@circle-fin/app-kit 1.8.0 → 1.8.1

package/index.cjs

@@ -3657,7 +3657,7 @@ function getOptionalString(value) {
  * - vault-not-found, unsupported-chain, unsupported-vault,
  *   signature-rejected, invalid-id, invalid-batch-size, position-not-registered,
  *   withdrawal-max-exceeded, insufficient-balance, bridge prepare idempotency
- *   conflicts
+ *   conflicts, invalid vault-asset amount precision
  *
  * SERVICE errors (RETRYABLE) — try again later:
  * - signing-failed, provider-error, rewards-fetch-failed,
@@ -3841,6 +3841,13 @@ function getOptionalString(value) {
             recoverability: 'RETRYABLE'
         }
     ],
+    [
+        380415,
+        {
+            errorDef: EarnError.INVALID_INPUT,
+            recoverability: 'FATAL'
+        }
+    ],
     // Bridge (380_5XX)
     [
         380500,
@@ -3876,6 +3883,13 @@ function getOptionalString(value) {
             errorDef: EarnError.PROVIDER_ERROR,
             recoverability: 'RETRYABLE'
         }
+    ],
+    [
+        380505,
+        {
+            errorDef: EarnError.PROVIDER_ERROR,
+            recoverability: 'FATAL'
+        }
     ]
 ]);
 /**
@@ -4335,23 +4349,6 @@ exports.EarnChain = void 0;
     }
 });
 
-/**
- * Standard decimal places for tokens.
- *
- * These constants define the decimal precision used by different token types
- * across the SDK. They are used for amount conversions between human-readable
- * format and smallest units (base units).
- *
- * @remarks
- * - Most stablecoins (USDC, EURC, USDT, PYUSD) use 6 decimal places
- * - Some stablecoins (DAI, USDE) and most native tokens (ETH, POL, PLUME) use 18 decimals
- * - The NATIVE alias uses chain-specific decimals which may vary (e.g., SOL uses 9)
- */ /**
- * Standard decimal places for 6-decimal tokens.
- *
- * Used by most stablecoins: USDC, EURC, USDT, PYUSD
- */ const TOKEN_DECIMALS_6 = 6;
-
 /**
  * @packageDocumentation
  * @module SwapTokenRegistry
@@ -9992,13 +9989,20 @@ function parseOrThrow(value, schema, context) {
     symbol: 'EURC',
     decimals: 6,
     locators: {
+        // =========================================================================
+        // Mainnets
+        // =========================================================================
         [exports.Blockchain.Avalanche]: '0xc891EB4cbdEFf6e073e859e987815Ed1505c2ACD',
         [exports.Blockchain.Base]: '0x60a3E35Cc302bFA44Cb288Bc5a4F316Fdb1adb42',
         [exports.Blockchain.Ethereum]: '0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c',
         [exports.Blockchain.Solana]: 'HzwqbKZw8HxMN6bF2yFZNrht3c2iXXzpKcFu7uBEDKtr',
         [exports.Blockchain.World_Chain]: '0x1C60ba0A0eD1019e8Eb035E6daF4155A5cE2380B',
+        // =========================================================================
         // Testnets
-        [exports.Blockchain.Arc_Testnet]: '0x89B50855Aa3bE2F677cD6303Cec089B5F319D72a'
+        // =========================================================================
+        [exports.Blockchain.Arc_Testnet]: '0x89B50855Aa3bE2F677cD6303Cec089B5F319D72a',
+        [exports.Blockchain.Base_Sepolia]: '0x808456652fdb597867f38412077A9182bf77359F',
+        [exports.Blockchain.Ethereum_Sepolia]: '0x08210F9170F89Ab7658F0B5E3fF39b0E03C594D4'
     }
 };
 
@@ -10208,8 +10212,7 @@ function parseOrThrow(value, schema, context) {
  * cirBTC (Circle Bitcoin) token definition with addresses and metadata.
  *
  * @remarks
- * Built-in cirBTC definition for the TokenRegistry. Currently deployed
- * on Arc Testnet.
+ * Built-in cirBTC definition for the TokenRegistry.
  *
  * @example
  * ```typescript
@@ -10225,7 +10228,15 @@ function parseOrThrow(value, schema, context) {
     symbol: 'cirBTC',
     decimals: 8,
     locators: {
-        [exports.Blockchain.Arc_Testnet]: '0xf0C4a4CE82A5746AbAAd9425360Ab04fbBA432BF'
+        // =========================================================================
+        // Mainnets
+        // =========================================================================
+        [exports.Blockchain.Ethereum]: '0x72DFB2E44f59C5AD2bAFE84314E5b99a7cd5075E',
+        // =========================================================================
+        // Testnets
+        // =========================================================================
+        [exports.Blockchain.Arc_Testnet]: '0xf0C4a4CE82A5746AbAAd9425360Ab04fbBA432BF',
+        [exports.Blockchain.Ethereum_Sepolia]: '0x3a3fe695F684Bf9b9e43CF43C2b895Ea5e392bB3'
     }
 };
 
@@ -11506,7 +11517,7 @@ function resolveOptions(options) {
 }
 
 var name$3 = "@circle-fin/bridge-kit";
-var version$4 = "1.11.0";
+var version$4 = "1.11.1";
 var pkg$4 = {
 	name: name$3,
 	version: version$4};
@@ -16297,7 +16308,7 @@ const mockAttestationMessage = {
     return step;
 }
 
-var version$3 = "1.8.4";
+var version$3 = "1.8.5";
 var pkg$3 = {
 	version: version$3};
 
@@ -18704,7 +18715,7 @@ registerKit(`${pkg$4.name}/${pkg$4.version}`);
 };
 
 var name$2 = "@circle-fin/swap-kit";
-var version$2 = "1.3.0";
+var version$2 = "1.3.1";
 var pkg$2 = {
 	name: name$2,
 	version: version$2};
@@ -23639,7 +23650,7 @@ function writeBytes32(buffer, hex, offset) {
     }
 }
 
-const TOKEN_REGISTRY$3 = createTokenRegistry();
+const TOKEN_REGISTRY$4 = createTokenRegistry();
 /**
  * Resolve token alias to contract address for the given chain.
