@kasufinance/kasu-sdk 2.7.0 → 2.8.0

package/dist/bundle.esm.js

@@ -20835,12 +20835,12 @@ function toURLEncodedForm(data, options) {
   });
 }
 
-const MAX_DEPTH = DEFAULT_FORM_DATA_MAX_DEPTH;
+const MAX_DEPTH$1 = DEFAULT_FORM_DATA_MAX_DEPTH;
 
 function throwIfDepthExceeded(index) {
-  if (index > MAX_DEPTH) {
+  if (index > MAX_DEPTH$1) {
     throw new AxiosError$1(
-      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH,
+      'FormData field is too deeply nested (' + index + ' levels). Max depth: ' + MAX_DEPTH$1,
       AxiosError$1.ERR_FORM_DATA_DEPTH_EXCEEDED
     );
   }
@@ -24804,6 +24804,193 @@ function buildFullNameRequestMessage(address, timestampMs) {
     return `I request my full name for ${address.toLowerCase()} at ${timestampMs}.`;
 }
 
+// ---------------------------------------------------------------------------
+// The selector tables
+// ---------------------------------------------------------------------------
+/**
+ * OpenZeppelin v5's ERC-20 errors. They are not in either Kasu ABI because no
+ * Kasu contract declares them — they arrive from the TOKEN, through the
+ * manager's `transferFrom`, and they are the modern spelling of the string
+ * reverts below.
+ */
+const ERC20_ERROR_ABI = [
+    'error ERC20InsufficientBalance(address sender, uint256 balance, uint256 needed)',
+    'error ERC20InsufficientAllowance(address spender, uint256 allowance, uint256 needed)',
+];
+/**
+ * The protocol errors that mean the ERC-20 transfer failed rather than the
+ * protocol refusing.
+ *
+ * `SafeERC20FailedOperation` is OpenZeppelin's wrapper around a token call
+ * that returned false or reverted, which on this path IS the `transferFrom`;
+ * `AddressInsufficientBalance` is its native-value sibling. Both belong with
+ * the balance case, not with the pool conditions — a lender who sees one of
+ * them really does need to fund or re-approve.
+ */
+const ERC20_FAMILY_NAMES = new Set([
+    'AddressInsufficientBalance',
+    'ERC20InsufficientAllowance',
+    'ERC20InsufficientBalance',
+    'SafeERC20FailedOperation',
+]);
+/** Solidity's `Error(string)`, the selector every `require` reason arrives under. */
+const STRING_REVERT_SELECTOR = '0x08c379a0';
+/**
+ * The `require` reasons that are a balance or an allowance, across the token
+ * implementations in circulation: OpenZeppelin v4's sentences, and the
+ * shorthand the minimal implementations use.
+ */
+const ERC20_REASON_PATTERNS = [
+    /exceeds\s+balance/,
+    /exceeds\s+allowance/,
+    /insufficient\s+balance/,
+    /insufficient\s+allowance/,
+    /transfer_from_failed/,
+    /transferfrom\s+failed/,
+    /low-level\s+call\s+failed/,
+];
+/**
+ * selector → error name, built once on first use.
+ *
+ * Lazily, because a consumer that never sees a revert should not pay for three
+ * `Interface` constructions at import. The two Kasu tables are the GENERATED
+ * typechain ABIs, so this cannot drift from the contracts: regenerate the ABIs
+ * and the new errors are recognised with no edit here.
+ */
+let selectorTable = null;
+function selectors() {
+    if (selectorTable)
+        return selectorTable;
+    const table = new Map();
+    const interfaces = [
+        // The manager the deposit is called against, and the allow list it
+        // delegates the KYC and block-window checks to.
+        ILendingPoolManagerAbi__factory.createInterface(),
+        IKasuAllowListAbi__factory.createInterface(),
+        new ethers.utils.Interface(ERC20_ERROR_ABI),
+    ];
+    for (const iface of interfaces) {
+        for (const fragment of Object.values(iface.errors)) {
+            // First writer wins: the same name declared by both ABIs is the
+            // same selector, so the duplicate would be a no-op anyway.
