@vultisig/core-mpc 1.19.0 → 1.19.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @vultisig/core-mpc
 
+## 1.19.1
+
+### Patch Changes
+
+- [#1813](https://github.com/vultisig/vultisig-sdk/pull/1813) [`aaa3aa9`](https://github.com/vultisig/vultisig-sdk/commit/aaa3aa93b62b6933f09ba8a33d09806d051215b9) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - fix(ripple): only declare genuine trust lines as TrustSet
+
+  `RippleSpecific.transaction_type` was set from the coin's shape alone, but an
+  issued-currency Payment has the identical shape — a non-native Ripple coin with
+  a `contractAddress`. So sending a token stamped that payload
+  `TRANSACTION_TYPE_RIPPLE_TRUST_SET`.
+
+  That is worse than the ambiguity it was meant to remove. Before the field
+  existed, a token send diverged: this SDK built a TrustSet, an iOS co-signer
+  built a Payment, and the ceremony failed without signing anything. With the
+  field set, every signer agrees to build a TrustSet — so the ceremony _completes_
+  over an operation the user never asked for, setting a trust-line limit to the
+  amount they meant to send. No funds move, and nothing surfaces it.
+
+  Declaring is an assertion, so it now requires more than the shape: a TrustSet is
+  addressed to the _issuer_, the party being trusted, while a Payment is addressed
+  to a recipient.
+
+  The signing fallback is deliberately left broad. Clients already released infer
+  TrustSet from a non-native coin alone, and honouring that inference is what keeps
+  a genuine TrustSet byte-identical across a mixed-version committee; narrowing it
+  would break MPC parity with every signer in the field. A token send therefore
+  returns to diverging safely rather than completing wrongly.
+
+- Updated dependencies [[`2e1b8bb`](https://github.com/vultisig/vultisig-sdk/commit/2e1b8bb597d2d0fa052a121ab2757efa228314f5), [`67dd842`](https://github.com/vultisig/vultisig-sdk/commit/67dd8425a10f0c7b7833c02147fc0036e6ee7a64), [`3ea8b2c`](https://github.com/vultisig/vultisig-sdk/commit/3ea8b2c5133a16878991ec33d569fd8498837316)]:
+  - @vultisig/core-chain@2.35.0
+
 ## 1.19.0
 
 ### Minor Changes

package/dist/keysign/chainSpecific/resolvers/ripple.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ripple.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/mpc/keysign/chainSpecific/resolvers/ripple.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAOtD,eAAO,MAAM,2BAA2B,GAAI,oBAAoB,MAAM,GAAG,SAAS,KAAG,MAMpF,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,CAAC,gBAAgB,CA0F7E,CAAA"}
+{"version":3,"file":"ripple.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/mpc/keysign/chainSpecific/resolvers/ripple.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAOtD,eAAO,MAAM,2BAA2B,GAAI,oBAAoB,MAAM,GAAG,SAAS,KAAG,MAMpF,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,CAAC,gBAAgB,CA8F7E,CAAA"}

package/dist/keysign/chainSpecific/resolvers/ripple.js

@@ -8,7 +8,7 @@ import { isInError } from '@vultisig/lib-utils/error/isInError';
 import { maxBigInt } from '@vultisig/lib-utils/math/maxBigInt';
 import { BuildKeysignPayloadError } from '../../error.js';
 import { getKeysignCoin } from '../../utils/getKeysignCoin.js';
-import { hasRippleTrustSetShape } from '../../utils/isRippleTrustSet.js';
+import { originatesRippleTrustSet } from '../../utils/isRippleTrustSet.js';
 import { resolveDestinationTag } from '../../utils/rippleDestinationTag.js';
 const minProtocolFee = 15n;
 const baseFeeMultiplier = 2n;
@@ -81,7 +81,11 @@ export const getRippleChainSpecific = async ({ keysignPayload, destinationTag, }
     // or "send this token", and the two sign different bytes — a co-signer that
     // reads the undiscriminated case as a Payment diverges from the TrustSet
     // built here, and the ceremony never completes.
-    const isTrustSet = hasRippleTrustSetShape(keysignPayload);
+    //
+    // Only genuine originations are declared. Stamping a token send would make
+    // every signer agree to build a TrustSet from it, which is worse than the
+    // divergence: the ceremony completes over an operation nobody asked for.
+    const isTrustSet = originatesRippleTrustSet(keysignPayload);
     return create(RippleSpecificSchema, {
         sequence: BigInt(account_data.Sequence),
         lastLedgerSequence: getRippleLastLedgerSequence(ledgerCurrentIndex),

