@ember-finance/sdk 2.19.0 → 2.21.0-ccip.0

package/dist/src/evm-vaults/on-chain-calls/tx-builder.d.ts

@@ -1,5 +1,5 @@
 import { EVMDeploymentParser } from "../utils/index.js";
-import { EvmProtocolInfo, VaultPauseOperation, ITransactionCall, IPermitSignature, IOFTSendParam, IOFTMessagingFee } from "../interfaces/index.js";
+import { EvmProtocolInfo, VaultPauseOperation, ITransactionCall, IPermitSignature, IOFTSendParam, IOFTMessagingFee, ICcipSendParam } from "../interfaces/index.js";
 import { NumStr } from "../../common/types.js";
 /**
  * EVM Transaction Builder for Ember Protocol (ERC-4626 Compatible)
@@ -543,6 +543,20 @@ export declare class EVMTxBuilder {
      * @returns Transaction call object
      */
     bridgeSend(adapterAddress: string, sendParam: IOFTSendParam, fee: IOFTMessagingFee, refundAddress: string): ITransactionCall;
+    /**
+     * Builds the CCIP send call.
+     *
+     * The counterpart to bridgeSend, but the call goes to Chainlink's Router
+     * rather than to our own pool: the Router pulls the tokens, charges the fee
+     * and hands off to the pool. That is also why the approval for a CCIP bridge
+     * goes to the Router and not to the pool.
+     *
+     * @param routerAddress The CCIP Router on the source chain
+     * @param sendParam Destination, receiver and amount
+     * @param tokenAddress The receipt token being bridged
+     * @param fee Fee from getCcipFeeQuote, sent as value when paying natively
+     */
+    ccipSend(routerAddress: string, sendParam: ICcipSendParam, tokenAddress: string, fee: bigint): ITransactionCall;
     private atomicCall;
     /** Claim the caller's own escrowed (deferred) holdback collateral. */
     atomicClaimHoldback(vaultAddress: string): ITransactionCall;

package/dist/src/evm-vaults/on-chain-calls/tx-builder.js

@@ -4,6 +4,8 @@ import EmberETHVaultABI from "../../abis/EmberETHVault.json" with { type: "json"
 import EmberProtocolConfigABI from "../../abis/EmberProtocolConfig.json" with { type: "json" };
 import ERC20TokenABI from "../../abis/ERC20Token.json" with { type: "json" };
 import EmberVaultOFTAdapterABI from "../../abis/EmberVaultMintBurnOFTAdapter.json" with { type: "json" };
+import CcipRouterABI from "../../abis/CcipRouter.json" with { type: "json" };
+import { ZERO_ADDRESS, encodeCcipReceiver, encodeCcipExtraArgs } from "../utils/ccip.js";
 import AtomicLiquidityABI from "../../abis/AtomicLiquidity.json" with { type: "json" };
 import EmberDepositParkingLotABI from "../../abis/EmberDepositParkingLot.json" with { type: "json" };
 import OpenCoverVaultABI from "../../abis/OpenCoverVault.json" with { type: "json" };
@@ -1147,6 +1149,40 @@ export class EVMTxBuilder {
             chainId: this.getChainId()
         };
     }
+    /**
+     * Builds the CCIP send call.
+     *
+     * The counterpart to bridgeSend, but the call goes to Chainlink's Router
+     * rather than to our own pool: the Router pulls the tokens, charges the fee
+     * and hands off to the pool. That is also why the approval for a CCIP bridge
+     * goes to the Router and not to the pool.
+     *
+     * @param routerAddress The CCIP Router on the source chain
+     * @param sendParam Destination, receiver and amount
+     * @param tokenAddress The receipt token being bridged
+     * @param fee Fee from getCcipFeeQuote, sent as value when paying natively
+     */
+    ccipSend(routerAddress, sendParam, tokenAddress, fee) {
+        const feeToken = sendParam.feeToken ?? ZERO_ADDRESS;
+        return {
+            to: routerAddress,
+            functionName: "ccipSend",
+            args: [
+                sendParam.destinationChainSelector,
+                {
+                    receiver: encodeCcipReceiver(sendParam.receiver),
+                    data: "0x",
+                    tokenAmounts: [{ token: tokenAddress, amount: sendParam.amount }],
+                    feeToken,
+                    extraArgs: encodeCcipExtraArgs(sendParam.destinationGasLimit)
+                }
+            ],
+            abi: CcipRouterABI.abi,
+            // Paying in a token means the Router pulls it instead, so no value.
+            value: feeToken === ZERO_ADDRESS ? fee : 0n,
+            chainId: this.getChainId()
+        };
+    }
     // ============================================
     // Atomic Liquidity Vault methods (BFE-817/818)
     //

