gate-evm-tools 1.2.0 → 1.2.2

package/runtime/delivery/scripts.ts

@@ -0,0 +1,162 @@
+/** Public script protocol and preparation API shared by CLI and application hosts. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import YAML from 'yaml';
+import Ajv from 'ajv';
+import { CustomModuleClosure } from './custom-closure';
+import { strictData, pointerPart } from './data';
+import { readInputBytes, parseInputDocument } from './input-files';
+import { object, safeId, portablePath } from './protocol';
+import { deepFreeze, semanticHash, canonicalJson } from '../workflow/lib/canonicalData';
+import { writeImmutableDeliveryFile } from './development-inputs';
+import { loadDeliveryPublicTarget } from './config';
+export interface ContractQuery { address: string; abi: string[]; method: string; args?: unknown[]; caller?: string }
+export interface ScriptStep {
+  id: string; dependsOn?: string[];
+  /** Explicit live evidence for omitted prerequisites, evaluated before the selected step. */
+  satisfiedBy?: Record<string, ContractQuery & { expect: unknown }>;
+  reads?: { files?: string[]; params?: string[]; state?: string[]; target?: string[]; chain?: boolean };
+}
+export interface DeliveryScript {
+  version: 1; description: string; inputSchema: Record<string, any>;
+  defaults?: Record<string, unknown>; steps: ScriptStep[];
+}
+export interface ScriptPorts {
+  resolve(key: string): unknown;
+  readJson(file: string): Promise<unknown>;
+  readBytes(file: string): Promise<unknown>;
+  readContract(query: ContractQuery): Promise<unknown>;
+}
+export interface ScriptInvocation { stepId: string; prerequisites: Array<ContractQuery & { expect: unknown }> }
+export function inspectDeliveryScript(root: string, script: string) {
+  portablePath(script,'business script');
+  if(!script.startsWith('scripts/operations/')&&!/^scripts\/tasks\/[^/]+\//.test(script))throw Error('Script must be under scripts/operations or the task directory');
+  const closure=new CustomModuleClosure(root),loaded=closure.load(script),d=closure.normalize(loaded.module.delivery) as DeliveryScript;
+  object(d,'delivery script',['version','description','inputSchema','defaults','steps']);
+  if(d.version!==1||typeof d.description!=='string'||!d.description.trim()||!Array.isArray(d.steps)||!d.steps.length||typeof loaded.module.planOperations!=='function')throw Error('Script requires delivery v1 and planOperations(ports,input)');
+  object(d.inputSchema,'inputSchema');
+  if(d.inputSchema.type!=='object'||d.inputSchema.additionalProperties!==false)throw Error('Input schema requires object with additionalProperties:false');
+  const names=d.steps.map(step=>{object(step,'script step',['id','dependsOn','satisfiedBy','reads']);return safeId(step.id,'business step');});
+  if(new Set(names).size!==names.length)throw Error('Duplicate script step');
+  d.steps.forEach((s,i)=>{if(s.dependsOn!==undefined&&(!Array.isArray(s.dependsOn)||new Set(s.dependsOn).size!==s.dependsOn.length))throw Error('Invalid dependencies');for(const dep of s.dependsOn??[])if(!names.slice(0,i).includes(dep))throw Error(`Dependency ${dep} must precede ${s.id}`);});
+  return {definition:deepFreeze(d),closure:closure.seal()};
+}
+const isObject=(v:unknown):v is Record<string,any>=>!!v&&typeof v==='object'&&!Array.isArray(v);
+export function mergeScriptInputs(base:Record<string,any>,over:Record<string,any>):Record<string,any>{
+  return Object.fromEntries([...new Set([...Object.keys(base),...Object.keys(over)])].map(k=>[k,Object.hasOwn(over,k)?isObject(base[k])&&isObject(over[k])?mergeScriptInputs(base[k],over[k]):over[k]:base[k]]));
+}
+function schemaDefaults(s:any):any{
+  if(Object.hasOwn(s,'default'))return strictData(s.default);
+  if(s.type==='object'){const entries=Object.entries(s.properties??{}).filter(([k])=>!(s.required??[]).includes(k)).map(([k,v])=>[k,schemaDefaults(v)]).filter(([,v])=>v!==undefined);return Object.fromEntries(entries);}
+  return undefined;
+}
+function parameterFile(root:string,file:string){portablePath(file,'parameter file');if(!/\.(json|ya?ml)$/.test(file)||file.split('/').some(p=>/^(?:\.env|rpc\.env|node_modules|\.git|\.gate-delivery|keys?|secrets?|credentials?)(?:\.|$)/i.test(p)))throw Error('Parameter file must be a public JSON/YAML business input');return readInputBytes(root,file);}
+function inputSchema(raw:any):any {const s=JSON.parse(canonicalJson(raw));const visit=(v:any)=>{delete v.default;delete v['x-derived'];if(v.properties)Object.values(v.properties).forEach(visit);if(v.items)visit(v.items);};visit(s);return s;}
+export function resolveScriptInputs(definition:DeliveryScript,file:unknown={},sets:string[]=[]){
+  object(file,'input parameters');
+  let values=mergeScriptInputs(mergeScriptInputs(schemaDefaults(definition.inputSchema)??{},definition.defaults??{}),strictData(file) as Record<string,any>);
+  const seen=new Set<string>();
+  for(const set of sets){const eq=set.indexOf('=');if(eq<1)throw Error('--set expects path=value');const key=set.slice(0,eq),parts=key.split('.');if(seen.has(key)||[...seen].some(p=>p.startsWith(key+'.')||key.startsWith(p+'.')))throw Error(`Conflicting --set ${key}`);seen.add(key);
+    let s=definition.inputSchema,v=values;
+    for(const [i,p]of parts.entries()){if(['__proto__','constructor','prototype'].includes(p)||s.type!=='object'||!s.properties?.[p])throw Error(`Unknown parameter ${key}`);s=s.properties[p];if(s['x-derived'])throw Error(`Derived parameter cannot be overridden: ${key}`);if(i<parts.length-1){v[p]??={};if(!isObject(v[p]))throw Error(`Non-object parameter ${p}`);v=v[p];}else{const text=set.slice(eq+1);let value:any;if(s.type==='string')value=text;else{try{value=JSON.parse(text);}catch{throw Error(`Invalid ${s.type} at ${key}`);}}v[p]=value;}}
+  }
+  const checkDerived=(s:any,v:any,p='')=>{if(s['x-derived']&&v!==undefined)throw Error(`Derived value ${p} belongs in planOperations, not input parameters`);if(isObject(v))for(const [k,x]of Object.entries(v))checkDerived(s.properties?.[k]??{},x,p+'/'+k);};checkDerived(definition.inputSchema,values);
+  const ajv=new Ajv({allErrors:true,strict:true});ajv.addKeyword({keyword:'x-policy',valid:true});const validate=ajv.compile(inputSchema(definition.inputSchema));
+  if(!validate(values))throw Error(`Script inputs: ${ajv.errorsText(validate.errors)}`);
+  strictData(values);return deepFreeze(values);
+}
+export function scriptManifest(root:string,script:string,selected?:string[]) {
+  const {definition,closure}=inspectDeliveryScript(root,script),ids=selected?.length?selected:definition.steps.map(s=>s.id);
