@bananapus/721-hook-v6 0.0.41 → 0.0.43

package/.gas-snapshot

@@ -1,152 +0,0 @@
-NFTHookAttacks:test_adjustTiers_noPermission_reverts() (gas: 355534)
-NFTHookAttacks:test_cannotIncreaseDiscountPercent_enforcement() (gas: 371175)
-NFTHookAttacks:test_cashOutWeight_afterTierRemoval() (gas: 9879224)
-NFTHookAttacks:test_duplicateTierIdsInMetadata_mintsMultiple() (gas: 9844592)
-NFTHookAttacks:test_invalidTierIdInMetadata_reverts() (gas: 401784)
-NFTHookAttacks:test_maxDiscountPercent_effectivePrice() (gas: 362841)
-NFTHookAttacks:test_maxSupplyTier_noOverflow() (gas: 357301)
-NFTHookAttacks:test_reserveDrain_highFrequency() (gas: 10193674)
-NFTHookAttacks:test_supplyExhaustion_noOvermint() (gas: 9847419)
-NFTHookAttacks:test_zeroPriceTier_mintBehavior() (gas: 9846210)
-TestJB721TiersRulesetMetadataResolver:testFuzz_mintPendingReservesPaused_bitIsolation(uint256) (runs: 256, μ: 488, ~: 488)
-TestJB721TiersRulesetMetadataResolver:testFuzz_packExpandRoundTrip(bool,bool) (runs: 256, μ: 1090, ~: 1091)
-TestJB721TiersRulesetMetadataResolver:testFuzz_pack_onlyUsesLow2Bits(bool,bool) (runs: 256, μ: 733, ~: 734)
-TestJB721TiersRulesetMetadataResolver:testFuzz_transfersPaused_bitIsolation(uint256) (runs: 256, μ: 459, ~: 459)
-TestJB721TiersRulesetMetadataResolver:test_expandMetadata_one() (gas: 453)
-TestJB721TiersRulesetMetadataResolver:test_expandMetadata_three() (gas: 475)
-TestJB721TiersRulesetMetadataResolver:test_expandMetadata_two() (gas: 485)
-TestJB721TiersRulesetMetadataResolver:test_expandMetadata_zero() (gas: 455)
-TestJB721TiersRulesetMetadataResolver:test_mintPendingReservesPaused() (gas: 457)
-TestJB721TiersRulesetMetadataResolver:test_packExpandRoundTrip_allCombinations() (gas: 2977)
-TestJB721TiersRulesetMetadataResolver:test_pack_allFalse() (gas: 514)
-TestJB721TiersRulesetMetadataResolver:test_pack_bothTrue() (gas: 477)
-TestJB721TiersRulesetMetadataResolver:test_pack_pauseMintPendingReservesOnly() (gas: 505)
-TestJB721TiersRulesetMetadataResolver:test_pack_pauseTransfersOnly() (gas: 486)
-TestJB721TiersRulesetMetadataResolver:test_transfersPaused() (gas: 434)
-TestJBBitmap:testFuzz_readId_depthMatchesIndex(uint16) (runs: 256, μ: 2886, ~: 2886)
-TestJBBitmap:testFuzz_refreshBitmapNeeded_consistency(uint16,uint16) (runs: 256, μ: 3127, ~: 3127)
-TestJBBitmap:testFuzz_removeTier_isolatedBit(uint16,uint16) (runs: 256, μ: 28176, ~: 28755)
-TestJBBitmap:testFuzz_removeTier_multipleBits(uint8,uint8,uint8) (runs: 256, μ: 28174, ~: 28174)
-TestJBBitmap:testFuzz_removeTier_roundTrip(uint16) (runs: 256, μ: 23824, ~: 23824)
-TestJBBitmap:test_isTierIdRemoved_memoryStruct() (gas: 23394)
-TestJBBitmap:test_isTierIdRemoved_wrongDepthReturnsWrong() (gas: 25144)
-TestJBBitmap:test_readId_depthCalculation() (gas: 7636)
-TestJBBitmap:test_readId_initiallyZero() (gas: 2859)
-TestJBBitmap:test_refreshBitmapNeeded_differentDepth() (gas: 2965)
-TestJBBitmap:test_refreshBitmapNeeded_sameDepth() (gas: 3052)
-TestJBBitmap:test_removeTier_acrossWords() (gas: 70159)
-TestJBBitmap:test_removeTier_doesNotAffectOtherBits() (gas: 24281)
-TestJBBitmap:test_removeTier_idempotent() (gas: 23479)
-TestJBBitmap:test_removeTier_multipleBitsInSameWord() (gas: 25337)
-TestJBBitmap:test_removeTier_setsbit() (gas: 23638)
-TestJBIpfsDecoder:testFuzz_decode_alwaysProduces46Chars(bytes32) (runs: 256, μ: 359415, ~: 359415)
-TestJBIpfsDecoder:testFuzz_decode_alwaysStartsWithQm(bytes32) (runs: 256, μ: 359671, ~: 359671)
-TestJBIpfsDecoder:testFuzz_decode_onlyBase58Chars(bytes32) (runs: 256, μ: 647995, ~: 649242)
-TestJBIpfsDecoder:testFuzz_decode_prependsBaseUri(bytes32,uint8) (runs: 256, μ: 369117, ~: 362596)
-TestJBIpfsDecoder:test_decode_deterministic() (gas: 718939)
-TestJBIpfsDecoder:test_decode_differentHashesDifferentOutput() (gas: 718729)
-TestJBIpfsDecoder:test_decode_emptyBaseUri() (gas: 359299)
-TestJBIpfsDecoder:test_decode_onlyBase58Chars() (gas: 626479)
-TestJBIpfsDecoder:test_decode_outputLength() (gas: 359327)
-TestJBIpfsDecoder:test_decode_outputStartsWithQm() (gas: 359626)
