gate-evm-tools 1.0.31 → 1.2.1

package/runtime/vendor/plan-codec/index.cjs

@@ -28,8 +28,11 @@ __export(read_only_exports, {
   SCHEMA_V1: () => SCHEMA_V1,
   SKILL_NAME: () => SKILL_NAME,
   TASK_STATUSES: () => TASK_STATUSES,
+  deploymentPurpose: () => deploymentPurpose,
+  deploymentRequirementIssue: () => deploymentRequirementIssue,
   detectSchema: () => detectSchema,
   parsePlan: () => parsePlan,
+  productionActionAllowed: () => productionActionAllowed,
   projectDefinitions: () => projectDefinitions,
   skillNames: () => skillNames,
   toolRefs: () => toolRefs,
@@ -39,7 +42,7 @@ module.exports = __toCommonJS(read_only_exports);
 
 // builtin-skills/gateflow-plan/scripts/lib/evm-contract.mjs
 var PROJECT_FIELDS = ["chainFamily", "framework", "projectRoot", "templateProfile", "templateVersion", "mode"];
-var DEPLOYMENT_FIELDS = ["chainFamily", "framework", "projectRoot", "deploymentId", "specPath", "sourceCodeRef", "requiredOperations", "developmentNetwork", "releaseTargetNetworks", "environment", "targetNetwork", "allowedActions", "releaseRef"];
+var DEPLOYMENT_FIELDS = ["purpose", "chainFamily", "framework", "projectRoot", "deploymentId", "specPath", "sourceCodeRef", "requiredOperations", "developmentNetwork", "releaseTargetNetworks", "environment", "targetNetwork", "allowedActions", "releaseRef", "requirementRef", "productionRequirementRef", "referenceDeploymentId"];
 var ANALYSIS_STEPS = ["deployment-request", "deployment-plan", "script"];
 var STEP_ACTIONS = {
   deploy: ["simulate", "execute", "reconcile", "verify"],
@@ -49,11 +52,53 @@ var STEP_ACTIONS = {
   "release-execute": ["execute", "export-calldata", "reconcile"],
   "release-verify": ["verify"]
 };
+var PURPOSE_ACTIONS = {
+  "dev-execution": ["simulate", "execute", "reconcile", "verify"],
+  "prod-qualification": ["simulate", "verify"],
+  "prod-execution": ["simulate", "execute", "export-calldata", "reconcile", "verify"]
+};
+function deploymentPurpose(task) {
+  const explicit = task.scope?.deployment?.purpose;
+  if (explicit !== void 0) return explicit;
+  if (ANALYSIS_STEPS.includes(task.step)) return "analysis";
+  if (["deploy", "check-code"].includes(task.step)) return "dev-execution";
+  if (task.step === "deploy-test") return "prod-qualification";
+  if (["release-prepare", "release-execute", "release-verify"].includes(task.step)) return "prod-execution";
+  return void 0;
+}
+function productionActionAllowed(task, intent) {
+  const d = task.scope?.deployment;
+  const action = intent === "prepare" ? "simulate" : intent;
+  return deploymentPurpose(task) === "prod-execution" && d?.environment === "prod" && !!d.releaseRef && Array.isArray(d.allowedActions) && d.allowedActions.includes(action);
+}
 var OPERATIONS = ["deploy", "upgrade", "call", "view", "check", "custom"];
 var isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function deploymentRequirementIssue(plan, task) {
+  const d = task.scope?.deployment;
+  if (!d || deploymentPurpose(task) === "analysis") return null;
+  const ref = d.requirementRef;
+  if (!ref) return "部署实施前必须引用本轮已确认的需求（requirementRef）";
+  const request = Object.values(plan.tasks).flat().find((t) => t.planKey === ref.planKey);
+  if (!request || request.status === "cancelled" || deploymentPurpose(request) !== "analysis" || request.scope?.deployment?.projectRoot !== d.projectRoot || request.rev !== ref.rev || request.requirementConfirmation?.rev !== ref.rev) return "本轮部署需求尚未确认或确认修订已失效";
+  const r = request.scope.deployment;
+  if (d.productionRequirementRef !== void 0) {
+    if (!["prod-qualification", "prod-execution"].includes(deploymentPurpose(task))) return "生产补充确认只用于 prod 资格或执行任务";
+    const extra = d.productionRequirementRef;
+    const production = Object.values(plan.tasks).flat().find((t) => t.planKey === extra.planKey);
+    const p = production?.scope?.deployment;
+    if (!production || production.status === "cancelled" || deploymentPurpose(production) !== "analysis" || production.rev !== extra.rev || production.requirementConfirmation?.rev !== extra.rev || p?.projectRoot !== d.projectRoot || p?.deploymentId !== d.deploymentId || JSON.stringify(p.requirementRef) !== JSON.stringify(ref)) return "本轮生产补充需求尚未确认或绑定已失效";
+    if (!task.dependsOn.includes(production.planKey)) return "生产任务必须依赖其补充需求确认任务";
+    if (p.developmentNetwork !== r.developmentNetwork || d.developmentNetwork !== r.developmentNetwork || p.sourceCodeRef !== d.sourceCodeRef || JSON.stringify(p.releaseTargetNetworks) !== JSON.stringify(d.releaseTargetNetworks) || !d.requiredOperations?.every((operation) => p.requiredOperations?.includes(operation) && r.requiredOperations?.includes(operation))) return "生产补充需求只能扩充 prod 网络与参数，不能改变原部署动作或源码";
+    return null;
+  }
+  if (r.developmentNetwork !== d.developmentNetwork || JSON.stringify(r.releaseTargetNetworks) !== JSON.stringify(d.releaseTargetNetworks) || !d.requiredOperations?.every((operation) => r.requiredOperations?.includes(operation))) return "部署动作或网络超出本轮确认范围";
+  return null;
+}
 function validateEvmContracts(plan, fail3) {
   const releases = /* @__PURE__ */ new Map();
   const projects = /* @__PURE__ */ new Map();
+  const requirementRounds = /* @__PURE__ */ new Map();
+  const roundRequirements = /* @__PURE__ */ new Map();
   const object = (value, where, fields) => {
     if (!isObject(value)) fail3(`${where} 必须是对象`);
     for (const field of Object.keys(value)) if (!fields.includes(field)) fail3(`${where}.${field} 是未知字段`);
@@ -101,7 +146,7 @@ function validateEvmContracts(plan, fail3) {
       if (explicitEvmProject || evmProject && (project !== void 0 || task.step === "project-setup")) {