package/dist/src/evm-vaults/on-chain-calls/user.d.ts

@@ -1,6 +1,6 @@
 import { Signer, Provider } from "ethers";
 import { EVMOnChainCalls } from "./onchain-calls.js";
-import { EvmProtocolInfo, IUserCallOptions, IEvmCallOptions, ICoverVaultCallOptions, EvmOnChainCallResponse, IPermitSignature, IETHDepositOptions, IBridgeSendOptions, IOFTFeeQuote } from "../interfaces/index.js";
+import { EvmProtocolInfo, IUserCallOptions, IEvmCallOptions, ICoverVaultCallOptions, EvmOnChainCallResponse, IPermitSignature, IETHDepositOptions, IBridgeSendOptions, IOFTFeeQuote, ICcipFeeQuote, ICcipBridgeSendOptions } from "../interfaces/index.js";
 import { NumStr } from "../../common/types.js";
 import { Chain } from "../../api/v2/index.js";
 /**
@@ -423,6 +423,45 @@ export declare class EVMUserCalls extends EVMOnChainCalls {
      * @returns Transaction execution response
      */
     bridgeSendToken(destinationChain: Chain, tokenAddress: string, amount: NumStr, receiver: string, feeQuote: IOFTFeeQuote, options?: IBridgeSendOptions): Promise<EvmOnChainCallResponse>;
+    /**
+     * Bridges a receipt token to a destination chain using the vault's CCIP pool.
+     *
+     * The counterpart to bridgeSendToken. Call getBridgeTransportForVault first
+     * and pick the matching method — a vault has exactly one active bridge, and
+     * calling the wrong one throws rather than silently doing nothing.
+     *
+     * One difference from the LayerZero path worth knowing: the allowance goes
+     * to the CCIP Router, not to the pool, because the Router is what pulls the
+     * tokens. An unconfigured route throws here rather than reverting on chain.
+     *
+     * @param destinationChain Destination chain metadata (must include ccipChainSelector)
+     * @param tokenAddress Receipt token address (also the vault identifier in EVM deployment data)
+     * @param amount Amount to bridge in local token decimals
+     * @param receiver Recipient wallet address on the destination chain
+     * @param feeQuote Fee quote returned by reader.getCcipFeeQuote
+     * @param options Optional bridge/send overrides
+     * @returns Transaction execution response
+     */
+    bridgeSendTokenViaCcip(destinationChain: Chain, tokenAddress: string, amount: NumStr, receiver: string, feeQuote: ICcipFeeQuote, options?: ICcipBridgeSendOptions): Promise<EvmOnChainCallResponse>;
+    /**
+     * Reports which bridge a vault uses, or undefined if it has none.
+     *
+     * A vault has exactly one active bridge, but different vaults use different
+     * ones, so branch on this rather than assuming either transport.
+     *
+     * @param tokenAddress Receipt token address (also the vault identifier in EVM deployment data)
+     */
+    getBridgeTransportForVault(tokenAddress: string): "LayerZero" | "CCIP" | undefined;
+    /**
+     * Lists the networks a vault can bridge to, whichever transport it uses.
+     *
+     * Empty for a vault with no bridge, and for a bridged vault with no route
+     * configured yet. A network absent from this list cannot be sent to — the
+     * send would revert on chain — so drive the destination picker from it.
+     *
+     * @param tokenAddress Receipt token address (also the vault identifier in EVM deployment data)
+     */
+    getBridgeDestinationsForVault(tokenAddress: string): string[];
     /**
      * Gets the vault contract instance for read operations
      * @param vaultAddress The address of the vault