+  if(new Set(ids).size!==ids.length||ids.some(id=>!definition.steps.some(s=>s.id===id)))throw Error('Unknown or duplicate selected step');
+  const steps=definition.steps.filter(s=>ids.includes(s.id)).map(s=>{
+    const missing=(s.dependsOn??[]).filter(dep=>!ids.includes(dep));
+    for(const dep of missing)if(!s.satisfiedBy?.[dep])throw Error(`Step ${s.id} requires ${dep}; explicitly select it or declare live satisfiedBy evidence`);
+    const reads=s.reads??{};
+    return {id:s.id,kind:'custom',script,input:{stepId:s.id,prerequisites:missing.map(dep=>s.satisfiedBy![dep])},reads:{files:reads.files??[],params:reads.params??Object.keys(definition.inputSchema.properties??{}),state:reads.state??[],target:reads.target??[],...(reads.chain||missing.length?{chain:true}:{})}};
+  });
+  return {definition,closure,steps,selectedSteps:steps.map(s=>s.id)};
+}
+/** Creates a fresh business round; no signature/approval and no GateFlow state involved. */
+export function prepareStandaloneTask(input:{root:string;script:string;network:string;paramsFile?:string;sets?:string[];steps?:string[];description?:string;releaseNetworks?:string[];referenceDeploymentId?:string}){
+ return writeStandaloneTask(input);
+}
+function writeStandaloneTask(input:{root:string;script:string;network:string;paramsFile?:string;sets?:string[];steps?:string[];description?:string;releaseNetworks?:string[];referenceDeploymentId?:string;values?:Record<string,unknown>;networkOverrides?:Record<string,Record<string,unknown>>;reuseId?:string}){
+  const root=fs.realpathSync(input.root),script=portablePath(input.script,'script'),selected=scriptManifest(root,script,input.steps);
+  loadDeliveryPublicTarget(root,input.network,'dev');
+  for(const n of input.releaseNetworks??[])loadDeliveryPublicTarget(root,n,'prod');
+  const bytes=input.paramsFile?parameterFile(root,input.paramsFile):undefined;
+  const values=resolveScriptInputs(selected.definition,mergeScriptInputs(input.values??{},bytes?parseInputDocument(bytes,/\.ya?ml$/.test(input.paramsFile!)?'yaml':'json') as Record<string,any>:{}),input.sets);
+  const overrides=input.networkOverrides??{};
+  for(const [network,v]of Object.entries(overrides)){if(!(input.releaseNetworks??[]).includes(network))throw Error('Parameter override outside release scope');resolveScriptInputs(selected.definition,mergeScriptInputs(values,v));}
+  const id=input.reuseId??`${path.basename(script).replace(/\.[^.]+$/,'').replace(/[^a-zA-Z0-9_-]/g,'-').slice(0,60)}-${randomUUID()}`,base=`scripts/tasks/${id}`;
+  const task={version:2,id,source:'standalone',description:input.description??selected.definition.description,developmentNetwork:input.network,releaseTargetNetworks:input.releaseNetworks??[],script,selectedSteps:selected.selectedSteps,...(input.referenceDeploymentId?{referenceDeploymentId:safeId(input.referenceDeploymentId,'referenceDeploymentId')}:{})};
+  const schema=inputSchema(selected.definition.inputSchema);schema.$schema='http://json-schema.org/draft-07/schema#';schema['x-policy']={kind:'manual'};
+  const manual:Record<string,unknown>={};const leaves=(v:any,p='')=>{const entries=v&&typeof v==='object'?Object.entries(v):[];if(!entries.length)manual[p]={source:'standalone-input',value:v};else for(const[k,x]of entries)leaves(x,p+'/'+pointerPart(k));};leaves(values);
+  const write=(file:string,data:unknown,yaml=false)=>{const bytes=yaml?YAML.stringify(data):canonicalJson(data)+'\n';if(input.reuseId)require('./materialization').atomicDevelopmentWrite(root,`${base}/${file}`,bytes);else writeImmutableDeliveryFile(root,`${base}/${file}`,Buffer.from(bytes));};
+  write('task.yaml',task,true);write('manifest.yaml',{id,description:task.description,steps:selected.steps},true);write('parameters.schema.json',schema);
+  const targets=Object.fromEntries(Object.entries(overrides).map(([network,v])=>{const entries:Record<string,unknown>={};const visit=(value:any,p='')=>{const fields=value&&typeof value==='object'?Object.entries(value):[];if(!fields.length)entries[p]={source:'standalone-input',value};else for(const[k,x]of fields)visit(x,p+'/'+pointerPart(k));};visit(v);return [network,{manual:entries,computed:{}}];}));
+  write('parameters.yaml',{defaults:values,params:{[input.network]:{},...overrides}},true);write('parameters.provenance.json',{version:1,producers:{},defaults:{manual,computed:{}},targets});
+  const captured=selected.closure.files.map(f=>({path:f.path,digest:f.digest,base64:readInputBytes(root,f.path).toString('base64')}));
+  if(bytes)captured.push({path:input.paramsFile!,digest:require('./input-files').inputDigest(bytes),base64:bytes.toString('base64')});
+  write('inputs/preparation.snapshot.json',{schema:'gate-delivery-script-inputs',version:1,selectedSteps:selected.selectedSteps,closure:selected.closure,files:captured});
+  return deepFreeze({deploymentId:id,taskPath:`${base}/task.yaml`,values,steps:selected.selectedSteps});
+}
+
+/** Re-prepare the same native round before signing; historical preparations stay immutable and revoked. */
+export async function reprepareStandaloneTask(input:{root:string;executionId:string;store:import('./execution-store').ExecutionStore;paramsFile?:string;sets?:string[];steps?:string[]}){
+ const source=JSON.parse(readInputBytes(input.root,`.gate-delivery/development/${safeId(input.executionId,'executionId')}.source.json`).toString());
+ const ref=source.targets?.[0]?.request?.sourceRef;if(ref?.kind!=='standalone')throw Error('Native reprepare requires a standalone source; managed rounds must use their owning host');
+ const task=require('./standalone-source').readStandaloneTask(input.root,ref.path) as import('./standalone-source').StandaloneDefinition;
+ const aggregate=JSON.parse(readInputBytes(input.root,`.gate-delivery/development/${input.executionId}.aggregate.json`).toString());
+ const previous=aggregate.inputs.sourceDefinitions[0].definition;
+ const withoutSelection=({selectedSteps,...rest}:any)=>rest;
+ if(canonicalJson(withoutSelection(task))!==canonicalJson(withoutSelection(previous)))throw Error('Reprepare cannot change the original task scope; create a new round');
+ const parameters=YAML.parse(readInputBytes(input.root,`scripts/tasks/${task.deploymentId}/parameters.yaml`).toString());
+ const networkOverrides=Object.fromEntries(Object.entries(parameters.params??{}).filter(([network])=>network!==task.developmentNetwork)) as Record<string,Record<string,unknown>>;
+ // Validate prospective inputs before revoking a usable preparation.
+ const selected=scriptManifest(input.root,task.script,input.steps??task.selectedSteps);
