@circle-fin/app-kit 1.8.0 → 1.8.1

package/earn.cjs

@@ -843,36 +843,6 @@ class KitError extends Error {
     };
     return new KitError(errorDetails);
 }
-/**
- * Creates error for unsupported token on chain.
- *
- * This error is thrown when a token is not supported on the specified chain.
- *
- * @param token - The token symbol (e.g., 'USDC', 'USDT')
- * @param chain - The chain name where the token is unsupported
- * @returns KitError with specific token support details
- *
- * @example
- * ```typescript
- * import { createUnsupportedTokenError } from '@core/errors'
- *
- * throw createUnsupportedTokenError('USDC', 'UnknownChain')
- * // Message: "USDC is not supported on UnknownChain"
- * ```
- */ function createUnsupportedTokenError(token, chain) {
-    const errorDetails = {
-        ...InputError.UNSUPPORTED_TOKEN,
-        recoverability: 'FATAL',
-        message: `${token} is not supported on ${chain}.`,
-        cause: {
-            trace: {
-                token,
-                chain
-            }
-        }
-    };
-    return new KitError(errorDetails);
-}
 /**
  * Creates error for invalid chain configuration.
  *
@@ -1898,7 +1868,7 @@ function getOptionalString(value) {
  * - vault-not-found, unsupported-chain, unsupported-vault,
  *   signature-rejected, invalid-id, invalid-batch-size, position-not-registered,
  *   withdrawal-max-exceeded, insufficient-balance, bridge prepare idempotency
- *   conflicts
+ *   conflicts, invalid vault-asset amount precision
  *
  * SERVICE errors (RETRYABLE) — try again later:
  * - signing-failed, provider-error, rewards-fetch-failed,
@@ -2082,6 +2052,13 @@ function getOptionalString(value) {
             recoverability: 'RETRYABLE'
         }
     ],
+    [
+        380415,
+        {
+            errorDef: EarnError.INVALID_INPUT,
+            recoverability: 'FATAL'
+        }
+    ],
     // Bridge (380_5XX)
     [
         380500,
@@ -2117,6 +2094,13 @@ function getOptionalString(value) {
             errorDef: EarnError.PROVIDER_ERROR,
             recoverability: 'RETRYABLE'
         }
+    ],
+    [
+        380505,
+        {
+            errorDef: EarnError.PROVIDER_ERROR,
+            recoverability: 'FATAL'
+        }
     ]
 ]);
 /**
@@ -2576,23 +2560,6 @@ var EarnChain;
     }
 });
 
-/**
- * Standard decimal places for tokens.
- *
- * These constants define the decimal precision used by different token types
- * across the SDK. They are used for amount conversions between human-readable
- * format and smallest units (base units).
- *
- * @remarks
- * - Most stablecoins (USDC, EURC, USDT, PYUSD) use 6 decimal places
- * - Some stablecoins (DAI, USDE) and most native tokens (ETH, POL, PLUME) use 18 decimals
- * - The NATIVE alias uses chain-specific decimals which may vary (e.g., SOL uses 9)
- */ /**
- * Standard decimal places for 6-decimal tokens.
- *
- * Used by most stablecoins: USDC, EURC, USDT, PYUSD
- */ const TOKEN_DECIMALS_6 = 6;
-
 /**
  * @packageDocumentation
  * @module SwapTokenRegistry
@@ -7269,13 +7236,20 @@ const swapTokenEnumSchema = zod.z.enum([
     symbol: 'EURC',
     decimals: 6,
     locators: {
+        // =========================================================================
+        // Mainnets
+        // =========================================================================
         [Blockchain.Avalanche]: '0xc891EB4cbdEFf6e073e859e987815Ed1505c2ACD',
         [Blockchain.Base]: '0x60a3E35Cc302bFA44Cb288Bc5a4F316Fdb1adb42',
         [Blockchain.Ethereum]: '0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c',
         [Blockchain.Solana]: 'HzwqbKZw8HxMN6bF2yFZNrht3c2iXXzpKcFu7uBEDKtr',
         [Blockchain.World_Chain]: '0x1C60ba0A0eD1019e8Eb035E6daF4155A5cE2380B',
+        // =========================================================================
         // Testnets
-        [Blockchain.Arc_Testnet]: '0x89B50855Aa3bE2F677cD6303Cec089B5F319D72a'
+        // =========================================================================
+        [Blockchain.Arc_Testnet]: '0x89B50855Aa3bE2F677cD6303Cec089B5F319D72a',
+        [Blockchain.Base_Sepolia]: '0x808456652fdb597867f38412077A9182bf77359F',
+        [Blockchain.Ethereum_Sepolia]: '0x08210F9170F89Ab7658F0B5E3fF39b0E03C594D4'
     }
 };
 
@@ -7485,8 +7459,7 @@ const swapTokenEnumSchema = zod.z.enum([
  * cirBTC (Circle Bitcoin) token definition with addresses and metadata.