         const p = object(project, `${where}.project`, PROJECT_FIELDS);
         identity(p, `${where}.project`);
-        if (p.templateProfile !== "core") fail3(`${where}.project.templateProfile 必须是 core`);
+        if (p.templateProfile !== "full") fail3(`${where}.project.templateProfile 必须是 full`);
         if (p.templateVersion !== 1) fail3(`${where}.project.templateVersion 必须是 1`);
         if (!["create", "resume"].includes(p.mode)) fail3(`${where}.project.mode 必须是 create 或 resume`);
         const metadata2 = JSON.stringify([p.chainFamily, p.framework, p.templateProfile, p.templateVersion]);
@@ -113,29 +158,38 @@ function validateEvmContracts(plan, fail3) {
       const w = `${where}.deployment`;
       const d = object(task.scope?.deployment, w, DEPLOYMENT_FIELDS);
       identity(d, w);
-      identifier(d.deploymentId, `${w}.deploymentId`);
-      relativePath(d.specPath, `${w}.specPath`);
-      if (task.step !== "deployment-request" || d.sourceCodeRef !== void 0) text(d.sourceCodeRef, `${w}.sourceCodeRef`);
-      if (task.step !== "deployment-request" || d.requiredOperations !== void 0) strings(d.requiredOperations, `${w}.requiredOperations`, OPERATIONS, 1);
-      identifier(d.developmentNetwork, `${w}.developmentNetwork`, true);
-      strings(d.releaseTargetNetworks, `${w}.releaseTargetNetworks`);
-      for (const network of d.releaseTargetNetworks) identifier(network, `${w}.releaseTargetNetworks`, true);
-      if (ANALYSIS_STEPS.includes(task.step)) {
+      const initialAnalysis = d.purpose === "analysis" || d.purpose === void 0 && task.step === "deployment-request";
+      if (!initialAnalysis || d.deploymentId !== void 0) identifier(d.deploymentId, `${w}.deploymentId`);
+      if (!initialAnalysis || d.specPath !== void 0) relativePath(d.specPath, `${w}.specPath`);
+      if (!initialAnalysis || d.sourceCodeRef !== void 0) text(d.sourceCodeRef, `${w}.sourceCodeRef`);
+      if (!initialAnalysis || d.requiredOperations !== void 0) strings(d.requiredOperations, `${w}.requiredOperations`, OPERATIONS, 1);
+      if (!initialAnalysis || d.developmentNetwork !== void 0) identifier(d.developmentNetwork, `${w}.developmentNetwork`, true);
+      if (!initialAnalysis || d.releaseTargetNetworks !== void 0) strings(d.releaseTargetNetworks, `${w}.releaseTargetNetworks`);
+      for (const network of d.releaseTargetNetworks ?? []) identifier(network, `${w}.releaseTargetNetworks`, true);
+      if (d.referenceDeploymentId !== void 0) identifier(d.referenceDeploymentId, `${w}.referenceDeploymentId`);
+      for (const field of ["requirementRef", "productionRequirementRef"]) if (d[field] !== void 0) {
+        const ref2 = object(d[field], `${w}.${field}`, ["planKey", "rev"]);
+        identifier(ref2.planKey, `${w}.${field}.planKey`);
+        if (!Number.isSafeInteger(ref2.rev) || ref2.rev < 1) fail3(`${w}.${field}.rev 必须是正整数`);
+      }
+      const purpose = deploymentPurpose(task);
+      if (d.productionRequirementRef !== void 0 && !["prod-qualification", "prod-execution"].includes(purpose)) fail3(`${w}.productionRequirementRef 只用于 prod 任务`);
+      if (!["analysis", ...Object.keys(PURPOSE_ACTIONS)].includes(purpose)) fail3(`${w} 不支持步骤 ${task.step}；purpose 必须明确部署用途`);
+      if (purpose === "analysis") {
         for (const field of ["environment", "targetNetwork", "allowedActions", "releaseRef"]) {
           if (d[field] !== void 0) fail3(`${w}.${field} 只能用于执行任务`);
         }
         continue;
       }
-      const actions = STEP_ACTIONS[task.step];
-      if (!Object.hasOwn(STEP_ACTIONS, task.step ?? "")) fail3(`${w} 不支持步骤 ${task.step}`);
-      const environment = ["deploy", "check-code"].includes(task.step) ? "dev" : "prod";
+      const actions = d.purpose === void 0 ? STEP_ACTIONS[task.step] : PURPOSE_ACTIONS[purpose];
+      const environment = purpose === "dev-execution" ? "dev" : "prod";
       if (d.environment !== environment) fail3(`${w}.environment 在 ${task.step} 中必须是 ${environment}`);
       identifier(d.targetNetwork, `${w}.targetNetwork`, true);
       if (environment === "dev" ? d.targetNetwork !== d.developmentNetwork : !d.releaseTargetNetworks.includes(d.targetNetwork)) {
         fail3(`${w}.targetNetwork 与已声明的 ${environment} 网络不一致`);
       }
       strings(d.allowedActions, `${w}.allowedActions`, actions, 1);
-      if (!task.step.startsWith("release-")) {
+      if (purpose !== "prod-execution") {
         if (d.releaseRef !== void 0) fail3(`${w}.releaseRef 只用于正式发布任务`);
         continue;
       }
@@ -150,6 +204,18 @@ function validateEvmContracts(plan, fail3) {
       releases.set(releaseKey, metadata);
     }
   }
+  for (const task of Object.values(plan.tasks).flat()) {
+    const d = task.scope?.deployment;
+    if (!d?.requirementRef || deploymentPurpose(task) === "analysis") continue;
+    const requirement = JSON.stringify([d.projectRoot, d.requirementRef.planKey, d.requirementRef.rev]);
+    const round = JSON.stringify([d.projectRoot, d.deploymentId]);
+    const existingRound = requirementRounds.get(requirement);
+    if (existingRound !== void 0 && existingRound !== d.deploymentId) fail3(`任务 ${task.planKey}.scope.deployment 同一需求修订必须复用 deploymentId=${existingRound}，不能因脚本准备、模拟或执行阶段另建部署轮次`);
+    const existingRequirement = roundRequirements.get(round);
+    if (existingRequirement !== void 0 && existingRequirement !== requirement) fail3(`任务 ${task.planKey}.scope.deployment 同一 deploymentId 必须引用同一需求修订；新业务轮次使用新 deploymentId`);
+    requirementRounds.set(requirement, d.deploymentId);
+    roundRequirements.set(round, requirement);
+  }
 }
 
