deploy_mainnet.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
CONTRACT_DIR="${ROOT_DIR}/Stellar-contracts-v1"
CLI="${STELLAR_CLI:-stellar}"

NETWORK="${STELLAR_NETWORK:-mainnet}"
NETWORK_PASSPHRASE="${STELLAR_NETWORK_PASSPHRASE:-Public Global Stellar Network ; September 2015}"
SOURCE_ACCOUNT="${STELLAR_ACCOUNT:-${ADMIN_IDENTITY:-}}"
ADMIN_ADDRESS="${ADMIN_ADDRESS:-}"
RPC_URL="${STELLAR_RPC_URL:-}"
DEPLOY_AMM="${DEPLOY_AMM:-false}"

WPI_WASM="${WPI_WASM:-${CONTRACT_DIR}/target/wasm32-unknown-unknown/release/wpi_token.wasm}"

NETWORK_ARGS=(--network "$NETWORK" --rpc-url "$RPC_URL" --network-passphrase "$NETWORK_PASSPHRASE")

run() {
  echo "+ $*"
  "$@"
}

ensure_cli() {
  if ! command -v "$CLI" >/dev/null 2>&1; then
    echo "ERROR: Stellar CLI not found. Set STELLAR_CLI or install stellar-cli." >&2
    exit 1
  fi
}

require_mainnet_inputs() {
  if [[ "$DEPLOY_AMM" == "true" ]]; then
    echo "ERROR: mock-amm is test-only and must never be deployed to mainnet. Unset DEPLOY_AMM." >&2
    exit 1
  fi

  if [[ -z "$SOURCE_ACCOUNT" ]]; then
    echo "ERROR: set STELLAR_ACCOUNT or ADMIN_IDENTITY to the mainnet signing identity." >&2
    exit 1
  fi

  if [[ -z "$RPC_URL" ]]; then
    echo "ERROR: set STELLAR_RPC_URL to a mainnet Soroban RPC endpoint." >&2
    exit 1
  fi

  if [[ -z "$ADMIN_ADDRESS" ]]; then
    if "$CLI" keys address "$SOURCE_ACCOUNT" >/dev/null 2>&1; then
      ADMIN_ADDRESS="$("$CLI" keys address "$SOURCE_ACCOUNT")"
    else
      echo "ERROR: set ADMIN_ADDRESS when STELLAR_ACCOUNT is not a local Stellar CLI identity." >&2
      exit 1
    fi
  fi
}

build_contracts() {
  (
    cd "$CONTRACT_DIR"
    run rustup target add wasm32-unknown-unknown
    run cargo build --locked --target wasm32-unknown-unknown --release
    run bash scripts/verify_dependency_provenance.sh
  )
}

require_artifact() {
  local artifact="$1"
  if [[ ! -f "$artifact" ]]; then
    echo "ERROR: missing WASM artifact: ${artifact}" >&2
    exit 1
  fi
}

upload_wasm() {
  local label="$1"
  local wasm="$2"
  local hash
  echo "== Upload ${label} WASM ==" >&2
  require_artifact "$wasm"
  hash="$("$CLI" contract upload \
    --wasm "$wasm" \
    --source-account "$SOURCE_ACCOUNT" \
    "${NETWORK_ARGS[@]}" | tail -n 1)"
  echo "${label}_WASM_HASH=${hash}" >&2
  printf '%s' "$hash"
}

deploy_uploaded_wasm() {
  local label="$1"
  local wasm_hash="$2"
  local contract_id
  echo "== Deploy ${label} contract ==" >&2
  contract_id="$("$CLI" contract deploy \
    --wasm-hash "$wasm_hash" \
    --source-account "$SOURCE_ACCOUNT" \
    "${NETWORK_ARGS[@]}" | tail -n 1)"
  echo "${label}_CONTRACT_ID=${contract_id}" >&2
  printf '%s' "$contract_id"
}

invoke_contract() {
  local contract_id="$1"
  shift

  echo "== Invoke contract ${contract_id} ==" >&2
  "$CLI" contract invoke \
    --id "$contract_id" \
    --source-account "$SOURCE_ACCOUNT" \
    "${NETWORK_ARGS[@]}" \
    -- "$@"
}

ensure_cli
require_mainnet_inputs
build_contracts

echo "Mainnet signing identity configured."
echo "Admin address:  ${ADMIN_ADDRESS}"

WPI_HASH="$(upload_wasm WPI "$WPI_WASM")"
WPI_CONTRACT_ID="$(deploy_uploaded_wasm WPI "$WPI_HASH")"

echo "== Initialize wPI contract =="
invoke_contract "$WPI_CONTRACT_ID" initialize --admin "$ADMIN_ADDRESS"

cat <<EOF

Mainnet deployment complete.
export WPI_CONTRACT_ID=${WPI_CONTRACT_ID}
EOF