add bridge upgrade script

protocol/script/UpgradeBridge.s.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script} from "forge-std/Script.sol";
+import {console} from "forge-std/console.sol";
+import {Bridge} from "pod-protocol/Bridge.sol";
+import {ProxyAdmin} from "@openzeppelin/contracts/proxy/transparent/ProxyAdmin.sol";
+import {ITransparentUpgradeableProxy} from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";
+import {ERC1967Utils} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Utils.sol";
+
+contract UpgradeBridge is Script {
+
+    /**
+     * @param proxyAddr The TransparentUpgradeableProxy address.
+     * @param newMerkleRoot Merkle root covering all unprocessed claims from before the upgrade.
+     *        Compute off-chain from pending claim tx hashes using the OLD hash scheme.
+     *        Pass bytes32(0) if there are no pending claims.
+     */
+    function run(address proxyAddr, bytes32 newMerkleRoot) external {
+        Bridge bridge = Bridge(proxyAddr);
+
+        // Read ProxyAdmin from ERC-1967 admin slot
+        address proxyAdminAddr = address(uint160(uint256(vm.load(proxyAddr, ERC1967Utils.ADMIN_SLOT))));
+        console.log("ProxyAdmin:", proxyAdminAddr);
+
+        // Read immutables from current implementation
+        address podBridgeAddr = bridge.BRIDGE_CONTRACT();
+        uint256 srcChainId = bridge.CHAIN_ID();
+
+        console.log("BRIDGE_CONTRACT:", podBridgeAddr);
+        console.log("CHAIN_ID:", srcChainId);
+        console.log("Current version:", bridge.version());
+
+        vm.startBroadcast();
+
+        // 1. Deploy new implementation
+        Bridge newImpl = new Bridge(podBridgeAddr, srcChainId);
+        console.log("New implementation deployed at:", address(newImpl));
+
+        // 2. Upgrade proxy to new implementation (no reinitializer needed — storage layout is identical)
+        ProxyAdmin(proxyAdminAddr).upgradeAndCall(ITransparentUpgradeableProxy(proxyAddr), address(newImpl), "");
+        console.log("Proxy upgraded");
+
+        console.log("Validator config updated");
+
+        vm.stopBroadcast();
+    }
+}

protocol/script/upgrade_bridge.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -euo pipefail
+
+: "${SOURCE_CHAIN_RPC:?}"
+: "${BRIDGE_ADMIN_SECRET:?}"
+: "${BRIDGE_PROXY_ADDRESS:?}" # Bridge proxy address from initial deployment
+
+# Merkle root for pending claims from the old hash scheme.
+# Set to 0x0 if there are no pending claims.
+MERKLE_ROOT=${UPGRADE_MERKLE_ROOT:-0x0000000000000000000000000000000000000000000000000000000000000000}
+
+echo "Upgrading bridge..."
+echo "RPC:          $SOURCE_CHAIN_RPC"
+echo "Bridge proxy: $BRIDGE_PROXY_ADDRESS"
+echo "Merkle root:  $MERKLE_ROOT"
+
+forge script ./script/UpgradeBridge.s.sol:UpgradeBridge \
+  --rpc-url "$SOURCE_CHAIN_RPC" \
+  --private-key "$BRIDGE_ADMIN_SECRET" \
+  --broadcast \
+  --slow \
+  --sig "run(address,bytes32)" \
+  "$BRIDGE_PROXY_ADDRESS" "$MERKLE_ROOT"
+
+echo "Done. Bridge upgraded."