@vultisig/core-mpc 1.12.1 → 1.14.0

package/dist/keysign/swap/buildLimitSwapKeysignPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildLimitSwapKeysignPayload.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/buildLimitSwapKeysignPayload.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AAYnE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAA;AAKzE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAiB7C,MAAM,MAAM,iCAAiC,GAAG;IAC9C,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,WAAW,CAAA;IACnB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;IACd,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,SAAS,CAAA;IACxB,WAAW,EAAE,SAAS,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,eAAO,MAAM,4BAA4B,GAAU,oIAahD,iCAAiC,yFA8HnC,CAAA"}

package/dist/keysign/swap/buildLimitSwapKeysignPayload.js

@@ -0,0 +1,178 @@
+import { Buffer } from 'buffer';
+import { create } from '@bufbuild/protobuf';
+import { fromChainAmountDisplay } from '@vultisig/core-chain/amount/fromChainAmountExact';
+import { Chain } from '@vultisig/core-chain/Chain';
+import { isChainOfKind } from '@vultisig/core-chain/ChainKind';
+import { getThorchainInboundAddress } from '@vultisig/core-chain/chains/cosmos/thor/getThorchainInboundAddress';
+import { getErc20Allowance } from '@vultisig/core-chain/chains/evm/erc20/getErc20Allowance';
+import { chainFeeCoin } from '@vultisig/core-chain/coin/chainFeeCoin';
+import { areEqualCoins } from '@vultisig/core-chain/coin/Coin';
+import { isFeeCoin } from '@vultisig/core-chain/coin/utils/isFeeCoin';
+import { getAdvancedSwapQueueEnabled } from '@vultisig/core-chain/swap/native/limitSwapAvailability';
+import { findLimitSwapInbound, isLimitSwapDestinationHalted, shouldBlockRuneDeposit, } from '@vultisig/core-chain/swap/native/limitSwapInbound';
+import { parseLimitSwapMemo } from '@vultisig/core-chain/swap/native/limitSwapMemo';
+import { getNativeSwapDecimals } from '@vultisig/core-chain/swap/native/utils/getNativeSwapDecimals';
+import { getChainSpecific } from '../chainSpecific/index.js';
+import { refineKeysignUtxo } from '../refine/utxo.js';
+import { getKeysignUtxoInfo } from '../utxo/getKeysignUtxoInfo.js';
+import { toCommCoin } from '../../types/utils/commCoin.js';
+import { Erc20ApprovePayloadSchema } from '../../types/vultisig/keysign/v1/erc20_approve_payload_pb.js';
+import { KeysignPayloadSchema } from '../../types/vultisig/keysign/v1/keysign_message_pb.js';
+import { THORChainSwapPayloadSchema } from '../../types/vultisig/keysign/v1/thorchain_swap_payload_pb.js';
+/**
+ * On-chain deadline for the router's `depositWithExpiry` call.
+ *
+ * This bounds when the *deposit transaction* may execute — a stale, long-
+ * unconfirmed tx cannot land later. It is NOT the resting order's lifetime: that
+ * is the memo's interval, up to 3 days, evaluated per block by THORChain. Once
+ * THORChain observes the deposit (a block or two, far inside this window) the
+ * order rests for its full memo TTL regardless of this value.
+ */
+const routerExpiryMs = 15 * 60 * 1000;
+/**
+ * Build the `KeysignPayload` for a THORChain limit order.
+ *
+ * The limit-ness always lives in the memo (`=<` vs the market `=>`); how that
+ * memo reaches the chain depends on the source asset:
+ *
+ * - **Native RUNE** — `MsgDeposit` on THORChain itself. No inbound vault and no
+ *   real destination, so `toAddress` carries the signer's own address as a
+ *   placeholder (the Cosmos signer keys off `isDeposit`, not `toAddress`).
+ * - **Native gas asset** (BTC/ETH/AVAX/…) — a plain transfer to the Asgard
+ *   inbound vault with the memo in tx `data` / `OP_RETURN`. No swap payload.
