@kasufinance/kasu-sdk 2.7.1 → 2.10.0

package/dist/bundle.esm.js

@@ -1,5 +1,5 @@
 import { formatUnits, parseUnits, formatEther, defaultAbiCoder, parseEther } from 'ethers/lib/utils';
-import { utils as utils$2, Contract, BigNumber, ethers, Signer, providers } from 'ethers';
+import { utils as utils$2, Contract, BigNumber, ethers, constants, Signer, providers } from 'ethers';
 
 const defaultJsonSerializer = JSON;
 
@@ -2031,7 +2031,7 @@ function isSource(source) {
  * Given a GraphQL source, parses it into a Document.
  * Throws GraphQLError if a syntax error is encountered.
  */
-function parse(source, options) {
+function parse$1(source, options) {
   const parser = new Parser(source, options);
   const document = parser.parseDocument();
   Object.defineProperty(document, 'tokenCount', {
@@ -4294,7 +4294,7 @@ const resolveRequestDocument = (document) => {
     if (typeof document === `string`) {
         let operationName = undefined;
         try {
-            const parsedDocument = parse(document);
+            const parsedDocument = parse$1(document);
             operationName = extractOperationName(parsedDocument);
         }
         catch (err) {
@@ -15809,6 +15809,7 @@ const getPoolOverviewQuery = (ids) => gql `
                         fixedTermDepositStatus
                         fixedTermDepositAllowlist{
                             id
+                            isAllowlisted
                             user{
                                 id
                             }
@@ -17238,10 +17239,32 @@ class UserLending {
             return yield this._lendingPoolManagerAbi.requestWithdrawal(lendingPool, tranche, amount);
         });
     }
-    requestWithdrawalInAsset(lendingPool, tranche, assetAmount) {
+    /**
+     * The tranche shares a withdrawal of `assetAmount` requests — the
+     * tranche's own `convertToShares`, read now. `requestWithdrawalInAsset`
+     * and the sponsored `kasu.calls.requestWithdrawal` both use this, so the
+     * two paths cannot convert differently.
+     */
+    getWithdrawalSharesForAssets(tranche, assetAmount) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const trancheContract = ILendingPoolTrancheAbi__factory.connect(tranche, this._signerOrProvider);
+            return yield trancheContract.convertToShares(assetAmount);
+        });
+    }
+    /**
+     * Every tranche share `user` holds — what a max withdrawal requests
+     * (`balanceOf(user)` on the tranche, read now). Shared by
+     * `requestWithdrawalMax` and the sponsored `kasu.calls.requestWithdrawal`.
+     */
+    getWithdrawalSharesMax(tranche, user) {
         return __awaiter(this, void 0, void 0, function* () {
             const trancheContract = ILendingPoolTrancheAbi__factory.connect(tranche, this._signerOrProvider);
-            const shareAmount = yield trancheContract.convertToShares(assetAmount);
+            return yield trancheContract['balanceOf(address)'](user);
+        });
+    }
+    requestWithdrawalInAsset(lendingPool, tranche, assetAmount) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const shareAmount = yield this.getWithdrawalSharesForAssets(tranche, assetAmount);
             return yield this._lendingPoolManagerAbi.requestWithdrawal(lendingPool, tranche, shareAmount);
         });
     }
@@ -17253,8 +17276,7 @@ class UserLending {
     }
     requestWithdrawalMax(lendingPool, tranche, user) {
         return __awaiter(this, void 0, void 0, function* () {
-            const trancheContract = ILendingPoolTrancheAbi__factory.connect(tranche, this._signerOrProvider);
-            const userShares = yield trancheContract['balanceOf(address)'](user);
+            const userShares = yield this.getWithdrawalSharesMax(tranche, user);
             return yield this._lendingPoolManagerAbi.requestWithdrawal(lendingPool, tranche, userShares);
         });
     }
@@ -20460,7 +20482,7 @@ function toFormData$1(obj, formData, options) {
  *
  * @returns {string} The encoded string.
  */
-function encode$1(str) {
+function encode$2(str) {
   const charMap = {
     '!': '%21',
     "'": '%27',
@@ -20496,8 +20518,8 @@ prototype.append = function append(name, value) {
 
 prototype.toString = function toString(encoder) {
   const _encode = encoder
-    ? (value) => encoder.call(this, value, encode$1)
-    : encode$1;
+    ? (value) => encoder.call(this, value, encode$2)
+    : encode$2;
 
   return this._pairs
     .map(function each(pair) {
@@ -20514,7 +20536,7 @@ prototype.toString = function toString(encoder) {
  *
  * @returns {string} The encoded value.
  */
-function encode(val) {
+function encode$1(val) {
   return encodeURIComponent(val)
     .replace(/%3A/gi, ':')
     .replace(/%24/g, '$')
@@ -20546,7 +20568,7 @@ function buildURL(url, params, options) {
   // Read serializer options pollution-safely: own properties and methods on a
   // class/template prototype are honored, but values injected onto a polluted
   // Object.prototype are ignored.
-  const _encode = utils$1.getSafeProp(_options, 'encode') || encode;
+  const _encode = utils$1.getSafeProp(_options, 'encode') || encode$1;
   const serializeFn = utils$1.getSafeProp(_options, 'serialize');
 
   let serializedParams;
@@ -21186,7 +21208,7 @@ let CanceledError$1 = class CanceledError extends AxiosError$1 {
  *
  * @returns {object} The response.
  */
-function settle(resolve, reject, response) {
+function settle$1(resolve, reject, response) {
   const validateStatus = response.config.validateStatus;
   if (!response.status || !validateStatus || validateStatus(response.status)) {
     resolve(response);
@@ -21949,7 +21971,7 @@ var xhrAdapter = isXHRAdapterSupported &&
           request,
         };
 
-        settle(
+        settle$1(
           function _resolve(value) {
             resolve(value);
             done();
@@ -23007,7 +23029,7 @@ const factory = (env) => {
       !isStreamResponse && unsubscribe && unsubscribe();
 
       return await new Promise((resolve, reject) => {
-        settle(resolve, reject, {
+        settle$1(resolve, reject, {
           data: responseData,
           headers: AxiosHeaders$1.from(response.headers),
           status: response.status,
@@ -24183,6 +24205,238 @@ class SdkConfig {
     }
 }
 
+/**
+ * The single-call `LendingPoolManager` requests a sponsored relay may carry,
+ * encoded by the SDK so no application hand-builds calldata or hand-maps the
+ * relay's `kind` for them.
+ *
+ * Every function here is PURE: addresses and ids in, `{ kind, call }` out.
+ * Reading the chain (the shares a withdrawal is for) is the facade's job —
+ * `kasu.calls` — and sending is the application's.
+ *
+ * Each call is `{ to, data }` and nothing else: no `value` (none of these
+ * functions is payable), no `from` (the manager acts for `msg.sender`, the
+ * lender's own account, which is why none of them takes a user argument).
+ * `data` is ethers' ABI encoding, which is canonical by construction — the
+ * relay re-encodes what it decodes and refuses anything that differs, so a
+ * hand-tweaked blob never gets through, and an SDK-built one always matches.
+ */
+/**
+ * The relay's name for each shape. Carried beside the call so the app posts
+ * `kind` from the SDK, never from a table of its own — a request declaring the
+ * wrong kind is refused (`invalid_calls`), so a hand-mapped table that drifts
+ * turns into a lender who cannot withdraw.
+ */
+const SPONSORED_CALL_KINDS = [
+    /** `LendingPoolManager.requestWithdrawal(pool, tranche, shares)`. */
+    'withdrawal',
+    /** `LendingPoolManager.cancelDepositRequest(pool, dNftID)`. */
+    'cancel_deposit',
+    /** `LendingPoolManager.cancelWithdrawalRequest(pool, wNftID)`. */
+    'cancel_withdrawal',
+    /** `LendingPoolManager.requestFixedTermDepositWithdrawal(pool, lockId)`. */
+    'withdraw_at_expiry',
+];
+/**
+ * Widened to the plain `Interface`: the typechain one overloads
+ * `encodeFunctionData` per literal name, and the name here comes from
+ * `FUNCTION_OF`.
+ */
+const LENDING_POOL_MANAGER$2 = ILendingPoolManagerAbi__factory.createInterface();
+/** The `LendingPoolManager` function behind each kind. */
+const FUNCTION_OF = Object.freeze({
+    withdrawal: 'requestWithdrawal',
+    cancel_deposit: 'cancelDepositRequest',
+    cancel_withdrawal: 'cancelWithdrawalRequest',
+    withdraw_at_expiry: 'requestFixedTermDepositWithdrawal',
+});
+/**
+ * The 4-byte selector of each kind's function, DERIVED from the generated
+ * `ILendingPoolManager` ABI — never typed in by hand, so an ABI change moves
+ * it and the cross-check spec against the relay's own pins goes red.
+ */
+const SPONSORED_CALL_SELECTORS = Object.freeze({
+    withdrawal: LENDING_POOL_MANAGER$2.getSighash(FUNCTION_OF.withdrawal),
+    cancel_deposit: LENDING_POOL_MANAGER$2.getSighash(FUNCTION_OF.cancel_deposit),
+    cancel_withdrawal: LENDING_POOL_MANAGER$2.getSighash(FUNCTION_OF.cancel_withdrawal),
+    withdraw_at_expiry: LENDING_POOL_MANAGER$2.getSighash(FUNCTION_OF.withdraw_at_expiry),
+});
+/**
+ * What an encoder throws for an input it will not encode. `code` names the
+ * argument; the message names no party, so a wallet-rejection classifier can
+ * never read it as something the lender did. Nothing has been sent when this
+ * is thrown.
+ */
+class SponsoredCallInputError extends Error {
+    constructor(code) {
+        super(`Sponsored call input refused (${code})`);
+        this.name = 'SponsoredCallInputError';
+        this.code = code;
+        Object.setPrototypeOf(this, SponsoredCallInputError.prototype);
+    }
+}
+const ADDRESS_RE$2 = /^0x[0-9a-fA-F]{40}$/;
+function assertAddress(value, code) {
+    if (typeof value !== 'string' || !ADDRESS_RE$2.test(value)) {
+        throw new SponsoredCallInputError(code);
+    }
+}
+/** A uint256 — an NFT or lock id. Zero is a valid id as far as encoding goes. */
+function toUint256(value, code) {
+    let parsed;
+    try {
+        parsed = BigNumber.from(value);
+    }
+    catch (_a) {
+        throw new SponsoredCallInputError(code);
+    }
+    if (parsed.isNegative() || parsed.gt(constants.MaxUint256)) {
+        throw new SponsoredCallInputError(code);
+    }
+    return parsed;
+}
+function encode(kind, lendingPoolManager, args) {
+    return {
+        kind,
+        call: {
+            to: lendingPoolManager,
+            data: LENDING_POOL_MANAGER$2.encodeFunctionData(FUNCTION_OF[kind], args),
+        },
+    };
+}
+/**
+ * `requestWithdrawal(poolId, trancheId, shares)` — `withdrawal`.
+ *
+ * `shares` are tranche SHARES, not assets: `kasu.calls.requestWithdrawal`
+ * converts an asset amount (or `'max'`) into them exactly as
+ * `UserLending.requestWithdrawalInAsset` / `requestWithdrawalMax` do. Zero
+ * shares is refused here: the contract reverts on it
+ * (`RequestWithdrawSharesAreZero`) and the relay refuses it before that.
+ */
+function encodeRequestWithdrawalCall(lendingPoolManager, poolId, trancheId, shares) {
+    assertAddress(lendingPoolManager, 'lending-pool-manager');
+    assertAddress(poolId, 'pool');
+    assertAddress(trancheId, 'tranche');
+    const amount = toUint256(shares, 'shares');
+    if (amount.isZero())
+        throw new SponsoredCallInputError('zero-shares');
+    return encode('withdrawal', lendingPoolManager, [
+        poolId,
+        trancheId,
+        amount,
+    ]);
+}
+/** `cancelDepositRequest(poolId, dNftId)` — `cancel_deposit`. */
+function encodeCancelDepositCall(lendingPoolManager, poolId, dNftId) {
+    assertAddress(lendingPoolManager, 'lending-pool-manager');
+    assertAddress(poolId, 'pool');
+    return encode('cancel_deposit', lendingPoolManager, [
+        poolId,
+        toUint256(dNftId, 'nft-id'),
+    ]);
+}
+/** `cancelWithdrawalRequest(poolId, wNftId)` — `cancel_withdrawal`. */
+function encodeCancelWithdrawalCall(lendingPoolManager, poolId, wNftId) {
+    assertAddress(lendingPoolManager, 'lending-pool-manager');
+    assertAddress(poolId, 'pool');
+    return encode('cancel_withdrawal', lendingPoolManager, [
+        poolId,
+        toUint256(wNftId, 'nft-id'),
+    ]);
+}
+/**
+ * `requestFixedTermDepositWithdrawal(poolId, fixedTermDepositId)` —
+ * `withdraw_at_expiry`. The contract function takes the pool and the LOCK id
+ * only (no tranche): the manager forwards to the fixed-term contract on the
+ * lender's behalf, which knows the lock's tranche.
+ */
+function encodeWithdrawAtExpiryCall(lendingPoolManager, poolId, fixedTermDepositId) {
+    assertAddress(lendingPoolManager, 'lending-pool-manager');
+    assertAddress(poolId, 'pool');
+    return encode('withdraw_at_expiry', lendingPoolManager, [
+        poolId,
+        toUint256(fixedTermDepositId, 'lock-id'),
+    ]);
+}
+
+const ADDRESS_RE$1 = /^0x[0-9a-fA-F]{40}$/;
+/**
+ * Encoded, ready-to-sponsor `LendingPoolManager` calls — read, then encode,
+ * NEVER send. Each returns `{ kind, call }`: post `kind` and `[call]` to a
+ * sponsored relay (or `submitSponsoredCall`), unchanged.
+ *
+ * ```ts
+ * const { kind, call } = kasu.calls.cancelDepositRequest(poolId, dNftId);
+ * ```
+ *
+ * `call.to` is always THIS chain's `LendingPoolManager`, from the chain
+ * config — the same address the deposit flow approves and calls — so no app
+ * supplies the one argument whose wrong value the relay refuses outright.
+ *
+ * Works on a read-only instance: the only chain access is the share read a
+ * withdrawal needs, and nothing is signed or sent here.
+ */
+class CallsFacade {
+    constructor(_userLending, _lendingPoolManager) {
+        this._userLending = _userLending;
+        this._lendingPoolManager = _lendingPoolManager;
+    }
+    /**
+     * `requestWithdrawal(pool, tranche, shares)` for an asset amount or
+     * `'max'`, converted into shares exactly as the direct path does it
+     * (`UserLending.requestWithdrawalInAsset` / `requestWithdrawalMax`): the
+     * tranche's `convertToShares(amount)`, or the lender's whole
+     * `balanceOf(userAddress)`, read now.
+     *
+     * Rejects with `SponsoredCallInputError` — before anything is sent — for
+     * a non-positive amount, a malformed address, or a conversion that comes
+     * to ZERO shares (an empty position, or dust below one share), which the
+     * contract would revert and the relay refuses.
+     */
+    requestWithdrawal(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { poolId, trancheId, amount, userAddress } = params;
+            if (typeof userAddress !== 'string' || !ADDRESS_RE$1.test(userAddress)) {
+                throw new SponsoredCallInputError('user');
+            }
+            if (typeof poolId !== 'string' || !ADDRESS_RE$1.test(poolId)) {
+                throw new SponsoredCallInputError('pool');
+            }
+            if (typeof trancheId !== 'string' || !ADDRESS_RE$1.test(trancheId)) {
+                throw new SponsoredCallInputError('tranche');
+            }
+            let shares;
+            if (amount === 'max') {
+                // Lowercased, as `WithdrawFlow` hands `withdrawMax` the address.
+                shares = yield this._userLending.getWithdrawalSharesMax(trancheId, userAddress.toLowerCase());
+            }
+            else {
+                if (!BigNumber.isBigNumber(amount) || amount.lte(0)) {
+                    throw new SponsoredCallInputError('non-positive-amount');
+                }
+                shares = yield this._userLending.getWithdrawalSharesForAssets(trancheId, amount);
+            }
+            return encodeRequestWithdrawalCall(this._lendingPoolManager, poolId, trancheId, shares);
+        });
+    }
+    /** `cancelDepositRequest(pool, dNftId)` — the pending deposit's NFT id. */
+    cancelDepositRequest(poolId, dNftId) {
+        return encodeCancelDepositCall(this._lendingPoolManager, poolId, dNftId);
+    }
+    /** `cancelWithdrawalRequest(pool, wNftId)` — the pending withdrawal's NFT id. */
+    cancelWithdrawalRequest(poolId, wNftId) {
+        return encodeCancelWithdrawalCall(this._lendingPoolManager, poolId, wNftId);
+    }
+    /**
+     * `requestFixedTermDepositWithdrawal(pool, fixedTermDepositId)` — what
+     * `UserLending.withdrawAtExpiry(pool, lockId)` sends: the pool and the
+     * LOCK id, no tranche.
+     */
+    withdrawAtExpiry(poolId, fixedTermDepositId) {
+        return encodeWithdrawAtExpiryCall(this._lendingPoolManager, poolId, fixedTermDepositId);
+    }
+}
+
 /**
  * Browser-viable XDC RPCs only. `rpc.xdc.org` / `erpc.xdc.org` answer OPTIONS
  * without `access-control-allow-origin`, so a browser call hangs on preflight
@@ -24240,6 +24494,7 @@ const CHAIN_CONFIGS = {
             'https://base-rpc.publicnode.com',
             'https://mainnet.base.org',
         ],
+        blockExplorerUrl: 'https://basescan.org',
     },
     xdc: {
         chainId: 50,
@@ -24275,6 +24530,7 @@ const CHAIN_CONFIGS = {
             currencyCode: 'AUD',
         },
         rpcUrls: XDC_RPC_URLS,
+        blockExplorerUrl: 'https://xdcscan.com',
     },
     'xdc-usdc': {
         chainId: 50,
@@ -24306,6 +24562,7 @@ const CHAIN_CONFIGS = {
             currencyCode: 'USD',
         },
         rpcUrls: XDC_RPC_URLS,
+        blockExplorerUrl: 'https://xdcscan.com',
     },
     plume: {
         chainId: 98866,
@@ -24346,6 +24603,8 @@ const CHAIN_CONFIGS = {
         // pointing at an endpoint nobody maintains. Pass your own
         // `signerOrProvider` to read the frozen history.
         rpcUrls: [],
+        // The explorer still serves the frozen history.
+        blockExplorerUrl: 'https://explorer.plume.org',
         retired: true,
     },
 };
@@ -24465,128 +24724,1084 @@ class DepositsFacade {
 }
 
