feat(transaction-pay-controller): add generic non-atomic post-Relay flow via atomic and recipient - #9497

…y deposit (MetaMask#33489)

<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.

In short: the template must be materially complete (not just section
titles
present), all status checks must be currently passing, and the only
expected
follow-up commits must be reviewer-driven.
-->
<!--
mms-check directive vocabulary — read by
.github/scripts/shared/pr-template-checks.ts
at module load to build the validation plan. Directives are invisible in
rendered
markdown and must NOT be removed or edited without updating the
validator registry.

  type=text           Section must contain non-placeholder prose.
  type=changelog      Section must have a valid CHANGELOG entry: line.
type=issue-link Section must have a Fixes:/Closes:/Refs: line with a
value.
type=manual-testing Section must have real testing steps or an explicit
N/A.
type=screenshot Section must have evidence (image/URL) or an explicit
N/A.
type=checklist Section must have all checkboxes consciously checked.
required=true|false Whether a missing/invalid section runs the validator
at all.
blocking=true|false Whether a failure of this check fails the CI
workflow.
Default: false — failures are shown as warnings in the sticky
                      comment but do not block the PR.

Sections without a directive are checked for structural presence only.
-->

## **Description**

<!-- mms-check: type=text required=true -->

Consumes the new `atomic` primitive from
`@metamask/transaction-pay-controller` (see
[core#9497](MetaMask/core#9497)) to enable two
previously-blocked Money Account flows:

- **Perps/Predict withdraw → Money Account** — post-quote flow whose
destination is mUSD on Monad. Settled amount is only known after Relay
completes; the transfer to MA now runs as a sponsored post-Relay batch.
All perps/predict withdraws to MA take this non-atomic path (a max flag
cannot be set for these flows, and EXACT_INPUT keeps fee semantics
consistent with standard withdraws).
- **Max-amount Money Account deposit** — `isMaxAmount` forces
EXACT_INPUT so the vault deposit cannot be pre-encoded at quote time.
The vault approve + deposit now runs post-Relay against the
actually-settled mUSD.

The `atomic: false` flag on the transaction config drives the non-atomic
path in TPC. There is no client-configurable `recipient`: TPC derives
where the Relay output settles at quote time — via this app's
`getPaymentOverrideData` callback (which returns the Money Account
address) for post-quote flows, or the transaction's own `from` for max
deposits. Regular (non-max) Money Account deposits and Money Account
withdraws keep the existing atomic path unchanged.

### Changes

- **`transaction-pay.ts` (`applyMoneyAccountOverride`)** — takes
`transactionMeta` and derives whether to set `atomic: false`
(Perps/Predict withdraw) or `refundTo` (Money Account deposit). Money
Account withdraw only gets `paymentOverride`.
- **`transaction-pay.ts` (`setMoneyAccountDepositMaxAtomic`)** — new
helper that flips `config.atomic` on the max toggle for Money Account
deposits.
- **`useTransactionCustomAmount.ts` (`setIsMax`)** — calls
`setMoneyAccountDepositMaxAtomic` when the transaction is a Money
Account deposit, so toggling max on/off correctly flips the non-atomic
path.
- **`useClearPaymentOverride.ts`** — clears `atomic` alongside
`paymentOverride` and `refundTo` when the user switches away from Money
Account pay-with.
- **`paymentoverride-callback.ts`** — forks on `transactionData.atomic`:
atomic path keeps the delegation-wrapped calls; non-atomic path returns
raw `[approve, deposit]` (post-quote deposit) or `[withdraw, transfer]`
(withdraw to MA) so TPC can submit the second leg as a sponsored batch
from the Money Account. The returned `recipient` (Money Account address)
is what TPC uses to settle the Relay quote at quote time.
- **`useInsufficientPredictBalanceAlert.ts`** — fixes the fee check for
predict withdraws: they are EXACT_INPUT (fees deducted from the receive
amount, never added on top), so the old `amount + fees > balance` check
wrongly blocked near-full-balance withdraws. Now mirrors perps: alert
only when fees consume the entire amount.
- **`useInsufficientPerpsBalanceAlert.ts`** — drops the atomic-era
`amount + fees > balance` check for MA-override withdraws; under the
non-atomic flow they are EXACT_INPUT like standard withdraws. The plain
`balance < amount` and `fees >= amount` checks apply to all perps
withdraws.
- **Patch files** — re-generated `@metamask/transaction-pay-controller`
and `@metamask/transaction-controller` patches to match the new core API
surface.