+ * - **ERC20** — the router's `depositWithExpiry(vault, asset, amount, memo,
+ *   expiry)` call, which needs `approve(router, amount)` first. Both ride one
+ *   ceremony, mirroring the market ERC20 THORChain swap. A token source signed
+ *   *without* a swap payload would fall through to a plain ERC20 transfer,
+ *   dropping the memo and stranding the tokens on the router — so it must carry
+ *   one.
+ *
+ * The swap payload is deliberately NOT attached to the first two branches, even
+ * though it would give co-signers the market path's swap review for free
+ * (sdk#1611). It is not display metadata: every signing-input resolver re-routes
+ * on its presence — UTXO takes both amount and destination from it, EVM and Tron
+ * take the destination from `vaultAddress`, and the Cosmos resolver drops the
+ * tx-body memo (`txMemo: swapPayload ? '' : memo`). Attaching one would change
+ * signed bytes on a working path to improve a display, and for RUNE it would
+ * additionally make `assertNativeSwapReadyForBroadcast` resolve a `THOR` inbound
+ * row that THORChain's own inbound list does not contain, failing the broadcast
+ * guard outright. Joining devices get the order terms from
+ * `getKeysignLimitSwapOrder` instead, which reads the memo that every branch
+ * already carries — and which, being the string THORChain executes, cannot
+ * disagree with what is signed.
+ *
+ * Fund-safety gates, all fail-closed:
+ * - The `EnableAdvSwapQueue` mimir is re-checked here, at sign time. Placement
+ *   was already gated on it, but it can flip while the user sits on Verify, and
+ *   a `=<` order on a network with the queue disabled can execute as an
+ *   unprotected market swap.
+ * - The memo must actually be a limit memo.
+ * - RUNE deposits are blocked on THORChain's global trading pause (they bypass
+ *   the per-chain inbound halt filter entirely), including when the inbound list
+ *   is unverifiable — and on a halted destination chain: with no swap payload
+ *   attached, the broadcast guard's destination-leg re-check never runs for
+ *   them, so sign time is their only destination gate.
+ * - External sources must resolve a live, non-halted, non-paused inbound row,
+ *   and the destination is taken from that same live view rather than a cache.
+ *
+ * Gas: unlike iOS, no EVM gas-limit override is applied. iOS pins a native-EVM
+ * limit deposit to 120000 to match its own market path; here both paths put the
+ * memo on `keysignPayload.memo` and neither sets a general swap payload, so both
+ * already floor at `deriveEvmGasLimit`'s 600000 data-tx limit. Forcing 120000
+ * would make the limit path diverge from the market path and risk under-gassing.
+ */
+export const buildLimitSwapKeysignPayload = async ({ fromCoin, toCoin, amount, memo, vaultId, localPartyId, fromPublicKey, toPublicKey, libType, walletCore, expectedToAmount, now = Date.now(), }) => {
+    const order = parseLimitSwapMemo(memo);
+    if (expectedToAmount !== undefined && expectedToAmount !== order.limit) {
+        throw new Error(`buildLimitSwapKeysignPayload: expectedToAmount ${expectedToAmount} disagrees with the memo's LIM ${order.limit}. ` +
+            "It must be the LIM in THORChain's 1e8 fixed point, not rescaled to the target coin's decimals.");
+    }
+    if (amount <= 0n) {
+        throw new Error('buildLimitSwapKeysignPayload: amount must be greater than 0');
+    }
+    if (!(await getAdvancedSwapQueueEnabled())) {
+        throw new Error("THORChain's advanced swap queue is disabled; a limit order placed now could execute as an unprotected market swap");
+    }
+    const fromCoinHexPublicKey = Buffer.from(fromPublicKey.data()).toString('hex');
+    const toCoinHexPublicKey = Buffer.from(toPublicKey.data()).toString('hex');
+    const isRuneDeposit = areEqualCoins(fromCoin, chainFeeCoin[Chain.THORChain]);
+    const inbounds = await getThorchainInboundAddress();
+    const { toAddress, swapPayload, approveSpender } = (() => {
+        if (isRuneDeposit) {
+            if (shouldBlockRuneDeposit(inbounds)) {
+                throw new Error('THORChain has globally paused trading (or its inbound list is unverifiable); refusing to sign a RUNE limit-order deposit');
+            }