 /**
- * The tiny observable-state kernel both flows are built on.
+ * The errors an atomic-batch submitter throws, in one module both
+ * `DepositFlow` and `submitBatch` import — so `instanceof` is one class
+ * whichever of them a consumer imports it through.
+ */
+/**
+ * What a `depositBatch` port throws when it KNOWS the batch reverted — from a
+ * simulation before sending, from the submitter refusing to broadcast a batch
+ * that would revert, or from a mined receipt whose user operation reverted.
+ * The run ends `{ step: 'request', reason: 'reverted', revertError }`.
+ *
+ * `revertError` is the custom error the contract named (`'ClearingIsPending'`,
+ * `'UserNotKycd'`, …), exactly as the ABI declares it. Pass `''` when the
+ * batch is known to revert but not why: the consumer then renders its generic
+ * `reverted` copy, which is what an unknown name gets anyway.
+ *
+ * A revert is DEFINITIVE — nothing was deposited. Throw it only when that is
+ * known; anything less certain is a `BatchPendingError`.
+ */
+class BatchRevertedError extends Error {
+    constructor(revertError, message) {
+        super(message !== null && message !== void 0 ? message : `DepositFlow: the batch reverted${revertError ? ` with ${revertError}` : ''}`);
+        this.name = 'BatchRevertedError';
+        this.revertError = revertError;
+        // Keeps `instanceof` honest under a down-levelled build.
+        Object.setPrototypeOf(this, BatchRevertedError.prototype);
+    }
+}
+/**
+ * Every non-revert failure of a batch submission, carrying its outcome and a
+ * short code (`'status_timeout'`, `'receipt_unavailable'`, …).
  *
- * Deliberately not a framework store: no React, no signals, no dependency.
- * A flow is a long asynchronous run that has to publish every transition to
- * whatever is rendering it, and has to be able to abandon a run that the
- * consumer walked away from. That is the whole requirement, and it is 60 lines.
+ * The message is fixed and names no party: the wallet-error classifier reads a
+ * thrown error's text for a USER rejection, and a relay outage worded "…wallet
+ * refused…" must never reach the lender as something they did.
  *
- * The `generation` counter is the abandonment mechanism. `reset()` bumps it;
- * an in-flight run captured the previous value, so every later `patch` it
- * attempts is dropped and every `isCurrent` checkpoint tells it to stop. It is
- * what makes `reset()` safe to call mid-flight — the run cannot resurrect a
- * dead state or, worse, drive the UI back into a phase the consumer has left.
+ * `outcome` has NO default. `failed` is the one outcome that invites a second
+ * deposit, so a port author has to spell it out — a `throw new
+ * BatchSubmissionError(code)` written in a catch block after the POST left
+ * must not quietly become "try again".
  */
-class FlowStore {
-    constructor(_initial) {
-        this._initial = _initial;
-        this._generation = 0;
-        this._listeners = new Set();
-        this._state = _initial;
-    }
-    get state() {
-        return this._state;
-    }
-    /** The run token an in-flight pipeline captures at `start()`. */
-    get generation() {
-        return this._generation;
-    }
-    /** False once `reset()` (or a later `start()`) has superseded `token`. */
-    isCurrent(token) {
-        return this._generation === token;
-    }
-    /**
-     * Subscribe to every transition. Returns the unsubscribe function; calling
-     * it twice is harmless.
-     *
-     * Listeners are NOT called on subscribe — read `state` for the current
-     * value. A listener that throws is not allowed to break the pipeline or
-     * starve the listeners registered after it, so throws are swallowed.
-     */
-    subscribe(listener) {
-        this._listeners.add(listener);
-        return () => {
-            this._listeners.delete(listener);
-        };
-    }
-    /**
-     * Merge `next` into the state and notify, unless `token` names a
-     * superseded run.
-     */
-    patch(next, token) {
-        if (token !== undefined && !this.isCurrent(token))
-            return;
-        this._state = Object.assign(Object.assign({}, this._state), next);
-        for (const listener of [...this._listeners]) {
-            try {
-                listener(this._state);
-            }
-            catch (_a) {
-                // A consumer's rendering fault is its own problem; the pipeline
-                // owns real money and keeps going.
-            }
+class BatchSubmissionError extends Error {
+    constructor(code, outcome, options) {
+        super(`Batch submission ${outcome} (${code})`);
+        this.name = 'BatchSubmissionError';
+        this.code = code;
+        this.outcome = outcome;
+        // Set by hand: `Error`'s own `cause` option is ES2022.
+        if (options && 'cause' in options) {
+            Object.defineProperty(this, 'cause', {
+                value: options.cause,
+                enumerable: false,
+                writable: true,
+                configurable: true,
+            });
         }
+        Object.setPrototypeOf(this, BatchSubmissionError.prototype);
     }
-    /**
-     * Back to the initial state, abandoning any in-flight run.
-     *
-     * Subscribers are kept: the consumer that was watching the last run is the
-     * one that will watch the next.
-     */
-    reset() {
-        this._generation += 1;
-        this.patch(this._initial);
-    }
-    /** Claim the next run token. Any earlier run is abandoned. */
-    beginRun() {
-        this._generation += 1;
-        return this._generation;
+}
+/**
+ * The ambiguous outcome: the batch may have landed. An instance of
+ * `BatchSubmissionError` with `outcome: 'pending'`.
+ */
+class BatchPendingError extends BatchSubmissionError {
+    constructor(code, options) {
+        super(code, 'pending', options);
+        this.name = 'BatchPendingError';
+        Object.setPrototypeOf(this, BatchPendingError.prototype);
     }
 }
+/** The outcome a thrown error stands for, or `null` if it is not a submission error. */
+function batchOutcomeOf(err) {
+    return err instanceof BatchSubmissionError ? err.outcome : null;
+}
+/**
+ * Nothing was deposited and nothing can be: a known revert, or a definitive
+ * `failed` refusal. Everything else — including an error this SDK did not
+ * produce — is NOT proof of that, and a consumer must not invite a retry on it.
+ */
+function isDefinitivelyNotSubmitted(err) {
+    return (err instanceof BatchRevertedError || batchOutcomeOf(err) === 'failed');
+}
 