+            const sighash = iface.getSighash(fragment);
+            if (!table.has(sighash))
+                table.set(sighash, fragment.name);
+        }
+    }
+    selectorTable = table;
+    return table;
+}
+// ---------------------------------------------------------------------------
+// Getting the bytes out of the envelope
+// ---------------------------------------------------------------------------
+/**
+ * How deep to look for the revert data. Providers nest it differently —
+ * ethers' own error wraps the provider's, which wraps the RPC body — and a
+ * bound is what keeps a self-referencing error object from being walked
+ * forever.
+ */
+const MAX_DEPTH = 6;
+/** The keys ethers and the providers under it put a wrapped error on. */
+const NESTED_KEYS = [
+    'data',
+    'error',
+    'originalError',
+    'info',
+    'cause',
+    'body',
+];
+/** At least a 4-byte selector, and a whole number of bytes. */
+function isRevertData(value) {
+    return (value.length >= 10 &&
+        value.length % 2 === 0 &&
+        /^0x[0-9a-fA-F]+$/.test(value));
+}
+/**
+ * Find the revert data on an error, wherever the provider left it.
+ *
+ * ethers v5 raises `UNPREDICTABLE_GAS_LIMIT` with the provider's own error
+ * attached, and each provider nests the bytes one layer differently:
+ * `error.data`, `error.error.data`, `error.data.originalError.data`, or only
+ * inside the JSON `body` of a `SERVER_ERROR`. Rather than enumerate the
+ * products, walk a fixed set of keys to a fixed depth and take the first value
+ * that is shaped like revert data.
+ */
+function extractRevertData(err) {
+    return walk(err, 0);
+}
+function walk(node, depth) {
+    if (node == null || depth > MAX_DEPTH)
+        return null;
+    if (typeof node === 'string') {
+        if (isRevertData(node))
+            return node;
+        // A `SERVER_ERROR`'s body: the RPC's JSON reply, verbatim.
+        if (!node.startsWith('{'))
+            return null;
+        try {
+            return walk(JSON.parse(node), depth + 1);
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    if (typeof node !== 'object')
+        return null;
+    const record = node;
+    for (const key of NESTED_KEYS) {
+        const found = walk(record[key], depth + 1);
+        if (found)
+            return found;
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Decoding
+// ---------------------------------------------------------------------------
+/**
+ * Decode a failed call's revert into the error the contract named, or `null`
+ * when there is nothing recognisable to name.
+ *
+ * `null` is the honest answer for an unknown selector, an unrelated `require`
+ * string, or an error with no revert data at all — the caller keeps whatever
+ * it did before rather than inventing a diagnosis from bytes it cannot read.
+ */
+function decodeRevert(err) {
+    const data = extractRevertData(err);
+    if (!data)
+        return null;
+    const selector = data.slice(0, 10).toLowerCase();
+    if (selector === STRING_REVERT_SELECTOR) {
+        const reason = decodeStringRevert(data);
+        if (reason === null)
+            return null;
+        return isErc20Reason(reason)
+            ? { name: 'Error', family: 'erc20', reason }
+            : null;
+    }
+    const name = selectors().get(selector);
+    if (!name)
+        return null;
+    return {
+        name,
+        family: ERC20_FAMILY_NAMES.has(name) ? 'erc20' : 'protocol',
+    };
+}
+function decodeStringRevert(data) {
+    try {
+        const [reason] = ethers.utils.defaultAbiCoder.decode(['string'], `0x${data.slice(10)}`);
+        return reason;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function isErc20Reason(reason) {
+    const lower = reason.toLowerCase();
+    return ERC20_REASON_PATTERNS.some((pattern) => pattern.test(lower));
+}
+
 /**
  * Wallet and RPC error predicates — pure functions over `unknown`.
  *
@@ -24959,19 +25146,94 @@ function classifyWalletFailure(step, err) {
         : { step, reason: 'failed', error: err };
 }
 
+/**
+ * What a `depositBatch` port throws when it KNOWS the batch reverted — from a
+ * simulation before sending, or from the submitter refusing to broadcast a
+ * batch that would revert. The run ends `{ step: 'request', reason:
+ * 'reverted', revertError }`.
+ *
+ * `revertError` is the custom error the contract named (`'ClearingIsPending'`,
+ * `'UserNotKycd'`, …), exactly as the ABI declares it. Pass `''` when the
+ * batch is known to revert but not why: the consumer then renders its generic
+ * `reverted` copy, which is what an unknown name gets anyway.