+            if (isLimitSwapDestinationHalted({ inbounds, chain: toCoin.chain })) {
+                throw new Error(`THORChain has halted ${toCoin.chain} trading; refusing to sign a RUNE limit-order deposit whose outbound could not leave`);
+            }
+            return { toAddress: fromCoin.address };
+        }
+        const inbound = findLimitSwapInbound({ inbounds, chain: fromCoin.chain });
+        if (isFeeCoin(fromCoin)) {
+            return { toAddress: inbound.address };
+        }
+        const { router } = inbound;
+        if (!router) {
+            throw new Error(`buildLimitSwapKeysignPayload: THORChain's ${inbound.chain} inbound has no router contract, so a token deposit cannot be built`);
+        }
+        return {
+            toAddress: router,
+            approveSpender: router,
+            swapPayload: create(THORChainSwapPayloadSchema, {
+                fromAddress: fromCoin.address,
+                fromCoin: toCommCoin({ ...fromCoin, hexPublicKey: fromCoinHexPublicKey }),
+                toCoin: toCommCoin({ ...toCoin, hexPublicKey: toCoinHexPublicKey }),
+                vaultAddress: inbound.address,
+                routerAddress: router,
+                fromAmount: amount.toString(),
+                // Display-only, for the co-signer's "you receive" row. The order's real
+                // floor is the LIM inside the memo; these fields are never read here.
+                toAmountDecimal: fromChainAmountDisplay(order.limit, getNativeSwapDecimals(toCoin)),
+                toAmountLimit: '0',
+                streamingInterval: '0',
+                streamingQuantity: '0',
+                expirationTime: BigInt(Math.floor((now + routerExpiryMs) / 1000)),
+                isAffiliate: true,
+            }),
+        };
+    })();
+    let keysignPayload = create(KeysignPayloadSchema, {
+        coin: toCommCoin({ ...fromCoin, hexPublicKey: fromCoinHexPublicKey }),
+        toAmount: amount.toString(),
+        vaultLocalPartyId: localPartyId,
+        vaultPublicKeyEcdsa: vaultId,
+        libType,
+        toAddress,
+        memo,
+        utxoInfo: await getKeysignUtxoInfo(fromCoin),
+        ...(swapPayload ? { swapPayload: { case: 'thorchainSwapPayload', value: swapPayload } } : {}),
+    });
+    keysignPayload.blockchainSpecific = await getChainSpecific({
+        keysignPayload,
+        walletCore,
+        isDeposit: isRuneDeposit,
+    });
+    if (approveSpender && isChainOfKind(fromCoin.chain, 'evm') && fromCoin.id) {
+        const allowance = await getErc20Allowance({
+            chain: fromCoin.chain,
+            id: fromCoin.id,
+            address: fromCoin.address,
+            spender: approveSpender,
+        });
+        if (allowance < amount) {
+            keysignPayload.erc20ApprovePayload = create(Erc20ApprovePayloadSchema, {
+                amount: amount.toString(),
+                spender: approveSpender,
+            });
+        }
+    }
+    if (isChainOfKind(fromCoin.chain, 'utxo')) {
+        keysignPayload = await refineKeysignUtxo({
+            keysignPayload,
+            walletCore,
+            publicKey: fromPublicKey,
+        });
+    }
+    return keysignPayload;
+};
+//# sourceMappingURL=buildLimitSwapKeysignPayload.js.map

package/dist/keysign/swap/buildLimitSwapKeysignPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildLimitSwapKeysignPayload.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/buildLimitSwapKeysignPayload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oEAAoE,CAAA;AAC/G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yDAAyD,CAAA;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAA;AACpG,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,mDAAmD,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAA;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8DAA8D,CAAA;AAIpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAA;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAA;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAA;AAEtG;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA+BrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,EACjD,QAAQ,EACR,MAAM,EACN,MAAM,EACN,IAAI,EACJ,OAAO,EACP,YAAY,EACZ,aAAa,EACb,WAAW,EACX,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GACkB,EAAE,EAAE;IACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAEtC,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,kDAAkD,gBAAgB,kCAAkC,KAAK,CAAC,KAAK,IAAI;YACjH,gGAAgG,CACnG,CAAA;IACH,CAAC;IAED,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,2BAA2B,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAA;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9E,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE1E,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IAE5E,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAA;IAEnD,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,CAAC,GAIlD,EAAE;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,0HAA0H,CAC3H,CAAA;YACH,CAAC;YAED,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,CAAC,KAAK,sFAAsF,CAC3H,CAAA;YACH,CAAC;YAED,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;QACxC,CAAC;QAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAEzE,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,CAAA;QACvC,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,6CAA6C,OAAO,CAAC,KAAK,qEAAqE,CAChI,CAAA;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,MAAM;YACjB,cAAc,EAAE,MAAM;YACtB,WAAW,EAAE,MAAM,CAAC,0BAA0B,EAAE;gBAC9C,WAAW,EAAE,QAAQ,CAAC,OAAO;gBAC7B,QAAQ,EAAE,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC;gBACzE,MAAM,EAAE,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;gBACnE,YAAY,EAAE,OAAO,CAAC,OAAO;gBAC7B,aAAa,EAAE,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAC7B,wEAAwE;gBACxE,sEAAsE;gBACtE,eAAe,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBACnF,aAAa,EAAE,GAAG;gBAClB,iBAAiB,EAAE,GAAG;gBACtB,iBAAiB,EAAE,GAAG;gBACtB,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjE,WAAW,EAAE,IAAI;aAClB,CAAC;SACH,CAAA;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,IAAI,cAAc,GAAG,MAAM,CAAC,oBAAoB,EAAE;QAChD,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC;QACrE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC3B,iBAAiB,EAAE,YAAY;QAC/B,mBAAmB,EAAE,OAAO;QAC5B,OAAO;QACP,SAAS;QACT,IAAI;QACJ,QAAQ,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,sBAA+B,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAC,CAAA;IAEF,cAAc,CAAC,kBAAkB,GAAG,MAAM,gBAAgB,CAAC;QACzD,cAAc;QACd,UAAU;QACV,SAAS,EAAE,aAAa;KACzB,CAAC,CAAA;IAEF,IAAI,cAAc,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1E,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;QAEF,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;YACvB,cAAc,CAAC,mBAAmB,GAAG,MAAM,CAAC,yBAAyB,EAAE;gBACrE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,OAAO,EAAE,cAAc;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1C,cAAc,GAAG,MAAM,iBAAiB,CAAC;YACvC,cAAc;YACd,UAAU;YACV,SAAS,EAAE,aAAa;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,cAAc,CAAA;AACvB,CAAC,CAAA"}

package/dist/keysign/swap/getKeysignLimitSwapOrder.d.ts

@@ -0,0 +1,41 @@
+import { Chain } from '@vultisig/core-chain/Chain';
+import { LimitSwapExpiryHours, ParsedLimitSwapMemo } from '@vultisig/core-chain/swap/native/limitSwapMemo';
+import { KeysignPayload } from '../../types/vultisig/keysign/v1/keysign_message_pb.js';
+export type KeysignLimitSwapOrder = ParsedLimitSwapMemo & {
+    /** The buy chain, when the target asset's prefix is one this SDK can route. */
+    targetChain?: Chain;
+    /**
+     * Guaranteed-minimum received, as a decimal string in the target asset's
+     * display units. Formatted from the LIM with THORChain's 8 decimals, matching
+     * how `toAmountDecimal` is formatted for market swaps.
+     */
+    minimumReceivedDecimal: string;
+    /** The order's resting lifetime, when the interval maps to one this SDK builds. */
+    expiryHours?: LimitSwapExpiryHours;
+};
+/**
+ * Decode the limit order a keysign payload is about to place, for review.
+ *
+ * Returns `undefined` for any payload that is not a limit order, so a caller can
+ * branch on it directly.
+ *
+ * **This is how a *joining* device reviews a limit order.** The builder attaches
+ * a `swapPayload` only for ERC20 sources — RUNE and native-gas-asset orders are
+ * plain deposits — so a co-signer keying off the swap payload alone sees a
+ * generic send to an opaque address with an opaque memo, and cannot tell what is
+ * being bought, where it pays out, or at what floor.
