gate-evm-tools 1.0.28 → 1.2.0

package/dist-runtime/delivery/compiler.js

@@ -0,0 +1,851 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDeliveryCompiler = registerDeliveryCompiler;
+exports.qualifyDeliveryCompiler = qualifyDeliveryCompiler;
+exports.ownedDeliveryCompiler = ownedDeliveryCompiler;
+exports.compilerPreparationHooks = compilerPreparationHooks;
+exports.hasCompilerSameForkInitial = hasCompilerSameForkInitial;
+exports.verifyCompilerSameForkUpgrade = verifyCompilerSameForkUpgrade;
+exports.validateCompilerPreparationPlan = validateCompilerPreparationPlan;
+exports.parseCompilerEvidence = parseCompilerEvidence;
+/** Owned compiler qualification v1. Evidence parsing never creates an owned collector. */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_async_hooks_1 = require("node:async_hooks");
+const compiler_io_1 = require("./compiler-io");
+const workflow_1 = require("gate-evm-tools/workflow");
+const ethers_1 = require("ethers");
+const deploy_impl_1 = require("@openzeppelin/hardhat-upgrades/dist/utils/deploy-impl");
+const options_1 = require("@openzeppelin/hardhat-upgrades/dist/utils/options");
+const upgrades_core_1 = require("@openzeppelin/upgrades-core");
+const data_1 = require("./data");
+const execution_identity_1 = require("./execution-identity");
+const canonicalData_1 = require("../workflow/lib/canonicalData");
+const compiler_files_1 = require("./compiler-files");
+const compiler_pins_1 = require("./compiler-pins");
+const compiler_pins_2 = require("./compiler-pins");
+const compiler_dependency_pins_1 = require("./compiler-dependency-pins");
+const same_fork_baseline_1 = require("./same-fork-baseline");
+const preparation_1 = require("./preparation");
+const ADAPTER = 'hardhat-2.26.3-oz-3.9.1-core-1.44.2-v1';
+const LONG_VERSION = '0.8.28+commit.7893614a';
+const NATIVE_HASH = '81515b0e53deaa266d549545ccaac0a5a96e6d4e8201c77f673b2c710976d9ea';
+const JS_HASH = '9ef37cc1d2597ed6d2f706a960f449e33eb9eee920936cea77b11e6f43861970';
+const JS_SOURCE = 'npm:solc@0.8.28/soljson.js#sha512-AFCiJ+b4RosyyNhnfdVH4ZR1+TxiL91iluPjw0EJslIu4LXGM9NYqi2z5y8TqochC4tcH9QsHfwWhOIC9jPDKA==';
+const NATIVE_SOURCE = 'solc-bin:78d9b01518c352f6c075a9d30f7b27b6e592da1d/macosx-amd64/solc-macosx-amd64-v0.8.28+commit.7893614a';
+// Resolve the same core manifest reader used by the actual preparation call site.
+const { readRegisteredTargetUpgradeState, resolveTargetManifestDirectory } = require(node_path_1.default.join(node_path_1.default.dirname(require.resolve('gate-evm-tools/workflow')), '../core/preparation/manifest.js'));
+const contexts = new node_async_hooks_1.AsyncLocalStorage();
+const collectors = new WeakMap();
+const owned = new WeakMap();
+const handles = new WeakMap();
+const initialRuntime = new WeakMap();
+let registered;
+let registrationError;
+const names = (tasks) => Object.keys(tasks).filter(k => k === 'compile' || k.startsWith('compile:')).sort();
+const chain = (task) => { const out = []; for (let t = task; t; t = t.parentTaskDefinition)
+    out.push(t); return out; };
+const equal = (a, b, label) => { if ((0, canonicalData_1.semanticHash)(a) !== (0, canonicalData_1.semanticHash)(b))
+    throw new Error(`${label} mismatch`); };
+/** This explicit projection applies only to official core 1.44.2 records/options. */
+function persistedOZ(value) {
+    const optional = new Set(['version', 'solcVersion', 'layoutVersion', 'flat', 'namespaces', 'astId', 'offset', 'slot', 'renamedFrom', 'retypedFrom', 'members', 'underlying', 'numberOfBytes', 'kind', 'unsafeAllowRenames', 'unsafeSkipStorageCheck']);
+    const visit = (v) => {
+        if (Array.isArray(v))
+            return v.map(visit);
+        if (v && typeof v === 'object') {
+            if (![Object.prototype, null].includes(Object.getPrototypeOf(v)))
+                throw new Error('Invalid official OZ record');
+            const out = {};
+            for (const [key, d] of Object.entries(Object.getOwnPropertyDescriptors(v))) {
+                if (!d.enumerable || !('value' in d))
+                    throw new Error('Invalid official OZ own record');
+                if (d.value === undefined) {
+                    if (!optional.has(key))
+                        throw new Error(`Unsupported OZ optional field ${key}`);
+                }
+                else
+                    Object.defineProperty(out, key, { value: visit(d.value), enumerable: true });
+            }
+            return out;
+        }
+        return v;
+    };
+    return (0, data_1.strictData)(visit(value));
+}
+function projection(sourceName, contractName, output) {
+    const hex = (s = '') => s.slice(0, 2).toLowerCase() === '0x' ? s : `0x${s}`;
+    return (0, data_1.strictData)({ _format: 'hh-sol-artifact-1', sourceName, contractName, abi: output.abi,
+        bytecode: hex(output.evm?.bytecode?.object), deployedBytecode: hex(output.evm?.deployedBytecode?.object),
+        linkReferences: output.evm?.bytecode?.linkReferences ?? {}, deployedLinkReferences: output.evm?.deployedBytecode?.linkReferences ?? {} });
+}
+function stable(e) {
+    return { version: e.version, adapter: e.adapter, toolchain: (0, execution_identity_1.compilerExecutionInput)(e.toolchain),
+        jobs: e.jobs.map(j => ({ id: j.id, config: j.config, sources: j.sources, main: j.runs[0] })),
+        builds: e.builds, artifacts: e.artifacts, selections: e.selections, baselines: e.baselines.map(({ prior, ...b }) => ({ ...b, prior: { stableDigest: prior.stableDigest, selection: prior.selection } })) };
+}
+function jobIdentity(j) {
+    return (0, canonicalData_1.semanticHash)({ config: j.config, sources: j.sources, input: j.runs[0].input, compiler: j.runs[0].compiler });
+}
+function validationFor(job) {
+    if (job.runs.length !== 2)
+        throw new Error('Missing exact main/auxiliary compiler pair');
+    const [main, aux] = job.runs;
+    for (const run of job.runs)
+        if (run.output.errors?.some((e) => e.severity === 'error'))
+            throw new Error('Compiler evidence contains failed compilation');
+    return persistedOZ((0, upgrades_core_1.validate)(main.output, (0, upgrades_core_1.solcInputOutputDecoder)(main.input, main.output), main.compiler.version, main.input, aux.output));
+}
+function selectedClosure(run, fqn) {
+    const result = {};
+    const visit = (name) => {
+        if (result[name])
+            return;
+        if (!run[name])
+            throw new Error('Selected validation closure missing contract');
+        result[name] = run[name];
+        for (const dep of [...(run[name].inherit ?? []), ...(run[name].libraries ?? [])])
+            visit(dep);
+    };
+    visit(fqn);
+    return persistedOZ(result);
+}
+/** Pure artifact/ABI/OZ relationships shared by owned observation and persisted parsing. */
+function selectedIdentity(entry, job, linkedBytecode, options) {
+    const artifact = entry.artifact;
+    if (artifact.bytecode === '0x')
+        throw new Error('ABI-only artifact cannot have an OZ deployment version');
+    // Construct from the actual artifact: the current adapter does not support library linking.