package/dist/src/evm-vaults/on-chain-calls/user.js

@@ -637,6 +637,81 @@ export class EVMUserCalls extends EVMOnChainCalls {
         }, refundAddress);
         return this.execCall(txCall, options);
     }
+    /**
+     * Bridges a receipt token to a destination chain using the vault's CCIP pool.
+     *
+     * The counterpart to bridgeSendToken. Call getBridgeTransportForVault first
+     * and pick the matching method — a vault has exactly one active bridge, and
+     * calling the wrong one throws rather than silently doing nothing.
+     *
+     * One difference from the LayerZero path worth knowing: the allowance goes
+     * to the CCIP Router, not to the pool, because the Router is what pulls the
+     * tokens. An unconfigured route throws here rather than reverting on chain.
+     *
+     * @param destinationChain Destination chain metadata (must include ccipChainSelector)
+     * @param tokenAddress Receipt token address (also the vault identifier in EVM deployment data)
+     * @param amount Amount to bridge in local token decimals
+     * @param receiver Recipient wallet address on the destination chain
+     * @param feeQuote Fee quote returned by reader.getCcipFeeQuote
+     * @param options Optional bridge/send overrides
+     * @returns Transaction execution response
+     */
+    async bridgeSendTokenViaCcip(destinationChain, tokenAddress, amount, receiver, feeQuote, options) {
+        if (!this.provider) {
+            throw new Error("Provider required for bridge send read operations and allowance checks");
+        }
+        const pool = this.parser.getCcipTokenPoolByVaultAddress(tokenAddress);
+        if (!pool?.router) {
+            throw new Error(`CCIP token pool not found for token address: ${tokenAddress}`);
+        }
+        if (destinationChain.ccipChainSelector === undefined ||
+            destinationChain.ccipChainSelector === null) {
+            throw new Error(`Destination chain "${destinationChain.name ?? destinationChain.identifier}" has no ccipChainSelector — cannot address a CCIP destination`);
+        }
+        const remoteChainSelector = destinationChain.ccipChainSelector;
+        const lane = this.parser.getCcipLaneByVaultAndSelector(tokenAddress, remoteChainSelector);
+        if (!lane) {
+            throw new Error(`No CCIP lane configured from this chain to "${destinationChain.identifier}" for token ${tokenAddress}`);
+        }
+        const amountBigInt = BigInt(amount);
+        // The Router moves the tokens, so it is the Router that needs approval.
+        const token = new ethers.Contract(tokenAddress, ["function allowance(address,address) view returns (uint256)"], this.provider);
+        const currentAllowance = await token.allowance(await this.getWalletAddress(), pool.router);
+        if (currentAllowance < amountBigInt) {
+            throw new Error(`Insufficient allowance for bridge transfer. Current allowance: ${currentAllowance}, required: ${amountBigInt}`);
+        }
+        const txCall = this.txBuilder.ccipSend(pool.router, {
+            destinationChainSelector: remoteChainSelector,
+            receiver,
+            amount: amountBigInt,
+            feeToken: options?.feeToken,
+            destinationGasLimit: options?.destinationGasLimit
+        }, tokenAddress, feeQuote.fee);
+        return this.execCall(txCall, options);
+    }
+    /**
+     * Reports which bridge a vault uses, or undefined if it has none.
+     *
+     * A vault has exactly one active bridge, but different vaults use different
+     * ones, so branch on this rather than assuming either transport.
+     *
+     * @param tokenAddress Receipt token address (also the vault identifier in EVM deployment data)
+     */
+    getBridgeTransportForVault(tokenAddress) {
+        return this.parser.getBridgeTransportByVaultAddress(tokenAddress);
+    }
+    /**
+     * Lists the networks a vault can bridge to, whichever transport it uses.
+     *
+     * Empty for a vault with no bridge, and for a bridged vault with no route
+     * configured yet. A network absent from this list cannot be sent to — the
+     * send would revert on chain — so drive the destination picker from it.
+     *
+     * @param tokenAddress Receipt token address (also the vault identifier in EVM deployment data)
+     */
+    getBridgeDestinationsForVault(tokenAddress) {
+        return this.parser.getBridgeDestinationsByVaultAddress(tokenAddress);
+    }
     // ============================================
     // Read-Only Methods
     // ============================================

