@vultisig/core-chain 4.0.1 → 4.1.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @vultisig/core-chain
 
+## 4.1.1
+
+### Patch Changes
+
+- [#2297](https://github.com/vultisig/vultisig-sdk/pull/2297) [`c0eafeb`](https://github.com/vultisig/vultisig-sdk/commit/c0eafeb12df42cffa70ef6951c081a74383e5fa2) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Make the SDK package graph explicit and acyclic. Shared Bitcoin signing protobuf schemas now live in `@vultisig/mpc-types`, `@vultisig/core-mpc` preserves its existing schema subpath as a compatibility export, and SDK builds resolve the declared core packages through their published export maps.
+
+- [#2252](https://github.com/vultisig/vultisig-sdk/pull/2252) [`ef252e4`](https://github.com/vultisig/vultisig-sdk/commit/ef252e40b590a6cad9f303f7aba743c617442f90) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - fix(ton): stop hiding action-phase failures on sends and in status
+
+  Every TON send OR'd `IGNORE_ACTION_PHASE_ERRORS` into the wallet contract's send mode, which tells the contract to skip an outgoing transfer it cannot carry out instead of failing. The transaction then landed un-aborted with the seqno consumed and nothing moved, and the status resolver — which read only `aborted` and `compute_ph.exit_code` — reported it as confirmed. The user was told a transfer succeeded while the funds never left.
+
+  The flag is now dropped from native, MAX, dApp `signTon`, and Jetton sends (both the WalletCore and the React Native builders), and `getTonTxStatus` reads the action phase (`success`, `no_funds`, `result_code`, `skipped_actions`) alongside the compute phase. A transaction the indexer knows but has not yet described stays pending instead of counting as success.
+
+  Dropping the flag changes the signed body, so TON signing hashes move. Clients must upgrade together: a co-signer on an older build derives a different hash and the keysign fails. The mobile and cross-encoder golden corpora are re-recorded to the new values.
+
+- [#2093](https://github.com/vultisig/vultisig-sdk/pull/2093) [`bfe0292`](https://github.com/vultisig/vultisig-sdk/commit/bfe0292e3876fb7acc7044bac1b544c27aba8919) Thanks [@gomesalexandre](https://github.com/gomesalexandre)! - Publishes token-transfer / ERC-20-calldata destination safety helpers alongside the existing burn-address guard (`assertSafeDestination`): `assertSafeTokenTransferDestination` (rejects a transfer whose recipient is itself a known token contract — not just its own, any registered token's), `isErc20TransferCalldata`, `decodeErc20Recipient`, `decodeErc20Approve`, and `decodeErc20RecipientFromSig`, all re-exported from `@vultisig/sdk`. Previously only `agent-backend-ts` had this guard family as a private fork; `packages/sdk/src/tools/prep/send.ts`'s inline own-token-contract check is now additionally backed by the registry-based guard (catching sends to a _different_ known token's contract, on top of the existing unconditional self-contract check).
+
+- [#2092](https://github.com/vultisig/vultisig-sdk/pull/2092) [`acd0b2e`](https://github.com/vultisig/vultisig-sdk/commit/acd0b2eaa882669a399fb378e51244ed4199ee47) Thanks [@gomesalexandre](https://github.com/gomesalexandre)! - Consolidates four independently-maintained, overlapping Cosmos-family bech32 HRP tables — `tools/cosmos/gov.ts`'s `CHAIN_HRP`, `tools/prep/ibcTransfer.ts`'s `IBC_CHAIN_HRP`, `tools/swap/skip/skipSwap.ts`'s `COSMOS_CHAIN_HRPS`, and `tools/token/resolveContract.ts`'s `CW20_CHAIN_PREFIX` — into a single canonical registry, `COSMOS_CHAIN_ID_HRP`/`getCosmosChainHrp` (`@vultisig/core-chain/chains/cosmos/cosmosHrp`). All four consumers now derive their HRP checks from the same source instead of hand-maintained local copies that could drift from each other. As a side effect, Skip swap address validation now also HRP-checks four chain-ids (`axelar-dojo-1`, `juno-1`, `stargaze-1`, `akashnet-2`) it previously had no entry for and silently skipped — strictly safer, not a behavior change for any chain that was already validated. Deliberately does not touch `utils/addressFormat.ts`'s separate `cosmosHRPByChain`/`cosmosValoperByChain` tables, which are keyed by a different (lowercase chain-tag) space and ported 1:1 from a Go reference for cross-language parity.
+
+- Updated dependencies [[`c0eafeb`](https://github.com/vultisig/vultisig-sdk/commit/c0eafeb12df42cffa70ef6951c081a74383e5fa2)]:
+  - @vultisig/mpc-types@0.3.0
+
+## 4.1.0
+
+### Minor Changes
+
+- [#2234](https://github.com/vultisig/vultisig-sdk/pull/2234) [`0697060`](https://github.com/vultisig/vultisig-sdk/commit/0697060107c7fe1c8ec818d3e0eae01557d9d96f) Thanks [@rcoderdev](https://github.com/rcoderdev)! - Add RUJI Trade quoting and CosmWasm execution for native RUNE and bRUNE swaps through the SDK's normal swap flow.
+
+### Patch Changes
+
+- [#2235](https://github.com/vultisig/vultisig-sdk/pull/2235) [`3fff7cf`](https://github.com/vultisig/vultisig-sdk/commit/3fff7cfdfe23d2d5622f7caa87a6f1525329f07e) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - fix(swap): stop reporting a native trading halt when an aggregator could still fill
+
+  `findSwapQuotes` collapsed a THORChain/MayaChain halt plus a transient aggregator failure into `TradingHalted` for the whole pair, so an ETH→SOL quote surfaced "trading halted" whenever LiFi/SwapKit happened to time out. A halt is scoped to the native protocol that raised it: those aggregators now get one automatic re-attempt, and when they are still unreachable the error reports the transient failure instead of a halt the user cannot retry out of. Halt-only pairs still throw `TradingHalted`.
+
 ## 4.0.1
 