  *
  * @remarks
- * Built-in cirBTC definition for the TokenRegistry. Currently deployed
- * on Arc Testnet.
+ * Built-in cirBTC definition for the TokenRegistry.
  *
  * @example
  * ```typescript
@@ -7502,7 +7475,15 @@ const swapTokenEnumSchema = zod.z.enum([
     symbol: 'cirBTC',
     decimals: 8,
     locators: {
-        [Blockchain.Arc_Testnet]: '0xf0C4a4CE82A5746AbAAd9425360Ab04fbBA432BF'
+        // =========================================================================
+        // Mainnets
+        // =========================================================================
+        [Blockchain.Ethereum]: '0x72DFB2E44f59C5AD2bAFE84314E5b99a7cd5075E',
+        // =========================================================================
+        // Testnets
+        // =========================================================================
+        [Blockchain.Arc_Testnet]: '0xf0C4a4CE82A5746AbAAd9425360Ab04fbBA432BF',
+        [Blockchain.Ethereum_Sepolia]: '0x3a3fe695F684Bf9b9e43CF43C2b895Ea5e392bB3'
     }
 };
 
@@ -7942,7 +7923,7 @@ const swapTokenEnumSchema = zod.z.enum([
 }
 
 var name$2 = "@circle-fin/bridge-kit";
-var version$2 = "1.11.0";
+var version$2 = "1.11.1";
 var pkg$2 = {
 	name: name$2,
 	version: version$2};
@@ -8799,7 +8780,7 @@ var TransferSpeed;
 registerKit(`${pkg$2.name}/${pkg$2.version}`);
 
 var name$1 = "@circle-fin/swap-kit";
-var version$1 = "1.3.0";
+var version$1 = "1.3.1";
 var pkg$1 = {
 	name: name$1,
 	version: version$1};
@@ -12093,11 +12074,14 @@ new Set(Object.values(Blockchain));
 registerKit(`${pkg$1.name}/${pkg$1.version}`);
 
 var name = "@circle-fin/earn-kit";
-var version = "1.2.0";
+var version = "1.2.1";
 var pkg = {
 	name: name,
 	version: version};
 
+const EARN_BRIDGE_ERC3009_TOKEN_SYMBOLS = [
+    'USDC'
+];
 /**
  * Default base URL for the Earn Service API.
  *
@@ -12142,20 +12126,7 @@ var pkg = {
  */ const EARN_BRIDGE_DESTINATION_CHAIN_TO_API = {
     [Blockchain.Arc_Testnet]: CHAIN_TO_API[Blockchain.Arc_Testnet]
 };
-/**
- * Expected EIP-712 domain of the ERC-3009 authorization token per source
- * chain.
- *
- * Cross-chain Earn deposits are USDC-only, but USDC deployments differ on the
- * EIP-712 domain name: newer deployments use `USDC` while older ones (for
- * example Arbitrum Sepolia) kept `USD Coin` from the FiatToken V2 upgrade.
- * These values mirror the bridge service's per-chain domain table and the
- * on-chain `DOMAIN_SEPARATOR` inputs. Asserted before signing so a tampered
- * prepare response cannot point the signature at another token. The
- * `satisfies` check forces a domain entry whenever a source chain is added.
- *
- * @internal
- */ const EARN_BRIDGE_ERC3009_DOMAINS = {
+const EARN_BRIDGE_USDC_ERC3009_DOMAINS = {
     [Blockchain.Arbitrum_Sepolia]: {
         name: 'USD Coin',
         version: '2'
@@ -12169,6 +12140,21 @@ var pkg = {
         version: '2'
     }
 };
+/**
+ * Expected EIP-712 domain of the ERC-3009 authorization token per
+ * cross-chain-supported source token and source chain.
+ *
+ * The bridge service prepares an ERC-3009 payload for the deposited token. We
+ * keep this table as an explicit SDK allowlist because token deployments can
+ * differ by source chain and by domain name/version. These values mirror the
+ * bridge service's per-chain domain table and the on-chain DOMAIN_SEPARATOR
+ * inputs. Asserted before signing so a tampered prepare response cannot point
+ * the signature at another token or unexpected token domain.
+ *
+ * @internal
+ */ const EARN_BRIDGE_ERC3009_DOMAINS = {
+    USDC: EARN_BRIDGE_USDC_ERC3009_DOMAINS
+};
 /**
  * Maximum tolerated remaining lifetime of a prepared ERC-3009 authorization.
  *
@@ -12628,6 +12614,16 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
     return approvalTxHash;
 }
 
+/** @internal */ function isSameAddress(actual, expected) {
+    return actual.toLowerCase() === expected.toLowerCase();
+}
+/** @internal */ function assertDecimalPlaces(field, value, tokenDecimals, reason) {
+    const decimals = value.split('.')[1]?.length ?? 0;
+    if (decimals > tokenDecimals) {
+        throw createValidationFailedError(field, value, reason);
+    }
+}
+
 /**
  * Build the `tokenInputs` array forwarded to the adapter contract's
  * `execute(executeParams, tokenInputs, signature)` call.