+// ---------------------------------------------------------------------------
+// The selector tables
+// ---------------------------------------------------------------------------
 /**
- * The run lifecycle both flows share: one run at a time, every transition
- * published, and a `reset()` that is safe to call in the middle of one.
- *
- * `DepositFlow` and `WithdrawFlow` each carried their own copy of this — the
- * re-entrancy guard, the `try/finally` around the run, `state`, `isRunning`,
- * `subscribe`, `reset`. Two copies of a guard is two places for a guard to be
- * wrong, on the money path, which is the same reason the pipelines themselves
- * moved out of the applications.
- *
- * ## The guard and the run token are separate, and both matter
+ * OpenZeppelin v5's ERC-20 errors. They are not in either Kasu ABI because no
+ * Kasu contract declares them — they arrive from the TOKEN, through the
+ * manager's `transferFrom`, and they are the modern spelling of the string
+ * reverts below.
+ */
+const ERC20_ERROR_ABI = [
+    'error ERC20InsufficientBalance(address sender, uint256 balance, uint256 needed)',
+    'error ERC20InsufficientAllowance(address spender, uint256 allowance, uint256 needed)',
+];
+/**
+ * The protocol errors that mean the ERC-20 transfer failed rather than the
+ * protocol refusing.
  *
- * `_runToken` is the re-entrancy guard: claimed synchronously, before the
- * first `await`, so a double tap cannot launch two pipelines. The store's
- * `generation` is the abandonment mechanism: an in-flight run holds the value
- * it claimed, and every `patch` and `isCurrent` checkpoint it makes after
- * `reset()` is dropped.
+ * `SafeERC20FailedOperation` is OpenZeppelin's wrapper around a token call
+ * that returned false or reverted, which on this path IS the `transferFrom`;
+ * `AddressInsufficientBalance` is its native-value sibling. Both belong with
+ * the balance case, not with the pool conditions — a lender who sees one of
+ * them really does need to fund or re-approve.
+ */
+const ERC20_FAMILY_NAMES = new Set([
+    'AddressInsufficientBalance',
+    'ERC20InsufficientAllowance',
+    'ERC20InsufficientBalance',
+    'SafeERC20FailedOperation',
+]);
+/** Solidity's `Error(string)`, the selector every `require` reason arrives under. */
+const STRING_REVERT_SELECTOR = '0x08c379a0';
+/**
+ * The `require` reasons that are a balance or an allowance, across the token
+ * implementations in circulation: OpenZeppelin v4's sentences, and the
+ * shorthand the minimal implementations use.
+ */
+const ERC20_REASON_PATTERNS = [
+    /exceeds\s+balance/,
+    /exceeds\s+allowance/,
+    /insufficient\s+balance/,
+    /insufficient\s+allowance/,
+    /transfer_from_failed/,
+    /transferfrom\s+failed/,
+    /low-level\s+call\s+failed/,
+];
+/**
+ * selector → error name, built once on first use.
  *
- * `reset()` releases the guard IMMEDIATELY rather than waiting for the
- * abandoned run to notice. It has to: a run parked on a wallet prompt that
- * never answers is a promise that may never settle, and a consumer that has
- * left that screen must be able to start a new run in the same tick. The
- * abandoned run's `finally` therefore releases the guard only if it still
- * holds it — by then a NEW run may own it, and clearing it there would let a
- * third run start alongside the second.
+ * Lazily, because a consumer that never sees a revert should not pay for three
+ * `Interface` constructions at import. The two Kasu tables are the GENERATED
+ * typechain ABIs, so this cannot drift from the contracts: regenerate the ABIs
+ * and the new errors are recognised with no edit here.
  */
-class Flow {
-    constructor(initial) {
-        /**
-         * The token of the run currently holding the guard, or `null` when none
-         * does. Not a boolean: releasing the guard has to be attributable to the
-         * run that claimed it.
-         */
-        this._runToken = null;
-        this._store = new FlowStore(initial);
-    }
-    /** The current state. Every transition is also published to `subscribe`. */
-    get state() {
-        return this._store.state;
-    }
-    /** True while a run is in flight, including while parked. */
-    get isRunning() {
+let selectorTable = null;
+function selectors() {
+    if (selectorTable)
+        return selectorTable;
+    const table = new Map();
+    const interfaces = [
+        // The manager the deposit is called against, and the allow list it
+        // delegates the KYC and block-window checks to.
+        ILendingPoolManagerAbi__factory.createInterface(),
+        IKasuAllowListAbi__factory.createInterface(),
+        new ethers.utils.Interface(ERC20_ERROR_ABI),
+    ];
+    for (const iface of interfaces) {
+        for (const fragment of Object.values(iface.errors)) {
+            // First writer wins: the same name declared by both ABIs is the
+            // same selector, so the duplicate would be a no-op anyway.
+            const sighash = iface.getSighash(fragment);
+            if (!table.has(sighash))
+                table.set(sighash, fragment.name);
+        }
+    }
+    selectorTable = table;
+    return table;
+}
+// ---------------------------------------------------------------------------
+// Getting the bytes out of the envelope
+// ---------------------------------------------------------------------------
+/**
+ * How deep to look for the revert data. Providers nest it differently —
+ * ethers' own error wraps the provider's, which wraps the RPC body — and a
+ * bound is what keeps a self-referencing error object from being walked
+ * forever.
+ */
+const MAX_DEPTH = 6;
+/** The keys ethers and the providers under it put a wrapped error on. */
+const NESTED_KEYS = [
+    'data',
+    'error',
+    'originalError',
+    'info',
+    'cause',
+    'body',
+];
+/** At least a 4-byte selector, and a whole number of bytes. */
+function isRevertData(value) {
+    return (value.length >= 10 &&
+        value.length % 2 === 0 &&
+        /^0x[0-9a-fA-F]+$/.test(value));
+}
+/**
+ * Find the revert data on an error, wherever the provider left it.
+ *
+ * ethers v5 raises `UNPREDICTABLE_GAS_LIMIT` with the provider's own error
+ * attached, and each provider nests the bytes one layer differently:
+ * `error.data`, `error.error.data`, `error.data.originalError.data`, or only
+ * inside the JSON `body` of a `SERVER_ERROR`. Rather than enumerate the
+ * products, walk a fixed set of keys to a fixed depth and take the first value
+ * that is shaped like revert data.
+ */
+function extractRevertData(err) {
+    return walk(err, 0);
+}
+function walk(node, depth) {
+    if (node == null || depth > MAX_DEPTH)
+        return null;
+    if (typeof node === 'string') {
+        if (isRevertData(node))
+            return node;
+        // A `SERVER_ERROR`'s body: the RPC's JSON reply, verbatim.
+        if (!node.startsWith('{'))
+            return null;
+        try {
+            return walk(JSON.parse(node), depth + 1);
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    if (typeof node !== 'object')
+        return null;
+    const record = node;
+    for (const key of NESTED_KEYS) {
+        const found = walk(record[key], depth + 1);
+        if (found)
+            return found;
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Decoding
+// ---------------------------------------------------------------------------
+/**
+ * Decode a failed call's revert into the error the contract named, or `null`
+ * when there is nothing recognisable to name.
+ *
+ * `null` is the honest answer for an unknown selector, an unrelated `require`
+ * string, or an error with no revert data at all — the caller keeps whatever
+ * it did before rather than inventing a diagnosis from bytes it cannot read.
+ */
+function decodeRevert(err) {
+    const data = extractRevertData(err);
+    if (!data)
+        return null;
+    const selector = data.slice(0, 10).toLowerCase();
+    if (selector === STRING_REVERT_SELECTOR) {
+        const reason = decodeStringRevert(data);
+        if (reason === null)
+            return null;
+        return isErc20Reason(reason)
+            ? { name: 'Error', family: 'erc20', reason }
+            : null;
+    }
+    const name = selectors().get(selector);
+    if (!name)
+        return null;
+    return {
+        name,
+        family: ERC20_FAMILY_NAMES.has(name) ? 'erc20' : 'protocol',
+    };
+}
+function decodeStringRevert(data) {
+    try {
+        const [reason] = ethers.utils.defaultAbiCoder.decode(['string'], `0x${data.slice(10)}`);
+        return reason;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function isErc20Reason(reason) {
+    const lower = reason.toLowerCase();
+    return ERC20_REASON_PATTERNS.some((pattern) => pattern.test(lower));
+}
+
+/**
+ * The money-path checks around an atomic, sponsored deposit batch — the
+ * `approve + requestDepositWithKyc` pair `DepositFlow` hands its
+ * `depositBatch` port.
+ *
+ * Two questions, both PURE:
+ *
+ * 1. Before anything is signed: is this batch exactly the deposit this run
+ *    asked for? (`validateDepositBatchCalls`)
+ * 2. After it is mined: did THIS receipt deposit THIS amount, for THIS
+ *    lender, into THIS tranche? (`proveDepositInReceipt`)
+ *
+ * Neither knows a relay, a wallet vendor or a URL; the app's submitter calls
+ * them.
+ */
+/**
+ * ERC-4337 EntryPoint v0.7 — the contract a bundler calls `handleOps` on. The
+ * proof reads the user operation's outcome from ITS events, and from no other
+ * contract's.
+ */
+const ENTRY_POINT_V07 = '0x0000000071727De22E5E9d8BAf0edAc6f37da032';
+/** EntryPoint v0.7 events (eth-infinitism `IEntryPoint`). */
+const ENTRY_POINT_EVENTS = new utils$2.Interface([
+    'event UserOperationEvent(bytes32 indexed userOpHash, address indexed sender, address indexed paymaster, uint256 nonce, bool success, uint256 actualGasCost, uint256 actualGasUsed)',
+    'event UserOperationRevertReason(bytes32 indexed userOpHash, address indexed sender, uint256 nonce, bytes revertReason)',
+    'event BeforeExecution()',
+]);
+/** kasu-contracts `IPendingPool` — emitted by the strategy's pending pool. */
+const PENDING_POOL_EVENTS = new utils$2.Interface([
+    'event DepositRequested(address indexed user, address indexed tranche, uint256 indexed dNftID, uint256 epochId, uint256 amount)',
+]);
+const USER_OPERATION_EVENT = ENTRY_POINT_EVENTS.getEventTopic('UserOperationEvent');
+const USER_OPERATION_REVERT_REASON = ENTRY_POINT_EVENTS.getEventTopic('UserOperationRevertReason');
+const BEFORE_EXECUTION = ENTRY_POINT_EVENTS.getEventTopic('BeforeExecution');
+const DEPOSIT_REQUESTED = PENDING_POOL_EVENTS.getEventTopic('DepositRequested');
+const ERC20$1 = IERC20MetadataAbi__factory.createInterface();
+const LENDING_POOL_MANAGER$1 = ILendingPoolManagerAbi__factory.createInterface();
+const ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+/**
+ * Case-insensitive address equality; `false` for anything that is not a
+ * 20-byte hex address. Checksums are not enforced — an all-lowercase address
+ * is the subgraph's own spelling.
+ */
+function sameAddress(a, b) {
+    return (typeof a === 'string' &&
+        typeof b === 'string' &&
+        ADDRESS_RE.test(a) &&
+        ADDRESS_RE.test(b) &&
+        a.toLowerCase() === b.toLowerCase());
+}
+function isHexData(value) {
+    return typeof value === 'string' && utils$2.isHexString(value);
+}
+/**
+ * What `validateDepositBatchCalls` throws. `code` says which pin failed; the
+ * message names no party, so a wallet-rejection classifier can never read it
+ * as something the lender did.
+ */
+class DepositBatchMismatchError extends Error {
+    constructor(code) {
+        super(`Deposit batch does not match the run (${code})`);
+        this.name = 'DepositBatchMismatchError';
+        this.code = code;
+        Object.setPrototypeOf(this, DepositBatchMismatchError.prototype);
+    }
+}
+function mismatch(code) {
+    throw new DepositBatchMismatchError(code);
+}
+function isCallShape(call) {
+    if (call === null || typeof call !== 'object')
+        return false;
+    const { to, data } = call;
+    return typeof to === 'string' && ADDRESS_RE.test(to) && isHexData(data);
+}
+function isZeroValue(value) {
+    if (value === undefined)
+        return true;
+    try {
+        return BigNumber.from(value).isZero();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function sameAmount(a, b) {
+    return BigNumber.isBigNumber(a) && a.eq(b);
+}
+/**
+ * Decode `data` as a call to `name` on `iface`, and refuse it unless it is
+ * the CANONICAL encoding of what it decodes to. The ABI decoder tolerates
+ * trailing bytes and non-minimal offsets; a signature over bytes that decode
+ * "the same" but are not the bytes the SDK produced is not a signature over
+ * this run's deposit.
+ */
+function decodeCanonical(iface, name, data, code) {
+    let parsed;
+    try {
+        parsed = iface.parseTransaction({ data });
+    }
+    catch (_a) {
+        return mismatch(code);
+    }
+    if (parsed.name !== name)
+        return mismatch(code);
+    let canonical;
+    try {
+        canonical = iface.encodeFunctionData(parsed.functionFragment, parsed.args);
+    }
+    catch (_b) {
+        return mismatch(code);
+    }
+    if (canonical.toLowerCase() !== data.toLowerCase()) {
+        return mismatch('non-canonical-encoding');
+    }
+    return parsed.args;
+}
+/**
+ * Pin a deposit batch to the run that produced it — PURE; throws a
+ * `DepositBatchMismatchError` on ANY deviation, before the lender's key signs
+ * anything.
+ *
+ * The batch must be exactly two calls, in this order, with no native value:
+ *
+ * 0. `stableAsset.approve(spender, A)`;
+ * 1. `spender.requestDepositWithKyc(poolId, trancheId, A, '0x', fixedTermConfigId, …)`;
+ *
+ * with `A` the run's own amount in BOTH — never more, never unlimited (house
+ * rule: exact-amount approvals) — the run's own fixed-term config, each call
+ * the canonical ABI encoding of its arguments, and no swap data. The deposit
+ * data and KYC signature are not pinned here: they are signatures the
+ * contract and the backend verify.
+ *
+ * This is the client's half; a relaying backend checks the same shape again.
+ */
+function validateDepositBatchCalls(calls, expected) {
+    const amount = BigNumber.from(expected.amount);
+    if (amount.lte(0))
+        mismatch('non-positive-amount');
+    if (!Array.isArray(calls) || calls.length !== 2)
+        mismatch('call-count');
+    const [approveCall, depositCall] = calls;
+    for (const call of [approveCall, depositCall]) {
+        if (!isCallShape(call))
+            mismatch('malformed-call');
+        if (!isZeroValue(call.value))
+            mismatch('native-value');
+    }
+    // 0 — the approval.
+    if (!sameAddress(approveCall.to, expected.stableAsset)) {
+        mismatch('approve-token');
+    }
+    const [approveSpender, approveAmount] = decodeCanonical(ERC20$1, 'approve', approveCall.data, 'approve-call');
+    if (!sameAddress(approveSpender, expected.spender)) {
+        mismatch('approve-spender');
+    }
+    // 1 — the deposit.
+    if (!sameAddress(depositCall.to, expected.spender)) {
+        mismatch('deposit-target');
+    }
+    const [pool, tranche, maxAmount, swapData, fixedTermConfigId] = decodeCanonical(LENDING_POOL_MANAGER$1, 'requestDepositWithKyc', depositCall.data, 'deposit-call');
+    if (!sameAddress(pool, expected.poolId))
+        mismatch('deposit-pool');
+    if (!sameAddress(tranche, expected.trancheId))
+        mismatch('deposit-tranche');
+    if (swapData !== '0x')
+        mismatch('swap-data');
+    if (!sameAmount(fixedTermConfigId, BigNumber.from(expected.fixedTermConfigId))) {
+        mismatch('fixed-term-config');
+    }
+    // EXACT amount, on both calls, equal to the run's.
+    if (!sameAmount(approveAmount, amount))
+        mismatch('approve-amount');
+    if (!sameAmount(maxAmount, amount))
+        mismatch('deposit-amount');
+    return { tranche: tranche, amount };
+}
+/** A log's first topic, lowercased; `undefined` for a log without a topic array. */
+function topicOf(log) {
+    var _a;
+    return Array.isArray(log.topics)
+        ? (_a = log.topics[0]) === null || _a === void 0 ? void 0 : _a.toLowerCase()
+        : undefined;
+}
+function parse(iface, log) {
+    try {
+        return iface.parseLog({ topics: [...log.topics], data: log.data });
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * Did THIS receipt deposit for THIS lender? — PURE.
+ *
+ * A sponsored batch lands as a bundler's `handleOps` transaction, and that
+ * transaction's `status` is success even when the user operation inside it
+ * reverted: the EntryPoint catches the revert, the account rolls back both
+ * calls, nothing is deposited. So `status` decides NOTHING. What does:
+ *
+ *  1. The EntryPoint's `UserOperationEvent` for OUR operation — emitted BY
+ *     the EntryPoint, `sender` = lender, and `userOpHash` = the known hash
+ *     when there is one.
+ *  2. Its `success` flag. `false` → `reverted`, naming the protocol error
+ *     from the matching `UserOperationRevertReason` when it decodes.
+ *  3. A `DepositRequested` with `user` = lender, `tranche` = the run's and
+ *     `amount` = the run's, INSIDE our operation's execution: the logs after
+ *     the previous operation's event (or `BeforeExecution`, which precedes
+ *     the first) and before ours. A deposit from another operation in the
+ *     same bundle does not count, and neither does one emitted by a contract
+ *     that is not the pending pool, when the pending pool is known.
+ *
+ * Anything short of all three is `unproven`, which a consumer must treat as
+ * PENDING — the money may have moved — and never as a failure.
+ */
+function proveDepositInReceipt(receipt, expected) {
+    // Typed as an array, but a receipt is foreign data: check before reading.
+    if (!Array.isArray(receipt.logs)) {
+        return { kind: 'unproven', reason: 'malformed-receipt' };
+    }
+    const amount = BigNumber.from(expected.amount);
+    const op = locateUserOperation(receipt.logs, {
+        sender: expected.lender,
+        userOperationHash: expected.userOperationHash,
+        entryPoint: expected.entryPoint,
+    });
+    if (op === null)
+        return { kind: 'unproven', reason: 'no-user-operation' };
+    if (op === 'ambiguous') {
+        return { kind: 'unproven', reason: 'ambiguous-operation' };
+    }
+    if (!op.success) {
+        return { kind: 'reverted', revertError: op.revertError() };
+    }
+    for (const log of op.window) {
+        if (topicOf(log) !== DEPOSIT_REQUESTED)
+            continue;
+        if (expected.pendingPool !== undefined &&
+            !sameAddress(log.address, expected.pendingPool)) {
+            continue;
+        }
+        const decoded = parse(PENDING_POOL_EVENTS, log);
+        if ((decoded === null || decoded === void 0 ? void 0 : decoded.name) !== 'DepositRequested')
+            continue;
+        if (!sameAddress(decoded.args.user, expected.lender))
+            continue;
+        if (!sameAddress(decoded.args.tranche, expected.tranche))
+            continue;
+        if (!sameAmount(decoded.args.amount, amount))
+            continue;
+        return {
+            kind: 'deposited',
+            dNftId: decoded.args.dNftID,
+            blockNumber: receipt.blockNumber,
+        };
+    }
+    return { kind: 'unproven', reason: 'no-deposit-requested' };
+}
+/**
+ * Did THIS receipt execute the sender's user operation? — PURE. The
+ * single-call sibling of `proveDepositInReceipt`, for a sponsored
+ * `requestWithdrawal`, a cancel or a fixed-term withdrawal: the same
+ * EntryPoint `UserOperationEvent` from the same contract, for the same
+ * sender (and hash, when known), read the same way — the `handleOps`
+ * transaction's own `status` decides NOTHING, because it is a success even
+ * when the operation inside it reverted.
+ *
+ * `executed` needs the operation's `success` flag. A single-call operation
+ * that succeeded executed its one call; there is no event to match beyond
+ * that, so pass the `userOperationHash` whenever the submitter reports one —
+ * without it, the sender's ONLY operation in the bundle is the one read, and a
+ * bundle holding two of theirs is `ambiguous-operation` (pending), never the
+ * first one's verdict: with one succeeded and one reverted, "executed" would
+ * tell the lender their request is queued when it is not.
+ */
+function proveUserOperationInReceipt(receipt, expected) {
+    if (!Array.isArray(receipt.logs)) {
+        return { kind: 'unproven', reason: 'malformed-receipt' };
+    }
+    const op = locateUserOperation(receipt.logs, expected);
+    if (op === null)
+        return { kind: 'unproven', reason: 'no-user-operation' };
+    if (op === 'ambiguous') {
+        return { kind: 'unproven', reason: 'ambiguous-operation' };
+    }
+    if (!op.success) {
+        return { kind: 'reverted', revertError: op.revertError() };
+    }
+    return { kind: 'executed', blockNumber: receipt.blockNumber };
+}
+/**
+ * The sender's user operation in a `handleOps` receipt — its `success` flag
+ * and its execution window — `null` when the receipt does not show one, or
+ * `'ambiguous'` when no hash was given and it shows more than one of theirs.
+ *
+ *  - The `UserOperationEvent` must be emitted BY the EntryPoint, with
+ *    `sender` = the expected sender and, when one is known, `userOpHash` =
+ *    the expected hash. Without a hash the sender must have exactly ONE
+ *    operation in the bundle: a bundler may pack two of theirs (sequential
+ *    nonces, or parallel nonce keys), and reading the first would attribute
+ *    the other one's verdict to this call.
+ *  - The window is the logs after the previous operation's event (or
+ *    `BeforeExecution`, which precedes the first) and before ours: what our
