gate-evm-tools 1.0.27 → 1.0.31

package/runtime/workflow/lib/deployments.ts

@@ -1,7 +1,7 @@
 import fs from "fs";
 import path from "path";
 import { isAddress } from "ethers";
-import type { WorkflowConfig } from "./config";
+import type { WorkflowConfiguration } from "./context";
 import { readJsonFile, writeJsonFile } from "./config";
 
 export type ContractInfo = Record<string, Record<string, string>>;
@@ -177,16 +177,8 @@ export const actualContractName = (contractName: string): string => {
   return actual;
 };
 
-export const deploymentInstanceId = (instanceId: string): string => {
-  const normalizedInstanceId = instanceId.trim();
-  if (!normalizedInstanceId) {
-    throw new Error("Deployment saveAs must not be empty");
-  }
-  if (normalizedInstanceId.includes(":")) {
-    throw new Error(`Deployment saveAs "${normalizedInstanceId}" must not contain ":"`);
-  }
-  return normalizedInstanceId;
-};
+export { deploymentInstanceId } from "./operationNames";
+import { deploymentInstanceId } from "./operationNames";
 
 export const contractInfoKey = (instanceId: string, contractName: string): string => {
   const normalizedInstanceId = deploymentInstanceId(instanceId);
@@ -196,7 +188,7 @@ export const contractInfoKey = (instanceId: string, contractName: string): strin
     : `${normalizedInstanceId}:${actual}`;
 };
 
-export const loadContractInfo = (root: string, _config: WorkflowConfig): ContractInfo => {
+export const loadContractInfo = (root: string, _config: WorkflowConfiguration): ContractInfo => {
   const filePath = contractInfoPath(root);
   if (!fs.existsSync(filePath)) return {};
   return validateContractInfo(readJsonFile<unknown>(filePath));
@@ -255,7 +247,7 @@ export const resolveDeployment = (
 
 export const findDeploymentAddress = (
   root: string,
-  config: WorkflowConfig,
+  config: WorkflowConfiguration,
   targetId: string,
   name: string,
 ): string | undefined => {
@@ -264,7 +256,7 @@ export const findDeploymentAddress = (
 
 export const getDeploymentAddress = (
   root: string,
-  config: WorkflowConfig,
+  config: WorkflowConfiguration,
   targetId: string,
   name: string,
 ): string => {

package/runtime/workflow/lib/evidencePorts.ts

@@ -0,0 +1,20 @@
+import type { GateToolPreparationRequestV1 } from 'gate-evm-tools/workflow';
+import type { DeploymentChange } from './deploymentRecords';
+import type { PreparedGateToolWorkflow } from './gateTool';
+export interface PreparationMapping { transactionId: string; gateToolTransactionIds: string[]; kind: 'multicall' | 'direct' }
+export interface PreparationInput { stepId: string; change: DeploymentChange; prepared: PreparedGateToolWorkflow; derivedKeys: string[] }
+export interface PreparationSink {
+  expected(stepId: string, request: GateToolPreparationRequestV1): PreparedGateToolWorkflow | undefined;
+  prepare(input: PreparationInput): void;
+  bind(stepId: string, mapping: PreparationMapping): void;
+  /** No same-fork upgrade until a complete validated OZ baseline is available. */
+  assertUpgradeBaseline(proxy: string): boolean | void;
+}
+export type TypedValue = { type: 'null'; value: null } | { type: 'string' | 'bigint' | 'number' | 'boolean'; value: string | boolean } | { type: 'array'; value: TypedValue[] } | { type: 'object'; value: Record<string, TypedValue> };
+export interface VerificationObservation {
+  stepId: string; callIndex: number; assertionId: string; contract: string; abiName: string;
+  abi: string[]; address: string; method: string; args: TypedValue;
+  definition: { method: string; args: TypedValue; expect: TypedValue };
+  actual: TypedValue; expected: TypedValue;
+}
+export interface VerificationSink { record(input: VerificationObservation): void }

