@getcofund/protocol 0.0.0 → 0.1.0

package/dist/evm/eip712.d.ts

@@ -0,0 +1,271 @@
+import { type Address, type Hex } from "viem";
+/**
+ * Every EIP-712 payload the v1 contract stack verifies, in one file, shared by
+ * the webapp (`apps/cofund/src/lib/evm/eip712.ts` re-exports it) and the SDK.
+ * A client that signs locally rebuilds the digest from these definitions and
+ * never from types or a domain a server handed it.
+ *
+ * `docs/v1-relaunch-design.md` §4.2 freezes nine struct types across three
+ * domains, and the field ORDER is part of the contract twice over: it is what
+ * `keccak256(typeString)` hashes, and it is the order a Ledger renders on
+ * screen (§8.1 — `company` first so an admin at two orgs can tell which one
+ * they are approving for; `authId` last so a descriptor can hide it).
+ *
+ * These objects are the single source of truth. They used to be scattered over
+ * `gen-eth-transfer-sig.ts`, `api/documents/util/eth-helpers.ts`,
+ * `gen-eth-policy-creation-sig.ts`, `invite-authorization-signature.ts` and
+ * three Ledger builders, each with its own copy — and the copies drifted (a
+ * device signed a `ForwardRequest` while the server recovered an `InviteUser`,
+ * rejecting every Ledger admin's EVM invite). One definition, imported.
+ *
+ * NEVER hand one of these objects straight to the Ledger Ethereum SDK: it adds
+ * an `EIP712Domain` key to the `types` object it is given, IN PLACE. Poisoning
+ * a module-level constant breaks every later signer or hasher that uses it
+ * (an ethers or viem call: "ambiguous primary types or unused types") for the
+ * lifetime of the tab.
+ * `Object.freeze` makes that a loud failure instead of a silent one; call sites
+ * that must hand over a mutable object use the `…Types()` copy functions.
+ */
+type Field = {
+    name: string;
+    type: string;
+};
+/**
+ * Mutable in the TYPE so a signer whose field lists are mutable (ethers'
+ * `TypedDataField[]`) accepts these directly, frozen at RUNTIME so a mutating
+ * consumer fails loudly rather than poisoning the module for the tab.
+ * Structural typing cannot express both, and the runtime guarantee is the one
+ * that has actually bitten.
+ */
+type TypeSet = Record<string, Field[]>;
+/**
+ * ONE domain for every payload in the stack:
+ * `{ name: "Cofund", version: "1", chainId, verifyingContract: State }`.
+ *
+ * v0 had three names and three verifying contracts — `cofund-signer/1.0.0` on
+ * the vault clone, `CFHelpersPolicies/v0` on the policies helper, and
+ * `Cofund Forwarder/1` on the forwarder. The forwarder is gone (§1) and the
+ * other two collapsed, because neither of the things a per-contract domain was
+ * doing survives scrutiny:
+ *
+ *   - **It did not scope a signature to an org.** Every v1 struct carries
+ *     `string company`, and every entrypoint checks
+ *     `sha256(bytes(company)) == clientId` before it looks at a signature.
+ *     That is what stops one client's approval moving another's money; the
+ *     vault clone's address never was.
+ *   - **It did scope a signature to a HELPER, which was a liability.** An
+ *     admin's frozen invite authorization was bound to the users helper's
+ *     address, so `gov.setHelperContract("users", …)` silently invalidated
+ *     every unspent invite — a state one production migration had to repair by
+ *     hand. Binding to State instead makes a helper rotation invisible to
+ *     anything already signed.
+ *
+ * What is left is a deployment identifier, which is exactly what a domain is
+ * for: a digest made for this chain's State cannot be replayed against another
+ * chain's, and nothing has to resolve a contract address before it can build
+ * one. The browser and the server therefore cannot disagree about a domain.
