@owney/sdk 0.7.21-beta.3 → 0.7.21-beta.5

package/dist/index.cjs

@@ -32,6 +32,26 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/lib/deposit-batch-callback.ts
+var batchCallbacks = /* @__PURE__ */ new WeakMap();
+var getDepositBatchTransfer = (callback) => callback ? batchCallbacks.get(callback) : void 0;
+function toBatchTransfer(to, amount, verification) {
+  return {
+    to,
+    amount,
+    ...verification ? {
+      yieldseeker: {
+        signature: verification.signature,
+        userId: verification.userId,
+        agentId: verification.yieldseekerAgentId
+      }
+    } : {}
+  };
+}
+function registerDepositBatch(callback, transfer) {
+  batchCallbacks.set(callback, transfer);
+}
+
 // src/errors.ts
 var OwneyError = class extends Error {
   code;
@@ -2098,39 +2118,6 @@ async function ensureWalletOnChain(pub, wallet, expected) {
 
 // src/lib/transfer-auth.ts
 var import_viem2 = require("viem");
-var ERC20_META_ABI = [
-  { type: "function", name: "name", stateMutability: "view", inputs: [], outputs: [{ name: "", type: "string" }] },
-  { type: "function", name: "version", stateMutability: "view", inputs: [], outputs: [{ name: "", type: "string" }] }
-];
-function buildTransferWithAuthorizationTypedData(input) {
-  return {
-    domain: { name: input.tokenName, version: input.tokenVersion, chainId: input.chainId, verifyingContract: input.token },
-    types: {
-      TransferWithAuthorization: [
-        { name: "from", type: "address" },
-        { name: "to", type: "address" },
-        { name: "value", type: "uint256" },
-        { name: "validAfter", type: "uint256" },
-        { name: "validBefore", type: "uint256" },
-        { name: "nonce", type: "bytes32" }
-      ]
-    },
-    primaryType: "TransferWithAuthorization",
-    message: input.message
-  };
-}
-async function readTokenMeta(publicClient, token) {
-  const [tokenName, tokenVersion] = await Promise.all([
-    publicClient.readContract({ address: token, abi: ERC20_META_ABI, functionName: "name" }),
-    publicClient.readContract({ address: token, abi: ERC20_META_ABI, functionName: "version" }).catch(() => "2")
-  ]);
-  return { tokenName, tokenVersion };
-}
-function randomAuthNonce() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  return (0, import_viem2.bytesToHex)(bytes);
-}
 
 // src/lib/sponsor-client.ts
 var ROUTING_API_BASE_URL = "https://owney-routing-api-243946518160.europe-west4.run.app";
@@ -2173,65 +2160,21 @@ async function postPaymasterIntent(input) {
   }
   return parsed.data;
 }
-async function postSponsorTransferAuth(input) {
+async function getSponsorRelayerAddress(input) {
   const base5 = input.baseUrl ?? ROUTING_API_BASE_URL;
   let res;
   try {
-    res = await fetch(`${base5}/api/v1/sponsor/erc20-transfer-auth`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-owney-api-key": input.apiKey,
-        ...input.yieldseekerSignature ? { Authorization: `Signature ${input.yieldseekerSignature}` } : {}
-      },
-      body: JSON.stringify(input.body)
-    });
-  } catch (networkError) {
-    throw new OwneyError(
-      "SPONSOR_REQUEST_FAILED",
-      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
-      { cause: String(networkError) }
-    );
-  }
-  const text = await res.text();
-  let parsed = null;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-  }
-  if (!res.ok || !parsed?.success || !parsed.data) {
-    throw new OwneyError(
-      "SPONSOR_REQUEST_FAILED",
-      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+    res = await fetch(
+      `${base5}/api/v1/sponsor/relayer-address?chainId=${input.chainId}`,
       {
-        statusCode: res.status,
-        responseBody: text.slice(0, 500),
-        // 503 SPONSOR_UNAVAILABLE = relayer out of gas; the tx was rejected
-        // before broadcast, so it is safe to fall back to a user-paid deposit.
