feat: add ows swap quote command via LI.FI

[Sertug17]

Part of #125

Adds ows swap quote — a dry-run cross-chain swap route lookup powered by LI.FI's aggregation API (27 bridges, 31 DEXs, 58 chains).

Usage

# Same-chain swap quote
ows swap quote --wallet my-wallet --from ETH --to USDC --amount 0.1 --from-chain ethereum

# Cross-chain swap quote
ows swap quote --wallet my-wallet --from ETH --to USDC --amount 0.5 --from-chain ethereum --to-chain base

# Output example:
#   Swap Route
#   ----------
#   0.1 ETH -> 186.31 USDC
#   Min received:  185.44 USDC
#   Via:           1inch
#   Gas cost:      ~$0.02
#   Est. time:     30s
#
#   [dry-run — no transaction signed]

Changes

ows-pay: new swap.rs module

• LI.FI /v1/quote API client (no SDK dependency, pure REST)
• SwapParams / SwapResult types
• swap_dry_run() — fetches route, formats amounts, returns result
• Token amount formatting with decimal handling
• 3 unit tests for format_amount

ows-cli: new swap subcommand

• ows swap quote with flags: --wallet, --from, --to, --amount, --from-chain, --to-chain, --slippage, --order
• Human-readable output with route details

Not included in this PR

• Transaction signing (follow-up PR)
• ows bridge alias (same as ows swap with --to-chain)
• ows swap execute (after signing integration)
• max_value_usd / allowed_tokens policy rules

---

Note

Medium Risk
Quotes send wallet addresses and swap parameters to a third-party API and rely on decimal heuristics for amounts; no on-chain execution yet, but mis-quotes could mislead users planning trades.

Overview
Adds cross-chain swap quoting to the CLI without signing or broadcasting transactions.

ows-pay gains a new swap module: a REST client for LI.FI’s /v1/quote endpoint, SwapParams / SwapResult types, human-readable format_amount, and swap_dry_run() that returns route details (amounts, min received, bridge/DEX tool, gas USD, ETA) while optionally retaining a transactionRequest for a future execute path.

ows-cli wires ows swap quote with flags for wallet, tokens, amount, --from-chain / --to-chain, slippage, and route order (CHEAPEST / FASTEST). The handler loads the vault wallet, maps OWS/CAIP-2 chain names to LI.FI IDs (EVM + Solana), picks from/to addresses for cross-VM routes, converts human amounts to raw units via token decimal heuristics, and prints a formatted route labeled dry-run.

Signing, swap execute, policy limits, and bridge aliases are explicitly out of scope for this change.

^{Reviewed by Cursor Bugbot for commit 5be2190. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

@Sertug17 is attempting to deploy a commit to the MoonPay Team on Vercel.

A member of the Team first needs to authorize it.

[Sertug17]

Addressed both Cursor Bugbot findings:

Hardcoded decimals expanded the decimal heuristic to cover WBTC/BTC/SBTC/TBTC (8 decimals), GUSD (2 decimals), and USDC.E/USDT.E (6 decimals) alongside existing USDC/USDT. Default remains 18 for unlisted tokens.

Third-party payload logging LI.FI error body is now truncated to 120 chars before being included in the error message.

[Sertug17]

Addressed both Cursor Bugbot findings:

LI.FI chain identifiers added ows_chain_to_lifi() that maps OWS
chain names to LI.FI numeric IDs (ethereum→1, polygon→137, base→8453,
arbitrum→42161, optimism→10, avalanche→43114, bsc→56, solana→1151111081099592).

Non EVM address mismatch the handler now picks a Solana account
address for Solana chains and an EVM account address for all other chains,
preventing inconsistent LI.FI requests.

[Sertug17]

Addressed both Cursor Bugbot findings:

Unknown chain sent to API ows_chain_to_lifi now returns an empty
string for unrecognized chains. The CLI validates both from-chain and
to-chain before making any HTTP call and returns a clear error listing
supported chains.

Missing cross-VM destination address SwapParams gains an optional
to_address field. For cross-VM routes (EVM→Solana or Solana→EVM), the
handler picks the destination chain's wallet address and passes it as
toAddress in the LI.FI quote URL.

[cursor]

UTF-8 panic truncating errors

Medium Severity

On failed LI.FI responses, the error body is truncated with &body[..120]. If byte 120 falls inside a multibyte UTF-8 character, slicing the str panics and can crash the CLI instead of returning an API error.

 

^{Reviewed by Cursor Bugbot for commit bcfd4f8. Configure here.}

[Sertug17]

Addressed both Cursor Bugbot findings:

Unsupported chain ID formats ows_chain_to_lifi now accepts CAIP-2
IDs (eip155:8453), bare numeric EVM IDs (8453), and friendly aliases
(ethereum, base, etc.) matching the formats other OWS CLI commands accept.

UTF-8 panic on truncation error body truncation now uses
chars().take(120).collect() instead of byte slicing, safe for multibyte
UTF-8 characters.

[Sertug17]

Addressed both Cursor Bugbot findings:

Substring misclassifies Solana chains — is_solana and is_to_solana
now check lifi_from/lifi_to == "1151111081099592" directly instead of
contains("solana"), eliminating false positives from substrings.

Transport errors expose request URL — transport failures now return
a generic "failed to connect to LI.FI API" message instead of the full
reqwest error which could contain wallet addresses in the URL.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a6a42e6. Configure here.}