feat(deploy): hydrate LibProdDeployV4 + add V4 suites to Deploy.sol

.github/workflows/manual-sol-artifacts.yaml

@@ -7,20 +7,45 @@ on:
         required: true
         type: choice
         options:
+          # ===================================================================
+          # V4 (rain.vats 0.1.6 — audited build). Deploy these in the listed
+          # order; later entries reference earlier ones via dependency pointers
+          # so an out-of-order run trips the dep-codehash check.
+          # ===================================================================
           # 1. Implementations (no dependencies, deploy first)
+          - stox-receipt-v4
+          - stox-receipt-vault-v4
+          - stox-wrapped-token-vault-v4
+          # 2. Beacon (depends on stox-wrapped-token-vault-v4)
+          - stox-wrapped-token-vault-beacon-v4
+          # 3. Deployers (depend on their beacons/implementations)
+          - stox-wrapped-token-vault-beacon-set-deployer-v4
+          - stox-offchain-asset-receipt-vault-beacon-set-deployer-v4
+          # 4. Unified deployer (depends on the two set-deployers above)
+          - stox-unified-deployer-v4
+          # 5. Authorizers (no on-chain dependencies)
+          - stox-offchain-asset-receipt-vault-authorizer-v1-v4
+          - stox-offchain-asset-receipt-vault-payment-mint-authorizer-v1-v4
+          # 6. Corporate-actions facet (no on-chain dependencies — the
+          #    receipt-vault impl hardcodes its address but doesn't link to it
+          #    at deploy time).
+          - stox-corporate-actions-facet-v4
+          # ===================================================================
+          # Pre-V4 / pre-audit entries — retained so a historical re-run is
+          # still possible (e.g. to deploy on a fresh network using the V2/V3
+          # snapshot for chain-history parity). Do NOT use these for the
+          # current rain.vats 0.1.6 build.
+          # ===================================================================
           - stox-receipt
           - stox-receipt-vault
           - stox-wrapped-token-vault
-          # 2. Beacon (depends on stox-wrapped-token-vault)
           - stox-wrapped-token-vault-beacon
-          # 3. Deployers (depend on their beacons/implementations)
           - stox-wrapped-token-vault-beacon-set-deployer
           - stox-offchain-asset-receipt-vault-beacon-set-deployer
-          # 4. Unified deployer (no on-chain dependencies)
           - stox-unified-deployer
-          # 5. Authorizers (no on-chain dependencies)
           - stox-offchain-asset-receipt-vault-authorizer-v1
           - stox-offchain-asset-receipt-vault-payment-mint-authorizer-v1
+          - stox-corporate-actions-facet
 jobs:
   deploy:
     uses: rainlanguage/rainix/.github/workflows/rainix-manual-sol-artifacts.yaml@main

script/Deploy.sol

@@ -7,6 +7,7 @@ import {Script, console2} from "forge-std-1.16.1/src/Script.sol";
 import {LibRainDeploy} from "rain-deploy-0.1.3/src/lib/LibRainDeploy.sol";
 import {LibProdDeployV2} from "../src/lib/LibProdDeployV2.sol";
 import {LibProdDeployV3} from "../src/lib/LibProdDeployV3.sol";
+import {LibProdDeployV4} from "../src/lib/LibProdDeployV4.sol";
 import {StoxReceipt} from "../src/concrete/StoxReceipt.sol";
 import {StoxReceiptVault} from "../src/concrete/StoxReceiptVault.sol";
 import {StoxWrappedTokenVault} from "../src/concrete/StoxWrappedTokenVault.sol";
@@ -47,6 +48,30 @@ bytes32 constant DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_PAYMENT_MINT
     keccak256("stox-offchain-asset-receipt-vault-payment-mint-authorizer-v1");
 bytes32 constant DEPLOYMENT_SUITE_STOX_CORPORATE_ACTIONS_FACET = keccak256("stox-corporate-actions-facet");
 
