@circle-fin/app-kit 1.10.0 → 1.11.0

package/index.mjs

@@ -16,6 +16,17 @@
  * limitations under the License.
  */
 
+// Buffer polyfill setup - executes before any other code
+// Ensures globalThis.Buffer is available for Solana libraries
+import { Buffer } from 'buffer';
+if (typeof globalThis !== 'undefined' && typeof globalThis.Buffer === 'undefined') {
+    globalThis.Buffer = Buffer;
+}
+if (typeof window !== 'undefined' && typeof window.Buffer === 'undefined') {
+    window.Buffer = Buffer;
+}
+
+
 import { z } from 'zod';
 import pino from 'pino';
 import { parseUnits as parseUnits$1, formatUnits as formatUnits$1 } from '@ethersproject/units';
@@ -82,6 +93,51 @@ import { keccak256 } from '@ethersproject/keccak256';
  * }
  * ```
  */ const isNodeEnvironment = ()=>typeof process !== 'undefined' && typeof process.versions === 'object' && typeof process.versions.node === 'string';
+/**
+ * Check whether the current runtime exposes a browser DOM.
+ *
+ * @remarks
+ * This intentionally does not treat every non-Node runtime as a browser.
+ * Server-side edge runtimes such as Cloudflare Workers, Deno, and Supabase
+ * Edge Functions do not expose Node globals but can safely use server
+ * credentials. A Node.js runtime remains server-side even when a test or SSR
+ * environment provides a DOM shim.
+ *
+ * @returns `true` when running in a browser window, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * import { isBrowserEnvironment } from '@core/utils'
+ *
+ * if (isBrowserEnvironment()) {
+ *   throw new Error('Server-only secrets must not be used in the browser')
+ * }
+ * ```
+ */ const isBrowserEnvironment = ()=>{
+    const browserWindow = globalThis.window;
+    return !isNodeEnvironment() && browserWindow?.document !== undefined;
+};
+/**
+ * Return the SDK User-Agent request header only when running in Node.js.
+ *
+ * Browsers forbid manually setting `User-Agent`, and a custom fallback header
+ * can trigger CORS preflight. Non-Node server runtimes also omit this optional
+ * attribution header because they cannot set it reliably.
+ *
+ * @returns A User-Agent header in Node.js, or an empty object otherwise.
+ *
+ * @example
+ * ```typescript
+ * import { getNodeUserAgentHeader } from '@core/utils'
+ *
+ * const headers = {
+ *   'Content-Type': 'application/json',
+ *   ...getNodeUserAgentHeader(),
+ * }
+ * ```
+ */ const getNodeUserAgentHeader = ()=>isNodeEnvironment() ? {
+        'User-Agent': getUserAgent()
+    } : {};
 /**
  * Detect the runtime environment and return a shortened identifier.
  *
@@ -9282,13 +9338,12 @@ const swapTokenEnumSchema = z.enum([
         headers: {
             ...DEFAULT_CONFIG$3.headers,
             ...config.headers ?? {},
-            // In browser environments, directly setting the 'User-Agent' or similar headers is restricted and may be ignored or cause errors.
-            // This is why we use the 'X-User-Agent' header instead.
-            ...typeof window === 'undefined' ? {
-                'User-Agent': getUserAgent()
-            } : {
-                'X-User-Agent': getUserAgent()
-            }
+            // Browsers forbid setting a user-agent request header, and the custom
+            // fallback header the SDK used instead trips CORS preflight against the
+            // Circle APIs (it isn't in their `Access-Control-Allow-Headers`),
+            // blocking the request. So send the SDK user agent only in Node;
+            // browsers omit it entirely.
+            ...getNodeUserAgentHeader()
         }
     };
     let lastError;
@@ -11219,6 +11274,7 @@ function resolveOptions(options) {
     if (payload.tokenIn !== undefined) safe['tokenIn'] = payload.tokenIn;
     if (payload.tokenOut !== undefined) safe['tokenOut'] = payload.tokenOut;
     if (payload.txHash !== undefined) safe['txHash'] = payload.txHash;
+    if (payload.correlationId !== undefined) safe['correlationId'] = payload.correlationId;
     if (payload.errorDetails !== undefined) {
         const errorDetails = {
             ...payload.errorDetails.errorCode !== undefined && {
@@ -11289,18 +11345,15 @@ function resolveOptions(options) {
         timeoutHandle.unref();
     }
     try {
-        const isNode = isNodeEnvironment();
-        const userAgent = getUserAgent();
         await fetch(getLogsUrl(), {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                // Browser restricts setting User-Agent; use X-User-Agent instead.
-                ...isNode ? {
-                    'User-Agent': userAgent
-                } : {
-                    'X-User-Agent': userAgent
-                }
+                // Browsers forbid setting a user-agent request header, and the custom
+                // fallback header the SDK used instead trips CORS preflight (it isn't
+                // in the telemetry endpoint's `Access-Control-Allow-Headers`), so send
+                // it only in Node; browsers omit it entirely.
+                ...getNodeUserAgentHeader()
             },
             body: JSON.stringify(toSafePayload(payload)),
             signal: controller.signal
@@ -11513,7 +11566,7 @@ function resolveOptions(options) {
         // discards the stack trace, nested `cause`, and any custom Error
         // properties — exactly the context an on-call needs when a
         // resolver-closure regression triggers this path.
-        console.warn(`[stablecoin-kits telemetry] dropped error event '${eventType}':`, cause);
+        console.warn(`[stablecoin-kits telemetry] dropped event '${eventType}':`, cause);
     } catch  {
     // console.warn itself throwing is the user's environment; nothing more we
     // can do without risking the original operation error.
@@ -11529,7 +11582,9 @@ function resolveOptions(options) {
         sdkVersion: config.sdkVersion,
         eventType,
         timestamp: new Date().toISOString(),
-        errorDetails,
+        ...errorDetails !== undefined && {
+            errorDetails
+        },
         clientContext: buildClientContext(),
         ...context?.sourceChain != null && {
             sourceChain: context.sourceChain
@@ -11545,9 +11600,45 @@ function resolveOptions(options) {
         },
         ...context?.txHash != null && {
             txHash: context.txHash
+        },
+        ...context?.correlationId != null && {
+            correlationId: context.correlationId
         }
     };
 }
+/**
+ * Emit telemetry for a completed operation without affecting its caller.
+ *
+ * No-ops when `config.disabled` is `true`. Like {@link withErrorTelemetry},
+ * failures while constructing or submitting the telemetry payload are reported
+ * as a soft warning and never change a completed operation's result.
