@circle-fin/app-kit 1.14.0 → 1.15.1

package/unifiedBalance.mjs

@@ -701,6 +701,38 @@ class KitError extends Error {
         name: 'INPUT_AMOUNT_OUT_OF_RANGE',
         type: 'INPUT'
     },
+    /**
+   * Protocol fee is denominated in a token that is not supported for the
+   * route (only the native gas token and the route's supported fee tokens,
+   * such as USDC, are accepted).
+   */ UNSUPPORTED_FEE_TOKEN: {
+        code: 1014,
+        name: 'INPUT_UNSUPPORTED_FEE_TOKEN',
+        type: 'INPUT'
+    },
+    /** Retry / resume is not supported by this provider for the given result */ RETRY_NOT_SUPPORTED: {
+        code: 1015,
+        name: 'INPUT_RETRY_NOT_SUPPORTED',
+        type: 'INPUT'
+    },
+    /** Bridge-step analysis for retry is not supported by this provider */ STEP_ANALYSIS_NOT_SUPPORTED: {
+        code: 1016,
+        name: 'INPUT_STEP_ANALYSIS_NOT_SUPPORTED',
+        type: 'INPUT'
+    },
+    /**
+   * A kit operation name collides with a reserved event-subscription
+   * method (`on` / `off`) at kit construction.
+   */ RESERVED_OPERATION_NAME: {
+        code: 1000,
+        name: 'INPUT_RESERVED_OPERATION_NAME',
+        type: 'INPUT'
+    },
+    /** A kit was constructed with a missing / undefined operation factory */ MISSING_OPERATION: {
+        code: 1017,
+        name: 'INPUT_MISSING_OPERATION',
+        type: 'INPUT'
+    },
     /** General validation failure for complex validation rules */ VALIDATION_FAILED: {
         code: 1098,
         name: 'INPUT_VALIDATION_FAILED',
@@ -931,8 +963,376 @@ class KitError extends Error {
         code: 8002,
         name: 'SERVICE_UNKNOWN_ERROR',
         type: 'SERVICE'
+    }};
+
+/**
+ * Log-safe error redaction for `KitError.cause.trace` fields.
+ *
+ * @packageDocumentation
+ */ // ============================================================================
+// Message redactor (operator-configurable secret scrubbing)
+// ============================================================================
+/**
+ * A pluggable redactor for the `message` strings that flow onto
+ * `KitError.cause.trace`.
+ *
+ * @remarks
+ * Two equivalent shapes are accepted:
+ *
+ * 1. **`readonly RegExp[]`** — the common case. Each pattern is run
+ *    against the message; matches are replaced with `[REDACTED]`.
+ *    The operator owns the `g` flag — pass a global regex to scrub
+ *    every occurrence, a non-global regex to scrub the first one.
+ *
+ * 2. **`(message: string) => string`** — escape hatch for callers
+ *    who want full control over the substitution (different
+ *    placeholders per pattern, length-preserving redaction for
+ *    log-volume parity, format-preserving encryption, etc.).
+ *
+ * @public
+ */ /**
+ * Known RPC provider host suffixes scrubbed by the default redactor.
+ *
+ * @remarks
+ * The default redactor (see {@link composeRedactor} and
+ * {@link defaultMessageRedactor}) finds every `https?:` / `wss?:` URL
+ * in an error message, parses each one with the platform `URL`
+ * constructor, and replaces it with `[REDACTED]` if the parsed
+ * hostname ends with one of these suffixes. Adding a new provider is
+ * a one-line change and cannot be wrong: there is no regex shape to
+ * audit, no anchor-vs-quantifier trade-off, no
+ * {@link https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS | ReDoS}
+ * surface — the worst case is over-redaction (an unrelated URL on
+ * the same host suffix gets scrubbed) which is the safe failure
+ * mode.
+ *
+ * Suffixes covered:
+ *
+ * | Provider | Suffix |
+ * | --- | --- |
+ * | Alchemy | `.g.alchemy.com` |
+ * | Infura | `.infura.io` |
+ * | QuickNode | `.quiknode.pro` |
+ * | Ankr | `.ankr.com` |
+ * | Chainstack | `.p2pify.com` |
+ * | Tenderly | `.gateway.tenderly.co` |
+ * | BlockPI | `.blockpi.network` |
+ * | GetBlock | `.getblock.io` |
+ * | Moralis | `.moralis-nodes.com` |
+ * | Helius | `.helius-rpc.com`, `.helius.xyz` |
+ * | Triton | `.rpcpool.com` |
+ *
+ * Compose this list with your own self-hosted RPC suffixes via
+ * {@link composeRedactor}.
+ *
+ * @public
+ */ const DEFAULT_RPC_HOST_SUFFIXES = Object.freeze([
+    '.g.alchemy.com',
+    '.infura.io',
+    '.quiknode.pro',
+    '.ankr.com',
+    '.p2pify.com',
+    '.gateway.tenderly.co',
+    '.blockpi.network',
+    '.getblock.io',
+    '.moralis-nodes.com',
+    '.helius-rpc.com',
+    '.helius.xyz',
+    '.rpcpool.com'
+]);
+/**
+ * Built-in non-URL redaction patterns applied alongside the
+ * URL-host scrubber.
+ *
+ * @remarks
+ * Two simple patterns:
+ *
+ * - **Generic credential-bearing query strings** — `?api-key=…`,
+ *   `?apikey=…`, `?api-token=…`, `?access-token=…`, `?auth-token=…`,
+ *   `?app-key=…`, plus bare `?key=…` / `?token=…` / `?secret=…`.
+ *   Catches the case where a self-hosted RPC bakes the credential
+ *   into a query string instead of the path. Single canonical-name
+ *   alternation; complexity is well under SonarQube S5856's
+ *   20-complexity bound.
+ * - **Bearer header tokens** — `Bearer <token>` with bounded body
+ *   length and a `(?<![A-Za-z])` anchor so it can't be matched as a
+ *   tail-fragment of a longer word.
