@anywalletkit/protocol-swap2-core 0.4.1 → 0.6.0

package/dist/{chunk-SKV5BVXK.js → chunk-MNJTMSFN.js}

@@ -1,4 +1,5 @@
 // src/util.ts
+import { resolveAsset } from "@anywalletkit/swap2-assets";
 function namespace(chain) {
   return chain.split(":")[0] ?? "";
 }
@@ -31,6 +32,10 @@ function anySignal(signals) {
 function redactUrls(text) {
   return text.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>]+/gi, "<url>");
 }
+function sourceAssetOf(params) {
+  const decimals = params.sourceDecimals;
+  return resolveAsset(params.sourceChain, params.sourceToken, decimals === void 0 ? {} : { allowUnlisted: true, decimals });
+}
 
 export {
   namespace,
@@ -38,6 +43,7 @@ export {
   evmRef,
   timeoutSignal,
   anySignal,
-  redactUrls
+  redactUrls,
+  sourceAssetOf
 };
-//# sourceMappingURL=chunk-SKV5BVXK.js.map
+//# sourceMappingURL=chunk-MNJTMSFN.js.map

package/dist/chunk-MNJTMSFN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/util.ts"],"sourcesContent":["import {resolveAsset, type CcAsset} from \"@anywalletkit/swap2-assets\";\nimport type {QuoteParams} from \"./types.js\";\n/** Shared CAIP-2 helpers. Contribution packages never read deployment env. */\nexport function namespace(chain: string): string {\n  return chain.split(\":\")[0] ?? \"\";\n}\n/** True for an `eip155:` chain id. */\nexport function isEvm(chain: string): boolean {\n  return namespace(chain) === \"eip155\";\n}\n/** Numeric chain id of an `eip155:<id>` CAIP-2 id. */\nexport function evmRef(chain: string): number {\n  return Number(chain.split(\":\")[1] ?? \"0\");\n}\n\n/**\n * `AbortSignal.timeout`, portably: Hermes (React Native) ships AbortController\n * but not the static helpers, and the unguarded call threw\n * \"AbortSignal.timeout is not a function\" on every remote execution — which\n * the auction then read as \"no route\". Falls back to a manual controller.\n */\nexport function timeoutSignal(ms: number): AbortSignal {\n  const native = (AbortSignal as unknown as {timeout?: (ms: number) => AbortSignal}).timeout;\n  if (typeof native === \"function\") return native.call(AbortSignal, ms);\n  const ctrl = new AbortController();\n  setTimeout(() => ctrl.abort(), ms);\n  return ctrl.signal;\n}\n\n/** `AbortSignal.any`, portably (see timeoutSignal). */\nexport function anySignal(signals: readonly AbortSignal[]): AbortSignal {\n  const native = (AbortSignal as unknown as {any?: (s: readonly AbortSignal[]) => AbortSignal}).any;\n  if (typeof native === \"function\") return native.call(AbortSignal, signals);\n  const ctrl = new AbortController();\n  for (const s of signals) {\n    if (s.aborted) {\n      ctrl.abort();\n      break;\n    }\n    s.addEventListener(\"abort\", () => ctrl.abort(), {once: true});\n  }\n  return ctrl.signal;\n}\n\n/**\n * Remove URLs from text that may travel to a client (a refusal reason, a build error):\n * transport errors carry the endpoint — and with a keyed RPC (QuickNode, Alchemy,\n * Infura…) the key sits in its path (scan 2026-10-23 F8).\n */\nexport function redactUrls(text: string): string {\n  return text.replace(/\\b[a-z][a-z0-9+.-]*:\\/\\/[^\\s\"'<>]+/gi, \"<url>\");\n}\n\n/**\n * The source asset a provider is asked to sell: the catalog's entry for `params.sourceToken`, or —\n * only when the engine sent `sourceDecimals` (an unlisted token the user added) — an unlisted asset\n * named by its contract / mint. Providers that can trade any token use this instead of the catalog\n * lookup; the others keep refusing what the catalog does not list.\n */\nexport function sourceAssetOf(params: Pick<QuoteParams, \"sourceChain\" | \"sourceToken\" | \"sourceDecimals\">): CcAsset | undefined {\n  const decimals = params.sourceDecimals;\n  return resolveAsset(params.sourceChain, params.sourceToken, decimals === undefined ? {} : {allowUnlisted: true, decimals});\n}\n"],"mappings":";AAAA,SAAQ,oBAAiC;AAGlC,SAAS,UAAU,OAAuB;AAC/C,SAAO,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAChC;AAEO,SAAS,MAAM,OAAwB;AAC5C,SAAO,UAAU,KAAK,MAAM;AAC9B;AAEO,SAAS,OAAO,OAAuB;AAC5C,SAAO,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG;AAC1C;AAQO,SAAS,cAAc,IAAyB;AACrD,QAAM,SAAU,YAAmE;AACnF,MAAI,OAAO,WAAW,WAAY,QAAO,OAAO,KAAK,aAAa,EAAE;AACpE,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,MAAM,KAAK,MAAM,GAAG,EAAE;AACjC,SAAO,KAAK;AACd;AAGO,SAAS,UAAU,SAA8C;AACtE,QAAM,SAAU,YAA8E;AAC9F,MAAI,OAAO,WAAW,WAAY,QAAO,OAAO,KAAK,aAAa,OAAO;AACzE,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,SAAS;AACb,WAAK,MAAM;AACX;AAAA,IACF;AACA,MAAE,iBAAiB,SAAS,MAAM,KAAK,MAAM,GAAG,EAAC,MAAM,KAAI,CAAC;AAAA,EAC9D;AACA,SAAO,KAAK;AACd;AAOO,SAAS,WAAW,MAAsB;AAC/C,SAAO,KAAK,QAAQ,wCAAwC,OAAO;AACrE;AAQO,SAAS,cAAc,QAAkG;AAC9H,QAAM,WAAW,OAAO;AACxB,SAAO,aAAa,OAAO,aAAa,OAAO,aAAa,aAAa,SAAY,CAAC,IAAI,EAAC,eAAe,MAAM,SAAQ,CAAC;AAC3H;","names":[]}

