@vultisig/cli 0.22.5 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @vultisig/cli
 
+## 0.23.0
+
+### Minor Changes
+
+- [#464](https://github.com/vultisig/vultisig-sdk/pull/464) [`a6db82f`](https://github.com/vultisig/vultisig-sdk/commit/a6db82fd103ea8eea01a084cc8fbd787367db437) Thanks [@neavra](https://github.com/neavra)! - feat(sdk/vault): `signMsgDeposit` for THORChain/MayaChain LP add/remove; sdk-cli dispatches LP memos through it
+
+  Adds `vault.signMsgDeposit({chain, amountBaseUnits, memo})` to `VaultBase`, building a `THORChainDeposit` cosmos message via the existing keysign pipeline (passes `isDeposit: true` through `getChainSpecific`). Memo is opaque pass-through — LP add (`+:POOL[:PAIRED]`), LP remove (`-:POOL:BPS[:ASSET]`), and any future deposit-style intent flow through the same surface.
+
+  sdk-cli's `signNonEvmServerTx` now dispatches THORChain/MayaChain MsgDeposit envelopes by memo prefix: `=:` continues to route through `vault.swap` (Phase D), `+:` and `-:` route through the new `signThorMsgDepositLp` → `vault.signMsgDeposit`. Unsupported prefixes (LOAN, BOND, etc.) throw `NotImplemented` with the offending memo in the error message. Phase E in the envelope-parity progression; previously these memos threw at `parseThorSwapMemo`.
+
+### Patch Changes
+
+- Updated dependencies [[`fde60dc`](https://github.com/vultisig/vultisig-sdk/commit/fde60dcc9f9822e21c2dbaeaacb9afb45cff0955), [`a6db82f`](https://github.com/vultisig/vultisig-sdk/commit/a6db82fd103ea8eea01a084cc8fbd787367db437)]:
+  - @vultisig/sdk@0.23.0
+  - @vultisig/client-shared@0.2.7
+  - @vultisig/rujira@18.0.0
+
+## 0.22.7
+
+### Patch Changes
+
+- [#457](https://github.com/vultisig/vultisig-sdk/pull/457) [`680119e`](https://github.com/vultisig/vultisig-sdk/commit/680119e7392921b8aeaf859c85e811fb40a25054) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Add regression tests and drift guards for Bitcoin PSBT compilation, ChainKind signing-input alignment, generated protobuf headers, and CLI agent action names aligned with AGENTS.md.
+
+- Updated dependencies [[`680119e`](https://github.com/vultisig/vultisig-sdk/commit/680119e7392921b8aeaf859c85e811fb40a25054), [`5102976`](https://github.com/vultisig/vultisig-sdk/commit/5102976d7c13fa9578bbbc6e5122526cefc1ec66), [`b36eb62`](https://github.com/vultisig/vultisig-sdk/commit/b36eb62842051b8b2bae06f1e123a5ebcf6cad88)]:
+  - @vultisig/sdk@0.22.7
+  - @vultisig/core-chain@1.7.1
+
 ## 0.22.5
 
 ### Patch Changes

package/dist/index.js

@@ -5395,8 +5395,399 @@ function getNativeTokenDecimals(chain) {
   return decimals[chain] || 18;
 }
 
+// ../../packages/core/chain/dist/Chain.js
+var EthereumL2Chain = {
+  Arbitrum: "Arbitrum",
+  Base: "Base",
+  Blast: "Blast",
+  Optimism: "Optimism",
+  Zksync: "Zksync",
+  Mantle: "Mantle"
+};
+var EvmChain = {
+  ...EthereumL2Chain,
+  Avalanche: "Avalanche",
+  CronosChain: "CronosChain",
+  BSC: "BSC",
+  Ethereum: "Ethereum",
+  Polygon: "Polygon",
+  Hyperliquid: "Hyperliquid",
+  Sei: "Sei"
+};
+var UtxoChain;
+(function(UtxoChain2) {
+  UtxoChain2["Bitcoin"] = "Bitcoin";
+  UtxoChain2["BitcoinCash"] = "Bitcoin-Cash";
+  UtxoChain2["Litecoin"] = "Litecoin";
+  UtxoChain2["Dogecoin"] = "Dogecoin";
+  UtxoChain2["Dash"] = "Dash";
+  UtxoChain2["Zcash"] = "Zcash";
+})(UtxoChain || (UtxoChain = {}));
+var cosmosChainsByKind = {
+  ibcEnabled: {
+    Cosmos: "Cosmos",
+    Osmosis: "Osmosis",
+    Dydx: "Dydx",
+    Kujira: "Kujira",
+    Terra: "Terra",
+    TerraClassic: "TerraClassic",
+    Noble: "Noble",
+    Akash: "Akash"
+  },
+  vaultBased: {
+    THORChain: "THORChain",
+    MayaChain: "MayaChain"
+  }
+};
+var IbcEnabledCosmosChain = cosmosChainsByKind.ibcEnabled;
+var VaultBasedCosmosChain = cosmosChainsByKind.vaultBased;
+var CosmosChain = {
+  ...IbcEnabledCosmosChain,
+  ...VaultBasedCosmosChain
+};
+var OtherChain;
+(function(OtherChain2) {
+  OtherChain2["Sui"] = "Sui";
+  OtherChain2["Solana"] = "Solana";
+  OtherChain2["Polkadot"] = "Polkadot";
+  OtherChain2["Bittensor"] = "Bittensor";
+  OtherChain2["Ton"] = "Ton";
+  OtherChain2["Ripple"] = "Ripple";
+  OtherChain2["Tron"] = "Tron";
+  OtherChain2["Cardano"] = "Cardano";
+  OtherChain2["QBTC"] = "QBTC";
+})(OtherChain || (OtherChain = {}));
+var Chain9 = {
+  ...EvmChain,
+  ...UtxoChain,
