@owney/sdk 0.7.25-beta.1 → 0.7.25-beta.10

package/dist/index.js

@@ -125,6 +125,34 @@ function rateLimitDelay(error, now = Date.now()) {
 }
 
 // src/lib/agent-reads.ts
+function rateLimitDiagnostics(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let details = {};
+  function visit(value, depth = 0) {
+    if (depth > 6 || !value || typeof value !== "object" || seen.has(value))
+      return;
+    seen.add(value);
+    const record = value;
+    for (const key2 of [
+      "rpcSource",
+      "chainId",
+      "rpcMethod",
+      "providerRequestId",
+      "statusCode"
+    ]) {
+      const candidate = record[key2];
+      if (candidate !== void 0 && details[key2] === void 0)
+        details = { ...details, [key2]: candidate };
+    }
+    for (const key2 of ["details", "cause", "response", "fields", "error"])
+      visit(record[key2], depth + 1);
+  }
+  visit(error);
+  return {
+    rpcSource: details.rpcSource ?? "agent-api",
+    ...details
+  };
+}
 var AgentReads = class {
   inFlight = /* @__PURE__ */ new Map();
   cooldowns = /* @__PURE__ */ new Map();
@@ -132,14 +160,15 @@ var AgentReads = class {
   clearInFlight() {
     this.inFlight.clear();
   }
-  limited(agentId, until) {
+  limited(agentId, until, diagnostics) {
     return new OwneyError(
       "AGENT_RATE_LIMITED",
       "Too many requests. Please wait before trying again.",
       {
         statusCode: 429,
         retryAt: until,
-        retryAfterSeconds: Math.max(0, Math.ceil((until - Date.now()) / 1e3))
+        retryAfterSeconds: Math.max(0, Math.ceil((until - Date.now()) / 1e3)),
+        ...diagnostics
       },
       agentId
     );
@@ -147,7 +176,9 @@ var AgentReads = class {
   run(agentId, key2, fetch2) {
     const cooldown = this.cooldowns.get(agentId);
     if (cooldown && cooldown.until > Date.now()) {
-      return Promise.reject(this.limited(agentId, cooldown.until));
+      return Promise.reject(
+        this.limited(agentId, cooldown.until, cooldown.diagnostics)
+      );
     }
     const requestKey = JSON.stringify([agentId, key2]);
     const existing = this.inFlight.get(requestKey);
@@ -168,8 +199,9 @@ var AgentReads = class {
           Math.min(3e4 * 2 ** (failures - 1), 3e5)
         );
         const until = Math.max(previous?.until ?? 0, Date.now() + delay);
-        this.cooldowns.set(agentId, { until, failures });
-        throw this.limited(agentId, until);
+        const diagnostics = rateLimitDiagnostics(error);
+        this.cooldowns.set(agentId, { until, failures, diagnostics });
+        throw this.limited(agentId, until, diagnostics);
       }
     ).finally(() => {
       if (this.inFlight.get(requestKey) === promise)
@@ -182,7 +214,7 @@ var AgentReads = class {
 
 // src/agents/zyfai/zyfai.agent.ts
 import { SMART_SESSIONS_VALIDATOR, ZyfaiSDK } from "@zyfai/sdk";
-import { createPublicClient, http, parseAbi } from "viem";
+import { parseAbi } from "viem";
 import { base, arbitrum, mainnet } from "viem/chains";
 
 // src/types/config.ts
@@ -1063,15 +1095,148 @@ function protocolsPolicyNeedsUpdate(current, desiredProtocols, desiredAutoSelect
   return !protocolListsEqual(current.protocols, desiredProtocols);
 }
 
+// src/lib/paid-rpc.ts
+import {
+  createPublicClient,
+  http
+} from "viem";
+var PAID_RPC_RETRY_COUNT = 3;
+var PAID_RPC_RETRY_DELAY_MS = 1e3;
+function configuredRpcProxyBaseUrl(baseUrl) {
+  const configured = (baseUrl ?? "")?.trim();
+  if (!configured) {
+    throw new Error(
+      "OWNEY_ROUTING_API_BASE_URL is required for RPC proxy requests unless routingApiBaseUrl or all rpcUrls are configured."
+    );
+  }
+  return configured;
+}
+function rpcProxyUrl(chainId, apiKey, baseUrl) {
+  const url = new URL(
+    `${configuredRpcProxyBaseUrl(baseUrl).replace(/\/$/, "")}/api/v1/rpc/${chainId}`
+  );
+  if (apiKey) url.searchParams.set("apiKey", apiKey);
+  return url.toString();
+}
+function resolveRpcUrl(rpcUrls, chainId, apiKey = "", baseUrl) {
+  const url = rpcUrls?.[chainId]?.trim();
+  if (url) return url;
+  return rpcProxyUrl(chainId, apiKey, baseUrl);
+}
+function resolveRpcUrls(rpcUrls, apiKey = "", baseUrl) {
+  return {
+    1: resolveRpcUrl(rpcUrls, 1, apiKey, baseUrl),
+    8453: resolveRpcUrl(rpcUrls, 8453, apiKey, baseUrl),
+    42161: resolveRpcUrl(rpcUrls, 42161, apiKey, baseUrl)
+  };
+}
+function createPaidRpcClient(chain, rpcUrls) {
+  const url = resolveRpcUrl(
+    rpcUrls,
+    chain.id
+  );
+  return createPublicClient({
+    chain,
+    transport: http(url, {
+      retryCount: PAID_RPC_RETRY_COUNT,
+      retryDelay: PAID_RPC_RETRY_DELAY_MS
+    })
+  });
+}
+function headerValue(error, name) {
+  const seen = /* @__PURE__ */ new Set();
+  let value;
+  function visit(candidate, depth = 0) {
+    if (value || depth > 6 || !candidate || typeof candidate !== "object")
+      return;
+    if (seen.has(candidate)) return;
+    seen.add(candidate);
+    const record = candidate;
+    const headers = record.headers;
+    let found;
+    if (typeof headers?.get === "function") {
+      found = headers.get(name);
+    } else {
+      const headerRecord = headers;
+      found = headerRecord?.[name] ?? headerRecord?.[name.toLowerCase()];
+    }
+    if (typeof found === "string" && found) {
+      value = found;
+      return;
+    }
+    for (const key2 of ["cause", "details", "response", "error"])
+      visit(record[key2], depth + 1);
+  }
+  visit(error);
+  return value;
+}
+function statusCode(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let status;
+  function visit(candidate, depth = 0) {
+    if (status || depth > 6 || !candidate || typeof candidate !== "object")
+      return;
+    if (seen.has(candidate)) return;
+    seen.add(candidate);
+    const record = candidate;
+    for (const key2 of ["status", "statusCode"]) {
+      const parsed = Number(record[key2]);
+      if (Number.isInteger(parsed) && parsed >= 100 && parsed <= 599) {
+        status = parsed;
+        return;
+      }
+    }
+    for (const key2 of ["cause", "details", "response", "error"])
+      visit(record[key2], depth + 1);
+  }
+  visit(error);
+  return status;
+}
+function paidRpcError(error, chainId, rpcMethod, agentId) {
+  const delay = rateLimitDelay(error);
+  const providerRequestId = headerValue(error, "x-alchemy-request-id") ?? headerValue(error, "x-request-id");
+  if (delay === void 0) {
+    return new OwneyError(
+      "AGENT_API_ERROR",
+      "The blockchain RPC request failed.",
+      {
+        rpcSource: "paid-rpc",
+        chainId,
+        rpcMethod,
+        ...statusCode(error) ? { statusCode: statusCode(error) } : {},
+        ...providerRequestId ? { providerRequestId } : {}
