@owney/sdk 0.6.9-beta.3 → 0.6.9-beta.5

package/dist/index.cjs

@@ -9,9 +9,9 @@ var __export = (target, all) => {
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    for (let key2 of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key2) && key2 !== except)
+        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
   }
   return to;
 };
@@ -562,23 +562,23 @@ var readLegacySession = (store, address) => {
   const legacyKeys = [];
   try {
     for (let i = 0; i < store.length; i++) {
-      const key = store.key(i);
-      if (key?.startsWith(prefix)) legacyKeys.push(key);
+      const key2 = store.key(i);
+      if (key2?.startsWith(prefix)) legacyKeys.push(key2);
     }
   } catch {
     return null;
   }
   let adopted = null;
-  for (const key of legacyKeys) {
+  for (const key2 of legacyKeys) {
     if (!adopted) {
       try {
-        const parsed = JSON.parse(store.getItem(key) ?? "");
+        const parsed = JSON.parse(store.getItem(key2) ?? "");
         if (isFreshSession(parsed)) adopted = parsed;
       } catch {
       }
     }
     try {
-      store.removeItem(key);
+      store.removeItem(key2);
     } catch {
     }
   }
@@ -586,11 +586,11 @@ var readLegacySession = (store, address) => {
 };
 var readSession = (address, _chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey(address);
+  const key2 = buildKey(address);
   const store = storage();
   let raw = null;
   try {
-    raw = store?.getItem(key) ?? null;
+    raw = store?.getItem(key2) ?? null;
   } catch {
     raw = null;
   }
@@ -600,9 +600,9 @@ var readSession = (address, _chainId) => {
       if (isFreshSession(parsed)) return parsed;
     } catch {
     }
-    memorySessions.delete(key);
+    memorySessions.delete(key2);
     try {
-      store?.removeItem(key);
+      store?.removeItem(key2);
     } catch {
     }
     return null;
@@ -612,27 +612,27 @@ var readSession = (address, _chainId) => {
     writeSession(address, _chainId, legacy);
     return legacy;
   }
-  const cached = memorySessions.get(key);
+  const cached = memorySessions.get(key2);
   if (isFreshSession(cached)) return cached;
-  if (cached) memorySessions.delete(key);
+  if (cached) memorySessions.delete(key2);
   return null;
 };
 var writeSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey(address);
-  memorySessions.set(key, session);
+  const key2 = buildKey(address);
+  memorySessions.set(key2, session);
   const store = storage();
   try {
-    store?.setItem(key, JSON.stringify(session));
+    store?.setItem(key2, JSON.stringify(session));
   } catch {
   }
 };
 var clearSession = (address, _chainId) => {
-  const key = buildKey(address);
-  memorySessions.delete(key);
+  const key2 = buildKey(address);
+  memorySessions.delete(key2);
   const store = storage();
   try {
-    store?.removeItem(key);
+    store?.removeItem(key2);
   } catch {
   }
   readLegacySession(store, address);
@@ -696,6 +696,99 @@ function splittingNeedsUpdate(current, desired) {
   return current.minSplits !== desired.minSplits;
 }
 
+// src/agents/zyfai/pool-policy.ts
+function toZyfaiCustomizations(policy, availableByProtocol, chainsByProtocol) {
+  const selectionByKey = /* @__PURE__ */ new Map();
+  for (const selection of policy.selections) {
+    selectionByKey.set(key(selection.protocolId, selection.chainId), selection);
+  }
+  const customizations = [];
+  for (const [protocolId, chainIds] of Object.entries(chainsByProtocol)) {
+    const available = availableByProtocol.get(protocolId);
+    if (available === void 0) {
+      continue;
+    }
+    const availableSet = new Set(available);
+    for (const chainId of chainIds) {
+      const stored = selectionByKey.get(key(protocolId, chainId));
+      if (stored === void 0) {
+        customizations.push({
+          protocolId,
+          chainId,
+          pools: [],
+          autoselect: true
+        });
+        continue;
+      }