+  ...CosmosChain,
+  ...OtherChain
+};
+var UtxoBasedChain = [
+  ...Object.values(UtxoChain),
+  OtherChain.Cardano
+];
+var defaultChains = [
+  Chain9.Bitcoin,
+  Chain9.Ethereum,
+  Chain9.THORChain,
+  Chain9.Solana,
+  Chain9.BSC
+];
+
+// ../../packages/core/chain/dist/ChainKind.js
+var chainKindRecord = {
+  [EvmChain.Arbitrum]: "evm",
+  [EvmChain.Avalanche]: "evm",
+  [EvmChain.Base]: "evm",
+  [EvmChain.CronosChain]: "evm",
+  [EvmChain.BSC]: "evm",
+  [EvmChain.Blast]: "evm",
+  [EvmChain.Ethereum]: "evm",
+  [EvmChain.Optimism]: "evm",
+  [EvmChain.Polygon]: "evm",
+  [EvmChain.Zksync]: "evm",
+  [EvmChain.Mantle]: "evm",
+  [EvmChain.Hyperliquid]: "evm",
+  [EvmChain.Sei]: "evm",
+  [UtxoChain.Bitcoin]: "utxo",
+  [UtxoChain.BitcoinCash]: "utxo",
+  [UtxoChain.Litecoin]: "utxo",
+  [UtxoChain.Dogecoin]: "utxo",
+  [UtxoChain.Dash]: "utxo",
+  [UtxoChain.Zcash]: "utxo",
+  [CosmosChain.THORChain]: "cosmos",
+  [CosmosChain.Cosmos]: "cosmos",
+  [CosmosChain.Osmosis]: "cosmos",
+  [CosmosChain.MayaChain]: "cosmos",
+  [CosmosChain.Dydx]: "cosmos",
+  [CosmosChain.Kujira]: "cosmos",
+  [CosmosChain.Terra]: "cosmos",
+  [CosmosChain.TerraClassic]: "cosmos",
+  [CosmosChain.Noble]: "cosmos",
+  [CosmosChain.Akash]: "cosmos",
+  [OtherChain.Sui]: "sui",
+  [OtherChain.Solana]: "solana",
+  [OtherChain.Polkadot]: "polkadot",
+  [OtherChain.Bittensor]: "bittensor",
+  [OtherChain.Ton]: "ton",
+  [OtherChain.Ripple]: "ripple",
+  [OtherChain.Tron]: "tron",
+  [OtherChain.Cardano]: "cardano",
+  [OtherChain.QBTC]: "qbtc"
+};
+function getChainKind(chain) {
+  return chainKindRecord[chain];
+}
+
+// ../../packages/lib/utils/dist/record/recordMap.js
+function recordMap(record, fn) {
+  return Object.fromEntries(Object.entries(record).map(([key, value]) => [
+    key,
+    fn(value, key)
+  ]));
+}
+
+// ../../packages/lib/utils/dist/record/makeRecord/index.js
+var makeRecord = (keys, getValue) => {
+  const record = {};
+  keys.forEach((key, index) => {
+    record[key] = getValue(key, index);
+  });
+  return record;
+};
+
+// ../../packages/core/chain/dist/chains/cosmos/thor/kujira-merge/index.js
+var kujiraCoinsMigratedToThorChain = [
+  "kuji",
+  "rkuji",
+  "fuzn",
+  "nstk",
+  "wink",
+  "lvn"
+];
+var kujiraCoinsMigratedToThorChainMetadata = {
+  kuji: {
+    ticker: "KUJI",
+    logo: "kuji",
+    priceProviderId: "kujira"
+  },
+  rkuji: {
+    ticker: "rKUJI",
+    logo: "rkuji.png",
+    priceProviderId: "kujira"
+  },
+  fuzn: {
+    ticker: "FUZN",
+    logo: "fuzn.png",
+    priceProviderId: "fuzion"
+  },
+  lvn: {
+    ticker: "LVN",
+    logo: "levana",
+    priceProviderId: "levana-protocol"
+  },
+  nstk: {
+    ticker: "NSTK",
+    logo: "nstk.png",
+    priceProviderId: "unstake-fi"
+  },
+  wink: {
+    ticker: "WINK",
+    logo: "wink.png",
+    priceProviderId: "winkhub"
+  }
+};
+var kujiraCoinMigratedToThorChainDestinationId = makeRecord(kujiraCoinsMigratedToThorChain, (id) => `thor.${id}`);
+
+// ../../packages/core/chain/dist/coin/chainFeeCoin.js
+var ether = {
+  ticker: "ETH",
+  logo: "eth",
+  decimals: 18,
+  priceProviderId: "ethereum"
+};
+var leanChainFeeCoin = {
+  [Chain9.Bitcoin]: {
+    ticker: "BTC",
+    logo: "btc",
+    decimals: 8,
+    priceProviderId: "bitcoin"
+  },
+  [Chain9.BitcoinCash]: {
+    ticker: "BCH",
+    logo: "bch",
+    decimals: 8,
+    priceProviderId: "bitcoin-cash"
+  },
+  [Chain9.Litecoin]: {
+    ticker: "LTC",
+    logo: "ltc",
+    decimals: 8,
+    priceProviderId: "litecoin"
+  },
+  [Chain9.Dogecoin]: {
+    ticker: "DOGE",
+    logo: "doge",
+    decimals: 8,
+    priceProviderId: "dogecoin"
+  },
+  [Chain9.Dash]: {
+    ticker: "DASH",
+    logo: "dash",
+    decimals: 8,
+    priceProviderId: "dash"
+  },
+  [Chain9.Ripple]: {
+    ticker: "XRP",
+    logo: "xrp",
+    decimals: 6,
+    priceProviderId: "ripple"
+  },
+  [Chain9.THORChain]: {
+    ticker: "RUNE",
+    logo: "rune",
+    decimals: 8,
+    priceProviderId: "thorchain"
+  },
+  [Chain9.MayaChain]: {
+    ticker: "CACAO",
+    logo: "cacao",
+    decimals: 10,
+    priceProviderId: "cacao"
+  },
+  [Chain9.Solana]: {
+    ticker: "SOL",
+    logo: "solana",
+    decimals: 9,
+    priceProviderId: "solana"
+  },
+  [Chain9.Ton]: {
+    ticker: "TON",
+    logo: "ton",
+    decimals: 9,
