@owney/sdk 0.6.4-beta.0 → 0.6.5-beta.0

package/dist/index.cjs

@@ -40,7 +40,7 @@ var P_SUPPORTED_CHAINS = {
   chainIds: [8453, 42161],
   chains: ["BASE", "ARBITRUM"]
 };
-var SUPPORTED_TOKENS = ["USDC", "USDT"];
+var SUPPORTED_TOKENS = ["USDC", "USDT", "WETH"];
 var SUPPORTED_CHAIN_IDS = P_SUPPORTED_CHAINS.chainIds;
 var SUPPORTED_CHAINS = P_SUPPORTED_CHAINS.chains;
 var SupportedAssets = [
@@ -61,6 +61,18 @@ var SupportedAssets = [
     symbol: "USDT",
     chainId: 42161,
     decimals: 6
+  },
+  {
+    address: `0x4200000000000000000000000000000000000006`,
+    symbol: "WETH",
+    chainId: 8453,
+    decimals: 18
+  },
+  {
+    address: `0x82aF49447D8a07e3bd95BD0d56f35241523fBab1`,
+    symbol: "WETH",
+    chainId: 42161,
+    decimals: 18
   }
 ];
 
@@ -545,11 +557,26 @@ var clearSession = (address, chainId) => {
   }
 };
 
+// src/agents/zyfai/autoSelect.ts
+function buildAutoSelectUpdate(current, asset) {
+  if (current.autoSelectProtocols === true)
+    return null;
+  return {
+    asset,
+    autoSelectProtocols: true,
+    ...current.chains ? { chains: current.chains } : {}
+  };
+}
+
 // src/agents/zyfai/zyfai.agent.ts
 var DEFAULT_ZYFAI_RPC_URLS = {
   8453: "https://base-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V",
   42161: "https://arb-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V"
 };
+var WETH_ADDRESS_BY_CHAIN = {
+  8453: "0x4200000000000000000000000000000000000006",
+  42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1"
+};
 var VIEM_CHAIN = { 8453: import_chains.base, 42161: import_chains.arbitrum };
 var ZyfaiAgent = class {
   id = "zyfai";
@@ -558,12 +585,18 @@ var ZyfaiAgent = class {
     {
       chainId: 8453,
       chain: "BASE",
-      assets: [{ symbol: "USDC", minDepositAmount: "1500000" }]
+      assets: [
+        { symbol: "USDC", minDepositAmount: "1500000" },
+        { symbol: "WETH", minDepositAmount: "500000000000000" }
+      ]
     },
     {
       chainId: 42161,
       chain: "ARBITRUM",
-      assets: [{ symbol: "USDC", minDepositAmount: "1500000" }]
+      assets: [
+        { symbol: "USDC", minDepositAmount: "1500000" },
+        { symbol: "WETH", minDepositAmount: "500000000000000" }
+      ]
     }
   ];
   sdk;
@@ -758,6 +791,22 @@ var ZyfaiAgent = class {
     this.smartWalletCache.set(`${address}_${validChainId}`, wallet.address);
     if (!wallet.isDeployed) {
       await this.sdk.deploySafe(address, validChainId, "aggressive", true);
+      try {
+        if (validChainId === 42161) {
+          await this.sdk.updateUserProfile({
+            asset: "WETH",
+            chains: [validChainId],
+            protocols: ["c24a33fa-4a87-4376-b756-93bd3957d3ea"],
+            // AAVE protocol ID
+            autoSelectProtocols: false
+          });
+        }
+      } catch (err) {
+        console.warn(
+          "Failed to configure AAVE protocol after Safe deployment:",
+          err instanceof Error ? err.message : String(err)
+        );
+      }
     }
     const user = await this.sdk.getUserDetails();
     if (!user.hasActiveSessionKey) {
@@ -799,7 +848,7 @@ var ZyfaiAgent = class {
       throw error;
     }
   }
-  async deposit(state, chainId, amount, depositCallback) {
+  async deposit(state, chainId, amount, asset, depositCallback) {
     try {
       await this.connectFull(state, chainId);
       const validChainId = isValidChainId(chainId);
@@ -813,13 +862,15 @@ var ZyfaiAgent = class {
           validChainId,
           amount
         );
-        await this.sdk.logDeposit(validChainId, txHash, amount);
+        const tokenAddress = asset === "WETH" ? WETH_ADDRESS_BY_CHAIN[validChainId] : void 0;
+        await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
         return { txHash, smartWallet: wallet.address, amount };
       }
       const raw = await this.sdk.depositFunds(
         this.getAddress(),
         validChainId,
-        amount
+        amount,
+        asset
       );
       return mapDeposit(raw);
     } catch (error) {
@@ -915,6 +966,21 @@ var ZyfaiAgent = class {
     }
     return mapUserProfile(raw, this.connectedAddress);
   }
+  async ensureAutoSelectProtocols(state, chainId, asset) {
+    await this.connectAuth(state, chainId);
+    const current = await this.sdk.getUserDetails(asset);
+    const update = buildAutoSelectUpdate(
+      {
+        autoSelectProtocols: current.autoSelectProtocols,
+        chains: current.chains
+      },
+      asset
+    );
+    if (!update)
+      return false;
+    await this.sdk.updateUserProfile(update);
+    return true;
+  }
   // --- IAgent: Discovery (no wallet required) ---
   async getAgentApy(days, options) {
     const raw = await this.sdk.getAPYPerStrategy(
@@ -1118,7 +1184,7 @@ function aggregateApyByChainAndAsset(agentApys, agentBalances) {
 }
 