+ *
+ * Deriving the terms from `keysignPayload.memo` fixes that uniformly, because
+ * the memo is present on every source branch. It is also the *only* trustworthy
+ * source: the memo is the exact string THORChain executes, so terms read from it
+ * cannot disagree with the order that gets signed. A display field carried
+ * alongside the memo can — it is supplied by the initiating device, and a
+ * co-signer has no way to tell a mistaken one from a malicious one.
+ *
+ * Parsing is fail-closed on a malformed memo, but a caller reviewing an
+ * arbitrary payload wants "not a limit order" rather than a throw, so a memo
+ * that does not parse is reported as not-a-limit-order. Signing still rejects it:
+ * `buildLimitSwapKeysignPayload` parses the same memo and throws.
+ */
+export declare const getKeysignLimitSwapOrder: ({ memo }: Pick<KeysignPayload, "memo">) => KeysignLimitSwapOrder | undefined;
+//# sourceMappingURL=getKeysignLimitSwapOrder.d.ts.map

package/dist/keysign/swap/getKeysignLimitSwapOrder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKeysignLimitSwapOrder.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/getKeysignLimitSwapOrder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAElD,OAAO,EAEL,oBAAoB,EAGpB,mBAAmB,EAEpB,MAAM,gDAAgD,CAAA;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAA;AASnF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG;IACxD,+EAA+E;IAC/E,WAAW,CAAC,EAAE,KAAK,CAAA;IACnB;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,CAAA;IAC9B,mFAAmF;IACnF,WAAW,CAAC,EAAE,oBAAoB,CAAA;CACnC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,wBAAwB,GAAI,UAAU,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,KAAG,qBAAqB,GAAG,SAkBzG,CAAA"}

package/dist/keysign/swap/getKeysignLimitSwapOrder.js

@@ -0,0 +1,50 @@
+import { fromChainAmountDisplay } from '@vultisig/core-chain/amount/fromChainAmountExact';
+import { Chain } from '@vultisig/core-chain/Chain';
+import { chainFeeCoin } from '@vultisig/core-chain/coin/chainFeeCoin';
+import { limitSwapExpiryHours, getLimitSwapIntervalBlocks, limitSwapMemoPrefix, parseLimitSwapMemo, } from '@vultisig/core-chain/swap/native/limitSwapMemo';
+import { thorchainAssetPrefixToChain } from '@vultisig/core-chain/swap/native/thorchainMemoAsset';
+import { attempt } from '@vultisig/lib-utils/attempt';
+/** THORChain's fixed point for pool amounts, which the memo's LIM is expressed in. */
+const thorchainDecimals = chainFeeCoin[Chain.THORChain].decimals;
+const intervalBlocksToExpiryHours = Object.freeze(Object.fromEntries(limitSwapExpiryHours.map(hours => [getLimitSwapIntervalBlocks(hours), hours])));
+/**
+ * Decode the limit order a keysign payload is about to place, for review.
+ *
+ * Returns `undefined` for any payload that is not a limit order, so a caller can
+ * branch on it directly.
+ *
+ * **This is how a *joining* device reviews a limit order.** The builder attaches
+ * a `swapPayload` only for ERC20 sources — RUNE and native-gas-asset orders are
+ * plain deposits — so a co-signer keying off the swap payload alone sees a
+ * generic send to an opaque address with an opaque memo, and cannot tell what is
+ * being bought, where it pays out, or at what floor.
+ *
+ * Deriving the terms from `keysignPayload.memo` fixes that uniformly, because
+ * the memo is present on every source branch. It is also the *only* trustworthy
+ * source: the memo is the exact string THORChain executes, so terms read from it
+ * cannot disagree with the order that gets signed. A display field carried
+ * alongside the memo can — it is supplied by the initiating device, and a
+ * co-signer has no way to tell a mistaken one from a malicious one.
+ *
+ * Parsing is fail-closed on a malformed memo, but a caller reviewing an
+ * arbitrary payload wants "not a limit order" rather than a throw, so a memo
+ * that does not parse is reported as not-a-limit-order. Signing still rejects it:
+ * `buildLimitSwapKeysignPayload` parses the same memo and throws.
