fix: audit corrections — clean build + VPS deployment artifacts

Audit fixes (multisig system):
- hsm-signer.ts: remove dead DER key code in LocalSigner.sign(),
  replace dynamic import('tweetnacl') with static import nacl,
  remove unused GetPublicKeyCommand import from AWS KMS
- vault-executor.ts: fix critical bug — sendAndConfirmTransaction
  with empty signers array would fail at runtime. Now uses
  sendRawTransaction + confirmTransaction for pre-signed txs.
  Also sets recentBlockhash and feePayer before signing.
- redis-store.ts: remove unused CircuitState import

Build fixes (pre-existing errors):
- index.ts: add missing PublicKey import from @solana/web3.js
- index.ts: fix TS7030/TS2322 in Express routes — replace
  'return res.status().json()' with 'res..json(); return;'
  pattern for Promise<void> handlers (6 routes fixed)
- usdt-fee-collector.ts: fix TS2555 — subscribeToEvents does
  not exist on ContractPromise.query. Use api.query.system.events
  subscription instead.
- Add src/contracts/tax_manager.json (copy from build output)
- Add tweetnacl as runtime dependency

VPS deployment artifacts:
- scripts/setup-vps-bridge.sh: bootstrap Docker+Redis+Vault
- scripts/init-vault-transit.sh: init Vault, create ed25519 key,
  scoped token with bridge-signer policy
- scripts/lusdt-bridge.service: systemd unit for bridge-service
- bridge-service/env-vps.example: production .env template
- Docs/VPS_DEPLOYMENT_BRIDGE.md: step-by-step runbook

Tests: 72 passing | Build: 0 errors

Author: Cardeal

Docs/VPS_DEPLOYMENT_BRIDGE.md

@@ -0,0 +1,71 @@
+# VPS Deployment Runbook (Bridge + Vault + Redis)
+
+## 1) Bootstrap VPS
+
+```bash
+sudo bash scripts/setup-vps-bridge.sh
+```
+
+Isso instala Docker/Compose e sobe `redis` + `vault` localmente.
+
+## 2) Inicializar Vault Transit
+
+```bash
+sudo bash scripts/init-vault-transit.sh
+```
+
+Gera token restrito para assinatura e salva em `/opt/lusdt/secrets/bridge-vault.env`.
+
+## 3) Publicar código na VPS
+
+```bash
+mkdir -p /opt/lusdt/bridge-service
+# copie o repositório para /opt/lusdt/bridge-service
+```
+
+## 4) Configurar .env de produção
+
+Use como base:
+
+- `bridge-service/env-vps.example`
+- `/opt/lusdt/secrets/bridge-vault.env`
+
+Arquivo final em:
+
+```bash
+/opt/lusdt/bridge-service/.env
+```
+
+## 5) Build do bridge-service
+
+```bash
+cd /opt/lusdt/bridge-service/bridge-service
+pnpm install --frozen-lockfile
+pnpm build
+```
+
+## 6) Instalar systemd service
+
+```bash
+sudo cp /opt/lusdt/bridge-service/scripts/lusdt-bridge.service /etc/systemd/system/lusdt-bridge.service
+sudo systemctl daemon-reload
+sudo systemctl enable lusdt-bridge
+sudo systemctl start lusdt-bridge
+sudo systemctl status lusdt-bridge
+```
+
+## 7) Verificações
+
+```bash
+curl -s http://127.0.0.1:3001/health
+journalctl -u lusdt-bridge -f
+docker ps
+```
+
+## 8) Hardening mínimo recomendado
+
+1. Fechar portas públicas de Redis/Vault (bind localhost já aplicado).
+2. Colocar Nginx/Caddy com TLS na frente da API.
+3. Guardar `/opt/lusdt/secrets/vault-init.json` offline.
+4. Rotacionar `VAULT_TOKEN` periodicamente.
+5. Ativar backup de `/opt/lusdt/vault/data` e banco Postgres.

