@vultisig/core-mpc 1.16.1 → 1.17.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @vultisig/core-mpc
 
+## 1.17.0
+
+### Minor Changes
+
+- [#1696](https://github.com/vultisig/vultisig-sdk/pull/1696) [`37d7044`](https://github.com/vultisig/vultisig-sdk/commit/37d7044e33d475ddce93b91ff6295d55490052b4) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - Limit-order cancellation, end to end: a full-form memo asset, a cancel keysign payload builder, and cancel-aware review for co-signers.
+
+  The primitives shipped earlier could describe a cancellation but not send one, and a device joining the ceremony could not read one at all. These are the three pieces that close that.
+
+  `getThorchainCancelMemoAsset` emits the spelling a cancel requires — the same notation as the placement path, minus the abbreviation. That difference is the entire point: `ModifyLimitSwapMemo` is the one inbound memo type `processOneTxIn` does not route through `fuzzyAssetMatch`, so a placement's six-character contract suffix would address a bucket holding no order. `buildCancelLimitSwapMemo` already refused abbreviated assets, which meant there was previously no supported way to produce an input it would accept for a token leg. Both spellings now share one converter and one set of validation rules, so they cannot drift apart in anything but the abbreviation. `getThorchainMemoAssetChain` resolves a memo asset back to its home chain across every flavour, including the secured denoms that a `.`-split would fail to resolve at all.
+
+  `buildLimitSwapCancelKeysignPayload` turns that memo into a signable transaction, branching on where the order was funded: a THORChain source becomes a `MsgDeposit` carrying no value, and an L1 source a transfer to the live Asgard inbound with derived dust attached solely so Bifrost observes it. The signing asset is the funding chain's **gas** asset, never the order's own — a cancel moves no tokens, and a token here would build an ERC20 transfer that drops the memo entirely. Every gate fails closed: a retarget (`m=<` with a non-zero final field) is refused rather than signed as a cancellation, a memo that overflows the source chain's budget is refused rather than truncated into one matching nothing, and the destination is taken from a live inbound view rather than a cache.
+
+  The signing coin's chain is checked against the memo's, too. The two arrive as independent parameters, so a caller reaching for "the vault's ETH coin" while holding a BTC-sourced memo would otherwise get a payload that builds, signs and broadcasts cleanly — and is then refunded by THORChain's `From.IsChain(Source.Asset.GetChain())` check, leaving a successful-looking transaction that cancelled nothing. The funding chain is derived from the memo rather than cross-checked against a second parameter, so there is one authority for it. `getThorchainMemoAssetSourceChain` supplies that with `GetChain()` semantics rather than the asset's home chain: a secured or synth source is custodied on THORChain and must be sent from a THOR address even though it originates elsewhere.
+
+  The `EnableAdvSwapQueue` mimir is deliberately _not_ re-checked here, unlike at placement. That gate protects a new order from executing as an unprotected market swap, a risk a cancel does not carry; refusing to close an already-resting position because the queue stopped accepting new ones would strand it for the remainder of its TTL with no way out.
+
+  `getKeysignLimitSwapCancel` and `parseCancelLimitSwapMemo` give a joining device the order being closed, decoded from the memo. A cancel carries no swap payload on any branch, so a co-signer keying off one previously saw a dust transfer to an opaque address — worse than uninformative, since a trivial amount reads as harmless while the transaction closes a position. As with placement, the terms come from the memo because the memo is the instruction THORChain executes, so what a reviewer sees cannot disagree with what gets signed. A retarget is reported as not-a-cancellation rather than mislabelled, and the reproduced bucket key travels alongside so a reviewer holding the vault's open orders can tell whether the cancel is unambiguous.
+
+  `getThorchainCancelMemoAsset` emits its asset UPPER-CASED, unlike the coin's own contract id. Case is not semantic to THORNode — `common.ParseAsset` upper-cases whatever it is given, and the queue index key is built from an upper-cased asset — but it is semantic to this package's pool-id validation, which cancel eligibility routes through to size the memo against its source chain. In the contract's native lower case, every ERC20-funded order reads as an unroutable source chain and becomes uncancellable.
+
+### Patch Changes
+
+- Updated dependencies [[`7d2a91d`](https://github.com/vultisig/vultisig-sdk/commit/7d2a91de80a297c6db6b2fe2e9db41ace609c822), [`37d7044`](https://github.com/vultisig/vultisig-sdk/commit/37d7044e33d475ddce93b91ff6295d55490052b4)]:
+  - @vultisig/core-chain@2.32.0
+
+## 1.16.2
+
+### Patch Changes
+
+- [#1756](https://github.com/vultisig/vultisig-sdk/pull/1756) [`fbc5b44`](https://github.com/vultisig/vultisig-sdk/commit/fbc5b4445e102534eb434d7cabcd6fe8d633b391) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - Allow native swaps whose source is the protocol's own chain (RUNE on THORChain, CACAO on MayaChain) past the broadcast guard: those routes are MsgDeposits with no inbound vault and never appear in /inbound_addresses, so the inbound-existence and vault-address checks are skipped for them while quote-expiry and trading-halt checks still run.
+
+- Updated dependencies [[`67667fe`](https://github.com/vultisig/vultisig-sdk/commit/67667fe61a8dd85d40c1b91978da5414987cab6c), [`fb601d5`](https://github.com/vultisig/vultisig-sdk/commit/fb601d5ad6f6e6a7089ca449ee24bc5c1d7b82f9)]:
+  - @vultisig/core-chain@2.31.2
+
 ## 1.16.1
 