+      const pools = stored.pools.filter((pool) => availableSet.has(pool));
+      customizations.push({
+        protocolId,
+        chainId,
+        pools,
+        autoselect: false
+      });
+    }
+  }
+  return customizations;
+}
+function deriveProtocols(policy, universe, chainsByProtocol) {
+  if (policy.selections.length === 0) {
+    return null;
+  }
+  const selectionByKey = /* @__PURE__ */ new Map();
+  for (const selection of policy.selections) {
+    selectionByKey.set(key(selection.protocolId, selection.chainId), selection);
+  }
+  return universe.filter((protocolId) => {
+    const chainIds = chainsByProtocol[protocolId];
+    if (chainIds === void 0 || chainIds.length === 0) {
+      return true;
+    }
+    const fullyDisabled = chainIds.every((chainId) => {
+      const stored = selectionByKey.get(key(protocolId, chainId));
+      return stored !== void 0 && stored.pools.length === 0;
+    });
+    return !fullyDisabled;
+  });
+}
+function key(protocolId, chainId) {
+  return `${protocolId}:${chainId}`;
+}
+function buildChainsByProtocol(protocols, dashboardChainIds) {
+  const allowed = new Set(dashboardChainIds);
+  const result = {};
+  for (const protocol of protocols) {
+    result[protocol.id] = (protocol.chains ?? []).filter(
+      (chainId) => allowed.has(chainId)
+    );
+  }
+  return result;
+}
+function flattenAvailablePools(raw) {
+  const byChain = raw ?? {};
+  const names = [];
+  for (const byToken of Object.values(byChain ?? {})) {
+    for (const entry of Object.values(byToken ?? {})) {
+      for (const pool of entry?.pools ?? []) {
+        if (pool?.name) names.push(pool.name);
+      }
+    }
+  }
+  return names;
+}
+function protocolListsEqual(a, b) {
+  const left = [...a ?? []].sort();
+  const right = [...b ?? []].sort();
+  if (left.length !== right.length) return false;
+  return left.every((value, index) => value === right[index]);
+}
+function protocolsPolicyNeedsUpdate(current, desiredProtocols, desiredAutoSelect) {
+  if (!current) return true;
+  if (current.autoSelectProtocols !== desiredAutoSelect) return true;
+  if (desiredProtocols === null) return false;
+  return !protocolListsEqual(current.protocols, desiredProtocols);
+}
+
 // src/lib/debug.ts
 var configuredDebug = false;
 function setOwneyDebug(enabled) {
@@ -726,6 +819,7 @@ var WETH_ADDRESS_BY_CHAIN = {
 };
 var VIEM_CHAIN = { 8453: import_chains.base, 42161: import_chains.arbitrum, 1: import_chains.mainnet };
 var SPLITTING_ASSETS = ["USDC", "WETH"];
+var POOL_POLICY_CHAIN_IDS = [8453, 42161, 1];
 function isAlreadyActiveSessionKeyError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return /already has an active session key/i.test(message);
@@ -1110,6 +1204,9 @@ var ZyfaiAgent = class {
     await Promise.all(
       SPLITTING_ASSETS.map((asset) => this.applySplitting(asset, policy))
     );
+    if (policy.poolPolicy) {
+      await this.applyPoolPolicy(policy.poolPolicy);
+    }
   }
   async applySplitting(asset, policy) {
     try {
@@ -1146,6 +1243,117 @@ var ZyfaiAgent = class {
       );
     }
   }
+  /**
+   * Apply the org's protocol/pool policy to this user's Zyfai profile.
+   *
+   * Two Zyfai writes, in a strict order:
+   *   1. `updateUserProfile({ protocols, autoSelectProtocols })` per asset —
+   *      the explicit allow-list. Chain-agnostic, mirrors `applySplitting`.
+   *   2. `customizeBatch(...)` once — per (protocol, chain), asset-agnostic
+   *      pool narrowing.
+   *
+   * Order matters: constraining a protocol's pools (step 2) while that
+   * protocol is not yet in the allow-list (step 1 not yet applied) lands the
+   * constraint on something the rebalance engine isn't considering.
+   *
+   * Wrapped so a failure anywhere is non-fatal — this runs as a side effect of
+   * connecting, so a Zyfai hiccup must leave the user connected with their
+   * profile unchanged, never fail activation.