package/dist/{chunk-4H2JVYXT.js → chunk-ZMWK3RQ4.js}

@@ -1,7 +1,7 @@
 import {
   anySignal,
   timeoutSignal
-} from "./chunk-SKV5BVXK.js";
+} from "./chunk-MNJTMSFN.js";
 
 // src/remote.ts
 function remoteProvider(opts) {
@@ -72,11 +72,12 @@ function remoteProvider(opts) {
     },
     ...opts.supportsChain ? { supportsChain: opts.supportsChain.bind(opts) } : {},
     ...opts.supportsChainPair ? { supportsChainPair: opts.supportsChainPair.bind(opts) } : {},
-    ...opts.supportsSameChain !== void 0 ? { supportsSameChain: opts.supportsSameChain } : {}
+    ...opts.supportsSameChain !== void 0 ? { supportsSameChain: opts.supportsSameChain } : {},
+    ...opts.claimTargets ? { claimTargets: opts.claimTargets } : {}
   };
 }
 
 export {
   remoteProvider
 };
-//# sourceMappingURL=chunk-4H2JVYXT.js.map
+//# sourceMappingURL=chunk-ZMWK3RQ4.js.map

package/dist/chunk-ZMWK3RQ4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/remote.ts"],"sourcesContent":["import type {Asset, CrossChainProvider, IntentRef, IntentStatus, Quote, QuoteParams, UnsignedTx} from \"./types.js\";\nimport {anySignal, timeoutSignal} from \"./util.js\";\n\n/**\n * HTTP-proxied `CrossChainProvider`: forwards every provider call to a backend\n * that runs the real provider. This is how a BROWSER context (e.g. a wallet's\n * signing worker) executes the full swap2 layer — account binding,\n * approvals, cell-body guards, id/status lifecycle — while provider secrets\n * (API JWTs, affiliate config) and non-CORS REST endpoints stay server-side.\n *\n * Wire protocol: POST {baseUrl}/{action} with a JSON body, one action per\n * provider method:\n *   quote  {provider, params: QuoteParams}        → Quote | null\n *   build  {provider, quote: Quote}               → UnsignedTx\n *   preflight {provider, quote: Quote, tx: UnsignedTx} → {}\n *   track  {provider, ref: IntentRef}             → IntentStatus\n *   notify {provider, intentId, txHash}           → {}\n *   register {provider, intentId, signature}      → {}\n *   claim  {provider, ref: IntentRef}             → UnsignedTx | null\n *   supports {provider, from, to}                 → {supported: boolean}\n *\n * `supportsRoute`/`enabled` need a SYNC answer, so they are config: pass the\n * routes the backend advertises via `supports`, or leave the default\n * allow-and-let-quote-decide behavior (a null quote is a clean miss).\n */\nexport interface RemoteProviderOptions {\n  /** Provider name the backend multiplexes on (e.g. \"near-intents\"). */\n  name: string;\n  /** Endpoint prefix, e.g. \"/api/v2/swap2\" (same-origin) or absolute URL. */\n  baseUrl: string;\n  /** Sync capability gate; defaults to true (the backend quote decides). */\n  supportsRoute?: (from: Asset, to: Asset) => boolean;\n  /** Optional synchronous dark flag for accurate client-side discovery. */\n  enabled?: () => boolean;\n  /** Optional chain-level discovery hooks mirrored from the backend. */\n  supportsChain?: (caip2: string) => boolean;\n  supportsChainPair?: (fromChain: string, toChain: string) => boolean;\n  /** Explicit opt-in when the backend can execute same-chain swaps. */\n  supportsSameChain?: boolean;\n  /**\n   * The contracts this provider's claims may call, per chain (e.g. `cctpClaimTargets` from\n   * `@anywalletkit/protocol-swap2-cctp`). The app's list, not the server's: without it the engine\n   * refuses claims from this stub (round 3, M24).\n   */\n  claimTargets?: (chain: string) => readonly string[];\n  /** Defaults to globalThis.fetch — injectable for tests. */\n  fetchImpl?: typeof fetch;\n  /** Extra headers (e.g. auth) attached to every call. */\n  headers?: Record<string, string>;\n  /** Per-request fail-closed timeout. Defaults to 12 seconds. */\n  timeoutMs?: number;\n}\n\n/**\n * A provider that runs on your server: quotes, deposits and tracking go to `baseUrl`, so API keys\n * and affiliate settings never ship in the app. The engine still validates every quote and\n * transaction locally before signing.\n */\nexport function remoteProvider(opts: RemoteProviderOptions): CrossChainProvider {\n  const name = opts.name;\n  if (!/^[A-Za-z0-9_-]+$/.test(name)) throw new Error(\"swap2-remote: invalid provider name\");\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n  if (!baseUrl) throw new Error(\"swap2-remote: baseUrl is required\");\n  const supportsRoute = opts.supportsRoute;\n  const enabled = opts.enabled;\n  const headers = Object.freeze({...opts.headers});\n  const doFetch = opts.fetchImpl ?? fetch;\n  const timeoutMs = opts.timeoutMs ?? 12_000;\n  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000) {\n    throw new Error(\"swap2-remote: timeoutMs must be an integer between 1 and 60000\");\n  }\n\n  async function call<T>(action: string, body: Record<string, unknown>, signal?: AbortSignal): Promise<T> {\n    const timeout = timeoutSignal(timeoutMs);\n    const requestSignal = signal ? anySignal([signal, timeout]) : timeout;\n    const res = await doFetch(`${baseUrl}/${action}`, {\n      method: \"POST\",\n      headers: {...headers, \"content-type\": \"application/json\"},\n      // UnsignedTx carries bigint fields (value, gasLimit) — JSON.stringify\n      // throws on them (\"Do not know how to serialize a BigInt\", seen\n      // 2026-10-10 on a Solana → Base preflight). Wire them as decimal strings.