+    priceProviderId: "the-open-network"
+  },
+  [Chain9.Ethereum]: ether,
+  [Chain9.Avalanche]: {
+    ticker: "AVAX",
+    logo: "avax",
+    decimals: 18,
+    priceProviderId: "avalanche-2"
+  },
+  [Chain9.BSC]: {
+    ticker: "BNB",
+    logo: "bsc",
+    decimals: 18,
+    priceProviderId: "binancecoin"
+  },
+  [Chain9.Polygon]: {
+    ticker: "POL",
+    logo: "polygon",
+    decimals: 18,
+    priceProviderId: "polygon-ecosystem-token"
+  },
+  [Chain9.CronosChain]: {
+    ticker: "CRO",
+    logo: "cro",
+    decimals: 18,
+    priceProviderId: "crypto-com-chain"
+  },
+  [Chain9.Dydx]: {
+    ticker: "DYDX",
+    logo: "dydx",
+    decimals: 18,
+    priceProviderId: "dydx-chain"
+  },
+  [Chain9.Kujira]: {
+    ...kujiraCoinsMigratedToThorChainMetadata.kuji,
+    decimals: 6
+  },
+  [Chain9.Terra]: {
+    ticker: "LUNA",
+    logo: "luna",
+    decimals: 6,
+    priceProviderId: "terra-luna-2"
+  },
+  [Chain9.TerraClassic]: {
+    ticker: "LUNC",
+    logo: "lunc",
+    decimals: 6,
+    priceProviderId: "terra-luna"
+  },
+  [Chain9.Sui]: {
+    ticker: "SUI",
+    logo: "sui",
+    decimals: 9,
+    priceProviderId: "sui"
+  },
+  [Chain9.Polkadot]: {
+    ticker: "DOT",
+    logo: "dot",
+    decimals: 10,
+    priceProviderId: "polkadot"
+  },
+  [Chain9.Bittensor]: {
+    ticker: "TAO",
+    logo: "bittensor",
+    decimals: 9,
+    priceProviderId: "bittensor"
+  },
+  [Chain9.Noble]: {
+    ticker: "USDC",
+    logo: "noble",
+    decimals: 6,
+    priceProviderId: "usd-coin"
+  },
+  [Chain9.Akash]: {
+    ticker: "AKT",
+    logo: "akash",
+    decimals: 6,
+    priceProviderId: "akash-network"
+  },
+  [Chain9.Cosmos]: {
+    ticker: "ATOM",
+    logo: "atom",
+    decimals: 6,
+    priceProviderId: "cosmos"
+  },
+  [Chain9.Osmosis]: {
+    ticker: "OSMO",
+    logo: "osmo",
+    decimals: 6,
+    priceProviderId: "osmosis"
+  },
+  [Chain9.Tron]: {
+    ticker: "TRX",
+    logo: "tron",
+    decimals: 6,
+    priceProviderId: "tron"
+  },
+  ...recordMap(EthereumL2Chain, () => ether),
+  [Chain9.Zcash]: {
+    ticker: "ZEC",
+    logo: "zec",
+    decimals: 8,
+    priceProviderId: "zcash"
+  },
+  [Chain9.Cardano]: {
+    ticker: "ADA",
+    logo: "ada",
+    decimals: 6,
+    priceProviderId: "cardano"
+  },
+  [Chain9.Mantle]: {
+    ticker: "MNT",
+    logo: "mantle",
+    decimals: 18,
+    priceProviderId: "mantle"
+  },
+  [Chain9.Hyperliquid]: {
+    ticker: "HYPE",
+    logo: "hyperliquid",
+    decimals: 18,
+    priceProviderId: "hyperliquid"
+  },
+  [Chain9.Sei]: {
+    ticker: "SEI",
+    logo: "sei",
+    decimals: 18,
+    priceProviderId: "sei-network"
+  },
+  [Chain9.QBTC]: {
+    ticker: "QBTC",
+    logo: "qbtc",
+    decimals: 6,
+    priceProviderId: "qbtc-testnet"
+  }
+};
+var chainFeeCoin = recordMap(leanChainFeeCoin, (coin, chain) => ({
+  ...coin,
+  chain
+}));
+
 // src/agent/executor.ts
-import { Chain as Chain9, Vultisig as VultisigSdk } from "@vultisig/sdk";
+import { Chain as Chain10, VaultError as VaultError3, VaultErrorCode as VaultErrorCode3, Vultisig as VultisigSdk } from "@vultisig/sdk";
 
 // ../../node_modules/viem/_esm/index.js
 init_formatUnits();
@@ -5557,6 +5948,45 @@ function sleep2(ms) {
 }
 
 // src/agent/executor.ts
+var THOR_MEMO_CHAIN_TO_ENUM = {
+  BTC: Chain10.Bitcoin,
+  ETH: Chain10.Ethereum,
+  BSC: Chain10.BSC,
+  AVAX: Chain10.Avalanche,
+  BASE: Chain10.Base,
+  // L2 — THORChain routinely quotes Base destinations (PR #439 review finding 1)
+  ARB: Chain10.Arbitrum,
+  // L1-via-bridge path (PR #439 review finding 1)
+  BCH: Chain10.BitcoinCash,
+  LTC: Chain10.Litecoin,
+  DOGE: Chain10.Dogecoin,
+  GAIA: Chain10.Cosmos,
+  THOR: Chain10.THORChain,
+  RUNE: Chain10.THORChain,
+  XRP: Chain10.Ripple,
+  DASH: Chain10.Dash,
+  ZEC: Chain10.Zcash,
+  MAYA: Chain10.MayaChain,
+  CACAO: Chain10.MayaChain
+};
+var THOR_MEMO_ASSET_SHORTCUTS = {
+  b: "BTC.BTC",
+  e: "ETH.ETH",
+  s: "BSC.BNB",
+  a: "AVAX.AVAX",
+  c: "BCH.BCH",
+  l: "LTC.LTC",
+  d: "DOGE.DOGE",
+  g: "GAIA.ATOM",
+  r: "THOR.RUNE",
+  x: "XRP.XRP",
+  cacao: "MAYA.CACAO",
+  dash: "DASH.DASH",
+  zec: "ZEC.ZEC"
+  // BASE / ARB don't have documented single-letter shortcuts; THORChain
+  // emits these as the full CHAIN.ASSET form in memos. Listed in
+  // THOR_MEMO_CHAIN_TO_ENUM only.