+// =============================================================================
+// V4 (rain.vats 0.1.6) suite ids. Re-deploy every ST0x contract whose source
+// or dependency tree changed under the rain.vats bump. Each suite asserts
+// against the corresponding `LibProdDeployV4` pin so a mid-deploy bytecode
+// drift trips the codehash check before broadcast. Keep the v2/v3 entries
+// above untouched — re-running a historical suite (e.g. for a fresh network)
+// must remain possible.
+// =============================================================================
+
+bytes32 constant DEPLOYMENT_SUITE_STOX_RECEIPT_V4 = keccak256("stox-receipt-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_RECEIPT_VAULT_V4 = keccak256("stox-receipt-vault-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_WRAPPED_TOKEN_VAULT_V4 = keccak256("stox-wrapped-token-vault-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_WRAPPED_TOKEN_VAULT_BEACON_V4 = keccak256("stox-wrapped-token-vault-beacon-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_WRAPPED_TOKEN_VAULT_BEACON_SET_DEPLOYER_V4 =
+    keccak256("stox-wrapped-token-vault-beacon-set-deployer-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_BEACON_SET_DEPLOYER_V4 =
+    keccak256("stox-offchain-asset-receipt-vault-beacon-set-deployer-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_UNIFIED_DEPLOYER_V4 = keccak256("stox-unified-deployer-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_AUTHORIZER_V1_V4 =
+    keccak256("stox-offchain-asset-receipt-vault-authorizer-v1-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_PAYMENT_MINT_AUTHORIZER_V1_V4 =
+    keccak256("stox-offchain-asset-receipt-vault-payment-mint-authorizer-v1-v4");
+bytes32 constant DEPLOYMENT_SUITE_STOX_CORPORATE_ACTIONS_FACET_V4 = keccak256("stox-corporate-actions-facet-v4");
+
 contract Deploy is Script {
     mapping(string => mapping(address => bytes32)) internal depCodeHashes;
 