+ */
+export type Eip712Domain = {
+    name: string;
+    version: string;
+    chainId: number;
+    verifyingContract: string;
+};
+/** The domain for one deployment: the chain id and that chain's State. */
+export declare function buildCofundDomain({ chainId, state, }: {
+    chainId: number;
+    /** `CFHelpersStatev1` on that chain. */
+    state: string;
+}): Eip712Domain & {
+    name: "Cofund";
+    version: "1";
+};
+/**
+ * The whole of an invite (§4.4). No `inviteHash` and no invite code: v1 has no
+ * pending invite on chain, so what the admin signs IS the seat — identity,
+ * role, position — bounded by `expiresAt` and replay-protected by `authId`.
+ * The member later signs this SAME digest with their own key, and the platform
+ * relays both in one `users.addUser`.
+ */
+export declare const INVITE_USER_TYPES: TypeSet;
+/** `CFHelpersUsersv1.MAX_INVITE_LIFETIME`: the furthest out an `InviteUser`'s `expiresAt` may be. */
+export declare const MAX_INVITE_LIFETIME_SECONDS: number;
+/**
+ * Headroom under the contract's ceiling. `_requireWindow` rejects
+ * `expiresAt > block.timestamp + MAX_INVITE_LIFETIME`, and `block.timestamp`
+ * at inclusion is the sequencer's clock, not the signer's: signing exactly
+ * `now + 30 days` reverts with `InvalidParams` whenever the chain is even one
+ * second behind (clock skew, a lagging L2 sequencer). Anvil stamps blocks from
+ * the same wall clock, so no local stack ever shows it. A full day of headroom
+ * (so 29 days signed) is far beyond any skew.
+ */
+export declare const CHAIN_CLOCK_SKEW_MARGIN_SECONDS: number;
+/** What an inviting admin signs: the ceiling minus the skew margin. */
+export declare const INVITE_LIFETIME_SECONDS: number;
+/** An invite's `expiresAt`: unix SECONDS, as `uint256 expiresAt` wants them. */
+export declare function inviteExpiresAt(now?: Date, lifetimeSeconds?: number): string;
+export declare const REMOVE_USER_TYPES: TypeSet;
+/**
+ * Closing a client's onboarding phase (§4.3, round 4).
+ *
+ * While `state.onboardingComplete(clientId)` is false the founder is allowed
+ * to act alone: one admin signature seats a co-admin, and one activates a
+ * policy. This is what ends that — signed by ANY active admin of the client,
+ * relayed like everything else, and irreversible (`OnboardingAlreadyComplete`
+ * on a second attempt).
+ */
+export declare const COMPLETE_ONBOARDING_TYPES: TypeSet;
+export declare const ROTATE_USER_TYPES: TypeSet;
+export type InviteUserMessage = {
+    company: string;
+    callerId: string;
+    userId: string;
+    userIsAdmin: boolean;
+    userPosition: string;
+    /** Unix SECONDS. `users.addUser` caps it at `now + 30 days`. */
+    expiresAt: string;
+    authId: string;
+};
+export type CompleteOnboardingMessage = {
+    company: string;
+    authId: string;
+};
+export type RemoveUserMessage = {
+    company: string;
+    removedUserId: string;
+    authId: string;
+};
+export type RotateUserMessage = {
+    company: string;
+    userId: string;
+    newAddress: string;
+    authId: string;
+};
+/**
+ * v0's single `PolicyActivation` carried both option groups with the unused
+ * half zeroed, plus `signersHash` and `trRecipientsHash`. v1 splits it in two
+ * so the zeroed half never reaches a device, and unhashes both arrays (§8.1
+ * tier A): the signer set is `string[] signerIds` — the members' on-chain user
+ * ids, NOT their addresses — and the allowlist is `address[] recipients`.
+ */
+export declare const TRANSFER_POLICY_ACTIVATION_TYPES: TypeSet;
+export declare const TRANSACTION_POLICY_ACTIVATION_TYPES: TypeSet;
+export declare const POLICY_DEACTIVATION_TYPES: TypeSet;
+export type TransferPolicyActivationMessage = {
+    company: string;
+    policyId: string;
+    title: string;
+    policyType: string;
+    signerIds: string[];
+    threshold: string;
+    token: string;
+    maxAmount: string;
+    recipients: string[];
+    authId: string;
+};
+export type TransactionPolicyActivationMessage = {
+    company: string;
+    policyId: string;
+    title: string;
+    policyType: string;
+    signerIds: string[];
+    threshold: string;
+    wrapper: string;
+    func: string;
+    authId: string;
+};
+export type PolicyDeactivationMessage = {
+    company: string;
+    policyId: string;
+    authId: string;
+};
+export declare const TRANSFER_TYPES: TypeSet;
+/**
+ * `allowancesHash` is gone: the allowances a signer grants the wrapper are the
+ * risk of the action, so they travel as a nested struct array and render on
+ * device. Note the rename AND the field swap — v0 hashed
+ * `ERC20Allowance(uint256 amount,address asset)`, v1 signs
+ * `Allowance(address asset,uint256 amount)`.
