@vultisig/core-chain 2.35.0 → 2.36.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @vultisig/core-chain
 
+## 2.36.0
+
+### Minor Changes
+
+- [#1830](https://github.com/vultisig/vultisig-sdk/pull/1830) [`1fd27b9`](https://github.com/vultisig/vultisig-sdk/commit/1fd27b9103b75a13191f173ebeed98288d8c16b0) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Fail closed when LI.FI returns a destination outside its official chain-scoped Diamond deployments. Accept that Diamond as LI.FI's deterministic approval-spender fast path, while requiring an independent benign Blockaid verdict for any route-dependent spender that differs from it. Require the same independent verdicts for SwapKit EVM transaction destinations and approval spenders, while retaining response-local target-address binding as defense in depth.
+
+  **Consumer-visible behavior changes:**
+
+  - **New runtime throws on the signing path.** A LI.FI destination outside the official Diamond, a distinct LI.FI approval spender that doesn't clear an independent Blockaid check, or a SwapKit destination/approval-spender that doesn't clear the same check now throws during quote construction and co-signer signing-input construction. A consumer on a caret range picks this up automatically.
+  - **Dynamic LI.FI approval spenders and SwapKit addresses add a live third-party network call (Blockaid) during MPC signing**, per co-signer. The official LI.FI Diamond remains an offline fast path. A slow or unreachable Blockaid response can stall a signing ceremony for up to the shared `queryUrl` timeout (20s default) before throwing.
+
+- [#1811](https://github.com/vultisig/vultisig-sdk/pull/1811) [`003ee98`](https://github.com/vultisig/vultisig-sdk/commit/003ee98728f3318eb2de661209f164b449150810) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Bind raw swap quotes to their exact coin identities, requested source amount, absolute expiry, and returned transaction, then reject missing, stale, mismatched, or mutated quotes in the vault-free swap preparation path before any payload construction. General quotes remain preparation-valid for five minutes while SDK presentation continues to recommend refreshing after 60 seconds, and vault-free callers can catch `SwapQuoteExpiredError` to requote.
+
+  Consumers must pass the live bound quote returned by `findSwapQuote` or `getSwapQuote` into preparation instead of constructing or persisting an unbound raw quote. Structured cloning is supported; JSON round-tripping is not because it loses required runtime value types such as `bigint`.
+
+### Patch Changes
+
+- [#1883](https://github.com/vultisig/vultisig-sdk/pull/1883) [`44f0ecb`](https://github.com/vultisig/vultisig-sdk/commit/44f0ecbdf10b07789341c0279041d3a1e37d46a0) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Share LI.FI fee-chain fallback logic between the core and React Native quote paths.
+
+- [#1886](https://github.com/vultisig/vultisig-sdk/pull/1886) [`eb25508`](https://github.com/vultisig/vultisig-sdk/commit/eb25508eadfde14ee62470e64d8c2b590627fd76) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Fail closed when Sui pagination reports more data without a usable cursor, preventing partial coin sets or portfolios from being returned as complete.
+
+## 2.35.1
+
+### Patch Changes
+
+- [#1846](https://github.com/vultisig/vultisig-sdk/pull/1846) [`8faa612`](https://github.com/vultisig/vultisig-sdk/commit/8faa612e6358af0a77cebf9c06d8865d832b69df) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - Reserve the OP-stack balance-check surcharges in the EVM fee amount, so a native max send on Optimism, Base, Blast or Mantle stays affordable at broadcast. op-geth requires `value + gasLimit * maxFeePerGas + l1Cost + operatorCost`, and an amount that left only the gas term behind was rejected by exactly the difference — after the keysign ceremony had already run. Both oracle reads fail open, so a chain whose oracle is unreachable or predates a term behaves exactly as before.
+
 ## 2.35.0
 