  *
@@ -23728,7 +23739,7 @@ const TOKEN_REGISTRY$3 = createTokenRegistry();
             }
         });
     }
-    const tokenDefinition = TOKEN_REGISTRY$3.get(upperToken);
+    const tokenDefinition = TOKEN_REGISTRY$4.get(upperToken);
     if (tokenDefinition !== undefined) {
         const resolvedAddress = tokenDefinition.locators[chain.chain];
         if (!resolvedAddress) {
@@ -23745,7 +23756,7 @@ const TOKEN_REGISTRY$3 = createTokenRegistry();
                 }
             });
         }
-        return TOKEN_REGISTRY$3.resolve(upperToken, chain.chain).locator;
+        return TOKEN_REGISTRY$4.resolve(upperToken, chain.chain).locator;
     }
     // Not an alias - return as-is (assumed to be address)
     return token;
@@ -23842,11 +23853,11 @@ function resolveFeePayoutChain(tokenIn, tokenOut, sourceChain, destinationChain)
     if (destinationChain.chain !== sourceChain.chain) {
         return sourceChain;
     }
-    const inputIsOk = isOkToken(tokenIn, sourceChain, TOKEN_REGISTRY$3, OK_TOKEN_SYMBOLS$1);
+    const inputIsOk = isOkToken(tokenIn, sourceChain, TOKEN_REGISTRY$4, OK_TOKEN_SYMBOLS$1);
     if (inputIsOk) {
         return sourceChain;
     }
-    const outputIsOk = isOkToken(tokenOut, destinationChain, TOKEN_REGISTRY$3, OK_TOKEN_SYMBOLS$1);
+    const outputIsOk = isOkToken(tokenOut, destinationChain, TOKEN_REGISTRY$4, OK_TOKEN_SYMBOLS$1);
     return outputIsOk ? destinationChain : sourceChain;
 }
 /**
@@ -25137,7 +25148,7 @@ function resolveFeePayoutChain(tokenIn, tokenOut, sourceChain, destinationChain)
     }
 }
 
-const TOKEN_REGISTRY$2 = createTokenRegistry();
+const TOKEN_REGISTRY$3 = createTokenRegistry();
 /**
  * Resolve a token identifier to its canonical symbol for the Stablecoin Service Swap Provider.
  *
@@ -25181,7 +25192,7 @@ const TOKEN_REGISTRY$2 = createTokenRegistry();
         return NATIVE_TOKEN;
     }
     // For known registry aliases, return canonical symbol directly.
-    if (TOKEN_REGISTRY$2.get(upperToken) !== undefined) {
+    if (TOKEN_REGISTRY$3.get(upperToken) !== undefined) {
         return upperToken;
     }
     // For EVM chains, normalize addresses to lowercase for case-insensitive comparison.
@@ -25191,7 +25202,7 @@ const TOKEN_REGISTRY$2 = createTokenRegistry();
     // Native address is given
     if (isNativeEvmAddress(token) || isNativeSolanaAddress(token)) return NATIVE_TOKEN;
     try {
-        const { symbol } = TOKEN_REGISTRY$2.resolveByAddress(normalizedToken, chain.chain);
+        const { symbol } = TOKEN_REGISTRY$3.resolveByAddress(normalizedToken, chain.chain);
         if (symbol === undefined) {
             return null;
         }
@@ -25322,7 +25333,7 @@ const TOKEN_REGISTRY$2 = createTokenRegistry();
     return `Insufficient ${displaySymbol} balance for swap operation.\n\n` + `Wallet: ${walletAddress}\n` + `Current balance: ${currentDisplay}\n` + `Required: ${requiredDisplay}\n` + `Shortfall: ${shortfallDisplay}\n\n` + `This swap requires ${requiredSummary} to complete the transaction.\n\n` + `Action: Add at least ${actionAmount} to your wallet to complete this swap.`;
 }
 
-const TOKEN_REGISTRY$1 = createTokenRegistry();
+const TOKEN_REGISTRY$2 = createTokenRegistry();
 /**
  * Format a raw base-unit amount into a human-readable decimal string.
  *
@@ -25382,12 +25393,12 @@ const TOKEN_REGISTRY$1 = createTokenRegistry();
                     value,
                     token: resolvedSymbol,
                     chain,
-                    tokens: TOKEN_REGISTRY$1
+                    tokens: TOKEN_REGISTRY$2
                 }),
                 token: resolvedSymbol
             };
         }
-        const tokenDef = TOKEN_REGISTRY$1.get(resolvedSymbol);
+        const tokenDef = TOKEN_REGISTRY$2.get(resolvedSymbol);
         if (tokenDef) {
             const decimals = resolveTokenDecimals$1(tokenDef, chain.chain);
             return {
@@ -25418,7 +25429,7 @@ const TOKEN_REGISTRY$1 = createTokenRegistry();
  * i.e. 1 + 0.2 + 0.1 = 1.3. Use the greater of (local estimate × this multiplier)
  * or the proxy's gasLimit.
  */ const GAS_SAFETY_MULTIPLIER = 1.3;
-const TOKEN_REGISTRY = createTokenRegistry();
+const TOKEN_REGISTRY$1 = createTokenRegistry();
 /**
  * Enhances a KitError with transaction details (txHash and explorerUrl).
  *
@@ -25494,6 +25505,19 @@ const TOKEN_REGISTRY = createTokenRegistry();
  *
  * @internal
  */ const SUPPORTED_CHAINS$1 = getSwapSupportedChains(Chains);
+/**
+ * Inter-poll delays (ms) for the same-chain `amountOut` enrichment loop.
+ *
+ * A same-chain swap is already terminal `DONE` once its source transaction
+ * confirms; this short, escalating budget (~5s total across up to four polls)
+ * gives the service a brief window to resolve the output amount before
+ * `swap()` returns. The loop exits the instant `amountOut` is available.