+ *    operation's calls emitted, and nothing another operation in the same
+ *    bundle did.
+ */
+function locateUserOperation(logs, expected) {
+    var _a, _b, _c;
+    const entryPoint = (_a = expected.entryPoint) !== null && _a !== void 0 ? _a : ENTRY_POINT_V07;
+    const wantedHash = (_c = (_b = expected.userOperationHash) === null || _b === void 0 ? void 0 : _b.toLowerCase()) !== null && _c !== void 0 ? _c : null;
+    const fromEntryPoint = (log) => sameAddress(log.address, entryPoint);
+    let opIndex = -1;
+    let success = false;
+    for (let i = 0; i < logs.length; i += 1) {
+        const log = logs[i];
+        if (!fromEntryPoint(log) || topicOf(log) !== USER_OPERATION_EVENT) {
+            continue;
+        }
+        const decoded = parse(ENTRY_POINT_EVENTS, log);
+        if ((decoded === null || decoded === void 0 ? void 0 : decoded.name) !== 'UserOperationEvent')
+            continue;
+        const userOpHash = String(decoded.args.userOpHash).toLowerCase();
+        if (wantedHash !== null && userOpHash !== wantedHash)
+            continue;
+        if (!sameAddress(decoded.args.sender, expected.sender))
+            continue;
+        // A second operation of this sender, and no hash to tell them apart.
+        if (opIndex >= 0)
+            return 'ambiguous';
+        opIndex = i;
+        success = decoded.args.success === true;
+        // A hash names exactly one operation; without one, keep scanning so
+        // a second operation of the sender is noticed.
+        if (wantedHash !== null)
+            break;
+    }
+    if (opIndex < 0)
+        return null;
+    // Our operation's execution window.
+    let windowStart = 0;
+    for (let i = opIndex - 1; i >= 0; i -= 1) {
+        const log = logs[i];
+        const topic = topicOf(log);
+        if (fromEntryPoint(log) &&
+            (topic === USER_OPERATION_EVENT || topic === BEFORE_EXECUTION)) {
+            windowStart = i + 1;
+            break;
+        }
+    }
+    const window = logs.slice(windowStart, opIndex);
+    return {
+        success,
+        window,
+        revertError: () => revertErrorIn(window, expected.sender, fromEntryPoint),
+    };
+}
+/**
+ * The protocol error a reverted operation named, or `''`. Only a PROTOCOL
+ * error is passed on: an `Error(string)` or an ERC-20 failure is not a name a
+ * consumer has words for.
+ */
+function revertErrorIn(window, lender, fromEntryPoint) {
+    for (const log of window) {
+        if (!fromEntryPoint(log))
+            continue;
+        // Through the same guard as the main loop: a malformed log beside the
+        // revert reason must not turn a DEFINITIVE revert into "pending".
+        if (topicOf(log) !== USER_OPERATION_REVERT_REASON)
+            continue;
+        const decoded = parse(ENTRY_POINT_EVENTS, log);
+        if ((decoded === null || decoded === void 0 ? void 0 : decoded.name) !== 'UserOperationRevertReason')
+            continue;
+        if (!sameAddress(decoded.args.sender, lender))
+            continue;
+        const revert = decodeRevert(decoded.args.revertReason);
+        return (revert === null || revert === void 0 ? void 0 : revert.family) === 'protocol' ? revert.name : '';
+    }
+    return '';
+}
+
+/**
+ * First read at once, then 3 s backing off ×1.5 to a 10 s ceiling, for up to
+ * 10 minutes. Running out of time is PENDING: the batch was accepted and may
+ * still land.
+ */
+const DEFAULT_BATCH_POLLING_POLICY = Object.freeze({
+    initialMs: 3000,
+    maxMs: 10000,
+    backoff: 1.5,
+    timeoutMs: 10 * 60 * 1000,
+});
+function resolvePolicy(policy) {
+    var _a, _b, _c, _d;
+    const resolved = {
+        initialMs: (_a = policy === null || policy === void 0 ? void 0 : policy.initialMs) !== null && _a !== void 0 ? _a : DEFAULT_BATCH_POLLING_POLICY.initialMs,
+        maxMs: (_b = policy === null || policy === void 0 ? void 0 : policy.maxMs) !== null && _b !== void 0 ? _b : DEFAULT_BATCH_POLLING_POLICY.maxMs,
+        backoff: (_c = policy === null || policy === void 0 ? void 0 : policy.backoff) !== null && _c !== void 0 ? _c : DEFAULT_BATCH_POLLING_POLICY.backoff,
+        timeoutMs: (_d = policy === null || policy === void 0 ? void 0 : policy.timeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_BATCH_POLLING_POLICY.timeoutMs,
+    };
+    const { initialMs, maxMs, backoff, timeoutMs } = resolved;
+    if (!(Number.isFinite(initialMs) && initialMs > 0) ||
+        !(Number.isFinite(maxMs) && maxMs >= initialMs) ||
+        !(Number.isFinite(backoff) && backoff >= 1) ||
+        !(Number.isFinite(timeoutMs) && timeoutMs > 0)) {
+        throw new TypeError('submitBatch: invalid polling policy');
+    }
+    return resolved;
+}
+/**
+ * Submit `calls` and return once the submitter ACCEPTED them; `wait()` then
+ * polls and proves. Use it as the body of a `DepositFlow` `depositBatch`
+ * port, after `validateDepositBatchCalls` and the app's own signing:
+ *
+ * ```ts
+ * depositBatch: (calls) => {
+ *     const { tranche, amount } = validateDepositBatchCalls(calls, expected);
+ *     return submitBatch(
+ *         // `pendingPool`: the strategy's pending pool, so only ITS
+ *         // `DepositRequested` can prove the deposit.
+ *         { calls, expect: { lender, tranche, amount, pendingPool } },
+ *         { post, getStatus, getReceipt, now: Date.now, sleep },
+ *     );
+ * },
+ * ```
+ *
+ * | what happened                                        | outcome                                  |
+ * | ---------------------------------------------------- | ---------------------------------------- |
+ * | `post` throws `BatchRevertedError`                   | rethrown — reverted, nothing deposited   |
+ * | `post` throws `BatchSubmissionError`                 | rethrown with its own outcome            |
+ * | `post` throws anything else                          | `BatchPendingError('post_unknown')`      |
+ * | `post` resolves without a transaction id             | `BatchPendingError('malformed_answer')`  |
+ * | status `reverted`                                    | `BatchRevertedError('')`                 |
+ * | status `unknown`                                     | `BatchPendingError(code)`                |
+ * | polling runs out of time                             | `BatchPendingError('status_timeout')`    |
+ * | receipt unreadable                                   | `BatchPendingError('receipt_unavailable')` |
+ * | receipt: user operation reverted                     | `BatchRevertedError(revertError)`        |
+ * | receipt: this deposit not shown                      | `BatchPendingError('deposit_unproven:<reason>')` |
+ * | receipt: this lender's deposit, tranche and amount   | resolves `ProvenBatch`                   |
+ *
+ * Nothing on this path ever produces a `failed` outcome: by the time a batch
+ * has been posted, only a revert proves that nothing was deposited.
+ */
+function submitBatch(input, ports, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const resolved = resolvePolicy(policy);
+        const transactionId = yield postOnce(() => ports.post(input.calls));
+        let settled = null;
+        return {
+            transactionId,
+            // Memoised: a second `wait()` reads the same outcome instead of
+            // polling the submitter twice.
+            wait: () => (settled !== null && settled !== void 0 ? settled : (settled = settle(transactionId, input.expect, ports, resolved))),
+        };
+    });
+}
+/**
+ * The post, and what its answer means: the transaction id, or the error the
+ * outcome table names. Shared by both submitters, so the two cannot come to
+ * disagree about which throws are ambiguous.
+ */
+function postOnce(post) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let accepted;
+        try {
+            accepted = yield post();
+        }
+        catch (err) {
+            if (err instanceof BatchRevertedError)
+                throw err;
+            if (err instanceof BatchSubmissionError)
+                throw err;
+            throw new BatchPendingError('post_unknown', { cause: err });
+        }
+        const transactionId = accepted === null || accepted === void 0 ? void 0 : accepted.transactionId;
+        if (typeof transactionId !== 'string' || transactionId === '') {
+            throw new BatchPendingError('malformed_answer');
+        }
+        return transactionId;
+    });
+}
+function readStatus(ports, transactionId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield ports.getStatus(transactionId);
+        }
+        catch (_a) {
+            return { kind: 'again' };
+        }
+    });
+}
+/** Poll until a mined hash, or a typed reason there will not be one. */
+function waitForMined(transactionId, ports, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const deadline = ports.now() + policy.timeoutMs;
+        let userOperationHash = null;
+        let delay = policy.initialMs;
+        for (;;) {
+            const read = yield readStatus(ports, transactionId);
+            switch (read.kind) {
+                case 'mined':
+                    if (typeof read.txHash !== 'string' || read.txHash === '') {
+                        break; // a malformed "mined" is not an answer; ask again
+                    }
+                    return {
+                        txHash: read.txHash,
+                        userOperationHash: (_a = read.userOperationHash) !== null && _a !== void 0 ? _a : userOperationHash,
+                    };
+                case 'reverted':
+                    throw new BatchRevertedError('');
+                case 'unknown':
+                    throw new BatchPendingError(read.code);
+                case 'again':
+                    if (read.userOperationHash) {
+                        userOperationHash = read.userOperationHash;
+                    }
+                    break;
+            }
+            if (ports.now() + delay > deadline) {
+                throw new BatchPendingError('status_timeout');
+            }
+            yield ports.sleep(delay);
+            delay = Math.min(policy.maxMs, Math.round(delay * policy.backoff));
+        }
+    });
+}
+/** Poll to a mined hash and read its receipt; a receipt read that throws is PENDING. */
+function minedReceipt(transactionId, ports, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const mined = yield waitForMined(transactionId, ports, policy);
+        try {
+            return {
+                receipt: yield ports.getReceipt(mined.txHash),
+                txHash: mined.txHash,
+                userOperationHash: mined.userOperationHash,
+            };
+        }
+        catch (err) {
+            throw new BatchPendingError('receipt_unavailable', { cause: err });
+        }
+    });
+}
+function settle(transactionId, expect, ports, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const mined = yield minedReceipt(transactionId, ports, policy);
+        let proof;
+        try {
+            proof = proveDepositInReceipt(mined.receipt, Object.assign(Object.assign({}, expect), { userOperationHash: mined.userOperationHash }));
+        }
+        catch (err) {
+            // A receipt the proof cannot even read proves nothing either way.
+            throw new BatchPendingError('deposit_unproven', { cause: err });
+        }
+        if (proof.kind === 'reverted')
+            throw new BatchRevertedError(proof.revertError);
+        if (proof.kind === 'unproven') {
+            // The proof's reason rides in the code: "no-user-operation" (the hash
+            // is not this lender's operation at all) and "no-deposit-requested"
+            // (the operation ran and shows no deposit) are the two things an
+            // operator reading the alert needs to tell apart first.
+            throw new BatchPendingError(`deposit_unproven:${proof.reason}`);
+        }
+        return { proof, receipt: mined.receipt, txHash: mined.txHash };
+    });
+}
+/**
+ * What became of an earlier submission that ended PENDING — ONE status read,
+ * no polling — for an app's guard against lending twice:
+ *
+ * - `deposited` — mined, and the receipt proves the deposit;
+ * - `not-deposited` — definitively reverted (vendor status or the user
+ *   operation's own flag);
+ * - `unknown` — anything else, including a read or receipt that failed.
+ *
+ * Only `not-deposited` may let a new lend proceed unprompted; `deposited`
+ * means the lender is told the earlier one landed (`already-submitted`).
+ */
+function checkBatchOutcome(transactionId, expect, ports) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        let read;
+        try {
+            read = yield ports.getStatus(transactionId);
+        }
+        catch (_b) {
+            return 'unknown';
+        }
+        if (read.kind === 'reverted')
+            return 'not-deposited';
+        if (read.kind !== 'mined' || typeof read.txHash !== 'string') {
+            return 'unknown';
+        }
+        try {
+            const receipt = yield ports.getReceipt(read.txHash);
+            const proof = proveDepositInReceipt(receipt, Object.assign(Object.assign({}, expect), { userOperationHash: (_a = read.userOperationHash) !== null && _a !== void 0 ? _a : null }));
+            if (proof.kind === 'deposited')
+                return 'deposited';
+            if (proof.kind === 'reverted')
+                return 'not-deposited';
+            return 'unknown';
+        }
+        catch (_c) {
+            return 'unknown';
+        }
+    });
+}
+/**
+ * `submitBatch` for ONE sponsored `LendingPoolManager` call — the body of a
+ * `WithdrawFlow` `submitCall` port, and of an app's cancel or
+ * withdraw-at-expiry action. Same post, same polling policy, same outcome
+ * table; the proof is `proveUserOperationInReceipt` (the sender's operation
+ * succeeded) instead of the deposit proof, and an unproven receipt is
+ * `call_unproven:<reason>`.
+ *
+ * ```ts
+ * submitCall: (call) =>
+ *     submitSponsoredCall(
+ *         { call, expect: { sender: lender } },
+ *         { post: (c) => postToMyRelay(c.kind, [c.call]), getStatus, getReceipt, now, sleep },
+ *     ),
+ * ```
+ *
+ * The call is checked against its kind before anything is posted — a known
+ * kind, exactly `{ to, data }`, and `data` opening with that kind's selector —
+ * and a mismatch is `BatchSubmissionError('call_mismatch', 'failed')`: nothing
+ * was sent. Build calls with `kasu.calls`, and this never fires.
+ *
+ * As on the deposit path, nothing after the post ever produces `failed`.
+ */
+function submitSponsoredCall(input, ports, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const resolved = resolvePolicy(policy);
+        if (!isWellFormedSponsoredCall(input.call)) {
+            throw new BatchSubmissionError('call_mismatch', 'failed');
+        }
+        const transactionId = yield postOnce(() => ports.post(input.call));
+        let settled = null;
+        return {
+            transactionId,
+            wait: () => (settled !== null && settled !== void 0 ? settled : (settled = settleCall(transactionId, input.expect, ports, resolved))),
+        };
+    });
+}
+function isWellFormedSponsoredCall(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const { kind, call } = value;
+    if (typeof kind !== 'string' ||
+        !SPONSORED_CALL_KINDS.includes(kind)) {
+        return false;
+    }
+    if (call === null || typeof call !== 'object')
+        return false;
+    const keys = Object.keys(call);
+    if (keys.length !== 2 || !keys.includes('to') || !keys.includes('data')) {
+        return false;
+    }
+    const { to, data } = call;
+    return (typeof to === 'string' &&
+        /^0x[0-9a-fA-F]{40}$/.test(to) &&
+        typeof data === 'string' &&
+        /^0x(?:[0-9a-fA-F]{2})*$/.test(data) &&
+        data
+            .toLowerCase()
+            .startsWith(SPONSORED_CALL_SELECTORS[kind]));
+}
+function settleCall(transactionId, expect, ports, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const mined = yield minedReceipt(transactionId, ports, policy);
+        let proof;
+        try {
+            proof = proveUserOperationInReceipt(mined.receipt, Object.assign(Object.assign({}, expect), { userOperationHash: mined.userOperationHash }));
+        }
+        catch (err) {
+            throw new BatchPendingError('call_unproven', { cause: err });
+        }
+        if (proof.kind === 'reverted') {
+            throw new BatchRevertedError(proof.revertError);
+        }
+        if (proof.kind === 'unproven') {
+            throw new BatchPendingError(`call_unproven:${proof.reason}`);
+        }
+        return { proof, receipt: mined.receipt, txHash: mined.txHash };
+    });
+}
+
+/**
+ * The tiny observable-state kernel both flows are built on.
+ *
+ * Deliberately not a framework store: no React, no signals, no dependency.
+ * A flow is a long asynchronous run that has to publish every transition to
+ * whatever is rendering it, and has to be able to abandon a run that the
+ * consumer walked away from. That is the whole requirement, and it is 60 lines.
+ *
+ * The `generation` counter is the abandonment mechanism. `reset()` bumps it;
+ * an in-flight run captured the previous value, so every later `patch` it
+ * attempts is dropped and every `isCurrent` checkpoint tells it to stop. It is
+ * what makes `reset()` safe to call mid-flight — the run cannot resurrect a
+ * dead state or, worse, drive the UI back into a phase the consumer has left.
+ */
+class FlowStore {
+    constructor(_initial) {
+        this._initial = _initial;
+        this._generation = 0;
+        this._listeners = new Set();
+        this._state = _initial;
+    }
+    get state() {
+        return this._state;
+    }
+    /** The run token an in-flight pipeline captures at `start()`. */
+    get generation() {
+        return this._generation;
+    }
+    /** False once `reset()` (or a later `start()`) has superseded `token`. */
+    isCurrent(token) {
+        return this._generation === token;
+    }
+    /**
+     * Subscribe to every transition. Returns the unsubscribe function; calling
+     * it twice is harmless.
+     *
+     * Listeners are NOT called on subscribe — read `state` for the current
+     * value. A listener that throws is not allowed to break the pipeline or
+     * starve the listeners registered after it, so throws are swallowed.
+     */
+    subscribe(listener) {
+        this._listeners.add(listener);
+        return () => {
+            this._listeners.delete(listener);
+        };
+    }
+    /**
+     * Merge `next` into the state and notify, unless `token` names a
+     * superseded run.
+     */
+    patch(next, token) {
+        if (token !== undefined && !this.isCurrent(token))
+            return;
+        this._state = Object.assign(Object.assign({}, this._state), next);
+        for (const listener of [...this._listeners]) {
+            try {
+                listener(this._state);
+            }
+            catch (_a) {
+                // A consumer's rendering fault is its own problem; the pipeline
+                // owns real money and keeps going.
+            }
+        }
+    }
+    /**
+     * Back to the initial state, abandoning any in-flight run.
+     *
+     * Subscribers are kept: the consumer that was watching the last run is the
+     * one that will watch the next.
+     */
+    reset() {
+        this._generation += 1;
+        this.patch(this._initial);
+    }
+    /** Claim the next run token. Any earlier run is abandoned. */
+    beginRun() {
+        this._generation += 1;
+        return this._generation;
+    }
+}
+
+/**
+ * The run lifecycle both flows share: one run at a time, every transition
+ * published, and a `reset()` that is safe to call in the middle of one.
+ *
+ * `DepositFlow` and `WithdrawFlow` each carried their own copy of this — the
+ * re-entrancy guard, the `try/finally` around the run, `state`, `isRunning`,
+ * `subscribe`, `reset`. Two copies of a guard is two places for a guard to be
+ * wrong, on the money path, which is the same reason the pipelines themselves
+ * moved out of the applications.
+ *
+ * ## The guard and the run token are separate, and both matter
+ *
+ * `_runToken` is the re-entrancy guard: claimed synchronously, before the
+ * first `await`, so a double tap cannot launch two pipelines. The store's
+ * `generation` is the abandonment mechanism: an in-flight run holds the value
+ * it claimed, and every `patch` and `isCurrent` checkpoint it makes after
+ * `reset()` is dropped.
+ *
+ * `reset()` releases the guard IMMEDIATELY rather than waiting for the
+ * abandoned run to notice. It has to: a run parked on a wallet prompt that
+ * never answers is a promise that may never settle, and a consumer that has
+ * left that screen must be able to start a new run in the same tick. The
+ * abandoned run's `finally` therefore releases the guard only if it still
+ * holds it — by then a NEW run may own it, and clearing it there would let a
+ * third run start alongside the second.
+ */
+class Flow {
+    constructor(initial) {
+        /**
+         * The token of the run currently holding the guard, or `null` when none
+         * does. Not a boolean: releasing the guard has to be attributable to the
+         * run that claimed it.
+         */
+        this._runToken = null;
+        this._store = new FlowStore(initial);
+    }
+    /** The current state. Every transition is also published to `subscribe`. */
+    get state() {
+        return this._store.state;
+    }
+    /** True while a run is in flight, including while parked. */
+    get isRunning() {
         return this._runToken !== null;
     }
     /**
@@ -24804,193 +26019,6 @@ function buildFullNameRequestMessage(address, timestampMs) {
     return `I request my full name for ${address.toLowerCase()} at ${timestampMs}.`;
 }
 