+   */
+  async applyPoolPolicy(policy) {
+    try {
+      const { protocols: universe } = await this.sdk.getAvailableProtocols(
+        this.supportedChainIds[0]
+      );
+      const universeIds = universe.map((p) => p.id);
+      const chainsByProtocol = buildChainsByProtocol(
+        universe,
+        POOL_POLICY_CHAIN_IDS
+      );
+      debugLog("zyfai:pools", "protocol universe", {
+        universeIds,
+        chainsByProtocol
+      });
+      let strategy;
+      const desiredProtocols = deriveProtocols(
+        policy,
+        universeIds,
+        chainsByProtocol
+      );
+      const desiredAutoSelect = policy.autoApproveProtocols;
+      for (const asset of SPLITTING_ASSETS) {
+        const current = await this.sdk.getUserDetails(asset);
+        if (strategy === void 0 && (current.strategy === "conservative" || current.strategy === "aggressive")) {
+          strategy = current.strategy;
+        }
+        const needsUpdate = protocolsPolicyNeedsUpdate(
+          current,
+          desiredProtocols,
+          desiredAutoSelect
+        );
+        debugLog("zyfai:pools", `${asset}: comparing protocols`, {
+          current: {
+            protocols: current.protocols,
+            autoSelectProtocols: current.autoSelectProtocols
+          },
+          desired: {
+            protocols: desiredProtocols,
+            autoSelectProtocols: desiredAutoSelect
+          },
+          decision: needsUpdate ? "will write \u2014 profile differs from the org policy" : "skipping \u2014 profile already matches"
+        });
+        if (!needsUpdate) continue;
+        const update = {
+          asset,
+          autoSelectProtocols: desiredAutoSelect
+        };
+        if (desiredProtocols !== null) update.protocols = desiredProtocols;
+        await this.sdk.updateUserProfile(update);
+        debugLog("zyfai:pools", `${asset}: wrote protocols update`, update);
+      }
+      const poolResults = await Promise.all(
+        universe.map(async (protocol) => {
+          try {
+            const raw = await this.sdk.getAvailablePools(protocol.id, strategy);
+            return [protocol.id, flattenAvailablePools(raw)];
+          } catch (error) {
+            console.warn(
+              `[zyfai] applyPoolPolicy: getAvailablePools(${protocol.id}) failed, skipping this protocol (non-fatal):`,
+              error instanceof Error ? error.message : String(error)
+            );
+            return null;
+          }
+        })
+      );
+      const availableByProtocol = /* @__PURE__ */ new Map();
+      for (const result of poolResults) {
+        if (result) availableByProtocol.set(result[0], result[1]);
+      }
+      const customizations = toZyfaiCustomizations(
+        policy,
+        availableByProtocol,
+        chainsByProtocol
+      );
+      debugLog("zyfai:pools", "derived customizeBatch payload", {
+        strategy,
+        availableProtocolCount: availableByProtocol.size,
+        customizations
+      });
+      if (customizations.length === 0) {
+        debugLog("zyfai:pools", "skipping customizeBatch \u2014 nothing to send");
+        return;
+      }
+      await this.sdk.customizeBatch(customizations);
+      debugLog("zyfai:pools", "wrote customizeBatch", {
+        count: customizations.length
+      });
+    } catch (error) {
+      console.warn(
+        "[zyfai] applyPoolPolicy failed (non-fatal):",
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+  }
   async deposit(state, chainId, amount, asset, depositCallback) {
     try {
       await this.connectFull(state, chainId);
@@ -2181,8 +2389,8 @@ var OwneySDK = class {
       this.initializingAgentsPromise = (async () => {
         const agentKeys = await fetchAgentKeys(this.apiKey);
         this.disabledAgents.clear();
-        for (const { key, agent_type, is_enabled } of agentKeys) {
-          const agent = this.createAgent(agent_type, key);
+        for (const { key: key2, agent_type, is_enabled } of agentKeys) {
+          const agent = this.createAgent(agent_type, key2);
