@stablechain/sdk 1.0.7 → 1.0.9

package/README.md

@@ -129,7 +129,13 @@ const { txHash } = await stable.transfer({
 });
 ```
 
-**ERC-20 (USDC, EURC, …)**
+**ERC-20 (PYUSD, USDC, EURC, …)**
+
+```ts
+import { STABLE_PYUSD_ADDRESS } from "@stablechain/sdk";
+
+await stable.transfer({ to: "0xRecipient", amount: 25, token: STABLE_PYUSD_ADDRESS, tokenDecimals: 6 });
+```
 
 ```ts
 const { txHash } = await stable.transfer({
@@ -254,8 +260,9 @@ automatically. Switches the wallet to the source chain (MetaMask will prompt) be
 sending.
 
 Only a lockbox pathway needs an allowance at all — Ethereum for USDT0 and XAUt0, and
-Sepolia on testnet. Every other deployment is an OFT that burns from the caller, so no
-approve and no allowance read is issued there. Where one is needed and the current
+Sepolia on testnet. Every other deployment burns from the caller, so no approve and no
+allowance read is issued there. That includes PYUSD on Ethereum, which mints and burns
+through the token instead of escrowing it. Where one is needed and the current
 allowance is short but not zero, it takes **two** approvals: legacy USDT refuses to
 overwrite a non-zero allowance with another non-zero value, so the SDK sends
 `approve(0)` first.
@@ -337,7 +344,7 @@ one of them. Alongside them:
 | Field     | Type            | What it is                                                          |
 |-----------|-----------------|---------------------------------------------------------------------|
 | `chainId` | `number`        | The source chain every step must be sent on                         |
-| `asset`   | `"usdt0" \| "xaut0"` | Which OFT mesh this send moves through                        |
+| `asset`   | `"usdt0" \| "xaut0" \| "pyusd"` | Which OFT mesh this send moves through                        |
 | `quote`   | `BridgeQuote`   | The quote the steps were built from — supplied or freshly read        |
 | `send`    | `object`        | The `send` step's arguments decoded: `dstEid`, `recipient`, `to`, `amountLD`, `minAmountLD`, `extraOptions`, `nativeFee`, `lzTokenFee`, `refundAddress` |
 
@@ -381,7 +388,7 @@ addresses name, LI.FI otherwise. Forcing `"oft"` on an unsupported pair throws
 
 #### Native OFT assets
 
-Two assets have their own OFT mesh, each with its own adapter and token address per
+Each OFT asset has its own mesh, with its own adapter and token address per
 chain. A bridge stays within one mesh: the OFT mints its own peer on the far side, so it
 cannot hand back a different token. A cross-asset request (USDT0 in, XAUt0 out) is a
 trade, not a bridge, and `"auto"` sends it to LI.FI.
@@ -409,6 +416,27 @@ chain burns from the caller and skips the approval transaction entirely.
 
 BSC is XAUt0-only: it has no USDT0 deployment, so a BSC USDT bridge routes to LI.FI.
 
+**PYUSD** (PayPal USD, 6 decimals) — Stable and Ethereum. The OFT is live between those
+two chains only, so `"auto"` takes it for Ethereum ↔ Stable and sends every other PYUSD
+pair to LI.FI.
+
+```ts
+// PYUSD: Ethereum → Stable, over the native OFT mesh
+await stable.bridge({
+  fromChain: Chain.Ethereum,
+  toChain:   Chain.Stable,
+  fromToken: "0x6c3ea9036406852006290770BEdFcAbA0e23A0e8", // PYUSD on Ethereum
+  toToken:   STABLE_PYUSD_ADDRESS,
+  amount: 100, // 100 PYUSD
+});
+```
+
+Neither side is a lockbox: both adapters mint and burn through PYUSD itself, so no
+approval is sent, even on Ethereum. Each direction is rate-limited by the adapter
+(100,000,000 PYUSD per 24 hours as of 2026-10-27), and a send past the limit reverts.
+From other chains, LI.FI had no PYUSD liquidity on Stable when last checked (2026-10-22),
+so those bridges fail with "no available quotes".
+
 Addresses per chain are in `BRIDGE_CHAIN_CONFIGS[chain].tokens`, keyed by asset:
 
 ```ts
@@ -419,7 +447,7 @@ stableChain.tokens.xaut0?.address;    // XAUt0 ERC-20 on Stable
 stableChain.tokens.xaut0?.oftAdapter; // its OFT
 
 // Which asset an address refers to on a chain, if any
-bridgeAssetFor(stableChain, someToken); // "usdt0" | "xaut0" | undefined
+bridgeAssetFor(stableChain, someToken); // "usdt0" | "xaut0" | "pyusd" | undefined
 ```
 
 ---
@@ -455,44 +483,57 @@ Nearly all of the wait is **source-chain finality**: the DVNs securing the pathw
 not attest until the send transaction is buried under `confirmations` source blocks.
 Destination execution is a few blocks on top.
 
