@owney/sdk 0.6.6-beta.3 → 0.6.6-beta.4

package/dist/index.cjs

@@ -583,6 +583,25 @@ var clearSession = (address, chainId) => {
   } catch {
   }
 };
+var SESSION_KEY_PREFIX = "owney.zyfai.sessionkey";
+var buildSessionKeyKey = (address, chainId) => `${SESSION_KEY_PREFIX}:${address.toLowerCase()}:${chainId}`;
+var wasSessionKeyActivated = (address, chainId) => {
+  const store = storage();
+  if (!store) return false;
+  try {
+    return store.getItem(buildSessionKeyKey(address, chainId)) === "1";
+  } catch {
+    return false;
+  }
+};
+var markSessionKeyActivated = (address, chainId) => {
+  const store = storage();
+  if (!store) return;
+  try {
+    store.setItem(buildSessionKeyKey(address, chainId), "1");
+  } catch {
+  }
+};
 
 // src/agents/zyfai/autoSelect.ts
 function buildAutoSelectUpdate(current, asset) {
@@ -836,7 +855,7 @@ var ZyfaiAgent = class {
     const wallet = await this.sdk.getSmartWalletAddress(address, validChainId);
     this.smartWalletCache.set(`${address}_${validChainId}`, wallet.address);
     if (!wallet.isDeployed) {
-      await this.sdk.deploySafe(address, validChainId, "aggressive", true);
+      await this.sdk.deploySafe(address, validChainId, "aggressive", false);
       try {
         if (validChainId === 42161) {
           await this.sdk.updateUserProfile({
@@ -854,10 +873,33 @@ var ZyfaiAgent = class {
         );
       }
     }
-    const user = await this.sdk.getUserDetails();
-    if (!user.hasActiveSessionKey) {
-      await this.sdk.createSessionKey(address, validChainId);
-    }
+    await this.ensureSessionKey(address, validChainId);
+  }
+  /**
+   * Ensures a session key is active for THIS chain.
+   *
+   * The Zyfai SDK tracks session-key state with a single global boolean — the
+   * in-memory `hasActiveSessionKey` and the `/users/me` field of the same name
+   * are neither chain-scoped. Once a key is activated on one chain, both
+   * `getUserDetails()` and the SDK's own `createSessionKey` guard report
+   * "active" on every other chain, so a deposit on a freshly-used chain runs
+   * without a valid session key and reverts. See [[zyfai-per-chain-session-key]].
+   *
+   * We keep our own per-(address, chainId) record of activated chains (in
+   * localStorage). On a miss we clear the SDK's global guard so
+   * `createSessionKey` actually signs and activates for THIS chain.
+   *
+   * Cost: on a chain we've never recorded (e.g. a key created on another device
+   * or a prior app version), this forces one `createSessionKey` — an extra
+   * wallet signature, idempotent on the backend. A prompt-free variant would
+   * read the session-validator module state on-chain instead of self-tracking.
+   */
+  async ensureSessionKey(address, chainId) {
+    if (wasSessionKeyActivated(address, chainId)) return;
+    const internals = this.sdk;
+    internals.hasActiveSessionKey = false;
+    await this.sdk.createSessionKey(address, chainId);
+    markSessionKeyActivated(address, chainId);
   }
   /** Connect + resolve smart wallet address for read operations. */
   async resolveSmartWallet(state, chainId) {
@@ -1007,9 +1049,7 @@ var ZyfaiAgent = class {
     await this.connectAuth(state, chainId);
     const validChainId = isValidChainId(chainId);
     const raw = await this.sdk.getUserDetails();
-    if (!raw.hasActiveSessionKey) {
-      await this.sdk.createSessionKey(this.getAddress(), validChainId);
-    }
+    await this.ensureSessionKey(this.getAddress(), validChainId);
     return mapUserProfile(raw, this.connectedAddress);
   }
   async ensureAutoSelectProtocols(state, chainId, asset) {