+ const file=input.paramsFile?parseInputDocument(parameterFile(input.root,input.paramsFile),/\.ya?ml$/.test(input.paramsFile)?'yaml':'json'):{};
+ const values=resolveScriptInputs(selected.definition,mergeScriptInputs(aggregate.inputs.business.parameters[0].resolved.values,file as Record<string,any>),input.sets);
+ for(const v of Object.values(networkOverrides))resolveScriptInputs(selected.definition,mergeScriptInputs(values,v));
+ const records=path.join(input.root,'.gate-delivery/executions');
+ if(fs.existsSync(records))for(const file of fs.readdirSync(records).filter(f=>f.endsWith('.json'))){const r=JSON.parse(readInputBytes(input.root,`.gate-delivery/executions/${file}`).toString());if(r.kind==='development'&&r.deploymentId===task.deploymentId&&r.executionId!==input.executionId&&!fs.existsSync(path.join(input.root,`.gate-delivery/development/${r.executionId}.superseded.json`)))throw Error(`Round already has replacement execution ${r.executionId}; resume it`);}
+ const original=await require('./development-inputs').invalidateDevelopmentPreparation(input);
+ return require('./materialization').withDevelopmentFileLock(input.root,async()=>{
+  const marker=`.gate-delivery/development/${input.executionId}.replacement.json`;
+  const intentHash=semanticHash({values,networkOverrides,steps:selected.selectedSteps,closure:selected.closure});
+  let executionId:string;
+  if(fs.existsSync(path.join(input.root,marker))){const prior=JSON.parse(readInputBytes(input.root,marker).toString());if(prior.intentHash!==intentHash)throw Error('Replacement preparation already reserved with different inputs; finish or resume that replacement');executionId=safeId(prior.executionId,'replacement executionId');}
+  else{executionId=randomUUID();writeImmutableDeliveryFile(input.root,marker,Buffer.from(canonicalJson({version:1,executionId,intentHash})+'\n'));}
+  return {...writeStandaloneTask({root:input.root,script:task.script,network:task.developmentNetwork,releaseNetworks:task.releaseTargetNetworks,referenceDeploymentId:task.referenceDeploymentId,description:task.description,steps:selected.selectedSteps,values,networkOverrides,reuseId:original.deploymentId}),executionId};
+ });
+}
+
+/** Prepare a reusable script inside an existing, genuinely confirmed GateFlow round. */
+export async function prepareGateFlowScriptTask(input:{root:string;request:import('./protocol').DeliveryRequest;script:string;steps?:string[];values:Record<string,unknown>;sets?:string[];paramsFile?:string;networkInputs?:Record<string,{values:Record<string,unknown>;sets?:string[]}>}){
+ const source=require('./source').readOwnedDeliverySource({workspaceRoot:input.root,projectRoot:'.',request:input.request}) as import('./source').DeliverySourceBinding;
+ if(source.kind!=='gateflow')throw Error('GateFlow preparation requires its real source adapter');
+ const deploymentId=safeId(source.scope.deploymentId,'deploymentId'),base=`scripts/tasks/${deploymentId}`,definition=scriptManifest(input.root,input.script,input.steps);
+ const file=input.paramsFile?parseInputDocument(parameterFile(input.root,input.paramsFile),/\.ya?ml$/.test(input.paramsFile)?'yaml':'json'):{};
+ const values=resolveScriptInputs(definition.definition,mergeScriptInputs(file as Record<string,any>,input.values),input.sets);
+ for(const network of Object.keys(input.networkInputs??{}))if(!(source.scope.releaseTargetNetworks as string[]).includes(network))throw Error('Network inputs outside confirmed release scope');
+ const networkValues=Object.fromEntries(Object.entries(input.networkInputs??{}).map(([network,v])=>[network,resolveScriptInputs(definition.definition,mergeScriptInputs(file as Record<string,any>,v.values),v.sets)]));
+ const schema=inputSchema(definition.definition.inputSchema);schema.$schema='http://json-schema.org/draft-07/schema#';schema['x-policy']={kind:'manual'};
+ const manual:Record<string,unknown>={};const leaves=(v:any,p='')=>{const entries=v&&typeof v==='object'?Object.entries(v):[];if(!entries.length)manual[p]={source:'confirmed-requirement',value:v};else for(const[k,x]of entries)leaves(x,p+'/'+pointerPart(k));};leaves(values);
+ // Refuse replacing the inputs of any already prepared execution, even before the first signature.
+ const dir=path.join(input.root,'.gate-delivery/development');if(fs.existsSync(dir))for(const f of fs.readdirSync(dir).filter(f=>f.endsWith('.aggregate.json'))){const a=JSON.parse(fs.readFileSync(path.join(dir,f),'utf8'));if(a.inputs?.business?.deploymentId===deploymentId&&!fs.existsSync(path.join(dir,f.replace('.aggregate.json','.superseded.json'))))throw Error('Round already prepared; invalidate through the owning host or create a new round');}
+ const targets:Record<string,unknown>={};for(const [network,value]of Object.entries(networkValues)){const observations:Record<string,unknown>={};const visit=(v:any,p='')=>{const entries=v&&typeof v==='object'?Object.entries(v):[];if(!entries.length)observations[p]={source:'confirmed-requirement',value:v};else for(const[k,x]of entries)visit(x,p+'/'+pointerPart(k));};visit(value);targets[network]={manual:observations,computed:{}};}
+ const writes:{[file:string]:string}={
+  'manifest.yaml':YAML.stringify({id:deploymentId,description:definition.definition.description,steps:definition.steps}),
+  'parameters.schema.json':canonicalJson(schema)+'\n',
+  'parameters.yaml':YAML.stringify({defaults:values,params:{[input.request.network]:{},...networkValues}}),
+  'parameters.provenance.json':canonicalJson({version:1,producers:{},defaults:{manual,computed:{}},targets})+'\n',
+ };
+ await require('./materialization').withDevelopmentFileLock(input.root,async()=>{
+  const current=require('./source').readOwnedDeliverySource({workspaceRoot:input.root,projectRoot:'.',request:input.request});
+  if(current.sourceDefinitionHash!==source.sourceDefinitionHash)throw Error('Confirmed source changed while preparing');
+  if(fs.existsSync(dir))for(const f of fs.readdirSync(dir).filter(f=>f.endsWith('.aggregate.json'))){const a=JSON.parse(readInputBytes(input.root,`.gate-delivery/development/${f}`).toString());if(a.inputs?.business?.deploymentId===deploymentId&&!fs.existsSync(path.join(dir,f.replace('.aggregate.json','.superseded.json'))))throw Error('Round already prepared; original execution is immutable');}
+  for(const[file,bytes]of Object.entries(writes))require('./materialization').atomicDevelopmentWrite(input.root,`${base}/${file}`,bytes);
+ });
+ return {deploymentId,script:input.script,selectedSteps:definition.selectedSteps,values,files:Object.keys(writes).map(f=>`${base}/${f}`)};
+}