package/runtime/workflow/lib/executionPlan.ts

@@ -1,24 +1,12 @@
+import { TransactionPlanner, normalizeTransaction } from "./transactionPlanner";
+import type { ReleaseExecutionTransaction, ReleaseExecutionTransactionInput, PlannedExecutionTransaction, CompletedExecutionTransaction } from "./transactionPlanner";
+export { ExecutionSegmentDeferred } from "./transactionPlanner";
+export type { ExecutionRoute, ReleaseExecutionTransaction, ReleaseExecutionTransactionInput, PlannedExecutionTransaction, CompletedExecutionTransaction } from "./transactionPlanner";
 import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 
 export type ReleaseKind = "development" | "admin_release";
-export type ExecutionRoute = "operator" | "external";
-
-export interface ReleaseExecutionTransaction {
-  transactionId: string;
-  stepId: string;
-  transactionIndex: number;
-  route: ExecutionRoute;
-  executor: string;
-  to: string;
-  value: string;
-  data: string;
-  operation: 0 | 1;
-  scheme?: "zksync-eravm";
-  factoryDeps?: string[];
-}
-
 export interface ReleaseExecutionPlan {
   version: 1;
   taskId: string;
@@ -33,34 +21,6 @@ export interface ReleaseExecutionPlan {
 
 type PlanBody = Omit<ReleaseExecutionPlan, "planHash" | "createdAt">;
 
-export interface ReleaseExecutionTransactionInput {
-  stepId: string;
-  executor: string;
-  to: string;
-  value: string;
-  data: string;
-  operation: 0 | 1;
-  scheme?: "zksync-eravm";
-  factoryDeps?: string[];
-}
-
-export interface CompletedExecutionTransaction {
-  transactionId: string;
-  transactionHash: string;
-}
-
-export interface PlannedExecutionTransaction extends ReleaseExecutionTransaction {
-  executionAction: "execute" | "package" | "replay";
-  transactionHash?: string;
-}
-
-export class ExecutionSegmentDeferred extends Error {
-  constructor(readonly transactionId: string) {
-    super(`Execution is waiting for the preceding external segment before ${transactionId}`);
-    this.name = "ExecutionSegmentDeferred";
-  }
-}
-
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$/;
 const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
 const DATA = /^0x(?:[0-9a-fA-F]{2})*$/;
@@ -83,40 +43,6 @@ const address = (value: unknown, label: string): string => {
   return value.toLowerCase();
 };
 
-const value = (raw: unknown, label: string): string => {
-  if (typeof raw !== "string" || !/^(?:0[xX][0-9a-fA-F]+|[0-9]+)$/.test(raw)) {
-    throw new Error(`${label} must be a nonnegative integer string`);
-  }
-  return BigInt(raw).toString(10);
-};
-
-const data = (raw: unknown, label: string): string => {
-  if (typeof raw !== "string" || !DATA.test(raw)) {
-    throw new Error(`${label} must be canonical byte calldata`);
-  }
-  return raw.toLowerCase();
-};
-
-const factoryDeps = (raw: unknown, label: string): string[] => {
-  if (!Array.isArray(raw)) throw new Error(`${label} must be an array`);
-  const seen = new Set<string>();
-  const normalized: string[] = [];
-  for (const [index, dependency] of raw.entries()) {
-    if (typeof dependency !== "string" || !/^0x(?:[0-9a-fA-F]{2})+$/.test(dependency)) {
-      throw new Error(`${label}[${index}] must be non-empty byte-aligned bytecode`);
-    }
-    const value = dependency.toLowerCase();
-    const hash = crypto
-      .createHash("sha256")
-      .update(Buffer.from(value.slice(2), "hex"))
-      .digest("hex");
-    if (seen.has(hash)) continue;
-    seen.add(hash);
-    normalized.push(value);
-  }
-  return normalized;
-};
-
 const exactKeys = (value: Record<string, unknown>, expected: string[], label: string): void => {
   const actual = Object.keys(value).sort();
   const wanted = [...expected].sort();
@@ -132,62 +58,6 @@ const record = (raw: unknown, label: string): Record<string, unknown> => {
   return raw as Record<string, unknown>;
 };
 
