@owney/sdk 0.7.32-beta.1 → 0.7.32-beta.4

package/dist/index.js

@@ -8,10 +8,13 @@ import {
   PERMIT2_BATCH_ABI,
   batchArgs,
   batchTypedData,
+  discardHashlessTokenBatch,
+  dropExpiredHashlessTokenBatch,
   erc2612TypedData,
   finishTokenBatchFamily,
   loadTokenBatchFamily,
   saveTokenBatchAttempt,
+  savedTokenBatchBody,
   supportsSponsoredErc2612,
   tokenBatchClear,
   tokenBatchKey,
@@ -19,7 +22,7 @@ import {
   tokenBatchStoredBody,
   tokenBatchWrite,
   validateTokenBatchAttempt
-} from "./chunk-YBMCUL5D.js";
+} from "./chunk-CW55W2WO.js";
 
 // src/lib/funding-evidence.ts
 import { decodeEventLog, decodeFunctionData, erc20Abi, parseAbi } from "viem";
@@ -356,25 +359,41 @@ async function observeTokenBatchFamily(input) {
 }
 
 // src/lib/swap/swap.observation.ts
-var active = /* @__PURE__ */ new Set();
-var isOrderObserved = (key2) => active.has(key2);
-async function observeOrder(key2, run) {
+var claims = /* @__PURE__ */ new Map();
+var watches = /* @__PURE__ */ new Map();
+var isOrderObserved = (key2) => claims.has(key2) || watches.has(key2);
+function claimOrder(key2) {
+  claims.set(key2, (claims.get(key2) ?? 0) + 1);
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    const left = (claims.get(key2) ?? 1) - 1;
+    if (left > 0) claims.set(key2, left);
+    else claims.delete(key2);
+  };
+}
+async function observeOrder(key2, run, options = {}) {
   const busy = () => new OwneyError(
     "SWAP_REQUEST_FAILED",
     "This order is already being observed.",
     { orderHash: key2, watchActive: true, settlementUnconfirmed: true }
   );
-  if (active.has(key2)) throw busy();
-  active.add(key2);
+  if (options.wait) {
+    for (let other = watches.get(key2); other; other = watches.get(key2))
+      await other.catch(() => void 0);
+  } else if (watches.has(key2)) throw busy();
+  const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+  const name = `owney.swap.observe:${key2}`;
+  const watch = !locks ? run() : options.wait ? locks.request(name, () => run()) : locks.request(name, { ifAvailable: true }, (lock) => {
+    if (!lock) throw busy();
+    return run();
+  });
+  watches.set(key2, watch);
   try {
-    if (typeof navigator !== "undefined" && navigator.locks)
-      return await navigator.locks.request(`owney.swap.observe:${key2}`, { ifAvailable: true }, (lock) => {
-        if (!lock) throw busy();
-        return run();
-      });
-    return await run();
+    return await watch;
   } finally {
-    active.delete(key2);
+    if (watches.get(key2) === watch) watches.delete(key2);
   }
 }
 
@@ -529,7 +548,7 @@ function parseLeg(item) {
   const r = item;
   if (typeof r.legKey !== "string" || !r.legKey) return null;
   if (typeof r.status !== "string" || !r.status) return null;
-  return {
+  const leg = {
     legKey: r.legKey,
     agentType: strOrNull(r.agentType),
     status: r.status,
@@ -539,8 +558,11 @@ function parseLeg(item) {
     confirmedAt: strOrNull(r.confirmedAt),
     agentWallet: strOrNull(r.agentWallet),
     providerIndexedAt: strOrNull(r.providerIndexedAt),
-    providerBookedAt: strOrNull(r.providerBookedAt)
+    providerBookedAt: strOrNull(r.providerBookedAt),
+    providerRef: strOrNull(r.providerRef)
   };
+  if (r.closed === true) leg.closed = true;
+  return leg;
 }
 function parseRow(item) {
   if (!item || typeof item !== "object") return null;
@@ -960,7 +982,7 @@ var SnapshotHistory = class {
 };
 
 // src/lib/funding-ledger.ts
-var SDK_VERSION = "0.7.32-beta.1";
+var SDK_VERSION = "0.7.32-beta.4";
 var SCOPE2 = "funding-ledger";
 var REQUEST_TIMEOUT_MS2 = 5e3;
 var RETRY_DELAYS_MS = [1e3, 4e3, 16e3];
@@ -1210,13 +1232,213 @@ function buildReporter(config) {
         } catch (err) {
           debugLog(SCOPE2, `event failed: ${describeError2(err)}`);
         }
+      },
+      settle(timeoutMs) {
+        return new Promise((resolve) => {
+          let deadline;
+          const done = () => {
+            if (deadline !== void 0) clearTimeout(deadline);
+            resolve();
+          };
+          try {
+            flush();
+            deadline = setTimeout(done, Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 0);
+            unrefTimer(deadline);
+            chain2.then(done, done);
+          } catch (err) {
+            debugLog(SCOPE2, `settle failed: ${describeError2(err)}`);
+            done();
+          }
+        });
       }
     };
   }
 }
 
+// src/lib/zyfai-server-tasks.ts
+var SCOPE3 = "zyfai-server-tasks";
+var ZYFAI_SERVER_TASKS = 1;
