@forgezero/runtime 0.1.15 → 0.1.17

package/README.md

@@ -5,7 +5,7 @@
   and commit the generator and rendered files together.
 -->
 
-# @forgezero/runtime
+# Platform runtime
 
 The machinery behind a request handler — jobs, queues, an outbox, a hash-chained audit trail, mail, backups, schema validation and exact money. 30 public modules, each imported on its own.
 

package/dist/jobs.d.ts

@@ -1,15 +1,14 @@
 /**
  * Jobs — background work that does not corrupt anything when it goes wrong.
  *
- * ForgeZero needs session and step-up reaping, provider health probes and
- * invoice runs. An exchange needs a deposit scanner and a withdrawal processor.
- * They are the same machinery, and the same four mistakes sink all of them:
+ * ForgeZero needs session and step-up reaping, provider health probes, Vault
+ * rotations and invoice runs. The same four mistakes sink all of them:
  *
  *   OVERLAP    `setInterval` fires again while the previous run is still going.
- *              Two deposit scans reading the same block credit it twice.
+ *              Two rotation scans may promote competing credential generations.
  *   CURSOR     the cursor advances past a batch that failed halfway, so the
- *              deposits in it are never seen again and the shortfall is found
- *              by a customer.
+ *              records in it are never seen again and the missed work is found
+ *              only after an operational failure.
  *   DUPLICATE  two processes run the same job because nothing coordinated them.
  *   SHUTDOWN   a deploy kills a run mid-write, leaving a record half-updated.
  *
@@ -200,7 +199,7 @@ export interface CursorJobSpec<T> extends Omit<JobSpec, 'run'> {
  * item three of ten throws, the whole batch is retried from the same cursor on
  * the next run. That means `process` must be idempotent — items one and two will
  * be seen again — and idempotent retries are strictly better than the
- * alternative, which is deposits that are never seen at all.
+ * alternative, which is records that are never processed at all.
  *
  * The lease is re-checked between batches. A run that stalled past its lease and
  * woke up must not keep writing while another process is doing the same work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/runtime",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -134,7 +134,7 @@
     "prepublishOnly": "bun ../tools/package-task.ts prepublish runtime"
   },
   "dependencies": {
-    "@forgezero/access": "^0.1.10"
+    "@forgezero/access": "^0.1.12"
   },
   "peerDependencies": {
     "@noble/ciphers": "^2.2.0",
@@ -200,9 +200,6 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE",
-    "contracts/src",
-    "contracts/test",
-    "contracts/foundry.toml"
+    "LICENSE"
   ]
 }

package/contracts/foundry.toml

@@ -1,9 +0,0 @@
-[profile.default]
-src = "src"
-test = "test"
-out = "out"
-libs = []
-solc_version = "0.8.24"
-optimizer = true
-optimizer_runs = 200
-evm_version = "shanghai"