 // builtin-skills/gateflow-plan/scripts/lib/yaml-lite.mjs
@@ -386,8 +452,8 @@ var TASK_STATUSES = ["pending", "running", "blocked", "completed", "failed", "ca
 var FAILURE_CATEGORIES = ["execution_error", "acceptance_failed", "review_rejected", "input_missing"];
 var CONTRACT_FIELDS = ["objective", "acceptance", "dependsOn", "step", "scope", "parameters", "expectedArtifacts", "allowedChanges"];
 var TOOL_FIELDS = ["tools", "toolsOptional", "skills"];
-var DEF_FIELDS = [...CONTRACT_FIELDS, ...TOOL_FIELDS];
-var PROGRESS_FIELDS = ["status", "adoptedRev", "blockedReason", "cancelReason", "result", "previousResult"];
+var DEF_FIELDS = [...CONTRACT_FIELDS, ...TOOL_FIELDS, "executionNotes"];
+var PROGRESS_FIELDS = ["status", "adoptedRev", "blockedReason", "cancelReason", "result", "previousResult", "requirementConfirmation"];
 var TASK_ORDER = ["no", "planKey", "rev", "title", ...DEF_FIELDS, ...PROGRESS_FIELDS];
 var PlanError = class extends Error {
   constructor(message, code = "invalid") {
@@ -508,11 +574,11 @@ function parseResult(v, where) {
   }
   fail2(`${where}.kind 必须是 success 或 failure`);
 }
-var TOOL_REF = /^(?:plugin:[A-Za-z0-9][A-Za-z0-9._-]{0,99}|mcp:[A-Za-z0-9][A-Za-z0-9._-]{0,99}(?:\/[A-Za-z0-9][A-Za-z0-9._-]{0,99})?)$/;
+var TOOL_REF = /^(?:plugin:[A-Za-z0-9][A-Za-z0-9._-]{0,99}|mcp:[A-Za-z0-9][A-Za-z0-9._-]{0,99}(?:\/[A-Za-z0-9][A-Za-z0-9._-]{0,99})?|host:[A-Za-z0-9][A-Za-z0-9._-]{0,99})$/;
 function toolRefs(v, where) {
   const refs = strArray(v, where);
   refs.forEach((ref, i) => {
-    if (!TOOL_REF.test(ref)) fail2(`${where}[${i}] 不是有效的工具引用："${ref}"（plugin:<id> 或 mcp:<服务器>[/<工具>]）`);
+    if (!TOOL_REF.test(ref)) fail2(`${where}[${i}] 不是有效的工具引用："${ref}"（plugin:<id>、mcp:<服务器>[/<工具>] 或 host:<本机 Codex 的 MCP>）`);
   });
   if (new Set(refs).size !== refs.length) fail2(`${where} 有重复的工具`);
   return refs;
@@ -544,6 +610,7 @@ function parseTaskDef(raw, where) {
     t.parameters = raw.parameters;
   }
   if (raw.expectedArtifacts !== void 0) t.expectedArtifacts = strArray(raw.expectedArtifacts, `${where}.expectedArtifacts`);
+  if (raw.executionNotes !== void 0) t.executionNotes = strArray(raw.executionNotes, `${where}.executionNotes`);
   if (raw.allowedChanges !== void 0) t.allowedChanges = strArray(raw.allowedChanges, `${where}.allowedChanges`);
   if (raw.tools !== void 0) t.tools = toolRefs(raw.tools, `${where}.tools`);
   if (raw.toolsOptional !== void 0) t.toolsOptional = toolRefs(raw.toolsOptional, `${where}.toolsOptional`);
@@ -567,6 +634,12 @@ function parseTask(raw, where) {
   }
   if (raw.blockedReason !== void 0) t.blockedReason = str(raw.blockedReason, `${where}.blockedReason`);
   if (raw.cancelReason !== void 0) t.cancelReason = str(raw.cancelReason, `${where}.cancelReason`);
+  if (raw.requirementConfirmation !== void 0) {
+    const c = raw.requirementConfirmation;
+    if (!isObject2(c) || Object.keys(c).some((k) => !["rev", "confirmedAt"].includes(k))) fail2(`${where}.requirementConfirmation 无效`);
+    t.requirementConfirmation = { rev: posInt(c.rev, `${where}.requirementConfirmation.rev`), confirmedAt: str(c.confirmedAt, `${where}.requirementConfirmation.confirmedAt`) };
+    if (c.rev > t.rev || !Number.isFinite(Date.parse(c.confirmedAt))) fail2(`${where}.requirementConfirmation 修订或时间无效`);
+  }
   const result = parseResult(raw.result, `${where}.result`);
   if (result) t.result = result;
   const previous = parseResult(raw.previousResult, `${where}.previousResult`);
@@ -747,7 +820,6 @@ function parsePlan(text) {
 