+      },
+      agentId
+    );
+  }
+  const retryAt = Date.now() + delay;
+  return new OwneyError(
+    "AGENT_RATE_LIMITED",
+    "The blockchain RPC is rate limited. Please wait before trying again.",
+    {
+      rpcSource: "paid-rpc",
+      chainId,
+      rpcMethod,
+      statusCode: 429,
+      retryAt,
+      retryAfterSeconds: Math.max(0, Math.ceil(delay / 1e3)),
+      ...providerRequestId ? { providerRequestId } : {}
+    },
+    agentId
+  );
+}
+async function withPaidRpcDiagnostics(operation, chainId, rpcMethod, agentId) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw paidRpcError(error, chainId, rpcMethod, agentId);
+  }
+}
+
 // src/agents/zyfai/zyfai.agent.ts
 var ERC7579_IS_MODULE_INSTALLED_ABI = parseAbi([
   "function isModuleInstalled(uint256 moduleTypeId, address module, bytes additionalContext) view returns (bool)"
 ]);
-var DEFAULT_ZYFAI_RPC_URLS = {
-  8453: "https://base-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V",
-  42161: "https://arb-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V",
-  1: "https://eth-mainnet.g.alchemy.com/v2/ZWyVU-9XfS3z8Rn-xkq7V"
-};
 var WETH_ADDRESS_BY_CHAIN = {
   8453: "0x4200000000000000000000000000000000000006",
   42161: "0x82aF49447D8a07e3bd95BD0d56f35241523fBab1",
@@ -1137,7 +1302,7 @@ var ZyfaiAgent = class _ZyfaiAgent {
   earningsSnapshot = null;
   earningsGeneration = 0;
   constructor(apiKey, rpcUrls, referralSource) {
-    this.rpcUrls = rpcUrls ?? DEFAULT_ZYFAI_RPC_URLS;
+    this.rpcUrls = resolveRpcUrls(rpcUrls);
     this.sdk = new ZyfaiSDK({
       apiKey,
       rpcUrls: this.rpcUrls,
@@ -1151,10 +1316,10 @@ var ZyfaiAgent = class _ZyfaiAgent {
   getPublicClient(chainId) {
     const cached = this.publicClients.get(chainId);
     if (cached) return cached;
-    const client = createPublicClient({
-      chain: VIEM_CHAIN[chainId],
-      transport: http(this.rpcUrls[chainId])
-    });
+    const client = createPaidRpcClient(
+      VIEM_CHAIN[chainId],
+      this.rpcUrls
+    );
     this.publicClients.set(chainId, client);
     return client;
   }
@@ -2287,11 +2452,12 @@ async function postSponsorBatchTransfer(input) {
 // src/lib/permit2.ts
 import { bytesToHex as bytesToHex2 } from "viem";
 var PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var MAX_UINT256 = 2n ** 256n - 1n;
 function permit2ApprovalAmount(requiredAmount) {
   if (requiredAmount <= 0n) {
     throw new Error("Permit2 approval requires a positive deposit amount");
   }
-  return requiredAmount;
+  return MAX_UINT256;
 }
 var ERC20_ALLOWANCE_ABI = [
   {
@@ -2327,12 +2493,13 @@ function randomPermit2Nonce() {
   globalThis.crypto.getRandomValues(bytes);
   return BigInt(bytesToHex2(bytes));
 }
-async function readPermit2Allowance(publicClient, token, owner) {
+async function readPermit2Allowance(publicClient, token, owner, blockNumber) {
   return publicClient.readContract({
     address: token,
     abi: ERC20_ALLOWANCE_ABI,
     functionName: "allowance",
-    args: [owner, PERMIT2_ADDRESS]
+    args: [owner, PERMIT2_ADDRESS],
+    ...blockNumber === void 0 ? {} : { blockNumber }
   });
 }
 async function readErc20Balance(publicClient, token, owner) {
@@ -2720,10 +2887,11 @@ var YieldseekerApiClient = class {
       const payload = await response.json().catch(() => null);
       if (!response.ok) {
         const error = providerError(payload, `HTTP_${response.status}`);
+        const retryAfter = response.headers.get("Retry-After");
         throw new YieldseekerApiError(
           response.status,
           error.code,
-          error.fields
+          retryAfter ? { ...error.fields, headers: { "Retry-After": retryAfter } } : error.fields
         );
       }
       if (payload && typeof payload === "object" && payload.success === true && "data" in payload) {
@@ -2854,13 +3022,14 @@ function position(value, asset, baseAssetDecimals) {
     // differ from the underlying asset. Yieldseeker already converts it to
     // underlying base-asset units in `assetsBase`; pair that value with the
     // snapshot's corresponding `baseAssetDecimals` for display. Keep the raw
-    // share quantity separately because withdraw-from-position expects it.
+    // share quantity separate from the withdrawable underlying asset amount.
     amount: decimal(
       value.assetsBase,
       baseAssetDecimals,
       "yield positions"
     ),
     amountRaw: String(value.assetsRaw),
+    withdrawableAmountRaw: String(value.withdrawableAssetsRaw),
     apy: percent(option.riskAdjustedApy),
     tvl: Number(option.totalDepositsUsd),
     liquidity: Number(option.withdrawableDepositsUsd)
@@ -3185,10 +3354,18 @@ function mapYieldseekerAgentApy(options, days) {
 
 // src/agents/yieldseeker/yieldseeker.agent.ts
 var OWNEY_AGENT_NAME = "owney";
+var OWNEY_AGENT_RULE_PRESET = "explorative";
 var YIELDSEEKER_USERNAME_PREFIX = "owney_";
 var YIELDSEEKER_USERNAME_RANDOM_LENGTH = 14;
 var YIELDSEEKER_USERNAME_CREATE_ATTEMPTS = 3;
 var YIELDSEEKER_YIELD_OPTIONS_CACHE_MS = 6e4;
+var YIELDSEEKER_AGENT_LIST_CACHE_MS = 12e4;
+var YIELDSEEKER_PORTFOLIO_CACHE_MS = 12e4;
+var YIELDSEEKER_SETTLEMENT_CACHE_MS = 5e3;
+var YIELDSEEKER_SETTLEMENT_ACTIVITY_CACHE_MS = 15e3;
+var YIELDSEEKER_READ_FAILURE_COOLDOWN_MS = 6e4;
+var YIELDSEEKER_SETTLEMENT_WINDOW_MS = 5 * 6e4;
+var YIELDSEEKER_ACTIVITY_CACHE_MS = 6e4;
 function generateYieldseekerUsername() {
   const suffix = globalThis.crypto.randomUUID().replaceAll("-", "").slice(0, YIELDSEEKER_USERNAME_RANDOM_LENGTH).toLowerCase();
   return `${YIELDSEEKER_USERNAME_PREFIX}${suffix}`;
@@ -3232,6 +3409,7 @@ function query(params) {
 var YieldseekerAgent = class {
   id = "yieldseeker";
   balanceComposition = "tokens-plus-positions";
+  withdrawalRequiresWalletApproval = true;
   supportedChainIds = [8453];
   supportedAssets = [
     {
@@ -3245,11 +3423,26 @@ var YieldseekerAgent = class {
   ];
   api;
   auth;
+  rpcUrls;
+  receiptClient;
   transactionExecutor;
   unwindReceiptWaiter;
   agentContexts = /* @__PURE__ */ new Map();
   users = /* @__PURE__ */ new Map();
   pendingAgents = /* @__PURE__ */ new Map();
+  pendingWalletContexts = /* @__PURE__ */ new Map();
+  readCache = /* @__PURE__ */ new Map();
+  pendingReads = /* @__PURE__ */ new Map();
+  readGeneration = 0;
+  portfolioVersions = /* @__PURE__ */ new Map();
+  snapshotFailures = /* @__PURE__ */ new Map();
+  standardReadFailures = /* @__PURE__ */ new Map();
+  reconcileUntil = /* @__PURE__ */ new Map();
+  activityRefreshUntil = /* @__PURE__ */ new Map();
+  // null means a confirmed movement has no reliable baseline. Do not guess
+  // settlement; keep slow reconciliation after the fast window expires.