+};
 var EVM_CHAINS = /* @__PURE__ */ new Set([
   "Ethereum",
   "BSC",
@@ -5592,6 +6022,12 @@ var AgentExecutor = class {
   /** Owning SDK (optional); used for address book backed by app storage */
   vultisig;
   pendingPayloads = /* @__PURE__ */ new Map();
+  /**
+   * Buffered legs for a 2-leg mcp-ts execute_* envelope (approve + main).
+   * Populated by storeServerTransaction when both `approvalTxArgs` and
+   * `txArgs` are present; consumed and cleared by signMultiLeg.
+   */
+  pendingLegs = [];
   password = null;
   verbose;
   stateStore = null;
@@ -5621,13 +6057,46 @@ var AgentExecutor = class {
         `[executor] storeServerTransaction called, keys: ${Object.keys(txReadyData || {}).join(",")}
 `
       );
-    if (txReadyData?.approvalTxArgs) {
-      if (this.verbose)
-        process.stderr.write(
-          `[executor] skipping multi-leg execute_swap envelope (approvalTxArgs present): not yet supported in sdk-cli \u2014 Phase B
+    if (txReadyData?.approvalTxArgs && txReadyData?.txArgs) {
+      const approvalChain = resolveChainFromTxReady(txReadyData.approvalTxArgs);
+      const mainChain = resolveChainFromTxReady(txReadyData.txArgs);
+      const parentChain = resolveChainFromTxReady(txReadyData);
+      if (!approvalChain || !mainChain || approvalChain !== mainChain || parentChain && parentChain !== approvalChain) {
+        if (this.verbose)
+          process.stderr.write(
+            `[executor] rejecting multi-leg envelope with inconsistent chain metadata: parent=${parentChain ?? "unresolved"} approval=${approvalChain ?? "unresolved"} main=${mainChain ?? "unresolved"}
 `
-        );
-      return false;
+          );
+        return false;
+      }
+      const chain2 = approvalChain;
+      if (!EVM_CHAINS.has(chain2)) {
+        if (this.verbose)
+          process.stderr.write(
+            `[executor] rejecting multi-leg envelope on non-EVM chain ${chain2}: signMultiLeg is EVM-only
+`
+          );
+        return false;
+      }
+      this.pendingLegs = [
+        {
+          txArgs: txReadyData.approvalTxArgs,
+          parent: txReadyData,
+          kind: "approve"
+        },
+        { txArgs: txReadyData.txArgs, parent: txReadyData, kind: "main" }
+      ];
+      this.pendingPayloads.clear();
+      this.pendingPayloads.set("latest", {
+        payload: { __serverTx: true, __multiLeg: true, ...txReadyData },
+        coin: { chain: chain2, address: "", decimals: 18, ticker: "" },
+        chain: chain2,
+        timestamp: Date.now()
+      });
+      if (this.verbose)
+        process.stderr.write(`[executor] stored multi-leg envelope: chain=${chain2}, legs=2 (approve, main)
+`);
+      return true;
     }
     const nestedTx = extractNestedTx(txReadyData);
     if (nestedTx?.status === "error" || nestedTx?.error) {
@@ -5636,13 +6105,34 @@ var AgentExecutor = class {
 `);
       return false;
     }
+    if (!nestedTx && txReadyData && typeof txReadyData === "object") {
+      const txArgs = txReadyData.txArgs;
+      if (txArgs && typeof txArgs === "object" && typeof txArgs.to === "string" && typeof txArgs.amount === "string") {
+        const chain2 = resolveChainFromTxReady(txReadyData) || Chain10.Ethereum;
+        if (getChainKind(chain2) !== "evm") {
+          this.pendingPayloads.clear();
+          this.pendingPayloads.set("latest", {
+            payload: { __serverTx: true, ...txReadyData },
+            coin: { chain: chain2, address: "", decimals: 18, ticker: "" },
+            chain: chain2,
+            timestamp: Date.now()
+          });
+          if (this.verbose)
+            process.stderr.write(
+              `[executor] Stored non-EVM server tx for chain ${chain2} (kind=${getChainKind(chain2)})
+`
+            );
+          return true;
+        }
+      }
+    }
     if (!nestedTx) {
       if (this.verbose)
         process.stderr.write(`[executor] storeServerTransaction: no swap_tx/send_tx/tx/txArgs.tx found in data
 `);
       return false;
     }
-    const chain = resolveChainFromTxReady(txReadyData) || Chain9.Ethereum;
+    const chain = resolveChainFromTxReady(txReadyData) || Chain10.Ethereum;
     this.pendingPayloads.clear();
     this.pendingPayloads.set("latest", {
       payload: { __serverTx: true, ...txReadyData },
@@ -5871,7 +6361,16 @@ var AgentExecutor = class {
         throw new Error("Pending transaction is not a server-built tx (no __serverTx flag).");
       }
       let result;
-      if (chain === "Solana" && (payload.swap_tx || payload.provider)) {
+      if (payload.__multiLeg) {
+        if (this.pendingLegs.length !== 2) {
+          throw new VaultError3(
+            VaultErrorCode3.InvalidConfig,
+            `signMultiLeg: expected 2 pending legs, got ${this.pendingLegs.length}`
+          );
+        }
+        result = await this.signMultiLeg(payload, chain, {});
+      }
+      if (!result && chain === "Solana" && (payload.swap_tx || payload.provider)) {
         try {
           result = await this.buildAndSignSolanaSwapLocally(payload);
         } catch (e) {
@@ -5890,10 +6389,223 @@ var AgentExecutor = class {
     });
   }
   /**
-   * Sign and broadcast a server-built transaction (raw EVM tx from tx_ready SSE).
-   * Uses vault.prepareSendTx with memo field to carry the calldata.