package/contracts/src/ColdVault.sol

@@ -1,206 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import { IERC20 } from './IERC20.sol';
-import { SafeTransferLib } from './SafeTransferLib.sol';
-
-/**
- * Cold storage: M-of-N custodians, and nothing else can move anything.
- *
- * There is no operator role here, no owner who can withdraw, and no key held by
- * any running process. Funds move only when M distinct custodians have each
- * signed the same withdrawal off-chain — on a Ledger, on an air-gapped machine,
- * on whatever they keep their key in. The signatures are collected however the
- * platform likes and submitted by anyone; the submitter has no power beyond
- * paying for gas.
- *
- * That is what makes it cold. Compromising every server the platform runs does
- * not move a single token, because no server holds a key that can.
- *
- * ## EIP-712, so a custodian can read what they are signing
- *
- * A raw hash tells a hardware wallet nothing, and a custodian approving an
- * opaque blob is a custodian who will eventually approve the wrong one. The
- * typed structure shows the token, the destination and the amount on the
- * device's own screen.
- *
- * ## What binds a signature to exactly one withdrawal
- *
- *   chainId              a testnet rehearsal cannot be replayed on mainnet
- *   verifyingContract    a signature for one vault is void at another
- *   nonce                each approval is spendable once, in order
- *   token/to/amount      changing any of them invalidates every signature
- *
- * Without all four, a signature gathered once is a signature reusable forever.
- */
-contract ColdVault {
-	using SafeTransferLib for address;
-
-	/* --------------------------------------------------------------- state --- */
-
-	mapping(address => bool) public isCustodian;
-	address[] private custodianList;
-	uint256 public threshold;
-	uint256 public nonce;
-
-	bytes32 private immutable DOMAIN_SEPARATOR;
-
-	bytes32 private constant WITHDRAW_TYPEHASH =
-		keccak256('Withdraw(address token,address to,uint256 amount,uint256 nonce)');
-
-	/* -------------------------------------------------------------- events --- */
-
-	event Withdrawn(address indexed token, address indexed to, uint256 amount, uint256 nonce);
-	event CustodiansChanged(address[] custodians, uint256 threshold);
-
-	/* -------------------------------------------------------------- errors --- */
-
-	error BadThreshold();
-	error DuplicateCustodian();
-	error ZeroAddress();
-	error NotEnoughSignatures(uint256 got, uint256 need);
-	error SignaturesOutOfOrder();
-	error NotACustodian(address signer);
-	error NativeSendFailed();
-	error OnlySelf();
-
-	constructor(address[] memory initialCustodians, uint256 requiredSignatures) {
-		_setCustodians(initialCustodians, requiredSignatures);
-		DOMAIN_SEPARATOR = keccak256(
-			abi.encode(
-				keccak256('EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)'),
-				keccak256('ForgeZeroColdVault'),
-				keccak256('1'),
-				block.chainid,
-				address(this)
-			)
-		);
-	}
-
-	/* ------------------------------------------------------------ withdraw --- */
-
-	/**
-	 * Move funds, given M valid custodian signatures over exactly this request.
-	 *
-	 * Signatures must be ordered by ascending signer address. That is not a style
-	 * choice: it is how the same custodian signing twice is rejected in one pass
-	 * without allocating a set, and without it an M-of-N vault is satisfied by
-	 * one custodian submitting M copies of their own approval.
-	 */
-	function withdraw(
-		address token,
-		address to,
-		uint256 amount,
-		bytes[] calldata signatures
-	) external {
-		if (to == address(0)) revert ZeroAddress();
-		if (signatures.length < threshold) revert NotEnoughSignatures(signatures.length, threshold);
-
-		bytes32 digest = keccak256(
-			abi.encodePacked(
-				'\x19\x01',
-				DOMAIN_SEPARATOR,
-				keccak256(abi.encode(WITHDRAW_TYPEHASH, token, to, amount, nonce))
-			)
-		);
-
-		address previous = address(0);
-		for (uint256 i = 0; i < signatures.length; ) {
-			address signer = _recover(digest, signatures[i]);
-			if (!isCustodian[signer]) revert NotACustodian(signer);
-			// Strictly increasing. Equal means the same custodian counted twice.
-			if (signer <= previous) revert SignaturesOutOfOrder();
-			previous = signer;
-			unchecked { ++i; }
-		}
-
-		// Bumped BEFORE the transfer, so every gathered signature is spent whether
-		// or not the token behaves, and a reverting token cannot be used to replay.
-		unchecked { ++nonce; }
-
-		if (token == address(0)) {
-			(bool ok, ) = to.call{ value: amount }('');
-			if (!ok) revert NativeSendFailed();
-		} else {
-			token.safeTransfer(to, amount);
-		}
-		emit Withdrawn(token, to, amount, nonce - 1);
-	}
-
-	/**
-	 * Rotate the custodian set — itself requiring the current quorum.
-	 *
-	 * Callable only by this contract, through `withdraw`-style quorum: the
-	 * platform submits a call to `address(this)` and the existing M must approve
-	 * it. A custodian set changeable by anything less than the set itself is not
-	 * a quorum.
-	 */
-	function setCustodians(address[] calldata nextCustodians, uint256 requiredSignatures) external {
-		if (msg.sender != address(this)) revert OnlySelf();
-		_setCustodians(nextCustodians, requiredSignatures);
-	}
-
-	function custodians() external view returns (address[] memory) {
-		return custodianList;
-	}
-
-	/** What a custodian's device should be asked to sign, for the next withdrawal. */
-	function digestFor(address token, address to, uint256 amount) external view returns (bytes32) {
-		return
-			keccak256(
-				abi.encodePacked(
-					'\x19\x01',
-					DOMAIN_SEPARATOR,
-					keccak256(abi.encode(WITHDRAW_TYPEHASH, token, to, amount, nonce))
-				)
-			);
-	}
-
-	/* ----------------------------------------------------------- internals --- */
-
-	function _setCustodians(address[] memory custodians_, uint256 requiredSignatures) private {
-		// A threshold of one is not a quorum, and a threshold above the set size
-		// is a vault nobody can ever open.
-		if (requiredSignatures < 2 || requiredSignatures > custodians_.length) revert BadThreshold();
-
-		for (uint256 i = 0; i < custodianList.length; ) {
-			isCustodian[custodianList[i]] = false;
-			unchecked { ++i; }
-		}
-		delete custodianList;
-
-		for (uint256 i = 0; i < custodians_.length; ) {
-			address who = custodians_[i];
-			if (who == address(0)) revert ZeroAddress();
-			if (isCustodian[who]) revert DuplicateCustodian();
-			isCustodian[who] = true;
-			custodianList.push(who);
-			unchecked { ++i; }
-		}
-
-		threshold = requiredSignatures;
-		emit CustodiansChanged(custodians_, requiredSignatures);
-	}
-
-	function _recover(bytes32 digest, bytes calldata signature) private pure returns (address) {
-		if (signature.length != 65) return address(0);
-		bytes32 r;
-		bytes32 s;
-		uint8 v;
-		assembly {
-			r := calldataload(signature.offset)
-			s := calldataload(add(signature.offset, 32))
-			v := byte(0, calldataload(add(signature.offset, 64)))
-		}
-		if (v < 27) v += 27;
-		// secp256k1 signatures are malleable: (r, s) and (r, n-s) both verify. A
-		// vault that accepted both would let a submitted approval be mutated into a
-		// second distinct signature by the same custodian.
-		if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) {
-			return address(0);
-		}
-		return ecrecover(digest, v, r, s);
-	}
-
-	receive() external payable {}
-}