+ *
+ * Any OTHER throw from the port is read the way a direct deposit's is — a
+ * wallet rejection is `cancelled`, a decodable revert is `reverted`, and
+ * everything else is `failed` with the error kept. A port that cannot tell is
+ * better off throwing what it has than guessing a name.
+ */
+class BatchRevertedError extends Error {
+    constructor(revertError, message) {
+        super(message !== null && message !== void 0 ? message : `DepositFlow: the batch reverted${revertError ? ` with ${revertError}` : ''}`);
+        this.name = 'BatchRevertedError';
+        this.revertError = revertError;
+        // Keeps `instanceof` honest under a down-levelled build.
+        Object.setPrototypeOf(this, BatchRevertedError.prototype);
+    }
+}
 /** Generated agreements are valid for five minutes upstream. */
 const CONTRACT_TTL_MS = 5 * 60 * 1000;
 /** What a run without a spender, from either source, fails with. */
 const NO_SPENDER_MESSAGE = 'DepositFlow: no ERC-20 spender; build the flow with kasu.flows.deposit() or pass `spender` on the input';
+/** What a malformed auth signature fails the generate step with. */
+const INVALID_AUTH_SIGNATURE_MESSAGE = 'DepositFlow: the wallet returned a malformed authentication signature; expected 65 bytes of 0x-prefixed hex';
+/** What a malformed acceptance signature fails the confirm step with. */
+const INVALID_ACCEPTANCE_SIGNATURE_MESSAGE = 'DepositFlow: the wallet returned a malformed acceptance signature; expected 65 bytes of 0x-prefixed hex';
+/**
+ * Is this an EIP-191 personal sign, in the only shape the protocol accepts?
+ *
+ * 65 bytes — `r`, `s`, `v` — 0x-prefixed. Nothing downstream checks it: the
+ * ABI coder takes any even-length hex as `bytes`, so `'0x'` and a 64-byte
+ * string both encode happily into a `depositData` the agreements service then
+ * cannot verify against anything. The check has to happen where the signature
+ * is taken, which is here.
+ */
+function isPersonalSignature(signature) {
+    return utils$2.isHexString(signature, 65);
+}
 const INITIAL$1 = {
     phase: 'idle',
     step: null,
     stepIndex: 0,
     stepTotal: 4,
     approvalRequired: true,
+    batched: false,
     contract: null,
     failure: null,
 };
+const ERC20 = IERC20MetadataAbi__factory.createInterface();
+const LENDING_POOL_MANAGER = ILendingPoolManagerAbi__factory.createInterface();
+/**
+ * The batch path's two calls, encoded by the SDK so no consumer has to: the
+ * EXACT-amount approve, then the very `requestDepositWithKyc` the default
+ * `deposit` port sends — `swapData` `'0x'`, no value. Both read `amount` from
+ * the same variable, so the batch cannot approve one figure and deposit
+ * another.
+ */
+function encodeDepositBatch(args) {
+    const { stableAsset, spender, input, depositData, kyc } = args;
+    return [
+        {
+            to: stableAsset,
+            data: ERC20.encodeFunctionData('approve', [spender, input.amount]),
+        },
+        {
+            to: spender,
+            data: LENDING_POOL_MANAGER.encodeFunctionData('requestDepositWithKyc', [
+                input.poolId,
+                input.trancheId,
+                input.amount,
+                '0x',
+                input.fixedTermConfigId,
+                depositData,
+                {
+                    blockExpiration: kyc.blockExpiration,
+                    signature: kyc.signature,
+                },
+            ]),
+        },
+    ];
+}
 /** 1-based badge position, with `approve` dropped when it is out of scope. */
 function stepIndexOf(step, approvalRequired) {
     const order = approvalRequired
@@ -24987,17 +25249,52 @@ function badgeFor(step, approvalRequired) {
     };
 }
 /**
- * The request step has a third outcome. `UNPREDICTABLE_GAS_LIMIT` here is
- * almost always `transferFrom` reverting on a balance that cannot cover the
- * deposit, and it takes precedence: nothing was refused by the lender, so
- * inviting a retry would just reproduce it.
+ * The request step's extra outcomes, in the order the evidence supports.
+ *
+ * A revert is read for WHAT reverted before it is read as a shortfall.
