upgrade_runtime.js

#!/usr/bin/env node
/**
 * Runtime Upgrade Script for Bulletin Chain Networks
 *
 * Usage:
 *   node upgrade_runtime.js <seed> <wasm_path> [options]
 *   node upgrade_runtime.js --verify-only [--network <name>]
 *
 * Options:
 *   --network <name>   Network: westend, paseo (default: westend)
 *   --rpc <url>        Custom RPC endpoint (overrides network default)
 *   --method <type>    Upgrade method: setCode, authorize (default: based on network)
 *   --verify-only      Only verify current runtime version, don't upgrade
 *   (dry-run validation runs automatically before every upgrade)
 */

import { cryptoWaitReady, blake2AsU8a } from '@polkadot/util-crypto';
import { createClient } from 'polkadot-api';
import { getWsProvider } from 'polkadot-api/ws';
import { newSigner, toHex } from './common.js';
import fs from 'fs';

// --- Network configs ---

const NETWORKS = {
    westend: {
        rpc: 'wss://westend-bulletin-rpc.polkadot.io',
        method: 'sudo',
    },
    paseo: {
        rpc: 'wss://paseo-bulletin-rpc.polkadot.io',
        method: 'sudo',
    }
};

// --- Arg parsing ---

function parseArgs() {
    const args = process.argv.slice(2);
    const opts = {
        seed: null,
        wasmPath: null,
        network: 'westend',
        rpc: null,
        method: null,
        verifyOnly: false,
    };

    let i = 0;
    while (i < args.length) {
        const arg = args[i];
        if (arg === '--network' && args[i + 1])    { opts.network = args[++i]; }
        else if (arg === '--rpc' && args[i + 1])    { opts.rpc = args[++i]; }
        else if (arg === '--method' && args[i + 1]) { opts.method = args[++i]; }
        else if (arg === '--verify-only')            { opts.verifyOnly = true; }
        else if (arg.startsWith('--'))               { console.error(`Unknown option: ${arg}`); process.exit(1); }
        else if (!opts.seed)                         { opts.seed = arg; }
        else if (!opts.wasmPath)                     { opts.wasmPath = arg; }
        i++;
    }

    return opts;
}

function resolveNetwork(opts) {
    const net = NETWORKS[opts.network];
    if (!net && !opts.rpc) {
        console.error(`Unknown network: ${opts.network}. Available: ${Object.keys(NETWORKS).join(', ')}`);
        process.exit(1);
    }
    return {
        rpc: opts.rpc || net.rpc,
        method: opts.method || net?.method || 'sudo',
    };
}

// --- Chain queries ---

async function getChainInfo(client) {
    const unsafeApi = client.getUnsafeApi();
    const runtimeVersion = await unsafeApi.constants.System.Version();

    let lastUpgrade = null;
    try { lastUpgrade = await unsafeApi.query.System.LastRuntimeUpgrade(); } catch (_) {}

    return { runtimeVersion, lastUpgrade };
}

function printChainInfo({ runtimeVersion, lastUpgrade }) {
    console.log('\nRuntime Version:');
    console.log(`  spec_name:           ${runtimeVersion.spec_name}`);
    console.log(`  spec_version:        ${runtimeVersion.spec_version}`);
    console.log(`  impl_version:        ${runtimeVersion.impl_version}`);
    console.log(`  authoring_version:   ${runtimeVersion.authoring_version}`);
    console.log(`  transaction_version: ${runtimeVersion.transaction_version}`);

    if (lastUpgrade) {
        console.log('\nLast Runtime Upgrade:');
        console.log(`  spec_version: ${lastUpgrade.spec_version}`);
        console.log(`  spec_name:    ${lastUpgrade.spec_name}`);
    }
}

// --- Upgrade methods ---

async function upgradeWithSetCode(client, signer, wasmCode, signerAddress) {
    const unsafeApi = client.getUnsafeApi();

    const setCodeCall = unsafeApi.tx.System.set_code({
        code: wasmCode,
    }).decodedCall;

    const tx = unsafeApi.tx.Sudo.sudo({ call: setCodeCall });

    // Step 1: Mandatory dry-run validation
    console.log('\nStep 1: Dry-run validation...');
    try {
        const fees = await tx.getEstimatedFees(signerAddress);
        console.log(`  Estimated fees: ${fees}`);
        console.log('  Dry-run passed!');
    } catch (error) {
        throw new Error(`Dry-run failed, upgrade NOT submitted: ${error.message}`);
    }

    // Step 2: Submit
    console.log('\nStep 2: Submitting sudo.sudo(system.setCode)...');
    const result = await tx.signAndSubmit(signer);
    console.log(`Success! Block: ${result.block.hash}`);
}

async function upgradeWithAuthorize(client, signer, wasmCode, codeHash, signerAddress) {
    const unsafeApi = client.getUnsafeApi();
    const hashHex = toHex(codeHash);

    const authorizeCall = unsafeApi.tx.System.authorize_upgrade({
        code_hash: hashHex,
    }).decodedCall;

    let authorizeTx;
    try {
        authorizeTx = unsafeApi.tx.Sudo.sudo({ call: authorizeCall });
        console.log('  via sudo.sudo(system.authorize_upgrade)');
    } catch (_) {
        authorizeTx = unsafeApi.tx.System.authorize_upgrade({
            code_hash: hashHex,
        });
        console.log('  via system.authorize_upgrade (requires governance origin)');
    }

