feat: prepare ENSv2 mainnet deployment

contracts/script/foundry/DeployDOSMainnet.s.sol

@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: MIT
+pragma solidity >=0.8.20;
+
+import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {IERC20Metadata} from "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";
+
+import {DeployDOS} from "./DeployDOS.s.sol";
+import {DeployDOSTestnet} from "./DeployDOSTestnet.s.sol";
+
+/// @title Deploy DOS Name Service on mainnet
+/// @notice Deploys the complete `.dos` ENSv2 stack against the canonical WDOS contract.
+contract DeployDOSMainnet is DeployDOSTestnet {
+    uint256 internal constant MAINNET_CHAIN_ID = 7979;
+    address internal constant MAINNET_DEPLOYER = 0x99999e454138f6be73E2bE82c890bc5765749999;
+    address internal constant MAINNET_OWNER = 0x310Bc061214ee89aF5CfB28a6ebF96c5436fa3CD;
+    uint8 internal constant MAINNET_WDOS_DECIMALS = 18;
+
+    error MainnetUnexpectedChain(uint256 actual, uint256 expected);
+    error MainnetUnexpectedDeployer(address actual, address expected);
+    error MainnetUnexpectedOwner(address actual, address expected);
+    error MainnetUnexpectedBeneficiary(address actual, address expected);
+    error MainnetInsufficientDeploymentBalance(uint256 actual, uint256 required);
+    error MissingPaymentTokenCode(address paymentToken);
+    error UnexpectedPaymentTokenDecimals(uint8 actual, uint8 expected);
+
+    /// @notice Contracts produced by the DOS mainnet deployment profile.
+    struct MainnetDeployment {
+        IERC20 paymentToken;
+        DeployDOS.Deployment names;
+    }
+
+    /// @notice Broadcasts the canonical Mainnet deployment using environment configuration.
+    /// @dev Required env: `PRIVATE_KEY`, `OWNER`. Optional env: `BENEFICIARY`.
+    function run() external override returns (Deployment memory deployment) {
+        uint256 privateKey = vm.envUint("PRIVATE_KEY");
+        address owner = vm.envAddress("OWNER");
+        address beneficiary = vm.envOr("BENEFICIARY", owner);
+        address broadcaster = vm.addr(privateKey);
+
+        preflightMainnet(broadcaster, owner, beneficiary, DEFAULT_WDOS);
+        vm.startBroadcast(privateKey);
+        MainnetDeployment memory mainnetDeployment =
+            deployMainnet(broadcaster, owner, beneficiary, IERC20(DEFAULT_WDOS), block.chainid);
+        vm.stopBroadcast();
+
+        deployment = mainnetDeployment.names;
+    }
+
+    /// @notice Fails before broadcasting if the Mainnet deployment configuration is not canonical.
+    function preflightMainnet(
+        address broadcaster,
+        address owner,
+        address beneficiary,
+        address paymentToken
+    )
+        public
+        view
+    {
+        if (block.chainid != MAINNET_CHAIN_ID) {
+            revert MainnetUnexpectedChain(block.chainid, MAINNET_CHAIN_ID);
+        }
+        if (broadcaster != MAINNET_DEPLOYER) {
+            revert MainnetUnexpectedDeployer(broadcaster, MAINNET_DEPLOYER);
+        }
+        if (owner != MAINNET_OWNER) {
+            revert MainnetUnexpectedOwner(owner, MAINNET_OWNER);
+        }
+        if (beneficiary != MAINNET_OWNER) {
+            revert MainnetUnexpectedBeneficiary(beneficiary, MAINNET_OWNER);
+        }
+        if (broadcaster.balance < MIN_DEPLOYMENT_BALANCE) {
+            revert MainnetInsufficientDeploymentBalance(broadcaster.balance, MIN_DEPLOYMENT_BALANCE);
+        }
+        if (paymentToken.code.length == 0) {
+            revert MissingPaymentTokenCode(paymentToken);
+        }
+        uint8 decimals = IERC20Metadata(paymentToken).decimals();
+        if (decimals != MAINNET_WDOS_DECIMALS) {
+            revert UnexpectedPaymentTokenDecimals(decimals, MAINNET_WDOS_DECIMALS);
+        }
+    }
+
+    /// @notice Deploys ENSv2 against an existing payment token and hands all control to the owner.
+    function deployMainnet(
+        address initialOwner,
+        address owner,
+        address beneficiary,
+        IERC20 paymentToken,
+        uint256 chainId
+    )
+        public
+        returns (MainnetDeployment memory deployment)
+    {
+        deployment.paymentToken = paymentToken;
+        deployment.names = deploy(initialOwner, beneficiary, paymentToken, chainId);
+        _registerBensSmokeName(deployment.names, initialOwner, owner, chainId);
+        _handoff(deployment.names, initialOwner, owner);
+    }
+}