package/dist/src/evm-vaults/on-chain-calls/vault-reader.d.ts

@@ -1,6 +1,6 @@
 import { Provider } from "ethers";
 import { EVMDeploymentParser } from "../utils/deployment-parser.js";
-import { EvmProtocolInfo, IOFTSendParam, IOFTFeeQuote, IOFTVaultSupportedChain, IParkingLotInfo } from "../interfaces/index.js";
+import { EvmProtocolInfo, IOFTSendParam, IOFTFeeQuote, IOFTVaultSupportedChain, IParkingLotInfo, ICcipSendParam, ICcipFeeQuote } from "../interfaces/index.js";
 import { NumStr } from "../../common/types.js";
 import { Chain, VaultsApi } from "../../api/v2/index.js";
 /**
@@ -524,4 +524,17 @@ export declare class EVMVaultReader {
      * @returns Combined fee quote including native fee and expected amounts
      */
     getOFTFeeQuote(vaultId: string, sendParam: IOFTSendParam, payInLzToken?: boolean): Promise<IOFTFeeQuote>;
+    /**
+     * Quotes what a CCIP bridge send will cost.
+     *
+     * The counterpart to getOFTFeeQuote. CCIP charges one fee rather than
+     * LayerZero's native/LZ-token pair, and quotes no received amount: a
+     * burn-and-mint pool mints exactly what it burned, so the amount received is
+     * the amount sent.
+     *
+     * @param vaultId The vault (receipt token) address on the source chain
+     * @param sendParam Destination, receiver and amount
+     * @returns The fee and the token it is charged in
+     */
+    getCcipFeeQuote(vaultId: string, sendParam: ICcipSendParam): Promise<ICcipFeeQuote>;
 }

package/dist/src/evm-vaults/on-chain-calls/vault-reader.js

@@ -4,6 +4,8 @@ import EmberVaultABI from "../../abis/EmberVault.json" with { type: "json" };
 import EmberETHVaultABI from "../../abis/EmberETHVault.json" with { type: "json" };
 import EmberProtocolConfigABI from "../../abis/EmberProtocolConfig.json" with { type: "json" };
 import ERC20TokenABI from "../../abis/ERC20Token.json" with { type: "json" };
+import CcipRouterABI from "../../abis/CcipRouter.json" with { type: "json" };
+import { ZERO_ADDRESS, encodeCcipReceiver, encodeCcipExtraArgs } from "../utils/ccip.js";
 import EmberVaultOFTAdapterABI from "../../abis/EmberVaultMintBurnOFTAdapter.json" with { type: "json" };
 import EmberDepositParkingLotABI from "../../abis/EmberDepositParkingLot.json" with { type: "json" };
 import { Configuration, VaultsApi } from "../../api/v2/index.js";
@@ -736,4 +738,32 @@ export class EVMVaultReader {
             maxAmountLD: oftQuote.oftLimit.maxAmountLD
         };
     }
+    /**
+     * Quotes what a CCIP bridge send will cost.
+     *
+     * The counterpart to getOFTFeeQuote. CCIP charges one fee rather than
+     * LayerZero's native/LZ-token pair, and quotes no received amount: a
+     * burn-and-mint pool mints exactly what it burned, so the amount received is
+     * the amount sent.
+     *
+     * @param vaultId The vault (receipt token) address on the source chain
+     * @param sendParam Destination, receiver and amount
+     * @returns The fee and the token it is charged in
+     */
+    async getCcipFeeQuote(vaultId, sendParam) {
+        const pool = this.parser.getCcipTokenPoolByVaultAddress(vaultId);
+        if (!pool?.router) {
+            throw new Error(`CCIP token pool not found for vault: ${vaultId}`);
+        }
+        const feeToken = sendParam.feeToken ?? ZERO_ADDRESS;
+        const router = new Contract(pool.router, CcipRouterABI.abi, this.provider);
+        const fee = await router.getFee(sendParam.destinationChainSelector, {
+            receiver: encodeCcipReceiver(sendParam.receiver),
+            data: "0x",
+            tokenAmounts: [{ token: vaultId, amount: sendParam.amount }],
+            feeToken,
+            extraArgs: encodeCcipExtraArgs(sendParam.destinationGasLimit)
+        });
+        return { fee, feeToken };
+    }
 }