+ *
+ * Provider-specific URL-host scrubbing lives in
+ * {@link DEFAULT_RPC_HOST_SUFFIXES} (parsed via `URL`) rather than as
+ * regexes here — the host-list approach is CodeQL-clean (no
+ * `js/regex/missing-anchor` heuristic match), false-positive-free
+ * (provider URLs cannot accidentally collide with calldata or tx
+ * hashes), and trivial to extend (one string per provider).
+ *
+ * @public
+ */ const DEFAULT_RPC_REDACTION_PATTERNS = Object.freeze([
+    /[?&](?:(?:api|access|auth|app)[-_]?)?(?:key|token|secret)=[^&\s"'<>`]{1,256}/gi,
+    /(?<![A-Za-z])Bearer\s+[A-Za-z0-9._~+/=-]{16,512}/g
+]);
+/**
+ * Generic URL extractor used by {@link composeRedactor}.
+ *
+ * @remarks
+ * Matches any `http://`, `https://`, `ws://`, or `wss://` URL,
+ * bounded to 2 048 characters (longest URL Chrome / Firefox / IE
+ * accept in practice; well below any reasonable error-message
+ * payload). The regex is intentionally generic — it does **not**
+ * encode any provider host shape — so CodeQL's
+ * `js/regex/missing-anchor` heuristic (which targets URL-validation
+ * regexes that look for a specific host) does not fire. All
+ * provider classification happens in JS via `URL` parsing + string
+ * suffix matching, never in regex.
+ */ const URL_EXTRACTOR = /(?<![A-Za-z0-9])(?:https?|wss?):\/\/[^\s"'<>`]{1,2048}/g;
+/**
+ * Construct a redactor function from a host-suffix list and a
+ * non-URL pattern list.
+ *
+ * @remarks
+ * Each invocation:
+ *
+ * 1. Finds every URL in the message via {@link URL_EXTRACTOR}.
+ * 2. Parses each candidate with the platform `URL` constructor (the
+ *    same one browsers and Node use for `fetch()` / `new Request()`),
+ *    discarding common trailing punctuation.
+ * 3. Replaces the URL with `[REDACTED]` if its parsed hostname ends
+ *    with one of the configured suffixes.
+ * 4. Applies every regex in `patterns` (Bearer headers, query-string
+ *    credentials, plus any operator-supplied additions).
+ *
+ * Both arrays default to the SDK's built-ins
+ * ({@link DEFAULT_RPC_HOST_SUFFIXES} and
+ * {@link DEFAULT_RPC_REDACTION_PATTERNS}); pass either to override.
+ *
+ * @param opts - Optional override for the default suffix list and/or
+ *   pattern list.
+ * @returns A pure `(message: string) => string` function suitable for
+ *   passing to {@link setMessageRedactor}.
+ *
+ * @example
+ * Add your self-hosted RPC URL to the host-suffix list (most common
+ * extension shape):
+ *
+ * ```typescript
+ * import {
+ *   composeRedactor,
+ *   setMessageRedactor,
+ *   DEFAULT_RPC_HOST_SUFFIXES,
+ * } from '@core/errors'
+ *
+ * setMessageRedactor(
+ *   composeRedactor({
+ *     hostSuffixes: [...DEFAULT_RPC_HOST_SUFFIXES, '.rpc.my-corp.example'],
+ *   }),
+ * )
+ * ```
+ *
+ * @example
+ * Add a custom non-URL pattern (e.g. a corporate header token):
+ *
+ * ```typescript
+ * setMessageRedactor(
+ *   composeRedactor({
+ *     patterns: [
+ *       ...DEFAULT_RPC_REDACTION_PATTERNS,
+ *       /X-Corp-Token:\s+[A-Za-z0-9_-]{16,128}/g,
+ *     ],
+ *   }),
+ * )
+ * ```
+ *
+ * @public
+ */ function composeRedactor(opts) {
+    const hostSuffixes = opts?.hostSuffixes ?? DEFAULT_RPC_HOST_SUFFIXES;
+    const patterns = opts?.patterns ?? DEFAULT_RPC_REDACTION_PATTERNS;
+    return (message)=>{
+        let result = message.replaceAll(URL_EXTRACTOR, (url)=>{
+            // Common trailing punctuation that error-message templates put
+            // immediately after a URL (`Status: 401.`, `(see ...)`, `[1]`).
+            // Strip before parsing so the `URL` parser doesn't reject
+            // `eth-mainnet.g.alchemy.com.` (or accept it with a trailing
+            // dot in `hostname` and miss the suffix match). Implemented as
+            // a length-bounded string loop instead of a `/[.,;)\]>]+$/`
+            // regex so CodeQL `js/redos-on-uncontrolled-input` cannot
+            // flag a polynomial-time backtracking shape on operator-
+            // controlled error text.
+            const TRIM_CHARS = '.,;)]>';
+            let end = url.length;
+            const cap = Math.max(end - 16, 0) // bound the loop, length-cap 16
+            ;
+            while(end > cap && TRIM_CHARS.includes(url.charAt(end - 1))){
+                end--;
+            }
+            const trimmed = end === url.length ? url : url.slice(0, end);
+            let parsed;
+            try {
+                parsed = new URL(trimmed);
+            } catch  {
+                return url;
+            }
+            // HTTP-Basic userinfo (`user:pass@host`) is a credential by
+            // definition — scrub it regardless of host, so enterprise /
+            // self-hosted RPC URLs that don't match a known provider suffix
+            // still get redacted.
+            if (parsed.username !== '' || parsed.password !== '') {
+                return '[REDACTED]';
+            }
+            const host = parsed.hostname.toLowerCase();
+            return hostSuffixes.some((suffix)=>host.endsWith(suffix)) ? '[REDACTED]' : url;
+        });
+        for (const pattern of patterns){
+            result = result.replaceAll(pattern, '[REDACTED]');
+        }
+        return result;
+    };
+}
+/**
+ * The SDK's default message redactor: scrubs URLs whose hostname
+ * matches a {@link DEFAULT_RPC_HOST_SUFFIXES} entry, plus the
+ * patterns in {@link DEFAULT_RPC_REDACTION_PATTERNS}.
