@owney/sdk 0.7.22-beta.0 → 0.7.23-beta.0

package/dist/index.js

@@ -1,18 +1,51 @@
-import {
-  AgentChainIncompatibleError,
-  AgentNotFoundError,
-  NotConnectedError,
-  OwneyError,
-  debugLog,
-  fetchAgentKeys,
-  fetchOrgAgentConfig,
-  setOwneyDebug
-} from "./chunk-XBDJWZXY.js";
-import {
-  buildTransferWithAuthorizationTypedData,
-  randomAuthNonce,
-  readTokenMeta
-} from "./chunk-5LU2SHO7.js";
+// src/errors.ts
+var OwneyError = class extends Error {
+  code;
+  details;
+  agentId;
+  constructor(code, message, details, agentId) {
+    const prefix = agentId ? `[${code}][agent:${agentId}]` : `[${code}]`;
+    super(`${prefix} ${message}`);
+    this.name = "OwneyError";
+    this.code = code;
+    this.details = details;
+    this.agentId = agentId;
+  }
+};
+var AgentNotFoundError = class extends OwneyError {
+  constructor(agentId, available) {
+    super(
+      "AGENT_NOT_FOUND",
+      `Unknown agent "${agentId}". Available agents: ${available.join(", ")}`,
+      { agentId, available },
+      agentId
+    );
+    this.name = "AgentNotFoundError";
+  }
+};
+var NotConnectedError = class extends OwneyError {
+  constructor() {
+    super("NOT_CONNECTED", "Not connected. Call sdk.connect(provider) first.");
+    this.name = "NotConnectedError";
+  }
+};
+var AgentChainIncompatibleError = class extends OwneyError {
+  incompatibleAgents;
+  connectedChainId;
+  constructor(incompatibleAgents, connectedChainId) {
+    const details = incompatibleAgents.map(
+      ({ agentId, supportedChainIds }) => `"${agentId}" supports chains [${supportedChainIds.join(", ")}]`
+    ).join("; ");
+    super(
+      "AGENT_CHAIN_INCOMPATIBLE",
+      `Chain ${connectedChainId} is not supported by the following agents: ${details}`,
+      { incompatibleAgents, connectedChainId }
+    );
+    this.name = "AgentChainIncompatibleError";
+    this.incompatibleAgents = incompatibleAgents;
+    this.connectedChainId = connectedChainId;
+  }
+};
 
 // src/lib/rate-limit.ts
 function rateLimitDelay(error, now = Date.now()) {
@@ -179,6 +212,23 @@ var SupportedAssets = [
   }
 ];
 
+// src/lib/debug.ts
+var configuredDebug = false;
+function setOwneyDebug(enabled) {
+  configuredDebug = enabled;
+}
+function isOwneyDebug() {
+  return globalThis.__OWNEY_DEBUG__ === true || configuredDebug;
+}
+function debugLog(scope, message, data) {
+  if (!isOwneyDebug()) return;
+  if (data === void 0) {
+    console.log(`[${scope}] ${message}`);
+  } else {
+    console.log(`[${scope}] ${message}`, data);
+  }
+}
+
 // src/lib/utils.ts
 var isValidChainId = (chainId) => {
   if (!SUPPORTED_CHAIN_IDS.includes(chainId)) {
@@ -190,12 +240,6 @@ var isValidChainId = (chainId) => {
   }
   return chainId;
 };
-function isSameAsset(tokenSymbol, asset) {
-  const token = tokenSymbol.toLowerCase();
-  const target = asset.toLowerCase();
-  if (token === target) return true;
-  return target === "weth" && token === "eth" || target === "eth" && token === "weth";
-}
 function hexToDecimal(hex, decimals = 6) {
   const normalized = hex.startsWith("0x") || hex.startsWith("0X") ? hex : `0x${hex}`;
   const parsed = BigInt(normalized);
@@ -1449,37 +1493,6 @@ var ZyfaiAgent = class _ZyfaiAgent {
       );
     }
   }
-  /**
-   * Records the deposit with Zyfai, retrying transient failures.
-   *
-   * This runs AFTER the transfer has already landed on-chain, so it must never
-   * fail the deposit — the funds moved. But it is also the ONLY source of the
-   * "Top up wallet" entry the history is built from: Zyfai auto-deploys the
-   * balance it detects either way, so when this call is lost the user's deposit
-   * never appears in Activity (an earlier withdrawal stays the newest row) and
-   * nothing ever backfills it. Retry, then log loudly enough to be recoverable.
-   */
-  async logDepositWithRetry(chainId, txHash, amount, tokenAddress) {
-    const ATTEMPTS = 3;
-    const RETRY_DELAY_MS = 1e3;
-    for (let attempt = 1; attempt <= ATTEMPTS; attempt++) {
-      try {
-        await (tokenAddress ? this.sdk.logDeposit(chainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(chainId, txHash, amount));
-        return;
-      } catch (logError) {
-        if (attempt === ATTEMPTS) {
-          console.error(
-            "[owney-sdk] Deposit landed on-chain but logDeposit failed \u2014 it will be missing from Zyfai history:",
-            { txHash, chainId, amount, tokenAddress, error: logError }
-          );
-          return;
-        }
-        await new Promise(
-          (resolve) => setTimeout(resolve, RETRY_DELAY_MS * attempt)
-        );
-      }
-    }
-  }
   /**
    * True when `smartWallet` is the backend-managed pool wallet Zyfai assigned
    * to this EOA — the "new wallet" kind that is predeployed on the chains it
@@ -1789,12 +1802,14 @@ var ZyfaiAgent = class _ZyfaiAgent {
         );
         const txHash = await depositCallback(smartWallet, validChainId, amount);
         const tokenAddress = asset === "WETH" ? WETH_ADDRESS_BY_CHAIN[validChainId] : void 0;
-        await this.logDepositWithRetry(
-          validChainId,
-          txHash,
-          amount,
-          tokenAddress
-        );
+        try {
+          await (tokenAddress ? this.sdk.logDeposit(validChainId, txHash, amount, tokenAddress) : this.sdk.logDeposit(validChainId, txHash, amount));
+        } catch (logError) {
+          console.warn(
+            "[owney-sdk] Deposit landed on-chain but logDeposit failed (non-fatal):",
+            logError
+          );
+        }
         return { txHash, smartWallet, amount };
       }
       await this.ensureWalletDeployed(this.getAddress(), validChainId);
@@ -1995,22 +2010,677 @@ var ZyfaiAgent = class _ZyfaiAgent {
     await this.sdk.updateUserProfile(update);
     return true;
   }
-  // --- IAgent: Discovery (no wallet required) ---
-  async getAgentApy(days, options) {
-    const raw = await this.sdk.getAPYPerStrategy(
-      false,
-      DayFilterMapping[days],
-      "aggressive",
-      options?.chainId,
-      options?.tokenSymbol
+  // --- IAgent: Discovery (no wallet required) ---
+  async getAgentApy(days, options) {
+    const raw = await this.sdk.getAPYPerStrategy(
+      false,
+      DayFilterMapping[days],
+      "aggressive",
+      options?.chainId,
+      options?.tokenSymbol
+    );
+    return mapApyByStrategy(raw);
+  }
+};
+
+// src/lib/routing-api.ts
