@owney/sdk 0.7.21-beta.4 → 0.7.21-beta.6

package/dist/index.js

@@ -1,3 +1,23 @@
+// src/lib/deposit-batch-callback.ts
+var batchCallbacks = /* @__PURE__ */ new WeakMap();
+var getDepositBatchTransfer = (callback) => callback ? batchCallbacks.get(callback) : void 0;
+function toBatchTransfer(to, amount, verification) {
+  return {
+    to,
+    amount,
+    ...verification ? {
+      yieldseeker: {
+        signature: verification.signature,
+        userId: verification.userId,
+        agentId: verification.yieldseekerAgentId
+      }
+    } : {}
+  };
+}
+function registerDepositBatch(callback, transfer) {
+  batchCallbacks.set(callback, transfer);
+}
+
 // src/errors.ts
 var OwneyError = class extends Error {
   code;
@@ -2072,39 +2092,6 @@ async function ensureWalletOnChain(pub, wallet, expected) {
 
 // src/lib/transfer-auth.ts
 import { bytesToHex } from "viem";
-var ERC20_META_ABI = [
-  { type: "function", name: "name", stateMutability: "view", inputs: [], outputs: [{ name: "", type: "string" }] },
-  { type: "function", name: "version", stateMutability: "view", inputs: [], outputs: [{ name: "", type: "string" }] }
-];
-function buildTransferWithAuthorizationTypedData(input) {
-  return {
-    domain: { name: input.tokenName, version: input.tokenVersion, chainId: input.chainId, verifyingContract: input.token },
-    types: {
-      TransferWithAuthorization: [
-        { name: "from", type: "address" },
-        { name: "to", type: "address" },
-        { name: "value", type: "uint256" },
-        { name: "validAfter", type: "uint256" },
-        { name: "validBefore", type: "uint256" },
-        { name: "nonce", type: "bytes32" }
-      ]
-    },
-    primaryType: "TransferWithAuthorization",
-    message: input.message
-  };
-}
-async function readTokenMeta(publicClient, token) {
-  const [tokenName, tokenVersion] = await Promise.all([
-    publicClient.readContract({ address: token, abi: ERC20_META_ABI, functionName: "name" }),
-    publicClient.readContract({ address: token, abi: ERC20_META_ABI, functionName: "version" }).catch(() => "2")
-  ]);
-  return { tokenName, tokenVersion };
-}
-function randomAuthNonce() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  return bytesToHex(bytes);
-}
 
 // src/lib/sponsor-client.ts
 var ROUTING_API_BASE_URL = "https://owney-routing-api-243946518160.europe-west4.run.app";
@@ -2147,65 +2134,21 @@ async function postPaymasterIntent(input) {
   }
   return parsed.data;
 }
-async function postSponsorTransferAuth(input) {
+async function getSponsorRelayerAddress(input) {
   const base5 = input.baseUrl ?? ROUTING_API_BASE_URL;
   let res;
   try {
-    res = await fetch(`${base5}/api/v1/sponsor/erc20-transfer-auth`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-owney-api-key": input.apiKey,
-        ...input.yieldseekerSignature ? { Authorization: `Signature ${input.yieldseekerSignature}` } : {}
-      },
-      body: JSON.stringify(input.body)
-    });
-  } catch (networkError) {
-    throw new OwneyError(
-      "SPONSOR_REQUEST_FAILED",
-      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
-      { cause: String(networkError) }
-    );
-  }
-  const text = await res.text();
-  let parsed = null;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-  }
-  if (!res.ok || !parsed?.success || !parsed.data) {
-    throw new OwneyError(
-      "SPONSOR_REQUEST_FAILED",
-      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+    res = await fetch(
+      `${base5}/api/v1/sponsor/relayer-address?chainId=${input.chainId}`,
       {
-        statusCode: res.status,
-        responseBody: text.slice(0, 500),
-        // 503 SPONSOR_UNAVAILABLE = relayer out of gas; the tx was rejected
-        // before broadcast, so it is safe to fall back to a user-paid deposit.
-        safeToFallback: res.status === 503
+        headers: { "x-owney-api-key": input.apiKey }
       }
     );
-  }
-  return parsed.data;
-}
-async function postSponsorPermit2Transfer(input) {
-  const base5 = input.baseUrl ?? ROUTING_API_BASE_URL;
-  let res;
-  try {
-    res = await fetch(`${base5}/api/v1/sponsor/permit2-transfer`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-owney-api-key": input.apiKey,
-        ...input.yieldseekerSignature ? { Authorization: `Signature ${input.yieldseekerSignature}` } : {}
-      },
-      body: JSON.stringify(input.body)
-    });
   } catch (networkError) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
       `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
-      { cause: String(networkError), safeToFallback: false }
+      { cause: String(networkError), safeToFallback: true }
     );
   }
   const text = await res.text();
@@ -2214,60 +2157,64 @@ async function postSponsorPermit2Transfer(input) {
     parsed = JSON.parse(text);
   } catch {
   }
-  if (!res.ok || !parsed?.success || !parsed.data) {
+  if (!res.ok || !parsed?.success || !parsed.data?.relayer) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
       `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
       {
         statusCode: res.status,
         responseBody: text.slice(0, 500),
-        safeToFallback: res.status >= 400 && res.status < 500 || res.status === 503
+        safeToFallback: true
       }
     );
   }
-  return parsed.data;
+  return parsed.data.relayer;
 }
-async function getSponsorRelayerAddress(input) {
-  const base5 = input.baseUrl ?? ROUTING_API_BASE_URL;
+async function postSponsorBatchTransfer(input) {
   let res;
   try {
     res = await fetch(
-      `${base5}/api/v1/sponsor/relayer-address?chainId=${input.chainId}`,
+      `${input.baseUrl ?? ROUTING_API_BASE_URL}/api/v1/sponsor/permit2-batch`,
       {
-        headers: { "x-owney-api-key": input.apiKey }
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-owney-api-key": input.apiKey
+        },
+        body: JSON.stringify(input.body)
       }
     );
-  } catch (networkError) {
+  } catch {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