-        safeToFallback: res.status === 503
+        headers: { "x-owney-api-key": input.apiKey }
       }
     );
-  }
-  return parsed.data;
-}
-async function postSponsorPermit2Transfer(input) {
-  const base5 = input.baseUrl ?? ROUTING_API_BASE_URL;
-  let res;
-  try {
-    res = await fetch(`${base5}/api/v1/sponsor/permit2-transfer`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-owney-api-key": input.apiKey,
-        ...input.yieldseekerSignature ? { Authorization: `Signature ${input.yieldseekerSignature}` } : {}
-      },
-      body: JSON.stringify(input.body)
-    });
   } catch (networkError) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
       `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
-      { cause: String(networkError), safeToFallback: false }
+      { cause: String(networkError), safeToFallback: true }
     );
   }
   const text = await res.text();
@@ -2240,54 +2183,53 @@ async function postSponsorPermit2Transfer(input) {
     parsed = JSON.parse(text);
   } catch {
   }
-  if (!res.ok || !parsed?.success || !parsed.data) {
+  if (!res.ok || !parsed?.success || !parsed.data?.relayer) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
       `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
       {
         statusCode: res.status,
         responseBody: text.slice(0, 500),
-        safeToFallback: res.status >= 400 && res.status < 500 || res.status === 503
+        safeToFallback: true
       }
     );
   }
-  return parsed.data;
+  return parsed.data.relayer;
 }
-async function getSponsorRelayerAddress(input) {
-  const base5 = input.baseUrl ?? ROUTING_API_BASE_URL;
+async function postSponsorBatchTransfer(input) {
   let res;
   try {
     res = await fetch(
-      `${base5}/api/v1/sponsor/relayer-address?chainId=${input.chainId}`,
+      `${input.baseUrl ?? ROUTING_API_BASE_URL}/api/v1/sponsor/permit2-batch`,
       {
-        headers: { "x-owney-api-key": input.apiKey }
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-owney-api-key": input.apiKey
+        },
+        body: JSON.stringify(input.body)
       }
     );
-  } catch (networkError) {
+  } catch {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
-      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
-      { cause: String(networkError), safeToFallback: true }
+      "Deposit status is unknown. Retry the same amount to check it.",
+      { safeToFallback: false }
     );
   }
-  const text = await res.text();
-  let parsed = null;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-  }
-  if (!res.ok || !parsed?.success || !parsed.data?.relayer) {
+  const parsed = await res.json().catch(() => null);
+  if (!res.ok || !parsed?.success || !/^0x[0-9a-fA-F]{64}$/.test(parsed.data?.txHash ?? "")) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
-      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+      "Deposit could not be confirmed. Retry the same amount to check its status.",
       {
         statusCode: res.status,
-        responseBody: text.slice(0, 500),
-        safeToFallback: true
+        safeToFallback: false,
+        notSubmitted: parsed?.notSubmitted === true || parsed?.error?.notSubmitted === true || parsed?.error?.details?.notSubmitted === true
       }
     );
   }
-  return parsed.data.relayer;
+  return parsed.data;
 }
 
 // src/lib/permit2.ts
@@ -2323,29 +2265,6 @@ var ERC20_ALLOWANCE_ABI = [
     outputs: [{ name: "", type: "uint256" }]
   }
 ];
-function buildPermitTransferFromTypedData(input) {
-  return {
-    domain: {
-      name: "Permit2",
-      chainId: input.chainId,
-      verifyingContract: PERMIT2_ADDRESS
-    },
-    types: {
-      PermitTransferFrom: [
-        { name: "permitted", type: "TokenPermissions" },
-        { name: "spender", type: "address" },
-        { name: "nonce", type: "uint256" },
-        { name: "deadline", type: "uint256" }
-      ],
-      TokenPermissions: [
-        { name: "token", type: "address" },
-        { name: "amount", type: "uint256" }
-      ]
-    },
-    primaryType: "PermitTransferFrom",
-    message: input.message
-  };
-}
 function randomPermit2Nonce() {
   const bytes = new Uint8Array(32);
   globalThis.crypto.getRandomValues(bytes);
@@ -2388,88 +2307,6 @@ function makeVerificationAwareDepositCallback(implementation) {
   });
   return callback;
 }
-function makeSponsoredDepositCallback(deps) {
-  const post = deps.httpPost ?? postSponsorTransferAuth;
-  return makeVerificationAwareDepositCallback(
-    async (smartWallet, chainId, amount, verification) => {
-      const cid = chainId;
-      const token = deps.tokenAddressByChain[cid];
-      if (!token) {
-        throw new OwneyError(
-          "CHAIN_UNSUPPORTED",
-          `No sponsored token configured for chain ${chainId}`
-        );
-      }
-      const pub = deps.getPublicClient(cid);
-      const wallet = deps.getWalletClient(cid);
-      await ensureWalletOnChain(pub, wallet, cid);
-      try {
-        const balance = await readErc20Balance(pub, token, deps.ownerAddress);
-        if (balance < BigInt(amount)) {
-          throw new OwneyError(
-            "DEPOSIT_INSUFFICIENT_BALANCE",
-            "Insufficient balance for this deposit.",
-            { token, chainId: cid, balance: balance.toString(), amount }
-          );
-        }
-      } catch (err) {
-        if (err instanceof OwneyError) throw err;
-        console.warn(
-          "[owney-sdk] Deposit balance pre-check failed (non-fatal):",
-          err instanceof Error ? err.message : String(err)
-        );
-      }
-      const { tokenName, tokenVersion } = await readTokenMeta(pub, token);
-      const validAfter = 0n;
-      const validBefore = BigInt(
-        Math.floor(Date.now() / 1e3) + AUTH_WINDOW_SECONDS
-      );
-      const nonce = randomAuthNonce();
-      const typedData = buildTransferWithAuthorizationTypedData({
-        token,
-        chainId: cid,
-        tokenName,
-        tokenVersion,
-        message: {
-          from: deps.ownerAddress,