-// ---------------------------------------------------------------------------
-// The selector tables
-// ---------------------------------------------------------------------------
-/**
- * OpenZeppelin v5's ERC-20 errors. They are not in either Kasu ABI because no
- * Kasu contract declares them — they arrive from the TOKEN, through the
- * manager's `transferFrom`, and they are the modern spelling of the string
- * reverts below.
- */
-const ERC20_ERROR_ABI = [
-    'error ERC20InsufficientBalance(address sender, uint256 balance, uint256 needed)',
-    'error ERC20InsufficientAllowance(address spender, uint256 allowance, uint256 needed)',
-];
-/**
- * The protocol errors that mean the ERC-20 transfer failed rather than the
- * protocol refusing.
- *
- * `SafeERC20FailedOperation` is OpenZeppelin's wrapper around a token call
- * that returned false or reverted, which on this path IS the `transferFrom`;
- * `AddressInsufficientBalance` is its native-value sibling. Both belong with
- * the balance case, not with the pool conditions — a lender who sees one of
- * them really does need to fund or re-approve.
- */
-const ERC20_FAMILY_NAMES = new Set([
-    'AddressInsufficientBalance',
-    'ERC20InsufficientAllowance',
-    'ERC20InsufficientBalance',
-    'SafeERC20FailedOperation',
-]);
-/** Solidity's `Error(string)`, the selector every `require` reason arrives under. */
-const STRING_REVERT_SELECTOR = '0x08c379a0';
-/**
- * The `require` reasons that are a balance or an allowance, across the token
- * implementations in circulation: OpenZeppelin v4's sentences, and the
- * shorthand the minimal implementations use.
- */
-const ERC20_REASON_PATTERNS = [
-    /exceeds\s+balance/,
-    /exceeds\s+allowance/,
-    /insufficient\s+balance/,
-    /insufficient\s+allowance/,
-    /transfer_from_failed/,
-    /transferfrom\s+failed/,
-    /low-level\s+call\s+failed/,
-];
-/**
- * selector → error name, built once on first use.
- *
- * Lazily, because a consumer that never sees a revert should not pay for three
- * `Interface` constructions at import. The two Kasu tables are the GENERATED
- * typechain ABIs, so this cannot drift from the contracts: regenerate the ABIs
- * and the new errors are recognised with no edit here.
- */
-let selectorTable = null;
-function selectors() {
-    if (selectorTable)
-        return selectorTable;
-    const table = new Map();
-    const interfaces = [
-        // The manager the deposit is called against, and the allow list it
-        // delegates the KYC and block-window checks to.
-        ILendingPoolManagerAbi__factory.createInterface(),
-        IKasuAllowListAbi__factory.createInterface(),
-        new ethers.utils.Interface(ERC20_ERROR_ABI),
-    ];
-    for (const iface of interfaces) {
-        for (const fragment of Object.values(iface.errors)) {
-            // First writer wins: the same name declared by both ABIs is the
-            // same selector, so the duplicate would be a no-op anyway.
-            const sighash = iface.getSighash(fragment);
-            if (!table.has(sighash))
-                table.set(sighash, fragment.name);
-        }
-    }
-    selectorTable = table;
-    return table;
-}
-// ---------------------------------------------------------------------------
-// Getting the bytes out of the envelope
-// ---------------------------------------------------------------------------
-/**
- * How deep to look for the revert data. Providers nest it differently —
- * ethers' own error wraps the provider's, which wraps the RPC body — and a
- * bound is what keeps a self-referencing error object from being walked
- * forever.
- */
-const MAX_DEPTH = 6;
-/** The keys ethers and the providers under it put a wrapped error on. */
-const NESTED_KEYS = [
-    'data',
-    'error',
-    'originalError',
-    'info',
-    'cause',
-    'body',
-];
-/** At least a 4-byte selector, and a whole number of bytes. */
-function isRevertData(value) {
-    return (value.length >= 10 &&
-        value.length % 2 === 0 &&
-        /^0x[0-9a-fA-F]+$/.test(value));
-}
-/**
- * Find the revert data on an error, wherever the provider left it.
- *
- * ethers v5 raises `UNPREDICTABLE_GAS_LIMIT` with the provider's own error
- * attached, and each provider nests the bytes one layer differently:
- * `error.data`, `error.error.data`, `error.data.originalError.data`, or only
- * inside the JSON `body` of a `SERVER_ERROR`. Rather than enumerate the
- * products, walk a fixed set of keys to a fixed depth and take the first value
- * that is shaped like revert data.
- */
-function extractRevertData(err) {
-    return walk(err, 0);
-}
-function walk(node, depth) {
-    if (node == null || depth > MAX_DEPTH)
-        return null;
-    if (typeof node === 'string') {
-        if (isRevertData(node))
-            return node;
-        // A `SERVER_ERROR`'s body: the RPC's JSON reply, verbatim.
-        if (!node.startsWith('{'))
-            return null;
-        try {
-            return walk(JSON.parse(node), depth + 1);
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    if (typeof node !== 'object')
-        return null;
-    const record = node;
-    for (const key of NESTED_KEYS) {
-        const found = walk(record[key], depth + 1);
-        if (found)
-            return found;
-    }
-    return null;
-}
-// ---------------------------------------------------------------------------
-// Decoding
-// ---------------------------------------------------------------------------
-/**
- * Decode a failed call's revert into the error the contract named, or `null`
- * when there is nothing recognisable to name.
- *
- * `null` is the honest answer for an unknown selector, an unrelated `require`
- * string, or an error with no revert data at all — the caller keeps whatever
- * it did before rather than inventing a diagnosis from bytes it cannot read.
- */
-function decodeRevert(err) {
-    const data = extractRevertData(err);
-    if (!data)
-        return null;
-    const selector = data.slice(0, 10).toLowerCase();
-    if (selector === STRING_REVERT_SELECTOR) {
-        const reason = decodeStringRevert(data);
-        if (reason === null)
-            return null;
-        return isErc20Reason(reason)
-            ? { name: 'Error', family: 'erc20', reason }
-            : null;
-    }
-    const name = selectors().get(selector);
-    if (!name)
-        return null;
-    return {
-        name,
-        family: ERC20_FAMILY_NAMES.has(name) ? 'erc20' : 'protocol',
-    };
-}
-function decodeStringRevert(data) {
-    try {
-        const [reason] = ethers.utils.defaultAbiCoder.decode(['string'], `0x${data.slice(10)}`);
-        return reason;
-    }
-    catch (_a) {
-        return null;
-    }
-}
-function isErc20Reason(reason) {
-    const lower = reason.toLowerCase();
-    return ERC20_REASON_PATTERNS.some((pattern) => pattern.test(lower));
-}
-
 /**
  * Wallet and RPC error predicates — pure functions over `unknown`.
  *
@@ -25172,9 +26200,43 @@ const INITIAL$1 = {
     stepIndex: 0,
     stepTotal: 4,
     approvalRequired: true,
+    batched: false,
     contract: null,
     failure: null,
 };
+const ERC20 = IERC20MetadataAbi__factory.createInterface();
+const LENDING_POOL_MANAGER = ILendingPoolManagerAbi__factory.createInterface();
+/**
+ * The batch path's two calls, encoded by the SDK so no consumer has to: the
+ * EXACT-amount approve, then the very `requestDepositWithKyc` the default
+ * `deposit` port sends — `swapData` `'0x'`, no value. Both read `amount` from
+ * the same variable, so the batch cannot approve one figure and deposit
+ * another.
+ */
+function encodeDepositBatch(args) {
+    const { stableAsset, spender, input, depositData, kyc } = args;
+    return [
+        {
+            to: stableAsset,
+            data: ERC20.encodeFunctionData('approve', [spender, input.amount]),
+        },
+        {
+            to: spender,
+            data: LENDING_POOL_MANAGER.encodeFunctionData('requestDepositWithKyc', [
+                input.poolId,
+                input.trancheId,
+                input.amount,
+                '0x',
+                input.fixedTermConfigId,
+                depositData,
+                {
+                    blockExpiration: kyc.blockExpiration,
+                    signature: kyc.signature,
+                },
+            ]),
+        },
+    ];
+}
 /** 1-based badge position, with `approve` dropped when it is out of scope. */
 function stepIndexOf(step, approvalRequired) {
     const order = approvalRequired
@@ -25218,7 +26280,33 @@ function classifyRequest(err) {
     if (revert !== null || isUnpredictableGas(err)) {
         return { step: 'request', reason: 'insufficient-balance', error: err };
     }
-    return classifyWalletFailure('request', err);
+    return classifyWalletFailure('request', err);
+}
+/**
+ * A `depositBatch` rejection. A submitter that KNOWS the batch reverts says so
+ * with `BatchRevertedError`; anything else is read exactly as a direct
+ * deposit's throw is, so a non-wallet error can never become `cancelled`.
+ */
+function classifyBatch(err) {
+    // A submission outcome is read FIRST and taken at its word. It must never
+    // reach the revert-data walk below: that walk follows `cause`, and an
+    // ambiguous outcome whose cause happens to carry revert bytes would read
+    // as `reverted` or `insufficient-balance` — "nothing was deposited, try
+    // again" — on a batch that may have moved the money.
+    if (err instanceof BatchSubmissionError) {
+        return err.outcome === 'failed'
+            ? { step: 'request', reason: 'failed', error: err }
+            : { step: 'request', reason: err.outcome, error: err };
+    }
+    if (err instanceof BatchRevertedError) {
+        return {
+            step: 'request',
+            reason: 'reverted',
+            revertError: err.revertError,
+            error: err,
+        };
+    }
+    return classifyRequest(err);
 }
 // ---------------------------------------------------------------------------
 // The flow
@@ -25246,8 +26334,15 @@ class DepositFlow extends Flow {
          * A stale token simply is not the current generation.
          */
         this._acceptingFor = null;
+        /**
+         * The batch path's authorisation handshake. Same shape and lifetime as
+         * `_accept`: the run parks on it, `authoriseTransfer`, `declineTransfer`
+         * and `reset` settle it, and it is cleared the moment it settles.
+         */
+        this._authorise = null;
         this._ttlMs = (_a = opts === null || opts === void 0 ? void 0 : opts.contractTtlMs) !== null && _a !== void 0 ? _a : CONTRACT_TTL_MS;
         this._defaultSpender = opts === null || opts === void 0 ? void 0 : opts.spender;
+        this._stableAsset = opts === null || opts === void 0 ? void 0 : opts.stableAsset;
         // Called through the ports object, never captured off it: a consumer
         // whose clock is a method on its own object keeps its `this`.
         this._now = () => { var _a, _b; return (_b = (_a = _ports.now) === null || _a === void 0 ? void 0 : _a.call(_ports)) !== null && _b !== void 0 ? _b : Date.now(); };
@@ -25309,6 +26404,33 @@ class DepositFlow extends Flow {
         this._accept = null;
         bridge.settle({ kind: 'declined' });
     }
+    /**
+     * Batch path: authorise the single transaction that approves and deposits,
+     * and resume the parked run. A no-op when nothing is parked on
+     * `awaiting-authorise`, so a double tap cannot submit twice.
+     *
+     * The batch has no wallet prompt per call, so this is the lender's
+     * explicit consent to the transfer — call it only from their action.
+     */
+    authoriseTransfer() {
+        const bridge = this._authorise;
+        if (!bridge)
+            return;
+        this._authorise = null;
+        bridge.settle({ kind: 'authorised' });
+    }
+    /**
+     * Batch path: refuse the transfer. The run ends on `error` with `{ step:
+     * 'request', reason: 'cancelled' }` and nothing is submitted. A no-op when
+     * nothing is parked on `awaiting-authorise`.
+     */
+    declineTransfer() {
+        const bridge = this._authorise;
+        if (!bridge)
+            return;
+        this._authorise = null;
+        bridge.settle({ kind: 'declined' });
+    }
     /** True only while THIS generation is waiting on the acceptance signature. */
     _isAccepting() {
         return (this._acceptingFor !== null &&
@@ -25320,6 +26442,9 @@ class DepositFlow extends Flow {
         this._accept = null;
         this._acceptingFor = null;
         bridge === null || bridge === void 0 ? void 0 : bridge.settle({ kind: 'abandoned' });
+        const authorise = this._authorise;
+        this._authorise = null;
+        authorise === null || authorise === void 0 ? void 0 : authorise.settle({ kind: 'abandoned' });
     }
     // -----------------------------------------------------------------------
     _run(input, token) {
@@ -25327,6 +26452,7 @@ class DepositFlow extends Flow {
             var _a;
             this._accept = null;
             this._acceptingFor = null;
+            this._authorise = null;
             const ports = this._ports;
             const owner = input.userAddress.toLowerCase();
             // 0. The spender, from the input or from the chain config the facade
@@ -25347,21 +26473,32 @@ class DepositFlow extends Flow {
             //    live, never cached: an exact-amount approval is fully consumed by
             //    the deposit it paid for, so a stale allowance is exactly the value
             //    that would wrongly skip the approve and revert the deposit.
-            let approvalRequired = true;
+            let allowanceShort = true;
             try {
                 const allowance = yield ports.readAllowance(owner, spender);
-                approvalRequired = allowance.lt(input.amount);
+                allowanceShort = allowance.lt(input.amount);
             }
             catch (_b) {
                 // A read failure is not a reason to skip an approval. Assume one is
                 // needed: the cost is a redundant approve, the alternative is a
                 // reverted deposit.
-                approvalRequired = true;
+                allowanceShort = true;
             }
             if (!this._store.isCurrent(token))
                 return;
+            // The path is chosen HERE, with the allowance, so the badge is right
+            // from the first state the lender sees. Batch only when there is an
+            // approval to fold in, a port to submit it, and a known token to
+            // approve on — never a guessed one. A batched run never enters the
+            // `approve` step, so every badge counts it as a three-step run.
+            const stableAsset = this._stableAsset;
+            const batched = allowanceShort &&
+                typeof ports.depositBatch === 'function' &&
+                !!stableAsset;
+            const approvalRequired = allowanceShort && !batched;
             // 2. Generate — sign the auth message.
-            this._store.patch(Object.assign({ approvalRequired, phase: 'generating-sign' }, badgeFor('generate', approvalRequired)), token);
+            this._store.patch(Object.assign({ approvalRequired,
+                batched, phase: 'generating-sign' }, badgeFor('generate', approvalRequired)), token);
             const timestamp = this._now();
             const signedMessage = buildAuthMessage(input, owner, timestamp);
             let signature;
@@ -25463,6 +26600,18 @@ class DepositFlow extends Flow {
                 });
                 return;
             }
+            if (batched && stableAsset) {
+                yield this._runBatch({
+                    token,
+                    input,
+                    owner,
+                    spender,
+                    stableAsset,
+                    depositData,
+                    contract,
+                });
+                return;
+            }
             // 6. Approve — the EXACT amount, never `MaxUint256`. House rule: an
             //    unlimited allowance outlives the deposit it was granted for, and a
             //    later exploit of the spender would drain a wallet that has long
@@ -25526,6 +26675,108 @@ class DepositFlow extends Flow {
             this._store.patch(Object.assign({ phase: 'success' }, badgeFor('request', approvalRequired)), token);
         });
     }
+    /**
+     * The batch path, from the accepted agreement to the receipt.
+     *
+     * 1. PARK on `awaiting-authorise`. A batch puts no wallet prompt in front
+     *    of each call, so the flow waits for an explicit authorisation before
+     *    any money moves. `declineTransfer()` ends it as `cancelled`.
+     * 2. Re-check the TTL: the lender may have idled on the authorisation as
+     *    long as they did on the agreement.
+     * 3. Only now fetch the KYC signature — it has a block expiration of its
+     *    own, and an authorisation left open must not spend it.
+     * 4. Encode both calls and hand them to `depositBatch`; then the receipt.
+     */
+    _runBatch(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { token, input, owner, spender, stableAsset, depositData } = args;
+            const ports = this._ports;
+            // A batched run is a three-step run on every badge.
+            const approvalRequired = false;
+            // Every settler clears the handshake before settling it, so there is
+            // nothing to clear here — and clearing it anyway could drop the
+            // handshake of a NEWER run that `reset(); start()` already parked.
+            const outcome = yield new Promise((resolve) => {
+                this._authorise = { settle: resolve };
+                this._store.patch(Object.assign({ phase: 'awaiting-authorise' }, badgeFor('request', approvalRequired)), token);
+            });
+            if (!this._store.isCurrent(token))
+                return;
+            if (outcome.kind === 'declined') {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'cancelled',
+                });
+                return;
+            }
+            if (outcome.kind !== 'authorised')
+                return;
+            if (this._now() > args.contract.timestamp + this._ttlMs) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'contract-expired',
+                });
+                return;
+            }
+            this._store.patch(Object.assign({ phase: 'request-sign' }, badgeFor('request', approvalRequired)), token);
+            // The consumer's backend, so `failed` — never `cancelled` — exactly as
+            // on the two-transaction path.
+            let kyc;
+            try {
+                const kycParams = yield ports.buildKycParams(owner);
+                kyc = yield ports.getKycSignature(kycParams);
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            // Encoded from values a backend returned (the KYC signature), so a
+            // shape the coder refuses is a failure the consumer can render, not a
+            // rejection out of a `start()` that promises it has none.
+            let calls;
+            try {
+                calls = encodeDepositBatch({
+                    stableAsset,
+                    spender,
+                    input,
+                    depositData,
+                    kyc,
+                });
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            try {
+                // Called through the ports object, so a port that is a method
+                // keeps its `this`. Its presence decided the path; a consumer
+                // that removed it since gets a `failed`, not a crash.
+                if (typeof ports.depositBatch !== 'function') {
+                    throw new Error('DepositFlow: the depositBatch port is gone');
+                }
+                const tx = yield ports.depositBatch(calls);
+                this._store.patch(Object.assign({ phase: 'request-confirm' }, badgeFor('request', approvalRequired)), token);
+                yield tx.wait();
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, classifyBatch(err));
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            this._store.patch(Object.assign({ phase: 'success' }, badgeFor('request', approvalRequired)), token);
+        });
+    }
     _fail(token, approvalRequired, failure) {
         this._store.patch(Object.assign({ phase: 'error', failure }, badgeFor(failure.step, approvalRequired)), token);
     }
@@ -25572,16 +26823,50 @@ const INITIAL = {
     phase: 'idle',
     step: null,
     isMax: false,
+    sponsored: false,
     failure: null,
 };
 /** What a KYC pre-check with no `buildKycParams` to call fails with. */
 const NO_KYC_PARAMS_MESSAGE = 'WithdrawFlow: getKycSignature was supplied without buildKycParams; build the flow with kasu.flows.withdraw() or pass both';
+/** What a sponsored run with no `encodeWithdrawal` to call fails with. */
+const NO_WITHDRAWAL_ENCODER_MESSAGE = 'WithdrawFlow: submitCall was supplied without encodeWithdrawal; build the flow with kasu.flows.withdraw() or pass both';
+/** What a sponsored run fails with when the encoder returned another kind of call. */
+const NOT_A_WITHDRAWAL_CALL_MESSAGE = 'WithdrawFlow: encodeWithdrawal returned a call that is not a withdrawal';
+/**
+ * A `submitCall` / `wait()` rejection, read with the batch path's taxonomy. A
+ * submission outcome is taken at its word FIRST — never through the wallet
+ * classifier, which would read a relay's "request rejected" as the lender's
+ * own doing. Then, from `submitCall` only, a wallet rejection is `cancelled`:
+ * the lender declined to sign and nothing was posted — the same reading a raw
+ * `depositBatch` throw gets. From `wait()` the call has already left, so a
+ * rejection-worded error there is as ambiguous as any other. Everything
+ * unrecognised is `pending`: it may have left.
+ */
+function classifySponsored(err, from) {
+    if (err instanceof BatchSubmissionError) {
+        return err.outcome === 'failed'
+            ? { step: 'request', reason: 'failed', error: err }
+            : { step: 'request', reason: err.outcome, error: err };
+    }
+    if (err instanceof BatchRevertedError) {
+        return {
+            step: 'request',
+            reason: 'reverted',
+            revertError: err.revertError,
+            error: err,
+        };
+    }
+    if (from === 'submit' && isUserRejected(err)) {
+        return { step: 'request', reason: 'cancelled' };
+    }
+    return { step: 'request', reason: 'pending', error: err };
+}
 // ---------------------------------------------------------------------------
 // The flow
 // ---------------------------------------------------------------------------
 class WithdrawFlow extends Flow {
     constructor(_ports) {
-        super(INITIAL);
+        super(Object.assign(Object.assign({}, INITIAL), { sponsored: typeof _ports.submitCall === 'function' }));
         this._ports = _ports;
     }
     _run(input, token) {
@@ -25612,6 +26897,10 @@ class WithdrawFlow extends Flow {
                 if (!this._store.isCurrent(token))
                     return;
             }
+            if (ports.submitCall) {
+                yield this._runSponsored(input, token, isMax);
+                return;
+            }
             // 2. The submission. This one IS a wallet call, so it keeps the
             //    `cancelled` / `failed` split.
             this._store.patch({ phase: 'request-sign', step: 'request', isMax }, token);
@@ -25638,6 +26927,72 @@ class WithdrawFlow extends Flow {
             this._store.patch({ phase: 'success' }, token);
         });
     }
+    /**
+     * 2'. The sponsored submission: encode, re-check the run, submit, settle.
+     *
+     * The encode reads the chain (the shares), so a run abandoned during it
+     * must stop BEFORE `submitCall` — nothing has been sent yet, and an
+     * abandoned run must never send. A throw while encoding is `failed`:
+     * nothing left. After `submitCall` is called, only the taxonomy decides.
+     */
+    _runSponsored(input, token, isMax) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const ports = this._ports;
+            // Only reached when `submitCall` is supplied; narrows it for below.
+            if (!ports.submitCall)
+                return;
+            this._store.patch({ phase: 'request-sign', step: 'request', isMax }, token);
+            let call;
+            try {
+                if (!ports.encodeWithdrawal) {
+                    throw new Error(NO_WITHDRAWAL_ENCODER_MESSAGE);
+                }
+                call = yield ports.encodeWithdrawal({
+                    poolId: input.poolId,
+                    trancheId: input.trancheId,
+                    amount: input.amount,
+                    userAddress: input.userAddress,
+                });
+                if ((call === null || call === void 0 ? void 0 : call.kind) !== 'withdrawal') {
+                    throw new Error(NOT_A_WITHDRAWAL_CALL_MESSAGE);
+                }
+            }
+            catch (err) {
+                this._store.patch({
+                    phase: 'error',
+                    failure: { step: 'request', reason: 'failed', error: err },
+                }, token);
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            let tx;
+            try {
+                tx = yield ports.submitCall(call);
+            }
+            catch (err) {
+                this._store.patch({ phase: 'error', failure: classifySponsored(err, 'submit') }, token);
+                return;
+            }
+            // The call has left. A run abandoned meanwhile stops HERE, without
+            // `wait()`: nothing it could learn would be published, and a sponsored
+            // `wait()` is minutes of polling against the submitter, not a cheap
+            // receipt read. The submission itself cannot be taken back.
+            if (!this._store.isCurrent(token))
+                return;
+            this._store.patch({ phase: 'request-confirm' }, token);
+            try {
+                yield tx.wait();
+            }
+            catch (err) {
+                this._store.patch({ phase: 'error', failure: classifySponsored(err, 'wait') }, token);
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            this._store.patch({ phase: 'success' }, token);
+        });
+    }
 }
 
