@vultisig/core-chain 2.26.0 → 2.27.0

package/dist/coin/balance/getEvmChainBalances.js

@@ -11,10 +11,11 @@ const getFallbackBalances = async ({ chain, address, coins }) => {
             return [accountCoinKeyToString(input), await getEvmCoinBalance(input)];
         }
         catch {
-            return [accountCoinKeyToString(input), 0n];
+            // OMIT the key rather than reporting 0n: the read failed, so the balance is unknown.
+            return undefined;
         }
     }));
-    return Object.fromEntries(entries);
+    return Object.fromEntries(entries.filter(entry => entry !== undefined));
 };
 export const getEvmChainBalances = async (input) => {
     const { chain, address, coins } = input;
@@ -48,10 +49,15 @@ export const getEvmChainBalances = async (input) => {
     if (!results) {
         return getFallbackBalances(input);
     }
-    return Object.fromEntries(coins.map((coin, index) => {
+    return Object.fromEntries(coins.flatMap((coin, index) => {
         const result = results[index];
-        const amount = result?.status === 'success' ? BigInt(result.result) : 0n;
-        return [accountCoinKeyToString({ ...coin, chain, address }), amount];
+        // A reverted / failed sub-call (allowFailure keeps it in the array as status 'failure') carries
+        // NO balance. Omit it instead of decoding it as 0n, so the caller can tell an unread coin from a
+        // genuinely empty one and refetch it rather than caching a fabricated zero.
+        if (result?.status !== 'success') {
+            return [];
+        }
+        return [[accountCoinKeyToString({ ...coin, chain, address }), BigInt(result.result)]];
     }));
 };
 //# sourceMappingURL=getEvmChainBalances.js.map

package/dist/coin/balance/getEvmChainBalances.js.map

@@ -1 +1 @@
-{"version":3,"file":"getEvmChainBalances.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/balance/getEvmChainBalances.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAkB,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AACrE,OAAO,EAAW,QAAQ,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAA;AAU/F,MAAM,mBAAmB,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAA4B,EAA6B,EAAE;IACnH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QACrB,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAEzC,IAAI,CAAC;YACH,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAU,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAU,CAAA;QACrD,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;AACpC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA+B,EAA6B,EAAE;IACtG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAA;IAE5E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjC,SAAS,CAAC,IAAI,CAAC;QACb,CAAC,CAAC;YACE,OAAO,EAAE,iBAAiB;YAC1B,GAAG,EAAE,aAAa;YAClB,YAAY,EAAE,eAAe;YAC7B,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB;QACH,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,EAAa;YAC3B,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CACN,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,YAAY;SAC/B,SAAS,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,SAAS;KACV,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAElF,OAAO,CAAC,sBAAsB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAU,CAAA;IAC/E,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"getEvmChainBalances.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/balance/getEvmChainBalances.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAkB,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AACrE,OAAO,EAAW,QAAQ,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAA;AAgB/F,MAAM,mBAAmB,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAA4B,EAA6B,EAAE;IACnH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QACrB,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAEzC,IAAI,CAAC;YACH,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAU,CAAA;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;YACrF,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAA+B,EAA6B,EAAE;IACtG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAA;IAE5E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACjC,SAAS,CAAC,IAAI,CAAC;QACb,CAAC,CAAC;YACE,OAAO,EAAE,iBAAiB;YAC1B,GAAG,EAAE,aAAa;YAClB,YAAY,EAAE,eAAe;YAC7B,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB;QACH,CAAC,CAAC;YACE,OAAO,EAAE,IAAI,CAAC,EAAa;YAC3B,GAAG,EAAE,QAAQ;YACb,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CACN,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,YAAY;SAC/B,SAAS,CAAC;QACT,YAAY,EAAE,IAAI;QAClB,SAAS;KACV,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAE7B,gGAAgG;QAChG,iGAAiG;QACjG,4EAA4E;QAC5E,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,CAAA;QACX,CAAC;QAED,OAAO,CAAC,CAAC,sBAAsB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAU,CAAC,CAAA;IAC1G,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAA"}

package/dist/coin/price/resolveTokenPriceId.d.ts

@@ -6,17 +6,15 @@ import type { Chain } from '../../Chain.js';
  * - When `denomOrAddress` is omitted, empty, or whitespace-only, returns the
  *   native chain coin's priceProviderId from chainFeeCoin (e.g.
  *   resolveTokenPriceId('Ethereum') -> 'ethereum').
- * - When `denomOrAddress` is provided, it is trimmed and lowercased, then
- *   looked up in knownTokensIndex[chain]. The lookup is case-insensitive (the
- *   index stores all keys lowercased) and tolerant of incidental surrounding
- *   whitespace from upstream string sources. Note: lowercasing is locale-
- *   independent (String.prototype.toLowerCase, not toLocaleLowerCase) and the
- *   index keys are built with the same call, so the build/lookup casing is
- *   always symmetric.
+ * - When `denomOrAddress` is provided, incidental surrounding whitespace is
+ *   trimmed. EVM contract addresses are matched case-insensitively; identifiers
+ *   for every other chain are matched exactly because Solana mints, Cosmos
+ *   denoms, TON jettons, and other non-EVM identifiers may be case-sensitive.
  *
- * Returns `undefined` if no registry entry exists — never guesses or
- * fabricates an id. The caller decides whether to fall back to CoinGecko
- * search, DeFiLlama, or surface a `price_unavailable` to the user.
+ * The native Cosmos fee denom is also resolved to its chain fee coin's
+ * priceProviderId. Other unknown identifiers return `undefined` — the caller
+ * decides whether to fall back to CoinGecko search, DeFiLlama, or surface a
+ * `price_unavailable` to the user.
  *
  * Referenced by vultisig/mcp-ts#255 — registry-driven price resolution.
  */

package/dist/coin/price/resolveTokenPriceId.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveTokenPriceId.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/price/resolveTokenPriceId.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM7F"}
+{"version":3,"file":"resolveTokenPriceId.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/price/resolveTokenPriceId.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAMxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAe7F"}