+    const factory = new ethers_1.ContractFactory(artifact.abi, artifact.bytecode);
+    if (factory.bytecode !== linkedBytecode)
+        throw new Error('Selected linked bytecode is not the qualified artifact');
+    const expected = { version: '3.4', log: [job.validation] };
+    const unlinkedBytecode = (0, upgrades_core_1.getUnlinkedBytecode)(expected, linkedBytecode);
+    if (unlinkedBytecode !== artifact.bytecode)
+        throw new Error('Actual factory bytecode is not the qualified artifact');
+    const encodedArgs = factory.interface.encodeDeploy(options.constructorArgs);
+    const version = (0, upgrades_core_1.getVersion)(unlinkedBytecode, linkedBytecode, encodedArgs);
+    const [fqn] = (0, upgrades_core_1.getContractNameAndRunValidation)(expected, version);
+    if (fqn !== entry.fqn)
+        throw new Error('Selected OZ first FQN does not match qualified artifact');
+    return { expected, fqn, unlinkedBytecode, encodedArgs, version,
+        validation: selectedClosure(job.validation, fqn), layout: persistedOZ((0, upgrades_core_1.getStorageLayout)(expected, version)) };
+}
+function assertFullOptions(options) {
+    const defaults = persistedOZ((0, options_1.withDefaults)((0, data_1.strictData)(options)));
+    // Official defaults append these legacy exceptions on every call, including
+    // for already-defaulted options. Preserve their recorded order/duplicates,
+    // while requiring the exceptions implied by the recorded legacy flags.
+    if (!Array.isArray(options.unsafeAllow)
+        || (defaults.unsafeAllowCustomTypes && !['enum-definition', 'struct-definition'].every(kind => options.unsafeAllow.includes(kind)))
+        || (defaults.unsafeAllowLinkedLibraries && !options.unsafeAllow.includes('external-library-linking')))
+        throw new Error('Persisted selected full safety options mismatch');
+    defaults.unsafeAllow = options.unsafeAllow;
+    equal(defaults, options, 'Persisted selected full safety options');
+}
+function registry(hre) {
+    if (registrationError)
+        throw registrationError;
+    if (!registered)
+        throw new Error('Compiler adapter was not registered by delivery bootstrap');
+    equal(names(hre.tasks), Object.keys(registered).sort(), 'Compiler task registry');
+    for (const [name, expected] of Object.entries(registered)) {
+        const actual = chain(hre.tasks[name]);
+        if (actual.length !== expected.length || actual.some((t, i) => t !== expected[i].task || t.action !== expected[i].action))
+            throw new Error(`Unsupported compiler task override: ${name}`);
+    }
+}
+/** Registered only after manifest bootstrap, pinned OZ and the owned proxy-source adapter. */
+function registerDeliveryCompiler(subtask, tasks, extendEnvironment) {
+    extendEnvironment(hre => initialRuntime.set(hre, { run: hre.run, provider: hre.network.provider }));
+    try {
+        equal(names(tasks), Object.keys(compiler_pins_1.compilerTaskPins).sort(), 'Initial compiler task registry');
+        for (const name of names(tasks))
+            equal(chain(tasks[name]).map(t => (0, compiler_files_1.sha256)(Function.prototype.toString.call(t.action))), compiler_pins_1.compilerTaskPins[name], `Unsupported compiler task ${name}`);
+    }
+    catch (e) {
+        registrationError = e;
+    }
+    const wrap = (name, action) => {
+        subtask(name).setAction(async (args, hre, runSuper) => {
+            const collector = collectors.get(hre.artifacts);
+            if (!collector)
+                return runSuper(args);
+            if (hre.config !== collector.hre.config || hre.tasks !== collector.hre.tasks || hre.network !== collector.hre.network)
+                throw new Error('Compiler task HRE capability association mismatch');
+            collector.assertRegistry();
+            const result = await action(args, hre, runSuper, collector);
+            collector.assertRegistry();
+            return result;
+        });
+    };
+    wrap('compile:solidity:get-dependency-graph', async (args, _hre, next, c) => {
+        const graph = await next(c.compiling ? { ...args, solidityFilesCache: undefined } : args);
+        c.graph(graph);
+        return graph;
+    });
+    wrap('compile:solidity:compile-job', async (args, _hre, next, c) => c.job(args, next));
+    wrap('compile:solidity:solc:compile', async (args, _hre, next, c) => c.run(args, next));
+    wrap('compile:solidity:solc:get-build', async (args, _hre, next, c) => c.build(args, next));
+    for (const name of ['compile:solidity:solc:run', 'compile:solidity:solcjs:run'])
+        wrap(name, async (args, _hre, next, c) => c.runner(name, args, next));
+    registered = Object.fromEntries(names(tasks).map(name => [name, chain(tasks[name]).map(task => ({ task, action: task.action }))]));
+}
+class CompilerSession {
+    hre;
+    options;
+    #files;
+    #jobs = [];
+    #artifacts = new Map();
+    #builds = new Map();
+    #selections = new Map();
+    #baselineSources = new Map();
+    #baselines = [];
+    #initialPreparations = new Map();
+    #observedInitials = new WeakSet();
+    #sameForkProofs = new WeakMap();
+    #edges = new Map();
+    #oldRead;
+    #read;
+    #compiling = false;
+    #failed = false;
+    #config;
+    #run;
+    #provider;
+    constructor(hre, options) {
+        this.hre = hre;
+        this.options = options;
+        const initial = initialRuntime.get(hre);
+        if (!initial || initial.run !== hre.run || (0, compiler_files_1.sha256)(Function.prototype.toString.call(hre.run)) !== compiler_pins_1.compilerDispatcherPin)
+            throw new Error('Qualification requires the stock initial Hardhat dispatcher');
+        if (initial.provider !== hre.network.provider)
+            throw new Error('Compiler provider changed before qualification');
+        this.#files = new compiler_files_1.CompilerFiles(node_fs_1.default.realpathSync(hre.config.paths.root));
+        this.#oldRead = hre.artifacts.readArtifact;
+        this.#read = this.#oldRead;
+        this.#config = this.configIdentity();
+        this.#run = hre.run;
+        this.#provider = initial.provider;
+        const { Artifacts } = require('hardhat/internal/artifacts');
+        if (this.#oldRead !== Artifacts.prototype.readArtifact)
+            throw new Error('Qualification requires stock Hardhat artifact reader');
+    }
+    configIdentity() { return (0, canonicalData_1.semanticHash)({ paths: this.hre.config.paths, solidity: this.hre.config.solidity, namespacedCompileErrors: this.hre.config.namespacedCompileErrors ?? 'error' }); }
+    get compiling() { return this.#compiling; }
+    assertRegistry() {
+        if (this.#failed)
+            throw new Error('Compiler collector failed and cannot qualify');
+        registry(this.hre);
+        if (this.configIdentity() !== this.#config)
+            throw new Error('Compiler effective config drift');
