@owney/sdk 0.6.4 → 0.6.5-beta.1

package/dist/index.cjs

@@ -40,7 +40,7 @@ var P_SUPPORTED_CHAINS = {
   chainIds: [8453, 42161],
   chains: ["BASE", "ARBITRUM"]
 };
-var SUPPORTED_TOKENS = ["USDC", "USDT"];
+var SUPPORTED_TOKENS = ["USDC", "USDT", "WETH"];
 var SUPPORTED_CHAIN_IDS = P_SUPPORTED_CHAINS.chainIds;
 var SUPPORTED_CHAINS = P_SUPPORTED_CHAINS.chains;
 var SupportedAssets = [
@@ -61,6 +61,18 @@ var SupportedAssets = [
     symbol: "USDT",
     chainId: 42161,
     decimals: 6
+  },
+  {
+    address: `0x4200000000000000000000000000000000000006`,
+    symbol: "WETH",
+    chainId: 8453,
+    decimals: 18
+  },
+  {
+    address: `0x82aF49447D8a07e3bd95BD0d56f35241523fBab1`,
+    symbol: "WETH",
+    chainId: 42161,
+    decimals: 18
   }
 ];
 
@@ -141,6 +153,20 @@ var DayFilterMapping = {
 };
 
 // src/agents/zyfai/zyfai.mapper.ts
+var DECIMALS_BY_SYMBOL = {
+  usdc: 6,
+  usdt: 6,
+  weth: 18,
+  eth: 18,
+  cbeth: 18,
+  wbtc: 8,
+  cbbtc: 8
+};
+function tokenDecimals(symbol, explicit) {
+  if (typeof explicit === "number" && Number.isFinite(explicit))
+    return explicit;
+  return DECIMALS_BY_SYMBOL[(symbol ?? "").toLowerCase()] ?? 6;
+}
 function mapDeposit(raw) {
   return {
     txHash: raw.txHash,
@@ -198,9 +224,16 @@ function mapBalances(raw, _chainId, smartWallet) {
     pool: p.pool,
     asset: p.token_symbol ?? "",
     // Position amount is hex-encoded base units (like the token balances
-    // above). Supported assets (USDC/USDT) are 6-decimal — hexToDecimal's
-    // default — so no per-token decimals lookup is needed.
-    amount: String(hexToDecimal(p.amount || "0")),
+    // above). `PositionSlot` doesn't type a `decimals` field, but runtime
+    // getBalances payloads often carry one (e.g. 18 for WETH) — prefer that
+    // when present, otherwise fall back to the per-symbol lookup so
+    // non-6-decimal assets like WETH don't render 1e12 too large.
+    amount: String(
+      hexToDecimal(
+        p.amount || "0",
+        tokenDecimals(p.token_symbol, p.decimals)
+      )
+    ),
     apy: p.pool_apy,
     tvl: p.pool_tvl,
     // PositionSlot has no `liquidity` field yet; Zyfai will add it. Narrow
@@ -323,7 +356,15 @@ function mapEntries(rawEntries, chainId) {
           fromPool: from.pool,
           toPool: to.pool,
           tokenSymbol: matched?.token_symbol ?? "",
-          amount: matched ? String(hexToDecimal(matched.amount || "0x")) : "",
+          amount: matched ? String(
+            hexToDecimal(
+              matched.amount || "0x",
+              tokenDecimals(
+                matched.token_symbol,
+                matched.decimals
+              )
+            )
+          ) : "",
           status: "success"
         }
       ];
@@ -342,7 +383,12 @@ function mapEntries(rawEntries, chainId) {
           txHashes: entry.transactionHash ? [entry.transactionHash] : [],
           chainId: entry.chainId,
           tokenSymbol: entry?.positions?.[0]?.token_symbol,