+ *
+ * @remarks
+ * Active at module load and re-installed by
+ * {@link resetMessageRedactor}. Operators who want to layer
+ * additional redaction on top of (rather than replace) the defaults
+ * can call this directly inside a custom function form:
+ *
+ * ```typescript
+ * setMessageRedactor((msg) =>
+ *   defaultMessageRedactor(msg).replace(/myExtraPattern/g, '[REDACTED]'),
+ * )
+ * ```
+ *
+ * For most extension cases prefer {@link composeRedactor}, which
+ * gives the same result with structured options instead of a
+ * post-hoc pipe.
+ *
+ * @public
+ */ const defaultMessageRedactor = composeRedactor();
+let activeRedactor = defaultMessageRedactor;
+/**
+ * Apply the active redactor to an arbitrary message string.
+ *
+ * @remarks
+ * Adapters call this on every string they place on `cause.trace`
+ * other than the redacted `rawError` itself — viem `shortMessage`,
+ * ethers `error.info.requestUrl`, the provider's `reason` field,
+ * etc. When no redactor is configured this is the identity function,
+ * so the cost on the no-redactor path is one `if`.
+ *
+ * @param message - The string to scrub.
+ * @returns The redacted string. The original is returned untouched
+ *   when no redactor is configured.
+ *
+ * @example
+ * ```typescript
+ * import { redactErrorMessage, setMessageRedactor } from '@core/errors'
+ *
+ * setMessageRedactor([/[A-Fa-f0-9]{32,64}/g])
+ * redactErrorMessage('failed: 0xabc...64chars...')
+ * //   => 'failed: [REDACTED]'
+ * ```
+ *
+ * @public
+ */ function redactErrorMessage(message) {
+    if (activeRedactor === undefined) return message;
+    // `setMessageRedactor` eagerly compiles the array form into a
+    // `composeRedactor`-wrapped function, so by the time we reach
+    // here `activeRedactor` is always a function. The runtime
+    // `typeof` guard exists for completeness — if a future
+    // contributor introduces a setter path that bypasses the
+    // compilation step, the guard keeps the dispatch correct.
+    if (typeof activeRedactor === 'function') return activeRedactor(message);
+    // Fallback (unreachable in normal use). See note above.
+    return composeRedactor({
+        patterns: activeRedactor,
+        hostSuffixes: []
+    })(message);
+}
+// ============================================================================
+// Object-graph redaction
+// ============================================================================
+/**
+ * Redact an `unknown` error to a small, log-safe shape.
+ *
+ * @remarks
+ * Wallet libraries (viem, ethers, web3-provider-engine, …) routinely
+ * attach provider-injected fields to thrown errors: configured RPC URLs,
+ * API keys, opaque internal state, the originating `XMLHttpRequest`,
+ * and so on. Embedding the raw object directly inside `KitError.cause.trace`
+ * means anyone who later JSON-serialises a `KitError` for telemetry leaks
+ * those fields into logs.
+ *
+ * This helper extracts only the two fields that are useful for
+ * post-mortem debugging — `name` and `message` — while never exposing the
+ * underlying object graph. The `message` is run through the operator's
+ * configured {@link setMessageRedactor | message redactor} (if any) so
+ * that secrets the provider has interpolated into the message string
+ * itself can be scrubbed. Non-`Error` throws (raw strings, plain
+ * objects, primitives) are stringified with `String(error)` and then
+ * run through the same redactor, so a secret-bearing string throw
+ * (e.g. WalletConnect / older mobile wallets) is scrubbed too.
+ *
+ * **Two redaction layers, two responsibilities.**
+ *
+ * - **Object-graph stripping (this function, always on)** — drops
+ *   extra properties such as `request`, `requestUrl`, `info`, the
+ *   originating `XMLHttpRequest`, the configured `transport.url`,
+ *   etc. Without this, viem/ethers errors round-trip with the full
+ *   provider state graph attached.
+ * - **Message-content scrubbing (configured via
+ *   {@link setMessageRedactor}, opt-in)** — handles the case where
+ *   the provider has already formatted secrets into `error.message`
+ *   itself. Notably, ethers v6's `makeError()` formats info keys
+ *   directly into the message:
+ *
+ * ```
+ * missing response (requestUrl="https://mainnet.infura.io/v3/MY_KEY", code=SERVER_ERROR, ...)
+ * ```
+ *
+ *   Viem's `HttpRequestError` exhibits the same pattern via
+ *   `shortMessage`, which carries the configured URL with API path.
+ *   Without a redactor, the API key rides on `cause.trace.rawError.message`
+ *   verbatim. With one configured, every match is replaced with
+ *   `[REDACTED]` (or the operator's custom substitution).
+ *
+ * The split is intentional: there is no universal URL/secret
+ * heuristic that won't false-positive on legitimate payloads
+ * (mainnet addresses, contract revert reasons, raw call data), so
+ * the SDK refuses to guess. Operators who know which patterns
+ * appear in *their* RPC URLs configure the policy with one call
+ * to {@link setMessageRedactor}.
+ *
+ * @param error - Anything thrown by a third-party wallet/provider library.
+ * @returns A `{ name, message }` pair for `Error` instances (with
+ *   `message` run through the active redactor); the stringified value —
+ *   also run through the active redactor — otherwise. Always JSON-safe.
+ *
+ * @example
+ * ```typescript
+ * import { redactRawError, setMessageRedactor } from '@core/errors'
+ *
+ * setMessageRedactor([/infura\.io\/v3\/[a-z0-9]+/gi])
+ * const err = new Error('failed: https://mainnet.infura.io/v3/abc123')
+ * redactRawError(err)
+ * //   => { name: 'Error', message: 'failed: https://[REDACTED]' }
+ * ```
+ *
+ * @public
+ */ function redactRawError(error) {
+    if (error instanceof Error) {
+        return {
+            name: error.name,
+            message: redactErrorMessage(error.message)
+        };
     }
-};
+    // Non-Error throws (raw strings from WalletConnect / older mobile
+    // wallets, plain objects, primitives) are stringified and then run
+    // through the active redactor. A raw string throw can carry a secret
+    // RPC URL just like an `Error.message` does, so it must be scrubbed
+    // rather than returned verbatim.