           if (!agent) continue;
           this.agents.set(agent_type, agent);
           if (is_enabled === false) {
@@ -2203,9 +2411,9 @@ var OwneySDK = class {
       this.initializingAgentsPromise = null;
     }
   }
-  createAgent(agentId, key) {
+  createAgent(agentId, key2) {
     if (agentId === "zyfai") {
-      return new ZyfaiAgent(key, this.zyfaiRpcUrls, this.referralSource);
+      return new ZyfaiAgent(key2, this.zyfaiRpcUrls, this.referralSource);
     }
     return null;
   }
@@ -3102,22 +3310,22 @@ var readLegacySiwxSession = (store, address) => {
   const legacyKeys = [];
   try {
     for (let i = 0; i < store.length; i++) {
-      const key = store.key(i);
-      if (key?.startsWith(prefix)) legacyKeys.push(key);
+      const key2 = store.key(i);
+      if (key2?.startsWith(prefix)) legacyKeys.push(key2);
     }
   } catch {
     return null;
   }
   let adopted = null;
-  for (const key of legacyKeys) {
+  for (const key2 of legacyKeys) {
     if (!adopted) {
       try {
-        adopted = JSON.parse(store.getItem(key) ?? "");
+        adopted = JSON.parse(store.getItem(key2) ?? "");
       } catch {
       }
     }
     try {
-      store.removeItem(key);
+      store.removeItem(key2);
     } catch {
     }
   }
@@ -3125,11 +3333,11 @@ var readLegacySiwxSession = (store, address) => {
 };
 var readSiwxSession = (address, chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey2(address);
+  const key2 = buildKey2(address);
   const store = storage2();
   let raw = null;
   try {
-    raw = store?.getItem(key) ?? null;
+    raw = store?.getItem(key2) ?? null;
   } catch {
     raw = null;
   }
@@ -3137,9 +3345,9 @@ var readSiwxSession = (address, chainId) => {
     try {
       return JSON.parse(raw);
     } catch {
-      memorySiwxSessions.delete(key);
+      memorySiwxSessions.delete(key2);
       try {
-        store?.removeItem(key);
+        store?.removeItem(key2);
       } catch {
       }
       return null;
@@ -3150,24 +3358,24 @@ var readSiwxSession = (address, chainId) => {
     writeSiwxSession(address, chainId, legacy);
     return legacy;
   }
-  return memorySiwxSessions.get(key) ?? null;
+  return memorySiwxSessions.get(key2) ?? null;
 };
 var writeSiwxSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey2(address);
-  memorySiwxSessions.set(key, session);
+  const key2 = buildKey2(address);
+  memorySiwxSessions.set(key2, session);
   const store = storage2();
   try {
-    store?.setItem(key, JSON.stringify(session));
+    store?.setItem(key2, JSON.stringify(session));
   } catch {
   }
 };
 var clearSiwxSession = (address, _chainId) => {
-  const key = buildKey2(address);
-  memorySiwxSessions.delete(key);
+  const key2 = buildKey2(address);
+  memorySiwxSessions.delete(key2);
   const store = storage2();
   try {
-    store?.removeItem(key);
+    store?.removeItem(key2);
   } catch {
   }
   readLegacySiwxSession(store, address);

package/dist/index.d.cts

@@ -110,14 +110,37 @@ type DepositOptions = {
     onApproved?: () => void;
 };
 
+/**
+ * One protocol's pool selection on one chain. `pools` holds Zyfai pool NAMES
+ * verbatim — matched case-sensitively by customizeBatch, and an unrecognised
+ * name makes Zyfai's rebalance engine skip the whole protocol, so these strings
+ * must not be normalised anywhere.
+ *
+ * An empty array means "no usable pools on this chain".
+ */
+type OrgPoolSelection = {
+    protocolId: string;
+    chainId: number;
+    pools: string[];
+};
+/**
+ * The partner's protocol/pool policy (ROUT-224). Sparse — only protocols they
+ * narrowed appear. Optional so an older routing API, which does not return the
+ * field, still parses; undefined and null both mean "change nothing".
+ */
+type OrgPoolPolicy = {
+    autoApproveProtocols: boolean;
+    autoApprovePools: boolean;
+    selections: OrgPoolSelection[];
+};
 /**
  * The organization's agent execution policy, or null when the partner has never
  * configured one — in which case the agents leave the user's profile alone.
- * Currently capital splitting only (ROUT-229).