\n      body: JSON.stringify({provider: name, ...body}, (_k, v) => (typeof v === \"bigint\" ? v.toString() : v)),\n      signal: requestSignal,\n    });\n    if (!res.ok) {\n      // Surface the backend's message — provider errors are actionable\n      // (\"quote expired\", \"route unsupported\"), not just status codes.\n      const text = await res.text().catch(() => \"\");\n      throw new Error(`swap2-remote ${name}/${action}: ${res.status} ${text.slice(0, 300)}`);\n    }\n    return (await res.json()) as T;\n  }\n\n  return {\n    name,\n    // The browser side has no dark-flag env; the backend enforces its own\n    // flags — a disabled provider simply quotes null / rejects build.\n    enabled: () => enabled ? enabled() : true,\n    supportsRoute(from: Asset, to: Asset): boolean {\n      return supportsRoute ? supportsRoute(from, to) : true;\n    },\n    async getQuote(params: QuoteParams, signal?: AbortSignal): Promise<Quote | null> {\n      const out = await call<Quote | {noQuote: string} | null>(\"quote\", {params}, signal);\n      if (out && typeof out === \"object\" && \"noQuote\" in out) {\n        // The backend forwarded the venue's own refusal — throw it so the\n        // router records a REASON instead of an anonymous null.\n        throw new Error(String((out as {noQuote: unknown}).noQuote).slice(0, 300));\n      }\n      return out;\n    },\n    async buildDeposit(quote: Quote): Promise<UnsignedTx> {\n      return call<UnsignedTx>(\"build\", {quote});\n    },\n    async preflightDeposit(quote: Quote, tx: UnsignedTx): Promise<void> {\n      await call<Record<string, never>>(\"preflight\", {quote, tx});\n    },\n    async trackIntent(ref: IntentRef): Promise<IntentStatus> {\n      return call<IntentStatus>(\"track\", {ref});\n    },\n    async notifyDeposit(intentId: string, txHash: string): Promise<void> {\n      await call<Record<string, never>>(\"notify\", {intentId, txHash});\n    },\n    async registerSignedOrder(intentId: string, signature: string): Promise<void> {\n      await call<Record<string, never>>(\"register\", {intentId, signature});\n    },\n    async buildClaim(ref: IntentRef): Promise<UnsignedTx | null> {\n      const out = await call<UnsignedTx | null | Record<string, never>>(\"claim\", {ref});\n      // A backend without the action (older deploy) answers {} — treat as \"not ready\".\n      if (!out || typeof out !== \"object\" || !(\"to\" in out)) return null;\n      return out as UnsignedTx;\n    },\n    ...(opts.supportsChain ? {supportsChain: opts.supportsChain.bind(opts)} : {}),\n    ...(opts.supportsChainPair ? {supportsChainPair: opts.supportsChainPair.bind(opts)} : {}),\n    ...(opts.supportsSameChain !== undefined ? {supportsSameChain: opts.supportsSameChain} : {}),\n    ...(opts.claimTargets ? {claimTargets: opts.claimTargets} : {}),\n  };\n}\n"],"mappings":";;;;;;AA0DO,SAAS,eAAe,MAAiD;AAC9E,QAAM,OAAO,KAAK;AAClB,MAAI,CAAC,mBAAmB,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACzF,QAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC/C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,mCAAmC;AACjE,QAAM,gBAAgB,KAAK;AAC3B,QAAM,UAAU,KAAK;AACrB,QAAM,UAAU,OAAO,OAAO,EAAC,GAAG,KAAK,QAAO,CAAC;AAC/C,QAAM,UAAU,KAAK,aAAa;AAClC,QAAM,YAAY,KAAK,aAAa;AACpC,MAAI,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,KAAK,YAAY,KAAQ;AACxE,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAEA,iBAAe,KAAQ,QAAgB,MAA+B,QAAkC;AACtG,UAAM,UAAU,cAAc,SAAS;AACvC,UAAM,gBAAgB,SAAS,UAAU,CAAC,QAAQ,OAAO,CAAC,IAAI;AAC9D,UAAM,MAAM,MAAM,QAAQ,GAAG,OAAO,IAAI,MAAM,IAAI;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS,EAAC,GAAG,SAAS,gBAAgB,mBAAkB;AAAA;AAAA;AAAA;AAAA,MAIxD,MAAM,KAAK,UAAU,EAAC,UAAU,MAAM,GAAG,KAAI,GAAG,CAAC,IAAI,MAAO,OAAO,MAAM,WAAW,EAAE,SAAS,IAAI,CAAE;AAAA,MACrG,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AAGX,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,YAAM,IAAI,MAAM,gBAAgB,IAAI,IAAI,MAAM,KAAK,IAAI,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAAA,IACvF;AACA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAEA,SAAO;AAAA,IACL;AAAA;AAAA;AAAA,IAGA,SAAS,MAAM,UAAU,QAAQ,IAAI;AAAA,IACrC,cAAc,MAAa,IAAoB;AAC7C,aAAO,gBAAgB,cAAc,MAAM,EAAE,IAAI;AAAA,IACnD;AAAA,IACA,MAAM,SAAS,QAAqB,QAA6C;AAC/E,YAAM,MAAM,MAAM,KAAuC,SAAS,EAAC,OAAM,GAAG,MAAM;AAClF,UAAI,OAAO,OAAO,QAAQ,YAAY,aAAa,KAAK;AAGtD,cAAM,IAAI,MAAM,OAAQ,IAA2B,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;AAAA,MAC3E;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,aAAa,OAAmC;AACpD,aAAO,KAAiB,SAAS,EAAC,MAAK,CAAC;AAAA,IAC1C;AAAA,IACA,MAAM,iBAAiB,OAAc,IAA+B;AAClE,YAAM,KAA4B,aAAa,EAAC,OAAO,GAAE,CAAC;AAAA,IAC5D;AAAA,IACA,MAAM,YAAY,KAAuC;AACvD,aAAO,KAAmB,SAAS,EAAC,IAAG,CAAC;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,UAAkB,QAA+B;AACnE,YAAM,KAA4B,UAAU,EAAC,UAAU,OAAM,CAAC;AAAA,IAChE;AAAA,IACA,MAAM,oBAAoB,UAAkB,WAAkC;AAC5E,YAAM,KAA4B,YAAY,EAAC,UAAU,UAAS,CAAC;AAAA,IACrE;AAAA,IACA,MAAM,WAAW,KAA4C;AAC3D,YAAM,MAAM,MAAM,KAAgD,SAAS,EAAC,IAAG,CAAC;AAEhF,UAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,EAAE,QAAQ,KAAM,QAAO;AAC9D,aAAO;AAAA,IACT;AAAA,IACA,GAAI,KAAK,gBAAgB,EAAC,eAAe,KAAK,cAAc,KAAK,IAAI,EAAC,IAAI,CAAC;AAAA,IAC3E,GAAI,KAAK,oBAAoB,EAAC,mBAAmB,KAAK,kBAAkB,KAAK,IAAI,EAAC,IAAI,CAAC;AAAA,IACvF,GAAI,KAAK,sBAAsB,SAAY,EAAC,mBAAmB,KAAK,kBAAiB,IAAI,CAAC;AAAA,IAC1F,GAAI,KAAK,eAAe,EAAC,cAAc,KAAK,aAAY,IAAI,CAAC;AAAA,EAC/D;AACF;","names":[]}