+ * `requestDepositWithKyc` reverts for a whole family of declared reasons —
+ * `LendingPoolIsStopped`, `ClearingIsPending`, `UserNotKycd`, `UserBlocked`,
+ * `UserNotInAllowList`, `InvalidTranche`, `BlockExpired` — and every one of
+ * them used to arrive as `insufficient-balance`, which told a fully funded
+ * lender to top up a wallet that was never short while their pool was simply
+ * mid-clearing. So: a decoded protocol error is `reverted` and names itself.
+ *
+ * Only a token balance or allowance failure — or revert data nothing can
+ * decode, on the `UNPREDICTABLE_GAS_LIMIT` ethers raises for a failed gas
+ * estimate — is still `insufficient-balance`, which is the case that reason
+ * was named for and the one where topping up is genuinely the answer.
  */
 function classifyRequest(err) {
-    if (isUnpredictableGas(err)) {
+    const revert = decodeRevert(err);
+    if ((revert === null || revert === void 0 ? void 0 : revert.family) === 'protocol') {
+        return {
+            step: 'request',
+            reason: 'reverted',
+            revertError: revert.name,
+            error: err,
+        };
+    }
+    if (revert !== null || isUnpredictableGas(err)) {
         return { step: 'request', reason: 'insufficient-balance', error: err };
     }
     return classifyWalletFailure('request', err);
 }
+/**
+ * A `depositBatch` rejection. A submitter that KNOWS the batch reverts says so
+ * with `BatchRevertedError`; anything else is read exactly as a direct
+ * deposit's throw is, so a non-wallet error can never become `cancelled`.
+ */
+function classifyBatch(err) {
+    if (err instanceof BatchRevertedError) {
+        return {
+            step: 'request',
+            reason: 'reverted',
+            revertError: err.revertError,
+            error: err,
+        };
+    }
+    return classifyRequest(err);
+}
 // ---------------------------------------------------------------------------
 // The flow
 // ---------------------------------------------------------------------------
@@ -25024,8 +25321,15 @@ class DepositFlow extends Flow {
          * A stale token simply is not the current generation.
          */
         this._acceptingFor = null;
+        /**
+         * The batch path's authorisation handshake. Same shape and lifetime as
+         * `_accept`: the run parks on it, `authoriseTransfer`, `declineTransfer`
+         * and `reset` settle it, and it is cleared the moment it settles.
+         */
+        this._authorise = null;
         this._ttlMs = (_a = opts === null || opts === void 0 ? void 0 : opts.contractTtlMs) !== null && _a !== void 0 ? _a : CONTRACT_TTL_MS;
         this._defaultSpender = opts === null || opts === void 0 ? void 0 : opts.spender;
+        this._stableAsset = opts === null || opts === void 0 ? void 0 : opts.stableAsset;
         // Called through the ports object, never captured off it: a consumer
         // whose clock is a method on its own object keeps its `this`.
         this._now = () => { var _a, _b; return (_b = (_a = _ports.now) === null || _a === void 0 ? void 0 : _a.call(_ports)) !== null && _b !== void 0 ? _b : Date.now(); };
@@ -25045,6 +25349,18 @@ class DepositFlow extends Flow {
             this._store.patch(Object.assign({ phase: 'accepting-sign' }, badgeFor('confirm', this._store.state.approvalRequired)), token);
             try {
                 const signature = yield this._ports.signMessage(contract.contractMessage);
+                // Checked HERE, not at the encoder: this is the signature the
+                // agreements service verifies the deposit against, and a wallet
+                // that returned something other than 65 bytes has not signed
+                // anything. Failing the confirm step names the step that produced
+                // it; letting it through would put an unverifiable blob on chain.
+                if (!isPersonalSignature(signature)) {
+                    bridge.settle({
+                        kind: 'failed',
+                        error: new Error(INVALID_ACCEPTANCE_SIGNATURE_MESSAGE),
+                    });
+                    return;
+                }
                 bridge.settle({ kind: 'accepted', signature });
             }
             catch (err) {
@@ -25075,6 +25391,33 @@ class DepositFlow extends Flow {
         this._accept = null;
         bridge.settle({ kind: 'declined' });
     }
+    /**
+     * Batch path: authorise the single transaction that approves and deposits,
+     * and resume the parked run. A no-op when nothing is parked on
+     * `awaiting-authorise`, so a double tap cannot submit twice.