+    return redactErrorMessage(String(error));
+}
 
 /**
  * Creates error for network type mismatch between source and destination.
@@ -978,6 +1378,15 @@ class KitError extends Error {
  *
  * @param source - Source chain name
  * @param destination - Destination chain name
+ * @param providerErrors - Optional list of providers whose `supportsRoute`
+ *   call threw during the search. When non-empty, the message includes a
+ *   summary so consumers can distinguish "no provider supports this route"
+ *   from "a provider errored mid-search." Pass the errors raw: each one is
+ *   run through `redactRawError` here, so neither the message nor
+ *   `cause.trace.providerErrors` carries the provider's raw object graph.
+ * @param token - Optional token the caller asked to bridge. When supplied it
+ *   is named in the message and the trace, so a symbol the routing layer does
+ *   not recognise reads as a token problem rather than a chain-pair one.
  * @returns KitError with specific route details
  *
  * @example
@@ -985,22 +1394,51 @@ class KitError extends Error {
  * import { createUnsupportedRouteError } from '@core/errors'
  *
  * throw createUnsupportedRouteError('Ethereum', 'Solana')
- * // Message: "Route from Ethereum to Solana is not supported"
- * ```
- */ function createUnsupportedRouteError(source, destination) {
+ * // Message: "Route from Ethereum to Solana is not supported."
+ *
+ * throw createUnsupportedRouteError('Ethereum', 'Arc', [
+ *   { provider: 'cctpx', error: new Error('ECONNRESET') },
+ * ])
+ * // Message: "Route from Ethereum to Arc is not supported.
+ * //   Providers errored during route check: cctpx (ECONNRESET)."
+ *
+ * throw createUnsupportedRouteError('Ethereum', 'Arc', undefined, 'USCD')
+ * // Message: "Route from Ethereum to Arc is not supported for token 'USCD'."
+ * ```
+ */ function createUnsupportedRouteError(source, destination, providerErrors, token) {
+    const failures = [];
+    // Redact once, here. `supportsRoute` may be async so a provider can do a
+    // registry-backed network check, and a fetch rejection embeds the request
+    // URL — with a credential in the worst case — in both its object graph and
+    // its message. Both consumers below read from this redacted copy, so the
+    // raw value never leaves this function. Redacting once is load-bearing:
+    // `redactRawError` is not idempotent (it stringifies a non-`Error` input,
+    // so a second pass collapses `{ name, message }` to `"[object Object]"`),
+    // which is why callers pass raw errors in and let the factory do it.
+    const redactedFailures = failures.map((failure)=>({
+            provider: failure.provider,
+            error: redactRawError(failure.error)
+        }));
+    const summary = redactedFailures.length === 0 ? '' : ` Providers errored during route check: ${redactedFailures.map((f)=>`${f.provider} (${describeProviderError(f.error)})`).join(', ')}.`;
+    const tokenClause = '' ;
     const errorDetails = {
         ...InputError.UNSUPPORTED_ROUTE,
         recoverability: 'FATAL',
-        message: `Route from ${source} to ${destination} is not supported.`,
+        message: `Route from ${source} to ${destination} is not supported` + `${tokenClause}.${summary}`,
         cause: {
             trace: {
                 source,
-                destination
+                destination,
+                providerErrors: redactedFailures,
+                ...{} 
             }
         }
     };
     return new KitError(errorDetails);
 }
+/** Extract a human-readable summary from a redacted provider error. */ function describeProviderError(error) {
+    return typeof error === 'string' ? error : error.message;
+}
 /**
  * Creates error for invalid amount format or precision.
  *
@@ -1189,7 +1627,7 @@ class KitError extends Error {
  * import { createValidationErrorFromZod } from '@core/errors'
  *
  * function validateBridgeParams(params: unknown): asserts params is BridgeParams {
- *   const result = bridgeParamsSchema.safeParse(params)
+ *   const result = usdcBridgeParamsSchema.safeParse(params)
  *   if (!result.success) {
  *     throw createValidationErrorFromZod(result.error, 'bridge parameters')
  *   }
@@ -3035,9 +3473,10 @@ class KitError extends Error {
     Blockchain["Algorand_Testnet"] = "Algorand_Testnet";
     Blockchain["Aptos"] = "Aptos";
     Blockchain["Aptos_Testnet"] = "Aptos_Testnet";
-    Blockchain["Arc_Testnet"] = "Arc_Testnet";
     Blockchain["Arbitrum"] = "Arbitrum";
     Blockchain["Arbitrum_Sepolia"] = "Arbitrum_Sepolia";
+    Blockchain["Arc"] = "Arc";
+    Blockchain["Arc_Testnet"] = "Arc_Testnet";
     Blockchain["Avalanche"] = "Avalanche";
     Blockchain["Avalanche_Fuji"] = "Avalanche_Fuji";
     Blockchain["Base"] = "Base";
@@ -3124,6 +3563,7 @@ var SwapChain;
     SwapChain["XDC"] = "XDC";
     SwapChain["HyperEVM"] = "HyperEVM";
     SwapChain["Monad"] = "Monad";
+    SwapChain["Arc"] = "Arc";
     // Testnet chains with swap support
     SwapChain["Arc_Testnet"] = "Arc_Testnet";
 })(SwapChain || (SwapChain = {}));
@@ -3131,6 +3571,7 @@ var BridgeChain;
 (function(BridgeChain) {
     // Mainnet chains with CCTPv2 support
     BridgeChain["Arbitrum"] = "Arbitrum";
+    BridgeChain["Arc"] = "Arc";
     BridgeChain["Avalanche"] = "Avalanche";
     BridgeChain["Base"] = "Base";
     BridgeChain["Codex"] = "Codex";
@@ -3186,6 +3627,7 @@ var BridgeChain;
 var UnifiedBalanceChain;
 (function(UnifiedBalanceChain) {
     // Mainnet chains with Gateway V1 support
+    UnifiedBalanceChain["Arc"] = "Arc";
     UnifiedBalanceChain["Arbitrum"] = "Arbitrum";
     UnifiedBalanceChain["Avalanche"] = "Avalanche";
     UnifiedBalanceChain["Base"] = "Base";
@@ -3215,6 +3657,7 @@ var UnifiedBalanceChain;
 })(UnifiedBalanceChain || (UnifiedBalanceChain = {}));
 var EarnChain;
 (function(EarnChain) {
+    EarnChain["Arc"] = "Arc";
     EarnChain["Arc_Testnet"] = "Arc_Testnet";
 })(EarnChain || (EarnChain = {}));
 /**
@@ -3231,8 +3674,11 @@ var EarnChain;
  * console.log(EARN_BRIDGE_SOURCE_BLOCKCHAINS.join(', '))
  * ```
  */ const EARN_BRIDGE_SOURCE_BLOCKCHAINS = [
+    "Arbitrum",
     "Arbitrum_Sepolia",
+    "Base",
     "Base_Sepolia",
+    "Ethereum",
     "Ethereum_Sepolia"
 ];
 /**
@@ -3246,6 +3692,7 @@ var EarnChain;
  * console.log(EARN_BRIDGE_DESTINATION_BLOCKCHAINS.join(', '))
  * ```
  */ const EARN_BRIDGE_DESTINATION_BLOCKCHAINS = [
+    "Arc",
     "Arc_Testnet"
 ];
 
@@ -3551,6 +3998,25 @@ var EarnChain;
  * EVM-compatible chains. Use this address when deploying or testing
  * cross-chain USDC transfers on test networks.
