feat(app): unify reviewed HLP deposit flow

[i-xtsu-sixyou-ken-mei]

Intent

Make the existing Base USDC → Hyperliquid bridge + official HLP vault deposit behave as one guided invest flow from the current InvestRouteScreen, instead of maintaining a separate HLP execution wizard UI.

The product CTA becomes one guided action, while preserving the non-custodial signing boundary: the reviewed Base EVM batch is signed first, then Hyperliquid requests its own L1 typed-data signature only after the bridged USDC is actually credited.

Context

The repository already had the hard execution primitives:

• HyperCore bridge planning via DepositPlan.followUps
• official HLP mainnet vault 0xdfc24b077bc1425ad1dea75bcb6f8158e10df303
• @nktkas/hyperliquid vaultTransfer
• HyperCore USDC arrival polling
• HLP vault-equity verification
• submittedUnverified protection so an accepted vault transfer is never resent after a confirmation timeout

The missing piece was orchestration: the unified reviewed route only understood EVM review groups, while HLP lived behind HyperliquidDepositPanel's independent wizard.

The HLP minimum in the repo was also stale at 5 USDC (with a 6 USDC UI input buffer). Product direction for the official vault is 10 USDC minimum.

Scope

• Model HLP as an explicit invest destination while keeping Base as the funding/source chain.
• Pin HLP plan requests to HyperCore (split: { 1337: 1 }).
• Route HLP amount entry into the normal /invest/route review screen.
• Show the HLP follow-up, official vault, quoted HyperCore output, minimum, and lockup in the route summary.
• Snapshot pre-bridge HyperCore withdrawable USDC before submitting the reviewed Base batch.
• Resume the exact reviewed plan after submission without re-executing source calls.
• Track the existing LI.FI bridge, wait for the balance delta, then request the HLP typed-data signature.
• Verify HLP vault equity and retain the existing submitted-but-unverified terminal behavior.
• Change the HLP protocol/UI minimum to 10 USDC and update targeted contracts/tests.

Out of scope

• Making Hyperliquid vaultTransfer part of the Tenderly EVM simulation. It is a non-EVM Hyperliquid L1 action.
• Pre-signing or automatically signing the HLP action.
• Reworking normal Base Morpho, Arbitrum GMX, or two-chain strategy execution.
• Adding a backend custodian/relayer for the HLP signature.

Product contract / invariants

• This PR does not change a documented product/architecture invariant.
• This PR intentionally changes an invariant with explicit product approval.

Affected invariant:

• HLP vault minimum: 5 USDC / UI 6 USDC buffer → official 10 USDC minimum.
• HLP UX: independent wizard → unified reviewed invest route with a separate post-bridge Hyperliquid signature.

Why:

• Product explicitly requested the official HLP vault and 10 USDC minimum, using the current Invest Route flow as the entry point.
• A single guided flow is possible without violating the non-custodial boundary; one cryptographic signature cannot safely cover both the Base EVM batch and the later Hyperliquid L1 action.

Acceptance criteria

• HLP amount entry routes to /invest/route instead of executing its own source batch.
• The reviewed plan is pinned to HyperCore and surfaces the official HLP follow-up.
• HyperCore balance is snapshotted before source submission, so pre-existing perps USDC is not mistaken for this deposit.
• The source Base batch is never resubmitted during bridge/HLP recovery.
• HLP vaultTransfer is requested only after the bridge/output balance is observed.
• An accepted HLP action is not resent if vault-equity confirmation times out.
• HLP minimum is 10 USDC and the planner still rejects quotes whose toAmountMin falls below the vault minimum.
• Normal strategy/Base/Arbitrum destination state is isolated from HLP state.

Implementation

• Added InvestDestination = 'strategy' | 'hlp' plus a pre-bridge HLP balance snapshot to the invest draft context.
• Included the invest split in preview/review cache identity so Base Morpho and Base→HyperCore plans cannot collide.
• Converted HyperliquidDepositPanel into an amount/configuration entry that freezes the exact Base USDC draft and opens the unified route.
• Added HlpPlanSummary to display the non-EVM follow-up separately from Tenderly evidence.
• Extended useDepositWizard with resumeReviewedPlan, which consumes an already-submitted exact DepositPlan and source tx hash, tracks that bridge, and never calls the source executor.
• Added /invest/hlp-progress to track bridge settlement and HyperCore credit, then trigger the existing wallet vaultTransfer path.
• Recovery is fail-closed: bridge/arrival failures retry tracking of the existing tx; only an HLP signature failure can retry the HLP action.

Contract alignment

• Implementation matches the invariant.
• Regression / contract tests cover it.
• Scoped AGENTS.md remains accurate.
• README / runbook remains accurate.

Validation

• Targeted contract assertions updated for 10 USDC HLP minimum.
• Added request-contract coverage proving HLP remains Base-funded but uses split: { '1337': 1 } and has a distinct preview cache key from Base Morpho.
• Reviewed main...feat/unified-hlp-deposit-flow changed-file set for unrelated changes — PASS (only invest/HLP code and targeted tests; latest main-only commit is an unrelated generated distribution snapshot).

Validation gaps

The GitHub connector used for this change cannot execute the repository locally, so pnpm typecheck/test/format commands were not run in this session. CI should be treated as the executable validation gate for this PR.

Known unrelated failures

None known. The branch is one generated distribution-snapshot commit behind the current main; that commit does not touch any invest/HLP file.

Reviewer notes

Please scrutinize the signing/retry boundary more than the UI:

1. The Base reviewed batch must be submitted at most once.
2. The HLP amount is derived from the post-bridge HyperCore balance delta against a snapshot captured before source submission.
3. Bridge/arrival retries must only re-poll the existing source tx.
4. vaultTransfer may be retried only when submission failed before the exchange accepted it.
5. submittedUnverified is terminal for submission purposes; a vault-equity polling timeout must never re-arm vaultTransfer.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
zap-engine-control-center	Skipped		Sep 2, 2026 7:10am UTC