deploy.yml

name: Deploy Soroban Contracts

on:
  push:
    branches: [main]
    tags: ["v*"]

env:
  CARGO_INCREMENTAL: 0
  RUSTFLAGS: -D warnings

jobs:
  # -----------------------------------------------------------------------
  # Build optimised WASMs and record sizes
  # -----------------------------------------------------------------------
  build-wasm:
    name: Build & optimise WASMs
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: dabdub_contracts
    outputs:
      wasm-artifact: wasm-contracts-${{ github.sha }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32v1-none

      - name: Install wasm-opt
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y binaryen

      - name: Build release WASMs
        run: cargo build --target wasm32v1-none --release

      - name: Optimise with wasm-opt -Oz
        run: |
          for wasm in target/wasm32v1-none/release/*.wasm; do
            echo "Optimising $wasm"
            wasm-opt -Oz --output "$wasm" "$wasm"
          done

      - name: Enforce 64 KB WASM size limit
        run: |
          LIMIT=65536
          failed=0
          for wasm in target/wasm32v1-none/release/*.wasm; do
            size=$(wc -c < "$wasm")
            if [ "$size" -gt "$LIMIT" ]; then
              echo "FAIL  $wasm  ${size}B  (limit ${LIMIT}B)"
              failed=1
            else
              echo "OK    $wasm  ${size}B"
            fi
          done
          [ "$failed" -eq 0 ] || exit 1

      - name: Upload WASM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: wasm-contracts-${{ github.sha }}
          path: dabdub_contracts/target/wasm32v1-none/release/*.wasm
          retention-days: 30

  # -----------------------------------------------------------------------
  # Deploy to testnet on every merge to main
  # -----------------------------------------------------------------------
  deploy-testnet:
    name: Deploy to Testnet
    needs: build-wasm
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      admin_auth_id: ${{ steps.deploy.outputs.admin_auth_id }}
      admin_timelock_id: ${{ steps.deploy.outputs.admin_timelock_id }}
      batch_payments_id: ${{ steps.deploy.outputs.batch_payments_id }}
      fee_calculator_id: ${{ steps.deploy.outputs.fee_calculator_id }}
      fee_distributor_id: ${{ steps.deploy.outputs.fee_distributor_id }}
      liquidity_router_id: ${{ steps.deploy.outputs.liquidity_router_id }}
      merchant_registry_id: ${{ steps.deploy.outputs.merchant_registry_id }}
      multisig_admin_id: ${{ steps.deploy.outputs.multisig_admin_id }}
      payment_escrow_id: ${{ steps.deploy.outputs.payment_escrow_id }}
      payment_request_id: ${{ steps.deploy.outputs.payment_request_id }}
      platform_stats_id: ${{ steps.deploy.outputs.platform_stats_id }}
      rbac_access_id: ${{ steps.deploy.outputs.rbac_access_id }}
      reconciliation_id: ${{ steps.deploy.outputs.reconciliation_id }}
      settlement_ledger_id: ${{ steps.deploy.outputs.settlement_ledger_id }}
      slippage_protection_id: ${{ steps.deploy.outputs.slippage_protection_id }}
      stellar_confirmations_id: ${{ steps.deploy.outputs.stellar_confirmations_id }}
    steps:
      - uses: actions/checkout@v4

      - name: Download WASMs
        uses: actions/download-artifact@v4
        with:
          name: wasm-contracts-${{ github.sha }}
          path: wasm/

      - name: Install Stellar CLI
        run: |
          cargo install --locked stellar-cli --features opt

      - name: Configure testnet network
        run: |
          stellar network add testnet \
            --rpc-url https://soroban-testnet.stellar.org \
            --network-passphrase "Test SDF Network ; September 2015"

      - name: Import deploy keypair
        env:
          DEPLOY_SECRET: ${{ secrets.TESTNET_DEPLOY_SECRET }}
        run: echo "$DEPLOY_SECRET" | stellar keys add deployer --secret-key