package/dist/index.cjs

@@ -54,6 +54,7 @@ __export(src_exports, {
   remoteProvider: () => remoteProvider,
   shortAddress: () => shortAddress,
   slippageClassOf: () => slippageClassOf,
+  sourceAssetOf: () => sourceAssetOf,
   suggestSlippage: () => suggestSlippage,
   swap2ChainId: () => swap2ChainId,
   validQuote: () => validQuote
@@ -158,6 +159,7 @@ function validQuote(q, params, provider) {
 }
 
 // src/util.ts
+var import_swap2_assets = require("@anywalletkit/swap2-assets");
 function namespace(chain) {
   return chain.split(":")[0] ?? "";
 }
@@ -190,6 +192,10 @@ function anySignal(signals) {
 function redactUrls(text) {
   return text.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>]+/gi, "<url>");
 }
+function sourceAssetOf(params) {
+  const decimals = params.sourceDecimals;
+  return (0, import_swap2_assets.resolveAsset)(params.sourceChain, params.sourceToken, decimals === void 0 ? {} : { allowUnlisted: true, decimals });
+}
 
 // src/remote.ts
 function remoteProvider(opts) {
@@ -260,7 +266,8 @@ function remoteProvider(opts) {
     },
     ...opts.supportsChain ? { supportsChain: opts.supportsChain.bind(opts) } : {},
     ...opts.supportsChainPair ? { supportsChainPair: opts.supportsChainPair.bind(opts) } : {},
-    ...opts.supportsSameChain !== void 0 ? { supportsSameChain: opts.supportsSameChain } : {}
+    ...opts.supportsSameChain !== void 0 ? { supportsSameChain: opts.supportsSameChain } : {},
+    ...opts.claimTargets ? { claimTargets: opts.claimTargets } : {}
   };
 }
 