package/dist/keysign/chainSpecific/resolvers/ripple.js.map

@@ -1 +1 @@
-{"version":3,"file":"ripple.js","sourceRoot":"","sources":["../../../../../../../packages/core/mpc/keysign/chainSpecific/resolvers/ripple.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAA;AACtF,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,qEAAqE,CAAA;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAA;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAGxE,MAAM,cAAc,GAAG,GAAG,CAAA;AAC1B,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,+BAA+B,GAAG,UAAU,CAAA;AAClD,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,kBAAsC,EAAU,EAAE;IAC5F,IAAI,kBAAkB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IAED,OAAO,MAAM,CAAC,kBAAkB,GAAG,wBAAwB,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA+C,KAAK,EAAE,EACvF,cAAc,EACd,cAAc,GACf,EAAE,EAAE;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IAExB,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,IAAI,SAAS,CAAA;IAEvD,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;QACpD,cAAc;QACd,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC,CAAA;IAEF,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,wBAAwB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/E,oBAAoB,CAAC,OAAO,CAAC;QAC7B,oBAAoB,EAAE;QACtB,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC,CAAA;IAEF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,WAAW,CAAA;IAChE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAA;IAEpE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,iBAAiB,CAAA;IAEtG,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAEzD,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,mDAAmD;IACnD,MAAM,mBAAmB,GACvB,wBAAwB,KAAK,SAAS;QACtC,OAAO,IAAI,wBAAwB;QACnC,SAAS,CAAC,wBAAwB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAEhE,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,SAAS,IAAI,wBAAwB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC7G,IAAI,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,4BAA4B,CAAC,CAAA;YACpG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,wBAAwB,CAChC,iCAAiC,EACjC,mBAAmB,SAAS,4BAA4B,CACzD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjE,IAAI,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,8BAA8B,SAAS,mDAAmD;gBACxF,mDAAmD,YAAY,0BAA0B;gBACzF,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,0CAA0C;gBAC5F,uDAAuD,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAA;IAEhF,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAA;IAEzD,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC;QACvC,kBAAkB,EAAE,2BAA2B,CAAC,kBAAkB,CAAC;QACnE,yEAAyE;QACzE,GAAG,EAAE,UAAU;QACf,GAAG,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"ripple.js","sourceRoot":"","sources":["../../../../../../../packages/core/mpc/keysign/chainSpecific/resolvers/ripple.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAA;AACtF,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,qEAAqE,CAAA;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAA;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAGxE,MAAM,cAAc,GAAG,GAAG,CAAA;AAC1B,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,+BAA+B,GAAG,UAAU,CAAA;AAClD,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAEnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,kBAAsC,EAAU,EAAE;IAC5F,IAAI,kBAAkB,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IAED,OAAO,MAAM,CAAC,kBAAkB,GAAG,wBAAwB,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA+C,KAAK,EAAE,EACvF,cAAc,EACd,cAAc,GACf,EAAE,EAAE;IACH,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,CAAC,CAAA;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IAExB,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,IAAI,SAAS,CAAA;IAEvD,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;QACpD,cAAc;QACd,IAAI,EAAE,cAAc,CAAC,IAAI;KAC1B,CAAC,CAAA;IAEF,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,wBAAwB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/E,oBAAoB,CAAC,OAAO,CAAC;QAC7B,oBAAoB,EAAE;QACtB,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC,CAAA;IAEF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,WAAW,CAAA;IAChE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAA;IAEpE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,iBAAiB,CAAA;IAEtG,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAEzD,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,mDAAmD;IACnD,MAAM,mBAAmB,GACvB,wBAAwB,KAAK,SAAS;QACtC,OAAO,IAAI,wBAAwB;QACnC,SAAS,CAAC,wBAAwB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAEhE,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,SAAS,IAAI,wBAAwB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC7G,IAAI,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,4BAA4B,CAAC,CAAA;YACpG,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,wBAAwB,CAChC,iCAAiC,EACjC,mBAAmB,SAAS,4BAA4B,CACzD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjE,IAAI,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,8BAA8B,SAAS,mDAAmD;gBACxF,mDAAmD,YAAY,0BAA0B;gBACzF,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,0CAA0C;gBAC5F,uDAAuD,CAC1D,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAA;IAEhF,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,gDAAgD;IAChD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,UAAU,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAA;IAE3D,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC;QACvC,kBAAkB,EAAE,2BAA2B,CAAC,kBAAkB,CAAC;QACnE,yEAAyE;QACzE,GAAG,EAAE,UAAU;QACf,GAAG,CAAC,uBAAuB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/keysign/utils/isRippleTrustSet.d.ts