 ### Patch Changes

package/dist/chains/cardano/cip30/buildCoseStructures.d.ts

@@ -15,7 +15,7 @@ type BuildCoseSign1Input = {
 /**
  * Build and return the full COSE_Sign1 CBOR:
  *
- *     [protected: bstr, unprotected: {}, payload: bstr, signature: bstr]
+ *     [protected: bstr, unprotected: { "hashed": false }, payload: bstr, signature: bstr]
  *
  * Also returns the `protectedSerialized` bytes needed to compute the
  * Sig_structure before signing.

package/dist/chains/cardano/cip30/buildCoseStructures.js

@@ -32,7 +32,7 @@ export const buildSigStructure = (protectedBytes, payload) => cborArray([
 /**
  * Build and return the full COSE_Sign1 CBOR:
  *
- *     [protected: bstr, unprotected: {}, payload: bstr, signature: bstr]
+ *     [protected: bstr, unprotected: { "hashed": false }, payload: bstr, signature: bstr]
  *
  * Also returns the `protectedSerialized` bytes needed to compute the
  * Sig_structure before signing.
@@ -41,7 +41,7 @@ export const buildCoseSign1 = ({ addressBytes, payload, signature }) => {
     const protectedSerialized = buildProtectedHeaders(addressBytes);
     return cborArray([
         cborBytes(protectedSerialized),
-        cborMap([]), // empty unprotected headers
+        cborMap([[cborText('hashed'), Uint8Array.of(0xf4)]]), // `false` per RFC 8949 §3.3
         cborBytes(payload),
         cborBytes(signature),
     ]);

package/dist/chains/cardano/cip30/buildCoseStructures.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildCoseStructures.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/cardano/cip30/buildCoseStructures.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAEvG;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,YAAwB,EAAc,EAAE,CACrE,OAAO,CAAC;IACN,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;CAC/C,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAA0B,EAAE,OAAmB,EAAc,EAAE,CAC/F,SAAS,CAAC;IACR,QAAQ,CAAC,YAAY,CAAC;IACtB,SAAS,CAAC,cAAc,CAAC;IACzB,SAAS,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB;IACnD,SAAS,CAAC,OAAO,CAAC;CACnB,CAAC,CAAA;AAWJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAuB,EAAc,EAAE;IACtG,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAA;IAC/D,OAAO,SAAS,CAAC;QACf,SAAS,CAAC,mBAAmB,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,EAAE,4BAA4B;QACzC,SAAS,CAAC,OAAO,CAAC;QAClB,SAAS,CAAC,SAAS,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,YAAwB,EAAc,EAAE,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAA;AAOtH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,SAAS,EAAqB,EAAc,EAAE,CAC3E,OAAO,CAAC;IACN,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;CACtC,CAAC,CAAA"}
+{"version":3,"file":"buildCoseStructures.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/cardano/cip30/buildCoseStructures.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAEvG;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,YAAwB,EAAc,EAAE,CACrE,OAAO,CAAC;IACN,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;CAC/C,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,cAA0B,EAAE,OAAmB,EAAc,EAAE,CAC/F,SAAS,CAAC;IACR,QAAQ,CAAC,YAAY,CAAC;IACtB,SAAS,CAAC,cAAc,CAAC;IACzB,SAAS,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB;IACnD,SAAS,CAAC,OAAO,CAAC;CACnB,CAAC,CAAA;AAWJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAuB,EAAc,EAAE;IACtG,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAA;IAC/D,OAAO,SAAS,CAAC;QACf,SAAS,CAAC,mBAAmB,CAAC;QAC9B,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,4BAA4B;QAClF,SAAS,CAAC,OAAO,CAAC;QAClB,SAAS,CAAC,SAAS,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,YAAwB,EAAc,EAAE,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAA;AAOtH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,SAAS,EAAqB,EAAc,EAAE,CAC3E,OAAO,CAAC;IACN,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;CACtC,CAAC,CAAA"}

package/dist/chains/cardano/config.d.ts

@@ -1,4 +1,35 @@
+/**
+ * Slots added to the current tip to produce a Cardano transaction's TTL.
+ *
+ * Cardano slots are 1 second, so this is the window during which a built
+ * transaction stays valid; past it the node rejects it outright. Read together
+ * with {@link cardanoBroadcastTtlSafetyMargin}: the usable window for a signing
+ * ceremony is `cardanoSlotOffset - cardanoBroadcastTtlSafetyMargin` seconds,
+ * because broadcast refuses anything closer to expiry than the margin.
+ *
+ * Do not read this constant directly to build a TTL - call
+ * {@link getCardanoSendTtl}, so every consumer applies one policy instead of
+ * re-deriving it from the raw number.
+ */
 export declare const cardanoSlotOffset = 720;
 export declare const cardanoDefaultFee = 180000n;
+/**
+ * How close to its TTL a Cardano transaction may get before broadcast refuses
+ * it. Guards against signing a transaction that expires in flight, which would
+ * otherwise surface as an opaque node rejection after the ceremony completed.
+ */
 export declare const cardanoBroadcastTtlSafetyMargin = 60;
+/**
+ * The canonical TTL for a Cardano transaction built against `currentSlot`.
+ *
+ * This is protocol policy, not a per-caller choice: a transaction's validity
+ * window has to agree across every consumer that builds, signs or broadcasts
+ * one. When a consumer re-derives it locally the two silently diverge, and the
+ * same send stays valid for a different length of time depending on which code
+ * path produced it - while the broadcast-time freshness guard keeps using this
+ * side's numbers to judge it.
+ *
+ * @param currentSlot - the chain tip the transaction is being built against
+ */
+export declare const getCardanoSendTtl: (currentSlot: bigint) => bigint;
 //# sourceMappingURL=config.d.ts.map