  */ const BRIDGE_CONTRACT_EVM_TESTNET = '0xC5567a5E3370d4DBfB0540025078e283e36A363d';
+/**
+ * The CrossChainTokenService (CCTPx) service address for EVM testnet networks.
+ *
+ * This service coordinates CCTPx cross-chain token operations on testnet
+ * environments and is shared by every EVM test network CCTPx supports. Read the
+ * chain definitions via `isCCTPXSupported` rather than trusting a list here,
+ * which goes stale as deployments land.
+ */ const CCTPX_SERVICE_ADDRESS_EVM_TESTNET = '0x63753E722bd2C2A5DF6EE19C5106662208B81077';
+/**
+ * CrossChainTokenService (CCTS) proxy address for CCTPx on EVM **mainnet**.
+ *
+ * @remarks
+ * A distinct deployment from {@link CCTPX_SERVICE_ADDRESS_EVM_TESTNET}, shared
+ * by every EVM mainnet chain that CCTPx supports. A chain becomes
+ * CCTPx-eligible only once its definition carries this as
+ * `cctpx.serviceAddress`, and a route additionally needs both of its endpoints
+ * eligible — so adding a chain here is the deliberate, reviewable step that
+ * opens mainnet CCTPx for it.
+ */ const CCTPX_SERVICE_ADDRESS_EVM_MAINNET = '0x431871229103b780868f8C6BB820cd16ECf942BC';
 /**
  * The bridge contract address for EVM mainnet networks.
  *
@@ -3669,6 +4135,76 @@ var EarnChain;
  * Used by the spend fee-split logic to route Circle's share of custom fees.
  */ const CIRCLE_FEE_RECIPIENT_SOLANA = 'HGMjULXsaMcbXgRhRECkSG3LyiKJgqiNAnLv1zZd8Kpn';
 
+/**
+ * Arc Mainnet chain definition
+ * @remarks
+ * This represents the official production network for the Arc blockchain,
+ * Circle's EVM-compatible Layer-1 designed for stablecoin finance
+ * and asset tokenization. Arc uses USDC as the native gas token and
+ * features the Malachite Byzantine Fault Tolerant (BFT) consensus
+ * engine for sub-second finality.
+ */ const Arc = defineChain({
+    type: 'evm',
+    chain: Blockchain.Arc,
+    name: 'Arc',
+    title: 'Arc Mainnet',
+    nativeCurrency: {
+        name: 'USDC',
+        symbol: 'USDC',
+        // Arc uses native USDC with 18 decimals for gas payments (EVM standard).
+        // Note: The ERC-20 USDC contract at usdcAddress uses 6 decimals.
+        // See: https://docs.arc.network/arc/references/contract-addresses
+        decimals: 18
+    },
+    chainId: 5042,
+    isTestnet: false,
+    explorerUrl: 'https://explorer.arc.io/tx/{hash}',
+    rpcEndpoints: [
+        'https://rpc.mainnet.arc.io/'
+    ],
+    eurcAddress: '0xbEf5f6d51CB62b58e6A8f77868681825C6fe21c1',
+    usdcAddress: '0x3600000000000000000000000000000000000000',
+    usdtAddress: null,
+    cctp: {
+        domain: 26,
+        contracts: {
+            v2: {
+                type: 'split',
+                tokenMessenger: '0x28b5a0e9C621a5BadaA536219b3a228C8168cf5d',
+                messageTransmitter: '0x81D40F21F12A8F0E3252Bccb954D722d4c464B64',
+                confirmations: 1,
+                fastConfirmations: 1
+            }
+        },
+        forwarderSupported: {
+            source: false,
+            destination: true
+        }
+    },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
+    kitContracts: {
+        bridge: BRIDGE_CONTRACT_EVM_MAINNET,
+        adapter: ADAPTER_CONTRACT_EVM_MAINNET
+    },
+    gateway: {
+        domain: 26,
+        contracts: {
+            v1: {
+                wallet: GATEWAY_WALLET_EVM_MAINNET,
+                minter: GATEWAY_MINTER_EVM_MAINNET,
+                depositForHandler: DEPOSIT_FOR_HANDLER_EVM_MAINNET,
+                genericExecutor: GENERIC_EXECUTOR_EVM_MAINNET
+            }
+        },
+        forwarderSupported: {
+            source: true,
+            destination: true
+        }
+    }
+});
+
 /**
  * Arc Testnet chain definition
  * @remarks
@@ -3716,6 +4252,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET,
         adapter: ADAPTER_CONTRACT_EVM_TESTNET
@@ -3783,6 +4322,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_MAINNET,
         adapter: ADAPTER_CONTRACT_EVM_MAINNET
@@ -3848,6 +4390,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET,
         adapter: ADAPTER_CONTRACT_EVM_TESTNET
@@ -3913,6 +4458,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_MAINNET,
         adapter: ADAPTER_CONTRACT_EVM_MAINNET
@@ -3980,6 +4528,9 @@ var EarnChain;
     rpcEndpoints: [
         'https://api.avax-test.network/ext/bc/C/rpc'
     ],
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET
     },
@@ -4047,6 +4598,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_MAINNET,
         adapter: ADAPTER_CONTRACT_EVM_MAINNET
@@ -4112,6 +4666,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET,
         adapter: ADAPTER_CONTRACT_EVM_TESTNET
@@ -4504,6 +5061,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_MAINNET,
         adapter: ADAPTER_CONTRACT_EVM_MAINNET
@@ -4569,6 +5129,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET,