+   * Dispatch a server-built tx_ready envelope to the chain-kind-specific
+   * signer. EVM stays in `signEvmServerTx` (the existing PR #422 + PR #435
+   * code, with EVM nonce/lock plumbing). Non-EVM kinds parse the envelope
+   * via `parseNonEvmEnvelope` and route through `vault.send`, which is
+   * already chain-agnostic via `VaultBase.prepareSendTx` virtuals.
+   *
+   * Phase D — see task `100526-sdk-cli-non-evm-signing.md`.
    */
   async signServerTx(serverTxData, defaultChain, params) {
+    const chain = resolveChainFromTxReady(serverTxData) || defaultChain;
+    const chainKind = getChainKind(chain);
+    if (chainKind === "evm") {
+      return this.signEvmServerTx(serverTxData, defaultChain, params);
+    }
+    return this.signNonEvmServerTx(serverTxData, chain);
+  }
+  /**
+   * Non-EVM signing path: parse the agent's tx_ready envelope into a
+   * `vault.send`-shaped argument bag and call through. The SDK already
+   * handles per-chain prepare/sign/broadcast internally via
+   * `VaultBase.prepareSendTx` virtuals — sdk-cli only owns envelope
+   * parsing here, not chain-specific signing logic.
+   *
+   * THORChain / MayaChain MsgDeposit envelopes (msg_type='deposit',
+   * to='') are routed through `vault.swap` because the agent's intent
+   * is a swap — the memo (`=:CHAIN.ASSET:DEST::v0:slippage`) carries
+   * the routing. We parse the memo to reconstruct vault.swap's
+   * fromChain / fromSymbol / toChain / toSymbol / amount args. The SDK
+   * then builds the MsgDeposit cosmos tx internally. Vultiagent uses an
+   * equivalent custom helper (`buildSignBroadcastThorchainLpDeposit`);
+   * we reuse the public `vault.swap` surface to avoid expanding the SDK.
+   */
+  async signNonEvmServerTx(serverTxData, chain) {
+    if (this.vault.isEncrypted && !this.vault.isUnlocked?.()) {
+      if (this.password) {
+        await this.vault.unlock?.(this.password);
+      }
+    }
+    const txArgs = serverTxData?.txArgs ?? {};
+    if (typeof txArgs.chain === "string" && txArgs.chain !== chain) {
+      throw new VaultError3(
+        VaultErrorCode3.InvalidConfig,
+        `signNonEvmServerTx: dispatcher chain '${chain}' disagrees with envelope chain '${txArgs.chain}'`
+      );
+    }
+    if (txArgs.msg_type === "deposit" && (chain === Chain10.THORChain || chain === Chain10.MayaChain)) {
+      const memo = typeof txArgs.memo === "string" ? txArgs.memo : "";
+      if (memo.startsWith("=:")) {
+        return this.signThorMsgDepositSwap(serverTxData, chain);
+      }
+      if (memo.startsWith("+:") || memo.startsWith("-:")) {
+        return this.signThorMsgDepositLp(serverTxData, chain);
+      }
+      throw new VaultError3(
+        VaultErrorCode3.NotImplemented,
+        `signNonEvmServerTx: MsgDeposit memo prefix not supported on ${chain}: '${memo}'. Supported prefixes: '=:' (swap), '+:' (LP add), '-:' (LP remove). Loan / validator ops are out of scope.`
+      );
+    }
+    const args = parseNonEvmEnvelope(serverTxData, chain);
+    if (this.verbose)
+      process.stderr.write(
+        `[sign_non_evm_server_tx] chain=${chain}, to=${args.to}, amount=${args.amount}${args.symbol ? ` ${args.symbol}` : ""}, memo=${args.memo ? `"${args.memo}"` : "(none)"}
+`
+      );
+    const result = await this.vault.send({
+      chain,
+      to: args.to,
+      amount: args.amount,
+      symbol: args.symbol,
+      memo: args.memo
+    });
+    if (result.dryRun) {
+      throw new VaultError3(
+        VaultErrorCode3.InvalidConfig,
+        "signNonEvmServerTx: vault.send unexpectedly returned dryRun result"
+      );
+    }
+    this.pendingPayloads.clear();
+    const broadcast = result;
+    const explorerUrl = VultisigSdk.getTxExplorerUrl(chain, broadcast.txHash);
+    return {
+      tx_hash: broadcast.txHash,
+      chain: chain.toString(),
+      status: "pending",
+      explorer_url: explorerUrl
+    };
+  }
+  /**
+   * Sign and broadcast a THORChain / MayaChain MsgDeposit-style swap
+   * envelope by reconstructing `vault.swap` args from the memo.
+   *
+   * The agent emits envelopes shaped:
+   *   { txArgs: { chain: 'THORChain', tx_encoding: 'cosmos-msg',
+   *               to: '', amount: '<base>', denom: 'rune',
+   *               memo: '=:DEST_CHAIN.DEST_ASSET:DEST_ADDR::v0:slippage_bps',
+   *               msg_type: 'deposit' } }
+   *
+   * The memo is THORChain's standard swap memo. We parse out the
+   * destination chain + asset, look up the corresponding `Chain` enum,
+   * then call `vault.swap` which builds the MsgDeposit internally.
+   *
+   * IMPORTANT — destination address handling: `vault.swap` re-derives the
+   * destination address from `vault.address(toChain)` when fetching the
+   * native swap quote (see `findSwapQuote` → `getNativeSwapQuote` —
+   * `destination: to.address`). It does NOT honor the destination address
+   * encoded in the envelope's memo. As a fund-safety guard we therefore
+   * require the memo's destination address to match the vault's own
+   * destination address (self-swap) and throw otherwise — see Phase D
+   * review F1. Cross-account routing must wait on a Phase E SDK extension
+   * that lets `vault.swap` accept a user-supplied destination.