package/contracts/src/DepositFactory.sol

@@ -1,202 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import { IERC20 } from './IERC20.sol';
-import { DepositProxy } from './DepositProxy.sol';
-import { SafeTransferLib } from './SafeTransferLib.sol';
-
-/**
- * Deterministic deposit addresses, and the sweep that collects them.
- *
- * ## The salt is opaque, deliberately
- *
- * This contract never learns what a salt MEANS. A platform that gives each user
- * one lasting deposit address and a platform that mints a fresh address per
- * invoice both work here unchanged, because the only thing this needs is a
- * distinct 32-byte value. That is the difference between a runtime and one
- * business's contract: encoding "user" or "invoice" here would force the choice
- * on everybody who ever deployed it.
- *
- * The convention belongs to the caller — `keccak256("<app>:user:" || key)` or
- * `keccak256("<app>:invoice:" || key)` — and both are just bytes32 to this
- * contract.
- *
- * ## No chain write to create an address
- *
- * `computeAddress` is pure arithmetic over the deployer, the salt and the proxy
- * init-code hash, so a platform derives a million deposit addresses with zero
- * transactions and zero gas. The proxy is deployed lazily, at the first sweep,
- * and only for addresses that actually received something.
- *
- * ## What this contract does NOT do
- *
- * It holds no policy. There is no per-user balance, no reserve, no fee, no
- * notion of what is owed to whom — those are the platform's, and they belong in
- * the platform's ledger where they can be changed without a redeploy. This moves
- * tokens and nothing else.
- */
-contract DepositFactory {
-	using SafeTransferLib for address;
-
-	address public owner;
-	address public pendingOwner;
-
-	/**
-	 * `keccak256(type(DepositProxy).creationCode)`, fixed at deploy.
-	 *
-	 * Exposed so an off-chain caller can mirror `computeAddress` byte for byte
-	 * instead of hardcoding a hash that silently stops matching after a compiler
-	 * upgrade.
-	 */
-	bytes32 public immutable PROXY_INIT_CODE_HASH;
-
-	event ProxyDeployed(bytes32 indexed salt, address indexed proxy);
-	event Swept(bytes32 indexed salt, address indexed token, uint256 amount);
-	event PaidOut(address indexed token, address indexed to, uint256 amount);
-	event OwnerProposed(address indexed newOwner);
-	event OwnerAccepted(address indexed previous, address indexed next);
-
-	error NotOwner();
-	error NotPendingOwner();
-	error ZeroAddress();
-	error Create2Failed();
-	error LengthMismatch();
-	error NativeSendFailed();
-
-	modifier onlyOwner() {
-		if (msg.sender != owner) revert NotOwner();
-		_;
-	}
-
-	constructor(address initialOwner) {
-		if (initialOwner == address(0)) revert ZeroAddress();
-		owner = initialOwner;
-		PROXY_INIT_CODE_HASH = keccak256(type(DepositProxy).creationCode);
-		emit OwnerAccepted(address(0), initialOwner);
-	}
-
-	/** The deposit address for a salt. Pure, so deriving costs nothing. */
-	function computeAddress(bytes32 salt) public view returns (address) {
-		return
-			address(
-				uint160(
-					uint256(
-						keccak256(
-							abi.encodePacked(bytes1(0xff), address(this), salt, PROXY_INIT_CODE_HASH)
-						)
-					)
-				)
-			);
-	}
-
-	/** Many at once, so a platform can reconcile a page of addresses in one call. */
-	function computeAddresses(bytes32[] calldata salts) external view returns (address[] memory out) {
-		out = new address[](salts.length);
-		for (uint256 i = 0; i < salts.length; ) {
-			out[i] = computeAddress(salts[i]);
-			unchecked { ++i; }
-		}
-	}
-
-	/**
-	 * Collect deposits into this contract, then pay out to the given destinations.
-	 *
-	 * One primitive rather than several, because every real operation is some
-	 * combination of the two halves:
-	 *
-	 *   withdraw for one user     salts=[one]   destinations=[external]
-	 *   consolidate to the float  salts=[many]  destinations=[hotAddress]
-	 *   move float to cold        salts=[]      destinations=[coldVault]
-	 *
-	 * Anything swept beyond what is paid out stays here as float, which is what
-	 * makes the middle case a single transaction instead of one per address.
-	 */
-	function sweepAndPay(
-		bytes32[] calldata salts,
-		address token,
-		address[] calldata destinations,
-		uint256[] calldata amounts
-	) external onlyOwner {
-		if (destinations.length != amounts.length) revert LengthMismatch();
-
-		for (uint256 i = 0; i < salts.length; ) {
-			address proxy = _ensureProxy(salts[i]);
-			uint256 before = _balanceOf(token);
-			DepositProxy(payable(proxy)).sweep(token, address(this));
-			// The DIFFERENCE, not a number passed in. A fee-on-transfer token
-			// delivers less than it was asked to send, and an event reporting the
-			// requested figure is a ledger entry for money that never arrived.
-			emit Swept(salts[i], token, _balanceOf(token) - before);
-			unchecked { ++i; }
-		}
-
-		for (uint256 j = 0; j < destinations.length; ) {
-			if (destinations[j] == address(0)) revert ZeroAddress();
-			_payOut(token, destinations[j], amounts[j]);
-			unchecked { ++j; }
-		}
-	}
-
-	/** Sweep only. The common case: consolidate into a vault held elsewhere. */
-	function sweepTo(bytes32[] calldata salts, address token, address destination)
-		external
-		onlyOwner
-	{
-		if (destination == address(0)) revert ZeroAddress();
-		for (uint256 i = 0; i < salts.length; ) {
-			DepositProxy(payable(_ensureProxy(salts[i]))).sweep(token, address(this));
-			unchecked { ++i; }
-		}
-		uint256 balance = _balanceOf(token);
-		if (balance > 0) _payOut(token, destination, balance);
-	}
-
-	function proposeOwner(address next) external onlyOwner {
-		if (next == address(0)) revert ZeroAddress();
-		pendingOwner = next;
-		emit OwnerProposed(next);
-	}
-
-	/**
-	 * Accepted by the new owner's own key.
-	 *
-	 * A one-step transfer to a mistyped address bricks every deposit address this
-	 * factory derives — the funds stay reachable only by a key nobody holds.
-	 */
-	function acceptOwnership() external {
-		if (msg.sender != pendingOwner) revert NotPendingOwner();
-		address previous = owner;
-		owner = msg.sender;
-		pendingOwner = address(0);
-		emit OwnerAccepted(previous, msg.sender);
-	}
-
-	function _ensureProxy(bytes32 salt) internal returns (address proxy) {
-		proxy = computeAddress(salt);
-		if (proxy.code.length == 0) {
-			bytes memory bytecode = type(DepositProxy).creationCode;
-			assembly {
-				proxy := create2(0, add(bytecode, 0x20), mload(bytecode), salt)
-			}
-			if (proxy == address(0)) revert Create2Failed();
-			emit ProxyDeployed(salt, proxy);
-		}
-	}
-
-	function _balanceOf(address token) internal view returns (uint256) {
-		return token == address(0) ? address(this).balance : IERC20(token).balanceOf(address(this));
-	}
-
-	function _payOut(address token, address to, uint256 amount) internal {
-		if (amount == 0) return;
-		if (token == address(0)) {
-			(bool ok, ) = to.call{ value: amount }('');
-			if (!ok) revert NativeSendFailed();
-		} else {
-			token.safeTransfer(to, amount);
-		}
-		emit PaidOut(token, to, amount);
-	}
-
-	receive() external payable {}
-}

