feat(infra): svm ism updates via turnkey (#7319)

Author: paulbalaji

typescript/infra/scripts/sealevel-helpers/update-multisig-ism-config.ts

@@ -1,4 +1,6 @@
+import { confirm } from '@inquirer/prompts';
 import {
+  ComputeBudgetProgram,
   PublicKey,
   Transaction,
   TransactionInstruction,
@@ -20,15 +22,16 @@ import { chainsToSkip } from '../../src/config/chain.js';
 import { DeployEnvironment } from '../../src/config/environment.js';
 import { squadsConfigs } from '../../src/config/squads.js';
 import {
-  FIRST_REAL_INSTRUCTION_INDEX,
   SvmMultisigConfigMap,
   buildMultisigIsmInstructions,
   diffMultisigIsmConfigs,
   fetchMultisigIsmState,
+  isComputeBudgetInstruction,
   loadCoreProgramIds,
   multisigIsmConfigPath,
   serializeMultisigIsmDifference,
 } from '../../src/utils/sealevel.js';
+import { submitProposalToSquads } from '../../src/utils/squads.js';
 import { getTurnkeySealevelDeployerSigner } from '../../src/utils/turnkey.js';
 import { chainIsProtocol, readJSONAtPath } from '../../src/utils/utils.js';
 import { getArgs, withChains } from '../agent-utils.js';
@@ -104,14 +107,15 @@ function analyzeConfigDifferences(
 }
 
 /**
- * Log MultisigIsm update transaction for manual Squads proposal
+ * Log MultisigIsm update transaction and optionally submit to Squads
  */
-async function logMultisigIsmUpdateTransaction(
+async function logAndSubmitMultisigIsmUpdateTransaction(
   chain: ChainName,
   instructions: TransactionInstruction[],
   owner: PublicKey,
   configsToUpdate: SvmMultisigConfigMap,
   mpp: MultiProtocolProvider,
+  signerAdapter: SvmMultiProtocolSignerAdapter,
 ): Promise<void> {
   rootLogger.info(chalk.cyan('\n=== Batched Transaction ==='));
   rootLogger.info(chalk.gray(`Total instructions: ${instructions.length}`));
@@ -124,26 +128,56 @@ async function logMultisigIsmUpdateTransaction(
   // Sort chain names alphabetically (same order as buildMultisigIsmInstructions)
   const sortedChainNames = Object.keys(configsToUpdate).sort();
 
+  // Dynamically detect which instructions are compute budget vs MultisigIsm
+  // This handles different chains potentially having different setup instructions
+  let multisigInstructionIndex = 0;
+
   // Log each instruction summary with data hex for verification
   instructions.forEach((instruction, idx) => {
-    if (idx === 0) {
-      rootLogger.info(
-        chalk.gray(`\nInstruction ${idx}: Set compute unit limit to 1,400,000`),
+    const isComputeBudget = isComputeBudgetInstruction(instruction);
+
+    if (isComputeBudget) {
+      // Decode compute budget instruction type
+      const dataView = new DataView(
+        instruction.data.buffer,
+        instruction.data.byteOffset,
+        instruction.data.byteLength,
       );
+      const instructionType = dataView.getUint8(0);
+
+      if (instructionType === 1) {
+        rootLogger.info(
+          chalk.gray(`Instruction ${idx}: Request heap frame (compute budget)`),
+        );
+      } else if (instructionType === 2) {
+        rootLogger.info(
+          chalk.gray(
+            `Instruction ${idx}: Set compute unit limit (compute budget)`,
+          ),
+        );
+      } else {
+        rootLogger.info(
+          chalk.gray(
+            `Instruction ${idx}: Compute budget (type ${instructionType})`,
+          ),
+        );
+      }
     } else {
-      const chainIndex = idx - FIRST_REAL_INSTRUCTION_INDEX;
-      const remoteChain = sortedChainNames[chainIndex];
+      // MultisigIsm instruction
+      const remoteChain = sortedChainNames[multisigInstructionIndex];
       const config = configsToUpdate[remoteChain];
       rootLogger.info(
         chalk.gray(
           `Instruction ${idx}: Set validators and threshold for ${remoteChain} (${config.validators.length} validators, threshold ${config.threshold})`,
         ),
       );
-    }
 