 ### Minor Changes

package/dist/chains/evm/opStack/getOpStackFeeSurcharge.d.ts

@@ -0,0 +1,22 @@
+import { OpStackChain } from './opStackChains.js';
+type GetOpStackFeeSurchargeInput = {
+    chain: OpStackChain;
+    gasLimit: bigint;
+    callDataSize: number;
+};
+/**
+ * The two terms op-geth adds to the balance check it runs before executing a
+ * transaction: the L1 data-availability cost and, from Isthmus onwards, the
+ * operator fee. The chain requires
+ * `value + gasLimit * maxFeePerGas + l1Cost + operatorCost` to be covered, so an
+ * amount that leaves only the gas term behind is rejected by exactly this much.
+ *
+ * Both terms fail open independently. A pre-Isthmus oracle reverts on
+ * `getOperatorFee`, and letting that failure take the L1 data fee down with it
+ * would leave the chain reserving nothing at all — a fee that cannot be read
+ * must never block a send that worked before. A negative answer is nonsense from
+ * a fee oracle and is floored rather than passed on to widen a max amount.
+ */
+export declare const getOpStackFeeSurcharge: ({ chain, gasLimit, callDataSize, }: GetOpStackFeeSurchargeInput) => Promise<bigint>;
+export {};
+//# sourceMappingURL=getOpStackFeeSurcharge.d.ts.map

package/dist/chains/evm/opStack/getOpStackFeeSurcharge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getOpStackFeeSurcharge.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/evm/opStack/getOpStackFeeSurcharge.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAoC9C,KAAK,2BAA2B,GAAG;IACjC,KAAK,EAAE,YAAY,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,GAAU,oCAI1C,2BAA2B,KAAG,OAAO,CAAC,MAAM,CAiC9C,CAAA"}

package/dist/chains/evm/opStack/getOpStackFeeSurcharge.js

@@ -0,0 +1,68 @@
+import { getEvmClient } from '@vultisig/core-chain/chains/evm/client';
+import { attempt, withFallback } from '@vultisig/lib-utils/attempt';
+import { bigIntMax } from '@vultisig/lib-utils/bigint/bigIntMax';
+import { l1FeeProbeData } from './l1FeeProbeData.js';
+/** Canonical `GasPriceOracle` predeploy address, identical on every OP-stack rollup. */
+const gasPriceOracleAddress = '0x420000000000000000000000000000000000000F';
+// `getL1Fee(bytes)` is preferred over the purpose-built `getL1FeeUpperBound(uint256)`,
+// which only exists from Fjord onwards — Blast's oracle predates it, while
+// `getL1Fee` has been there since Bedrock. `getOperatorFee(uint256)` arrives with
+// Isthmus and simply reverts on older oracles, which reads the same as "this chain
+// charges no operator fee".
+const gasPriceOracleAbi = [
+    {
+        name: 'getL1Fee',
+        type: 'function',
+        stateMutability: 'view',
+        inputs: [{ name: '_data', type: 'bytes' }],
+        outputs: [{ name: '', type: 'uint256' }],
+    },
+    {
+        name: 'getOperatorFee',
+        type: 'function',
+        stateMutability: 'view',
+        inputs: [{ name: '_gasUsed', type: 'uint256' }],
+        outputs: [{ name: '', type: 'uint256' }],
+    },
+];
+// Serialized size, in bytes, that the L1-fee probe stands in for on top of the
+// transaction's own calldata. The oracle wants the UNSIGNED transaction and adds
+// its own 68-byte allowance for the signature, so this models the ~70-byte
+// unsigned EIP-1559 envelope with deliberate margin: the transaction is not built
+// yet when its fee has to be reserved, and over-reserving leaves dust behind
+// where under-reserving costs a broadcast rejected after the keysign ceremony has
+// already run.
+const unsignedTxEnvelopeSize = 160;
+/**
+ * The two terms op-geth adds to the balance check it runs before executing a
+ * transaction: the L1 data-availability cost and, from Isthmus onwards, the
+ * operator fee. The chain requires
+ * `value + gasLimit * maxFeePerGas + l1Cost + operatorCost` to be covered, so an
+ * amount that leaves only the gas term behind is rejected by exactly this much.
+ *
+ * Both terms fail open independently. A pre-Isthmus oracle reverts on
+ * `getOperatorFee`, and letting that failure take the L1 data fee down with it
+ * would leave the chain reserving nothing at all — a fee that cannot be read
+ * must never block a send that worked before. A negative answer is nonsense from
+ * a fee oracle and is floored rather than passed on to widen a max amount.
+ */
+export const getOpStackFeeSurcharge = async ({ chain, gasLimit, callDataSize, }) => {
+    const client = getEvmClient(chain);
+    const l1DataFee = withFallback(attempt(client.readContract({
+        address: gasPriceOracleAddress,
+        abi: gasPriceOracleAbi,
+        functionName: 'getL1Fee',
+        args: [l1FeeProbeData(unsignedTxEnvelopeSize + callDataSize)],
+    })), 0n);
+    const operatorFee = gasLimit > 0n
+        ? withFallback(attempt(client.readContract({
+            address: gasPriceOracleAddress,
+            abi: gasPriceOracleAbi,
+            functionName: 'getOperatorFee',
+            args: [gasLimit],
+        })), 0n)
+        : Promise.resolve(0n);
+    const terms = await Promise.all([l1DataFee, operatorFee]);
+    return terms.reduce((total, term) => total + bigIntMax(0n, term), 0n);
+};
+//# sourceMappingURL=getOpStackFeeSurcharge.js.map