-          to: smartWallet,
-          value: BigInt(amount),
-          validAfter,
-          validBefore,
-          nonce
-        }
-      });
-      const authSignature = await wallet.signTypedData({
-        account: deps.ownerAddress,
-        ...typedData
-      });
-      deps.onApproved?.();
-      const result = await post({
-        baseUrl: deps.baseUrl,
-        apiKey: deps.apiKey,
-        ...verification?.agentId === "yieldseeker" ? { yieldseekerSignature: verification.signature } : {},
-        body: {
-          chainId: cid,
-          token,
-          from: deps.ownerAddress,
-          to: smartWallet,
-          value: amount,
-          validAfter: validAfter.toString(),
-          validBefore: validBefore.toString(),
-          nonce,
-          authSignature,
-          tokenName,
-          tokenVersion,
-          ...verification?.agentId === "yieldseeker" ? {
-            yieldseekerUserId: verification.userId,
-            yieldseekerAgentId: verification.yieldseekerAgentId
-          } : {}
-        }
-      });
-      return result.txHash;
-    }
-  );
-}
 
 // src/agents/yieldseeker/yieldseeker.auth.ts
 var import_siwe = require("siwe");
@@ -4325,105 +4162,305 @@ function aggregateApyByChainAndAsset(agentApys, agentBalances) {
 }
 
 // src/client.ts
-var import_viem9 = require("viem");
+var import_viem11 = require("viem");
 var import_chains4 = require("viem/chains");
 
-// src/lib/sponsored-weth-deposit.ts
-var PERMIT_WINDOW_SECONDS = 15 * 60;
-function makeSponsoredWethCallback(deps) {
-  const get = deps.httpGet ?? getSponsorRelayerAddress;
-  const post = deps.httpPost ?? postSponsorPermit2Transfer;
-  return makeVerificationAwareDepositCallback(
-    async (smartWallet, chainId, amount, verification) => {
-      const cid = chainId;
-      const token = deps.tokenAddressByChain[cid];
-      if (!token) {
-        throw new OwneyError(
-          "CHAIN_UNSUPPORTED",
-          `No sponsored WETH configured for chain ${chainId}`
-        );
-      }
-      const amountWei = BigInt(amount);
-      const pub = deps.getPublicClient(cid);
-      const wallet = deps.getWalletClient(cid);
-      await ensureWalletOnChain(pub, wallet, cid);
-      try {
-        const balance = await readErc20Balance(pub, token, deps.ownerAddress);
-        if (balance < amountWei) {
-          throw new OwneyError(
-            "DEPOSIT_INSUFFICIENT_BALANCE",
-            "Insufficient WETH balance for this deposit.",
-            { token, chainId: cid, balance: balance.toString(), amount }
-          );
-        }
-      } catch (err) {
-        if (err instanceof OwneyError) throw err;
-        console.warn(
-          "[owney-sdk] WETH balance pre-check failed (non-fatal):",
-          err instanceof Error ? err.message : String(err)
-        );
-      }
-      const allowance = await readPermit2Allowance(
-        pub,
-        token,
-        deps.ownerAddress
+// src/lib/sponsored-token-batch.ts
+var import_viem9 = require("viem");
+
+// src/lib/permit2-batch.ts
+var import_viem8 = require("viem");
+var BATCH_PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var PERMIT_BATCH_TYPES = {
+  PermitBatchWitnessTransferFrom: [
+    { name: "permitted", type: "TokenPermissions[]" },
+    { name: "spender", type: "address" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" },
+    { name: "witness", type: "Deposit" }
+  ],
+  Deposit: [{ name: "recipients", type: "address[]" }],
+  TokenPermissions: [
+    { name: "token", type: "address" },
+    { name: "amount", type: "uint256" }
+  ]
+};
+var PERMIT2_BATCH_ABI = (0, import_viem8.parseAbi)([
+  "struct TokenPermissions { address token; uint256 amount; }",
+  "struct PermitBatchTransferFrom { TokenPermissions[] permitted; uint256 nonce; uint256 deadline; }",
+  "struct SignatureTransferDetails { address to; uint256 requestedAmount; }",
+  "function permitWitnessTransferFrom(PermitBatchTransferFrom permit,SignatureTransferDetails[] transferDetails,address owner,bytes32 witness,string witnessTypeString,bytes signature)",
+  "function nonceBitmap(address owner,uint256 wordPos) view returns (uint256)"
+]);
+function batchPermit(b) {
+  return {
+    permitted: b.transfers.map((t) => ({
+      token: b.token,
+      amount: BigInt(t.amount)
+    })),
+    nonce: BigInt(b.nonce),
+    deadline: BigInt(b.deadline)
+  };
+}
+function batchTypedData(b, spender) {
+  return {
+    domain: {
+      name: "Permit2",
+      chainId: b.chainId,
+      verifyingContract: BATCH_PERMIT2_ADDRESS
+    },
+    types: PERMIT_BATCH_TYPES,
+    primaryType: "PermitBatchWitnessTransferFrom",
+    message: {
+      ...batchPermit(b),
+      spender,
+      witness: { recipients: b.transfers.map((t) => t.to) }
+    }
+  };
+}
+
+// src/lib/sponsored-token-batch.ts
+var memory = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+var planOf = (transfers) => JSON.stringify(
+  transfers.map((t) => ({
+    to: t.to.toLowerCase(),
+    amount: BigInt(t.amount).toString()
+  }))
+);
+function read(key2) {
+  return typeof window === "undefined" ? memory.get(key2) : window.localStorage.getItem(key2);
+}
+function save(key2, body) {
+  const value = JSON.stringify({
+    ...body,
+    transfers: body.transfers.map(({ to, amount }) => ({ to, amount }))
+  });
+  if (typeof window === "undefined") memory.set(key2, value);
+  else window.localStorage.setItem(key2, value);
+}
+function clear(key2) {
+  if (typeof window === "undefined") memory.delete(key2);
+  else window.localStorage.removeItem(key2);
+}
+function sponsorTokenBatch(i) {
+  const key2 = `owney.token-batch.v1:${(0, import_viem9.keccak256)((0, import_viem9.toBytes)(i.apiKey))}:${i.baseUrl ?? "default"}:${i.chainId}:${i.owner.toLowerCase()}:${i.token.toLowerCase()}`;
+  const plan = planOf(i.transfers);
+  const active = inflight.get(key2);
+  if (active) {
+    if (active.plan !== plan)
+      return Promise.reject(
+        new Error(
+          "A token deposit is already in progress. Wait for its result before depositing again."