 ### Patch Changes

package/dist/keysign/swap/assertNativeSwapReadyForBroadcast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assertNativeSwapReadyForBroadcast.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/assertNativeSwapReadyForBroadcast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oEAAoE,CAAA;AAC3E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,kDAAkD,CAAA;AAIzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAA;AAGxF,KAAK,6BAA6B,GAAG,CAAC,WAAW,EAAE,eAAe,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAA;AAEzG,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,KAAK,CAAA;IACZ,cAAc,EAAE,cAAc,CAAA;IAC9B,mBAAmB,CAAC,EAAE,6BAA6B,CAAA;IACnD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,iCAAiC,GACzC,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,mBAAmB,CAAA;AAEvB,qBAAa,6BAA8B,SAAQ,KAAK;IAEpD,QAAQ,CAAC,IAAI,EAAE,iCAAiC;gBAAvC,IAAI,EAAE,iCAAiC,EAChD,OAAO,EAAE,MAAM;CAKlB;AAUD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,GAAU,sDAKrD,6BAA6B,KAAG,OAAO,CAAC,IAAI,CAqG9C,CAAA"}
+{"version":3,"file":"assertNativeSwapReadyForBroadcast.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/assertNativeSwapReadyForBroadcast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oEAAoE,CAAA;AAC3E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,kDAAkD,CAAA;AAIzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAA;AAGxF,KAAK,6BAA6B,GAAG,CAAC,WAAW,EAAE,eAAe,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAA;AAEzG,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,KAAK,CAAA;IACZ,cAAc,EAAE,cAAc,CAAA;IAC9B,mBAAmB,CAAC,EAAE,6BAA6B,CAAA;IACnD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,iCAAiC,GACzC,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,mBAAmB,CAAA;AAEvB,qBAAa,6BAA8B,SAAQ,KAAK;IAEpD,QAAQ,CAAC,IAAI,EAAE,iCAAiC;gBAAvC,IAAI,EAAE,iCAAiC,EAChD,OAAO,EAAE,MAAM;CAKlB;AAUD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,GAAU,sDAKrD,6BAA6B,KAAG,OAAO,CAAC,IAAI,CAmH9C,CAAA"}

package/dist/keysign/swap/assertNativeSwapReadyForBroadcast.js

@@ -58,8 +58,15 @@ export const assertNativeSwapReadyForBroadcast = async ({ chain, keysignPayload,
         throw new NativeSwapBroadcastGuardError('network_error', `Cannot fetch ${native.chain} inbound vaults for source chain ${sourceChainId}`);
     }
     const inboundByChainId = new Map(inboundAddresses.map(info => [info.chain.toUpperCase(), info]));
+    // sdk#1726: a swap whose SOURCE is the protocol's own chain (RUNE on THORChain, CACAO on
+    // MayaChain) is a MsgDeposit straight to the network - it has no inbound vault, and
+    // /inbound_addresses only lists external chains, so the lookup below is undefined by design.
+    // Skip the inbound-existence and vault-address checks for those routes (the same tolerance the
+    // halt loop below already applies); quote expiry and the halt checks still run. A RUNE source
+    // routed VIA Maya is NOT exempt: Maya's feed lists THOR as an external chain.
+    const sourceIsProtocolChain = chain === native.chain;
     const activeInbound = inboundByChainId.get(sourceChainId.toUpperCase());
-    if (!activeInbound?.address) {
+    if (!sourceIsProtocolChain && !activeInbound?.address) {
         throw new NativeSwapBroadcastGuardError('network_error', `Cannot validate ${native.chain} inbound vault for source chain ${sourceChainId}`);
     }
     // sdk#1360: re-check the trading-halt flags at BROADCAST, not only at quote time
@@ -89,7 +96,12 @@ export const assertNativeSwapReadyForBroadcast = async ({ chain, keysignPayload,
                 `refusing to broadcast into a halted chain`);
         }
     }
-    if (activeInbound.address.toLowerCase() !== native.vaultAddress.toLowerCase()) {
+    // MsgDeposit payloads carry no vault address, so the staleness comparison is meaningless for
+    // protocol-chain sources even if the feed ever grew a THOR/MAYA entry.
+    if (sourceIsProtocolChain) {
+        return;
+    }
+    if (!activeInbound?.address || activeInbound.address.toLowerCase() !== native.vaultAddress.toLowerCase()) {
         throw new NativeSwapBroadcastGuardError('invalid_vault', `${native.chain} inbound vault address changed; refresh the swap quote before broadcasting`);
     }
 };