@@ -12651,15 +12647,17 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
  *
  * @example
  * ```typescript
- * const approvedToken = assertHexAddress(
- *   'chain.usdcAddress',
- *   chain.usdcAddress,
- * )
- *
- * const tokenInputs = buildEarnTokenInputs(
+ * const approvalToken = resolveEarnApprovalToken(
  *   executionPayload.executionParams,
- *   approvedToken,
  * )
+ *
+ * const tokenInputs =
+ *   approvalToken === undefined
+ *     ? []
+ *     : buildEarnTokenInputs(
+ *         executionPayload.executionParams,
+ *         approvalToken,
+ *       )
  * ```
  *
  * @internal
@@ -12671,7 +12669,7 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
             return;
         }
         const { tokenIn } = instruction;
-        if (tokenIn.toLowerCase() !== approvedToken.toLowerCase()) {
+        if (!isSameAddress(tokenIn, approvedToken)) {
             throw createValidationFailedError(`executionParams.instructions[${index.toString()}].tokenIn`, tokenIn, 'tokenIn must match the token approved for adapter spending');
         }
         tokenInputs.push({
@@ -12683,6 +12681,33 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
     });
     return tokenInputs;
 }
+/**
+ * Resolve the single token that needs adapter allowance from signed Earn
+ * instructions.
+ *
+ * @param executionParams - Service-signed `ExecutionParams` forwarded to the adapter.
+ * @returns The token requested by positive approval instructions, or `undefined`.
+ * @throws {@link KitError} If positive approval instructions reference multiple tokens.
+ *
+ * @internal
+ */ function resolveEarnApprovalToken(executionParams) {
+    let approvedToken;
+    executionParams.instructions.forEach((instruction, index)=>{
+        const amount = BigInt(instruction.amountToApprove);
+        if (amount <= 0n) {
+            return;
+        }
+        const { tokenIn } = instruction;
+        if (approvedToken === undefined) {
+            approvedToken = tokenIn;
+            return;
+        }
+        if (!isSameAddress(tokenIn, approvedToken)) {
+            throw createValidationFailedError(`executionParams.instructions[${index.toString()}].tokenIn`, tokenIn, 'tokenIn must match the token approved for adapter spending');
+        }
+    });
+    return approvedToken;
+}
 
 /**
  * Prepare an earn adapter action, execute it, wait for confirmation, and
@@ -13174,6 +13199,7 @@ const hexSignatureSchema = evmSignatureSchema;
 const hexAddressSchema = evmAddressSchema;
 // '0x' prefix + 32 bytes * 2 hex chars.
 const BYTES32_HEX_LENGTH = 66;
+const bridgeFeeTokenSchema = hexAddressSchema;
 /**
  * Zod schema for a non-negative uint256-like value.
  *
@@ -13460,14 +13486,12 @@ const eip712DomainSchema = eip712DomainSchema$1.extend({
  *
  * The bridge prepare path returns one item per collected source fee (e.g.
  * `PRE_FINALITY` for the fast-burn fee and `FORWARD` for the destination
- * forward fee), all denominated in the shared `feeToken`. The signed
- * authorization `value` is `principal + sum(items[].amount)`, so the pre-sign
- * guard parses these to recompute the expected value. Each item's `amount` is
- * a base-unit decimal string in `feeToken` units.
+ * forward fee), all denominated in the shared `feeToken`. Each item's `amount`
+ * is a base-unit decimal string in `feeToken` units.
  *
  * @internal
  */ const bridgeFeeQuoteSchema = zod.z.object({
-    feeToken: hexAddressSchema,
+    feeToken: bridgeFeeTokenSchema,
     items: zod.z.array(zod.z.object({
         type: zod.z.string(),
         amount: uint256LikeSchema
@@ -13483,6 +13507,12 @@ const eip712DomainSchema = eip712DomainSchema$1.extend({
     erc3009TypedData: erc3009TypedDataSchema,
     feeQuote: bridgeFeeQuoteSchema
 }).passthrough();
+const bridgeDepositPrepareReviewSchema = zod.z.object({
+    sourceChain: zod.z.string(),
+    destinationChain: zod.z.string(),
+    amount: amountJsonSchema,
+    vaultAddress: hexAddressSchema
+}).passthrough();
 /**
  * Zod schema for the bridge deposit prepare payload.
  *
@@ -13494,7 +13524,7 @@ const eip712DomainSchema = eip712DomainSchema$1.extend({
     execId: bridgeDepositExecIdSchema,
     erc3009TypedData: bridgeDepositPreparedBundleSchema,
     expiresAt: zod.z.string().datetime(),
-    review: zod.z.unknown().optional()
+    review: bridgeDepositPrepareReviewSchema
 });
 /**
  * Zod schema for the `POST /v1/earnKit/bridge/deposit/prepare` API response.