package/contracts/src/DepositProxy.sol

@@ -1,72 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import { IERC20 } from './IERC20.sol';
-import { SafeTransferLib } from './SafeTransferLib.sol';
-
-/**
- * A deposit address that needs no key, no gas and no approval.
- *
- * This is the whole reason the CREATE2 pattern beats the obvious alternative.
- * Sweeping from an ordinary account requires that account to sign an approval,
- * which means every deposit address must first be funded with native coin and
- * must have a private key derived, held and used. With a thousand deposit
- * addresses that is a thousand gas top-ups and a thousand keys.
- *
- * A CREATE2 address holds balances before any code exists at it. The factory
- * deploys this contract there only at the moment of the first sweep, and the
- * constructor records the deployer, so nothing but that factory can ever move
- * the funds.
- *
- * ## Never change this file
- *
- * The address depends on `keccak256(type(DepositProxy).creationCode)`. Adding a
- * field, a function, or even changing the compiler settings changes the init
- * code hash, which changes EVERY derived deposit address. Funds already sent to
- * the old addresses stay recoverable only by the old factory. A change here is
- * a new contract, deployed by a new factory, with addresses re-derived.
- */
-contract DepositProxy {
-	using SafeTransferLib for address;
-
-	/** The factory that deployed this. Immutable, and the only caller allowed. */
-	address public immutable factory;
-
-	event Swept(address indexed token, address indexed to, uint256 amount);
-
-	error OnlyFactory();
-	error NativeSendFailed();
-
-	constructor() {
-		factory = msg.sender;
-	}
-
-	/**
-	 * Move the whole balance of `token` to `to`. `address(0)` means native coin.
-	 *
-	 * Returns silently on a zero balance rather than reverting, so a batch across
-	 * many addresses is not undone by the ones that were already swept.
-	 *
-	 * The amount is read from the chain rather than passed in: a figure computed
-	 * off-chain is stale by the time it mines, and a fee-on-transfer token would
-	 * make it wrong even if it were not.
-	 */
-	function sweep(address token, address to) external {
-		if (msg.sender != factory) revert OnlyFactory();
-		uint256 amount;
-		if (token == address(0)) {
-			amount = address(this).balance;
-			if (amount == 0) return;
-			(bool ok, ) = to.call{ value: amount }('');
-			if (!ok) revert NativeSendFailed();
-		} else {
-			amount = IERC20(token).balanceOf(address(this));
-			if (amount == 0) return;
-			token.safeTransfer(to, amount);
-		}
-		emit Swept(token, to, amount);
-	}
-
-	/** Native coin sent to a deposit address lands here without hitting a fallback. */
-	receive() external payable {}
-}