@@ -268,7 +275,7 @@ function remoteProvider(opts) {
 var import_core = require("@anywalletkit/core");
 var import_viem = require("viem");
 var import_tx_preview_evm = require("@anywalletkit/tx-preview-evm");
-var import_swap2_assets = require("@anywalletkit/swap2-assets");
+var import_swap2_assets2 = require("@anywalletkit/swap2-assets");
 var ZERO = "0x0000000000000000000000000000000000000000";
 var ERC20_TRANSFER_ABI = [
   {
@@ -291,12 +298,14 @@ var inFlightKey = (fromChain, o) => JSON.stringify(
   [fromChain, o.fromToken, o.toToken, o.toChain, o.recipient, o.refundAddress, o.fromTokenAmount, o.toTokenAmount, o.minAmountOut, o.slippage],
   (_k, v) => typeof v === "bigint" ? v.toString() : v
 );
+var LOST_ANSWER = /socket hang up|ECONNRESET|ECONNABORTED|ETIMEDOUT|EPIPE|ENETUNREACH|EHOSTUNREACH|EAI_AGAIN|UND_ERR_[A-Z_]+|timed? ?out|TimeoutError|request aborted|AbortError|connection (?:closed|reset)|fetch failed|failed to fetch|network request failed|other side closed/i;
 function maybeSent(error) {
-  for (let e = error, i = 0; e && typeof e === "object" && i < 5; e = e.cause, i++) {
-    if (e.maybeSent === true) return typeof e.hash === "string" && e.hash ? { hash: e.hash } : {};
-  }
-  const text = error instanceof Error ? error.message : String(error);
-  return /socket hang up|ECONNRESET|ETIMEDOUT|EPIPE|timed? ?out|request aborted|connection (?:closed|reset)/i.test(text) ? {} : null;
+  const chain = [];
+  for (let e = error, i = 0; e && typeof e === "object" && i < 6; e = e.cause, i++) chain.push(e);
+  for (const e of chain) if (e.maybeSent === true) return typeof e.hash === "string" && e.hash ? { hash: e.hash } : {};
+  if (chain.some((e) => e.answered === true)) return null;
+  const texts = chain.length ? chain.map((e) => [e.message, e.code, e.name].filter((x) => typeof x === "string").join(" ")) : [String(error)];
+  return texts.some((t) => LOST_ANSWER.test(t)) ? {} : null;
 }
 var NATIVE_DECIMALS = Object.freeze({
   "eip155:5042": 18
@@ -380,22 +389,24 @@ function reviewedIdentity(plan) {
   return JSON.stringify(pinned, (_k, v) => typeof v === "bigint" ? v.toString() : v);
 }
 var SWAP2_ID_PREFIX = "awk1";
-function encodeId(provider, intentId, sourceTxHash) {
+function encodeId(provider, intentId, sourceTxHash, destTxHash) {
   const enc = (v) => encodeURIComponent(v).replace(/\./g, "%2E");
-  return `${SWAP2_ID_PREFIX}.${[provider, intentId, sourceTxHash].filter((v) => v != null).map(enc).join(".")}`;
+  const parts = [provider, intentId, ...sourceTxHash != null ? [sourceTxHash, ...destTxHash != null ? [destTxHash] : []] : []];
+  return `${SWAP2_ID_PREFIX}.${parts.map(enc).join(".")}`;
 }
 function decodeId(id) {
   try {
     if (!id.startsWith(`${SWAP2_ID_PREFIX}.`)) throw new Error("unsupported id version");
     const parts = id.slice(SWAP2_ID_PREFIX.length + 1).split(".");
-    if (parts.length < 2 || parts.length > 3 || !parts[0] || !parts[1]) throw new Error("invalid id shape");
+    if (parts.length < 2 || parts.length > 4 || !parts[0] || !parts[1]) throw new Error("invalid id shape");
     const provider = decodeURIComponent(parts[0]);
     const intentId = decodeURIComponent(parts[1]);
     const sourceTxHash = parts[2] ? decodeURIComponent(parts[2]) : void 0;
-    if (!/^[A-Za-z0-9_-]+$/.test(provider) || !intentId || parts[2] !== void 0 && !sourceTxHash) {
+    const destTxHash = parts[3] ? decodeURIComponent(parts[3]) : void 0;
+    if (!/^[A-Za-z0-9_-]+$/.test(provider) || !intentId || parts[2] !== void 0 && !sourceTxHash || parts[3] !== void 0 && !destTxHash) {
       throw new Error("invalid id contents");
     }
-    return { provider, intentId, ...sourceTxHash ? { sourceTxHash } : {} };
+    return { provider, intentId, ...sourceTxHash ? { sourceTxHash } : {}, ...destTxHash ? { destTxHash } : {} };
   } catch {
     throw new Swap2ValidationError("swap2: malformed swap2 status id");
   }
@@ -447,16 +458,23 @@ function toCaip2(chain, fallback) {
   }
   return swap2ChainId(chain);
 }
+function nonEmptyRef(ref, side) {
+  if (typeof ref !== "string" || ref.trim() === "") throw new Swap2ValidationError(`swap2: ${side} token must not be empty (pass the symbol or the contract address)`);
+  return ref;
+}
 function toSymbol(caip2, ref) {
-  const byToken = ref.startsWith("0x") || ref.length > 20 ? (0, import_swap2_assets.ccAssetByToken)(caip2, ref) : void 0;
+  nonEmptyRef(ref, "source");
+  const byToken = ref.startsWith("0x") || ref.length > 20 ? (0, import_swap2_assets2.ccAssetByToken)(caip2, ref) : void 0;
   if (byToken) return byToken.symbol;
-  if ((0, import_swap2_assets.ccAsset)(caip2, ref)) return ref;
+  if ((0, import_swap2_assets2.ccAsset)(caip2, ref)) return ref;
   return ref;
 }
-function toDestAddress(caip2, ref) {
+function toDestAddress(caip2, ref, allowUnlisted = false) {
+  nonEmptyRef(ref, "destination");
   if (ref.startsWith("0x")) return ref;
-  const asset = (0, import_swap2_assets.ccAssetByToken)(caip2, ref) ?? (0, import_swap2_assets.ccAsset)(caip2, ref);
+  const asset = (0, import_swap2_assets2.ccAssetByToken)(caip2, ref) ?? (0, import_swap2_assets2.ccAsset)(caip2, ref);
   if (!asset) {
+    if (allowUnlisted && (0, import_swap2_assets2.isTokenAddress)(caip2, ref)) return ref;
     throw new Error(`swap2: unknown destination token '${ref}' on ${caip2}`);
   }
   return asset.contract ?? ZERO;
@@ -538,6 +556,15 @@ function mapStatus(s) {
   const status = s.state === "completed" ? "completed" : s.state === "action-required" ? "action-required" : s.state === "refund-pending" ? "refund-pending" : s.state === "partial" ? "partial" : s.state === "failed" ? "failed" : s.state === "refunded" ? "refunded" : s.state === "cancelled" ? "cancelled" : s.state === "expired" ? "expired" : "pending";
   return s.destTxHash ? { status, transactions: [{ hash: s.destTxHash, type: "destination" }] } : { status };
 }
+function blankToUndefined(v) {