         adapter: ADAPTER_CONTRACT_EVM_TESTNET
@@ -5400,6 +5963,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_MAINNET,
         adapter: ADAPTER_CONTRACT_EVM_MAINNET
@@ -5465,6 +6031,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET
     },
@@ -5860,6 +6429,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_MAINNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_MAINNET,
         adapter: ADAPTER_CONTRACT_EVM_MAINNET
@@ -5928,6 +6500,9 @@ var EarnChain;
             destination: true
         }
     },
+    cctpx: {
+        serviceAddress: CCTPX_SERVICE_ADDRESS_EVM_TESTNET
+    },
     kitContracts: {
         bridge: BRIDGE_CONTRACT_EVM_TESTNET
     },
@@ -6936,6 +7511,7 @@ var Chains = /*#__PURE__*/Object.freeze({
   AptosTestnet: AptosTestnet,
   Arbitrum: Arbitrum,
   ArbitrumSepolia: ArbitrumSepolia,
+  Arc: Arc,
   ArcTestnet: ArcTestnet,
   Avalanche: Avalanche,
   AvalancheFuji: AvalancheFuji,
@@ -7353,6 +7929,7 @@ var Chains = /*#__PURE__*/Object.freeze({
     usdcAddress: z.string().nullable(),
     usdtAddress: z.string().nullable(),
     cctp: z.any().nullable(),
+    cctpx: z.any().optional(),
     kitContracts: z.object({
         bridge: z.string().optional(),
         adapter: z.string().optional()
@@ -7558,14 +8135,15 @@ const EARN_BRIDGE_DESTINATION_CHAIN_VALUES = EARN_BRIDGE_DESTINATION_BLOCKCHAINS
  * Zod schema for validating the source chain of a cross-chain Earn deposit.
  *
  * Accept a supported source Blockchain value, a matching string literal, or a
- * ChainDefinition for a supported source chain. Source chains are Ethereum
- * Sepolia, Arbitrum Sepolia, and Base Sepolia.
+ * ChainDefinition for a supported source chain. Source chains are Ethereum,
+ * Arbitrum, and Base (mainnet and testnet).
  *
  * @example
  * ```typescript
  * import { earnBridgeSourceChainIdentifierSchema } from '@core/chains'
  *
  * // Valid
+ * earnBridgeSourceChainIdentifierSchema.parse('Ethereum')
  * earnBridgeSourceChainIdentifierSchema.parse('Ethereum_Sepolia')
  *
  * // Invalid (throws ZodError)
@@ -7584,14 +8162,15 @@ const EARN_BRIDGE_DESTINATION_CHAIN_VALUES = EARN_BRIDGE_DESTINATION_BLOCKCHAINS
  * deposit.
  *
  * Accept a supported destination Blockchain value, a matching string literal,
- * or a ChainDefinition for a supported destination chain. Currently only Arc
- * Testnet is supported.
+ * or a ChainDefinition for a supported destination chain. Arc (mainnet) and
+ * Arc Testnet are supported.
  *
  * @example
  * ```typescript
  * import { earnBridgeDestinationChainIdentifierSchema } from '@core/chains'
  *
  * // Valid
+ * earnBridgeDestinationChainIdentifierSchema.parse('Arc')
  * earnBridgeDestinationChainIdentifierSchema.parse('Arc_Testnet')
  *
  * // Invalid (throws ZodError)
@@ -9217,6 +9796,7 @@ function parseOrThrow(value, schema, context) {
         // Mainnets (alphabetically sorted)
         // =========================================================================
         [Blockchain.Arbitrum]: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831',
+        [Blockchain.Arc]: '0x3600000000000000000000000000000000000000',
         [Blockchain.Avalanche]: '0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E',
         [Blockchain.Base]: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
         [Blockchain.Celo]: '0xcebA9300f2b948710d2653dD7B07f33A8B32118C',
@@ -9331,6 +9911,7 @@ function parseOrThrow(value, schema, context) {
         // =========================================================================
         // Mainnets
         // =========================================================================
+        [Blockchain.Arc]: '0xbEf5f6d51CB62b58e6A8f77868681825C6fe21c1',
         [Blockchain.Avalanche]: '0xc891EB4cbdEFf6e073e859e987815Ed1505c2ACD',
         [Blockchain.Base]: '0x60a3E35Cc302bFA44Cb288Bc5a4F316Fdb1adb42',
         [Blockchain.Cronos]: '0xA6dE01a2d62C6B5f3525d768f34d276652C554c8',
@@ -9574,6 +10155,7 @@ function parseOrThrow(value, schema, context) {
         // =========================================================================
         // Mainnets
         // =========================================================================
+        [Blockchain.Arc]: '0x171A4217b86A807A64eB94757Db6849fb4bDbAA0',
         [Blockchain.Ethereum]: '0x72DFB2E44f59C5AD2bAFE84314E5b99a7cd5075E',
         // =========================================================================
         // Testnets
@@ -9666,13 +10248,28 @@ function parseOrThrow(value, schema, context) {
 }
 
 /**
- * Check if a selector is a raw token selector (object form).
+ * Type guard: narrows a {@link TokenSelector} to a {@link RawTokenSelector}.
  *
  * @param selector - The token selector to check.
- * @returns True if the selector is a raw token selector.