package/dist/chains/cardano/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/cardano/config.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,MAAM,CAAA;AACpC,eAAO,MAAM,iBAAiB,UAAU,CAAA;AACxC,eAAO,MAAM,+BAA+B,KAAK,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/cardano/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAA;AAEjD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,aAAa,MAAM,KAAG,MAAiD,CAAA"}

package/dist/chains/cardano/config.js

@@ -1,4 +1,35 @@
+/**
+ * Slots added to the current tip to produce a Cardano transaction's TTL.
+ *
+ * Cardano slots are 1 second, so this is the window during which a built
+ * transaction stays valid; past it the node rejects it outright. Read together
+ * with {@link cardanoBroadcastTtlSafetyMargin}: the usable window for a signing
+ * ceremony is `cardanoSlotOffset - cardanoBroadcastTtlSafetyMargin` seconds,
+ * because broadcast refuses anything closer to expiry than the margin.
+ *
+ * Do not read this constant directly to build a TTL - call
+ * {@link getCardanoSendTtl}, so every consumer applies one policy instead of
+ * re-deriving it from the raw number.
+ */
 export const cardanoSlotOffset = 720;
 export const cardanoDefaultFee = 180000n;
+/**
+ * How close to its TTL a Cardano transaction may get before broadcast refuses
+ * it. Guards against signing a transaction that expires in flight, which would
+ * otherwise surface as an opaque node rejection after the ceremony completed.
+ */
 export const cardanoBroadcastTtlSafetyMargin = 60;
+/**
+ * The canonical TTL for a Cardano transaction built against `currentSlot`.
+ *
+ * This is protocol policy, not a per-caller choice: a transaction's validity
+ * window has to agree across every consumer that builds, signs or broadcasts
+ * one. When a consumer re-derives it locally the two silently diverge, and the
+ * same send stays valid for a different length of time depending on which code
+ * path produced it - while the broadcast-time freshness guard keeps using this
+ * side's numbers to judge it.
+ *
+ * @param currentSlot - the chain tip the transaction is being built against
+ */
+export const getCardanoSendTtl = (currentSlot) => currentSlot + BigInt(cardanoSlotOffset);
 //# sourceMappingURL=config.js.map

package/dist/chains/cardano/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/cardano/config.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACxC,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/cardano/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAU,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAA"}

package/dist/chains/cosmos/cosmosHrp.d.ts

@@ -0,0 +1,39 @@
+import { CosmosChain } from '../../Chain.js';
+/**
+ * Canonical Cosmos-family bech32 HRP (human-readable prefix), keyed by
+ * CHAIN-ID rather than the SDK `Chain` enum, so it covers both:
+ *
+ *   - every first-class Vultisig-supported Cosmos chain (`CosmosChain`,
+ *     resolvable to an HRP via `getCosmosChainHrp` below), and
+ *   - IBC/Skip DESTINATION chains that are valid transfer/swap targets but
+ *     have no wallet/RPC support of their own (e.g. `neutron-1`, `juno-1`,
+ *     `stargaze-1`) — these have no `CosmosChain` member to key by.
+ *
+ * Consolidates what were four independently-maintained, overlapping copies
+ * (architecture#1787): `tools/cosmos/gov.ts`'s `CHAIN_HRP`, `tools/prep/
+ * ibcTransfer.ts`'s `IBC_CHAIN_HRP`, `tools/swap/skip/skipSwap.ts`'s
+ * `COSMOS_CHAIN_HRPS`, and `tools/token/resolveContract.ts`'s
+ * `CW20_CHAIN_PREFIX`. Every entry below was cross-checked against all four
+ * source tables for the chains they had in common — no value differs across
+ * copies, so this union is a lossless merge, not a judgment call on which
+ * source wins.
+ *
+ * Deliberately does NOT absorb `utils/addressFormat.ts`'s `cosmosHRPByChain`
+ * / `cosmosValoperByChain` — those are keyed by a THIRD, different space
+ * (lowercase "canonical chain tag", not chain-id or `Chain` enum), ported
+ * 1:1 from a Go reference (`chain_prefix_extractor.go`) for cross-language
+ * parity, and cover additional chains (sei, kava, persistence, secret,
+ * crescent, qbtc) this registry has no chain-id for. Forcing that table
+ * through this one would risk silently breaking Go parity for no
+ * consolidation benefit — a real, but separately-scoped, follow-up.
+ */
+export declare const COSMOS_CHAIN_ID_HRP: Record<string, string>;
+/**
+ * Resolve the bech32 HRP for a first-class Vultisig `CosmosChain`. Throws on
+ * a registry gap (a `CosmosChain` member with no HRP entry above) rather
+ * than returning `undefined` — that's a bug in this file, not a caller
+ * error, and failing loudly here beats a confusing downstream 404/wrong-HRP
+ * address match.
+ */
+export declare function getCosmosChainHrp(chain: CosmosChain): string;
+//# sourceMappingURL=cosmosHrp.d.ts.map

package/dist/chains/cosmos/cosmosHrp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosmosHrp.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/cosmos/cosmosHrp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmBtD,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAO5D"}