-      `Sponsor API network error: ${networkError instanceof Error ? networkError.message : String(networkError)}`,
-      { cause: String(networkError), safeToFallback: true }
+      "Deposit status is unknown. Retry the same amount to check it.",
+      { safeToFallback: false }
     );
   }
-  const text = await res.text();
-  let parsed = null;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-  }
-  if (!res.ok || !parsed?.success || !parsed.data?.relayer) {
+  const parsed = await res.json().catch(() => null);
+  if (!res.ok || !parsed?.success || !/^0x[0-9a-fA-F]{64}$/.test(parsed.data?.txHash ?? "")) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
-      `Sponsor API error ${res.status}: ${parsed?.message ?? text.slice(0, 500)}`,
+      "Deposit could not be confirmed. Retry the same amount to check its status.",
       {
         statusCode: res.status,
-        responseBody: text.slice(0, 500),
-        safeToFallback: true
+        safeToFallback: false,
+        notSubmitted: parsed?.notSubmitted === true || parsed?.error?.notSubmitted === true || parsed?.error?.details?.notSubmitted === true
       }
     );
   }
-  return parsed.data.relayer;
+  return parsed.data;
 }
 
 // src/lib/permit2.ts
 import { bytesToHex as bytesToHex2 } from "viem";
 var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
-var MAX_UINT256 = 2n ** 256n - 1n;
+function permit2ApprovalAmount(requiredAmount) {
+  if (requiredAmount <= 0n) {
+    throw new Error("Permit2 approval requires a positive deposit amount");
+  }
+  return requiredAmount;
+}
 var ERC20_ALLOWANCE_ABI = [
   {
     type: "function",
@@ -2297,29 +2244,6 @@ var ERC20_ALLOWANCE_ABI = [
     outputs: [{ name: "", type: "uint256" }]
   }
 ];
-function buildPermitTransferFromTypedData(input) {
-  return {
-    domain: {
-      name: "Permit2",
-      chainId: input.chainId,
-      verifyingContract: PERMIT2_ADDRESS
-    },
-    types: {
-      PermitTransferFrom: [
-        { name: "permitted", type: "TokenPermissions" },
-        { name: "spender", type: "address" },
-        { name: "nonce", type: "uint256" },
-        { name: "deadline", type: "uint256" }
-      ],
-      TokenPermissions: [
-        { name: "token", type: "address" },
-        { name: "amount", type: "uint256" }
-      ]
-    },
-    primaryType: "PermitTransferFrom",
-    message: input.message
-  };
-}
 function randomPermit2Nonce() {
   const bytes = new Uint8Array(32);
   globalThis.crypto.getRandomValues(bytes);
@@ -2362,88 +2286,6 @@ function makeVerificationAwareDepositCallback(implementation) {
   });
   return callback;
 }
-function makeSponsoredDepositCallback(deps) {
-  const post = deps.httpPost ?? postSponsorTransferAuth;
-  return makeVerificationAwareDepositCallback(
-    async (smartWallet, chainId, amount, verification) => {
-      const cid = chainId;
-      const token = deps.tokenAddressByChain[cid];
-      if (!token) {
-        throw new OwneyError(
-          "CHAIN_UNSUPPORTED",
-          `No sponsored token configured for chain ${chainId}`
-        );
-      }
-      const pub = deps.getPublicClient(cid);
-      const wallet = deps.getWalletClient(cid);
-      await ensureWalletOnChain(pub, wallet, cid);
-      try {
-        const balance = await readErc20Balance(pub, token, deps.ownerAddress);
-        if (balance < BigInt(amount)) {
-          throw new OwneyError(
-            "DEPOSIT_INSUFFICIENT_BALANCE",
-            "Insufficient balance for this deposit.",
-            { token, chainId: cid, balance: balance.toString(), amount }
-          );
-        }
-      } catch (err) {
-        if (err instanceof OwneyError) throw err;
-        console.warn(
-          "[owney-sdk] Deposit balance pre-check failed (non-fatal):",
-          err instanceof Error ? err.message : String(err)
-        );
-      }
-      const { tokenName, tokenVersion } = await readTokenMeta(pub, token);
-      const validAfter = 0n;
-      const validBefore = BigInt(
-        Math.floor(Date.now() / 1e3) + AUTH_WINDOW_SECONDS
-      );
-      const nonce = randomAuthNonce();
-      const typedData = buildTransferWithAuthorizationTypedData({
-        token,
-        chainId: cid,
-        tokenName,
-        tokenVersion,
-        message: {
-          from: deps.ownerAddress,
-          to: smartWallet,
-          value: BigInt(amount),
-          validAfter,
-          validBefore,
-          nonce
-        }
-      });
-      const authSignature = await wallet.signTypedData({
-        account: deps.ownerAddress,
-        ...typedData
-      });
-      deps.onApproved?.();
-      const result = await post({
-        baseUrl: deps.baseUrl,
-        apiKey: deps.apiKey,
-        ...verification?.agentId === "yieldseeker" ? { yieldseekerSignature: verification.signature } : {},
-        body: {
-          chainId: cid,
-          token,
-          from: deps.ownerAddress,
-          to: smartWallet,
-          value: amount,
-          validAfter: validAfter.toString(),
-          validBefore: validBefore.toString(),
-          nonce,
-          authSignature,
-          tokenName,
-          tokenVersion,
-          ...verification?.agentId === "yieldseeker" ? {
-            yieldseekerUserId: verification.userId,
-            yieldseekerAgentId: verification.yieldseekerAgentId
-          } : {}
-        }
-      });
-      return result.txHash;
-    }
-  );
-}
 
 // src/agents/yieldseeker/yieldseeker.auth.ts
 import { SiweMessage, generateNonce } from "siwe";
@@ -3127,7 +2969,7 @@ function depositDestination(context, movement) {
   if (receipt && minted) return { protocol: "Vault", pool: receipt.name || receipt.symbol, tokenSymbol: context.asset };
   return void 0;
 }
-function movementEntry(movement, wallet, agent, asset, ownerAddress, destination) {
+function movementEntry(movement, wallet, agent, asset, ownerAddress, vaultAddresses, destination) {
   const from = movement.fromAddress.toLowerCase();
   const to = movement.toAddress.toLowerCase();