package/dist/keysign/swap/assertNativeSwapReadyForBroadcast.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertNativeSwapReadyForBroadcast.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/assertNativeSwapReadyForBroadcast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EACL,0BAA0B,GAE3B,MAAM,oEAAoE,CAAA;AAC3E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAA;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAG7D,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAiBzF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAE3C;IADX,YACW,IAAuC,EAChD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,SAAI,GAAJ,IAAI,CAAmC;QAIhD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;IAC7C,CAAC;CACF;AAED,MAAM,oCAAoC,GAAkC,WAAW,CAAC,EAAE;IACxF,IAAI,WAAW,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,0BAA0B,EAAE,CAAA;IACrC,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,EAAE,EACtD,KAAK,EACL,cAAc,EACd,mBAAmB,GAAG,oCAAoC,EAC1D,GAAG,GAAG,IAAI,CAAC,GAAG,GACgB,EAAiB,EAAE;IACjD,MAAM,WAAW,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAM;IACR,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAA;IAC9B,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAChE,OAAM;IACR,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAEvD,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,6BAA6B,CACrC,gBAAgB,EAChB,8FAA8F,CAC/F,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,IAAI,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,6BAA6B,CACrC,gBAAgB,EAChB,qEAAqE,CACtE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACzE,OAAM;IACR,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,6BAA6B,CACrC,mBAAmB,EACnB,mBAAmB,MAAM,CAAC,KAAK,+CAA+C,KAAK,EAAE,CACtF,CAAA;IACH,CAAC;IAED,IAAI,gBAA2C,CAAA;IAC/C,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,gBAAgB,MAAM,CAAC,KAAK,oCAAoC,aAAa,EAAE,CAChF,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAEhG,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAA;IAEvE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,mBAAmB,MAAM,CAAC,KAAK,mCAAmC,aAAa,EAAE,CAClF,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,6FAA6F;IAC7F,8FAA8F;IAC9F,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,gGAAgG;IAChG,sGAAsG;IACtG,kGAAkG;IAClG,mGAAmG;IACnG,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAA;IAC7C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,gBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzG,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrF,MAAM,aAAa,GAAG,iBAAiB,CACrC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/G,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,mBAAmB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,6BAA6B,CACrC,gBAAgB,EAChB,GAAG,MAAM,CAAC,KAAK,0BAA0B,OAAO,YAAY,OAAO,CAAC,MAAM,IAAI;gBAC5E,iBAAiB,mBAAmB,kBAAkB,OAAO,CAAC,oBAAoB,KAAK;gBACvF,2CAA2C,CAC9C,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,GAAG,MAAM,CAAC,KAAK,4EAA4E,CAC5F,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"assertNativeSwapReadyForBroadcast.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/assertNativeSwapReadyForBroadcast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EACL,0BAA0B,GAE3B,MAAM,oEAAoE,CAAA;AAC3E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GAErB,MAAM,kDAAkD,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAA;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAA;AAG7D,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAiBzF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAE3C;IADX,YACW,IAAuC,EAChD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,SAAI,GAAJ,IAAI,CAAmC;QAIhD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;IAC7C,CAAC;CACF;AAED,MAAM,oCAAoC,GAAkC,WAAW,CAAC,EAAE;IACxF,IAAI,WAAW,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,0BAA0B,EAAE,CAAA;IACrC,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,KAAK,EAAE,EACtD,KAAK,EACL,cAAc,EACd,mBAAmB,GAAG,oCAAoC,EAC1D,GAAG,GAAG,IAAI,CAAC,GAAG,GACgB,EAAiB,EAAE;IACjD,MAAM,WAAW,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAM;IACR,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAA;IAC9B,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAChE,OAAM;IACR,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAEvD,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,6BAA6B,CACrC,gBAAgB,EAChB,8FAA8F,CAC/F,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,IAAI,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,6BAA6B,CACrC,gBAAgB,EAChB,qEAAqE,CACtE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACzE,OAAM;IACR,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACjD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,6BAA6B,CACrC,mBAAmB,EACnB,mBAAmB,MAAM,CAAC,KAAK,+CAA+C,KAAK,EAAE,CACtF,CAAA;IACH,CAAC;IAED,IAAI,gBAA2C,CAAA;IAC/C,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,gBAAgB,MAAM,CAAC,KAAK,oCAAoC,aAAa,EAAE,CAChF,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAEhG,yFAAyF;IACzF,oFAAoF;IACpF,6FAA6F;IAC7F,+FAA+F;IAC/F,8FAA8F;IAC9F,8EAA8E;IAC9E,MAAM,qBAAqB,GAAG,KAAK,KAAK,MAAM,CAAC,KAAK,CAAA;IAEpD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAA;IAEvE,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,mBAAmB,MAAM,CAAC,KAAK,mCAAmC,aAAa,EAAE,CAClF,CAAA;IACH,CAAC;IAED,iFAAiF;IACjF,6FAA6F;IAC7F,8FAA8F;IAC9F,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,gGAAgG;IAChG,sGAAsG;IACtG,kGAAkG;IAClG,mGAAmG;IACnG,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAA;IAC7C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,CAAC,gBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzG,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrF,MAAM,aAAa,GAAG,iBAAiB,CACrC,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/G,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,mBAAmB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,6BAA6B,CACrC,gBAAgB,EAChB,GAAG,MAAM,CAAC,KAAK,0BAA0B,OAAO,YAAY,OAAO,CAAC,MAAM,IAAI;gBAC5E,iBAAiB,mBAAmB,kBAAkB,OAAO,CAAC,oBAAoB,KAAK;gBACvF,2CAA2C,CAC9C,CAAA;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,uEAAuE;IACvE,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACzG,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,GAAG,MAAM,CAAC,KAAK,4EAA4E,CAC5F,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}