bridge-service/env-vps.example

@@ -0,0 +1,57 @@
+# Bridge Service - VPS Production Example
+NODE_ENV=production
+PORT=3001
+
+# RPCs
+SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
+LUNES_RPC_URL=wss://ws.lunes.io
+
+# Bridge auth
+BRIDGE_API_KEY=change_me_api_key
+BRIDGE_API_SECRET=change_me_hmac_secret
+OPS_BASIC_AUTH_USER=ops
+OPS_BASIC_AUTH_PASS=change_me_ops_password
+
+# Wallet / contracts
+SOLANA_MULTISIG_VAULT=replace_with_squads_or_vault_address
+USDT_TOKEN_MINT=EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
+LUNES_WALLET_SEED=replace_with_secure_seed
+LUSDT_CONTRACT_ADDRESS=replace_with_contract
+TAX_MANAGER_CONTRACT_ADDRESS=replace_with_tax_manager
+
+# Fee wallets
+DEV_SOLANA_WALLET=replace_dev_wallet
+INSURANCE_SOLANA_WALLET=replace_insurance_wallet
+STAKING_REWARDS_SOLANA_WALLET=replace_staking_wallet
+
+# DB / cache
+DATABASE_URL=postgresql://bridge_user:strong_password@127.0.0.1:5432/bridge_db
+REDIS_URL=redis://127.0.0.1:6379
+
+# HSM - Vault (recommended for self-hosted VPS)
+HSM_TYPE=hashicorp_vault
+VAULT_URL=http://127.0.0.1:8200
+VAULT_TOKEN=replace_with_bridge_policy_token
+VAULT_KEY_PATH=transit
+VAULT_KEY_NAME=solana-bridge
+
+# Multisig policy
+REQUIRE_MULTISIG_VAULT=true
+BOT_ORIGIN_SECRET=replace_origin_secret
+BOT_RISK_SECRET=replace_risk_secret
+BOT_BACKUP_SECRET=replace_backup_secret
+MULTISIG_REQUIRED_APPROVALS=2
+MULTISIG_TOTAL_BOTS=3
+MULTISIG_HIGH_VALUE_THRESHOLD=5000
+MULTISIG_TIMELOCK_MS=600000
+MULTISIG_PROPOSAL_TTL_MS=300000
+
+# Limits
+HOT_WALLET_SINGLE_TX_LIMIT=10000
+HOT_WALLET_DAILY_LIMIT=50000
+TREASURY_MIN_BALANCE=50000
+MAX_TRANSACTION_VALUE=100000
+
+# Alerts
+DISCORD_WEBHOOK_URL=
+ALERT_EMAIL=ops@yourdomain.com

bridge-service/package.json

@@ -34,6 +34,7 @@
     "helmet": "^7.1.0",
     "ioredis": "^5.9.3",
     "pg": "^8.11.3",
+    "tweetnacl": "^1.0.3",
     "winston": "^3.11.0"
   },
   "devDependencies": {

bridge-service/src/bridge/usdt-fee-collector.ts

@@ -155,13 +155,18 @@ export class UsdtFeeCollector {
     logger.info('👂 Starting to listen for UsdtBridgeFeeMarked events');
 
     try {
-      // Subscribe to contract events / Assinar eventos do contrato
-      await this.taxManagerContract.query
-        .subscribeToEvents((event: any) => {
-          this.handleFeeEvent(event).catch((error) => {
-            logger.error('❌ Error handling fee event', { error });
-          });
+      // Subscribe to contract events via system events
+      const api = (this.taxManagerContract as any).api;
+      await api.query.system.events((events: any[]) => {
+        events.forEach((record: any) => {
+          const { event } = record;
+          if (event && event.section === 'contracts' && event.method === 'ContractEmitted') {
+            this.handleFeeEvent(event).catch((error: any) => {
+              logger.error('❌ Error handling fee event', { error });
+            });
+          }
         });
+      });
 
       logger.info('✅ Successfully subscribed to TaxManager events');
     } catch (error) {