+var ZYFAI_SERVER_TASKS_OFF_CODE = "ZYFAI_SERVER_TASKS_OFF";
+function zyfaiServerTasksEnabled(option) {
+  if (typeof option !== "function") return option === true;
+  try {
+    return option() === true;
+  } catch {
+    return false;
+  }
+}
+var ZYFAI_HANDOFF_FEATURE_OFF_CODES = /* @__PURE__ */ new Set([
+  "FUNDING_TASK_KIND_DISABLED",
+  "ZYFAI_NOT_CONFIGURED",
+  "PROBE_ONLY",
+  "HTTP_404",
+  "HTTP_401",
+  "HTTP_403",
+  ZYFAI_SERVER_TASKS_OFF_CODE
+]);
+var ZYFAI_HANDOFF_NO_TASK_CODES = /* @__PURE__ */ new Set([
+  ...ZYFAI_HANDOFF_FEATURE_OFF_CODES,
+  "ZYFAI_SESSION_MISMATCH",
+  "NEEDS_USER_SESSION"
+]);
+var UNCHECKED_NO_TASK_CODES = /* @__PURE__ */ new Set([
+  "HTTP_401",
+  "HTTP_403",
+  "HTTP_404",
+  ZYFAI_SERVER_TASKS_OFF_CODE
+]);
+function provesNoServerTask(code, afterLostAnswer) {
+  return ZYFAI_HANDOFF_NO_TASK_CODES.has(code) && !(afterLostAnswer && UNCHECKED_NO_TASK_CODES.has(code));
+}
+var ZYFAI_WITHDRAWAL_NOT_SENT_CODES = /* @__PURE__ */ new Set([
+  "PREREQUISITE_FAILED",
+  "PREREQUISITE_TIMEOUT",
+  "SUPERSEDED",
+  "ZYFAI_SESSION_MISMATCH",
+  "ZYFAI_REDEMPTION_IN_FLIGHT",
+  "NEEDS_USER_SESSION",
+  "NEEDS_USER_SESSION_KEY",
+  "ZYFAI_FORBIDDEN",
+  "WITHDRAW_INSUFFICIENT_BALANCE",
+  "WITHDRAWAL_IN_PROGRESS",
+  // The task's own agent:zyfai leg was already failed or confirmed (P4-8).
+  "LEG_CLOSED",
+  "MAX_ATTEMPTS",
+  "SECRET_UNREADABLE"
+]);
+var ZYFAI_REGISTRATION_NOT_SENT_CODES = /* @__PURE__ */ new Set([
+  "TRANSFER_NOT_SEEN",
+  "DEPOSIT_NOT_SENT",
+  "DEPOSIT_REVERTED",
+  "TRANSFER_MISMATCH",
+  "NEEDS_USER_SESSION",
+  "ZYFAI_REGISTRATION_REJECTED",
+  "MAX_ATTEMPTS",
+  "SECRET_UNREADABLE"
+]);
+var ZYFAI_TASK_LIFETIME_MS = {
+  zyfai_withdrawal: 72e5,
+  zyfai_deposit_registration: 36e5
+};
+var SESSION_MARGIN_MS = 3e5;
+var SESSION_SLACK_MS = 6e4;
+function sessionExp(session) {
+  try {
+    const parts = session.split(".");
+    if (parts.length !== 3) return void 0;
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
+    const claims2 = JSON.parse(decoded);
+    const exp = isRecord(claims2) ? claims2.exp : void 0;
+    return typeof exp === "number" && Number.isFinite(exp) ? exp : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function zyfaiSessionOutlivesTask(session, kind, nowMs = Date.now()) {
+  const lifetimeMs = Object.prototype.hasOwnProperty.call(ZYFAI_TASK_LIFETIME_MS, kind) ? ZYFAI_TASK_LIFETIME_MS[kind] : void 0;
+  if (typeof session !== "string" || lifetimeMs === void 0) return false;
+  const exp = sessionExp(session);
+  return exp !== void 0 && exp * 1e3 > nowMs + lifetimeMs + SESSION_MARGIN_MS + SESSION_SLACK_MS;
+}
+var DEFAULT_TIMEOUT_MS = 25e3;
+var DECLINED_STATUSES = /* @__PURE__ */ new Set([400, 401, 403, 404, 409, 429]);
+var ID = /^.{1,128}$/s;
+var TX_HASH = /^0x[0-9a-fA-F]{64}$/;
+var unknown = () => ({ type: "unknown" });
+var isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+function requestBody(body, session) {
+  const out = {
+    kind: body.kind,
+    operationId: body.operationId,
+    owner: body.owner,
+    chainId: body.chainId,
+    asset: body.asset,
+    amount: body.amount,
+    agentWallet: body.agentWallet,
+    zyfaiSession: session
+  };
+  if (body.after !== void 0) out.after = body.after;
+  if (body.runNow !== void 0) out.runNow = body.runNow;
+  return out;
+}
+function taskResult(value) {
+  const result = {};
+  if (!isRecord(value)) return result;
+  if (typeof value.providerWithdrawalId === "string" && ID.test(value.providerWithdrawalId))
+    result.providerWithdrawalId = value.providerWithdrawalId;
+  if (typeof value.providerDepositId === "string" && ID.test(value.providerDepositId))
+    result.providerDepositId = value.providerDepositId;
+  if (typeof value.txHash === "string" && TX_HASH.test(value.txHash)) result.txHash = value.txHash;
+  if (value.asyncPending === true) result.asyncPending = true;
+  if (value.handedOff === "reconciler") result.handedOff = "reconciler";
+  if (value.lifecycle === "failed") result.lifecycle = "failed";
+  return result;
+}
+function answerOf(payload) {
+  if (!isRecord(payload) || payload.success !== true || !isRecord(payload.data)) return unknown();
+  const data = payload.data;
+  if (data.accepted === false)
+    return typeof data.code === "string" && data.code ? { type: "declined", code: data.code } : unknown();
+  if (data.accepted !== true || typeof data.taskId !== "string" || !data.taskId || typeof data.state !== "string" || !data.state) return unknown();