      - name: Deploy contracts to testnet
        id: deploy
        env:
          DEPLOY_ADMIN: ${{ vars.TESTNET_DEPLOY_ADMIN }}
          RBAC_SUPER_ADMIN: ${{ vars.TESTNET_RBAC_SUPER_ADMIN }}
          XLM_TOKEN: ${{ vars.TESTNET_XLM_TOKEN }}
          USDC_TOKEN: ${{ vars.TESTNET_USDC_TOKEN }}
          TREASURY: ${{ vars.TESTNET_TREASURY }}
          LP_ADDRESS: ${{ vars.TESTNET_LP_ADDRESS }}
          LP_SHARE_BPS: ${{ vars.TESTNET_LP_SHARE_BPS }}
          FEE_TIERS: ${{ vars.TESTNET_FEE_TIERS }}
          MULTISIG_ADMIN_1: ${{ vars.TESTNET_MULTISIG_ADMIN_1 }}
          MULTISIG_ADMIN_2: ${{ vars.TESTNET_MULTISIG_ADMIN_2 }}
          MULTISIG_ADMIN_3: ${{ vars.TESTNET_MULTISIG_ADMIN_3 }}
          ESCROW_DEFAULT_TTL_LEDGERS: ${{ vars.TESTNET_ESCROW_DEFAULT_TTL_LEDGERS }}
          EMERGENCY_SIGNERS: ${{ vars.TESTNET_EMERGENCY_SIGNERS }}
          EMERGENCY_TREASURY: ${{ vars.TESTNET_EMERGENCY_TREASURY }}
          EMERGENCY_COOLDOWN_LEDGERS: ${{ vars.TESTNET_EMERGENCY_COOLDOWN_LEDGERS }}
          CONFIRMATION_COUNT: ${{ vars.TESTNET_CONFIRMATION_COUNT }}
          REGISTRY_ADDRESS: ${{ vars.TESTNET_REGISTRY_ADDRESS }}
          BATCH_PAYMENTS_MIN_AMOUNT: ${{ vars.TESTNET_BATCH_PAYMENTS_MIN_AMOUNT }}
          BATCH_PAYMENTS_MAX_AMOUNT: ${{ vars.TESTNET_BATCH_PAYMENTS_MAX_AMOUNT }}
        run: |
          set -euo pipefail

          # ------------------------------------------------------------------
          # Required configuration. Every contract with a `__constructor` needs
          # its arguments supplied here; a missing value is reported by name
          # rather than surfacing as an opaque CLI error mid-deploy.
          # ------------------------------------------------------------------
          require() {
            local var=$1
            if [ -z "${!var:-}" ]; then
              echo "::error::$var is not set — configure it in the repository's Actions variables"
              missing=1
            fi
          }

          missing=0
          require DEPLOY_ADMIN
          require RBAC_SUPER_ADMIN
          require XLM_TOKEN
          require USDC_TOKEN
          require TREASURY
          require LP_ADDRESS
          require LP_SHARE_BPS
          require FEE_TIERS
          require MULTISIG_ADMIN_1
          require MULTISIG_ADMIN_2
          require MULTISIG_ADMIN_3
          require ESCROW_DEFAULT_TTL_LEDGERS
          require EMERGENCY_SIGNERS
          require EMERGENCY_TREASURY
          require EMERGENCY_COOLDOWN_LEDGERS
          require CONFIRMATION_COUNT
          require BATCH_PAYMENTS_MIN_AMOUNT
          require BATCH_PAYMENTS_MAX_AMOUNT
          [ "$missing" -eq 0 ] || exit 1