+        )
       );
-      if (allowance < amountWei) {
-        throw new OwneyError(
-          "PERMIT2_APPROVAL_REQUIRED",
-          "WETH gasless deposits need a one-time Permit2 approval; call approvePermit2() first",
-          { token, chainId: cid, allowance: allowance.toString(), amount }
-        );
+    return active.promise;
+  }
+  const promise = execute(i, key2, plan).finally(() => inflight.delete(key2));
+  inflight.set(key2, { plan, promise });
+  return promise;
+}
+async function execute(i, key2, plan) {
+  if (!i.transfers.length || i.transfers.length > 16 || i.transfers.some(
+    (t) => BigInt(t.amount) <= 0n || BigInt(t.amount) >= 1n << 256n
+  ) || new Set(i.transfers.map((t) => t.to.toLowerCase())).size !== i.transfers.length)
+    throw new Error("Invalid token deposit shares.");
+  const send = async (initial) => {
+    let body = initial;
+    save(key2, body);
+    try {
+      if (!body.serializedTransaction) {
+        const prepared = await postSponsorBatchTransfer({
+          apiKey: i.apiKey,
+          baseUrl: i.baseUrl,
+          body
+        });
+        if (!prepared.serializedTransaction || (0, import_viem9.keccak256)(prepared.serializedTransaction) !== prepared.txHash)
+          throw new Error(
+            "Sponsorship API did not return a valid prepared transaction."
+          );
+        body = {
+          ...body,
+          serializedTransaction: prepared.serializedTransaction
+        };
+        save(key2, body);
       }
-      const relayer = await get({
-        baseUrl: deps.baseUrl,
-        apiKey: deps.apiKey,
-        chainId: cid
-      });
-      const nonce = randomPermit2Nonce();
-      const deadline = BigInt(
-        Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS
-      );
-      const typedData = buildPermitTransferFromTypedData({
-        chainId: cid,
-        message: {
-          permitted: { token, amount: amountWei },
-          spender: relayer,
-          nonce,
-          deadline
-        }
-      });
-      const signature = await wallet.signTypedData({
-        account: deps.ownerAddress,
-        ...typedData
-      });
-      deps.onApproved?.();
-      const result = await post({
-        baseUrl: deps.baseUrl,
-        apiKey: deps.apiKey,
-        ...verification?.agentId === "yieldseeker" ? { yieldseekerSignature: verification.signature } : {},
-        body: {
-          chainId: cid,
-          token,
-          from: deps.ownerAddress,
-          to: smartWallet,
-          amount,
-          nonce: nonce.toString(),
-          deadline: deadline.toString(),
-          signature,
-          ...verification?.agentId === "yieldseeker" ? {
-            yieldseekerUserId: verification.userId,
-            yieldseekerAgentId: verification.yieldseekerAgentId
-          } : {}
-        }
+      const result = await postSponsorBatchTransfer({
+        apiKey: i.apiKey,
+        baseUrl: i.baseUrl,
+        body
       });
+      if (result.txHash !== (0, import_viem9.keccak256)(body.serializedTransaction))
+        throw new Error(
+          "Sponsorship receipt does not match the pending transaction."
+        );
+      clear(key2);
       return result.txHash;
+    } catch (error) {
+      if (!body.serializedTransaction || error instanceof OwneyError && error.details?.notSubmitted === true)
+        clear(key2);
+      throw error;
     }
+  };
+  const saved = read(key2);
+  if (saved) {
+    const previous = JSON.parse(saved);
+    if (previous.chainId !== i.chainId || !(0, import_viem9.isAddressEqual)(previous.from, i.owner) || !(0, import_viem9.isAddressEqual)(previous.token, i.token) || planOf(previous.transfers) !== plan)
+      throw new Error(
+        "Retry the previous token deposit and agent split first to reconcile its status."
+      );
+    i.onApproved?.();
+    return send({ ...previous, transfers: i.transfers });
+  }
+  const total = i.transfers.reduce((sum, t) => sum + BigInt(t.amount), 0n);
+  const [balance, allowance] = await Promise.all([
+    readErc20Balance(i.pub, i.token, i.owner),
+    readPermit2Allowance(i.pub, i.token, i.owner)
+  ]);
+  if (balance < total)
+    throw new OwneyError(
+      "DEPOSIT_INSUFFICIENT_BALANCE",
+      "Insufficient token balance for this deposit."
+    );
+  if (allowance < total)
+    throw new OwneyError(
+      "PERMIT2_APPROVAL_REQUIRED",
+      "token deposits need a one-time Permit2 approval."