+ *
+ * `instructionsHash` stays a hash: the wrapper's calldata is arbitrary bytes
+ * and per-wrapper decoding is its own project (§4.2).
+ */
+export declare const TRANSACTION_TYPES: TypeSet;
+export type AllowanceMessage = {
+    asset: string;
+    amount: string;
+};
+/**
+ * The one function name a Cofund wrapper transaction ever carries.
+ *
+ * Every wrapper exposes a single entrypoint, `routerWrapper(func, instructions)`,
+ * and routes on `instructions`; `func` is a label the policy commits to at
+ * activation and the signers approve at execution. It is a constant, never a
+ * value read off the protocol record (`supportedActions` is display copy), so
+ * activation, request creation, co-signing and the relay all name the same
+ * thing — the app enforces the equality the live v1 vault does not.
+ */
+export declare const WRAPPER_ENTRYPOINT = "entry";
+export type TransferMessage = {
+    company: string;
+    policyId: string;
+    messageType: string;
+    amount: string;
+    token: string;
+    recipient: string;
+    authId: string;
+};
+export type TransactionMessage = {
+    company: string;
+    policyId: string;
+    messageType: string;
+    wrapper: string;
+    func: string;
+    allowances: AllowanceMessage[];
+    instructionsHash: string;
+    authId: string;
+};
+export declare const inviteUserTypes: () => Record<string, Field[]>;
+export declare const removeUserTypes: () => Record<string, Field[]>;
+export declare const completeOnboardingTypes: () => Record<string, Field[]>;
+export declare const rotateUserTypes: () => Record<string, Field[]>;
+export declare const transferPolicyActivationTypes: () => Record<string, Field[]>;
+export declare const transactionPolicyActivationTypes: () => Record<string, Field[]>;
+export declare const policyDeactivationTypes: () => Record<string, Field[]>;
+export declare const transferTypes: () => Record<string, Field[]>;
+export declare const transactionTypes: () => Record<string, Field[]>;
+/**
+ * `sha256(bytes(company))`, 0x-prefixed: the id State keys a cofund by, which
+ * every entrypoint checks against the signed `company`.
+ */
+export declare function cofundClientId(company: string): Hex;
+/**
+ * One message as EIP-712 typed data: what a viem account's or wallet
+ * client's `signTypedData` takes (and `eth_signTypedData_v4`), and what
+ * `typedDataDigest` hashes. uint256 fields may be decimal strings, as the
+ * message types above carry them.
+ */
+export type TypedData = {
+    domain: Omit<Eip712Domain, "verifyingContract"> & {
+        verifyingContract: Address;
+    };
+    types: Record<string, readonly {
+        name: string;
+        type: string;
+    }[]>;
+    primaryType: string;
+    message: Record<string, unknown>;
+};
+/** The one type in `types` no other type references: EIP-712's primary type. */
+export declare function primaryTypeOf(types: Record<string, readonly {
+    name: string;
+    type: string;
+}[]>): string;
+/** `message` under `domain` as typed data, its primary type read from `types`. */
+export declare function typedData(domain: Eip712Domain, types: Record<string, readonly {
+    name: string;
+    type: string;
+}[]>, message: object): TypedData;
+/** The `\x19\x01`-prefixed digest a key signs and the contracts recover from. */
+export declare function typedDataDigest(data: TypedData): Hex;
+export {};

package/dist/evm/eip712.js

@@ -0,0 +1,224 @@
+import { hashTypedData, sha256, stringToBytes, } from "viem";
+/** The domain for one deployment: the chain id and that chain's State. */
+export function buildCofundDomain({ chainId, state, }) {
+    return { name: "Cofund", version: "1", chainId, verifyingContract: state };
+}
+/* ══════════════════════════════════════════════════════════════════════════
+ *  Users types — signed under the one `("Cofund", "1")` domain
+ * ═════════════════════════════════════════════════════════════════════════ */
+/**
+ * The whole of an invite (§4.4). No `inviteHash` and no invite code: v1 has no
+ * pending invite on chain, so what the admin signs IS the seat — identity,
+ * role, position — bounded by `expiresAt` and replay-protected by `authId`.