+var ROUTING_API_BASE_URL = "https://owney-routing-api-243946518160.europe-west4.run.app";
+async function fetchOrgAgentConfig(apiKey, baseUrl = ROUTING_API_BASE_URL) {
+  const url = `${baseUrl}/api/v1/agent/org-config`;
+  try {
+    const res = await fetch(url, {
+      method: "GET",
+      headers: {
+        "Content-Type": "application/json",
+        "x-owney-api-key": `${apiKey}`
+      }
+    });
+    if (!res.ok) {
+      if (res.status !== 404) {
+        console.warn(
+          `[owney-sdk] Could not read org agent config (${res.status}); leaving user profiles unchanged.`
+        );
+      }
+      return null;
+    }
+    const json = await res.json();
+    const policy = json.success ? json.data ?? null : null;
+    debugLog(
+      "owney-sdk",
+      policy ? "org agent config: loaded" : "org agent config: none set by this partner \u2014 user profiles will be left as they are",
+      policy ?? void 0
+    );
+    return policy;
+  } catch (error) {
+    console.warn(
+      "[owney-sdk] Could not read org agent config (non-fatal):",
+      error instanceof Error ? error.message : String(error)
+    );
+    return null;
+  }
+}
+async function fetchAgentKeys(apiKey, baseUrl = ROUTING_API_BASE_URL) {
+  const url = `${baseUrl}/api/v1/agent/keys`;
+  const res = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Content-Type": "application/json",
+      "x-owney-api-key": `${apiKey}`
+    }
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new OwneyError(
+      "API_ROUTING_ERROR",
+      `Routing API error ${res.status}: ${text}`,
+      { statusCode: res.status, responseBody: text }
+    );
+  }
+  const json = await res.json();
+  if (!json.success) {
+    throw new OwneyError(
+      "API_ROUTING_FAILED",
+      `Routing API request failed: ${json.message}`,
+      { message: json.message }
+    );
+  }
+  return json.data;
+}
+
+// src/lib/chain-guard.ts
+var CHAIN_NAMES = {
+  1: "Ethereum",
+  8453: "Base",
+  42161: "Arbitrum"
+};
+function chainName(chainId) {
+  return CHAIN_NAMES[chainId] ?? `chain ${chainId}`;
+}
+async function ensureWalletOnChain(pub, wallet, expected) {
+  const actual = await pub.getChainId();
+  if (actual === expected) return;
+  try {
+    await wallet.switchChain({ id: expected });
+  } catch (error) {
+    throw new OwneyError(
+      "CHAIN_MISMATCH",
+      `Your wallet is on ${chainName(actual)}. Switch it to ${chainName(expected)} and try again.`,
+      {
+        expectedChainId: expected,
+        actualChainId: actual,
+        cause: error instanceof Error ? error.message : String(error)
+      }
+    );
+  }
+  const after = await pub.getChainId();
+  if (after !== expected) {
+    throw new OwneyError(
+      "CHAIN_MISMATCH",
+      `Your wallet is still on ${chainName(after)}. Switch it to ${chainName(expected)} and try again.`,
+      { expectedChainId: expected, actualChainId: after }
+    );
+  }
+}
+
+// src/lib/swap/swap-api.ts
+async function request(baseUrl, apiKey, path, init) {
+  const url = `${baseUrl}/api/v1/swap${path}`;
+  const res = await fetch(url, {
+    method: init?.method ?? "GET",
+    headers: {
+      "Content-Type": "application/json",
+      "x-owney-api-key": apiKey
+    },
+    ...init ? { body: JSON.stringify(init.body) } : {}
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    if (res.status === 429) {
+      throw new OwneyError(
+        "SWAP_RATE_LIMITED",
+        "Swap provider is rate limiting, retry shortly",
+        { statusCode: res.status }
+      );
+    }
+    if (res.status === 403) {
+      throw new OwneyError(
+        "SWAP_DISABLED",
+        "Swap is not enabled for this organization",
+        { statusCode: res.status }
+      );
+    }
+    throw new OwneyError(
+      "SWAP_REQUEST_FAILED",
+      `Swap API error ${res.status}: ${text}`,
+      { statusCode: res.status, responseBody: text }
+    );
+  }
+  const json = await res.json();
+  if (!json.success) {
+    throw new OwneyError(
+      "SWAP_REQUEST_FAILED",
+      `Swap API request failed: ${json.message ?? "unknown error"}`,
+      { message: json.message }
+    );
+  }
+  return json.data;
+}
+function createSwapApi(baseUrl, apiKey) {
+  return {
+    /** Source assets the user may pay with, and each chain's deposit targets. */
+    listTokens: () => request(baseUrl, apiKey, "/tokens"),
+    /**
+     * `walletAddress` is required even though the routing API could not infer
+     * it: the Fusion+ quoter binds a quote to whoever will sign the order and
+     * rejects the request without it.
+     */
+    quote: (params) => request(baseUrl, apiKey, "/quote", {
+      method: "POST",
+      body: {
+        srcChainId: params.from.chainId,
+        srcSymbol: params.from.symbol,
+        dstChainId: params.to.chainId,
+        dstSymbol: params.to.symbol,
+        amount: params.from.amount,
+        walletAddress: params.walletAddress
+      }
+    }),
+    /** Ready-to-send calldata for a same-chain swap. */
+    swapTx: (params) => request(baseUrl, apiKey, "/tx", {
+      method: "POST",
+      body: {
+        srcChainId: params.from.chainId,
+        srcSymbol: params.from.symbol,
+        dstChainId: params.to.chainId,
+        dstSymbol: params.to.symbol,
+        amount: params.from.amount,
+        walletAddress: params.walletAddress,
+        slippage: params.slippage
+      }
+    }),
+    /**
+     * Builds a Fusion+ order server-side and returns EIP-712 typed data.
+     *
+     * Only HASHES go over the wire. The preimages never leave the browser —
+     * see swap.secrets.
+     */
+    buildOrder: (params) => request(baseUrl, apiKey, "/order/build", {
+      method: "POST",
+      body: {
+        srcChainId: params.from.chainId,
+        srcSymbol: params.from.symbol,
+        dstChainId: params.to.chainId,
+        dstSymbol: params.to.symbol,
+        amount: params.from.amount,
+        walletAddress: params.walletAddress,
+        secretHashes: params.secretHashes,
+        ...params.receiver ? { receiver: params.receiver } : {}
+      }
+    }),
+    submitOrder: (body) => request(baseUrl, apiKey, "/order", { method: "POST", body }),
+    /**
+     * Only call once `readyForSecrets` reports the escrow deployed. Publishing
+     * earlier hands a resolver the preimage while the user's funds are locked
+     * and nothing has been posted on the destination chain.