  */
 type OrgAgentConfig = {
     splittingMode: "none" | "automatic" | "force";
     minSplits: number | null;
+    poolPolicy?: OrgPoolPolicy | null;
 };
 
 interface OwneyDepositResult {

package/dist/index.d.ts

@@ -110,14 +110,37 @@ type DepositOptions = {
     onApproved?: () => void;
 };
 
+/**
+ * One protocol's pool selection on one chain. `pools` holds Zyfai pool NAMES
+ * verbatim — matched case-sensitively by customizeBatch, and an unrecognised
+ * name makes Zyfai's rebalance engine skip the whole protocol, so these strings
+ * must not be normalised anywhere.
+ *
+ * An empty array means "no usable pools on this chain".
+ */
+type OrgPoolSelection = {
+    protocolId: string;
+    chainId: number;
+    pools: string[];
+};
+/**
+ * The partner's protocol/pool policy (ROUT-224). Sparse — only protocols they
+ * narrowed appear. Optional so an older routing API, which does not return the
+ * field, still parses; undefined and null both mean "change nothing".
+ */
+type OrgPoolPolicy = {
+    autoApproveProtocols: boolean;
+    autoApprovePools: boolean;
+    selections: OrgPoolSelection[];
+};
 /**
  * The organization's agent execution policy, or null when the partner has never
  * configured one — in which case the agents leave the user's profile alone.
- * Currently capital splitting only (ROUT-229).
  */
 type OrgAgentConfig = {
     splittingMode: "none" | "automatic" | "force";
     minSplits: number | null;
+    poolPolicy?: OrgPoolPolicy | null;
 };
 
 interface OwneyDepositResult {

package/dist/index.js

@@ -529,23 +529,23 @@ var readLegacySession = (store, address) => {
   const legacyKeys = [];
   try {
     for (let i = 0; i < store.length; i++) {
-      const key = store.key(i);
-      if (key?.startsWith(prefix)) legacyKeys.push(key);
+      const key2 = store.key(i);
+      if (key2?.startsWith(prefix)) legacyKeys.push(key2);
     }
   } catch {
     return null;
   }
   let adopted = null;
-  for (const key of legacyKeys) {
+  for (const key2 of legacyKeys) {
     if (!adopted) {
       try {
-        const parsed = JSON.parse(store.getItem(key) ?? "");
+        const parsed = JSON.parse(store.getItem(key2) ?? "");
         if (isFreshSession(parsed)) adopted = parsed;
       } catch {
       }
     }
     try {
-      store.removeItem(key);
+      store.removeItem(key2);
     } catch {
     }
   }
@@ -553,11 +553,11 @@ var readLegacySession = (store, address) => {
 };
 var readSession = (address, _chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey(address);
+  const key2 = buildKey(address);
   const store = storage();
   let raw = null;
   try {
-    raw = store?.getItem(key) ?? null;
+    raw = store?.getItem(key2) ?? null;
   } catch {
     raw = null;
   }
@@ -567,9 +567,9 @@ var readSession = (address, _chainId) => {
       if (isFreshSession(parsed)) return parsed;
     } catch {
     }
-    memorySessions.delete(key);
+    memorySessions.delete(key2);
     try {
-      store?.removeItem(key);
+      store?.removeItem(key2);
     } catch {
     }
     return null;
@@ -579,27 +579,27 @@ var readSession = (address, _chainId) => {
     writeSession(address, _chainId, legacy);
     return legacy;
   }
-  const cached = memorySessions.get(key);
+  const cached = memorySessions.get(key2);
   if (isFreshSession(cached)) return cached;
-  if (cached) memorySessions.delete(key);
+  if (cached) memorySessions.delete(key2);
   return null;
 };
 var writeSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey(address);
-  memorySessions.set(key, session);
+  const key2 = buildKey(address);
+  memorySessions.set(key2, session);
   const store = storage();
   try {
-    store?.setItem(key, JSON.stringify(session));
+    store?.setItem(key2, JSON.stringify(session));
   } catch {
   }
 };
 var clearSession = (address, _chainId) => {
-  const key = buildKey(address);
-  memorySessions.delete(key);
+  const key2 = buildKey(address);
+  memorySessions.delete(key2);
   const store = storage();
   try {
-    store?.removeItem(key);
+    store?.removeItem(key2);
   } catch {
   }
   readLegacySession(store, address);