+        if (this.hre.run !== this.#run)
+            throw new Error('Compiler top-level dispatcher changed');
+        if (this.hre.network.provider !== this.#provider)
+            throw new Error('Compiler provider changed');
+        if (this.hre.artifacts.readArtifact !== this.#read)
+            throw new Error('Compiler artifact reader changed');
+    }
+    async compile() {
+        this.assertRegistry();
+        this.#files.toolchain();
+        if (this.options.compiler?.kind === 'npm-soljson-0.8.28')
+            this.#files.wrapper();
+        this.#compiling = true;
+        try {
+            await this.hre.run('compile', { force: true, quiet: true });
+            if (!this.#jobs.length)
+                throw new Error('Qualification requires actual compiler jobs');
+            this.#files.runtime();
+            this.#files.verify();
+            this.#read = async (name) => this.artifact(name, await this.#oldRead.call(this.hre.artifacts, name));
+            this.hre.artifacts.readArtifact = this.#read;
+            this.assertRegistry();
+        }
+        catch (error) {
+            this.#failed = true;
+            throw error;
+        }
+        finally {
+            this.#compiling = false;
+        }
+    }
+    graph(graph) {
+        if (!this.#compiling)
+            return;
+        for (const file of graph.getResolvedFiles())
+            this.#edges.set(file.sourceName, graph.getDependencies(file).map((f) => f.sourceName).sort());
+    }
+    async job(args, next) {
+        if (!this.#compiling)
+            throw new Error('New unassociated compilation after qualification');
+        const sources = args.compilationJob.getResolvedFiles().map((file) => {
+            const bytes = this.#files.read(file.absolutePath), text = bytes.toString('utf8');
+            if (!Buffer.from(text).equals(bytes) || text !== file.content.rawContent)
+                throw new Error('Actual original compiler source differs from physical UTF-8 file');
+            const physical = (0, compiler_files_1.relative)(this.#files.root, file.absolutePath);
+            const pkg = physical.startsWith('node_modules/') ? this.#files.package(file.absolutePath) : undefined;
+            if (pkg && (file.library?.name !== pkg.name || file.library?.version !== pkg.version))
+                throw new Error('Compiler npm physical source identity mismatch');
+            if (pkg && file.sourceName !== `${pkg.name}/${(0, compiler_files_1.relative)(node_path_1.default.join(this.#files.root, pkg.lockLocation), file.absolutePath)}`)
+                throw new Error('Compiler package sourceName/physical path mismatch');
+            if (!pkg && file.sourceName !== physical)
+                throw new Error('Virtual/transformed project compiler source is unsupported');
+            return { sourceName: file.sourceName, path: physical, digest: (0, compiler_files_1.sha256)(bytes), package: pkg?.lockLocation ?? null, dependencies: this.#edges.get(file.sourceName) ?? [], emitsArtifact: args.compilationJob.emitsArtifacts(file) };
+        }).sort((a, b) => a.sourceName.localeCompare(b.sourceName, 'en'));
+        const captured = { id: '', config: (0, data_1.strictData)(args.compilationJob.getSolcConfig()), sources, runs: [], validation: {} };
+        const result = await contexts.run({ job: args.compilationJob, captured }, () => next(args));
+        if (captured.runs.length !== 2)
+            throw new Error('Missing actual OZ auxiliary compiler invocation');
+        equal(captured.runs[0].input, result.input, 'Actual main job input');
+        equal(captured.runs[0].output, result.output, 'Actual main job output');
+        for (const s of sources)
+            if ((0, compiler_files_1.sha256)(captured.runs[0].input.sources[s.sourceName]?.content ?? '') !== s.digest)
+                throw new Error('Original input/source mapping mismatch');
+        equal(Object.keys(captured.runs[0].input.sources).sort(), sources.map(s => s.sourceName).sort(), 'Original source set');
+        captured.id = jobIdentity(captured);
+        if (this.#jobs.some(j => j.id === captured.id))
+            throw new Error('Duplicate compiler job identity');
+        captured.validation = validationFor(captured);
+        this.#jobs.push((0, canonicalData_1.deepFreeze)(captured));
+        return result;
+    }
+    async run(args, next) {
+        const context = contexts.getStore();
+        if (!context || context.job !== args.compilationJob || context.run)
+            throw new Error('Compiler invocation has no unique job context');
+        const run = { input: (0, data_1.strictData)(args.input) };
+        const result = await contexts.run({ ...context, run }, () => next(args));
+        if (!run.build || !run.output || !run.compiler)
+            throw new Error('Missing observed compiler runner/build');
+        equal(result.output, run.output, 'Compiler runner output');
+        equal(result.solcBuild, run.build, 'Compiler build');
+        context.captured.runs.push({ input: run.input, output: run.output, compiler: run.compiler, inputDigest: (0, canonicalData_1.semanticHash)(run.input), outputDigest: (0, canonicalData_1.semanticHash)(run.output) });
+        return result;
+    }
+    async build(args, next) {
+        const run = contexts.getStore()?.run;
+        if (!run || run.build)
+            throw new Error('Compiler build outside unique invocation');
+        if (args.solcVersion !== '0.8.28')
+            throw new Error('Unsupported qualification compiler version');
+        const build = this.options.compiler ? { compilerPath: node_path_1.default.resolve(this.options.compiler.path), isSolcJs: this.options.compiler.kind === 'npm-soljson-0.8.28', version: '0.8.28', longVersion: LONG_VERSION } : await next(args);
+        if (build.version !== '0.8.28' || build.longVersion !== LONG_VERSION || (build.isSolcJs && !this.options.compiler) || (!build.isSolcJs && process.platform !== 'darwin'))
+            throw new Error('Unsupported qualification compiler backend');
+        run.build = (0, data_1.strictData)(build);
+        return build;
+    }
+    async runner(name, args, next) {
+        const run = contexts.getStore()?.run, build = run?.build;
+        if (!run || !build || run.output)
+            throw new Error('Unassociated compiler runner');
+        const file = name.endsWith('solcjs:run') ? args.solcJsPath : args.solcPath;
+        if (file !== build.compilerPath || build.isSolcJs !== name.endsWith('solcjs:run'))
+            throw new Error('Actual compiler runner/build path mismatch');
+        equal(run.input, args.input, 'Actual runner input');
+        if (build.isSolcJs)
+            this.#files.wrapper();
+        this.#files.runtime();
+        // Native host cache paths stay local. Only approved bytes/source enter portable evidence.