+     */
+    submitSecret: (orderHash, secret) => request(baseUrl, apiKey, "/order/secret", {
+      method: "POST",
+      body: { orderHash, secret }
+    }),
+    orderStatus: (orderHash) => request(baseUrl, apiKey, `/order/${orderHash}`),
+    readyForSecrets: (orderHash) => request(
+      baseUrl,
+      apiKey,
+      `/order/${orderHash}/ready-for-secrets`
+    )
+  };
+}
+
+// src/lib/swap/swap.rpc.ts
+import { fallback, http as http2 } from "viem";
+var DEFAULT_RPC_URLS = {
+  1: ["https://cloudflare-eth.com", "https://ethereum-rpc.publicnode.com"],
+  8453: ["https://mainnet.base.org", "https://base-rpc.publicnode.com"],
+  42161: [
+    "https://arb1.arbitrum.io/rpc",
+    "https://arbitrum-one-rpc.publicnode.com"
+  ]
+};
+function swapReadTransport(chainId, overrides) {
+  const override = overrides?.[chainId];
+  if (override) return http2(override);
+  const urls = DEFAULT_RPC_URLS[chainId];
+  if (!urls || urls.length === 0) return http2();
+  return fallback(urls.map((url) => http2(url)));
+}
+function receiptTimeoutMs(chainId) {
+  return chainId === 1 ? 6e5 : 18e4;
+}
+
+// src/lib/permit2.ts
+import { bytesToHex } from "viem";
+var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var MAX_UINT256 = 2n ** 256n - 1n;
+var ERC20_ALLOWANCE_ABI = [
+  {
+    type: "function",
+    name: "allowance",
+    stateMutability: "view",
+    inputs: [
+      { name: "owner", type: "address" },
+      { name: "spender", type: "address" }
+    ],
+    outputs: [{ name: "", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "approve",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "spender", type: "address" },
+      { name: "amount", type: "uint256" }
+    ],
+    outputs: [{ name: "", type: "bool" }]
+  },
+  {
+    type: "function",
+    name: "balanceOf",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "", type: "uint256" }]
+  }
+];
+function buildPermitTransferFromTypedData(input) {
+  return {
+    domain: {
+      name: "Permit2",
+      chainId: input.chainId,
+      verifyingContract: PERMIT2_ADDRESS
+    },
+    types: {
+      PermitTransferFrom: [
+        { name: "permitted", type: "TokenPermissions" },
+        { name: "spender", type: "address" },
+        { name: "nonce", type: "uint256" },
+        { name: "deadline", type: "uint256" }
+      ],
+      TokenPermissions: [
+        { name: "token", type: "address" },
+        { name: "amount", type: "uint256" }
+      ]
+    },
+    primaryType: "PermitTransferFrom",
+    message: input.message
+  };
+}
+function randomPermit2Nonce() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return BigInt(bytesToHex(bytes));
+}
+async function readPermit2Allowance(publicClient, token, owner) {
+  return publicClient.readContract({
+    address: token,
+    abi: ERC20_ALLOWANCE_ABI,
+    functionName: "allowance",
+    args: [owner, PERMIT2_ADDRESS]
+  });
+}
+async function readErc20Balance(publicClient, token, owner) {
+  return publicClient.readContract({
+    address: token,
+    abi: ERC20_ALLOWANCE_ABI,
+    functionName: "balanceOf",
+    args: [owner]
+  });
+}
+
+// src/lib/swap/swap.secrets.ts
+import { keccak256, toHex } from "viem";
+var SECRET_BYTES = 32;
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  const cryptoObj = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!cryptoObj?.getRandomValues) {
+    throw new Error(
+      "[owney-sdk] Secure randomness is unavailable, so a swap secret cannot be generated safely."
+    );
+  }
+  cryptoObj.getRandomValues(bytes);
+  return bytes;
+}
+function mintSecrets(count) {
+  if (!Number.isInteger(count) || count < 1) {
+    throw new Error(
+      `[owney-sdk] A swap needs at least one secret, got ${String(count)}.`
+    );
+  }
+  const secrets = [];
+  const secretHashes = [];
+  for (let i = 0; i < count; i++) {
+    const secret = toHex(randomBytes(SECRET_BYTES));
+    secrets.push(secret);
+    secretHashes.push(keccak256(secret));
+  }
+  return { secrets, secretHashes };
+}
+
+// src/lib/swap/swap.types.ts
+var SWAP_TERMINAL_STATUSES = [
+  "executed",
+  "expired",
+  "cancelled",
+  "refunded"
+];
+var isSwapTerminal = (status) => SWAP_TERMINAL_STATUSES.includes(status);
+
+// src/lib/swap/swap.order-runner.ts
+var DEFAULT_POLL_MS = 5e3;
+var MAX_BACKOFF_MS = 3e4;
+var backoffFor = (failures, base3) => Math.min(base3 * 2 ** Math.min(failures, 5), MAX_BACKOFF_MS);
+var DEFAULT_TIMEOUT_MS = 15 * 60 * 1e3;
+async function runFusionOrder(deps, options) {
+  const {
+    orderHash,
+    secrets,
+    onStage,
+    pollIntervalMs = DEFAULT_POLL_MS,
+    timeoutMs = DEFAULT_TIMEOUT_MS
+  } = options;
+  const deadline = deps.now() + timeoutMs;
+  let failures = 0;
+  const published = /* @__PURE__ */ new Set();
+  onStage?.("swapping");
+  for (; ; ) {
+    if (deps.now() >= deadline) {
+      throw new OwneyError(
+        "SWAP_REQUEST_FAILED",
+        "Timed out waiting for the swap to settle. It may still complete \u2014 check the order status before retrying.",
+        { orderHash }
+      );
+    }
+    let ready;
+    try {
+      ready = await deps.readyForSecrets(orderHash);
+    } catch {
+      ready = {};
+    }
+    for (const fill of ready.fills ?? []) {
+      if (published.has(fill.idx)) continue;
+      const secret = secrets[fill.idx];
+      if (secret === void 0) {
+        throw new OwneyError(
+          "SWAP_REQUEST_FAILED",
+          `Swap needs a secret for fill ${fill.idx} that this session does not have. The order will refund once its timelock expires.`,
+          { orderHash, fillIndex: fill.idx }
+        );
+      }
+      try {
+        await deps.submitSecret(orderHash, secret);
+        published.add(fill.idx);
+      } catch {
+        failures += 1;
+      }
+    }
+    let status;
+    try {
+      ({ status } = await deps.orderStatus(orderHash));
+      failures = 0;
+    } catch {
+      failures += 1;
+      await deps.sleep(backoffFor(failures, pollIntervalMs));
+      continue;
+    }
+    if (status === "refunding") onStage?.("refunding");
+    if (isSwapTerminal(status)) {
+      if (status === "executed") {
+        onStage?.("swapped");
+        return { status, filled: true };
+      }
+      if (status === "refunded") onStage?.("refunded");