+ * The member later signs this SAME digest with their own key, and the platform
+ * relays both in one `users.addUser`.
+ */
+export const INVITE_USER_TYPES = Object.freeze({
+    InviteUser: [
+        { name: "company", type: "string" },
+        { name: "callerId", type: "string" },
+        { name: "userId", type: "string" },
+        { name: "userIsAdmin", type: "bool" },
+        { name: "userPosition", type: "string" },
+        { name: "expiresAt", type: "uint256" },
+        { name: "authId", type: "string" },
+    ],
+});
+/** `CFHelpersUsersv1.MAX_INVITE_LIFETIME`: the furthest out an `InviteUser`'s `expiresAt` may be. */
+export const MAX_INVITE_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
+/**
+ * Headroom under the contract's ceiling. `_requireWindow` rejects
+ * `expiresAt > block.timestamp + MAX_INVITE_LIFETIME`, and `block.timestamp`
+ * at inclusion is the sequencer's clock, not the signer's: signing exactly
+ * `now + 30 days` reverts with `InvalidParams` whenever the chain is even one
+ * second behind (clock skew, a lagging L2 sequencer). Anvil stamps blocks from
+ * the same wall clock, so no local stack ever shows it. A full day of headroom
+ * (so 29 days signed) is far beyond any skew.
+ */
+export const CHAIN_CLOCK_SKEW_MARGIN_SECONDS = 24 * 60 * 60;
+/** What an inviting admin signs: the ceiling minus the skew margin. */
+export const INVITE_LIFETIME_SECONDS = MAX_INVITE_LIFETIME_SECONDS - CHAIN_CLOCK_SKEW_MARGIN_SECONDS;
+/** An invite's `expiresAt`: unix SECONDS, as `uint256 expiresAt` wants them. */
+export function inviteExpiresAt(now = new Date(), lifetimeSeconds = INVITE_LIFETIME_SECONDS) {
+    return String(Math.floor(now.getTime() / 1000) + lifetimeSeconds);
+}
+export const REMOVE_USER_TYPES = Object.freeze({
+    RemoveUser: [
+        { name: "company", type: "string" },
+        { name: "removedUserId", type: "string" },
+        { name: "authId", type: "string" },
+    ],
+});
+/**
+ * Closing a client's onboarding phase (§4.3, round 4).
+ *
+ * While `state.onboardingComplete(clientId)` is false the founder is allowed
+ * to act alone: one admin signature seats a co-admin, and one activates a
+ * policy. This is what ends that — signed by ANY active admin of the client,
+ * relayed like everything else, and irreversible (`OnboardingAlreadyComplete`
+ * on a second attempt).
+ */
+export const COMPLETE_ONBOARDING_TYPES = Object.freeze({
+    CompleteOnboarding: [
+        { name: "company", type: "string" },
+        { name: "authId", type: "string" },
+    ],
+});
+export const ROTATE_USER_TYPES = Object.freeze({
+    RotateUser: [
+        { name: "company", type: "string" },
+        { name: "userId", type: "string" },
+        { name: "newAddress", type: "address" },
+        { name: "authId", type: "string" },
+    ],
+});
+/* ══════════════════════════════════════════════════════════════════════════
+ *  Policies types — signed under the one `("Cofund", "1")` domain
+ * ═════════════════════════════════════════════════════════════════════════ */
+/**
+ * v0's single `PolicyActivation` carried both option groups with the unused
+ * half zeroed, plus `signersHash` and `trRecipientsHash`. v1 splits it in two
+ * so the zeroed half never reaches a device, and unhashes both arrays (§8.1
+ * tier A): the signer set is `string[] signerIds` — the members' on-chain user
+ * ids, NOT their addresses — and the allowlist is `address[] recipients`.