+    );
+  const relayer = await getSponsorRelayerAddress({
+    apiKey: i.apiKey,
+    baseUrl: i.baseUrl,
+    chainId: i.chainId
+  });
+  const now = (await i.pub.getBlock()).timestamp;
+  const unsigned = {
+    chainId: i.chainId,
+    token: i.token,
+    from: i.owner,
+    transfers: i.transfers,
+    nonce: randomPermit2Nonce().toString(),
+    deadline: (now + 900n).toString()
+  };
+  const signature = await i.wallet.signTypedData({
+    account: i.owner,
+    ...batchTypedData(unsigned, relayer)
+  });
+  i.onApproved?.();
+  return send({ ...unsigned, signature });
+}
+
+// src/lib/sponsored-token-deposit.ts
+function makeSponsoredTokenCallback(deps) {
+  const batch = async (chainId, transfers) => {
+    if (chainId !== 8453 && chainId !== 42161 && chainId !== 1)
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored token configured for chain ${chainId}`
+      );
+    const token = deps.tokenAddressByChain[chainId];
+    if (!token)
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored token configured for chain ${chainId}`
+      );
+    const pub = deps.getPublicClient(chainId), wallet = deps.getWalletClient(chainId);
+    await ensureWalletOnChain(pub, wallet, chainId);
+    return sponsorTokenBatch({
+      apiKey: deps.apiKey,
+      baseUrl: deps.baseUrl,
+      owner: deps.ownerAddress,
+      token,
+      chainId,
+      transfers,
+      pub,
+      wallet,
+      onApproved: deps.onApproved
+    });
+  };
+  const callback = makeVerificationAwareDepositCallback(
+    (to, chainId, amount, verification) => batch(chainId, [toBatchTransfer(to, amount, verification)])
   );
+  registerDepositBatch(callback, batch);
+  return callback;
+}
+
+// src/lib/agent-deposit-batch.ts
+function deferred() {
+  let resolve, reject;
+  const promise = new Promise((yes, no) => {
+    resolve = yes;
+    reject = no;
+  });
+  void promise.catch(() => {
+  });
+  return { promise, resolve, reject };
+}
+async function runAgentDepositBatch(chainId, legs, transfer) {
+  const funding = deferred();
+  const tasks = [];
+  const transfers = [];
+  try {
+    for (const leg of legs) {
+      const ready = deferred();
+      let entered = false;
+      const callback = makeVerificationAwareDepositCallback(
+        (to, cid, amount, verification) => {
+          if (entered || cid !== chainId || BigInt(amount) !== BigInt(leg.amount)) {
+            const error = new Error(
+              "Agent changed its prepared deposit share."
+            );
+            ready.reject(error);
+            throw error;
+          }
+          entered = true;
+          ready.resolve(toBatchTransfer(to, amount, verification));
+          return funding.promise;
+        }
+      );
+      const task = Promise.resolve().then(() => leg.run(callback));
+      tasks.push(task);
+      void task.then(
+        () => {
+          if (!entered)
+            ready.reject(
+              new Error("Agent did not prepare a deposit transfer.")
+            );
+        },
+        (error) => ready.reject(error)
+      );
+      transfers.push(await ready.promise);
+    }
+    const txHash = await transfer(chainId, transfers);
+    funding.resolve(txHash);
+    const settled = await Promise.allSettled(tasks);
+    const agentResults = {};
+    const failures = [];
+    for (const [index, result] of settled.entries()) {
+      if (result.status === "fulfilled")
+        agentResults[legs[index].id] = result.value;
+      else failures.push(legs[index].id);
+    }
+    if (failures.length)
+      throw new OwneyError(
+        "DEPOSIT_PARTIAL_FAILURE",
+        "The deposit was sent to all agents, but some agent updates could not be confirmed. Check activity before depositing again.",
+        {
+          txHash,
+          fundsSubmitted: true,
+          agentResults,
+          failedAgentIds: failures
+        }
+      );
+    return { agentResults };
+  } catch (error) {
+    funding.reject(error);
+    await Promise.allSettled(tasks);
+    throw error;
+  }
 }
 
 // src/lib/sponsored-calls-deposit.ts
-var import_viem8 = require("viem");
+var import_viem10 = require("viem");
 var DEFAULT_POLL_INTERVAL_MS = 1500;
 var DEFAULT_MAX_POLLS = 30;
 async function paymasterSupported(provider, owner, chainId) {
@@ -4431,7 +4468,7 @@ async function paymasterSupported(provider, owner, chainId) {
     method: "wallet_getCapabilities",
     params: [owner]
   });
-  const forChain = caps?.[(0, import_viem8.toHex)(chainId)] ?? caps?.[String(chainId)];
+  const forChain = caps?.[(0, import_viem10.toHex)(chainId)] ?? caps?.[String(chainId)];
   return Boolean(forChain?.paymasterService?.supported);
 }
 function makeSponsoredCallsCallback(deps) {
@@ -4449,7 +4486,7 @@ function makeSponsoredCallsCallback(deps) {
     }
     return new URL(configured, origin).toString();
   };
-  return makeVerificationAwareDepositCallback(async (smartWallet, chainId, amount, verification) => {
+  const batch = async (chainId, transfers) => {
     const cid = chainId;
     const token = deps.tokenAddressByChain[cid];
     if (!token) {
@@ -4465,19 +4502,24 @@ function makeSponsoredCallsCallback(deps) {