+        const stat = node_fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+            throw new Error('Compiler binary must be a regular unlinked file');
+        const digest = (0, compiler_files_1.sha256)(node_fs_1.default.readFileSync(file));
+        if (digest !== (build.isSolcJs ? JS_HASH : NATIVE_HASH))
+            throw new Error('Unapproved compiler binary bytes');
+        this.#files.verify();
+        const result = await next(args);
+        if ((0, compiler_files_1.sha256)(node_fs_1.default.readFileSync(file)) !== digest)
+            throw new Error('Compiler binary changed during execution');
+        this.#files.verify();
+        run.output = (0, data_1.strictData)(result);
+        run.compiler = { kind: build.isSolcJs ? 'npm-soljson-0.8.28' : 'native-macos-0.8.28', version: build.version, longVersion: build.longVersion, digest,
+            source: build.isSolcJs ? JS_SOURCE : NATIVE_SOURCE };
+        return result;
+    }
+    artifact(name, raw) {
+        this.assertRegistry();
+        const artifact = (0, data_1.strictData)(raw), fqn = `${artifact.sourceName}:${artifact.contractName}`;
+        if (name.includes(':') ? name !== fqn : name !== artifact.contractName)
+            throw new Error('Actual artifact FQN mismatch');
+        const file = node_path_1.default.join(this.hre.config.paths.artifacts, artifact.sourceName, `${artifact.contractName}.json`);
+        const contents = this.#files.read(file).toString('utf8');
+        equal(JSON.parse(contents), artifact, 'Actual persisted artifact');
+        const dbgFile = file.slice(0, -5) + '.dbg.json';
+        const debugContents = this.#files.read(dbgFile).toString('utf8'), dbg = JSON.parse(debugContents);
+        if (dbg._format !== 'hh-sol-dbg-1' || typeof dbg.buildInfo !== 'string' || node_path_1.default.isAbsolute(dbg.buildInfo))
+            throw new Error('Unsupported artifact debug pointer');
+        const infoFile = node_path_1.default.resolve(node_path_1.default.dirname(dbgFile), dbg.buildInfo);
+        (0, compiler_files_1.relative)(node_path_1.default.join(this.hre.config.paths.artifacts, 'build-info'), infoFile);
+        const infoContents = this.#files.read(infoFile).toString('utf8'), info = JSON.parse(infoContents);
+        if (info._format !== 'hh-sol-build-info-1')
+            throw new Error('Invalid compiler build-info format');
+        const matching = this.#jobs.filter(j => (0, canonicalData_1.semanticHash)(j.runs[0].input) === (0, canonicalData_1.semanticHash)(info.input) && (0, canonicalData_1.semanticHash)(j.runs[0].output) === (0, canonicalData_1.semanticHash)(info.output)
+            && j.runs[0].compiler.version === info.solcVersion && j.runs[0].compiler.longVersion === info.solcLongVersion);
+        if (matching.length !== 1)
+            throw new Error('Artifact has no unique observed compiler job');
+        const job = matching[0], output = job.runs[0].output.contracts?.[artifact.sourceName]?.[artifact.contractName];
+        if (!output)
+            throw new Error('Artifact absent from observed compiler output');
+        equal(projection(artifact.sourceName, artifact.contractName, output), artifact, 'Independent stock artifact projection');
+        const build = { path: (0, compiler_files_1.relative)(this.#files.root, infoFile), contents: infoContents, digest: (0, compiler_files_1.sha256)(infoContents), job: job.id };
+        this.#builds.set(build.digest, (0, canonicalData_1.deepFreeze)(build));
+        const entry = { fqn, job: job.id, artifact, digest: (0, canonicalData_1.semanticHash)(artifact), path: (0, compiler_files_1.relative)(this.#files.root, file), contents, debugPath: (0, compiler_files_1.relative)(this.#files.root, dbgFile), debugContents, buildInfo: build.digest };
+        if (this.#artifacts.has(fqn))
+            equal(this.#artifacts.get(fqn), entry, 'Selected artifact drift');
+        this.#artifacts.set(fqn, (0, canonicalData_1.deepFreeze)(entry));
+        return (0, canonicalData_1.deepFreeze)(artifact);
+    }
+    async implementation(name, constructorArgs, options = {}) {
+        try {
+            const artifact = await this.hre.artifacts.readArtifact(name);
+            if (artifact.bytecode === '0x')
+                throw new Error('ABI-only artifact cannot have an OZ deployment version');
+            const factory = new ethers_1.ContractFactory(artifact.abi, artifact.bytecode);
+            const data = await (0, deploy_impl_1.getDeployData)(this.hre, factory, { ...options, constructorArgs });
+            return this.observeDeployData(artifact, factory, data, { ...options, constructorArgs });
+        }
+        finally {
+            await (0, compiler_io_1.yieldCompilerIo)();
+        }
+    }
+    observeDeployData(artifact, factory, data, options) {
+        this.artifact(`${artifact.sourceName}:${artifact.contractName}`, artifact);
+        const entry = this.#artifacts.get(`${artifact.sourceName}:${artifact.contractName}`);
+        const job = this.#jobs.find(j => j.id === entry.job);
+        const { fqn, unlinkedBytecode, encodedArgs, version, validation, layout } = selectedIdentity(entry, job, factory.bytecode, options);
+        if (factory.interface.encodeDeploy(options.constructorArgs) !== encodedArgs)
+            throw new Error('Actual factory ABI constructor encoding mismatch');
+        equal(data.version, version, 'Selected OZ version');
+        if (data.encodedArgs !== encodedArgs || data.unlinkedBytecode !== unlinkedBytecode)
+            throw new Error('Selected OZ bytecode/constructor mismatch');
+        const [actualFqn, actualRun] = (0, upgrades_core_1.getContractNameAndRunValidation)(data.validations, version);
+        if (actualFqn !== fqn)
+            throw new Error('Selected OZ first FQN does not match qualified artifact');
+        equal(selectedClosure(actualRun, fqn), validation, 'Selected OZ validation');
+        equal(persistedOZ(data.layout), layout, 'Selected full effective storage layout');
+        equal(persistedOZ(data.fullOpts), persistedOZ((0, options_1.withDefaults)(options)), 'Selected full safety options');
+        (0, upgrades_core_1.assertUpgradeSafe)(data.validations, version, data.fullOpts);
+        const body = { fqn, job: job.id, artifactDigest: entry.digest, unlinkedBytecode, linkedBytecode: factory.bytecode, encodedArgs, version, layout, validation, options: persistedOZ(data.fullOpts) };
+        const result = (0, canonicalData_1.deepFreeze)({ ...body, digest: (0, canonicalData_1.semanticHash)(body) });
+        this.#selections.set(result.digest, result);
+        return result;
+    }
+    /** Explicit historical source/artifact/constructor selection, never parsed JSON authority. */
+    baseline(implementation, handle, selection) {
+        const collector = owned.get(handle);
+        if (!collector || collector.#selections.get(selection.digest) !== selection)
+            throw new Error('Baseline requires an owned qualified selection');
+        if (!/^0x[0-9a-fA-F]{40}$/.test(implementation))
+            throw new Error('Invalid baseline implementation address');
+        const key = implementation.toLowerCase(), old = this.#baselineSources.get(key);
+        if (old && old.selection.digest !== selection.digest)
+            throw new Error('Ambiguous baseline qualification');
+        this.#baselineSources.set(key, { collector, selection });
+    }
+    priorQualification(prior) {
+        // A self-reference to today's aggregate would be circular. Bind the immutable selected original job instead.