+  return typeof v === "string" && v.trim() === "" ? void 0 : v;
+}
+function withoutBlankAddresses(o) {
+  const { recipient, refundAddress, ...rest } = o;
+  const r = blankToUndefined(recipient);
+  const f = blankToUndefined(refundAddress);
+  return { ...rest, ...r !== void 0 ? { recipient: r } : {}, ...f !== void 0 ? { refundAddress: f } : {} };
+}
 var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   fromChain;
   constructor(account, config) {
@@ -570,19 +597,61 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   pairSupported(fromChain, toChain) {
     return this.chainSupported(fromChain) && this.chainSupported(toChain);
   }
+  unlistedAllowed() {
+    return this._config.allowUnlistedTokens === true;
+  }
+  /** The source asset the options name: the catalog's, or (allowUnlistedTokens) an unlisted one with its decimals. */
+  sourceAsset(options) {
+    const decimals = options.fromTokenDecimals;
+    return (0, import_swap2_assets2.resolveAsset)(this.fromChain, toSymbol(this.fromChain, options.fromToken), {
+      allowUnlisted: this.unlistedAllowed(),
+      ...decimals !== void 0 ? { decimals } : {}
+    });
+  }
+  unlistedDecimals = /* @__PURE__ */ new Map();
+  /**
+   * Options ready to quote: with `allowUnlistedTokens`, an unlisted source token gets its decimals,
+   * read from the chain through the account (cached per token) — a caller's `fromTokenDecimals` that
+   * disagrees is refused. Listed tokens and every option otherwise pass through unchanged.
+   */
+  async prepareOptions(options) {
+    if (!this.unlistedAllowed()) return options;
+    const ref = toSymbol(this.fromChain, options.fromToken);
+    if ((0, import_swap2_assets2.resolveAsset)(this.fromChain, ref) || !(0, import_swap2_assets2.isTokenAddress)(this.fromChain, ref)) return options;
+    const key = ref.startsWith("0x") ? ref.toLowerCase() : ref;
+    let decimals = this.unlistedDecimals.get(key);
+    if (decimals === void 0) {
+      const reader = this._account;
+      if (typeof reader?.getTokenInfo !== "function") {
+        if (options.fromTokenDecimals === void 0) {
+          throw new Swap2ValidationError(`swap2: '${ref}' is not in the catalog \u2014 pass fromTokenDecimals, or use an account that can read token info`);
+        }
+        return options;
+      }
+      decimals = (await reader.getTokenInfo(ref)).decimals;
+      this.unlistedDecimals.set(key, decimals);
+    }
+    if (options.fromTokenDecimals !== void 0 && options.fromTokenDecimals !== decimals) {
+      throw new Swap2ValidationError(`swap2: fromTokenDecimals ${options.fromTokenDecimals} does not match the token's ${decimals}`);
+    }
+    return snapshotOptions({ ...options, fromTokenDecimals: decimals });
+  }
   /** Swap2Options → the engine's QuoteParams (exact-in only). */
-  toParams(options, dry) {
+  toParams(given, dry) {
+    const options = withoutBlankAddresses(given);
     if (options.fromTokenAmount == null) {
       throw new Swap2UnsupportedOperationError("swap2: exact-out swap2 is not supported by the engine");
     }
     const destChain = toCaip2(options.toChain, this.fromChain);
     const constraints = callerConstraints(options);
     const amountIn = exactPositiveAmount(options.fromTokenAmount, "fromTokenAmount");
+    const source = this.sourceAsset(options);
     const params = {
       sourceChain: this.fromChain,
-      sourceToken: toSymbol(this.fromChain, options.fromToken),
+      sourceToken: (0, import_swap2_assets2.isUnlisted)(source) ? source.contract : toSymbol(this.fromChain, options.fromToken),
+      ...(0, import_swap2_assets2.isUnlisted)(source) ? { sourceDecimals: source.decimals } : {},
       destChain,
-      destToken: toDestAddress(destChain, options.toToken),
+      destToken: toDestAddress(destChain, options.toToken, this.unlistedAllowed()),
       amountIn: amountIn.toString(),
       destAddress: options.recipient ?? "",
       dry,
@@ -638,7 +707,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     }
   }
   assertQuoteFeeCaps(q, options, config) {
-    const source = (0, import_swap2_assets.ccAsset)(this.fromChain, toSymbol(this.fromChain, options.fromToken));
+    const source = this.sourceAsset(options);
     if (!source) throw new Error(`swap2: unknown source token '${options.fromToken}' on ${this.fromChain}`);
     const token = source.contract ?? source.assetId;
     const fees = q.fees?.map((fee) => ({ ...fee, amount: BigInt(fee.amount) }));
@@ -683,7 +752,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
    * gave one.
    */
   async quoteSwap2(options) {
-    const snapshot = snapshotOptions(options);
+    const snapshot = await this.prepareOptions(snapshotOptions(options));
     const q = await this.resolveQuote(this.toParams(snapshot, true));
     if (!q) {
       const detail = this.noRouteDetail();
@@ -725,9 +794,9 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     this.assertFeeConfig(configSnapshot);
     await this.assertAccountChain(signer);
     const selfAddress = await signer.getAddress();
-    const recipient = snapshot.recipient ?? selfAddress;
-    const refundAddress = snapshot.refundAddress ?? selfAddress;
-    const executionOptions = snapshotOptions({ ...snapshot, recipient, refundAddress });
+    const recipient = blankToUndefined(snapshot.recipient) ?? selfAddress;
+    const refundAddress = blankToUndefined(snapshot.refundAddress) ?? selfAddress;
+    const executionOptions = await this.prepareOptions(snapshotOptions({ ...snapshot, recipient, refundAddress }));
     const params = this.toParams(executionOptions, false);
     const resolved = await this.resolveQuote(params);
     if (!resolved) {
@@ -769,7 +838,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
         throw new Error("swap2: provider build does not match the validated quote transaction");
       }
     } else if (!unsigned.bodyBoc && !unsigned.typedData) {