package/dist/coin/price/resolveTokenPriceId.js

@@ -1,5 +1,7 @@
+import { getChainKind } from '../../ChainKind.js';
+import { cosmosFeeCoinDenom } from '../../chains/cosmos/cosmosFeeCoinDenom.js';
 import { chainFeeCoin } from '../chainFeeCoin.js';
-import { knownTokensIndex } from '../knownTokens/index.js';
+import { knownTokens, knownTokensIndex } from '../knownTokens/index.js';
 /**
  * Resolve a token's CoinGecko price-provider id from the SDK's curated
  * registry. Pure synchronous lookup, no I/O.
@@ -7,25 +9,30 @@ import { knownTokensIndex } from '../knownTokens/index.js';
  * - When `denomOrAddress` is omitted, empty, or whitespace-only, returns the
  *   native chain coin's priceProviderId from chainFeeCoin (e.g.
  *   resolveTokenPriceId('Ethereum') -> 'ethereum').
- * - When `denomOrAddress` is provided, it is trimmed and lowercased, then
- *   looked up in knownTokensIndex[chain]. The lookup is case-insensitive (the
- *   index stores all keys lowercased) and tolerant of incidental surrounding
- *   whitespace from upstream string sources. Note: lowercasing is locale-
- *   independent (String.prototype.toLowerCase, not toLocaleLowerCase) and the
- *   index keys are built with the same call, so the build/lookup casing is
- *   always symmetric.
+ * - When `denomOrAddress` is provided, incidental surrounding whitespace is
+ *   trimmed. EVM contract addresses are matched case-insensitively; identifiers
+ *   for every other chain are matched exactly because Solana mints, Cosmos
+ *   denoms, TON jettons, and other non-EVM identifiers may be case-sensitive.
  *
- * Returns `undefined` if no registry entry exists — never guesses or
- * fabricates an id. The caller decides whether to fall back to CoinGecko
- * search, DeFiLlama, or surface a `price_unavailable` to the user.
+ * The native Cosmos fee denom is also resolved to its chain fee coin's
+ * priceProviderId. Other unknown identifiers return `undefined` — the caller
+ * decides whether to fall back to CoinGecko search, DeFiLlama, or surface a
+ * `price_unavailable` to the user.
  *
  * Referenced by vultisig/mcp-ts#255 — registry-driven price resolution.
  */
 export function resolveTokenPriceId(chain, denomOrAddress) {
-    const normalized = denomOrAddress?.trim().toLowerCase();
-    if (!normalized) {
+    const identifier = denomOrAddress?.trim();
+    if (!identifier) {
         return chainFeeCoin[chain]?.priceProviderId || undefined;
     }
-    return knownTokensIndex[chain]?.[normalized]?.priceProviderId || undefined;
+    const knownPriceProviderId = getChainKind(chain) === 'evm'
+        ? knownTokensIndex[chain]?.[identifier.toLowerCase()]?.priceProviderId
+        : knownTokens[chain]?.find(coin => coin.id === identifier)?.priceProviderId;
+    if (knownPriceProviderId)
+        return knownPriceProviderId;
+    return cosmosFeeCoinDenom[chain] === identifier
+        ? chainFeeCoin[chain]?.priceProviderId || undefined
+        : undefined;
 }
 //# sourceMappingURL=resolveTokenPriceId.js.map

package/dist/coin/price/resolveTokenPriceId.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveTokenPriceId.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/price/resolveTokenPriceId.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY,EAAE,cAAuB;IACvE,MAAM,UAAU,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,KAAK,CAAC,EAAE,eAAe,IAAI,SAAS,CAAA;IAC1D,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,eAAe,IAAI,SAAS,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"resolveTokenPriceId.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/coin/price/resolveTokenPriceId.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAY,EAAE,cAAuB;IACvE,MAAM,UAAU,GAAG,cAAc,EAAE,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,KAAK,CAAC,EAAE,eAAe,IAAI,SAAS,CAAA;IAC1D,CAAC;IAED,MAAM,oBAAoB,GACxB,YAAY,CAAC,KAAK,CAAC,KAAK,KAAK;QAC3B,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,eAAe;QACtE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,eAAe,CAAA;IAC/E,IAAI,oBAAoB;QAAE,OAAO,oBAAoB,CAAA;IAErD,OAAO,kBAAkB,CAAC,KAAwC,CAAC,KAAK,UAAU;QAChF,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,eAAe,IAAI,SAAS;QACnD,CAAC,CAAC,SAAS,CAAA;AACf,CAAC"}

package/dist/swap/general/GeneralSwapQuote.d.ts

@@ -10,6 +10,22 @@ export type GeneralSwapTx = {
         value: string;
         gasLimit?: bigint;
         affiliateFee?: SwapFee;
+        /**
+         * The address that will be called as `transferFrom` spender for the
+         * input ERC-20 token. Set by LI.FI quotes from `estimate.approvalAddress`
+         * when it differs from `to` (e.g. when 1inch or another inner executor
+         * does the token pull directly instead of the Diamond/router).
+         *
+         * On-chain proof of the gap: tx 0xa3aadf17 (Ethereum, block 25415989)
+         * reverted with "ERC20: transfer amount exceeds allowance" because the
+         * vault had 9.41 USDC approved to the Diamond (`to` = 0x9025B8ff…) but
+         * zero allowance to the 1inch executor (`approvalAddress`). The Diamond
+         * being approved is not sufficient when an inner executor does the pull.
+         *
+         * Consumers building an ERC-20 approve leg MUST use this field as the
+         * spender when present, falling back to `to` only when absent.
+         */
+        approvalAddress?: string;
     };
 } | {
     solana: {
@@ -56,9 +72,9 @@ export type GeneralSwapTx = {
  * Consumers building a "View on Explorer" link should call
  * `getSwapExplorerUrl({ provider, txHash, fromChain })` from
  * `@vultisig/core-chain/swap/utils/getSwapExplorerUrl` instead of routing
- * by hand — the helper covers the LI.FI / Helius scanners and falls back to
- * the source-chain explorer for `1inch` / `jupiter` / `kyber` / `swapkit` (none of which
- * expose a per-tx aggregator page).
+ * by hand — the helper covers LI.FI / Helius and SwapKit scanners, accepts the
+ * provider-specific CoW order UID for pending CowSwap orders, and falls back to
+ * the source-chain explorer for `1inch` / `jupiter` / `kyber`.
  */
 export type GeneralSwapQuote = {
     dstAmount: string;