@@ -14222,7 +14252,8 @@ function toPositionInfo(data) {
         return {
             execId: response.data.execId,
             preparedBundle,
-            expiresAt: response.data.expiresAt
+            expiresAt: response.data.expiresAt,
+            review: response.data.review
         };
     } catch (error) {
         throw parseEarnApiError(error, {
@@ -14333,47 +14364,34 @@ const VALID_AFTER_CLOCK_SKEW_SECONDS = 60n;
  * @throws If any typed-data field does not match the expected bridge deposit intent.
  * @internal
  */ function assertBridgeDepositTypedDataMatchesIntent(intent) {
-    const { preparedBundle, sourceChain, sourceAddress, sourceTokenAddress, authorizationRecipient, amount, maxFee, tokenDecimals, nowSeconds = BigInt(Math.floor(Date.now() / 1000)) } = intent;
+    const { preparedBundle, sourceChain, sourceAddress, sourceTokenAddress, expectedDomain, authorizationRecipient, amount, maxFee, tokenDecimals, amountRaw, nowSeconds = BigInt(Math.floor(Date.now() / 1000)) } = intent;
     const { domain, message } = preparedBundle.erc3009TypedData;
-    // USDC deployments differ on the EIP-712 domain name per chain, so the
-    // expected domain is looked up for the source chain being signed on.
-    const expectedDomain = EARN_BRIDGE_ERC3009_DOMAINS[sourceChain.chain];
-    if (expectedDomain === undefined) {
-        throw createValidationFailedError('sourceChain.chain', sourceChain.chain, 'no expected ERC-3009 domain is configured for the source chain');
-    }
-    if (domain.name !== expectedDomain.name) {
-        throw createValidationFailedError('preparedBundle.erc3009TypedData.domain.name', domain.name, `domain name must be ${expectedDomain.name}`);
-    }
-    if (domain.version !== expectedDomain.version) {
-        throw createValidationFailedError('preparedBundle.erc3009TypedData.domain.version', domain.version, `domain version must be ${expectedDomain.version}`);
-    }
     assertSameAddress('preparedBundle.erc3009TypedData.domain.verifyingContract', domain.verifyingContract, sourceTokenAddress, 'verifyingContract must match the source token contract');
     assertSameBigInt('preparedBundle.erc3009TypedData.domain.chainId', domain.chainId, BigInt(sourceChain.chainId), 'chainId must match the source chain');
+    assertSameString('preparedBundle.erc3009TypedData.domain.name', domain.name, expectedDomain.name, 'domain name must match the source token');
+    assertSameString('preparedBundle.erc3009TypedData.domain.version', domain.version, expectedDomain.version, 'domain version must match the source token');
     assertSameAddress('preparedBundle.erc3009TypedData.message.from', message.from, sourceAddress, 'from must match the source wallet');
     assertSameAddress('preparedBundle.erc3009TypedData.message.to', message.to, authorizationRecipient, 'to must match the configured authorization recipient');
-    // The prepare path folds the source fee into the signed authorization:
-    // message.value = principal + sum(feeQuote.items[].amount), all denominated
-    // in the source token. The fee items only add up to a meaningful total when
-    // they are priced in the same token as the principal, so first pin the fee
-    // token to the source token contract before summing.
-    assertSameAddress('preparedBundle.feeQuote.feeToken', preparedBundle.feeQuote.feeToken, sourceTokenAddress, 'feeQuote.feeToken must match the source token contract');
-    // Recompute the expected value from locally trusted inputs (the caller
-    // principal) plus the bundle's own fee items so the guard accepts fee-bearing
-    // deposits while still rejecting any other value tampering. The fee quote is
-    // service-supplied, so bound it to the caller-accepted quote-derived cap
-    // before including it in the signed value.
-    const principal = Amount.parse(amount, {
+    // Recompute the expected ERC-3009 value from locally trusted inputs. Bridge
+    // source fees are paid in the source ERC-20 and are part of the authorization.