+  snapshotMovements = /* @__PURE__ */ new Map();
+  movementEpochs = /* @__PURE__ */ new Map();
   yieldOptions = /* @__PURE__ */ new Map();
   pendingYieldOptions = /* @__PURE__ */ new Map();
   constructor(owneyApiKey, options = {}) {
@@ -3259,10 +3452,16 @@ var YieldseekerAgent = class {
       options.fetchFn
     );
     this.auth = new YieldseekerAuth(options.auth);
+    this.rpcUrls = options.rpcUrls;
     this.transactionExecutor = options.transactionExecutor;
     this.unwindReceiptWaiter = options.unwindReceiptWaiter;
   }
+  getReceiptClient() {
+    this.receiptClient ??= createPaidRpcClient(base3, this.rpcUrls);
+    return this.receiptClient;
+  }
   async disconnect() {
+    this.readGeneration += 1;
     this.auth.clear();
     for (const key2 of this.users.keys()) {
       const [walletAddress, chainId] = key2.split(":");
@@ -3271,6 +3470,16 @@ var YieldseekerAgent = class {
     this.users.clear();
     this.agentContexts.clear();
     this.pendingAgents.clear();
+    this.pendingWalletContexts.clear();
+    this.readCache.clear();
+    this.pendingReads.clear();
+    this.portfolioVersions.clear();
+    this.snapshotFailures.clear();
+    this.standardReadFailures.clear();
+    this.reconcileUntil.clear();
+    this.activityRefreshUntil.clear();
+    this.snapshotMovements.clear();
+    this.movementEpochs.clear();
   }
   async activateAgent(state, chainId, asset) {
     this.assertChain(chainId);
@@ -3290,41 +3499,37 @@ var YieldseekerAgent = class {
       );
     }
     const context = await this.ensureAgent(state, chainId, asset);
+    const generation = this.readGeneration;
+    const movement = this.snapshotMovement(state, chainId, context, BigInt(amount));
     let txHash;
-    try {
-      if (depositCallback) {
-        provideDepositVerificationContext(depositCallback, {
-          agentId: "yieldseeker",
-          signature: await this.auth.getToken(state, chainId),
-          userId: context.user.userId,
-          yieldseekerAgentId: context.agent.agentId
-        });
-        txHash = await depositCallback(
-          context.wallet.walletAddress,
-          chainId,
-          amount
-        );
-        await this.waitForReceipt(state, chainId, txHash);
-      } else {
-        txHash = await this.submitTransaction(state, chainId, {
-          from: getAddress2(state.walletAddress),
-          to: YIELDSEEKER_ASSET_METADATA[asset].address,
-          data: encodeFunctionData({
-            abi: erc20Abi,
-            functionName: "transfer",
-            args: [getAddress2(context.wallet.walletAddress), BigInt(amount)]
-          }),
-          value: "0",
-          chainId
-        });
-      }
-    } finally {
-      await this.refreshSnapshotAfterMovement(
-        state,
+    if (depositCallback) {
+      provideDepositVerificationContext(depositCallback, {
+        agentId: "yieldseeker",
+        signature: await this.auth.getToken(state, chainId),
+        userId: context.user.userId,
+        yieldseekerAgentId: context.agent.agentId
+      });
+      txHash = await depositCallback(
+        context.wallet.walletAddress,
         chainId,
-        context,
-        "deposit"
+        amount
       );
+      await this.waitForReceipt(state, chainId, txHash);
+    } else {
+      txHash = await this.submitTransaction(state, chainId, {
+        from: getAddress2(state.walletAddress),
+        to: YIELDSEEKER_ASSET_METADATA[asset].address,
+        data: encodeFunctionData({
+          abi: erc20Abi,
+          functionName: "transfer",
+          args: [getAddress2(context.wallet.walletAddress), BigInt(amount)]
+        }),
+        value: "0",
+        chainId
+      });
+    }
+    if (this.readGeneration === generation) {
+      void this.refreshSnapshotAfterMovement(state, chainId, context, "deposit", movement);
     }
     return {
       txHash,
@@ -3352,6 +3557,9 @@ var YieldseekerAgent = class {
         this.id
       );
     }
+    const generation = this.readGeneration;
+    let confirmedMovement = false;
+    let settlement = null;
     try {
       const portfolio = await this.loadPortfolioContext(
         state,
@@ -3369,6 +3577,7 @@ var YieldseekerAgent = class {
       );
       const totalAvailable = idle + deployed;
       const requested = amount === void 0 ? totalAvailable : BigInt(amount);
+      const plannedMovement = this.snapshotMovement(state, chainId, context, -requested);
       if (requested > totalAvailable) {
         throw new OwneyError(
           "WITHDRAW_INSUFFICIENT_BALANCE",
@@ -3404,6 +3613,7 @@ var YieldseekerAgent = class {
           throw this.invalidResponse("position withdrawal");
         }
         await this.waitForReceipt(state, chainId, response.transactionHash);
+        confirmedMovement = true;
         remaining -= assetsRaw;
       }
       if (remaining > 0n) {
@@ -3428,18 +3638,23 @@ var YieldseekerAgent = class {
         value: "0",
         chainId
       });
+      confirmedMovement = true;
+      settlement = plannedMovement;
       return {
         txHash,
         type: amount === void 0 ? "full" : "partial",
         amount: requested.toString()
       };
     } finally {
-      await this.refreshSnapshotAfterMovement(
-        state,
-        chainId,
-        context,
-        "withdrawal"
-      );
+      if (confirmedMovement && this.readGeneration === generation) {
+        void this.refreshSnapshotAfterMovement(
+          state,
+          chainId,
+          context,
+          "withdrawal",
+          settlement
+        );
+      }
     }
   }
   async getBalances(state, chainId) {
@@ -3464,7 +3679,7 @@ var YieldseekerAgent = class {
     this.assertChain(chainId);
     const asset = options?.tokenSymbol?.toUpperCase();
     if (asset !== void 0) this.assertAsset(asset);
-    const contexts = await this.loadPortfolio(state, chainId, {
+    const contexts = await this.loadActivityPortfolio(state, chainId, {
       ...asset ? { asset } : {},
       historic: true,
       actions: true
@@ -3491,7 +3706,7 @@ var YieldseekerAgent = class {
     this.assertChain(chainId);
     return mapYieldseekerProfile(
       state.walletAddress,
-      await this.loadPortfolio(state, chainId, {})
+      await this.loadActivityPortfolio(state, chainId, {})
     );
   }
   async getAgentApy(days, options) {
@@ -3533,6 +3748,95 @@ var YieldseekerAgent = class {
   contextKey(state, chainId, asset) {
     return `${this.userKey(state, chainId)}:${asset}`;
   }
+  assertSession(generation, chainId, asset) {
+    if (this.readGeneration !== generation) {
+      throw new OwneyError(
+        "NOT_CONNECTED",
+        "Wallet session changed during the Yieldseeker request.",
+        { rpcSource: "agent-api", chainId, ...asset ? { asset } : {} },
+        this.id
+      );
+    }
+  }
+  cachedRead(key2, ttlMs, read2) {
+    const cached = this.readCache.get(key2);
+    if (cached && cached.expiresAt > Date.now()) {
+      return Promise.resolve(cached.value);
+    }
+    const pending = this.pendingReads.get(key2);
+    if (pending) return pending;
+    const generation = this.readGeneration;
+    const request = Promise.resolve().then(read2).then((value) => {
+      if (this.readGeneration === generation && this.pendingReads.get(key2) === request) {
+        this.readCache.set(key2, {
+          expiresAt: Date.now() + ttlMs,
+          value
+        });
+      }
+      return value;
+    }).finally(() => {
+      if (this.pendingReads.get(key2) === request) {
+        this.pendingReads.delete(key2);
+      }
+    });
+    this.pendingReads.set(key2, request);
+    return request;
+  }
+  agentListKey(state, chainId) {
+    return `agents:${this.userKey(state, chainId)}`;
+  }
+  async listAgents(state, chainId, user) {
+    const response = await this.cachedRead(
+      this.agentListKey(state, chainId),
+      YIELDSEEKER_AGENT_LIST_CACHE_MS,
+      async () => {
+        const response2 = await this.walletRequest(
+          state,
+          chainId,
+          `/users/${user.userId}/agents`
+        );
+        if (!Array.isArray(response2?.agents)) {
+          throw this.invalidResponse("agent list");
+        }
+        return response2;
+      }
+    );
+    return response.agents;
+  }
+  async contextForAgent(state, chainId, user, agent, asset) {
+    const key2 = this.contextKey(state, chainId, asset);
+    const cached = this.agentContexts.get(key2);
+    if (cached?.agent.agentId === agent.agentId) return cached;
+    const pending = this.pendingWalletContexts.get(key2);
+    if (pending) return pending;
+    const generation = this.readGeneration;
+    const request = this.walletRequest(
+      state,
+      chainId,
+      `/users/${user.userId}/agents/${agent.agentId}/wallet`
+    ).then((walletResponse) => {
+      this.assertSession(generation, chainId, asset);
+      if (!walletResponse?.agentWallet || !isAddress2(walletResponse.agentWallet.walletAddress)) {
+        throw this.invalidResponse("agent wallet");
+      }
+      const context = {
+        user,
+        agent,
+        wallet: walletResponse.agentWallet,
+        asset
+      };
+      this.agentContexts.set(key2, context);
+      return context;
+    });
+    this.pendingWalletContexts.set(key2, request);
+    try {
+      return await request;
+    } finally {
+      if (this.pendingWalletContexts.get(key2) === request) {
+        this.pendingWalletContexts.delete(key2);
+      }
+    }
+  }
   async resolveUser(state, chainId) {
     const key2 = this.userKey(state, chainId);
     const inMemory = this.users.get(key2);
@@ -3543,6 +3847,7 @@ var YieldseekerAgent = class {
       return persisted;
     }
     const walletAddress = getAddress2(state.walletAddress);
+    const generation = this.readGeneration;
     let user = null;
     try {
       const login = await this.providerRequest(
@@ -3589,6 +3894,7 @@ var YieldseekerAgent = class {
     if (!user || !/^[a-zA-Z0-9_-]{1,128}$/.test(user.userId)) {
       throw this.invalidResponse("wallet identity");
     }
+    this.assertSession(generation, chainId);
     const resolved = { userId: user.userId };
     this.users.set(key2, resolved);
     writeYieldseekerIdentity(state.walletAddress, chainId, resolved.userId);
@@ -3604,10 +3910,13 @@ var YieldseekerAgent = class {
     if (cached) return cached;
     const pending = this.pendingAgents.get(key2);
     if (pending) return pending;