   const owner = ownerAddress.toLowerCase();
@@ -3137,7 +2979,7 @@ function movementEntry(movement, wallet, agent, asset, ownerAddress, destination
     return void 0;
   }
   let action;
-  if (from === owner && to === agentWallet) {
+  if (to === agentWallet && !vaultAddresses.has(from)) {
     action = "Top up";
   } else if (from === agentWallet && to === owner) {
     action = "Withdraw";
@@ -3187,6 +3029,7 @@ function mapYieldseekerHistory(contexts, options) {
           context.agent,
           context.asset,
           options.ownerAddress,
+          options.vaultAddresses,
           depositDestination(context, movement)
         )
       ),
@@ -3267,6 +3110,7 @@ var OWNEY_AGENT_NAME = "owney";
 var YIELDSEEKER_USERNAME_PREFIX = "owney_";
 var YIELDSEEKER_USERNAME_RANDOM_LENGTH = 14;
 var YIELDSEEKER_USERNAME_CREATE_ATTEMPTS = 3;
+var YIELDSEEKER_YIELD_OPTIONS_CACHE_MS = 6e4;
 function generateYieldseekerUsername() {
   const suffix = globalThis.crypto.randomUUID().replaceAll("-", "").slice(0, YIELDSEEKER_USERNAME_RANDOM_LENGTH).toLowerCase();
   return `${YIELDSEEKER_USERNAME_PREFIX}${suffix}`;
@@ -3328,6 +3172,8 @@ var YieldseekerAgent = class {
   agentContexts = /* @__PURE__ */ new Map();
   users = /* @__PURE__ */ new Map();
   pendingAgents = /* @__PURE__ */ new Map();
+  yieldOptions = /* @__PURE__ */ new Map();
+  pendingYieldOptions = /* @__PURE__ */ new Map();
   constructor(owneyApiKey, options = {}) {
     this.api = new YieldseekerApiClient(
       owneyApiKey,
@@ -3394,7 +3240,6 @@ var YieldseekerAgent = class {
           chainId
         });
       }
-      await this.deployAfterFunding(state, chainId, context);
     } finally {
       await this.refreshSnapshotAfterMovement(
         state,
@@ -3546,9 +3391,20 @@ var YieldseekerAgent = class {
       historic: true,
       actions: true
     });
+    const catalog = await Promise.all(
+      [...new Set(contexts.map((context) => context.asset))].map(
+        (contextAsset) => this.loadYieldOptions(contextAsset)
+      )
+    );
+    const vaultAddresses = new Set(
+      catalog.flat().filter(
+        (yieldOption) => yieldOption.chainId === chainId && isAddress2(yieldOption.address)
+      ).map((yieldOption) => yieldOption.address.toLowerCase())
+    );
     return mapYieldseekerHistory(contexts, {
       limit: options?.limit ?? 10,
       ownerAddress: state.walletAddress,
+      vaultAddresses,
       ...options?.fromDate ? { fromDate: options.fromDate } : {},
       ...options?.toDate ? { toDate: options.toDate } : {}
     });
@@ -3567,18 +3423,32 @@ var YieldseekerAgent = class {
     const assets = requested ? [requested] : ["USDC", "WETH"];
     const values = await Promise.all(
       assets.map(async (asset) => {
-        const metadata = YIELDSEEKER_ASSET_METADATA[asset];
-        const response = await this.api.request(
-          `/chains/8453/assets/${metadata.address}/yield-options`
-        );
-        if (!Array.isArray(response?.yieldOptions)) {
-          throw this.invalidResponse("yield options");
-        }
-        return { asset, yieldOptions: response.yieldOptions };
+        return { asset, yieldOptions: await this.loadYieldOptions(asset) };
       })
     );
     return mapYieldseekerAgentApy(values, days);
   }
+  async loadYieldOptions(asset) {
+    const cached = this.yieldOptions.get(asset);
+    if (cached && cached.expiresAt > Date.now()) return cached.value;
+    const pending = this.pendingYieldOptions.get(asset);
+    if (pending) return pending;
+    const metadata = YIELDSEEKER_ASSET_METADATA[asset];
+    const request = this.api.request(
+      `/chains/8453/assets/${metadata.address}/yield-options`
+    ).then((response) => {
+      if (!Array.isArray(response?.yieldOptions)) {
+        throw this.invalidResponse("yield options");
+      }
+      this.yieldOptions.set(asset, {
+        expiresAt: Date.now() + YIELDSEEKER_YIELD_OPTIONS_CACHE_MS,
+        value: response.yieldOptions
+      });
+      return response.yieldOptions;
+    }).finally(() => this.pendingYieldOptions.delete(asset));
+    this.pendingYieldOptions.set(asset, request);
+    return request;
+  }
   userKey(state, chainId) {
     return `${state.walletAddress.toLowerCase()}:${chainId}`;
   }
@@ -3657,8 +3527,9 @@ var YieldseekerAgent = class {
     const pending = this.pendingAgents.get(key2);
     if (pending) return pending;
     const request = this.resolveAgent(state, chainId, asset, true).then(
-      (context) => {
+      async (context) => {
         if (!context) throw this.invalidResponse("agent creation");
+        await this.deployAgent(state, chainId, context);
         this.agentContexts.set(key2, context);
         return context;
       }
@@ -3803,24 +3674,21 @@ var YieldseekerAgent = class {
       ...actions?.actions ? { actions: actions.actions } : {}
     };
   }
-  async deployAfterFunding(state, chainId, context) {
+  async deployAgent(state, chainId, context) {
     if (context.wallet.initializedDate != null) return;
-    try {
-      const deployed = await this.walletRequest(
-        state,
-        chainId,
-        this.agentPath(context, "deploy"),
-        { method: "POST", body: {} }
-      );
-      if (deployed?.agentWallet) {
-        context.wallet = deployed.agentWallet;
-      }
-    } catch (error) {
-      console.warn(
-        "[owney-sdk] Yieldseeker deposit is funded but not deployable yet:",
-        error
-      );
+    const walletAddress = context.wallet.walletAddress.toLowerCase();
+    const deployed = await this.walletRequest(
+      state,
+      chainId,
+      this.agentPath(context, "deploy"),
+      { method: "POST", body: {} }
+    );
+    if (!deployed?.agentWallet || !isAddress2(deployed.agentWallet.walletAddress) || deployed.agentWallet.walletAddress.toLowerCase() !== walletAddress) {
+      throw this.invalidResponse("agent deployment", {
+        reason: "Deploy did not return the expected Agent Wallet."