-          amount: hasAmount ? String(hexToDecimal(rawAmount)) : void 0
+          amount: hasAmount ? String(
+            hexToDecimal(
+              rawAmount,
+              tokenDecimals(entry?.positions?.[0]?.token_symbol)
+            )
+          ) : void 0
         }
       ],
       rebalanceLog
@@ -545,11 +591,26 @@ var clearSession = (address, chainId) => {
   }
 };
 
+// src/agents/zyfai/autoSelect.ts
+function buildAutoSelectUpdate(current, asset) {
+  if (current.autoSelectProtocols === true)
+    return null;
+  return {
+    asset,
+    autoSelectProtocols: true,
+    ...current.chains ? { chains: current.chains } : {}
+  };
+}
+
 // src/agents/zyfai/zyfai.agent.ts
 var DEFAULT_ZYFAI_RPC_URLS = {
   8453: "https://base-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V",
   42161: "https://arb-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V"
 };
+var WETH_ADDRESS_BY_CHAIN = {
+  8453: "0x4200000000000000000000000000000000000006",
+  42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1"
+};
 var VIEM_CHAIN = { 8453: import_chains.base, 42161: import_chains.arbitrum };
 var ZyfaiAgent = class {
   id = "zyfai";
@@ -558,12 +619,18 @@ var ZyfaiAgent = class {
     {
       chainId: 8453,
       chain: "BASE",
-      assets: [{ symbol: "USDC", minDepositAmount: "1500000" }]
+      assets: [
+        { symbol: "USDC", minDepositAmount: "1500000" },
+        { symbol: "WETH", minDepositAmount: "500000000000000" }
+      ]
     },
     {
       chainId: 42161,
       chain: "ARBITRUM",
-      assets: [{ symbol: "USDC", minDepositAmount: "1500000" }]
+      assets: [
+        { symbol: "USDC", minDepositAmount: "1500000" },
+        { symbol: "WETH", minDepositAmount: "500000000000000" }
+      ]
     }
   ];
   sdk;
@@ -598,22 +665,24 @@ var ZyfaiAgent = class {
   }
   /**
    * Fills in the true withdrawn amount for `Withdraw` entries by decoding the
-   * USDC `Transfer` that lands in the user's wallet on-chain. The Zyfai history
+   * on-chain `Transfer` that lands in the user's wallet. The Zyfai history
    * payload only reports the *remaining* position for a partial withdraw (see
    * the note in `mapEntries`), so without this the UI shows the leftover
    * balance instead of the amount withdrawn.
    *
+   * The withdrawn asset varies per entry (USDC or WETH), so it's resolved
+   * from `tx.tokenSymbol` (set by `mapEntries` from the entry's own
+   * position) rather than assumed to always be USDC. Zyfai sometimes
+   * denominates WETH as lowercase "eth" — that's normalized to WETH.
+   * Entries with no symbol (older payload shapes) fall back to USDC to
+   * preserve prior behavior.
+   *
    * Mutates `entries` in place. Runs all lookups concurrently and is tolerant
    * of RPC failures: an entry whose amount can't be resolved keeps
    * `amount: undefined`, which consumers render as a hidden/retryable row
    * rather than a wrong number.