+ */ const SAME_CHAIN_AMOUNT_OUT_POLL_DELAYS_MS = [
+    1_000,
+    2_000,
+    2_000
+];
+const sleep$3 = async (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
 function buildSwapProgress(statusResult) {
     return {
         status: statusResult.status,
@@ -25513,29 +25537,46 @@ async function fetchSameChainStatusSnapshot({ isCrossChainSwap, txHash, chain, a
             }
         };
     }
-    try {
-        const statusResult = await getSwapStatus$2({
-            txHash,
-            chain: chain.chain,
-            apiKey
-        });
-        const progress = buildSwapProgress(statusResult);
-        if (statusResult.status === 'DONE' && statusResult.amountOut !== undefined) {
+    // A same-chain swap completes atomically in the source transaction, which
+    // has already been confirmed (and receipt-checked for revert) by the time we
+    // get here. Its terminal status is therefore `DONE`. We briefly poll the
+    // status endpoint to enrich `amountOut`, which the service usually resolves
+    // within a few seconds. A non-DONE/erroneous peek never downgrades the
+    // status — once the short budget is exhausted we return `DONE` without
+    // `amountOut`, and the caller can fetch it later via `getSwapStatus`.
+    for(let attempt = 0;; attempt += 1){
+        try {
+            const statusResult = await getSwapStatus$2({
+                txHash,
+                chain: chain.chain,
+                apiKey
+            });
+            if (statusResult.status === 'DONE' && statusResult.amountOut !== undefined) {
+                return {
+                    progress: buildSwapProgress(statusResult),
+                    amountOut: statusResult.amountOut
+                };
+            }
+        } catch  {
+            // Reachability/parse failure during enrichment — non-fatal; the swap
+            // already succeeded on-chain. `getSwapStatus` already retried transient
+            // network errors internally, so further polling is unlikely to help.
             return {
-                progress,
-                amountOut: statusResult.amountOut
+                progress: {
+                    status: 'DONE'
+                }
             };
         }
-        return {
-            progress
-        };
-    } catch  {
-        // Non-fatal — the swap already succeeded on-chain. status stays PENDING.
-        return {
-            progress: {
-                status: 'PENDING'
-            }
-        };
+        const delayMs = SAME_CHAIN_AMOUNT_OUT_POLL_DELAYS_MS[attempt];
+        if (delayMs === undefined) {
+            // Budget exhausted — terminal `DONE`, `amountOut` not yet available.
+            return {
+                progress: {
+                    status: 'DONE'
+                }
+            };
+        }
+        await sleep$3(delayMs);
     }
 }
 /**
@@ -25816,7 +25857,7 @@ async function fetchSameChainStatusSnapshot({ isCrossChainSwap, txHash, chain, a
             return true;
         }
         // At least one token must be supported for fee collection
-        return getSwapOkTokenStatus(tokenInAddress, tokenOutAddress, chain, TOKEN_REGISTRY, OK_TOKEN_SYMBOLS$1).hasOkToken;
+        return getSwapOkTokenStatus(tokenInAddress, tokenOutAddress, chain, TOKEN_REGISTRY$1, OK_TOKEN_SYMBOLS$1).hasOkToken;
     }
     /**
    * Estimate swap costs and output amount by delegating to the Stablecoin Service quote API.
@@ -26413,14 +26454,14 @@ async function fetchSameChainStatusSnapshot({ isCrossChainSwap, txHash, chain, a
         }
         // Build swap fees with adapter-backed formatting for unregistered tokens
         const swapResultFees = serviceResponse.fees ? await this.buildFormattedFees(serviceResponse.fees, chain, destinationChain, adapter, config?.customFee?.recipientAddress) : undefined;
-        // Best-effort enrichment: fetch amountOut and provider-reported status.
-        // Only performed for same-chain swaps — they typically reach DONE within
-        // a few seconds of source-tx confirmation, so the peek is useful UX and
-        // adds minimal latency. Cross-chain swaps are skipped because the
-        // destination mint takes minutes (CCTPv2 attestation), meaning the peek
-        // would always return PENDING/WAIT_DESTINATION_TRANSACTION while still
-        // burning up to 30s of the load balancer's server-side wait. Callers
-        // should use `kit.getSwapStatus()` to poll cross-chain swaps to DONE.
+        // Best-effort enrichment: briefly poll for amountOut on same-chain swaps.
+        // They complete atomically in the (already-confirmed) source tx, so the
+        // result is terminal `DONE` regardless; the short poll only adds amountOut
+        // once the service has resolved it. Cross-chain swaps are skipped because
+        // the destination mint takes minutes (CCTPv2 attestation), so polling would
+        // always return PENDING/WAIT_DESTINATION_TRANSACTION while burning the
+        // budget. Callers should use `kit.getSwapStatus()` to poll cross-chain
+        // swaps to DONE.
         const statusSnapshot = await fetchSameChainStatusSnapshot({
             isCrossChainSwap,
             txHash,
@@ -30722,11 +30763,14 @@ registerKit(`${pkg$2.name}/${pkg$2.version}`);
 };
 
 var name$1 = "@circle-fin/earn-kit";
-var version$1 = "1.2.0";
+var version$1 = "1.2.1";
 var pkg$1 = {
 	name: name$1,
 	version: version$1};
 
+const EARN_BRIDGE_ERC3009_TOKEN_SYMBOLS = [
+    'USDC'
+];
 /**
  * Default base URL for the Earn Service API.
  *
@@ -30771,20 +30815,7 @@ var pkg$1 = {
  */ const EARN_BRIDGE_DESTINATION_CHAIN_TO_API = {
     [exports.Blockchain.Arc_Testnet]: CHAIN_TO_API[exports.Blockchain.Arc_Testnet]
 };
-/**
- * Expected EIP-712 domain of the ERC-3009 authorization token per source
- * chain.
- *
- * Cross-chain Earn deposits are USDC-only, but USDC deployments differ on the
- * EIP-712 domain name: newer deployments use `USDC` while older ones (for
- * example Arbitrum Sepolia) kept `USD Coin` from the FiatToken V2 upgrade.
- * These values mirror the bridge service's per-chain domain table and the
- * on-chain `DOMAIN_SEPARATOR` inputs. Asserted before signing so a tampered
- * prepare response cannot point the signature at another token. The
- * `satisfies` check forces a domain entry whenever a source chain is added.
- *
- * @internal
- */ const EARN_BRIDGE_ERC3009_DOMAINS = {
+const EARN_BRIDGE_USDC_ERC3009_DOMAINS = {
     [exports.Blockchain.Arbitrum_Sepolia]: {
         name: 'USD Coin',
         version: '2'
@@ -30798,6 +30829,21 @@ var pkg$1 = {
         version: '2'
     }
 };
+/**
+ * Expected EIP-712 domain of the ERC-3009 authorization token per
+ * cross-chain-supported source token and source chain.
