gate-evm-tools 1.0.28 → 1.2.0

package/runtime/workflow/steps/deploy.ts

@@ -1,13 +1,15 @@
+import { resolveWorkflowValue } from '../lib/validation';
+import { recordPreparedDeployment } from "../lib/preparationEvidence";
 import { CONTROLLED_MULTICALL_AUTHORITY_ABI } from "../lib/controlledMulticallAbi";
 import path from "path";
-import { ethers, network } from "../../projectHardhat";
+import {verifyTransparentAdmin, transparentAdminAddress} from "gate-evm-tools/workflow";
 import type {
   GateToolDeploymentPlan,
   GateToolPreparationPlanV1,
   GateToolPreparationRequestV1,
   GateToolTransactionPlan,
 } from "gate-evm-tools/workflow";
-import type { WorkflowContext } from "../run";
+import type { WorkflowContext } from "../lib/context";
 import {
   requireExistingDeploymentPolicy,
   resolveExistingDeploymentPolicyAction,
@@ -29,27 +31,20 @@ import {
 } from "../lib/create2";
 import { assertReusableDeployment } from "../lib/checkCodeReport";
 import { getERC1967Implementation } from "../lib/erc1967";
-import { recordParameterLockImplementationSalts } from "../lib/lock";
 import {
   deriveImplementationSalt,
   FirstUpgradeOptions,
   ProxyOptions,
 } from "../lib/proxy";
 import { decideControlledMulticallAuthority } from "../lib/authority";
-import { impersonateWorkflowSimulationSigner } from "../lib/signer";
+import { impersonateLocalForkSigner } from "../lib/runtime";
 import { prepareGateToolWorkflow } from "../lib/gateTool";
 import { syncGateToolUups } from "../lib/gateToolSync";
-import { resolvePendingUupsReuse } from "../lib/pendingDeploymentReuse";
 
 const resolveInContext = (
   context: WorkflowContext,
   value: unknown,
-): unknown => resolveValue(value, {
-  targetId: context.targetId,
-  target: context.target,
-  params: context.targetParams,
-  state: context.state,
-});
+): unknown => resolveWorkflowValue(context, value);
 
 const resolveArray = (
   context: WorkflowContext,
@@ -85,6 +80,7 @@ const resolveProxyOptions = (
     options: {
       kind: typeof proxy.kind === "string" ? proxy.kind : undefined,
       initializer,
+      adminOwner: typeof proxy.adminOwner === "string" ? proxy.adminOwner : undefined,
       unsafeAllow: Array.isArray(proxy.unsafeAllow)
         ? proxy.unsafeAllow.map((item) => String(item))
         : undefined,
@@ -168,7 +164,7 @@ const applyExistingDeploymentPolicy = async (
   const existing = findDeploymentAddress(context.root, context.config, context.targetId, saveAs);
   if (!existing) return { completed: false, create2Options };
   const policy = requireExistingDeploymentPolicy(context.existingDeploymentPolicies, saveAs);
-  const implementationAddress = await getERC1967Implementation(ethers.provider, existing);
+  const implementationAddress = await getERC1967Implementation(context.runtime.hre.ethers.provider, existing);
   const action = resolveExistingDeploymentPolicyAction(policy, {
     instanceId: saveAs,
     existingAddress: existing,
@@ -188,8 +184,10 @@ const applyExistingDeploymentPolicy = async (
       address: existing,
       artifactHash: context.releaseArtifactHash,
     });
-    context.deploymentRecorder?.prepare(preparedChange);
-    context.deploymentRecorder?.apply({
+    if (context.preparations || context.validation) throw new Error("Delivery registry reuse requires bound preparation evidence; cannot omit expected transactions");
+    const recorder = context.mode === "execute" ? context.deploymentRecorder : undefined;
+    recorder?.prepare(preparedChange);
+    recorder?.apply({
       ...preparedChange,
       address: existing,
       proxyAddress: implementationAddress ? existing : undefined,
@@ -243,10 +241,11 @@ const deploymentForRole = (
 };
 
 const assertDeployedCode = async (
+  context: WorkflowContext,
   label: string,
   address: string,
 ): Promise<void> => {
-  const code = await ethers.provider.getCode(address);
+  const code = await context.runtime.hre.ethers.provider.getCode(address);