package/dist/chains/cosmos/cosmosHrp.js

@@ -0,0 +1,65 @@
+import { getCosmosChainId } from './chainInfo.js';
+/**
+ * Canonical Cosmos-family bech32 HRP (human-readable prefix), keyed by
+ * CHAIN-ID rather than the SDK `Chain` enum, so it covers both:
+ *
+ *   - every first-class Vultisig-supported Cosmos chain (`CosmosChain`,
+ *     resolvable to an HRP via `getCosmosChainHrp` below), and
+ *   - IBC/Skip DESTINATION chains that are valid transfer/swap targets but
+ *     have no wallet/RPC support of their own (e.g. `neutron-1`, `juno-1`,
+ *     `stargaze-1`) — these have no `CosmosChain` member to key by.
+ *
+ * Consolidates what were four independently-maintained, overlapping copies
+ * (architecture#1787): `tools/cosmos/gov.ts`'s `CHAIN_HRP`, `tools/prep/
+ * ibcTransfer.ts`'s `IBC_CHAIN_HRP`, `tools/swap/skip/skipSwap.ts`'s
+ * `COSMOS_CHAIN_HRPS`, and `tools/token/resolveContract.ts`'s
+ * `CW20_CHAIN_PREFIX`. Every entry below was cross-checked against all four
+ * source tables for the chains they had in common — no value differs across
+ * copies, so this union is a lossless merge, not a judgment call on which
+ * source wins.
+ *
+ * Deliberately does NOT absorb `utils/addressFormat.ts`'s `cosmosHRPByChain`
+ * / `cosmosValoperByChain` — those are keyed by a THIRD, different space
+ * (lowercase "canonical chain tag", not chain-id or `Chain` enum), ported
+ * 1:1 from a Go reference (`chain_prefix_extractor.go`) for cross-language
+ * parity, and cover additional chains (sei, kava, persistence, secret,
+ * crescent, qbtc) this registry has no chain-id for. Forcing that table
+ * through this one would risk silently breaking Go parity for no
+ * consolidation benefit — a real, but separately-scoped, follow-up.
+ */
+export const COSMOS_CHAIN_ID_HRP = {
+    'phoenix-1': 'terra',
+    'columbus-5': 'terra',
+    'cosmoshub-4': 'cosmos',
+    'osmosis-1': 'osmo',
+    'kaiyo-1': 'kujira',
+    'neutron-1': 'neutron',
+    'axelar-dojo-1': 'axelar',
+    'injective-1': 'inj',
+    'juno-1': 'juno',
+    'stargaze-1': 'stars',
+    'noble-1': 'noble',
+    'akashnet-2': 'akash',
+    'dydx-mainnet-1': 'dydx',
+    'stride-1': 'stride',
+    celestia: 'celestia',
+    'thorchain-1': 'thor',
+    'mayachain-mainnet-v1': 'maya',
+    'agoric-3': 'agoric',
+};
+/**
+ * Resolve the bech32 HRP for a first-class Vultisig `CosmosChain`. Throws on
+ * a registry gap (a `CosmosChain` member with no HRP entry above) rather
+ * than returning `undefined` — that's a bug in this file, not a caller
+ * error, and failing loudly here beats a confusing downstream 404/wrong-HRP
+ * address match.
+ */
+export function getCosmosChainHrp(chain) {
+    const chainId = getCosmosChainId(chain);
+    const hrp = COSMOS_CHAIN_ID_HRP[chainId];
+    if (!hrp) {
+        throw new Error(`getCosmosChainHrp: no HRP registered for ${chain} (chainId ${chainId})`);
+    }
+    return hrp;
+}
+//# sourceMappingURL=cosmosHrp.js.map

package/dist/chains/cosmos/cosmosHrp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosmosHrp.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/chains/cosmos/cosmosHrp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,WAAW,EAAE,OAAO;IACpB,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,MAAM;IACnB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,SAAS;IACtB,eAAe,EAAE,QAAQ;IACzB,aAAa,EAAE,KAAK;IACpB,QAAQ,EAAE,MAAM;IAChB,YAAY,EAAE,OAAO;IACrB,SAAS,EAAE,OAAO;IAClB,YAAY,EAAE,OAAO;IACrB,gBAAgB,EAAE,MAAM;IACxB,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,MAAM;IACrB,sBAAsB,EAAE,MAAM;IAC9B,UAAU,EAAE,QAAQ;CACrB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAkB;IAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,aAAa,OAAO,GAAG,CAAC,CAAA;IAC3F,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/chains/utxo/tx/buildSignBitcoinFromPsbt.d.ts

@@ -1,4 +1,4 @@
-import { SignBitcoin } from '@vultisig/core-mpc/types/vultisig/keysign/v1/wasm_execute_contract_payload_pb';
+import { SignBitcoin } from '@vultisig/mpc-types/types/vultisig/keysign/v1/wasm_execute_contract_payload_pb';
 import { Network, Psbt } from 'bitcoinjs-lib';
 type BuildSignBitcoinFromPsbtInput = {
     psbt: Psbt;

package/dist/chains/utxo/tx/buildSignBitcoinFromPsbt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildSignBitcoinFromPsbt.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/utxo/tx/buildSignBitcoinFromPsbt.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,+EAA+E,CAAA;AACtF,OAAO,EAAyB,OAAO,EAAqB,IAAI,EAAkC,MAAM,eAAe,CAAA;AAiEvH,KAAK,6BAA6B,GAAG;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GAAI,mCAItC,6BAA6B,KAAG,WA8HlC,CAAA"}
+{"version":3,"file":"buildSignBitcoinFromPsbt.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/utxo/tx/buildSignBitcoinFromPsbt.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,gFAAgF,CAAA;AACvF,OAAO,EAAyB,OAAO,EAAqB,IAAI,EAAkC,MAAM,eAAe,CAAA;AAiEvH,KAAK,6BAA6B,GAAG;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,aAAa,EAAE,MAAM,CAAA;IACrB,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GAAI,mCAItC,6BAA6B,KAAG,WA8HlC,CAAA"}

package/dist/chains/utxo/tx/buildSignBitcoinFromPsbt.js

@@ -1,5 +1,5 @@
 import { create } from '@bufbuild/protobuf';
-import { BitcoinInputSchema, BitcoinOutputSchema, SignBitcoinSchema, } from '@vultisig/core-mpc/types/vultisig/keysign/v1/wasm_execute_contract_payload_pb';
+import { BitcoinInputSchema, BitcoinOutputSchema, SignBitcoinSchema, } from '@vultisig/mpc-types/types/vultisig/keysign/v1/wasm_execute_contract_payload_pb';
 import { address as btcAddress, networks, opcodes, script as bscript, Transaction } from 'bitcoinjs-lib';
 /**
  * Detect the script type from a scriptPubKey buffer.