+ *
+ * The bridge service prepares an ERC-3009 payload for the deposited token. We
+ * keep this table as an explicit SDK allowlist because token deployments can
+ * differ by source chain and by domain name/version. These values mirror the
+ * bridge service's per-chain domain table and the on-chain DOMAIN_SEPARATOR
+ * inputs. Asserted before signing so a tampered prepare response cannot point
+ * the signature at another token or unexpected token domain.
+ *
+ * @internal
+ */ const EARN_BRIDGE_ERC3009_DOMAINS = {
+    USDC: EARN_BRIDGE_USDC_ERC3009_DOMAINS
+};
 /**
  * Maximum tolerated remaining lifetime of a prepared ERC-3009 authorization.
  *
@@ -31257,6 +31303,16 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
     return approvalTxHash;
 }
 
+/** @internal */ function isSameAddress(actual, expected) {
+    return actual.toLowerCase() === expected.toLowerCase();
+}
+/** @internal */ function assertDecimalPlaces(field, value, tokenDecimals, reason) {
+    const decimals = value.split('.')[1]?.length ?? 0;
+    if (decimals > tokenDecimals) {
+        throw createValidationFailedError$1(field, value, reason);
+    }
+}
+
 /**
  * Build the `tokenInputs` array forwarded to the adapter contract's
  * `execute(executeParams, tokenInputs, signature)` call.
@@ -31280,15 +31336,17 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
  *
  * @example
  * ```typescript
- * const approvedToken = assertHexAddress(
- *   'chain.usdcAddress',
- *   chain.usdcAddress,
- * )
- *
- * const tokenInputs = buildEarnTokenInputs(
+ * const approvalToken = resolveEarnApprovalToken(
  *   executionPayload.executionParams,
- *   approvedToken,
  * )
+ *
+ * const tokenInputs =
+ *   approvalToken === undefined
+ *     ? []
+ *     : buildEarnTokenInputs(
+ *         executionPayload.executionParams,
+ *         approvalToken,
+ *       )
  * ```
  *
  * @internal
@@ -31300,7 +31358,7 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
             return;
         }
         const { tokenIn } = instruction;
-        if (tokenIn.toLowerCase() !== approvedToken.toLowerCase()) {
+        if (!isSameAddress(tokenIn, approvedToken)) {
             throw createValidationFailedError$1(`executionParams.instructions[${index.toString()}].tokenIn`, tokenIn, 'tokenIn must match the token approved for adapter spending');
         }
         tokenInputs.push({
@@ -31312,6 +31370,33 @@ const GAS_SAFETY_MULTIPLIER_DENOMINATOR = 10n;
     });
     return tokenInputs;
 }
+/**
+ * Resolve the single token that needs adapter allowance from signed Earn
+ * instructions.
+ *
+ * @param executionParams - Service-signed `ExecutionParams` forwarded to the adapter.
+ * @returns The token requested by positive approval instructions, or `undefined`.
+ * @throws {@link KitError} If positive approval instructions reference multiple tokens.
+ *
+ * @internal
+ */ function resolveEarnApprovalToken(executionParams) {
+    let approvedToken;
+    executionParams.instructions.forEach((instruction, index)=>{
+        const amount = BigInt(instruction.amountToApprove);
+        if (amount <= 0n) {
+            return;
+        }
+        const { tokenIn } = instruction;
+        if (approvedToken === undefined) {
+            approvedToken = tokenIn;
+            return;
+        }
+        if (!isSameAddress(tokenIn, approvedToken)) {
+            throw createValidationFailedError$1(`executionParams.instructions[${index.toString()}].tokenIn`, tokenIn, 'tokenIn must match the token approved for adapter spending');
+        }
+    });
+    return approvedToken;
+}
 
 /**
  * Prepare an earn adapter action, execute it, wait for confirmation, and
@@ -31803,6 +31888,7 @@ const hexSignatureSchema = evmSignatureSchema;
 const hexAddressSchema = evmAddressSchema;
 // '0x' prefix + 32 bytes * 2 hex chars.
 const BYTES32_HEX_LENGTH = 66;
+const bridgeFeeTokenSchema = hexAddressSchema;
 /**
  * Zod schema for a non-negative uint256-like value.
  *
@@ -32089,14 +32175,12 @@ const eip712DomainSchema = eip712DomainSchema$1.extend({
  *
  * The bridge prepare path returns one item per collected source fee (e.g.
  * `PRE_FINALITY` for the fast-burn fee and `FORWARD` for the destination
- * forward fee), all denominated in the shared `feeToken`. The signed
- * authorization `value` is `principal + sum(items[].amount)`, so the pre-sign
- * guard parses these to recompute the expected value. Each item's `amount` is
- * a base-unit decimal string in `feeToken` units.
+ * forward fee), all denominated in the shared `feeToken`. Each item's `amount`
+ * is a base-unit decimal string in `feeToken` units.
  *
  * @internal
  */ const bridgeFeeQuoteSchema = zod.z.object({
-    feeToken: hexAddressSchema,
+    feeToken: bridgeFeeTokenSchema,
     items: zod.z.array(zod.z.object({
         type: zod.z.string(),
         amount: uint256LikeSchema
@@ -32112,6 +32196,12 @@ const eip712DomainSchema = eip712DomainSchema$1.extend({
     erc3009TypedData: erc3009TypedDataSchema,
     feeQuote: bridgeFeeQuoteSchema
 }).passthrough();
+const bridgeDepositPrepareReviewSchema = zod.z.object({
+    sourceChain: zod.z.string(),
+    destinationChain: zod.z.string(),
+    amount: amountJsonSchema,
+    vaultAddress: hexAddressSchema
+}).passthrough();
 /**
  * Zod schema for the bridge deposit prepare payload.
  *
@@ -32123,7 +32213,7 @@ const eip712DomainSchema = eip712DomainSchema$1.extend({
     execId: bridgeDepositExecIdSchema,
     erc3009TypedData: bridgeDepositPreparedBundleSchema,
     expiresAt: zod.z.string().datetime(),
-    review: zod.z.unknown().optional()
+    review: bridgeDepositPrepareReviewSchema
 });
 /**
  * Zod schema for the `POST /v1/earnKit/bridge/deposit/prepare` API response.