 /**
@@ -25678,11 +27033,26 @@ class FlowsFacade {
      * an address whose only wrong value grants an approval to the wrong
      * contract.
      */
-    _spender) {
+    _spender, 
+    /**
+     * This chain's stable token address — the target of the batch path's
+     * approve. `undefined` for a hand-built config without `stableAsset`,
+     * in which case a run never batches: it does not guess a token.
+     */
+    _stableAsset, 
+    /**
+     * This instance's call encoders — the sponsored withdraw path's
+     * default `encodeWithdrawal`. Optional so a hand-built facade keeps
+     * constructing; without it a sponsored run fails (`failed`, nothing
+     * sent) unless the consumer passes `encodeWithdrawal` itself.
+     */
+    _calls) {
         this._deposits = _deposits;
         this._erc20 = _erc20;
         this._isReadOnly = _isReadOnly;
         this._spender = _spender;
+        this._stableAsset = _stableAsset;
+        this._calls = _calls;
     }
     /**
      * A deposit pipeline. `readAllowance`, `approve`, `deposit` and
@@ -25695,9 +27065,13 @@ class FlowsFacade {
      * delete the default it was meant to keep, and
      * `approve: sponsoredGas ? sponsoredApprove : undefined` is exactly how a
      * consumer writes a conditional override.
+     *
+     * `depositBatch` has NO default: how several calls become one atomic
+     * transaction is the application's business. Supplying it lets a run
+     * whose allowance is short approve and deposit in one batch.
      */
     deposit(ports, opts) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         return new DepositFlow({
             signMessage: ports.signMessage,
             generateContract: ports.generateContract,
@@ -25712,21 +27086,26 @@ class FlowsFacade {
                 return yield this._erc20().approve(spender, amount);
             })),
             deposit: (_d = ports.deposit) !== null && _d !== void 0 ? _d : ((params) => this._deposits.deposit(params)),
+            depositBatch: ports.depositBatch,
             now: ports.now,
         }, {
             contractTtlMs: opts === null || opts === void 0 ? void 0 : opts.contractTtlMs,
             // Per key here too, for the same reason the ports are: an
             // explicit `spender: undefined` must not delete the default.
             spender: (_e = opts === null || opts === void 0 ? void 0 : opts.spender) !== null && _e !== void 0 ? _e : this._spender,
+            stableAsset: (_f = opts === null || opts === void 0 ? void 0 : opts.stableAsset) !== null && _f !== void 0 ? _f : this._stableAsset,
         });
     }
     /**
      * A withdrawal pipeline. Both write ports and `buildKycParams` default to
      * this instance; supplying `getKycSignature` turns the KYC pre-check on.
+     * Supplying `submitCall` turns the sponsored path on, and its encoder
+     * defaults to `kasu.calls.requestWithdrawal` on this instance — which
+     * reads, never writes, so it works on a read-only instance too.
      * Defaults are applied per key, for the reason `deposit()` gives.
      */
     withdraw(ports = {}) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         return new WithdrawFlow({
             buildKycParams: (_a = ports.buildKycParams) !== null && _a !== void 0 ? _a : ((userAddress) => this._deposits.buildKycParams(userAddress)),
             getKycSignature: ports.getKycSignature,
@@ -25736,8 +27115,17 @@ class FlowsFacade {
                 amount: params.amount,
             })),
             withdrawMax: (_c = ports.withdrawMax) !== null && _c !== void 0 ? _c : ((poolId, trancheId, userAddress) => this._deposits.withdrawMax(poolId, trancheId, userAddress)),
+            submitCall: ports.submitCall,
+            encodeWithdrawal: (_d = ports.encodeWithdrawal) !== null && _d !== void 0 ? _d : this._defaultEncoder(),
         });
     }
+    /** `kasu.calls.requestWithdrawal`, when this facade was given the encoders. */
+    _defaultEncoder() {
+        const calls = this._calls;
+        if (!calls)
+            return undefined;
+        return (params) => calls.requestWithdrawal(params);
+    }
     _assertWritable() {
         if (this._isReadOnly) {
             throw new Error(READ_ONLY_MESSAGE);
@@ -26032,9 +27420,72 @@ function maxNetRateCeiling(pools, feePercent) {
  * Handles epoch fetching internally so callers never need to know about epochs.
  */
 class StrategiesFacade {
-    constructor(_dataService, _userLending) {
+    constructor(_dataService, _userLending, 
+    /**
+     * Chain pool id → the pool id its CMS record is keyed by (XDC pools
+     * share their Base counterpart's editorial record). Lowercase keys.
+     */
+    _poolMetadataMapping = {}) {
         this._dataService = _dataService;
         this._userLending = _userLending;
+        this._poolMetadataMapping = _poolMetadataMapping;
+    }
+    /**
+     * The pool's loss rate and first-loss capital, from its CMS
+     * risk-management record. `null` when the pool has no record.
+     *
+     * Each figure is a NUMBER or `null` — never a guess. The CMS returns
+     * "numeric" fields as a number, a numeric string, an empty string or
+     * null, and an empty string must not become a confident `0`: anything that
+     * is not a finite number reads as `null` (render "—"). `poolLossRate` is a
+     * 0..1 fraction.
+     *
+     * Requires `directusUrl`; without it the call rejects with
+     * `NO_DIRECTUS_URL_MESSAGE`, like every CMS-only read.
+     */
+    getRiskPerformance(poolId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const metadataId = this._metadataIdOf(poolId);
+            const records = yield this._dataService.getRiskManagement();
+            const record = records.find((r) => String(r.poolIdFK).toLowerCase() === metadataId);
+            if (!record)
+                return null;
+            const performance = record.riskPerformance;
+            return {
+                poolLossRate: finiteOrNull(performance === null || performance === void 0 ? void 0 : performance.poolLossRate),
+                firstLossCapital: finiteOrNull(performance === null || performance === void 0 ? void 0 : performance.firstLossCapital),
+            };
+        });
+    }
+    /**
+     * The credit originator's profile and lending history for a pool — the
+     * CMS record whose `otherKASUPools` lists it. `null` when none does.
+     *
+     * Matched on the chain pool id, then on its metadata id, case-
+     * insensitively. The record is returned as the service maps it; its
+     * numeric fields are CMS-authored, so read them defensively.
+     *
+     * The service filters `otherKASUPools` through the CURRENT chain's
+     * subgraph with the CMS record's (Base-keyed) ids, so on an XDC
+     * deployment every profile lists no pools and this resolves `null` —
+     * the same answer kasu-ui's own lookup gives there today. The metadata
+     * candidate becomes live once the service resolves the mapping.
+     */
+    getOriginator(poolId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const candidates = new Set([
+                poolId.toLowerCase(),
+                this._metadataIdOf(poolId),
+            ]);
+            const profiles = yield this._dataService.getPoolDelegateProfileAndHistory();
+            return ((_a = profiles.find((profile) => profile.otherKASUPools.some((pool) => candidates.has(String(pool.id).toLowerCase())))) !== null && _a !== void 0 ? _a : null);
+        });
+    }
+    _metadataIdOf(poolId) {
+        var _a;
+        const lower = poolId.toLowerCase();
+        return ((_a = this._poolMetadataMapping[lower]) !== null && _a !== void 0 ? _a : lower).toLowerCase();
     }
     /**
      * Fetch all active lending strategies.
@@ -26113,9 +27564,7 @@ class StrategiesFacade {
      */
     calculateDepositLimits(tranche) {
         const raw = tranche._raw;
-        const min = parseFloat(raw.minimumDeposit) < 1
-            ? '1'
-            : raw.minimumDeposit;
+        const min = parseFloat(raw.minimumDeposit) < 1 ? '1' : raw.minimumDeposit;
         const max = parseFloat(raw.maximumDeposit) > parseFloat(raw.poolCapacity)
             ? raw.poolCapacity
             : raw.maximumDeposit;
@@ -26163,14 +27612,146 @@ class StrategiesFacade {
         };
     }
 }
+/**
+ * A CMS "numeric" field as a finite number, or `null`. An empty or blank
+ * string is UNAUTHORED, not zero.
+ */
+function finiteOrNull(value) {
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : null;
+    if (typeof value === 'string') {
+        if (value.trim() === '')
+            return null;
+        const numeric = Number(value);
+        return Number.isFinite(numeric) ? numeric : null;
+    }
+    return null;
+}
+
+var UserRequestStatus;
+(function (UserRequestStatus) {
+    UserRequestStatus["REQUESTED"] = "Requested";
+    UserRequestStatus["PROCESSING"] = "Processing";
+    UserRequestStatus["PROCESSED"] = "Processed";
+})(UserRequestStatus || (UserRequestStatus = {}));
+
+/**
+ * Cycles and the clearing window — the protocol's weekly clock, as numbers.
+ *
+ * Lifted verbatim from kasu-ui's `features/portfolio/lib/settlement-window.ts`
+ * and `features/lending/lib/cycle-dates.ts`. The two formatters that live
+ * beside `deriveCycleDates` there (`formatCycleDate`, `formatCycleCloseUtc`)
+ * print words and stay in the applications; everything here is unix seconds in
+ * and unix seconds out.
+ *
+ * The clearing window is the fixed 48 hours immediately preceding an epoch
+ * end. Inside it, pending requests are being processed and cannot be modified,
+ * and the countdown runs to the epoch end. Outside it, the countdown runs to
+ * the next clearing-window start.
+ *
+ * The epoch end comes straight from the chain (`nextEpochStartTimestamp`, i.e.
+ * the SDK's `getNextEpochDate`) — the same value the protocol's own
+ * `getNextClearingPeriodDate` derives from — so the window always lines up
+ * with the real weekly schedule (Tue 06:00 → Thu 06:00 UTC on Base) instead of
+ * a projected subgraph timestamp that can drift off the grid.
+ */
+/**
+ * Clearing-window length — a fixed 48h protocol constant. Exported so every
+ * consumer derives the window from the same number this module runs on.
+ */
+const CLEARING_WINDOW_SECONDS = 48 * 60 * 60;
+/**
+ * Weekly cadence — the epoch schedule is fixed weekly (Tue → Thu UTC on Base).
+ * Used only to roll a cycle forward when a request lands inside a window that
+ * has already closed.
+ */
+const WEEK_SECONDS = 7 * 24 * 60 * 60;
+/**
+ * Which phase of the weekly cycle `nowSeconds` falls in, and how long is left
+ * of it.
+ *
+ * `'unknown'` when no epoch boundary has been loaded yet, or when the one on
+ * hand is stale (it has already elapsed — the on-chain value refetches to the
+ * next boundary shortly after rollover). A caller must render its "no cycle
+ * loaded" state there, never a zeroed countdown.
+ */
+function computeSettlementWindow({ nowSeconds, nextEpochStart, clearingWindowSeconds = CLEARING_WINDOW_SECONDS, }) {
+    // No epoch boundary loaded yet, or a stale one that already elapsed.
+    if (nextEpochStart <= 0 || nextEpochStart <= nowSeconds) {
+        return { phase: 'unknown' };
+    }
+    const clearingStart = nextEpochStart - clearingWindowSeconds;
+    if (nowSeconds < clearingStart) {
+        return {
+            phase: 'awaiting',
+            secondsUntilClearing: clearingStart - nowSeconds,
+            nextClearingStart: clearingStart,
+        };
+    }
+    // nowSeconds is in [clearingStart, nextEpochStart) — inside the window.
+    return {
+        phase: 'clearing',
+        secondsUntilEpochEnd: nextEpochStart - nowSeconds,
+        epochEnd: nextEpochStart,
+    };
+}
+/**
+ * The next cycle boundary strictly after `nowSeconds`, in unix seconds — the
+ * cycle close (`nextEpochStart − 48h`) while the window is still open, the
+ * epoch end once we are inside it.
+ *
+ * `undefined` when there is no boundary left to wait for: no epoch boundary
+ * loaded, or a cached one that has already elapsed — the same staleness rule
+ * `computeSettlementWindow` applies before it reports `'unknown'`.
+ *
+ * Split out of the state machine because some consumers need the INSTANT
+ * rather than the phase: one to flush the cycle-dependent caches when the
+ * clock crosses it, one to move a pre-commit screen's snapshot clock at the
+ * same moment.
+ */
+function nextCycleBoundary(nextEpochStart, nowSeconds, clearingWindowSeconds = CLEARING_WINDOW_SECONDS) {
+    if (!nextEpochStart || nextEpochStart <= 0)
+        return undefined;
+    const clearingStart = nextEpochStart - clearingWindowSeconds;
+    if (nowSeconds < clearingStart)
+        return clearingStart;
+    if (nowSeconds < nextEpochStart)
+        return nextEpochStart;
+    return undefined;
+}
+/**
+ * The cycle-close and outcome dates for a request submitted `now`.
+ *
+ * - The cycle "closes" (stops accepting requests, starts processing) at the
+ *   start of the 48h clearing window, i.e. 48h before the epoch end.
+ * - Processing takes up to 48h, so the outcome is confirmed by the epoch end
+ *   (close + 48h).
+ *
+ * Returns `null` when the epoch boundary is not available or is stale — a
+ * caller then omits the dates entirely (omit, don't stub).
+ *
+ * The common case is a request submitted OUTSIDE the clearing window: the
+ * close is `nextEpochStart − 48h` and the outcome is `nextEpochStart`. When
+ * the request lands INSIDE the current clearing window (that close is already
+ * in the past), it queues for the NEXT weekly cycle, so the close is advanced
+ * by whole weeks until it is in the future.
+ */
+function deriveCycleDates(nextEpochStart, nowSeconds) {
+    // No boundary loaded, or a stale one that already elapsed — the same
+    // staleness rule as `computeSettlementWindow`.
+    if (!nextEpochStart || nextEpochStart <= nowSeconds)
+        return null;
+    let close = nextEpochStart - CLEARING_WINDOW_SECONDS;
+    let outcome = nextEpochStart;
+    // Inside the current clearing window the close already passed; a request
+    // now is queued for the next weekly cycle.
+    while (close <= nowSeconds) {
+        close += WEEK_SECONDS;
+        outcome += WEEK_SECONDS;
+    }
+    return { close, outcome };
+}
 