+     *
+     * The batch has no wallet prompt per call, so this is the lender's
+     * explicit consent to the transfer — call it only from their action.
+     */
+    authoriseTransfer() {
+        const bridge = this._authorise;
+        if (!bridge)
+            return;
+        this._authorise = null;
+        bridge.settle({ kind: 'authorised' });
+    }
+    /**
+     * Batch path: refuse the transfer. The run ends on `error` with `{ step:
+     * 'request', reason: 'cancelled' }` and nothing is submitted. A no-op when
+     * nothing is parked on `awaiting-authorise`.
+     */
+    declineTransfer() {
+        const bridge = this._authorise;
+        if (!bridge)
+            return;
+        this._authorise = null;
+        bridge.settle({ kind: 'declined' });
+    }
     /** True only while THIS generation is waiting on the acceptance signature. */
     _isAccepting() {
         return (this._acceptingFor !== null &&
@@ -25086,6 +25429,9 @@ class DepositFlow extends Flow {
         this._accept = null;
         this._acceptingFor = null;
         bridge === null || bridge === void 0 ? void 0 : bridge.settle({ kind: 'abandoned' });
+        const authorise = this._authorise;
+        this._authorise = null;
+        authorise === null || authorise === void 0 ? void 0 : authorise.settle({ kind: 'abandoned' });
     }
     // -----------------------------------------------------------------------
     _run(input, token) {
@@ -25093,6 +25439,7 @@ class DepositFlow extends Flow {
             var _a;
             this._accept = null;
             this._acceptingFor = null;
+            this._authorise = null;
             const ports = this._ports;
             const owner = input.userAddress.toLowerCase();
             // 0. The spender, from the input or from the chain config the facade
@@ -25113,21 +25460,32 @@ class DepositFlow extends Flow {
             //    live, never cached: an exact-amount approval is fully consumed by
             //    the deposit it paid for, so a stale allowance is exactly the value
             //    that would wrongly skip the approve and revert the deposit.
-            let approvalRequired = true;
+            let allowanceShort = true;
             try {
                 const allowance = yield ports.readAllowance(owner, spender);
-                approvalRequired = allowance.lt(input.amount);
+                allowanceShort = allowance.lt(input.amount);
             }
             catch (_b) {
                 // A read failure is not a reason to skip an approval. Assume one is
                 // needed: the cost is a redundant approve, the alternative is a
                 // reverted deposit.
-                approvalRequired = true;
+                allowanceShort = true;
             }
             if (!this._store.isCurrent(token))
                 return;
+            // The path is chosen HERE, with the allowance, so the badge is right
+            // from the first state the lender sees. Batch only when there is an
+            // approval to fold in, a port to submit it, and a known token to
+            // approve on — never a guessed one. A batched run never enters the
+            // `approve` step, so every badge counts it as a three-step run.
+            const stableAsset = this._stableAsset;
+            const batched = allowanceShort &&
+                typeof ports.depositBatch === 'function' &&
+                !!stableAsset;
+            const approvalRequired = allowanceShort && !batched;
             // 2. Generate — sign the auth message.
-            this._store.patch(Object.assign({ approvalRequired, phase: 'generating-sign' }, badgeFor('generate', approvalRequired)), token);
+            this._store.patch(Object.assign({ approvalRequired,
+                batched, phase: 'generating-sign' }, badgeFor('generate', approvalRequired)), token);
             const timestamp = this._now();
             const signedMessage = buildAuthMessage(input, owner, timestamp);
             let signature;
@@ -25138,6 +25496,18 @@ class DepositFlow extends Flow {
                 this._fail(token, approvalRequired, classifyWalletFailure('generate', err));
                 return;
             }
+            // The same EIP-191 shape as the acceptance, and the same reason to
+            // check it: kasu-backend verifies this one to decide whether to issue
+            // an agreement at all, so a malformed signature is a 4xx that says
+            // nothing about which step produced it. Named here instead.
+            if (!isPersonalSignature(signature)) {
+                this._fail(token, approvalRequired, {
+                    step: 'generate',
+                    reason: 'failed',
+                    error: new Error(INVALID_AUTH_SIGNATURE_MESSAGE),
+                });
+                return;
+            }
             if (!this._store.isCurrent(token))
                 return;
             // 3. Generate — POST the request.