 // builtin-skills/gateflow-plan/scripts/lib/read-only.mjs
 var DEFINITION_CONTRACT = "gateflow-plan/definition@1";
-var RELEASE_STEPS = /* @__PURE__ */ new Set(["release-prepare", "release-execute", "release-verify"]);
 function freeze(value) {
   if (value && typeof value === "object") {
     Object.values(value).forEach(freeze);
@@ -774,9 +846,11 @@ function projectDefinitions(text, selection) {
     if (selected.has(key2)) return;
     const entry = byKey.get(key2);
     if (!entry) throw new PlanError(`Definition root/dependency missing: ${key2}`);
-    if (selection.mode === "upstream" && RELEASE_STEPS.has(entry.task.step)) throw new PlanError(`Upstream definitions cannot include generated release task: ${key2}`);
+    if (selection.mode === "upstream" && deploymentPurpose(entry.task) === "prod-execution") throw new PlanError(`Upstream definitions cannot include generated release task: ${key2}`);
     selected.add(key2);
     entry.task.dependsOn.forEach(visit);
+    const requirement = entry.task.scope?.deployment?.requirementRef;
+    if (requirement) visit(requirement.planKey);
   };
   roots.forEach(visit);
   const entries = line.filter(({ task }) => selected.has(task.planKey));
@@ -811,8 +885,11 @@ function projectDefinitions(text, selection) {
   SCHEMA_V1,
   SKILL_NAME,
   TASK_STATUSES,
+  deploymentPurpose,
+  deploymentRequirementIssue,
   detectSchema,
   parsePlan,
+  productionActionAllowed,
   projectDefinitions,
   skillNames,
   toolRefs,

package/runtime/vendor/plan-codec/index.d.cts

@@ -11,6 +11,7 @@ export interface PlanTask {
   step?: string; scope?: Record<string, unknown>; parameters?: unknown[]; expectedArtifacts?: string[]; allowedChanges?: string[]
   tools?: string[]; toolsOptional?: string[]; skills?: string[]; status: typeof TASK_STATUSES[number]; adoptedRev?: number
   blockedReason?: string; cancelReason?: string; result?: Record<string, unknown>; previousResult?: Record<string, unknown>
+  requirementConfirmation?: { rev: number; confirmedAt: string }
 }
 export interface PlanLane { name: string; state: 'enabled' | 'disabled'; reason?: string; skill?: string; steps?: { id: string; name: string }[] }
 export interface Plan {
@@ -30,3 +31,8 @@ export function projectDefinitions(text: string, selection: DefinitionSelection)
 export function skillNames(value: unknown, where: string): string[]
 export function toolRefs(value: unknown, where: string): string[]
 export function validateEvmContracts(plan: { flow?: string; lanes: Record<string, { skill?: string }>; tasks: Record<string, { planKey: string; step?: string; scope?: Record<string, unknown> }[]> }, fail: (message: string) => never): void
+
+export type DeploymentPurpose = 'analysis' | 'dev-execution' | 'prod-qualification' | 'prod-execution'
+export function deploymentPurpose(task: {step?: string; scope?: Record<string, unknown>}): DeploymentPurpose | undefined
+export function productionActionAllowed(task: {step?: string; scope?: Record<string, unknown>}, intent: string): boolean
+export function deploymentRequirementIssue(plan: { tasks: Record<string, {planKey:string;rev:number;status:string;step?:string;scope?:Record<string,unknown>;requirementConfirmation?:{rev:number;confirmedAt:string}}[]> }, task: Pick<PlanTask, 'step' | 'scope' | 'dependsOn'>): string | null