package/dist/src/evm-vaults/utils/ccip.d.ts

@@ -0,0 +1,23 @@
+/** The native currency, as CCIP names it when no fee token is given. */
+export declare const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+/**
+ * Encodes a receiver for a CCIP message.
+ *
+ * CCIP carries the receiver as `bytes` rather than `address`, because the far
+ * end of a lane need not be an EVM chain. On an EVM destination that is the
+ * address left-padded to 32 bytes, which is why the same account looks
+ * different on the two sides of a transfer.
+ */
+export declare const encodeCcipReceiver: (receiver: string) => string;
+/**
+ * Encodes CCIP extraArgs.
+ *
+ * `allowOutOfOrderExecution` is true because a token transfer carries no
+ * message the destination has to apply in sequence; requiring ordering would
+ * make one stuck message block every later one on the lane.
+ *
+ * gasLimit is 0 by default: a plain token transfer runs no code on the
+ * destination beyond the pool's own mint, and paying for gas that is never used
+ * only raises the fee.
+ */
+export declare const encodeCcipExtraArgs: (destinationGasLimit?: bigint) => string;

package/dist/src/evm-vaults/utils/ccip.js

@@ -0,0 +1,32 @@
+import { AbiCoder, getAddress, zeroPadValue } from "ethers";
+/** The native currency, as CCIP names it when no fee token is given. */
+export const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+/**
+ * Tag for CCIP's EVMExtraArgsV2, the first four bytes of
+ * keccak256("CCIP EVMExtraArgsV2"). Verified against a deployed ramp.
+ */
+const EVM_EXTRA_ARGS_V2_TAG = "0x181dcf10";
+/**
+ * Encodes a receiver for a CCIP message.
+ *
+ * CCIP carries the receiver as `bytes` rather than `address`, because the far
+ * end of a lane need not be an EVM chain. On an EVM destination that is the
+ * address left-padded to 32 bytes, which is why the same account looks
+ * different on the two sides of a transfer.
+ */
+export const encodeCcipReceiver = (receiver) => zeroPadValue(getAddress(receiver), 32);
+/**
+ * Encodes CCIP extraArgs.
+ *
+ * `allowOutOfOrderExecution` is true because a token transfer carries no
+ * message the destination has to apply in sequence; requiring ordering would
+ * make one stuck message block every later one on the lane.
+ *
+ * gasLimit is 0 by default: a plain token transfer runs no code on the
+ * destination beyond the pool's own mint, and paying for gas that is never used
+ * only raises the fee.
+ */
+export const encodeCcipExtraArgs = (destinationGasLimit = 0n) => {
+    const encoded = AbiCoder.defaultAbiCoder().encode(["uint256", "bool"], [destinationGasLimit, true]);
+    return EVM_EXTRA_ARGS_V2_TAG + encoded.slice(2);
+};

package/dist/src/evm-vaults/utils/deployment-parser.d.ts

@@ -1,4 +1,4 @@
-import { EvmOFTAdapter } from "../../api/v2/index.js";
+import { EvmCcipLane, EvmCcipTokenPool, EvmOFTAdapter } from "../../api/v2/index.js";
 import { EvmProtocolInfo } from "../interfaces/index.js";
 export declare class EVMDeploymentParser {
     deployment: EvmProtocolInfo;
@@ -124,4 +124,49 @@ export declare class EVMDeploymentParser {
      * @param vaultAddress The vault address (receipt token address in EVM deployment data)
      */
     getOFTAdapterObjectByVaultAddress(vaultAddress: string): EvmOFTAdapter | undefined;
+    /**
+     * Finds the CCIP token pool entry for a given vault address.
+     * @param vaultAddress The vault address (receipt token address in EVM deployment data)
+     */
+    getCcipTokenPoolByVaultAddress(vaultAddress: string): EvmCcipTokenPool | undefined;
+    /**
+     * Reports which bridge a vault uses, or undefined if it has none.
+     *
+     * A vault has exactly one active bridge, but different vaults use different
+     * ones, so call this before choosing between the LayerZero and CCIP send
+     * methods rather than assuming either.
+     *
+     * @param vaultAddress The vault address (receipt token address in EVM deployment data)
+     */
+    getBridgeTransportByVaultAddress(vaultAddress: string): "LayerZero" | "CCIP" | undefined;
+    /**
+     * Lists the networks a vault can bridge to, whichever transport it uses.
+     *
+     * Returns an empty array for a vault with no bridge, so it is safe to render
+     * directly. Names are as the deployment records them, which is what
+     * bridgeSendTokenViaCcip takes as its destination.
+     *
+     * @param vaultAddress The vault address (receipt token address in EVM deployment data)
+     */
+    getBridgeDestinationsByVaultAddress(vaultAddress: string): string[];
+    /**
+     * Finds the configured CCIP lane from a vault to a destination chain selector.
+     *
+     * A missing lane means the route is not configured and a send would revert.
+     *
+     * @param vaultAddress The vault address on the source chain
+     * @param remoteChainSelector The destination CCIP chain selector
+     */
+    getCcipLaneByVaultAndSelector(vaultAddress: string, remoteChainSelector: string): EvmCcipLane | undefined;
+    /**
+     * Finds the configured CCIP lane from a vault to a destination network.
+     *
+     * Lanes are keyed by the destination's CCIP chain selector, which nothing
+     * outside CCIP knows, so this looks the lane up by network name instead.
+     * A missing lane means the route is not configured — sending would revert.
+     *
+     * @param vaultAddress The vault address on the source chain
+     * @param destinationNetwork The destination network name, e.g. "atlantic"
+     */
+    getCcipLaneByVaultAndNetwork(vaultAddress: string, destinationNetwork: string): EvmCcipLane | undefined;
 }