+ *
+ * @param eventType - The telemetry event type for the completed operation.
+ * @param config - Per-kit SDK identity and disabled flag.
+ * @param context - Optional chain, token, and transaction context.
+ * @returns Nothing.
+ * @throws Never — telemetry failures are reported as warnings.
+ *
+ * @example
+ * ```typescript
+ * import { emitSuccessTelemetry } from '@core/utils'
+ *
+ * emitSuccessTelemetry(
+ *   'bridge_bridge',
+ *   { sdkName: 'bridge-kit', sdkVersion: '1.0.0', disabled: false },
+ *   { sourceChain: 'Ethereum', destinationChain: 'Base', tokenIn: 'USDC' },
+ * )
+ * ```
+ */ function emitSuccessTelemetry(eventType, config, context) {
+    if (config.disabled) {
+        return;
+    }
+    try {
+        void emitAnalyticsLog(buildPayload$1(config, eventType, undefined, context));
+    } catch (telemetryError) {
+        warnTelemetryDrop(eventType, telemetryError);
+    }
+}
 /**
  * Wrap an async operation with error telemetry.
  *
@@ -11658,7 +11749,7 @@ function resolveOptions(options) {
 }
 
 var name$4 = "@circle-fin/bridge-kit";
-var version$5 = "1.12.1";
+var version$5 = "1.12.2";
 var pkg$5 = {
 	name: name$4,
 	version: version$5};
@@ -14294,7 +14385,13 @@ const FAST_TIER_FINALITY_THRESHOLD = 1000;
 /**
  * The ASCII "cctp-forward" magic, hex-encoded (no `0x`), that a forward-friendly
  * hookData must start with.
- */ const CCTP_FORWARD_MAGIC_HEX = Buffer.from(CCTP_FORWARD_MAGIC_PREFIX, 'ascii').toString('hex');
+ *
+ * Encoded with `TextEncoder` (a browser-safe Web API) rather than `Buffer.from`
+ * so this module-level constant does not reference the Node `Buffer` global at
+ * import time. App Kit inlines this provider into its bundle without a Buffer polyfill, and a
+ * bare `Buffer` here crashes browser bundles (e.g. Vite) on load — even for apps
+ * that never touch the prepaid FORWARD path. Mirrors `buildForwardingHookData`.
+ */ const CCTP_FORWARD_MAGIC_HEX = Array.from(new TextEncoder().encode(CCTP_FORWARD_MAGIC_PREFIX)).map((byte)=>byte.toString(16).padStart(2, '0')).join('');
 /**
  * Determine whether a hookData blob begins with the `cctp-forward` envelope.
  *
@@ -16732,7 +16829,7 @@ const mockAttestationMessage = {
     return step;
 }
 
-var version$4 = "1.10.0";
+var version$4 = "1.10.1";
 var pkg$4 = {
 	version: version$4};
 
@@ -18611,7 +18708,7 @@ function assertCCTPV2Config(config) {
     ]
 ];
 
-/** SDK name used in telemetry payloads. */ const SDK_NAME$2 = resolveKitSdkName(pkg$5.name);
+/** SDK name used in telemetry payloads. */ const SDK_NAME$3 = resolveKitSdkName(pkg$5.name);
 /**
  * Pick the most-relevant `txHash` to attach to an error telemetry payload.
  *
@@ -18753,7 +18850,7 @@ function assertCCTPV2Config(config) {
         this.actionDispatcher = new Actionable();
         this.disableErrorReporting = config.disableErrorReporting === true;
         this.telemetryConfig = {
-            sdkName: SDK_NAME$2,
+            sdkName: SDK_NAME$3,
             sdkVersion: pkg$5.version,
             disabled: this.disableErrorReporting
         };
@@ -19346,7 +19443,7 @@ registerKit(`${pkg$5.name}/${pkg$5.version}`);
 };
 
 var name$3 = "@circle-fin/swap-kit";
-var version$3 = "1.4.0";
+var version$3 = "1.5.0";
 var pkg$3 = {
 	name: name$3,
 	version: version$3};
@@ -20179,6 +20276,16 @@ getQuoteRequestBaseSchema.superRefine(requireCrossChainQuoteToAddress);
         required_error: 'estimatedAmount is required',
         invalid_type_error: 'estimatedAmount must be a string'
     }).min(1, 'estimatedAmount must be a non-empty string'),
+    // Per-swap join key echoed back verbatim on success telemetry. Optional so a
+    // not-yet-upgraded service (no field) still validates during rollout. A
+    // malformed/non-UUID value is coerced to `undefined` (no telemetry id) rather
+    // than throwing: this is a telemetry-only field (stripped from the developer
+    // result, never used for control flow), so it must not be able to abort the
+    // swap via `parseCreateSwapResponse().parse()`. Mirrors the best-effort,
+    // never-throw contract of the rest of the telemetry stack. Implemented with
+    // `preprocess` rather than Zod's `.catch()` because static analysis misreads
+    // `.catch` on the schema chain as an unhandled Promise (S7785).
+    correlationId: z.preprocess((value)=>z.string().uuid().safeParse(value).success ? value : undefined, z.string().optional()),
     config: createSwapRequestBaseSchema.shape.config.optional(),
     fees: createSwapFeesSchema.optional(),
     transaction: createSwapTransactionSchema
@@ -20304,6 +20411,45 @@ getQuoteRequestBaseSchema.superRefine(requireCrossChainQuoteToAddress);
     // Validate without trimming - any whitespace will cause validation to fail
     return apiKeyPattern.test(apiKey);
 };
+/**
+ * Assert that a Stablecoin Service kit key is not being supplied from a browser.
+ *
+ * The kit key (`KIT_KEY:<id>:<secret>`) is a server-only secret. Every
+ * Stablecoin Service request that attaches an `Authorization: Bearer` header
+ * funnels through this package, so calling this guard before that header is
+ * built prevents the secret from being sent from — and thus bundled into — a
+ * client application. In Node.js the check is a no-op, preserving the
+ * legitimate "hold the kit key on the server, forward the prepared transaction
+ * to the client" flow. When no kit key is supplied the permissionless (keyless)
+ * client path remains fully allowed.
+ *
+ * @param apiKey - The inline kit key for the request, or `undefined` when none
+ *   was supplied (permissionless mode).
+ * @returns Nothing.
+ * @throws KitError with VALIDATION_FAILED when a kit key is supplied while
+ *   running in a browser environment. The secret value is never echoed.