+  return {
+    type: "accepted",
+    taskId: data.taskId,
+    state: data.state,
+    ...typeof data.code === "string" && data.code ? { code: data.code } : {},
+    result: taskResult(data.result)
+  };
+}
+async function handOffZyfaiTask(cfg, body, session) {
+  if (cfg?.zyfaiServerTasks !== true) return { type: "declined", code: ZYFAI_SERVER_TASKS_OFF_CODE };
+  let timer;
+  try {
+    const controller = new AbortController();
+    const timeoutMs = typeof cfg.timeoutMs === "number" && Number.isFinite(cfg.timeoutMs) && cfg.timeoutMs > 0 ? cfg.timeoutMs : DEFAULT_TIMEOUT_MS;
+    const url = `${getRoutingApiBaseUrl(cfg.baseUrl).replace(/\/$/, "")}/api/v1/funding/zyfai-tasks`;
+    const timedOut = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve("timeout");
+      }, timeoutMs);
+      timer.unref?.();
+    });
+    const exchange = (async () => {
+      const res = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-owney-api-key": cfg.apiKey },
+        body: JSON.stringify(requestBody(body, session)),
+        signal: controller.signal,
+        // The body carries the session: never follow a redirect to another host.
+        redirect: "error"
+      });
+      if (DECLINED_STATUSES.has(res.status)) return { type: "declined", code: `HTTP_${res.status}` };
+      if (res.status !== 200) {
+        debugLog(SCOPE3, `handoff answered ${res.status}`);
+        return unknown();
+      }
+      return answerOf(await res.json());
+    })();
+    exchange.catch(() => {
+    });
+    const answer = await Promise.race([exchange, timedOut]);
+    if (answer === "timeout") {
+      debugLog(SCOPE3, "handoff timed out");
+      return unknown();
+    }
+    debugLog(SCOPE3, `handoff ${answer.type}`);
+    return answer;
+  } catch {
+    debugLog(SCOPE3, "handoff failed");
+    return unknown();
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+
 // src/lib/withdrawal-reservation.ts
-var SCOPE3 = "withdrawal-reservation";
+var SCOPE4 = "withdrawal-reservation";
 var CLAIM_TIMEOUT_MS = 4e3;
 var HEARTBEAT_INTERVAL_MS = 6e4;
 var HOLDER_TIMEOUT_MS = 5e3;
@@ -1314,7 +1536,7 @@ function compact2(obj) {
 async function claimWithdrawalReservation(cfg, input) {
   const result = await claimOnce(cfg, input);
   if (result.status === "unavailable" && result.httpStatus === 403 && input.supersedes) {
-    debugLog(SCOPE3, "claim 403 with supersedes: retrying without it");
+    debugLog(SCOPE4, "claim 403 with supersedes: retrying without it");
     const { supersedes: _dropped, ...rest } = input;
     const retried = await claimOnce(cfg, rest);
     return retried.status === "claimed" ? { ...retried, supersedesDropped: true } : retried;
@@ -1341,7 +1563,7 @@ async function claimOnce(cfg, input) {
     res = await post(cfg, endpoint(cfg), body, CLAIM_TIMEOUT_MS);
   } catch (err) {
     const reason = err instanceof RequestTimeout ? "timeout" : "network";
-    debugLog(SCOPE3, `claim ${reason}: ${describeError3(err)}`);
+    debugLog(SCOPE4, `claim ${reason}: ${describeError3(err)}`);
     return { status: "unavailable", reason };
   }
   if (!res) return { status: "unavailable", reason: "network" };
@@ -1357,7 +1579,7 @@ async function claimOnce(cfg, input) {
     }
   }
   if (!res.ok) {
-    debugLog(SCOPE3, `claim ${res.status}`);
+    debugLog(SCOPE4, `claim ${res.status}`);
     return { status: "unavailable", reason: "http", httpStatus: res.status };
   }
   const data = unwrap2(res.body);
@@ -1392,12 +1614,12 @@ async function holderRequest(cfg, operationId, action, body, retryDelays = []) {
       if (res.ok) return "ok";
       if (res.status === 404) return "gone";
       if (res.status < 500 && res.status !== 429) {
-        debugLog(SCOPE3, `${action} rejected with ${res.status}`);
+        debugLog(SCOPE4, `${action} rejected with ${res.status}`);
         return "rejected";
       }
-      debugLog(SCOPE3, `${action} ${res.status}`);
+      debugLog(SCOPE4, `${action} ${res.status}`);
     } catch (err) {
-      debugLog(SCOPE3, `${action} failed: ${describeError3(err)}`);
+      debugLog(SCOPE4, `${action} failed: ${describeError3(err)}`);
     }
     if (attempt < retryDelays.length) {
       await new Promise((resolve) => unrefTimer2(setTimeout(resolve, retryDelays[attempt])));
@@ -1570,6 +1792,8 @@ function ledgerLegFromEvidence(e, kind) {
   if (e.callsId && e.callsId.length <= 200) leg.callsId = e.callsId;
   if (isUint(e.confirmedAmount)) leg.confirmedAmountRaw = e.confirmedAmount;