-The SDK resolves this from two independent inputs and reports both:
+`estimateBridgeTime` reports that breakdown:
 
 | Field             | Meaning                                                                                          |
 |-------------------|--------------------------------------------------------------------------------------------------|
-| `seconds`         | Best available estimate — display this                                                            |
-| `source`          | `"observed"` or `"formula"`, whichever produced `seconds`                                          |
+| `seconds`         | The estimate — display this                                                                       |
+| `source`          | `"formula"`, `"floor"`, or `"observed"` — which input produced `seconds`                           |
 | `observedSeconds` | Median delivery time of recent messages on this exact pathway, from LayerZero Scan                 |
 | `formulaSeconds`  | LayerZero's documented estimate: `srcBlockTime × confirmations + dstBlockTime × (2 + dvnCount)`     |
 | `confirmations`   | Source blocks the DVNs wait for, read live from the pathway's ULN config                           |
 | `dvnCount`        | DVNs verifying the pathway                                                                        |
 
-`observed` wins when available. The formula assumes block confirmations are the whole
-wait, which holds for L1 sources but understates rollups badly — Arbitrum→Stable computes
-to ~19 s (60 blocks × 0.25 s) against a real median of ~18 min, because the DVNs wait for
-the L2 batch to finalize on Ethereum.
+`seconds` comes from the formula — the pathway's live ULN config is what the DVNs are
+actually bound by, so a config change is reflected the moment it lands. On every pathway
+that is purely confirmation-bound it agrees with both usdt0.to's own estimate and the
+delivery times LayerZero Scan reports to well under a percent.
+
+Some source chains carry a floor. DVN attestation and destination execution sit outside the
+formula, and on Ethereum and Arbitrum the DVNs additionally hold until the send finalizes on
+the beacon chain. Where confirmations are high that overhead vanishes into the rounding;
+where they are low it dominates — Arbitrum's 60 confirmations compute to ~19 s against a real
+~18 min. Those chains are floored at a measured minimum, and `source` reports `"floor"`.
+
+`observedSeconds` is fetched alongside and reported for comparison, but does not drive
+`seconds`: a 50-message window can reach back months, so on a pathway that has been
+reconfigured or has gone quiet it answers from a config that no longer exists.
 
 Pathway configs and observed medians are cached for 5 minutes; call
 `clearBridgeEstimateCache()` to force a refetch.
 
-Roughly what to expect on mainnet, measured 2026-07-30:
+Roughly what to expect on mainnet, from configs read 2026-08-27:
 
 | Pathway             | Confirmations | Typical delivery |
 |---------------------|---------------|------------------|
-| Polygon → Stable    | 32            | ~1 min           |
-| Bera → Stable       | 60            | ~2 min           |
-| Unichain → Stable   | 1600          | ~8 min           |
-| Flare → Stable      | 500           | ~11 min          |
-| Optimism → Stable   | 1000          | ~15 min          |
-| Ethereum → Stable   | 65            | ~17 min          |
+| Polygon → Stable    | 32            | ~1 min ᶠ         |
+| Bera → Stable       | 60            | ~2 min ᶠ         |
+| Flare → Stable      | 500           | ~10 min ᶠ        |
 | Sei → Stable        | 2000          | ~17 min          |
-| Arbitrum → Stable   | 60            | ~18 min          |
+| Ethereum → Stable   | 65            | ~19.5 min ᶠ      |
+| Arbitrum → Stable   | 60            | ~22.5 min ᶠ      |
+| Unichain → Stable   | 1600          | ~27 min          |
 | Plasma → Stable     | 1800          | ~30 min          |
+| Optimism → Stable   | 1000          | ~33 min          |
 | Stable → any        | 3600          | ~42 min          |
 | Rootstock → Stable  | 120           | ~62 min          |
 | MegaETH → Stable    | 5400          | ~90 min          |
 | X Layer → Stable    | 9000          | ~2.5 h           |
 | HyperEVM → Stable   | 43200         | ~12 h            |
 
+ᶠ Floored at the source chain's measured minimum, because its confirmation count is not the
+whole wait — Ethereum and Arbitrum would otherwise compute to ~13 min and ~19 s.
+
 ---
 
 ### `trackBridge(srcTxHash)` → `BridgeStatus`
@@ -618,6 +659,21 @@ if (check.ok) await stable.authorization.transferWithAuthorization({ signed });
 
 `value` is a **raw `bigint`** in the token's smallest unit (USDT0 is 6 decimals) — this is the 6-dp ERC-20 path, not the 18-dp native one. `token` defaults to USDT0; `nonce` defaults to a cryptographically-random 32 bytes; the EIP-712 `domain` is read from the token (EIP-5267 `eip712Domain()`, falling back to `name()` + version `"1"`) unless overridden.
 