@@ -1,17 +1,35 @@
 import { KeysignPayload } from '@vultisig/core-mpc/types/vultisig/keysign/v1/keysign_message_pb';
 /**
- * Whether the payload's shape alone reads as a TrustSet, i.e. how every signer
+ * Whether the payload's shape alone reads as a TrustSet — i.e. how every signer
  * that predates `RippleSpecific.transaction_type` decides.
  *
- * This is what the builder uses to know it must set the field, and what the
- * signer falls back to when the field is absent. Keeping one definition is the
- * point: if the two drifted, a payload could be built as one operation and
- * signed as the other.
+ * Deliberately broad, and **only** for the signing fallback. Clients already in
+ * the field infer TrustSet from a non-native Ripple coin alone, so honouring
+ * that same inference is what keeps a TrustSet byte-identical across a
+ * mixed-version committee. Narrowing it would break MPC parity with every
+ * signer already released.
+ *
+ * Do not use this to decide what a payload *is*: an issued-currency Payment has
+ * the same shape. Use {@link originatesRippleTrustSet} when originating.
  *
  * A verbatim dApp transaction (`signRipple`) is excluded — it is signed exactly
  * as given and never rebuilt from the coin.
  */
 export declare const hasRippleTrustSetShape: ({ signData, coin }: KeysignPayload) => boolean;
+/**
+ * Whether this payload is being originated as a TrustSet, and so should declare
+ * itself one on the wire.
+ *
+ * Stricter than {@link hasRippleTrustSetShape} because declaring is an
+ * assertion, not a guess. A send of an issued currency has the identical coin
+ * shape, and stamping that as a TrustSet would make every signer agree to build
+ * one — turning what used to be a safe divergence into a completed ceremony
+ * over an operation the user never asked for.
+ *
+ * A TrustSet is addressed to the *issuer*: it is the party being trusted. A
+ * Payment is addressed to a recipient. That is what separates them here.
+ */
+export declare const originatesRippleTrustSet: (keysignPayload: KeysignPayload) => boolean;
 /**
  * Whether this Ripple payload describes a TrustSet — opening or modifying a
  * trust line, where the keysign amount is the trust-line LIMIT — rather than a
@@ -20,13 +38,9 @@ export declare const hasRippleTrustSetShape: ({ signData, coin }: KeysignPayload
  * A non-native Ripple coin cannot say this on its own: the same
  * `(currency, issuer)` pair means either operation, and the two produce
  * different signed bytes. `RippleSpecific.transaction_type` states it
- * explicitly, so it wins when present.
- *
- * The shape fallback is load-bearing for MPC byte-parity, not a convenience.
- * Clients shipped before the field infer TrustSet from a non-native coin alone,
- * so honouring that inference keeps a TrustSet byte-identical across a
- * mixed-version committee. Dropping it would break every signer already in the
- * field.
+ * explicitly, so it wins when present, and the shape decides only when it is
+ * absent — which is the mixed-version case documented on
+ * {@link hasRippleTrustSetShape}.
  */
 export declare const isRippleTrustSet: (keysignPayload: KeysignPayload) => boolean;
 //# sourceMappingURL=isRippleTrustSet.d.ts.map

package/dist/keysign/utils/isRippleTrustSet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isRippleTrustSet.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/utils/isRippleTrustSet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAA;AAKhG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAAI,oBAAoB,cAAc,KAAG,OACe,CAAA;AAE3F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,GAAI,gBAAgB,cAAc,KAAG,OAQjE,CAAA"}
+{"version":3,"file":"isRippleTrustSet.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/utils/isRippleTrustSet.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAA;AAMhG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAAI,oBAAoB,cAAc,KAAG,OACe,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,GAAI,gBAAgB,cAAc,KAAG,OASzE,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,gBAAgB,cAAc,KAAG,OAQjE,CAAA"}