package/dist/swap/general/GeneralSwapQuote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GeneralSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/GeneralSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,MAAM,MAAM,aAAa,GACrB;IACE,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,CAAA;CACF,GACD;IACE,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,OAAO,CAAA;KACjB,CAAA;CACF,GACD;IACE,QAAQ,EAAE;QACR,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,SAAS,CAAC,EAAE,UAAU,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,GACD;IACE,aAAa,EAAE;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,gBAAgB,CAAA;QACtB,iBAAiB,EAAE,OAAO,CAAA;QAC1B,gBAAgB,EAAE,mBAAmB,CAAA;QACrC,eAAe,EAAE,mBAAmB,CAAA;QACpC,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf;;kFAE0E;QAC1E,cAAc,CAAC,EAAE,IAAI,CAAA;KACtB,CAAA;CACF,CAAA;AAEL;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,EAAE,EAAE,aAAa,CAAA;CAClB,CAAA"}
+{"version":3,"file":"GeneralSwapQuote.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/GeneralSwapQuote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,MAAM,MAAM,aAAa,GACrB;IACE,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,YAAY,CAAC,EAAE,OAAO,CAAA;QACtB;;;;;;;;;;;;;;WAcG;QACH,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;CACF,GACD;IACE,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,OAAO,CAAA;KACjB,CAAA;CACF,GACD;IACE,QAAQ,EAAE;QACR,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,SAAS,CAAC,EAAE,UAAU,CAAA;QACtB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF,GACD;IACE,aAAa,EAAE;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,gBAAgB,CAAA;QACtB,iBAAiB,EAAE,OAAO,CAAA;QAC1B,gBAAgB,EAAE,mBAAmB,CAAA;QACrC,eAAe,EAAE,mBAAmB,CAAA;QACpC,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf;;kFAE0E;QAC1E,cAAc,CAAC,EAAE,IAAI,CAAA;KACtB,CAAA;CACF,CAAA;AAEL;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,EAAE,EAAE,aAAa,CAAA;CAClB,CAAA"}

package/dist/swap/general/cowswap/sign/buildCowSwapOrderTypedData.d.ts

@@ -98,15 +98,6 @@ type BuildCowSwapOrderTypedDataInput = {
     order: CowSwapOrder;
     chainId: number;
 };
-/**
- * Build the `eth_signTypedData_v4` document for a CowSwap order.
- *
- * The resulting digest (EIP-712 hash of this document) is what the MPC ceremony
- * signs; the 65-byte `r||s||v` signature is submitted to the orderbook alongside
- * the order via `submitCowSwapOrder`. The order's `appDataHash` becomes the
- * signed `appData` field — the orderbook verifies it matches the `appData`
- * string in the submitted order.
- */
 export declare const buildCowSwapOrderTypedData: ({ order, chainId, }: BuildCowSwapOrderTypedDataInput) => CowSwapOrderTypedData;
 export {};
 //# sourceMappingURL=buildCowSwapOrderTypedData.d.ts.map

package/dist/swap/general/cowswap/sign/buildCowSwapOrderTypedData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildCowSwapOrderTypedData.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/sign/buildCowSwapOrderTypedData.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAqB,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAErE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa3B,CAAA;AAEV,QAAA,MAAM,kBAAkB;;;;;;;;;;;;EAKd,CAAA;AAEV;;yDAEyD;AACzD,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB,EAAE,OAAO,CAAA;IAC1B,gBAAgB,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED;;;gEAGgE;AAChE,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,EAAE;QACL,YAAY,EAAE,OAAO,kBAAkB,CAAA;QACvC,KAAK,EAAE,OAAO,wBAAwB,CAAA;KACvC,CAAA;IACD,OAAO,EAAE,yBAAyB,CAAA;CACnC,CAAA;AAED,KAAK,+BAA+B,GAAG;IACrC,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAI,qBAGxC,+BAA+B,KAAG,qBAqBnC,CAAA"}
+{"version":3,"file":"buildCowSwapOrderTypedData.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/sign/buildCowSwapOrderTypedData.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAqB,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAErE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa3B,CAAA;AAEV,QAAA,MAAM,kBAAkB;;;;;;;;;;;;EAKd,CAAA;AAEV;;yDAEyD;AACzD,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB,EAAE,OAAO,CAAA;IAC1B,gBAAgB,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED;;;gEAGgE;AAChE,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,EAAE;QACL,YAAY,EAAE,OAAO,kBAAkB,CAAA;QACvC,KAAK,EAAE,OAAO,wBAAwB,CAAA;KACvC,CAAA;IACD,OAAO,EAAE,yBAAyB,CAAA;CACnC,CAAA;AAED,KAAK,+BAA+B,GAAG;IACrC,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AA4CD,eAAO,MAAM,0BAA0B,GAAI,qBAGxC,+BAA+B,KAAG,qBAyBpC,CAAA"}