package/dist/keysign/swap/buildLimitSwapCancelKeysignPayload.d.ts

@@ -0,0 +1,66 @@
+import { AccountCoin } from '@vultisig/core-chain/coin/AccountCoin';
+import { WalletCore } from '@trustwallet/wallet-core';
+import { PublicKey } from '@trustwallet/wallet-core/dist/src/wallet-core';
+import { KeysignLibType } from '../../mpcLib.js';
+export type BuildLimitSwapCancelKeysignPayloadInput = {
+    /**
+     * The gas asset of the chain the order was FUNDED FROM — never the order's own
+     * asset. A cancel moves no tokens: it is a memo, carried by whatever the source
+     * chain charges to carry one. A BTC-funded order cancels with BTC; an
+     * ERC20-funded one cancels with ETH, not with the token.
+     */
+    signingCoin: AccountCoin;
+    /** The `m=<` memo from `buildCancelLimitSwapMemo`. */
+    memo: string;
+    vaultId: string;
+    localPartyId: string;
+    publicKey: PublicKey;
+    libType: KeysignLibType;
+    walletCore: WalletCore;
+};
+/**
+ * Build the `KeysignPayload` that cancels a resting THORChain limit order.
+ *
+ * Two branches, decided by where the order was funded:
+ *
+ * - **THORChain source** (RUNE, and THORChain-held assets) — `MsgDeposit` from
+ *   the vault's own THOR address. No inbound vault and no real destination, so
+ *   `toAddress` carries the signer's own address as a placeholder (the Cosmos
+ *   signer keys off `isDeposit`, not `toAddress`) and no value is attached.
+ * - **L1 source** — a plain transfer to the chain's Asgard inbound vault with the
+ *   memo attached. The amount is dust from `getLimitSwapCancelDust`, present
+ *   solely so Bifrost observes the transaction; it is not a payment, and the
+ *   router is deliberately not involved even for an ERC20-funded order, because
+ *   `depositWithExpiry` exists to move tokens and a cancel moves none.
+ *
+ * Fund-safety gates, all fail-closed — a cancel that is accepted but matches
+ * nothing is indistinguishable from success, so every unknown refuses:
+ *
+ * - The memo must actually CANCEL. `m=<` with a non-zero final field re-prices a
+ *   resting order instead of closing it, and must not be signed by a function
+ *   whose callers believe they are cancelling.
+ * - The signing coin's chain must be the chain the memo says funded the order.
+ *   These arrive as independent parameters, so a caller reaching for "the
+ *   vault's ETH coin" while holding a BTC-sourced memo would otherwise get a
+ *   payload that broadcasts cleanly and is then refunded by THORChain's
+ *   `From.IsChain(Source.Asset.GetChain())` check — a successful-looking
+ *   transaction that cancels nothing.
+ * - The memo must fit the source chain's per-transaction budget. A cancel cannot
+ *   be shortened — its amounts define the bucket and its assets skip
+ *   `fuzzyAssetMatch` — so an over-long one has to be refused here rather than
+ *   silently truncated into a memo addressing nothing.
+ * - A THORChain-sourced cancel is blocked on THORChain's global trading pause,
+ *   including when the inbound list is unverifiable, exactly as placement is.
+ * - An L1 cancel must resolve a live, non-halted, non-paused inbound, and takes
+ *   its destination from that same live view rather than a cache. A cancel sent
+ *   to a churned-away vault is as lost as a placement would be.
+ *
+ * Note what is NOT gated: the `EnableAdvSwapQueue` mimir, which placement does
+ * re-check at sign time. That gate protects a NEW `=<` order from executing as an
+ * unprotected market swap — a risk a cancel does not carry. Refusing to close an
+ * already-resting order because the queue stopped accepting new ones would strand
+ * a position for the remainder of its TTL with no way out, which is the worse
+ * failure of the two.
+ */
+export declare const buildLimitSwapCancelKeysignPayload: ({ signingCoin, memo, vaultId, localPartyId, publicKey, libType, walletCore, }: BuildLimitSwapCancelKeysignPayloadInput) => Promise<import("../../types/vultisig/keysign/v1/keysign_message_pb.js").KeysignPayload>;
+//# sourceMappingURL=buildLimitSwapCancelKeysignPayload.d.ts.map

package/dist/keysign/swap/buildLimitSwapCancelKeysignPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildLimitSwapCancelKeysignPayload.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/buildLimitSwapCancelKeysignPayload.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAA;AAWnE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAA;AAKzE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAI7C,MAAM,MAAM,uCAAuC,GAAG;IACpD;;;;;OAKG;IACH,WAAW,EAAE,WAAW,CAAA;IACxB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,SAAS,CAAA;IACpB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,kCAAkC,GAAU,+EAQtD,uCAAuC,yFAyGzC,CAAA"}