package/runtime/delivery/setup.ts

@@ -4,7 +4,6 @@ import crypto from 'node:crypto';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import YAML from 'yaml';
-import { REVIEWED_DELIVERY_OVERRIDES } from './toolchain';
 import { object } from './protocol';
 import { deliveryProjectMarker, projectRoot, readFile, confinedFile, stat, integratedConfig, readPublicProjectNetworkSnapshots, projectSourcesDirectory } from './project';
 import { configDocument, parseDeliveryPublicTargets, validateDeliveryTarget, type DeliveryTarget } from './config';
@@ -13,11 +12,10 @@ export { loadDeliveryTarget } from './config';
 export { configureDeliveryEnvironment } from './manifest';
 export type { DeliveryTarget, DeliveryTargetConfig } from './config';
 
-const TOOLCHAIN: Record<string, string> = { hardhat: '2.26.3', ethers: '6.15.0', '@nomicfoundation/hardhat-ethers': '3.1.0', typescript: '5.9.3', 'ts-node': '10.9.2' };
-// Resolve our identity from the executing package, including an explicitly installed tarball.
-const toolIdentity = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../../package.json'), 'utf8'));
-if (toolIdentity.name !== 'gate-evm-tools' || typeof toolIdentity.version !== 'string') throw new Error('Invalid GateTool package identity');
-const DEPENDENCIES: Record<string, string> = { 'gate-evm-tools': toolIdentity.version, '@openzeppelin/hardhat-upgrades': '3.9.1', '@openzeppelin/upgrades-core': '1.44.2', '@openzeppelin/contracts': '5.4.0' };
+// Setup checks locally available capabilities. The project owns dependency versions;
+// compiler qualification separately validates the toolchain used for deployment.
+const DEPENDENCIES = ['hardhat', 'ethers', '@nomicfoundation/hardhat-ethers', 'typescript', 'ts-node',
+  'gate-evm-tools', '@openzeppelin/hardhat-upgrades', '@openzeppelin/upgrades-core', '@openzeppelin/contracts'];
 export interface DeliverySetupOptions {
   workspaceRoot: string;
   projectRoot: string;
@@ -73,10 +71,6 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
   const before = new Map<string, string | undefined>();
   for (const file of ['.gate-template.json', 'package.json', 'hardhat.config.ts', 'config.yaml', 'contractInfo.json']) before.set(file, readFile(root, file));
   const pkg = object(JSON.parse(before.get('package.json') ?? 'null'), 'package.json');
-  const overrides = pkg.overrides === undefined ? {} : object(pkg.overrides, 'package overrides');
-  for (const [name, version] of Object.entries(REVIEWED_DELIVERY_OVERRIDES)) {
-    if (overrides[name] !== undefined && overrides[name] !== version) throw new Error(`Reviewed delivery dependency override conflict: ${name}`);
-  }
   const declarations: Record<string, unknown> = {};
   for (const section of ['dependencies', 'devDependencies']) {
     const entries = pkg[section] === undefined ? {} : object(pkg[section], section);
@@ -85,18 +79,14 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
       declarations[name] = value;
     }
   }
-  const required = { ...DEPENDENCIES };
+  const required = [...DEPENDENCIES];
+  let toolDeclaration: string | undefined;
   if (input.toolPackage !== undefined) {
     if (!path.isAbsolute(input.toolPackage) || !input.toolPackage.endsWith('.tgz') || !stat(input.toolPackage)?.isFile() || stat(input.toolPackage)?.isSymbolicLink()) throw new Error('toolPackage must be an explicit absolute local tarball path');
-    required['gate-evm-tools'] = `file:${input.toolPackage}`;
-  }
-  if (businessUsesUpgradeable(root)) required['@openzeppelin/contracts-upgradeable'] = '5.4.0';
-  for (const [name, version] of Object.entries({ ...TOOLCHAIN, ...required })) {
-    const declared = declarations[name];
-    // Preserve an existing explicit local tarball declaration when rerunning after installation.
-    const localTool = name === 'gate-evm-tools' && input.toolPackage === undefined && typeof declared === 'string' && /^file:.*\.tgz$/.test(declared);
-    if ((name in TOOLCHAIN && declared === undefined) || (declared !== undefined && declared !== version && !localTool)) throw new Error(`Dependency declaration conflict for ${name}: expected ${version}`);
+    toolDeclaration = `file:${input.toolPackage}`;
+    if (declarations['gate-evm-tools'] !== undefined && declarations['gate-evm-tools'] !== toolDeclaration) throw new Error('Explicit toolPackage conflicts with the project gate-evm-tools declaration');
   }
+  if (businessUsesUpgradeable(root)) required.push('@openzeppelin/contracts-upgradeable');
   const networks = readPublicProjectNetworkSnapshots(root, targets.map(target => target.network));
   const source = before.get('hardhat.config.ts')!;
   const withPlugin = integratedConfig(source); // Check integration conflicts even when dependencies are missing.
@@ -120,12 +110,14 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