@@ -663,6 +663,99 @@ function splittingNeedsUpdate(current, desired) {
   return current.minSplits !== desired.minSplits;
 }
 
+// src/agents/zyfai/pool-policy.ts
+function toZyfaiCustomizations(policy, availableByProtocol, chainsByProtocol) {
+  const selectionByKey = /* @__PURE__ */ new Map();
+  for (const selection of policy.selections) {
+    selectionByKey.set(key(selection.protocolId, selection.chainId), selection);
+  }
+  const customizations = [];
+  for (const [protocolId, chainIds] of Object.entries(chainsByProtocol)) {
+    const available = availableByProtocol.get(protocolId);
+    if (available === void 0) {
+      continue;
+    }
+    const availableSet = new Set(available);
+    for (const chainId of chainIds) {
+      const stored = selectionByKey.get(key(protocolId, chainId));
+      if (stored === void 0) {
+        customizations.push({
+          protocolId,
+          chainId,
+          pools: [],
+          autoselect: true
+        });
+        continue;
+      }
+      const pools = stored.pools.filter((pool) => availableSet.has(pool));
+      customizations.push({
+        protocolId,
+        chainId,
+        pools,
+        autoselect: false
+      });
+    }
+  }
+  return customizations;
+}
+function deriveProtocols(policy, universe, chainsByProtocol) {
+  if (policy.selections.length === 0) {
+    return null;
+  }
+  const selectionByKey = /* @__PURE__ */ new Map();
+  for (const selection of policy.selections) {
+    selectionByKey.set(key(selection.protocolId, selection.chainId), selection);
+  }
+  return universe.filter((protocolId) => {
+    const chainIds = chainsByProtocol[protocolId];
+    if (chainIds === void 0 || chainIds.length === 0) {
+      return true;
+    }
+    const fullyDisabled = chainIds.every((chainId) => {
+      const stored = selectionByKey.get(key(protocolId, chainId));
+      return stored !== void 0 && stored.pools.length === 0;
+    });
+    return !fullyDisabled;
+  });
+}
+function key(protocolId, chainId) {
+  return `${protocolId}:${chainId}`;
+}
+function buildChainsByProtocol(protocols, dashboardChainIds) {
+  const allowed = new Set(dashboardChainIds);
+  const result = {};
+  for (const protocol of protocols) {
+    result[protocol.id] = (protocol.chains ?? []).filter(
+      (chainId) => allowed.has(chainId)
+    );
+  }
+  return result;
+}
+function flattenAvailablePools(raw) {
+  const byChain = raw ?? {};
+  const names = [];
+  for (const byToken of Object.values(byChain ?? {})) {
+    for (const entry of Object.values(byToken ?? {})) {
+      for (const pool of entry?.pools ?? []) {
+        if (pool?.name) names.push(pool.name);
+      }
+    }
+  }
+  return names;
+}
+function protocolListsEqual(a, b) {
+  const left = [...a ?? []].sort();
+  const right = [...b ?? []].sort();
+  if (left.length !== right.length) return false;
+  return left.every((value, index) => value === right[index]);
+}
+function protocolsPolicyNeedsUpdate(current, desiredProtocols, desiredAutoSelect) {
+  if (!current) return true;
+  if (current.autoSelectProtocols !== desiredAutoSelect) return true;
+  if (desiredProtocols === null) return false;
+  return !protocolListsEqual(current.protocols, desiredProtocols);
+}
+
 // src/lib/debug.ts
 var configuredDebug = false;
 function setOwneyDebug(enabled) {
@@ -693,6 +786,7 @@ var WETH_ADDRESS_BY_CHAIN = {
 };
 var VIEM_CHAIN = { 8453: base, 42161: arbitrum, 1: mainnet };
 var SPLITTING_ASSETS = ["USDC", "WETH"];
+var POOL_POLICY_CHAIN_IDS = [8453, 42161, 1];
 function isAlreadyActiveSessionKeyError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return /already has an active session key/i.test(message);
@@ -1077,6 +1171,9 @@ var ZyfaiAgent = class {
     await Promise.all(
       SPLITTING_ASSETS.map((asset) => this.applySplitting(asset, policy))
     );
+    if (policy.poolPolicy) {
+      await this.applyPoolPolicy(policy.poolPolicy);
+    }
   }
   async applySplitting(asset, policy) {
     try {
@@ -1113,6 +1210,117 @@ var ZyfaiAgent = class {
       );
     }
   }
+  /**
+   * Apply the org's protocol/pool policy to this user's Zyfai profile.