+PYUSD on Stable implements ERC-3009 too. Pass `token: STABLE_PYUSD_ADDRESS` and the same
+actions work with no domain override, because the `name()` + `"1"` fallback matches its
+on-chain `DOMAIN_SEPARATOR`:
+
+```ts
+import { STABLE_PYUSD_ADDRESS } from "@stablechain/sdk";
+
+const signed = await stable.authorization.signTransferAuthorization({
+  token: STABLE_PYUSD_ADDRESS,
+  to: "0xVendor",
+  value: 1_250_000n,                              // 1.25 PYUSD (6 dp)
+  validBefore: BigInt(Math.floor(Date.now() / 1000) + 3600),
+});
+```
+
 To relay gaslessly, pass `prepareTransferWithAuthorization`'s output to the [`@stablechain/enterprise`](../enterprise) gas-waiver rail.
 
 > **Contract signers:** canonical ERC-3009 uses `ecrecover`, so Safe / EIP-1271 accounts cannot sign an authorization. Use an EOA (optionally a 7702 session key) for the payer.
@@ -640,6 +696,23 @@ const stable = createStable({
 const { txHash } = await stable.earn.deposit({ amount: 100 }); // 100 USDT0
 ```
 
+Earn works with any Morpho V2 vault, not just USDT0. The SDK reads the vault's own
+`asset()` and that token's decimals, and approves that token, so a PYUSD vault needs only
+its address. `deposit` and `bulkDeposit` accept `vault` per call. Withdraw, redeem and
+the reader always use the vault set in config, so manage a PYUSD position with a client
+configured for that vault:
+
+```ts
+const pyusdEarn = createStable({
+  network: Network.Mainnet,
+  earn: { vault: PYUSD_VAULT },
+  walletClient: myWalletClient,
+});
+
+await pyusdEarn.earn.deposit({ amount: 100 });  // 100 PYUSD
+await pyusdEarn.earn.withdraw({ amount: 40 });  // 40 PYUSD back
+```
+
 | Param               | Type     | Description                                                       |
 |---------------------|----------|-------------------------------------------------------------------|
 | `amount`            | `number` | Amount in human-readable units                                    |

package/dist/{chunk-VS6GBRDF.js → chunk-FN7OKBRH.js}

@@ -122,6 +122,7 @@ import { signTypedData } from "viem/actions";
 
 // src/constants.ts
 var STABLE_USDT_ADDRESS = "0x779ded0c9e1022225f8e0630b35a9b54be713736";
+var STABLE_PYUSD_ADDRESS = "0x28F1f38a9F7dB1f769A71aF0a13E8BACe2ab0E9f";
 var STABLE_VAULT_ADDRESS = "0xb7Df8db22A5DBBFA9ebeb94b3910aec6a4f05c08";
 
 // src/errors.ts
@@ -649,9 +650,10 @@ export {
   StableTransactionError,
   StableNetworkError,
   StableBulkError,
-  ERC3009_ABI,
   STABLE_USDT_ADDRESS,
+  STABLE_PYUSD_ADDRESS,
   STABLE_VAULT_ADDRESS,
+  ERC3009_ABI,
   signTransferAuthorization,
   signReceiveAuthorization,
   transferWithAuthorization,

package/dist/{chunk-QQ26UI3F.cjs → chunk-MMZ7HVWZ.cjs}

@@ -122,6 +122,7 @@ var _actions = require('viem/actions');
 
 // src/constants.ts
 var STABLE_USDT_ADDRESS = "0x779ded0c9e1022225f8e0630b35a9b54be713736";
+var STABLE_PYUSD_ADDRESS = "0x28F1f38a9F7dB1f769A71aF0a13E8BACe2ab0E9f";
 var STABLE_VAULT_ADDRESS = "0xb7Df8db22A5DBBFA9ebeb94b3910aec6a4f05c08";
 
 // src/errors.ts
@@ -662,4 +663,5 @@ function erc3009Actions(client) {
 
 
 
-exports.StableError = StableError; exports.StableValidationError = StableValidationError; exports.StableQuoteError = StableQuoteError; exports.StableTransactionError = StableTransactionError; exports.StableNetworkError = StableNetworkError; exports.StableBulkError = StableBulkError; exports.ERC3009_ABI = ERC3009_ABI; exports.STABLE_USDT_ADDRESS = STABLE_USDT_ADDRESS; exports.STABLE_VAULT_ADDRESS = STABLE_VAULT_ADDRESS; exports.signTransferAuthorization = signTransferAuthorization; exports.signReceiveAuthorization = signReceiveAuthorization; exports.transferWithAuthorization = transferWithAuthorization; exports.receiveWithAuthorization = receiveWithAuthorization; exports.cancelAuthorization = cancelAuthorization; exports.prepareTransferWithAuthorization = prepareTransferWithAuthorization; exports.verifyAuthorization = verifyAuthorization; exports.getAuthorizationState = getAuthorizationState; exports.getAuthorizationUsage = getAuthorizationUsage; exports.erc3009Actions = erc3009Actions;