+ * @returns `true` if `selector` is a raw token selector (object with `locator`).
+ *
+ * @example
+ * ```typescript
+ * if (isRawSelector(selector)) {
+ *   console.log(selector.locator)
+ * }
+ * ```
  */ function isRawSelector(selector) {
-    return typeof selector === 'object' && 'locator' in selector;
+    // `typeof null === 'object'` (a JS quirk) and `'locator' in null`
+    // throws, so the explicit `null` check is required at this exported
+    // guard for JS consumers passing nullish values. The lint rule sees
+    // the parameter typed as `TokenSelector` (no null) and flags the
+    // check as unnecessary — disabled because the check IS necessary at
+    // runtime even though TypeScript can prove it dead statically.
+    return typeof selector === 'object' && // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+    selector !== null && 'locator' in selector;
 }
+
 /**
  * Normalize a symbol to uppercase for case-insensitive lookup.
  *
@@ -9860,7 +10457,7 @@ function parseOrThrow(value, schema, context) {
             if (typeof selector === 'string') {
                 return resolveSymbol(selector, chainId);
             }
-            throw createTokenResolutionError(`Invalid selector type: ${typeof selector}. Expected string or object with locator.`, selector, chainId);
+            throw createTokenResolutionError(`Invalid selector type: ${typeof selector}. Expected a token symbol or a raw selector (with locator).`, selector, chainId);
         },
         resolveByAddress (address, chainId) {
             if (!address || typeof address !== 'string') {
@@ -11120,7 +11717,7 @@ function resolveOptions(options) {
 }
 
 var name = "@circle-fin/unified-balance-kit";
-var version$1 = "1.6.0";
+var version$1 = "1.7.0";
 var pkg$1 = {
 	name: name,
 	version: version$1};
@@ -21135,10 +21732,26 @@ function toString(amount) {
  * - Executing the actual bridge operations
  * - Handling protocol-specific logic and error conditions
  *
+ * @remarks
+ * Token-type default rationale: `TToken` defaults to the literal
+ * `'USDC'` so a USDC-only subclass needs no generic ceremony at every
+ * call site. This matches the literal `'USDC'` default on
+ * {@link BridgeParams} (consumed at the provider boundary, where the
+ * provider knows exactly which token symbol it accepts). The default
+ * matches the default on {@link BridgeResult} and {@link EstimateResult} for
+ * source compatibility. Provider-agnostic kit internals widen those result
+ * types explicitly.
+ *
+ * Quotes are not typed here. A provider that issues one narrows its own
+ * `estimate` return to the shape it produces — see the CCTPx provider's
+ * `QuoteEnvelope` — which keeps that shape in the provider package rather
+ * than in this shared one. `bridge` takes a caller-supplied quote, which is
+ * public input the provider validates before reading a field.
+ *
  * @example
  * ```typescript
  * class CustomBridgingProvider extends BridgingProvider {
- *   async supportsRoute(source: Chain, destination: Chain, token: TokenType): Promise<boolean> {
+ *   supportsRoute(source: Chain, destination: Chain, token: TokenType): boolean {
  *     // Implementation specific logic
  *     return true
  *   }
@@ -21187,6 +21800,36 @@ function toString(amount) {
         return this.supportedChains.filter((chain)=>chain.isTestnet === source.isTestnet && chain.chain !== source.chain);
     }
     /**
+   * Return the decimal precision for the given token, or `undefined` when
+   * the provider does not track it.
+   *
+   * Consumers that format a result amount resolve decimals through this
+   * hook first, falling back to their own built-in token registry when it
+   * returns `undefined`. The default implementation returns `undefined`,
+   * so a provider whose tokens are already in the consumer's registry needs
+   * no override; a provider that identifies tokens outside that registry
+   * overrides this to supply their decimals.
+   *
+   * @param _token - The token to resolve decimals for (provider-defined);
+   *   unused by the default implementation, consumed by overrides.
+   * @param _sourceChain - Source chain of the bridge. Providers whose tokens
+   *   live in per-network registries use it to scope the lookup to the relevant
+   *   network; unused by the default implementation. Required, so a lookup is
+   *   never asked to guess which network a token belongs to.
+   * @returns A promise resolving to the token's decimals, or `undefined`
+   *   when the provider cannot resolve it.
+   *
+   * @example
+   * ```typescript
+   * const decimals = await provider.getTokenDecimals(token, source.chain)
+   * if (decimals === undefined) {
+   *   // fall back to the consumer's own decimals lookup
+   * }
+   * ```
+   */ /* eslint-disable @typescript-eslint/require-await, @typescript-eslint/no-unused-vars -- Async so overrides can resolve decimals via I/O; the default is a constant that ignores its arguments. */ async getTokenDecimals(_token, _sourceChain) {
+        return undefined;
+    }
+    /* eslint-enable @typescript-eslint/require-await, @typescript-eslint/no-unused-vars */ /**
    * Register an event dispatcher for handling provider-specific actions and events.
    *
    *
@@ -21428,7 +22071,72 @@ var TransferSpeed;
      */ recipientAddress: z.string().trim().min(1, 'Fee recipient must be a non-empty string').optional()
 }).strict();
 /**
- * Schema for validating bridge parameters.
+ * Factory for the bridge-params Zod schema, parameterized by the token
+ * validator. The base schema enforces all non-token fields (amount,
+ * source, destination, config); callers supply the Zod schema for the
+ * `token` field, allowing each provider to validate the token type it
+ * accepts.
+ *
+ * @param tokenSchema - Zod schema applied to the `token` field. Pass
+ *   `z.literal('USDC')` for USDC-only validation, or any
+ *   provider-specific schema (e.g. a `0x`-prefixed hex regex) for
+ *   providers that accept a different token type.
+ * @param config - Required. `maxDecimals` caps the decimal precision
+ *   permitted in `amount` and `config.maxFee`. Pass the widest value
+ *   any of the provider's tokens require — `6` for USDC-only, `18`
+ *   for an ERC-20 family that includes wETH, etc. The schema is a
+ *   coarse syntactic gate; narrower per-token precision is enforced
+ *   by the provider downstream.