package/dist/index.js

@@ -551,6 +551,25 @@ var clearSession = (address, chainId) => {
   } catch {
   }
 };
+var SESSION_KEY_PREFIX = "owney.zyfai.sessionkey";
+var buildSessionKeyKey = (address, chainId) => `${SESSION_KEY_PREFIX}:${address.toLowerCase()}:${chainId}`;
+var wasSessionKeyActivated = (address, chainId) => {
+  const store = storage();
+  if (!store) return false;
+  try {
+    return store.getItem(buildSessionKeyKey(address, chainId)) === "1";
+  } catch {
+    return false;
+  }
+};
+var markSessionKeyActivated = (address, chainId) => {
+  const store = storage();
+  if (!store) return;
+  try {
+    store.setItem(buildSessionKeyKey(address, chainId), "1");
+  } catch {
+  }
+};
 
 // src/agents/zyfai/autoSelect.ts
 function buildAutoSelectUpdate(current, asset) {
@@ -804,7 +823,7 @@ var ZyfaiAgent = class {
     const wallet = await this.sdk.getSmartWalletAddress(address, validChainId);
     this.smartWalletCache.set(`${address}_${validChainId}`, wallet.address);
     if (!wallet.isDeployed) {
-      await this.sdk.deploySafe(address, validChainId, "aggressive", true);
+      await this.sdk.deploySafe(address, validChainId, "aggressive", false);
       try {
         if (validChainId === 42161) {
           await this.sdk.updateUserProfile({
@@ -822,10 +841,33 @@ var ZyfaiAgent = class {
         );
       }
     }
-    const user = await this.sdk.getUserDetails();
-    if (!user.hasActiveSessionKey) {
-      await this.sdk.createSessionKey(address, validChainId);
-    }
+    await this.ensureSessionKey(address, validChainId);
+  }
+  /**
+   * Ensures a session key is active for THIS chain.
+   *
+   * The Zyfai SDK tracks session-key state with a single global boolean — the
+   * in-memory `hasActiveSessionKey` and the `/users/me` field of the same name
+   * are neither chain-scoped. Once a key is activated on one chain, both
+   * `getUserDetails()` and the SDK's own `createSessionKey` guard report
+   * "active" on every other chain, so a deposit on a freshly-used chain runs
+   * without a valid session key and reverts. See [[zyfai-per-chain-session-key]].
+   *
+   * We keep our own per-(address, chainId) record of activated chains (in
+   * localStorage). On a miss we clear the SDK's global guard so
+   * `createSessionKey` actually signs and activates for THIS chain.
+   *
+   * Cost: on a chain we've never recorded (e.g. a key created on another device
+   * or a prior app version), this forces one `createSessionKey` — an extra
+   * wallet signature, idempotent on the backend. A prompt-free variant would
+   * read the session-validator module state on-chain instead of self-tracking.
+   */
+  async ensureSessionKey(address, chainId) {
+    if (wasSessionKeyActivated(address, chainId)) return;
+    const internals = this.sdk;
+    internals.hasActiveSessionKey = false;
+    await this.sdk.createSessionKey(address, chainId);
+    markSessionKeyActivated(address, chainId);
   }
   /** Connect + resolve smart wallet address for read operations. */
   async resolveSmartWallet(state, chainId) {
@@ -975,9 +1017,7 @@ var ZyfaiAgent = class {
     await this.connectAuth(state, chainId);
     const validChainId = isValidChainId(chainId);
     const raw = await this.sdk.getUserDetails();
-    if (!raw.hasActiveSessionKey) {
-      await this.sdk.createSessionKey(this.getAddress(), validChainId);
-    }
+    await this.ensureSessionKey(this.getAddress(), validChainId);
     return mapUserProfile(raw, this.connectedAddress);
   }
   async ensureAutoSelectProtocols(state, chainId, asset) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owney/sdk",
-  "version": "0.6.6-beta.3",
+  "version": "0.6.6-beta.4",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",