   if (e.blockNumber && /^\d{1,19}$/.test(e.blockNumber)) leg.blockNumber = e.blockNumber;
+  const providerRef = e.withdrawalRequest?.providerWithdrawalId || e.providerDepositId;
+  if (typeof providerRef === "string" && providerRef.length >= 1 && providerRef.length <= 128) leg.providerRef = providerRef;
   const failure = e.withdrawalRequest?.failure;
   if (failure) leg.errorCode = failure.toUpperCase().replace(/-/g, "_");
   return leg;
@@ -1597,6 +1821,12 @@ function withdrawalLedgerRail(e) {
     return e.userOpHash ? "yieldseeker_userop" : e.callsId ? "yieldseeker_wallet_calls" : e.txHash ? "yieldseeker_paid" : void 0;
   return void 0;
 }
+function depositLedgerRail(e) {
+  if (e.callsId) return "wallet_calls";
+  if (e.depositAuthorization || e.serverBroadcast) return "permit2_batch";
+  return void 0;
+}
+var FUNDING_DEPOSIT_RECOVERY_REPORT = 1;
 var SWAP_LEDGER_RAILS = {
   classic: "swap_classic",
   fusion: "swap_fusion",
@@ -1664,6 +1894,12 @@ var TRANSFER_EVENT = getAbiItem({
   abi: parseAbi2(["event Transfer(address indexed from, address indexed to, uint256 value)"]),
   name: "Transfer"
 });
+var acceptedChunk = /* @__PURE__ */ new Map();
+var acceptedChunkByClient = /* @__PURE__ */ new WeakMap();
+function providerKey(client) {
+  const { chain: chain2, transport } = client;
+  return typeof chain2?.id === "number" ? `${chain2.id}:${typeof transport?.url === "string" ? transport.url : ""}` : void 0;
+}
 function parseBlock(value) {
   if (value === void 0 || value === null) return void 0;
   return typeof value === "string" && /^\d{1,19}$/.test(value) ? BigInt(value) : null;
@@ -1688,11 +1924,12 @@ async function scanWithdrawalPayouts(client, input) {
   const candidates = [];
   if (start > end) {
     const kept = input.cursor ?? (start > 0n ? start - 1n : 0n);
-    return { candidates, scannedTo: kept.toString() };
+    return { candidates, scannedTo: kept.toString(), caughtUp: true };
   }
   const tokenAddress = input.token.toLowerCase();
   const owner = input.owner.toLowerCase();
-  let size = PAYOUT_SCAN_CHUNK_BLOCKS;
+  const key2 = providerKey(client);
+  let size = (key2 !== void 0 ? acceptedChunk.get(key2) : acceptedChunkByClient.get(client)) ?? PAYOUT_SCAN_CHUNK_BLOCKS;
   let from = start;
   let scannedTo = start - 1n;
   for (let requests = 0; from <= end && requests < MAX_CHUNKS_PER_SCAN; ) {
@@ -1707,12 +1944,21 @@ async function scanWithdrawalPayouts(client, input) {
         toBlock: to
       });
     } catch (error) {
-      if (size > 1n && !isRateLimited(error) && isRangeError(error)) {
-        size /= 2n;
-        continue;
+      if (!isRateLimited(error) && isRangeError(error)) {
+        const requested = to - from + 1n;
+        const allowed = allowedRange(error);
+        const next = allowed !== void 0 && allowed < requested ? allowed : requested / 2n;
+        if (next >= 1n && next < requested) {
+          size = next;
+          continue;
+        }
       }
       throw error;
     }
+    if (size < PAYOUT_SCAN_CHUNK_BLOCKS) {
+      if (key2 !== void 0) acceptedChunk.set(key2, size);
+      else acceptedChunkByClient.set(client, size);
+    }
     check();
     requests++;
     for (const log of logs) {
@@ -1730,7 +1976,8 @@ async function scanWithdrawalPayouts(client, input) {
     scannedTo = to;
     from = to + 1n;
   }
-  return { candidates, scannedTo: (scannedTo < 0n ? 0n : scannedTo).toString() };
+  const stalled = input.cursor !== void 0 && scannedTo <= input.cursor;
+  return { candidates, scannedTo: (scannedTo < 0n ? 0n : scannedTo).toString(), caughtUp: from > end || stalled };
 }
 async function estimateBlockAt(client, latest, targetMs) {
   const head = await client.getBlock({ blockNumber: latest });
@@ -1755,6 +2002,7 @@ function causeChain(error) {
     chain2.push({
       code: value.code,
       status: value.status,
+      data: value.data,
       text: [value.message, value.details, value.shortMessage].filter((part) => typeof part === "string").join(" ")
     });
     current = value.cause;
@@ -1764,6 +2012,14 @@ function causeChain(error) {
 function isRateLimited(error) {
   return causeChain(error).some((entry) => entry.status === 429 || entry.code === 429 || /rate|too many requests/i.test(entry.text));
 }
+function allowedRange(error) {
+  for (const entry of causeChain(error)) {
+    const hinted = entry.data && typeof entry.data === "object" ? entry.data.maxBlockRange : void 0;