+   */
+  async signThorMsgDepositSwap(serverTxData, chain) {
+    const txArgs = serverTxData?.txArgs ?? {};
+    const memo = typeof txArgs.memo === "string" ? txArgs.memo : "";
+    const parsed = parseThorSwapMemo(memo);
+    const toChain = THOR_MEMO_CHAIN_TO_ENUM[parsed.destChainCode];
+    if (!toChain) {
+      throw new VaultError3(
+        VaultErrorCode3.UnsupportedChain,
+        `signThorMsgDepositSwap: unsupported destination chain code '${parsed.destChainCode}' in memo '${memo}'.`
+      );
+    }
+    const vaultDestAddress = await this.vault.address(toChain);
+    const normalizeForCompare = (addr) => EVM_CHAINS.has(toChain) ? addr.toLowerCase() : addr;
+    if (parsed.destAddress && normalizeForCompare(parsed.destAddress) !== normalizeForCompare(vaultDestAddress)) {
+      throw new VaultError3(
+        VaultErrorCode3.NotImplemented,
+        `signThorMsgDepositSwap: memo destination '${parsed.destAddress}' does not match vault address '${vaultDestAddress}' on ${toChain}. Phase D only supports self-swaps; cross-account routing requires a Phase E SDK extension that passes the user-supplied destination through to vault.swap.`
+      );
+    }
+    const fromSymbol = chain === Chain10.THORChain ? "RUNE" : "CACAO";
+    const amountRaw = typeof txArgs.amount === "string" ? txArgs.amount : void 0;
+    if (!amountRaw) {
+      throw new VaultError3(
+        VaultErrorCode3.InvalidConfig,
+        `signThorMsgDepositSwap: missing or non-string 'amount' field on ${chain} envelope`
+      );
+    }
+    const amountDecimal = convertBaseUnitsToDecimal(chain, amountRaw, "signThorMsgDepositSwap");
+    if (this.verbose)
+      process.stderr.write(
+        `[sign_thor_msg_deposit_swap] ${fromSymbol}@${chain} \u2192 ${parsed.destAsset}@${toChain}, amount=${amountDecimal}, memo='${memo}'
+`
+      );
+    const result = await this.vault.swap({
+      fromChain: chain,
+      fromSymbol,
+      toChain,
+      toSymbol: parsed.destAsset,
+      amount: amountDecimal
+    });
+    if (result.dryRun) {
+      throw new VaultError3(
+        VaultErrorCode3.InvalidConfig,
+        "signThorMsgDepositSwap: vault.swap unexpectedly returned dryRun result"
+      );
+    }
+    this.pendingPayloads.clear();
+    const broadcast = result;
+    const explorerUrl = VultisigSdk.getTxExplorerUrl(chain, broadcast.txHash);
+    return {
+      tx_hash: broadcast.txHash,
+      chain: chain.toString(),
+      status: "pending",
+      explorer_url: explorerUrl
+    };
+  }
+  /**
+   * Sign and broadcast a THORChain / MayaChain MsgDeposit envelope whose
+   * memo is an LP add (`+:POOL[:PAIRED]`) or remove (`-:POOL:BPS[:ASSET]`).
+   *
+   * The agent emits the same `cosmos-msg / msg_type: deposit` envelope as
+   * the swap path; only the memo prefix differs. The memo is opaque
+   * pass-through — sdk-cli doesn't parse pool / paired address / bps
+   * because the SDK doesn't need to, the on-chain handler does.
+   *
+   * Uses `vault.signMsgDeposit` which builds a THORChainDeposit cosmos
+   * message via the SDK's keysign payload pipeline. Amount is consumed
+   * as base units directly (no decimal conversion) since the agent
+   * already emits RUNE / CACAO in base units.
+   */
+  async signThorMsgDepositLp(serverTxData, chain) {
+    const txArgs = serverTxData?.txArgs ?? {};
+    const memo = typeof txArgs.memo === "string" ? txArgs.memo : "";
+    const amountRaw = typeof txArgs.amount === "string" ? txArgs.amount : void 0;
+    if (!amountRaw) {
+      throw new VaultError3(
+        VaultErrorCode3.InvalidConfig,
+        `signThorMsgDepositLp: missing or non-string 'amount' field on ${chain} envelope`
+      );
+    }
+    if (amountRaw.length > MAX_AMOUNT_DIGITS) {
+      throw new VaultError3(
+        VaultErrorCode3.InvalidAmount,
+        `signThorMsgDepositLp: amount '${amountRaw}' for ${chain} exceeds ${MAX_AMOUNT_DIGITS}-digit safety bound. Likely a quote-side bug. Refusing to sign.`
+      );
+    }
+    if (this.verbose)
+      process.stderr.write(`[sign_thor_msg_deposit_lp] chain=${chain}, memo='${memo}', amountBaseUnits=${amountRaw}
+`);
+    const result = await this.vault.signMsgDeposit({ chain, amountBaseUnits: amountRaw, memo });
+    this.pendingPayloads.clear();
+    const explorerUrl = VultisigSdk.getTxExplorerUrl(chain, result.txHash);
+    return {
+      tx_hash: result.txHash,
+      chain: chain.toString(),
+      status: "pending",
+      explorer_url: explorerUrl
+    };
+  }
+  /**
+   * Sign and broadcast a server-built EVM transaction (raw EVM tx from
+   * tx_ready SSE). Uses vault.prepareSendTx with memo field to carry the
+   * calldata, plus EVM-specific nonce/lock plumbing that Phase B's
+   * `signMultiLeg` depends on for back-to-back approve+main broadcasts.
+   */
+  async signEvmServerTx(serverTxData, defaultChain, params) {
     const swapTx = extractNestedTx(serverTxData);
     if (!swapTx?.to) {
       throw new Error("Server transaction missing required fields (to)");
@@ -5987,6 +6699,97 @@ var AgentExecutor = class {
       throw err;
     }
   }
+  /**
+   * Sign and broadcast a 2-leg ERC-20 approve + main flow originating from
+   * mcp-ts `execute_*` envelopes that carry both `approvalTxArgs` and
+   * `txArgs`. Mirrors vultiagent's `useTransactionFlow`: leg 1 (approve) is
+   * signed and broadcast first, the receipt is awaited, then leg 2 (main)
+   * is signed and broadcast. Fails closed if the approve doesn't confirm
+   * — the main leg is NEVER broadcast against a stale or failed allowance.
+   *
+   * Phase B is intentionally EVM-only; non-EVM 2-leg flows are not a real
+   * shape on mcp-ts today (Pattern 1 / Pattern 2 multi-leg flows are split
+   * server-side via sequence_id and don't traverse this path).
