "fossil",
+    "foster", "found", "fox", "fragile", "frame", "frequent", "fresh", "friend", "fringe", "frog", "front", "frost", "frown", "frozen", "fruit", "fuel",
+    "fun", "funny", "furnace", "fury", "future", "gadget", "gain", "galaxy", "gallery", "game", "gap", "garage", "garbage", "garden", "garlic", "garment",
+    "gas", "gasp", "gate", "gather", "gauge", "gaze", "general", "genius", "genre", "gentle", "genuine", "gesture", "ghost", "giant", "gift", "giggle",
+    "ginger", "giraffe", "girl", "give", "glad", "glance", "glare", "glass", "glide", "glimpse", "globe", "gloom", "glory", "glove", "glow", "glue",
+    "goat", "goddess", "gold", "good", "goose", "gorilla", "gospel", "gossip", "govern", "gown", "grab", "grace", "grain", "grant", "grape", "grass",
+    "gravity", "great", "green", "grid", "grief", "grit", "grocery", "group", "grow", "grunt", "guard", "guess", "guide", "guilt", "guitar", "gun",
+    "gym", "habit", "hair", "half", "hammer", "hamster", "hand", "happy", "harbor", "hard", "harsh", "harvest", "hat", "have", "hawk", "hazard",
+    "head", "health", "heart", "heavy", "hedgehog", "height", "hello", "helmet", "help", "hen", "hero", "hidden", "high", "hill", "hint", "hip",
+    "hire", "history", "hobby", "hockey", "hold", "hole", "holiday", "hollow", "home", "honey", "hood", "hope", "horn", "horror", "horse", "hospital",
+    "host", "hotel", "hour", "hover", "hub", "huge", "human", "humble", "humor", "hundred", "hungry", "hunt", "hurdle", "hurry", "hurt", "husband",
+    "hybrid", "ice", "icon", "idea", "identify", "idle", "ignore", "ill", "illegal", "illness", "image", "imitate", "immense", "immune", "impact", "impose",
+    "improve", "impulse", "inch", "include", "income", "increase", "index", "indicate", "indoor", "industry", "infant", "inflict", "inform", "inhale", "inherit", "initial",
+    "inject", "injury", "inmate", "inner", "innocent", "input", "inquiry", "insane", "insect", "inside", "inspire", "install", "intact", "interest", "into", "invest",
+    "invite", "involve", "iron", "island", "isolate", "issue", "item", "ivory", "jacket", "jaguar", "jar", "jazz", "jealous", "jeans", "jelly", "jewel",
+    "job", "join", "joke", "journey", "joy", "judge", "juice", "jump", "jungle", "junior", "junk", "just", "kangaroo", "keen", "keep", "ketchup",
+    "key", "kick", "kid", "kidney", "kind", "kingdom", "kiss", "kit", "kitchen", "kite", "kitten", "kiwi", "knee", "knife", "knock", "know",
+    "lab", "label", "labor", "ladder", "lady", "lake", "lamp", "language", "laptop", "large", "later", "latin", "laugh", "laundry", "lava", "law",
+    "lawn", "lawsuit", "layer", "lazy", "leader", "leaf", "learn", "leave", "lecture", "left", "leg", "legal", "legend", "leisure", "lemon", "lend",
+    "length", "lens", "leopard", "lesson", "letter", "level", "liar", "liberty", "library", "license", "life", "lift", "light", "like", "limb", "limit",
+    "link", "lion", "liquid", "list", "little", "live", "lizard", "load", "loan", "lobster", "local", "lock", "logic", "lonely", "long", "loop",
+    "lottery", "loud", "lounge", "love", "loyal", "lucky", "luggage", "lumber", "lunar", "lunch", "luxury", "lyrics", "machine", "mad", "magic", "magnet",
+    "maid", "mail", "main", "major", "make", "mammal", "man", "manage", "mandate", "mango", "mansion", "manual", "maple", "marble", "march", "margin",
+    "marine", "market", "marriage", "mask", "mass", "master", "match", "material", "math", "matrix", "matter", "maximum", "maze", "meadow", "mean", "measure",
+    "meat", "mechanic", "medal", "media", "melody", "melt", "member", "memory", "mention", "menu", "mercy", "merge", "merit", "merry", "mesh", "message",
+    "metal", "method", "middle", "midnight", "milk", "million", "mimic", "mind", "minimum", "minor", "minute", "miracle", "mirror", "misery", "miss", "mistake",
+    "mix", "mixed", "mixture", "mobile", "model", "modify", "mom", "moment", "monitor", "monkey", "monster", "month", "moon", "moral", "more", "morning",
+    "mosquito", "mother", "motion", "motor", "mountain", "mouse", "move", "movie", "much", "muffin", "mule", "multiply", "muscle", "museum", "mushroom", "music",