package/dist/swap/general/cowswap/sign/buildCowSwapOrderTypedData.js

@@ -42,26 +42,56 @@ const eip712DomainFields = [
  * signed `appData` field — the orderbook verifies it matches the `appData`
  * string in the submitted order.
  */
-export const buildCowSwapOrderTypedData = ({ order, chainId, }) => ({
-    primaryType: 'Order',
-    domain: buildEip712Domain(chainId),
-    types: {
-        EIP712Domain: eip712DomainFields,
-        Order: cowSwapOrderEip712Fields,
-    },
-    message: {
-        sellToken: order.sellToken,
-        buyToken: order.buyToken,
-        receiver: order.receiver,
-        sellAmount: order.sellAmount,
-        buyAmount: order.buyAmount,
-        validTo: order.validTo,
-        appData: order.appDataHash,
-        feeAmount: order.feeAmount,
-        kind: order.kind,
-        partiallyFillable: order.partiallyFillable,
-        sellTokenBalance: order.sellTokenBalance,
-        buyTokenBalance: order.buyTokenBalance,
-    },
-});
+// Matches a checksummed or lowercase EVM address (case-insensitive 0x prefix, per findSwapQuote's
+// isEvmAddress) — CowSwap is EVM-only, so the receiver is always an EVM address.
+const isEvmAddress = (address) => /^0x[0-9a-fA-F]{40}$/i.test(address);
+const ZERO_EVM_ADDRESS = '0x0000000000000000000000000000000000000000';
+const BURN_EVM_ADDRESS = '0x000000000000000000000000000000000000dead';
+/**
+ * Fund-safety re-check on the SIGNING side (sdk#1358 class). `assertValidCustomRecipient`
+ * (findSwapQuote.ts) rejects a zero/burn/malformed CowSwap receiver at QUOTE construction, but the
+ * MPC co-signer never sees the quote — it decodes a `cowswap-order:` blob from the KeysignPayload
+ * (decodeCowSwapKeysignData, which validates SHAPE only) and builds THIS EIP-712 digest to sign. A
+ * hand-built payload with `receiver = 0x…dead` (or the zero address, or a malformed address) would
+ * otherwise be signed into an unrecoverable order. This is the digest-construction choke point every
+ * signer funnels through, so guarding here binds the receiver the signature actually covers.
+ *
+ * vultisig always sets an explicit receiver (`normalizedRecipient ?? from.address`,
+ * findSwapQuote.ts) — never CowSwap's `address(0)` "pay-the-owner" sentinel — so rejecting zero here
+ * matches the quote-time guard and cannot false-block a legitimately-produced order.
+ */
+const assertCowSwapReceiverSafe = (receiver) => {
+    if (!isEvmAddress(receiver)) {
+        throw new Error(`CowSwap order receiver "${receiver}" is not a valid EVM address — refusing to sign an order to a malformed recipient.`);
+    }
+    const lower = receiver.toLowerCase();
+    if (lower === ZERO_EVM_ADDRESS || lower === BURN_EVM_ADDRESS) {
+        throw new Error(`CowSwap order receiver "${receiver}" is a zero/burn address — the swap output would be unrecoverable; refusing to sign.`);
+    }
+};
+export const buildCowSwapOrderTypedData = ({ order, chainId, }) => {
+    assertCowSwapReceiverSafe(order.receiver);
+    return {
+        primaryType: 'Order',
+        domain: buildEip712Domain(chainId),
+        types: {
+            EIP712Domain: eip712DomainFields,
+            Order: cowSwapOrderEip712Fields,
+        },
+        message: {
+            sellToken: order.sellToken,
+            buyToken: order.buyToken,
+            receiver: order.receiver,
+            sellAmount: order.sellAmount,
+            buyAmount: order.buyAmount,
+            validTo: order.validTo,
+            appData: order.appDataHash,
+            feeAmount: order.feeAmount,
+            kind: order.kind,
+            partiallyFillable: order.partiallyFillable,
+            sellTokenBalance: order.sellTokenBalance,
+            buyTokenBalance: order.buyTokenBalance,
+        },
+    };
+};
 //# sourceMappingURL=buildCowSwapOrderTypedData.js.map

package/dist/swap/general/cowswap/sign/buildCowSwapOrderTypedData.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildCowSwapOrderTypedData.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/sign/buildCowSwapOrderTypedData.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAgB,MAAM,qBAAqB,CAAA;AAErE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;IACvC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACtC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE;IAC3C,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;CACnC,CAAA;AAEV,MAAM,kBAAkB,GAAG;IACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;CACtC,CAAA;AAuCV;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,EACzC,KAAK,EACL,OAAO,GACyB,EAAyB,EAAE,CAAC,CAAC;IAC7D,WAAW,EAAE,OAAO;IACpB,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC;IAClC,KAAK,EAAE;QACL,YAAY,EAAE,kBAAkB;QAChC,KAAK,EAAE,wBAAwB;KAChC;IACD,OAAO,EAAE;QACP,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,WAAW;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC;CACF,CAAC,CAAA"}
+{"version":3,"file":"buildCowSwapOrderTypedData.js","sourceRoot":"","sources":["../../../../../../../../packages/core/chain/swap/general/cowswap/sign/buildCowSwapOrderTypedData.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAgB,MAAM,qBAAqB,CAAA;AAErE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACtC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;IACvC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACtC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;IACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE;IAC3C,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;CACnC,CAAA;AAEV,MAAM,kBAAkB,GAAG;IACzB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;CACtC,CAAA;AAuCV;;;;;;;;GAQG;AACH,kGAAkG;AAClG,iFAAiF;AACjF,MAAM,YAAY,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACvF,MAAM,gBAAgB,GAAG,4CAA4C,CAAA;AACrE,MAAM,gBAAgB,GAAG,4CAA4C,CAAA;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,yBAAyB,GAAG,CAAC,QAAgB,EAAQ,EAAE;IAC3D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,oFAAoF,CACxH,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACpC,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,sFAAsF,CAC1H,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,EACzC,KAAK,EACL,OAAO,GACyB,EAAyB,EAAE;IAC3D,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAEzC,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,YAAY,EAAE,kBAAkB;YAChC,KAAK,EAAE,wBAAwB;SAChC;QACD,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,WAAW;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/swap/general/knownAggregatorRouters.d.ts