+ */
+export const getKeysignLimitSwapOrder = ({ memo }) => {
+    if (!memo?.startsWith(limitSwapMemoPrefix)) {
+        return undefined;
+    }
+    const parsed = attempt(() => parseLimitSwapMemo(memo));
+    if ('error' in parsed) {
+        return undefined;
+    }
+    const { data: order } = parsed;
+    return {
+        ...order,
+        targetChain: thorchainAssetPrefixToChain[order.targetAsset.split('.')[0].toUpperCase()],
+        minimumReceivedDecimal: fromChainAmountDisplay(order.limit, thorchainDecimals),
+        expiryHours: intervalBlocksToExpiryHours[order.intervalBlocks],
+    };
+};
+//# sourceMappingURL=getKeysignLimitSwapOrder.js.map

package/dist/keysign/swap/getKeysignLimitSwapOrder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKeysignLimitSwapOrder.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/getKeysignLimitSwapOrder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EACL,oBAAoB,EAEpB,0BAA0B,EAC1B,mBAAmB,EAEnB,kBAAkB,GACnB,MAAM,gDAAgD,CAAA;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAA;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAIrD,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAA;AAEhE,MAAM,2BAA2B,GAA4D,MAAM,CAAC,MAAM,CACxG,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAClG,CAAA;AAeD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,EAAE,IAAI,EAAgC,EAAqC,EAAE;IACpH,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;IAE9B,OAAO;QACL,GAAG,KAAK;QACR,WAAW,EAAE,2BAA2B,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvF,sBAAsB,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAC9E,WAAW,EAAE,2BAA2B,CAAC,KAAK,CAAC,cAAc,CAAC;KAC/D,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/core-mpc",
-  "version": "1.12.1",
+  "version": "1.14.0",
   "description": "MPC, keysign, and vault types shared across Vultisig clients",
   "license": "MIT",
   "repository": {
@@ -591,11 +591,21 @@
       "import": "./dist/keysign/swap/build.js",
       "default": "./dist/keysign/swap/build.js"
     },
+    "./keysign/swap/buildLimitSwapKeysignPayload": {
+      "types": "./dist/keysign/swap/buildLimitSwapKeysignPayload.d.ts",
+      "import": "./dist/keysign/swap/buildLimitSwapKeysignPayload.js",
+      "default": "./dist/keysign/swap/buildLimitSwapKeysignPayload.js"
+    },
     "./keysign/swap/cowswap/buildCowSwapApprovalSigningInput": {
       "types": "./dist/keysign/swap/cowswap/buildCowSwapApprovalSigningInput.d.ts",
       "import": "./dist/keysign/swap/cowswap/buildCowSwapApprovalSigningInput.js",
       "default": "./dist/keysign/swap/cowswap/buildCowSwapApprovalSigningInput.js"
     },
+    "./keysign/swap/getKeysignLimitSwapOrder": {
+      "types": "./dist/keysign/swap/getKeysignLimitSwapOrder.d.ts",
+      "import": "./dist/keysign/swap/getKeysignLimitSwapOrder.js",
+      "default": "./dist/keysign/swap/getKeysignLimitSwapOrder.js"
+    },
     "./keysign/swap/getKeysignSwapPayload": {
       "types": "./dist/keysign/swap/getKeysignSwapPayload.d.ts",
       "import": "./dist/keysign/swap/getKeysignSwapPayload.js",
@@ -1063,13 +1073,13 @@
   },
   "dependencies": {
     "7z-wasm": "^1.2.0",
-    "@bufbuild/protobuf": "^2.12.0",
+    "@bufbuild/protobuf": "^2.13.0",
     "@cosmjs/encoding": "^0.39.0",
-    "@mysten/sui": "^2.20.3",
+    "@mysten/sui": "^2.22.1",
     "@noble/hashes": "^1.8.0",
     "@solana/web3.js": "^1.98.4",
     "@trustwallet/wallet-core": "^4.7.0",
-    "@vultisig/core-chain": "2.27.0",
+    "@vultisig/core-chain": "2.29.0",
     "@vultisig/core-config": "0.9.1",
     "@vultisig/lib-dkls": "0.9.0",
     "@vultisig/lib-mldsa": "0.9.0",