+    assertDecimalPlaces('amount', amount, tokenDecimals, `amount must have at most ${String(tokenDecimals)} decimal places for the cross-chain Earn deposit source token`);
+    const parsedAmount = Amount.parse(amount, {
         decimals: tokenDecimals
     }).raw;
+    const principal = amountRaw === undefined ? parsedAmount : parseReviewedAmount(amountRaw, parsedAmount);
+    const feeQuote = preparedBundle.feeQuote;
     const feeTotal = sumBridgeFeeItems(preparedBundle.feeQuote);
+    assertFeeTokenMatchesSourceToken(feeQuote.feeToken, sourceTokenAddress);
+    const feeDecimals = tokenDecimals;
+    assertDecimalPlaces('maxFee', maxFee, feeDecimals, `maxFee must have at most ${String(feeDecimals)} decimal places for the cross-chain Earn deposit fee token`);
     const maxFeeRaw = Amount.parse(maxFee, {
-        decimals: tokenDecimals
+        decimals: feeDecimals
     }).raw;
     if (feeTotal > maxFeeRaw) {
         throw createValidationFailedError('preparedBundle.feeQuote.items', feeTotal.toString(), 'fee total must not exceed maxFee in base units');
     }
     const expectedValue = principal + feeTotal;
-    assertSameBigInt('preparedBundle.erc3009TypedData.message.value', message.value, expectedValue, 'value must match the requested amount plus the bundle fee in base units');
+    assertSameBigInt('preparedBundle.erc3009TypedData.message.value', message.value, expectedValue, 'value must match the requested amount plus source-token fees in base units');
     const window = checkErc3009ValidityWindow({
         validAfter: BigInt(message.validAfter),
         validBefore: BigInt(message.validBefore),
@@ -14447,14 +14465,19 @@ const VALID_AFTER_CLOCK_SKEW_SECONDS = 60n;
 /**
  * Sum the source-collected fee items in a prepared bundle's fee quote.
  *
- * Each item amount is a base-unit value in the shared `feeToken`; the total is
- * what the prepare path adds to the principal when building `message.value`.
+ * Each item amount is a base-unit value in the shared `feeToken`.
  *
  * @param feeQuote - Fee quote parsed from the prepared bundle.
- * @returns Total fee in source token base units (0n when there are no items).
+ * @returns Total fee in fee-token base units (0n when there are no items).
  */ function sumBridgeFeeItems(feeQuote) {
     return feeQuote.items.reduce((total, item)=>total + BigInt(item.amount), 0n);
 }
+function assertFeeTokenMatchesSourceToken(feeToken, sourceTokenAddress) {
+    if (isSameAddress(feeToken, sourceTokenAddress)) {
+        return;
+    }
+    throw createValidationFailedError('preparedBundle.feeQuote.feeToken', feeToken, 'fee token must match the cross-chain Earn deposit source token');
+}
 function assertNever(value) {
     throw new KitError({
         ...EarnError.INTERNAL_ERROR,
@@ -14462,8 +14485,23 @@ function assertNever(value) {
         message: `Unexpected validity window reason: ${String(value)}`
     });
 }
+function parseReviewedAmount(amountRaw, parsedAmount) {
+    let reviewedAmount;
+    try {
+        reviewedAmount = BigInt(amountRaw);
+    } catch  {
+        throw createValidationFailedError('prepared.review.amount.raw', amountRaw, 'amount must be a non-negative integer string');
+    }
+    if (reviewedAmount < 0n) {
+        throw createValidationFailedError('prepared.review.amount.raw', amountRaw, 'amount must be a non-negative integer string');
+    }
+    if (reviewedAmount !== parsedAmount) {
+        throw createValidationFailedError('prepared.review.amount.raw', amountRaw, 'review amount must match the requested amount');
+    }
+    return reviewedAmount;
+}
 function assertSameAddress(field, actual, expected, reason) {
-    if (actual.toLowerCase() !== expected.toLowerCase()) {
+    if (!isSameAddress(actual, expected)) {
         throw createValidationFailedError(field, actual, reason);
     }
 }
@@ -14472,6 +14510,11 @@ function assertSameBigInt(field, actual, expected, reason) {
         throw createValidationFailedError(field, actual, reason);
     }
 }
+function assertSameString(field, actual, expected, reason) {
+    if (actual !== expected) {
+        throw createValidationFailedError(field, actual, reason);
+    }
+}
 
 /**
  * Build signed withdrawal instructions via the Earn Service API.
@@ -14829,6 +14872,9 @@ function toWithdrawalQuoteInfo(data) {
     'CONFIRMED',
     'COMPLETE'
 ]);
+// Intentionally built-ins-only: Earn bridge support is limited to SDK-known
+// token contracts plus the explicit ERC-3009 domain allowlist below.