@@ -1,5 +1,62 @@
 import { Chain } from '../../Chain.js';
-export type EnforcedRouterProvider = '1inch' | 'kyber';
+export type EnforcedRouterProvider = '1inch' | 'kyber' | 'cowswap';
+/**
+ * Signing-path re-assert (sdk#1358): the same allow-list check as {@link assertKnownAggregatorRouter},
+ * but keyed off an arbitrary provider STRING (the value carried in KeysignSwapPayload.general.provider,
+ * which is a plain `string`). Enforced providers (1inch/kyber/cowswap) fail closed; the small closed set
+ * of genuinely unenforceable providers (li.fi/swapkit, plus the legacy `''` unattributed provider - see
+ * RECOGNIZED_UNENFORCED_PROVIDERS) fall through to the same log-only path they take at quote construction;
+ * anything else is rejected outright (sdk#1457, see below).
+ *
+ * WHY THIS EXISTS SEPARATELY FROM quote construction: a compromised initiator (or server composing the
+ * intent) can hand a co-signer a KeysignPayload whose swapPayload.quote.tx.to was NEVER run through the
+ * quote-time check - every co-signer independently rebuilds the signing input from that payload, so the
+ * guard has to run HERE too, on the signing-input path, or a co-signer (e.g. VultiServer in a 2-of-2)
+ * signs a destination it never validated. Mirrors the Ripple resolver's in-resolver fail-closed binding.
+ *
+ * THREAT MODEL / TRUST OF `provider` (CodeRabbit security review; sdk#1457): `provider` here is the free
+ * `provider` STRING on the OneInchSwapPayload proto (the `oneinchSwapPayload` oneof case carries
+ * 1inch/li.fi/cowswap/kyber with only this string to tell them apart; swapkit's dedicated transfer route
+ * is the one general provider that has its own oneof case - see getKeysignSwapPayload.ts). It is
+ * therefore part of the attacker-influenceable payload, NOT a trusted oneof discriminant, and a payload
+ * whose `provider` disagrees with its actual executing shape (an attacker relabeling to dodge
+ * enforcement) is a real, closable gap - not just a theoretical one.
+ *
+ * sdk#1457 FIX: two structural improvements that need no proto change. (1) CowSwap is now enforced -
+ * unlike li.fi/swapkit it settles through ONE fixed, deterministic contract (the GPv2VaultRelayer, see
+ * assertKnownAggregatorRouter), so its destination is exactly as allow-listable as 1inch/Kyber's; a
+ * payload can no longer relabel itself 'cowswap' to dodge a router check the way it previously could. (2)
+ * the log-only fallback is now a CLOSED list of the provider values the codebase legitimately produces
+ * (li.fi/swapkit, plus the legacy `''` unattributed provider) - a `provider` string outside every known
+ * value (enforced or unenforced) is unrecognized and REJECTED, not silently passed through. Together
+ * these shrink "relabel to escape enforcement" from "any string at all" down to exactly li.fi, swapkit,
+ * and the legacy `''`, which remain unenforceable by address because they legitimately route through
+ * many different contracts by design (see the file doc comment) - closing that residual gap needs the
+ * provider identity to be a trusted wire discriminant instead of a free string, i.e. a proto oneof case
+ * per provider (tracked in sdk#1457, not attempted here: a schema change on the shared commondata proto
+ * is a cross-repo, cross-consumer change every native client (iOS/Android/Windows) also builds against).
+ *
+ * This guard remains MONOTONIC beyond that residual gap: it only ever THROWS (rejects) or no-ops - it
+ * never makes anything signable that wasn't already.
+ */
+export declare function assertKnownAggregatorRouterOnSigningPath(provider: string, address: string, chain: Chain): void;
+/**
+ * Signing-path approval-spender bind (sdk#1358 review follow-up, requested by neavra). The
+ * follow-on to {@link assertKnownAggregatorRouterOnSigningPath}: that guard validates the swap-leg
+ * destination (`quote.tx.to`), but a general swap that needs an allowance also carries a SEPARATE,
+ * independent wire field - `erc20ApprovePayload.spender` - which the approve resolver (erc20.ts)
+ * reads verbatim and nothing binds to `quote.tx.to`. So a payload can pass the router check with a
+ * genuine 1inch/kyber `tx.to` yet still carry an approve granting an ATTACKER an allowance over the
+ * user's token (a classic approval-drain the co-signer would otherwise sign blind).
+ *
+ * On the initiator these coincide by construction (build.ts sets the approve spender to
+ * `getSwapDestinationAddress` === `tx.to`), so this only ever fires on a hand-built/tampered payload.
+ * Enforced providers (1inch/kyber/cowswap) MUST have `spender === routerDestination`; unenforced
+ * providers (li.fi/swapkit) are NOT bound. CowSwap's spender IS its `tx.to` (both are the fixed
+ * GPv2VaultRelayer - see getSwapDestinationAddress.ts), so it binds the same way 1inch/kyber do. Like
+ * its sibling this is a MONOTONIC gate: it only throws or no-ops, never changes the signed bytes.
+ */
+export declare function assertEnforcedSwapApprovalSpenderBound(provider: string, spender: string, routerDestination: string, chain: Chain): void;
 /**
  * Throws if `address` isn't the known router for `provider` on `chain`. Call this at quote
  * construction, before a GeneralSwapQuote carrying `address` as `tx.evm.to` can exist.
@@ -10,5 +67,5 @@ export declare function assertKnownAggregatorRouter(provider: EnforcedRouterProv
  * contracts. Structured so the data is queryable (provider + address) and a future allowlist
  * is easy to build if a stable pattern emerges from real usage.
  */
-export declare function logUnenforcedAggregatorDestination(provider: 'li.fi' | 'swapkit', address: string): void;
+export declare function logUnenforcedAggregatorDestination(provider: string, address: string): void;
 //# sourceMappingURL=knownAggregatorRouters.d.ts.map

package/dist/swap/general/knownAggregatorRouters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knownAggregatorRouters.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AA8DnC,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,CAAA;AAEtD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAcjH;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAKvG"}
+{"version":3,"file":"knownAggregatorRouters.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAmEnC,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAclE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,wCAAwC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAkB9G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,KAAK,GACX,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAwBjH;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAK1F"}