+    const value = typeof hinted === "number" ? hinted : Number(/"maxBlockRange"\s*:\s*(\d+)/.exec(entry.text)?.[1]);
+    if (Number.isSafeInteger(value) && value >= 1) return BigInt(value);
+  }
+  return void 0;
+}
 function isRangeError(error) {
   return causeChain(error).some((entry) => entry.code === -32005 || /block range|range (is )?too (large|wide|big)|range limit|exceed(s|ed)? .*(range|limit|results)|too many (results|logs|blocks)|response size|query returned more than|max(imum)? .*blocks/i.test(entry.text));
 }
@@ -1869,6 +2125,7 @@ async function getSponsorRelayerAddress(input) {
   return parsed.data.relayer;
 }
 async function postSponsorBatchTransfer(input) {
+  const flaggedPrepare = input.body.serverBroadcast === true && !input.body.serializedTransaction;
   let res;
   try {
     res = await fetch(
@@ -1887,7 +2144,7 @@ async function postSponsorBatchTransfer(input) {
     throw new OwneyError(
       "SPONSOR_REQUEST_FAILED",
       "Deposit status is unknown. Retry the same amount to check it.",
-      { safeToFallback: false }
+      { safeToFallback: false, ...flaggedPrepare ? { outcomeUnknown: true } : {} }
     );
   }
   const parsed = await res.json().catch(() => null);
@@ -1898,7 +2155,13 @@ async function postSponsorBatchTransfer(input) {
       {
         statusCode: res.status,
         safeToFallback: false,
-        notSubmitted: parsed?.notSubmitted === true || parsed?.error?.notSubmitted === true || parsed?.error?.details?.notSubmitted === true
+        notSubmitted: parsed?.notSubmitted === true || parsed?.error?.notSubmitted === true || parsed?.error?.details?.notSubmitted === true,
+        // Another authorization of this operation is being sent by the
+        // server (409, nothing signed).
+        ...parsed?.code === "DEPOSIT_ALREADY_SENDING" ? { code: "DEPOSIT_ALREADY_SENDING" } : {},
+        // No definitive answer (5xx, an unreadable or malformed body): the
+        // server may have accepted it. A 4xx with a body is a refusal.
+        ...flaggedPrepare && (res.status >= 500 || parsed === null || res.ok) ? { outcomeUnknown: true } : {}
       }
     );
   }
@@ -1915,19 +2178,19 @@ async function postSponsorBatchRecovery(input) {
     input.signal?.throwIfAborted();
     if (!response.ok || payload?.success !== true) throw failure();
     const value = payload.data;
-    const { isAddress: isAddress5, keccak256: keccak2564, parseTransaction: parseTransaction3, recoverTransactionAddress } = await import("viem");
-    const { validateTokenBatchAttempt: validateTokenBatchAttempt2 } = await import("./token-batch-family-EKOLMSTD.js");
+    const { isAddress: isAddress6, keccak256: keccak2564, parseTransaction: parseTransaction3, recoverTransactionAddress } = await import("viem");
+    const { validateTokenBatchAttempt: validateTokenBatchAttempt2 } = await import("./token-batch-family-TUGZWETV.js");
     const phase = input.body.phase;
     const original = phase === "approval" ? input.body.serializedPermitTransaction : input.body.serializedTransaction;
     if (!original) throw failure();
     const hash2 = keccak2564(original), relayer = await recoverTransactionAddress({ serializedTransaction: original });
-    const validHash = (v) => typeof v === "string" && /^0x[\da-f]{64}$/i.test(v);
-    if (!value || value.protocol !== 1 || value.phase !== phase || !validHash(value.txHash) || !isAddress5(value.relayer) || value.relayer.toLowerCase() !== relayer.toLowerCase()) throw failure();
+    const validHash2 = (v) => typeof v === "string" && /^0x[\da-f]{64}$/i.test(v);
+    if (!value || value.protocol !== 1 || value.phase !== phase || !validHash2(value.txHash) || !isAddress6(value.relayer) || value.relayer.toLowerCase() !== relayer.toLowerCase()) throw failure();
     if (value.status !== "prepared" && value.txHash.toLowerCase() !== hash2.toLowerCase()) throw failure();
     if (value.status === "unresolved") {
       if (!["nonce-not-consumed", "authorization-used", "authorization-expired", "state-unavailable", "preparation-rejected", "relayer-changed"].includes(value.reason)) throw failure();
     } else {
-      if (!("blockNumber" in value) || typeof value.blockNumber !== "string" || !/^\d{1,78}$/.test(value.blockNumber) || BigInt(value.blockNumber) >= 1n << 256n || !validHash(value.blockHash)) throw failure();
+      if (!("blockNumber" in value) || typeof value.blockNumber !== "string" || !/^\d{1,78}$/.test(value.blockNumber) || BigInt(value.blockNumber) >= 1n << 256n || !validHash2(value.blockHash)) throw failure();