-    // Debug log instruction data
-    const dataHex = instruction.data.toString('hex');
-    rootLogger.debug(chalk.gray(`    Data: ${dataHex}`));
+      // Debug log instruction data
+      const dataHex = instruction.data.toString('hex');
+      rootLogger.debug(chalk.gray(`    Data: ${dataHex}`));
+
+      multisigInstructionIndex++;
+    }
   });
 
   // Create a transaction with ALL instructions
@@ -159,62 +193,101 @@ async function logMultisigIsmUpdateTransaction(
 
     instructions.forEach((ix) => transaction.add(ix));
 
+    const isSolana = chain === 'solanamainnet';
+
     // Serialize transaction to base58 (for Solana Squads)
     const txBase58 = bs58.encode(
       new Uint8Array(transaction.serialize({ requireAllSignatures: false })),
     );
-    rootLogger.info(
-      chalk.green(`\nTransaction (base58) - for Solana Squads:\n${txBase58}`),
-    );
 
     // Serialize message to base58 (for alt SVM Squads UIs like Eclipse)
     const message = transaction.compileMessage();
     const messageBase58 = bs58.encode(new Uint8Array(message.serialize()));
-    rootLogger.info(
-      chalk.magenta(
-        `\nMessage (base58) - for alt SVM Squads UIs:\n${messageBase58}\n`,
-      ),
-    );
+
+    if (isSolana) {
+      rootLogger.info(
+        chalk.green(`\nTransaction (base58) - for Solana Squads:\n${txBase58}`),
+      );
+    } else {
+      rootLogger.info(
+        chalk.magenta(
+          `\nMessage (base58) - for alt SVM Squads UIs:\n${messageBase58}\n`,
+        ),
+      );
+    }
+
+    // Create descriptive memo for the proposal
+    const chainNames = sortedChainNames.join(', ');
+    const updateCount = sortedChainNames.length;
+    const memo = `Update MultisigIsm validators for ${updateCount} chain${updateCount > 1 ? 's' : ''}: ${chainNames}`;
+
+    // Prompt for Squads submission
+    const shouldSubmitToSquads = await confirm({
+      message:
+        'Do you want to submit this proposal to Squads multisig automatically?',
+      default: true,
+    });
+
+    if (!shouldSubmitToSquads) {
+      rootLogger.info(
+        chalk.yellow(
+          `\nSkipping Squads submission. Use the base58 ${isSolana ? 'transaction' : 'message'} above to submit manually.`,
+        ),
+      );
+      return;
+    }
+
+    // Submit to Squads
+    await submitProposalToSquads(chain, instructions, mpp, signerAdapter, memo);
   } catch (error) {
-    rootLogger.warn(
-      chalk.yellow(`Could not serialize transaction/message: ${error}`),
-    );
+    rootLogger.error(chalk.red(`Failed to log/submit transaction: ${error}`));
+    throw error;
   }
 }
 
 /**
  * Print update instructions as a single batched transaction for Squads multisig submission
  */
-async function printMultisigIsmUpdates(
+async function printAndSubmitMultisigIsmUpdates(
   chain: ChainName,
   multisigIsmProgramId: PublicKey,
   vaultPubkey: PublicKey,
   configsToUpdate: SvmMultisigConfigMap,
   mpp: MultiProtocolProvider,
+  signerAdapter: SvmMultiProtocolSignerAdapter,
 ): Promise<number> {
   if (Object.keys(configsToUpdate).length === 0) {
     return 0;
   }
 
   const instructions = buildMultisigIsmInstructions(
+    chain,
     multisigIsmProgramId,
     vaultPubkey,
     configsToUpdate,
     mpp,
   );
 