-const normalizeTransaction = (
-  raw: unknown,
-  index: number,
-  strict: boolean,
-): ReleaseExecutionTransaction => {
-  const input = record(raw, `transactions[${index}]`);
-  const isZkSync = input.scheme === "zksync-eravm";
-  if (input.scheme !== undefined && !isZkSync) {
-    throw new Error(`transactions[${index}].scheme must be zksync-eravm when present`);
-  }
-  if (isZkSync && input.factoryDeps === undefined) {
-    throw new Error(`transactions[${index}].factoryDeps is required for zkSync`);
-  }
-  if (!isZkSync && input.factoryDeps !== undefined) {
-    throw new Error(`transactions[${index}].factoryDeps is only supported for zkSync`);
-  }
-  if (strict) {
-    exactKeys(input, [
-      "transactionId",
-      "stepId",
-      "transactionIndex",
-      "route",
-      "executor",
-      "to",
-      "value",
-      "data",
-      "operation",
-      ...(isZkSync ? ["scheme", "factoryDeps"] : []),
-    ], `transactions[${index}]`);
-  }
-  if (input.transactionIndex !== index) {
-    throw new Error(`transactions[${index}].transactionIndex must equal ${index}`);
-  }
-  if (input.route !== "operator" && input.route !== "external") {
-    throw new Error(`transactions[${index}].route is invalid`);
-  }
-  if (input.operation !== 0 && input.operation !== 1) {
-    throw new Error(`transactions[${index}].operation must be 0 or 1`);
-  }
-  return {
-    transactionId: safeId(input.transactionId, `transactions[${index}].transactionId`),
-    stepId: safeId(input.stepId, `transactions[${index}].stepId`),
-    transactionIndex: index,
-    route: input.route,
-    executor: address(input.executor, `transactions[${index}].executor`),
-    to: address(input.to, `transactions[${index}].to`),
-    value: value(input.value, `transactions[${index}].value`),
-    data: data(input.data, `transactions[${index}].data`),
-    operation: input.operation,
-    ...(isZkSync ? {
-      scheme: "zksync-eravm" as const,
-      factoryDeps: factoryDeps(input.factoryDeps, `transactions[${index}].factoryDeps`),
-    } : {}),
-  };
-};
-
 const normalizeBody = (raw: unknown, strict: boolean): PlanBody => {
   const input = record(raw, "execution plan");
   if (strict) {
@@ -306,148 +176,27 @@ const writeExclusive = (filePath: string, value: unknown): void => {
 