-TestJBIpfsDecoder:test_decode_prependsBaseUri() (gas: 361561)
-TestTieredHookStoreInvariant:invariant_maxTierIdMonotonic() (runs: 256, calls: 128000, reverts: 0)
-TestTieredHookStoreInvariant:invariant_reserveMintBounds() (runs: 256, calls: 128000, reverts: 0)
-TestTieredHookStoreInvariant:invariant_supplyConservation() (runs: 256, calls: 128000, reverts: 0)
-Test_Getters_Constructor_Unit:test_balanceOf_returnsCompleteBalance(uint256,address) (runs: 256, μ: 11423292, ~: 11326514)
-Test_Getters_Constructor_Unit:test_bools_doesPackingAndUnpackingWork(bool,bool,bool,bool,bool) (runs: 256, μ: 3439343, ~: 3439343)
-Test_Getters_Constructor_Unit:test_cashOutWeightOf_returnsCorrectWeightAsCumSumOfPrices(uint256,uint256,uint256) (runs: 256, μ: 11195261, ~: 10992258)
-Test_Getters_Constructor_Unit:test_constructor_deployIfInitialSuppliesNotEmpty(uint256) (runs: 256, μ: 10167481, ~: 10200751)
-Test_Getters_Constructor_Unit:test_constructor_revertDeploymentIfOneEmptyInitialSupply(uint256,uint256) (runs: 256, μ: 487693, ~: 400030)
-Test_Getters_Constructor_Unit:test_firstOwnerOf_shouldReturnCurrentOwnerIfFirstOwner(uint256,address) (runs: 256, μ: 10587416, ~: 10587416)
-Test_Getters_Constructor_Unit:test_firstOwnerOf_shouldReturnFirstOwnerIfOwnerChanged(address,address) (runs: 256, μ: 10485438, ~: 10485438)
-Test_Getters_Constructor_Unit:test_firstOwnerOf_shouldReturnZeroAddressIfNotMinted(uint256) (runs: 256, μ: 10566284, ~: 10566284)
-Test_Getters_Constructor_Unit:test_numberOfPendingReservesFor_returnsPendingReserves() (gas: 10915529)
-Test_Getters_Constructor_Unit:test_pricingContext_packingFunctionsAsExpected(uint32,uint8,address,bytes32) (runs: 256, μ: 991314, ~: 991314)
-Test_Getters_Constructor_Unit:test_setEncodedIPFSUriOf_returnsCorrectEncodedURI() (gas: 10971375)
-Test_Getters_Constructor_Unit:test_tierOfTokenId_returnsCorrectTierNumber(uint16,uint16) (runs: 256, μ: 29544, ~: 29544)
-Test_Getters_Constructor_Unit:test_tierOf_returnsAGivenTier(uint256,uint16) (runs: 256, μ: 11097249, ~: 11056900)
-Test_Getters_Constructor_Unit:test_tiersOf_returnsAllTiers(uint256) (runs: 256, μ: 11333900, ~: 11133203)
-Test_Getters_Constructor_Unit:test_tiersOf_returnsAllTiersExcludingRemovedOnes(uint256,uint256,uint256) (runs: 256, μ: 11587343, ~: 11564906)
-Test_Getters_Constructor_Unit:test_tiersOf_returnsAllTiersWithResolver(uint256) (runs: 256, μ: 11605638, ~: 11393755)
-Test_Getters_Constructor_Unit:test_tokenURI_returnsCorrectUriWithResolver(uint256) (runs: 256, μ: 10641767, ~: 10641767)
-Test_Getters_Constructor_Unit:test_tokenURI_returnsCorrectUriWithoutResolver() (gas: 14291263)
-Test_Getters_Constructor_Unit:test_totalCashOutWeight_returnsCorrectTotalWeightAsCumSumOfPrices(uint256) (runs: 256, μ: 11051332, ~: 10917296)
-Test_Getters_Constructor_Unit:test_totalSupplyOf_returnsTotalSupply(uint256) (runs: 256, μ: 11036700, ~: 10904015)
-Test_Getters_Constructor_Unit:test_votingUnitsOf_returnsVotingUnitsCorrectly(uint256,uint256,uint256) (runs: 256, μ: 11413665, ~: 11289995)
-Test_ProjectDeployer_Unit:test_launchProjectFor_shouldLaunchProject(uint256,bytes32) (runs: 256, μ: 1007027, ~: 1006740)
-Test_TiersHook_E2E:testCashOutAll(bytes32) (runs: 256, μ: 2638007, ~: 2638007)
-Test_TiersHook_E2E:testCashOutToken(uint256,bytes32) (runs: 256, μ: 2384922, ~: 2389496)
-Test_TiersHook_E2E:testFuzzMintWithDiscountOnPayIfOneTierIsPassed(uint256,uint256) (runs: 257, μ: 1265656, ~: 1308144)
-Test_TiersHook_E2E:testLaunchProjectAndAddHookToRegistry(bytes32) (runs: 256, μ: 4570480, ~: 4570480)
-Test_TiersHook_E2E:testMintOnPayIfMultipleTiersArePassed(bytes32) (runs: 256, μ: 2444650, ~: 2444650)
-Test_TiersHook_E2E:testMintOnPayIfOneTierIsPassed(uint256,bytes32) (runs: 256, μ: 2049940, ~: 2050860)
-Test_TiersHook_E2E:testMintReservedNft(uint256,bytes32) (runs: 256, μ: 2140927, ~: 2141363)
-Test_TiersHook_E2E:testNoMintOnPayWhenNotIncludingMetadata(uint256,bytes32) (runs: 256, μ: 1868459, ~: 1868581)
-Test_TiersHook_E2E:testNoMintOnPayWhenNotIncludingTierIds(uint256,bytes32) (runs: 256, μ: 1874747, ~: 1874869)