 // src/client.ts
-var import_viem4 = require("viem");
+var import_viem5 = require("viem");
 var import_chains2 = require("viem/chains");
 
 // src/lib/transfer-auth.ts
@@ -1190,6 +1256,70 @@ async function postSponsorTransferAuth(input) {
   }
   return parsed.data;
 }
+async function postSponsorPermit2Transfer(input) {
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
+  let res;
+  try {
+    res = await fetch(`${base3}/api/v1/sponsor/permit2-transfer`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-owney-api-key": input.apiKey },
+      body: JSON.stringify(input.body)
+    });
+  } catch (networkError) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
+      { cause: String(networkError), safeToFallback: false }
+    );
+  }
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+  }
+  if (!res.ok || !parsed?.success || !parsed.data) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+      {
+        statusCode: res.status,
+        responseBody: text.slice(0, 500),
+        safeToFallback: res.status >= 400 && res.status < 500
+      }
+    );
+  }
+  return parsed.data;
+}
+async function getSponsorRelayerAddress(input) {
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
+  let res;
+  try {
+    res = await fetch(`${base3}/api/v1/sponsor/relayer-address?chainId=${input.chainId}`, {
+      headers: { "x-owney-api-key": input.apiKey }
+    });
+  } catch (networkError) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
+      { cause: String(networkError), safeToFallback: true }
+    );
+  }
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+  }
+  if (!res.ok || !parsed?.success || !parsed.data?.relayer) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+      { statusCode: res.status, responseBody: text.slice(0, 500), safeToFallback: true }
+    );
+  }
+  return parsed.data.relayer;
+}
 
 // src/lib/sponsored-deposit.ts
 var AUTH_WINDOW_SECONDS = 15 * 60;
@@ -1241,6 +1371,114 @@ function makeSponsoredDepositCallback(deps) {
   };
 }
 