package/dist/src/evm-vaults/utils/deployment-parser.js

@@ -206,4 +206,78 @@ export class EVMDeploymentParser {
         }
         return entry;
     }
+    /**
+     * Finds the CCIP token pool entry for a given vault address.
+     * @param vaultAddress The vault address (receipt token address in EVM deployment data)
+     */
+    getCcipTokenPoolByVaultAddress(vaultAddress) {
+        return Object.values(this.deployment.contracts?.ccipTokenPools ?? {}).find(pool => pool.vaultAddress?.toLowerCase() === vaultAddress.toLowerCase());
+    }
+    /**
+     * Reports which bridge a vault uses, or undefined if it has none.
+     *
+     * A vault has exactly one active bridge, but different vaults use different
+     * ones, so call this before choosing between the LayerZero and CCIP send
+     * methods rather than assuming either.
+     *
+     * @param vaultAddress The vault address (receipt token address in EVM deployment data)
+     */
+    getBridgeTransportByVaultAddress(vaultAddress) {
+        if (this.getCcipTokenPoolByVaultAddress(vaultAddress))
+            return "CCIP";
+        if (this.getOFTAdapterObjectByVaultAddress(vaultAddress))
+            return "LayerZero";
+        return undefined;
+    }
+    /**
+     * Lists the networks a vault can bridge to, whichever transport it uses.
+     *
+     * Returns an empty array for a vault with no bridge, so it is safe to render
+     * directly. Names are as the deployment records them, which is what
+     * bridgeSendTokenViaCcip takes as its destination.
+     *
+     * @param vaultAddress The vault address (receipt token address in EVM deployment data)
+     */
+    getBridgeDestinationsByVaultAddress(vaultAddress) {
+        // Both transports record the far end the same way, under remoteNetwork,
+        // but one keys its map by CCIP chain selector and the other by LayerZero
+        // endpoint id — neither of which a caller has any way to resolve. Reading
+        // the values rather than the keys is what keeps the two symmetric.
+        const pool = this.getCcipTokenPoolByVaultAddress(vaultAddress);
+        const adapter = this.getOFTAdapterObjectByVaultAddress(vaultAddress);
+        const networks = [
+            ...Object.values(pool?.lanes ?? {}),
+            ...Object.values(adapter?.peers ?? {})
+        ]
+            .map(entry => entry.remoteNetwork)
+            .filter((network) => !!network);
+        return [...new Set(networks)];
+    }
+    /**
+     * Finds the configured CCIP lane from a vault to a destination chain selector.
+     *
+     * A missing lane means the route is not configured and a send would revert.
+     *
+     * @param vaultAddress The vault address on the source chain
+     * @param remoteChainSelector The destination CCIP chain selector
+     */
+    getCcipLaneByVaultAndSelector(vaultAddress, remoteChainSelector) {
+        // Lanes are keyed by selector, so this is a direct hit rather than the
+        // scan the by-network lookup has to do.
+        return this.getCcipTokenPoolByVaultAddress(vaultAddress)?.lanes?.[remoteChainSelector];
+    }
+    /**
+     * Finds the configured CCIP lane from a vault to a destination network.
+     *
+     * Lanes are keyed by the destination's CCIP chain selector, which nothing
+     * outside CCIP knows, so this looks the lane up by network name instead.
+     * A missing lane means the route is not configured — sending would revert.
+     *
+     * @param vaultAddress The vault address on the source chain
+     * @param destinationNetwork The destination network name, e.g. "atlantic"
+     */
+    getCcipLaneByVaultAndNetwork(vaultAddress, destinationNetwork) {
+        const pool = this.getCcipTokenPoolByVaultAddress(vaultAddress);
+        return Object.values(pool?.lanes ?? {}).find(lane => lane.remoteNetwork?.toLowerCase() === destinationNetwork.toLowerCase());
+    }
 }