-Test_adjustTier_Unit:test_adjustTiers_addAndRemoveTiers() (gas: 1343154)
-Test_adjustTier_Unit:test_adjustTiers_addNewTiers(uint256,uint256,uint256) (runs: 256, μ: 2340387, ~: 2352813)
-Test_adjustTier_Unit:test_adjustTiers_addNewTiersWithNonSequentialCategories(uint256,uint256,uint256) (runs: 256, μ: 2581968, ~: 2563953)
-Test_adjustTier_Unit:test_adjustTiers_addNewTiers_fetchSpecificTier(uint256,uint256,uint256) (runs: 256, μ: 1660417, ~: 1683246)
-Test_adjustTier_Unit:test_adjustTiers_removeTiers(uint256,uint256,uint256) (runs: 256, μ: 10170249, ~: 10150499)
-Test_adjustTier_Unit:test_adjustTiers_removeTiersMultipleTimes(uint256,uint256,uint256) (runs: 256, μ: 2285592, ~: 2265940)
-Test_adjustTier_Unit:test_adjustTiers_revertIfAddingWithReserveFrequency(uint256,uint256) (runs: 256, μ: 10169685, ~: 10166640)
-Test_adjustTier_Unit:test_adjustTiers_revertIfAddingWithVotingPower(uint256,uint256) (runs: 256, μ: 10168360, ~: 10165321)
-Test_adjustTier_Unit:test_adjustTiers_revertIfCannotRemoveTier() (gas: 394356)
-Test_adjustTier_Unit:test_adjustTiers_revertIfEmptyQuantity(uint256,uint256) (runs: 256, μ: 10169424, ~: 10166381)
-Test_adjustTier_Unit:test_adjustTiers_revertIfInvalidCategorySortOrder(uint256,uint256) (runs: 256, μ: 10897255, ~: 10925524)
-Test_adjustTier_Unit:test_adjustTiers_revertIfMoreVotingUnitsNotAllowedUsingVotingUnits(uint256,uint256) (runs: 256, μ: 10778370, ~: 10808162)
-Test_adjustTier_Unit:test_adjustTiers_revertIfMoreVotingUnitsNotAllowedWithPriceChange(uint256,uint256) (runs: 256, μ: 10141122, ~: 10138435)
-Test_adjustTier_Unit:test_adjustTiers_withDifferentCategories(uint256,uint256,uint256) (runs: 256, μ: 2609853, ~: 2601407)
-Test_adjustTier_Unit:test_adjustTiers_withDifferentCategoriesAndFetchedTogether(uint256,uint256,uint256) (runs: 256, μ: 2651662, ~: 2655539)
-Test_adjustTier_Unit:test_adjustTiers_withSameCategoryMultipleTimes(uint256,uint256,uint256) (runs: 256, μ: 3211356, ~: 3174714)
-Test_adjustTier_Unit:test_adjustTiers_withZeroCategory(uint256,uint256,uint256) (runs: 256, μ: 2019794, ~: 1998614)
-Test_adjustTier_Unit:test_cleanTiers_removeInactiveTiers(uint256,uint256,uint256) (runs: 256, μ: 10396186, ~: 10378896)
-Test_adjustTier_Unit:test_setDiscountPercentOf_revertIfCannotIncreaseDiscount() (gas: 338824)
-Test_adjustTier_Unit:test_setDiscountPercentsOf_revertIfCannotIncreaseDiscounts() (gas: 395153)
-Test_adjustTier_Unit:test_tiersOf_emptyArrayIfNoInitializedTiers(uint256) (runs: 256, μ: 217659, ~: 217659)
-Test_adjustTier_Unit:test_tiersOf_recentlyAddedTiersFetchedFirstWhenSorted(uint256,uint256,uint256) (runs: 256, μ: 2200972, ~: 2196814)
-Test_adjustTier_Unit:test_tiersOf_recentlyAddedTiersFetchedFirstWhenSortedAfterTiersCleaned(uint256,uint256,uint256) (runs: 256, μ: 3616874, ~: 3631859)
-Test_afterPayRecorded_Unit:test_afterCashOutRecordedWith_cashOutEvenIfTransfersPausedInRuleset() (gas: 1385297)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_doNotMintIfNotUsingCorrectToken(address) (runs: 257, μ: 85884, ~: 85884)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_doNotMintWithSomeoneElsesCredits() (gas: 514975)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_doesNotRevertOnAmountBelowPriceIfNoMetadata() (gas: 65557)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintAndReserveCorrectAmounts(uint256,uint256,uint256) (runs: 256, μ: 14417219, ~: 14622413)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintCorrectTier() (gas: 344650)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintCorrectTierWithAnotherCurrency() (gas: 1574686)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintCorrectTiersWhenPartiallyUsingPayCredits() (gas: 553961)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintNoneIfNonePassed(uint8) (runs: 256, μ: 126870, ~: 130887)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintTierAndTrackLeftover() (gas: 190328)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_mintWithExistingCreditsWhenMoreExistingCreditsThanNewCredits() (gas: 439389)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfAllowanceRunsOutInSpecifiedTier() (gas: 