package/contracts/src/IERC20.sol

@@ -1,7 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-interface IERC20 {
-	function balanceOf(address account) external view returns (uint256);
-	function transfer(address to, uint256 amount) external returns (bool);
-}

package/contracts/src/MockTokens.sol

@@ -1,32 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-contract MockToken {
-	event Transfer(address indexed from, address indexed to, uint256 value);
-	mapping(address => uint256) public balanceOf;
-	function mint(address to, uint256 a) external { balanceOf[to] += a; emit Transfer(address(0), to, a); }
-	function transfer(address to, uint256 a) external returns (bool) {
-		balanceOf[msg.sender] -= a; balanceOf[to] += a; emit Transfer(msg.sender, to, a); return true;
-	}
-}
-
-/** USDT: `transfer` returns NOTHING. */
-contract MockNoReturnToken {
-	event Transfer(address indexed from, address indexed to, uint256 value);
-	mapping(address => uint256) public balanceOf;
-	function mint(address to, uint256 a) external { balanceOf[to] += a; emit Transfer(address(0), to, a); }
-	function transfer(address to, uint256 a) external {
-		balanceOf[msg.sender] -= a; balanceOf[to] += a; emit Transfer(msg.sender, to, a);
-	}
-}
-
-/** Takes a 1% cut on the way through. Delivers less than it was asked to send. */
-contract MockFeeToken {
-	event Transfer(address indexed from, address indexed to, uint256 value);
-	mapping(address => uint256) public balanceOf;
-	function mint(address to, uint256 a) external { balanceOf[to] += a; emit Transfer(address(0), to, a); }
-	function transfer(address to, uint256 a) external returns (bool) {
-		uint256 fee = a / 100;
-		balanceOf[msg.sender] -= a; balanceOf[to] += a - fee; emit Transfer(msg.sender, to, a - fee); return true;
-	}
-}

package/contracts/src/SafeTransferLib.sol

@@ -1,31 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-/**
- * ERC-20 transfer that survives the tokens people actually hold.
- *
- *   returns true     -> pass
- *   returns NOTHING  -> pass   (USDT on Ethereum, and it is not alone)
- *   returns false    -> revert
- *   reverts          -> revert
- *
- * The empty-returndata case is the one that matters. A call typed to return
- * `bool` reverts on decode against USDT, and that failure appears only on a
- * chain where real money is moving.
- *
- * Pair this with balanceOf-based sweeping — as the proxy and factory do — so a
- * fee-on-transfer token moves what is ACTUALLY held rather than an overstated
- * figure. Otherwise the platform pays out coins it does not have.
- */
-library SafeTransferLib {
-	bytes4 private constant TRANSFER_SELECTOR = 0xa9059cbb;
-
-	error TransferFailed();
-
-	function safeTransfer(address token, address to, uint256 amount) internal {
-		(bool ok, bytes memory data) = token.call(
-			abi.encodeWithSelector(TRANSFER_SELECTOR, to, amount)
-		);
-		if (!ok || (data.length != 0 && !abi.decode(data, (bool)))) revert TransferFailed();
-	}
-}