+    const generation = this.readGeneration;
     const request = this.resolveAgent(state, chainId, asset, true).then(
       async (context) => {
+        this.assertSession(generation, chainId, asset);
         if (!context) throw this.invalidResponse("agent creation");
         await this.deployAgent(state, chainId, context);
+        this.assertSession(generation, chainId, asset);
         this.agentContexts.set(key2, context);
         return context;
       }
@@ -3616,29 +3925,27 @@ var YieldseekerAgent = class {
     try {
       return await request;
     } finally {
-      this.pendingAgents.delete(key2);
+      if (this.pendingAgents.get(key2) === request) this.pendingAgents.delete(key2);
     }
   }
   async findAgent(state, chainId, asset) {
     const key2 = this.contextKey(state, chainId, asset);
     const cached = this.agentContexts.get(key2);
     if (cached) return cached;
+    const generation = this.readGeneration;
     const context = await this.resolveAgent(state, chainId, asset, false);
+    this.assertSession(generation, chainId, asset);
     if (context) this.agentContexts.set(key2, context);
     return context;
   }
   async resolveAgent(state, chainId, asset, createIfMissing) {
+    const generation = this.readGeneration;
     const user = await this.resolveUser(state, chainId);
-    const response = await this.walletRequest(
-      state,
-      chainId,
-      `/users/${user.userId}/agents`
-    );
-    if (!Array.isArray(response?.agents)) {
-      throw this.invalidResponse("agent list");
-    }
+    this.assertSession(generation, chainId, asset);
+    const agents = await this.listAgents(state, chainId, user);
+    this.assertSession(generation, chainId, asset);
     const metadata = YIELDSEEKER_ASSET_METADATA[asset];
-    let agent = response.agents.find(
+    let agent = agents.find(
       (candidate) => this.isOwneyAgent(candidate) && candidate.chainId === chainId && candidate.type === "vault" && candidate.assetAddress.toLowerCase() === metadata.address.toLowerCase()
     );
     if (!agent && createIfMissing) {
@@ -3654,99 +3961,254 @@ var YieldseekerAgent = class {
             chainId,
             assetAddress: metadata.address,
             type: "vault",
-            rulePreset: null
+            rulePreset: OWNEY_AGENT_RULE_PRESET
           }
         }
       );
+      this.assertSession(generation, chainId, asset);
       agent = created?.agent;
+      if (agent) {
+        this.readCache.set(this.agentListKey(state, chainId), {
+          expiresAt: Date.now() + YIELDSEEKER_AGENT_LIST_CACHE_MS,
+          value: {
+            agents: [...agents, agent]
+          }
+        });
+      }
     }
     if (!agent) return null;
     this.assertAgent(agent);
-    const walletResponse = await this.walletRequest(
-      state,
-      chainId,
-      `/users/${user.userId}/agents/${agent.agentId}/wallet`
-    );
-    if (!walletResponse?.agentWallet || !isAddress2(walletResponse.agentWallet.walletAddress)) {
-      throw this.invalidResponse("agent wallet");
-    }
-    return { user, agent, wallet: walletResponse.agentWallet, asset };
+    return this.contextForAgent(state, chainId, user, agent, asset);
   }
   async loadPortfolio(state, chainId, options) {
-    const user = await this.resolveUser(state, chainId);
-    const response = await this.walletRequest(
-      state,
-      chainId,
-      `/users/${user.userId}/agents`
+    const contexts = await this.resolvePortfolioContexts(state, chainId, options.asset);
+    return Promise.all(
+      contexts.map(
+        (context) => this.loadPortfolioContext(state, chainId, context, options)
+      )
     );
-    if (!Array.isArray(response?.agents)) {
-      throw this.invalidResponse("agent list");
-    }
+  }
+  async loadActivityPortfolio(state, chainId, options) {
+    const contexts = await this.resolvePortfolioContexts(state, chainId, options.asset);
+    return Promise.all(
+      contexts.map(
+        (context) => this.loadActivityContext(state, chainId, context, options)
+      )
+    );
+  }
+  async resolvePortfolioContexts(state, chainId, assetFilter) {
+    const generation = this.readGeneration;
+    const user = await this.resolveUser(state, chainId);
+    this.assertSession(generation, chainId);
+    const agents = await this.listAgents(state, chainId, user);
+    this.assertSession(generation, chainId);
     const contexts = [];
-    for (const agent of response.agents) {
+    for (const agent of agents) {
       const asset = this.assetForAgent(agent);
-      if (!this.isOwneyAgent(agent) || !asset || agent.chainId !== chainId || agent.type !== "vault" || options.asset && options.asset !== asset) {
+      if (!this.isOwneyAgent(agent) || !asset || agent.chainId !== chainId || agent.type !== "vault" || assetFilter && assetFilter !== asset) {
         continue;
       }
       this.assertAgent(agent);
-      const walletResponse = await this.walletRequest(
-        state,
-        chainId,
-        `/users/${user.userId}/agents/${agent.agentId}/wallet`
-      );
-      if (!walletResponse?.agentWallet || !isAddress2(walletResponse.agentWallet.walletAddress)) {
-        throw this.invalidResponse("agent wallet");
-      }
-      const context = {
-        user,
-        agent,
-        wallet: walletResponse.agentWallet,
-        asset
+      contexts.push(this.contextForAgent(state, chainId, user, agent, asset));
+    }
+    const resolvedContexts = await Promise.all(contexts);
+    this.assertSession(generation, chainId);
+    return resolvedContexts;
+  }
+  portfolioVersion(contextKey) {
+    return this.portfolioVersions.get(contextKey) ?? 0;
+  }
+  portfolioCacheMs(contextKey) {
+    return (this.reconcileUntil.get(contextKey) ?? 0) > Date.now() ? YIELDSEEKER_SETTLEMENT_CACHE_MS : YIELDSEEKER_PORTFOLIO_CACHE_MS;
+  }
+  snapshotMovement(state, chainId, context, delta) {
+    const key2 = this.contextKey(state, chainId, context.asset);
+    const previous = this.snapshotMovements.get(key2);
+    if (this.snapshotMovements.has(key2)) {
+      if (!previous || previous.delta > 0n !== delta > 0n) return null;
+      return {
+        ...previous,
+        epoch: this.movementEpochs.get(key2) ?? 0,
+        delta: previous.delta + delta,
+        expectedBalance: previous.expectedBalance + delta,
+        expectedNetDeposits: previous.expectedNetDeposits + delta
       };
-      this.agentContexts.set(this.contextKey(state, chainId, asset), context);
-      contexts.push(context);
     }
-    return Promise.all(
-      contexts.map(
-        (context) => this.loadPortfolioContext(state, chainId, context, options)
-      )
-    );
+    const cached = this.readCache.get(`snapshot:${key2}`);
+    if (!cached || cached.expiresAt <= Date.now()) return null;
+    const snapshot = cached.value.agentSnapshot;
+    if (snapshot.baseAssetDecimals !== YIELDSEEKER_ASSET_METADATA[context.asset].decimals) return null;
+    if (!/^-?\d+$/.test(snapshot.netDepositsBase) || !/^\d+$/.test(snapshot.totalValueBase)) return null;
+    return {
+      epoch: this.movementEpochs.get(key2) ?? 0,
+      delta,
+      decimals: snapshot.baseAssetDecimals,
+      expectedBalance: BigInt(snapshot.totalValueBase) + delta,
+      expectedNetDeposits: BigInt(snapshot.netDepositsBase) + delta
+    };
+  }
+  advancePortfolioVersion(contextKey) {
+    const version = this.portfolioVersion(contextKey) + 1;
+    this.portfolioVersions.set(contextKey, version);
+    this.snapshotFailures.delete(contextKey);
+    for (const kind of ["snapshot", "positions", "historic", "actions"]) {
+      const key2 = `${kind}:${contextKey}`;
+      this.readCache.delete(key2);
+      this.pendingReads.delete(key2);
+    }
+    return version;
+  }
+  requestPortfolioSnapshot(state, chainId, context, contextKey, version, generation, forceRefresh = false) {
+    return this.walletRequest(
+      state,
+      chainId,
+      `${this.agentPath(context, "snapshot")}${query(forceRefresh ? { shouldForceRefresh: true } : { shouldOnlyUseRecentValue: true, shouldAllowStaleOnError: true })}`
+    ).then((response) => {
+      if (!response?.agentSnapshot) {
+        throw this.invalidResponse("agent snapshot");
+      }
+      if (this.readGeneration === generation && this.portfolioVersion(contextKey) === version) {
+        this.snapshotFailures.delete(contextKey);
+        const movement = this.snapshotMovements.get(contextKey);
+        const snapshot = response.agentSnapshot;
+        if (movement && snapshot.baseAssetDecimals === movement.decimals && /^-?\d+$/.test(snapshot.netDepositsBase) && /^\d+$/.test(snapshot.totalValueBase)) {
+          const balance = BigInt(snapshot.totalValueBase);
+          const netDeposits = BigInt(snapshot.netDepositsBase);
+          const reconciled = movement.delta > 0n ? balance >= movement.expectedBalance && netDeposits >= movement.expectedNetDeposits : balance <= movement.expectedBalance && netDeposits <= movement.expectedNetDeposits;
+          if (reconciled) {
+            this.snapshotMovements.delete(contextKey);
+            this.reconcileUntil.delete(contextKey);
+          }
+        }
+      }
+      return response;
+    }).catch((error) => {
+      if (this.readGeneration === generation && this.portfolioVersion(contextKey) === version) {
+        this.snapshotFailures.set(contextKey, {
+          retryAt: Date.now() + Math.max(YIELDSEEKER_READ_FAILURE_COOLDOWN_MS, rateLimitDelay(error) ?? 0),
+          error
+        });
+      }
+      throw error;
+    });
+  }
+  portfolioSnapshot(state, chainId, context, contextKey) {
+    const key2 = `snapshot:${contextKey}`;
+    const cached = this.readCache.get(key2);
+    if ((!cached || cached.expiresAt <= Date.now()) && !this.pendingReads.has(key2)) {
+      const failure = this.snapshotFailures.get(contextKey);
+      if (failure && failure.retryAt > Date.now()) throw failure.error;
+      this.advancePortfolioVersion(contextKey);
+    }
+    const version = this.portfolioVersion(contextKey);
+    const generation = this.readGeneration;
+    return {
+      version,
+      read: this.cachedRead(key2, this.portfolioCacheMs(contextKey), () => (
+        // Force only during the bounded post-transaction window. Keep unknown
+        // or unreconciled movements for verification, but do not let them turn
+        // routine polling into forced refreshes indefinitely.