          # ------------------------------------------------------------------
          # Deploy helper. Anything after the wasm path is forwarded to the
          # contract's constructor.
          # ------------------------------------------------------------------
          deploy_contract() {
            local name=$1
            local wasm=$2
            shift 2
            local id
            if [ "$#" -gt 0 ]; then
              id=$(stellar contract deploy \
                --wasm "$wasm" \
                --source deployer \
                --network testnet \
                -- "$@" 2>&1 | tail -1)
            else
              id=$(stellar contract deploy \
                --wasm "$wasm" \
                --source deployer \
                --network testnet 2>&1 | tail -1)
            fi
            echo "${name}_id=${id}" >> "$GITHUB_OUTPUT"
            echo "Deployed $name: $id"
            # Echoed into the environment so a later contract can point at it.
            printf -v "${name}_id" '%s' "$id"
          }

          # --- no constructor ------------------------------------------------
          deploy_contract liquidity_router      wasm/liquidity_router.wasm
          deploy_contract payment_request       wasm/payment_request.wasm

          # liquidity_router doesn't use Soroban's `__constructor` convention,
          # so its one-time admin setup has to be invoked as a separate call
          # right after deploy — otherwise the instance sits with no
          # DataKey::Admin set until someone calls `initialize` out-of-band.
          stellar contract invoke \
            --id "$liquidity_router_id" \
            --source deployer \
            --network testnet \
            -- initialize \
            --admin "$DEPLOY_ADMIN"

          # --- no constructor, but has a required one-time init() -----------
          # batch_payments has no __constructor; its storage (admin, min/max
          # amount limits) is only set up by calling init() after deploy. Skip
          # this and every create_batch/set_limits/get_limits call panics with
          # "contract not initialized".
          deploy_contract batch_payments        wasm/batch_payments.wasm
          stellar contract invoke \
            --id "$batch_payments_id" \
            --source deployer \
            --network testnet \
            -- init \
            --admin "$DEPLOY_ADMIN" \
            --min_amount "$BATCH_PAYMENTS_MIN_AMOUNT" \
            --max_amount "$BATCH_PAYMENTS_MAX_AMOUNT"

          # --- admin only ----------------------------------------------------
          deploy_contract admin_auth            wasm/admin_auth.wasm \
            --super_admin "$DEPLOY_ADMIN"
          deploy_contract admin_timelock        wasm/admin_timelock.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract merchant_registry     wasm/merchant_registry.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract reconciliation        wasm/reconciliation.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract settlement_ledger     wasm/settlement_ledger.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract slippage_protection   wasm/slippage_protection.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract rbac_access           wasm/rbac_access.wasm \
            --super_admin "$RBAC_SUPER_ADMIN"
          deploy_contract platform_stats        wasm/platform_stats.wasm \
            --admin "$DEPLOY_ADMIN"

          # --- multi-argument constructors -----------------------------------
          deploy_contract stellar_confirmations wasm/stellar_confirmations.wasm \
            --admin "$DEPLOY_ADMIN" \
            --confirmation_count "$CONFIRMATION_COUNT"

          deploy_contract multisig_admin        wasm/multisig_admin.wasm \
            --admin1 "$MULTISIG_ADMIN_1" \
            --admin2 "$MULTISIG_ADMIN_2" \
            --admin3 "$MULTISIG_ADMIN_3"

          # FEE_TIERS is a JSON array of FeeTier structs.
          deploy_contract fee_calculator        wasm/fee_calculator.wasm \
            --admin "$DEPLOY_ADMIN" \
            --tiers "$FEE_TIERS"

          deploy_contract fee_distributor       wasm/fee_distributor.wasm \
            --admin "$DEPLOY_ADMIN" \
            --treasury "$TREASURY" \
            --lp_address "$LP_ADDRESS" \
            --lp_share_bps "$LP_SHARE_BPS" \
            --usdc_token "$USDC_TOKEN"

