@owney/sdk 0.6.7 → 0.6.8-beta.2

package/dist/index.cjs

@@ -535,7 +535,8 @@ var storage = () => {
     return null;
   }
 };
-var buildKey = (address, chainId) => `${KEY_PREFIX}:${address.toLowerCase()}:${chainId}`;
+var buildKey = (address) => `${KEY_PREFIX}:${address.toLowerCase()}`;
+var legacyKeyPrefix = (address) => `${KEY_PREFIX}:${address.toLowerCase()}:`;
 var isJwtExpired = (token) => {
   const parts = token.split(".");
   if (parts.length !== 3) return false;
@@ -552,9 +553,37 @@ var isJwtExpired = (token) => {
 };
 var memorySessions = /* @__PURE__ */ new Map();
 var isFreshSession = (session) => !!session && !!session.token && !isJwtExpired(session.token);
-var readSession = (address, chainId) => {
+var readLegacySession = (store, address) => {
+  if (!store) return null;
+  const prefix = legacyKeyPrefix(address);
+  const legacyKeys = [];
+  try {
+    for (let i = 0; i < store.length; i++) {
+      const key = store.key(i);
+      if (key?.startsWith(prefix)) legacyKeys.push(key);
+    }
+  } catch {
+    return null;
+  }
+  let adopted = null;
+  for (const key of legacyKeys) {
+    if (!adopted) {
+      try {
+        const parsed = JSON.parse(store.getItem(key) ?? "");
+        if (isFreshSession(parsed)) adopted = parsed;
+      } catch {
+      }
+    }
+    try {
+      store.removeItem(key);
+    } catch {
+    }
+  }
+  return adopted;
+};
+var readSession = (address, _chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey(address, chainId);
+  const key = buildKey(address);
   const store = storage();
   let raw = null;
   try {
@@ -575,14 +604,19 @@ var readSession = (address, chainId) => {
     }
     return null;
   }
+  const legacy = readLegacySession(store, address);
+  if (legacy) {
+    writeSession(address, _chainId, legacy);
+    return legacy;
+  }
   const cached = memorySessions.get(key);
   if (isFreshSession(cached)) return cached;
   if (cached) memorySessions.delete(key);
   return null;
 };
-var writeSession = (address, chainId, session) => {
+var writeSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey(address, chainId);
+  const key = buildKey(address);
   memorySessions.set(key, session);
   const store = storage();
   try {
@@ -590,14 +624,15 @@ var writeSession = (address, chainId, session) => {
   } catch {
   }
 };
-var clearSession = (address, chainId) => {
-  const key = buildKey(address, chainId);
+var clearSession = (address, _chainId) => {
+  const key = buildKey(address);
   memorySessions.delete(key);
   const store = storage();
   try {
     store?.removeItem(key);
   } catch {
   }
+  readLegacySession(store, address);
 };
 
 // src/agents/zyfai/autoSelect.ts
@@ -686,11 +721,15 @@ var ZyfaiAgent = class {
   // successful decode is cached forever; failures are NOT cached so a transient
   // RPC error retries on the next fetch.
   withdrawAmountCache = /* @__PURE__ */ new Map();
-  constructor(apiKey, rpcUrls) {
+  constructor(apiKey, rpcUrls, referralSource) {
     this.rpcUrls = rpcUrls ?? DEFAULT_ZYFAI_RPC_URLS;
     this.sdk = new import_sdk.ZyfaiSDK({
       apiKey,
-      rpcUrls: this.rpcUrls
+      rpcUrls: this.rpcUrls,
+      // Forwarded to /auth/login by the SDK's own SIWE handshake, so
+      // attribution survives without the AppKit SIWX config (which carried it
+      // via `createOwneySIWX({ referralSource })` when apps used the modal).