       if (value.status === "prepared") {
         if (value.predecessorHash?.toLowerCase() !== hash2.toLowerCase()) throw failure();
         const tx = parseTransaction3(value.serializedTransaction), old = parseTransaction3(original);
@@ -2225,10 +2488,19 @@ var AgentReads = class {
   }
 };
 
+// src/agents/zyfai/zyfai.session-errors.ts
+var SESSION_REJECTED = /(?:^|: )Unauthorized: (?:(?:Invalid or expired user session|Missing user session)\b.*|Invalid API key)$/;
+function isZyfaiSessionRejected(message) {
+  return SESSION_REJECTED.test(message);
+}
+
 // src/agents/zyfai/zyfai.withdraw-submission.ts
 var BELOW_MINIMUM = /^Idle balance (\d+(?:\.\d+)?) (USDC|WETH|ETH|EURC) is below the minimum withdrawal of (\d+(?:\.\d+)?) \2\.?$/;
 var listenersByClient = /* @__PURE__ */ new WeakMap();
-function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent) {
+var ZYFAI_WITHDRAW_DISPATCH_CHECKPOINT = 1;
+var MAX_WITHDRAWAL_ID_LENGTH = 128;
+var WITHDRAWAL_PATHS = { get: "/users/withdraw/v2", post: "/users/partial-withdraw/v2" };
+function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent, beforeDispatch) {
   const client = sdk.httpClient;
   if (!client || typeof client.get !== "function" || typeof client.post !== "function")
     return {
@@ -2248,7 +2520,7 @@ function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent) {
       const original = client[method];
       client[method] = async function(...args) {
         const [url, options] = args;
-        const withdrawal = method === "get" && url === "/users/withdraw" || method === "post" && url === "/users/partial-withdraw";
+        const withdrawal = url === WITHDRAWAL_PATHS[method];
         const payload = method === "get" ? options?.params : options;
         const matching = withdrawal ? [...observers].filter((observer) => observer.chainId === payload?.chainId && observer.token === payload?.tokenSymbol) : [];
         for (const observer of matching) observer.assertCurrent?.();
@@ -2256,8 +2528,12 @@ function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent) {
         const request3 = {
           attempted: true,
           method: method === "get" ? "GET" : "POST",
-          path: method === "get" ? "/users/withdraw" : "/users/partial-withdraw"
+          path: WITHDRAWAL_PATHS[method]
         };
+        if (withdrawal) {
+          for (const observer of matching) await observer.beforeDispatch?.({ ...request3 });
+          for (const observer of matching) observer.assertCurrent?.();
+        }
         let belowMinimum2;
         const notify2 = (outcome) => {
           if (outcome === "rejected" && matching.length !== 1) return;
@@ -2291,7 +2567,13 @@ function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent) {
           ] };
         }
         try {
-          return await original.apply(this, callArgs);
+          const result = await original.apply(this, callArgs);
+          if (withdrawal) {
+            const id = result?.id;
+            if (typeof id === "string" && id.length >= 1 && id.length <= MAX_WITHDRAWAL_ID_LENGTH)
+              request3.providerWithdrawalId = id;
+          }
+          return result;
         } catch (error) {
           const message = error instanceof Error ? error.message : "";
           const minimum = BELOW_MINIMUM.exec(message);
@@ -2299,7 +2581,7 @@ function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent) {
           const status = error?.response?.status;
           if (request3.httpStatus === void 0 && typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599)
             request3.httpStatus = status;
-          request3.failure = message === "Unauthorized: Invalid API key" ? "unauthorized" : message === "Forbidden: Access denied" ? "forbidden" : message === "Rate limit exceeded. Please try again later." ? "rate-limited" : request3.httpStatus === 400 && message === "No balance to withdraw" ? "insufficient-balance" : minimum ? "insufficient-balance" : /^User doesn't have any active session key\.?$/.test(message) ? "session-key-missing" : method === "post" && request3.httpStatus === 400 && message === "Partial withdrawal already in progress" ? "withdrawal-in-progress" : message === "Network error: Unable to reach the server" ? "network" : "other";