package/dist/keysign/swap/buildLimitSwapCancelKeysignPayload.js

@@ -0,0 +1,139 @@
+import { Buffer } from 'buffer';
+import { create } from '@bufbuild/protobuf';
+import { Chain } from '@vultisig/core-chain/Chain';
+import { isChainOfKind } from '@vultisig/core-chain/ChainKind';
+import { getThorchainInboundAddress } from '@vultisig/core-chain/chains/cosmos/thor/getThorchainInboundAddress';
+import { isFeeCoin } from '@vultisig/core-chain/coin/utils/isFeeCoin';
+import { getLimitSwapCancelDust } from '@vultisig/core-chain/swap/native/limitSwapCancelDust';
+import { doesCancelLimitSwapMemoFit, isCancelLimitSwapMemo, isModifyLimitSwapMemo, parseCancelLimitSwapMemo, } from '@vultisig/core-chain/swap/native/limitSwapCancelMemo';
+import { findLimitSwapInbound, shouldBlockRuneDeposit } from '@vultisig/core-chain/swap/native/limitSwapInbound';
+import { getThorchainMemoAssetSourceChain } from '@vultisig/core-chain/swap/native/thorchainMemoAsset';
+import { getChainSpecific } from '../chainSpecific/index.js';
+import { refineKeysignUtxo } from '../refine/utxo.js';
+import { getKeysignUtxoInfo } from '../utxo/getKeysignUtxoInfo.js';
+import { toCommCoin } from '../../types/utils/commCoin.js';
+import { KeysignPayloadSchema } from '../../types/vultisig/keysign/v1/keysign_message_pb.js';
+/**
+ * Build the `KeysignPayload` that cancels a resting THORChain limit order.
+ *
+ * Two branches, decided by where the order was funded:
+ *
+ * - **THORChain source** (RUNE, and THORChain-held assets) — `MsgDeposit` from
+ *   the vault's own THOR address. No inbound vault and no real destination, so
+ *   `toAddress` carries the signer's own address as a placeholder (the Cosmos
+ *   signer keys off `isDeposit`, not `toAddress`) and no value is attached.
+ * - **L1 source** — a plain transfer to the chain's Asgard inbound vault with the
+ *   memo attached. The amount is dust from `getLimitSwapCancelDust`, present
+ *   solely so Bifrost observes the transaction; it is not a payment, and the
+ *   router is deliberately not involved even for an ERC20-funded order, because
+ *   `depositWithExpiry` exists to move tokens and a cancel moves none.
+ *
+ * Fund-safety gates, all fail-closed — a cancel that is accepted but matches
+ * nothing is indistinguishable from success, so every unknown refuses:
+ *
+ * - The memo must actually CANCEL. `m=<` with a non-zero final field re-prices a
+ *   resting order instead of closing it, and must not be signed by a function
+ *   whose callers believe they are cancelling.
+ * - The signing coin's chain must be the chain the memo says funded the order.
+ *   These arrive as independent parameters, so a caller reaching for "the
+ *   vault's ETH coin" while holding a BTC-sourced memo would otherwise get a
+ *   payload that broadcasts cleanly and is then refunded by THORChain's
+ *   `From.IsChain(Source.Asset.GetChain())` check — a successful-looking
+ *   transaction that cancels nothing.
+ * - The memo must fit the source chain's per-transaction budget. A cancel cannot
+ *   be shortened — its amounts define the bucket and its assets skip
+ *   `fuzzyAssetMatch` — so an over-long one has to be refused here rather than
+ *   silently truncated into a memo addressing nothing.
+ * - A THORChain-sourced cancel is blocked on THORChain's global trading pause,
+ *   including when the inbound list is unverifiable, exactly as placement is.
+ * - An L1 cancel must resolve a live, non-halted, non-paused inbound, and takes
+ *   its destination from that same live view rather than a cache. A cancel sent
+ *   to a churned-away vault is as lost as a placement would be.
+ *
+ * Note what is NOT gated: the `EnableAdvSwapQueue` mimir, which placement does
+ * re-check at sign time. That gate protects a NEW `=<` order from executing as an
+ * unprotected market swap — a risk a cancel does not carry. Refusing to close an
+ * already-resting order because the queue stopped accepting new ones would strand
+ * a position for the remainder of its TTL with no way out, which is the worse
+ * failure of the two.
+ */
+export const buildLimitSwapCancelKeysignPayload = async ({ signingCoin, memo, vaultId, localPartyId, publicKey, libType, walletCore, }) => {
+    if (!isCancelLimitSwapMemo(memo)) {
+        throw new Error(isModifyLimitSwapMemo(memo)
+            ? `buildLimitSwapCancelKeysignPayload: memo re-targets a limit order rather than cancelling it: ${JSON.stringify(memo)}`
+            : `buildLimitSwapCancelKeysignPayload: memo is not a THORChain limit-order cancel: ${JSON.stringify(memo)}`);
+    }
+    // Both branches spend gas and move nothing, so a token here means the caller
+    // passed the order's own asset rather than the funding chain's gas asset —
+    // which on an EVM chain would build an ERC20 transfer that drops the memo.
+    if (!isFeeCoin(signingCoin)) {
+        throw new Error(`buildLimitSwapCancelKeysignPayload: a cancel must be signed with ${signingCoin.chain}'s gas asset, got ${signingCoin.ticker}`);
+    }
+    // The coin and the memo arrive as independent parameters, and nothing above
+    // ties them together — so a caller that reaches for "the vault's ETH coin"
+    // while holding a BTC-sourced memo gets a payload that builds, signs and
+    // broadcasts cleanly. THORChain then refuses it at
+    // `MsgModifyLimitSwap.ValidateBasic`, which requires
+    // `From.IsChain(Source.Asset.GetChain())`, and refunds: a successful-looking
+    // transaction that cancels nothing, which is precisely the failure every other
+    // gate here exists to prevent.
+    //
+    // Derived from the memo rather than cross-checked against a second parameter,
+    // so there is one authority for which chain sends, and `GetChain()` semantics
+    // rather than the asset's home chain — a secured or synth source is custodied
+    // on THORChain and must be sent from a THOR address even though it originates
+    // elsewhere.
+    const sourceChain = getThorchainMemoAssetSourceChain(parseCancelLimitSwapMemo(memo).sourceAsset);
+    if (sourceChain === undefined) {
+        throw new Error(`buildLimitSwapCancelKeysignPayload: cannot resolve which chain must send this cancel from its memo: ${JSON.stringify(memo)}`);
+    }
+    if (sourceChain !== signingCoin.chain) {
+        throw new Error(`buildLimitSwapCancelKeysignPayload: this order was funded on ${sourceChain}, so its cancel must be sent from ${sourceChain}, not ${signingCoin.chain}`);
+    }
+    const isThorchainSource = sourceChain === Chain.THORChain;
+    if (!doesCancelLimitSwapMemoFit(memo, isChainOfKind(signingCoin.chain, 'utxo') ? 'utxo' : 'other')) {
+        throw new Error(`buildLimitSwapCancelKeysignPayload: the cancel memo does not fit ${signingCoin.chain}'s memo budget: ${JSON.stringify(memo)}`);
+    }
+    const hexPublicKey = Buffer.from(publicKey.data()).toString('hex');
+    const inbounds = await getThorchainInboundAddress();
+    const { toAddress, amount } = (() => {
+        if (isThorchainSource) {
+            if (shouldBlockRuneDeposit(inbounds)) {
+                throw new Error('THORChain has globally paused trading (or its inbound list is unverifiable); refusing to sign a limit-order cancel');
+            }
+            // A MsgDeposit carries no value for a cancel — the memo is the whole
+            // instruction — and the Cosmos signer routes on `isDeposit`, not on this
+            // address.
+            return { toAddress: signingCoin.address, amount: 0n };
+        }
+        const inbound = findLimitSwapInbound({ inbounds, chain: signingCoin.chain });
+        return {
+            toAddress: inbound.address,
+            amount: getLimitSwapCancelDust({ inbound, decimals: signingCoin.decimals }),
+        };
+    })();
+    let keysignPayload = create(KeysignPayloadSchema, {
+        coin: toCommCoin({ ...signingCoin, hexPublicKey }),
+        toAmount: amount.toString(),
+        vaultLocalPartyId: localPartyId,
+        vaultPublicKeyEcdsa: vaultId,
+        libType,
+        toAddress,
+        memo,
+        utxoInfo: await getKeysignUtxoInfo(signingCoin),
+    });
+    keysignPayload.blockchainSpecific = await getChainSpecific({
+        keysignPayload,
+        walletCore,
+        isDeposit: isThorchainSource,
+    });
+    if (isChainOfKind(signingCoin.chain, 'utxo')) {
+        keysignPayload = await refineKeysignUtxo({
+            keysignPayload,
+            walletCore,
+            publicKey,
+        });
+    }
+    return keysignPayload;
+};
+//# sourceMappingURL=buildLimitSwapCancelKeysignPayload.js.map