+const TOKEN_REGISTRY = createTokenRegistry();
 /**
  * Build the typed error raised when a cross-chain wait is cancelled via its
  * `AbortSignal`. Mirrors `@core/adapter-base`'s `createAbortError` (same
@@ -15148,24 +15194,20 @@ function finishElapsedWait(lastStatus, lastError) {
             }
             const { address, chain: apiChain, chainDefinition: chain } = await resolveAdapterContext(params.from);
             const adapterContractAddress = requireAdapterContract(chain);
-            const rawUsdcAddress = chain.usdcAddress;
-            if (rawUsdcAddress === null) {
-                throw createUnsupportedTokenError('USDC', chain.name);
-            }
-            const usdcAddress = assertHexAddress('chain.usdcAddress', rawUsdcAddress, `USDC address for chain ${chain.name} must be a 0x-prefixed 20-byte hex address.`);
             const { adapter } = params.from;
+            const vaultAddress = assertHexAddress('vaultAddress', params.vaultAddress, 'Vault address must be a 0x-prefixed 20-byte hex address.');
             const { executionParams, signature } = await this.runPhase(ctx, 'deposit', 'fetchParams', async ()=>fetchDeposit({
-                    vaultAddress: params.vaultAddress,
+                    vaultAddress,
                     amount: params.amount,
                     address,
                     chain: apiChain,
                     config
                 }), ()=>undefined);
             validateExecutionDeadline(executionParams);
-            const tokenInputs = buildEarnTokenInputs(executionParams, usdcAddress);
-            const approvalToken = tokenInputs[0]?.token;
+            const approvalToken = resolveEarnApprovalToken(executionParams);
+            const tokenInputs = approvalToken === undefined ? [] : buildEarnTokenInputs(executionParams, approvalToken);
             const requiredAllowance = sumTokenInputAmounts(tokenInputs);
-            if (!options.skipApprove && approvalToken !== undefined) {
+            if (!options.skipApprove && approvalToken !== undefined && requiredAllowance > 0n) {
                 await this.runPhase(ctx, 'approve', 'approve', async ()=>approveAllowanceIfNeeded({
                         adapter,
                         chain,
@@ -15173,7 +15215,7 @@ function finishElapsedWait(lastStatus, lastError) {
                         delegate: adapterContractAddress,
                         address,
                         requiredAllowance,
-                        revertMessage: 'USDC approval reverted on-chain'
+                        revertMessage: 'Earn deposit token approval reverted on-chain'
                     }), (txHash)=>txHash);
             }
             const { txHash, explorerUrl } = await this.runPhase(ctx, 'deposit', 'execute', async ()=>executeEarnAction({
@@ -15192,7 +15234,7 @@ function finishElapsedWait(lastStatus, lastError) {
                 kind: 'same-chain',
                 txHash,
                 explorerUrl,
-                vaultAddress: params.vaultAddress,
+                vaultAddress,
                 amount: params.amount
             };
         } catch (error) {
@@ -15214,13 +15256,6 @@ function finishElapsedWait(lastStatus, lastError) {
         const sourceAddress = assertHexAddress('from.address', await resolveCrossChainSourceAddress(params.from, sourceChain), `Source address for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
         const destinationAddress = assertHexAddress('to.recipientAddress', params.to.recipientAddress, `Destination address for chain ${destinationChain.name} must be a 0x-prefixed 20-byte hex address.`);
         const vaultAddress = assertHexAddress('vaultAddress', params.vaultAddress, 'Vault address must be a 0x-prefixed 20-byte hex address.');
-        // The signed ERC-3009 value is denominated in USDC's 6 decimals. More
-        // precise inputs would be silently truncated by Amount.parse, so the
-        // result would claim a larger deposit than was actually authorized.
-        const amountDecimals = params.amount.split('.')[1]?.length ?? 0;
-        if (amountDecimals > TOKEN_DECIMALS_6) {
-            throw createValidationFailedError('amount', params.amount, `amount must have at most ${String(TOKEN_DECIMALS_6)} decimal places for cross-chain Earn deposits`);
-        }
         const execId = params.idempotencyKey;
         const prepared = await this.runPhase(ctx, 'crossChainDeposit', 'prepare', async ()=>fetchBridgeDepositPrepare({
                 execId,
@@ -15240,17 +15275,19 @@ function finishElapsedWait(lastStatus, lastError) {
             // the error trace, instead of ending the event stream unannounced
             // after the prepare success event.
             assertPreparedBundleMatchesTypedDataNonce(prepared.preparedBundle);
+            const sourceToken = resolvePreparedBridgeSourceToken(prepared.preparedBundle, route.sourceChain);
+            validatePreparedReviewAmountDecimals(prepared.review.amount.decimals, sourceToken.decimals);
             assertBridgeDepositTypedDataMatchesIntent({
                 preparedBundle: prepared.preparedBundle,
                 sourceChain: route.sourceChain,
                 sourceAddress,
-                sourceTokenAddress: route.sourceTokenAddress,
+                sourceTokenAddress: sourceToken.address,
+                expectedDomain: sourceToken.erc3009Domain,
                 authorizationRecipient: route.authorizationRecipient,
                 amount: params.amount,
                 maxFee: params.maxFee,
-                // Cross-chain Earn is USDC-only today. USDC uses 6 decimals on all
-                // configured source chains.
