swap: remove intermediate safe bridge custody

[Makyl]

Summary

This PR removes the intermediate Safe custody hop from non-7702 swap bridge funding.

The Safe remains the source-swap taker, authorized EOA spender, and bridge-call executor, while remote source-swap output and EOA-held bridge funding now land directly at the ephemeral bridge holder. This removes one token transfer from every non-7702 ERC-20 bridge path without changing the public SDK surface.

Changes

• Route remote source-swap output directly to the ephemeral address while retaining the predicted Safe as the aggregator taker on non-7702 chains.
• Encode non-7702 fast-path funding as transferFrom(EOA, ephemeral, amount), with the Safe remaining the authorized spender.
• Reduce Nexus Safe bridge batches from transfer → permit → deposit to permit → deposit.
• Reduce Mayan Safe allowance batches from transfer → permit to permit.
• Share ephemeral-owned EIP-2612 permit construction between bridge execution and failure recovery.
• Read remote source settlement from the ephemeral on both wallet paths, while preserving destination-chain Safe custody when a destination swap follows.
• Recover non-7702 remote source settlement through a Safe-executed permit(EPH → Safe) → transferFrom(EPH → EOA) batch.
• Update the swap execution reference, receiver graph, characterization coverage, and focused unit tests for the new custody model and call sequences.

Testing

• npm run lint
• npm run typecheck
• npm test

Risk / Impact

• No public SDK method, exported type, or package-root export changes.
• Non-7702 aggregator quotes now use different taker and receiver addresses: the Safe executes the swap and the ephemeral receives remote settlement.
• Happy-path non-7702 ERC-20 bridge batches execute one fewer token call for both Nexus and Mayan.
• Non-7702 bridge tokens must still support the canonical EIP-2612 permit used by the existing ephemeral-to-vault allowance path.
• Failure recovery for remote non-7702 settlement now requires an ephemeral permit before the Safe can return funds to the EOA.
• 7702, native-token, direct-to-EOA, and destination-Safe execution paths retain their existing behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nexus-sdk	Ready	Preview, Comment	Jul 29, 2026 1:39pm