package/dist/keysign/swap/buildLimitSwapCancelKeysignPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildLimitSwapCancelKeysignPayload.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/buildLimitSwapCancelKeysignPayload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oEAAoE,CAAA;AAE/G,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sDAAsD,CAAA;AAC7F,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAA;AAChH,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAA;AAItG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAA;AAmBzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,EAAE,EACvD,WAAW,EACX,IAAI,EACJ,OAAO,EACP,YAAY,EACZ,SAAS,EACT,OAAO,EACP,UAAU,GAC8B,EAAE,EAAE;IAC5C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,qBAAqB,CAAC,IAAI,CAAC;YACzB,CAAC,CAAC,gGAAgG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;YACxH,CAAC,CAAC,mFAAmF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,oEAAoE,WAAW,CAAC,KAAK,qBAAqB,WAAW,CAAC,MAAM,EAAE,CAC/H,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,mDAAmD;IACnD,qDAAqD;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,+BAA+B;IAC/B,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,aAAa;IACb,MAAM,WAAW,GAAG,gCAAgC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAA;IAEhG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,uGAAuG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC9H,CAAA;IACH,CAAC;IAED,IAAI,WAAW,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,WAAW,qCAAqC,WAAW,SAAS,WAAW,CAAC,KAAK,EAAE,CACxJ,CAAA;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,KAAK,KAAK,CAAC,SAAS,CAAA;IAEzD,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CACb,oEAAoE,WAAW,CAAC,KAAK,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/H,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAA;IAEnD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,GAA0C,EAAE;QACzE,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAA;YACH,CAAC;YAED,qEAAqE;YACrE,yEAAyE;YACzE,WAAW;YACX,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAA;QAE5E,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,OAAO;YAC1B,MAAM,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;SAC5E,CAAA;IACH,CAAC,CAAC,EAAE,CAAA;IAEJ,IAAI,cAAc,GAAG,MAAM,CAAC,oBAAoB,EAAE;QAChD,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,CAAC;QAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;QAC3B,iBAAiB,EAAE,YAAY;QAC/B,mBAAmB,EAAE,OAAO;QAC5B,OAAO;QACP,SAAS;QACT,IAAI;QACJ,QAAQ,EAAE,MAAM,kBAAkB,CAAC,WAAW,CAAC;KAChD,CAAC,CAAA;IAEF,cAAc,CAAC,kBAAkB,GAAG,MAAM,gBAAgB,CAAC;QACzD,cAAc;QACd,UAAU;QACV,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAA;IAEF,IAAI,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,cAAc,GAAG,MAAM,iBAAiB,CAAC;YACvC,cAAc;YACd,UAAU;YACV,SAAS;SACV,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,cAAc,CAAA;AACvB,CAAC,CAAA"}