package/contracts/test/Custody.t.sol

@@ -1,361 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import { DepositFactory } from '../src/DepositFactory.sol';
-import { DepositProxy } from '../src/DepositProxy.sol';
-import { ColdVault } from '../src/ColdVault.sol';
-import { MockToken, MockNoReturnToken, MockFeeToken } from '../src/MockTokens.sol';
-
-/** Foundry cheatcodes, declared inline — this repository does not use submodules. */
-interface Vm {
-	function prank(address) external;
-	function expectRevert(bytes4) external;
-	function expectRevert(bytes calldata) external;
-	function expectRevert() external;
-	function deal(address, uint256) external;
-	function addr(uint256) external pure returns (address);
-	function sign(uint256, bytes32) external pure returns (uint8, bytes32, bytes32);
-	function warp(uint256) external;
-}
-
-contract CustodyTest {
-	Vm constant vm = Vm(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
-
-	DepositFactory factory;
-	MockToken token;
-	address owner = address(this);
-	address hot = address(0x8074);
-
-	function setUp() public {
-		factory = new DepositFactory(owner);
-		token = new MockToken();
-	}
-
-	/* ================================================== deposit factory === */
-
-	function test_addressIsDerivedWithNoChainWrite() public {
-		// A million deposit addresses cost nothing to derive. This is the whole
-		// advantage over generating and funding a key per address.
-		bytes32 salt = keccak256('anything');
-		address derived = factory.computeAddress(salt);
-		require(derived != address(0), 'derived');
-		require(derived.code.length == 0, 'nothing deployed yet');
-		require(factory.computeAddress(salt) == derived, 'stable');
-	}
-
-	function test_offChainDerivationMatchesTheContract() public {
-		// The formula a platform runs off-chain, computed here from the published
-		// init-code hash. If these ever disagree, deposits go to an address the
-		// platform is not watching.
-		bytes32 salt = keccak256('user:42');
-		address expected = address(
-			uint160(uint256(keccak256(abi.encodePacked(
-				bytes1(0xff), address(factory), salt, factory.PROXY_INIT_CODE_HASH()
-			))))
-		);
-		require(factory.computeAddress(salt) == expected, 'formula matches');
-	}
-
-	function test_theSaltIsOpaque_userOrInvoiceBothWork() public {
-		// The runtime never learns what a salt means. A per-user address and a
-		// per-invoice address are the same primitive with a different convention,
-		// and encoding either here would force it on every platform.
-		bytes32 perUser = keccak256(abi.encodePacked('app:user:', uint256(7)));
-		bytes32 perInvoice = keccak256(abi.encodePacked('app:invoice:', uint256(7)));
-		require(factory.computeAddress(perUser) != factory.computeAddress(perInvoice), 'distinct');
-	}
-
-	function test_sweepNeedsNoApprovalAndNoGasAtTheDepositAddress() public {
-		// The property that makes this design work at all. The deposit address has
-		// no key, no native balance and has never signed anything.
-		bytes32 salt = keccak256('user:1');
-		address deposit = factory.computeAddress(salt);
-		token.mint(deposit, 500);
-		require(deposit.balance == 0, 'no gas at the deposit address');
-
-		bytes32[] memory salts = new bytes32[](1);
-		salts[0] = salt;
-		factory.sweepTo(salts, address(token), hot);
-
-		require(token.balanceOf(deposit) == 0, 'collected');
-		require(token.balanceOf(hot) == 500, 'delivered');
-	}
-
-	function test_theProxyIsDeployedLazilyAndOnlyOnce() public {
-		bytes32 salt = keccak256('user:2');
-		address deposit = factory.computeAddress(salt);
-		token.mint(deposit, 100);
-
-		bytes32[] memory salts = new bytes32[](1);
-		salts[0] = salt;
-		factory.sweepTo(salts, address(token), hot);
-		require(deposit.code.length > 0, 'deployed on first sweep');
-
-		token.mint(deposit, 100);
-		factory.sweepTo(salts, address(token), hot);
-		require(token.balanceOf(hot) == 200, 'second sweep works');
-	}
-
-	function test_onlyTheFactoryCanSweepAProxy() public {
-		bytes32 salt = keccak256('user:3');
-		address deposit = factory.computeAddress(salt);
-		token.mint(deposit, 100);
-		bytes32[] memory salts = new bytes32[](1);
-		salts[0] = salt;
-		factory.sweepTo(salts, address(token), hot);
-
-		// Deployed now — and inert to everybody else.
-		vm.prank(address(0xBAD));
-		vm.expectRevert(DepositProxy.OnlyFactory.selector);
-		DepositProxy(payable(deposit)).sweep(address(token), address(0xBAD));
-	}
-
-	function test_manyAddressesConsolidateInOneTransaction() public {
-		bytes32[] memory salts = new bytes32[](3);
-		for (uint256 i = 0; i < 3; i++) {
-			salts[i] = keccak256(abi.encodePacked('user:', i));
-			token.mint(factory.computeAddress(salts[i]), 100);
-		}
-		factory.sweepTo(salts, address(token), hot);
-		require(token.balanceOf(hot) == 300, 'all three');
-	}
-
-	function test_anAlreadyEmptyAddressDoesNotUndoTheBatch() public {
-		bytes32[] memory salts = new bytes32[](2);
-		salts[0] = keccak256('empty');
-		salts[1] = keccak256('funded');
-		token.mint(factory.computeAddress(salts[1]), 250);
-		factory.sweepTo(salts, address(token), hot);
-		require(token.balanceOf(hot) == 250, 'funded one still swept');
-	}
-
-	function test_nativeCoinSweeps() public {
-		bytes32 salt = keccak256('native');
-		address deposit = factory.computeAddress(salt);
-		vm.deal(deposit, 3 ether);
-		bytes32[] memory salts = new bytes32[](1);
-		salts[0] = salt;
-		factory.sweepTo(salts, address(0), hot);
-		require(hot.balance == 3 ether, 'native delivered');
-	}
-
-	function test_usdtStyleTokenSweeps() public {
-		// Returns nothing from transfer. A bool-typed call reverts on decode.
-		MockNoReturnToken usdt = new MockNoReturnToken();
-		bytes32 salt = keccak256('usdt');
-		usdt.mint(factory.computeAddress(salt), 900);
-		bytes32[] memory salts = new bytes32[](1);
-		salts[0] = salt;
-		factory.sweepTo(salts, address(usdt), hot);
-		require(usdt.balanceOf(hot) == 900, 'usdt swept');
-	}
-
-	function test_feeOnTransferMovesWhatActuallyArrives() public {
-		// The proxy sweeps its measured balance, so the platform never credits a
-		// figure the token did not deliver.
-		MockFeeToken fee = new MockFeeToken();
-		bytes32 salt = keccak256('fee');
-		fee.mint(factory.computeAddress(salt), 1000);
-		bytes32[] memory salts = new bytes32[](1);
-		salts[0] = salt;
-		factory.sweepTo(salts, address(fee), hot);
-		// 1% on the way to the factory, 1% again on the way out.
-		require(fee.balanceOf(hot) < 1000, 'fee was taken');
-		require(fee.balanceOf(hot) > 970, 'and only the fee');
-	}
-
-	function test_aStrangerCannotSweep() public {
-		bytes32[] memory salts = new bytes32[](0);
-		vm.prank(address(0xBAD));
-		vm.expectRevert(DepositFactory.NotOwner.selector);
-		factory.sweepTo(salts, address(token), hot);
-	}
-}
-
-contract VaultTest {
-	Vm constant vm = Vm(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
-
-	ColdVault vault;
-	MockToken token;
-
-	uint256 k1 = 0xA11CE;
-	uint256 k2 = 0xB0B;
-	uint256 k3 = 0xCA401;
-	address c1;
-	address c2;
-	address c3;
-	address operator = address(0x0FF);