    */
   async resolveWithdrawnAmounts(entries, chainId, recipient) {
-    const asset = SupportedAssets.find(
-      (a) => a.chainId === chainId && a.symbol === "USDC"
-    );
-    if (!asset)
-      return;
     const withdrawals = entries.filter(
       (e) => e.action === "Withdraw" && e.transactions[0]?.txHashes[0]
     );
@@ -624,7 +693,17 @@ var ZyfaiAgent = class {
       withdrawals.map(async (entry) => {
         const tx = entry.transactions[0];
         const txHash = tx.txHashes[0];
-        const cached = this.withdrawAmountCache.get(txHash);
+        const rawSymbol = tx.tokenSymbol;
+        const normalizedSymbol = rawSymbol ? rawSymbol.toLowerCase() === "eth" ? "WETH" : rawSymbol.toUpperCase() : "USDC";
+        const asset = SupportedAssets.find(
+          (a) => a.chainId === chainId && a.symbol === normalizedSymbol
+        ) ?? SupportedAssets.find(
+          (a) => a.chainId === chainId && a.symbol === "USDC"
+        );
+        if (!asset)
+          return;
+        const cacheKey = `${txHash}:${asset.address}`;
+        const cached = this.withdrawAmountCache.get(cacheKey);
         if (cached !== void 0) {
           tx.amount = cached;
           return;
@@ -640,7 +719,7 @@ var ZyfaiAgent = class {
             asset.decimals
           );
           if (amount !== void 0) {
-            this.withdrawAmountCache.set(txHash, amount);
+            this.withdrawAmountCache.set(cacheKey, amount);
             tx.amount = amount;
           }
         } catch {
@@ -758,6 +837,22 @@ var ZyfaiAgent = class {
     this.smartWalletCache.set(`${address}_${validChainId}`, wallet.address);
     if (!wallet.isDeployed) {
       await this.sdk.deploySafe(address, validChainId, "aggressive", true);
+      try {
+        if (validChainId === 42161) {
+          await this.sdk.updateUserProfile({
+            asset: "WETH",
+            chains: [validChainId],
+            protocols: ["c24a33fa-4a87-4376-b756-93bd3957d3ea"],
+            // AAVE protocol ID
+            autoSelectProtocols: false
+          });
+        }
+      } catch (err) {
+        console.warn(
+          "Failed to configure AAVE protocol after Safe deployment:",
+          err instanceof Error ? err.message : String(err)
+        );
+      }
     }
     const user = await this.sdk.getUserDetails();
     if (!user.hasActiveSessionKey) {
@@ -799,7 +894,7 @@ var ZyfaiAgent = class {
       throw error;
     }
   }
-  async deposit(state, chainId, amount, depositCallback) {
+  async deposit(state, chainId, amount, asset, depositCallback) {
     try {
       await this.connectFull(state, chainId);
       const validChainId = isValidChainId(chainId);
@@ -813,13 +908,15 @@ var ZyfaiAgent = class {
           validChainId,
           amount
         );
-        await this.sdk.logDeposit(validChainId, txHash, amount);
+        const tokenAddress = asset === "WETH" ? WETH_ADDRESS_BY_CHAIN[validChainId] : void 0;
+        await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
         return { txHash, smartWallet: wallet.address, amount };
       }
       const raw = await this.sdk.depositFunds(
         this.getAddress(),
         validChainId,
-        amount
+        amount,
+        asset
       );
       return mapDeposit(raw);
     } catch (error) {
@@ -915,6 +1012,21 @@ var ZyfaiAgent = class {
     }
     return mapUserProfile(raw, this.connectedAddress);
   }
+  async ensureAutoSelectProtocols(state, chainId, asset) {
+    await this.connectAuth(state, chainId);
+    const current = await this.sdk.getUserDetails(asset);
+    const update = buildAutoSelectUpdate(
+      {
+        autoSelectProtocols: current.autoSelectProtocols,
+        chains: current.chains
+      },
+      asset
+    );
+    if (!update)
+      return false;
+    await this.sdk.updateUserProfile(update);
+    return true;
+  }
   // --- IAgent: Discovery (no wallet required) ---
   async getAgentApy(days, options) {
     const raw = await this.sdk.getAPYPerStrategy(
@@ -1118,7 +1230,7 @@ function aggregateApyByChainAndAsset(agentApys, agentBalances) {
 }
 
 // src/client.ts
-var import_viem4 = require("viem");
+var import_viem5 = require("viem");
 var import_chains2 = require("viem/chains");
 
 // src/lib/transfer-auth.ts