+  // Count instruction types dynamically
+  const computeBudgetCount = instructions.filter(
+    isComputeBudgetInstruction,
+  ).length;
   const updateCount = Object.keys(configsToUpdate).length;
+
+  const budgetNote =
+    computeBudgetCount === 0 ? ' (compute budget handled by Squads UI)' : '';
   rootLogger.debug(
-    `[${chain}] Generating batched transaction with ${instructions.length} instructions (${updateCount} MultisigIsm updates + 1 compute budget)`,
+    `[${chain}] Generating batched transaction with ${instructions.length} instructions (${computeBudgetCount} compute budget + ${updateCount} MultisigIsm updates)${budgetNote}`,
   );
 
-  // Log the batched transaction for manual Squads multisig proposal submission
-  await logMultisigIsmUpdateTransaction(
+  // Log the batched transaction and optionally submit to Squads
+  await logAndSubmitMultisigIsmUpdateTransaction(
     chain,
     instructions,
     vaultPubkey,
     configsToUpdate,
     mpp,
+    signerAdapter,
   );
 
   return updateCount;
@@ -253,7 +326,7 @@ async function processChain(
   const vaultPubkey = new PublicKey(squadsConfigs[chain].vault);
   rootLogger.debug(`Using Squads vault (multisig): ${vaultPubkey.toBase58()}`);
   rootLogger.debug(
-    `Using Turnkey signer (owner/approver): ${await adapter.address()}`,
+    `Using Turnkey signer (proposal creator): ${await adapter.address()}`,
   );
 
   // Load configuration from file
@@ -288,12 +361,13 @@ async function processChain(
       `Found ${Object.keys(configsToUpdate).length} MultisigIsm configs to update for ${chain}`,
     );
 
-    updated = await printMultisigIsmUpdates(
+    updated = await printAndSubmitMultisigIsmUpdates(
       chain,
       multisigIsmProgramId,
       vaultPubkey,
       configsToUpdate,
       mpp,
+      adapter,
     );
   } else {
     rootLogger.info(`No updates needed for ${chain} - all configs match`);
@@ -308,18 +382,10 @@ async function main() {
     environment,
     chains: chainsArg,
     context = Contexts.Hyperlane,
-    apply,
   } = await withChains(getArgs())
     .describe('context', 'MultisigIsm context to update')
     .choices('context', [Contexts.Hyperlane, Contexts.ReleaseCandidate])
-    .alias('x', 'context')
-    .option('apply', {
-      type: 'boolean',
-      description: 'Apply changes on-chain (default is dry-run mode)',
-      default: false,
-    }).argv;
-
-  const dryRun = !apply;
+    .alias('x', 'context').argv;
 
   // Compute default chains based on environment
   const envConfig = getEnvironmentConfig(environment);
@@ -335,27 +401,15 @@ async function main() {
   // Initialize Turnkey signer
   rootLogger.info('Initializing Turnkey signer from GCP Secret Manager...');
   const turnkeySigner = await getTurnkeySealevelDeployerSigner(environment);
-  rootLogger.info(`Signer public key: ${turnkeySigner.publicKey.toBase58()}`);
+  const creatorPublicKey = turnkeySigner.publicKey;
+  rootLogger.info(
+    `Proposal creator public key: ${creatorPublicKey.toBase58()}`,
+  );
 
   rootLogger.info(
     `Configuring MultisigIsm for chains: ${chains.join(', ')} on ${environment} (context: ${context})`,
   );
 
-  if (!dryRun) {
-    rootLogger.warn(
-      chalk.yellow(
-        '⚠️  WARNING: --apply flag is not yet implemented. Running in dry-run mode.',
-      ),
-    );
-    rootLogger.warn(
-      chalk.yellow(
-        '    Transactions will be printed for manual Squads multisig submission.',
-      ),
-    );
-  } else {
-    rootLogger.info('Running in DRY RUN mode - no transactions will be sent');
-  }
-
   // Process all chains sequentially (to avoid overwhelming the user with prompts)
   const mpp = await envConfig.getMultiProtocolProvider();
   const results: Array<{ chain: string; updated: number; matched: number }> =