@@ -32851,7 +32941,8 @@ function toPositionInfo(data) {
         return {
             execId: response.data.execId,
             preparedBundle,
-            expiresAt: response.data.expiresAt
+            expiresAt: response.data.expiresAt,
+            review: response.data.review
         };
     } catch (error) {
         throw parseEarnApiError(error, {
@@ -32962,47 +33053,34 @@ const VALID_AFTER_CLOCK_SKEW_SECONDS = 60n;
  * @throws If any typed-data field does not match the expected bridge deposit intent.
  * @internal
  */ function assertBridgeDepositTypedDataMatchesIntent(intent) {
-    const { preparedBundle, sourceChain, sourceAddress, sourceTokenAddress, authorizationRecipient, amount, maxFee, tokenDecimals, nowSeconds = BigInt(Math.floor(Date.now() / 1000)) } = intent;
+    const { preparedBundle, sourceChain, sourceAddress, sourceTokenAddress, expectedDomain, authorizationRecipient, amount, maxFee, tokenDecimals, amountRaw, nowSeconds = BigInt(Math.floor(Date.now() / 1000)) } = intent;
     const { domain, message } = preparedBundle.erc3009TypedData;
-    // USDC deployments differ on the EIP-712 domain name per chain, so the
-    // expected domain is looked up for the source chain being signed on.
-    const expectedDomain = EARN_BRIDGE_ERC3009_DOMAINS[sourceChain.chain];
-    if (expectedDomain === undefined) {
-        throw createValidationFailedError$1('sourceChain.chain', sourceChain.chain, 'no expected ERC-3009 domain is configured for the source chain');
-    }
-    if (domain.name !== expectedDomain.name) {
-        throw createValidationFailedError$1('preparedBundle.erc3009TypedData.domain.name', domain.name, `domain name must be ${expectedDomain.name}`);
-    }
-    if (domain.version !== expectedDomain.version) {
-        throw createValidationFailedError$1('preparedBundle.erc3009TypedData.domain.version', domain.version, `domain version must be ${expectedDomain.version}`);
-    }
     assertSameAddress('preparedBundle.erc3009TypedData.domain.verifyingContract', domain.verifyingContract, sourceTokenAddress, 'verifyingContract must match the source token contract');
     assertSameBigInt('preparedBundle.erc3009TypedData.domain.chainId', domain.chainId, BigInt(sourceChain.chainId), 'chainId must match the source chain');
+    assertSameString('preparedBundle.erc3009TypedData.domain.name', domain.name, expectedDomain.name, 'domain name must match the source token');
+    assertSameString('preparedBundle.erc3009TypedData.domain.version', domain.version, expectedDomain.version, 'domain version must match the source token');
     assertSameAddress('preparedBundle.erc3009TypedData.message.from', message.from, sourceAddress, 'from must match the source wallet');
     assertSameAddress('preparedBundle.erc3009TypedData.message.to', message.to, authorizationRecipient, 'to must match the configured authorization recipient');
-    // The prepare path folds the source fee into the signed authorization:
-    // message.value = principal + sum(feeQuote.items[].amount), all denominated
-    // in the source token. The fee items only add up to a meaningful total when
-    // they are priced in the same token as the principal, so first pin the fee
-    // token to the source token contract before summing.
-    assertSameAddress('preparedBundle.feeQuote.feeToken', preparedBundle.feeQuote.feeToken, sourceTokenAddress, 'feeQuote.feeToken must match the source token contract');
-    // Recompute the expected value from locally trusted inputs (the caller
-    // principal) plus the bundle's own fee items so the guard accepts fee-bearing
-    // deposits while still rejecting any other value tampering. The fee quote is
-    // service-supplied, so bound it to the caller-accepted quote-derived cap
-    // before including it in the signed value.
-    const principal = Amount.parse(amount, {
+    // Recompute the expected ERC-3009 value from locally trusted inputs. Bridge
+    // source fees are paid in the source ERC-20 and are part of the authorization.
+    assertDecimalPlaces('amount', amount, tokenDecimals, `amount must have at most ${String(tokenDecimals)} decimal places for the cross-chain Earn deposit source token`);
+    const parsedAmount = Amount.parse(amount, {
         decimals: tokenDecimals
     }).raw;
+    const principal = amountRaw === undefined ? parsedAmount : parseReviewedAmount(amountRaw, parsedAmount);
+    const feeQuote = preparedBundle.feeQuote;
     const feeTotal = sumBridgeFeeItems(preparedBundle.feeQuote);
+    assertFeeTokenMatchesSourceToken(feeQuote.feeToken, sourceTokenAddress);
+    const feeDecimals = tokenDecimals;
+    assertDecimalPlaces('maxFee', maxFee, feeDecimals, `maxFee must have at most ${String(feeDecimals)} decimal places for the cross-chain Earn deposit fee token`);
     const maxFeeRaw = Amount.parse(maxFee, {
-        decimals: tokenDecimals
+        decimals: feeDecimals
     }).raw;
     if (feeTotal > maxFeeRaw) {
         throw createValidationFailedError$1('preparedBundle.feeQuote.items', feeTotal.toString(), 'fee total must not exceed maxFee in base units');
     }
     const expectedValue = principal + feeTotal;
-    assertSameBigInt('preparedBundle.erc3009TypedData.message.value', message.value, expectedValue, 'value must match the requested amount plus the bundle fee in base units');
+    assertSameBigInt('preparedBundle.erc3009TypedData.message.value', message.value, expectedValue, 'value must match the requested amount plus source-token fees in base units');
     const window = checkErc3009ValidityWindow({
         validAfter: BigInt(message.validAfter),
         validBefore: BigInt(message.validBefore),
@@ -33076,14 +33154,19 @@ const VALID_AFTER_CLOCK_SKEW_SECONDS = 60n;
 /**
  * Sum the source-collected fee items in a prepared bundle's fee quote.
  *
- * Each item amount is a base-unit value in the shared `feeToken`; the total is
- * what the prepare path adds to the principal when building `message.value`.
+ * Each item amount is a base-unit value in the shared `feeToken`.
  *
  * @param feeQuote - Fee quote parsed from the prepared bundle.