 export class ReleaseExecutionPlanner {
   private readonly body: Omit<PlanBody, "transactions">;
-  private readonly expected?: PlanBody;
-  private readonly transactions: ReleaseExecutionTransaction[] = [];
-  private readonly segmentedExecution: boolean;
-  private readonly completedTransactions: CompletedExecutionTransaction[];
-  private readonly segmentEnd: number;
-
+  private readonly kernel: TransactionPlanner;
   constructor(input: {
-    taskId: string;
-    target: string;
-    executionId: string;
-    releaseKind: ReleaseKind;
-    operator: string;
-    expectedPlan?: ReleaseExecutionPlan;
-    segmentedExecution?: boolean;
+    taskId: string; target: string; executionId: string; releaseKind: ReleaseKind;
+    operator: string; expectedPlan?: ReleaseExecutionPlan; segmentedExecution?: boolean;
     completedTransactions?: CompletedExecutionTransaction[];
   }) {
-    const body = normalizeBody({
-      version: 1,
-      taskId: input.taskId,
-      target: input.target,
-      executionId: input.executionId,
-      releaseKind: input.releaseKind,
-      operator: input.operator,
-      transactions: [],
-    }, false);
-    this.body = {
-      version: 1,
-      taskId: body.taskId,
-      target: body.target,
-      executionId: body.executionId,
-      releaseKind: body.releaseKind,
-      operator: body.operator,
-    };
-    if (input.expectedPlan) {
-      const expected = normalizeBody(input.expectedPlan, false);
+    const { transactions: _, ...body } = normalizeBody({ version: 1, ...input, transactions: [] }, false);
+    this.body = body;
+    const expected = input.expectedPlan ? normalizeBody(input.expectedPlan, false) : undefined;
+    if (expected) {
       for (const key of ["taskId", "target", "executionId", "releaseKind", "operator"] as const) {
-        if (expected[key] !== this.body[key]) {
-          throw new Error(`locked execution plan ${key} does not match the runtime`);
-        }
+        if (expected[key] !== body[key]) throw new Error(`locked execution plan ${key} does not match the runtime`);
       }
-      this.expected = expected;
     }
-    this.segmentedExecution = input.segmentedExecution === true;
-    this.completedTransactions = input.completedTransactions ?? [];
-    if (this.segmentedExecution && !this.expected) {
-      throw new Error("segmented execution requires a locked execution plan");
-    }
-    if (!this.segmentedExecution && this.completedTransactions.length > 0) {
-      throw new Error("completed transactions require segmented execution");
-    }
-    if (this.expected) {
-      if (this.completedTransactions.length > this.expected.transactions.length) {
-        throw new Error("completed transactions exceed the execution plan");
-      }
-      for (const [index, completed] of this.completedTransactions.entries()) {
-        if (
-          completed.transactionId !== this.expected.transactions[index]?.transactionId
-          || typeof completed.transactionHash !== "string"
-          || !/^0x[0-9a-fA-F]{64}$/.test(completed.transactionHash)
-        ) {
-          throw new Error("completed transactions must form a contiguous plan prefix");
-        }
-      }
-    }
-    const expectedTransactions = this.expected?.transactions ?? [];
-    let segmentEnd = this.completedTransactions.length;
-    if (this.segmentedExecution && segmentEnd < expectedTransactions.length) {
-      if (expectedTransactions[segmentEnd].route === "operator") {
-        while (
-          segmentEnd < expectedTransactions.length
-          && expectedTransactions[segmentEnd].route === "operator"
-        ) segmentEnd += 1;
-      }
-      while (
-        segmentEnd < expectedTransactions.length
-        && expectedTransactions[segmentEnd].route === "external"
-      ) segmentEnd += 1;
-    } else if (!this.segmentedExecution) {
-      segmentEnd = Number.MAX_SAFE_INTEGER;
-    }
-    this.segmentEnd = segmentEnd;
+    this.kernel = new TransactionPlanner({ operator: body.operator, allowExternal: body.releaseKind !== "development",
+      expectedTransactions: expected?.transactions, segmentedExecution: input.segmentedExecution,
+      completedTransactions: input.completedTransactions });
   }
-
-  add(input: ReleaseExecutionTransactionInput): PlannedExecutionTransaction {
-    const index = this.transactions.length;
-    const stepId = safeId(input.stepId, "planned transaction stepId");
-    const executor = address(input.executor, "planned transaction executor");
-    const transaction = normalizeTransaction({
-      transactionId: `tx-${String(index + 1).padStart(4, "0")}-${stepId}`,
-      stepId,
-      transactionIndex: index,
-      route: executor === this.body.operator ? "operator" : "external",
-      executor,
-      to: input.to,
-      value: input.value,
-      data: input.data,
-      operation: input.operation,
-      ...(input.scheme === undefined ? {} : { scheme: input.scheme }),
-      ...(input.factoryDeps === undefined ? {} : { factoryDeps: input.factoryDeps }),
-    }, index, false);
-    if (this.body.releaseKind === "development" && transaction.route === "external") {
-      throw new Error("development execution plans cannot contain external transactions");
-    }
-    const expected = this.expected?.transactions[index];
-    if (this.expected && (!expected || JSON.stringify(expected) !== JSON.stringify(transaction))) {
-      throw new Error(
-        `transaction ${transaction.transactionId} does not match locked execution plan`,
-      );
-    }
-    if (this.segmentedExecution && index >= this.segmentEnd) {
-      throw new ExecutionSegmentDeferred(transaction.transactionId);
-    }
-    this.transactions.push(transaction);
-    const completed = this.completedTransactions[index];
-    if (completed) {
-      return {
-        ...transaction,
-        executionAction: "replay",
-        transactionHash: completed.transactionHash.toLowerCase(),
-      };
-    }
-    return {
-      ...transaction,
-      executionAction: transaction.route === "external" ? "package" : "execute",
-    };
-  }
-
+  add(input: ReleaseExecutionTransactionInput): PlannedExecutionTransaction { return this.kernel.add(input); }
   complete(options: { allowPartial?: boolean } = {}): PlanBody {
-    if (
-      this.expected
-      && this.transactions.length !== this.expected.transactions.length
-      && options.allowPartial !== true
-    ) {
-      throw new Error("execution did not consume every locked transaction");
-    }
-    if (options.allowPartial === true && !this.segmentedExecution) {
-      throw new Error("partial execution plan completion requires segmented execution");
-    }
-    return normalizeBody({
-      ...this.body,
-      transactions: this.transactions,
-    }, false);
+    return normalizeBody({ ...this.body, transactions: this.kernel.complete(options) }, false);
   }
 }
 