@@ -1190,6 +1302,70 @@ async function postSponsorTransferAuth(input) {
   }
   return parsed.data;
 }
+async function postSponsorPermit2Transfer(input) {
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
+  let res;
+  try {
+    res = await fetch(`${base3}/api/v1/sponsor/permit2-transfer`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-owney-api-key": input.apiKey },
+      body: JSON.stringify(input.body)
+    });
+  } catch (networkError) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
+      { cause: String(networkError), safeToFallback: false }
+    );
+  }
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+  }
+  if (!res.ok || !parsed?.success || !parsed.data) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+      {
+        statusCode: res.status,
+        responseBody: text.slice(0, 500),
+        safeToFallback: res.status >= 400 && res.status < 500
+      }
+    );
+  }
+  return parsed.data;
+}
+async function getSponsorRelayerAddress(input) {
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
+  let res;
+  try {
+    res = await fetch(`${base3}/api/v1/sponsor/relayer-address?chainId=${input.chainId}`, {
+      headers: { "x-owney-api-key": input.apiKey }
+    });
+  } catch (networkError) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
+      { cause: String(networkError), safeToFallback: true }
+    );
+  }
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+  }
+  if (!res.ok || !parsed?.success || !parsed.data?.relayer) {
+    throw new OwneyError(
+      "SPONSOR_REQUEST_FAILED",
+      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+      { statusCode: res.status, responseBody: text.slice(0, 500), safeToFallback: true }
+    );
+  }
+  return parsed.data.relayer;
+}
 
 // src/lib/sponsored-deposit.ts
 var AUTH_WINDOW_SECONDS = 15 * 60;
@@ -1241,6 +1417,114 @@ function makeSponsoredDepositCallback(deps) {
   };
 }
 
+// src/lib/permit2.ts
+var import_viem4 = require("viem");
+var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var MAX_UINT256 = 2n ** 256n - 1n;
+var ERC20_ALLOWANCE_ABI = [
+  {
+    type: "function",
+    name: "allowance",
+    stateMutability: "view",
+    inputs: [{ name: "owner", type: "address" }, { name: "spender", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "approve",
+    stateMutability: "nonpayable",
+    inputs: [{ name: "spender", type: "address" }, { name: "amount", type: "uint256" }],
+    outputs: [{ name: "", type: "bool" }]
+  }
+];
+function buildPermitTransferFromTypedData(input) {
+  return {
+    domain: { name: "Permit2", chainId: input.chainId, verifyingContract: PERMIT2_ADDRESS },
+    types: {
+      PermitTransferFrom: [
+        { name: "permitted", type: "TokenPermissions" },
+        { name: "spender", type: "address" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint256" }
+      ],
+      TokenPermissions: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint256" }
+      ]
+    },
+    primaryType: "PermitTransferFrom",
+    message: input.message
+  };
+}
+function randomPermit2Nonce() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return BigInt((0, import_viem4.bytesToHex)(bytes));
+}
+async function readPermit2Allowance(publicClient, token, owner) {
+  return publicClient.readContract({
+    address: token,
+    abi: ERC20_ALLOWANCE_ABI,
+    functionName: "allowance",
+    args: [owner, PERMIT2_ADDRESS]
+  });
+}
+
+// src/lib/sponsored-weth-deposit.ts
+var PERMIT_WINDOW_SECONDS = 15 * 60;
+function makeSponsoredWethCallback(deps) {
+  const get = deps.httpGet ?? getSponsorRelayerAddress;
+  const post = deps.httpPost ?? postSponsorPermit2Transfer;
+  return async (smartWallet, chainId, amount) => {
+    const cid = chainId;
+    const token = deps.tokenAddressByChain[cid];
+    if (!token) {
+      throw new OwneyError("CHAIN_UNSUPPORTED", `No sponsored WETH configured for chain ${chainId}`);
+    }
+    const amountWei = BigInt(amount);
+    const pub = deps.getPublicClient(cid);
+    const allowance = await readPermit2Allowance(pub, token, deps.ownerAddress);
+    if (allowance < amountWei) {
+      throw new OwneyError(
+        "PERMIT2_APPROVAL_REQUIRED",
+        "WETH gasless deposits need a one-time Permit2 approval; call approvePermit2() first",