+      });
     }
+    context.wallet = deployed.agentWallet;
   }
   async refreshSnapshotAfterMovement(state, chainId, context, movement) {
     try {
@@ -4311,98 +4179,302 @@ import {
 } from "viem";
 import { base as base4, arbitrum as arbitrum2, mainnet as mainnet2 } from "viem/chains";
 
-// src/lib/sponsored-weth-deposit.ts
-var PERMIT_WINDOW_SECONDS = 15 * 60;
-function makeSponsoredWethCallback(deps) {
-  const get = deps.httpGet ?? getSponsorRelayerAddress;
-  const post = deps.httpPost ?? postSponsorPermit2Transfer;
-  return makeVerificationAwareDepositCallback(
-    async (smartWallet, chainId, amount, verification) => {
-      const cid = chainId;
-      const token = deps.tokenAddressByChain[cid];
-      if (!token) {
-        throw new OwneyError(
-          "CHAIN_UNSUPPORTED",
-          `No sponsored WETH configured for chain ${chainId}`
-        );
-      }
-      const amountWei = BigInt(amount);
-      const pub = deps.getPublicClient(cid);
-      const wallet = deps.getWalletClient(cid);
-      await ensureWalletOnChain(pub, wallet, cid);
-      try {
-        const balance = await readErc20Balance(pub, token, deps.ownerAddress);
-        if (balance < amountWei) {
-          throw new OwneyError(
-            "DEPOSIT_INSUFFICIENT_BALANCE",
-            "Insufficient WETH balance for this deposit.",
-            { token, chainId: cid, balance: balance.toString(), amount }
-          );
-        }
-      } catch (err) {
-        if (err instanceof OwneyError) throw err;
-        console.warn(
-          "[owney-sdk] WETH balance pre-check failed (non-fatal):",
-          err instanceof Error ? err.message : String(err)
-        );
-      }
-      const allowance = await readPermit2Allowance(
-        pub,
-        token,
-        deps.ownerAddress
+// src/lib/sponsored-token-batch.ts
+import {
+  isAddressEqual,
+  keccak256,
+  toBytes
+} from "viem";
+
+// src/lib/permit2-batch.ts
+import { parseAbi as parseAbi2, hashStruct } from "viem";
+var BATCH_PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var PERMIT_BATCH_TYPES = {
+  PermitBatchWitnessTransferFrom: [
+    { name: "permitted", type: "TokenPermissions[]" },
+    { name: "spender", type: "address" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" },
+    { name: "witness", type: "Deposit" }
+  ],
+  Deposit: [{ name: "recipients", type: "address[]" }],
+  TokenPermissions: [
+    { name: "token", type: "address" },
+    { name: "amount", type: "uint256" }
+  ]
+};
+var PERMIT2_BATCH_ABI = parseAbi2([
+  "struct TokenPermissions { address token; uint256 amount; }",
+  "struct PermitBatchTransferFrom { TokenPermissions[] permitted; uint256 nonce; uint256 deadline; }",
+  "struct SignatureTransferDetails { address to; uint256 requestedAmount; }",
+  "function permitWitnessTransferFrom(PermitBatchTransferFrom permit,SignatureTransferDetails[] transferDetails,address owner,bytes32 witness,string witnessTypeString,bytes signature)",
+  "function nonceBitmap(address owner,uint256 wordPos) view returns (uint256)"
+]);
+function batchPermit(b) {
+  return {
+    permitted: b.transfers.map((t) => ({
+      token: b.token,
+      amount: BigInt(t.amount)
+    })),
+    nonce: BigInt(b.nonce),
+    deadline: BigInt(b.deadline)
+  };
+}
+function batchTypedData(b, spender) {
+  return {
+    domain: {
+      name: "Permit2",
+      chainId: b.chainId,
+      verifyingContract: BATCH_PERMIT2_ADDRESS
+    },
+    types: PERMIT_BATCH_TYPES,
+    primaryType: "PermitBatchWitnessTransferFrom",
+    message: {
+      ...batchPermit(b),
+      spender,
+      witness: { recipients: b.transfers.map((t) => t.to) }
+    }
+  };
+}
+
+// src/lib/sponsored-token-batch.ts
+var memory = /* @__PURE__ */ new Map();
+var inflight = /* @__PURE__ */ new Map();
+var planOf = (transfers) => JSON.stringify(
+  transfers.map((t) => ({
+    to: t.to.toLowerCase(),
+    amount: BigInt(t.amount).toString()
+  }))
+);
+function read(key2) {
+  return typeof window === "undefined" ? memory.get(key2) : window.localStorage.getItem(key2);
+}
+function save(key2, body) {
+  const value = JSON.stringify({
+    ...body,
+    transfers: body.transfers.map(({ to, amount }) => ({ to, amount }))
+  });
+  if (typeof window === "undefined") memory.set(key2, value);
+  else window.localStorage.setItem(key2, value);
+}
+function clear(key2) {
+  if (typeof window === "undefined") memory.delete(key2);
+  else window.localStorage.removeItem(key2);
+}
+function sponsorTokenBatch(i) {
+  const key2 = `owney.token-batch.v1:${keccak256(toBytes(i.apiKey))}:${i.baseUrl ?? "default"}:${i.chainId}:${i.owner.toLowerCase()}:${i.token.toLowerCase()}`;
+  const plan = planOf(i.transfers);
+  const active = inflight.get(key2);
+  if (active) {
+    if (active.plan !== plan)
+      return Promise.reject(
+        new Error(
+          "A token deposit is already in progress. Wait for its result before depositing again."