## **Changelog**

<!-- mms-check: type=changelog required=true blocking=true -->

CHANGELOG entry: Enabled Perps/Predict withdraws to Money Account and
max-amount Money Account deposits via the new post-Relay sponsored
deposit flow.

## **Related issues**

<!-- mms-check: type=issue-link required=true -->

Fixes:

## **Manual testing steps**

<!-- mms-check: type=manual-testing required=true -->

```gherkin
Feature: Perps/Predict withdraw to Money Account

  Scenario: user withdraws from Perps to Money Account
    Given user has a Perps position with USDC balance on HyperLiquid
    And user has a Money Account
    When user opens the Perps withdraw flow
    And user selects Money Account as the destination
    And user enters an amount (any amount, including full balance)
    Then a quote appears with the entered amount as source amount
    When user confirms the transaction
    Then Relay settles mUSD directly on the Money Account
    And a sponsored batch approves + deposits the settled mUSD into the vault

  Scenario: user max-deposits into Money Account
    Given user has mUSD on Monad
    And user has a Money Account
    When user opens the Money Account deposit flow
    And user taps "Max"
    Then a quote appears with the full balance as source amount
    When user confirms the transaction
    Then Relay settles mUSD to the Money Account address
    And a sponsored batch approves + deposits mUSD into the vault

  Scenario: regular (non-max) Money Account deposit continues to work
    Given user has mUSD on Monad
    And user has a Money Account
    When user opens the Money Account deposit flow
    And user types a specific (non-max) amount
    Then a quote appears with the typed target amount
    When user confirms the transaction
    Then the atomic embedded vault deposit runs as before

  Scenario: Money Account withdraw to Perps continues to work
    Given user has mUSD in a Money Account
    And user has a Perps account
    When user opens the Money Account withdraw flow
    And user selects Perps as the destination
    And user types an amount
    Then a quote appears
    When user confirms the transaction
    Then the vault withdraw + transfer + Relay bridge complete atomically
```

## **Screenshots/Recordings**

<!-- mms-check: type=screenshot required=true -->

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

N/A — flow was blocked (no quote available for max Perps/Predict
withdraw to MA and max MA deposit).

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

<!-- mms-check: type=checklist required=true -->

<!--
Every checklist item must be consciously assessed before marking this PR
as
"Ready for review". A checked box means you deliberately considered that
responsibility, not that you literally performed every action listed.

Unchecked boxes are ambiguous: they are not an implicit "N/A" and they
are not
a silent "skip". See `docs/readme/ready-for-review.md` for the full
checklist
semantics.
-->

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

<!--
Reviewer checklist items follow the same semantics as the author
checklist: an
unchecked box is ambiguous, a checked box means the reviewer consciously
assessed that responsibility. See `docs/readme/ready-for-review.md`.
-->

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **High Risk**
> Changes payment override, atomic batching, and vault deposit/withdraw
submission paths for real money flows; incorrect atomic or fee logic
could block quotes or mis-settle funds.
> 
> **Overview**
> Wires **`atomic: false`** through Money Account transaction pay so
Perps/Predict withdraws to the Money Account and **max** Money Account
deposits can run vault steps as a **post-Relay** sponsored batch instead
of only inside the atomic bundle.
> 
> **`applyMoneyAccountOverride`** now takes **`transactionMeta`** and
sets **`atomic: false`** for Perps/Predict withdraw, **`refundTo`** for
deposit-direction flows, and nothing extra for Money Account withdraw.
**`setMoneyAccountDepositMaxAtomic`** toggles **`atomic`** when max is
selected on Money Account deposit; **`useTransactionCustomAmount`**
calls it from **`setIsMax`** and treats predict withdraw like perps for
max (**`isMaxAmount`** stays off). **`useClearPaymentOverride`** clears
**`atomic`** unless a max Money Account deposit still needs **`atomic:
false`**.
> 
> **`getPaymentOverrideData`** branches on **`atomic`**: non-atomic
paths return raw withdraw/transfer or approve/deposit calls without
delegation wrap.
> 
> **`hasMax`** is enabled on Money Account deposit and Predict withdraw
UIs. Insufficient-balance alerts for predict and perps withdraws now use
**`getTotalPayFeesUsd`** and only flag fees that **consume the entire**
entered amount (EXACT_INPUT), removing the old **`amount + fees >
balance`** logic for Money Account override perps withdraws.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
8d1b512. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->