+// src/lib/permit2.ts
+var import_viem4 = require("viem");
+var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var MAX_UINT256 = 2n ** 256n - 1n;
+var ERC20_ALLOWANCE_ABI = [
+  {
+    type: "function",
+    name: "allowance",
+    stateMutability: "view",
+    inputs: [{ name: "owner", type: "address" }, { name: "spender", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "approve",
+    stateMutability: "nonpayable",
+    inputs: [{ name: "spender", type: "address" }, { name: "amount", type: "uint256" }],
+    outputs: [{ name: "", type: "bool" }]
+  }
+];
+function buildPermitTransferFromTypedData(input) {
+  return {
+    domain: { name: "Permit2", chainId: input.chainId, verifyingContract: PERMIT2_ADDRESS },
+    types: {
+      PermitTransferFrom: [
+        { name: "permitted", type: "TokenPermissions" },
+        { name: "spender", type: "address" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint256" }
+      ],
+      TokenPermissions: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint256" }
+      ]
+    },
+    primaryType: "PermitTransferFrom",
+    message: input.message
+  };
+}
+function randomPermit2Nonce() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return BigInt((0, import_viem4.bytesToHex)(bytes));
+}
+async function readPermit2Allowance(publicClient, token, owner) {
+  return publicClient.readContract({
+    address: token,
+    abi: ERC20_ALLOWANCE_ABI,
+    functionName: "allowance",
+    args: [owner, PERMIT2_ADDRESS]
+  });
+}
+
+// src/lib/sponsored-weth-deposit.ts
+var PERMIT_WINDOW_SECONDS = 15 * 60;
+function makeSponsoredWethCallback(deps) {
+  const get = deps.httpGet ?? getSponsorRelayerAddress;
+  const post = deps.httpPost ?? postSponsorPermit2Transfer;
+  return async (smartWallet, chainId, amount) => {
+    const cid = chainId;
+    const token = deps.tokenAddressByChain[cid];
+    if (!token) {
+      throw new OwneyError("CHAIN_UNSUPPORTED", `No sponsored WETH configured for chain ${chainId}`);
+    }
+    const amountWei = BigInt(amount);
+    const pub = deps.getPublicClient(cid);
+    const allowance = await readPermit2Allowance(pub, token, deps.ownerAddress);
+    if (allowance < amountWei) {
+      throw new OwneyError(
+        "PERMIT2_APPROVAL_REQUIRED",
+        "WETH gasless deposits need a one-time Permit2 approval; call approvePermit2() first",
+        { token, chainId: cid, allowance: allowance.toString(), amount }
+      );
+    }
+    const relayer = await get({ baseUrl: deps.baseUrl, apiKey: deps.apiKey, chainId: cid });
+    const nonce = randomPermit2Nonce();
+    const deadline = BigInt(Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS);
+    const typedData = buildPermitTransferFromTypedData({
+      chainId: cid,
+      message: {
+        permitted: { token, amount: amountWei },
+        spender: relayer,
+        nonce,
+        deadline
+      }
+    });
+    const wallet = deps.getWalletClient(cid);
+    const signature = await wallet.signTypedData(
+      { account: deps.ownerAddress, ...typedData }
+    );
+    const result = await post({
+      baseUrl: deps.baseUrl,
+      apiKey: deps.apiKey,
+      body: {
+        chainId: cid,
+        token,
+        from: deps.ownerAddress,
+        to: smartWallet,
+        amount,
+        nonce: nonce.toString(),
+        deadline: deadline.toString(),
+        signature
+      }
+    });
+    return result.txHash;
+  };
+}
+
 // src/client.ts
 function encodeMultiAgentCursor(map) {
   return Buffer.from(JSON.stringify(map), "utf8").toString("base64");
@@ -1270,6 +1508,13 @@ var VIEM_CHAIN2 = {
   8453: import_chains2.base,
   42161: import_chains2.arbitrum
 };
+var SPONSORED_WETH_BY_CHAIN = {
+  8453: "0x4200000000000000000000000000000000000006",
+  42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1"
+};
+function shouldFallbackToUserPaid(error, asset, appCallback) {
+  return asset === "WETH" && appCallback === void 0 && error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED" && error.details?.safeToFallback === true;
+}
 var OwneySDK = class {
   agents = /* @__PURE__ */ new Map();
   activeAgents = /* @__PURE__ */ new Set();
@@ -1283,6 +1528,7 @@ var OwneySDK = class {
   apiKey;
   zyfaiRpcUrls;
   cachedSponsoredCallback = null;
+  cachedWethSponsoredCallback = null;
   initializingAgentsPromise = null;
   constructor(config) {
     this.apiKey = config.apiKey;
@@ -1307,6 +1553,7 @@ var OwneySDK = class {
     }
     this.state = { provider, walletAddress, chainId: null };
     this.cachedSponsoredCallback = null;
+    this.cachedWethSponsoredCallback = null;
   }
   /**
    * Disconnect from all agents and clear connection state.
@@ -1320,6 +1567,7 @@ var OwneySDK = class {
     this.disabledAgents.clear();
     this.state = null;
     this.cachedSponsoredCallback = null;
+    this.cachedWethSponsoredCallback = null;
   }
   isAgentDisabled(agentId) {
     return this.disabledAgents.has(agentId);