package/runtime/vendor/plan-codec/provenance.json

@@ -4,21 +4,22 @@
   "version": 1,
   "schema": "gateflow-plan/v2",
   "definitionContract": "gateflow-plan/definition@1",
-  "sourceCommit": "9b175e7906ca6735aeca92b50ce7cf716d980f17",
+  "sourceCommit": "ee0f90991ca1a94c3f58c8893df16d0c8c41b230",
+  "sourceMode": "working-tree",
   "sources": {
-    "builtin-skills/gateflow-plan/scripts/lib/evm-contract.mjs": "f7498feb2baeeed5022ab4e88e87c2567c786e7839249f5143fd565a5800bb13",
-    "builtin-skills/gateflow-plan/scripts/lib/handoff-v2.mjs": "185dc9fe11fd3d4bfb40a27175ddc27ed6f590d6427bf533d1f0d2aeda25d623",
-    "builtin-skills/gateflow-plan/scripts/lib/read-only.d.mts": "43cebba0e3d08ac5abb87cb34719e2d747aaa7cc8a6136eeccbc9f099758e490",
-    "builtin-skills/gateflow-plan/scripts/lib/read-only.mjs": "bb4b91d518fb9e12114ade0c251a3baba610516351a12fa5a9b501e93bb5f8ea",
+    "builtin-skills/gateflow-plan/scripts/lib/evm-contract.mjs": "c41dd9e6d630ea033001dd0922911bf365ff2baaa894107f6a80a3019eca1c17",
+    "builtin-skills/gateflow-plan/scripts/lib/handoff-v2.mjs": "05c89b794b65d6c73dc2427df8dc1b21f06c377c30f2c3baf8517459b8df56e0",
+    "builtin-skills/gateflow-plan/scripts/lib/read-only.d.mts": "716d1252adf79d5c7e6c3b7ed17984203ae3e1853695dc04fa9e769c9ac24c50",
+    "builtin-skills/gateflow-plan/scripts/lib/read-only.mjs": "1cb928d76ce14b07028efe002e624d91d36168494b5cc2cc0ba35153a311ff3e",
     "builtin-skills/gateflow-plan/scripts/lib/yaml-lite.mjs": "b53b8322b27bb73bbbf2a4254be4698ee43ec79c27828068954afd6d05902784",
-    "scripts/build-plan-codec.mjs": "d78243d5824bff60eb1a0d8cc5f86919bc9f585b9ece0824bf7e22c9653d874d"
+    "scripts/build-plan-codec.mjs": "048e647687da5a55a9f1899af510b9f1b0eb0872876e5eef278ede89c53c5d75"
   },
   "builder": {
     "name": "esbuild",
     "version": "0.21.5"
   },
   "artifacts": {
-    "index.cjs": "4c38b283bab25b7e906a961058bea87c7bcb0c103fefdace4cf46cb76c273adf",
-    "index.d.cts": "43cebba0e3d08ac5abb87cb34719e2d747aaa7cc8a6136eeccbc9f099758e490"
+    "index.cjs": "1014b59dad45b47510602791e426eaf2ee6d58720583670134fa14431b935d0d",
+    "index.d.cts": "716d1252adf79d5c7e6c3b7ed17984203ae3e1853695dc04fa9e769c9ac24c50"
   }
 }

package/runtime/workflow/lib/calls.ts

@@ -252,6 +252,7 @@ export const runContractWriteCalls = async (
         operation: 0,
         ...(zkSync ? { scheme: "zksync-eravm" as const, factoryDeps: [] } : {}),
       });
+      context.calldataReview?.record(planned, { abi: resolved.contract.interface.fragments, method: call.method, args });
       if (planned.executionAction === "replay") {
         context.reporter.result("execution", {
           stepId: planned.stepId,