   if (!code || code === "0x") {
     throw new Error(`${label} is missing deployed code at ${address}`);
   }
@@ -286,7 +285,7 @@ const runGateToolControlledMulticall = async (
     })),
     create2.scheme,
   );
-  const multicall = await ethers.getContractAt(
+  const multicall = await context.runtime.hre.ethers.getContractAt(
     CONTROLLED_MULTICALL_AUTHORITY_ABI,
     create2.controlledMulticall,
     context.signer,
@@ -327,6 +326,7 @@ const runGateToolControlledMulticall = async (
     ...(prepared.scheme === undefined ? {} : { scheme: prepared.scheme }),
     ...(prepared.factoryDeps === undefined ? {} : { factoryDeps: prepared.factoryDeps }),
   });
+  context.preparations?.bind(step.id, { transactionId: planned.transactionId, gateToolTransactionIds: transactions.map(t => t.id), kind: "multicall" });
   if (planned.executionAction === "replay") {
     return {
       external: planned.route === "external",
@@ -350,9 +350,10 @@ const runGateToolControlledMulticall = async (
     return { external: true, transactionId: planned.transactionId };
   }
   const selectedSigner = planned.route === "external"
-    ? await impersonateWorkflowSimulationSigner(planned.executor)
+    ? await impersonateLocalForkSigner(context.runtime, planned.executor)
     : context.signer;
   const transaction = await sendPreparedControlledMulticallTransaction(prepared, selectedSigner);
+  context.transactionObserver?.record({ transactionId: planned.transactionId, transactionHash: transaction.hash });
   if (context.mode === "execute" && planned.route === "operator") {
     context.operatorReceipts.push({
       transactionId: planned.transactionId,
@@ -402,6 +403,46 @@ export const runDeployStep = async (
     throw new Error(`Deploy step ${step.id} requires an execution deployment recorder`);
   }
 
+  if (proxy?.options.kind === 'transparent') {
+    if(create2Options.scheme!=='evm'||step.upgradeableStrategy!=='transparent-proxy'||step.firstUpgrade!==undefined)throw Error('Transparent deployment requires EVM transparent-proxy strategy');
+    const adminOwner=proxy.options.adminOwner;
+    if(!adminOwner)throw Error('Transparent deployment requires explicit proxy.adminOwner');
+    if(proxy.options.initializer===undefined)throw Error('Transparent deployment requires explicit initializer method or false');
+    const actualContract=actualContractName(contractName),registryKey=contractInfoKey(saveAs,contractName);
+    const initialChange:DeploymentChange={stepId:step.id,kind:'deploy',instanceId:saveAs,actualContract,contractInfoKey:registryKey,strategy:'create2',proxyKind:'transparent',factory:create2Options.factory,multicall:create2Options.controlledMulticall,salt:create2Options.salt};
+    const existing=await applyExistingDeploymentPolicy(context,step,saveAs,initialChange,create2Options,true);
+    if(existing.completed){await verifyTransparentAdmin({hre:context.runtime.hre as any,proxy:existing.existingAddress!,admin:transparentAdminAddress(existing.existingAddress!),owner:adminOwner});return;}
+    const effective=existing.create2Options,implementationSalt=deriveImplementationSalt(context.bindings?.derivationSeed??context.executionId,contractName,effective.salt);
+    const request:GateToolPreparationRequestV1={version:1,kind:'transparent-deploy',scheme:'evm',network:context.runtime.hre.network.name,target:context.targetId,contract:contractName,
+      constructorArgs:proxy.options.constructorArgs??[],factory:effective.factory,proxyKind:'transparent',implementationSalt,proxySalt:effective.salt,proxyAdminOwner:adminOwner,
+      ...(proxy.options.unsafeAllow?{unsafeAllow:proxy.options.unsafeAllow}:{}),...(addressPolicy(effective)?{proxyAddressPolicy:addressPolicy(effective)}:{}),
+      ...(proxy.options.initializer===false?{}:{call:{method:proxy.options.initializer,args:resolveArray(context,step.args??[],`Step ${step.id} args`)}})};