package/dist/chains/evm/opStack/getOpStackFeeSurcharge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getOpStackFeeSurcharge.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/evm/opStack/getOpStackFeeSurcharge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAA;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjD,wFAAwF;AACxF,MAAM,qBAAqB,GAAG,4CAA4C,CAAA;AAE1E,uFAAuF;AACvF,2EAA2E;AAC3E,kFAAkF;AAClF,mFAAmF;AACnF,4BAA4B;AAC5B,MAAM,iBAAiB,GAAG;IACxB;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,UAAU;QAChB,eAAe,EAAE,MAAM;QACvB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KACzC;CACO,CAAA;AAEV,+EAA+E;AAC/E,iFAAiF;AACjF,2EAA2E;AAC3E,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,eAAe;AACf,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAQlC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,EAC3C,KAAK,EACL,QAAQ,EACR,YAAY,GACgB,EAAmB,EAAE;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAElC,MAAM,SAAS,GAAG,YAAY,CAC5B,OAAO,CACL,MAAM,CAAC,YAAY,CAAC;QAClB,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,UAAU;QACxB,IAAI,EAAE,CAAC,cAAc,CAAC,sBAAsB,GAAG,YAAY,CAAC,CAAC;KAC9D,CAAC,CACH,EACD,EAAE,CACH,CAAA;IAED,MAAM,WAAW,GACf,QAAQ,GAAG,EAAE;QACX,CAAC,CAAC,YAAY,CACV,OAAO,CACL,MAAM,CAAC,YAAY,CAAC;YAClB,OAAO,EAAE,qBAAqB;YAC9B,GAAG,EAAE,iBAAiB;YACtB,YAAY,EAAE,gBAAgB;YAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CACH,EACD,EAAE,CACH;QACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAEzB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;IAEzD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA"}