package/dist/chains/utxo/tx/buildSignBitcoinFromPsbt.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildSignBitcoinFromPsbt.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/utxo/tx/buildSignBitcoinFromPsbt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEnB,iBAAiB,GAClB,MAAM,+EAA+E,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAW,QAAQ,EAAE,OAAO,EAAQ,MAAM,IAAI,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAKvH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAoB,EAAE,YAAyB,EAAc,EAAE;IACvF,iDAAiD;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,wFAAwF;IACxF,IACE,YAAY,CAAC,MAAM,KAAK,EAAE;QAC1B,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,EAAE,CAAC,KAAK,IAAI;QACzB,YAAY,CAAC,EAAE,CAAC,KAAK,IAAI,EACzB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,8CAA8C;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,MAAM,CAAA;IACf,CAAC;IACD,gDAAgD;IAChD,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,wEAAwE;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACnE,IACE,YAAY,CAAC,MAAM,KAAK,EAAE;QAC1B,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,EAAE,CAAC,KAAK,IAAI;QACzB,MAAM,EAAE,MAAM,KAAK,EAAE;QACrB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,sBAAsB,GAA4B,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;AAE1F,MAAM,UAAU,GAAG,CAAC,MAAc,EAAW,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,CAAA;AAC3D,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IAChE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAClD,CAAC,CAAA;AASD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,EACvC,IAAI,EACJ,aAAa,EACb,OAAO,GAAG,QAAQ,CAAC,OAAO,GACI,EAAe,EAAE;IAC/C,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5C,GAAG,CAAC,EAAE,CACJ,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;QACvD,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAChE,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAErC,iEAAiE;QACjE,IAAI,YAAoB,CAAA;QACxB,IAAI,UAAkB,CAAA;QACtB,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACxD,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAEhD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0GAA0G;YAC1G,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;gBAC5E,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;gBAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACxE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,0BAA0B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB;wBAC9E,kBAAkB,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CACpD,CAAA;gBACH,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC7C,IAAI,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,wBAAwB,UAAU,mBAAmB;wBAC9D,yBAAyB,UAAU,CAAC,KAAK,wBAAwB,CACpE,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;YAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,2CAA2C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC7C,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,8CAA8C,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,UAAU,GAAG,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAEzE,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,QAAQ,GACZ,CAAC,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YACnE,CAAC,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAEnD,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAA2B;gBACpC,IAAI,EAAE,6GAA6G;gBACnH,KAAK,EAAE,sDAAsD;gBAC7D,KAAK,EAAE,mEAAmE;gBAC1E,OAAO,EAAE,8BAA8B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;aACtE,CAAA;YACD,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,8BAA8B,UAAU,kBAAkB,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACjH,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,CAAC,CAAA,CAAC,cAAc;QAE7D,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE7G,OAAO,MAAM,CAAC,kBAAkB,EAAE;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1C,UAAU;YACV,WAAW;YACX,MAAM;YACN,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAEnC,IAAI,aAAa,GAAG,EAAE,CAAA;QACtB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,+EAA+E;QAC/E,qEAAqE;QACrE,OAAO,MAAM,CAAC,mBAAmB,EAAE;YACjC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,QAAQ,EAAE,aAAa,KAAK,EAAE,IAAI,aAAa,KAAK,aAAa;SAClE,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAC,iBAAiB,EAAE;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,OAAO;KACR,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"buildSignBitcoinFromPsbt.js","sourceRoot":"","sources":["../../../../../../../packages/core/chain/chains/utxo/tx/buildSignBitcoinFromPsbt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEnB,iBAAiB,GAClB,MAAM,gFAAgF,CAAA;AACvF,OAAO,EAAE,OAAO,IAAI,UAAU,EAAW,QAAQ,EAAE,OAAO,EAAQ,MAAM,IAAI,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAKvH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,YAAoB,EAAE,YAAyB,EAAc,EAAE;IACvF,iDAAiD;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,wFAAwF;IACxF,IACE,YAAY,CAAC,MAAM,KAAK,EAAE;QAC1B,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,EAAE,CAAC,KAAK,IAAI;QACzB,YAAY,CAAC,EAAE,CAAC,KAAK,IAAI,EACzB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,8CAA8C;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,MAAM,CAAA;IACf,CAAC;IACD,gDAAgD;IAChD,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,wEAAwE;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACnE,IACE,YAAY,CAAC,MAAM,KAAK,EAAE;QAC1B,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;QACxB,YAAY,CAAC,EAAE,CAAC,KAAK,IAAI;QACzB,MAAM,EAAE,MAAM,KAAK,EAAE;QACrB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,sBAAsB,GAA4B,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;AAE1F,MAAM,UAAU,GAAG,CAAC,MAAc,EAAW,EAAE;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,CAAA;AAC3D,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IAChE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAClD,CAAC,CAAA;AASD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,EACvC,IAAI,EACJ,aAAa,EACb,OAAO,GAAG,QAAQ,CAAC,OAAO,GACI,EAAe,EAAE;IAC/C,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5C,GAAG,CAAC,EAAE,CACJ,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;QACvD,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAChE,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAErC,iEAAiE;QACjE,IAAI,YAAoB,CAAA;QACxB,IAAI,UAAkB,CAAA;QACtB,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YAC1B,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACxD,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAEhD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0GAA0G;YAC1G