         { chainId }
       );
     }
-    const data = (0, import_viem8.encodeFunctionData)({
-      abi: import_viem8.erc20Abi,
-      functionName: "transfer",
-      args: [smartWallet, BigInt(amount)]
-    });
+    const calls = transfers.map((transfer) => ({
+      to: token,
+      value: "0x0",
+      data: (0, import_viem10.encodeFunctionData)({
+        abi: import_viem10.erc20Abi,
+        functionName: "transfer",
+        args: [transfer.to, BigInt(transfer.amount)]
+      })
+    }));
     let paymasterUrl = absolutePaymasterUrl();
-    if (verification?.agentId === "yieldseeker") {
-      if (chainId !== 8453) {
+    for (const transfer of transfers) {
+      const verification = transfer.yieldseeker;
+      if (!verification) continue;
+      if (chainId !== 8453)
         throw new OwneyError(
           "CHAIN_UNSUPPORTED",
-          `Yieldseeker Base Account sponsorship is not available on chain ${chainId}.`
+          `Yieldseeker sponsorship is not available on chain ${chainId}.`
         );
-      }
       const { intent } = await postPaymasterIntent({
         baseUrl: deps.routingApiBaseUrl,
         apiKey: deps.apiKey,
@@ -4486,14 +4528,14 @@ function makeSponsoredCallsCallback(deps) {
           chainId,
           token,
           from: deps.ownerAddress,
-          to: smartWallet,
-          amount,
+          to: transfer.to,
+          amount: transfer.amount,
           yieldseekerUserId: verification.userId,
-          yieldseekerAgentId: verification.yieldseekerAgentId
+          yieldseekerAgentId: verification.agentId
         }
       });
       const url = new URL(paymasterUrl);
-      url.searchParams.set("owneyIntent", intent);
+      url.searchParams.append("owneyIntent", intent);
       paymasterUrl = url.toString();
     }
     const sendResult = await deps.provider.request({
@@ -4502,9 +4544,9 @@ function makeSponsoredCallsCallback(deps) {
         {
           version: "2.0.0",
           from: deps.ownerAddress,
-          chainId: (0, import_viem8.toHex)(chainId),
-          atomicRequired: false,
-          calls: [{ to: token, value: "0x0", data }],
+          chainId: (0, import_viem10.toHex)(chainId),
+          atomicRequired: transfers.length > 1,
+          calls,
           capabilities: {
             paymasterService: { url: paymasterUrl }
           }
@@ -4526,7 +4568,24 @@ function makeSponsoredCallsCallback(deps) {
         params: [callsId]
       });
       const txHash = status?.receipts?.[0]?.transactionHash;
-      if (txHash) return txHash;
+      if (status?.receipts?.some((receipt) => receipt.status === "0x0") || typeof status?.status === "number" && status.status >= 400) {
+        throw new OwneyError(
+          "SPONSOR_REQUEST_FAILED",
+          "The sponsored deposit did not complete successfully.",
+          { chainId, callsId, safeToFallback: false }
+        );
+      }
+      if (txHash && (transfers.length === 1 || status?.status === 200 || status?.status === "CONFIRMED")) {
+        if (status?.receipts?.some(
+          (receipt) => receipt.transactionHash !== txHash
+        ))
+          throw new OwneyError(
+            "SPONSORED_CALLS_NO_RECEIPT",
+            "The wallet returned multiple transactions for an atomic deposit. Check activity before trying again.",
+            { chainId, callsId }
+          );
+        return txHash;
+      }
       if (pollIntervalMs > 0) {
         await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
       }
@@ -4536,7 +4595,12 @@ function makeSponsoredCallsCallback(deps) {
       `No receipt for calls ${callsId} after ${maxPolls} polls; the deposit may still settle.`,
       { chainId, callsId }
     );
-  });
+  };
+  const callback = makeVerificationAwareDepositCallback(
+    (to, chainId, amount, verification) => batch(chainId, [toBatchTransfer(to, amount, verification)])
+  );
+  registerDepositBatch(callback, batch);
+  return callback;
 }
 
 // src/client.ts
@@ -4575,6 +4639,11 @@ var SPONSORED_WETH_BY_CHAIN = {
   42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1",
   1: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
 };
+var SPONSORED_TOKENS_BY_ASSET = { USDC: SPONSORED_USDC_BY_CHAIN, WETH: SPONSORED_WETH_BY_CHAIN };
+function sponsoredTokensFor(asset) {
+  if (!Object.prototype.hasOwnProperty.call(SPONSORED_TOKENS_BY_ASSET, asset)) throw new OwneyError("ASSET_UNSUPPORTED", `No sponsored token configured for ${asset}`);
+  return SPONSORED_TOKENS_BY_ASSET[asset];
+}
 function shouldFallbackToUserPaid(error, asset, appCallback) {
   return (asset === "WETH" || asset === "USDC") && appCallback === void 0 && error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED" && error.details?.safeToFallback === true;
 }
@@ -4709,18 +4778,13 @@ var OwneySDK = class {
     }
     return this.state.provider;
   }
-  /**
-   * Lazily builds (and caches) the default EIP-3009 sponsored deposit callback
-   * used when the caller omits `depositCallback`. Wraps the connected EIP-1193
-   * provider with viem `custom(provider)` to read token meta and sign the
-   * `TransferWithAuthorization`, then POSTs to the sponsor API.