+   */
+  async signMultiLeg(_payload, chain, params) {
+    const [approveLeg, mainLeg] = this.pendingLegs;
+    try {
+      const approveEnvelope = {
+        ...approveLeg.parent,
+        txArgs: approveLeg.txArgs,
+        approvalTxArgs: void 0,
+        __multiLeg: void 0,
+        swap_tx: void 0,
+        send_tx: void 0,
+        tx: void 0
+      };
+      const approveResult = await this.signServerTx(approveEnvelope, chain, params);
+      const approveTxHash = approveResult.tx_hash;
+      if (!approveTxHash) {
+        throw new VaultError3(VaultErrorCode3.BroadcastFailed, "signMultiLeg: approve leg returned no tx_hash");
+      }
+      if (this.verbose)
+        process.stderr.write(`[signMultiLeg] approve broadcast: ${approveTxHash}, waiting for receipt...
+`);
+      try {
+        await this.waitForEvmReceipt(chain, approveTxHash, { timeoutSec: 90 });
+      } catch (err) {
+        throw new VaultError3(
+          VaultErrorCode3.Timeout,
+          `signMultiLeg: approve leg ${approveTxHash} did not confirm: ${err?.message ?? err}`,
+          err instanceof Error ? err : void 0
+        );
+      }
+      if (this.verbose) process.stderr.write(`[signMultiLeg] approve confirmed, broadcasting main leg
+`);
+      const mainEnvelope = {
+        ...mainLeg.parent,
+        txArgs: mainLeg.txArgs,
+        approvalTxArgs: void 0,
+        __multiLeg: void 0,
+        swap_tx: void 0,
+        send_tx: void 0,
+        tx: void 0
+      };
+      const mainResult = await this.signServerTx(mainEnvelope, chain, params);
+      return {
+        tx_hash: mainResult.tx_hash,
+        approval_tx_hash: approveTxHash,
+        chain: mainResult.chain,
+        status: "pending",
+        explorer_url: mainResult.explorer_url
+      };
+    } finally {
+      this.pendingLegs = [];
+    }
+  }
+  /**
+   * Poll vault.getTxStatus until the EVM tx confirms or the timeout fires.
+   * Mirrors VaultBase's private `waitForConfirmation` (used by `vault.swap`
+   * for its own approve-before-swap flow) — kept at the executor layer here
+   * so we can stub it from unit tests without exposing private SDK methods.
+   *
+   * Throws on timeout or on receipt status === 'error' (revert). Returns on
+   * success.
+   */
+  async waitForEvmReceipt(chain, txHash, opts) {
+    const intervalMs = 3e3;
+    const deadline = Date.now() + opts.timeoutSec * 1e3;
+    while (Date.now() < deadline) {
+      try {
+        const result = await this.vault.getTxStatus({ chain, txHash });
+        if (result?.status === "success") return;
+        if (result?.status === "error") {
+          throw new VaultError3(VaultErrorCode3.BroadcastFailed, `approve tx reverted (${txHash})`);
+        }
+      } catch (e) {
+        if (e instanceof VaultError3 && e.code === VaultErrorCode3.BroadcastFailed) throw e;
+        if (e?.message?.includes("reverted")) throw e;
+      }
+      await new Promise((r) => setTimeout(r, intervalMs));
+    }
+    throw new VaultError3(VaultErrorCode3.Timeout, `approve tx ${txHash} not confirmed within ${opts.timeoutSec}s`);
+  }
   /**
    * Build, sign, and broadcast a Solana swap locally using the SDK's swap flow.
    * Uses swap params from the tx_ready event to call vault.getSwapQuote → prepareSwapTx.
@@ -6305,11 +7108,11 @@ var AgentExecutor = class {
 `);
     const chainName = params.chain;
     const chainId = domain.chainId;
-    let chain = Chain9.Ethereum;
+    let chain = Chain10.Ethereum;
     if (chainName) {
-      chain = resolveChain(chainName) || Chain9.Ethereum;
+      chain = resolveChain(chainName) || Chain10.Ethereum;
     } else if (chainId) {
-      chain = resolveChainId(chainId) || Chain9.Ethereum;
+      chain = resolveChainId(chainId) || Chain10.Ethereum;
     }
     const sigResult = await this.vault.signBytes({
       data: eip712Hash,
@@ -6414,11 +7217,11 @@ var AgentExecutor = class {
 };
 function resolveChain(name) {
   if (!name) return null;
-  if (Object.values(Chain9).includes(name)) {
+  if (Object.values(Chain10).includes(name)) {
     return name;
   }
   const lower = name.toLowerCase();
-  for (const [, value] of Object.entries(Chain9)) {
+  for (const [, value] of Object.entries(Chain10)) {
     if (typeof value === "string" && value.toLowerCase() === lower) {
       return value;
     }
@@ -6444,7 +7247,7 @@ function resolveChain(name) {
     xrp: "Ripple"
   };
   const aliased = aliases[lower];
-  if (aliased && Object.values(Chain9).includes(aliased)) {
+  if (aliased && Object.values(Chain10).includes(aliased)) {
     return aliased;
   }
   return null;
@@ -6480,20 +7283,89 @@ function resolveChainFromTxReady(txReadyData) {
 function extractNestedTx(txReadyData) {
   return txReadyData?.swap_tx || txReadyData?.send_tx || txReadyData?.tx || txReadyData?.txArgs?.tx;
 }
+var MAX_AMOUNT_DIGITS = 26;
+function convertBaseUnitsToDecimal(chain, amountRaw, context) {
+  if (amountRaw.length > MAX_AMOUNT_DIGITS) {
+    throw new VaultError3(
+      VaultErrorCode3.InvalidAmount,
+      `${context}: amount '${amountRaw}' for ${chain} exceeds ${MAX_AMOUNT_DIGITS}-digit safety bound. Likely a quote-side bug. Refusing to sign.`
+    );
+  }
+  const decimals = chainFeeCoin[chain]?.decimals;