+
+exports.StableError = StableError; exports.StableValidationError = StableValidationError; exports.StableQuoteError = StableQuoteError; exports.StableTransactionError = StableTransactionError; exports.StableNetworkError = StableNetworkError; exports.StableBulkError = StableBulkError; exports.STABLE_USDT_ADDRESS = STABLE_USDT_ADDRESS; exports.STABLE_PYUSD_ADDRESS = STABLE_PYUSD_ADDRESS; exports.STABLE_VAULT_ADDRESS = STABLE_VAULT_ADDRESS; exports.ERC3009_ABI = ERC3009_ABI; exports.signTransferAuthorization = signTransferAuthorization; exports.signReceiveAuthorization = signReceiveAuthorization; exports.transferWithAuthorization = transferWithAuthorization; exports.receiveWithAuthorization = receiveWithAuthorization; exports.cancelAuthorization = cancelAuthorization; exports.prepareTransferWithAuthorization = prepareTransferWithAuthorization; exports.verifyAuthorization = verifyAuthorization; exports.getAuthorizationState = getAuthorizationState; exports.getAuthorizationUsage = getAuthorizationUsage; exports.erc3009Actions = erc3009Actions;

package/dist/erc3009.cjs

@@ -10,7 +10,7 @@
 
 
 
-var _chunkQQ26UI3Fcjs = require('./chunk-QQ26UI3F.cjs');
+var _chunkMMZ7HVWZcjs = require('./chunk-MMZ7HVWZ.cjs');
 
 
 
@@ -23,4 +23,4 @@ var _chunkQQ26UI3Fcjs = require('./chunk-QQ26UI3F.cjs');
 
 
 
-exports.ERC3009_ABI = _chunkQQ26UI3Fcjs.ERC3009_ABI; exports.cancelAuthorization = _chunkQQ26UI3Fcjs.cancelAuthorization; exports.erc3009Actions = _chunkQQ26UI3Fcjs.erc3009Actions; exports.getAuthorizationState = _chunkQQ26UI3Fcjs.getAuthorizationState; exports.getAuthorizationUsage = _chunkQQ26UI3Fcjs.getAuthorizationUsage; exports.prepareTransferWithAuthorization = _chunkQQ26UI3Fcjs.prepareTransferWithAuthorization; exports.receiveWithAuthorization = _chunkQQ26UI3Fcjs.receiveWithAuthorization; exports.signReceiveAuthorization = _chunkQQ26UI3Fcjs.signReceiveAuthorization; exports.signTransferAuthorization = _chunkQQ26UI3Fcjs.signTransferAuthorization; exports.transferWithAuthorization = _chunkQQ26UI3Fcjs.transferWithAuthorization; exports.verifyAuthorization = _chunkQQ26UI3Fcjs.verifyAuthorization;
+exports.ERC3009_ABI = _chunkMMZ7HVWZcjs.ERC3009_ABI; exports.cancelAuthorization = _chunkMMZ7HVWZcjs.cancelAuthorization; exports.erc3009Actions = _chunkMMZ7HVWZcjs.erc3009Actions; exports.getAuthorizationState = _chunkMMZ7HVWZcjs.getAuthorizationState; exports.getAuthorizationUsage = _chunkMMZ7HVWZcjs.getAuthorizationUsage; exports.prepareTransferWithAuthorization = _chunkMMZ7HVWZcjs.prepareTransferWithAuthorization; exports.receiveWithAuthorization = _chunkMMZ7HVWZcjs.receiveWithAuthorization; exports.signReceiveAuthorization = _chunkMMZ7HVWZcjs.signReceiveAuthorization; exports.signTransferAuthorization = _chunkMMZ7HVWZcjs.signTransferAuthorization; exports.transferWithAuthorization = _chunkMMZ7HVWZcjs.transferWithAuthorization; exports.verifyAuthorization = _chunkMMZ7HVWZcjs.verifyAuthorization;

package/dist/erc3009.js

@@ -10,7 +10,7 @@ import {
   signTransferAuthorization,
   transferWithAuthorization,
   verifyAuthorization
-} from "./chunk-VS6GBRDF.js";
+} from "./chunk-FN7OKBRH.js";
 export {
   ERC3009_ABI,
   cancelAuthorization,