- * @returns Total fee in source token base units (0n when there are no items).
+ * @returns Total fee in fee-token base units (0n when there are no items).
  */ function sumBridgeFeeItems(feeQuote) {
     return feeQuote.items.reduce((total, item)=>total + BigInt(item.amount), 0n);
 }
+function assertFeeTokenMatchesSourceToken(feeToken, sourceTokenAddress) {
+    if (isSameAddress(feeToken, sourceTokenAddress)) {
+        return;
+    }
+    throw createValidationFailedError$1('preparedBundle.feeQuote.feeToken', feeToken, 'fee token must match the cross-chain Earn deposit source token');
+}
 function assertNever(value) {
     throw new KitError({
         ...EarnError.INTERNAL_ERROR,
@@ -33091,8 +33174,23 @@ function assertNever(value) {
         message: `Unexpected validity window reason: ${String(value)}`
     });
 }
+function parseReviewedAmount(amountRaw, parsedAmount) {
+    let reviewedAmount;
+    try {
+        reviewedAmount = BigInt(amountRaw);
+    } catch  {
+        throw createValidationFailedError$1('prepared.review.amount.raw', amountRaw, 'amount must be a non-negative integer string');
+    }
+    if (reviewedAmount < 0n) {
+        throw createValidationFailedError$1('prepared.review.amount.raw', amountRaw, 'amount must be a non-negative integer string');
+    }
+    if (reviewedAmount !== parsedAmount) {
+        throw createValidationFailedError$1('prepared.review.amount.raw', amountRaw, 'review amount must match the requested amount');
+    }
+    return reviewedAmount;
+}
 function assertSameAddress(field, actual, expected, reason) {
-    if (actual.toLowerCase() !== expected.toLowerCase()) {
+    if (!isSameAddress(actual, expected)) {
         throw createValidationFailedError$1(field, actual, reason);
     }
 }
@@ -33101,6 +33199,11 @@ function assertSameBigInt(field, actual, expected, reason) {
         throw createValidationFailedError$1(field, actual, reason);
     }
 }
+function assertSameString(field, actual, expected, reason) {
+    if (actual !== expected) {
+        throw createValidationFailedError$1(field, actual, reason);
+    }
+}
 
 /**
  * Build signed withdrawal instructions via the Earn Service API.
@@ -33458,6 +33561,9 @@ function toWithdrawalQuoteInfo(data) {
     'CONFIRMED',
     'COMPLETE'
 ]);
+// Intentionally built-ins-only: Earn bridge support is limited to SDK-known
+// token contracts plus the explicit ERC-3009 domain allowlist below.
+const TOKEN_REGISTRY = createTokenRegistry();
 /**
  * Build the typed error raised when a cross-chain wait is cancelled via its
  * `AbortSignal`. Mirrors `@core/adapter-base`'s `createAbortError` (same
@@ -33787,24 +33893,20 @@ function finishElapsedWait(lastStatus, lastError) {
             }
             const { address, chain: apiChain, chainDefinition: chain } = await resolveAdapterContext(params.from);
             const adapterContractAddress = requireAdapterContract(chain);
-            const rawUsdcAddress = chain.usdcAddress;
-            if (rawUsdcAddress === null) {
-                throw createUnsupportedTokenError('USDC', chain.name);
-            }
-            const usdcAddress = assertHexAddress('chain.usdcAddress', rawUsdcAddress, `USDC address for chain ${chain.name} must be a 0x-prefixed 20-byte hex address.`);
             const { adapter } = params.from;
+            const vaultAddress = assertHexAddress('vaultAddress', params.vaultAddress, 'Vault address must be a 0x-prefixed 20-byte hex address.');
             const { executionParams, signature } = await this.runPhase(ctx, 'deposit', 'fetchParams', async ()=>fetchDeposit({
-                    vaultAddress: params.vaultAddress,
+                    vaultAddress,
                     amount: params.amount,
                     address,
                     chain: apiChain,
                     config
                 }), ()=>undefined);
             validateExecutionDeadline(executionParams);
-            const tokenInputs = buildEarnTokenInputs(executionParams, usdcAddress);
-            const approvalToken = tokenInputs[0]?.token;
+            const approvalToken = resolveEarnApprovalToken(executionParams);
+            const tokenInputs = approvalToken === undefined ? [] : buildEarnTokenInputs(executionParams, approvalToken);
             const requiredAllowance = sumTokenInputAmounts(tokenInputs);
-            if (!options.skipApprove && approvalToken !== undefined) {
+            if (!options.skipApprove && approvalToken !== undefined && requiredAllowance > 0n) {
                 await this.runPhase(ctx, 'approve', 'approve', async ()=>approveAllowanceIfNeeded({
                         adapter,
                         chain,
@@ -33812,7 +33914,7 @@ function finishElapsedWait(lastStatus, lastError) {
                         delegate: adapterContractAddress,
                         address,
                         requiredAllowance,
-                        revertMessage: 'USDC approval reverted on-chain'
+                        revertMessage: 'Earn deposit token approval reverted on-chain'
                     }), (txHash)=>txHash);
             }
             const { txHash, explorerUrl } = await this.runPhase(ctx, 'deposit', 'execute', async ()=>executeEarnAction({
@@ -33831,7 +33933,7 @@ function finishElapsedWait(lastStatus, lastError) {
                 kind: 'same-chain',
                 txHash,
                 explorerUrl,
-                vaultAddress: params.vaultAddress,
+                vaultAddress,
                 amount: params.amount
             };
         } catch (error) {
@@ -33853,13 +33955,6 @@ function finishElapsedWait(lastStatus, lastError) {
         const sourceAddress = assertHexAddress('from.address', await resolveCrossChainSourceAddress(params.from, sourceChain), `Source address for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
         const destinationAddress = assertHexAddress('to.recipientAddress', params.to.recipientAddress, `Destination address for chain ${destinationChain.name} must be a 0x-prefixed 20-byte hex address.`);
         const vaultAddress = assertHexAddress('vaultAddress', params.vaultAddress, 'Vault address must be a 0x-prefixed 20-byte hex address.');
-        // The signed ERC-3009 value is denominated in USDC's 6 decimals. More
-        // precise inputs would be silently truncated by Amount.parse, so the
-        // result would claim a larger deposit than was actually authorized.