+    const prepared=await prepareGateToolWorkflow({hre:context.runtime.hre,validation:context.validation,root:context.root,evidenceDir:gateToolEvidenceDir(context),evidenceName:step.id,request,
+      expected:context.preparations?.expected(step.id,request),readBlockTag:context.mode==='simulate'?context.simulation.snapshot?.blockNumber:undefined});
+    const implementation=deploymentForRole(prepared.plan,'implementation'),deployed=deploymentForRole(prepared.plan,'proxy'),admin=prepared.plan.proxyAdmin!;
+    if(existing.existingAddress?.toLowerCase()===deployed.address.toLowerCase())throw Error('Transparent redeploy predicted the existing address');
+    const change:DeploymentChange={...initialChange,salt:effective.salt,predictedAddress:deployed.address,implementationAddress:implementation.address,implementationSalt,
+      proxyAdminAddress:admin.address,proxyAdminOwner:admin.owner,constructorArgs:request.constructorArgs,gateTool:gateToolChange(context,prepared.planPath,prepared.plan),
+      ...(existing.existingAddress?{previousAddress:existing.existingAddress}:{}),...(existing.redeployReason?{redeployReason:existing.redeployReason}:{})};
+    context.bindings?.recordOrAssertDerivedValue(`${step.id}.implementation`,implementationSalt);recorder?.prepare(change);
+    recordPreparedDeployment(context,change,prepared,[`${step.id}.implementation`]);
+    if(context.mode==='execute')recorder?.stageAddressCandidate(change,deployed.address);
+    const execution=await runGateToolControlledMulticall(context,step,effective,prepared.plan.transactions);
+    if(context.mode==='execute'&&execution.transactionId)recorder?.bindProxyTransaction(step.id,execution.transactionId);
+    if(!execution.external){
+      await verifyTransparentAdmin({hre:context.runtime.hre as any,proxy:deployed.address,admin:admin.address,owner:admin.owner});
+      if((await getERC1967Implementation(context.runtime.hre.ethers.provider,deployed.address))?.toLowerCase()!==implementation.address.toLowerCase())throw Error('Transparent implementation mismatch');
+    }
+    const gateToolSync=context.mode==='execute'&&!execution.external&&deployed.status!=='reused'?await syncGateToolUups({hre:context.runtime.hre,root:context.root,evidenceDir:gateToolEvidenceDir(context),evidenceName:step.id,
+      scheme:'evm',network:context.runtime.hre.network.name,target:context.targetId,manifestDir:context.target.openzeppelin.manifestDir,proxy:deployed.address,implementation:implementation.address,
+      contract:actualContract,constructorArgs:request.constructorArgs,transactionHash:execution.txHash??'',proxyKind:'transparent',proxyAdminAddress:admin.address,proxyAdminOwner:admin.owner}):undefined;
+    if(context.mode==='execute'&&!execution.external)recorder?.applyAddress({...change,address:deployed.address,proxyAddress:deployed.address,txHash:execution.txHash,gateToolSync,reused:deployed.status==='reused'},deployed.address);
+    context.state.set(saveAs,{address:deployed.address,proxyAddress:deployed.address,implementationAddress:implementation.address,implementationSalt,proxyAdminAddress:admin.address,proxyAdminOwner:admin.owner,txHash:execution.txHash,external:execution.external});
+    context.reporter.result('execution',{stepId:step.id,kind:step.kind,mode:execution.external?'external':context.mode,contract:contractName,actualContract,saveAs,contractInfoKey:registryKey,strategy:'create2',scheme:'evm',proxy:'transparent',
+      address:deployed.address,implementationAddress:implementation.address,proxyAdminAddress:admin.address,proxyAdminOwner:admin.owner,transactionId:execution.transactionId,txHash:execution.txHash,gateToolPlan:change.gateTool!.outputPath});
+    return;
+  }
+
   if (proxy) {
     const firstUpgrade = resolveFirstUpgradeOptions(context, step);
     if (step.upgradeableStrategy !== "uups-placeholder-proxy" || !firstUpgrade) {
@@ -449,31 +490,26 @@ export const runDeployStep = async (
     );
     if (existingResolution.completed) return;
     const effectiveCreate2 = existingResolution.create2Options;
