V48 Gate 4 (impl-only): Track Foundry lockfile

npm-like deps: commit foundry.lock, ignore lib/, drop
forge-std submodule, document forge install --no-git.

Author: geraldarthurdavis

.gitmodules

@@ -16,6 +16,3 @@
 [submodule "contract/lib/solmate"]
 	path = contract/lib/solmate
 	url = https://github.com/transmissions11/solmate
-[submodule "packages/btd/contracts/lib/forge-std"]
-	path = packages/btd/contracts/lib/forge-std
-	url = https://github.com/foundry-rs/forge-std

packages/btd/contracts/.gitignore

@@ -1,9 +1,14 @@
-# Foundry
+# Foundry build / local artifacts (regenerable)
 cache/
 out/
 broadcast/
+
+# Installed deps (like node_modules) — restore from foundry.lock
 lib/
 
 # Local env / keys (never commit)
 .env
 .env.*
+
+# Track the lockfile (like package-lock.json / pnpm-lock.yaml)
+# foundry.lock is NOT ignored

packages/btd/contracts/DEPLOY.md

@@ -16,9 +16,12 @@
 
 ## 1. Compile & unit test
 
+Deps are **not** vendored: `foundry.lock` is tracked; `lib/` is gitignored (like `node_modules`).
+
 ```bash
 cd packages/btd/contracts
-forge install foundry-rs/forge-std   # once per clone
+# Restore forge-std to the pin in foundry.lock (currently v1.16.2)
+forge install foundry-rs/forge-std@v1.16.2 --no-git
 forge build
 forge test -vv
 ```

packages/btd/contracts/README.md

@@ -19,19 +19,32 @@ DEPLOY.md
 
 Dual-maintain TS: `packages/btd/src/erc1155/`.
 
-## Setup (once per clone)
+## Dependencies (npm-like)
+
+| Track in git | Do not track |
+| --- | --- |
+| `foundry.toml` | `lib/` (installed packages) |
+| **`foundry.lock`** (exact pins) | `out/`, `cache/`, `broadcast/` |
+
+Current lock pins **forge-std @ v1.16.2** (`bf647bd…`).
+
+### Install / restore deps
 
 ```bash
 cd packages/btd/contracts
-forge install foundry-rs/forge-std
+# --no-git: install into lib/ without creating a git submodule
+forge install foundry-rs/forge-std@v1.16.2 --no-git
 ```
 
-`lib/` is local (see `.gitignore`).
+Use the tag/rev recorded in `foundry.lock` if the pin changes. After upgrading a dependency, **commit the updated `foundry.lock`**.
+
+Do **not** commit `lib/`.
 
 ## Build / test
 
 ```bash
 cd packages/btd/contracts
+forge install foundry-rs/forge-std@v1.16.2 --no-git   # if lib/ missing
 forge build
 forge test -vv
 ```

packages/btd/contracts/foundry.lock

@@ -0,0 +1,8 @@
+{
+  "lib/forge-std": {
+    "tag": {
+      "name": "v1.16.2",
+      "rev": "bf647bd6046f2f7da30d0c2bf435e5c76a780c1b"
+    }
+  }
+}

packages/btd/contracts/foundry.toml

@@ -1,3 +1,16 @@
+# BitcodeERC1155 Foundry project
+#
+# Dependency hygiene (npm-like):
+#   Track:  foundry.toml, foundry.lock
+#   Ignore: lib/ (install output), out/, cache/, broadcast/
+#
+# Restore deps after clone (pin must match foundry.lock):
+#   forge install foundry-rs/forge-std@v1.16.2 --no-git
+#
+# Upgrade a dep:
+#   forge install foundry-rs/forge-std@vX.Y.Z --no-git
+#   # commit the updated foundry.lock
+
 [profile.default]
 src = "src"
 out = "out"
@@ -8,7 +21,7 @@ optimizer_runs = 200
 # Quote hashing locals overflow stack without IR pipeline.
 via_ir = true
 
-# Remappings for forge-std
+# Remappings for forge-std (after forge install into lib/)
 remappings = ["forge-std/=lib/forge-std/src/"]
 
 [rpc_endpoints]