+ *
+ * @example
+ * ```typescript
+ * import { assertBrowserSafeApiKey } from '@core/service-client'
+ *
+ * // Server (Node.js): no-op, request proceeds with the Authorization header.
+ * assertBrowserSafeApiKey('KIT_KEY:my-id:my-secret')
+ *
+ * // Browser: throws to stop the secret from leaking into the client bundle.
+ * assertBrowserSafeApiKey('KIT_KEY:my-id:my-secret')
+ *
+ * // Browser, permissionless: allowed.
+ * assertBrowserSafeApiKey(undefined)
+ * ```
+ */ const assertBrowserSafeApiKey = (apiKey)=>{
+    if (apiKey === undefined) {
+        return;
+    }
+    if (isBrowserEnvironment()) {
+        throw createValidationFailedError$1('kitKey', '[redacted]', 'kitKey must not be provided in a browser environment — it is a server-only secret. Run kit operations that use a kit key on your server, or omit kitKey to use the permissionless (keyless) client path');
+    }
+};
 
 /**
  * Create a cross-chain bridge and swap transaction through the Stablecoin Service.
@@ -20361,6 +20507,8 @@ getQuoteRequestBaseSchema.superRefine(requireCrossChainQuoteToAddress);
     const url = new URL('/v1/stablecoinKits/swap', STABLECOIN_SERVICE_BASE_URL).toString();
     // Remove the API key from the request body
     const { apiKey, ...requestBody } = validatedParams;
+    // Never let a server-only kit key leave a browser (no-op in Node.js).
+    assertBrowserSafeApiKey(apiKey);
     const effectiveConfig = {
         ...DEFAULT_CONFIG$1,
         headers: {
@@ -20515,6 +20663,8 @@ getQuoteRequestBaseSchema.superRefine(requireCrossChainQuoteToAddress);
     }
     // Use validated data
     const validatedParams = result.data;
+    // Never let a server-only kit key leave a browser (no-op in Node.js).
+    assertBrowserSafeApiKey(validatedParams.apiKey);
     // Build the API URL
     const url = buildQuoteUrl(validatedParams);
     // Merge default config with Authorization header
@@ -20587,6 +20737,8 @@ getQuoteRequestBaseSchema.superRefine(requireCrossChainQuoteToAddress);
             toChain: result.data.toChain
         }
     };
+    // Never let a server-only kit key leave a browser (no-op in Node.js).
+    assertBrowserSafeApiKey(validatedParams.apiKey);
     const url = buildSwapStatusUrl(validatedParams);
     const effectiveConfig = {
         ...DEFAULT_CONFIG$1,
@@ -20691,6 +20843,8 @@ getQuoteRequestBaseSchema.superRefine(requireCrossChainQuoteToAddress);
             addresses: result.data.addresses
         }
     };
+    // Never let a server-only kit key leave a browser (no-op in Node.js).
+    assertBrowserSafeApiKey(validatedParams.apiKey);
     const url = buildTokenRatesUrl(validatedParams);
     const effectiveConfig = {
         ...DEFAULT_CONFIG$1,
@@ -27462,6 +27616,11 @@ async function fetchSameChainStatusSnapshot({ isCrossChainSwap, txHash, chain, a
                 apiKey: serviceParams.apiKey
             }
         });
+        // Per-swap correlation id returned by the service as a top-level response
+        // field for every chain (EVM + Solana). Attached to success telemetry so a
+        // swap can be correlated across records; never used for control flow.
+        // Undefined only against a not-yet-upgraded service that omits it.
+        const correlationId = serviceResponse.correlationId;
         // Build and return SwapResult
         return {
             tokenIn,
@@ -27471,6 +27630,9 @@ async function fetchSameChainStatusSnapshot({ isCrossChainSwap, txHash, chain, a
             fromAddress: serviceParams.fromAddress,
             toAddress: serviceParams.toAddress,
             txHash,
+            ...correlationId !== undefined && {
+                correlationId
+            },
             executedTransactions,
             ...config !== undefined && {
                 config
@@ -30370,7 +30532,13 @@ async function resolveTokenDecimals(context, resolvedParams) {
  *   amountIn: '50.00'
  * })
  * ```
- */ async function swap$1(context, params, /** @internal */ onBroadcast) {
+ */ async function swap$1(context, params, /**
+   * @internal
+   * Invoked after a successful broadcast with the on-chain `txHash` and the
+   * service-issued `correlationId` (join key for success telemetry). The
+   * service returns `correlationId` for every chain (EVM + Solana); it is
+   * undefined only against a not-yet-upgraded service that omits the field.
+   */ onBroadcast) {
     // Step 1: Validate parameters using schema
     assertSwapParams(params, swapParamsSchema);
     // Step 2: Resolve parameters (chain definitions, wallet addresses, token aliases preserved)
@@ -30390,13 +30558,16 @@ async function resolveTokenDecimals(context, resolvedParams) {
     // Step 5: Execute swap via provider
     const swapParams = buildServiceSwapParams(resolvedParams, paramsWithFees);
     const providerResult = await provider.swap(swapParams);
+    // `correlationId` is an internal telemetry join key, not part of the public
+    // SwapResult — strip it here so it never leaks into the formatted result.
+    const { correlationId, ...providerResultPublic } = providerResult;
     // A throwing `onBroadcast` must never strand the caller after a
     // successful swap broadcast — the chain has moved. `safeInvokeCallback`
     // swallows the error and surfaces a `console.warn` prefixed with
     // `[stablecoin-kits swap-kit] callback threw and was swallowed:` so a
     // kit-side closure bug stays debuggable rather than vanishing.
     safeInvokeCallback('swap-kit', ()=>{
-        onBroadcast?.(providerResult.txHash);
+        onBroadcast?.(providerResultPublic.txHash, correlationId);
     });
     const { tokenInDecimals, tokenOutDecimals } = await resolveTokenDecimals(context, resolvedParams);
     // Step 6: Compose chain identity (owned by the kit, derived from the
@@ -30405,10 +30576,10 @@ async function resolveTokenDecimals(context, resolvedParams) {
     // resolves `progress` — the provider's snapshot, or a terminal `'DONE'` for
     // a provider that omits it (a synchronous same-chain completion).
     const composedResult = {
-        ...providerResult,
+        ...providerResultPublic,
         chainIn: resolvedParams.from.chain,
         chainOut: resolvedParams.toChain ?? resolvedParams.from.chain,
-        progress: providerResult.progress ?? {
+        progress: providerResultPublic.progress ?? {
             status: 'DONE'
         }
     };
@@ -31189,7 +31360,7 @@ function resolveTokenEntry(entry, index, chain, chainDef, context) {
     ESTIMATE: 'swap_estimate'
 };
 
-/** SDK name used in telemetry payloads. */ const SDK_NAME$1 = resolveKitSdkName(pkg$3.name);
+/** SDK name used in telemetry payloads. */ const SDK_NAME$2 = resolveKitSdkName(pkg$3.name);
 /**
  * A high-level class-based interface for same-chain and cross-chain token swap operations.