9359196)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfAmountTooLow() (gas: 150759)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfCallerIsNotATerminalOfProjectId(address) (runs: 256, μ: 25585, ~: 25585)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfTierDoesNotExist(uint256) (runs: 256, μ: 177275, ~: 177754)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfTierRemoved() (gas: 170846)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfUnexpectedLeftover() (gas: 64790)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertIfUnexpectedLeftoverAndOverspendingPrevented(bool) (runs: 256, μ: 65853, ~: 53252)
-Test_afterPayRecorded_Unit:test_afterPayRecorded_revertsOnAmountBelowPriceIfNoMetadataAndOverspendingIsPrevented() (gas: 1325309)
-Test_afterPayRecorded_Unit:test_transferFrom_pauseFlagOverridesRuleset() (gas: 1603935)
-Test_afterPayRecorded_Unit:test_transferFrom_revertTransferIfPausedInRuleset() (gas: 1568089)
-Test_cashOut_Unit:test_afterCashOutRecordedWith_burnCashOutNft(uint256) (runs: 256, μ: 13781545, ~: 13639188)
-Test_cashOut_Unit:test_afterCashOutRecordedWith_revertIfCallerIsNotATerminalOfTheProject() (gas: 27783)
-Test_cashOut_Unit:test_afterCashOutRecordedWith_revertIfNotCorrectProjectId(uint8) (runs: 256, μ: 28421, ~: 28421)
-Test_cashOut_Unit:test_afterCashOutRecordedWith_revertIfWrongHolder(address,uint8) (runs: 256, μ: 9677720, ~: 9677720)
-Test_cashOut_Unit:test_beforeCashOutContext_returnsCorrectAmount() (gas: 10828929)
-Test_cashOut_Unit:test_beforeCashOutContext_returnsPartOfOverflowOwnedIfCashOutTaxRateIsMaximum() (gas: 10830525)
-Test_cashOut_Unit:test_beforeCashOutContext_returnsZeroAmountIfReserveFrequencyIsZero() (gas: 10812126)
-Test_cashOut_Unit:test_beforeCashOutContext_revertIfNonZeroTokenCount(uint256) (runs: 256, μ: 19456, ~: 19456)
-Test_mintFor_mintReservesFor_Unit:test_mintFor_mintArrayOfTiers() (gas: 10129100)
-Test_mintFor_mintReservesFor_Unit:test_mintFor_revertIfManualMintNotAllowed() (gas: 10585321)
-Test_mintFor_mintReservesFor_Unit:test_mintPendingReservesFor_mintMultipleReservedTokens() (gas: 9977856)
-Test_mintFor_mintReservesFor_Unit:test_mintPendingReservesFor_mintOddReservedTokens() (gas: 10344857)
-Test_mintFor_mintReservesFor_Unit:test_mintPendingReservesFor_mintsCorrectly() (gas: 9984341)
-Test_mintFor_mintReservesFor_Unit:test_mintPendingReservesFor_revertIfNotEnoughPendingReserves() (gas: 11010767)
-Test_mintFor_mintReservesFor_Unit:test_mintPendingReservesFor_revertIfReservedMintingIsPausedInRuleset() (gas: 9954862)
-Test_mintFor_mintReservesFor_Unit:test_numberOfPendingReservesFor_noReservesIfNoBeneficiarySet() (gas: 10812175)
-TierLifecycleInvariant_Local:invariant_721_1_perTierSupplyAccounting() (runs: 256, calls: 128000, reverts: 0)
-TierLifecycleInvariant_Local:invariant_721_2_totalCashOutWeightConsistency() (runs: 256, calls: 128000, reverts: 0)
-TierLifecycleInvariant_Local:invariant_721_3_payCreditsNonNegative() (runs: 256, calls: 128000, reverts: 0)
-TierLifecycleInvariant_Local:invariant_721_4_reserveMintsBounded() (runs: 256, calls: 128000, reverts: 0)
-TierLifecycleInvariant_Local:invariant_721_5_removedTiersExcluded() (runs: 256, calls: 128000, reverts: 0)
-TierLifecycleInvariant_Local:invariant_721_6_cashOutWeightBoundedByPrice() (runs: 256, calls: 128000, reverts: 0)

package/ADMINISTRATION.md

@@ -1,87 +0,0 @@
-# Administration
-
-## At A Glance
-
-| Item | Details |
-| --- | --- |
-| Scope | Tiered NFT hook configuration, tier adjustment, and deployer wiring |
-| Control posture | Mixed project-owner and delegated control |
-| Highest-risk actions | Adjusting tiers, setting discount or metadata behavior, and wiring the wrong hook or resolver |
-| Recovery posture | Some configuration is mutable, but many tier properties are intentionally one-way |
-
-## Purpose
-
-`nana-721-hook-v6` splits control between project-level hook ownership and the tier rules enforced by the store. Many important settings can be changed only in limited ways after launch.