+        this.requestPortfolioSnapshot(
+          state,
+          chainId,
+          context,
+          contextKey,
+          version,
+          generation,
+          this.snapshotMovements.has(contextKey) && (this.reconcileUntil.get(contextKey) ?? 0) > Date.now()
+        )
+      ))
+    };
   }
   async loadPortfolioContext(state, chainId, context, options = {}) {
-    const [snapshot, positions, historic, actions] = await Promise.all([
-      this.walletRequest(
-        state,
-        chainId,
-        `${this.agentPath(context, "snapshot")}${query({
-          shouldOnlyUseRecentValue: true,
-          shouldAllowStaleOnError: true
-        })}`
-      ),
-      this.walletRequest(
-        state,
-        chainId,
-        this.agentPath(context, "yield-positions")
+    const contextKey = this.contextKey(state, chainId, context.asset);
+    const generation = this.readGeneration;
+    const assertSession = () => this.assertSession(generation, chainId, context.asset);
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const { version, read: read2 } = this.portfolioSnapshot(state, chainId, context, contextKey);
+      const parts = this.loadPortfolioParts(state, chainId, context, options, contextKey);
+      try {
+        const [snapshot, portfolioParts] = await Promise.all([read2, parts]);
+        assertSession();
+        if (this.portfolioVersion(contextKey) !== version) continue;
+        return {
+          ...context,
+          snapshot: snapshot.agentSnapshot,
+          ...portfolioParts
+        };
+      } catch (error) {
+        assertSession();
+        if (this.portfolioVersion(contextKey) !== version) continue;
+        throw error;
+      }
+    }
+    throw new OwneyError(
+      "AGENT_API_ERROR",
+      "Yieldseeker portfolio changed during the read. Please retry.",
+      { rpcSource: "agent-api", chainId, asset: context.asset },
+      this.id
+    );
+  }
+  async loadActivityContext(state, chainId, context, options) {
+    const contextKey = this.contextKey(state, chainId, context.asset);
+    const generation = this.readGeneration;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const version = this.portfolioVersion(contextKey);
+      try {
+        const parts = await this.loadPortfolioParts(state, chainId, context, options, contextKey);
+        this.assertSession(generation, chainId, context.asset);
+        if (this.portfolioVersion(contextKey) !== version) continue;
+        return { ...context, ...parts };
+      } catch (error) {
+        this.assertSession(generation, chainId, context.asset);
+        if (this.portfolioVersion(contextKey) !== version) continue;
+        throw error;
+      }
+    }
+    throw new OwneyError(
+      "AGENT_API_ERROR",
+      "Yieldseeker activity changed during the read. Please retry.",
+      { rpcSource: "agent-api", chainId, asset: context.asset },
+      this.id
+    );
+  }
+  async loadPortfolioParts(state, chainId, context, options, contextKey) {
+    const [positions, historic, actions] = await Promise.all([
+      this.cachedRead(
+        `positions:${contextKey}`,
+        this.portfolioCacheMs(contextKey),
+        async () => {
+          const response = await this.walletRequest(
+            state,
+            chainId,
+            this.agentPath(context, "yield-positions")
+          );
+          if (!Array.isArray(response?.yieldPositions)) {
+            throw this.invalidResponse("yield positions");
+          }
+          return response;
+        }
       ),
-      options.historic ? this.walletRequest(
-        state,
-        chainId,
-        this.agentPath(context, "wallet/historic-position")
+      options.historic ? this.cachedRead(
+        `historic:${contextKey}`,
+        (this.activityRefreshUntil.get(contextKey) ?? 0) > Date.now() ? YIELDSEEKER_SETTLEMENT_ACTIVITY_CACHE_MS : YIELDSEEKER_ACTIVITY_CACHE_MS,
+        () => this.walletRequest(
+          state,
+          chainId,
+          this.agentPath(context, "wallet/historic-position")
+        )
       ) : Promise.resolve(void 0),
-      options.actions ? this.walletRequest(
-        state,
-        chainId,
-        this.agentPath(context, "actions")
+      options.actions ? this.cachedRead(
+        `actions:${contextKey}`,
+        (this.activityRefreshUntil.get(contextKey) ?? 0) > Date.now() ? YIELDSEEKER_SETTLEMENT_ACTIVITY_CACHE_MS : YIELDSEEKER_ACTIVITY_CACHE_MS,
+        () => this.walletRequest(
+          state,
+          chainId,
+          this.agentPath(context, "actions")
+        )
       ) : Promise.resolve(void 0)
     ]);
-    if (!snapshot?.agentSnapshot) {
-      throw this.invalidResponse("agent snapshot");
-    }
-    if (!Array.isArray(positions?.yieldPositions)) {
-      throw this.invalidResponse("yield positions");
-    }
     return {
-      ...context,
-      snapshot: snapshot.agentSnapshot,
       positions: positions.yieldPositions,
       ...historic?.position ? { historic: historic.position } : {},
       ...actions?.actions ? { actions: actions.actions } : {}
@@ -3768,18 +4230,21 @@ var YieldseekerAgent = class {
     }
     context.wallet = deployed.agentWallet;
   }
-  async refreshSnapshotAfterMovement(state, chainId, context, movement) {
+  async refreshSnapshotAfterMovement(state, chainId, context, movement, settlement) {
+    const contextKey = this.contextKey(state, chainId, context.asset);
+    this.reconcileUntil.set(contextKey, Date.now() + YIELDSEEKER_SETTLEMENT_WINDOW_MS);
+    this.activityRefreshUntil.set(contextKey, Date.now() + YIELDSEEKER_SETTLEMENT_WINDOW_MS);
+    const epoch = this.movementEpochs.get(contextKey) ?? 0;
+    this.snapshotMovements.set(contextKey, settlement?.epoch === epoch ? settlement : null);
+    this.movementEpochs.set(contextKey, epoch + 1);
+    const version = this.advancePortfolioVersion(contextKey);
+    const generation = this.readGeneration;
     try {
-      const response = await this.walletRequest(
-        state,
-        chainId,
-        `${this.agentPath(context, "snapshot")}${query({
-          shouldForceRefresh: true
-        })}`
+      await this.cachedRead(
+        `snapshot:${contextKey}`,
+        YIELDSEEKER_SETTLEMENT_CACHE_MS,
+        () => this.requestPortfolioSnapshot(state, chainId, context, contextKey, version, generation, true)
       );
-      if (!response?.agentSnapshot) {
-        throw this.invalidResponse("agent snapshot refresh");
-      }
     } catch (error) {
       console.warn(
         `[owney-sdk] Yieldseeker ${movement} snapshot refresh failed:`,
@@ -3791,10 +4256,26 @@ var YieldseekerAgent = class {
     return `/users/${context.user.userId}/agents/${context.agent.agentId}/${suffix}`;
   }
   async walletRequest(state, chainId, path, options = {}) {
+    const read2 = (options.method ?? "GET") === "GET";
+    const userKey = this.userKey(state, chainId);
+    if (read2) {
+      const failure = this.standardReadFailures.get(userKey);
+      if (failure && failure.retryAt > Date.now()) throw failure.error;
+      if (failure) this.standardReadFailures.delete(userKey);
+    }
+    const generation = this.readGeneration;
     try {
       return await this.providerRequest(state, chainId, path, options);
     } catch (error) {
-      throw this.mapApiError(error);
+      const mapped = this.mapApiError(error);
+      const delay = read2 ? rateLimitDelay(mapped) : void 0;
+      if (delay !== void 0 && this.readGeneration === generation) {
+        this.standardReadFailures.set(userKey, {
+          retryAt: Date.now() + Math.max(YIELDSEEKER_READ_FAILURE_COOLDOWN_MS, delay),
+          error: mapped
+        });
+      }
+      throw mapped;
     }
   }
   async providerRequest(state, chainId, path, options = {}) {
@@ -3835,6 +4316,7 @@ var YieldseekerAgent = class {
       code,
       `Yieldseeker request failed: ${error.providerCode}.`,