package/dist/chains/evm/opStack/l1FeeProbeData.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Stand-in bytes for the serialized transaction handed to the `GasPriceOracle`
+ * predeploy's `getL1Fee(bytes)`, which has to price a transaction that does not
+ * exist yet — the amount being priced is itself derived from the answer.
+ *
+ * The bytes are deliberately incompressible. From Fjord onwards the oracle
+ * charges for the FastLZ-compressed size of what it is handed, so a *periodic*
+ * payload prices far below what a real transaction costs: a plain counter wraps
+ * every 256 bytes and every window after the first lap is a back reference, at
+ * which point the quote stops growing with size at all.
+ *
+ * This stream repeats no 3-byte window — FastLZ's shortest encodable match —
+ * through its first 3,652 bytes, which covers every probe the callers build
+ * (a 160-byte envelope plus calldata, the largest being a ~3 KB swap router
+ * call). Past that the birthday bound makes isolated repeats inevitable in any
+ * uniformly distributed stream, and they are harmless: a lone 3-byte match
+ * costs more to encode as a back reference than it saves, so FastLZ does not
+ * take it. Measured against the live oracles, this stream prices identically to
+ * crypto-random bytes at 1–4 KB and 0.01% *above* them at 8–16 KB — it never
+ * quotes below the incompressible ideal.
+ */
+export declare const l1FeeProbeData: (size: number) => `0x${string}`;
+//# sourceMappingURL=l1FeeProbeData.d.ts.map

package/dist/chains/evm/opStack/l1FeeProbeData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"l1FeeProbeData.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/evm/opStack/l1FeeProbeData.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,KAAK,MAAM,EAUxD,CAAA"}

package/dist/chains/evm/opStack/l1FeeProbeData.js

@@ -0,0 +1,38 @@
+import { bytesToHex } from 'viem';
+// Linear congruential generator (Numerical Recipes constants) seeded with the
+// golden-ratio word. Deterministic across runs, so the same send reserves the
+// same amount twice running, and aperiodic over any length we ask it for.
+const lcgSeed = 0x9e3779b9;
+const lcgMultiplier = 1_664_525;
+const lcgIncrement = 1_013_904_223;
+/**
+ * Stand-in bytes for the serialized transaction handed to the `GasPriceOracle`
+ * predeploy's `getL1Fee(bytes)`, which has to price a transaction that does not
+ * exist yet — the amount being priced is itself derived from the answer.
+ *
+ * The bytes are deliberately incompressible. From Fjord onwards the oracle
+ * charges for the FastLZ-compressed size of what it is handed, so a *periodic*
+ * payload prices far below what a real transaction costs: a plain counter wraps
+ * every 256 bytes and every window after the first lap is a back reference, at
+ * which point the quote stops growing with size at all.
+ *
+ * This stream repeats no 3-byte window — FastLZ's shortest encodable match —
+ * through its first 3,652 bytes, which covers every probe the callers build
+ * (a 160-byte envelope plus calldata, the largest being a ~3 KB swap router
+ * call). Past that the birthday bound makes isolated repeats inevitable in any
+ * uniformly distributed stream, and they are harmless: a lone 3-byte match
+ * costs more to encode as a back reference than it saves, so FastLZ does not
+ * take it. Measured against the live oracles, this stream prices identically to
+ * crypto-random bytes at 1–4 KB and 0.01% *above* them at 8–16 KB — it never
+ * quotes below the incompressible ideal.
+ */
+export const l1FeeProbeData = (size) => {
+    const bytes = new Uint8Array(Math.max(0, size));
+    let state = lcgSeed;
+    for (let i = 0; i < bytes.length; i++) {
+        state = (Math.imul(state, lcgMultiplier) + lcgIncrement) >>> 0;
+        bytes[i] = (state >>> 24) & 0xff;
+    }
+    return bytesToHex(bytes);
+};
+//# sourceMappingURL=l1FeeProbeData.js.map

package/dist/chains/evm/opStack/l1FeeProbeData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"l1FeeProbeData.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/evm/opStack/l1FeeProbeData.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEjC,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,OAAO,GAAG,UAAU,CAAA;AAC1B,MAAM,aAAa,GAAG,SAAS,CAAA;AAC/B,MAAM,YAAY,GAAG,aAAa,CAAA;AAElC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAiB,EAAE;IAC5D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IAE/C,IAAI,KAAK,GAAG,OAAO,CAAA;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9D,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,CAAA;IAClC,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC,CAAA"}