   if (before.get('contractInfo.json') !== undefined) object(JSON.parse(before.get('contractInfo.json')!), 'contractInfo.json');
   const dependencies: DeliveryInspection['dependencies'] = [];
   const projectRequire = createRequire(path.join(root, 'package.json'));
-  for (const [name, requested] of Object.entries({ ...TOOLCHAIN, ...required })) {
+  for (const name of required) {
+    const requested = name === 'gate-evm-tools' && toolDeclaration !== undefined ? toolDeclaration : declarations[name];
+    const selection = typeof requested === 'string' ? requested : 'project-selected version';
+    if (requested === undefined) { dependencies.push({ name, required: selection, reason: 'not declared in the project' }); continue; }
     const metadata = confinedFile(root, `node_modules/${name}/package.json`);
-    if (!stat(metadata)) { dependencies.push({ name, required: requested, reason: 'not installed locally' }); continue; }
+    if (!stat(metadata)) { dependencies.push({ name, required: selection, reason: 'not installed locally' }); continue; }
     const installed = JSON.parse(fs.readFileSync(metadata, 'utf8'));
-    const expected = name === 'gate-evm-tools' ? DEPENDENCIES[name] : requested;
-    if (installed.name !== name || installed.version !== expected) throw new Error(`Installed dependency conflict for ${name}: expected ${expected}`);
+    if (installed.name !== name) throw new Error(`Installed dependency identity mismatch for ${name}`);
     if (name !== 'gate-evm-tools') {
       const entry = name === '@openzeppelin/contracts' ? `${name}/proxy/ERC1967/ERC1967Proxy.sol`
         : name === '@openzeppelin/contracts-upgradeable' ? `${name}/package.json` : name;
@@ -133,7 +125,7 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
         const resolved = fs.realpathSync(projectRequire.resolve(entry));
         if (!stat(resolved)?.isFile() || !resolved.startsWith(path.join(root, 'node_modules') + path.sep)) throw new Error('nonlocal entry');
       } catch {
-        dependencies.push({ name, required: requested, reason: 'required entry point is missing or nonlocal' });
+        dependencies.push({ name, required: selection, reason: 'required entry point is missing or nonlocal' });
       }
     }
     if (name === 'gate-evm-tools') {
@@ -142,7 +134,7 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
           const resolved = projectRequire.resolve(`gate-evm-tools/${entry}`);
           if (!resolved.startsWith(path.join(root, 'node_modules') + path.sep)) throw new Error('nonlocal API');
         }
-      } catch { dependencies.push({ name, required: requested, reason: 'installed package lacks delivery API exports; install a built delivery package' }); }
+      } catch { dependencies.push({ name, required: selection, reason: 'installed package lacks delivery API exports; install a built delivery package' }); }
     }
   }
   if (!dependencies.length) {
@@ -150,12 +142,10 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
     if (reason) dependencies.push({ name: 'dependency-tree', required: 'complete local dependency graph', reason });
   }
   const writes = new Map<string, string>();
-  const missing = Object.entries(required).filter(([name]) => declarations[name] === undefined);
-  const missingOverrides = Object.entries(REVIEWED_DELIVERY_OVERRIDES).some(([name]) => overrides[name] === undefined);
-  if (missing.length || missingOverrides) {
+  if (toolDeclaration !== undefined && declarations['gate-evm-tools'] === undefined) {
     const dev = { ...(pkg.devDependencies as Record<string, unknown> ?? {}) };
-    for (const [name, version] of missing) dev[name] = version;
-    writes.set('package.json', JSON.stringify({ ...pkg, devDependencies: dev, overrides: { ...overrides, ...REVIEWED_DELIVERY_OVERRIDES } }, null, 2) + '\n');
+    dev['gate-evm-tools'] = toolDeclaration;
+    writes.set('package.json', JSON.stringify({ ...pkg, devDependencies: dev }, null, 2) + '\n');
   }
   if (changedYaml) writes.set('config.yaml', doc.toString());
   if (before.get('contractInfo.json') === undefined) writes.set('contractInfo.json', '{}\n');
@@ -165,7 +155,7 @@ function preflight(input: DeliverySetupOptions): { result: DeliveryInspection; w
 }
 /** Read-only, never imports the project's config/HRE or contacts an RPC. */
 export function inspectDeliveryProject(options: DeliverySetupOptions): DeliveryInspection { return preflight(options).result; }
-/** Stage declarations/config; caller explicitly installs dependencies then reruns to enable the plugin. */
+/** Stage config; dependency selections remain project-owned except an explicit missing toolPackage. */
 export function setupDeliveryProject(options: DeliverySetupOptions): DeliveryInspection {
   const { result, writes, before } = preflight(options);
   const root = projectRoot(options.workspaceRoot, options.projectRoot);