-   */
+  /** Builds the default USDC batch callback for the connected wallet. */
   getDefaultSponsoredCallback(onApproved) {
     if (!onApproved && this.cachedSponsoredCallback)
       return this.cachedSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    const callback = makeSponsoredDepositCallback({
+    const callback = makeSponsoredTokenCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
@@ -4729,25 +4793,20 @@ var OwneySDK = class {
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
       // runtime, but the two share a name TS treats as unrelated.
-      getPublicClient: (cid) => (0, import_viem9.createPublicClient)({
+      getPublicClient: (cid) => (0, import_viem11.createPublicClient)({
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem9.custom)(provider)
+        transport: (0, import_viem11.custom)(provider)
       }),
-      getWalletClient: (cid) => (0, import_viem9.createWalletClient)({
+      getWalletClient: (cid) => (0, import_viem11.createWalletClient)({
         account: owner,
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem9.custom)(provider)
+        transport: (0, import_viem11.custom)(provider)
       })
     });
     if (!onApproved) this.cachedSponsoredCallback = callback;
     return callback;
   }
-  /**
-   * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
-   * callback used when the caller omits `depositCallback` for a WETH
-   * deposit. Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
-   * `PermitTransferFrom` instead of an EIP-3009 authorization.
-   */
+  /** Builds the wallet-native sponsored calls callback for compatible paymasters. */
   getDefaultSponsoredCallsCallback(asset, onApproved) {
     const cached = this.cachedSponsoredCallsCallbacks.get(asset);
     if (!onApproved && cached) return cached;
@@ -4759,7 +4818,7 @@ var OwneySDK = class {
       ownerAddress: this.state.walletAddress,
       paymasterServiceUrl: this.paymasterServiceUrl,
       onApproved,
-      tokenAddressByChain: asset === "WETH" ? SPONSORED_WETH_BY_CHAIN : SPONSORED_USDC_BY_CHAIN
+      tokenAddressByChain: sponsoredTokensFor(asset)
     });
     if (!onApproved) this.cachedSponsoredCallsCallbacks.set(asset, callback);
     return callback;
@@ -4768,14 +4827,14 @@ var OwneySDK = class {
    * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
    * callback used when the caller omits `depositCallback` for a WETH deposit.
    * Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
-   * `PermitTransferFrom` instead of an EIP-3009 authorization.
+   * single-use batch authorization instead of an EIP-3009 authorization.
    */
   getDefaultWethSponsoredCallback(onApproved) {
     if (!onApproved && this.cachedWethSponsoredCallback)
       return this.cachedWethSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    const callback = makeSponsoredWethCallback({
+    const callback = makeSponsoredTokenCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
@@ -4784,14 +4843,14 @@ var OwneySDK = class {
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
       // runtime, but the two share a name TS treats as unrelated.
-      getPublicClient: (cid) => (0, import_viem9.createPublicClient)({
+      getPublicClient: (cid) => (0, import_viem11.createPublicClient)({
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem9.custom)(provider)
+        transport: (0, import_viem11.custom)(provider)
       }),
-      getWalletClient: (cid) => (0, import_viem9.createWalletClient)({
+      getWalletClient: (cid) => (0, import_viem11.createWalletClient)({
         account: owner,
         chain: VIEM_CHAIN2[cid],
-        transport: (0, import_viem9.custom)(provider)
+        transport: (0, import_viem11.custom)(provider)
       })
     });
     if (!onApproved) this.cachedWethSponsoredCallback = callback;
@@ -5027,10 +5086,9 @@ var OwneySDK = class {
    * Serializing costs no real wall-clock: the user can only approve one prompt
    * at a time anyway.
    *
-   * Every agent is attempted even if an earlier one fails, so one declined
-   * signature can't deny the remaining agents their turn. Once all agents have
-   * had a chance, a partial failure identifies the agents that still need a
-   * retry; if none activated, the original provider error is preserved.
+   * Stop at the first failure so a canceled sign-in does not open another
+   * agent's wallet prompt. Report any earlier successes for diagnostics; the
+   * app discards the session when the complete sign-in does not succeed.
    */
   async activateAgentsInTurn(agents, state, chainId, asset) {
     let firstError = null;
@@ -5058,6 +5116,7 @@ var OwneySDK = class {
         } else {
           console.error(`activateAgent(${agent.id}) failed:`, error);
         }
+        break;
       }
     }
     if (firstError === null) return;
@@ -5081,7 +5140,8 @@ var OwneySDK = class {
    * @param options.asset - Asset symbol to deposit (e.g. "USDC")
    * @param options.depositCallback - Callback that performs the token transfer and returns a tx hash.
    *   When agentId is omitted, this callback is invoked once per eligible agent with that agent's
-   *   split amount and smart wallet address — expect multiple wallet prompts.
+   *   split amount and smart wallet address. Default sponsored deposits batch
+   *   all shares into one signature; custom callbacks still run once per agent.
    * @param options.agentId - Optional explicit target. Otherwise split equally,
    *   or fund remaining agents when a recovery deposit cannot meet every minimum.