package/dist/chains/evm/opStack/opStackChains.d.ts

@@ -0,0 +1,19 @@
+import { Chain } from '@vultisig/core-chain/Chain';
+/**
+ * EVM chains that settle to Ethereum through the OP stack and therefore expose
+ * the `GasPriceOracle` predeploy. op-geth bills these chains' transactions an
+ * L1 data-availability cost — and, from Isthmus onwards, an operator fee — on
+ * top of L2 execution gas, and adds both to the balance check it runs before a
+ * transaction executes.
+ *
+ * Membership is asserted, not detected: the predeploy answers on exactly these
+ * four and has no code on every other EVM chain in the registry. An omission is
+ * safe but silent — the chain reserves nothing extra, which is how every chain
+ * behaved before the oracle was read at all — so a newly added OP-stack rollup
+ * has to be listed here or its max sends will under-reserve.
+ */
+export declare const opStackChains: readonly ["Optimism", "Base", "Blast", "Mantle"];
+export type OpStackChain = (typeof opStackChains)[number];
+/** Narrows a chain to one whose node prices an L1 data fee through the `GasPriceOracle` predeploy. */
+export declare const isOpStackChain: (chain: Chain) => chain is OpStackChain;
+//# sourceMappingURL=opStackChains.d.ts.map

package/dist/chains/evm/opStack/opStackChains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opStackChains.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/evm/opStack/opStackChains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAY,MAAM,4BAA4B,CAAA;AAG5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,kDAA+E,CAAA;AAEzG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzD,sGAAsG;AACtG,eAAO,MAAM,cAAc,GAAI,OAAO,KAAK,KAAG,KAAK,IAAI,YAA6C,CAAA"}

package/dist/chains/evm/opStack/opStackChains.js

@@ -0,0 +1,19 @@
+import { EvmChain } from '@vultisig/core-chain/Chain';
+import { isOneOf } from '@vultisig/lib-utils/array/isOneOf';
+/**
+ * EVM chains that settle to Ethereum through the OP stack and therefore expose
+ * the `GasPriceOracle` predeploy. op-geth bills these chains' transactions an
+ * L1 data-availability cost — and, from Isthmus onwards, an operator fee — on
+ * top of L2 execution gas, and adds both to the balance check it runs before a
+ * transaction executes.
+ *
+ * Membership is asserted, not detected: the predeploy answers on exactly these
+ * four and has no code on every other EVM chain in the registry. An omission is
+ * safe but silent — the chain reserves nothing extra, which is how every chain
+ * behaved before the oracle was read at all — so a newly added OP-stack rollup
+ * has to be listed here or its max sends will under-reserve.
+ */
+export const opStackChains = [EvmChain.Optimism, EvmChain.Base, EvmChain.Blast, EvmChain.Mantle];
+/** Narrows a chain to one whose node prices an L1 data fee through the `GasPriceOracle` predeploy. */
+export const isOpStackChain = (chain) => isOneOf(chain, opStackChains);
+//# sourceMappingURL=opStackChains.js.map

package/dist/chains/evm/opStack/opStackChains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opStackChains.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/evm/opStack/opStackChains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAA;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAU,CAAA;AAIzG,sGAAsG;AACtG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAY,EAAyB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA"}

package/dist/chains/sui/listAllCoins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listAllCoins.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/sui/listAllCoins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAIlC,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,GAAI,YAAY,MAAM,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,MAChC,CAAA;AAErD,KAAK,oBAAoB,GAAG;IAC1B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAU,6BAA6B,oBAAoB,KAAG,OAAO,CAAC,aAAa,EAAE,CA4BhH,CAAA"}
+{"version":3,"file":"listAllCoins.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/sui/listAllCoins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAIlC,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,GAAI,YAAY,MAAM,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,MAChC,CAAA;AAErD,KAAK,oBAAoB,GAAG;IAC1B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAU,6BAA6B,oBAAoB,KAAG,OAAO,CAAC,aAAa,EAAE,CAuChH,CAAA"}