          # payment_escrow takes an Option<Address> registry. Default it to the
          # merchant_registry just deployed, so the two are wired together in
          # one run instead of needing a follow-up call; REGISTRY_ADDRESS
          # overrides that when pointing at an already-deployed registry.
          # EMERGENCY_SIGNERS is a JSON array of addresses.
          deploy_contract payment_escrow        wasm/payment_escrow.wasm \
            --admin "$DEPLOY_ADMIN" \
            --xlm_token "$XLM_TOKEN" \
            --usdc_token "$USDC_TOKEN" \
            --default_ttl_ledgers "$ESCROW_DEFAULT_TTL_LEDGERS" \
            --registry "${REGISTRY_ADDRESS:-$merchant_registry_id}" \
            --emergency_signers "$EMERGENCY_SIGNERS" \
            --emergency_treasury "$EMERGENCY_TREASURY" \
            --emergency_cooldown_ledgers "$EMERGENCY_COOLDOWN_LEDGERS"

      - name: Summary
        run: |
          echo "### Testnet contract IDs" >> "$GITHUB_STEP_SUMMARY"
          echo "| Contract | ID |" >> "$GITHUB_STEP_SUMMARY"
          echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
          echo "| admin_auth | ${{ steps.deploy.outputs.admin_auth_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| admin_timelock | ${{ steps.deploy.outputs.admin_timelock_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| batch_payments | ${{ steps.deploy.outputs.batch_payments_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| fee_calculator | ${{ steps.deploy.outputs.fee_calculator_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| fee_distributor | ${{ steps.deploy.outputs.fee_distributor_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| liquidity_router | ${{ steps.deploy.outputs.liquidity_router_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| merchant_registry | ${{ steps.deploy.outputs.merchant_registry_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| multisig_admin | ${{ steps.deploy.outputs.multisig_admin_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| payment_escrow | ${{ steps.deploy.outputs.payment_escrow_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| payment_request | ${{ steps.deploy.outputs.payment_request_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| platform_stats | ${{ steps.deploy.outputs.platform_stats_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| rbac_access | ${{ steps.deploy.outputs.rbac_access_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| reconciliation | ${{ steps.deploy.outputs.reconciliation_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| settlement_ledger | ${{ steps.deploy.outputs.settlement_ledger_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| slippage_protection | ${{ steps.deploy.outputs.slippage_protection_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| stellar_confirmations | ${{ steps.deploy.outputs.stellar_confirmations_id }} |" >> "$GITHUB_STEP_SUMMARY"

  # -----------------------------------------------------------------------
  # Deploy to mainnet on version tags — requires manual approval
  # -----------------------------------------------------------------------
  deploy-mainnet:
    name: Deploy to Mainnet
    needs: build-wasm
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    environment:
      name: mainnet
      url: https://stellar.expert/explorer/public
    steps:
      - uses: actions/checkout@v4

      - name: Download WASMs
        uses: actions/download-artifact@v4
        with:
          name: wasm-contracts-${{ github.sha }}
          path: wasm/

      - name: Install Stellar CLI
        run: cargo install --locked stellar-cli --features opt

      - name: Configure mainnet network
        run: |
          stellar network add mainnet \
            --rpc-url https://soroban-mainnet.stellar.org \
            --network-passphrase "Public Global Stellar Network ; September 2015"

      - name: Import deploy keypair
        env:
          DEPLOY_SECRET: ${{ secrets.MAINNET_DEPLOY_SECRET }}
        run: echo "$DEPLOY_SECRET" | stellar keys add deployer --secret-key