+      referralSource
     });
     this.installAuthCache();
   }
@@ -1012,7 +1051,14 @@ var ZyfaiAgent = class {
           amount
         );
         const tokenAddress = asset === "WETH" ? WETH_ADDRESS_BY_CHAIN[validChainId] : void 0;
-        await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
+        try {
+          await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
+        } catch (logError) {
+          console.warn(
+            "[owney-sdk] Deposit landed on-chain but logDeposit failed (non-fatal):",
+            logError
+          );
+        }
         return { txHash, smartWallet: wallet.address, amount };
       }
       const raw = await this.sdk.depositFunds(
@@ -1494,18 +1540,29 @@ function makeSponsoredDepositCallback(deps) {
     const wallet = deps.getWalletClient(cid);
     const { tokenName, tokenVersion } = await readTokenMeta(pub, token);
     const validAfter = 0n;
-    const validBefore = BigInt(Math.floor(Date.now() / 1e3) + AUTH_WINDOW_SECONDS);
+    const validBefore = BigInt(
+      Math.floor(Date.now() / 1e3) + AUTH_WINDOW_SECONDS
+    );
     const nonce = randomAuthNonce();
     const typedData = buildTransferWithAuthorizationTypedData({
       token,
       chainId: cid,
       tokenName,
       tokenVersion,
-      message: { from: deps.ownerAddress, to: smartWallet, value: BigInt(amount), validAfter, validBefore, nonce }
+      message: {
+        from: deps.ownerAddress,
+        to: smartWallet,
+        value: BigInt(amount),
+        validAfter,
+        validBefore,
+        nonce
+      }
     });
-    const authSignature = await wallet.signTypedData(
-      { account: deps.ownerAddress, ...typedData }
-    );
+    const authSignature = await wallet.signTypedData({
+      account: deps.ownerAddress,
+      ...typedData
+    });
+    deps.onApproved?.();
     const result = await post({
       baseUrl: deps.baseUrl,
       apiKey: deps.apiKey,
@@ -1589,7 +1646,10 @@ function makeSponsoredWethCallback(deps) {
     const cid = chainId;
     const token = deps.tokenAddressByChain[cid];
     if (!token) {
-      throw new OwneyError("CHAIN_UNSUPPORTED", `No sponsored WETH configured for chain ${chainId}`);
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored WETH configured for chain ${chainId}`
+      );
     }
     const amountWei = BigInt(amount);
     const pub = deps.getPublicClient(cid);
@@ -1601,9 +1661,15 @@ function makeSponsoredWethCallback(deps) {
         { token, chainId: cid, allowance: allowance.toString(), amount }
       );
     }
-    const relayer = await get({ baseUrl: deps.baseUrl, apiKey: deps.apiKey, chainId: cid });
+    const relayer = await get({
+      baseUrl: deps.baseUrl,
+      apiKey: deps.apiKey,
+      chainId: cid
+    });
     const nonce = randomPermit2Nonce();
-    const deadline = BigInt(Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS);
+    const deadline = BigInt(
+      Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS
+    );
     const typedData = buildPermitTransferFromTypedData({
       chainId: cid,
       message: {
@@ -1614,9 +1680,11 @@ function makeSponsoredWethCallback(deps) {
       }
     });
     const wallet = deps.getWalletClient(cid);
-    const signature = await wallet.signTypedData(
-      { account: deps.ownerAddress, ...typedData }
-    );
+    const signature = await wallet.signTypedData({
+      account: deps.ownerAddress,
+      ...typedData
+    });
+    deps.onApproved?.();
     const result = await post({
       baseUrl: deps.baseUrl,
       apiKey: deps.apiKey,
@@ -1687,6 +1755,7 @@ var OwneySDK = class {
   apiKey;
   zyfaiRpcUrls;
   routingApiBaseUrl;
+  referralSource;
   cachedSponsoredCallback = null;
   cachedWethSponsoredCallback = null;
   initializingAgentsPromise = null;
@@ -1694,6 +1763,7 @@ var OwneySDK = class {
     this.apiKey = config.apiKey;
     this.zyfaiRpcUrls = config.zyfaiRpcUrls;
     this.routingApiBaseUrl = config.routingApiBaseUrl;
+    this.referralSource = config.referralSource;
   }
   /**
    * Establish connection state for all subsequent SDK calls.