+        )
       );
-      if (allowance < amountWei) {
-        throw new OwneyError(
-          "PERMIT2_APPROVAL_REQUIRED",
-          "WETH gasless deposits need a one-time Permit2 approval; call approvePermit2() first",
-          { token, chainId: cid, allowance: allowance.toString(), amount }
-        );
+    return active.promise;
+  }
+  const promise = execute(i, key2, plan).finally(() => inflight.delete(key2));
+  inflight.set(key2, { plan, promise });
+  return promise;
+}
+async function execute(i, key2, plan) {
+  if (!i.transfers.length || i.transfers.length > 16 || i.transfers.some(
+    (t) => BigInt(t.amount) <= 0n || BigInt(t.amount) >= 1n << 256n
+  ) || new Set(i.transfers.map((t) => t.to.toLowerCase())).size !== i.transfers.length)
+    throw new Error("Invalid token deposit shares.");
+  const send = async (initial) => {
+    let body = initial;
+    save(key2, body);
+    try {
+      if (!body.serializedTransaction) {
+        const prepared = await postSponsorBatchTransfer({
+          apiKey: i.apiKey,
+          baseUrl: i.baseUrl,
+          body
+        });
+        if (!prepared.serializedTransaction || keccak256(prepared.serializedTransaction) !== prepared.txHash)
+          throw new Error(
+            "Sponsorship API did not return a valid prepared transaction."
+          );
+        body = {
+          ...body,
+          serializedTransaction: prepared.serializedTransaction
+        };
+        save(key2, body);
       }
-      const relayer = await get({
-        baseUrl: deps.baseUrl,
-        apiKey: deps.apiKey,
-        chainId: cid
-      });
-      const nonce = randomPermit2Nonce();
-      const deadline = BigInt(
-        Math.floor(Date.now() / 1e3) + PERMIT_WINDOW_SECONDS
-      );
-      const typedData = buildPermitTransferFromTypedData({
-        chainId: cid,
-        message: {
-          permitted: { token, amount: amountWei },
-          spender: relayer,
-          nonce,
-          deadline
-        }
-      });
-      const signature = await wallet.signTypedData({
-        account: deps.ownerAddress,
-        ...typedData
-      });
-      deps.onApproved?.();
-      const result = await post({
-        baseUrl: deps.baseUrl,
-        apiKey: deps.apiKey,
-        ...verification?.agentId === "yieldseeker" ? { yieldseekerSignature: verification.signature } : {},
-        body: {
-          chainId: cid,
-          token,
-          from: deps.ownerAddress,
-          to: smartWallet,
-          amount,
-          nonce: nonce.toString(),
-          deadline: deadline.toString(),
-          signature,
-          ...verification?.agentId === "yieldseeker" ? {
-            yieldseekerUserId: verification.userId,
-            yieldseekerAgentId: verification.yieldseekerAgentId
-          } : {}
-        }
+      const result = await postSponsorBatchTransfer({
+        apiKey: i.apiKey,
+        baseUrl: i.baseUrl,
+        body
       });
+      if (result.txHash !== keccak256(body.serializedTransaction))
+        throw new Error(
+          "Sponsorship receipt does not match the pending transaction."
+        );
+      clear(key2);
       return result.txHash;
+    } catch (error) {
+      if (!body.serializedTransaction || error instanceof OwneyError && error.details?.notSubmitted === true)
+        clear(key2);
+      throw error;
     }
+  };
+  const saved = read(key2);
+  if (saved) {
+    const previous = JSON.parse(saved);
+    if (previous.chainId !== i.chainId || !isAddressEqual(previous.from, i.owner) || !isAddressEqual(previous.token, i.token) || planOf(previous.transfers) !== plan)
+      throw new Error(
+        "Retry the previous token deposit and agent split first to reconcile its status."
+      );
+    i.onApproved?.();
+    return send({ ...previous, transfers: i.transfers });
+  }
+  const total = i.transfers.reduce((sum, t) => sum + BigInt(t.amount), 0n);
+  const [balance, allowance] = await Promise.all([
+    readErc20Balance(i.pub, i.token, i.owner),
+    readPermit2Allowance(i.pub, i.token, i.owner)
+  ]);
+  if (balance < total)
+    throw new OwneyError(
+      "DEPOSIT_INSUFFICIENT_BALANCE",
+      "Insufficient token balance for this deposit."
+    );
+  if (allowance < total)
+    throw new OwneyError(
+      "PERMIT2_APPROVAL_REQUIRED",
+      "token deposits need a one-time Permit2 approval."