      - name: Deploy contracts to mainnet
        id: deploy
        env:
          DEPLOY_ADMIN: ${{ vars.MAINNET_DEPLOY_ADMIN }}
          RBAC_SUPER_ADMIN: ${{ vars.MAINNET_RBAC_SUPER_ADMIN }}
          XLM_TOKEN: ${{ vars.MAINNET_XLM_TOKEN }}
          USDC_TOKEN: ${{ vars.MAINNET_USDC_TOKEN }}
          TREASURY: ${{ vars.MAINNET_TREASURY }}
          LP_ADDRESS: ${{ vars.MAINNET_LP_ADDRESS }}
          LP_SHARE_BPS: ${{ vars.MAINNET_LP_SHARE_BPS }}
          FEE_TIERS: ${{ vars.MAINNET_FEE_TIERS }}
          MULTISIG_ADMIN_1: ${{ vars.MAINNET_MULTISIG_ADMIN_1 }}
          MULTISIG_ADMIN_2: ${{ vars.MAINNET_MULTISIG_ADMIN_2 }}
          MULTISIG_ADMIN_3: ${{ vars.MAINNET_MULTISIG_ADMIN_3 }}
          ESCROW_DEFAULT_TTL_LEDGERS: ${{ vars.MAINNET_ESCROW_DEFAULT_TTL_LEDGERS }}
          EMERGENCY_SIGNERS: ${{ vars.MAINNET_EMERGENCY_SIGNERS }}
          EMERGENCY_TREASURY: ${{ vars.MAINNET_EMERGENCY_TREASURY }}
          EMERGENCY_COOLDOWN_LEDGERS: ${{ vars.MAINNET_EMERGENCY_COOLDOWN_LEDGERS }}
          CONFIRMATION_COUNT: ${{ vars.MAINNET_CONFIRMATION_COUNT }}
          REGISTRY_ADDRESS: ${{ vars.MAINNET_REGISTRY_ADDRESS }}
          BATCH_PAYMENTS_MIN_AMOUNT: ${{ vars.MAINNET_BATCH_PAYMENTS_MIN_AMOUNT }}
          BATCH_PAYMENTS_MAX_AMOUNT: ${{ vars.MAINNET_BATCH_PAYMENTS_MAX_AMOUNT }}
        run: |
          set -euo pipefail

          # ------------------------------------------------------------------
          # Required configuration. Every contract with a `__constructor` needs
          # its arguments supplied here; a missing value is reported by name
          # rather than surfacing as an opaque CLI error mid-deploy.
          # ------------------------------------------------------------------
          require() {
            local var=$1
            if [ -z "${!var:-}" ]; then
              echo "::error::$var is not set — configure it in the repository's Actions variables"
              missing=1
            fi
          }

          missing=0
          require DEPLOY_ADMIN
          require RBAC_SUPER_ADMIN
          require XLM_TOKEN
          require USDC_TOKEN
          require TREASURY
          require LP_ADDRESS
          require LP_SHARE_BPS
          require FEE_TIERS
          require MULTISIG_ADMIN_1
          require MULTISIG_ADMIN_2
          require MULTISIG_ADMIN_3
          require ESCROW_DEFAULT_TTL_LEDGERS
          require EMERGENCY_SIGNERS
          require EMERGENCY_TREASURY
          require EMERGENCY_COOLDOWN_LEDGERS
          require CONFIRMATION_COUNT
          require BATCH_PAYMENTS_MIN_AMOUNT
          require BATCH_PAYMENTS_MAX_AMOUNT
          [ "$missing" -eq 0 ] || exit 1

          # ------------------------------------------------------------------
          # Deploy helper. Anything after the wasm path is forwarded to the
          # contract's constructor.
          # ------------------------------------------------------------------
          deploy_contract() {
            local name=$1
            local wasm=$2
            shift 2
            local id
            if [ "$#" -gt 0 ]; then
              id=$(stellar contract deploy \
                --wasm "$wasm" \
                --source deployer \
                --network mainnet \
                -- "$@" 2>&1 | tail -1)
            else
              id=$(stellar contract deploy \
                --wasm "$wasm" \
                --source deployer \
                --network mainnet 2>&1 | tail -1)
            fi
            echo "${name}_id=${id}" >> "$GITHUB_OUTPUT"
            echo "Deployed $name: $id"
            # Echoed into the environment so a later contract can point at it.
            printf -v "${name}_id" '%s' "$id"
          }

          # --- no constructor ------------------------------------------------
          deploy_contract liquidity_router      wasm/liquidity_router.wasm
          deploy_contract payment_request       wasm/payment_request.wasm