-var UserRequestStatus;
-(function (UserRequestStatus) {
-    UserRequestStatus["REQUESTED"] = "Requested";
-    UserRequestStatus["PROCESSING"] = "Processing";
-    UserRequestStatus["PROCESSED"] = "Processed";
-})(UserRequestStatus || (UserRequestStatus = {}));
-
 /**
  * Events that represent a lender SUBMISSION into the bundle. A dNFT position
  * aggregates every submission the lender made into the same pool/tranche this
@@ -26231,6 +27812,38 @@ function lastEventTimestamp(events, fallback) {
 function isCycleClosed(request) {
     return !request.canCancel;
 }
+/**
+ * Until when can THIS request still be cancelled? — unix seconds, or `null`
+ * when it cannot be cancelled at all, or when no epoch boundary is loaded.
+ *
+ * The answer is the next cycle close (`deriveCycleDates(...).close`): the
+ * clearing window opens there, and the contract refuses a cancel while the
+ * pool's clearing is pending (`CannotCancelRequestIfClearingIsPending`).
+ * Inside a window whose clearing already ENDED, a still-cancellable request is
+ * queued for the next cycle, so its deadline is next week's close — which is
+ * exactly what `deriveCycleDates` rolls forward to.
+ *
+ * `null` unless the request is BOTH:
+ *
+ * - `canCancel` — the SDK's per-pool signal (see `isCycleClosed`);
+ * - live: `statusCode` `pending`, or `partial` (a partly-filled withdrawal
+ *   whose remainder is back in the queue — a resolved partial has
+ *   `canCancel: false`). A cancelled, forced, reallocated, rejected or complete
+ *   request has nothing left to cancel, whatever `canCancel` says.
+ *
+ * `canCancel` is read ONCE, when the request was fetched. A request held
+ * across a cycle boundary (`nextCycleBoundary`) must be refetched before this
+ * is shown again — the deadline is a hint, the contract is the gate.
+ */
+function cancelDeadline(request, nextEpochStart, nowSeconds) {
+    var _a, _b;
+    if (!request.canCancel)
+        return null;
+    if (request.statusCode !== 'pending' && request.statusCode !== 'partial') {
+        return null;
+    }
+    return (_b = (_a = deriveCycleDates(nextEpochStart, nowSeconds)) === null || _a === void 0 ? void 0 : _a.close) !== null && _b !== void 0 ? _b : null;
+}
 const isCancelled = (events) => events.some((e) => e.requestType === 'Cancelled');
 const isForced = (events) => events.some((e) => e.requestType === 'Forced');
 const initiatedEvent = (events) => events.find((e) => e.requestType === 'Initiated');
@@ -26457,8 +28070,8 @@ class PortfolioFacade {
 /**
  * High-level entry point for external integrators.
  *
- * Provides four domain facades — `strategies`, `deposits`, `portfolio`,
- * `flows` — and exposes the underlying `KasuSdk` services via `.services` for
+ * Provides five domain facades — `strategies`, `deposits`, `portfolio`,
+ * `flows`, `calls` — and exposes the underlying `KasuSdk` services via `.services` for
  * power-users.
  *
  * ```ts
@@ -26478,18 +28091,22 @@ class PortfolioFacade {
  */
 class Kasu {
     constructor(sdk, chainConfig, signerOrProvider, configOverrides) {
+        var _a, _b;
         this._sdk = sdk;
         this._chainConfig = chainConfig;
         this._signerOrProvider = signerOrProvider;
         this._configOverrides = configOverrides;
-        this.strategies = new StrategiesFacade(sdk.DataService, sdk.UserLending);
+        this.strategies = new StrategiesFacade(sdk.DataService, sdk.UserLending, normaliseMapping((_a = configOverrides.poolMetadataMapping) !== null && _a !== void 0 ? _a : chainConfig.poolMetadataMapping));
         // Derived ONCE and handed to every facade that needs it. Each of them
         // re-deriving `Signer.isSigner` is how two facades come to disagree
         // about whether the same instance can write.
         const isReadOnly = !Signer.isSigner(signerOrProvider);
         this.deposits = new DepositsFacade(sdk.UserLending, chainConfig.chainId.toString(), isReadOnly);
         this.portfolio = new PortfolioFacade(sdk.DataService, sdk.UserLending, sdk.Portfolio);
-        this.flows = new FlowsFacade(this.deposits, () => erc20Of(chainConfig, signerOrProvider), isReadOnly, chainConfig.contracts.LendingPoolManager);
+        // The same `LendingPoolManager` the deposit flow approves and calls:
+        // the chain config's, which is what a relay allow-lists `to` against.
+        this.calls = new CallsFacade(sdk.UserLending, chainConfig.contracts.LendingPoolManager);
+        this.flows = new FlowsFacade(this.deposits, () => erc20Of(chainConfig, signerOrProvider), isReadOnly, chainConfig.contracts.LendingPoolManager, (_b = stableAssetOf(chainConfig)) === null || _b === void 0 ? void 0 : _b.address, this.calls);
     }
     /**
      * Create a Kasu instance with built-in chain config.
@@ -26674,6 +28291,14 @@ function resolveChainConfig(chain) {
     }
     return chain;
 }
+/** Lowercase both sides, so a lookup by any casing of a pool id matches. */
+function normaliseMapping(mapping) {
+    const out = {};
+    for (const [from, to] of Object.entries(mapping !== null && mapping !== void 0 ? mapping : {})) {
+        out[from.toLowerCase()] = to.toLowerCase();
+    }
+    return out;
+}
 
 /** Directus instance holding Kasu's pool editorial content. */
 const DEFAULT_DIRECTUS_URL = 'https://kasu-finance.directus.app/';
@@ -26961,17 +28586,143 @@ function ceilToCents(n) {
     return snapped < n ? (k + 1) / CENTS : snapped;
 }
 
+const TX_HASH = /^0x[0-9a-fA-F]{64}$/;
+const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+/** `https://host[:port][/path]`, no query, fragment, credentials or space. */
+const HTTPS_BASE = /^https:\/\/[A-Za-z0-9.-]+(:[0-9]{1,5})?(\/[A-Za-z0-9._~\-/]*)?$/;
+function explorerBase(config) {
+    // Read defensively: a custom config written before 2.10.0 has no field,
+    // and TypeScript only tells its author once they bump.
+    const base = config === null || config === void 0 ? void 0 : config.blockExplorerUrl;
+    if (typeof base !== 'string' || !HTTPS_BASE.test(base)) {
+        throw new Error('explorer url: the chain config has no valid https blockExplorerUrl');
+    }
+    return base.replace(/\/+$/, '');
+}
+/**
+ * `<blockExplorerUrl>/tx/<txHash>`. Throws unless `txHash` is exactly `0x`
+ * followed by 64 hex digits.
+ */
+function explorerTxUrl(config, txHash) {
+    if (typeof txHash !== 'string' || !TX_HASH.test(txHash)) {
+        throw new Error('explorerTxUrl: not a 32-byte 0x-prefixed hex hash');
+    }
+    return `${explorerBase(config)}/tx/${txHash}`;
+}
+/**
+ * `<blockExplorerUrl>/address/<address>`, the address as given. Throws unless
+ * `address` is `0x` followed by 40 hex digits with a valid checksum when it
+ * is mixed-case (all-lower and all-upper carry no checksum and are accepted).
+ */
+function explorerAddressUrl(config, address) {
+    if (typeof address !== 'string' ||
+        !ADDRESS.test(address) ||
+        !utils$2.isAddress(address)) {
+        throw new Error('explorerAddressUrl: not a valid 0x-prefixed address');
+    }
+    return `${explorerBase(config)}/address/${address}`;
+}
+
+/**
+ * One epoch's nominal length in days. A lock is counted in epochs, and the
+ * loan-agreement text states its term from the same 7-day epoch.
+ */
+const DAYS_PER_EPOCH = 7;
+/**
+ * The average calendar month, 365.25 / 12. A lock is counted in epochs, so a
+ * "12-month" term is 52 epochs = 364 days, and only the average-month divisor
+ * lands that on 12 (364 / 30.4375 = 11.96 → 12).
+ */
+const DAYS_PER_MONTH = 30.4375;
+/**
+ * The shortest lock stated in months. Below it a term reads in weeks or days,
+ * so nothing may claim a month count for it — a 3-epoch lock is 21 days, which
+ * the average-month divisor would otherwise round UP to one month.
+ */
+const MIN_DAYS_FOR_MONTHS = 30;
+/**
+ * `'0'`, empty or absent is the variable-rate sentinel, not a fixed term.
+ * Every surface that tags a rate "variable" or "fixed" must derive the tag
+ * through this, so no screen can hardcode a tag that contradicts the rate
+ * beside it.
+ */
+function isFixedTermConfigId(configId) {
+    if (configId == null)
+        return false;
+    const trimmed = configId.trim();
+    return trimmed !== '' && trimmed !== '0';
+}
+/**
+ * The fixed-term configs this wallet may actually select on a tranche: a
+ * config open to `Everyone`, or an `AllowlistedOnly` config whose allowlist
+ * names the wallet. Anything else is dropped (hide-ineligible): the contract
+ * refuses a deposit into an allowlisted config from a wallet that is not on
+ * it, so offering one is offering a transaction that reverts.
+ *
+ * Address matching is case-insensitive. An allowlist entry whose
+ * `isAllowlisted` is `false` is a wallet that was REMOVED — the subgraph keeps
+ * the entity and flips the flag — so it does not count. An entry that carries
+ * no flag at all counts by its presence, which is how every entry read before
+ * 2.9.0 arrived (the query did not select the field).
+ *
+ * `address` `null` / `undefined` — no wallet yet — sees only the `Everyone`
+ * configs. Order is the tranche's own.
+ */
+function availableFixedTermConfigs(tranche, address) {
+    if (!tranche)
+        return [];
+    const lower = address === null || address === void 0 ? void 0 : address.toLowerCase();
+    return tranche.fixedTermConfig.filter((config) => config.fixedTermDepositStatus === 'Everyone' ||
+        (lower != null &&
+            lower !== '' &&
+            config.fixedTermDepositAllowlist.some((entry) => entry.isAllowlisted !==
+                false && entry.userId.toLowerCase() === lower)));
+}
+/**
+ * A lock's length in days: `epochLockDuration × 7`.
+ *
+ * FAILS CLOSED: an unparseable, non-finite, zero or negative epoch count
+ * returns `NaN`, never `0` — a zero-day lock is not a term, and a consumer
+ * that rendered it would state one.
+ *
+ * @param epochLockDuration the config's `epochLockDuration`, a decimal string.
+ */
+function lockDurationDays(epochLockDuration) {
+    const epochs = parseFloat(epochLockDuration);
+    if (!Number.isFinite(epochs) || epochs <= 0)
+        return NaN;
+    return epochs * DAYS_PER_EPOCH;
+}
+/**
+ * A lock in WHOLE months, or `null` when the epoch count is not a positive
+ * number or the lock is shorter than `MIN_DAYS_FOR_MONTHS`.
+ *
+ * Unlike a year-rounding formatter it never rolls up into years: a 104-epoch
+ * lock is 24 months. A consumer that states years does that conversion in its
+ * own words.
+ */
+function lockDurationMonths(epochLockDuration) {
+    const days = lockDurationDays(epochLockDuration);
+    if (Number.isNaN(days) || days < MIN_DAYS_FOR_MONTHS)
+        return null;
+    const months = Math.round(days / DAYS_PER_MONTH);
+    return months > 0 ? months : null;
+}
+
 const APXIUM = {
     name: 'Apxium',
     url: 'https://www.apxium.com/',
+    region: 'Australia',
 };
 const INVOICEMATE = {
     name: 'InvoiceMate',
     url: 'https://invoicemate.net/',
+    region: 'Global',
 };
 const RIXON_CAPITAL = {
     name: 'Rixon Capital',
     url: 'https://rixon.capital/',
+    region: 'Australia',
 };
 function poolNameOf(pool) {
     var _a, _b;
@@ -27003,122 +28754,22 @@ function getCreditOriginator(pool) {
 function getInstitutionalLender(originator) {
     return originator.name === APXIUM.name ? RIXON_CAPITAL : null;
 }
-
-/**
- * Cycles and the clearing window — the protocol's weekly clock, as numbers.
- *
- * Lifted verbatim from kasu-ui's `features/portfolio/lib/settlement-window.ts`
- * and `features/lending/lib/cycle-dates.ts`. The two formatters that live
- * beside `deriveCycleDates` there (`formatCycleDate`, `formatCycleCloseUtc`)
- * print words and stay in the applications; everything here is unix seconds in
- * and unix seconds out.
- *
- * The clearing window is the fixed 48 hours immediately preceding an epoch
- * end. Inside it, pending requests are being processed and cannot be modified,
- * and the countdown runs to the epoch end. Outside it, the countdown runs to
- * the next clearing-window start.
- *
- * The epoch end comes straight from the chain (`nextEpochStartTimestamp`, i.e.
- * the SDK's `getNextEpochDate`) — the same value the protocol's own
- * `getNextClearingPeriodDate` derives from — so the window always lines up
- * with the real weekly schedule (Tue 06:00 → Thu 06:00 UTC on Base) instead of
- * a projected subgraph timestamp that can drift off the grid.
- */
-/**
- * Clearing-window length — a fixed 48h protocol constant. Exported so every
- * consumer derives the window from the same number this module runs on.
- */
-const CLEARING_WINDOW_SECONDS = 48 * 60 * 60;
-/**
- * Weekly cadence — the epoch schedule is fixed weekly (Tue → Thu UTC on Base).
- * Used only to roll a cycle forward when a request lands inside a window that
- * has already closed.
- */
-const WEEK_SECONDS = 7 * 24 * 60 * 60;
-/**
- * Which phase of the weekly cycle `nowSeconds` falls in, and how long is left
- * of it.
- *
- * `'unknown'` when no epoch boundary has been loaded yet, or when the one on
- * hand is stale (it has already elapsed — the on-chain value refetches to the
- * next boundary shortly after rollover). A caller must render its "no cycle
- * loaded" state there, never a zeroed countdown.
- */
-function computeSettlementWindow({ nowSeconds, nextEpochStart, clearingWindowSeconds = CLEARING_WINDOW_SECONDS, }) {
-    // No epoch boundary loaded yet, or a stale one that already elapsed.
-    if (nextEpochStart <= 0 || nextEpochStart <= nowSeconds) {
-        return { phase: 'unknown' };
-    }
-    const clearingStart = nextEpochStart - clearingWindowSeconds;
-    if (nowSeconds < clearingStart) {
-        return {
-            phase: 'awaiting',
-            secondsUntilClearing: clearingStart - nowSeconds,
-            nextClearingStart: clearingStart,
-        };
-    }
-    // nowSeconds is in [clearingStart, nextEpochStart) — inside the window.
-    return {
-        phase: 'clearing',