@@ -1777,14 +1847,16 @@ var OwneySDK = class {
    * provider with viem `custom(provider)` to read token meta and sign the
    * `TransferWithAuthorization`, then POSTs to the sponsor API.
    */
-  getDefaultSponsoredCallback() {
-    if (this.cachedSponsoredCallback) return this.cachedSponsoredCallback;
+  getDefaultSponsoredCallback(onApproved) {
+    if (!onApproved && this.cachedSponsoredCallback)
+      return this.cachedSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    this.cachedSponsoredCallback = makeSponsoredDepositCallback({
+    const callback = makeSponsoredDepositCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
+      onApproved,
       tokenAddressByChain: SPONSORED_USDC_BY_CHAIN,
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
@@ -1799,7 +1871,8 @@ var OwneySDK = class {
         transport: (0, import_viem5.custom)(provider)
       })
     });
-    return this.cachedSponsoredCallback;
+    if (!onApproved) this.cachedSponsoredCallback = callback;
+    return callback;
   }
   /**
    * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
@@ -1807,15 +1880,16 @@ var OwneySDK = class {
    * deposit. Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
    * `PermitTransferFrom` instead of an EIP-3009 authorization.
    */
-  getDefaultWethSponsoredCallback() {
-    if (this.cachedWethSponsoredCallback)
+  getDefaultWethSponsoredCallback(onApproved) {
+    if (!onApproved && this.cachedWethSponsoredCallback)
       return this.cachedWethSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    this.cachedWethSponsoredCallback = makeSponsoredWethCallback({
+    const callback = makeSponsoredWethCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
+      onApproved,
       tokenAddressByChain: SPONSORED_WETH_BY_CHAIN,
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
@@ -1830,7 +1904,8 @@ var OwneySDK = class {
         transport: (0, import_viem5.custom)(provider)
       })
     });
-    return this.cachedWethSponsoredCallback;
+    if (!onApproved) this.cachedWethSponsoredCallback = callback;
+    return callback;
   }
   getAgent(agentId) {
     const agent = this.agents.get(agentId);
@@ -1877,7 +1952,7 @@ var OwneySDK = class {
   }
   createAgent(agentId, key) {
     if (agentId === "zyfai") {
-      return new ZyfaiAgent(key, this.zyfaiRpcUrls);
+      return new ZyfaiAgent(key, this.zyfaiRpcUrls, this.referralSource);
     }
     return null;
   }
@@ -1976,13 +2051,13 @@ var OwneySDK = class {
    * @returns {OwneyDepositResult} for a single agent, or {OwneyMultiDepositResult} with per-agent results
    */
   async deposit(options) {
-    const { amount, asset, depositCallback, agentId } = options;
+    const { amount, asset, depositCallback, agentId, onApproved } = options;
     if (BigInt(amount) === 0n) {
       return { agentResults: {} };
     }
     const state = this.requireState();
     const chainId = this.requireChainId();
-    const effectiveCallback = depositCallback ?? (asset === "WETH" ? this.getDefaultWethSponsoredCallback() : this.getDefaultSponsoredCallback());
+    const effectiveCallback = depositCallback ?? (asset === "WETH" ? this.getDefaultWethSponsoredCallback(onApproved) : this.getDefaultSponsoredCallback(onApproved));
     if (agentId) {
       if (this.isAgentDisabled(agentId)) {
         throw new OwneyError(
@@ -2763,11 +2838,39 @@ var storage2 = () => {
     return null;
   }
 };
-var buildKey2 = (address, chainId) => `${KEY_PREFIX2}:${address.toLowerCase()}:${chainId}`;
+var buildKey2 = (address) => `${KEY_PREFIX2}:${address.toLowerCase()}`;
+var legacyKeyPrefix2 = (address) => `${KEY_PREFIX2}:${address.toLowerCase()}:`;
 var memorySiwxSessions = /* @__PURE__ */ new Map();
+var readLegacySiwxSession = (store, address) => {