          # liquidity_router doesn't use Soroban's `__constructor` convention,
          # so its one-time admin setup has to be invoked as a separate call
          # right after deploy — otherwise the instance sits with no
          # DataKey::Admin set until someone calls `initialize` out-of-band.
          stellar contract invoke \
            --id "$liquidity_router_id" \
            --source deployer \
            --network mainnet \
            -- initialize \
            --admin "$DEPLOY_ADMIN"

          # --- no constructor, but has a required one-time init() -----------
          # batch_payments has no __constructor; its storage (admin, min/max
          # amount limits) is only set up by calling init() after deploy. Skip
          # this and every create_batch/set_limits/get_limits call panics with
          # "contract not initialized".
          deploy_contract batch_payments        wasm/batch_payments.wasm
          stellar contract invoke \
            --id "$batch_payments_id" \
            --source deployer \
            --network mainnet \
            -- init \
            --admin "$DEPLOY_ADMIN" \
            --min_amount "$BATCH_PAYMENTS_MIN_AMOUNT" \
            --max_amount "$BATCH_PAYMENTS_MAX_AMOUNT"

          # --- admin only ----------------------------------------------------
          deploy_contract admin_auth            wasm/admin_auth.wasm \
            --super_admin "$DEPLOY_ADMIN"
          deploy_contract admin_timelock        wasm/admin_timelock.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract merchant_registry     wasm/merchant_registry.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract reconciliation        wasm/reconciliation.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract settlement_ledger     wasm/settlement_ledger.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract slippage_protection   wasm/slippage_protection.wasm \
            --admin "$DEPLOY_ADMIN"
          deploy_contract rbac_access           wasm/rbac_access.wasm \
            --super_admin "$RBAC_SUPER_ADMIN"
          deploy_contract platform_stats        wasm/platform_stats.wasm \
            --admin "$DEPLOY_ADMIN"

          # --- multi-argument constructors -----------------------------------
          deploy_contract stellar_confirmations wasm/stellar_confirmations.wasm \
            --admin "$DEPLOY_ADMIN" \
            --confirmation_count "$CONFIRMATION_COUNT"

          deploy_contract multisig_admin        wasm/multisig_admin.wasm \
            --admin1 "$MULTISIG_ADMIN_1" \
            --admin2 "$MULTISIG_ADMIN_2" \
            --admin3 "$MULTISIG_ADMIN_3"

          # FEE_TIERS is a JSON array of FeeTier structs.
          deploy_contract fee_calculator        wasm/fee_calculator.wasm \
            --admin "$DEPLOY_ADMIN" \
            --tiers "$FEE_TIERS"

          deploy_contract fee_distributor       wasm/fee_distributor.wasm \
            --admin "$DEPLOY_ADMIN" \
            --treasury "$TREASURY" \
            --lp_address "$LP_ADDRESS" \
            --lp_share_bps "$LP_SHARE_BPS" \
            --usdc_token "$USDC_TOKEN"

          # payment_escrow takes an Option<Address> registry. Default it to the
          # merchant_registry just deployed, so the two are wired together in
          # one run instead of needing a follow-up call; REGISTRY_ADDRESS
          # overrides that when pointing at an already-deployed registry.
          # EMERGENCY_SIGNERS is a JSON array of addresses.
          deploy_contract payment_escrow        wasm/payment_escrow.wasm \
            --admin "$DEPLOY_ADMIN" \
            --xlm_token "$XLM_TOKEN" \
            --usdc_token "$USDC_TOKEN" \
            --default_ttl_ledgers "$ESCROW_DEFAULT_TTL_LEDGERS" \
            --registry "${REGISTRY_ADDRESS:-$merchant_registry_id}" \
            --emergency_signers "$EMERGENCY_SIGNERS" \
            --emergency_treasury "$EMERGENCY_TREASURY" \
            --emergency_cooldown_ledgers "$EMERGENCY_COOLDOWN_LEDGERS"