-
-## Control Model
-
-- project owners or delegates control hook-level configuration
-- tier creation and mutation are permissioned and partially one-way
-- the store trusts the calling hook for its own state namespace
-- deployers package setup, but do not remove the need for runtime review
-
-## Roles
-
-| Role | How Assigned | Scope | Notes |
-| --- | --- | --- | --- |
-| Project owner | `owner()` or project control surface | Per hook | Main authority |
-| Tier delegate | `JBPermissions` grant | Per project | Usually tier, mint, discount, or metadata permissions |
-| Reserve beneficiary | Tier config | Per tier | Receives reserve NFTs |
-
-## Privileged Surfaces
-
-- `adjustTiers(...)`
-- `mintFor(...)`
-- `setDiscountPercentOf(...)`
-- `setMetadata(...)`
-- deployer setup and hook ownership transfer paths
-
-## Deployer Permission Model
-
-`JB721TiersHookProjectDeployer` requires callers to hold the correct Juicebox permission for each operation:
-
-| Function | Required Permissions |
-| --- | --- |
-| `launchProjectFor(...)` | None (creates a new project) |
-| `launchRulesetsFor(...)` | `LAUNCH_RULESETS` + `SET_TERMINALS` |
-| `queueRulesetsOf(...)` | `QUEUE_RULESETS` |
-
-Permissions are checked against the project owner via `_requirePermissionFrom`. The deployer calls the controller on the caller's behalf, so the controller sees the deployer as `msg.sender`.
-
-## Immutable And One-Way
-
-- many tier properties are immutable once created
-- removed tiers do not reduce `maxTierIdOf`
-- pool-like mutable rescue does not exist here; bad tier design is often expensive to unwind
-
-## Operational Notes
-
-- review tier parameters before launch as if they were economic policy
-- treat discount changes and metadata changes as meaningful authority, not cosmetic controls
-- be explicit about whether the hook participates in pay, cash out, or both
-- separate resolver trust from hook and store trust
-
-## Machine Notes
-
-- do not reason from the hook alone when the bug may live in the store
-- if a resolver is involved, inspect it separately
-- if tier counts are large, re-check gas-sensitive reads and writes before operational changes
-
-## Recovery
-
-- some mistakes can be corrected through allowed metadata or discount changes
-- many tier-design mistakes are effectively permanent once live
-- deployer mistakes may require a new hook path rather than in-place repair
-
-## Admin Boundaries
-
-- no one can rewrite immutable tier properties after creation
-- deployers do not bypass runtime permissions after setup
-- resolver behavior cannot fix broken hook accounting
-
-## Source Map
-
-- `src/JB721TiersHook.sol`
-- `src/JB721TiersHookStore.sol`
-- `src/JB721TiersHookDeployer.sol`
-- `src/JB721TiersHookProjectDeployer.sol`

package/ARCHITECTURE.md

@@ -1,98 +0,0 @@
-# Architecture
-
-## Purpose
-
-`nana-721-hook-v6` is the shared tiered NFT layer for Juicebox V6. It lets projects sell NFT tiers, track reserves, route split payouts, and cash out NFTs without replacing core treasury accounting.
-
-## System Overview
-
-`JB721TiersHook` is the runtime hook. `JB721TiersHookStore` is the accounting backend for tiers, supply, reserves, and lookup. The deployers package that hook into reusable flows for existing projects and new project launches.
-
-Custom token URI resolvers usually live outside this repo, but they still affect the trusted surface seen by users.