    * @returns {OwneyDepositResult} for a single agent, or {OwneyMultiDepositResult} with per-agent results
@@ -5166,6 +5226,32 @@ var OwneySDK = class {
         }
       );
     }
+    const batchTransfer = getDepositBatchTransfer(effectiveCallback);
+    if (!depositCallback && batchTransfer) {
+      return runAgentDepositBatch(
+        chainId,
+        agentAmounts.map(({ agent, amount: amount2 }) => ({
+          id: agent.id,
+          amount: amount2,
+          run: (callback) => withFailureReporting(
+            this.apiKey,
+            agent.id,
+            () => agent.deposit(state, chainId, amount2, asset, callback),
+            this.routingApiBaseUrl
+          )
+        })),
+        async (cid, transfers) => {
+          try {
+            return await batchTransfer(cid, transfers);
+          } catch (error) {
+            if (!(error instanceof OwneyError) || error.code !== "PERMIT2_APPROVAL_REQUIRED")
+              throw error;
+            await this.approvePermit2(asset);
+            return batchTransfer(cid, transfers);
+          }
+        }
+      );
+    }
     const agentResults = {};
     for (const [
       index,
@@ -5205,7 +5291,7 @@ var OwneySDK = class {
    *
    * 1. Missing Permit2 allowance: when the app did not supply its own
    *    callback and the attempt fails with `PERMIT2_APPROVAL_REQUIRED` on a
-   *    WETH deposit, this is the wallet's first gasless WETH deposit. We send
+   *    token deposit, this is the wallet's first Permit2 deposit for that token. We send
    *    the one-time (user-paid) Permit2 approval via `approvePermit2()` and
    *    retry the SAME sponsored attempt once. Bounded to one approval attempt
    *    per call so a wallet/agent that keeps reporting the allowance as
@@ -5242,12 +5328,12 @@ var OwneySDK = class {
       try {
         return await attempt(effectiveCallback);
       } catch (error) {
-        if (!approvalAttempted && appCallback === void 0 && asset === "WETH" && error instanceof OwneyError && error.code === "PERMIT2_APPROVAL_REQUIRED") {
+        if (!approvalAttempted && appCallback === void 0 && (asset === "WETH" || asset === "USDC") && error instanceof OwneyError && error.code === "PERMIT2_APPROVAL_REQUIRED") {
           approvalAttempted = true;
           console.warn(
-            "[owney-sdk] First WETH deposit: sending one-time Permit2 approval..."
+            "[owney-sdk] First token deposit: sending one-time Permit2 approval..."
           );
-          await this.approvePermit2();
+          await this.approvePermit2(asset);
           continue;
         }
         if (!shouldFallbackToUserPaid(error, asset, appCallback)) throw error;
@@ -5900,30 +5986,29 @@ var OwneySDK = class {
     return pending;
   }
   /**
-   * One-time, user-paid approval of Permit2 on the sponsored WETH token for
-   * the active chain. Required once per wallet per chain before gasless WETH
+   * One-time, user-paid approval of Permit2 on the selected token for
+   * the active chain. Required once per wallet, token and chain before sponsored
    * deposits; afterwards deposit() is signature-only. Resolves only after the
    * approval transaction is mined (1 confirmation), so a subsequent deposit()
    * will see the new allowance; throws if the transaction reverted.
    * @returns the approval transaction hash.
    */
   async approvePermit2(asset = "WETH") {
-    void asset;
     const state = this.requireState();
     const chainId = this.requireChainId();
-    this.validateAssetSupport(this.getAgent("zyfai"), chainId, "WETH");
-    const token = SPONSORED_WETH_BY_CHAIN[chainId];
+    this.getEligibleAgents(chainId, asset, { excludeDisabled: true });
+    const token = sponsoredTokensFor(asset)[chainId];
     if (!token) {
       throw new OwneyError(
         "CHAIN_UNSUPPORTED",
-        `No sponsored WETH on chain ${chainId}`
+        `No sponsored token on chain ${chainId}`
       );
     }
     const provider = this.requireConnectedProvider();
-    const wallet = (0, import_viem9.createWalletClient)({
+    const wallet = (0, import_viem11.createWalletClient)({
       account: state.walletAddress,
       chain: VIEM_CHAIN2[chainId],
-      transport: (0, import_viem9.custom)(provider)
+      transport: (0, import_viem11.custom)(provider)
     });
     const hash = await wallet.writeContract({
       address: token,
@@ -5933,9 +6018,9 @@ var OwneySDK = class {
       account: state.walletAddress,
       chain: VIEM_CHAIN2[chainId]
     });
-    const publicClient = (0, import_viem9.createPublicClient)({
+    const publicClient = (0, import_viem11.createPublicClient)({
       chain: VIEM_CHAIN2[chainId],
-      transport: (0, import_viem9.custom)(provider)
+      transport: (0, import_viem11.custom)(provider)
     });
     const receipt = await publicClient.waitForTransactionReceipt({
       hash,
@@ -6049,7 +6134,7 @@ var OwneySDK = class {
 };
 
 // src/agents/zyfai/zyfai.siwx.ts
-var import_viem10 = require("viem");
+var import_viem12 = require("viem");
 var import_siwe2 = require("siwe");
 var import_sdk2 = require("@zyfai/sdk");
 
@@ -6176,7 +6261,7 @@ function buildSIWXConfig(deps) {
       issuedAt,
       toString() {
         return new import_siwe2.SiweMessage({
-          address: (0, import_viem10.getAddress)(accountAddress),
+          address: (0, import_viem12.getAddress)(accountAddress),
           chainId: numericChainId(chainId),
           domain,
           uri,