      - name: Summary
        run: |
          echo "### Mainnet contract IDs (${{ github.ref_name }})" >> "$GITHUB_STEP_SUMMARY"
          echo "| Contract | ID |" >> "$GITHUB_STEP_SUMMARY"
          echo "|---|---|" >> "$GITHUB_STEP_SUMMARY"
          echo "| admin_auth | ${{ steps.deploy.outputs.admin_auth_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| admin_timelock | ${{ steps.deploy.outputs.admin_timelock_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| batch_payments | ${{ steps.deploy.outputs.batch_payments_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| fee_calculator | ${{ steps.deploy.outputs.fee_calculator_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| fee_distributor | ${{ steps.deploy.outputs.fee_distributor_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| liquidity_router | ${{ steps.deploy.outputs.liquidity_router_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| merchant_registry | ${{ steps.deploy.outputs.merchant_registry_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| multisig_admin | ${{ steps.deploy.outputs.multisig_admin_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| payment_escrow | ${{ steps.deploy.outputs.payment_escrow_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| payment_request | ${{ steps.deploy.outputs.payment_request_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| platform_stats | ${{ steps.deploy.outputs.platform_stats_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| rbac_access | ${{ steps.deploy.outputs.rbac_access_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| reconciliation | ${{ steps.deploy.outputs.reconciliation_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| settlement_ledger | ${{ steps.deploy.outputs.settlement_ledger_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| slippage_protection | ${{ steps.deploy.outputs.slippage_protection_id }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| stellar_confirmations | ${{ steps.deploy.outputs.stellar_confirmations_id }} |" >> "$GITHUB_STEP_SUMMARY"

      # `stellar contract deploy` installs the WASM and creates a *new* contract
      # instance with a *new* ID. It does not touch the live contract, so the
      # previous wording here described deploying an empty orphan while the
      # contract holding every open escrow kept running the bad code.
      - name: Rollback procedure reminder
        run: |
          cat <<'ROLLBACK'
          ================================ ROLLBACK ================================

          Do NOT use `stellar contract deploy` to roll back. It creates a NEW
          contract with a NEW ID and empty storage; the live contract — holding
          every open escrow, the admin address and the registry pointer — keeps
          running the bad code, and every service still points at it.

          payment_escrow (in-place, preserves contract ID and storage)
          ---------------------------------------------------------------------
          1. Install the previous release WASM to get its hash:

               stellar contract install \
                 --wasm <prev-release>/payment_escrow.wasm \
                 --source deployer \
                 --network mainnet

          2. Invoke the contract's own upgrade entrypoint with that hash:

               stellar contract invoke \
                 --id <LIVE_PAYMENT_ESCROW_ID> \
                 --source deployer \
                 --network mainnet \
                 -- upgrade \
                 --caller <ADMIN_ADDRESS> \
                 --new_wasm_hash <PREV_WASM_HASH>

             `upgrade` is admin-only. If the admin is a multisig, the
             transaction needs the required signatures.

          3. Confirm the swap landed:

               stellar contract invoke --id <LIVE_PAYMENT_ESCROW_ID> \
                 --network mainnet -- get_version

             `get_version` increments on every upgrade, including a downgrade —
             it counts upgrades, it does not name the code version. Verify
             against the WASM hash on-chain, not this number.

          Every other contract — no in-place path
          ---------------------------------------------------------------------
          payment_escrow is the only contract in this workspace that implements
          `upgrade`. The other 13 have no `update_current_contract_wasm`
          entrypoint, so there is no way to swap their code in place. Rolling
          one back means deploying the previous WASM as a new contract and then
          repointing everything that references the old ID:

            - merchant_registry's registry pointer in payment_escrow
              (`set_registry`)
            - the NestJS backend's configured contract addresses
            - any other contract holding the old ID

          Storage does NOT carry over. Treat this as a migration, not a
          rollback, and plan it as one.

          Previous WASM artifacts are retained for 30 days in GitHub Actions.

          See docs/escrow_upgrade_procedure.md and
          dabdub_contracts/contracts/payment_escrow/EMERGENCY_RUNBOOK.md.
          ==========================================================================
          ROLLBACK