package/dist/chains/sui/listAllCoins.js

@@ -33,6 +33,14 @@ export const listAllSuiCoins = async ({ client, owner, coinType }) => {
                 balance: object.balance,
             });
         }
+        // `hasNextPage: true` without a cursor cannot be followed. Treat every
+        // falsy cursor as malformed because the gRPC adapter can turn an empty page
+        // token into `cursor: ''`, while GraphQL can return a null end cursor.
+        // Returning the coins collected so far would make a truncated set look
+        // complete and can surface later as a false insufficient-balance error.
+        if (page.hasNextPage && !page.cursor) {
+            throw new Error(`listAllSuiCoins: page ${pages + 1} for ${owner} (${coinType}) reports hasNextPage with no cursor — refusing to build a send from a truncated coin set`);
+        }
         cursor = page.hasNextPage ? page.cursor : null;
         if (++pages >= maxSuiCoinPages && cursor) {
             throw new Error(`listAllSuiCoins: exceeded ${maxSuiCoinPages} pages for ${owner} (${coinType}) — refusing to build a send from a possibly-truncated or looping coin set`);

package/dist/chains/sui/listAllCoins.js.map

@@ -1 +1 @@
-{"version":3,"file":"listAllCoins.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/sui/listAllCoins.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC,MAAM,eAAe,GAAG,qBAAqB,CAAA;AAE7C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAA8B,EAAE,QAAgB,EAAU,EAAE,CAC5F,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAA;AAQrD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAwB,EAA4B,EAAE;IACnH,MAAM,KAAK,GAAoB,EAAE,CAAA;IACjC,IAAI,MAAM,GAA8B,SAAS,CAAA;IACjD,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAEhE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAClD,YAAY,EAAE,MAAM,CAAC,QAAQ;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAE9C,IAAI,EAAE,KAAK,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,6BAA6B,eAAe,cAAc,KAAK,KAAK,QAAQ,4EAA4E,CACzJ,CAAA;QACH,CAAC;IACH,CAAC,QAAQ,MAAM,EAAC;IAEhB,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"listAllCoins.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/sui/listAllCoins.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC,MAAM,eAAe,GAAG,qBAAqB,CAAA;AAE7C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAA8B,EAAE,QAAgB,EAAU,EAAE,CAC5F,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAA;AAQrD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAwB,EAA4B,EAAE;IACnH,MAAM,KAAK,GAAoB,EAAE,CAAA;IACjC,IAAI,MAAM,GAA8B,SAAS,CAAA;IACjD,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QAEhE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAClD,YAAY,EAAE,MAAM,CAAC,QAAQ;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAA;QACJ,CAAC;QAED,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,GAAG,CAAC,QAAQ,KAAK,KAAK,QAAQ,2FAA2F,CACxJ,CAAA;QACH,CAAC;QAED,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAE9C,IAAI,EAAE,KAAK,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,6BAA6B,eAAe,cAAc,KAAK,KAAK,QAAQ,4EAA4E,CACzJ,CAAA;QACH,CAAC;IACH,CAAC,QAAQ,MAAM,EAAC;IAEhB,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/dist/swap/general/knownAggregatorRouters.d.ts