@@ -1381,18 +1629,48 @@ var OwneySDK = class {
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
       // runtime, but the two share a name TS treats as unrelated.
-      getPublicClient: (cid) => (0, import_viem4.createPublicClient)({
+      getPublicClient: (cid) => (0, import_viem5.createPublicClient)({
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem4.custom)(provider)
+        transport: (0, import_viem5.custom)(provider)
       }),
-      getWalletClient: (cid) => (0, import_viem4.createWalletClient)({
+      getWalletClient: (cid) => (0, import_viem5.createWalletClient)({
         account: owner,
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem4.custom)(provider)
+        transport: (0, import_viem5.custom)(provider)
       })
     });
     return this.cachedSponsoredCallback;
   }
+  /**
+   * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
+   * callback used when the caller omits `depositCallback` for a WETH
+   * deposit. Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
+   * `PermitTransferFrom` instead of an EIP-3009 authorization.
+   */
+  getDefaultWethSponsoredCallback() {
+    if (this.cachedWethSponsoredCallback)
+      return this.cachedWethSponsoredCallback;
+    const provider = this.requireConnectedProvider();
+    const owner = this.state.walletAddress;
+    this.cachedWethSponsoredCallback = makeSponsoredWethCallback({
+      apiKey: this.apiKey,
+      ownerAddress: owner,
+      tokenAddressByChain: SPONSORED_WETH_BY_CHAIN,
+      // Casts work around viem's chain-narrowed Client vs the generic
+      // PublicClient/WalletClient param types — structurally identical at
+      // runtime, but the two share a name TS treats as unrelated.
+      getPublicClient: (cid) => (0, import_viem5.createPublicClient)({
+        chain: VIEM_CHAIN2[cid],
+        transport: (0, import_viem5.custom)(provider)
+      }),
+      getWalletClient: (cid) => (0, import_viem5.createWalletClient)({
+        account: owner,
+        chain: VIEM_CHAIN2[cid],
+        transport: (0, import_viem5.custom)(provider)
+      })
+    });
+    return this.cachedWethSponsoredCallback;
+  }
   getAgent(agentId) {
     const agent = this.agents.get(agentId);
     if (!agent) {
@@ -1546,7 +1824,7 @@ var OwneySDK = class {
     }
     const state = this.requireState();
     const chainId = this.requireChainId();
-    const effectiveCallback = depositCallback ?? this.getDefaultSponsoredCallback();
+    const effectiveCallback = depositCallback ?? (asset === "WETH" ? this.getDefaultWethSponsoredCallback() : this.getDefaultSponsoredCallback());
     if (agentId) {
       if (this.isAgentDisabled(agentId)) {
         throw new OwneyError(
@@ -1558,10 +1836,14 @@ var OwneySDK = class {
       const agent = this.getAgent(agentId);
       this.validateAssetSupport(agent, chainId, asset);
       await this.validateMinDepositAmount(agent, state, chainId, asset, amount);
-      return withFailureReporting(
-        this.apiKey,
-        agent.id,
-        () => agent.deposit(state, chainId, amount, effectiveCallback)
+      return this.depositWithFallback(
+        agent,
+        state,
+        chainId,
+        amount,
+        asset,
+        effectiveCallback,
+        depositCallback
       );
     }
     const totalAmount = BigInt(amount);
@@ -1592,14 +1874,78 @@ var OwneySDK = class {
     }
     const agentResults = {};
     for (const { agent, amount: agentAmount } of agentAmounts) {
-      agentResults[agent.id] = await withFailureReporting(
-        this.apiKey,
-        agent.id,
-        () => agent.deposit(state, chainId, agentAmount, effectiveCallback)
+      agentResults[agent.id] = await this.depositWithFallback(
+        agent,
+        state,
+        chainId,
+        agentAmount,
+        asset,
+        effectiveCallback,
+        depositCallback
       );
     }
     return { agentResults };
   }
+  /**
+   * Invokes `agent.deposit` with the resolved sponsored callback, composing
+   * two independent auto-recovery mechanisms:
+   *
+   * 1. Missing Permit2 allowance: when the app did not supply its own
+   *    callback and the attempt fails with `PERMIT2_APPROVAL_REQUIRED` on a
+   *    WETH deposit, this is the wallet's first gasless WETH deposit. We send
+   *    the one-time (user-paid) Permit2 approval via `approvePermit2()` and
+   *    retry the SAME sponsored attempt once. Bounded to one approval attempt
+   *    per call so a wallet/agent that keeps reporting the allowance as
+   *    missing can't loop forever. If `approvePermit2()` itself throws (e.g.
+   *    the user rejects the wallet prompt), that error propagates as-is —
+   *    the user said no to a transaction, so we must not turn around and ask
+   *    them to pay for a different one via the fallback below.
+   * 2. `shouldFallbackToUserPaid`: the SDK's own WETH sponsor path failed at
+   *    the infrastructure layer in a provably safe-to-retry way, so we warn