       {
+        rpcSource: "agent-api",
         statusCode: error.status,
         providerCode: error.providerCode,
         ...error.responseFields ? { fields: error.responseFields } : {}
@@ -3853,12 +4335,12 @@ var YieldseekerAgent = class {
       chain: base3,
       transport: custom2(state.provider)
     });
-    const publicClient = createPublicClient3({
+    const walletChainClient = createPublicClient3({
       chain: base3,
       transport: custom2(state.provider)
     });
     await ensureWalletOnChain(
-      publicClient,
+      walletChainClient,
       walletClient,
       8453
     );
@@ -3869,10 +4351,15 @@ var YieldseekerAgent = class {
       data: transaction.data,
       value: BigInt(transaction.value)
     });
-    const receipt = await publicClient.waitForTransactionReceipt({
-      hash,
-      confirmations: 1
-    });
+    const receipt = await withPaidRpcDiagnostics(
+      () => this.getReceiptClient().waitForTransactionReceipt({
+        hash,
+        confirmations: 1
+      }),
+      8453,
+      "eth_getTransactionReceipt",
+      this.id
+    );
     if (receipt.status !== "success") {
       throw new OwneyError(
         "AGENT_TRANSACTION_REVERTED",
@@ -3888,14 +4375,15 @@ var YieldseekerAgent = class {
       await this.unwindReceiptWaiter(state, chainId, transactionHash);
       return;
     }
-    const publicClient = createPublicClient3({
-      chain: base3,
-      transport: custom2(state.provider)
-    });
-    const receipt = await publicClient.waitForTransactionReceipt({
-      hash: transactionHash,
-      confirmations: 1
-    });
+    const receipt = await withPaidRpcDiagnostics(
+      () => this.getReceiptClient().waitForTransactionReceipt({
+        hash: transactionHash,
+        confirmations: 1
+      }),
+      8453,
+      "eth_getTransactionReceipt",
+      this.id
+    );
     if (receipt.status !== "success") {
       throw new OwneyError(
         "AGENT_TRANSACTION_REVERTED",
@@ -4084,16 +4572,16 @@ function projectAgentBalancesForAsset(agents, aggregated, chainId, asset, decima
         const positionChain = position2.chain.trim().toUpperCase();
         const matchesChain = positionChain === String(chainId) || targetChain !== void 0 && positionChain === targetChain;
         if (!matchesChain || position2.asset.toUpperCase() !== target) continue;
-        if (position2.amountRaw !== void 0) {
-          try {
-            balance += BigInt(position2.amountRaw);
-            continue;
-          } catch {
-          }
-        }
-        balance += parseUnits(position2.amount, decimals);
+        balance += position2.withdrawableAmountRaw !== void 0 ? BigInt(position2.withdrawableAmountRaw) : parseUnits(position2.amount, decimals);
       }
     }
+    const assetTotal = agentBalance?.assetBalances?.find(
+      (t) => t.chainId === chainId && t.asset.toUpperCase() === target
+    );
+    if (assetTotal) {
+      const total = parseUnits(assetTotal.amount, decimals);
+      if (total < balance) balance = total > 0n ? total : 0n;
+    }
     return { agent, balance };
   });
 }
@@ -4267,6 +4755,41 @@ import {
 // src/lib/permit2-batch.ts
 import { parseAbi as parseAbi2, hashStruct } from "viem";
 var BATCH_PERMIT2_ADDRESS = "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+var BASE_USDC_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+var MULTICALL3_ADDRESS = "0xcA11bde05977b3631167028862bE2a173976CA11";
+var ERC2612_PERMIT_TYPES = {
+  Permit: [
+    { name: "owner", type: "address" },
+    { name: "spender", type: "address" },
+    { name: "value", type: "uint256" },
+    { name: "nonce", type: "uint256" },
+    { name: "deadline", type: "uint256" }
+  ]
+};
+var ERC2612_READ_ABI = parseAbi2([
+  "function name() view returns (string)",
+  "function version() view returns (string)",
+  "function nonces(address owner) view returns (uint256)"
+]);
+function erc2612TypedData(input) {
+  return {
+    domain: {
+      name: input.permit.tokenName,
+      version: input.permit.tokenVersion,
+      chainId: input.chainId,
+      verifyingContract: input.token
+    },
+    types: ERC2612_PERMIT_TYPES,
+    primaryType: "Permit",
+    message: {
+      owner: input.owner,
+      spender: BATCH_PERMIT2_ADDRESS,
+      value: BigInt(input.permit.value),
+      nonce: BigInt(input.permit.nonce),
+      deadline: BigInt(input.permit.deadline)
+    }
+  };
+}
 var PERMIT_BATCH_TYPES = {
   PermitBatchWitnessTransferFrom: [
     { name: "permitted", type: "TokenPermissions[]" },
@@ -4418,28 +4941,67 @@ async function execute(i, key2, plan) {
       "DEPOSIT_INSUFFICIENT_BALANCE",
       "Insufficient token balance for this deposit."
     );
-  if (allowance < total)
+  if (allowance < total && (i.chainId !== 8453 || !isAddressEqual(i.token, BASE_USDC_ADDRESS)))
     throw new OwneyError(
       "PERMIT2_APPROVAL_REQUIRED",
       "token deposits need a one-time Permit2 approval."
     );
-  const relayer = await getSponsorRelayerAddress({
+  const now = (await i.pub.getBlock()).timestamp;
+  let erc2612Permit;
+  if (allowance < total) {
+    const [tokenName, tokenVersion, permitNonce] = await Promise.all([
+      i.pub.readContract({
+        address: i.token,
+        abi: ERC2612_READ_ABI,
+        functionName: "name"
+      }),
+      i.pub.readContract({
+        address: i.token,
+        abi: ERC2612_READ_ABI,
+        functionName: "version"
+      }),
+      i.pub.readContract({
+        address: i.token,
+        abi: ERC2612_READ_ABI,
+        functionName: "nonces",
+        args: [i.owner]
+      })
+    ]);
+    const unsignedPermit = {
+      value: MAX_UINT256.toString(),
+      nonce: permitNonce.toString(),
+      deadline: (now + 900n).toString(),
+      tokenName,
+      tokenVersion
+    };
+    const signature2 = await i.wallet.signTypedData({
+      account: i.owner,
+      ...erc2612TypedData({
+        chainId: 8453,
+        token: i.token,
+        owner: i.owner,
+        permit: unsignedPermit
+      })
+    });
+    erc2612Permit = { ...unsignedPermit, signature: signature2 };
+  }
+  const spender = erc2612Permit ? MULTICALL3_ADDRESS : await getSponsorRelayerAddress({
     apiKey: i.apiKey,
     baseUrl: i.baseUrl,
     chainId: i.chainId
   });
-  const now = (await i.pub.getBlock()).timestamp;
   const unsigned = {
     chainId: i.chainId,
     token: i.token,
     from: i.owner,
     transfers: i.transfers,
     nonce: randomPermit2Nonce().toString(),
-    deadline: (now + 900n).toString()
+    deadline: (now + 900n).toString(),
+    ...erc2612Permit ? { erc2612Permit } : {}
   };
   const signature = await i.wallet.signTypedData({
     account: i.owner,
-    ...batchTypedData(unsigned, relayer)
+    ...batchTypedData(unsigned, spender)
   });
   i.onApproved?.();
   return send({ ...unsigned, signature });
@@ -4459,8 +5021,8 @@ function makeSponsoredTokenCallback(deps) {
         "CHAIN_UNSUPPORTED",
         `No sponsored token configured for chain ${chainId}`
       );
-    const pub = deps.getPublicClient(chainId), wallet = deps.getWalletClient(chainId);
-    await ensureWalletOnChain(pub, wallet, chainId);
+    const pub = deps.getPublicClient(chainId), walletChain = deps.getWalletChainClient?.(chainId) ?? pub, wallet = deps.getWalletClient(chainId);
+    await ensureWalletOnChain(walletChain, wallet, chainId);
     return sponsorTokenBatch({
       apiKey: deps.apiKey,
       baseUrl: deps.baseUrl,
@@ -4700,6 +5262,8 @@ function makeSponsoredCallsCallback(deps) {
 }
 
 // src/client.ts
+var PERMIT2_ALLOWANCE_VERIFY_ATTEMPTS = 6;
+var PERMIT2_ALLOWANCE_VERIFY_DELAY_MS = 250;
 function encodeMultiAgentCursor(map) {
   return Buffer.from(JSON.stringify(map), "utf8").toString("base64");
 }
@@ -4760,6 +5324,7 @@ var OwneySDK = class {
   // leave every user's agent profile alone.