+  if (!store) return null;
+  const prefix = legacyKeyPrefix2(address);
+  const legacyKeys = [];
+  try {
+    for (let i = 0; i < store.length; i++) {
+      const key = store.key(i);
+      if (key?.startsWith(prefix)) legacyKeys.push(key);
+    }
+  } catch {
+    return null;
+  }
+  let adopted = null;
+  for (const key of legacyKeys) {
+    if (!adopted) {
+      try {
+        adopted = JSON.parse(store.getItem(key) ?? "");
+      } catch {
+      }
+    }
+    try {
+      store.removeItem(key);
+    } catch {
+    }
+  }
+  return adopted;
+};
 var readSiwxSession = (address, chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey2(address, chainId);
+  const key = buildKey2(address);
   const store = storage2();
   let raw = null;
   try {
@@ -2787,11 +2890,16 @@ var readSiwxSession = (address, chainId) => {
       return null;
     }
   }
+  const legacy = readLegacySiwxSession(store, address);
+  if (legacy) {
+    writeSiwxSession(address, chainId, legacy);
+    return legacy;
+  }
   return memorySiwxSessions.get(key) ?? null;
 };
-var writeSiwxSession = (address, chainId, session) => {
+var writeSiwxSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey2(address, chainId);
+  const key = buildKey2(address);
   memorySiwxSessions.set(key, session);
   const store = storage2();
   try {
@@ -2799,14 +2907,15 @@ var writeSiwxSession = (address, chainId, session) => {
   } catch {
   }
 };
-var clearSiwxSession = (address, chainId) => {
-  const key = buildKey2(address, chainId);
+var clearSiwxSession = (address, _chainId) => {
+  const key = buildKey2(address);
   memorySiwxSessions.delete(key);
   const store = storage2();
   try {
     store?.removeItem(key);
   } catch {
   }
+  readLegacySiwxSession(store, address);
 };
 
 // src/agents/zyfai/zyfai.siwx.ts
@@ -2870,9 +2979,12 @@ function buildSIWXConfig(deps) {
     }
     if (!stored) return [];
     const session = {
-      // `stored.data.chainId` is a plain string in the cache (kept AppKit-free);
-      // it always holds a valid CaipNetworkId here, so narrow at the boundary.
-      data: stored.data,
+      // `stored.data` is kept AppKit-free in the cache, so narrow at the
+      // boundary. Echo the REQUESTED chain rather than the one originally
+      // signed: the Zyfai JWT is account-scoped (no chain claim), so one
+      // signature is valid for every chain, and AppKit would otherwise treat
+      // the session as not covering the active network and re-prompt.
+      data: { ...stored.data, chainId },
       message: stored.message,
       signature: stored.signature
     };

package/dist/index.d.cts

@@ -15,6 +15,12 @@ interface OwneySDKConfig {
      * e.g. "http://localhost:3000", when testing sponsor changes.
      */
     routingApiBaseUrl?: string;
+    /**
+     * Optional attribution tag forwarded to Zyfai's /auth/login when the SDK
+     * authenticates (e.g. "delos"). Replaces the equivalent option on
+     * `createOwneySIWX` for apps that don't use the AppKit SIWX modal.
+     */
+    referralSource?: string;
 }
 interface ConnectionState {
     provider: any;
@@ -92,6 +98,7 @@ type DepositOptions = {
     asset: Asset;
     depositCallback?: DepositCallback;
     agentId?: AgentId;
+    onApproved?: () => void;
 };
 
 interface OwneyDepositResult {
@@ -313,6 +320,7 @@ declare class OwneySDK {
     private apiKey;
     private zyfaiRpcUrls?;
     private routingApiBaseUrl?;
+    private referralSource?;
     private cachedSponsoredCallback;
     private cachedWethSponsoredCallback;
     private initializingAgentsPromise;

package/dist/index.d.ts

@@ -15,6 +15,12 @@ interface OwneySDKConfig {
      * e.g. "http://localhost:3000", when testing sponsor changes.