package/dist/swap/general/knownAggregatorRouters.js

@@ -1,4 +1,6 @@
+import { isOneOf } from '@vultisig/lib-utils/array/isOneOf';
 import { Chain } from '../../Chain.js';
+import { COW_VAULT_RELAYER_ADDRESS, cowSwapSupportedChains } from './cowswap/config.js';
 /**
  * Fund-safety allowlist for the general-purpose EVM swap aggregators (AGG-02, round-2
  * spec-level fund-safety audit, 2026-07-08).
@@ -18,6 +20,12 @@ import { Chain } from '../../Chain.js';
  * stable, deterministically-deployed constant on almost every chain — verified against each
  * provider's OWN live quote API (not just docs/explorers), chain by chain, on 2026-07-08.
  *
+ * CowSwap is ALSO enforced (sdk#1457): unlike 1inch/Kyber it doesn't route to a swap router at
+ * all - orders settle off-chain via solvers, and the on-chain leg (both the swap-leg address AND
+ * the ERC-20 approval spender) is always the same fixed GPv2VaultRelayer contract across every
+ * supported chain (see build.ts / getSwapDestinationAddress.ts). That determinism makes it just
+ * as allow-listable as 1inch/Kyber's routers.
+ *
  * CHAIN-SCOPING MATTERS (codex review, PR #1079): 1inch's V6 router is NOT the same address
  * on zkSync Era — confirmed live (a real 200 response from a real quote request returned a
  * DIFFERENT contract there). This is exactly the caveat chains/evm/contract/knownContracts.ts
@@ -30,7 +38,10 @@ import { Chain } from '../../Chain.js';
  * bridge/DEX contracts by design (diamond routing, multi-hop, chain-specific deployments),
  * so a hard allowlist would false-block legitimate routes. Those two are logged (never
  * thrown) via logUnenforcedAggregatorDestination so an anomaly is queryable, and so a future
- * allowlist has real usage data to build from if a pattern emerges.
+ * allowlist has real usage data to build from if a pattern emerges. sdk#1457: because they are
+ * the only genuinely unenforceable-by-address providers, they are the one residual gap
+ * assertKnownAggregatorRouterOnSigningPath's provider-string closed-list still can't structurally
+ * close - see that function's doc comment.
  */
 // 1inch Aggregation Router V5 (legacy). Same address as
 // chains/evm/contract/knownContracts.ts's display-only registry; kept separate here since
@@ -45,15 +56,100 @@ const ONE_INCH_V6_STANDARD_ROUTER = '0x111111125421ca6dc452d289314280a0f8842a65'
 // V6 on zkSync Era ONLY — live-confirmed 2026-07-08 via a real api.vultisig.com/1inch
 // v6.0 quote request returning this address (NOT the standard one above).
 const ONE_INCH_V6_ZKSYNC_ROUTER = '0x6fd4383cb451173d5f9304f041c7bcbf27d561ff';
-// KyberSwap MetaAggregationRouterV2 — same address confirmed live 2026-07-08 on every chain
-// that returned a response through aggregator-api.kyberswap.com's /routes (Ethereum, BSC,
-// Arbitrum, Optimism, Avalanche, Base, Polygon — 7 of 9 kyberSwapEnabledChains chains).
-// zkSync/Blast 404'd on this exact API path during verification — that looks like those two
-// chains aren't actually live through this aggregator endpoint today (a pre-existing,
-// separate question from this fix — kyberSwapEnabledChains may be ahead of what the live API
-// serves), not evidence of a differing router address. No chain-scoping needed unless that
-// changes.
+// KyberSwap MetaAggregationRouterV2 — same address confirmed live 2026-07-08 on every
+// kyberSwapEnabledChains chain through aggregator-api.kyberswap.com's /routes
+// (Ethereum, BSC, Arbitrum, Optimism, Avalanche, Base, Polygon).
 const KYBER_STANDARD_ROUTER = '0x6131b5fae19ea4f9d964eac0408e4408b66337b5';
+const ENFORCED_ROUTER_PROVIDERS = new Set(['1inch', 'kyber', 'cowswap']);
+// sdk#1457: the small, closed set of provider values the codebase legitimately produces for a
+// route that is genuinely NOT address-allow-listable. `li.fi`/`swapkit` route through many
+// different bridge/DEX contracts by design (see the file doc comment). `''` is NOT an attacker
+// label - it is the documented fallback mapSwapPayload.ts (and getKeysignSwapPayload's own
+// callers) use for pre-provider-field mobile captures, proven by real golden fixtures
+// (mobileFixtures.golden.test.ts's arb.json/lifiswap.json) that still carry an unset provider.
+// This is a CLOSED list, not "everything not enforced": a `provider` string outside BOTH this
+// set and ENFORCED_ROUTER_PROVIDERS is unrecognized and rejected below, instead of silently logged.
+const RECOGNIZED_UNENFORCED_PROVIDERS = new Set(['li.fi', 'swapkit', '']);
+/**
+ * Signing-path re-assert (sdk#1358): the same allow-list check as {@link assertKnownAggregatorRouter},
+ * but keyed off an arbitrary provider STRING (the value carried in KeysignSwapPayload.general.provider,
+ * which is a plain `string`). Enforced providers (1inch/kyber/cowswap) fail closed; the small closed set
+ * of genuinely unenforceable providers (li.fi/swapkit, plus the legacy `''` unattributed provider - see
+ * RECOGNIZED_UNENFORCED_PROVIDERS) fall through to the same log-only path they take at quote construction;
+ * anything else is rejected outright (sdk#1457, see below).
+ *
+ * WHY THIS EXISTS SEPARATELY FROM quote construction: a compromised initiator (or server composing the
+ * intent) can hand a co-signer a KeysignPayload whose swapPayload.quote.tx.to was NEVER run through the
+ * quote-time check - every co-signer independently rebuilds the signing input from that payload, so the
+ * guard has to run HERE too, on the signing-input path, or a co-signer (e.g. VultiServer in a 2-of-2)
+ * signs a destination it never validated. Mirrors the Ripple resolver's in-resolver fail-closed binding.
+ *
+ * THREAT MODEL / TRUST OF `provider` (CodeRabbit security review; sdk#1457): `provider` here is the free
+ * `provider` STRING on the OneInchSwapPayload proto (the `oneinchSwapPayload` oneof case carries
+ * 1inch/li.fi/cowswap/kyber with only this string to tell them apart; swapkit's dedicated transfer route
+ * is the one general provider that has its own oneof case - see getKeysignSwapPayload.ts). It is
+ * therefore part of the attacker-influenceable payload, NOT a trusted oneof discriminant, and a payload
+ * whose `provider` disagrees with its actual executing shape (an attacker relabeling to dodge
+ * enforcement) is a real, closable gap - not just a theoretical one.