package/dist/keysign/swap/getKeysignLimitSwapCancel.d.ts

@@ -0,0 +1,44 @@
+import { Chain } from '@vultisig/core-chain/Chain';
+import { ParsedLimitSwapCancelMemo } from '@vultisig/core-chain/swap/native/limitSwapCancelMemo';
+import { KeysignPayload } from '../../types/vultisig/keysign/v1/keysign_message_pb.js';
+export type KeysignLimitSwapCancel = ParsedLimitSwapCancelMemo & {
+    /** Home chain of the sold asset, when its prefix is one this SDK can route. */
+    sourceChain?: Chain;
+    /** Home chain of the bought asset, under the same caveat. */
+    targetChain?: Chain;
+    /** The order's deposited amount, as a decimal string in display units. */
+    sourceAmountDecimal: string;
+    /** The order's original minimum-received, as a decimal string in display units. */
+    tradeTargetDecimal: string;
+    /**
+     * The advanced-swap-queue bucket this cancel will address, reproduced from the
+     * memo. Two orders sharing it are not independently cancellable, so a reviewer
+     * holding the vault's open orders can tell whether this cancel is unambiguous.
+     */
+    bucketKey: string;
+};
+/**
+ * Decode the limit order a keysign payload is about to CANCEL, for review.
+ *
+ * Returns `undefined` for any payload that is not a limit-order cancellation, so
+ * a caller can branch on it directly.
+ *
+ * **This is how a *joining* device reviews a cancellation.** A cancel carries no
+ * swap payload on any branch — it is a `MsgDeposit` or a dust transfer to an
+ * inbound vault — so a co-signer keying off the swap payload alone sees a send of
+ * a trivial amount to an opaque address with an opaque memo, with nothing saying
+ * an order is being closed. Worse than uninformative: the visible amount is dust,
+ * which reads as harmless while the transaction closes a position.
+ *
+ * As with placement, the terms come from `keysignPayload.memo` because the memo
+ * IS the instruction THORChain executes, so what a reviewer sees cannot disagree
+ * with what gets signed — unlike a display field supplied alongside it, which a
+ * co-signer has no way to verify.
+ *
+ * A *retarget* is deliberately not reported here. `m=<` with a non-zero final
+ * field re-prices an order rather than closing it, and a reviewer told "this
+ * cancels your order" would be approving something else entirely; the parser
+ * rejects it and this returns `undefined`.
+ */
+export declare const getKeysignLimitSwapCancel: ({ memo, }: Pick<KeysignPayload, "memo">) => KeysignLimitSwapCancel | undefined;
+//# sourceMappingURL=getKeysignLimitSwapCancel.d.ts.map

package/dist/keysign/swap/getKeysignLimitSwapCancel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKeysignLimitSwapCancel.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/getKeysignLimitSwapCancel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAGlD,OAAO,EAGL,yBAAyB,EAC1B,MAAM,sDAAsD,CAAA;AAI7D,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAA;AAKnF,MAAM,MAAM,sBAAsB,GAAG,yBAAyB,GAAG;IAC/D,+EAA+E;IAC/E,WAAW,CAAC,EAAE,KAAK,CAAA;IACnB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,KAAK,CAAA;IACnB,0EAA0E;IAC1E,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mFAAmF;IACnF,kBAAkB,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,GAAI,WAEvC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,KAAG,sBAAsB,GAAG,SAoB1D,CAAA"}