+      throw new OwneyError(
+        status === "refunded" ? "SWAP_ORDER_REFUNDED" : status === "cancelled" ? "SWAP_ORDER_CANCELLED" : "SWAP_ORDER_EXPIRED",
+        status === "refunded" ? "The swap did not complete and your funds have been returned." : "The swap did not complete in time. Your funds will be returned once the timelock expires.",
+        { orderHash, status }
+      );
+    }
+    await deps.sleep(pollIntervalMs);
+  }
+}
+
+// src/lib/swap/swap.secret-store.ts
+var KEY_PREFIX2 = "owney.swap.order";
+var MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var storage2 = () => {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.localStorage;
+  } catch {
+    return null;
+  }
+};
+var keyFor = (orderHash) => `${KEY_PREFIX2}.${orderHash}`;
+function saveOrder(order) {
+  const store = storage2();
+  if (!store) return;
+  try {
+    store.setItem(keyFor(order.orderHash), JSON.stringify(order));
+  } catch {
+  }
+}
+function clearOrder(orderHash) {
+  const store = storage2();
+  if (!store) return;
+  try {
+    store.removeItem(keyFor(orderHash));
+  } catch {
+  }
+}
+function listOrders(now = Date.now()) {
+  const store = storage2();
+  if (!store) return [];
+  const out = [];
+  try {
+    const keys = [];
+    for (let i = 0; i < store.length; i++) {
+      const key2 = store.key(i);
+      if (key2?.startsWith(`${KEY_PREFIX2}.`)) keys.push(key2);
+    }
+    for (const key2 of keys) {
+      const raw = store.getItem(key2);
+      if (!raw) continue;
+      try {
+        const parsed = JSON.parse(raw);
+        if (now - parsed.createdAt > MAX_AGE_MS) {
+          store.removeItem(key2);
+          continue;
+        }
+        if (Array.isArray(parsed.secrets) && parsed.secrets.length > 0) {
+          out.push(parsed);
+        }
+      } catch {
+        store.removeItem(key2);
+      }
+    }
+  } catch {
+    return out;
+  }
+  return out.sort((a, b) => b.createdAt - a.createdAt);
+}
+
+// src/lib/swap/swap.executor.ts
+var DEFAULT_SLIPPAGE = 1;
+async function affordableAmount(deps, quoted) {
+  const balance = await deps.readSourceBalance();
+  if (balance >= quoted) return quoted;
+  debugLog("owney-sdk", "swap: trimming to the current source balance", {
+    quoted: quoted.toString(),
+    balance: balance.toString(),
+    short: (quoted - balance).toString()
+  });
+  return balance;
+}
+async function executeSwap(deps, options) {
+  const { quote, walletAddress, onStage } = options;
+  debugLog("owney-sdk", "swap: start", {
+    rail: quote.rail,
+    from: `${quote.src.amount} ${quote.src.symbol} on ${quote.src.chainId}`,
+    to: `${quote.dst.symbol} on ${quote.dst.chainId}`,
+    expected: quote.dst.amount,
+    floor: quote.dstAmountMin
+  });
+  const before = await deps.readTargetBalance();
+  debugLog("owney-sdk", "swap: target balance before", before.toString());
+  const result = quote.rail === "classic" ? await runClassic(deps, options) : await runFusion(deps, options, walletAddress);
+  const after = await deps.readTargetBalance();
+  const received = after - before;
+  debugLog("owney-sdk", "swap: target balance after", {
+    after: after.toString(),
+    received: received.toString()
+  });
+  if (received <= 0n) {
+    throw new OwneyError(
+      "SWAP_REQUEST_FAILED",
+      "The swap completed but no funds arrived in the wallet. Check the transaction before retrying.",
+      { rail: quote.rail, ...result }
     );
-    return mapApyByStrategy(raw);
   }
-};
+  return { received: received.toString(), ...result };
+}
+async function runClassic(deps, options) {
+  const {
+    quote,
+    walletAddress,
+    slippage = DEFAULT_SLIPPAGE,
+    onStage
+  } = options;
+  const isNativeSource = quote.src.address.toLowerCase().startsWith("0xeeee");
+  const amount = isNativeSource ? BigInt(quote.src.amount) : await affordableAmount(deps, BigInt(quote.src.amount));
+  onStage?.("quoting");
+  debugLog("owney-sdk", "swap: fetching classic calldata");
+  const { tx } = await deps.api.swapTx({
+    from: {
+      chainId: quote.src.chainId,
+      symbol: quote.src.symbol,
+      amount: amount.toString()
+    },
+    to: { chainId: quote.dst.chainId, symbol: quote.dst.symbol },
+    walletAddress,
+    slippage
+  });
+  const isNative = BigInt(tx.value ?? "0") > 0n;
+  if (!isNative) {
+    const needed = amount;
+    const current = await deps.readAllowance(tx.to);
+    debugLog("owney-sdk", "swap: allowance", {
+      spender: tx.to,
+      current: current.toString(),
+      needed: needed.toString()
+    });
+    if (current < needed) {
+      onStage?.("approving");
+      await deps.ensureChain(quote.src.chainId);
+      await deps.approve(tx.to, MAX_UINT256);
+    }
+  }
+  onStage?.("signing");
+  await deps.ensureChain(quote.src.chainId);
+  debugLog("owney-sdk", "swap: sending classic swap tx", { to: tx.to });
+  const txHash = await deps.sendTransaction({
+    to: tx.to,
+    data: tx.data,
+    value: tx.value ?? "0"
+  });
+  onStage?.("swapped");
+  return { txHash };
+}
+async function runFusion(deps, options, walletAddress) {
+  const { quote, onStage } = options;
+  const isNativeSource = quote.src.address.toLowerCase().startsWith("0xeeee");
+  const amount = isNativeSource ? BigInt(quote.src.amount) : await affordableAmount(deps, BigInt(quote.src.amount));
+  if (quote.spender && !isNativeSource) {
+    const needed = amount;
+    const current = await deps.readAllowance(quote.spender);
+    debugLog("owney-sdk", "swap: fusion allowance", {
+      spender: quote.spender,
+      current: current.toString(),
+      needed: needed.toString()
+    });
+    if (current < needed) {
+      onStage?.("approving");
+      await deps.ensureChain(quote.src.chainId);
+      await deps.approve(quote.spender, MAX_UINT256);
+      debugLog("owney-sdk", "swap: approved limit order protocol");
+    }
+  }
+  const { secrets, secretHashes } = mintSecrets(quote.secretsCount ?? 1);
+  onStage?.("quoting");
+  debugLog("owney-sdk", "swap: building fusion order", {
+    secrets: secretHashes.length
+  });
+  const built = await deps.api.buildOrder({
+    from: {
+      chainId: quote.src.chainId,
+      symbol: quote.src.symbol,
+      // The trimmed amount — the order is re-quoted at this size server-side.