-                tokenDecimals: TOKEN_DECIMALS_6
+                tokenDecimals: sourceToken.decimals,
+                amountRaw: prepared.review.amount.raw
             });
             return signBridgeDepositAuthorization({
                 adapter: bridgeSigningAdapter,
@@ -15473,21 +15510,17 @@ function finishElapsedWait(lastStatus, lastError) {
         const { adapter, chain, apiChain, address, vaultAddress, amount, config } = params;
         try {
             const adapterContractAddress = requireAdapterContract(chain);
-            const rawUsdcAddress = chain.usdcAddress;
-            if (rawUsdcAddress === null) {
-                throw createUnsupportedTokenError('USDC', chain.name);
-            }
-            const usdcAddress = assertHexAddress('chain.usdcAddress', rawUsdcAddress, `USDC address for chain ${chain.name} must be a 0x-prefixed 20-byte hex address.`);
+            const normalizedVaultAddress = assertHexAddress('vaultAddress', vaultAddress, 'Vault address must be a 0x-prefixed 20-byte hex address.');
             const { executionParams, signature } = await fetchDeposit({
-                vaultAddress,
+                vaultAddress: normalizedVaultAddress,
                 amount,
                 address,
                 chain: apiChain,
                 config
             });
             validateExecutionDeadline(executionParams);
-            const tokenInputs = buildEarnTokenInputs(executionParams, usdcAddress);
-            const approvalToken = tokenInputs[0]?.token;
+            const approvalToken = resolveEarnApprovalToken(executionParams);
+            const tokenInputs = approvalToken === undefined ? [] : buildEarnTokenInputs(executionParams, approvalToken);
             const requiredAllowance = sumTokenInputAmounts(tokenInputs);
             return await estimateEarnQuoteGasFees({
                 adapter,
@@ -15500,7 +15533,7 @@ function finishElapsedWait(lastStatus, lastError) {
                     tokenInputs,
                     signature
                 },
-                approval: approvalToken !== undefined ? {
+                approval: approvalToken !== undefined && requiredAllowance > 0n ? {
                     token: approvalToken,
                     delegate: adapterContractAddress,
                     requiredAllowance
@@ -15744,11 +15777,6 @@ function validateCrossChainDepositRoute(sourceChain, destinationChain) {
     if (destinationApiChain === undefined) {
         throw createUnsupportedCrossChainDepositError(destinationChain, 'destination chain is not enabled for cross-chain Earn deposits');
     }
-    const sourceTokenAddressRaw = sourceChain.usdcAddress;
-    if (sourceTokenAddressRaw === null) {
-        throw createUnsupportedTokenError('USDC', sourceChain.name);
-    }
-    const sourceTokenAddress = assertHexAddress('sourceChain.usdcAddress', sourceTokenAddressRaw, `USDC address for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
     if (sourceChain.cctp == null) {
         throw createBridgeRouteNotConfiguredError(sourceChain, 'source chain does not support CCTP');
     }
@@ -15772,10 +15800,50 @@ function validateCrossChainDepositRoute(sourceChain, destinationChain) {
         destinationApiChain,
         destinationDomain: destinationChain.cctp.domain,
         sourceChain,
-        sourceTokenAddress,
         authorizationRecipient
     };
 }
+function resolvePreparedBridgeSourceToken(preparedBundle, sourceChain) {
+    const sourceTokenAddress = assertHexAddress('preparedBundle.erc3009TypedData.domain.verifyingContract', preparedBundle.erc3009TypedData.domain.verifyingContract, `Source token for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
+    let sourceToken;
+    try {
+        sourceToken = TOKEN_REGISTRY.resolveByAddress(sourceTokenAddress, sourceChain.chain);
+    } catch  {
+        throw createValidationFailedError('preparedBundle.erc3009TypedData.domain.verifyingContract', sourceTokenAddress, `source token ${sourceTokenAddress} is not configured on source chain ${sourceChain.name} for cross-chain Earn deposits`);
+    }
+    const registryAddress = assertHexAddress('sourceToken.locator', sourceToken.locator, `Source token ${sourceToken.symbol ?? sourceTokenAddress} for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
+    if (!isSameAddress(sourceTokenAddress, registryAddress)) {
+        throw createValidationFailedError('preparedBundle.erc3009TypedData.domain.verifyingContract', sourceTokenAddress, `source token must match the configured ${sourceToken.symbol ?? 'token'} address on source chain ${sourceChain.name}`);
+    }
+    const { symbol } = sourceToken;
+    if (symbol === undefined) {
+        throw createValidationFailedError('preparedBundle.erc3009TypedData.domain.verifyingContract', sourceTokenAddress, `source token ${sourceTokenAddress} is not a registered Earn bridge token on source chain ${sourceChain.name}`);
+    }
+    return {
+        address: sourceTokenAddress,
+        erc3009Domain: resolveBridgeErc3009Domain(symbol, sourceChain),
+        decimals: sourceToken.decimals
+    };
+}
+function validatePreparedReviewAmountDecimals(reviewedDecimals, tokenDecimals) {
+    if (reviewedDecimals !== tokenDecimals) {
+        throw createValidationFailedError('prepared.review.amount.decimals', reviewedDecimals, `review amount decimals must match the cross-chain Earn deposit source token decimals ${String(tokenDecimals)}`);
+    }
+}
+function resolveBridgeErc3009Domain(tokenSymbol, sourceChain) {
+    if (!isEarnBridgeErc3009TokenSymbol(tokenSymbol)) {
+        throw createValidationFailedError('sourceToken.symbol', tokenSymbol, `ERC-3009 domain is not configured for ${tokenSymbol} on source chain ${sourceChain.name}`);
+    }
+    const domainsByChain = EARN_BRIDGE_ERC3009_DOMAINS[tokenSymbol];
+    const domain = domainsByChain[sourceChain.chain];
+    if (domain === undefined) {
+        throw createValidationFailedError('sourceToken.symbol', tokenSymbol, `ERC-3009 domain is not configured for ${tokenSymbol} on source chain ${sourceChain.name}`);
+    }
+    return domain;
+}
+function isEarnBridgeErc3009TokenSymbol(tokenSymbol) {
+    return EARN_BRIDGE_ERC3009_TOKEN_SYMBOLS.includes(tokenSymbol);
+}
 function createUnsupportedCrossChainDepositError(chain, reason) {
     return new KitError({
         ...EarnError.UNSUPPORTED_CHAIN,
@@ -15848,7 +15916,6 @@ function createUnsupportedCrossChainDepositError(chain, reason) {
     // Untyped callers can pass anything here; without these guards a null
     // config crashes with a raw TypeError on `config.providers` instead of
     // the structured validation error every other public surface throws.