+  if (decimals === void 0) {
+    throw new VaultError3(VaultErrorCode3.UnsupportedChain, `${context}: no native decimals registered for ${chain}`);
+  }
+  try {
+    return formatUnits(BigInt(amountRaw), decimals);
+  } catch (err) {
+    throw new VaultError3(
+      VaultErrorCode3.InvalidAmount,
+      `${context}: failed to convert amount '${amountRaw}' for ${chain}: ${err?.message ?? err}`
+    );
+  }
+}
+function parseNonEvmEnvelope(serverTxData, chain) {
+  const txArgs = serverTxData?.txArgs ?? serverTxData;
+  if (!txArgs || typeof txArgs !== "object") {
+    throw new VaultError3(VaultErrorCode3.InvalidConfig, "parseNonEvmEnvelope: envelope missing txArgs");
+  }
+  const to = typeof txArgs.to === "string" ? txArgs.to : void 0;
+  if (!to) {
+    throw new VaultError3(VaultErrorCode3.InvalidConfig, `parseNonEvmEnvelope: missing 'to' field for ${chain}`);
+  }
+  const amountRaw = typeof txArgs.amount === "string" ? txArgs.amount : void 0;
+  if (!amountRaw) {
+    throw new VaultError3(VaultErrorCode3.InvalidConfig, `parseNonEvmEnvelope: missing 'amount' field for ${chain}`);
+  }
+  const amountDecimal = convertBaseUnitsToDecimal(chain, amountRaw, "parseNonEvmEnvelope");
+  let symbol;
+  const tokenResolved = serverTxData?.resolved?.labels?.token_resolved;
+  const nativeTicker = chainFeeCoin[chain]?.ticker;
+  if (typeof tokenResolved === "string" && tokenResolved !== nativeTicker) {
+    symbol = tokenResolved;
+  }
+  const memo = typeof txArgs.memo === "string" && txArgs.memo.length > 0 ? txArgs.memo : void 0;
+  return { chain, to, amount: amountDecimal, symbol, memo };
+}
+function parseThorSwapMemo(memo) {
+  if (!memo.startsWith("=:")) {
+    throw new VaultError3(
+      VaultErrorCode3.NotImplemented,
+      `parseThorSwapMemo: only swap memos (=:CHAIN.ASSET:DEST...) supported on this path; got memo='${memo}'. LP memos (+:/-:) route through signThorMsgDepositLp; loan / validator ops out of scope.`
+    );
+  }
+  const memoBody = memo.slice(2);
+  const parts = memoBody.split(":");
+  let chainAsset = parts[0];
+  if (chainAsset && !chainAsset.includes(".")) {
+    const expanded = THOR_MEMO_ASSET_SHORTCUTS[chainAsset.toLowerCase()];
+    if (expanded) chainAsset = expanded;
+  }
+  if (!chainAsset || !chainAsset.includes(".")) {
+    throw new VaultError3(
+      VaultErrorCode3.InvalidConfig,
+      `parseThorSwapMemo: malformed swap memo '${memo}': missing CHAIN.ASSET in first segment.`
+    );
+  }
+  const [destChainCode, destAssetRaw] = chainAsset.split(".");
+  const destAsset = destAssetRaw?.split("-")[0] ?? "";
+  const destAddress = typeof parts[1] === "string" ? parts[1] : "";
+  return { destChainCode, destAsset, destAddress };
+}
 function resolveChainId(chainId) {
   const id = typeof chainId === "string" ? parseInt(chainId, 10) : chainId;
   if (isNaN(id)) return null;
   const chainIdMap = {
-    1: Chain9.Ethereum,
-    56: Chain9.BSC,
-    137: Chain9.Polygon,
-    43114: Chain9.Avalanche,
-    42161: Chain9.Arbitrum,
-    10: Chain9.Optimism,
-    8453: Chain9.Base,
-    81457: Chain9.Blast,
-    324: Chain9.Zksync,
-    25: Chain9.CronosChain
+    1: Chain10.Ethereum,
+    56: Chain10.BSC,
+    137: Chain10.Polygon,
+    43114: Chain10.Avalanche,
+    42161: Chain10.Arbitrum,
+    10: Chain10.Optimism,
+    8453: Chain10.Base,
+    81457: Chain10.Blast,
+    324: Chain10.Zksync,
+    25: Chain10.CronosChain
   };
   return chainIdMap[id] || null;
 }
@@ -7858,7 +8730,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "0.22.5";
+    cachedVersion = "0.23.0";
     return cachedVersion;
   }
   try {
@@ -8141,7 +9013,7 @@ function readArgValue(args, optionName) {
 }
 
 // src/interactive/completer.ts
-import { Chain as Chain10 } from "@vultisig/sdk";
+import { Chain as Chain11 } from "@vultisig/sdk";
 import fs3 from "fs";
 import path3 from "path";
 var COMMANDS = [
@@ -8285,7 +9157,7 @@ function completeVaultName(ctx2, partial) {
   return [show, partial];
 }
 function completeChainName(partial) {
-  const allChains = Object.values(Chain10);
+  const allChains = Object.values(Chain11);
   const partialLower = partial.toLowerCase();
   const matches = allChains.filter((chain) => chain.toLowerCase().startsWith(partialLower));
   matches.sort();
@@ -8293,7 +9165,7 @@ function completeChainName(partial) {
   return [show, partial];
 }
 function findChainByName(name) {
-  const allChains = Object.values(Chain10);
+  const allChains = Object.values(Chain11);
   const nameLower = name.toLowerCase();
   const found = allChains.find((chain) => chain.toLowerCase() === nameLower);
   return found ? found : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "0.22.5",
+  "version": "0.23.0",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -73,10 +73,10 @@
     "@cosmjs/stargate": "^0.38.1",
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.0.1",
-    "@vultisig/client-shared": "^0.2.6",
-    "@vultisig/core-chain": "^1.6.1",
-    "@vultisig/rujira": "^17.0.1",
-    "@vultisig/sdk": "^0.22.5",
+    "@vultisig/client-shared": "^0.2.7",
+    "@vultisig/core-chain": "^1.7.1",
+    "@vultisig/rujira": "^18.0.0",
+    "@vultisig/sdk": "^0.23.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^14.0.3",