package/runtime/delivery/source.ts

@@ -4,6 +4,7 @@ import { createHash } from 'node:crypto';
 import { deliveryProjectMarker, projectRoot, confinedFile } from './project-files';
 import { object, parseDeliveryRequest, validateDeliveryRpc, type DeliveryRequest, type ChainIdProvider, type ProjectNetworkSnapshot } from './protocol';
 import { loadPlanCodec } from './codec';
+import type { StandaloneDefinition } from './standalone-source';
 import type { Plan, PlanTask, DefinitionSelection, DefinitionSnapshot, DeepReadonly } from '../vendor/plan-codec/index.cjs';
 export type { DefinitionSelection, DefinitionSnapshot, DeepReadonly } from '../vendor/plan-codec/index.cjs';
 
@@ -20,8 +21,10 @@ export interface DeliverySourceBinding {
   workspaceRoot: string;
   projectRoot: string;
   observation: { path: string; sha256: string };
-  invocation: { lane: string; task: PlanTask };
-  sourceDefinition: DefinitionSnapshot;
+  kind: 'gateflow' | 'standalone';
+  scope: Readonly<Record<string, any>>;
+  invocation?: { lane: string; task: PlanTask };
+  sourceDefinition: DefinitionSnapshot | StandaloneDefinition;
   sourceDefinitionBytes: string;
   sourceDefinitionHash: string;
   prodTaskGraph?: DefinitionSnapshot;
@@ -77,6 +80,7 @@ function readSource(input: Omit<DeliverySourceOptions, 'sourceRoots'> & { source
   const workspace = projectRoot(input.workspaceRoot, '.');
   const root = projectRoot(workspace, input.projectRoot);
   deliveryProjectMarker(root);
+  if(request.sourceRef.kind==='standalone')return freeze((require('./standalone-source') as typeof import('./standalone-source')).standaloneSource(workspace,root,input.projectRoot,request)) as DeepReadonly<DeliverySourceBinding>;
   const bytes = actualSource(workspace, request.sourceRef.path);
   const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
   if (input.sourceRoots === undefined) (require('./input-files') as typeof import('./input-files')).assertUnambiguousHandoff(text);
@@ -116,7 +120,7 @@ function readSource(input: Omit<DeliverySourceOptions, 'sourceRoots'> & { source
   }
   // All values came from detached request parsing and actual handoff text; freeze before exposing.
   return freeze({ request, workspaceRoot: workspace, projectRoot: root, observation: { path: request.sourceRef.path, sha256: sha256(bytes) },
-    invocation, sourceDefinition: source.snapshot, sourceDefinitionBytes: source.bytes, sourceDefinitionHash: sha256(source.bytes),
+    kind:'gateflow' as const, scope:deployment, invocation, sourceDefinition: source.snapshot, sourceDefinitionBytes: source.bytes, sourceDefinitionHash: sha256(source.bytes),
     ...(production ? { prodTaskGraph: production.snapshot, prodTaskGraphBytes: production.bytes, prodTaskGraphHash: sha256(production.bytes) } : {}),
   }) as DeepReadonly<DeliverySourceBinding>;
 }

package/runtime/delivery/standalone-source.ts

@@ -0,0 +1,40 @@
+/** Native task-file adapter. No synthetic handoff, lanes, PlanTask or JSON approval. */
+import path from 'node:path';
+import { readInputBytes, parseInputDocument, inputDigest } from './input-files';
+import { object, safeId, portablePath, type DeliveryRequest } from './protocol';
+import { canonicalJson, deepFreeze, semanticHash } from '../workflow/lib/canonicalData';
+export interface StandaloneDefinition {
+  schema: 'gate-delivery-standalone'; version: 1; deploymentId: string;
+  description: string; developmentNetwork: string; releaseTargetNetworks: string[];
+  referenceDeploymentId?: string;
+  script: string; selectedSteps: string[];
+}
+export function readStandaloneTask(root: string, relative: string): StandaloneDefinition {
+  portablePath(relative,'standalone task');
+  const t=object(parseInputDocument(readInputBytes(root,relative),'yaml'),'standalone task',
+    ['version','id','source','description','developmentNetwork','releaseTargetNetworks','referenceDeploymentId','script','selectedSteps']);
+  if(t.version!==2 || t.source!=='standalone') throw Error('Native standalone task.yaml version 2 required');
+  const id=safeId(t.id,'deploymentId');
+  if(relative!==`scripts/tasks/${id}/task.yaml`)throw Error('Noncanonical standalone task path');
+  if(typeof t.description!=='string'||!t.description.trim())throw Error('Explicit operation description required');
+  safeId(t.developmentNetwork,'developmentNetwork');portablePath(t.script,'business script');
+  if(!Array.isArray(t.releaseTargetNetworks)||new Set(t.releaseTargetNetworks).size!==t.releaseTargetNetworks.length)throw Error('Invalid release targets');
+  for(const n of t.releaseTargetNetworks){safeId(n,'release target');if(n===t.developmentNetwork)throw Error('Development network cannot be a production target');}
+  if(!Array.isArray(t.selectedSteps)||!t.selectedSteps.length||new Set(t.selectedSteps).size!==t.selectedSteps.length)throw Error('Selected steps required');
+  t.selectedSteps.forEach(s=>safeId(s,'selected step'));
+  if(t.referenceDeploymentId!==undefined)safeId(t.referenceDeploymentId,'referenceDeploymentId');
+  return deepFreeze({schema:'gate-delivery-standalone' as const,version:1 as const,deploymentId:id,description:t.description,
+    developmentNetwork:t.developmentNetwork as string,releaseTargetNetworks:t.releaseTargetNetworks as string[],script:t.script as string,
+    selectedSteps:t.selectedSteps as string[],...(t.referenceDeploymentId?{referenceDeploymentId:t.referenceDeploymentId as string}:{})});
+}
+export function standaloneSource(workspace:string,root:string,relativeProject:string,request:DeliveryRequest) {
+  const relative=path.relative(root,path.resolve(workspace,request.sourceRef.path)).split(path.sep).join('/');
+  const definition=readStandaloneTask(root,relative);
+  if(definition.deploymentId!==request.sourceRef.deploymentId)throw Error('Standalone source deployment mismatch');
+  if(request.purpose==='dev-execution'?request.network!==definition.developmentNetwork:!definition.releaseTargetNetworks.includes(request.network))throw Error('Target outside standalone scope');
+  const scope={...definition,projectRoot:relativeProject,chainFamily:'evm',framework:'hardhat2'};
+  const bytes=canonicalJson(definition);
+  return {request,workspaceRoot:workspace,projectRoot:root,kind:'standalone' as const,scope,
+    observation:{path:request.sourceRef.path,sha256:inputDigest(readInputBytes(workspace,request.sourceRef.path))},
+    sourceDefinition:definition,sourceDefinitionBytes:bytes,sourceDefinitionHash:semanticHash(definition)};
+}