@@ -1,12 +1,11 @@
 import { Chain } from '../../Chain.js';
-export type EnforcedRouterProvider = '1inch' | 'kyber' | 'cowswap';
+export type EnforcedRouterProvider = '1inch' | 'kyber' | 'cowswap' | 'li.fi';
 /**
  * Signing-path re-assert (sdk#1358): the same allow-list check as {@link assertKnownAggregatorRouter},
  * but keyed off an arbitrary provider STRING (the value carried in KeysignSwapPayload.general.provider,
- * which is a plain `string`). Enforced providers (1inch/kyber/cowswap) fail closed; the small closed set
- * of genuinely unenforceable providers (li.fi/swapkit, plus the legacy `''` unattributed provider - see
- * RECOGNIZED_UNENFORCED_PROVIDERS) fall through to the same log-only path they take at quote construction;
- * anything else is rejected outright (sdk#1457, see below).
+ * which is a plain `string`). Fixed-router providers fail closed against their allowlists, SwapKit
+ * fails closed against an independent Blockaid reputation verdict, and only the legacy `''`
+ * unattributed provider remains log-only. Anything else is rejected outright (sdk#1457, see below).
  *
  * WHY THIS EXISTS SEPARATELY FROM quote construction: a compromised initiator (or server composing the
  * intent) can hand a co-signer a KeysignPayload whose swapPayload.quote.tx.to was NEVER run through the
@@ -23,23 +22,35 @@ export type EnforcedRouterProvider = '1inch' | 'kyber' | 'cowswap';
  * enforcement) is a real, closable gap - not just a theoretical one.
  *
  * sdk#1457 FIX: two structural improvements that need no proto change. (1) CowSwap is now enforced -
- * unlike li.fi/swapkit it settles through ONE fixed, deterministic contract (the GPv2VaultRelayer, see
+ * unlike swapkit it settles through ONE fixed, deterministic contract (the GPv2VaultRelayer, see
  * assertKnownAggregatorRouter), so its destination is exactly as allow-listable as 1inch/Kyber's; a
  * payload can no longer relabel itself 'cowswap' to dodge a router check the way it previously could. (2)
  * the log-only fallback is now a CLOSED list of the provider values the codebase legitimately produces
- * (li.fi/swapkit, plus the legacy `''` unattributed provider) - a `provider` string outside every known
+ * (at that time li.fi/swapkit, plus the legacy `''` unattributed provider) - a `provider` string outside every known
  * value (enforced or unenforced) is unrecognized and REJECTED, not silently passed through. Together
- * these shrink "relabel to escape enforcement" from "any string at all" down to exactly li.fi, swapkit,
- * and the legacy `''`, which remain unenforceable by address because they legitimately route through
- * many different contracts by design (see the file doc comment) - closing that residual gap needs the
- * provider identity to be a trusted wire discriminant instead of a free string, i.e. a proto oneof case
- * per provider (tracked in sdk#1457, not attempted here: a schema change on the shared commondata proto
- * is a cross-repo, cross-consumer change every native client (iOS/Android/Windows) also builds against).
+ * these originally shrank "relabel to escape enforcement" from "any string at all" to that closed set.
+ * sdk#1458 subsequently removes li.fi from the residual gap using its official Diamond deployments
+ * and applies an independent Blockaid reputation check to SwapKit destinations on both quote and
+ * co-signer paths. The legacy unattributed value remains the only log-only compatibility case.
  *
  * This guard remains MONOTONIC beyond that residual gap: it only ever THROWS (rejects) or no-ops - it
  * never makes anything signable that wasn't already.
  */
 export declare function assertKnownAggregatorRouterOnSigningPath(provider: string, address: string, chain: Chain): void;
+/**
+ * Independent trust boundary for dynamic SwapKit EVM addresses. SwapKit's `tx.to`,
+ * `targetAddress`, and optional approval transaction all come from the same `/v3/swap`
+ * response, so equality between them cannot establish destination safety when that response
+ * is compromised.
+ */
+export declare function assertSwapKitAddressReputation(address: string, chain: Chain, role?: string): Promise<void>;
+/**
+ * LI.FI documents `estimate.approvalAddress` as route-dependent and explicitly warns consumers
+ * not to hardcode it. The official Diamond is safe without a network dependency; a distinct
+ * spender is accepted only after an independent benign Blockaid verdict. This preserves valid
+ * inner-executor routes without trusting the quote response to authorize its own spender.
+ */