+          request3.failure = isZyfaiSessionRejected(message) && (request3.httpStatus === void 0 || request3.httpStatus === 401) ? "unauthorized" : message === "Forbidden: Access denied" ? "forbidden" : message === "Rate limit exceeded. Please try again later." ? "rate-limited" : request3.httpStatus === 400 && message === "No balance to withdraw" ? "insufficient-balance" : minimum ? "insufficient-balance" : /^User doesn't have any active session key\.?$/.test(message) ? "session-key-missing" : method === "post" && request3.httpStatus === 400 && message === "Partial withdrawal already in progress" ? "withdrawal-in-progress" : message === "Network error: Unable to reach the server" ? "network" : "other";
           if (["unauthorized", "forbidden", "rate-limited", "insufficient-balance", "session-key-missing", "withdrawal-in-progress"].includes(request3.failure) && (request3.httpStatus === void 0 || request3.httpStatus >= 400 && request3.httpStatus < 500)) notify2("rejected");
           throw error;
         } finally {
@@ -2313,7 +2595,7 @@ function observeWithdrawalSubmission(sdk, chainId, token, assertCurrent) {
   let rejected = false;
   let request2 = { attempted: false };
   let belowMinimum;
-  const listener = { chainId, token, assertCurrent, notify: (outcome, evidence, detail) => {
+  const listener = { chainId, token, assertCurrent, beforeDispatch, notify: (outcome, evidence, detail) => {
     request2 = evidence;
     if (outcome === "attempted") submitted = true;
     else if (outcome === "rejected") {
@@ -2454,7 +2736,7 @@ async function submitZyfaiDeposit({ sdk, state, chain: chain2, amount, asset, sm
   if (!token || !isAddress(owner) || !isAddress(smartWallet) || !/^\d+$/.test(amount) || BigInt(amount) <= 0n)
     throw new OwneyError("AGENT_INVALID_RESPONSE", "Invalid Zyfai deposit transfer.", { chainId: chain2.id, asset }, "zyfai");
   assertCurrent();
-  const prepared = await sdk.prepareEnterPosition({ userAddress: owner, chainId: chain2.id, amount, asset, strategy: "aggressive" });
+  const prepared = await sdk.prepareDeposit({ userAddress: owner, chainId: chain2.id, amount, asset });
   assertCurrent();
   const expectedData = encodeFunctionData({ abi: erc20Abi2, functionName: "transfer", args: [smartWallet, BigInt(amount)] });
   const transfer = prepared?.transfer;
@@ -2536,6 +2818,13 @@ function tokenDecimals(symbol2, explicit) {
     return explicit;
   return DECIMALS_BY_SYMBOL[(symbol2 ?? "").toLowerCase()] ?? 6;
 }
+function decodeDeltaAmount(raw2, decimals) {
+  if (typeof raw2 !== "string") return void 0;
+  if (/^0x[0-9a-f]+$/i.test(raw2)) return String(hexToDecimal(raw2, decimals));
+  if (/^\d+$/.test(raw2))
+    return String(hexToDecimal(BigInt(raw2).toString(16), decimals));
+  return void 0;
+}
 function mapWithdraw(raw2) {
   return {
     txHash: raw2.txHash,
@@ -2585,6 +2874,40 @@ function mapPendingAllocations(raw2) {
   }
   return pending.length > 0 ? pending : void 0;
 }
+function mapPendingWithdrawals(raw2) {
+  if (!Array.isArray(raw2)) return void 0;
+  const pending = [];
+  for (const entry of raw2) {
+    if (typeof entry !== "object" || entry === null) continue;
+    if (typeof entry.id !== "string" || entry.id === "") continue;
+    if (entry.status !== "REQUESTED" && entry.status !== "CLAIMABLE") continue;
+    if (typeof entry.chainId !== "number" || !Number.isFinite(entry.chainId)) continue;
+    const asset = entry.token?.symbol;
+    if (typeof asset !== "string" || asset === "" || typeof entry.amount !== "string") continue;
+    let amountRaw;
+    try {
+      const amount = BigInt(/^0x/i.test(entry.amount) ? entry.amount : `0x${entry.amount}`);
+      if (amount <= 0n) continue;
+      amountRaw = amount.toString();
+    } catch {
+      continue;
+    }
+    pending.push({ id: entry.id, status: entry.status, chainId: entry.chainId, asset, amountRaw });
+  }
+  return pending.length > 0 ? pending : void 0;
+}
+function mapRecentAsyncWithdrawals(raw2) {
+  if (!Array.isArray(raw2)) return void 0;
+  const recent = [];
+  for (const entry of raw2) {
+    if (typeof entry !== "object" || entry === null) return void 0;
+    if (entry.status === "FAILED") continue;
+    const asset = entry.token?.symbol;
+    if (typeof entry.id !== "string" || entry.id === "" || typeof entry.status !== "string" || entry.status === "" || typeof entry.chainId !== "number" || !Number.isFinite(entry.chainId) || typeof asset !== "string" || asset === "") return void 0;
+    recent.push({ id: entry.id, status: entry.status, chainId: entry.chainId, asset });
+  }
+  return recent;
+}
 function mapBalances(raw2, _chainId, smartWallet) {
   const portfolio = raw2.portfolio;
   if (!portfolio?.portfolioByChain || typeof portfolio.portfolioByChain !== "object")