+   *
+   * Two Zyfai writes, in a strict order:
+   *   1. `updateUserProfile({ protocols, autoSelectProtocols })` per asset —
+   *      the explicit allow-list. Chain-agnostic, mirrors `applySplitting`.
+   *   2. `customizeBatch(...)` once — per (protocol, chain), asset-agnostic
+   *      pool narrowing.
+   *
+   * Order matters: constraining a protocol's pools (step 2) while that
+   * protocol is not yet in the allow-list (step 1 not yet applied) lands the
+   * constraint on something the rebalance engine isn't considering.
+   *
+   * Wrapped so a failure anywhere is non-fatal — this runs as a side effect of
+   * connecting, so a Zyfai hiccup must leave the user connected with their
+   * profile unchanged, never fail activation.
+   */
+  async applyPoolPolicy(policy) {
+    try {
+      const { protocols: universe } = await this.sdk.getAvailableProtocols(
+        this.supportedChainIds[0]
+      );
+      const universeIds = universe.map((p) => p.id);
+      const chainsByProtocol = buildChainsByProtocol(
+        universe,
+        POOL_POLICY_CHAIN_IDS
+      );
+      debugLog("zyfai:pools", "protocol universe", {
+        universeIds,
+        chainsByProtocol
+      });
+      let strategy;
+      const desiredProtocols = deriveProtocols(
+        policy,
+        universeIds,
+        chainsByProtocol
+      );
+      const desiredAutoSelect = policy.autoApproveProtocols;
+      for (const asset of SPLITTING_ASSETS) {
+        const current = await this.sdk.getUserDetails(asset);
+        if (strategy === void 0 && (current.strategy === "conservative" || current.strategy === "aggressive")) {
+          strategy = current.strategy;
+        }
+        const needsUpdate = protocolsPolicyNeedsUpdate(
+          current,
+          desiredProtocols,
+          desiredAutoSelect
+        );
+        debugLog("zyfai:pools", `${asset}: comparing protocols`, {
+          current: {
+            protocols: current.protocols,
+            autoSelectProtocols: current.autoSelectProtocols
+          },
+          desired: {
+            protocols: desiredProtocols,
+            autoSelectProtocols: desiredAutoSelect
+          },
+          decision: needsUpdate ? "will write \u2014 profile differs from the org policy" : "skipping \u2014 profile already matches"
+        });
+        if (!needsUpdate) continue;
+        const update = {
+          asset,
+          autoSelectProtocols: desiredAutoSelect
+        };
+        if (desiredProtocols !== null) update.protocols = desiredProtocols;
+        await this.sdk.updateUserProfile(update);
+        debugLog("zyfai:pools", `${asset}: wrote protocols update`, update);
+      }
+      const poolResults = await Promise.all(
+        universe.map(async (protocol) => {
+          try {
+            const raw = await this.sdk.getAvailablePools(protocol.id, strategy);
+            return [protocol.id, flattenAvailablePools(raw)];
+          } catch (error) {
+            console.warn(
+              `[zyfai] applyPoolPolicy: getAvailablePools(${protocol.id}) failed, skipping this protocol (non-fatal):`,
+              error instanceof Error ? error.message : String(error)
+            );
+            return null;
+          }
+        })
+      );
+      const availableByProtocol = /* @__PURE__ */ new Map();
+      for (const result of poolResults) {
+        if (result) availableByProtocol.set(result[0], result[1]);
+      }
+      const customizations = toZyfaiCustomizations(
+        policy,
+        availableByProtocol,
+        chainsByProtocol
+      );
+      debugLog("zyfai:pools", "derived customizeBatch payload", {
+        strategy,
+        availableProtocolCount: availableByProtocol.size,
+        customizations
+      });
+      if (customizations.length === 0) {
+        debugLog("zyfai:pools", "skipping customizeBatch \u2014 nothing to send");
+        return;
+      }
+      await this.sdk.customizeBatch(customizations);