  *
@@ -31261,7 +31432,13 @@ function resolveTokenEntry(entry, index, chain, chainDef, context) {
  */ class SwapKit {
     context;
     /** Whether error telemetry is disabled. */ disableErrorReporting;
-    /** Per-kit telemetry identity for shared helpers. */ telemetryConfig;
+    /** Per-kit telemetry identity for error reporting. */ telemetryConfig;
+    /**
+   * Per-kit telemetry identity for success/analytics events. Gated by
+   * `disableAnalytics` (independent of `disableErrorReporting`) so a developer
+   * can opt out of volume analytics without also silencing error reports —
+   * mirrors EarnKit.
+   */ analyticsTelemetryConfig;
     /**
    * Create a new SwapKit instance.
    *
@@ -31311,10 +31488,15 @@ function resolveTokenEntry(entry, index, chain, chainDef, context) {
         this.context = createSwapKitContext(config);
         this.disableErrorReporting = config.disableErrorReporting === true;
         this.telemetryConfig = {
-            sdkName: SDK_NAME$1,
+            sdkName: SDK_NAME$2,
             sdkVersion: pkg$3.version,
             disabled: this.disableErrorReporting
         };
+        this.analyticsTelemetryConfig = {
+            sdkName: SDK_NAME$2,
+            sdkVersion: pkg$3.version,
+            disabled: config.disableAnalytics === true
+        };
     }
     /**
    * Estimate the output amount and fees for a swap operation.
@@ -31355,8 +31537,12 @@ function resolveTokenEntry(entry, index, chain, chainDef, context) {
    * console.log(`Fees:`, quote.fees)
    * ```
    */ async estimate(params) {
+        const destinationChain = params.to?.chain ? resolveChainName(params.to.chain) : undefined;
         return withErrorTelemetry(async ()=>estimate(this.context, params), SWAP_EVENT_TYPES.ESTIMATE, this.telemetryConfig, {
             sourceChain: resolveChainName(params.from.chain),
+            ...destinationChain != null && {
+                destinationChain
+            },
             tokenIn: params.tokenIn,
             tokenOut: params.tokenOut
         });
@@ -31415,16 +31601,54 @@ function resolveTokenEntry(entry, index, chain, chainDef, context) {
    * ```
    */ async swap(params) {
         let txHash;
-        return withErrorTelemetry(async ()=>swap$1(this.context, params, (h)=>{
-                txHash = h;
-            }), SWAP_EVENT_TYPES.SWAP, this.telemetryConfig, ()=>({
+        let correlationId;
+        // Shared context builder so the error resolver and the success emit stay in
+        // lockstep — a field added here reaches both call sites. Reads the per-call
+        // locals lazily, so txHash/correlationId (set during the swap) are captured
+        // whenever it is invoked.
+        // Destination chain is the primary attribution dimension for cross-chain
+        // swaps; resolved once from the (static) params. Omitted for same-chain
+        // swaps that leave `to.chain` unset (destination == source).
+        const destinationChain = params.to?.chain ? resolveChainName(params.to.chain) : undefined;
+        const buildTelemetryContext = ()=>({
                 sourceChain: resolveChainName(params.from.chain),
+                ...destinationChain != null && {
+                    destinationChain
+                },
                 tokenIn: params.tokenIn,
                 tokenOut: params.tokenOut,
                 ...txHash != null && {
                     txHash
+                },
+                ...correlationId != null && {
+                    correlationId
                 }
-            }));
+            });
+        const result = await withErrorTelemetry(async ()=>swap$1(this.context, params, (h, cId)=>{
+                txHash = h;
+                correlationId = cId;
+            }), SWAP_EVENT_TYPES.SWAP, this.telemetryConfig, buildTelemetryContext);
+        // withErrorTelemetry only emits on failure. Record the successful swap here
+        // so the backend can attribute swap volume to a developer: the client event
+        // carries the (burn) txHash + correlationId, which joins to the
+        // server-emitted event carrying entity_id. Best-effort; never throws.
+        //
+        // Emit whenever a broadcast happened, i.e. we have the source/burn txHash.
+        // For a cross-chain swap that is the source-chain burn (progress is still
+        // PENDING while the destination mint settles) — we intentionally attribute
+        // at broadcast using the burn txHash rather than tracking the destination
+        // leg, which keeps the capture simple and self-contained in swap().
+        //
+        // Guard against a terminal-failure result: the EVM provider throws on
+        // revert today, but the kit is provider-agnostic, so a provider that
+        // returns a FAILED/NOT_FOUND result without throwing must not be recorded
+        // as a successful swap. Routed through analyticsTelemetryConfig so it is
+        // gated by disableAnalytics, independent of error reporting.
+        const status = result.progress?.status;
+        if (txHash != null && status !== 'FAILED' && status !== 'NOT_FOUND') {
+            emitSuccessTelemetry(SWAP_EVENT_TYPES.SWAP, this.analyticsTelemetryConfig, buildTelemetryContext());
+        }
+        return result;
     }
     /**
    * Fetch the current status of a swap from the Stablecoin Service.
@@ -31803,6 +32027,9 @@ registerKit(`${pkg$3.name}/${pkg$3.version}`);
     const kit = new SwapKit({
         ...context.disableErrorReporting != null && {
             disableErrorReporting: context.disableErrorReporting
+        },
+        ...context.disableAnalytics != null && {
+            disableAnalytics: context.disableAnalytics
         }
     });
     if (hasBoth) {
@@ -31864,7 +32091,7 @@ registerKit(`${pkg$3.name}/${pkg$3.version}`);
 };
 
 var name$2 = "@circle-fin/earn-kit";
-var version$2 = "1.3.0";
+var version$2 = "1.4.0";
 var pkg$2 = {
 	name: name$2,
 	version: version$2};
@@ -33863,7 +34090,7 @@ const bridgeDepositPrepareReviewSchema = z.object({
 }
 
 var name$1 = "@circle-fin/provider-earn-service";
-var version$1 = "1.3.0";
+var version$1 = "1.3.1";
 var pkg$1 = {
 	name: name$1,
 	version: version$1};
@@ -33925,15 +34152,25 @@ var pkg$1 = {
  *
  * @internal
  */ function buildConfig(serviceConfig) {
+    // The kit key is a server-only secret. Reject it in the browser so it cannot
+    // leak into a client bundle (no-op in Node.js). Keyless usage stays allowed.