+export declare function assertLifiApprovalAddress(address: string, chain: Chain): Promise<void>;
 /**
  * Signing-path approval-spender bind (sdk#1358 review follow-up, requested by neavra). The
  * follow-on to {@link assertKnownAggregatorRouterOnSigningPath}: that guard validates the swap-leg
@@ -49,12 +60,14 @@ export declare function assertKnownAggregatorRouterOnSigningPath(provider: strin
  * genuine 1inch/kyber `tx.to` yet still carry an approve granting an ATTACKER an allowance over the
  * user's token (a classic approval-drain the co-signer would otherwise sign blind).
  *
- * On the initiator these coincide by construction (build.ts sets the approve spender to
- * `getSwapDestinationAddress` === `tx.to`), so this only ever fires on a hand-built/tampered payload.
- * Enforced providers (1inch/kyber/cowswap) MUST have `spender === routerDestination`; unenforced
- * providers (li.fi/swapkit) are NOT bound. CowSwap's spender IS its `tx.to` (both are the fixed
- * GPv2VaultRelayer - see getSwapDestinationAddress.ts), so it binds the same way 1inch/kyber do. Like
- * its sibling this is a MONOTONIC gate: it only throws or no-ops, never changes the signed bytes.
+ * On the initiator the fixed-spender providers coincide by construction. LI.FI and SwapKit can
+ * instead set an explicit `approvalAddress`, which is why their spender checks are separate.
+ * Approval-bound providers (1inch/kyber/cowswap) MUST have `spender === routerDestination`.
+ * LI.FI approval spenders can vary by route and are instead checked by
+ * {@link assertLifiApprovalAddress}; SwapKit spenders use its corresponding reputation guard.
+ * CowSwap's spender IS its `tx.to` (both are the fixed GPv2VaultRelayer - see
+ * getSwapDestinationAddress.ts), so it binds the same way 1inch/kyber do. Like its sibling this is
+ * a MONOTONIC gate: it only throws or no-ops, never changes the signed bytes.
  */
 export declare function assertEnforcedSwapApprovalSpenderBound(provider: string, spender: string, routerDestination: string, chain: Chain): void;
 /**
@@ -63,9 +76,14 @@ export declare function assertEnforcedSwapApprovalSpenderBound(provider: string,
  */
 export declare function assertKnownAggregatorRouter(provider: EnforcedRouterProvider, address: string, chain: Chain): void;
 /**
- * Log-only (never throws) — for LiFi/SwapKit, whose legitimate routes span many different
- * contracts. Structured so the data is queryable (provider + address) and a future allowlist
- * is easy to build if a stable pattern emerges from real usage.
+ * SwapKit v3 returns `targetAddress` independently from the ready-to-sign EVM
+ * transaction and defines it as the address the transaction must call or transfer to.
+ * Bind those fields before constructing a GeneralSwapQuote so a substituted `tx.to`
+ * cannot silently become the signed destination (or the approval fallback).
+ */
+export declare function assertSwapKitDestinationMatchesTarget(address: string, targetAddress: string | undefined, chain: Chain): void;
+/**
+ * Log-only (never throws) — retained only for legacy unattributed signing payloads.
  */
 export declare function logUnenforcedAggregatorDestination(provider: string, address: string): void;
 //# sourceMappingURL=knownAggregatorRouters.d.ts.map

package/dist/swap/general/knownAggregatorRouters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knownAggregatorRouters.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAwEnC,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;AAclE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,wCAAwC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAkB9G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,KAAK,GACX,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CA0BjH;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAK1F"}
+{"version":3,"file":"knownAggregatorRouters.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/general/knownAggregatorRouters.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAY,MAAM,aAAa,CAAA;AA+F7C,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAA;AAuB5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,wCAAwC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAuB9G;AAsCD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,SAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjH;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,KAAK,GACX,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CA4BjH;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,EAAE,KAAK,GACX,IAAI,CAYN;AAED;;GAEG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAK1F"}