Add core-side synthetic destination for swap-to-address

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Description

Technical design doc

Asana task

Production implementation of swap-to-address (the core piece of Stealth Send / send-to-any-asset). EdgeSwapRequest accepts an optional toAddressInfo descriptor as an alternative to toWallet (exactly one of the two required); the core builds a synthetic, bridgified destination wallet from it, backed by the real currencyConfig, so swap plugins receive an EdgeCurrencyWallet unchanged. Nothing Houdini-specific lives in core: the same mechanism powers provider-agnostic send-to-any-asset (verified in-app with a ChangeNOW-routed cross-chain send).

Judgement calls, with alternates:

• Slim descriptor. EdgeSwapToAddressInfo carries only toPluginId, toAddress, and optional toMemos. toPluginId selects the currencyConfig (not derivable from the request); toAddress is the payload; the destination token comes from the request's own toTokenId. Alternate (descriptor carrying toTokenId) was rejected as a two-sources-of-truth hazard.
• Destination memos ride getMemos on the synthetic wallet. For memo-required payout chains (e.g. an XRP destination tag), the descriptor's toMemos is only the GUI-to-core transport; plugins never read the descriptor. The synthetic wallet exposes getMemos() (EdgeSyntheticDestinationWallet), so the plugin-facing mechanism stays wallet-shaped. Alternate (plugins reading a tag field off the request descriptor) was rejected to keep the plugin interface generic. A pure no-descriptor design is not physically possible: the value must cross the GUI-core bridge somewhere, and the descriptor is the plain-data channel that crosses yaob cleanly.
• EdgeTxActionSwap.payoutWalletId and EdgeTxSwap.payoutWalletId are both optional now. A swap-to-address destination has no payout wallet; payoutAddress carries the destination. Making only the action type optional (the prototype state) left a latent inconsistency in EdgeTxSwap. Alternate (keeping them required and writing the synthetic synthetic://<pluginId> id) was rejected: it embeds fake wallet ids in persistent tx metadata.
• Log privacy. Both swap-quote logging paths redact the pasted destination address AND memo values (a deposit tag can identify the recipient's exchange account).

The yaob bridge-crossing proof test covers descriptor-only construction, plugin-faithful reads, memo round-trip via getMemos, and the synthetic surviving the wire format back to the GUI.

Testing: tsc clean, 174 mocha tests pass, eslint clean, verify-repo.sh PASSED. The plugin-selection rule that forceEnabled and disabled encode is now a named predicate (isSwapPluginQueryable) instead of an inline condition inside fetchSwapQuotes, with its full truth table under test. The corner that matters: a caller can reach a provider the user switched off, and can never reach one it disabled itself in the same call, which is exactly what a stealth send does (every other plugin disabled, Houdini force-enabled, one request). In-app verification (linked into edge-react-gui with the Stealth Send UI): a real cross-chain send-to-address executed on the iOS sim through this mechanism (Base ETH to an Ethereum address via ChangeNOW, deposit broadcast on-chain, swap success scene reached).

---

Note

Medium Risk
Changes the central swap quote path and makes toWallet optional on EdgeSwapRequest, which can break callers that assumed a payout wallet id always exists; synthetic wallet casting is intentionally partial but plugins only touch the implemented surface.

Overview
Adds swap-to-address so swaps can target a pasted destination instead of a user wallet, enabling send-to-any-asset and private-send flows without changing swap plugins.

EdgeSwapRequest now accepts either toWallet or toAddressInfo (exactly one). The core validates the descriptor, builds a bridgified synthetic destination wallet from real currencyConfig, and passes a normal toWallet to plugins. Destination memos ride on synthetic getMemos() (EdgeSyntheticDestinationWallet), not on the descriptor. Quote logging redacts pasted addresses and memo values.

API additions: optional privacy: 'required' on swap requests; optional forceEnabled on EdgeSwapRequestOptions (with disabled still winning—isSwapPluginQueryable); optional swapType on EdgeTxActionSwap for send-shaped flows. payoutWalletId on swap tx metadata is now optional when there is no payout wallet.

Cleaners, SwapCurrencyError, and tests cover synthetic wallet bridge behavior and plugin-selection truth table.

^{Reviewed by Cursor Bugbot for commit ca9ed1d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[j0ntz]

📸 Test evidence (in-app swap-to-address via synthetic destination)

agent proof 1216251688512498 03 send to any quote

agent proof 1216251688512498 04 send to any success

Captured by the agent's in-app test run (build-and-test).

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[j0ntz]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ca9ed1d. Configure here.}