+    );
+  const relayer = await getSponsorRelayerAddress({
+    apiKey: i.apiKey,
+    baseUrl: i.baseUrl,
+    chainId: i.chainId
+  });
+  const now = (await i.pub.getBlock()).timestamp;
+  const unsigned = {
+    chainId: i.chainId,
+    token: i.token,
+    from: i.owner,
+    transfers: i.transfers,
+    nonce: randomPermit2Nonce().toString(),
+    deadline: (now + 900n).toString()
+  };
+  const signature = await i.wallet.signTypedData({
+    account: i.owner,
+    ...batchTypedData(unsigned, relayer)
+  });
+  i.onApproved?.();
+  return send({ ...unsigned, signature });
+}
+
+// src/lib/sponsored-token-deposit.ts
+function makeSponsoredTokenCallback(deps) {
+  const batch = async (chainId, transfers) => {
+    if (chainId !== 8453 && chainId !== 42161 && chainId !== 1)
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored token configured for chain ${chainId}`
+      );
+    const token = deps.tokenAddressByChain[chainId];
+    if (!token)
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `No sponsored token configured for chain ${chainId}`
+      );
+    const pub = deps.getPublicClient(chainId), wallet = deps.getWalletClient(chainId);
+    await ensureWalletOnChain(pub, wallet, chainId);
+    return sponsorTokenBatch({
+      apiKey: deps.apiKey,
+      baseUrl: deps.baseUrl,
+      owner: deps.ownerAddress,
+      token,
+      chainId,
+      transfers,
+      pub,
+      wallet,
+      onApproved: deps.onApproved
+    });
+  };
+  const callback = makeVerificationAwareDepositCallback(
+    (to, chainId, amount, verification) => batch(chainId, [toBatchTransfer(to, amount, verification)])
   );
+  registerDepositBatch(callback, batch);
+  return callback;
+}
+
+// src/lib/agent-deposit-batch.ts
+function deferred() {
+  let resolve, reject;
+  const promise = new Promise((yes, no) => {
+    resolve = yes;
+    reject = no;
+  });
+  void promise.catch(() => {
+  });
+  return { promise, resolve, reject };
+}
+async function runAgentDepositBatch(chainId, legs, transfer) {
+  const funding = deferred();
+  const tasks = [];
+  const transfers = [];
+  try {
+    for (const leg of legs) {
+      const ready = deferred();
+      let entered = false;
+      const callback = makeVerificationAwareDepositCallback(
+        (to, cid, amount, verification) => {
+          if (entered || cid !== chainId || BigInt(amount) !== BigInt(leg.amount)) {
+            const error = new Error(
+              "Agent changed its prepared deposit share."
+            );
+            ready.reject(error);
+            throw error;
+          }
+          entered = true;
+          ready.resolve(toBatchTransfer(to, amount, verification));
+          return funding.promise;
+        }
+      );
+      const task = Promise.resolve().then(() => leg.run(callback));
+      tasks.push(task);
+      void task.then(
+        () => {
+          if (!entered)
+            ready.reject(
+              new Error("Agent did not prepare a deposit transfer.")
+            );
+        },
+        (error) => ready.reject(error)
+      );
+      transfers.push(await ready.promise);
+    }
+    const txHash = await transfer(chainId, transfers);
+    funding.resolve(txHash);
+    const settled = await Promise.allSettled(tasks);
+    const agentResults = {};
+    const failures = [];
+    for (const [index, result] of settled.entries()) {
+      if (result.status === "fulfilled")
+        agentResults[legs[index].id] = result.value;
+      else failures.push(legs[index].id);
+    }
+    if (failures.length)
+      throw new OwneyError(
+        "DEPOSIT_PARTIAL_FAILURE",
+        "The deposit was sent to all agents, but some agent updates could not be confirmed. Check activity before depositing again.",
+        {
+          txHash,
+          fundsSubmitted: true,
+          agentResults,
+          failedAgentIds: failures
+        }
+      );
+    return { agentResults };
+  } catch (error) {
+    funding.reject(error);
+    await Promise.allSettled(tasks);
+    throw error;
+  }
 }
 
 // src/lib/sponsored-calls-deposit.ts
@@ -4432,7 +4504,7 @@ function makeSponsoredCallsCallback(deps) {
     }
     return new URL(configured, origin).toString();
   };
-  return makeVerificationAwareDepositCallback(async (smartWallet, chainId, amount, verification) => {
+  const batch = async (chainId, transfers) => {
     const cid = chainId;
     const token = deps.tokenAddressByChain[cid];
     if (!token) {
@@ -4448,19 +4520,24 @@ function makeSponsoredCallsCallback(deps) {
         { chainId }
       );
     }
-    const data = encodeFunctionData2({
-      abi: erc20Abi2,
-      functionName: "transfer",
-      args: [smartWallet, BigInt(amount)]
-    });
+    const calls = transfers.map((transfer) => ({
+      to: token,
+      value: "0x0",
+      data: encodeFunctionData2({
+        abi: erc20Abi2,
+        functionName: "transfer",
+        args: [transfer.to, BigInt(transfer.amount)]
+      })
+    }));
     let paymasterUrl = absolutePaymasterUrl();
-    if (verification?.agentId === "yieldseeker") {
-      if (chainId !== 8453) {
+    for (const transfer of transfers) {
+      const verification = transfer.yieldseeker;
+      if (!verification) continue;
+      if (chainId !== 8453)
         throw new OwneyError(
           "CHAIN_UNSUPPORTED",
-          `Yieldseeker Base Account sponsorship is not available on chain ${chainId}.`
+          `Yieldseeker sponsorship is not available on chain ${chainId}.`
         );
-      }
       const { intent } = await postPaymasterIntent({
         baseUrl: deps.routingApiBaseUrl,
         apiKey: deps.apiKey,
@@ -4469,14 +4546,14 @@ function makeSponsoredCallsCallback(deps) {
           chainId,
           token,
           from: deps.ownerAddress,
-          to: smartWallet,
-          amount,
+          to: transfer.to,
+          amount: transfer.amount,
           yieldseekerUserId: verification.userId,
-          yieldseekerAgentId: verification.yieldseekerAgentId
+          yieldseekerAgentId: verification.agentId