package/runtime/workflow/lib/gateTool.ts

@@ -1,6 +1,6 @@
+import type { WorkflowValidationPort } from './validation';
 import fs from "fs";
 import path from "path";
-import hardhat from "../../projectHardhat";
 import {
   canonicalPreparationJson,
   hashPreparationRequest,
@@ -21,8 +21,10 @@ export interface PrepareGateToolWorkflowOptions {
   evidenceDir: string;
   evidenceName: string;
   request: GateToolPreparationRequestV1;
-  hre?: GateToolPreparationHre;
+  hre: GateToolPreparationHre;
   readBlockTag?: number;
+  expected?: PreparedGateToolWorkflow;
+  validation?: WorkflowValidationPort;
 }
 
 export interface PreparedGateToolWorkflow {
@@ -149,7 +151,7 @@ const readRegularJson = (
   }
 };
 
-const expectedTransactionPurposes = (
+export const expectedTransactionPurposes = (
   plan: GateToolPreparationPlanV1,
 ): GateToolTransactionPurpose[] => {
   const requiredRoles = new Set(
@@ -185,8 +187,9 @@ const assertPlanMatchesRequest = async (
   hre: GateToolPreparationHre,
   request: GateToolPreparationRequestV1,
   rawPlan: unknown,
+  validation?: WorkflowValidationPort,
 ): Promise<GateToolPreparationPlanV1> => {
-  const plan = normalizePreparationPlan(rawPlan);
+  const plan = normalizePreparationPlan(validation ? validation.preparation.data(rawPlan) : rawPlan);
   const provider = (hre as GateToolPreparationHre & {
     ethers?: { provider?: { getNetwork(): Promise<{ chainId: bigint | number | string }> } };
   }).ethers?.provider;
@@ -214,20 +217,28 @@ const assertPlanMatchesRequest = async (
   ) {
     throw new Error("GateTool plan transaction order does not match its deployment evidence");
   }
+  await validation?.preparationPlan(request, plan);
   return plan;
 };
 