+ *
+ * sdk#1457 FIX: two structural improvements that need no proto change. (1) CowSwap is now enforced -
+ * unlike li.fi/swapkit it settles through ONE fixed, deterministic contract (the GPv2VaultRelayer, see
+ * assertKnownAggregatorRouter), so its destination is exactly as allow-listable as 1inch/Kyber's; a
+ * payload can no longer relabel itself 'cowswap' to dodge a router check the way it previously could. (2)
+ * the log-only fallback is now a CLOSED list of the provider values the codebase legitimately produces
+ * (li.fi/swapkit, plus the legacy `''` unattributed provider) - a `provider` string outside every known
+ * value (enforced or unenforced) is unrecognized and REJECTED, not silently passed through. Together
+ * these shrink "relabel to escape enforcement" from "any string at all" down to exactly li.fi, swapkit,
+ * and the legacy `''`, which remain unenforceable by address because they legitimately route through
+ * many different contracts by design (see the file doc comment) - closing that residual gap needs the
+ * provider identity to be a trusted wire discriminant instead of a free string, i.e. a proto oneof case
+ * per provider (tracked in sdk#1457, not attempted here: a schema change on the shared commondata proto
+ * is a cross-repo, cross-consumer change every native client (iOS/Android/Windows) also builds against).
+ *
+ * This guard remains MONOTONIC beyond that residual gap: it only ever THROWS (rejects) or no-ops - it
+ * never makes anything signable that wasn't already.
+ */
+export function assertKnownAggregatorRouterOnSigningPath(provider, address, chain) {
+    if (ENFORCED_ROUTER_PROVIDERS.has(provider)) {
+        // assertKnownAggregatorRouter fails closed on an unrecognized address, INCLUDING an empty/missing
+        // one - an enforced-provider swap with no destination is itself a malformed intent we won't sign.
+        assertKnownAggregatorRouter(provider, address, chain);
+        return;
+    }
+    if (!RECOGNIZED_UNENFORCED_PROVIDERS.has(provider)) {
+        throw new Error(`Unrecognized swap provider "${provider}" on the co-signer signing path - refusing to sign a swap ` +
+            'whose provider label does not match any known aggregator (enforced or unenforced).');
+    }
+    // Unenforced (li.fi/swapkit): log-only, and log the ACTUAL provider so the usage dataset the future
+    // allow-list is built from isn't poisoned by a coerced label. Skip a genuinely empty address.
+    if (address) {
+        logUnenforcedAggregatorDestination(provider, address);
+    }
+}
+/**
+ * Signing-path approval-spender bind (sdk#1358 review follow-up, requested by neavra). The
+ * follow-on to {@link assertKnownAggregatorRouterOnSigningPath}: that guard validates the swap-leg
+ * destination (`quote.tx.to`), but a general swap that needs an allowance also carries a SEPARATE,
+ * independent wire field - `erc20ApprovePayload.spender` - which the approve resolver (erc20.ts)
+ * reads verbatim and nothing binds to `quote.tx.to`. So a payload can pass the router check with a
+ * genuine 1inch/kyber `tx.to` yet still carry an approve granting an ATTACKER an allowance over the
+ * user's token (a classic approval-drain the co-signer would otherwise sign blind).
+ *
+ * On the initiator these coincide by construction (build.ts sets the approve spender to
+ * `getSwapDestinationAddress` === `tx.to`), so this only ever fires on a hand-built/tampered payload.
+ * Enforced providers (1inch/kyber/cowswap) MUST have `spender === routerDestination`; unenforced
+ * providers (li.fi/swapkit) are NOT bound. CowSwap's spender IS its `tx.to` (both are the fixed
+ * GPv2VaultRelayer - see getSwapDestinationAddress.ts), so it binds the same way 1inch/kyber do. Like
+ * its sibling this is a MONOTONIC gate: it only throws or no-ops, never changes the signed bytes.
+ */
+export function assertEnforcedSwapApprovalSpenderBound(provider, spender, routerDestination, chain) {
+    if (!ENFORCED_ROUTER_PROVIDERS.has(provider)) {
+        return;
+    }
+    if (spender.toLowerCase() !== routerDestination.toLowerCase()) {
+        throw new Error(`${provider} swap approval spender (${spender}) does not match the verified swap router (${routerDestination}) on ${chain} — refusing to sign an approval to an unbound spender.`);
+    }
+}
 /**
  * Throws if `address` isn't the known router for `provider` on `chain`. Call this at quote
  * construction, before a GeneralSwapQuote carrying `address` as `tx.evm.to` can exist.
@@ -62,9 +158,19 @@ export function assertKnownAggregatorRouter(provider, address, chain) {
     const normalized = address.toLowerCase();
     const isKnown = provider === 'kyber'
         ? normalized === KYBER_STANDARD_ROUTER
-        : chain === Chain.Zksync
-            ? normalized === ONE_INCH_V6_ZKSYNC_ROUTER
-            : normalized === ONE_INCH_V5_ROUTER || normalized === ONE_INCH_V6_STANDARD_ROUTER;
+        : provider === 'cowswap'
+            ? // CHAIN-SCOPED, same reason the 1inch arm is: the relayer is a deterministic address, so it
+                // resolves on EVERY EVM chain, but CoW has only deployed the GPv2 stack on
+                // cowSwapSupportedChains (findSwapQuote gates quotes to exactly those). Accepting it
+                // chain-agnostically would let a tampered payload relabelled 'cowswap' on e.g. CronosChain /
+                // Zksync / Blast — where eth_getCode at this address is literally `0x`, verified 2026-07-21 —
+                // pass BOTH this guard and assertEnforcedSwapApprovalSpenderBound, so the co-signer would
+                // sign an ERC-20 approve to a codeless address anyone can later claim via the deterministic
+                // deployment proxy. Fail closed off the supported set.
+                isOneOf(chain, cowSwapSupportedChains) && normalized === COW_VAULT_RELAYER_ADDRESS.toLowerCase()
+            : chain === Chain.Zksync
+                ? normalized === ONE_INCH_V6_ZKSYNC_ROUTER
+                : normalized === ONE_INCH_V5_ROUTER || normalized === ONE_INCH_V6_STANDARD_ROUTER;
     if (!isKnown) {
         throw new Error(`${provider} swap quote returned an unrecognized router address (${address}) on ${chain} — refusing to build a signable transaction against it.`);
     }