    // Step 1: Mandatory dry-run validation
    console.log(`\nStep 1: Dry-run validation for authorize_upgrade (hash: ${hashHex})...`);
    try {
        const fees = await authorizeTx.getEstimatedFees(signerAddress);
        console.log(`  Estimated fees: ${fees}`);
        console.log('  Dry-run passed!');
    } catch (error) {
        throw new Error(`Dry-run failed, upgrade NOT submitted: ${error.message}`);
    }

    // Step 2: Authorize (needs sudo or governance origin)
    console.log('\nStep 2: Submitting authorize_upgrade...');
    const result1 = await authorizeTx.signAndSubmit(signer);
    console.log(`  Authorized! Block: ${result1.block.hash}`);

    // Step 3: Apply as unsigned extrinsic (no signer/fees needed for the large WASM payload).
    // apply_authorized_upgrade supports ValidateUnsigned in the runtime.
    console.log('\nStep 3: Applying authorized upgrade (unsigned)...');
    const applyTx = unsafeApi.tx.System.apply_authorized_upgrade({
        code: wasmCode,
    });
    const bareExtrinsic = await applyTx.getBareTx();
    const result2 = await client.submit(bareExtrinsic);
    console.log(`  Applied! Block: ${result2.block.hash}`);
}

// --- Verify ---

async function verifyUpgrade(client, previousVersion, maxAttempts = 30, intervalMs = 12000) {
    console.log(`\nVerifying upgrade (waiting for version to change from ${previousVersion})...`);
    console.log(`Will poll every ${intervalMs / 1000}s for up to ${maxAttempts} attempts (~${(maxAttempts * intervalMs / 60000).toFixed(0)} minutes).`);
    console.log('On parachains, runtime upgrades are enacted after a delay of several blocks.\n');

    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
        await new Promise(resolve => setTimeout(resolve, intervalMs));

        const { runtimeVersion } = await getChainInfo(client);
        console.log(`  [${attempt}/${maxAttempts}] spec_version: ${runtimeVersion.spec_version}`);

        if (runtimeVersion.spec_version > previousVersion) {
            console.log(`\nUpgrade successful! Runtime upgraded from ${previousVersion} to ${runtimeVersion.spec_version}`);
            return;
        }
    }

    console.log(`\nWarning: spec_version is still ${previousVersion} after ${maxAttempts} attempts.`);
    console.log('The upgrade may still be pending enactment. Check manually with --verify-only.');
}

// --- Main ---

async function main() {
    const opts = parseArgs();
    const { rpc, method } = resolveNetwork(opts);

    // -- Verify-only mode --
    if (opts.verifyOnly) {
        console.log(`Connecting to ${rpc}...`);
        const client = createClient(getWsProvider(rpc));
        try {
            printChainInfo(await getChainInfo(client));
        } finally {
            client.destroy();
        }
        process.exit(0);
    }

    // -- Validate inputs --
    if (!opts.seed || !opts.wasmPath) {
        console.error('Missing required arguments: <seed> <wasm_path>');
        console.error('Run with --help or see script header for usage.');
        process.exit(1);
    }
    if (!fs.existsSync(opts.wasmPath)) {
        console.error(`WASM file not found: ${opts.wasmPath}`);
        process.exit(1);
    }

    // -- Prepare --
    await cryptoWaitReady();
    const { signer, address } = newSigner(opts.seed);
    const wasmCode = fs.readFileSync(opts.wasmPath);
    const codeHash = blake2AsU8a(wasmCode, 256);

    console.log(`Signer:   ${address}`);
    console.log(`WASM:     ${opts.wasmPath} (${(wasmCode.length / 1024 / 1024).toFixed(2)} MB)`);
    console.log(`Hash:     ${toHex(codeHash)}`);
    console.log(`Network:  ${opts.network} (${method})`);

    // -- Connect & upgrade --
    console.log(`\nConnecting to ${rpc}...`);
    const client = createClient(getWsProvider(rpc));

    try {
        const { runtimeVersion: current } = await getChainInfo(client);
        console.log(`Current runtime: ${current.spec_name} v${current.spec_version}`);

        if (method === 'setCode') {
            await upgradeWithSetCode(client, signer, wasmCode, address);
        } else {
            await upgradeWithAuthorize(client, signer, wasmCode, codeHash, address);
        }

        await verifyUpgrade(client, current.spec_version);
    } catch (error) {
        console.error('\nError:', error.message);
        if (error.cause) console.error('Cause:', error.cause);
        process.exit(1);
    } finally {
        client.destroy();
    }
}

main();