@@ -25194,12 +25564,41 @@ class DepositFlow extends Flow {
                 });
                 return;
             }
-            const depositData = encodeDepositData({
-                signature: outcome.signature,
-                timestamp: contract.timestamp,
-                contractVersion: contract.contractVersion,
-                contractType: asContractType(contract.contractType),
-            });
+            // The acceptance signature is already known to be 65 bytes, but the
+            // encoder also reads `timestamp`, `contractVersion` and
+            // `contractType` off a response the SDK did not produce. `start()`
+            // promises it does not reject, so anything that throws in here becomes
+            // a failure the consumer can render rather than an unhandled rejection
+            // in an application that was told it never had to catch one.
+            let depositData;
+            try {
+                depositData = encodeDepositData({
+                    signature: outcome.signature,
+                    timestamp: contract.timestamp,
+                    contractVersion: contract.contractVersion,
+                    contractType: asContractType(contract.contractType),
+                });
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            if (batched && stableAsset) {
+                yield this._runBatch({
+                    token,
+                    input,
+                    owner,
+                    spender,
+                    stableAsset,
+                    depositData,
+                    contract,
+                });
+                return;
+            }
             // 6. Approve — the EXACT amount, never `MaxUint256`. House rule: an
             //    unlimited allowance outlives the deposit it was granted for, and a
             //    later exploit of the spender would drain a wallet that has long
@@ -25263,6 +25662,108 @@ class DepositFlow extends Flow {
             this._store.patch(Object.assign({ phase: 'success' }, badgeFor('request', approvalRequired)), token);
         });
     }
+    /**
+     * The batch path, from the accepted agreement to the receipt.
+     *
+     * 1. PARK on `awaiting-authorise`. A batch puts no wallet prompt in front
+     *    of each call, so the flow waits for an explicit authorisation before
+     *    any money moves. `declineTransfer()` ends it as `cancelled`.
+     * 2. Re-check the TTL: the lender may have idled on the authorisation as
+     *    long as they did on the agreement.
+     * 3. Only now fetch the KYC signature — it has a block expiration of its
+     *    own, and an authorisation left open must not spend it.
+     * 4. Encode both calls and hand them to `depositBatch`; then the receipt.
+     */
+    _runBatch(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { token, input, owner, spender, stableAsset, depositData } = args;
+            const ports = this._ports;
+            // A batched run is a three-step run on every badge.
+            const approvalRequired = false;
+            // Every settler clears the handshake before settling it, so there is
+            // nothing to clear here — and clearing it anyway could drop the
+            // handshake of a NEWER run that `reset(); start()` already parked.
+            const outcome = yield new Promise((resolve) => {
+                this._authorise = { settle: resolve };
+                this._store.patch(Object.assign({ phase: 'awaiting-authorise' }, badgeFor('request', approvalRequired)), token);
+            });
+            if (!this._store.isCurrent(token))
+                return;
+            if (outcome.kind === 'declined') {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'cancelled',
+                });
+                return;
+            }
+            if (outcome.kind !== 'authorised')
+                return;
+            if (this._now() > args.contract.timestamp + this._ttlMs) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'contract-expired',
+                });
+                return;
+            }
+            this._store.patch(Object.assign({ phase: 'request-sign' }, badgeFor('request', approvalRequired)), token);
+            // The consumer's backend, so `failed` — never `cancelled` — exactly as
+            // on the two-transaction path.
+            let kyc;
+            try {
+                const kycParams = yield ports.buildKycParams(owner);
+                kyc = yield ports.getKycSignature(kycParams);
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            // Encoded from values a backend returned (the KYC signature), so a
+            // shape the coder refuses is a failure the consumer can render, not a
+            // rejection out of a `start()` that promises it has none.
+            let calls;
+            try {
+                calls = encodeDepositBatch({
+                    stableAsset,
+                    spender,
+                    input,
+                    depositData,
+                    kyc,
+                });
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            try {
+                // Called through the ports object, so a port that is a method
+                // keeps its `this`. Its presence decided the path; a consumer
+                // that removed it since gets a `failed`, not a crash.