+    if (serviceConfig?.kitKey !== undefined && isBrowserEnvironment()) {
+        throw createValidationFailedError$1('kitKey', '[redacted]', 'kitKey must not be provided in a browser environment — it is a server-only secret. Run EarnKit operations that use a kit key on your server, or omit kitKey to use the permissionless (keyless) client path');
+    }
     const baseUrl = serviceConfig?.baseUrl ?? EARN_SERVICE_BASE_URL;
-    const sdkVersion = resolveSdkVersionHeader();
+    // The API CORS policy does not allow this custom header. Keep the existing
+    // per-request version attribution for Node callers, but omit it in browsers
+    // so public EarnKit endpoints do not fail at CORS preflight.
+    const sdkVersionHeader = isNodeEnvironment() ? {
+        [SDK_VERSION_HEADER]: resolveSdkVersionHeader()
+    } : {};
     if (serviceConfig?.kitKey === undefined) {
         return {
             pollingConfig: {
                 ...DEFAULT_CONFIG,
                 headers: {
                     ...DEFAULT_CONFIG.headers,
-                    [SDK_VERSION_HEADER]: sdkVersion
+                    ...sdkVersionHeader
                 }
             },
             baseUrl
@@ -33951,7 +34188,7 @@ var pkg$1 = {
             ...DEFAULT_CONFIG,
             headers: {
                 ...DEFAULT_CONFIG.headers,
-                [SDK_VERSION_HEADER]: sdkVersion,
+                ...sdkVersionHeader,
                 Authorization: `Bearer ${serviceConfig.kitKey}`
             }
         },
@@ -36065,6 +36302,12 @@ function createUnsupportedCrossChainDepositError(chain, reason) {
     if (config.providers !== undefined && !Array.isArray(config.providers)) {
         throw createValidationFailedError$1('config.providers', config.providers, 'providers must be an array of earn providers when provided');
     }
+    if (config.disableAnalytics !== undefined && typeof config.disableAnalytics !== 'boolean') {
+        throw createValidationFailedError$1('config.disableAnalytics', config.disableAnalytics, 'disableAnalytics must be a boolean when provided');
+    }
+    if (config.disableErrorReporting !== undefined && typeof config.disableErrorReporting !== 'boolean') {
+        throw createValidationFailedError$1('config.disableErrorReporting', config.disableErrorReporting, 'disableErrorReporting must be a boolean when provided');
+    }
     const defaultProviders = getDefaultProviders$1();
     const providers = [
         ...config.providers ?? [],
@@ -36076,6 +36319,31 @@ function createUnsupportedCrossChainDepositError(chain, reason) {
     return context;
 }
 
+/**
+ * Register Earn Kit telemetry event type strings with the shared registry so
+ * error telemetry helpers remain compile-time checked.
+ *
+ * @internal
+ */ /**
+ * Telemetry event type identifiers for Earn Kit operations.
+ *
+ * @internal
+ */ const EARN_EVENT_TYPES = {
+    GET_VAULTS: 'earn_get_vaults',
+    EXPLORE_VAULTS: 'earn_explore_vaults',
+    GET_POSITION: 'earn_get_position',
+    GET_CROSS_CHAIN_DEPOSIT_STATUS: 'earn_get_cross_chain_deposit_status',
+    WAIT_FOR_CROSS_CHAIN_DEPOSIT: 'earn_wait_for_cross_chain_deposit',
+    DEPOSIT: 'earn_deposit',
+    CROSS_CHAIN_DEPOSIT: 'earn_cross_chain_deposit',
+    WITHDRAW: 'earn_withdraw',
+    CLAIM_REWARDS: 'earn_claim_rewards',
+    GET_DEPOSIT_QUOTE: 'earn_get_deposit_quote',
+    GET_WITHDRAWAL_QUOTE: 'earn_get_withdrawal_quote',
+    GET_CLAIM_REWARDS_QUOTE: 'earn_get_claim_rewards_quote',
+    RETRY: 'earn_retry'
+};
+
 /**
  * Format a provider amount object as a human-readable decimal string.
  *
@@ -37591,6 +37859,14 @@ function hasCrossChainDestination(params) {
     return formatClaimRewardsQuoteInfo(result);
 }
 
+/** SDK name used in telemetry payloads. */ const SDK_NAME$1 = resolveKitSdkName(pkg$2.name);
+/**
+ * Determine whether deposit parameters target a destination chain.
+ *
+ * @internal
+ */ function isCrossChainDeposit(params) {
+    return 'to' in params && params.to !== undefined;
+}
 function formatRetryResult(operation, result) {
     switch(operation){
         case 'deposit':
@@ -37605,6 +37881,70 @@ function formatRetryResult(operation, result) {
             }
     }
 }
+/**
+ * Emit the success event corresponding to a completed retry.
+ *
+ * @internal
+ */ function emitRetrySuccessTelemetry(trace, result, config) {
+    switch(trace.operation){
+        case 'deposit':
+            {
+                const sourceChain = resolveChainName(trace.params.from.chain);
+                if ('to' in trace.params && trace.params.to !== undefined) {
+                    const destinationChain = resolveChainName(trace.params.to.chain);
+                    emitSuccessTelemetry(EARN_EVENT_TYPES.CROSS_CHAIN_DEPOSIT, config, {
+                        ...sourceChain != null && {
+                            sourceChain
+                        },
+                        ...destinationChain != null && {
+                            destinationChain
+                        }
+                    });
+                    return;
+                }
+                emitSuccessTelemetry(EARN_EVENT_TYPES.DEPOSIT, config, {
+                    ...sourceChain != null && {
+                        sourceChain
+                    },
+                    ...'txHash' in result && {
+                        txHash: result.txHash
+                    }
+                });
+                return;
+            }
+        case 'withdraw':
+            {
+                const sourceChain = resolveChainName(trace.params.from.chain);
+                emitSuccessTelemetry(EARN_EVENT_TYPES.WITHDRAW, config, {
+                    ...sourceChain != null && {
+                        sourceChain
+                    },
+                    ...'txHash' in result && {
+                        txHash: result.txHash
+                    }
+                });
+                return;
+            }
+        case 'claimRewards':
+            {
+                if ('rewards' in result && result.status === 'claimed') {
+                    const sourceChain = resolveChainName(trace.params.from.chain);
+                    emitSuccessTelemetry(EARN_EVENT_TYPES.CLAIM_REWARDS, config, {
+                        ...sourceChain != null && {
+                            sourceChain
+                        },
+                        txHash: result.txHash
+                    });
+                }
+                return;
+            }
+        default:
+            {
+                const exhaustive = trace;
+                throw createValidationFailedError$1('error.cause.trace', exhaustive, 'EarnKit.retry() does not support this earn operation');
+            }
+    }
+}
 /**
  * A high-level class-based interface for DeFi lending vault operations.