         }
       });
       const url = new URL(paymasterUrl);
-      url.searchParams.set("owneyIntent", intent);
+      url.searchParams.append("owneyIntent", intent);
       paymasterUrl = url.toString();
     }
     const sendResult = await deps.provider.request({
@@ -4486,8 +4563,8 @@ function makeSponsoredCallsCallback(deps) {
           version: "2.0.0",
           from: deps.ownerAddress,
           chainId: toHex(chainId),
-          atomicRequired: false,
-          calls: [{ to: token, value: "0x0", data }],
+          atomicRequired: transfers.length > 1,
+          calls,
           capabilities: {
             paymasterService: { url: paymasterUrl }
           }
@@ -4509,7 +4586,24 @@ function makeSponsoredCallsCallback(deps) {
         params: [callsId]
       });
       const txHash = status?.receipts?.[0]?.transactionHash;
-      if (txHash) return txHash;
+      if (status?.receipts?.some((receipt) => receipt.status === "0x0") || typeof status?.status === "number" && status.status >= 400) {
+        throw new OwneyError(
+          "SPONSOR_REQUEST_FAILED",
+          "The sponsored deposit did not complete successfully.",
+          { chainId, callsId, safeToFallback: false }
+        );
+      }
+      if (txHash && (transfers.length === 1 || status?.status === 200 || status?.status === "CONFIRMED")) {
+        if (status?.receipts?.some(
+          (receipt) => receipt.transactionHash !== txHash
+        ))
+          throw new OwneyError(
+            "SPONSORED_CALLS_NO_RECEIPT",
+            "The wallet returned multiple transactions for an atomic deposit. Check activity before trying again.",
+            { chainId, callsId }
+          );
+        return txHash;
+      }
       if (pollIntervalMs > 0) {
         await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
       }
@@ -4519,7 +4613,12 @@ function makeSponsoredCallsCallback(deps) {
       `No receipt for calls ${callsId} after ${maxPolls} polls; the deposit may still settle.`,
       { chainId, callsId }
     );
-  });
+  };
+  const callback = makeVerificationAwareDepositCallback(
+    (to, chainId, amount, verification) => batch(chainId, [toBatchTransfer(to, amount, verification)])
+  );
+  registerDepositBatch(callback, batch);
+  return callback;
 }
 
 // src/client.ts
@@ -4558,6 +4657,11 @@ var SPONSORED_WETH_BY_CHAIN = {
   42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1",
   1: "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
 };
+var SPONSORED_TOKENS_BY_ASSET = { USDC: SPONSORED_USDC_BY_CHAIN, WETH: SPONSORED_WETH_BY_CHAIN };
+function sponsoredTokensFor(asset) {
+  if (!Object.prototype.hasOwnProperty.call(SPONSORED_TOKENS_BY_ASSET, asset)) throw new OwneyError("ASSET_UNSUPPORTED", `No sponsored token configured for ${asset}`);
+  return SPONSORED_TOKENS_BY_ASSET[asset];
+}
 function shouldFallbackToUserPaid(error, asset, appCallback) {
   return (asset === "WETH" || asset === "USDC") && appCallback === void 0 && error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED" && error.details?.safeToFallback === true;
 }
@@ -4692,18 +4796,13 @@ var OwneySDK = class {
     }
     return this.state.provider;
   }
-  /**
-   * Lazily builds (and caches) the default EIP-3009 sponsored deposit callback
-   * used when the caller omits `depositCallback`. Wraps the connected EIP-1193
-   * provider with viem `custom(provider)` to read token meta and sign the
-   * `TransferWithAuthorization`, then POSTs to the sponsor API.
-   */
+  /** Builds the default USDC batch callback for the connected wallet. */
   getDefaultSponsoredCallback(onApproved) {
     if (!onApproved && this.cachedSponsoredCallback)
       return this.cachedSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    const callback = makeSponsoredDepositCallback({
+    const callback = makeSponsoredTokenCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
@@ -4725,12 +4824,7 @@ var OwneySDK = class {
     if (!onApproved) this.cachedSponsoredCallback = callback;
     return callback;
   }
-  /**
-   * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
-   * callback used when the caller omits `depositCallback` for a WETH
-   * deposit. Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
-   * `PermitTransferFrom` instead of an EIP-3009 authorization.
-   */
+  /** Builds the wallet-native sponsored calls callback for compatible paymasters. */
   getDefaultSponsoredCallsCallback(asset, onApproved) {
     const cached = this.cachedSponsoredCallsCallbacks.get(asset);
     if (!onApproved && cached) return cached;
@@ -4742,7 +4836,7 @@ var OwneySDK = class {
       ownerAddress: this.state.walletAddress,
       paymasterServiceUrl: this.paymasterServiceUrl,
       onApproved,
-      tokenAddressByChain: asset === "WETH" ? SPONSORED_WETH_BY_CHAIN : SPONSORED_USDC_BY_CHAIN
+      tokenAddressByChain: sponsoredTokensFor(asset)
     });
     if (!onApproved) this.cachedSponsoredCallsCallbacks.set(asset, callback);
     return callback;
@@ -4751,14 +4845,14 @@ var OwneySDK = class {
    * Lazily builds (and caches) the default Permit2 sponsored WETH deposit
    * callback used when the caller omits `depositCallback` for a WETH deposit.
    * Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
-   * `PermitTransferFrom` instead of an EIP-3009 authorization.
+   * single-use batch authorization instead of an EIP-3009 authorization.
    */
   getDefaultWethSponsoredCallback(onApproved) {
     if (!onApproved && this.cachedWethSponsoredCallback)
       return this.cachedWethSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const owner = this.state.walletAddress;
-    const callback = makeSponsoredWethCallback({
+    const callback = makeSponsoredTokenCallback({
       apiKey: this.apiKey,
       baseUrl: this.routingApiBaseUrl,
       ownerAddress: owner,
@@ -5064,7 +5158,8 @@ var OwneySDK = class {
    * @param options.asset - Asset symbol to deposit (e.g. "USDC")
    * @param options.depositCallback - Callback that performs the token transfer and returns a tx hash.