package/runtime/workflow/lib/calls.ts

@@ -350,21 +350,39 @@ export const runContractViewCalls = async (
   const resolved = await resolveContract(context, step);
   const calls = resolveStepCalls(step);
   const results: Record<string, string> = {};
+  const typedResults: Record<string, unknown> = {};
+  const queries: unknown[] = [];
+  const provider=context.runtime.hre.network.provider;
+  const caller=context.signerAddress??await context.signer?.getAddress()??"0x0000000000000000000000000000000000000001";
+  const block:any=await provider.request({method:"eth_getBlockByNumber",params:["latest",false]});
+  const chainId=BigInt(await provider.request({method:"eth_chainId",params:[]}) as string).toString();
 
   for (const [index, call] of calls.entries()) {
     const args = resolveCallArgs(context, call);
     await context.validation?.call(resolved.abiName, call.method, args, call.value === undefined ? undefined : resolveWorkflowValue(context, call.value));
     context.validation?.callInterface(resolved.contract.interface.fragments, call.method, args);
-    const value = await resolved.contract.getFunction(call.method).staticCall(...args);
+    const fn = resolved.contract.interface.getFunction(call.method);
+    let value: unknown;
+    if (fn && ["view", "pure"].includes(fn.stateMutability)) {
+      const query=await require("../../delivery/query").readScriptContract({address:resolved.address,abi:resolved.contract.interface.fragments.filter(f=>f.type==="function").map(f=>f.format("full")),method:call.method,args}, {request:(method:string,params:unknown[])=>provider.request({method,params}),chainId,block:{number:block.number,hash:block.hash},caller,source:{blockNumber:context.simulation.snapshot?.blockNumber??Number(BigInt(block.number)),blockHash:context.simulation.snapshot?.blockHash??block.hash}});
+      value=query.value;queries.push(query.evidence);
+    } else {
+      // Legacy view steps may statically inspect a non-view ABI. Keep that
+      // eth_call behavior without presenting it as a reusable view dependency.
+      value = await resolved.contract.getFunction(call.method).staticCall(...args);
+    }
     results[resultKey(call, index, calls)] = context.validation ? context.validation.stringify(value) : stringifyCallResult(value);
+    typedResults[resultKey(call,index,calls)] = require("../../delivery/abi").normalizeRuntimeValue(value);
   }
 
+  context.state.set(String(step.saveAs ?? step.id), { ...typedResults, values: Object.values(typedResults), value: Object.values(typedResults).length===1?Object.values(typedResults)[0]:Object.values(typedResults) });
   context.reporter.result("view", {
     stepId: step.id,
     kind: step.kind,
     contract: resolved.contractName,
     address: resolved.address,
     results,
+    queries,
   });
 };
 

package/dist-runtime/delivery/toolchain.d.ts

@@ -1,3 +0,0 @@
-/** Reviewed compiler adapter dependency selections; payload checks remain authoritative.
- * Range-scoped entries preserve distinct dependency majors. Setup never overrides a conflicting project choice. */
-export declare const REVIEWED_DELIVERY_OVERRIDES: Record<string, string>;

package/dist-runtime/delivery/toolchain.js

@@ -1,52 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.REVIEWED_DELIVERY_OVERRIDES = void 0;
-const compiler_dependency_pins_1 = require("./compiler-dependency-pins");
-/** Reviewed compiler adapter dependency selections; payload checks remain authoritative.
- * Range-scoped entries preserve distinct dependency majors. Setup never overrides a conflicting project choice. */
-exports.REVIEWED_DELIVERY_OVERRIDES = {
-    "axios": "1.20.0",
-    "@aws-sdk/client-lambda": "3.1152.0",
-    "@aws-sdk/core": "3.978.3",
-    "@aws-sdk/credential-provider-env": "3.972.74",
-    "@aws-sdk/credential-provider-http": "3.972.76",
-    "@aws-sdk/credential-provider-ini": "3.973.19",
-    "@aws-sdk/credential-provider-login": "3.972.81",
-    "@aws-sdk/credential-provider-node": "3.972.86",
-    "@aws-sdk/credential-provider-process": "3.972.74",
-    "@aws-sdk/credential-provider-sso": "3.973.18",
-    "@aws-sdk/credential-provider-web-identity": "3.972.80",
-    "@aws-sdk/nested-clients": "3.997.48",
-    "@aws-sdk/signature-v4-multi-region": "3.996.48",
-    "@aws-sdk/token-providers": "3.1150.0",
-    "@aws-sdk/types": "3.974.6",
-    "@smithy/types": "4.19.0",
-    "@smithy/signature-v4": "5.7.4",
-    "@smithy/fetch-http-handler": "5.8.0",
-    "@smithy/credential-provider-imds": "4.5.2",
-    "@smithy/core": "3.36.0",
-    "@smithy/node-http-handler": "4.12.1",
-    "bowser": "2.14.1",
-    "follow-redirects": "1.16.1",
-    "undici@>=5 <6": "5.29.0",
-    "undici@>=6 <7": "6.29.0",
-    "tslib@>=1 <2": "1.14.1",
-    "tslib@>=2 <3": "2.7.0",
-    "semver@>=5 <6": "5.7.2",
-    "semver@>=6 <7": "6.3.1",
-    "semver@>=7 <8": "7.8.5",
-    "ansi-regex@>=6 <7": "6.4.0"
-};
-// OZ's compiler adapter follows floating AWS/Smithy ranges. Freeze that reviewed
-// family closure so a fresh npm resolution cannot select unqualified payloads.
-// Other project dependencies keep their original constraints and payload checks.
-for (const key of Object.keys(compiler_dependency_pins_1.compilerDependencyPins)) {
-    if (!key.startsWith('@aws-sdk/') && !key.startsWith('@smithy/'))
-        continue;
-    const at = key.lastIndexOf('@'), name = key.slice(0, at), version = key.slice(at + 1);
-    const existing = exports.REVIEWED_DELIVERY_OVERRIDES[name];
-    if (existing && existing !== version)
-        throw new Error('Ambiguous reviewed compiler dependency: ' + name);
-    exports.REVIEWED_DELIVERY_OVERRIDES[name] = version;
-}
-//# sourceMappingURL=toolchain.js.map