      */
     routingApiBaseUrl?: string;
+    /**
+     * Optional attribution tag forwarded to Zyfai's /auth/login when the SDK
+     * authenticates (e.g. "delos"). Replaces the equivalent option on
+     * `createOwneySIWX` for apps that don't use the AppKit SIWX modal.
+     */
+    referralSource?: string;
 }
 interface ConnectionState {
     provider: any;
@@ -92,6 +98,7 @@ type DepositOptions = {
     asset: Asset;
     depositCallback?: DepositCallback;
     agentId?: AgentId;
+    onApproved?: () => void;
 };
 
 interface OwneyDepositResult {
@@ -313,6 +320,7 @@ declare class OwneySDK {
     private apiKey;
     private zyfaiRpcUrls?;
     private routingApiBaseUrl?;
+    private referralSource?;
     private cachedSponsoredCallback;
     private cachedWethSponsoredCallback;
     private initializingAgentsPromise;

package/dist/index.js

@@ -503,7 +503,8 @@ var storage = () => {
     return null;
   }
 };
-var buildKey = (address, chainId) => `${KEY_PREFIX}:${address.toLowerCase()}:${chainId}`;
+var buildKey = (address) => `${KEY_PREFIX}:${address.toLowerCase()}`;
+var legacyKeyPrefix = (address) => `${KEY_PREFIX}:${address.toLowerCase()}:`;
 var isJwtExpired = (token) => {
   const parts = token.split(".");
   if (parts.length !== 3) return false;
@@ -520,9 +521,37 @@ var isJwtExpired = (token) => {
 };
 var memorySessions = /* @__PURE__ */ new Map();
 var isFreshSession = (session) => !!session && !!session.token && !isJwtExpired(session.token);
-var readSession = (address, chainId) => {
+var readLegacySession = (store, address) => {
+  if (!store) return null;
+  const prefix = legacyKeyPrefix(address);
+  const legacyKeys = [];
+  try {
+    for (let i = 0; i < store.length; i++) {
+      const key = store.key(i);
+      if (key?.startsWith(prefix)) legacyKeys.push(key);
+    }
+  } catch {
+    return null;
+  }
+  let adopted = null;
+  for (const key of legacyKeys) {
+    if (!adopted) {
+      try {
+        const parsed = JSON.parse(store.getItem(key) ?? "");
+        if (isFreshSession(parsed)) adopted = parsed;
+      } catch {
+      }
+    }
+    try {
+      store.removeItem(key);
+    } catch {
+    }
+  }
+  return adopted;
+};
+var readSession = (address, _chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey(address, chainId);
+  const key = buildKey(address);
   const store = storage();
   let raw = null;
   try {
@@ -543,14 +572,19 @@ var readSession = (address, chainId) => {
     }
     return null;
   }
+  const legacy = readLegacySession(store, address);
+  if (legacy) {
+    writeSession(address, _chainId, legacy);
+    return legacy;
+  }
   const cached = memorySessions.get(key);
   if (isFreshSession(cached)) return cached;
   if (cached) memorySessions.delete(key);
   return null;
 };
-var writeSession = (address, chainId, session) => {
+var writeSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey(address, chainId);
+  const key = buildKey(address);
   memorySessions.set(key, session);
   const store = storage();
   try {
@@ -558,14 +592,15 @@ var writeSession = (address, chainId, session) => {
   } catch {
   }
 };
-var clearSession = (address, chainId) => {
-  const key = buildKey(address, chainId);
+var clearSession = (address, _chainId) => {
+  const key = buildKey(address);
   memorySessions.delete(key);
   const store = storage();
   try {
     store?.removeItem(key);
   } catch {
   }
+  readLegacySession(store, address);
 };
 
 // src/agents/zyfai/autoSelect.ts
@@ -654,11 +689,15 @@ var ZyfaiAgent = class {
   // successful decode is cached forever; failures are NOT cached so a transient
   // RPC error retries on the next fetch.