   orgAgentConfig;
   orgAgentConfigPromise = null;
+  rpcUrls;
   zyfaiRpcUrls;
   yieldseekerApiBaseUrl;
   yieldseekerSiweOrigin;
@@ -4784,7 +5349,12 @@ var OwneySDK = class {
   constructor(config) {
     this.apiKey = config.apiKey;
     if (config.debug) setOwneyDebug(true);
-    this.zyfaiRpcUrls = config.zyfaiRpcUrls;
+    this.rpcUrls = resolveRpcUrls(
+      config.rpcUrls,
+      config.apiKey,
+      config.routingApiBaseUrl
+    );
+    this.zyfaiRpcUrls = config.rpcUrls ? void 0 : config.zyfaiRpcUrls;
     this.yieldseekerApiBaseUrl = config.yieldseekerApiBaseUrl;
     this.yieldseekerSiweOrigin = config.yieldseekerSiweOrigin;
     this.routingApiBaseUrl = config.routingApiBaseUrl;
@@ -4874,6 +5444,9 @@ var OwneySDK = class {
     }
     return this.state.provider;
   }
+  getPaidRpcClient(chainId) {
+    return createPaidRpcClient(VIEM_CHAIN2[chainId], this.rpcUrls);
+  }
   /** Builds the default USDC batch callback for the connected wallet. */
   getDefaultSponsoredCallback(onApproved) {
     if (!onApproved && this.cachedSponsoredCallback)
@@ -4889,7 +5462,8 @@ var OwneySDK = class {
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
       // runtime, but the two share a name TS treats as unrelated.
-      getPublicClient: (cid) => createPublicClient4({
+      getPublicClient: (cid) => this.getPaidRpcClient(cid),
+      getWalletChainClient: (cid) => createPublicClient4({
         chain: VIEM_CHAIN2[cid],
         transport: custom3(provider)
       }),
@@ -4939,7 +5513,8 @@ var OwneySDK = class {
       // Casts work around viem's chain-narrowed Client vs the generic
       // PublicClient/WalletClient param types — structurally identical at
       // runtime, but the two share a name TS treats as unrelated.
-      getPublicClient: (cid) => createPublicClient4({
+      getPublicClient: (cid) => this.getPaidRpcClient(cid),
+      getWalletChainClient: (cid) => createPublicClient4({
         chain: VIEM_CHAIN2[cid],
         transport: custom3(provider)
       }),
@@ -5052,12 +5627,21 @@ var OwneySDK = class {
   createAgent(agentId, key2) {
     if (agentId === "zyfai") {
       if (!key2) return null;
-      return new ZyfaiAgent(key2, this.zyfaiRpcUrls, this.referralSource);
+      return new ZyfaiAgent(
+        key2,
+        this.zyfaiRpcUrls ? resolveRpcUrls(
+          this.zyfaiRpcUrls,
+          this.apiKey,
+          this.routingApiBaseUrl
+        ) : this.rpcUrls,
+        this.referralSource
+      );
     }
     if (agentId === "yieldseeker") {
       return new YieldseekerAgent(this.apiKey, {
         auth: { origin: this.yieldseekerSiweOrigin },
-        baseUrl: this.yieldseekerApiBaseUrl ?? getYieldseekerProxyBaseUrl(this.routingApiBaseUrl)
+        baseUrl: this.yieldseekerApiBaseUrl ?? getYieldseekerProxyBaseUrl(this.routingApiBaseUrl),
+        rpcUrls: this.rpcUrls
       });
     }
     return null;
@@ -5348,7 +5932,8 @@ var OwneySDK = class {
             );
             await this.approvePermit2(
               asset,
-              requiredAmount
+              requiredAmount,
+              cid
             );
             return batchTransfer(cid, transfers);
           }
@@ -5392,10 +5977,12 @@ var OwneySDK = class {
    * Invokes `agent.deposit` with the resolved sponsored callback, composing
    * two independent auto-recovery mechanisms:
    *
-   * 1. Missing Permit2 allowance: when the app did not supply its own
-   *    callback and the attempt fails with `PERMIT2_APPROVAL_REQUIRED` on a
-   *    token deposit, this is the wallet's first Permit2 deposit for that token. We send
-   *    the one-time (user-paid) Permit2 approval via `approvePermit2()` and
+   * 1. Missing Permit2 allowance outside the atomic Base-USDC path: when the
+   *    app did not supply its own callback and the attempt fails with
+   *    `PERMIT2_APPROVAL_REQUIRED`, this is the wallet's first Permit2 deposit
+   *    for that token. Base USDC bundles a gasless ERC-2612 approval inside
+   *    its sponsored deposit and never reaches this branch. Other tokens send
+   *    the one-time user-paid Permit2 approval via `approvePermit2()` and
    *    retry the SAME sponsored attempt once. Bounded to one approval attempt
    *    per call so a wallet/agent that keeps reporting the allowance as
    *    missing can't loop forever. If `approvePermit2()` itself throws (e.g.
@@ -5438,7 +6025,8 @@ var OwneySDK = class {
           );
           await this.approvePermit2(
             asset,
-            BigInt(amount)
+            BigInt(amount),
+            chainId
           );
           continue;
         }
@@ -5585,6 +6173,32 @@ var OwneySDK = class {
     }
     return eligible;
   }
+  /**
+   * Run owner-approved withdrawals before relayer-only withdrawals. Wallet
+   * approval is the only point at which the user can cancel the aggregate
+   * operation, so no relayer leg should commit before it has completed.
+   */
+  orderAgentsForWithdrawal(agents) {
+    return agents.map((agent, index) => ({ agent, index })).sort((left, right) => {
+      const approvalOrder = Number(Boolean(right.agent.withdrawalRequiresWalletApproval)) - Number(Boolean(left.agent.withdrawalRequiresWalletApproval));
+      return approvalOrder || left.index - right.index;
+    }).map(({ agent }) => agent);
+  }
+  isUserRejectedWithdrawal(error) {
+    let current = error;
+    const seen = /* @__PURE__ */ new Set();
+    while (current && typeof current === "object" && !seen.has(current)) {
+      seen.add(current);
+      const candidate = current;
+      if (candidate.code === 4001 || candidate.code === "4001") return true;
+      const message = [candidate.message, candidate.shortMessage].filter((value) => typeof value === "string").join(" ");
+      if (/user (?:rejected|denied)|rejected by user/i.test(message)) {
+        return true;
+      }
+      current = candidate.cause;
+    }
+    return false;
+  }
   // --- Fund operations ---
   /**
    * Withdraw funds from a specific agent, or all agents that support the active chain+asset if agentId is omitted.