+      amount: amount.toString()
+    },
+    to: { chainId: quote.dst.chainId, symbol: quote.dst.symbol },
+    walletAddress,
+    secretHashes
+  });
+  saveOrder({
+    orderHash: built.orderHash,
+    secrets,
+    srcChainId: quote.src.chainId,
+    srcSymbol: quote.src.symbol,
+    dstChainId: quote.dst.chainId,
+    dstSymbol: quote.dst.symbol,
+    amount: amount.toString(),
+    createdAt: Date.now()
+  });
+  debugLog("owney-sdk", "swap: order built", { orderHash: built.orderHash });
+  onStage?.("signing");
+  await deps.ensureChain(quote.src.chainId);
+  debugLog("owney-sdk", "swap: awaiting signature in wallet", {
+    signingOnChain: quote.src.chainId
+  });
+  const signature = await deps.signTypedData(built.typedData);
+  debugLog("owney-sdk", "swap: signed, submitting to relayer");
+  await deps.api.submitOrder({
+    srcChainId: quote.src.chainId,
+    // The ORDER STRUCT, not the typed-data envelope we just signed. Sending
+    // the envelope here gets a bare 500 from the relayer.
+    order: built.order,
+    signature,
+    quoteId: built.quoteId,
+    // Single-fill orders must NOT carry secretHashes — the relayer rejects
+    // them with SECRET_HASHES_NOT_REQUIRED. The one hash is already inside the
+    // order's hashlock, so repeating it here is redundant, and only a
+    // multi-fill order (a Merkle tree of hashes) needs them listed.
+    ...secretHashes.length > 1 ? { secretHashes } : {},
+    ...built.extension ? { extension: built.extension } : {}
+  });
+  debugLog("owney-sdk", "swap: order submitted, polling escrows");
+  try {
+    await runFusionOrder(deps.runner, {
+      orderHash: built.orderHash,
+      secrets,
+      ...onStage ? { onStage } : {}
+    });
+  } catch (error) {
+    if (error instanceof OwneyError && (error.code === "SWAP_ORDER_REFUNDED" || error.code === "SWAP_ORDER_CANCELLED")) {
+      clearOrder(built.orderHash);
+    }
+    throw error;
+  }
+  clearOrder(built.orderHash);
+  return { orderHash: built.orderHash };
+}
 
 // src/lib/health-report.ts
-var ROUTING_API_BASE_URL = "https://owney-routing-api-243946518160.europe-west4.run.app";
-async function reportAgentFailure(apiKey, agentType, errorCode, baseUrl = ROUTING_API_BASE_URL) {
+var ROUTING_API_BASE_URL2 = "https://owney-routing-api-243946518160.europe-west4.run.app";
+async function reportAgentFailure(apiKey, agentType, errorCode, baseUrl = ROUTING_API_BASE_URL2) {
   try {
     await fetch(`${baseUrl}/api/v1/agent/health-report`, {
       method: "POST",
@@ -2044,10 +2714,11 @@ async function withFailureReporting(apiKey, agentType, fn, baseUrl) {
 // src/lib/helpers/withdraw-helper.ts
 import { parseUnits } from "viem";
 function projectAgentBalancesForAsset(agents, aggregated, chainId, asset, decimals) {
+  const target = asset.toUpperCase();
   return agents.map((agent) => {
     const agentBalance = aggregated[agent.id];
     const tokenBalance = agentBalance?.tokens.find(
-      (t) => t.chainId === chainId && isSameAsset(t.asset, asset)
+      (t) => t.chainId === chainId && t.asset.toUpperCase() === target
     );
     if (!tokenBalance) return { agent, balance: 0n };
     return { agent, balance: parseUnits(tokenBalance.amount, decimals) };
@@ -2200,14 +2871,51 @@ function aggregateApyByChainAndAsset(agentApys, agentBalances) {
 import {
   createPublicClient as createPublicClient2,
   createWalletClient,
-  custom
+  custom,
+  erc20Abi as erc20Abi2
 } from "viem";
 import { base as base2, arbitrum as arbitrum2, mainnet as mainnet2 } from "viem/chains";
 
+// src/lib/transfer-auth.ts
+import { bytesToHex as bytesToHex2 } from "viem";
+var ERC20_META_ABI = [
+  { type: "function", name: "name", stateMutability: "view", inputs: [], outputs: [{ name: "", type: "string" }] },
+  { type: "function", name: "version", stateMutability: "view", inputs: [], outputs: [{ name: "", type: "string" }] }
+];
+function buildTransferWithAuthorizationTypedData(input) {
+  return {
+    domain: { name: input.tokenName, version: input.tokenVersion, chainId: input.chainId, verifyingContract: input.token },
+    types: {
+      TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" }
+      ]
+    },
+    primaryType: "TransferWithAuthorization",
+    message: input.message
+  };
+}
+async function readTokenMeta(publicClient, token) {
+  const [tokenName, tokenVersion] = await Promise.all([
+    publicClient.readContract({ address: token, abi: ERC20_META_ABI, functionName: "name" }),
+    publicClient.readContract({ address: token, abi: ERC20_META_ABI, functionName: "version" }).catch(() => "2")
+  ]);
+  return { tokenName, tokenVersion };
+}
+function randomAuthNonce() {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytesToHex2(bytes);
+}
+
 // src/lib/sponsor-client.ts
-var ROUTING_API_BASE_URL2 = "https://owney-routing-api-243946518160.europe-west4.run.app";
+var ROUTING_API_BASE_URL3 = "https://owney-routing-api-243946518160.europe-west4.run.app";
 async function postSponsorTransferAuth(input) {
-  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL2;
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
   let res;
   try {
     res = await fetch(`${base3}/api/v1/sponsor/erc20-transfer-auth`, {
@@ -2247,7 +2955,7 @@ async function postSponsorTransferAuth(input) {
   return parsed.data;
 }
 async function postSponsorPermit2Transfer(input) {
-  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL2;
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
   let res;
   try {
     res = await fetch(`${base3}/api/v1/sponsor/permit2-transfer`, {
@@ -2285,7 +2993,7 @@ async function postSponsorPermit2Transfer(input) {
   return parsed.data;
 }
 async function getSponsorRelayerAddress(input) {
-  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL2;
+  const base3 = input.baseUrl ?? ROUTING_API_BASE_URL3;
   let res;
   try {
     res = await fetch(
@@ -2321,119 +3029,6 @@ async function getSponsorRelayerAddress(input) {
   return parsed.data.relayer;
 }
 
-// src/lib/permit2.ts
-import { bytesToHex } from "viem";
-var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
-var MAX_UINT256 = 2n ** 256n - 1n;
-var ERC20_ALLOWANCE_ABI = [
-  {
-    type: "function",
-    name: "allowance",
-    stateMutability: "view",
-    inputs: [
-      { name: "owner", type: "address" },
-      { name: "spender", type: "address" }
-    ],
-    outputs: [{ name: "", type: "uint256" }]
-  },
-  {
-    type: "function",
-    name: "approve",
-    stateMutability: "nonpayable",
-    inputs: [
-      { name: "spender", type: "address" },
-      { name: "amount", type: "uint256" }
-    ],
-    outputs: [{ name: "", type: "bool" }]
-  },
-  {
-    type: "function",
-    name: "balanceOf",
-    stateMutability: "view",
-    inputs: [{ name: "account", type: "address" }],
-    outputs: [{ name: "", type: "uint256" }]
-  }
-];
-function buildPermitTransferFromTypedData(input) {