,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;gBAC5E,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;gBAC/B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;gBACxE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,0BAA0B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB;wBAC9E,kBAAkB,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CACpD,CAAA;gBACH,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAC7C,IAAI,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,wBAAwB,UAAU,mBAAmB;wBAC9D,yBAAyB,UAAU,CAAC,KAAK,wBAAwB,CACpE,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;YAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,2CAA2C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC7C,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,8CAA8C,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,sBAAsB,UAAU,GAAG,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAEzE,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,QAAQ,GACZ,CAAC,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YACnE,CAAC,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAEnD,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAA2B;gBACpC,IAAI,EAAE,6GAA6G;gBACnH,KAAK,EAAE,sDAAsD;gBAC7D,KAAK,EAAE,mEAAmE;gBAC1E,OAAO,EAAE,8BAA8B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;aACtE,CAAA;YACD,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,8BAA8B,UAAU,kBAAkB,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACjH,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,CAAC,CAAA,CAAC,cAAc;QAE7D,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE7G,OAAO,MAAM,CAAC,kBAAkB,EAAE;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC1C,UAAU;YACV,WAAW;YACX,MAAM;YACN,YAAY;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAEnC,IAAI,aAAa,GAAG,EAAE,CAAA;QACtB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,+EAA+E;QAC/E,qEAAqE;QACrE,OAAO,MAAM,CAAC,mBAAmB,EAAE;YACjC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,OAAO,EAAE,aAAa;YACtB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,QAAQ,EAAE,aAAa,KAAK,EAAE,IAAI,aAAa,KAAK,aAAa;SAClE,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAC,iBAAiB,EAAE;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,OAAO;KACR,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/security/tokenTransferGuards.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Throws when a plain token-transfer `recipient` is itself a known token
+ * contract address on `chain` — most commonly the SAME token being sent to
+ * its own contract, but also catches a transfer aimed at a different known
+ * token's contract.
+ *
+ * Call this ONLY on plain-transfer recipients (a native/ERC-20 send, or a
+ * decoded ERC-20 `transfer` hidden inside an arbitrary contract-call's
+ * calldata — see `decodeErc20Recipient` below). `sendingTokenContract` is
+ * the contract address of the token actually being sent (`undefined` for a
+ * native-coin send, which this guard is a no-op for — there is no "the ETH
+ * contract" to accidentally send ETH to).
+ */
+export declare function assertSafeTokenTransferDestination(chain: string, recipient: string, sendingTokenContract: string | undefined): void;
+/**
+ * True when `data`'s selector is a plain ERC-20 `transfer`/`transferFrom` —
+ * the two calldata shapes where the call target IS the token being moved, so
+ * a recipient that is itself a known token contract strands the funds and
+ * `assertSafeTokenTransferDestination` applies. ERC-721 `safeTransferFrom`
+ * deliberately returns false: the 721 standard's on-chain `onERC721Received`
+ * check already reverts a transfer to a non-receiver contract, so extending
+ * the registry guard there would add false-positive surface without closing
+ * a loss path. Every other selector is an arbitrary contract call and stays
+ * out of scope.
+ */
+export declare function isErc20TransferCalldata(data: string): boolean;
+/**
+ * If `data` looks like an ERC-20 `transfer`/`transferFrom` (or the
+ * same-shaped ERC-721 `safeTransferFrom`) call, return the decoded recipient
+ * address (lower-cased, `0x`-prefixed). Otherwise returns `null`.
+ *
+ * A contract-call builder that sets `to = <token contract>` + `data =
+ * <encoded transfer>` must run this to check the ACTUAL recipient —
+ * otherwise a destination guard that only vets the token contract address
+ * lets the real recipient slip through unchecked.
+ *
+ * Calldata layout for `transfer(address,uint256)`:
+ *   0x00–0x04  selector (4 bytes)
+ *   0x04–0x24  recipient (32-byte padded; address in last 20 bytes)
+ *   0x24–0x44  amount
+ *
+ * For `transferFrom(address,address,uint256)` (ERC-20) and
+ * `safeTransferFrom(address,address,uint256[,bytes])` (ERC-721 — same head layout):
+ *   0x00–0x04  selector
+ *   0x04–0x24  sender
+ *   0x24–0x44  recipient
+ *   0x44–0x64  amount / tokenId
+ */
+export declare function decodeErc20Recipient(data: string): string | null;
+export declare const ERC20_APPROVE_SELECTOR = "0x095ea7b3";
+/**
+ * If `data` is an ERC-20 `approve(address spender, uint256 amount)` call,
+ * decode the SPENDER (lower-cased, `0x`-prefixed) + the raw allowance
+ * amount. Otherwise null. Mirrors `decodeErc20Recipient`'s slot math:
+ * spender = first 32-byte slot (bytes 4..36), amount = second slot (bytes
+ * 36..68).
+ */
+export declare function decodeErc20Approve(data: string): {
+    spender: string;
+    amount: bigint;
+} | null;
+/**
+ * Extract the ERC-20/721 transfer RECIPIENT from a `function_sig` + `args`
+ * shape — the alternative to raw ABI-encoded `data` some builders accept
+ * (function signature + positional args, ABI-encoded server/caller-side
+ * AFTER any pre-dispatch destination guard already ran). Without this, a
+ * transfer expressed as `function_sig: "transfer(address,uint256)"` +
+ * `args: [<recipient>, <amount>]` has no `data` for `decodeErc20Recipient`
+ * to see and a destination guard silently no-ops.
+ *
+ * Mirrors `decodeErc20Recipient`'s selector→slot mapping on the parsed
+ * signature: `transfer(address,uint256)` → `args[0]`;
+ * `transferFrom`/`safeTransferFrom(address from,address to,…)` → `args[1]`
+ * (the recipient is the SECOND address, never `from`). A non-transfer
+ * signature (or one that doesn't match either shape) → `null`.
+ */
+export declare function decodeErc20RecipientFromSig(functionSig: unknown, args: unknown): string | null;
+//# sourceMappingURL=tokenTransferGuards.d.ts.map