+ */
+export const TRANSFER_POLICY_ACTIVATION_TYPES = Object.freeze({
+    TransferPolicyActivation: [
+        { name: "company", type: "string" },
+        { name: "policyId", type: "string" },
+        { name: "title", type: "string" },
+        { name: "policyType", type: "string" },
+        { name: "signerIds", type: "string[]" },
+        { name: "threshold", type: "uint256" },
+        { name: "token", type: "address" },
+        { name: "maxAmount", type: "uint256" },
+        { name: "recipients", type: "address[]" },
+        { name: "authId", type: "string" },
+    ],
+});
+export const TRANSACTION_POLICY_ACTIVATION_TYPES = Object.freeze({
+    TransactionPolicyActivation: [
+        { name: "company", type: "string" },
+        { name: "policyId", type: "string" },
+        { name: "title", type: "string" },
+        { name: "policyType", type: "string" },
+        { name: "signerIds", type: "string[]" },
+        { name: "threshold", type: "uint256" },
+        { name: "wrapper", type: "address" },
+        { name: "func", type: "string" },
+        { name: "authId", type: "string" },
+    ],
+});
+export const POLICY_DEACTIVATION_TYPES = Object.freeze({
+    PolicyDeactivation: [
+        { name: "company", type: "string" },
+        { name: "policyId", type: "string" },
+        { name: "authId", type: "string" },
+    ],
+});
+/* ══════════════════════════════════════════════════════════════════════════
+ *  Vault types — signed under the one `("Cofund", "1")` domain
+ * ═════════════════════════════════════════════════════════════════════════ */
+export const TRANSFER_TYPES = Object.freeze({
+    Transfer: [
+        { name: "company", type: "string" },
+        { name: "policyId", type: "string" },
+        { name: "messageType", type: "string" },
+        { name: "amount", type: "uint256" },
+        { name: "token", type: "address" },
+        { name: "recipient", type: "address" },
+        { name: "authId", type: "string" },
+    ],
+});
+/**
+ * `allowancesHash` is gone: the allowances a signer grants the wrapper are the
+ * risk of the action, so they travel as a nested struct array and render on
+ * device. Note the rename AND the field swap — v0 hashed
+ * `ERC20Allowance(uint256 amount,address asset)`, v1 signs
+ * `Allowance(address asset,uint256 amount)`.
+ *
+ * `instructionsHash` stays a hash: the wrapper's calldata is arbitrary bytes
+ * and per-wrapper decoding is its own project (§4.2).
+ */
+export const TRANSACTION_TYPES = Object.freeze({
+    Transaction: [
+        { name: "company", type: "string" },
+        { name: "policyId", type: "string" },
+        { name: "messageType", type: "string" },
+        { name: "wrapper", type: "address" },
+        { name: "func", type: "string" },
+        { name: "allowances", type: "Allowance[]" },
+        { name: "instructionsHash", type: "bytes32" },
+        { name: "authId", type: "string" },
+    ],
+    Allowance: [
+        { name: "asset", type: "address" },
+        { name: "amount", type: "uint256" },
+    ],
+});
+/**
+ * The one function name a Cofund wrapper transaction ever carries.
+ *
+ * Every wrapper exposes a single entrypoint, `routerWrapper(func, instructions)`,
+ * and routes on `instructions`; `func` is a label the policy commits to at
+ * activation and the signers approve at execution. It is a constant, never a
+ * value read off the protocol record (`supportedActions` is display copy), so
+ * activation, request creation, co-signing and the relay all name the same
+ * thing — the app enforces the equality the live v1 vault does not.
+ */
+export const WRAPPER_ENTRYPOINT = "entry";
+/* ══════════════════════════════════════════════════════════════════════════
+ *  Mutable copies for signers that write into `types`
+ * ═════════════════════════════════════════════════════════════════════════ */
+/**
+ * A disposable copy for the Ledger Ethereum SDK, which inserts `EIP712Domain`
+ * into the object it is handed. The field arrays are shared but never written
+ * to — only the top-level object gains keys, and that is what has to stay
+ * private to the call.