-  return {
-    domain: {
-      name: "Permit2",
-      chainId: input.chainId,
-      verifyingContract: PERMIT2_ADDRESS
-    },
-    types: {
-      PermitTransferFrom: [
-        { name: "permitted", type: "TokenPermissions" },
-        { name: "spender", type: "address" },
-        { name: "nonce", type: "uint256" },
-        { name: "deadline", type: "uint256" }
-      ],
-      TokenPermissions: [
-        { name: "token", type: "address" },
-        { name: "amount", type: "uint256" }
-      ]
-    },
-    primaryType: "PermitTransferFrom",
-    message: input.message
-  };
-}
-function randomPermit2Nonce() {
-  const bytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(bytes);
-  return BigInt(bytesToHex(bytes));
-}
-async function readPermit2Allowance(publicClient, token, owner) {
-  return publicClient.readContract({
-    address: token,
-    abi: ERC20_ALLOWANCE_ABI,
-    functionName: "allowance",
-    args: [owner, PERMIT2_ADDRESS]
-  });
-}
-async function readErc20Balance(publicClient, token, owner) {
-  return publicClient.readContract({
-    address: token,
-    abi: ERC20_ALLOWANCE_ABI,
-    functionName: "balanceOf",
-    args: [owner]
-  });
-}
-
-// src/lib/chain-guard.ts
-var CHAIN_NAMES = {
-  1: "Ethereum",
-  8453: "Base",
-  42161: "Arbitrum"
-};
-function chainName(chainId) {
-  return CHAIN_NAMES[chainId] ?? `chain ${chainId}`;
-}
-async function ensureWalletOnChain(pub, wallet, expected) {
-  const actual = await pub.getChainId();
-  if (actual === expected) return;
-  try {
-    await wallet.switchChain({ id: expected });
-  } catch (error) {
-    throw new OwneyError(
-      "CHAIN_MISMATCH",
-      `Your wallet is on ${chainName(actual)}. Switch it to ${chainName(expected)} and try again.`,
-      {
-        expectedChainId: expected,
-        actualChainId: actual,
-        cause: error instanceof Error ? error.message : String(error)
-      }
-    );
-  }
-  const after = await pub.getChainId();
-  if (after !== expected) {
-    throw new OwneyError(
-      "CHAIN_MISMATCH",
-      `Your wallet is still on ${chainName(after)}. Switch it to ${chainName(expected)} and try again.`,
-      { expectedChainId: expected, actualChainId: after }
-    );
-  }
-}
-
 // src/lib/sponsored-deposit.ts
 var AUTH_WINDOW_SECONDS = 15 * 60;
 function makeSponsoredDepositCallback(deps) {
@@ -2596,7 +3191,7 @@ function makeSponsoredWethCallback(deps) {
 }
 
 // src/lib/sponsored-calls-deposit.ts
-import { encodeFunctionData, erc20Abi, toHex } from "viem";
+import { encodeFunctionData, erc20Abi, toHex as toHex2 } from "viem";
 var DEFAULT_POLL_INTERVAL_MS = 1500;
 var DEFAULT_MAX_POLLS = 30;
 async function paymasterSupported(provider, owner, chainId) {
@@ -2604,7 +3199,7 @@ async function paymasterSupported(provider, owner, chainId) {
     method: "wallet_getCapabilities",
     params: [owner]
   });
-  const forChain = caps?.[toHex(chainId)] ?? caps?.[String(chainId)];
+  const forChain = caps?.[toHex2(chainId)] ?? caps?.[String(chainId)];
   return Boolean(forChain?.paymasterService?.supported);
 }
 function makeSponsoredCallsCallback(deps) {
@@ -2649,7 +3244,7 @@ function makeSponsoredCallsCallback(deps) {
         {
           version: "2.0.0",
           from: deps.ownerAddress,
-          chainId: toHex(chainId),
+          chainId: toHex2(chainId),
           atomicRequired: false,
           calls: [{ to: token, value: "0x0", data }],
           capabilities: {
@@ -2725,7 +3320,6 @@ var SPONSORED_WETH_BY_CHAIN = {
 function shouldFallbackToUserPaid(error, asset, appCallback) {
   return (asset === "WETH" || asset === "USDC") && appCallback === void 0 && error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED" && error.details?.safeToFallback === true;
 }
-var AGENT_ELIGIBILITY_ORDER = ["surfliquid", "zyfai"];
 var OwneySDK = class {
   agents = /* @__PURE__ */ new Map();
   activeAgents = /* @__PURE__ */ new Set();
@@ -3009,7 +3603,7 @@ var OwneySDK = class {
         );
         this.disabledAgents.clear();
         for (const { key: key2, agent_type, is_enabled } of agentKeys) {
-          const agent = await this.createAgent(agent_type, key2);
+          const agent = this.createAgent(agent_type, key2);
           if (!agent) continue;
           this.agents.set(agent_type, agent);
           if (is_enabled === false) {
@@ -3030,18 +3624,10 @@ var OwneySDK = class {
       this.initializingAgentsPromise = null;
     }
   }
-  async createAgent(agentId, key2) {
+  createAgent(agentId, key2) {
     if (agentId === "zyfai") {
       return new ZyfaiAgent(key2, this.zyfaiRpcUrls, this.referralSource);
     }
-    if (agentId === "surfliquid") {
-      if (!key2) return null;
-      const { SurfLiquidAgent } = await import("./surfliquid.agent-XDJ672GM.js");
-      return new SurfLiquidAgent({
-        apiKey: this.apiKey,
-        routingApiBaseUrl: this.routingApiBaseUrl
-      });
-    }
     return null;
   }
   /**
@@ -3439,14 +4025,15 @@ var OwneySDK = class {
   async hasExistingBalance(agent, state, chainId, asset, requireReliableRead = false) {
     try {
       const balance = await agent.getBalances(state, chainId);
+      const target = asset.toLowerCase();
       const token = balance.tokens.find(
-        (t) => t.chainId === chainId && isSameAsset(t.asset, asset)
+        (t) => t.chainId === chainId && t.asset.toLowerCase() === target
       );
       const targetChainName = agent.supportedAssets.find((entry) => entry.chainId === chainId)?.chain?.trim().toUpperCase();
       const position = (balance.positions ?? []).find((p) => {
         const positionChain = p.chain.trim().toUpperCase();
         const matchesChain = positionChain === String(chainId) || targetChainName !== void 0 && positionChain === targetChainName;
-        return matchesChain && isSameAsset(p.asset, asset) && Number(p.amount) > 0;
+        return matchesChain && p.asset.toLowerCase() === target && Number(p.amount) > 0;
       });
       return !!token && Number(token.amount) > 0 || !!position;
     } catch (error) {
@@ -3493,35 +4080,212 @@ var OwneySDK = class {
     }
     return eligible;
   }
+  // --- Fund operations ---
+  // --- Swap to yield (ROUT-242) ---
+  /** Lazily built so an app that never swaps pays nothing for it. */
+  swapApiClient;
+  swapApi() {
+    this.swapApiClient ??= createSwapApi(
+      this.routingApiBaseUrl ?? ROUTING_API_BASE_URL,
+      this.apiKey
+    );
+    return this.swapApiClient;
+  }
   /**
-   * Agent ids the routing API provisioned for this org that support the given
-   * chain + asset, ordered by preference ({@link AGENT_ELIGIBILITY_ORDER},
-   * surfliquid first). Returns `[]` when the org has no compatible agent — never
-   * throws on an empty org. Loads agent keys on first call (apiKey only, no
-   * wallet), so the UI can resolve which agent to use before the user connects.