+    "must", "mutual", "myself", "mystery", "myth", "naive", "name", "napkin", "narrow", "nasty", "nation", "nature", "near", "neck", "need", "negative",
+    "neglect", "neither", "nephew", "nerve", "nest", "net", "network", "neutral", "never", "news", "next", "nice", "night", "noble", "noise", "nominee",
+    "noodle", "normal", "north", "nose", "notable", "note", "nothing", "notice", "novel", "now", "nuclear", "number", "nurse", "nut", "oak", "obey",
+    "object", "oblige", "obscure", "observe", "obtain", "obvious", "occur", "ocean", "october", "odor", "off", "offer", "office", "often", "oil", "okay",
+    "old", "olive", "olympic", "omit", "once", "one", "onion", "online", "only", "open", "opera", "opinion", "oppose", "option", "orange", "orbit",
+    "orchard", "order", "ordinary", "organ", "orient", "original", "orphan", "ostrich", "other", "outdoor", "outer", "output", "outside", "oval", "oven", "over",
+    "own", "owner", "oxygen", "oyster", "ozone", "pact", "paddle", "page", "pair", "palace", "palm", "panda", "panel", "panic", "panther", "paper",
+    "parade", "parent", "park", "parrot", "party", "pass", "patch", "path", "patient", "patrol", "pattern", "pause", "pave", "payment", "peace", "peanut",
+    "pear", "peasant", "pelican", "pen", "penalty", "pencil", "people", "pepper", "perfect", "permit", "person", "pet", "phone", "photo", "phrase", "physical",
+    "piano", "picnic", "picture", "piece", "pig", "pigeon", "pill", "pilot", "pink", "pioneer", "pipe", "pistol", "pitch", "pizza", "place", "planet",
+    "plastic", "plate", "play", "please", "pledge", "pluck", "plug", "plunge", "poem", "poet", "point", "polar", "pole", "police", "pond", "pony",
+    "pool", "popular", "portion", "position", "possible", "post", "potato", "pottery", "poverty", "powder", "power", "practice", "praise", "predict", "prefer", "prepare",
+    "present", "pretty", "prevent", "price", "pride", "primary", "print", "priority", "prison", "private", "prize", "problem", "process", "produce", "profit", "program",
+    "project", "promote", "proof", "property", "prosper", "protect", "proud", "provide", "public", "pudding", "pull", "pulp", "pulse", "pumpkin", "punch", "pupil",
+    "puppy", "purchase", "purity", "purpose", "purse", "push", "put", "puzzle", "pyramid", "quality", "quantum", "quarter", "question", "quick", "quit", "quiz",
+    "quote", "rabbit", "raccoon", "race", "rack", "radar", "radio", "rail", "rain", "raise", "rally", "ramp", "ranch", "random", "range", "rapid",
+    "rare", "rate", "rather", "raven", "raw", "razor", "ready", "real", "reason", "rebel", "rebuild", "recall", "receive", "recipe", "record", "recycle",
+    "reduce", "reflect", "reform", "refuse", "region", "regret", "regular", "reject", "relax", "release", "relief", "rely", "remain", "remember", "remind", "remove",
+    "render", "renew", "rent", "reopen", "repair", "repeat", "replace", "report", "require", "rescue", "resemble", "resist", "resource", "response", "result", "retire",
+    "retreat", "return", "reunion", "reveal", "review", "reward", "rhythm", "rib", "ribbon", "rice", "rich", "ride", "ridge", "rifle", "right", "rigid",
+    "ring", "riot", "ripple", "risk", "ritual", "rival", "river", "road", "roast", "robot", "robust", "rocket", "romance", "roof", "rookie", "room",
+    "rose", "rotate", "rough", "round", "route", "royal", "rubber", "rude", "rug", "rule", "run", "runway", "rural", "sad", "saddle", "sadness",
+    "safe", "sail", "salad", "salmon", "salon", "salt", "salute", "same", "sample", "sand", "satisfy", "satoshi", "sauce", "sausage", "save", "say",
+    "scale", "scan", "scare", "scatter", "scene", "scheme", "school", "science", "scissors", "scorpion", "scout", "scrap", "screen", "script", "scrub", "sea",
+    "search", "season", "seat", "second", "secret", "section", "security", "seed", "seek", "segment", "select", "sell", "seminar", "senior", "sense", "sentence",
+    "series", "service", "session", "settle", "setup", "seven", "shadow", "shaft", "shallow", "share", "shed", "shell", "sheriff", "shield", "shift", "shine",
+    "ship", "shiver", "shock", "shoe", "shoot", "shop", "short", "shoulder", "shove", "shrimp", "shrug", "shuffle", "shy", "sibling", "sick", "side",