+ */
+function copy(types) {
+    return Object.fromEntries(Object.entries(types).map(([name, fields]) => [name, [...fields]]));
+}
+export const inviteUserTypes = () => copy(INVITE_USER_TYPES);
+export const removeUserTypes = () => copy(REMOVE_USER_TYPES);
+export const completeOnboardingTypes = () => copy(COMPLETE_ONBOARDING_TYPES);
+export const rotateUserTypes = () => copy(ROTATE_USER_TYPES);
+export const transferPolicyActivationTypes = () => copy(TRANSFER_POLICY_ACTIVATION_TYPES);
+export const transactionPolicyActivationTypes = () => copy(TRANSACTION_POLICY_ACTIVATION_TYPES);
+export const policyDeactivationTypes = () => copy(POLICY_DEACTIVATION_TYPES);
+export const transferTypes = () => copy(TRANSFER_TYPES);
+export const transactionTypes = () => copy(TRANSACTION_TYPES);
+/**
+ * `sha256(bytes(company))`, 0x-prefixed: the id State keys a cofund by, which
+ * every entrypoint checks against the signed `company`.
+ */
+export function cofundClientId(company) {
+    return sha256(stringToBytes(company));
+}
+/** `[]` or `[n]`, repeated: what makes a type an array of its base type. */
+const ARRAY_SUFFIX = /(\[\d*\])+$/;
+/** The one type in `types` no other type references: EIP-712's primary type. */
+export function primaryTypeOf(types) {
+    const referenced = new Set(Object.values(types).flatMap((fields) => fields.map(({ type }) => type.replace(ARRAY_SUFFIX, ""))));
+    const primary = Object.keys(types).filter((name) => name !== "EIP712Domain" && !referenced.has(name));
+    if (primary.length !== 1) {
+        throw new Error(`Typed data needs exactly one primary type, not ${primary.length}`);
+    }
+    return primary[0];
+}
+/** `message` under `domain` as typed data, its primary type read from `types`. */
+export function typedData(domain, types, message) {
+    return {
+        domain: {
+            ...domain,
+            verifyingContract: domain.verifyingContract,
+        },
+        types,
+        primaryType: primaryTypeOf(types),
+        message: message,
+    };
+}
+/** The `\x19\x01`-prefixed digest a key signs and the contracts recover from. */
+export function typedDataDigest(data) {
+    return hashTypedData(data);
+}

package/dist/evm/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@getcofund/protocol/evm`: the deployment config, the EIP-712 messages and
+ * the company name they carry, a call builder per contract entry point with
+ * its checks, State's reads, the two submitters, a vault call's simulation
+ * and how it is described, the StockSwap verb, the contracts' ABIs, and the
+ * values they are made of.
+ */
+export * from "./abis/index.ts";
+export * from "./address.ts";
+export * from "./calls/index.ts";
+export * from "./chain.ts";
+export * from "./company-name.ts";
+export * from "./deployment.ts";
+export * from "./eip712.ts";
+export * from "./reads.ts";
+export { CallRefusedError, type RecoverFailure, tryRecover, } from "./signatures.ts";
+export * from "./simulate/index.ts";
+export * from "./stocks/index.ts";
+export * from "./submitters.ts";
+export * from "./types.ts";

package/dist/evm/index.js

@@ -0,0 +1,21 @@
+/**
+ * `@getcofund/protocol/evm`: the deployment config, the EIP-712 messages and
+ * the company name they carry, a call builder per contract entry point with
+ * its checks, State's reads, the two submitters, a vault call's simulation
+ * and how it is described, the StockSwap verb, the contracts' ABIs, and the
+ * values they are made of.
+ */
+// biome-ignore lint/performance/noBarrelFile: the package's `./evm` entry
+export * from "./abis/index.js";
+export * from "./address.js";
+export * from "./calls/index.js";
+export * from "./chain.js";
+export * from "./company-name.js";
+export * from "./deployment.js";
+export * from "./eip712.js";
+export * from "./reads.js";
+export { CallRefusedError, tryRecover, } from "./signatures.js";
+export * from "./simulate/index.js";
+export * from "./stocks/index.js";
+export * from "./submitters.js";
+export * from "./types.js";

package/dist/evm/reads.d.ts

@@ -0,0 +1,64 @@
+import { type Address, type Hex } from "viem";
+import { type EvmReader } from "./chain.ts";
+import type { EvmDeployment } from "./deployment.ts";
+/**
+ * State's getters, typed, through the consumer's reader: the registries and
+ * invariants every call builder checks against. There is no index: a
+ * consumer that needs history or speed brings its own.