package/dist/src/evm-vaults/utils/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./deployment-parser.js";
 export * from "./permit-utils.js";
+export * from "./ccip.js";

package/dist/src/evm-vaults/utils/index.js

@@ -1,2 +1,3 @@
 export * from "./deployment-parser.js";
 export * from "./permit-utils.js";
+export * from "./ccip.js";

package/dist/src/sui-vaults/interfaces/index.d.ts

@@ -70,6 +70,20 @@ export interface IVaultOptionalParams extends ITxBuilderOptionalParams {
     dryRun?: boolean;
     returnTxb?: boolean;
 }
+/**
+ * Operations that can be paused individually on a vault.
+ *
+ * The values are the exact `vector<u8>` the Move entry points compare against
+ * (`OP_DEPOSITS` and friends in `vault.move`), shared by the regular and atomic
+ * vault flavours. Note `privileged_operations` is snake_case here and
+ * `privilegedOperations` in EVM's `VaultPauseOperation` — consumers serving both
+ * chains have to map, which is why this enum exists rather than a bare string.
+ */
+export declare enum SuiVaultPauseOperation {
+    Deposits = "deposits",
+    Withdrawals = "withdrawals",
+    PrivilegedOperations = "privileged_operations"
+}
 /** `version` and the protocol-wide pause flag from the shared ProtocolConfig. */
 export interface IProtocolConfigState {
     /** The package VERSION the protocol currently accepts, as a decimal string. */

package/dist/src/sui-vaults/interfaces/index.js

@@ -1 +1,15 @@
-export {};
+/**
+ * Operations that can be paused individually on a vault.
+ *
+ * The values are the exact `vector<u8>` the Move entry points compare against
+ * (`OP_DEPOSITS` and friends in `vault.move`), shared by the regular and atomic
+ * vault flavours. Note `privileged_operations` is snake_case here and
+ * `privilegedOperations` in EVM's `VaultPauseOperation` — consumers serving both
+ * chains have to map, which is why this enum exists rather than a bare string.
+ */
+export var SuiVaultPauseOperation;
+(function (SuiVaultPauseOperation) {
+    SuiVaultPauseOperation["Deposits"] = "deposits";
+    SuiVaultPauseOperation["Withdrawals"] = "withdrawals";
+    SuiVaultPauseOperation["PrivilegedOperations"] = "privileged_operations";
+})(SuiVaultPauseOperation || (SuiVaultPauseOperation = {}));

package/dist/src/sui-vaults/on-chain-calls/tx-builder.d.ts

@@ -1,5 +1,5 @@
 import { SuiDeploymentParser } from "../utils/index.js";
-import { ISuiDeployment, ITxBuilderOptionalParams } from "../interfaces/index.js";
+import { ISuiDeployment, ITxBuilderOptionalParams, SuiVaultPauseOperation } from "../interfaces/index.js";
 import { Address, NumStr, TransactionBlock } from "@firefly-exchange/library-sui";
 export declare class TxBuilder {
     parser: SuiDeploymentParser;
@@ -45,6 +45,32 @@ export declare class TxBuilder {
      * @returns TransactionBlock
      */
     setGuardian(newGuardian: Address, options?: ITxBuilderOptionalParams): TransactionBlock;
+    /**
+     * Guardian fast-path to pause / unpause one operation on a regular vault.
+     * Callable directly by the guardian address — no AdminCap.
+     *
+     * Per-operation, unlike the AdminCap-gated {@link updateVaultPausedStatus},
+     * which flips the vault's single legacy `paused` flag. On chain the effective
+     * answer is `vault.paused || <this operation's flag>`, so clearing an
+     * operation here does not un-pause a vault the admin stopped wholesale.
+     * @param vaultId Id of the vault
+     * @param operation Operation to pause or resume
+     * @param paused True to pause, false to resume
+     * @param options Optional tx building params; `packageId` routes through a retired package
+     * @returns TransactionBlock
+     */
+    guardianSetVaultPausedStatus(vaultId: string, operation: SuiVaultPauseOperation, paused: boolean, options?: ITxBuilderOptionalParams): TransactionBlock;
+    /**
+     * Guardian fast-path to pause / unpause one operation on an atomic liquidity
+     * vault. Same vocabulary as the regular-vault variant; separate entry point
+     * because the vault type differs and takes only the collateral type.
+     * @param vaultId Id of the atomic vault
+     * @param operation Operation to pause or resume
+     * @param paused True to pause, false to resume
+     * @param options Optional tx building params; `packageId` routes through a retired package
+     * @returns TransactionBlock
+     */
+    atomicGuardianSetPauseStatus(vaultId: string, operation: SuiVaultPauseOperation, paused: boolean, options?: ITxBuilderOptionalParams): TransactionBlock;
     /**
      * Asserts `ProtocolConfig.version` equals the VERSION compiled into the target
      * package, aborting EUnsupportedPackage (1000) otherwise.