+    "siege", "sight", "sign", "silent", "silk", "silly", "silver", "similar", "simple", "since", "sing", "siren", "sister", "situate", "six", "size",
+    "skate", "sketch", "ski", "skill", "skin", "skirt", "skull", "slab", "slam", "sleep", "slender", "slice", "slide", "slight", "slim", "slogan",
+    "slot", "slow", "slush", "small", "smart", "smile", "smoke", "smooth", "snack", "snake", "snap", "sniff", "snow", "soap", "soccer", "social",
+    "sock", "soda", "soft", "solar", "soldier", "solid", "solution", "solve", "someone", "song", "soon", "sorry", "sort", "soul", "sound", "soup",
+    "source", "south", "space", "spare", "spatial", "spawn", "speak", "special", "speed", "spell", "spend", "sphere", "spice", "spider", "spike", "spin",
+    "spirit", "split", "spoil", "sponsor", "spoon", "sport", "spot", "spray", "spread", "spring", "spy", "square", "squeeze", "squirrel", "stable", "stadium",
+    "staff", "stage", "stairs", "stamp", "stand", "start", "state", "stay", "steak", "steel", "stem", "step", "stereo", "stick", "still", "sting",
+    "stock", "stomach", "stone", "stool", "story", "stove", "strategy", "street", "strike", "strong", "struggle", "student", "stuff", "stumble", "style", "subject",
+    "submit", "subway", "success", "such", "sudden", "suffer", "sugar", "suggest", "suit", "summer", "sun", "sunny", "sunset", "super", "supply", "supreme",
+    "sure", "surface", "surge", "surprise", "surround", "survey", "suspect", "sustain", "swallow", "swamp", "swap", "swarm", "swear", "sweet", "swift", "swim",
+    "swing", "switch", "sword", "symbol", "symptom", "syrup", "system", "table", "tackle", "tag", "tail", "talent", "talk", "tank", "tape", "target",
+    "task", "taste", "tattoo", "taxi", "teach", "team", "tell", "ten", "tenant", "tennis", "tent", "term", "test", "text", "thank", "that",
+    "theme", "then", "theory", "there", "they", "thing", "this", "thought", "three", "thrive", "throw", "thumb", "thunder", "ticket", "tide", "tiger",
+    "tilt", "timber", "time", "tiny", "tip", "tired", "tissue", "title", "toast", "tobacco", "today", "toddler", "toe", "together", "toilet", "token",
+    "tomato", "tomorrow", "tone", "tongue", "tonight", "tool", "tooth", "top", "topic", "topple", "torch", "tornado", "tortoise", "toss", "total", "tourist",
+    "toward", "tower", "town", "toy", "track", "trade", "traffic", "tragic", "train", "transfer", "trap", "trash", "travel", "tray", "treat", "tree",
+    "trend", "trial", "tribe", "trick", "trigger", "trim", "trip", "trophy", "trouble", "truck", "true", "truly", "trumpet", "trust", "truth", "try",
+    "tube", "tuition", "tumble", "tuna", "tunnel", "turkey", "turn", "turtle", "twelve", "twenty", "twice", "twin", "twist", "two", "type", "typical",
+    "ugly", "umbrella", "unable", "unaware", "uncle", "uncover", "under", "undo", "unfair", "unfold", "unhappy", "uniform", "unique", "unit", "universe", "unknown",
+    "unlock", "until", "unusual", "unveil", "update", "upgrade", "uphold", "upon", "upper", "upset", "urban", "urge", "usage", "use", "used", "useful",
+    "useless", "usual", "utility", "vacant", "vacuum", "vague", "valid", "valley", "valve", "van", "vanish", "vapor", "various", "vast", "vault", "vehicle",
+    "velvet", "vendor", "venture", "venue", "verb", "verify", "version", "very", "vessel", "veteran", "viable", "vibrant", "vicious", "victory", "video", "view",
+    "village", "vintage", "violin", "virtual", "virus", "visa", "visit", "visual", "vital", "vivid", "vocal", "voice", "void", "volcano", "volume", "vote",
+    "voyage", "wage", "wagon", "wait", "walk", "wall", "walnut", "want", "warfare", "warm", "warrior", "wash", "wasp", "waste", "water", "wave",
+    "way", "wealth", "weapon", "wear", "weasel", "weather", "web", "wedding", "weekend", "weird", "welcome", "west", "wet", "whale", "what", "wheat",
+    "wheel", "when", "where", "whip", "whisper", "wide", "width", "wife", "wild", "will", "win", "window", "wine", "wing", "wink", "winner",
+    "winter", "wire", "wisdom", "wise", "wish", "witness", "wolf", "woman", "wonder", "wood", "wool", "word", "work", "world", "worry", "worth",
+    "wrap", "wreck", "wrestle", "wrist", "write", "wrong", "yard", "year", "yellow", "you", "young", "youth", "zebra", "zero", "zone", "zoo",
+]);