+      debugLog("zyfai:pools", "wrote customizeBatch", {
+        count: customizations.length
+      });
+    } catch (error) {
+      console.warn(
+        "[zyfai] applyPoolPolicy failed (non-fatal):",
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+  }
   async deposit(state, chainId, amount, asset, depositCallback) {
     try {
       await this.connectFull(state, chainId);
@@ -2152,8 +2360,8 @@ var OwneySDK = class {
       this.initializingAgentsPromise = (async () => {
         const agentKeys = await fetchAgentKeys(this.apiKey);
         this.disabledAgents.clear();
-        for (const { key, agent_type, is_enabled } of agentKeys) {
-          const agent = this.createAgent(agent_type, key);
+        for (const { key: key2, agent_type, is_enabled } of agentKeys) {
+          const agent = this.createAgent(agent_type, key2);
           if (!agent) continue;
           this.agents.set(agent_type, agent);
           if (is_enabled === false) {
@@ -2174,9 +2382,9 @@ var OwneySDK = class {
       this.initializingAgentsPromise = null;
     }
   }
-  createAgent(agentId, key) {
+  createAgent(agentId, key2) {
     if (agentId === "zyfai") {
-      return new ZyfaiAgent(key, this.zyfaiRpcUrls, this.referralSource);
+      return new ZyfaiAgent(key2, this.zyfaiRpcUrls, this.referralSource);
     }
     return null;
   }
@@ -3073,22 +3281,22 @@ var readLegacySiwxSession = (store, address) => {
   const legacyKeys = [];
   try {
     for (let i = 0; i < store.length; i++) {
-      const key = store.key(i);
-      if (key?.startsWith(prefix)) legacyKeys.push(key);
+      const key2 = store.key(i);
+      if (key2?.startsWith(prefix)) legacyKeys.push(key2);
     }
   } catch {
     return null;
   }
   let adopted = null;
-  for (const key of legacyKeys) {
+  for (const key2 of legacyKeys) {
     if (!adopted) {
       try {
-        adopted = JSON.parse(store.getItem(key) ?? "");
+        adopted = JSON.parse(store.getItem(key2) ?? "");
       } catch {
       }
     }
     try {
-      store.removeItem(key);
+      store.removeItem(key2);
     } catch {
     }
   }
@@ -3096,11 +3304,11 @@ var readLegacySiwxSession = (store, address) => {
 };
 var readSiwxSession = (address, chainId) => {
   if (typeof window === "undefined") return null;
-  const key = buildKey2(address);
+  const key2 = buildKey2(address);
   const store = storage2();
   let raw = null;
   try {
-    raw = store?.getItem(key) ?? null;
+    raw = store?.getItem(key2) ?? null;
   } catch {
     raw = null;
   }
@@ -3108,9 +3316,9 @@ var readSiwxSession = (address, chainId) => {
     try {
       return JSON.parse(raw);
     } catch {
-      memorySiwxSessions.delete(key);
+      memorySiwxSessions.delete(key2);
       try {
-        store?.removeItem(key);
+        store?.removeItem(key2);
       } catch {
       }
       return null;
@@ -3121,24 +3329,24 @@ var readSiwxSession = (address, chainId) => {
     writeSiwxSession(address, chainId, legacy);
     return legacy;
   }
-  return memorySiwxSessions.get(key) ?? null;
+  return memorySiwxSessions.get(key2) ?? null;
 };
 var writeSiwxSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
-  const key = buildKey2(address);
-  memorySiwxSessions.set(key, session);
+  const key2 = buildKey2(address);
+  memorySiwxSessions.set(key2, session);
   const store = storage2();
   try {
-    store?.setItem(key, JSON.stringify(session));
+    store?.setItem(key2, JSON.stringify(session));
   } catch {
   }
 };
 var clearSiwxSession = (address, _chainId) => {
-  const key = buildKey2(address);
-  memorySiwxSessions.delete(key);
+  const key2 = buildKey2(address);
+  memorySiwxSessions.delete(key2);
   const store = storage2();
   try {
-    store?.removeItem(key);
+    store?.removeItem(key2);
   } catch {
   }
   readLegacySiwxSession(store, address);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owney/sdk",
-  "version": "0.6.9-beta.3",
+  "version": "0.6.9-beta.5",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",