package/dist/keysign/utils/isRippleTrustSet.js

@@ -1,18 +1,45 @@
+import { parseRippleTokenId } from '@vultisig/core-chain/chains/ripple/issuedCurrency';
+import { attempt } from '@vultisig/lib-utils/attempt';
 import { TransactionType } from '../../types/vultisig/keysign/v1/blockchain_specific_pb.js';
 import { getBlockchainSpecificValue } from '../chainSpecific/KeysignChainSpecific.js';
 /**
- * Whether the payload's shape alone reads as a TrustSet, i.e. how every signer
+ * Whether the payload's shape alone reads as a TrustSet — i.e. how every signer
  * that predates `RippleSpecific.transaction_type` decides.
  *
- * This is what the builder uses to know it must set the field, and what the
- * signer falls back to when the field is absent. Keeping one definition is the
- * point: if the two drifted, a payload could be built as one operation and
- * signed as the other.
+ * Deliberately broad, and **only** for the signing fallback. Clients already in
+ * the field infer TrustSet from a non-native Ripple coin alone, so honouring
+ * that same inference is what keeps a TrustSet byte-identical across a
+ * mixed-version committee. Narrowing it would break MPC parity with every
+ * signer already released.
+ *
+ * Do not use this to decide what a payload *is*: an issued-currency Payment has
+ * the same shape. Use {@link originatesRippleTrustSet} when originating.
  *
  * A verbatim dApp transaction (`signRipple`) is excluded — it is signed exactly
  * as given and never rebuilt from the coin.
  */
 export const hasRippleTrustSetShape = ({ signData, coin }) => signData.case !== 'signRipple' && !!coin && !coin.isNativeToken && !!coin.contractAddress;
+/**
+ * Whether this payload is being originated as a TrustSet, and so should declare
+ * itself one on the wire.
+ *
+ * Stricter than {@link hasRippleTrustSetShape} because declaring is an
+ * assertion, not a guess. A send of an issued currency has the identical coin
+ * shape, and stamping that as a TrustSet would make every signer agree to build
+ * one — turning what used to be a safe divergence into a completed ceremony
+ * over an operation the user never asked for.
+ *
+ * A TrustSet is addressed to the *issuer*: it is the party being trusted. A
+ * Payment is addressed to a recipient. That is what separates them here.
+ */
+export const originatesRippleTrustSet = (keysignPayload) => {
+    if (!hasRippleTrustSetShape(keysignPayload)) {
+        return false;
+    }
+    const { coin, toAddress } = keysignPayload;
+    const issuer = attempt(() => parseRippleTokenId(coin?.contractAddress ?? '').issuer);
+    return 'data' in issuer && issuer.data === toAddress;
+};
 /**
  * Whether this Ripple payload describes a TrustSet — opening or modifying a
  * trust line, where the keysign amount is the trust-line LIMIT — rather than a
@@ -21,13 +48,9 @@ export const hasRippleTrustSetShape = ({ signData, coin }) => signData.case !==
  * A non-native Ripple coin cannot say this on its own: the same
  * `(currency, issuer)` pair means either operation, and the two produce
  * different signed bytes. `RippleSpecific.transaction_type` states it
- * explicitly, so it wins when present.
- *
- * The shape fallback is load-bearing for MPC byte-parity, not a convenience.
- * Clients shipped before the field infer TrustSet from a non-native coin alone,
- * so honouring that inference keeps a TrustSet byte-identical across a
- * mixed-version committee. Dropping it would break every signer already in the
- * field.
+ * explicitly, so it wins when present, and the shape decides only when it is
+ * absent — which is the mixed-version case documented on
+ * {@link hasRippleTrustSetShape}.
  */
 export const isRippleTrustSet = (keysignPayload) => {
     const { transactionType } = getBlockchainSpecificValue(keysignPayload.blockchainSpecific, 'rippleSpecific');

package/dist/keysign/utils/isRippleTrustSet.js.map

@@ -1 +1 @@
-{"version":3,"file":"isRippleTrustSet.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/utils/isRippleTrustSet.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAA;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAkB,EAAW,EAAE,CACpF,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAA;AAE3F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,cAA8B,EAAW,EAAE;IAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,0BAA0B,CAAC,cAAc,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAA;IAE3G,IAAI,eAAe,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,sBAAsB,CAAC,cAAc,CAAC,CAAA;AAC/C,CAAC,CAAA"}
+{"version":3,"file":"isRippleTrustSet.js","sourceRoot":"","sources":["../../../../../../packages/core/mpc/keysign/utils/isRippleTrustSet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAA;AAEtF,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAA;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAElF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAkB,EAAW,EAAE,CACpF,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAA;AAE3F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,cAA8B,EAAW,EAAE;IAClF,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,cAAc,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;IAEpF,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAA;AACtD,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,cAA8B,EAAW,EAAE;IAC1E,MAAM,EAAE,eAAe,EAAE,GAAG,0BAA0B,CAAC,cAAc,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAA;IAE3G,IAAI,eAAe,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,sBAAsB,CAAC,cAAc,CAAC,CAAA;AAC/C,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/core-mpc",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "description": "MPC, keysign, and vault types shared across Vultisig clients",
   "license": "MIT",
   "repository": {
@@ -1094,7 +1094,7 @@
     "@noble/hashes": "^1.8.0",
     "@solana/web3.js": "^1.98.4",
     "@trustwallet/wallet-core": "^4.7.0",
-    "@vultisig/core-chain": "2.34.0",
+    "@vultisig/core-chain": "2.35.0",
     "@vultisig/core-config": "0.9.1",
     "@vultisig/lib-dkls": "0.9.0",
     "@vultisig/lib-mldsa": "0.9.0",