+                if (typeof ports.depositBatch !== 'function') {
+                    throw new Error('DepositFlow: the depositBatch port is gone');
+                }
+                const tx = yield ports.depositBatch(calls);
+                this._store.patch(Object.assign({ phase: 'request-confirm' }, badgeFor('request', approvalRequired)), token);
+                yield tx.wait();
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, classifyBatch(err));
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            this._store.patch(Object.assign({ phase: 'success' }, badgeFor('request', approvalRequired)), token);
+        });
+    }
     _fail(token, approvalRequired, failure) {
         this._store.patch(Object.assign({ phase: 'error', failure }, badgeFor(failure.step, approvalRequired)), token);
     }
@@ -25415,11 +25916,18 @@ class FlowsFacade {
      * an address whose only wrong value grants an approval to the wrong
      * contract.
      */
-    _spender) {
+    _spender, 
+    /**
+     * This chain's stable token address — the target of the batch path's
+     * approve. `undefined` for a hand-built config without `stableAsset`,
+     * in which case a run never batches: it does not guess a token.
+     */
+    _stableAsset) {
         this._deposits = _deposits;
         this._erc20 = _erc20;
         this._isReadOnly = _isReadOnly;
         this._spender = _spender;
+        this._stableAsset = _stableAsset;
     }
     /**
      * A deposit pipeline. `readAllowance`, `approve`, `deposit` and
@@ -25432,9 +25940,13 @@ class FlowsFacade {
      * delete the default it was meant to keep, and
      * `approve: sponsoredGas ? sponsoredApprove : undefined` is exactly how a
      * consumer writes a conditional override.
+     *
+     * `depositBatch` has NO default: how several calls become one atomic
+     * transaction is the application's business. Supplying it lets a run
+     * whose allowance is short approve and deposit in one batch.
      */
     deposit(ports, opts) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         return new DepositFlow({
             signMessage: ports.signMessage,
             generateContract: ports.generateContract,
@@ -25449,12 +25961,14 @@ class FlowsFacade {
                 return yield this._erc20().approve(spender, amount);
             })),
             deposit: (_d = ports.deposit) !== null && _d !== void 0 ? _d : ((params) => this._deposits.deposit(params)),
+            depositBatch: ports.depositBatch,
             now: ports.now,
         }, {
             contractTtlMs: opts === null || opts === void 0 ? void 0 : opts.contractTtlMs,
             // Per key here too, for the same reason the ports are: an
             // explicit `spender: undefined` must not delete the default.
             spender: (_e = opts === null || opts === void 0 ? void 0 : opts.spender) !== null && _e !== void 0 ? _e : this._spender,
+            stableAsset: (_f = opts === null || opts === void 0 ? void 0 : opts.stableAsset) !== null && _f !== void 0 ? _f : this._stableAsset,
         });
     }
     /**
@@ -26215,6 +26729,7 @@ class PortfolioFacade {
  */
 class Kasu {
     constructor(sdk, chainConfig, signerOrProvider, configOverrides) {
+        var _a;
         this._sdk = sdk;
         this._chainConfig = chainConfig;
         this._signerOrProvider = signerOrProvider;
@@ -26226,7 +26741,7 @@ class Kasu {
         const isReadOnly = !Signer.isSigner(signerOrProvider);
         this.deposits = new DepositsFacade(sdk.UserLending, chainConfig.chainId.toString(), isReadOnly);
         this.portfolio = new PortfolioFacade(sdk.DataService, sdk.UserLending, sdk.Portfolio);
-        this.flows = new FlowsFacade(this.deposits, () => erc20Of(chainConfig, signerOrProvider), isReadOnly, chainConfig.contracts.LendingPoolManager);
+        this.flows = new FlowsFacade(this.deposits, () => erc20Of(chainConfig, signerOrProvider), isReadOnly, chainConfig.contracts.LendingPoolManager, (_a = stableAssetOf(chainConfig)) === null || _a === void 0 ? void 0 : _a.address);
     }
     /**
      * Create a Kasu instance with built-in chain config.