-        secondsUntilEpochEnd: nextEpochStart - nowSeconds,
-        epochEnd: nextEpochStart,
-    };
-}
-/**
- * The next cycle boundary strictly after `nowSeconds`, in unix seconds — the
- * cycle close (`nextEpochStart − 48h`) while the window is still open, the
- * epoch end once we are inside it.
- *
- * `undefined` when there is no boundary left to wait for: no epoch boundary
- * loaded, or a cached one that has already elapsed — the same staleness rule
- * `computeSettlementWindow` applies before it reports `'unknown'`.
- *
- * Split out of the state machine because some consumers need the INSTANT
- * rather than the phase: one to flush the cycle-dependent caches when the
- * clock crosses it, one to move a pre-commit screen's snapshot clock at the
- * same moment.
- */
-function nextCycleBoundary(nextEpochStart, nowSeconds, clearingWindowSeconds = CLEARING_WINDOW_SECONDS) {
-    if (!nextEpochStart || nextEpochStart <= 0)
-        return undefined;
-    const clearingStart = nextEpochStart - clearingWindowSeconds;
-    if (nowSeconds < clearingStart)
-        return clearingStart;
-    if (nowSeconds < nextEpochStart)
-        return nextEpochStart;
-    return undefined;
-}
 /**
- * The cycle-close and outcome dates for a request submitted `now`.
- *
- * - The cycle "closes" (stops accepting requests, starts processing) at the
- *   start of the 48h clearing window, i.e. 48h before the epoch end.
- * - Processing takes up to 48h, so the outcome is confirmed by the epoch end
- *   (close + 48h).
- *
- * Returns `null` when the epoch boundary is not available or is stale — a
- * caller then omits the dates entirely (omit, don't stub).
- *
- * The common case is a request submitted OUTSIDE the clearing window: the
- * close is `nextEpochStart − 48h` and the outcome is `nextEpochStart`. When
- * the request lands INSIDE the current clearing window (that close is already
- * in the past), it queues for the NEXT weekly cycle, so the close is advanced
- * by whole weeks until it is in the future.
+ * The strategy's region — `'Australia'` for the Apxium family, `'Global'` for
+ * PayFi — derived from its credit originator, exactly as every surface that
+ * states a region must derive it.
+ *
+ * LOAD-BEARING ON THE MONEY PATH: this is the `region` a lender's wallet signs
+ * in the loan-agreement message (`buildLoanAgreementSignMessage`). The backend
+ * rebuilds that message from whatever region the client sends and treats it
+ * as display-only, so nothing but this function keeps the signed word equal to
+ * the word on screen. Never state a region from a constant — that is how a
+ * PayFi lender came to pick "Global · Junior" and sign "Australia".
+ *
+ * Replace the inference with a per-pool field (in the SDK) when one ships.
  */
-function deriveCycleDates(nextEpochStart, nowSeconds) {
-    // No boundary loaded, or a stale one that already elapsed — the same
-    // staleness rule as `computeSettlementWindow`.
-    if (!nextEpochStart || nextEpochStart <= nowSeconds)
-        return null;
-    let close = nextEpochStart - CLEARING_WINDOW_SECONDS;
-    let outcome = nextEpochStart;
-    // Inside the current clearing window the close already passed; a request
-    // now is queued for the next weekly cycle.
-    while (close <= nowSeconds) {
-        close += WEEK_SECONDS;
-        outcome += WEEK_SECONDS;
-    }
-    return { close, outcome };
+function getStrategyRegion(pool) {
+    return getCreditOriginator(pool).region;
 }
 
 // Business rename (2026-07): Apxium strategies market their top retail tranche
@@ -27150,4 +28801,155 @@ function getTrancheDisplayName(trancheName, pool) {
         : trancheName;
 }
 
-export { APXIUM, AU_ALPHA3, AU_MIN_CUMULATIVE_BY_STABLE, CHAIN_CONFIGS, CLEARING_WINDOW_SECONDS, CONTRACT_TTL_MS, DepositFlow, DepositsFacade, EPOCHS_IN_YEAR, Flow, FlowStore, FlowsFacade, INVALID_ACCEPTANCE_SIGNATURE_MESSAGE, INVALID_AUTH_SIGNATURE_MESSAGE, INVOICEMATE, Kasu, KasuSdk, MAX_LENDING_AMOUNT_FALLBACK, MIN_LENDING_AMOUNT_FALLBACK, MIN_TRANCHE_CAPACITY, NO_DIRECTUS_URL_MESSAGE, NO_KYC_PARAMS_MESSAGE, NO_SPENDER_MESSAGE, PortfolioFacade, READ_ONLY_MESSAGE, RIXON_CAPITAL, SdkConfig, StrategiesFacade, UPPER_MEZZANINE, WithdrawFlow, apyToEpochRate, asContractType, auMinimumRemaining, auThresholdFor, buildContractVersionType, buildFullNameRequestMessage, buildLegacyContractRequestMessage, buildLoanAgreementSignMessage, ceilToCents, classifyWalletFailure, compareTrancheSeniority, computeSettlementWindow, countSubmissions, decodeRevert, deriveCycleDates, derivePoolStatus, deriveRequestState, encodeDepositData, epochRateToApy, extractRevertData, fetchUnusedPoolIds, firstSubmissionTimestamp, floorToCents, formatSignTimestampUtc, getCreditOriginator, getInstitutionalLender, getTrancheDisplayName, isAuMinimumExempt, isAustralianKyc, isBelowMinimumCapacity, isCycleClosed, isUnpredictableGas, isUserRejected, lastEventTimestamp, maxNetRateCeiling, netEffectiveApy, netTrancheApyBounds, nextCycleBoundary, parseFormattedMessage, parseMinorUnits, parseTrancheBound, pickDefaultTrancheId, pickHighestYieldTranche, poolAllTranchesFull, poolMaxApy, resolveBoundShortcuts, resolveDepositBounds, selectVisiblePools, submissionEvents, trancheApyBounds, trancheHasCapacity, trancheRiskRank };
+/**
+ * Forward-looking interest on a lender's CURRENT balances — the figures a
+ * portfolio shows as "weekly", "daily" and the moving part of "lifetime"
+ * interest, and the "≈ $Y a year" line beside a lend amount.
+ *
+ * Every figure is NET of the platform performance fee, the way the chain
+ * credits it: `LendingPool._applyTrancheInterest` mints the lender
+ * `interest × (1 − performanceFee)` at each cycle close, and only that net
+ * amount ever reaches the balance. A gross projection would out-run what the
+ * next close actually credits.
+ *
+ * Units: balances and results are display units of the deployment's stable
+ * asset (not base units); rates are 0..1 fractions; `feePercent` is a
+ * PERCENTAGE IN 0..100 — see `netEffectiveApy`.
+ */
+/**
+ * Seconds in one epoch's nominal week. The per-epoch rate covers exactly this
+ * window, and the accrual spreads an epoch's interest across it.
+ */
+const SECONDS_PER_WEEK = 604800;
+function isUsableFeePercent(feePercent) {
+    return (feePercent !== null &&
+        Number.isFinite(feePercent) &&
+        feePercent >= 0 &&
+        feePercent <= 100);
+}
+/**
+ * Interest the slices accrue over ONE epoch, net of the fee.
+ *
+ * ```
+ * weekly = Σ(slice.balance × slice.epochRate) × (1 − feePercent / 100)
+ * ```
+ *
+ * **The rate is the raw per-epoch one, never the APY.** An APY is that rate
+ * already compounded over `EPOCHS_IN_YEAR`; dividing it by 365 charges a day
+ * of compounded annual growth to a single day and overstates it.
+ *
+ * FAILS CLOSED, returning `null` rather than a wrong number:
+ * - a `null`, non-finite or out-of-domain fee — a fee-less projection dressed
+ *   up as the lender's net earnings is the failure this guards;
+ * - any slice with a POSITIVE balance and a non-finite rate — skipping it
+ *   would return a silently partial total, quietly missing that slice.
+ *
+ * Non-finite and non-positive BALANCES are skipped: a slice with nothing in it
+ * earns nothing whatever its rate, so it cannot hide earnings. A portfolio
+ * with nothing lent is therefore a legitimate `0`, never `null`.
+ */
+function weeklyInterest(slices, feePercent) {
+    if (!isUsableFeePercent(feePercent))
+        return null;
+    let gross = 0;
+    for (const slice of slices) {
+        if (!Number.isFinite(slice.balance) || slice.balance <= 0)
+            continue;
+        if (!Number.isFinite(slice.epochRate))
+            return null;
+        gross += slice.balance * slice.epochRate;
+    }
+    return gross * (1 - feePercent / 100);
+}
+/**
+ * A day's share of the epoch's net interest: a seventh of it, NOT a
+ * de-compounded daily rate. The chain mints interest once per epoch, so
+ * nothing compounds within the cycle and the accrual is linear across it.
+ *
+ * Fails closed with its input: `null` or non-finite → `null`.
+ */
+function dailyInterest(weekly) {
+    if (weekly === null || !Number.isFinite(weekly))
+        return null;
+    return weekly / 7;
+}
+/**
+ * Interest accrued since each pool's OWN last cycle close — the moving part
+ * of lifetime interest (lifetime = settled on chain + this).
+ *
+ * ```
+ * accrued = Σ_pool  weekly_pool × clamp(now − clearing_pool, 0, 604 800) / 604 800
+ * ```
+ *
+ * **Per pool, because pools clear independently.** One shared anchor accrues
+ * a stale pool's share from a close it never had, and when another pool
+ * clears it drops the total by the stale pool's whole weekly share. Anchored
+ * per pool, the total is monotonic across any single pool's clearing: that
+ * pool swaps its accrued share for a capitalised one, and no other term moves.
+ *
+ * **The one-epoch cap is load-bearing.** Clearings are not exactly weekly,
+ * and `weeklyInterest` is per EPOCH, so extrapolating past seven days would
+ * promise interest the close will not credit; a late clearing under-reports
+ * instead. The low clamp makes a close ahead of the local clock zero, never
+ * negative.
+ *
+ * A non-finite term contributes nothing; a non-finite `nowSeconds` accrues
+ * nothing. Callers fail closed upstream by not offering an accrual for a pool
+ * whose weekly interest or anchor is unknown.
+ */
+function accruedInterest(accruals, nowSeconds) {
+    if (!Number.isFinite(nowSeconds))
+        return 0;
+    let accrued = 0;
+    for (const { weeklyInterest: weekly, clearingTimestamp } of accruals) {
+        if (!Number.isFinite(weekly) || !Number.isFinite(clearingTimestamp)) {
+            continue;
+        }
+        const elapsed = Math.min(Math.max(nowSeconds - clearingTimestamp, 0), SECONDS_PER_WEEK);
+        accrued += (weekly * elapsed) / SECONDS_PER_WEEK;
+    }
+    return accrued;
+}
+/**
+ * What `amount` earns in a year at a NET rate — the "≈ $Y a year" line.
+ * Feed it `netEffectiveApy(...)`, never a gross APY: the result is a lender's
+ * earnings, so the fee must already be off the rate.
+ *
+ * FAILS CLOSED: a non-finite or negative amount or rate returns `NaN`, which
+ * the consumer renders as "no figure" — exactly what `netEffectiveApy`
+ * returns when the fee is unknown, so that state carries straight through.
+ *
+ * @param amount display units of the stable asset.
+ * @param netApy the net effective annual rate as a 0..1 fraction.
+ */
+function projectedAnnualEarnings(amount, netApy) {
+    if (!Number.isFinite(amount) || amount < 0)
+        return NaN;
+    if (!Number.isFinite(netApy) || netApy < 0)
+        return NaN;
+    return amount * netApy;
+}
+/**
+ * Balance-weighted average APY across slices, skipping non-finite and
+ * non-positive balances and non-finite rates; `0` when nothing carries a
+ * positive balance. Whatever basis goes in comes out — feed it NET rates for
+ * an average effective (net) rate.
+ */
+function weightedAverageApy(slices) {
+    let totalBalance = 0;
+    let weighted = 0;
+    for (const slice of slices) {
+        if (!Number.isFinite(slice.balance) || !Number.isFinite(slice.apy)) {
+            continue;
+        }
+        if (slice.balance <= 0)
+            continue;
+        totalBalance += slice.balance;
+        weighted += slice.balance * slice.apy;
+    }
+    if (totalBalance <= 0)
+        return 0;
+    return weighted / totalBalance;
+}
+
+export { APXIUM, AU_ALPHA3, AU_MIN_CUMULATIVE_BY_STABLE, BatchPendingError, BatchRevertedError, BatchSubmissionError, CHAIN_CONFIGS, CLEARING_WINDOW_SECONDS, CONTRACT_TTL_MS, CallsFacade, DAYS_PER_EPOCH, DAYS_PER_MONTH, DEFAULT_BATCH_POLLING_POLICY, DepositBatchMismatchError, DepositFlow, DepositsFacade, ENTRY_POINT_V07, EPOCHS_IN_YEAR, Flow, FlowStore, FlowsFacade, INVALID_ACCEPTANCE_SIGNATURE_MESSAGE, INVALID_AUTH_SIGNATURE_MESSAGE, INVOICEMATE, Kasu, KasuSdk, MAX_LENDING_AMOUNT_FALLBACK, MIN_DAYS_FOR_MONTHS, MIN_LENDING_AMOUNT_FALLBACK, MIN_TRANCHE_CAPACITY, NOT_A_WITHDRAWAL_CALL_MESSAGE, NO_DIRECTUS_URL_MESSAGE, NO_KYC_PARAMS_MESSAGE, NO_SPENDER_MESSAGE, NO_WITHDRAWAL_ENCODER_MESSAGE, PortfolioFacade, READ_ONLY_MESSAGE, RIXON_CAPITAL, SECONDS_PER_WEEK, SPONSORED_CALL_KINDS, SPONSORED_CALL_SELECTORS, SdkConfig, SponsoredCallInputError, StrategiesFacade, UPPER_MEZZANINE, WithdrawFlow, accruedInterest, apyToEpochRate, asContractType, auMinimumRemaining, auThresholdFor, availableFixedTermConfigs, batchOutcomeOf, buildContractVersionType, buildFullNameRequestMessage, buildLegacyContractRequestMessage, buildLoanAgreementSignMessage, cancelDeadline, ceilToCents, checkBatchOutcome, classifyWalletFailure, compareTrancheSeniority, computeSettlementWindow, countSubmissions, dailyInterest, decodeRevert, deriveCycleDates, derivePoolStatus, deriveRequestState, encodeCancelDepositCall, encodeCancelWithdrawalCall, encodeDepositData, encodeRequestWithdrawalCall, encodeWithdrawAtExpiryCall, epochRateToApy, explorerAddressUrl, explorerTxUrl, extractRevertData, fetchUnusedPoolIds, firstSubmissionTimestamp, floorToCents, formatSignTimestampUtc, getCreditOriginator, getInstitutionalLender, getStrategyRegion, getTrancheDisplayName, isAuMinimumExempt, isAustralianKyc, isBelowMinimumCapacity, isCycleClosed, isDefinitivelyNotSubmitted, isFixedTermConfigId, isUnpredictableGas, isUserRejected, lastEventTimestamp, lockDurationDays, lockDurationMonths, maxNetRateCeiling, netEffectiveApy, netTrancheApyBounds, nextCycleBoundary, parseFormattedMessage, parseMinorUnits, parseTrancheBound, pickDefaultTrancheId, pickHighestYieldTranche, poolAllTranchesFull, poolMaxApy, projectedAnnualEarnings, proveDepositInReceipt, proveUserOperationInReceipt, resolveBoundShortcuts, resolveDepositBounds, selectVisiblePools, submissionEvents, submitBatch, submitSponsoredCall, trancheApyBounds, trancheHasCapacity, trancheRiskRank, validateDepositBatchCalls, weeklyInterest, weightedAverageApy };