+        const priorJob = prior.collector.#jobs.find(j => j.id === prior.selection.job);
+        const priorEvidence = prior.collector.evidence();
+        const priorArtifacts = priorEvidence.artifacts.filter(a => a.digest === prior.selection.artifactDigest);
+        const priorBody = { version: 1, adapter: ADAPTER, toolchain: priorEvidence.toolchain, jobs: [priorJob], builds: priorEvidence.builds.filter(b => priorArtifacts.some(a => a.buildInfo === b.digest)), artifacts: priorArtifacts, selections: [prior.selection], baselines: [] };
+        const qualification = { ...priorBody, stableDigest: (0, canonicalData_1.semanticHash)(stable(priorBody)), exactDigest: (0, canonicalData_1.semanticHash)(priorBody) };
+        prior.collector.assertRegistry();
+        prior.collector.#files.verify();
+        return { stableDigest: qualification.stableDigest, exactDigest: qualification.exactDigest, selection: prior.selection.digest, qualification };
+    }
+    captureBaseline(request, selection, observation) {
+        const { currentImplementation, chainId } = observation;
+        const prior = this.#baselineSources.get(currentImplementation.toLowerCase());
+        if (!prior)
+            throw new Error('Historical baseline requires prior qualified source/artifact/constructor selection');
+        (0, upgrades_core_1.assertStorageUpgradeSafe)(prior.selection.layout, selection.layout, selection.options);
+        let origin;
+        if ('state' in observation) {
+            const { state } = observation;
+            if (state.implementationKey !== prior.selection.version.linkedWithoutMetadata)
+                throw new Error('Historical baseline implementation map key/version mismatch');
+            equal(persistedOZ(state.oldLayout), prior.selection.layout, 'Historical baseline layout');
+            origin = { kind: 'target-manifest', manifestPolicy: state.paths.manifestDir, manifestDigest: state.digest, proxy: state.proxyEntry, implementationEntry: persistedOZ(state.implementationEntry) };
+        }
+        else {
+            const initial = this.#sameForkProofs.get(observation.sameFork);
+            if (!initial || (request.kind !== 'uups-upgrade' && request.kind !== 'transparent-upgrade') || initial.selection.digest !== prior.selection.digest
+                || !(0, same_fork_baseline_1.matchesSameForkInitial)(initial, request.target, String(chainId), request.proxy, currentImplementation, request.proxyKind))
+                throw new Error('Same-fork baseline requires its owned initial preparation and actual deployment observation');
+            origin = { kind: 'same-fork', manifestPolicy: resolveTargetManifestDirectory(this.hre.config.paths.root, request.target), proxy: { address: request.proxy.toLowerCase(), kind: request.proxyKind }, sameForkBaselineDigest: observation.sameFork.digest, initial: { request: initial.request, plan: initial.plan } };
+        }
+        const baseline = (0, data_1.strictData)({ ...origin, target: request.target, chainId, selection: selection.digest, currentImplementation: currentImplementation.toLowerCase(), implementationKey: prior.selection.version.linkedWithoutMetadata, oldLayout: prior.selection.layout, prior: this.priorQualification(prior) });
+        if (!this.#baselines.some(b => (0, canonicalData_1.semanticHash)(b) === (0, canonicalData_1.semanticHash)(baseline)))
+            this.#baselines.push(baseline);
+    }
+    hasSameForkInitial(initial) {
+        this.assertRegistry();
+        return this.#initialPreparations.has((0, canonicalData_1.semanticHash)({ request: initial.request, plan: initial.plan }));
+    }
+    async verifySameForkUpgrade(target, proxy, sourceBlock) {
+        this.assertRegistry();
+        if (!Number.isSafeInteger(sourceBlock) || sourceBlock < 0)
+            throw new Error('Same-fork baseline requires a pinned source block');
+        const chainId = String(BigInt(await this.#provider.send('eth_chainId')));
+        const currentImplementation = await (0, upgrades_core_1.getImplementationAddress)(this.#provider, proxy);
+        const matches = [...this.#initialPreparations.values()].filter(p => (0, same_fork_baseline_1.matchesSameForkInitial)(p, target, chainId, proxy, currentImplementation));
+        if (matches.length !== 1)
+            throw new Error('Same-fork baseline requires one owned initial preparation');
+        const [sourceCode, proxyCode, implementationCode] = await Promise.all([
+            this.#provider.send('eth_getCode', [proxy, `0x${sourceBlock.toString(16)}`]),
+            this.#provider.send('eth_getCode', [proxy, 'latest']),
+            this.#provider.send('eth_getCode', [currentImplementation, 'latest']),
+        ]);
+        if (sourceCode !== '0x' || proxyCode === '0x' || implementationCode === '0x')
+            throw new Error('Same-fork baseline requires source absence and actual local deployment');
+        this.assertRegistry();
+        this.#observedInitials.add(matches[0]);
+    }
+    sameForkBaseline = async (input) => {
+        this.assertRegistry();
+        const matches = [...this.#initialPreparations.values()].filter(p => this.#observedInitials.has(p) && (0, same_fork_baseline_1.matchesSameForkInitial)(p, input.request.target, String(input.chainId), input.request.proxy, input.currentImplementation, input.request.proxyKind));
+        if (!matches.length)
+            return undefined;
+        if (matches.length !== 1)
+            throw new Error('Ambiguous same-fork initial preparation');
+        const actual = await (0, upgrades_core_1.getImplementationAddress)(this.#provider, input.request.proxy);
+        const chainId = Number(BigInt(await this.#provider.send('eth_chainId')));
+        if (actual.toLowerCase() !== input.currentImplementation.toLowerCase() || chainId !== input.chainId)
+            throw new Error('Same-fork provider identity mismatch');
+        const initial = matches[0], oldLayoutHash = (0, compiler_files_1.sha256)((0, workflow_1.canonicalPreparationJson)(initial.selection.layout));
+        const proof = (0, canonicalData_1.deepFreeze)({ kind: 'same-fork', oldLayout: initial.selection.layout, digest: (0, same_fork_baseline_1.sameForkBaselineDigest)(initial, oldLayoutHash) });
+        this.#sameForkProofs.set(proof, initial);
+        this.assertRegistry();
+        return proof;
+    };
+    // Full synchronous qualification may outlast HTTP keepalive. Process queued I/O
+    // before callers resume RPCs, including recovery after a validation rejection.
+    deployData = async (input) => {
+        try {
+            const selection = this.observeDeployData(input.artifact, input.factory, input.data, input.options);
+            if (input.baseline)
+                this.captureBaseline(input.request, selection, input.baseline);
+            if (input.request.kind !== 'create2-deploy') {
+                const address = (0, ethers_1.getCreate2Address)(input.request.factory, input.request.implementationSalt, (0, ethers_1.keccak256)((0, ethers_1.concat)([input.factory.bytecode, input.data.encodedArgs])));
+                this.baseline(address, handles.get(this), selection);
+            }
+        }
+        finally {
+            await (0, compiler_io_1.yieldCompilerIo)();
+        }
+    };
+    preparationSelection(request, plan) {
+        const options = persistedOZ((0, options_1.withDefaults)({ kind: request.proxyKind, constructorArgs: request.constructorArgs, ...(request.unsafeAllow ? { unsafeAllow: request.unsafeAllow } : {}) }));
+        const matches = [...this.#selections.values()].filter(s => s.fqn === `${plan.artifact.sourceName}:${plan.artifact.contractName}` && (0, canonicalData_1.semanticHash)(s.options) === (0, canonicalData_1.semanticHash)(options));
+        if (matches.length !== 1)
+            throw new Error('Preparation reuse requires one prior owned qualified OZ selection');
+        return matches[0];
+    }
+    /** Awaited read-only replay observation. No compile, preparation or DeployData invocation. */
+    async observePreparationPlan(request, plan) {
+        try {
+            this.assertRegistry();
+            if ((request.kind === 'uups-upgrade' || request.kind === 'transparent-upgrade') && (plan.validation.kind === 'uups-upgrade' || plan.validation.kind === 'transparent-upgrade')) {
+                const selected = this.preparationSelection(request, plan);
+                const chainId = Number(BigInt(await this.#provider.send('eth_chainId')));
+                if (!Number.isSafeInteger(chainId) || chainId <= 0 || String(chainId) !== plan.chainId)
