refactor(morpho-sdk): Extract morpho-sdk bundler action encoding

[Rubilmax]

Summary

• Extract the Bundler3 action encoding surface required by morpho-sdk into packages/morpho-sdk.
• Remove @morpho-org/bundler-sdk-viem from morpho-sdk dependencies and lockfile importer data.
• Keep migration-sdk-viem unchanged, including its existing bundler-sdk-viem wiring, because it is slated for deprecation.
• Move the new BundlerErrors namespace into packages/morpho-sdk/src/types/error.ts and re-export it from the local bundler action surface.

Fixes SDK-186

Validation

• pnpm --filter @morpho-org/morpho-sdk exec tsc --noEmit -p tsconfig.build.esm.json
• pnpm --filter @morpho-org/morpho-sdk exec tsc --noEmit -p tsconfig.build.cjs.json
• pnpm exec vitest --root . --project morpho-sdk packages/morpho-sdk/src/actions/bundler.test.ts --run
• pnpm lint
• git diff --check

[Rubilmax]

LGTM

[Rubilmax]

@codex

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

[linear]

SDK-186

[Rubilmax]

Automated /pr-review-local findings, posted as inline comments.

Severity	Count
Critical	1
High	4
Medium	11
Low	4

9 personas fired (baseline + ci-release-security). 0 agent failures. Deduplicated against branch base extract-public-reallocation (merge-base 1b736238). Scope filter dropped 2 findings on files outside the diff.

Guard against /pr-review-local's known limits: messages may drift between reruns (LLM nondeterminism); the line of a finding is always within the changed-line window of the file, but the exact line can lag the symbol by a few lines on dense files.

[Rubilmax]

📍 Finding targets packages/morpho-sdk/BUNDLER3.md:13 — the line is unchanged in this PR's diff so an inline review comment cannot be anchored. Posting as a top-level comment.

[MEDIUM] Stale line reference src/actions/vaultV1/deposit.ts#L82-L84 for the getChainAddresses(chainId).bundler3.generalAdapter1 claim. The added @throws {Permit2ExpirationMissingError} JSDoc in vaultV1/deposit.ts shifts the actual destructuring; in HEAD it lives at L115-L118 (and was never at L82-L84 even before — those lines are inside the JSDoc).

Suggestion: update to #L115 or drop the line anchor.

[Foulks-Plb]

Parallel PR Review (Claude) — focus: security / fund loss / tx flow

Reviewed commit: 9cb99a1b • Base: extract-public-reallocation

Severity	Count
Critical	0
High	0
Medium	0
Low	1

Transaction-flow / tx.value audit (no fund-loss bugs found)

The core refactor — moving tx.value from explicit callsite overrides (value: nativeAmount, value: reallocationFee, value: nativeAmount + reallocationFee) to a derived value computed by the new BundlerAction.encodeBundle — was traced end-to-end:

• nativeTransfer(bundler3, generalAdapter1, X) emits one bundler call with value=X; consumeCallValue deficits the bundler-available balance and rolls the shortfall into tx.value. ✓
• nativeTransfer(user, bundler3, X) enters the prefund branch (addBundlerPrefund), which increments BOTH state.value and availableBundlerValue, so later value-carrying calls (e.g. reallocateTo) consume the prefund before adding to tx.value. ✓
• reallocateTo action carries value: fee; each reallocateTo correctly bumps tx.value by fee minus any remaining prefund. ✓
• Per-builder traces match the legacy explicit values:
  • supplyCollateral (native): tx.value = nativeAmount ✓
  • borrow (with reallocations): tx.value = Σ fees ✓
  • supplyCollateralBorrow (native + reallocations): tx.value = nativeAmount + Σ fees ✓
  • repay / repayWithdrawCollateral: tx.value = 0n ✓
  • vaultV1 / vaultV2 deposit (native): tx.value = nativeAmount ✓
• Callback actions inside morphoSupplyCollateral / morphoRepay are correctly recursed in encodeBundleAction, so a value > 0n callback (e.g. a transfer in a callback) correctly contributes to tx.value. ✓

The parity test in bundler/actions.test.ts documents the new tx.value = 130n vs legacyTx.value = 123n for the same mixed bundle — the new encoder accounts for a reallocateTo fee whose value exceeds the remaining bundler prefund (the legacy encodeBundle did not, which is why the old callsites had to override value explicitly). Removing the explicit value override is therefore only safe because the new encoder is more accurate — both observations are true together.

Other correctness checks that came up while auditing the diff:

• The bundler-sdk-viem === → isAddressEqual fix (separate changeset, included in this PR) is a real bug fix — the old === on bundler3 / generalAdapter1 recipients would miss non-checksummed inputs and either skip value-counting or skip the recipient===bundler3 short-circuit in nativeTransfer. The new morpho-sdk encoder already uses isAddressEqual everywhere. morpho-sdk action builders source addresses from getChainAddresses (always canonical), so the old === bug never affected morpho-sdk outputs, but external bundler-sdk-viem callers could have hit it.
• BundlerErrors.MissingSignature / UnexpectedAction are now distinct classes from the ones in @morpho-org/bundler-sdk-viem. Anyone catching BundlerErrors.X from the old bundler-sdk-viem path will not match throws from the new morpho-sdk encoder via instanceof. The PR description notes migration-sdk-viem intentionally keeps the bundler-sdk-viem wiring, so this is the expected break, but worth flagging in release notes / migration guide.
• Note on scope: the extract-public-reallocation base branch (separate PR) is the one that removes the legacy 1h delay margin from ReallocationData.getMarketPublicReallocations. That is a behaviour change worth reviewing on the base PR, not this one.

Findings

See inline comment.

This is an automated parallel review. Findings list is conservative — only issues a reviewer would clearly act on in this PR.

[Foulks-Plb]

One finding (Low): ABI duplication — packages/morpho-sdk/src/abis.ts ships 12 ABIs but the bundler only uses 3 of them (bundler3Abi, coreAdapterAbi, generalAdapter1Abi). The other 9 (URD, paraswap, Aave/Compound migrations, etc.) are dead code in this package and create a drift surface with bundler-sdk-viem. Suggestion: narrow to the 3 actually used, or add a comment naming the expected external consumer.