package/runtime/workflow/lib/checkCodeRunner.ts

@@ -657,6 +657,7 @@ const manifestIsCurrent = (input: {
   proxyAddress: string;
   implementationAddress: string;
   storageLayoutHash: string;
+  proxyKind?: string;
 }): boolean => {
   const proxy = input.proxyAddress.toLowerCase();
   const implementation = input.implementationAddress.toLowerCase();
@@ -669,6 +670,7 @@ const manifestIsCurrent = (input: {
       isRecord(item)
       && typeof item.address === "string"
       && item.address.toLowerCase() === proxy
+      && (input.proxyKind === undefined || item.kind === input.proxyKind)
     ));
   }
   if (isRecord(document.impls)) {
@@ -1114,7 +1116,7 @@ export const runCheckCode = async (
       manifestFile: exactManifest.relative,
       beforeHash,
     };
-    if (metadata?.proxyKind === "uups" && !implementationAddress) {
+    if ((metadata?.proxyKind === "uups" || metadata?.proxyKind === "transparent") && !implementationAddress) {
       entries.push({ ...base, syncStatus: "failed", afterHash: directoryHash(directory) });
       continue;
     }
@@ -1135,11 +1137,11 @@ export const runCheckCode = async (
       }
       continue;
     }
-    if (!implementationAddress || metadata?.proxyKind && metadata.proxyKind !== "uups") {
+    if (!implementationAddress || metadata?.proxyKind && metadata.proxyKind !== "uups" && metadata.proxyKind !== "transparent") {
       entries.push({ ...base, syncStatus: "not_required", afterHash: directoryHash(directory) });
       continue;
     }
-    if (!metadata || metadata.proxyKind !== "uups") {
+    if (!metadata || (metadata.proxyKind !== "uups" && metadata.proxyKind !== "transparent")) {
       entries.push({ ...base, syncStatus: "proxy_kind_unknown", afterHash: directoryHash(directory) });
       continue;
     }
@@ -1159,6 +1161,7 @@ export const runCheckCode = async (
       proxyAddress: selected.address,
       implementationAddress,
       storageLayoutHash,
+      proxyKind:metadata.proxyKind,
     })) {
       entries.push({ ...base, syncStatus: "already_current", afterHash: beforeHash });
       continue;
@@ -1178,6 +1181,7 @@ export const runCheckCode = async (
       "--target",
       selected.network,
       "--skip-tx-hash",
+      ...(metadata.proxyKind === "transparent" ? ["--proxy-kind","transparent","--proxy-admin-address",metadata.proxyAdminAddress??"","--proxy-admin-owner",metadata.proxyAdminOwner??""] : []),
     ], {
       network: selected.network,
       scheme,

package/runtime/workflow/lib/context.ts

@@ -67,6 +67,7 @@ export interface WorkflowContext {
   validation?: WorkflowValidationPort;
   pendingUupsReuse?: PendingUupsResolverPort;
   verification?: VerificationSink;
+  calldataReview?: import('../../delivery/calldata-review').CalldataReviewSink;
   deploymentRecorder?: DeploymentRecorder;
   executionPlanner?: TransactionPlannerPort;
   externalCalls: ExternalCall[];

package/runtime/workflow/lib/create2.ts

@@ -1,16 +1,14 @@
 import { resolveWorkflowValue, type Create2FieldKind } from './validation';
 import type { Signer } from "ethers";
-import { getAddress, Interface, isAddress } from "ethers";
+import { getAddress, isAddress } from "ethers";
 import { WorkflowStep } from "./parameters";
 import type { WorkflowContext } from "./context";
 
-const CONTROLLED_MULTICALL_INTERFACE = new Interface([
-  "function aggregate3(tuple(address target,bool allowFailure,bytes callData)[] calls) payable returns (tuple(bool success, bytes returnData)[] returnData)",
-  "function aggregate3Value(tuple(address target,bool allowFailure,uint256 value,bytes callData)[] calls) payable returns (tuple(bool success, bytes returnData)[] returnData)",
-]);
-
-export type Create2Scheme = "evm" | "zksync-eravm";
-
+import { prepareControlledMulticallTransaction } from 'gate-evm-tools/workflow';
+import type { PreparedWorkflowTransaction, PreparedControlledMulticallTransaction } from 'gate-evm-tools/workflow';
+export { prepareControlledMulticallTransaction } from 'gate-evm-tools/workflow';
+export type { PreparedWorkflowTransaction, PreparedControlledMulticallTransaction, ControlledMulticallInnerCall } from 'gate-evm-tools/workflow';
+export type Create2Scheme = 'evm' | 'zksync-eravm';
 export interface Create2Options {
   scheme: Create2Scheme;
   factory: string;
@@ -23,106 +21,7 @@ export interface Create2Options {
   uupsPlaceholderImplementation?: string;
 }
 