+                    throw new Error('Preparation baseline chain mismatch');
+                const currentImplementation = await (0, upgrades_core_1.getImplementationAddress)(this.#provider, request.proxy);
+                if (currentImplementation.toLowerCase() !== plan.validation.currentImplementation.toLowerCase())
+                    throw new Error('Preparation baseline current implementation mismatch');
+                if (plan.validation.sameForkBaselineDigest !== undefined) {
+                    const sameFork = await this.sameForkBaseline({ request: (0, workflow_1.normalizePreparationRequest)(request), currentImplementation, chainId });
+                    if (!sameFork || sameFork.digest !== plan.validation.sameForkBaselineDigest)
+                        throw new Error('Preparation same-fork baseline digest mismatch');
+                    this.captureBaseline(request, selected, { sameFork, currentImplementation, chainId });
+                }
+                else {
+                    const state = readRegisteredTargetUpgradeState({ root: this.hre.config.paths.root, target: request.target, chainId, proxy: request.proxy, currentImplementation, proxyKind: request.proxyKind });
+                    if (state.digest !== plan.validation.manifestDigest)
+                        throw new Error('Preparation baseline manifest digest mismatch');
+                    this.assertRegistry();
+                    this.captureBaseline(request, selected, { state, currentImplementation, chainId });
+                }
+            }
+            this.preparationPlan(request, plan);
+            if (request.kind === 'uups-placeholder-deploy' || request.kind === 'transparent-deploy') {
+                await (0, preparation_1.validatePreparationSemantics)(request, plan, name => this.hre.artifacts.readArtifact(name));
+                const selection = this.preparationSelection(request, plan);
+                const initial = (0, canonicalData_1.deepFreeze)({ request: (0, workflow_1.normalizePreparationRequest)(request), plan: (0, data_1.strictData)(plan), selection });
+                this.#initialPreparations.set((0, canonicalData_1.semanticHash)({ request: initial.request, plan: initial.plan }), initial);
+                this.baseline(plan.deployments.find(d => d.role === 'implementation').address, handles.get(this), selection);
+            }
+        }
+        finally {
+            await (0, compiler_io_1.yieldCompilerIo)();
+        }
+    }
+    /** Pure expected/disk/reuse check over complete owned baseline observations. */
+    preparationPlan(request, plan) {
+        this.assertRegistry();
+        if (request.kind === 'create2-deploy')
+            return;
+        const selected = this.preparationSelection(request, plan);
+        if (plan.validation.kind === 'uups-upgrade' || plan.validation.kind === 'transparent-upgrade') {
+            if ((request.kind !== 'uups-upgrade' && request.kind !== 'transparent-upgrade'))
+                throw new Error('Preparation baseline request mismatch');
+            if ((0, compiler_files_1.sha256)((0, workflow_1.canonicalPreparationJson)(selected.layout)) !== plan.validation.newLayoutHash)
+                throw new Error('Preparation selected new layout mismatch');
+            const validation = plan.validation;
+            const matches = this.#baselines.filter(b => b.target === request.target && String(b.chainId) === plan.chainId && b.proxy.address.toLowerCase() === request.proxy.toLowerCase() && b.proxy.kind === request.proxyKind
+                && b.currentImplementation === validation.currentImplementation.toLowerCase() && b.selection === selected.digest
+                && (b.kind === 'target-manifest' ? validation.sameForkBaselineDigest === undefined && b.manifestDigest === validation.manifestDigest
+                    : validation.manifestDigest === undefined && b.sameForkBaselineDigest === validation.sameForkBaselineDigest));
+            if (matches.length !== 1 || (0, compiler_files_1.sha256)((0, workflow_1.canonicalPreparationJson)(matches[0].oldLayout)) !== validation.oldLayoutHash)
+                throw new Error('Preparation requires exact qualified historical baseline observation');
+            (0, upgrades_core_1.assertStorageUpgradeSafe)(matches[0].oldLayout, selected.layout, selected.options);
+        }
+    }
+    evidence() {
+        this.assertRegistry();
+        this.#files.verify();
+        const body = { version: 1, adapter: ADAPTER,
+            toolchain: { node: process.versions.node, platform: process.platform, arch: process.arch, abi: process.versions.modules, packages: [...this.#files.packages.values()].sort((a, b) => a.lockLocation.localeCompare(b.lockLocation, 'en')), resolutions: [...this.#files.resolutions].sort((a, b) => (0, canonicalData_1.semanticHash)(a).localeCompare((0, canonicalData_1.semanticHash)(b))), modules: [...this.#files.modules].sort(([a], [b]) => a.localeCompare(b, 'en')).map(([path, digest]) => ({ path, digest })) },
+            jobs: [...this.#jobs].sort((a, b) => a.id.localeCompare(b.id)), builds: [...this.#builds.values()].sort((a, b) => a.digest.localeCompare(b.digest)), artifacts: [...this.#artifacts.values()].sort((a, b) => a.fqn.localeCompare(b.fqn)), selections: [...this.#selections.values()].sort((a, b) => a.digest.localeCompare(b.digest)), baselines: [...this.#baselines] };
+        return (0, canonicalData_1.deepFreeze)({ ...body, stableDigest: (0, canonicalData_1.semanticHash)(stable(body)), exactDigest: (0, canonicalData_1.semanticHash)(body) });
+    }
+}
+async function qualifyDeliveryCompiler(hre, options = {}) {
+    try {
+        if (Object.keys(options).some(k => k !== 'compiler') || (options.compiler && (Object.keys(options.compiler).sort().join() !== 'kind,path' || !['npm-soljson-0.8.28', 'native-macos-0.8.28'].includes(options.compiler.kind) || !node_path_1.default.isAbsolute(options.compiler.path))))
+            throw new Error('Unsupported owned compiler adapter options');
+        if (collectors.has(hre.artifacts))
+            throw new Error('Compiler qualification already exists for this HRE');
+        const collector = new CompilerSession(hre, (0, data_1.strictData)(options));
+        collectors.set(hre.artifacts, collector);
+        await collector.compile();
+        const handle = Object.freeze({ artifact: collector.artifact.bind(collector), implementation: collector.implementation.bind(collector), baseline: collector.baseline.bind(collector), evidence: collector.evidence.bind(collector), preparationPlan: collector.preparationPlan.bind(collector) });
+        owned.set(handle, collector);
+        handles.set(collector, handle);
+        return handle;
+    }
+    finally {
+        await (0, compiler_io_1.yieldCompilerIo)();
+    }
+}
+function ownedDeliveryCompiler(hre) {
+    const collector = collectors.get(hre.artifacts);
+    return collector?.hre === hre ? handles.get(collector) : undefined;
+}
+/** Internal adapter port, intentionally absent from the public opaque handle. */
+function compilerPreparationHooks(hre) {
+    const c = collectors.get(hre.artifacts);
+    return c?.hre === hre && handles.has(c) ? Object.freeze({ deployData: c.deployData, sameForkBaseline: c.sameForkBaseline }) : Object.freeze({});
+}
+function hasCompilerSameForkInitial(hre, initial) {
+    const c = collectors.get(hre.artifacts);
+    return c?.hre === hre && handles.has(c) && c.hasSameForkInitial(initial);
+}
+async function verifyCompilerSameForkUpgrade(hre, target, proxy, sourceBlock) {
+    const c = collectors.get(hre.artifacts);
+    if (c?.hre !== hre || !handles.has(c))
+        throw new Error('Same-fork upgrade requires an owned compiler collector');
+    await c.verifySameForkUpgrade(target, proxy, sourceBlock);
+}
+async function validateCompilerPreparationPlan(hre, request, plan) {
+    const c = collectors.get(hre.artifacts);
+    if (c?.hre === hre && handles.has(c))
+        await c.observePreparationPlan(request, plan);
+}
+function parseCompilerEvidence(raw) {
+    const e = (0, data_1.strictData)(raw);
+    const shape = (x, keys, label) => {
+        if (!x || typeof x !== 'object' || Array.isArray(x) || Object.keys(x).sort().join() !== keys.split(' ').sort().join())
+            throw new Error(`Invalid compiler ${label} shape`);
+    };
+    const digest = (x) => { if (typeof x !== 'string' || !/^[a-f0-9]{64}$/.test(x))
+        throw new Error('Invalid compiler digest'); };
+    const portable = (x) => { if (typeof x !== 'string' || !x || x.startsWith('/') || x.includes('\\') || x.split('/').some(p => !p || p === '.' || p === '..'))