+ * @returns A Zod object schema whose `token` field is validated by
+ *   `tokenSchema` and whose other fields (`amount`, `source`,
+ *   `destination`, `config`) are validated against the shared bridge
+ *   contract. Use `.safeParse` / `.parse` directly, or feed the schema
+ *   to {@link parseOrThrow} from `@core/utils` to surface validation
+ *   failures as `KitError` with the canonical
+ *   `INPUT_VALIDATION_FAILED` code.
+ *
+ * @example
+ * ```typescript
+ * import { createBridgeParamsSchema, z } from '@core/provider'
+ *
+ * const usdcSchema = createBridgeParamsSchema(z.literal('USDC'), { maxDecimals: 6 })
+ * const hexSchema = createBridgeParamsSchema(
+ *   z.string().regex(/^0x[0-9a-fA-F]{64}$/),
+ *   { maxDecimals: 18 },
+ * )
+ * ```
+ */ // The full inferred return type of `z.object({...})` here is
+// effectively impossible to spell out by hand without re-stating every
+// field's schema. TypeScript infers it from the body — callers receive
+// a precise Zod schema type via inference, and the explicit-return
+// rules are disabled for that reason.
+// eslint-disable-next-line @typescript-eslint/explicit-function-return-type, @typescript-eslint/explicit-module-boundary-types
+function createBridgeParamsSchema(tokenSchema, config) {
+    const { maxDecimals } = config;
+    return z.object({
+        amount: z.string().min(1, 'Required').pipe(createDecimalStringValidator({
+            allowZero: false,
+            regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
+            attributeName: 'amount',
+            maxDecimals
+        })(z.string())),
+        source: walletContextSchema,
+        destination: bridgeDestinationSchema,
+        token: tokenSchema,
+        config: z.object({
+            transferSpeed: z.nativeEnum(TransferSpeed).optional(),
+            maxFee: z.string().pipe(createDecimalStringValidator({
+                allowZero: true,
+                regexMessage: MAX_FEE_FORMAT_ERROR_MESSAGE,
+                attributeName: 'maxFee',
+                maxDecimals
+            })(z.string())).optional(),
+            customFee: customFeeSchema.optional()
+        })
+    });
+}
+/**
+ * Schema for validating bridge parameters with USDC as the token.
  * This ensures all required fields are present and properly typed.
  * A bridge must include:
  * - A valid amount (non-empty numeric string \> 0)
@@ -21436,11 +22144,15 @@ var TransferSpeed;
  * - USDC as the token
  * - Optional config with transfer speed and max fee settings
  *
+ * Providers that accept a non-USDC token type should call
+ * {@link createBridgeParamsSchema} with their own token schema rather
+ * than reusing this constant.
+ *
  * @throws KitError if validation fails
  *
  * @example
  * ```typescript
- * import { bridgeParamsSchema } from '@core/provider'
+ * import { usdcBridgeParamsSchema } from '@core/provider'
  *
  * const validBridge = {
  *   amount: '100.50',
@@ -21465,29 +22177,11 @@ var TransferSpeed;
  *   }
  * }
  *
- * const result = bridgeParamsSchema.safeParse(validBridge)
+ * const result = usdcBridgeParamsSchema.safeParse(validBridge)
  * console.log(result.success) // true
  * ```
- */ const bridgeParamsSchema = z.object({
-    amount: z.string().min(1, 'Required').pipe(createDecimalStringValidator({
-        allowZero: false,
-        regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
-        attributeName: 'amount',
-        maxDecimals: 6
-    })(z.string())),
-    source: walletContextSchema,
-    destination: bridgeDestinationSchema,
-    token: z.literal('USDC'),
-    config: z.object({
-        transferSpeed: z.nativeEnum(TransferSpeed).optional(),
-        maxFee: z.string().pipe(createDecimalStringValidator({
-            allowZero: true,
-            regexMessage: MAX_FEE_FORMAT_ERROR_MESSAGE,
-            attributeName: 'maxFee',
-            maxDecimals: 6
-        })(z.string())).optional(),
-        customFee: customFeeSchema.optional()
-    })
+ */ const usdcBridgeParamsSchema = createBridgeParamsSchema(z.literal('USDC'), {
+    maxDecimals: 6
 });
 
 // ---------------------------------------------------------------------------
@@ -22081,6 +22775,10 @@ const USDC_DECIMALS$1 = 6;
  *
  * @see {@link https://developers.circle.com/gateway/references/fees}
  */ const GAS_FEE_BY_CHAIN = new Map([
+    [
+        Blockchain.Arc,
+        parseUnits('0.001', USDC_DECIMALS$1)
+    ],
     [
         Blockchain.Arc_Testnet,
         parseUnits('0.001', USDC_DECIMALS$1)
@@ -27446,7 +28144,7 @@ const assertCCTPv2BridgeParamsSymbol = Symbol('assertCCTPv2BridgeParams');
  * ```
  */ function assertCCTPv2BridgeParams(params) {
     // First validate basic bridge params
-    validateWithStateTracking(params, bridgeParamsSchema, 'CCTPv2 bridge parameters', assertCCTPv2BridgeParamsSymbol);
+    validateWithStateTracking(params, usdcBridgeParamsSchema, 'CCTPv2 bridge parameters', assertCCTPv2BridgeParamsSymbol);
     // After validation, we know params is CCTPV2BridgeParams
     const bridgeParams = params;
     // Enforce that source and destination chains are either testnet or mainnet
@@ -28313,7 +29011,7 @@ const mockAttestationMessage = {
     return step;
 }
 
-var version = "1.13.0";
+var version = "1.14.0";
 var pkg = {
 	version: version};
 
@@ -29905,7 +30603,7 @@ function assertCCTPV2Config(config) {
    * @example
    * ```typescript
    * const provider = new CCTPV2BridgingProvider()
-   * const canTransfer = provider.supportsRoute(Ethereum, Base)
+   * const canTransfer = provider.supportsRoute(Ethereum, Base, 'USDC')
    *
    * if (canTransfer) {
    *   console.log('CCTP v2 transfer is supported between these chains')