-export interface PreparedWorkflowTransaction {
-  target: string;
-  value: string;
-  data: string;
-  operation: 0;
-  scheme?: "zksync-eravm";
-  factoryDeps?: string[];
-}
-
-export interface ControlledMulticallInnerCall {
-  target: string;
-  value: string;
-  data: string;
-  factoryDeps?: string[];
-}
-
-export interface PreparedControlledMulticallTransaction
-  extends PreparedWorkflowTransaction {
-  method: "aggregate3" | "aggregate3Value";
-  calls: Array<{
-    target: string;
-    allowFailure: false;
-    value: string;
-    callData: string;
-  }>;
-}
-
-interface SentTransaction {
-  hash: string;
-  wait: () => Promise<unknown>;
-}
-
-const bigintValue = (value: string | undefined): bigint => {
-  if (!value || value === "0") return 0n;
-  const parsed = BigInt(value);
-  if (parsed < 0n) throw new Error("transaction value must be nonnegative");
-  return parsed;
-};
-
-const normalizeFactoryDeps = (
-  input: string[],
-  label: string,
-): string[] => {
-  const seen = new Set<string>();
-  const output: string[] = [];
-  for (const [index, dependency] of input.entries()) {
-    if (!/^0x(?:[0-9a-fA-F]{2})+$/.test(dependency)) {
-      throw new Error(`${label}[${index}] must be non-empty byte-aligned bytecode`);
-    }
-    const normalized = dependency.toLowerCase();
-    if (seen.has(normalized)) continue;
-    seen.add(normalized);
-    output.push(normalized);
-  }
-  return output;
-};
-
-export const prepareControlledMulticallTransaction = (
-  controlledMulticall: string,
-  inputCalls: ControlledMulticallInnerCall[],
-  scheme: Create2Scheme = "evm",
-): PreparedControlledMulticallTransaction => {
-  if (!isAddress(controlledMulticall)) {
-    throw new Error("controlledMulticall must be an EVM address");
-  }
-  if (inputCalls.length === 0) {
-    throw new Error("controlled multicall requires at least one inner call");
-  }
-  if (scheme === "evm" && inputCalls.some((call) => call.factoryDeps !== undefined)) {
-    throw new Error("factoryDeps are only supported for zkSync transactions");
-  }
-  if (scheme === "zksync-eravm" && inputCalls.some((call) => call.factoryDeps === undefined)) {
-    throw new Error("every zkSync GateTool call must include factoryDeps");
-  }
-  const calls = inputCalls.map((call) => ({
-    target: getAddress(call.target),
-    allowFailure: false as const,
-    value: bigintValue(call.value).toString(10),
-    callData: call.data,
-  }));
-  const totalValue = calls.reduce((sum, call) => sum + BigInt(call.value), 0n);
-  const method = totalValue === 0n ? "aggregate3" as const : "aggregate3Value" as const;
-  const encodedCalls = method === "aggregate3"
-    ? calls.map(({ value: _value, ...call }) => call)
-    : calls;
-  const factoryDeps = scheme === "zksync-eravm"
-    ? normalizeFactoryDeps(inputCalls.flatMap((call) => call.factoryDeps!), "factoryDeps")
-    : undefined;
-  return {
-    target: getAddress(controlledMulticall),
-    value: totalValue.toString(10),
-    data: CONTROLLED_MULTICALL_INTERFACE.encodeFunctionData(method, [encodedCalls]),
-    operation: 0,
-    method,
-    calls,
-    ...(scheme === "zksync-eravm"
-      ? { scheme: "zksync-eravm" as const, factoryDeps: factoryDeps! }
-      : {}),
-  };
-};
+interface SentTransaction { hash:string; wait:()=>Promise<unknown>; }
 
 export const sendPreparedWorkflowTransaction = async (
   prepared: PreparedWorkflowTransaction,

package/runtime/workflow/lib/deploymentInfo.ts

@@ -11,6 +11,8 @@ export interface DeploymentInfoEntry {
   actualContract: string;
   proxyKind?: "uups" | "transparent";
   implementationAddress?: string;
+  proxyAdminAddress?: string;
+  proxyAdminOwner?: string;
   source: DeploymentInfoSource;
   updatedAt: string;
 }
@@ -114,6 +116,8 @@ const validateEntry = (value: unknown, label: string): DeploymentInfoEntry => {
     "actualContract",
     "proxyKind",
     "implementationAddress",
+    "proxyAdminAddress",
+    "proxyAdminOwner",
     "source",
     "updatedAt",
   ]);
@@ -140,6 +144,8 @@ const validateEntry = (value: unknown, label: string): DeploymentInfoEntry => {
     ...(value.implementationAddress
       ? { implementationAddress: address(value.implementationAddress, `${label}.implementationAddress`) }
       : {}),
+    ...(value.proxyAdminAddress?{proxyAdminAddress:address(value.proxyAdminAddress,`${label}.proxyAdminAddress`)}:{}),
+    ...(value.proxyAdminOwner?{proxyAdminOwner:address(value.proxyAdminOwner,`${label}.proxyAdminOwner`)}:{}),
     source: validateSource(value.source, `${label}.source`),
     updatedAt: value.updatedAt,
   };
@@ -243,6 +249,7 @@ export function prepareDeploymentInfoFromRecords(input: {
         actualContract,
         ...(proxyKind ? { proxyKind } : {}),
         ...(implementationAddress ? { implementationAddress } : {}),
+        ...(proxyKind === "transparent" ? {proxyAdminAddress:optionalAddress(rawChange.proxyAdminAddress??existing?.proxyAdminAddress,"ProxyAdmin address"),proxyAdminOwner:optionalAddress(rawChange.proxyAdminOwner??existing?.proxyAdminOwner,"ProxyAdmin owner")}:{}),
         source: {
           kind: "deployment" as const,
           deploymentId,
@@ -259,6 +266,7 @@ export function prepareDeploymentInfoFromRecords(input: {
             ...(existing.implementationAddress
               ? { implementationAddress: existing.implementationAddress }
               : {}),
+            ...(existing.proxyKind === "transparent" ? {proxyAdminAddress:existing.proxyAdminAddress,proxyAdminOwner:existing.proxyAdminOwner}:{}),
             source: existing.source,
           }
         : undefined;

package/runtime/workflow/lib/deploymentRecords.ts

@@ -63,6 +63,8 @@ export interface DeploymentChange {
   proxyKind?: string;
   address?: string;
   proxyAddress?: string;
+  proxyAdminAddress?: string;
+  proxyAdminOwner?: string;
   implementationAddress?: string;
   preparedImplementationAddress?: string;
   placeholderImplementationAddress?: string;
@@ -272,7 +274,7 @@ export class DeploymentRecorder {
       throw new Error("Deployment proxy transactionId is invalid");
     }
     const change = this.record.changes.find((entry) => entry.stepId === stepId);
-    if (!change || change.proxyKind !== "uups") {
+    if (!change || (change.proxyKind !== "uups" && change.proxyKind !== "transparent")) {
       throw new Error(`Cannot bind a proxy transaction for deployment change ${stepId}`);
     }
     if (