+ */
+type Deployment = Pick<EvmDeployment, "state">;
+/** A user of a cofund as State holds them. */
+export type CofundUser = {
+    address: Address;
+    position: string;
+    isAdmin: boolean;
+    active: boolean;
+};
+/** `State.getUser`: null when `userId` was never seated in the cofund. */
+export declare function readUser(reader: EvmReader, deployment: Deployment, clientId: Hex, userId: string): Promise<CofundUser | null>;
+/** `State.getUserIdByAddress`: the user id `address` holds in the cofund, active or not; null when none. */
+export declare function readUserIdByAddress(reader: EvmReader, deployment: Deployment, clientId: Hex, address: Address): Promise<string | null>;
+/** A policy as State holds it. `signerIds` are the hashes State keeps: `keccak256(bytes(userId))`. */
+export type CofundPolicy = {
+    active: boolean;
+    title: string;
+    policyType: string;
+    signerIds: Hex[];
+    threshold: number;
+    /** A transaction policy's wrapper and function; a transfer policy's are zero. */
+    transaction: {
+        wrapper: Address;
+        func: string;
+    };
+    /** A transfer policy's cap, token and allowlist (empty: any recipient). */
+    transfer: {
+        maxAmount: bigint;
+        token: Address;
+        recipients: Address[];
+    };
+    isTransaction: boolean;
+};
+/** `State.getPolicy`: null when no policy was ever activated under `policyId`. */
+export declare function readPolicy(reader: EvmReader, deployment: Deployment, clientId: Hex, policyId: string): Promise<CofundPolicy | null>;
+/** `State.clientVaults`: the cofund's vault and its subscription tier; null before it is created. */
+export declare function readClientVault(reader: EvmReader, deployment: Deployment, clientId: Hex): Promise<{
+    vault: Address;
+    tier: string;
+} | null>;
+/** `State.onboardingComplete`: whether the cofund's onboarding phase is closed. */
+export declare function readOnboardingComplete(reader: EvmReader, deployment: Deployment, clientId: Hex): Promise<boolean>;
+/** `State.getActiveAdmins`: the cofund's active admins. */
+export declare function readActiveAdmins(reader: EvmReader, deployment: Deployment, clientId: Hex): Promise<number>;
+/** A helper State registers: the users and policies helpers, the vault factory, the guard, gov. */
+export type HelperKind = "users" | "policies" | "vaults" | "sponsorGuard" | "gov";
+/** `State.helperContracts(kind)`: zero when none is registered. */
+export declare function readHelperContract(reader: EvmReader, deployment: Deployment, kind: HelperKind): Promise<Address>;
+/** `State.getClientContractAuthID`: whether `authId` is spent for the cofund (one use, across every helper and the vault). */
+export declare function readAuthIdSpent(reader: EvmReader, deployment: Deployment, clientId: Hex, authId: string): Promise<boolean>;
+/** `Users.requiredAdminInviteSignatures`: admin signatures an admin seat needs, the inviter's included. */
+export declare function readRequiredAdminInviteSignatures(reader: EvmReader, deployment: Pick<EvmDeployment, "users">, clientId: Hex): Promise<number>;
+/** `Policies.requiredPolicyActivationSignatures`: admin signatures activating a policy of `threshold` needs. */
+export declare function readRequiredPolicyActivationSignatures(reader: EvmReader, deployment: Pick<EvmDeployment, "policies">, clientId: Hex, threshold: number | bigint): Promise<number>;
+/** `VaultFactory.predictVault`: the address a cofund's vault has, or will have once it is created. */
+export declare function readPredictedVault(reader: EvmReader, deployment: Pick<EvmDeployment, "vaults">, clientId: Hex): Promise<Address>;
+export {};