+   * Put the wallet on `chainId`, or fail with something actionable.
    *
-   * This is the source of truth for agent availability: an agent appears here
-   * iff the routing API returned its key. No per-app feature flags.
+   * Reuses the same guard the deposit rail uses, which re-reads the chain after
+   * switching — some wallets resolve wallet_switchEthereumChain before the
+   * network has actually changed.
    */
-  async getEligibleAgentIds(chainId, asset) {
-    try {
-      await this.ensureAgentsInitialized();
-    } catch (error) {
-      if (error instanceof OwneyError && error.code === "API_NO_AGENTS") {
-        return [];
-      }
-      throw error;
-    }
-    return [...this.agents.values()].filter((agent) => {
-      const chainAssets = agent.supportedAssets.find(
-        (sa) => sa.chainId === chainId
+  async ensureSwapChain(chainId) {
+    const provider = this.requireConnectedProvider();
+    const state = this.requireState();
+    const chain = VIEM_CHAIN2[chainId];
+    if (!chain) {
+      throw new OwneyError(
+        "CHAIN_UNSUPPORTED",
+        `Chain ${chainId} is not supported`,
+        { chainId }
       );
-      return chainAssets?.assets.some((a) => a.symbol === asset) ?? false;
-    }).map((agent) => agent.id).sort(
-      (a, b) => AGENT_ELIGIBILITY_ORDER.indexOf(a) - AGENT_ELIGIBILITY_ORDER.indexOf(b)
+    }
+    await ensureWalletOnChain(
+      createPublicClient2({ chain, transport: custom(provider) }),
+      createWalletClient({
+        account: state.walletAddress,
+        chain,
+        transport: custom(provider)
+      }),
+      chainId
     );
   }
-  // --- Fund operations ---
+  /**
+   * Binds the executor's abstract deps to this client's wallet.
+   *
+   * Kept as a builder rather than baked into the executor so the whole swap
+   * flow stays testable without a provider — the executor never imports viem.
+   */
+  buildSwapDeps(quote) {
+    const state = this.requireState();
+    const provider = this.requireConnectedProvider();
+    const srcChain = VIEM_CHAIN2[quote.src.chainId];
+    const dstChain = VIEM_CHAIN2[quote.dst.chainId];
+    const wallet = createWalletClient({
+      account: state.walletAddress,
+      chain: srcChain,
+      transport: custom(provider)
+    });
+    const srcPublic = createPublicClient2({
+      chain: srcChain,
+      transport: swapReadTransport(quote.src.chainId, this.zyfaiRpcUrls)
+    });
+    const dstPublic = createPublicClient2({
+      chain: dstChain,
+      transport: swapReadTransport(quote.dst.chainId, this.zyfaiRpcUrls)
+    });
+    return {
+      api: this.swapApi(),
+      readTargetBalance: () => dstPublic.readContract({
+        address: quote.dst.address,
+        abi: erc20Abi2,
+        functionName: "balanceOf",
+        args: [state.walletAddress]
+      }),
+      sendTransaction: async (tx) => {
+        const hash = await wallet.sendTransaction({
+          to: tx.to,
+          data: tx.data,
+          value: BigInt(tx.value || "0"),
+          account: state.walletAddress,
+          chain: srcChain
+        });
+        const receipt = await srcPublic.waitForTransactionReceipt({
+          timeout: receiptTimeoutMs(quote.src.chainId),
+          hash,
+          confirmations: 1
+        });
+        if (receipt.status !== "success") {
+          throw new OwneyError(
+            "SWAP_REQUEST_FAILED",
+            `Swap transaction reverted (tx ${hash})`,
+            { hash }
+          );
+        }
+        return hash;
+      },
+      signTypedData: (typedData) => wallet.signTypedData({
+        account: state.walletAddress,
+        ...typedData
+      }),
+      // Chain-bound like every other read here: the wallet provider's chain is
+      // not ours to rely on mid-swap.
+      readSourceBalance: async () => {
+        const src = quote.src.address;
+        if (src.toLowerCase().startsWith("0xeeee")) {
+          return srcPublic.getBalance({ address: state.walletAddress });
+        }
+        return srcPublic.readContract({
+          address: src,
+          abi: ERC20_ALLOWANCE_ABI,
+          functionName: "balanceOf",
+          args: [state.walletAddress]
+        });
+      },
+      readAllowance: (spender) => srcPublic.readContract({
+        address: quote.src.address,
+        abi: ERC20_ALLOWANCE_ABI,
+        functionName: "allowance",
+        args: [state.walletAddress, spender]
+      }),
+      approve: async (spender, amount) => {
+        const hash = await wallet.writeContract({
+          address: quote.src.address,
+          abi: ERC20_ALLOWANCE_ABI,
+          functionName: "approve",
+          args: [spender, amount],
+          account: state.walletAddress,
+          chain: srcChain
+        });
+        await srcPublic.waitForTransactionReceipt({
+          hash,
+          confirmations: 1,
+          timeout: receiptTimeoutMs(quote.src.chainId)
+        });
+        return hash;
+      },
+      ensureChain: (chainId) => this.ensureSwapChain(chainId),
+      runner: {
+        readyForSecrets: (h) => this.swapApi().readyForSecrets(h),
+        submitSecret: (h, secret) => this.swapApi().submitSecret(h, secret),
+        orderStatus: (h) => this.swapApi().orderStatus(h),
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        now: () => Date.now()
+      }
+    };
+  }
+  /**
+   * Assets the user may pay with, and what each chain deposits into.