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- JS consumers may pass null or a non-object config
     if (typeof config !== 'object' || config === null || Array.isArray(config)) {
         throw createValidationFailedError('config', config, 'config must be a plain object when provided');
     }
@@ -16215,10 +16282,9 @@ const sourceAdapterContextSchema = zod.z.object({
  * Schema for validating human-readable decimal amount strings.
  *
  * Accept positive decimal strings like '100', '100.50', '0.001'. Reject
- * zero, negative, non-numeric, and non-canonical strings. EarnKit
- * same-chain amounts are USDC/EURC (6 decimals), so precision is capped at
- * 6 to match the Earn Service and fail fast locally instead of leaking
- * 7+ decimal-place inputs to the server.
+ * zero, negative, non-numeric, and non-canonical strings. Same-chain
+ * EarnKit vaults can use different asset precisions, so the service enforces
+ * the vault-specific decimal cap after resolving the vault asset.
  *
  * @internal
  */ const amountSchema = zod.z.string({
@@ -16227,32 +16293,15 @@ const sourceAdapterContextSchema = zod.z.object({
     allowZero: false,
     regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
     attributeName: 'amount',
-    maxDecimals: 6
-})(zod.z.string())).refine((value)=>CANONICAL_AMOUNT_REGEX.test(value), AMOUNT_FORMAT_ERROR_MESSAGE);
-/**
- * Schema for cross-chain deposit amount strings.
- *
- * Cross-chain Earn deposits are USDC-only, and the signed ERC-3009 value is
- * denominated in USDC's 6 decimals. Reject more precise inputs up front so
- * the signed value always equals the requested amount instead of a silent
- * truncation. Non-canonical forms (leading dot, leading zeros) are rejected
- * too, matching the Earn Service.
- *
- * @internal
- */ const crossChainAmountSchema = zod.z.string({
-    required_error: 'amount is required'
-}).min(1, 'amount is required').pipe(createDecimalStringValidator({
-    allowZero: false,
-    regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
-    attributeName: 'amount',
-    maxDecimals: 6
+    maxDecimals: 18
 })(zod.z.string())).refine((value)=>CANONICAL_AMOUNT_REGEX.test(value), AMOUNT_FORMAT_ERROR_MESSAGE);
 /**
  * Schema for cross-chain source fee caps.
  *
- * Cross-chain source fees are denominated in USDC base units. Zero is valid
- * when the quote contains no source-collected fees; otherwise the cap should be
- * the caller-accepted total from a recent quote.
+ * Cross-chain source fees are denominated in the quote's fee token. Zero is
+ * valid when the quote contains no source-collected fees; otherwise the cap
+ * should be the caller-accepted total from a recent quote. The provider
+ * enforces the prepared bundle's fee-token precision before signing.
  *
  * @internal
  */ const crossChainMaxFeeSchema = zod.z.string({
@@ -16261,7 +16310,7 @@ const sourceAdapterContextSchema = zod.z.object({
     allowZero: true,
     regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
     attributeName: 'maxFee',
-    maxDecimals: 6
+    maxDecimals: 18
 })(zod.z.string())).refine((value)=>CANONICAL_AMOUNT_REGEX.test(value), AMOUNT_FORMAT_ERROR_MESSAGE);
 /**
  * Build a schema for an optional non-negative decimal filter string.
@@ -16422,7 +16471,7 @@ const crossChainDepositDestinationSchema = zod.z.object({
     from: sourceAdapterContextSchema,
     to: crossChainDepositDestinationSchema,
     vaultAddress: vaultAddressSchema,
-    amount: crossChainAmountSchema,
+    amount: amountSchema,
     maxFee: crossChainMaxFeeSchema,
     transferSpeed: zod.z.enum([
         'FAST',