-    const pendingReuse = context.parameterLockExecutionId
-      ? await resolvePendingUupsReuse({
-          root: context.root,
-          taskDir: context.taskDir,
-          taskId: context.taskId,
-          currentExecutionId: context.parameterLockExecutionId,
-          network: context.targetId,
-          stepId: step.id,
-          instanceId: saveAs,
-          actualContract,
-          contractInfoKey: registryKey,
-          scheme: effectiveCreate2.scheme,
-          factory: effectiveCreate2.factory,
-          multicall: effectiveCreate2.controlledMulticall!,
-          proxySalt: effectiveCreate2.salt,
-          expectedAddress: effectiveCreate2.expectedAddress,
-          placeholderImplementationAddress: effectiveCreate2.uupsPlaceholderImplementation!,
-          provider: ethers.provider,
-          blockTag: context.mode === "simulate"
-            ? context.simulation.snapshot?.blockNumber
-            : undefined,
-        })
-      : undefined;
+    const pendingReuse = await context.pendingUupsReuse?.resolve({
+      taskId: context.taskId,
+      network: context.targetId,
+      stepId: step.id,
+      instanceId: saveAs,
+      actualContract,
+      contractInfoKey: registryKey,
+      scheme: effectiveCreate2.scheme,
+      factory: effectiveCreate2.factory,
+      multicall: effectiveCreate2.controlledMulticall!,
+      proxySalt: effectiveCreate2.salt,
+      expectedAddress: effectiveCreate2.expectedAddress,
+      placeholderImplementationAddress: effectiveCreate2.uupsPlaceholderImplementation!,
+      provider: context.runtime.hre.ethers.provider,
+      blockTag: context.mode === "simulate"
+        ? context.simulation.snapshot?.blockNumber
+        : undefined,
+    });
     const implementationSalt = pendingReuse?.implementationSalt ?? deriveImplementationSalt(
-      context.executionId,
+      context.bindings?.derivationSeed ?? context.executionId,
       firstUpgrade.contractName,
       effectiveCreate2.salt,
     );
@@ -481,7 +517,7 @@ export const runDeployStep = async (
       version: 1,
       kind: "uups-placeholder-deploy",
       scheme: effectiveCreate2.scheme,
-      network: network.name,
+      network: context.runtime.hre.network.name,
       target: context.targetId,
       contract: firstUpgrade.contractName,
       constructorArgs: firstUpgrade.constructorArgs || [],
@@ -501,10 +537,13 @@ export const runDeployStep = async (
         : {}),
     };
     const prepared = await prepareGateToolWorkflow({
+      hre: context.runtime.hre,
+      validation: context.validation,
       root: context.root,
       evidenceDir: gateToolEvidenceDir(context),
       evidenceName: step.id,
       request,
+      expected: context.preparations?.expected(step.id, request),
       readBlockTag: context.mode === "simulate"
         ? context.simulation.snapshot?.blockNumber
         : undefined,
@@ -512,8 +551,8 @@ export const runDeployStep = async (
     const implementation = deploymentForRole(prepared.plan, "implementation");
     const proxyDeployment = deploymentForRole(prepared.plan, "proxy");
     if (pendingReuse && (
-      prepared.plan.transactions.length !== 0
-      || prepared.plan.artifact.digest !== pendingReuse.evidence.artifactDigest
+      (!pendingReuse.binding && prepared.plan.transactions.length !== 0)
+      || prepared.plan.artifact.digest !== pendingReuse.artifactDigest
       || implementation.address.toLowerCase() !== pendingReuse.implementationAddress.toLowerCase()
       || proxyDeployment.address.toLowerCase() !== pendingReuse.proxyAddress.toLowerCase()
     )) {
@@ -536,6 +575,7 @@ export const runDeployStep = async (
     const plannedChange: DeploymentChange = {
       ...preparedChange,
       salt: effectiveCreate2.salt,
+      expectedAddress: effectiveCreate2.expectedAddress,
       previousAddress: existingResolution.existingAddress,
       redeployReason: existingResolution.redeployReason,
       implementationAddress: implementation.address,