   withdrawAmountCache = /* @__PURE__ */ new Map();
-  constructor(apiKey, rpcUrls) {
+  constructor(apiKey, rpcUrls, referralSource) {
     this.rpcUrls = rpcUrls ?? DEFAULT_ZYFAI_RPC_URLS;
     this.sdk = new ZyfaiSDK({
       apiKey,
-      rpcUrls: this.rpcUrls
+      rpcUrls: this.rpcUrls,
+      // Forwarded to /auth/login by the SDK's own SIWE handshake, so
+      // attribution survives without the AppKit SIWX config (which carried it
+      // via `createOwneySIWX({ referralSource })` when apps used the modal).
+      referralSource
     });
     this.installAuthCache();
   }
@@ -980,7 +1019,14 @@ var ZyfaiAgent = class {
           amount
         );
         const tokenAddress = asset === "WETH" ? WETH_ADDRESS_BY_CHAIN[validChainId] : void 0;
-        await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
+        try {
+          await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
+        } catch (logError) {
+          console.warn(
+            "[owney-sdk] Deposit landed on-chain but logDeposit failed (non-fatal):",
+            logError
+          );
+        }
         return { txHash, smartWallet: wallet.address, amount };
       }
       const raw = await this.sdk.depositFunds(
@@ -1466,18 +1512,29 @@ function makeSponsoredDepositCallback(deps) {
     const wallet = deps.getWalletClient(cid);
     const { tokenName, tokenVersion } = await readTokenMeta(pub, token);
     const validAfter = 0n;
-    const validBefore = BigInt(Math.floor(Date.now() / 1e3) + AUTH_WINDOW_SECONDS);
+    const validBefore = BigInt(
+      Math.floor(Date.now() / 1e3) + AUTH_WINDOW_SECONDS
+    );
     const nonce = randomAuthNonce();
     const typedData = buildTransferWithAuthorizationTypedData({
       token,
       chainId: cid,
       tokenName,
       tokenVersion,
-      message: { from: deps.ownerAddress, to: smartWallet, value: BigInt(amount), validAfter, validBefore, nonce }
+      message: {
+        from: deps.ownerAddress,
+        to: smartWallet,
+        value: BigInt(amount),
+        validAfter,
+        validBefore,
+        nonce
+      }
     });
-    const authSignature = await wallet.signTypedData(
-      { account: deps.ownerAddress, ...typedData }
-    );
+    const authSignature = await wallet.signTypedData({
+      account: deps.ownerAddress,
+      ...typedData
+    });
+    deps.onApproved?.();
     const result = await post({
       baseUrl: deps.baseUrl,
       apiKey: deps.apiKey,
@@ -1561,7 +1618,10 @@ function makeSponsoredWethCallback(deps) {
     const cid = chainId;
     const token = deps.tokenAddressByChain[cid];
     if (!token) {
-      throw new OwneyError("CHAIN_UNSUPPORTED", `No sponsored WETH configured for chain ${chainId}`);
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored WETH configured for chain ${chainId}`
+      );
     }
     const amountWei = BigInt(amount);
     const pub = deps.getPublicClient(cid);
@@ -1573,9 +1633,15 @@ function makeSponsoredWethCallback(deps) {
         { token, chainId: cid, allowance: allowance.toString(), amount }
       );
     }
-    const relayer = await get({ baseUrl: deps.baseUrl, apiKey: deps.apiKey, chainId: cid });
+    const relayer = await get({
+      baseUrl: deps.baseUrl,
+      apiKey: deps.apiKey,
+      chainId: cid
+    });
     const nonce = randomPermit2Nonce();
-    const deadline = BigInt(Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS);
+    const deadline = BigInt(
+      Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS
+    );
     const typedData = buildPermitTransferFromTypedData({
       chainId: cid,
       message: {
@@ -1586,9 +1652,11 @@ function makeSponsoredWethCallback(deps) {
       }
     });