+        { token, chainId: cid, allowance: allowance.toString(), amount }
+      );
+    }
+    const relayer = await get({ baseUrl: deps.baseUrl, apiKey: deps.apiKey, chainId: cid });
+    const nonce = randomPermit2Nonce();
+    const deadline = BigInt(Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS);
+    const typedData = buildPermitTransferFromTypedData({
+      chainId: cid,
+      message: {
+        permitted: { token, amount: amountWei },
+        spender: relayer,
+        nonce,
+        deadline
+      }
+    });
+    const wallet = deps.getWalletClient(cid);
+    const signature = await wallet.signTypedData(
+      { account: deps.ownerAddress, ...typedData }
+    );
+    const result = await post({
+      baseUrl: deps.baseUrl,
+      apiKey: deps.apiKey,
+      body: {
+        chainId: cid,
+        token,
+        from: deps.ownerAddress,
+        to: smartWallet,
+        amount,
+        nonce: nonce.toString(),
+        deadline: deadline.toString(),
+        signature
+      }
+    });
+    return result.txHash;
+  };
+}
+
 // src/client.ts
 function encodeMultiAgentCursor(map) {
   return Buffer.from(JSON.stringify(map), "utf8").toString("base64");
@@ -1270,6 +1554,13 @@ var VIEM_CHAIN2 = {
   8453: import_chains2.base,
   42161: import_chains2.arbitrum
 };
+var SPONSORED_WETH_BY_CHAIN = {
+  8453: "0x4200000000000000000000000000000000000006",
+  42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1"
+};
+function shouldFallbackToUserPaid(error, asset, appCallback) {
+  return asset === "WETH" && appCallback === void 0 && error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED" && error.details?.safeToFallback === true;
+}
 var OwneySDK = class {
   agents = /* @__PURE__ */ new Map();
   activeAgents = /* @__PURE__ */ new Set();
@@ -1283,6 +1574,7 @@ var OwneySDK = class {
   apiKey;
   zyfaiRpcUrls;
   cachedSponsoredCallback = null;
+  cachedWethSponsoredCallback = null;
   initializingAgentsPromise = null;
   constructor(config) {
     this.apiKey = config.apiKey;
@@ -1307,6 +1599,7 @@ var OwneySDK = class {
     }
     this.state = { provider, walletAddress, chainId: null };
     this.cachedSponsoredCallback = null;
+    this.cachedWethSponsoredCallback = null;
   }
   /**
    * Disconnect from all agents and clear connection state.
@@ -1320,6 +1613,7 @@ var OwneySDK = class {
     this.disabledAgents.clear();
     this.state = null;
     this.cachedSponsoredCallback = null;
+    this.cachedWethSponsoredCallback = null;
   }
   isAgentDisabled(agentId) {
     return this.disabledAgents.has(agentId);
@@ -1381,18 +1675,48 @@ var OwneySDK = class {
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
       // runtime, but the two share a name TS treats as unrelated.
-      getPublicClient: (cid) => (0, import_viem4.createPublicClient)({
+      getPublicClient: (cid) => (0, import_viem5.createPublicClient)({
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem4.custom)(provider)
+        transport: (0, import_viem5.custom)(provider)
       }),
-      getWalletClient: (cid) => (0, import_viem4.createWalletClient)({
+      getWalletClient: (cid) => (0, import_viem5.createWalletClient)({
         account: owner,
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem4.custom)(provider)
+        transport: (0, import_viem5.custom)(provider)
       })
     });
     return this.cachedSponsoredCallback;
   }
+  /**
+   * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
+   * callback used when the caller omits `depositCallback` for a WETH
+   * deposit. Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
+   * `PermitTransferFrom` instead of an EIP-3009 authorization.
+   */
+  getDefaultWethSponsoredCallback() {
+    if (this.cachedWethSponsoredCallback)
+      return this.cachedWethSponsoredCallback;
+    const provider = this.requireConnectedProvider();
+    const owner = this.state.walletAddress;
+    this.cachedWethSponsoredCallback = makeSponsoredWethCallback({
+      apiKey: this.apiKey,
+      ownerAddress: owner,
+      tokenAddressByChain: SPONSORED_WETH_BY_CHAIN,
+      // Casts work around viem's chain-narrowed Client vs the generic
+      // PublicClient/WalletClient param types — structurally identical at
+      // runtime, but the two share a name TS treats as unrelated.