package/dist/src/sui-vaults/on-chain-calls/tx-builder.js

@@ -94,6 +94,69 @@ export class TxBuilder {
             txb.setSenderIfNotSet(options.sender);
         return txb;
     }
+    /**
+     * Guardian fast-path to pause / unpause one operation on a regular vault.
+     * Callable directly by the guardian address — no AdminCap.
+     *
+     * Per-operation, unlike the AdminCap-gated {@link updateVaultPausedStatus},
+     * which flips the vault's single legacy `paused` flag. On chain the effective
+     * answer is `vault.paused || <this operation's flag>`, so clearing an
+     * operation here does not un-pause a vault the admin stopped wholesale.
+     * @param vaultId Id of the vault
+     * @param operation Operation to pause or resume
+     * @param paused True to pause, false to resume
+     * @param options Optional tx building params; `packageId` routes through a retired package
+     * @returns TransactionBlock
+     */
+    guardianSetVaultPausedStatus(vaultId, operation, paused, options) {
+        const txb = options?.txBlock || new TransactionBlock();
+        txb.moveCall({
+            arguments: [
+                txb.object(vaultId),
+                txb.object(this.parser.getProtocolConfig()),
+                txb.pure.vector("u8", Array.from(Buffer.from(operation, "utf8"))),
+                txb.pure.bool(paused)
+            ],
+            typeArguments: [
+                this.parser.getDepositCoinType(vaultId),
+                this.parser.getReceiptCoinType(vaultId)
+            ],
+            target: `${this.targetPackageId(options)}::gateway::guardian_set_vault_paused_status`
+        });
+        if (options?.gasBudget)
+            txb.setGasBudget(options.gasBudget);
+        if (options?.sender)
+            txb.setSenderIfNotSet(options.sender);
+        return txb;
+    }
+    /**
+     * Guardian fast-path to pause / unpause one operation on an atomic liquidity
+     * vault. Same vocabulary as the regular-vault variant; separate entry point
+     * because the vault type differs and takes only the collateral type.
+     * @param vaultId Id of the atomic vault
+     * @param operation Operation to pause or resume
+     * @param paused True to pause, false to resume
+     * @param options Optional tx building params; `packageId` routes through a retired package
+     * @returns TransactionBlock
+     */
+    atomicGuardianSetPauseStatus(vaultId, operation, paused, options) {
+        const txb = options?.txBlock || new TransactionBlock();
+        txb.moveCall({
+            arguments: [
+                txb.object(vaultId),
+                txb.object(this.parser.getProtocolConfig()),
+                txb.pure.vector("u8", Array.from(Buffer.from(operation, "utf8"))),
+                txb.pure.bool(paused)
+            ],
+            typeArguments: [this.parser.getAtomicCollateralType(vaultId)],
+            target: `${this.targetPackageId(options)}::gateway::atomic_guardian_set_pause_status`
+        });
+        if (options?.gasBudget)
+            txb.setGasBudget(options.gasBudget);
+        if (options?.sender)
+            txb.setSenderIfNotSet(options.sender);
+        return txb;
+    }
     /**
      * Asserts `ProtocolConfig.version` equals the VERSION compiled into the target
      * package, aborting EUnsupportedPackage (1000) otherwise.