+   *
+   * The source list is deliberately wider than the deposit list: it includes
+   * native ETH and USDT, which Owney never holds but users often do.
+   */
+  async getSwapTokens() {
+    return this.swapApi().listTokens();
+  }
+  /**
+   * Price a swap without committing to it.
+   *
+   * `dstAmountMin` is the number to validate against a deposit minimum —
+   * `dst.amount` is an estimate that a decaying auction or slippage can undercut,
+   * and a swap landing below the floor leaves the user swapped but not
+   * deposited.
+   */
+  async getSwapQuote(params) {
+    const state = this.requireState();
+    return this.swapApi().quote({ ...params, walletAddress: state.walletAddress });
+  }
+  /**
+   * Swap an asset the user holds into a deposit asset, then deposit it.
+   *
+   * Kept separate from `deposit()` rather than bolted on as an option: the
+   * return shape differs, the staging callback is meaningless on the plain
+   * path, and integrators who never swap should not have to reason about any
+   * of it.
+   *
+   * The deposit runs on the MEASURED arrival, not the quote. A quote is an
+   * estimate, so depositing the quoted figure would either strand dust or try
+   * to move funds that never came.
+   *
+   * Failure modes differ in a way callers must respect. A same-chain swap is
+   * atomic — if it fails, nothing moved. A cross-chain swap escrows the user's
+   * funds first, so SWAP_ORDER_EXPIRED / REFUNDED / CANCELLED all mean the
+   * money left the wallet. Only the former can honestly say "nothing has left
+   * your wallet".
+   */
+  async swapAndDeposit(options) {
+    const state = this.requireState();
+    const api = this.swapApi();
+    const quote = await api.quote({
+      from: options.from,
+      to: options.to,
+      walletAddress: state.walletAddress
+    });
+    await this.ensureSwapChain(quote.src.chainId);
+    const swap = await executeSwap(this.buildSwapDeps(quote), {
+      quote,
+      walletAddress: state.walletAddress,
+      ...options.slippage === void 0 ? {} : { slippage: options.slippage },
+      ...options.onSwapProgress ? { onStage: options.onSwapProgress } : {}
+    });
+    options.onSwapProgress?.("depositing");
+    await this.ensureSwapChain(quote.dst.chainId);
+    const deposit = await this.deposit({
+      amount: swap.received,
+      asset: options.to.symbol,
+      ...options.agentId ? { agentId: options.agentId } : {}
+    });
+    return { swap, deposit };
+  }
   /**
    * Withdraw funds from a specific agent, or all agents that support the active chain+asset if agentId is omitted.
    * Validates that the asset is supported by the target agent(s) on the active chain.
@@ -3557,19 +4321,9 @@ var OwneySDK = class {
     }
     const eligibleAgents = this.getEligibleAgents(chainId, asset);
     if (!amount) {
-      const aggregated2 = await this.getBalances();
-      const funded = projectAgentBalancesForAsset(
-        eligibleAgents,
-        aggregated2.agentBalances,
-        chainId,
-        asset,
-        assetInfo.decimals
-      ).filter(
-        ({ agent, balance }) => balance > 0n || aggregated2.agentErrors?.[agent.id] !== void 0
-      ).map(({ agent }) => agent);
       const results2 = {};
       const agentErrors2 = {};
-      for (const agent of funded) {
+      for (const agent of eligibleAgents) {
         try {
           results2[agent.id] = await agent.withdraw(state, chainId, token);
         } catch (err) {
@@ -4158,8 +4912,8 @@ import { SiweMessage } from "siwe";
 import { ZyfaiSDK as ZyfaiSDK2 } from "@zyfai/sdk";
 
 // src/agents/zyfai/zyfai.siwx-cache.ts
-var KEY_PREFIX2 = "owney.siwx.session";
-var storage2 = () => {
+var KEY_PREFIX3 = "owney.siwx.session";
+var storage3 = () => {
   if (typeof window === "undefined") return null;
   try {
     return window.localStorage;
@@ -4167,8 +4921,8 @@ var storage2 = () => {
     return null;
   }
 };
-var buildKey2 = (address) => `${KEY_PREFIX2}:${address.toLowerCase()}`;
-var legacyKeyPrefix2 = (address) => `${KEY_PREFIX2}:${address.toLowerCase()}:`;
+var buildKey2 = (address) => `${KEY_PREFIX3}:${address.toLowerCase()}`;
+var legacyKeyPrefix2 = (address) => `${KEY_PREFIX3}:${address.toLowerCase()}:`;
 var memorySiwxSessions = /* @__PURE__ */ new Map();
 var readLegacySiwxSession = (store, address) => {
   if (!store) return null;
@@ -4200,7 +4954,7 @@ var readLegacySiwxSession = (store, address) => {
 var readSiwxSession = (address, chainId) => {
   if (typeof window === "undefined") return null;
   const key2 = buildKey2(address);
-  const store = storage2();
+  const store = storage3();
   let raw = null;
   try {
     raw = store?.getItem(key2) ?? null;
@@ -4230,7 +4984,7 @@ var writeSiwxSession = (address, _chainId, session) => {
   if (typeof window === "undefined") return;
   const key2 = buildKey2(address);
   memorySiwxSessions.set(key2, session);
-  const store = storage2();
+  const store = storage3();
   try {
     store?.setItem(key2, JSON.stringify(session));
   } catch {
@@ -4239,7 +4993,7 @@ var writeSiwxSession = (address, _chainId, session) => {
 var clearSiwxSession = (address, _chainId) => {
   const key2 = buildKey2(address);
   memorySiwxSessions.delete(key2);
-  const store = storage2();
+  const store = storage3();
   try {
     store?.removeItem(key2);
   } catch {
@@ -4358,9 +5112,9 @@ function buildSIWXConfig(deps) {
 }
 function createOwneySIWX(config) {
   const zyfai = new ZyfaiSDK2({ apiKey: config.apiKey });
-  const http2 = zyfai.httpClient;
+  const http4 = zyfai.httpClient;
   return buildSIWXConfig({
-    post: (url, data) => http2.post(url, data),
+    post: (url, data) => http4.post(url, data),
     referralSource: config.referralSource
   });
 }
@@ -4372,5 +5126,6 @@ export {
   OwneyError,
   OwneySDK,
   createOwneySIWX,
+  listOrders as listPendingSwaps,
   setOwneyDebug
 };