package/dist/security/tokenTransferGuards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenTransferGuards.d.ts","sourceRoot":"","sources":["../../../../../packages/core/chain/security/tokenTransferGuards.ts"],"names":[],"mappings":"AAuBA;;;;;;;;;;;;GAYG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,IAAI,CAiBN;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA4BhE;AAMD,eAAO,MAAM,sBAAsB,eAAe,CAAA;AAElD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe3F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAuC9F"}

package/dist/security/tokenTransferGuards.js

@@ -0,0 +1,203 @@
+import { knownTokensIndex } from '@vultisig/core-chain/coin/knownTokens';
+const EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+/**
+ * Throws when a plain token-transfer `recipient` is itself a known token
+ * contract address on `chain` — most commonly the SAME token being sent to
+ * its own contract, but also catches a transfer aimed at a different known
+ * token's contract.
+ *
+ * Call this ONLY on plain-transfer recipients (a native/ERC-20 send, or a
+ * decoded ERC-20 `transfer` hidden inside an arbitrary contract-call's
+ * calldata — see `decodeErc20Recipient` below). `sendingTokenContract` is
+ * the contract address of the token actually being sent (`undefined` for a
+ * native-coin send, which this guard is a no-op for — there is no "the ETH
+ * contract" to accidentally send ETH to).
+ */
+export function assertSafeTokenTransferDestination(chain, recipient, sendingTokenContract) {
+    if (!sendingTokenContract)
+        return;
+    const hit = knownTokensIndex[chain]?.[recipient.toLowerCase()];
+    if (!hit)
+        return;
+    const isSameToken = recipient.toLowerCase() === sendingTokenContract.toLowerCase();
+    if (isSameToken) {
+        throw new Error(`Refusing to build transaction: sending ${hit.ticker} to the ${hit.ticker} token contract ` +
+            `(${recipient}) would permanently burn it — the contract cannot credit a balance to itself. ` +
+            'Did you mean to send to a wallet address instead?');
+    }
+    throw new Error(`Refusing to build transaction: destination ${recipient} is the ${hit.ticker} token contract on ${chain}, ` +
+        'not a wallet — tokens sent to a token contract are permanently unrecoverable. ' +
+        'Did you mean to send to a wallet address instead?');
+}
+// ── ERC-20 calldata recipient decoding ───────────────────────────────────────
+const ERC20_TRANSFER_SELECTOR = '0xa9059cbb';
+const ERC20_TRANSFER_FROM_SELECTOR = '0x23b872dd';
+// ERC-721 safeTransferFrom — same recipient offset as ERC-20 transferFrom
+// (second 32-byte slot). Two overloads; both hit the same decode path:
+//   safeTransferFrom(address,address,uint256)       → 0x42842e0e (3-arg)
+//   safeTransferFrom(address,address,uint256,bytes) → 0xb88d4fde (4-arg, common in wallet SDKs)
+const ERC721_SAFE_TRANSFER_FROM_SELECTOR = '0x42842e0e';
+const ERC721_SAFE_TRANSFER_FROM_BYTES_SELECTOR = '0xb88d4fde';
+/**
+ * True when `data`'s selector is a plain ERC-20 `transfer`/`transferFrom` —
+ * the two calldata shapes where the call target IS the token being moved, so
+ * a recipient that is itself a known token contract strands the funds and
+ * `assertSafeTokenTransferDestination` applies. ERC-721 `safeTransferFrom`
+ * deliberately returns false: the 721 standard's on-chain `onERC721Received`
+ * check already reverts a transfer to a non-receiver contract, so extending
+ * the registry guard there would add false-positive surface without closing
+ * a loss path. Every other selector is an arbitrary contract call and stays
+ * out of scope.
+ */
+export function isErc20TransferCalldata(data) {
+    if (typeof data !== 'string')
+        return false;
+    const hex = data.startsWith('0x') ? data : `0x${data}`;
+    const selector = hex.slice(0, 10).toLowerCase();
+    return selector === ERC20_TRANSFER_SELECTOR || selector === ERC20_TRANSFER_FROM_SELECTOR;
+}
+/**
+ * If `data` looks like an ERC-20 `transfer`/`transferFrom` (or the
+ * same-shaped ERC-721 `safeTransferFrom`) call, return the decoded recipient
+ * address (lower-cased, `0x`-prefixed). Otherwise returns `null`.
+ *
+ * A contract-call builder that sets `to = <token contract>` + `data =
+ * <encoded transfer>` must run this to check the ACTUAL recipient —
+ * otherwise a destination guard that only vets the token contract address
+ * lets the real recipient slip through unchecked.
+ *
+ * Calldata layout for `transfer(address,uint256)`:
+ *   0x00–0x04  selector (4 bytes)
+ *   0x04–0x24  recipient (32-byte padded; address in last 20 bytes)
+ *   0x24–0x44  amount
+ *
+ * For `transferFrom(address,address,uint256)` (ERC-20) and
+ * `safeTransferFrom(address,address,uint256[,bytes])` (ERC-721 — same head layout):
+ *   0x00–0x04  selector
+ *   0x04–0x24  sender
+ *   0x24–0x44  recipient
+ *   0x44–0x64  amount / tokenId
+ */
+export function decodeErc20Recipient(data) {
+    if (typeof data !== 'string')
+        return null;
+    const hex = data.startsWith('0x') ? data : `0x${data}`;