@@ -26887,4 +27402,4 @@ function getTrancheDisplayName(trancheName, pool) {
         : trancheName;
 }
 
-export { APXIUM, AU_ALPHA3, AU_MIN_CUMULATIVE_BY_STABLE, CHAIN_CONFIGS, CLEARING_WINDOW_SECONDS, CONTRACT_TTL_MS, DepositFlow, DepositsFacade, EPOCHS_IN_YEAR, Flow, FlowStore, FlowsFacade, INVOICEMATE, Kasu, KasuSdk, MAX_LENDING_AMOUNT_FALLBACK, MIN_LENDING_AMOUNT_FALLBACK, MIN_TRANCHE_CAPACITY, NO_DIRECTUS_URL_MESSAGE, NO_KYC_PARAMS_MESSAGE, NO_SPENDER_MESSAGE, PortfolioFacade, READ_ONLY_MESSAGE, RIXON_CAPITAL, SdkConfig, StrategiesFacade, UPPER_MEZZANINE, WithdrawFlow, apyToEpochRate, asContractType, auMinimumRemaining, auThresholdFor, buildContractVersionType, buildFullNameRequestMessage, buildLegacyContractRequestMessage, buildLoanAgreementSignMessage, ceilToCents, classifyWalletFailure, compareTrancheSeniority, computeSettlementWindow, countSubmissions, deriveCycleDates, derivePoolStatus, deriveRequestState, encodeDepositData, epochRateToApy, fetchUnusedPoolIds, firstSubmissionTimestamp, floorToCents, formatSignTimestampUtc, getCreditOriginator, getInstitutionalLender, getTrancheDisplayName, isAuMinimumExempt, isAustralianKyc, isBelowMinimumCapacity, isCycleClosed, isUnpredictableGas, isUserRejected, lastEventTimestamp, maxNetRateCeiling, netEffectiveApy, netTrancheApyBounds, nextCycleBoundary, parseFormattedMessage, parseMinorUnits, parseTrancheBound, pickDefaultTrancheId, pickHighestYieldTranche, poolAllTranchesFull, poolMaxApy, resolveBoundShortcuts, resolveDepositBounds, selectVisiblePools, submissionEvents, trancheApyBounds, trancheHasCapacity, trancheRiskRank };
+export { APXIUM, AU_ALPHA3, AU_MIN_CUMULATIVE_BY_STABLE, BatchRevertedError, CHAIN_CONFIGS, CLEARING_WINDOW_SECONDS, CONTRACT_TTL_MS, DepositFlow, DepositsFacade, EPOCHS_IN_YEAR, Flow, FlowStore, FlowsFacade, INVALID_ACCEPTANCE_SIGNATURE_MESSAGE, INVALID_AUTH_SIGNATURE_MESSAGE, INVOICEMATE, Kasu, KasuSdk, MAX_LENDING_AMOUNT_FALLBACK, MIN_LENDING_AMOUNT_FALLBACK, MIN_TRANCHE_CAPACITY, NO_DIRECTUS_URL_MESSAGE, NO_KYC_PARAMS_MESSAGE, NO_SPENDER_MESSAGE, PortfolioFacade, READ_ONLY_MESSAGE, RIXON_CAPITAL, SdkConfig, StrategiesFacade, UPPER_MEZZANINE, WithdrawFlow, apyToEpochRate, asContractType, auMinimumRemaining, auThresholdFor, buildContractVersionType, buildFullNameRequestMessage, buildLegacyContractRequestMessage, buildLoanAgreementSignMessage, ceilToCents, classifyWalletFailure, compareTrancheSeniority, computeSettlementWindow, countSubmissions, decodeRevert, deriveCycleDates, derivePoolStatus, deriveRequestState, encodeDepositData, epochRateToApy, extractRevertData, fetchUnusedPoolIds, firstSubmissionTimestamp, floorToCents, formatSignTimestampUtc, getCreditOriginator, getInstitutionalLender, getTrancheDisplayName, isAuMinimumExempt, isAustralianKyc, isBelowMinimumCapacity, isCycleClosed, isUnpredictableGas, isUserRejected, lastEventTimestamp, maxNetRateCeiling, netEffectiveApy, netTrancheApyBounds, nextCycleBoundary, parseFormattedMessage, parseMinorUnits, parseTrancheBound, pickDefaultTrancheId, pickHighestYieldTranche, poolAllTranchesFull, poolMaxApy, resolveBoundShortcuts, resolveDepositBounds, selectVisiblePools, submissionEvents, trancheApyBounds, trancheHasCapacity, trancheRiskRank };