package/dist/checks/admin.d.ts

@@ -0,0 +1,24 @@
+import type { CheckResult } from '../types.js';
+/**
+ * keccak256 of the runtime code at the canonical Safe 1.4.1 addresses, read with eth_getCode
+ * from both governors RPCs on 2026-09-12 (identical on 151 and 153). A singleton whose code
+ * hashes to something else is not the Safe 1.4.1 release, whatever address it sits at.
+ */
+export declare const SAFE_141_CODE_HASHES: {
+    readonly safeSingleton: "0x1fe2df852ba3299d6534ef416eefa406e56ced995bca886ab7a553e6d0c5e1c4";
+    readonly safeL2Singleton: "0xb1f926978a0f44a2c0ec8fe822418ae969bd8c3f18d61e5103100339894f81ff";
+    readonly safeProxyFactory: "0x50c3cdc4074750a7a974204a716c999edd37482f907608d960b2b025ee0b3317";
+    readonly safeFallbackHandler: "0x7c6007a5d711cea8dfd5d91f5940ec29c7f200fe511eb1fc1397b367af3c42f9";
+};
+/** keccak256 of runtime code given as a 0x hex string, hashing the bytes rather than the text. */
+export declare function codeHash(codeHex: string): string;
+export interface AdminReading {
+    address: string;
+    isContract: boolean;
+    singleton: string | null;
+    singletonKind: 'safeSingleton' | 'safeL2Singleton' | null;
+    singletonCodeMatches: boolean | null;
+    threshold: number | null;
+}
+export declare function readAdmin(address: string, rpc: string, network: 'mainnet' | 'testnet'): Promise<AdminReading>;
+export declare function checkAdminSafe(admin: string | null, rpc: string, chain: number | null): Promise<CheckResult>;