package/dist-runtime/delivery/toolchain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"toolchain.js","sourceRoot":"","sources":["../../runtime/delivery/toolchain.ts"],"names":[],"mappings":";;;AAAA,yEAAoE;AAEpE;mHACmH;AACtG,QAAA,2BAA2B,GAA2B;IACjE,OAAO,EAAE,QAAQ;IACjB,wBAAwB,EAAE,UAAU;IACpC,eAAe,EAAE,SAAS;IAC1B,kCAAkC,EAAE,UAAU;IAC9C,mCAAmC,EAAE,UAAU;IAC/C,kCAAkC,EAAE,UAAU;IAC9C,oCAAoC,EAAE,UAAU;IAChD,mCAAmC,EAAE,UAAU;IAC/C,sCAAsC,EAAE,UAAU;IAClD,kCAAkC,EAAE,UAAU;IAC9C,2CAA2C,EAAE,UAAU;IACvD,yBAAyB,EAAE,UAAU;IACrC,oCAAoC,EAAE,UAAU;IAChD,0BAA0B,EAAE,UAAU;IACtC,gBAAgB,EAAE,SAAS;IAC3B,eAAe,EAAE,QAAQ;IACzB,sBAAsB,EAAE,OAAO;IAC/B,4BAA4B,EAAE,OAAO;IACrC,kCAAkC,EAAE,OAAO;IAC3C,cAAc,EAAE,QAAQ;IACxB,2BAA2B,EAAE,QAAQ;IACrC,QAAQ,EAAE,QAAQ;IAClB,kBAAkB,EAAE,QAAQ;IAC5B,eAAe,EAAE,QAAQ;IACzB,eAAe,EAAE,QAAQ;IACzB,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,OAAO;IACvB,eAAe,EAAE,OAAO;IACxB,eAAe,EAAE,OAAO;IACxB,eAAe,EAAE,OAAO;IACxB,mBAAmB,EAAE,OAAO;CAC7B,CAAC;AAEF,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,iDAAsB,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,SAAS;IAC1E,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,mCAA2B,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,IAAI,CAAC,CAAC;IACzG,mCAA2B,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;AAC9C,CAAC"}

package/runtime/delivery/toolchain.ts

@@ -1,48 +0,0 @@
-import { compilerDependencyPins } from './compiler-dependency-pins';
-
-/** Reviewed compiler adapter dependency selections; payload checks remain authoritative.
- * Range-scoped entries preserve distinct dependency majors. Setup never overrides a conflicting project choice. */
-export const REVIEWED_DELIVERY_OVERRIDES: Record<string, string> = {
-  "axios": "1.20.0",
-  "@aws-sdk/client-lambda": "3.1152.0",
-  "@aws-sdk/core": "3.978.3",
-  "@aws-sdk/credential-provider-env": "3.972.74",
-  "@aws-sdk/credential-provider-http": "3.972.76",
-  "@aws-sdk/credential-provider-ini": "3.973.19",
-  "@aws-sdk/credential-provider-login": "3.972.81",
-  "@aws-sdk/credential-provider-node": "3.972.86",
-  "@aws-sdk/credential-provider-process": "3.972.74",
-  "@aws-sdk/credential-provider-sso": "3.973.18",
-  "@aws-sdk/credential-provider-web-identity": "3.972.80",
-  "@aws-sdk/nested-clients": "3.997.48",
-  "@aws-sdk/signature-v4-multi-region": "3.996.48",
-  "@aws-sdk/token-providers": "3.1150.0",
-  "@aws-sdk/types": "3.974.6",
-  "@smithy/types": "4.19.0",
-  "@smithy/signature-v4": "5.7.4",
-  "@smithy/fetch-http-handler": "5.8.0",
-  "@smithy/credential-provider-imds": "4.5.2",
-  "@smithy/core": "3.36.0",
-  "@smithy/node-http-handler": "4.12.1",
-  "bowser": "2.14.1",
-  "follow-redirects": "1.16.1",
-  "undici@>=5 <6": "5.29.0",
-  "undici@>=6 <7": "6.29.0",
-  "tslib@>=1 <2": "1.14.1",
-  "tslib@>=2 <3": "2.7.0",
-  "semver@>=5 <6": "5.7.2",
-  "semver@>=6 <7": "6.3.1",
-  "semver@>=7 <8": "7.8.5",
-  "ansi-regex@>=6 <7": "6.4.0"
-};
-
-// OZ's compiler adapter follows floating AWS/Smithy ranges. Freeze that reviewed
-// family closure so a fresh npm resolution cannot select unqualified payloads.
-// Other project dependencies keep their original constraints and payload checks.
-for (const key of Object.keys(compilerDependencyPins)) {
-  if (!key.startsWith('@aws-sdk/') && !key.startsWith('@smithy/')) continue;
-  const at = key.lastIndexOf('@'), name = key.slice(0, at), version = key.slice(at + 1);
-  const existing = REVIEWED_DELIVERY_OVERRIDES[name];
-  if (existing && existing !== version) throw new Error('Ambiguous reviewed compiler dependency: ' + name);
-  REVIEWED_DELIVERY_OVERRIDES[name] = version;
-}