-	address payee = address(0xFEE);
-
-	function setUp() public {
-		c1 = vm.addr(k1);
-		c2 = vm.addr(k2);
-		c3 = vm.addr(k3);
-		address[] memory custodians = new address[](3);
-		// Sorted, because signatures must arrive in ascending signer order.
-		(custodians[0], custodians[1], custodians[2]) = _sorted(c1, c2, c3);
-		vault = new ColdVault(custodians, 2);
-		token = new MockToken();
-		token.mint(address(vault), 1_000_000);
-	}
-
-	function _sorted(address a, address b, address c) private pure returns (address, address, address) {
-		address t;
-		if (a > b) { t = a; a = b; b = t; }
-		if (b > c) { t = b; b = c; c = t; }
-		if (a > b) { t = a; a = b; b = t; }
-		return (a, b, c);
-	}
-
-	function _sign(uint256 key, bytes32 digest) private pure returns (bytes memory) {
-		(uint8 v, bytes32 r, bytes32 s) = vm.sign(key, digest);
-		return abi.encodePacked(r, s, v);
-	}
-
-	/** Two signatures, ordered by signer address as the vault requires. */
-	function _quorum(bytes32 digest) private view returns (bytes[] memory out) {
-		out = new bytes[](2);
-		uint256[3] memory keys = [k1, k2, k3];
-		address[3] memory addrs = [c1, c2, c3];
-		// Pick the two lowest addresses so the ordering rule is satisfied.
-		uint256 lowest = 0;
-		for (uint256 i = 1; i < 3; i++) if (addrs[i] < addrs[lowest]) lowest = i;
-		uint256 second = lowest == 0 ? 1 : 0;
-		for (uint256 i = 0; i < 3; i++) {
-			if (i != lowest && addrs[i] < addrs[second]) second = i;
-		}
-		if (second == lowest) second = (lowest + 1) % 3;
-		out[0] = _sign(keys[lowest], digest);
-		out[1] = _sign(keys[second], digest);
-		if (addrs[lowest] > addrs[second]) {
-			bytes memory tmp = out[0]; out[0] = out[1]; out[1] = tmp;
-		}
-	}
-
-	/* ======================================================= cold vault === */
-
-	function test_quorumMovesFunds() public {
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		vault.withdraw(address(token), payee, 5000, _quorum(digest));
-		require(token.balanceOf(payee) == 5000, 'paid');
-	}
-
-	function test_oneSignatureIsNotAQuorum() public {
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		bytes[] memory one = new bytes[](1);
-		one[0] = _sign(k1, digest);
-		vm.expectRevert(abi.encodeWithSelector(ColdVault.NotEnoughSignatures.selector, 1, 2));
-		vault.withdraw(address(token), payee, 5000, one);
-	}
-
-	function test_theSameCustodianTwiceIsNotTwoCustodians() public {
-		// Without the ascending-order rule, one custodian submits M copies of
-		// their own approval and an M-of-N vault is a 1-of-N vault.
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		bytes[] memory doubled = new bytes[](2);
-		doubled[0] = _sign(k1, digest);
-		doubled[1] = _sign(k1, digest);
-		vm.expectRevert(ColdVault.SignaturesOutOfOrder.selector);
-		vault.withdraw(address(token), payee, 5000, doubled);
-	}
-
-	function test_aStrangersSignatureIsRejected() public {
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		bytes[] memory sigs = new bytes[](2);
-		uint256 outsider = 0xDEAD;
-		address outsiderAddr = vm.addr(outsider);
-		// Ordered so the failure is "not a custodian", not the ordering rule.
-		if (outsiderAddr < c1) {
-			sigs[0] = _sign(outsider, digest);
-			sigs[1] = _sign(k1, digest);
-		} else {
-			sigs[0] = _sign(k1, digest);
-			sigs[1] = _sign(outsider, digest);
-		}
-		vm.expectRevert(abi.encodeWithSelector(ColdVault.NotACustodian.selector, outsiderAddr));
-		vault.withdraw(address(token), payee, 5000, sigs);
-	}
-
-	function test_aSpentApprovalCannotBeReplayed() public {
-		// The nonce is what makes a gathered signature spendable once. Without it,
-		// a set of approvals collected today drains the vault forever.
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		bytes[] memory sigs = _quorum(digest);
-		vault.withdraw(address(token), payee, 5000, sigs);
-
-		// The nonce moved, so the same bytes now recover to SOME other address --
-		// whichever one, it is not a custodian, and the vault refuses.
-		uint256 before = token.balanceOf(payee);
-		vm.expectRevert();
-		vault.withdraw(address(token), payee, 5000, sigs);
-		require(token.balanceOf(payee) == before, 'nothing moved twice');
-	}
-
-	function test_signaturesDoNotTransferToADifferentAmount() public {
-		// The amount is inside what was signed, so a submitter cannot inflate it.
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		bytes[] memory sigs = _quorum(digest);
-		vm.expectRevert();
-		vault.withdraw(address(token), payee, 999_999, sigs);
-		require(token.balanceOf(payee) == 0, 'nothing moved');
-	}
-
-	function test_signaturesDoNotTransferToADifferentDestination() public {
-		bytes32 digest = vault.digestFor(address(token), payee, 5000);
-		bytes[] memory sigs = _quorum(digest);
-		vm.expectRevert();
-		vault.withdraw(address(token), address(0xBAD), 5000, sigs);
-		require(token.balanceOf(address(0xBAD)) == 0, 'nothing moved');
-	}
-
-	function test_signaturesFromAnotherVaultAreVoidHere() public {
-		// `verifyingContract` is in the domain, so approvals gathered for one
-		// deployment cannot be pointed at another.
-		address[] memory custodians = new address[](3);
-		(custodians[0], custodians[1], custodians[2]) = _sorted(c1, c2, c3);
-		ColdVault other = new ColdVault(custodians, 2);
-		token.mint(address(other), 10_000);
-
-		bytes32 otherDigest = other.digestFor(address(token), payee, 5000);
-		bytes[] memory sigs = _quorum(otherDigest);
-		vm.expectRevert();
-		vault.withdraw(address(token), payee, 5000, sigs);
-		require(token.balanceOf(payee) == 0, 'nothing moved');
-	}
-
-	function test_aThresholdOfOneIsRefused() public {
-		address[] memory custodians = new address[](3);
-		(custodians[0], custodians[1], custodians[2]) = _sorted(c1, c2, c3);
-		vm.expectRevert(ColdVault.BadThreshold.selector);
-		new ColdVault(custodians, 1);
-	}
-
-	function test_aThresholdAboveTheSetIsRefused() public {
-		// A vault nobody can ever open is not more secure, it is destroyed.
-		address[] memory custodians = new address[](2);
-		custodians[0] = c1 < c2 ? c1 : c2;
-		custodians[1] = c1 < c2 ? c2 : c1;
-		vm.expectRevert(ColdVault.BadThreshold.selector);
-		new ColdVault(custodians, 3);
-	}
-
-	function test_nobodyCanRotateCustodiansWithoutTheQuorum() public {
-		address[] memory next = new address[](2);
-		next[0] = address(0x1);
-		next[1] = address(0x2);
-		vm.expectRevert(ColdVault.OnlySelf.selector);
-		vault.setCustodians(next, 2);
-	}
-
-	/* ------------------------------------------------------------------------
-	 * There is no hot vault, deliberately.
-	 *
-	 * A hot wallet is an ADDRESS, not a contract. The factory already holds float
-	 * and already sweeps to any destination, so a separate contract to hold
-	 * working capital adds a deployment, an upgrade path and a second set of
-	 * permissions without adding a property neither of these already has.
-	 *
-	 * Operational funds sit at whatever address the platform sweeps to; the cold
-	 * vault holds what M-of-N custodians guard. Two things, each doing one job.
-	 * ---------------------------------------------------------------------- */
-}