  *
@@ -37663,6 +38003,8 @@ function formatRetryResult(operation, result) {
  * ```
  */ class EarnKit {
     context;
+    /** Per-kit identity and opt-out state for error telemetry. */ telemetryConfig;
+    /** Per-kit identity and opt-out state for success telemetry. */ analyticsTelemetryConfig;
     /**
    * Event dispatcher for step-level events emitted during multi-phase earn
    * operations. Prefer {@link EarnKit.on} / {@link EarnKit.off} over using
@@ -37687,6 +38029,16 @@ function formatRetryResult(operation, result) {
    */ constructor(config = {}){
         this.context = createEarnKitContext(config);
         this.actionDispatcher = new Actionable();
+        this.telemetryConfig = {
+            sdkName: SDK_NAME$1,
+            sdkVersion: pkg$2.version,
+            disabled: config.disableErrorReporting === true
+        };
+        this.analyticsTelemetryConfig = {
+            sdkName: SDK_NAME$1,
+            sdkVersion: pkg$2.version,
+            disabled: config.disableAnalytics === true
+        };
         for (const provider of this.context.providers){
             provider.registerDispatcher(this.actionDispatcher);
         }
@@ -37747,29 +38099,36 @@ function formatRetryResult(operation, result) {
    * }
    * ```
    */ async retry(error) {
-        if (!isKitError(error)) {
-            throw createValidationFailedError$1('error', error, 'EarnKit.retry() requires a KitError thrown by a previous earn operation');
-        }
-        if (!isRetryableError$1(error)) {
-            throw createValidationFailedError$1('error.recoverability', error.recoverability, 'EarnKit.retry() requires a retryable or resumable error — check isRetryableError(error) first');
-        }
-        const trace = error.cause?.trace;
-        if (!isEarnErrorTrace(trace)) {
-            throw createValidationFailedError$1('error.cause.trace', trace, 'EarnKit.retry() requires a KitError carrying earn retry context (operation, steps, provider, params)');
-        }
-        const provider = this.context.providers.find((candidate)=>candidate.name === trace.provider);
-        if (provider === undefined) {
-            throw createValidationFailedError$1('error.cause.trace.provider', trace.provider, `No earn provider named "${trace.provider}" is registered with this kit`);
-        }
-        const result = await provider.retry(error);
-        // `provider.retry` returns a flat result union with no compile-time link to
-        // `trace.operation`, so narrow the operation here to select the matching
-        // overload. The result cast in each branch is sound: the provider always
-        // returns the result type corresponding to the resumed operation.
-        if (trace.operation === 'claimRewards') {
+        const result = await withErrorTelemetry(async ()=>{
+            if (!isKitError(error)) {
+                throw createValidationFailedError$1('error', error, 'EarnKit.retry() requires a KitError thrown by a previous earn operation');
+            }
+            if (!isRetryableError$1(error)) {
+                throw createValidationFailedError$1('error.recoverability', error.recoverability, 'EarnKit.retry() requires a retryable or resumable error — check isRetryableError(error) first');
+            }
+            const trace = error.cause?.trace;
+            if (!isEarnErrorTrace(trace)) {
+                throw createValidationFailedError$1('error.cause.trace', trace, 'EarnKit.retry() requires a KitError carrying earn retry context (operation, steps, provider, params)');
+            }
+            const provider = this.context.providers.find((candidate)=>candidate.name === trace.provider);
+            if (provider === undefined) {
+                throw createValidationFailedError$1('error.cause.trace.provider', trace.provider, `No earn provider named "${trace.provider}" is registered with this kit`);
+            }
+            const result = await provider.retry(error);
+            // `provider.retry` returns a flat result union with no compile-time link to
+            // `trace.operation`, so narrow the operation here to select the matching
+            // overload. The result cast in each branch is sound: the provider always
+            // returns the result type corresponding to the resumed operation.
+            if (trace.operation === 'claimRewards') {
+                return formatRetryResult(trace.operation, result);
+            }
             return formatRetryResult(trace.operation, result);
+        }, EARN_EVENT_TYPES.RETRY, this.telemetryConfig);
+        const trace = isKitError(error) ? error.cause?.trace : undefined;
+        if (isEarnErrorTrace(trace)) {
+            emitRetrySuccessTelemetry(trace, result, this.analyticsTelemetryConfig);
         }
-        return formatRetryResult(trace.operation, result);
+        return result;
     }
     /**
    * Return the chains supported by configured earn providers.
@@ -37803,7 +38162,9 @@ function formatRetryResult(operation, result) {
    * result.vaults.forEach(v => console.log(`${v.name}: ${(v.currentApy * 100).toFixed(2)}% APY`))
    * ```
    */ async getVaults(params) {
-        return getVaults$1(this.context, params);
+        const result = await withErrorTelemetry(async ()=>getVaults$1(this.context, params), EARN_EVENT_TYPES.GET_VAULTS, this.telemetryConfig);
+        emitSuccessTelemetry(EARN_EVENT_TYPES.GET_VAULTS, this.analyticsTelemetryConfig, {});
+        return result;
     }
     /**
    * Discover vaults available on a chain.
@@ -37828,7 +38189,12 @@ function formatRetryResult(operation, result) {
    * const guarded = result.vaults.filter(v => v.circleGuarded) // Circle-guarded vaults only
    * ```
    */ async exploreVaults(params) {
-        return exploreVaults$1(this.context, params);
+        const context = {
+            sourceChain: resolveChainName(params.chain)
+        };
+        const result = await withErrorTelemetry(async ()=>exploreVaults$1(this.context, params), EARN_EVENT_TYPES.EXPLORE_VAULTS, this.telemetryConfig, context);
+        emitSuccessTelemetry(EARN_EVENT_TYPES.EXPLORE_VAULTS, this.analyticsTelemetryConfig, context);
+        return result;
     }
     /**
    * Lazily iterate every vault available on a chain.