    *   When agentId is omitted, this callback is invoked once per eligible agent with that agent's
-   *   split amount and smart wallet address — expect multiple wallet prompts.
+   *   split amount and smart wallet address. Default sponsored deposits batch
+   *   all shares into one signature; custom callbacks still run once per agent.
    * @param options.agentId - Optional explicit target. Otherwise split equally,
    *   or fund remaining agents when a recovery deposit cannot meet every minimum.
    * @returns {OwneyDepositResult} for a single agent, or {OwneyMultiDepositResult} with per-agent results
@@ -5149,6 +5244,39 @@ var OwneySDK = class {
         }
       );
     }
+    const batchTransfer = getDepositBatchTransfer(effectiveCallback);
+    if (!depositCallback && batchTransfer) {
+      return runAgentDepositBatch(
+        chainId,
+        agentAmounts.map(({ agent, amount: amount2 }) => ({
+          id: agent.id,
+          amount: amount2,
+          run: (callback) => withFailureReporting(
+            this.apiKey,
+            agent.id,
+            () => agent.deposit(state, chainId, amount2, asset, callback),
+            this.routingApiBaseUrl
+          )
+        })),
+        async (cid, transfers) => {
+          try {
+            return await batchTransfer(cid, transfers);
+          } catch (error) {
+            if (!(error instanceof OwneyError) || error.code !== "PERMIT2_APPROVAL_REQUIRED")
+              throw error;
+            const requiredAmount = transfers.reduce(
+              (sum, transfer) => sum + BigInt(transfer.amount),
+              0n
+            );
+            await this.approvePermit2(
+              asset,
+              requiredAmount
+            );
+            return batchTransfer(cid, transfers);
+          }
+        }
+      );
+    }
     const agentResults = {};
     for (const [
       index,
@@ -5188,7 +5316,7 @@ var OwneySDK = class {
    *
    * 1. Missing Permit2 allowance: when the app did not supply its own
    *    callback and the attempt fails with `PERMIT2_APPROVAL_REQUIRED` on a
-   *    WETH deposit, this is the wallet's first gasless WETH deposit. We send
+   *    token deposit, this is the wallet's first Permit2 deposit for that token. We send
    *    the one-time (user-paid) Permit2 approval via `approvePermit2()` and
    *    retry the SAME sponsored attempt once. Bounded to one approval attempt
    *    per call so a wallet/agent that keeps reporting the allowance as
@@ -5225,12 +5353,15 @@ var OwneySDK = class {
       try {
         return await attempt(effectiveCallback);
       } catch (error) {
-        if (!approvalAttempted && appCallback === void 0 && asset === "WETH" && error instanceof OwneyError && error.code === "PERMIT2_APPROVAL_REQUIRED") {
+        if (!approvalAttempted && appCallback === void 0 && (asset === "WETH" || asset === "USDC") && error instanceof OwneyError && error.code === "PERMIT2_APPROVAL_REQUIRED") {
           approvalAttempted = true;
           console.warn(
-            "[owney-sdk] First WETH deposit: sending one-time Permit2 approval..."
+            "[owney-sdk] First token deposit: sending one-time Permit2 approval..."
+          );
+          await this.approvePermit2(
+            asset,
+            BigInt(amount)
           );
-          await this.approvePermit2();
           continue;
         }
         if (!shouldFallbackToUserPaid(error, asset, appCallback)) throw error;
@@ -5883,26 +6014,31 @@ var OwneySDK = class {
     return pending;
   }
   /**
-   * One-time, user-paid approval of Permit2 on the sponsored WETH token for
-   * the active chain. Required once per wallet per chain before gasless WETH
-   * deposits; afterwards deposit() is signature-only. Resolves only after the
-   * approval transaction is mined (1 confirmation), so a subsequent deposit()
-   * will see the new allowance; throws if the transaction reverted.
+   * User-paid approval of Permit2 on the selected token for the active chain.
+   * Approves exactly the pending deposit amount. Another approval is required
+   * for a later deposit once this allowance has been consumed. Resolves after
+   * one confirmation so the subsequent deposit attempt sees the new allowance.
+   *
+   * @param requiredAmount Raw base-unit amount the pending deposit must cover.
    * @returns the approval transaction hash.
    */
-  async approvePermit2(asset = "WETH") {
-    void asset;
+  async approvePermit2(asset = "WETH", requiredAmount = 0n) {
     const state = this.requireState();
     const chainId = this.requireChainId();
-    this.validateAssetSupport(this.getAgent("zyfai"), chainId, "WETH");
-    const token = SPONSORED_WETH_BY_CHAIN[chainId];
+    this.getEligibleAgents(chainId, asset, { excludeDisabled: true });
+    const token = sponsoredTokensFor(asset)[chainId];
     if (!token) {
       throw new OwneyError(
         "CHAIN_UNSUPPORTED",
-        `No sponsored WETH on chain ${chainId}`
+        `No sponsored token on chain ${chainId}`
       );
     }
     const provider = this.requireConnectedProvider();
+    const publicClient = createPublicClient4({
+      chain: VIEM_CHAIN2[chainId],
+      transport: custom3(provider)
+    });
+    const approvalAmount = permit2ApprovalAmount(requiredAmount);
     const wallet = createWalletClient3({
       account: state.walletAddress,
       chain: VIEM_CHAIN2[chainId],
@@ -5912,14 +6048,10 @@ var OwneySDK = class {
       address: token,
       abi: ERC20_ALLOWANCE_ABI,
       functionName: "approve",
-      args: [PERMIT2_ADDRESS, MAX_UINT256],
+      args: [PERMIT2_ADDRESS, approvalAmount],
       account: state.walletAddress,
       chain: VIEM_CHAIN2[chainId]
     });
-    const publicClient = createPublicClient4({
-      chain: VIEM_CHAIN2[chainId],
-      transport: custom3(provider)
-    });
     const receipt = await publicClient.waitForTransactionReceipt({
       hash,
       confirmations: 1