     const wallet = deps.getWalletClient(cid);
-    const signature = await wallet.signTypedData(
-      { account: deps.ownerAddress, ...typedData }
-    );
+    const signature = await wallet.signTypedData({
+      account: deps.ownerAddress,
+      ...typedData
+    });
+    deps.onApproved?.();
     const result = await post({
       baseUrl: deps.baseUrl,
       apiKey: deps.apiKey,
@@ -1659,6 +1727,7 @@ var OwneySDK = class {
   apiKey;
   zyfaiRpcUrls;
   routingApiBaseUrl;
+  referralSource;
   cachedSponsoredCallback = null;
   cachedWethSponsoredCallback = null;
   initializingAgentsPromise = null;
@@ -1666,6 +1735,7 @@ var OwneySDK = class {
     this.apiKey = config.apiKey;
     this.zyfaiRpcUrls = config.zyfaiRpcUrls;
     this.routingApiBaseUrl = config.routingApiBaseUrl;
+    this.referralSource = config.referralSource;
   }
   /**
    * Establish connection state for all subsequent SDK calls.
@@ -1749,14 +1819,16 @@ var OwneySDK = class {
    * provider with viem `custom(provider)` to read token meta and sign the
    * `TransferWithAuthorization`, then POSTs to the sponsor API.
    */
-  getDefaultSponsoredCallback() {
-    if (this.cachedSponsoredCallback) return this.cachedSponsoredCallback;
+  getDefaultSponsoredCallback(onApproved) {
+    if (!onApproved && this.cachedSponsoredCallback)
+      return this.cachedSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    this.cachedSponsoredCallback = makeSponsoredDepositCallback({
+    const callback = makeSponsoredDepositCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
+      onApproved,
       tokenAddressByChain: SPONSORED_USDC_BY_CHAIN,
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
@@ -1771,7 +1843,8 @@ var OwneySDK = class {
         transport: custom(provider)
       })
     });
-    return this.cachedSponsoredCallback;
+    if (!onApproved) this.cachedSponsoredCallback = callback;
+    return callback;
   }
   /**
    * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
@@ -1779,15 +1852,16 @@ var OwneySDK = class {
    * deposit. Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
    * `PermitTransferFrom` instead of an EIP-3009 authorization.
    */
-  getDefaultWethSponsoredCallback() {
-    if (this.cachedWethSponsoredCallback)
+  getDefaultWethSponsoredCallback(onApproved) {
+    if (!onApproved && this.cachedWethSponsoredCallback)
       return this.cachedWethSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    this.cachedWethSponsoredCallback = makeSponsoredWethCallback({
+    const callback = makeSponsoredWethCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
+      onApproved,
       tokenAddressByChain: SPONSORED_WETH_BY_CHAIN,
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
@@ -1802,7 +1876,8 @@ var OwneySDK = class {
         transport: custom(provider)
       })
     });
-    return this.cachedWethSponsoredCallback;
+    if (!onApproved) this.cachedWethSponsoredCallback = callback;
+    return callback;
   }
   getAgent(agentId) {
     const agent = this.agents.get(agentId);
@@ -1849,7 +1924,7 @@ var OwneySDK = class {
   }
   createAgent(agentId, key) {
     if (agentId === "zyfai") {
-      return new ZyfaiAgent(key, this.zyfaiRpcUrls);
+      return new ZyfaiAgent(key, this.zyfaiRpcUrls, this.referralSource);
     }
     return null;
   }
@@ -1948,13 +2023,13 @@ var OwneySDK = class {
    * @returns {OwneyDepositResult} for a single agent, or {OwneyMultiDepositResult} with per-agent results
    */
   async deposit(options) {
-    const { amount, asset, depositCallback, agentId } = options;
+    const { amount, asset, depositCallback, agentId, onApproved } = options;
     if (BigInt(amount) === 0n) {
       return { agentResults: {} };