+        throw new Error('Invalid portable compiler path'); };
+    if (Object.keys(e).sort().join() !== ['version', 'adapter', 'toolchain', 'jobs', 'builds', 'artifacts', 'selections', 'baselines', 'stableDigest', 'exactDigest'].sort().join() || e.version !== 1 || e.adapter !== ADAPTER || !Array.isArray(e.jobs) || !e.jobs.length || !Array.isArray(e.builds) || !Array.isArray(e.artifacts) || !Array.isArray(e.selections) || !Array.isArray(e.baselines))
+        throw new Error('Invalid compiler evidence shape');
+    const { stableDigest, exactDigest, ...body } = e;
+    if ((0, canonicalData_1.semanticHash)(body) !== exactDigest || (0, canonicalData_1.semanticHash)(stable(body)) !== stableDigest)
+        throw new Error('Compiler evidence digest mismatch');
+    const jobs = new Map();
+    shape(e.toolchain, 'node platform arch abi packages resolutions modules', 'toolchain');
+    if (!Array.isArray(e.toolchain.packages) || !Array.isArray(e.toolchain.resolutions) || !Array.isArray(e.toolchain.modules) || typeof e.toolchain.node !== 'string' || e.toolchain.platform !== 'darwin' || !['x64', 'arm64'].includes(e.toolchain.arch) || typeof e.toolchain.abi !== 'string')
+        throw new Error('Invalid compiler toolchain');
+    const packages = new Map();
+    for (const p of e.toolchain.packages) {
+        shape(p, 'lockLocation name version integrity source payload payloadDigest', 'package');
+        portable(p.lockLocation);
+        digest(p.payloadDigest);
+        shape(p.source, 'kind identity', 'package source');
+        if (!p.lockLocation.startsWith('node_modules/') || packages.has(p.lockLocation) || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(p.integrity) || !['registry', 'tarball'].includes(p.source.kind) || p.source.identity !== p.integrity || !Array.isArray(p.payload))
+            throw new Error('Invalid compiler package provenance');
+        const seen = new Set();
+        for (const f of p.payload) {
+            shape(f, 'path digest', 'payload');
+            portable(f.path);
+            digest(f.digest);
+            if (seen.has(f.path))
+                throw new Error('Duplicate compiler package file');
+            seen.add(f.path);
+        }
+        const sorted = [...p.payload].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+        equal(p.payload, sorted, 'Compiler package ordering');
+        if ((0, compiler_files_1.sha256)(p.payload.map(f => `${f.path}\0${f.digest}\n`).join('')) !== p.payloadDigest)
+            throw new Error('Compiler package payload digest mismatch');
+        const pin = compiler_pins_2.compilerPackagePins[p.name];
+        const dependency = compiler_dependency_pins_1.compilerDependencyPins[`${p.name}@${p.version}`];
+        if (pin && (p.version !== pin.version || p.integrity !== pin.integrity || p.payloadDigest !== pin.payloadDigest))
+            throw new Error('Unapproved compiler package evidence');
+        if (dependency && (p.integrity !== dependency.integrity || p.payloadDigest !== dependency.payloadDigest))
+            throw new Error('Unapproved compiler dependency evidence');
+        packages.set(p.lockLocation, p);
+    }
+    for (const edge of e.toolchain.resolutions) {
+        shape(edge, 'issuer specifier path mode', 'resolution');
+        portable(edge.issuer);
+        portable(edge.path);
+        if (!['cjs', 'esm-node'].includes(edge.mode) || typeof edge.specifier !== 'string' || ![...packages.values()].some(p => edge.path.startsWith(p.lockLocation + '/') && p.payload.some(f => edge.path === `${p.lockLocation}/${f.path}`)))
+            throw new Error('Compiler resolution lacks package payload');
+    }
+    const modules = new Set();
+    for (const module of e.toolchain.modules) {
+        shape(module, 'path digest', 'module');
+        portable(module.path);
+        digest(module.digest);
+        if (modules.has(module.path) || ![...packages.values()].some(p => p.payload.some(f => `${p.lockLocation}/${f.path}` === module.path && f.digest === module.digest)))
+            throw new Error('Compiler runtime module payload mismatch');
+        modules.add(module.path);
+    }
+    for (const job of e.jobs) {
+        shape(job, 'id config sources runs validation', 'job');
+        digest(job.id);
+        if (!Array.isArray(job.runs) || job.runs.length !== 2 || !Array.isArray(job.sources))
+            throw new Error('Invalid main/auxiliary pair');
+        if (jobs.has(job.id) || jobIdentity(job) !== job.id)
+            throw new Error('Compiler job identity mismatch');
+        for (const run of job.runs) {
+            shape(run, 'input output compiler inputDigest outputDigest', 'invocation');
+            shape(run.compiler, 'kind version longVersion digest source', 'binary');
+            const js = run.compiler.kind === 'npm-soljson-0.8.28';
+            if (!['npm-soljson-0.8.28', 'native-macos-0.8.28'].includes(run.compiler.kind) || run.compiler.version !== '0.8.28' || run.compiler.longVersion !== LONG_VERSION || run.compiler.digest !== (js ? JS_HASH : NATIVE_HASH) || run.compiler.source !== (js ? JS_SOURCE : NATIVE_SOURCE))
+                throw new Error('Unapproved compiler evidence');
+            if ((0, canonicalData_1.semanticHash)(run.input) !== run.inputDigest || (0, canonicalData_1.semanticHash)(run.output) !== run.outputDigest)
+                throw new Error('Compiler invocation digest mismatch');
+        }
+        equal(job.runs[0].compiler, job.runs[1].compiler, 'Main/auxiliary compiler');
+        equal(Object.keys(job.runs[0].input.sources).sort(), Object.keys(job.runs[1].input.sources).sort(), 'Auxiliary source set');
+        equal(Object.keys(job.runs[0].input.sources).sort(), job.sources.map(s => s.sourceName).sort(), 'Original physical source set');
+        if (job.config.version !== job.runs[0].compiler.version)
+            throw new Error('Compiler config/version mismatch');
+        equal(job.config.settings, job.runs[0].input.settings, 'Complete original compiler settings');
+        for (const source of job.sources) {
+            shape(source, 'sourceName path digest package dependencies emitsArtifact', 'source');
+            portable(source.sourceName);
+            portable(source.path);
+            digest(source.digest);
+            if ((0, compiler_files_1.sha256)(job.runs[0].input.sources[source.sourceName].content) !== source.digest || typeof source.emitsArtifact !== 'boolean' || !Array.isArray(source.dependencies) || source.dependencies.some(d => !job.sources.some(s => s.sourceName === d)))
+                throw new Error('Compiler source/graph mismatch');
+            if (source.package !== null && !packages.get(source.package)?.payload.some(f => `${source.package}/${f.path}` === source.path && f.digest === source.digest))
+                throw new Error('Compiler source package mismatch');
+            if (source.package === null && source.sourceName !== source.path)
+                throw new Error('Unsupported virtual compiler source');
+        }
+        equal(validationFor(job), job.validation, 'Compiler validation evidence');
+        jobs.set(job.id, job);
+    }
+    const builds = new Map();
+    for (const b of e.builds) {
+        shape(b, 'path contents digest job', 'build-info');
+        portable(b.path);
+        digest(b.digest);
+        if (typeof b.contents !== 'string' || (0, compiler_files_1.sha256)(b.contents) !== b.digest || builds.has(b.digest) || !jobs.has(b.job))