-        const amountDecimals = params.amount.split('.')[1]?.length ?? 0;
-        if (amountDecimals > TOKEN_DECIMALS_6) {
-            throw createValidationFailedError$1('amount', params.amount, `amount must have at most ${String(TOKEN_DECIMALS_6)} decimal places for cross-chain Earn deposits`);
-        }
         const execId = params.idempotencyKey;
         const prepared = await this.runPhase(ctx, 'crossChainDeposit', 'prepare', async ()=>fetchBridgeDepositPrepare({
                 execId,
@@ -33879,17 +33974,19 @@ function finishElapsedWait(lastStatus, lastError) {
             // the error trace, instead of ending the event stream unannounced
             // after the prepare success event.
             assertPreparedBundleMatchesTypedDataNonce(prepared.preparedBundle);
+            const sourceToken = resolvePreparedBridgeSourceToken(prepared.preparedBundle, route.sourceChain);
+            validatePreparedReviewAmountDecimals(prepared.review.amount.decimals, sourceToken.decimals);
             assertBridgeDepositTypedDataMatchesIntent({
                 preparedBundle: prepared.preparedBundle,
                 sourceChain: route.sourceChain,
                 sourceAddress,
-                sourceTokenAddress: route.sourceTokenAddress,
+                sourceTokenAddress: sourceToken.address,
+                expectedDomain: sourceToken.erc3009Domain,
                 authorizationRecipient: route.authorizationRecipient,
                 amount: params.amount,
                 maxFee: params.maxFee,
-                // Cross-chain Earn is USDC-only today. USDC uses 6 decimals on all
-                // configured source chains.
-                tokenDecimals: TOKEN_DECIMALS_6
+                tokenDecimals: sourceToken.decimals,
+                amountRaw: prepared.review.amount.raw
             });
             return signBridgeDepositAuthorization({
                 adapter: bridgeSigningAdapter,
@@ -34112,21 +34209,17 @@ function finishElapsedWait(lastStatus, lastError) {
         const { adapter, chain, apiChain, address, vaultAddress, amount, config } = params;
         try {
             const adapterContractAddress = requireAdapterContract(chain);
-            const rawUsdcAddress = chain.usdcAddress;
-            if (rawUsdcAddress === null) {
-                throw createUnsupportedTokenError('USDC', chain.name);
-            }
-            const usdcAddress = assertHexAddress('chain.usdcAddress', rawUsdcAddress, `USDC address for chain ${chain.name} must be a 0x-prefixed 20-byte hex address.`);
+            const normalizedVaultAddress = assertHexAddress('vaultAddress', vaultAddress, 'Vault address must be a 0x-prefixed 20-byte hex address.');
             const { executionParams, signature } = await fetchDeposit({
-                vaultAddress,
+                vaultAddress: normalizedVaultAddress,
                 amount,
                 address,
                 chain: apiChain,
                 config
             });
             validateExecutionDeadline(executionParams);
-            const tokenInputs = buildEarnTokenInputs(executionParams, usdcAddress);
-            const approvalToken = tokenInputs[0]?.token;
+            const approvalToken = resolveEarnApprovalToken(executionParams);
+            const tokenInputs = approvalToken === undefined ? [] : buildEarnTokenInputs(executionParams, approvalToken);
             const requiredAllowance = sumTokenInputAmounts(tokenInputs);
             return await estimateEarnQuoteGasFees({
                 adapter,
@@ -34139,7 +34232,7 @@ function finishElapsedWait(lastStatus, lastError) {
                     tokenInputs,
                     signature
                 },
-                approval: approvalToken !== undefined ? {
+                approval: approvalToken !== undefined && requiredAllowance > 0n ? {
                     token: approvalToken,
                     delegate: adapterContractAddress,
                     requiredAllowance
@@ -34383,11 +34476,6 @@ function validateCrossChainDepositRoute(sourceChain, destinationChain) {
     if (destinationApiChain === undefined) {
         throw createUnsupportedCrossChainDepositError(destinationChain, 'destination chain is not enabled for cross-chain Earn deposits');
     }
-    const sourceTokenAddressRaw = sourceChain.usdcAddress;
-    if (sourceTokenAddressRaw === null) {
-        throw createUnsupportedTokenError('USDC', sourceChain.name);
-    }
-    const sourceTokenAddress = assertHexAddress('sourceChain.usdcAddress', sourceTokenAddressRaw, `USDC address for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
     if (sourceChain.cctp == null) {
         throw createBridgeRouteNotConfiguredError(sourceChain, 'source chain does not support CCTP');
     }
@@ -34411,10 +34499,50 @@ function validateCrossChainDepositRoute(sourceChain, destinationChain) {
         destinationApiChain,
         destinationDomain: destinationChain.cctp.domain,
         sourceChain,
-        sourceTokenAddress,
         authorizationRecipient
     };
 }
+function resolvePreparedBridgeSourceToken(preparedBundle, sourceChain) {
+    const sourceTokenAddress = assertHexAddress('preparedBundle.erc3009TypedData.domain.verifyingContract', preparedBundle.erc3009TypedData.domain.verifyingContract, `Source token for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
+    let sourceToken;
+    try {
+        sourceToken = TOKEN_REGISTRY.resolveByAddress(sourceTokenAddress, sourceChain.chain);
+    } catch  {
+        throw createValidationFailedError$1('preparedBundle.erc3009TypedData.domain.verifyingContract', sourceTokenAddress, `source token ${sourceTokenAddress} is not configured on source chain ${sourceChain.name} for cross-chain Earn deposits`);
+    }
+    const registryAddress = assertHexAddress('sourceToken.locator', sourceToken.locator, `Source token ${sourceToken.symbol ?? sourceTokenAddress} for chain ${sourceChain.name} must be a 0x-prefixed 20-byte hex address.`);
+    if (!isSameAddress(sourceTokenAddress, registryAddress)) {