     }
     const state = this.requireState();
     const chainId = this.requireChainId();
-    const effectiveCallback = depositCallback ?? (asset === "WETH" ? this.getDefaultWethSponsoredCallback() : this.getDefaultSponsoredCallback());
+    const effectiveCallback = depositCallback ?? (asset === "WETH" ? this.getDefaultWethSponsoredCallback(onApproved) : this.getDefaultSponsoredCallback(onApproved));
     if (agentId) {
       if (this.isAgentDisabled(agentId)) {
         throw new OwneyError(
@@ -2735,11 +2810,39 @@ var storage2 = () => {
     return null;
   }
 };
-var buildKey2 = (address, chainId) => `${KEY_PREFIX2}:${address.toLowerCase()}:${chainId}`;
+var buildKey2 = (address) => `${KEY_PREFIX2}:${address.toLowerCase()}`;
+var legacyKeyPrefix2 = (address) => `${KEY_PREFIX2}:${address.toLowerCase()}:`;
 var memorySiwxSessions = /* @__PURE__ */ new Map();
+var readLegacySiwxSession = (store, address) => {
+  if (!store) return null;
+  const prefix = legacyKeyPrefix2(address);
+  const legacyKeys = [];
+  try {
+    for (let i = 0; i < store.length; i++) {
+      const key = store.key(i);
+      if (key?.startsWith(prefix)) legacyKeys.push(key);
+    }
+  } catch {
+    return null;
+  }
+  let adopted = null;
+  for (const key of legacyKeys) {
+    if (!adopted) {
+      try {
+        adopted = JSON.parse(store.getItem(key) ?? "");
+      } catch {
+      }
+    }
+    try {
+      store.removeItem(key);
+    } catch {
+    }
+  }
+  return adopted;
+};
 var readSiwxSession = (address, chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey2(address, chainId);
+  const key = buildKey2(address);
   const store = storage2();
   let raw = null;
   try {
@@ -2759,11 +2862,16 @@ var readSiwxSession = (address, chainId) => {
       return null;
     }
   }
+  const legacy = readLegacySiwxSession(store, address);
+  if (legacy) {
+    writeSiwxSession(address, chainId, legacy);
+    return legacy;
+  }
   return memorySiwxSessions.get(key) ?? null;
 };
-var writeSiwxSession = (address, chainId, session) => {
+var writeSiwxSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey2(address, chainId);
+  const key = buildKey2(address);
   memorySiwxSessions.set(key, session);
   const store = storage2();
   try {
@@ -2771,14 +2879,15 @@ var writeSiwxSession = (address, chainId, session) => {
   } catch {
   }
 };
-var clearSiwxSession = (address, chainId) => {
-  const key = buildKey2(address, chainId);
+var clearSiwxSession = (address, _chainId) => {
+  const key = buildKey2(address);
   memorySiwxSessions.delete(key);
   const store = storage2();
   try {
     store?.removeItem(key);
   } catch {
   }
+  readLegacySiwxSession(store, address);
 };
 
 // src/agents/zyfai/zyfai.siwx.ts
@@ -2842,9 +2951,12 @@ function buildSIWXConfig(deps) {
     }
     if (!stored) return [];
     const session = {
-      // `stored.data.chainId` is a plain string in the cache (kept AppKit-free);
-      // it always holds a valid CaipNetworkId here, so narrow at the boundary.
-      data: stored.data,
+      // `stored.data` is kept AppKit-free in the cache, so narrow at the
+      // boundary. Echo the REQUESTED chain rather than the one originally
+      // signed: the Zyfai JWT is account-scoped (no chain claim), so one
+      // signature is valid for every chain, and AppKit would otherwise treat
+      // the session as not covering the active network and re-prompt.
+      data: { ...stored.data, chainId },
       message: stored.message,
       signature: stored.signature
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owney/sdk",
-  "version": "0.6.7",
+  "version": "0.6.8-beta.2",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",