@@ -37875,7 +38241,9 @@ function formatRetryResult(operation, result) {
    * }
    * ```
    */ async getPosition(params) {
-        return getPosition$1(this.context, params);
+        return withErrorTelemetry(async ()=>getPosition$1(this.context, params), EARN_EVENT_TYPES.GET_POSITION, this.telemetryConfig, {
+            sourceChain: resolveChainName(params.from.chain)
+        });
     }
     /**
    * Fetch the current status of a cross-chain deposit by execution ID.
@@ -37900,7 +38268,7 @@ function formatRetryResult(operation, result) {
    * console.log(`Bridge ${status.execId} is ${status.status}`)
    * ```
    */ async getCrossChainDepositStatus(params) {
-        return getCrossChainDepositStatus$1(this.context, params);
+        return withErrorTelemetry(async ()=>getCrossChainDepositStatus$1(this.context, params), EARN_EVENT_TYPES.GET_CROSS_CHAIN_DEPOSIT_STATUS, this.telemetryConfig);
     }
     /**
    * Poll a cross-chain deposit until it reaches a terminal bridge state.
@@ -37927,10 +38295,30 @@ function formatRetryResult(operation, result) {
    * console.log(`Bridge ended as ${result.outcome}`)
    * ```
    */ async waitForCrossChainDeposit(params) {
-        return waitForCrossChainDeposit$1(this.context, params);
+        return withErrorTelemetry(async ()=>waitForCrossChainDeposit$1(this.context, params), EARN_EVENT_TYPES.WAIT_FOR_CROSS_CHAIN_DEPOSIT, this.telemetryConfig);
     }
     async deposit(params) {
-        return deposit$3(this.context, params);
+        const isCrossChain = isCrossChainDeposit(params);
+        const context = {
+            sourceChain: resolveChainName(params.from.chain),
+            ...isCrossChain && {
+                destinationChain: resolveChainName(params.to.chain)
+            }
+        };
+        const eventType = isCrossChain ? EARN_EVENT_TYPES.CROSS_CHAIN_DEPOSIT : EARN_EVENT_TYPES.DEPOSIT;
+        const result = await withErrorTelemetry(async ()=>deposit$3(this.context, params), eventType, this.telemetryConfig, context);
+        if (result.kind === 'cross-chain') {
+            emitSuccessTelemetry(EARN_EVENT_TYPES.CROSS_CHAIN_DEPOSIT, this.analyticsTelemetryConfig, {
+                sourceChain: resolveChainName(result.sourceChain),
+                destinationChain: resolveChainName(result.destinationChain)
+            });
+        } else {
+            emitSuccessTelemetry(EARN_EVENT_TYPES.DEPOSIT, this.analyticsTelemetryConfig, {
+                ...context,
+                txHash: result.txHash
+            });
+        }
+        return result;
     }
     /**
    * Execute a withdrawal from a DeFi lending vault.
@@ -37956,7 +38344,15 @@ function formatRetryResult(operation, result) {
    * console.log(`Withdrew ${result.amount} from ${result.vaultAddress}, tx: ${result.txHash}`)
    * ```
    */ async withdraw(params) {
-        return withdraw$1(this.context, params);
+        const context = {
+            sourceChain: resolveChainName(params.from.chain)
+        };
+        const result = await withErrorTelemetry(async ()=>withdraw$1(this.context, params), EARN_EVENT_TYPES.WITHDRAW, this.telemetryConfig, context);
+        emitSuccessTelemetry(EARN_EVENT_TYPES.WITHDRAW, this.analyticsTelemetryConfig, {
+            ...context,
+            txHash: result.txHash
+        });
+        return result;
     }
     /**
    * Claim rewards from earn vaults.
@@ -37983,7 +38379,17 @@ function formatRetryResult(operation, result) {
    *
    * @internal
    */ async claimRewards(params) {
-        return claimRewards$1(this.context, params);
+        const context = {
+            sourceChain: resolveChainName(params.from.chain)
+        };
+        const result = await withErrorTelemetry(async ()=>claimRewards$1(this.context, params), EARN_EVENT_TYPES.CLAIM_REWARDS, this.telemetryConfig, context);
+        if (result.status === 'claimed') {
+            emitSuccessTelemetry(EARN_EVENT_TYPES.CLAIM_REWARDS, this.analyticsTelemetryConfig, {
+                ...context,
+                txHash: result.txHash
+            });
+        }
+        return result;
     }
     /**
    * Get an informational quote for a deposit into a vault.
@@ -38005,7 +38411,9 @@ function formatRetryResult(operation, result) {
    * console.log(`Expected shares: ${quote.expectedShares.amount}`)
    * ```
    */ async getDepositQuote(params) {
-        return getDepositQuote$1(this.context, params);
+        return withErrorTelemetry(async ()=>getDepositQuote$1(this.context, params), EARN_EVENT_TYPES.GET_DEPOSIT_QUOTE, this.telemetryConfig, {
+            sourceChain: resolveChainName(params.from.chain)
+        });
     }
     /**
    * Get an informational quote for a withdrawal from a vault.
@@ -38027,7 +38435,9 @@ function formatRetryResult(operation, result) {
    * console.log(`Shares to redeem: ${quote.sharesToRedeem.amount}`)
    * ```
    */ async getWithdrawalQuote(params) {
-        return getWithdrawalQuote$1(this.context, params);
+        return withErrorTelemetry(async ()=>getWithdrawalQuote$1(this.context, params), EARN_EVENT_TYPES.GET_WITHDRAWAL_QUOTE, this.telemetryConfig, {
+            sourceChain: resolveChainName(params.from.chain)
+        });
     }
     /**
    * Get an informational quote for claiming rewards.