-
-## Core Invariants
-
-- the hook must not create alternate treasury accounting
-- tier supply, burned counts, and reserves must stay coherent
-- cash-out weight must reflect the intended tier economics
-- reserve minting and split routing must not drift from stored tier state
-- store-linked list and bitmap assumptions must stay valid under tier add, remove, and clean operations
-- deployer wiring must preserve the expected ruleset and hook shape
-
-## Modules
-
-| Module | Responsibility | Notes |
-| --- | --- | --- |
-| `JB721TiersHook` | Pay hook, cash-out hook, permissions, and project-facing execution | Runtime core |
-| `JB721TiersHookStore` | Tier definitions, balances, reserve tracking, and accounting | Shared state |
-| `JB721TiersHookDeployer` | Clone deployer for existing projects | Wiring helper |
-| `JB721TiersHookProjectDeployer` | Project-launch deployer with hook setup | Launch helper |
-| `JB721Hook` | Abstract 721 hook base | Shared behavior |
-
-## Trust Boundaries
-
-- core accounting, pricing, and terminal authentication remain in `nana-core-v6`
-- metadata resolvers can be project-specific and should be treated as trusted external surfaces
-- the store is trusted by every hook that uses it
-- deployers are trusted to wire the hook into the intended project and ruleset shape
-
-## Critical Flows
-
-### Pay And Mint
-
-```text
-payment arrives
-  -> hook decodes metadata and tier choices
-  -> store records mints, credits, supply changes, and reserve effects
-  -> hook may route split payouts from forwarded funds
-  -> collection state and balances update for the beneficiary
-```
-
-### Cash Out
-
-```text
-cash out requested
-  -> hook checks NFT-specific metadata and selected token IDs
-  -> hook burns NFTs
-  -> store records burn and supply effects
-  -> terminal reclaims value using hook-aware cash-out math
-```
-
-## Accounting Model
-
-This repo owns tier accounting and NFT lifecycle logic. It does not own the canonical project ledger for balances, fees, or surplus.
-
-The most important state lives in the store: remaining supply, burned counts, reserve tracking, and per-tier configuration.
-
-## Security Model
-
-- store corruption has ecosystem-wide blast radius because many products reuse it
-- reserve logic, discounts, and cash-out weight are the main economic risk surfaces
-- split distribution and fallback behavior are part of correctness, not a secondary concern
-- gas costs matter because some reads and writes scale with tier count
-
-## Safe Change Guide
-
-- review hook and store behavior together when changing tier lifecycle logic
-- if reserve logic changes, re-check cash-out weight and pending reserve effects together
-- if deployer behavior changes, re-check ruleset wiring and ownership transfer paths
-- do not treat resolver behavior as proof that hook accounting is correct
-
-## Canonical Checks
-
-- pay, mint, and redeem end-to-end behavior:
-  `test/E2E/Pay_Mint_Redeem_E2E.t.sol`
-- store and lifecycle invariants:
-  `test/invariants/TierLifecycleInvariant.t.sol`
-  `test/invariants/TieredHookStoreInvariant.t.sol`
-- split-credit and deployer regressions:
-  `test/audit/CodexSplitCreditsMismatch.t.sol`
-  `test/regression/ProjectDeployerRulesets.t.sol`
-
-## Source Map
-
-- `src/JB721TiersHook.sol`
-- `src/JB721TiersHookStore.sol`
-- `src/JB721TiersHookDeployer.sol`
-- `src/JB721TiersHookProjectDeployer.sol`
-- `src/libraries/JB721TiersHookLib.sol`

package/AUDIT_INSTRUCTIONS.md

@@ -1,77 +0,0 @@
-# Audit Instructions
-
-This repo adds tiered NFT issuance and cash-out behavior to Juicebox projects. Audit it as a shared accounting layer whose mistakes can affect many downstream products.
-
-## Audit Objective
-
-Find issues that:
-
-- corrupt tier supply, reserve state, or burn accounting
-- misprice cash outs or split routing
-- let permissions or deployer wiring create unsafe lifecycle changes
-- create gas or liveness failures in tier-heavy deployments
-- break trust boundaries between hook, store, and resolver behavior
-
-## Scope
-
-In scope:
-
-- `src/JB721TiersHook.sol`
-- `src/JB721TiersHookStore.sol`
-- deployers, libraries, interfaces, and structs under `src/`
-- deployment scripts in `script/`
-
-## Start Here
-
-1. `src/JB721TiersHook.sol`
-2. `src/JB721TiersHookStore.sol`
-3. `src/libraries/JB721TiersHookLib.sol`
-
-## Security Model
-
-The hook:
-
-- mints and burns tiered NFTs through Juicebox flows
-- records tier lifecycle state in a shared store
-- can route split payouts from forwarded value
-- composes with project-specific metadata resolvers
-
-## Roles And Privileges
-
-| Role | Powers | How constrained |
-|------|--------|-----------------|
-| Project authority | Configure tiers, metadata, and minting policy | Must stay inside explicit permission checks |
-| Store caller | Mutate store state in its own namespace | Must not corrupt tier accounting |
-| Resolver | Serve metadata and URI behavior | Must not be confused with accounting truth |
-
-## Integration Assumptions
-
-| Dependency | Assumption | What breaks if wrong |
-|------------|------------|----------------------|
-| `nana-core-v6` | Terminal auth and pricing behavior are accurate | Pay and cash-out behavior drift |
-| Resolver repo | Metadata reads behave as expected | UI and marketplace behavior break |
-
-## Critical Invariants
-
-1. Tier supply stays coherent.  
-   Remaining supply, burned counts, and outstanding ownership must reconcile.
-2. Reserve logic stays bounded.  
-   Pending reserves and reserve minting must not over-allocate.
-3. Cash-out weight is consistent.  
-   NFT reclaim value must match the tier model the hook and store intend.
-4. Split and fallback behavior is safe.  