package/dist/swap/general/knownAggregatorRouters.js.map

@@ -1 +1 @@
-{"version":3,"file":"knownAggregatorRouters.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,wDAAwD;AACxD,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,qFAAqF;AACrF,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,4CAA4C,CAAA;AAEvE,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,4CAA4C,CAAA;AAEhF,sFAAsF;AACtF,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,4CAA4C,CAAA;AAE9E,4FAA4F;AAC5F,0FAA0F;AAC1F,wFAAwF;AACxF,4FAA4F;AAC5F,sFAAsF;AACtF,6FAA6F;AAC7F,2FAA2F;AAC3F,WAAW;AACX,MAAM,qBAAqB,GAAG,4CAA4C,CAAA;AAI1E;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC,EAAE,OAAe,EAAE,KAAY;IACzG,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACxC,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,UAAU,KAAK,qBAAqB;QACtC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM;YACtB,CAAC,CAAC,UAAU,KAAK,yBAAyB;YAC1C,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,2BAA2B,CAAA;IAEvF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,wDAAwD,OAAO,QAAQ,KAAK,yDAAyD,CACjJ,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAA6B,EAAE,OAAe;IAC/F,OAAO,CAAC,IAAI,CAAC,8FAA8F,EAAE;QAC3G,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"knownAggregatorRouters.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAE3D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,wDAAwD;AACxD,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,qFAAqF;AACrF,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,4CAA4C,CAAA;AAEvE,sFAAsF;AACtF,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,4CAA4C,CAAA;AAEhF,sFAAsF;AACtF,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,4CAA4C,CAAA;AAE9E,sFAAsF;AACtF,8EAA8E;AAC9E,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,4CAA4C,CAAA;AAI1E,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;AAErH,8FAA8F;AAC9F,2FAA2F;AAC3F,+FAA+F;AAC/F,2FAA2F;AAC3F,sFAAsF;AACtF,+FAA+F;AAC/F,8FAA8F;AAC9F,oGAAoG;AACpG,MAAM,+BAA+B,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;AAE9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,wCAAwC,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAY;IACtG,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,kGAAkG;QAClG,kGAAkG;QAClG,2BAA2B,CAAC,QAAkC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC/E,OAAM;IACR,CAAC;IACD,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,4DAA4D;YACjG,oFAAoF,CACvF,CAAA;IACH,CAAC;IACD,oGAAoG;IACpG,8FAA8F;IAC9F,IAAI,OAAO,EAAE,CAAC;QACZ,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sCAAsC,CACpD,QAAgB,EAChB,OAAe,EACf,iBAAyB,EACzB,KAAY;IAEZ,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,2BAA2B,OAAO,8CAA8C,iBAAiB,QAAQ,KAAK,wDAAwD,CAClL,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC,EAAE,OAAe,EAAE,KAAY;IACzG,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACxC,MAAM,OAAO,GACX,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,UAAU,KAAK,qBAAqB;QACtC,CAAC,CAAC,QAAQ,KAAK,SAAS;YACtB,CAAC,CAAC,4FAA4F;gBAC5F,2EAA2E;gBAC3E,qFAAqF;gBACrF,6FAA6F;gBAC7F,8FAA8F;gBAC9F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,uDAAuD;gBACvD,OAAO,CAAC,KAAK,EAAE,sBAAsB,CAAC,IAAI,UAAU,KAAK,yBAAyB,CAAC,WAAW,EAAE;YAClG,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM;gBACtB,CAAC,CAAC,UAAU,KAAK,yBAAyB;gBAC1C,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,2BAA2B,CAAA;IAEzF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,wDAAwD,OAAO,QAAQ,KAAK,yDAAyD,CACjJ,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAgB,EAAE,OAAe;IAClF,OAAO,CAAC,IAAI,CAAC,8FAA8F,EAAE;QAC3G,QAAQ;QACR,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}

package/dist/swap/general/kyber/chains.d.ts

@@ -1,3 +1,3 @@
-export declare const kyberSwapEnabledChains: readonly ["Ethereum", "BSC", "Arbitrum", "Polygon", "Optimism", "Avalanche", "Base", "Zksync", "Blast"];
+export declare const kyberSwapEnabledChains: readonly ["Ethereum", "BSC", "Arbitrum", "Polygon", "Optimism", "Avalanche", "Base"];
 export type KyberSwapEnabledChain = (typeof kyberSwapEnabledChains)[number];
 //# sourceMappingURL=chains.d.ts.map

package/dist/swap/general/kyber/chains.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chains.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/swap/general/kyber/chains.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,sBAAsB,yGAUzB,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"chains.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/swap/general/kyber/chains.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,sBAAsB,sFAQzB,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/swap/general/kyber/chains.js

@@ -1,4 +1,9 @@
 import { Chain } from '@vultisig/core-chain/Chain';
+// Zksync and Blast are intentionally absent (sdk#1151): Kyber's
+// aggregator-api.kyberswap.com /routes endpoint 404s on both (verified
+// 2026-07-08, see knownAggregatorRouters.ts) — listing them only burned a
+// doomed fetch + timeout slot per quote on those chains. Re-add if Kyber's
+// API starts serving them.
 export const kyberSwapEnabledChains = [
     Chain.Ethereum,
     Chain.BSC,
@@ -7,7 +12,5 @@ export const kyberSwapEnabledChains = [
     Chain.Optimism,
     Chain.Avalanche,
     Chain.Base,
-    Chain.Zksync,
-    Chain.Blast,
 ];
 //# sourceMappingURL=chains.js.map

package/dist/swap/general/kyber/chains.js.map

@@ -1 +1 @@
-{"version":3,"file":"chains.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/swap/general/kyber/chains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAElD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,GAAG;IACT,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,OAAO;IACb,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,SAAS;IACf,KAAK,CAAC,IAAI;IACV,KAAK,CAAC,MAAM;IACZ,KAAK,CAAC,KAAK;CACH,CAAA"}
+{"version":3,"file":"chains.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/swap/general/kyber/chains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAElD,gEAAgE;AAChE,uEAAuE;AACvE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,GAAG;IACT,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,OAAO;IACb,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,SAAS;IACf,KAAK,CAAC,IAAI;CACF,CAAA"}