+        throw createValidationFailedError$1('preparedBundle.erc3009TypedData.domain.verifyingContract', sourceTokenAddress, `source token must match the configured ${sourceToken.symbol ?? 'token'} address on source chain ${sourceChain.name}`);
+    }
+    const { symbol } = sourceToken;
+    if (symbol === undefined) {
+        throw createValidationFailedError$1('preparedBundle.erc3009TypedData.domain.verifyingContract', sourceTokenAddress, `source token ${sourceTokenAddress} is not a registered Earn bridge token on source chain ${sourceChain.name}`);
+    }
+    return {
+        address: sourceTokenAddress,
+        erc3009Domain: resolveBridgeErc3009Domain(symbol, sourceChain),
+        decimals: sourceToken.decimals
+    };
+}
+function validatePreparedReviewAmountDecimals(reviewedDecimals, tokenDecimals) {
+    if (reviewedDecimals !== tokenDecimals) {
+        throw createValidationFailedError$1('prepared.review.amount.decimals', reviewedDecimals, `review amount decimals must match the cross-chain Earn deposit source token decimals ${String(tokenDecimals)}`);
+    }
+}
+function resolveBridgeErc3009Domain(tokenSymbol, sourceChain) {
+    if (!isEarnBridgeErc3009TokenSymbol(tokenSymbol)) {
+        throw createValidationFailedError$1('sourceToken.symbol', tokenSymbol, `ERC-3009 domain is not configured for ${tokenSymbol} on source chain ${sourceChain.name}`);
+    }
+    const domainsByChain = EARN_BRIDGE_ERC3009_DOMAINS[tokenSymbol];
+    const domain = domainsByChain[sourceChain.chain];
+    if (domain === undefined) {
+        throw createValidationFailedError$1('sourceToken.symbol', tokenSymbol, `ERC-3009 domain is not configured for ${tokenSymbol} on source chain ${sourceChain.name}`);
+    }
+    return domain;
+}
+function isEarnBridgeErc3009TokenSymbol(tokenSymbol) {
+    return EARN_BRIDGE_ERC3009_TOKEN_SYMBOLS.includes(tokenSymbol);
+}
 function createUnsupportedCrossChainDepositError(chain, reason) {
     return new KitError({
         ...EarnError.UNSUPPORTED_CHAIN,
@@ -34487,7 +34615,6 @@ function createUnsupportedCrossChainDepositError(chain, reason) {
     // Untyped callers can pass anything here; without these guards a null
     // config crashes with a raw TypeError on `config.providers` instead of
     // the structured validation error every other public surface throws.
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- JS consumers may pass null or a non-object config
     if (typeof config !== 'object' || config === null || Array.isArray(config)) {
         throw createValidationFailedError$1('config', config, 'config must be a plain object when provided');
     }
@@ -34854,10 +34981,9 @@ const sourceAdapterContextSchema = zod.z.object({
  * Schema for validating human-readable decimal amount strings.
  *
  * Accept positive decimal strings like '100', '100.50', '0.001'. Reject
- * zero, negative, non-numeric, and non-canonical strings. EarnKit
- * same-chain amounts are USDC/EURC (6 decimals), so precision is capped at
- * 6 to match the Earn Service and fail fast locally instead of leaking
- * 7+ decimal-place inputs to the server.
+ * zero, negative, non-numeric, and non-canonical strings. Same-chain
+ * EarnKit vaults can use different asset precisions, so the service enforces
+ * the vault-specific decimal cap after resolving the vault asset.
  *
  * @internal
  */ const amountSchema$1 = zod.z.string({
@@ -34866,32 +34992,15 @@ const sourceAdapterContextSchema = zod.z.object({
     allowZero: false,
     regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
     attributeName: 'amount',
-    maxDecimals: 6
-})(zod.z.string())).refine((value)=>CANONICAL_AMOUNT_REGEX.test(value), AMOUNT_FORMAT_ERROR_MESSAGE);
-/**
- * Schema for cross-chain deposit amount strings.
- *
- * Cross-chain Earn deposits are USDC-only, and the signed ERC-3009 value is
- * denominated in USDC's 6 decimals. Reject more precise inputs up front so
- * the signed value always equals the requested amount instead of a silent
- * truncation. Non-canonical forms (leading dot, leading zeros) are rejected
- * too, matching the Earn Service.
- *
- * @internal
- */ const crossChainAmountSchema = zod.z.string({
-    required_error: 'amount is required'
-}).min(1, 'amount is required').pipe(createDecimalStringValidator({
-    allowZero: false,
-    regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
-    attributeName: 'amount',
-    maxDecimals: 6
+    maxDecimals: 18
 })(zod.z.string())).refine((value)=>CANONICAL_AMOUNT_REGEX.test(value), AMOUNT_FORMAT_ERROR_MESSAGE);
 /**
  * Schema for cross-chain source fee caps.
  *
- * Cross-chain source fees are denominated in USDC base units. Zero is valid
- * when the quote contains no source-collected fees; otherwise the cap should be
- * the caller-accepted total from a recent quote.
+ * Cross-chain source fees are denominated in the quote's fee token. Zero is
+ * valid when the quote contains no source-collected fees; otherwise the cap
+ * should be the caller-accepted total from a recent quote. The provider
+ * enforces the prepared bundle's fee-token precision before signing.
  *
  * @internal
  */ const crossChainMaxFeeSchema = zod.z.string({
@@ -34900,7 +35009,7 @@ const sourceAdapterContextSchema = zod.z.object({
     allowZero: true,
     regexMessage: AMOUNT_FORMAT_ERROR_MESSAGE,
     attributeName: 'maxFee',
-    maxDecimals: 6
+    maxDecimals: 18
 })(zod.z.string())).refine((value)=>CANONICAL_AMOUNT_REGEX.test(value), AMOUNT_FORMAT_ERROR_MESSAGE);
 /**
  * Build a schema for an optional non-negative decimal filter string.
@@ -35061,7 +35170,7 @@ const crossChainDepositDestinationSchema = zod.z.object({
     from: sourceAdapterContextSchema,
     to: crossChainDepositDestinationSchema,
     vaultAddress: vaultAddressSchema,
-    amount: crossChainAmountSchema,
+    amount: amountSchema$1,
     maxFee: crossChainMaxFeeSchema,
     transferSpeed: zod.z.enum([
         'FAST',
@@ -37801,7 +37910,7 @@ async function deposit$2(context, params) {
 }
 
 var name = "@circle-fin/unified-balance-kit";
-var version = "1.2.0";
+var version = "1.2.1";
 var pkg = {
 	name: name,
 	version: version};