-   Failed split paths must not silently corrupt value or lifecycle state.
-
-## Attack Surfaces
-
-- pay and cash-out hook entrypoints
-- tier add, remove, and clean flows
-- reserve minting
-- split distribution and fallback paths
-- resolver integration
-
-## Verification
-
-- `npm install`
-- `forge build`
-- `forge test`

package/RISKS.md

@@ -1,118 +0,0 @@
-# Juicebox 721 Hook Risk Register
-
-This file covers the tiered-NFT accounting, reserve-mint, and cash-out risks in the shared 721 hook used across multiple higher-level products.
-
-## How To Use This File
-
-- Read `Priority risks` first. They summarize the shared 721-hook risks with the widest blast radius.
-- Use the later sections for reentrancy, gas, tier accounting, and integration reasoning.
-- Treat `Invariants to verify` as required coverage for any hook or store change.
-
-## Priority Risks
-
-| Priority | Risk | Why it matters | Primary controls |
-|----------|------|----------------|------------------|
-| P0 | Shared store corruption or accounting drift | `JB721TiersHookStore` is reused across products. A tier-accounting bug can affect many repos at once. | Heavy store testing, invariants, and cautious deployment review. |
-| P1 | Gas and iteration ceilings around tier state | Tier operations can iterate over reserves, pricing state, and cash-out weights. | Gas tests, tier-count limits, and DoS review. |
-| P1 | Cash-out and reserve math mismatch | Fair redemption depends on tier supply, pending reserves, and pricing state staying aligned. | Detailed invariants, fuzzing, and integration tests. |
-
-## 1. Trust Assumptions
-
-- **The store is trusted.** It keys state by `msg.sender`, so a hook can only affect its own namespace, but that namespace is fully trusted.
-- **Tier configuration is partly immutable.** Price, supply, reserve frequency, category, voting units, and split percent are permanent after creation.
-- **Category ordering matters.** The store's linked-list assumptions depend on correct sorted insertion.
-- **`useReserveBeneficiaryAsDefault` has wide effects.** Setting it on a new tier can change the default reserve beneficiary for older tiers without their own explicit beneficiary.
-- **Clone initialization is one-shot.** Clones are deployed and initialized atomically.
-- **Directory and prices are trusted.** Terminal authentication and cross-currency behavior depend on core.
-
-## 2. Economic Risks
-
-- **Cash-out weight uses full undiscounted price.**
-- **Pending reserves inflate the cash-out denominator before reserves are minted.**
-- **Pay credits can accumulate without a cap.**
-- **Zero-price tiers are valid.**
-- **Discount math uses a denominator of 200, not 10,000.**
-- **Currency mismatch can silently skip minting when no prices contract is configured.**
-- **`splitPercent` can reduce fungible-token minting weight.**
-- **Reserve minting is permissionless.**
-
-## 3. Reentrancy Surface
-
-- **Split hook callbacks execute arbitrary code.**
-- **Split beneficiary ETH sends can fail softly and reroute value.**
-- **Terminal `pay` and `addToBalanceOf` calls during split distribution can reenter external systems.**
-- **Split fallback can still strand value if the project terminal rejects leftovers.**
-- **There is no `ReentrancyGuard`.** Safety depends on state ordering, terminal auth, and wrapped external calls.
-
-## 4. Gas And DoS Vectors
-
-- **`totalCashOutWeight` iterates all tier IDs.**
-- **`balanceOf`, `votingUnitsOf`, and `totalSupplyOf` also iterate all tiers.**
-- **Large tier catalogs are technically allowed but not the supported operating shape.**
-- **`tiersOf` still traverses removed tiers until cleanup runs.**
-- **Minting across many tiers in one payment can get expensive fast.**
-- **Reserve minting is loop-based and should be batched when large.**
-
-## 5. Access Control
-
-- **`adjustTiers` is permissioned and respects append-only restrictions.**
-- **`mintFor` is permissioned and still depends on per-tier owner-mint flags.**
-- **`setDiscountPercentOf` is permissioned and can be one-way constrained.**
-- **`setMetadata` is permissioned and changes name, symbol, URIs, resolver, and tier URIs.**
-- **Transfer pause is tier-sensitive.**
-- **`mintPendingReservesFor` and `cleanTiers` are permissionless by design.**
-
-## 6. Integration Risks
-
-- **Hook weight can override fungible-token minting.**
-- **Metadata encoding is fragile.**
-- **`beforeCashOutRecordedWith` rejects mixed fungible-token cash outs.**
-- **Split group IDs are tightly coupled to the hook address.**
-- **ERC-20 split distribution depends on terminal allowance behavior.**
-- **Forwarded funds with empty hook metadata can skip distribution and remain in the hook.**
-- **Token URI resolver calls can block metadata reads if the resolver reverts.**
-
-## 7. Invariants To Verify
-
-- per-tier supply conservation holds
-- total cash-out weight stays consistent with outstanding NFTs and pending reserves
-- reserve minting stays bounded by reserve frequency
-- token IDs remain unique
-- credits track leftovers correctly
-- removed tiers stay excluded from active listings
-- store balance views match ERC-721 balances
-- discount monotonicity is enforced when locked
-
-## 8. Accepted Behaviors
-
-### 8.1 Pending reserves dilute cash-out value before minting
-
-This is intentional. Including pending reserves in the denominator prevents reserve front-running.