-      if (!q.depositAddress || unsigned.to !== q.depositAddress || (unsigned.memo ?? null) !== q.depositMemo) {
+      if (!q.depositAddress || unsigned.to !== q.depositAddress || (unsigned.memo ?? null) !== q.depositMemo || unsigned.data !== void 0 || unsigned.approvalAddress !== void 0 || unsigned.serializedTx !== void 0) {
         throw new Error("swap2: provider build does not match the validated quote deposit");
       }
     }
@@ -808,7 +877,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     }
     let tokenId;
     if (!unsigned.data && !unsigned.bodyBoc && !unsigned.typedData && !serialized) {
-      const src = (0, import_swap2_assets.ccAsset)(this.fromChain, toSymbol(this.fromChain, executionOptions.fromToken));
+      const src = this.sourceAsset(executionOptions);
       if (src?.contract) {
         if (this.fromChain.startsWith("eip155:")) {
           unsigned = {
@@ -834,7 +903,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     if (tokenId && (cellBody !== void 0 || unsigned.memo !== void 0 && !tronSource && !nearSource && !tonSource)) {
       throw new Error("swap2: token deposit with memo/cell payload is not implemented");
     }
-    const source = (0, import_swap2_assets.ccAsset)(this.fromChain, toSymbol(this.fromChain, executionOptions.fromToken));
+    const source = this.sourceAsset(executionOptions);
     if (!source) throw new Error(`swap2: unknown source token '${executionOptions.fromToken}' on ${this.fromChain}`);
     const executionValue = BigInt(unsigned.value);
     if (serialized) {
@@ -1124,10 +1193,10 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   }
   /** Status of a swap by the id `swap2()` returned, asked from the provider that executed it. */
   async getSwap2Status(id, _options) {
-    const { provider: name, intentId, sourceTxHash } = decodeId(id);
+    const { provider: name, intentId, sourceTxHash, destTxHash } = decodeId(id);
     const provider = this.providerFor(name);
     if (!provider) throw new Error(`swap2: no swap2 found for id '${id}'`);
-    return mapStatus(await provider.trackIntent(sourceTxHash == null ? { intentId } : { intentId, sourceTxHash }));
+    return mapStatus(await provider.trackIntent({ intentId, ...sourceTxHash != null ? { sourceTxHash } : {}, ...destTxHash != null ? { destTxHash } : {} }));
   }
   /**
    * Two-phase routes (CCTP-style burn-and-mint): once `getSwap2Status` reports
@@ -1173,6 +1242,17 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     if (unsigned.chainId !== void 0 && String(unsigned.chainId) !== expectedId) {
       throw new Error(`swap2: claim chainId ${unsigned.chainId} does not match ${unsigned.chain}`);
     }
+    if (typeof provider.claimTargets !== "function") {
+      throw new Swap2UnsupportedOperationError(`swap2: provider '${name}' declares no claimTargets \u2014 a claim may only call contracts the provider names for its chain`);
+    }
+    const targets = provider.claimTargets(unsigned.chain).map((a) => a.toLowerCase());
+    if (!targets.includes(unsigned.to.toLowerCase())) {
+      throw new Swap2ValidationError(`swap2: claim target ${unsigned.to} is not a contract '${name}' declares for ${unsigned.chain} \u2014 refused`);
+    }
+    const claimCall = (0, import_tx_preview_evm.decodeCall)({ to: unsigned.to, data: unsigned.data, value: 0n });
+    if (claimCall.transfer || claimCall.approval) {
+      throw new Swap2ValidationError(`swap2: claim calldata (${claimCall.method}) moves tokens or grants an allowance \u2014 refused`);
+    }
     const actual = await readAccountChain(signer);
     if (actual == null) throw new Error(`swap2: destination account chain identity is unavailable for ${unsigned.chain}`);
     const actualText = typeof actual === "string" ? actual : String(actual);
@@ -1188,7 +1268,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     });
     if (!sent.hash) throw new Swap2ExecutionError("swap2: account did not return a claim transaction hash");
     this.emitPhase("broadcast", { hash: sent.hash });
-    return { hash: sent.hash, chain: unsigned.chain, id };
+    return { hash: sent.hash, chain: unsigned.chain, id: encodeId(name, intentId, sourceTxHash, sent.hash) };
   }
   /** The inherited bridge() has no floor field: quote first, then bind execution
    * to that quote's minimum so the inherited convenience API stays safe. */
@@ -1230,7 +1310,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   /** Source chains this protocol can swap from. */
   async getSupportedChains() {
     if (!this.protocolEnabled()) return [];
-    return import_swap2_assets.CC_SOURCE_CHAINS.filter((c) => this.chainSupported(c.caip2)).map((c) => ({
+    return import_swap2_assets2.CC_SOURCE_CHAINS.filter((c) => this.chainSupported(c.caip2)).map((c) => ({
       id: c.caip2,
       name: c.label,
       type: chainType(c.caip2),
@@ -1243,12 +1323,14 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     const wantTo = options?.toChain != null ? toCaip2(options.toChain, "") : void 0;
     if (!this.protocolEnabled() || wantFrom && wantTo && !this.pairSupported(wantFrom, wantTo)) return [];
     const out = [];
-    for (const c of import_swap2_assets.CC_SOURCE_CHAINS) {
+    for (const c of import_swap2_assets2.CC_SOURCE_CHAINS) {
       if (!this.chainSupported(c.caip2)) continue;
       if ((wantFrom || wantTo) && c.caip2 !== wantFrom && c.caip2 !== wantTo) continue;
       for (const a of c.assets) {
         out.push({
-          token: a.assetId,
+          // What quoteSwap2 takes back: the contract, or the symbol of the native coin — never the
+          // provider-specific assetId, which is "" for most catalog entries (round 3, M25).
+          token: a.contract ?? a.symbol,
           chain: c.caip2,
           symbol: a.symbol,
           decimals: a.decimals,
@@ -1330,7 +1412,7 @@ var SingleProviderSwap2 = class extends BaseSwap2Protocol {
 