 export const prepareGateToolWorkflow = async (
   options: PrepareGateToolWorkflowOptions,
 ): Promise<PreparedGateToolWorkflow> => {
+  if (!options.hre) throw new Error("GateTool requires an explicit Hardhat runtime");
   if (!SAFE_FILE_ID.test(options.evidenceName)) {
     throw new Error(`GateTool evidenceName must match ${SAFE_FILE_ID}`);
   }
-  const request = normalizePreparationRequest(options.request);
+  const request = normalizePreparationRequest(options.validation ? options.validation.preparation.data(options.request) : options.request);
   const runtime = pinGateToolReadBlockTag(
-    options.hre ?? hardhat as unknown as GateToolPreparationHre,
+    options.hre,
     options.readBlockTag,
   );
+  if (options.expected) {
+    const expectedRequest = normalizePreparationRequest(options.validation ? options.validation.preparation.data(options.expected.request) : options.expected.request);
+    if (canonicalPreparationJson(expectedRequest) !== canonicalPreparationJson(request)) throw new Error("Expected GateTool request differs from replay");
+    const plan = await assertPlanMatchesRequest(runtime, request, options.expected.plan, options.validation);
+    return { ...options.expected, request, plan };
+  }
   const evidenceDir = confinedPath(options.root, options.evidenceDir, "GateTool evidence directory");
   const requestPath = path.join(evidenceDir, `${options.evidenceName}-request.json`);
   const planPath = path.join(evidenceDir, `${options.evidenceName}-plan.json`);
@@ -248,13 +259,14 @@ export const prepareGateToolWorkflow = async (
       runtime,
       request,
       readRegularJson(planPath, options.root, "GateTool plan evidence"),
+      options.validation,
     );
     return { request, requestPath, plan, planPath };
   }
 
+  const prepared = await prepareWorkflow(runtime, request, options.validation?.preparation);
+  const plan = await assertPlanMatchesRequest(runtime, request, prepared, options.validation);
   writeCanonicalJsonAtomic(requestPath, request, options.root);
-  const prepared = await prepareWorkflow(runtime, request);
-  const plan = await assertPlanMatchesRequest(runtime, request, prepared);
   writePreparationPlanAtomic(planPath, plan, options.root);
 
   return { request, requestPath, plan, planPath };

package/runtime/workflow/lib/gateToolSync.ts

@@ -1,7 +1,6 @@
 import crypto from "crypto";
 import fs from "fs";
 import path from "path";
-import hardhat from "../../projectHardhat";
 import { syncWithHre } from "gate-evm-tools/sync";
 import { writeJsonFile } from "./config";
 
@@ -25,7 +24,7 @@ export interface SyncGateToolUupsOptions {
   contract: string;
   constructorArgs: unknown[];
   transactionHash: string;
-  hre?: GateToolSyncHre;
+  hre: GateToolSyncHre;
 }
 
 const SAFE_FILE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$/;
@@ -254,6 +253,7 @@ const buildSyncEvidence = (
 export const syncGateToolUups = async (
   options: SyncGateToolUupsOptions,
 ): Promise<GateToolSyncEvidence> => {
+  if (!options.hre) throw new Error("GateTool requires an explicit Hardhat runtime");
   if (!SAFE_FILE_ID.test(options.evidenceName)) {
     throw new Error(`GateTool sync evidenceName must match ${SAFE_FILE_ID}`);
   }
@@ -340,7 +340,7 @@ export const syncGateToolUups = async (
     ...(options.scheme === "evm"
       ? { skipTxHash: true }
       : { transactionHash: options.transactionHash }),
-  }, options.hre ?? hardhat, options.root), "GateTool sync result");
+  }, options.hre, options.root), "GateTool sync result");
   const returnedProxy = typeof rawResult.proxyAddress === "string"
     ? rawResult.proxyAddress
     : stringField(rawResult, "proxy");

