feat(cli): add TokenBridge SetPauserAddresses and Sui ContractUpgrade…

.github/workflows/build.yml

@@ -81,7 +81,7 @@ jobs:
         with:
           node-version: "22"
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@8789b3e21e6c11b2697f5eb56eddae542f746c10 # v1.7.0
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
       - run: cd ethereum && make test-push0 && make test
 
   ethereum-upgrade:
@@ -94,7 +94,7 @@ jobs:
         with:
           node-version: "22"
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@8789b3e21e6c11b2697f5eb56eddae542f746c10 # v1.7.0
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
       - run: cd clients/js && make install
       - run: cd ethereum && make test-upgrade
 

clients/js/README.md

@@ -153,6 +153,9 @@ worm generate [command]
 Commands:
   worm generate registration                Generate registration VAA
   worm generate upgrade                     Generate contract upgrade VAA
+  worm generate set-pauser-addresses        Generate a token bridge
+                                            SetPauserAddresses VAA (whitepaper
+                                            0003)
   worm generate attestation                 Generate a token attestation VAA
   worm generate recover-chain-id            Generate a recover chain ID VAA
   worm generate                             Sets the default delivery provider

clients/js/src/algorand.ts

@@ -100,6 +100,8 @@ export async function execute_algorand(
         case "AttestMeta":
           console.log("Creating wrapped token");
           break;
+        case "SetPauserAddresses":
+          throw new Error("SetPauserAddresses not supported on algorand");
         case "TransferWithPayload":
           throw Error("Can't complete payload 3 transfer from CLI");
         default:

clients/js/src/aptos.ts

@@ -220,6 +220,8 @@ export async function execute_aptos(
           );
           break;
         }
+        case "SetPauserAddresses":
+          throw new Error("SetPauserAddresses not supported on aptos");
         case "TransferWithPayload":
           throw Error("Can't complete payload 3 transfer from CLI");
         default:

clients/js/src/chains/sei/submit.ts

@@ -116,6 +116,8 @@ export const submit = async (
         case "AttestMeta":
           console.log("Creating wrapped token");
           break;
+        case "SetPauserAddresses":
+          throw new Error("SetPauserAddresses not supported on sei");
         case "TransferWithPayload":
           throw Error("Can't complete payload 3 transfer from CLI");
         default:

clients/js/src/chains/sui/submit.ts

@@ -7,17 +7,22 @@ import {
 import { Payload, impossible } from "../../vaa";
 import {
   assertSuccess,
+  buildTokenBridgePackage,
   executeTransactionBlock,
   getOriginalPackageId,
   getPackageId,
   getProvider,
   getPublishedPackageId,
   getSigner,
   getUpgradeCapObjectId,
+  migrateTokenBridge,
   normalizeSuiAddress,
   registerChain,
   setMaxGasBudgetDevnet,
+  setPauserAddresses,
   SUI_CLOCK_OBJECT_ID,
+  upgradeTokenBridge,
+  waitForNewPackage,
 } from "./utils";
 import { SuiGrpcClient } from "@mysten/sui/grpc";
 import {
@@ -204,8 +209,64 @@ export const submit = async (
 
           break;
         }
-        case "ContractUpgrade":
-          throw new Error("ContractUpgrade not supported on Sui");
+        case "ContractUpgrade": {
+          console.log("Upgrading contract");
+          // On Sui the VAA authorizes a build digest, and the upgrade
+          // transaction itself carries the compiled bytecode — build the
+          // package locally and refuse to submit if it doesn't reproduce the
+          // authorized digest (the chain would reject it anyway).
+          const { modules, dependencies, digest } =
+            buildTokenBridgePackage(network);
+          const authorized = payload.address.replace(/^0x/, "");
+          if (digest.toString("hex") !== authorized) {
+            throw new Error(
+              `local build digest ${digest.toString(
+                "hex"
+              )} does not match the digest authorized by the VAA (${authorized}); ` +
+                "rebuild from the proposal's commit with the proposal's sui CLI version"
+            );
+          }
+          const oldPackage = await getPackageId(
+            client,
+            tokenBridgeStateObjectId
+          );
+          const tx = await upgradeTokenBridge(
+            client,
+            network,
+            vaa,
+            coreBridgeStateObjectId,
+            tokenBridgeStateObjectId,
+            modules,
+            dependencies
+          );
+          setMaxGasBudgetDevnet(network, tx);
+          const res = await executeTransactionBlock(signer, tx);
+          console.log(JSON.stringify(res));
+          assertSuccess(res, "Upgrade failed.");
+
+          // The upgrade only publishes the new package; it becomes active
+          // once migrate flips the version on the state object.
+          const newPackage = await waitForNewPackage(
+            client,
+            tokenBridgeStateObjectId,
+            oldPackage
+          );
+          console.log(`New package: ${newPackage}`);
+
+          console.log("Migrating");
+          const migrateTx = await migrateTokenBridge(
+            client,
+            network,
+            vaa,
+            coreBridgeStateObjectId,
+            tokenBridgeStateObjectId
+          );
+          setMaxGasBudgetDevnet(network, migrateTx);
+          const migrateRes = await executeTransactionBlock(signer, migrateTx);
+          console.log(JSON.stringify(migrateRes));
+          assertSuccess(migrateRes, "Migrate failed.");
+          break;
+        }
         case "RecoverChainId":
           throw new Error("RecoverChainId not supported on Sui");
         case "RegisterChain": {
@@ -222,6 +283,20 @@ export const submit = async (
           console.log(JSON.stringify(res));
           break;
         }
+        case "SetPauserAddresses": {
+          console.log("Setting pauser addresses");
+          const tx = await setPauserAddresses(
+            client,
+            network,
+            vaa,
+            coreBridgeStateObjectId,
+            tokenBridgeStateObjectId
+          );
+          setMaxGasBudgetDevnet(network, tx);
+          const res = await executeTransactionBlock(signer, tx);
+          console.log(JSON.stringify(res));
+          break;
+        }
         case "Transfer":
           throw new Error("Transfer not supported on Sui");
         case "TransferWithPayload":