 // src/activity.ts
 var import_core2 = require("@anywalletkit/core");
-var import_swap2_assets2 = require("@anywalletkit/swap2-assets");
+var import_swap2_assets3 = require("@anywalletkit/swap2-assets");
 function calledContract(tx) {
   const to = tx.call?.to ?? tx.to;
   if (!to) return null;
@@ -1367,7 +1449,7 @@ function matchesCall(tx, contracts, selectors) {
   return sel !== void 0 && want.has(sel);
 }
 function chainLabel(caip2) {
-  return (0, import_swap2_assets2.ccChain)(caip2)?.label ?? caip2;
+  return (0, import_swap2_assets3.ccChain)(caip2)?.label ?? caip2;
 }
 function shortAddress(a) {
   return a.length > 14 ? `${a.slice(0, 6)}\u2026${a.slice(-4)}` : a;
@@ -1386,7 +1468,7 @@ function assetMetaFor(tx) {
     const key = token === null ? null : token.startsWith("0x") ? token.toLowerCase() : token;
     const known = fromTransfers.get(key);
     if (known?.symbol !== void 0 && known.decimals !== void 0) return known;
-    const cat = (0, import_swap2_assets2.ccAssetByToken)(tx.chain, token ?? "");
+    const cat = (0, import_swap2_assets3.ccAssetByToken)(tx.chain, token ?? "");
     if (!cat) return known;
     const meta = { symbol: known?.symbol ?? cat.symbol, decimals: known?.decimals ?? cat.decimals };
     return meta;
@@ -1394,7 +1476,7 @@ function assetMetaFor(tx) {
 }
 function assetLabel(tx, a) {
   if (a.symbol) return a.symbol;
-  if (a.token === null) return (0, import_swap2_assets2.ccAssetByToken)(tx.chain, "")?.symbol ?? "native";
+  if (a.token === null) return (0, import_swap2_assets3.ccAssetByToken)(tx.chain, "")?.symbol ?? "native";
   return shortAddress(a.token);
 }
 function ownerAssets(tx, ctx) {