+            throw new Error('Invalid persisted build-info identity');
+        const info = (0, data_1.strictData)(JSON.parse(b.contents));
+        shape(info, '_format id solcVersion solcLongVersion input output', 'persisted build-info');
+        const main = jobs.get(b.job).runs[0];
+        if (info._format !== 'hh-sol-build-info-1' || info.solcVersion !== main.compiler.version || info.solcLongVersion !== main.compiler.longVersion)
+            throw new Error('Persisted build-info compiler mismatch');
+        equal(info.input, main.input, 'Persisted build-info input');
+        equal(info.output, main.output, 'Persisted build-info output');
+        builds.set(b.digest, b);
+    }
+    const artifactNames = new Set();
+    for (const a of e.artifacts) {
+        shape(a, 'fqn job artifact digest path contents debugPath debugContents buildInfo', 'artifact');
+        portable(a.path);
+        portable(a.debugPath);
+        const j = jobs.get(a.job), [source, name] = a.fqn.split(':');
+        if (!j || artifactNames.has(a.fqn) || (0, canonicalData_1.semanticHash)(a.artifact) !== a.digest)
+            throw new Error('Invalid artifact compiler relation');
+        artifactNames.add(a.fqn);
+        equal(projection(source, name, j.runs[0].output.contracts[source][name]), a.artifact, 'Persisted artifact projection');
+        equal(JSON.parse(a.contents), a.artifact, 'Persisted artifact bytes');
+        const dbg = JSON.parse(a.debugContents), build = builds.get(a.buildInfo);
+        shape(dbg, '_format buildInfo', 'debug pointer');
+        if (dbg._format !== 'hh-sol-dbg-1' || typeof dbg.buildInfo !== 'string' || node_path_1.default.posix.isAbsolute(dbg.buildInfo) || !build || build.job !== a.job || node_path_1.default.posix.normalize(node_path_1.default.posix.join(node_path_1.default.posix.dirname(a.debugPath), dbg.buildInfo)) !== build.path || !build.path.includes('/build-info/'))
+            throw new Error('Persisted artifact debug/build-info relationship mismatch');
+    }
+    for (const s of e.selections) {
+        shape(s, 'fqn job artifactDigest unlinkedBytecode linkedBytecode encodedArgs version layout validation options digest', 'selection');
+        const { digest, ...selection } = s, job = jobs.get(s.job);
+        const entry = e.artifacts.find(a => a.digest === s.artifactDigest && a.fqn === s.fqn && a.job === s.job);
+        if ((0, canonicalData_1.semanticHash)(selection) !== digest || !job || !entry)
+            throw new Error('Invalid selected compiler relation');
+        assertFullOptions(s.options);
+        const identity = selectedIdentity(entry, job, s.linkedBytecode, s.options);
+        equal(identity.unlinkedBytecode, s.unlinkedBytecode, 'Persisted selected unlinked bytecode');
+        equal(identity.encodedArgs, s.encodedArgs, 'Persisted selected constructor encoding');
+        equal(identity.version, s.version, 'Persisted selected bytecode version');
+        equal(identity.validation, s.validation, 'Persisted selected validation');
+        equal(identity.layout, s.layout, 'Persisted selected effective layout');
+        (0, upgrades_core_1.assertUpgradeSafe)(identity.expected, identity.version, (0, data_1.strictData)(s.options));
+    }
+    for (const b of e.baselines) {
+        const common = 'kind target chainId manifestPolicy selection proxy currentImplementation implementationKey oldLayout prior';
+        if (b.kind === 'target-manifest') {
+            shape(b, common + ' manifestDigest implementationEntry', 'baseline');
+            digest(b.manifestDigest);
+        }
+        else if (b.kind === 'same-fork') {
+            shape(b, common + ' sameForkBaselineDigest initial', 'baseline');
+            shape(b.initial, 'request plan', 'same-fork initial preparation');
+            digest(b.sameForkBaselineDigest);
+        }
+        else
+            throw new Error('Invalid compiler baseline kind');
+        const selected = e.selections.find(s => s.digest === b.selection);
+        if (!selected)
+            throw new Error('Historical baseline replacement selection missing');
+        shape(b.prior, 'stableDigest exactDigest selection qualification', 'baseline qualification');
+        const prior = parseCompilerEvidence(b.prior.qualification);
+        if (prior.baselines.length || prior.selections.length !== 1 || prior.stableDigest !== b.prior.stableDigest || prior.exactDigest !== b.prior.exactDigest || prior.selections[0].digest !== b.prior.selection || prior.selections[0].version.linkedWithoutMetadata !== b.implementationKey)
+            throw new Error('Historical compiler baseline relation mismatch');
+        equal(b.oldLayout, prior.selections[0].layout, 'Historical qualified layout');
+        (0, upgrades_core_1.assertStorageUpgradeSafe)(b.oldLayout, selected.layout, selected.options);
+        if (selected.options.kind !== b.proxy.kind || prior.selections[0].options.kind !== b.proxy.kind || !['uups', 'transparent'].includes(b.proxy.kind) || !Number.isSafeInteger(b.chainId) || b.chainId <= 0)
+            throw new Error('Historical baseline identity mismatch');
+        if (b.kind === 'target-manifest') {
+            equal(b.oldLayout, b.implementationEntry.layout, 'Historical manifest layout');
+            if (![b.implementationEntry.address, ...(b.implementationEntry.allAddresses ?? [])].some(a => typeof a === 'string' && a.toLowerCase() === b.currentImplementation))
+                throw new Error('Historical manifest identity mismatch');
+        }
+        else {
+            const initial = b.initial, selection = prior.selections[0];
+            const layoutHash = (0, compiler_files_1.sha256)((0, workflow_1.canonicalPreparationJson)(b.oldLayout));
+            if (!(0, same_fork_baseline_1.matchesSameForkInitial)(initial, b.target, String(b.chainId), b.proxy.address, b.currentImplementation, b.proxy.kind)
+                || (0, same_fork_baseline_1.sameForkBaselineDigest)(initial, layoutHash) !== b.sameForkBaselineDigest || (initial.request.kind !== 'uups-placeholder-deploy' && initial.request.kind !== 'transparent-deploy'))
+                throw new Error('Same-fork initial preparation relation mismatch');
+            const artifact = prior.artifacts.find(a => a.digest === selection.artifactDigest).artifact;
+            equal((0, workflow_1.artifactIdentity)(artifact, 'evm'), initial.plan.artifact, 'Same-fork prior artifact');
+            const encodedArgs = new ethers_1.ContractFactory(artifact.abi, artifact.bytecode).interface.encodeDeploy(initial.request.constructorArgs);
+            if (encodedArgs !== selection.encodedArgs || (0, ethers_1.getCreate2Address)(initial.request.factory, initial.request.implementationSalt, (0, ethers_1.keccak256)((0, ethers_1.concat)([selection.linkedBytecode, encodedArgs]))).toLowerCase() !== b.currentImplementation)
+                throw new Error('Same-fork prior constructor/implementation mismatch');
+            equal(persistedOZ((0, options_1.withDefaults)({ kind: initial.request.proxyKind, constructorArgs: initial.request.constructorArgs, ...(initial.request.unsafeAllow ? { unsafeAllow: initial.request.unsafeAllow } : {}) })), selection.options, 'Same-fork prior options');
+        }
+    }
+    return (0, canonicalData_1.deepFreeze)(e);
+}
+//# sourceMappingURL=compiler.js.map