package/dist/checks/admin.js

@@ -0,0 +1,81 @@
+// Is the admin a Safe? On mainnet the admin address must hold a SafeProxy whose singleton is
+// the canonical Safe 1.4.1 (L1 or L2 singleton), the singleton must carry the 1.4.1 bytecode,
+// and getThreshold() must be at least 2. On testnet the same reads run but an EOA or a low
+// threshold is a warning, because testnet is for trying things.
+import { addresses, ethCall, keccak256Hex, toCaller } from '@gatedpath/chains';
+/**
+ * keccak256 of the runtime code at the canonical Safe 1.4.1 addresses, read with eth_getCode
+ * from both governors RPCs on 2026-09-12 (identical on 151 and 153). A singleton whose code
+ * hashes to something else is not the Safe 1.4.1 release, whatever address it sits at.
+ */
+export const SAFE_141_CODE_HASHES = {
+    safeSingleton: '0x1fe2df852ba3299d6534ef416eefa406e56ced995bca886ab7a553e6d0c5e1c4',
+    safeL2Singleton: '0xb1f926978a0f44a2c0ec8fe822418ae969bd8c3f18d61e5103100339894f81ff',
+    safeProxyFactory: '0x50c3cdc4074750a7a974204a716c999edd37482f907608d960b2b025ee0b3317',
+    safeFallbackHandler: '0x7c6007a5d711cea8dfd5d91f5940ec29c7f200fe511eb1fc1397b367af3c42f9',
+};
+const GET_THRESHOLD = '0xe75235b8'; // getThreshold()
+/** keccak256 of runtime code given as a 0x hex string, hashing the bytes rather than the text. */
+export function codeHash(codeHex) {
+    return keccak256Hex(Buffer.from(codeHex.replace(/^0x/, ''), 'hex'));
+}
+export async function readAdmin(address, rpc, network) {
+    const caller = toCaller(rpc);
+    const code = (await caller('eth_getCode', [address, 'latest']));
+    const reading = { address, isContract: code !== '0x' && code !== '0x0' && code.length > 2, singleton: null, singletonKind: null, singletonCodeMatches: null, threshold: null };
+    if (!reading.isContract)
+        return reading;
+    const slot0 = (await caller('eth_getStorageAt', [address, '0x0', 'latest']));
+    const singleton = '0x' + slot0.slice(-40);
+    reading.singleton = singleton;
+    const known = addresses[network];
+    for (const kind of ['safeSingleton', 'safeL2Singleton']) {
+        if (known[kind].address.toLowerCase() === singleton.toLowerCase())
+            reading.singletonKind = kind;
+    }
+    if (reading.singletonKind) {
+        const singletonCode = (await caller('eth_getCode', [singleton, 'latest']));
+        reading.singletonCodeMatches = codeHash(singletonCode) === SAFE_141_CODE_HASHES[reading.singletonKind];
+    }
+    try {
+        const ret = await ethCall(rpc, address, GET_THRESHOLD);
+        if (ret && ret !== '0x')
+            reading.threshold = Number(BigInt(ret));
+    }
+    catch {
+        reading.threshold = null;
+    }
+    return reading;
+}
+export async function checkAdminSafe(admin, rpc, chain) {
+    if (!admin)
+        return { id: 'admin-safe', status: 'skip', reason: 'No admin given; pass --admin <0x…> with the address that will own the deployed contracts.' };
+    if (!/^0x[0-9a-fA-F]{40}$/.test(admin))
+        return { id: 'admin-safe', status: 'fail', reason: `"${admin}" is not a 20-byte hex address.` };
+    if (chain !== 151 && chain !== 153)
+        return { id: 'admin-safe', status: 'skip', reason: 'The RPC is not a Redbelly chain.' };
+    const network = chain === 151 ? 'mainnet' : 'testnet';
+    const bad = chain === 151 ? 'fail' : 'warn';
+    let r;
+    try {
+        r = await readAdmin(admin, rpc, network);
+    }
+    catch (e) {
+        return { id: 'admin-safe', status: 'fail', reason: `Could not read the admin address: ${e.message}.` };
+    }
+    const data = { ...r };
+    if (!r.isContract) {
+        return chain === 151
+            ? { id: 'admin-safe', status: 'fail', reason: `Admin ${admin} is an externally owned account; on mainnet the admin must be a Safe 1.4.1 with a threshold of at least 2.`, data }
+            : { id: 'admin-safe', status: 'warn', reason: `Admin ${admin} is an externally owned account; fine on testnet, but mainnet pre-flight will refuse it, so put a Safe in place now.`, data };
+    }
+    if (!r.singletonKind)
+        return { id: 'admin-safe', status: bad, reason: `Admin ${admin} is a contract but its storage slot 0 (${r.singleton}) is not the canonical Safe 1.4.1 singleton or SafeL2 singleton on this chain.`, data };
+    if (r.singletonCodeMatches === false)
+        return { id: 'admin-safe', status: bad, reason: `Admin ${admin} points at ${r.singleton}, whose code does not hash to the Safe 1.4.1 release.`, data };
+    if (r.threshold === null)
+        return { id: 'admin-safe', status: bad, reason: `Admin ${admin} looks like a Safe but getThreshold() did not answer; the proxy may not be set up.`, data };
+    if (r.threshold < 2)
+        return { id: 'admin-safe', status: bad, reason: `Admin ${admin} is a Safe 1.4.1 with threshold ${r.threshold}; one signer is one stolen key away from your contracts, so use 2 or more.`, data };
+    return { id: 'admin-safe', status: 'pass', reason: `Admin ${admin} is a Safe 1.4.1 (${r.singletonKind === 'safeL2Singleton' ? 'SafeL2' : 'Safe'} singleton, code hash verified) with threshold ${r.threshold}.`, data };
+}