contracts/script/foundry/DeployDOSTestnet.s.sol

@@ -44,7 +44,7 @@ contract DeployDOSTestnet is DeployDOS {
 
     /// @notice Broadcasts a testnet deployment using environment configuration.
     /// @dev Required env: `PRIVATE_KEY`, `OWNER`. Optional env: `BENEFICIARY`.
-    function run() external override returns (Deployment memory deployment) {
+    function run() external virtual override returns (Deployment memory deployment) {
         uint256 privateKey = vm.envUint("PRIVATE_KEY");
         address owner = vm.envAddress("OWNER");
         address beneficiary = vm.envOr("BENEFICIARY", owner);

contracts/script/foundry/Invoke-DeployDOSMainnet.ps1

@@ -0,0 +1,125 @@
+[CmdletBinding()]
+param(
+    [string]$RpcUrl = "https://main.doschain.com",
+    [switch]$Broadcast
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$expectedRpcUrl = "https://main.doschain.com"
+$expectedChainId = 7979
+$expectedGenesisHash = "0x3b5fbd6089c79e21843f16384316ad75de4951f8bb2d0f26e3ce12e984e2e82b"
+$expectedDeployer = "0x99999e454138f6be73e2be82c890bc5765749999"
+$expectedOwner = "0x310bc061214ee89af5cfb28a6ebf96c5436fa3cd"
+$expectedPaymentToken = "0x1111111111111111111111111111111111111111"
+$minimumBalanceWei = [System.Numerics.BigInteger]::Parse("1000000000000000000")
+
+function Resolve-FoundryCommand {
+    param([Parameter(Mandatory)][string]$Name)
+
+    $command = Get-Command $Name -ErrorAction SilentlyContinue
+    if ($null -ne $command) {
+        return $command.Source
+    }
+
+    $bundled = Join-Path $env:USERPROFILE ".foundry\bin\$Name.exe"
+    if (Test-Path -LiteralPath $bundled) {
+        return $bundled
+    }
+
+    throw "$Name was not found in PATH or the Foundry installation directory"
+}
+
+if ($RpcUrl.TrimEnd("/") -ne $expectedRpcUrl) {
+    throw "RPC URL must be $expectedRpcUrl"
+}
+if ([string]::IsNullOrWhiteSpace($env:PRIVATE_KEY)) {
+    throw "PRIVATE_KEY is required"
+}
+if ([string]::IsNullOrWhiteSpace($env:OWNER)) {
+    throw "OWNER is required"
+}
+
+$privateKey = $env:PRIVATE_KEY.Trim()
+if ($privateKey -match "^[0-9a-fA-F]{64}$") {
+    $privateKey = "0x$privateKey"
+}
+if ($privateKey -notmatch "^0x[0-9a-fA-F]{64}$") {
+    throw "PRIVATE_KEY must be a 32-byte hexadecimal value"
+}
+$env:PRIVATE_KEY = $privateKey
+
+$owner = $env:OWNER.Trim().ToLowerInvariant()
+$beneficiary = if ([string]::IsNullOrWhiteSpace($env:BENEFICIARY)) {
+    $env:OWNER
+} else {
+    $env:BENEFICIARY
+}
+$beneficiary = $beneficiary.Trim().ToLowerInvariant()
+if ($owner -ne $expectedOwner) {
+    throw "OWNER does not match the canonical DOS Names owner"
+}
+if ($beneficiary -ne $expectedOwner) {
+    throw "BENEFICIARY does not match the canonical DOS Names beneficiary"
+}
+$env:BENEFICIARY = $beneficiary
+
+$cast = Resolve-FoundryCommand -Name "cast"