@@ -38049,7 +38459,9 @@ function formatRetryResult(operation, result) {
    *
    * @internal
    */ async getClaimRewardsQuote(params) {
-        return getClaimRewardsQuote$1(this.context, params);
+        return withErrorTelemetry(async ()=>getClaimRewardsQuote$1(this.context, params), EARN_EVENT_TYPES.GET_CLAIM_REWARDS_QUOTE, this.telemetryConfig, {
+            sourceChain: resolveChainName(params.from.chain)
+        });
     }
 }
 
@@ -38138,7 +38550,14 @@ registerKit(`${pkg$2.name}/${pkg$2.version}`);
  * const earnKit = createEarnKit(context)
  * ```
  */ const createEarnKit = (context)=>{
-    const kit = new EarnKit();
+    const kit = new EarnKit({
+        ...context.disableErrorReporting != null && {
+            disableErrorReporting: context.disableErrorReporting
+        },
+        ...context.disableAnalytics != null && {
+            disableAnalytics: context.disableAnalytics
+        }
+    });
     registerActionHandlers(kit, context.actions.earn, 'earn');
     return kit;
 };
@@ -39447,7 +39866,7 @@ async function deposit$2(context, params) {
 }
 
 var name = "@circle-fin/unified-balance-kit";
-var version = "1.3.0";
+var version = "1.3.1";
 var pkg = {
 	name: name,
 	version: version};
@@ -45957,7 +46376,11 @@ const removeFundParamsSchema = z.object({
 // Remove Fund Operations
 // ---------------------------------------------------------------------------
 /**
- * Kick off a delayed fund removal from an account.
+ * Kick off a delayed recovery fund removal from an account.
+ *
+ * Use `initiateRemoveFund` only as a trustless fallback when the normal spend
+ * flow is unavailable. For day-to-day movement out of a Unified Balance, use
+ * `spend`.
  *
  * Validates `from` and `amount`, resolves the chain and token via
  * {@link resolveRemoveFundParams}, selects the matching provider, then calls
@@ -45994,7 +46417,10 @@ const removeFundParamsSchema = z.object({
     return provider.initiateRemoveFund(resolved);
 }
 /**
- * Complete a fund removal once the 7-day activation period has passed.
+ * Complete a recovery fund removal once the 7-day withdrawal delay has passed.
+ *
+ * Use `removeFund` only as a trustless fallback when the normal spend flow is
+ * unavailable. For day-to-day movement out of a Unified Balance, use `spend`.
  *
  * Validates `from`, resolves the chain and token via
  * {@link resolveRemoveFundParams}, selects the matching provider, then calls
@@ -46083,13 +46509,18 @@ const removeFundParamsSchema = z.object({
 /** SDK name used in telemetry payloads. */ const SDK_NAME = resolveKitSdkName(pkg.name);
 /**
  * A high-level class-based interface for cross-chain USDC deposits,
- * spending, balance queries, delegation management, and withdrawals.
+ * spending, balance queries, delegation management, and recovery fund removals.
  *
  * UnifiedBalanceKit provides a familiar class-based API for developers who
  * prefer traditional object-oriented patterns. The class maintains an
  * internal context and provides methods that delegate to the standalone
  * operation functions exported by this package.
  *
+ * Use `spend` for normal movement out of a Unified Balance. `removeFund` is a
+ * trustless recovery path for situations where the normal spend flow is
+ * unavailable, and it requires a 7-day withdrawal delay before funds can be
+ * removed.
+ *
  * @remarks
  * For functional usage, import and use the operations directly:
  * ```typescript
@@ -46310,7 +46741,11 @@ const removeFundParamsSchema = z.object({
         });
     }
     /**
-   * Kick off a delayed fund removal from an account.
+   * Kick off a delayed recovery fund removal from an account.
+   *
+   * Use this only as a trustless fallback when the normal spend flow is
+   * unavailable. For day-to-day movement out of a Unified Balance, use
+   * `spend`.
    *
    * @param params - The account owner's adapter context, amount, and
    *   optional token type.
@@ -46324,7 +46759,12 @@ const removeFundParamsSchema = z.object({
         });
     }
     /**
-   * Complete a fund removal once the activation period has passed.
+   * Complete a recovery fund removal once the 7-day withdrawal delay has
+   * passed.
+   *
+   * Use this only as a trustless fallback when the normal spend flow is
+   * unavailable. For day-to-day movement out of a Unified Balance, use
+   * `spend`.
    *
    * @param params - The account owner context matching the original
    *   fund removal initiation.
@@ -46451,6 +46891,11 @@ registerKit(`${pkg.name}/${pkg.version}`);
  * Internally holds a persistent {@link UnifiedBalanceKit} instance so that
  * event dispatchers and custom fee policies are preserved across calls.
  *
+ * Use {@link AppKitUnifiedBalance.spend} for normal movement out of a Unified
+ * Balance. {@link AppKitUnifiedBalance.removeFund} is a trustless recovery path
+ * for situations where the normal spend flow is unavailable, and it requires a
+ * 7-day withdrawal delay after {@link AppKitUnifiedBalance.initiateRemoveFund}.
+ *
  * @example
  * ```typescript
  * import { AppKit } from '@circle-fin/app-kit'
@@ -46662,7 +47107,12 @@ registerKit(`${pkg.name}/${pkg.version}`);
         return this.kit.removeDelegate(params);
     }
     /**
-   * Kick off a delayed fund removal from an account.
+   * Initiate a trustless recovery removal from an account.
+   *
+   * Use `spend` for normal movement out of a Unified Balance. `removeFund` is a
+   * recovery path for situations where the normal spend flow is unavailable.
+   * Calling this method starts the 7-day withdrawal delay before the removal can
+   * be completed.
    *
    * @param params - The account owner's adapter context, amount, and token.
    * @returns Promise resolving to the initiation details.
@@ -46681,11 +47131,16 @@ registerKit(`${pkg.name}/${pkg.version}`);
         return this.kit.initiateRemoveFund(params);
     }
     /**
-   * Complete a fund removal once the activation period has passed.
+   * Complete a trustless recovery removal after the withdrawal delay.
+   *
+   * Use `spend` for normal movement out of a Unified Balance. `removeFund` is a
+   * recovery path for situations where the normal spend flow is unavailable.
+   * Both EVM and Solana removals require a 7-day withdrawal delay after
+   * `initiateRemoveFund` before funds can be removed.
    *
    * @param params - The account owner context matching the original initiation.
    * @returns Promise resolving to the fund removal details.
-   * @throws {KitError} If the activation period has not elapsed or the
+   * @throws {KitError} If the withdrawal delay has not elapsed or the
    *   on-chain transaction fails.
    *
    * @example
@@ -46934,6 +47389,9 @@ registerKit(`${pkg.name}/${pkg.version}`);
             ...config.unifiedBalance,
             ...config.disableErrorReporting != null && {
                 disableErrorReporting: config.disableErrorReporting
+            },
+            ...config.disableAnalytics != null && {
+                disableAnalytics: config.disableAnalytics
             }
         });
         this.earn = {