+      getPublicClient: (cid) => (0, import_viem5.createPublicClient)({
+        chain: VIEM_CHAIN2[cid],
+        transport: (0, import_viem5.custom)(provider)
+      }),
+      getWalletClient: (cid) => (0, import_viem5.createWalletClient)({
+        account: owner,
+        chain: VIEM_CHAIN2[cid],
+        transport: (0, import_viem5.custom)(provider)
+      })
+    });
+    return this.cachedWethSponsoredCallback;
+  }
   getAgent(agentId) {
     const agent = this.agents.get(agentId);
     if (!agent) {
@@ -1546,7 +1870,7 @@ var OwneySDK = class {
     }
     const state = this.requireState();
     const chainId = this.requireChainId();
-    const effectiveCallback = depositCallback ?? this.getDefaultSponsoredCallback();
+    const effectiveCallback = depositCallback ?? (asset === "WETH" ? this.getDefaultWethSponsoredCallback() : this.getDefaultSponsoredCallback());
     if (agentId) {
       if (this.isAgentDisabled(agentId)) {
         throw new OwneyError(
@@ -1558,10 +1882,14 @@ var OwneySDK = class {
       const agent = this.getAgent(agentId);
       this.validateAssetSupport(agent, chainId, asset);
       await this.validateMinDepositAmount(agent, state, chainId, asset, amount);
-      return withFailureReporting(
-        this.apiKey,
-        agent.id,
-        () => agent.deposit(state, chainId, amount, effectiveCallback)
+      return this.depositWithFallback(
+        agent,
+        state,
+        chainId,
+        amount,
+        asset,
+        effectiveCallback,
+        depositCallback
       );
     }
     const totalAmount = BigInt(amount);
@@ -1592,14 +1920,78 @@ var OwneySDK = class {
     }
     const agentResults = {};
     for (const { agent, amount: agentAmount } of agentAmounts) {
-      agentResults[agent.id] = await withFailureReporting(
-        this.apiKey,
-        agent.id,
-        () => agent.deposit(state, chainId, agentAmount, effectiveCallback)
+      agentResults[agent.id] = await this.depositWithFallback(
+        agent,
+        state,
+        chainId,
+        agentAmount,
+        asset,
+        effectiveCallback,
+        depositCallback
       );
     }
     return { agentResults };
   }
+  /**
+   * Invokes `agent.deposit` with the resolved sponsored callback, composing
+   * two independent auto-recovery mechanisms:
+   *
+   * 1. Missing Permit2 allowance: when the app did not supply its own
+   *    callback and the attempt fails with `PERMIT2_APPROVAL_REQUIRED` on a
+   *    WETH deposit, this is the wallet's first gasless WETH deposit. We send
+   *    the one-time (user-paid) Permit2 approval via `approvePermit2()` and
+   *    retry the SAME sponsored attempt once. Bounded to one approval attempt
+   *    per call so a wallet/agent that keeps reporting the allowance as
+   *    missing can't loop forever. If `approvePermit2()` itself throws (e.g.
+   *    the user rejects the wallet prompt), that error propagates as-is —
+   *    the user said no to a transaction, so we must not turn around and ask
+   *    them to pay for a different one via the fallback below.
+   * 2. `shouldFallbackToUserPaid`: the SDK's own WETH sponsor path failed at
+   *    the infrastructure layer in a provably safe-to-retry way, so we warn
+   *    and retry once with `undefined`, falling through to a user-paid
+   *    native deposit. This still applies after a successful Permit2
+   *    approval retry (the retried sponsored attempt can itself hit a safe
+   *    sponsor failure).
+   *
+   * Any other error — an app-supplied callback's own failure in particular —
+   * propagates unchanged. Scoped per agent invocation so one agent's failure
+   * doesn't force a retry of sibling agents in a multi-agent split.
+   */
+  async depositWithFallback(agent, state, chainId, amount, asset, effectiveCallback, appCallback) {
+    const attempt = (callback) => withFailureReporting(
+      this.apiKey,
+      agent.id,
+      () => agent.deposit(
+        state,
+        chainId,
+        amount,
+        asset,
+        callback
+      )
+    );
+    let approvalAttempted = false;
+    for (; ; ) {
+      try {
+        return await attempt(effectiveCallback);
+      } catch (error) {
+        if (!approvalAttempted && appCallback === void 0 && asset === "WETH" && error instanceof OwneyError && error.code === "PERMIT2_APPROVAL_REQUIRED") {
+          approvalAttempted = true;
+          console.warn(
+            "[owney-sdk] First WETH deposit: sending one-time Permit2 approval..."