@@ -543,16 +583,11 @@ export const runDeployStep = async (
       constructorArgs: firstUpgrade.constructorArgs || [],
       predictedAddress: proxyDeployment.address,
       gateTool,
-      ...(pendingReuse ? { pendingReuse: pendingReuse.evidence } : {}),
+      ...(pendingReuse?.legacyEvidence ? { pendingReuse: pendingReuse.legacyEvidence } : {}),
     };
-    if (context.parameterLockExecutionId) {
-      recordParameterLockImplementationSalts(
-        context.taskDir,
-        context.parameterLockExecutionId,
-        { [`${step.id}.implementation`]: implementationSalt },
-      );
-    }
+    context.bindings?.recordOrAssertDerivedValue(`${step.id}.implementation`, implementationSalt);
     recorder?.prepare(plannedChange);
+    recordPreparedDeployment(context, plannedChange, prepared, [`${step.id}.implementation`]);
     if (context.mode === "execute") {
       recorder?.stageAddressCandidate(plannedChange, proxyDeployment.address);
     }
@@ -567,12 +602,13 @@ export const runDeployStep = async (
     }
     if (!execution.external) {
       await assertDeployedCode(
+        context,
         `${firstUpgrade.contractName} implementation`,
         implementation.address,
       );
-      await assertDeployedCode("ERC1967Proxy", proxyDeployment.address);
+      await assertDeployedCode(context, "ERC1967Proxy", proxyDeployment.address);
       const currentImplementation = await getERC1967Implementation(
-        ethers.provider,
+        context.runtime.hre.ethers.provider,
         proxyDeployment.address,
       );
       if (
@@ -588,11 +624,12 @@ export const runDeployStep = async (
       && !execution.external
       && proxyDeployment.status !== "reused"
       ? await syncGateToolUups({
+          hre: context.runtime.hre,
           root: context.root,
           evidenceDir: gateToolEvidenceDir(context),
           evidenceName: step.id,
           scheme: prepared.plan.scheme,
-          network: network.name,
+          network: context.runtime.hre.network.name,
           target: context.targetId,
           manifestDir: context.target.openzeppelin.manifestDir,
           proxy: proxyDeployment.address,
@@ -644,7 +681,7 @@ export const runDeployStep = async (
       txHash: execution.txHash,
       gateToolPlan: gateTool.outputPath,
       gateToolSync: gateToolSync?.outputPath,
-      pendingReuse: pendingReuse?.evidence,
+      pendingReuse: pendingReuse?.legacyEvidence ?? pendingReuse?.binding,
     });
     return;
   }
@@ -679,7 +716,7 @@ export const runDeployStep = async (
     version: 1,
     kind: "create2-deploy",
     scheme: effectiveCreate2.scheme,
-    network: network.name,
+    network: context.runtime.hre.network.name,
     target: context.targetId,
     contract: contractName,
     constructorArgs: args,
@@ -696,10 +733,13 @@ export const runDeployStep = async (
       : {}),
   };
   const prepared = await prepareGateToolWorkflow({
+    hre: context.runtime.hre,
+    validation: context.validation,
     root: context.root,
     evidenceDir: gateToolEvidenceDir(context),
     evidenceName: step.id,
     request,
+    expected: context.preparations?.expected(step.id, request),
     readBlockTag: context.mode === "simulate"
       ? context.simulation.snapshot?.blockNumber
       : undefined,
@@ -723,6 +763,7 @@ export const runDeployStep = async (
     gateTool,
   };
   recorder?.prepare(preparedChange);
+  recordPreparedDeployment(context, preparedChange, prepared, []);
   if (context.mode === "execute") {
     recorder?.stageAddressCandidate(preparedChange, deployment.address);
   }
@@ -733,7 +774,7 @@ export const runDeployStep = async (
     prepared.plan.transactions,
   );
   if (!execution.external) {
-    await assertDeployedCode(contractName, deployment.address);
+    await assertDeployedCode(context, contractName, deployment.address);
   }
   if (context.mode === "execute" && !execution.external) {
     recorder?.applyAddress({