-
-### 8.2 Cash-out weight uses full price regardless of discount
-
-This is intentional. The cash-out weight represents treasury share, not purchase price.
-
-### 8.3 Currency mismatch can skip minting when no prices surface exists
-
-If currencies differ and `PRICES == address(0)`, payments can increase project balance without minting NFTs. That is an accepted degradation rather than a revert path.
-
-### 8.4 Tiny split allocations can round down to zero
-
-Dust-sized split allocations can become economically lossy after rounding.
-
-### 8.5 Failed split payouts only degrade cleanly if the fallback terminal path works
-
-If both the primary split path and the fallback `addToBalanceOf` path fail, the hook can retain assets with no built-in rescue path.
-
-### 8.6 Credit-funded tier purchases may underfund split obligations
-
-Pay credits can be used to buy tiers that carry a `splitPercent`. When credits satisfy part of the tier price, the fresh ETH forwarded to splits may be less than the split obligation implied by the full tier price. Project owners who consider this a problem should enable the `preventBuyingTierWithCredits` flag on affected tiers. This is accepted behavior.
-
-### 8.7 Changing the default reserve beneficiary redirects pending reserves
-
-When the default reserve beneficiary is updated, any pending (unminted) reserves across all tiers that rely on the default will be distributed to the new beneficiary once minted. This is by design — the project owner controls reserve distribution targets and may intentionally redirect pending reserves by updating the default.
-
-### 8.8 Discounted credit mints retain full cash-out weight
-
-Tokens minted at a discounted price via credits still carry the full undiscounted tier price as their cash-out weight. This means a holder who purchased at a discount receives the same treasury share as a holder who paid full price. Project owners should factor this into discount percentage decisions, as aggressive discounts can create favorable cash-out economics for discounted buyers.

package/SKILLS.md

@@ -1,43 +0,0 @@
-# Juicebox 721 Hook
-
-## Use This File For
-
-- Use this file when the task involves tiered NFT minting, reserve minting, tier adjustments, deployer wiring, or 721-aware cash-out behavior.
-- Start here, then decide whether the issue is in hook execution, store accounting, deployer setup, or resolver behavior.
-
-## Read This Next
-
-| If you need... | Open this next |
-|---|---|
-| Repo overview and architecture | [`README.md`](./README.md), [`ARCHITECTURE.md`](./ARCHITECTURE.md) |
-| Runtime hook behavior | [`src/JB721TiersHook.sol`](./src/JB721TiersHook.sol) |
-| Tier accounting | [`src/JB721TiersHookStore.sol`](./src/JB721TiersHookStore.sol) |
-| Shared math and metadata helpers | [`src/libraries/`](./src/libraries/), [`src/interfaces/`](./src/interfaces/), [`src/structs/`](./src/structs/) |
-| Deployer flows | [`src/JB721TiersHookDeployer.sol`](./src/JB721TiersHookDeployer.sol), [`src/JB721TiersHookProjectDeployer.sol`](./src/JB721TiersHookProjectDeployer.sol) |
-| Lifecycle, invariant, and audit coverage | [`test/E2E/Pay_Mint_Redeem_E2E.t.sol`](./test/E2E/Pay_Mint_Redeem_E2E.t.sol), [`test/invariants/TierLifecycleInvariant.t.sol`](./test/invariants/TierLifecycleInvariant.t.sol), [`test/invariants/TieredHookStoreInvariant.t.sol`](./test/invariants/TieredHookStoreInvariant.t.sol), [`test/audit/CodexSplitCreditsMismatch.t.sol`](./test/audit/CodexSplitCreditsMismatch.t.sol) |
-
-## Repo Map
-
-| Area | Where to look |
-|---|---|
-| Main contracts | [`src/`](./src/) |
-| Libraries, interfaces, and structs | [`src/libraries/`](./src/libraries/), [`src/interfaces/`](./src/interfaces/), [`src/structs/`](./src/structs/) |
-| Scripts | [`script/`](./script/) |
-| Tests | [`test/`](./test/) |
-
-## Purpose
-
-Tiered NFT hook for Juicebox V6. This repo handles priced NFT tiers, reserve logic, tier-aware cash outs, and deployer flows that wire those hooks into projects.
-
-## Reference Files
-
-- Open [`references/runtime.md`](./references/runtime.md) when you need hook and store roles, cash-out weight behavior, or main invariants.
-- Open [`references/operations.md`](./references/operations.md) when you need permission paths, tier-adjustment rules, test breadcrumbs, or common stale assumptions.
-
-## Working Rules
-
-- Start in [`src/JB721TiersHookStore.sol`](./src/JB721TiersHookStore.sol) for tier accounting questions.
-- Keep hook behavior, store behavior, and resolver behavior separate.
-- Reserve logic, split routing, and cash-out weight calculations are part of the economic surface.
-- Tier adjustments are high-risk because many tier properties are intentionally immutable after creation.
-- If a problem looks like metadata only, verify it is not actually a hook or store issue first.