+          );
+          await this.approvePermit2();
+          continue;
+        }
+        if (!shouldFallbackToUserPaid(error, asset, appCallback))
+          throw error;
+        console.warn(
+          "[owney-sdk] WETH sponsorship unavailable, falling back to user-paid deposit:",
+          error
+        );
+        return attempt(void 0);
+      }
+    }
+  }
   getMinDepositAmount(agent, chainId, asset) {
     const chainAssets = agent.supportedAssets.find(
       (sa) => sa.chainId === chainId
@@ -2087,6 +2479,66 @@ var OwneySDK = class {
       agentUserProfile: results
     };
   }
+  /**
+   * Ensure the given asset uses backend protocol auto-selection for the active
+   * chain's account. No-op (returns false) for agents that don't support it.
+   * @param asset - "USDC" or "WETH".
+   * @param agentId - Agent to target. Defaults to "zyfai".
+   * @returns whether a profile write occurred.
+   */
+  async ensureAutoSelectProtocols(asset, agentId = "zyfai") {
+    const state = this.requireState();
+    const chainId = this.requireChainId();
+    const agent = this.getAgent(agentId);
+    if (typeof agent.ensureAutoSelectProtocols !== "function")
+      return false;
+    return agent.ensureAutoSelectProtocols(state, chainId, asset);
+  }
+  /**
+   * One-time, user-paid approval of Permit2 on the sponsored WETH token for
+   * the active chain. Required once per wallet per chain before gasless WETH
+   * deposits; afterwards deposit() is signature-only. Resolves only after the
+   * approval transaction is mined (1 confirmation), so a subsequent deposit()
+   * will see the new allowance; throws if the transaction reverted.
+   * @returns the approval transaction hash.
+   */
+  async approvePermit2(asset = "WETH") {
+    const state = this.requireState();
+    const chainId = this.requireChainId();
+    const token = SPONSORED_WETH_BY_CHAIN[chainId];
+    if (!token) {
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored WETH on chain ${chainId}`
+      );
+    }
+    const provider = this.requireConnectedProvider();
+    const wallet = (0, import_viem5.createWalletClient)({
+      account: state.walletAddress,
+      chain: VIEM_CHAIN2[chainId],
+      transport: (0, import_viem5.custom)(provider)
+    });
+    const hash = await wallet.writeContract({
+      address: token,
+      abi: ERC20_ALLOWANCE_ABI,
+      functionName: "approve",
+      args: [PERMIT2_ADDRESS, MAX_UINT256],
+      account: state.walletAddress,
+      chain: VIEM_CHAIN2[chainId]
+    });
+    const publicClient = (0, import_viem5.createPublicClient)({
+      chain: VIEM_CHAIN2[chainId],
+      transport: (0, import_viem5.custom)(provider)
+    });
+    const receipt = await publicClient.waitForTransactionReceipt({
+      hash,
+      confirmations: 1
+    });
+    if (receipt.status !== "success") {
+      throw new Error(`Permit2 approval reverted (tx ${hash})`);
+    }
+    return hash;
+  }
   // --- Discovery (no wallet required) ---
   /**
    * Get the agent's average APY performance over a time period. Does not require a wallet connection.
@@ -2185,7 +2637,7 @@ var OwneySDK = class {
 };
 
 // src/agents/zyfai/zyfai.siwx.ts
-var import_viem5 = require("viem");
+var import_viem6 = require("viem");
 var import_siwe = require("siwe");
 var import_sdk2 = require("@zyfai/sdk");
 
@@ -2267,7 +2719,7 @@ function buildSIWXConfig(deps) {
       issuedAt,
       toString() {
         return new import_siwe.SiweMessage({
-          address: (0, import_viem5.getAddress)(accountAddress),
+          address: (0, import_viem6.getAddress)(accountAddress),
           chainId: numericChainId(chainId),
           domain,
           uri,