package/runtime/workflow/lib/externalExecutionScanner.ts

@@ -790,7 +790,7 @@ export const reconcileExternalExecution = async (input: {
       orderedMatches.map((match) => [match.transactionId, match]),
     );
     for (const change of deployment.changes) {
-      if (change.proxyKind !== "uups") continue;
+      if (change.proxyKind !== "uups" && change.proxyKind !== "transparent") continue;
       if (
         !change.proxyAddress
         || !change.implementationAddress
@@ -846,6 +846,7 @@ export const reconcileExternalExecution = async (input: {
         target: input.network,
         manifestDir: target.openzeppelin.manifestDir,
         proxy: change.proxyAddress,
+        ...(change.proxyKind === 'transparent'?{proxyKind:'transparent' as const,proxyAdminAddress:change.proxyAdminAddress,proxyAdminOwner:change.proxyAdminOwner}:{}),
         implementation: change.implementationAddress,
         contract: change.actualContract,
         constructorArgs: change.constructorArgs,

package/runtime/workflow/lib/gateTool.ts

@@ -162,7 +162,7 @@ export const expectedTransactionPurposes = (
   if (plan.kind === "create2-deploy") {
     return requiredRoles.has("contract") ? ["deploy-contract"] : [];
   }
-  if (plan.kind === "uups-placeholder-deploy") {
+  if (plan.kind === "uups-placeholder-deploy" || plan.kind === "transparent-deploy") {
     if (!requiredRoles.has("proxy")) {
       if (requiredRoles.has("implementation")) {
         throw new Error(
@@ -174,7 +174,7 @@ export const expectedTransactionPurposes = (
     return [
       ...(requiredRoles.has("implementation") ? ["deploy-implementation" as const] : []),
       "deploy-proxy",
-      "upgrade-proxy",
+      ...(plan.kind === "uups-placeholder-deploy" ? ["upgrade-proxy" as const] : []),
     ];
   }
   return [

package/runtime/workflow/lib/gateToolSync.ts

@@ -20,6 +20,9 @@ export interface SyncGateToolUupsOptions {
   target: string;
   manifestDir: string;
   proxy: string;
+  proxyKind?: "uups" | "transparent";
+  proxyAdminAddress?: string;
+  proxyAdminOwner?: string;
   implementation: string;
   contract: string;
   constructorArgs: unknown[];
@@ -163,6 +166,9 @@ const validateEvidenceIdentity = (
     || raw.scheme !== options.scheme
     || raw.network !== options.network
     || raw.target !== options.target
+    || raw.proxyKind !== options.proxyKind
+    || raw.proxyAdminAddress !== options.proxyAdminAddress
+    || raw.proxyAdminOwner !== options.proxyAdminOwner
     || raw.manifestDir !== options.manifestDir
     || raw.contract !== options.contract
     || JSON.stringify(raw.constructorArgs) !== JSON.stringify(options.constructorArgs)
@@ -239,6 +245,7 @@ const buildSyncEvidence = (
   network: options.network,
   target: options.target,
   manifestDir: options.manifestDir,
+  ...(options.proxyKind?{proxyKind:options.proxyKind,proxyAdminAddress:options.proxyAdminAddress,proxyAdminOwner:options.proxyAdminOwner}:{}),
   proxy: options.proxy.toLowerCase(),
   implementation: options.implementation.toLowerCase(),
   contract: options.contract,
@@ -335,6 +342,7 @@ export const syncGateToolUups = async (
     network: options.network,
     target: options.target,
     proxy: options.proxy,
+    ...(options.proxyKind?{proxyKind:options.proxyKind,proxyAdminAddress:options.proxyAdminAddress,proxyAdminOwner:options.proxyAdminOwner}:{}),
     contract: options.contract,
     constructorArgs: options.constructorArgs,
     ...(options.scheme === "evm"

package/runtime/workflow/lib/parameters.ts

@@ -246,6 +246,10 @@ export const validateDeployCreate2Strategy = (steps: WorkflowStep[]): void => {
     }
 
     if (step.proxy !== undefined) {
+      if(asObject(step.proxy).kind === "transparent") {
+        if(step.upgradeableStrategy!=="transparent-proxy"||step.firstUpgrade!==undefined)throw new Error(`Deploy step ${step.id} requires transparent-proxy strategy without firstUpgrade`);
+        continue;
+      }
       if (step.upgradeableStrategy !== "uups-placeholder-proxy") {
         throw new Error(`Deploy step ${step.id} requires upgradeableStrategy: uups-placeholder-proxy`);
       }

package/runtime/workflow/lib/proxy.ts

@@ -10,6 +10,7 @@ export interface ProxyOptions {
   initializer?: string | false;
   unsafeAllow?: string[];
   constructorArgs?: unknown[];
+  adminOwner?: string;
 }
 
 export interface FirstUpgradeOptions {