+    if (hex.length < 10)
+        return null;
+    const selector = hex.slice(0, 10).toLowerCase();
+    let recipientSliceStart;
+    if (selector === ERC20_TRANSFER_SELECTOR) {
+        // recipient is at bytes 4..36 → hex chars 10..74, last 40 chars = addr
+        recipientSliceStart = 10;
+    }
+    else if (selector === ERC20_TRANSFER_FROM_SELECTOR ||
+        selector === ERC721_SAFE_TRANSFER_FROM_SELECTOR ||
+        selector === ERC721_SAFE_TRANSFER_FROM_BYTES_SELECTOR) {
+        // recipient is at bytes 36..68 → hex chars 74..138, last 40 chars = addr
+        recipientSliceStart = 74;
+    }
+    else {
+        return null;
+    }
+    const slotEnd = recipientSliceStart + 64;
+    if (hex.length < slotEnd)
+        return null;
+    const slot = hex.slice(recipientSliceStart, slotEnd);
+    // Recipient occupies the last 40 hex chars (rightmost 20 bytes) of the slot.
+    const addr = `0x${slot.slice(24).toLowerCase()}`;
+    if (!EVM_ADDRESS_RE.test(addr))
+        return null;
+    return addr;
+}
+// ERC-20 approve(address spender, uint256 amount) — 0x095ea7b3. The SPENDER
+// receives spend authority over the owner's tokens; a raw approve built via
+// an arbitrary contract-call path is OPAQUE (no spender decode, no
+// WYSIWYS surface) unless decoded explicitly.
+export const ERC20_APPROVE_SELECTOR = '0x095ea7b3';
+/**
+ * If `data` is an ERC-20 `approve(address spender, uint256 amount)` call,
+ * decode the SPENDER (lower-cased, `0x`-prefixed) + the raw allowance
+ * amount. Otherwise null. Mirrors `decodeErc20Recipient`'s slot math:
+ * spender = first 32-byte slot (bytes 4..36), amount = second slot (bytes
+ * 36..68).
+ */
+export function decodeErc20Approve(data) {
+    if (typeof data !== 'string')
+        return null;
+    const hex = data.startsWith('0x') ? data : `0x${data}`;
+    if (hex.slice(0, 10).toLowerCase() !== ERC20_APPROVE_SELECTOR)
+        return null;
+    // 4-byte selector + 32-byte spender + 32-byte amount = 138 hex chars incl the `0x`.
+    if (hex.length < 138)
+        return null;
+    const spender = `0x${hex.slice(10, 74).slice(24).toLowerCase()}`;
+    if (!EVM_ADDRESS_RE.test(spender))
+        return null;
+    let amount;
+    try {
+        amount = BigInt(`0x${hex.slice(74, 138)}`);
+    }
+    catch {
+        return null;
+    }
+    return { spender, amount };
+}
+/**
+ * Extract the ERC-20/721 transfer RECIPIENT from a `function_sig` + `args`
+ * shape — the alternative to raw ABI-encoded `data` some builders accept
+ * (function signature + positional args, ABI-encoded server/caller-side
+ * AFTER any pre-dispatch destination guard already ran). Without this, a
+ * transfer expressed as `function_sig: "transfer(address,uint256)"` +
+ * `args: [<recipient>, <amount>]` has no `data` for `decodeErc20Recipient`
+ * to see and a destination guard silently no-ops.
+ *
+ * Mirrors `decodeErc20Recipient`'s selector→slot mapping on the parsed
+ * signature: `transfer(address,uint256)` → `args[0]`;
+ * `transferFrom`/`safeTransferFrom(address from,address to,…)` → `args[1]`
+ * (the recipient is the SECOND address, never `from`). A non-transfer
+ * signature (or one that doesn't match either shape) → `null`.
+ */
+export function decodeErc20RecipientFromSig(functionSig, args) {
+    if (typeof functionSig !== 'string' || !Array.isArray(args))
+        return null;
+    // Accept "function transfer(address,uint256)" or "transfer(address,uint256)".
+    const m = functionSig
+        .replace(/^\s*function\s+/i, '')
+        .trim()
+        .match(/^(\w+)\s*\(([^)]*)\)$/);
+    if (!m)
+        return null;
+    const name = m[1];
+    // Strip any inline arg names ("address to" → "address") so we compare pure types.
+    const argTypes = m[2].split(',').map(t => t.trim().split(/\s+/)[0]);
+    const isUint256 = (type) => type === 'uint' || type === 'uint256';
+    let idx;
+    if (name === 'transfer' && argTypes.length === 2 && argTypes[0] === 'address' && isUint256(argTypes[1])) {
+        idx = 0; // transfer(address to, uint256 amount) — recipient is the FIRST arg
+    }
+    else if (name === 'transferFrom' &&
+        argTypes.length === 3 &&
+        argTypes[0] === 'address' &&
+        argTypes[1] === 'address' &&
+        isUint256(argTypes[2])) {
+        idx = 1; // transferFrom(address from, address to, uint256 amount) — recipient is the SECOND arg
+    }
+    else if (name === 'safeTransferFrom' &&
+        (argTypes.length === 3 || (argTypes.length === 4 && argTypes[3] === 'bytes')) &&
+        argTypes[0] === 'address' &&
+        argTypes[1] === 'address' &&
+        isUint256(argTypes[2])) {
+        idx = 1; // ERC-721 safeTransferFrom overloads — recipient is the SECOND arg
+    }
+    else {
+        return null;
+    }
+    if (args.length !== argTypes.length)
+        return null;
+    const raw = args[idx];
+    if (typeof raw !== 'string')
+        return null;
+    const addr = raw.trim().toLowerCase();
+    return EVM_ADDRESS_RE.test(addr) ? addr : null;
+}
+//# sourceMappingURL=tokenTransferGuards.js.map