package/contracts/test/Vectors.t.sol

@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import { DepositFactory } from '../src/DepositFactory.sol';
-import { ColdVault } from '../src/ColdVault.sol';
-
-/**
- * Emit values the TypeScript client must reproduce.
- *
- * The client mirrors two pure contract functions. Checking it against itself
- * proves nothing — a formula wrong the same way every time is deterministic and
- * still points a platform at an address the factory cannot sweep.
- */
-contract VectorsTest {
-	function test_emitVectors() public {
-		// A fixed owner so the factory address is stable across runs.
-		DepositFactory factory = new DepositFactory(address(0xF00D));
-
-		bytes32 salt = keccak256(abi.encodePacked('myapp:user:', 'u1'));
-
-		address[] memory custodians = new address[](3);
-		custodians[0] = address(0x1111111111111111111111111111111111111111);
-		custodians[1] = address(0x2222222222222222222222222222222222222222);
-		custodians[2] = address(0x3333333333333333333333333333333333333333);
-		ColdVault vault = new ColdVault(custodians, 2);
-
-		bytes32 digest = vault.digestFor(
-			address(0xdAC17F958D2ee523a2206206994597C13D831ec7),
-			address(0x000000000000000000000000000000000000dEaD),
-			1_000_000
-		);
-
-		// Read from the trace; the TS test asserts against these.
-		require(factory.computeAddress(salt) != address(0), 'derived');
-		emit Vector('factory', abi.encode(address(factory)));
-		emit Vector('proxyInitCodeHash', abi.encode(factory.PROXY_INIT_CODE_HASH()));
-		emit Vector('salt', abi.encode(salt));
-		emit Vector('depositAddress', abi.encode(factory.computeAddress(salt)));
-		emit Vector('vault', abi.encode(address(vault)));
-		emit Vector('chainId', abi.encode(block.chainid));
-		emit Vector('withdrawDigest', abi.encode(digest));
-	}
-
-	event Vector(string name, bytes value);
-}