@@ -5596,7 +6210,14 @@ var OwneySDK = class {
    * @returns {AgentWithdrawResult} for a single agent, or {OwneyWithdrawResult} with per-agent results
    */
   async withdraw(options) {
-    const { asset, amount, agentId } = options;
+    const { asset, amount, agentId, onAgentResult } = options;
+    const notifyAgentResult = (id, result) => {
+      try {
+        onAgentResult?.(id, result);
+      } catch (error) {
+        console.warn("Withdrawal result observer failed:", error);
+      }
+    };
     const state = this.requireState();
     const chainId = this.requireChainId();
     const token = asset;
@@ -5612,21 +6233,26 @@ var OwneySDK = class {
     if (agentId) {
       const agent = this.getAgent(agentId);
       this.validateAssetSupport(agent, chainId, asset);
-      return withFailureReporting(
+      const result = await withFailureReporting(
         this.apiKey,
         agent.id,
         () => agent.withdraw(state, chainId, token, amount),
         this.routingApiBaseUrl
       );
+      notifyAgentResult(agent.id, result);
+      return result;
     }
     const eligibleAgents = this.getEligibleAgents(chainId, asset);
+    const withdrawalAgents = this.orderAgentsForWithdrawal(eligibleAgents);
     if (!amount) {
       const results2 = {};
       const agentErrors2 = {};
-      for (const agent of eligibleAgents) {
+      for (const agent of withdrawalAgents) {
         try {
           results2[agent.id] = await agent.withdraw(state, chainId, token);
+          notifyAgentResult(agent.id, results2[agent.id]);
         } catch (err) {
+          if (this.isUserRejectedWithdrawal(err)) throw err;
           console.error(`withdraw failed for agent "${agent.id}":`, err);
           agentErrors2[agent.id] = err instanceof Error ? err.message : String(err);
           const code = err instanceof OwneyError ? err.code : "SDK_AGENT_FAILURE";
@@ -5707,12 +6333,13 @@ var OwneySDK = class {
       planned: 0n
     }));
     const plans = [...disabledPlans, ...enabledPlans];
+    const orderedPlans = this.orderAgentsForWithdrawal(plans.map((p) => p.agent)).map((agent) => plans.find((plan) => plan.agent === agent));
     const results = {};
     const agentErrors = {
       ...aggregated.agentErrors ?? {}
     };
-    for (let i = 0; i < plans.length; i++) {
-      const p = plans[i];
+    for (let i = 0; i < orderedPlans.length; i++) {
+      const p = orderedPlans[i];
       if (p.planned === 0n) continue;
       try {
         results[p.agent.id] = await p.agent.withdraw(
@@ -5721,7 +6348,9 @@ var OwneySDK = class {
           token,
           p.planned.toString()
         );
+        notifyAgentResult(p.agent.id, results[p.agent.id]);
       } catch (err) {
+        if (this.isUserRejectedWithdrawal(err)) throw err;
         console.error(`withdraw failed for agent "${p.agent.id}":`, err);
         agentErrors[p.agent.id] = err instanceof Error ? err.message : String(err);
         const code = err instanceof OwneyError ? err.code : "SDK_AGENT_FAILURE";
@@ -5733,7 +6362,7 @@ var OwneySDK = class {
         );
         const failedAmount = p.planned;
         p.planned = 0n;
-        redistributeShare(plans, i, failedAmount);
+        redistributeShare(orderedPlans, i, failedAmount);
       }
     }
     if (Object.keys(results).length === 0) {
@@ -5843,23 +6472,11 @@ var OwneySDK = class {
       const agent = this.getAgent(agentId);
       return this.readAgent(agent, "earnings", () => agent.getEarnings(state, chainId));
     }
-    let totalEarnings = 0;
-    const results = {};
     const entries = [...this.getActiveAgents().entries()];
-    const earningsResults = await Promise.all(
-      entries.map(async ([id, agent]) => {
-        const e = await this.readAgent(agent, "earnings", () => agent.getEarnings(state, chainId));
-        return [id, e];
-      })
+    return this.aggregateEarnings(
+      entries,
+      (agent) => this.readAgent(agent, "earnings", () => agent.getEarnings(state, chainId))
     );
-    for (const [id, e] of earningsResults) {
-      results[id] = e;
-      totalEarnings += Number(e.lifetimeEarnings);
-    }
-    return {
-      totalEarnings: String(totalEarnings),
-      agentEarnings: results
-    };
   }
   /**
    * Return refreshed earnings while letting each agent own its refresh policy.
@@ -5874,18 +6491,42 @@ var OwneySDK = class {
       () => agent.refreshEarnings?.(state, chainId) ?? agent.getEarnings(state, chainId)
     );
     if (agentId) return refreshAgent(this.getAgent(agentId));
-    let totalEarnings = 0;
+    return this.aggregateEarnings([...this.getActiveAgents().entries()], refreshAgent);
+  }
+  async aggregateEarnings(entries, read2) {
+    const settled = await Promise.allSettled(entries.map(([, agent]) => read2(agent)));
     const agentEarnings = {};
-    const refreshed = await Promise.all(
-      [...this.getActiveAgents().entries()].map(
-        async ([id, agent]) => [id, await refreshAgent(agent)]
-      )
-    );
-    for (const [id, earnings] of refreshed) {
-      agentEarnings[id] = earnings;
-      totalEarnings += Number(earnings.lifetimeEarnings);
+    const agentErrors = {};
+    const agentRetryAt = {};
+    const failures = [];
+    let totalEarnings = 0;
+    for (let i = 0; i < settled.length; i++) {
+      const [id] = entries[i];
+      const result = settled[i];
+      if (result.status === "fulfilled") {
+        agentEarnings[id] = result.value;
+        totalEarnings += Number(result.value.lifetimeEarnings);
+        continue;
+      }
+      const reason = result.reason;
+      failures.push(reason);
+      const retryDelay = rateLimitDelay(reason);
+      if (retryDelay !== void 0) agentRetryAt[id] = Date.now() + retryDelay;
+      agentErrors[id] = reason instanceof Error ? reason.message : String(reason);
+      console.error(`[owney-sdk] Earnings fetch failed for agent "${id}":`, reason);
     }
-    return { totalEarnings: String(totalEarnings), agentEarnings };
+    if (entries.length > 0 && Object.keys(agentEarnings).length === 0) {
+      throw new OwneyError(
+        "EARNINGS_ALL_FAILED",
+        "Failed to fetch earnings for all active agents.",
+        { agentErrors, failures }
+      );
+    }
+    return {
+      totalEarnings: String(totalEarnings),
+      agentEarnings,
+      ...Object.keys(agentErrors).length > 0 ? { agentErrors, agentRetryAt } : {}
+    };
   }
   /**
    * Get the weighted APY for the user's account over a time period.
@@ -6159,16 +6800,18 @@ var OwneySDK = class {
   }
   /**
    * User-paid approval of Permit2 on the selected token for the active chain.
-   * Approves exactly the pending deposit amount. Another approval is required
-   * for a later deposit once this allowance has been consumed. Resolves after
-   * one confirmation so the subsequent deposit attempt sees the new allowance.
+   * Grants the maximum ERC20 allowance so later deposits do not require another
+   * approval. Resolves after one confirmation so the subsequent deposit attempt
+   * sees the new allowance. Deposit retries pass their captured chain id so a
+   * concurrent activation cannot redirect the approval to another network.
    *
    * @param requiredAmount Raw base-unit amount the pending deposit must cover.
+   * @param expectedChainId Chain captured by the deposit that requested approval.
    * @returns the approval transaction hash.
    */
-  async approvePermit2(asset = "WETH", requiredAmount = 0n) {
+  async approvePermit2(asset = "WETH", requiredAmount = 0n, expectedChainId) {
     const state = this.requireState();
-    const chainId = this.requireChainId();
+    const chainId = expectedChainId ?? this.requireChainId();
     this.getEligibleAgents(chainId, asset, { excludeDisabled: true });
     const token = sponsoredTokensFor(asset)[chainId];
     if (!token) {
@@ -6178,16 +6821,18 @@ var OwneySDK = class {
       );
     }
     const provider = this.requireConnectedProvider();
-    const publicClient = createPublicClient4({
+    const walletChainClient = createPublicClient4({
       chain: VIEM_CHAIN2[chainId],
       transport: custom3(provider)
     });
+    const publicClient = this.getPaidRpcClient(chainId);
     const approvalAmount = permit2ApprovalAmount(requiredAmount);
     const wallet = createWalletClient3({
       account: state.walletAddress,
       chain: VIEM_CHAIN2[chainId],
       transport: custom3(provider)
     });
+    await ensureWalletOnChain(walletChainClient, wallet, chainId);
     const hash = await wallet.writeContract({
       address: token,
       abi: ERC20_ALLOWANCE_ABI,
@@ -6196,14 +6841,53 @@ var OwneySDK = class {
       account: state.walletAddress,
       chain: VIEM_CHAIN2[chainId]
     });
-    const receipt = await publicClient.waitForTransactionReceipt({
-      hash,
-      confirmations: 1
-    });
+    const receipt = await withPaidRpcDiagnostics(
+      () => publicClient.waitForTransactionReceipt({
+        hash,
+        confirmations: 1
+      }),
+      chainId,
+      "eth_getTransactionReceipt"
+    );
     if (receipt.status !== "success") {
       throw new Error(`Permit2 approval reverted (tx ${hash})`);
     }
-    return hash;
+    let observedAllowance = 0n;
+    let verificationError;
+    for (let attempt = 0; attempt < PERMIT2_ALLOWANCE_VERIFY_ATTEMPTS; attempt += 1) {
+      try {
+        observedAllowance = await readPermit2Allowance(
+          publicClient,
+          token,
+          state.walletAddress,
+          attempt === 0 ? receipt.blockNumber : void 0
+        );
+        verificationError = void 0;
+        if (observedAllowance >= requiredAmount) return hash;
+      } catch (error) {
+        verificationError = error;
+      }
+      if (attempt + 1 < PERMIT2_ALLOWANCE_VERIFY_ATTEMPTS) {
+        await new Promise(
+          (resolve) => setTimeout(resolve, PERMIT2_ALLOWANCE_VERIFY_DELAY_MS)
+        );
+      }
+    }
+    throw new OwneyError(
+      "PERMIT2_APPROVAL_REQUIRED",
+      "Permit2 approval was confirmed, but the required token allowance was not observable.",
+      {
+        approvalConfirmed: true,
+        approvalTxHash: hash,
+        owner: state.walletAddress,
+        token,
+        spender: PERMIT2_ADDRESS,
+        chainId,
+        requiredAmount: requiredAmount.toString(),
+        observedAllowance: observedAllowance.toString(),
+        ...verificationError instanceof Error ? { verificationError: verificationError.message } : {}
+      }
+    );
   }
   // --- Discovery (no wallet required) ---
   /**