package/dist/keysign/swap/getKeysignLimitSwapCancel.js

@@ -0,0 +1,51 @@
+import { fromChainAmountDisplay } from '@vultisig/core-chain/amount/fromChainAmountExact';
+import { Chain } from '@vultisig/core-chain/Chain';
+import { chainFeeCoin } from '@vultisig/core-chain/coin/chainFeeCoin';
+import { getThorchainLimitOrderBucketKey } from '@vultisig/core-chain/swap/native/limitSwapCancelBucket';
+import { isModifyLimitSwapMemo, parseCancelLimitSwapMemo, } from '@vultisig/core-chain/swap/native/limitSwapCancelMemo';
+import { getThorchainMemoAssetChain } from '@vultisig/core-chain/swap/native/thorchainMemoAsset';
+import { attempt } from '@vultisig/lib-utils/attempt';
+/** THORChain's fixed point, which both amounts in a cancel memo are expressed in. */
+const thorchainDecimals = chainFeeCoin[Chain.THORChain].decimals;
+/**
+ * Decode the limit order a keysign payload is about to CANCEL, for review.
+ *
+ * Returns `undefined` for any payload that is not a limit-order cancellation, so
+ * a caller can branch on it directly.
+ *
+ * **This is how a *joining* device reviews a cancellation.** A cancel carries no
+ * swap payload on any branch — it is a `MsgDeposit` or a dust transfer to an
+ * inbound vault — so a co-signer keying off the swap payload alone sees a send of
+ * a trivial amount to an opaque address with an opaque memo, with nothing saying
+ * an order is being closed. Worse than uninformative: the visible amount is dust,
+ * which reads as harmless while the transaction closes a position.
+ *
+ * As with placement, the terms come from `keysignPayload.memo` because the memo
+ * IS the instruction THORChain executes, so what a reviewer sees cannot disagree
+ * with what gets signed — unlike a display field supplied alongside it, which a
+ * co-signer has no way to verify.
+ *
+ * A *retarget* is deliberately not reported here. `m=<` with a non-zero final
+ * field re-prices an order rather than closing it, and a reviewer told "this
+ * cancels your order" would be approving something else entirely; the parser
+ * rejects it and this returns `undefined`.
+ */
+export const getKeysignLimitSwapCancel = ({ memo, }) => {
+    if (!isModifyLimitSwapMemo(memo) || !memo) {
+        return undefined;
+    }
+    const parsed = attempt(() => parseCancelLimitSwapMemo(memo));
+    if ('error' in parsed) {
+        return undefined;
+    }
+    const { data: cancel } = parsed;
+    return {
+        ...cancel,
+        sourceChain: getThorchainMemoAssetChain(cancel.sourceAsset),
+        targetChain: getThorchainMemoAssetChain(cancel.targetAsset),
+        sourceAmountDecimal: fromChainAmountDisplay(cancel.sourceAmount, thorchainDecimals),
+        tradeTargetDecimal: fromChainAmountDisplay(cancel.tradeTarget, thorchainDecimals),
+        bucketKey: getThorchainLimitOrderBucketKey(cancel),
+    };
+};
+//# sourceMappingURL=getKeysignLimitSwapCancel.js.map

package/dist/keysign/swap/getKeysignLimitSwapCancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getKeysignLimitSwapCancel.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/swap/getKeysignLimitSwapCancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAA;AACzF,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAA;AACxG,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GAEzB,MAAM,sDAAsD,CAAA;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAA;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAIrD,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAA;AAmBhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,EACxC,IAAI,GACyB,EAAsC,EAAE;IACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5D,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAE/B,OAAO;QACL,GAAG,MAAM;QACT,WAAW,EAAE,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC;QAC3D,WAAW,EAAE,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC;QAC3D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC;QACnF,kBAAkB,EAAE,sBAAsB,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC;QACjF,SAAS,EAAE,+BAA+B,CAAC,MAAM,CAAC;KACnD,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/core-mpc",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "MPC, keysign, and vault types shared across Vultisig clients",
   "license": "MIT",
   "repository": {
@@ -591,6 +591,11 @@
       "import": "./dist/keysign/swap/build.js",
       "default": "./dist/keysign/swap/build.js"
     },
+    "./keysign/swap/buildLimitSwapCancelKeysignPayload": {
+      "types": "./dist/keysign/swap/buildLimitSwapCancelKeysignPayload.d.ts",
+      "import": "./dist/keysign/swap/buildLimitSwapCancelKeysignPayload.js",
+      "default": "./dist/keysign/swap/buildLimitSwapCancelKeysignPayload.js"
+    },
     "./keysign/swap/buildLimitSwapKeysignPayload": {
       "types": "./dist/keysign/swap/buildLimitSwapKeysignPayload.d.ts",
       "import": "./dist/keysign/swap/buildLimitSwapKeysignPayload.js",
@@ -601,6 +606,11 @@
       "import": "./dist/keysign/swap/cowswap/buildCowSwapApprovalSigningInput.js",
       "default": "./dist/keysign/swap/cowswap/buildCowSwapApprovalSigningInput.js"
     },
+    "./keysign/swap/getKeysignLimitSwapCancel": {
+      "types": "./dist/keysign/swap/getKeysignLimitSwapCancel.d.ts",
+      "import": "./dist/keysign/swap/getKeysignLimitSwapCancel.js",
+      "default": "./dist/keysign/swap/getKeysignLimitSwapCancel.js"
+    },
     "./keysign/swap/getKeysignLimitSwapOrder": {
       "types": "./dist/keysign/swap/getKeysignLimitSwapOrder.d.ts",
       "import": "./dist/keysign/swap/getKeysignLimitSwapOrder.js",
@@ -1079,7 +1089,7 @@
     "@noble/hashes": "^1.8.0",
     "@solana/web3.js": "^1.98.4",
     "@trustwallet/wallet-core": "^4.7.0",
-    "@vultisig/core-chain": "2.31.1",
+    "@vultisig/core-chain": "2.32.0",
     "@vultisig/core-config": "0.9.1",
     "@vultisig/lib-dkls": "0.9.0",
     "@vultisig/lib-mldsa": "0.9.0",