+   *    and retry once with `undefined`, falling through to a user-paid
+   *    native deposit. This still applies after a successful Permit2
+   *    approval retry (the retried sponsored attempt can itself hit a safe
+   *    sponsor failure).
+   *
+   * Any other error — an app-supplied callback's own failure in particular —
+   * propagates unchanged. Scoped per agent invocation so one agent's failure
+   * doesn't force a retry of sibling agents in a multi-agent split.
+   */
+  async depositWithFallback(agent, state, chainId, amount, asset, effectiveCallback, appCallback) {
+    const attempt = (callback) => withFailureReporting(
+      this.apiKey,
+      agent.id,
+      () => agent.deposit(
+        state,
+        chainId,
+        amount,
+        asset,
+        callback
+      )
+    );
+    let approvalAttempted = false;
+    for (; ; ) {
+      try {
+        return await attempt(effectiveCallback);
+      } catch (error) {
+        if (!approvalAttempted && appCallback === void 0 && asset === "WETH" && error instanceof OwneyError && error.code === "PERMIT2_APPROVAL_REQUIRED") {
+          approvalAttempted = true;
+          console.warn(
+            "[owney-sdk] First WETH deposit: sending one-time Permit2 approval..."
+          );
+          await this.approvePermit2();
+          continue;
+        }
+        if (!shouldFallbackToUserPaid(error, asset, appCallback))
+          throw error;
+        console.warn(
+          "[owney-sdk] WETH sponsorship unavailable, falling back to user-paid deposit:",
+          error
+        );
+        return attempt(void 0);
+      }
+    }
+  }
   getMinDepositAmount(agent, chainId, asset) {
     const chainAssets = agent.supportedAssets.find(
       (sa) => sa.chainId === chainId
@@ -2087,6 +2433,66 @@ var OwneySDK = class {
       agentUserProfile: results
     };
   }
+  /**
+   * Ensure the given asset uses backend protocol auto-selection for the active
+   * chain's account. No-op (returns false) for agents that don't support it.
+   * @param asset - "USDC" or "WETH".
+   * @param agentId - Agent to target. Defaults to "zyfai".
+   * @returns whether a profile write occurred.
+   */
+  async ensureAutoSelectProtocols(asset, agentId = "zyfai") {
+    const state = this.requireState();
+    const chainId = this.requireChainId();
+    const agent = this.getAgent(agentId);
+    if (typeof agent.ensureAutoSelectProtocols !== "function")
+      return false;
+    return agent.ensureAutoSelectProtocols(state, chainId, asset);
+  }
+  /**
+   * One-time, user-paid approval of Permit2 on the sponsored WETH token for
+   * the active chain. Required once per wallet per chain before gasless WETH
+   * deposits; afterwards deposit() is signature-only. Resolves only after the
+   * approval transaction is mined (1 confirmation), so a subsequent deposit()
+   * will see the new allowance; throws if the transaction reverted.
+   * @returns the approval transaction hash.
+   */
+  async approvePermit2(asset = "WETH") {
+    const state = this.requireState();
+    const chainId = this.requireChainId();
+    const token = SPONSORED_WETH_BY_CHAIN[chainId];
+    if (!token) {
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored WETH on chain ${chainId}`
+      );
+    }
+    const provider = this.requireConnectedProvider();
+    const wallet = (0, import_viem5.createWalletClient)({
+      account: state.walletAddress,
+      chain: VIEM_CHAIN2[chainId],
+      transport: (0, import_viem5.custom)(provider)
+    });
+    const hash = await wallet.writeContract({
+      address: token,
+      abi: ERC20_ALLOWANCE_ABI,
+      functionName: "approve",
+      args: [PERMIT2_ADDRESS, MAX_UINT256],
+      account: state.walletAddress,
+      chain: VIEM_CHAIN2[chainId]
+    });
+    const publicClient = (0, import_viem5.createPublicClient)({
+      chain: VIEM_CHAIN2[chainId],
+      transport: (0, import_viem5.custom)(provider)
+    });
+    const receipt = await publicClient.waitForTransactionReceipt({
+      hash,
+      confirmations: 1
+    });
+    if (receipt.status !== "success") {
+      throw new Error(`Permit2 approval reverted (tx ${hash})`);
+    }
+    return hash;
+  }
   // --- Discovery (no wallet required) ---
   /**
    * Get the agent's average APY performance over a time period. Does not require a wallet connection.
@@ -2185,7 +2591,7 @@ var OwneySDK = class {
 };
 
 // src/agents/zyfai/zyfai.siwx.ts
-var import_viem5 = require("viem");
+var import_viem6 = require("viem");
 var import_siwe = require("siwe");
 var import_sdk2 = require("@zyfai/sdk");
 
@@ -2267,7 +2673,7 @@ function buildSIWXConfig(deps) {
       issuedAt,
       toString() {
         return new import_siwe.SiweMessage({
-          address: (0, import_viem5.getAddress)(accountAddress),
+          address: (0, import_viem6.getAddress)(accountAddress),
           chainId: numericChainId(chainId),
           domain,
           uri,