package/dist/checks/balance.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from '../types.js';
+export declare const MARGIN_PERCENT = 25;
+export declare function checkBalance(deployer: string | null, gas: bigint, rpc: string, chain: number | null): Promise<CheckResult>;

package/dist/checks/balance.js

@@ -0,0 +1,39 @@
+// Does the deployer hold enough RBNT? Cost is gas times the latest base fee, priced in USD
+// through the on-chain feed by gasCostUsd from @gatedpath/chains, with 25 percent on
+// top because the base fee moves with the RBNT price between now and the send.
+import { formatUnits, gasCostUsd, toCaller } from '@gatedpath/chains';
+export const MARGIN_PERCENT = 25;
+export async function checkBalance(deployer, gas, rpc, chain) {
+    if (!deployer)
+        return { id: 'balance', status: 'skip', reason: 'No deployer given, so there is no balance to read.' };
+    if (chain !== 151 && chain !== 153)
+        return { id: 'balance', status: 'skip', reason: 'The RPC is not a Redbelly chain, so the price feed is not there to read.' };
+    try {
+        const caller = toCaller(rpc);
+        const balance = BigInt((await caller('eth_getBalance', [deployer, 'latest'])));
+        const cost = await gasCostUsd({ gasUsed: gas, rpc });
+        const required = (cost.wei * BigInt(100 + MARGIN_PERCENT)) / 100n;
+        const data = {
+            deployer,
+            gas: gas.toString(),
+            gasPriceWei: cost.gasPriceWei.toString(),
+            costWei: cost.wei.toString(),
+            costRbnt: cost.rbnt,
+            costUsd: cost.usd,
+            usdPerRbnt: cost.usdPerRbnt,
+            requiredWei: required.toString(),
+            requiredRbnt: formatUnits(required, 18),
+            balanceWei: balance.toString(),
+            balanceRbnt: formatUnits(balance, 18),
+            marginPercent: MARGIN_PERCENT,
+        };
+        const short = (s) => (s.includes('.') ? s.replace(/(\.\d{4})\d+$/, '$1') : s);
+        if (balance >= required) {
+            return { id: 'balance', status: 'pass', reason: `${deployer} holds ${short(data.balanceRbnt)} RBNT; ${gas.toLocaleString('en-US')} gas costs about ${short(cost.rbnt)} RBNT (US$${cost.usd.toFixed(4)}) and ${short(data.requiredRbnt)} RBNT covers it with ${MARGIN_PERCENT}% margin.`, data };
+        }
+        return { id: 'balance', status: 'fail', reason: `${deployer} holds ${short(data.balanceRbnt)} RBNT but ${gas.toLocaleString('en-US')} gas needs ${short(data.requiredRbnt)} RBNT with ${MARGIN_PERCENT}% margin (US$${cost.usd.toFixed(4)} at the feed price); ${chain === 153 ? 'get testnet RBNT at https://redbelly.faucetme.pro/' : 'fund the deployer first'}.`, data };
+    }
+    catch (e) {
+        return { id: 'balance', status: 'fail', reason: `Could not price the deployment: ${e.message}.`, data: { deployer, gas: gas.toString() } };
+    }
+}