+$forge = Resolve-FoundryCommand -Name "forge"
+
+$chainId = [int]((& $cast chain-id --rpc-url $RpcUrl).Trim())
+if ($LASTEXITCODE -ne 0 -or $chainId -ne $expectedChainId) {
+    throw "RPC chain ID does not match DOS Mainnet"
+}
+
+$genesis = (& $cast block 0 --rpc-url $RpcUrl --json | ConvertFrom-Json).hash.ToLowerInvariant()
+if ($LASTEXITCODE -ne 0 -or $genesis -ne $expectedGenesisHash) {
+    throw "RPC genesis hash does not match DOS Mainnet"
+}
+
+$paymentTokenCode = (& $cast code $expectedPaymentToken --rpc-url $RpcUrl).Trim()
+if ($LASTEXITCODE -ne 0 -or $paymentTokenCode -eq "0x" -or $paymentTokenCode -eq "0x0") {
+    throw "Canonical WDOS has no Mainnet bytecode"
+}
+$paymentTokenDecimals = [int]((& $cast call $expectedPaymentToken "decimals()(uint8)" --rpc-url $RpcUrl).Trim())
+if ($LASTEXITCODE -ne 0 -or $paymentTokenDecimals -ne 18) {
+    throw "Canonical WDOS must use 18 decimals"
+}
+
+$balanceOutput = & $cast balance $expectedDeployer --rpc-url $RpcUrl
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($balanceOutput)) {
+    throw "Unable to read the canonical deployer balance"
+}
+$balance = [System.Numerics.BigInteger]::Parse($balanceOutput.Trim())
+if ($balance -lt $minimumBalanceWei) {
+    throw "Canonical deployer balance is below the 1 DOS deployment floor"
+}
+
+$contractsRoot = Resolve-Path (Join-Path $PSScriptRoot "..\..")
+Push-Location $contractsRoot
+try {
+    & $forge script "script/foundry/DeployDOSMainnet.s.sol:DeployDOSMainnet" `
+        --rpc-url $RpcUrl `
+        --slow
+    if ($LASTEXITCODE -ne 0) {
+        throw "Foundry simulation failed"
+    }
+
+    if (-not $Broadcast) {
+        Write-Output "DOS_MAINNET_ENSV2_SIMULATION_OK"
+        return
+    }
+
+    & $forge script "script/foundry/DeployDOSMainnet.s.sol:DeployDOSMainnet" `
+        --rpc-url $RpcUrl `
+        --broadcast `
+        --slow
+    if ($LASTEXITCODE -ne 0) {
+        throw "Foundry broadcast failed"
+    }
+    Write-Output "DOS_MAINNET_ENSV2_BROADCAST_OK"
+}
+finally {
+    Pop-Location
+}

contracts/test/e2e/mainnetDeployWrapper.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "bun:test";
+import { resolve } from "node:path";
+
+const wrapperPath = resolve(
+  import.meta.dir,
+  "../../script/foundry/Invoke-DeployDOSMainnet.ps1",
+);
+
+describe("DOS Mainnet deployment wrapper", () => {
+  it("never passes the private key through process arguments", async () => {
+    const wrapper = await Bun.file(wrapperPath).text();
+
+    expect(wrapper).not.toContain("--private-key");
+    expect(wrapper).not.toContain("wallet address");
+    expect(wrapper).toContain('$env:PRIVATE_KEY = $privateKey');
+    expect(wrapper).toContain(
+      'forge script "script/foundry/DeployDOSMainnet.s.sol:DeployDOSMainnet"',
+    );
+  });
+});