package/runtime/workflow/lib/operationNames.ts

@@ -0,0 +1,32 @@
+import type { WorkflowStep } from "./parameters";
+export const validateDeploySaveAs = (steps: WorkflowStep[]): void => {
+  const seen = new Set<string>();
+
+  for (const step of steps) {
+    if (step.kind !== "deploy") continue;
+
+    const saveAs = typeof step.saveAs === "string" ? step.saveAs.trim() : "";
+    if (!saveAs) {
+      throw new Error(`Deploy step ${step.id} requires saveAs`);
+    }
+    if (saveAs.includes(":")) {
+      throw new Error(`Deploy step ${step.id} saveAs "${saveAs}" must not contain ":"`);
+    }
+    if (seen.has(saveAs)) {
+      throw new Error(`Duplicate deploy saveAs "${saveAs}"`);
+    }
+    seen.add(saveAs);
+  }
+};
+
+export const deploymentInstanceId = (instanceId: string): string => {
+  const normalizedInstanceId = instanceId.trim();
+  if (!normalizedInstanceId) {
+    throw new Error("Deployment saveAs must not be empty");
+  }
+  if (normalizedInstanceId.includes(":")) {
+    throw new Error(`Deployment saveAs "${normalizedInstanceId}" must not contain ":"`);
+  }
+  return normalizedInstanceId;
+};
+

package/runtime/workflow/lib/parameters.ts

@@ -77,25 +77,8 @@ export const validateWorkflowStepIds = (steps: WorkflowStep[]): void => {
   }
 };
 
-export const validateDeploySaveAs = (steps: WorkflowStep[]): void => {
-  const seen = new Set<string>();
-
-  for (const step of steps) {
-    if (step.kind !== "deploy") continue;
-
-    const saveAs = typeof step.saveAs === "string" ? step.saveAs.trim() : "";
-    if (!saveAs) {
-      throw new Error(`Deploy step ${step.id} requires saveAs`);
-    }
-    if (saveAs.includes(":")) {
-      throw new Error(`Deploy step ${step.id} saveAs "${saveAs}" must not contain ":"`);
-    }
-    if (seen.has(saveAs)) {
-      throw new Error(`Duplicate deploy saveAs "${saveAs}"`);
-    }
-    seen.add(saveAs);
-  }
-};
+export { validateDeploySaveAs } from "./operationNames";
+import { validateDeploySaveAs } from "./operationNames";
 
 export const validateWorkflowStepKinds = (steps: WorkflowStep[]): void => {
   for (const step of steps) {
@@ -266,9 +249,10 @@ export const validateDeployCreate2Strategy = (steps: WorkflowStep[]): void => {
       if (step.upgradeableStrategy !== "uups-placeholder-proxy") {
         throw new Error(`Deploy step ${step.id} requires upgradeableStrategy: uups-placeholder-proxy`);
       }
-      if (String(step.contract) !== "contracts/workflow/UUPSPlaceholder.sol:UUPSPlaceholder") {
+      if (String(step.contract) !== "contracts/workflow/UUPSPlaceholder.sol:UUPSPlaceholder"
+        && step.contract !== asObject(step.firstUpgrade).contract) {
         throw new Error(
-          `Deploy step ${step.id} must create UUPS proxies with contracts/workflow/UUPSPlaceholder.sol:UUPSPlaceholder`,
+          `Deploy step ${step.id} must use the same business implementation in contract and firstUpgrade.contract`,
         );
       }
       if (!asObject(step.firstUpgrade).contract) {
@@ -385,7 +369,7 @@ const readPath = (source: Record<string, unknown>, pathExpression: string): unkn
   let current: unknown = source;
 
   for (const part of parts) {
-    if (typeof current !== "object" || current === null || !(part in current)) {
+    if (typeof current !== "object" || current === null || !Object.hasOwn(current, part)) {
       throw new Error(`Reference not found: ${pathExpression}`);
     }
     current = (current as Record<string, unknown>)[part];
@@ -411,7 +395,7 @@ export const resolveValue = (value: unknown, context: ResolveContext): unknown =
 
   if (typeof value === "object" && value !== null) {
     const objectValue = value as Record<string, unknown>;
-    if (typeof objectValue.$ref === "string") {
+    if (Object.hasOwn(objectValue, "$ref") && typeof objectValue.$ref === "string") {
       const ref = objectValue.$ref;
       if (ref.startsWith("state.")) {
         return context.state.get(ref.slice("state.".length));