@@ -199,6 +224,96 @@ contract Deploy is Script {
                 LibProdDeployV3.STOX_CORPORATE_ACTIONS_FACET_CODEHASH,
                 noDeps
             );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_RECEIPT_V4) {
+            deploySuite(
+                type(StoxReceipt).creationCode,
+                "src/concrete/StoxReceipt.sol:StoxReceipt",
+                LibProdDeployV4.STOX_RECEIPT_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_RECEIPT_CODEHASH_RAIN_VATS_0_1_6,
+                noDeps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_RECEIPT_VAULT_V4) {
+            deploySuite(
+                type(StoxReceiptVault).creationCode,
+                "src/concrete/StoxReceiptVault.sol:StoxReceiptVault",
+                LibProdDeployV4.STOX_RECEIPT_VAULT_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_RECEIPT_VAULT_CODEHASH_RAIN_VATS_0_1_6,
+                noDeps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_WRAPPED_TOKEN_VAULT_V4) {
+            deploySuite(
+                type(StoxWrappedTokenVault).creationCode,
+                "src/concrete/StoxWrappedTokenVault.sol:StoxWrappedTokenVault",
+                LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_CODEHASH_RAIN_VATS_0_1_6,
+                noDeps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_WRAPPED_TOKEN_VAULT_BEACON_V4) {
+            address[] memory deps = new address[](1);
+            deps[0] = LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_RAIN_VATS_0_1_6;
+            deploySuite(
+                type(StoxWrappedTokenVaultBeacon).creationCode,
+                "src/concrete/StoxWrappedTokenVaultBeacon.sol:StoxWrappedTokenVaultBeacon",
+                LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_BEACON_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_BEACON_CODEHASH_RAIN_VATS_0_1_6,
+                deps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_WRAPPED_TOKEN_VAULT_BEACON_SET_DEPLOYER_V4) {
+            address[] memory deps = new address[](1);
+            deps[0] = LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_BEACON_RAIN_VATS_0_1_6;
+            deploySuite(
+                type(StoxWrappedTokenVaultBeaconSetDeployer).creationCode,
+                "src/concrete/deploy/StoxWrappedTokenVaultBeaconSetDeployer.sol:StoxWrappedTokenVaultBeaconSetDeployer",
+                LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_BEACON_SET_DEPLOYER_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_BEACON_SET_DEPLOYER_CODEHASH_RAIN_VATS_0_1_6,
+                deps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_BEACON_SET_DEPLOYER_V4) {
+            address[] memory deps = new address[](2);
+            deps[0] = LibProdDeployV4.STOX_RECEIPT_RAIN_VATS_0_1_6;
+            deps[1] = LibProdDeployV4.STOX_RECEIPT_VAULT_RAIN_VATS_0_1_6;
+            deploySuite(
+                type(StoxOffchainAssetReceiptVaultBeaconSetDeployer).creationCode,
+                "src/concrete/deploy/StoxOffchainAssetReceiptVaultBeaconSetDeployer.sol:StoxOffchainAssetReceiptVaultBeaconSetDeployer",
+                LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_BEACON_SET_DEPLOYER_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_BEACON_SET_DEPLOYER_CODEHASH_RAIN_VATS_0_1_6,
+                deps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_UNIFIED_DEPLOYER_V4) {
+            address[] memory deps = new address[](2);
+            deps[0] = LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_BEACON_SET_DEPLOYER_RAIN_VATS_0_1_6;
+            deps[1] = LibProdDeployV4.STOX_WRAPPED_TOKEN_VAULT_BEACON_SET_DEPLOYER_RAIN_VATS_0_1_6;
+            deploySuite(
+                type(StoxUnifiedDeployer).creationCode,
+                "src/concrete/deploy/StoxUnifiedDeployer.sol:StoxUnifiedDeployer",
+                LibProdDeployV4.STOX_UNIFIED_DEPLOYER_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_UNIFIED_DEPLOYER_CODEHASH_RAIN_VATS_0_1_6,
+                deps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_AUTHORIZER_V1_V4) {
+            deploySuite(
+                type(StoxOffchainAssetReceiptVaultAuthorizerV1).creationCode,
+                "src/concrete/authorize/StoxOffchainAssetReceiptVaultAuthorizerV1.sol:StoxOffchainAssetReceiptVaultAuthorizerV1",
+                LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_AUTHORIZER_V1_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_AUTHORIZER_V1_CODEHASH_RAIN_VATS_0_1_6,
+                noDeps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_PAYMENT_MINT_AUTHORIZER_V1_V4) {
+            deploySuite(
+                type(StoxOffchainAssetReceiptVaultPaymentMintAuthorizerV1).creationCode,
+                "src/concrete/authorize/StoxOffchainAssetReceiptVaultPaymentMintAuthorizerV1.sol:StoxOffchainAssetReceiptVaultPaymentMintAuthorizerV1",
+                LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_PAYMENT_MINT_AUTHORIZER_V1_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_OFFCHAIN_ASSET_RECEIPT_VAULT_PAYMENT_MINT_AUTHORIZER_V1_CODEHASH_RAIN_VATS_0_1_6,
+                noDeps
+            );
+        } else if (suite == DEPLOYMENT_SUITE_STOX_CORPORATE_ACTIONS_FACET_V4) {
+            deploySuite(
+                type(StoxCorporateActionsFacet).creationCode,
+                "src/concrete/StoxCorporateActionsFacet.sol:StoxCorporateActionsFacet",
+                LibProdDeployV4.STOX_CORPORATE_ACTIONS_FACET_RAIN_VATS_0_1_6,
+                LibProdDeployV4.STOX_CORPORATE_ACTIONS_FACET_CODEHASH_RAIN_VATS_0_1_6,
+                noDeps
+            );
         } else {
             revert UnknownDeploymentSuite(suite);
         }