package/dist/checks/chain-id.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkChainId(expected: number | null, reported: number | null, expectedSource: string, rpc: string): CheckResult;

package/dist/checks/chain-id.js

@@ -0,0 +1,11 @@
+export function checkChainId(expected, reported, expectedSource, rpc) {
+    if (reported === null)
+        return { id: 'chain-id', status: 'fail', reason: `The RPC at ${rpc} did not answer eth_chainId.` };
+    if (reported !== 151 && reported !== 153)
+        return { id: 'chain-id', status: 'fail', reason: `The RPC reports chain ${reported}, which is neither Redbelly mainnet (151) nor testnet (153).`, data: { expected, reported } };
+    if (expected === null)
+        return { id: 'chain-id', status: 'skip', reason: `No chain ID in the project config; pass --chain to compare it with the RPC's ${reported}.`, data: { expected, reported } };
+    if (expected !== reported)
+        return { id: 'chain-id', status: 'fail', reason: `${expectedSource} says chain ${expected} but the RPC at ${rpc} reports ${reported}.`, data: { expected, reported } };
+    return { id: 'chain-id', status: 'pass', reason: `${expectedSource} says chain ${expected} and the RPC reports ${reported}.`, data: { expected, reported } };
+}

package/dist/checks/compiler.d.ts

@@ -0,0 +1,5 @@
+import type { ProjectConfig } from '../config.js';
+import type { CheckResult } from '../types.js';
+export declare const SOLC_PIN = "0.8.30";
+export declare const EVM_PIN = "prague";
+export declare function checkCompilerPins(config: ProjectConfig): CheckResult;

package/dist/checks/compiler.js

@@ -0,0 +1,20 @@
+export const SOLC_PIN = '0.8.30';
+export const EVM_PIN = 'prague';
+export function checkCompilerPins(config) {
+    if (config.kind === 'none')
+        return { id: 'compiler-pins', status: 'fail', reason: 'No foundry.toml or hardhat.config.* found, so the compiler and EVM pins cannot be confirmed.' };
+    const where = `${config.file}${config.profile ? ` (${config.kind === 'foundry' ? 'profile' : 'network'} ${config.profile})` : ''}`;
+    const data = { solc: config.solc, evmVersion: config.evmVersion, file: config.file, profile: config.profile };
+    const problems = [];
+    if (config.solc === null)
+        problems.push(`no ${config.kind === 'foundry' ? 'solc_version' : 'solidity version'} is pinned`);
+    else if (config.solc !== SOLC_PIN)
+        problems.push(`solc is ${config.solc}, not ${SOLC_PIN}`);
+    if (config.evmVersion === null)
+        problems.push(`no ${config.kind === 'foundry' ? 'evm_version' : 'evmVersion'} is set`);
+    else if (config.evmVersion.toLowerCase() !== EVM_PIN)
+        problems.push(`evm version is ${config.evmVersion}, not ${EVM_PIN}`);
+    if (problems.length > 0)
+        return { id: 'compiler-pins', status: 'fail', reason: `In ${where}, ${problems.join(' and ')}; Redbelly is Prague with solc ${SOLC_PIN} on both networks (verified 2026-09-12).`, data };
+    return { id: 'compiler-pins', status: 'pass', reason: `${where} pins solc ${SOLC_PIN} and EVM ${EVM_PIN}.`, data };
+}

package/dist/checks/deployer.d.ts

@@ -0,0 +1,14 @@
+import type { CheckResult } from '../types.js';
+export interface DeployerSource {
+    account?: string | undefined;
+    address?: string | undefined;
+    passwordFile?: string | undefined;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}
+export declare function resolveDeployer(src: DeployerSource): Promise<{
+    address: string | null;
+    how: string;
+    error?: string;
+}>;
+export declare function checkDeployerVerified(address: string | null, how: string, error: string | undefined, rpc: string, chain: number | null): Promise<CheckResult>;