@@ -2643,6 +2966,9 @@ function mapBalances(raw2, _chainId, smartWallet) {
   const pendingAllocations = mapPendingAllocations(
     portfolio.staleBalances
   );
+  const asyncWithdrawals = portfolio.pendingAsyncWithdrawals;
+  const pendingWithdrawals = mapPendingWithdrawals(asyncWithdrawals);
+  const recentAsyncWithdrawals = mapRecentAsyncWithdrawals(asyncWithdrawals);
   return {
     smartWallet,
     totalBalance: String(totalBalance),
@@ -2658,7 +2984,49 @@ function mapBalances(raw2, _chainId, smartWallet) {
       blockNumber: provenance.blockNumber === void 0 ? void 0 : String(provenance.blockNumber),
       positionsStatus: Array.isArray(portfolio.positions) ? "available" : "unavailable"
     })),
-    ...pendingAllocations ? { pendingAllocations } : {}
+    ...pendingAllocations ? { pendingAllocations } : {},
+    ...pendingWithdrawals ? { pendingWithdrawals } : {},
+    ...recentAsyncWithdrawals ? { recentAsyncWithdrawals } : {}
+  };
+}
+var TX_HASH2 = /^0x[0-9a-fA-F]{64}$/;
+var validHash = (value) => typeof value === "string" && TX_HASH2.test(value) ? value : void 0;
+var validDate = (value) => typeof value === "string" && Number.isFinite(Date.parse(value)) ? value : void 0;
+function mapWithdrawalLifecycle(raw2) {
+  const body = raw2;
+  if (!body || typeof body !== "object" || typeof body.status !== "string" || typeof body.syncSettled !== "boolean")
+    return null;
+  const syncTxHash = validHash(body.syncTxHash);
+  const estimatedClaimAt = validDate(body.estimatedClaimAt);
+  const asyncLegs = [];
+  for (const leg of Array.isArray(body.asyncLegs) ? body.asyncLegs : []) {
+    if (!leg || typeof leg !== "object" || typeof leg.id !== "string" || leg.id === "" || typeof leg.status !== "string") continue;
+    const legClaimAt = validDate(leg.estimatedClaimAt);
+    const claimTxHash = validHash(leg.claimTxHash);
+    asyncLegs.push({
+      id: leg.id,
+      status: leg.status,
+      ...legClaimAt ? { estimatedClaimAt: legClaimAt } : {},
+      ...claimTxHash ? { claimTxHash } : {}
+    });
+  }
+  const failedAsyncIds = Array.isArray(body.failedAsyncIds) ? body.failedAsyncIds.filter((id) => typeof id === "string" && id !== "") : [];
+  return {
+    status: body.status,
+    syncSettled: body.syncSettled,
+    ...syncTxHash ? { syncTxHash } : {},
+    asyncLegs,
+    failedAsyncIds,
+    ...estimatedClaimAt ? { estimatedClaimAt } : {},
+    hasError: typeof body.lastError === "string" && body.lastError !== ""
+  };
+}
+function mapDepositPlacement(raw2) {
+  const body = raw2;
+  if (!body || typeof body !== "object" || typeof body.status !== "string") return null;
+  return {
+    status: body.status,
+    ...typeof body.positionOutcome === "string" ? { positionOutcome: body.positionOutcome } : {}
   };
 }
 function sumTokenValues(tokens) {
@@ -2822,12 +3190,24 @@ function mapEntries(rawEntries, chainId) {
     const mappedAction = (entry.action ? actionMap[entry.action] : void 0) ?? entry.action;
     const rawAmount2 = entry?.positions?.[0]?.amount;
     const hasAmount = mappedAction !== "Withdraw" && typeof rawAmount2 === "string" && rawAmount2 !== "" && rawAmount2 !== "0x" && rawAmount2 !== "0x0" && rawAmount2 !== "0";
+    const rawDelta = mappedAction === "Deposit" ? decodeDeltaAmount(
+      entry?.positions?.[0]?.deltaAmount,
+      tokenDecimals(entry?.positions?.[0]?.token_symbol)
+    ) : void 0;
     const mappedPositions = positions.filter((p) => p.protocol_name).map((p) => ({
       protocol: p.protocol_name,
       pool: p.pool ?? void 0,
       tokenSymbol: p.token_symbol ?? void 0,
-      amount: mappedAction !== "Withdraw" && typeof p.amount === "string" && p.amount !== "" && p.amount !== "0x" ? String(hexToDecimal(p.amount, tokenDecimals(p.token_symbol))) : void 0
+      amount: mappedAction !== "Withdraw" && typeof p.amount === "string" && p.amount !== "" && p.amount !== "0x" ? String(hexToDecimal(p.amount, tokenDecimals(p.token_symbol))) : void 0,
+      deltaAmount: mappedAction !== "Withdraw" ? decodeDeltaAmount(p.deltaAmount, tokenDecimals(p.token_symbol)) : void 0
     }));
+    const reportedAmount = hasAmount ? String(
+      hexToDecimal(
+        rawAmount2,
+        tokenDecimals(entry?.positions?.[0]?.token_symbol)
+      )
+    ) : void 0;
+    const transactionAmount = rawDelta === void 0 ? reportedAmount : Number(rawDelta) > 0 ? rawDelta : void 0;
     return {
       agent: "zyfai",
       action: mappedAction,
@@ -2840,12 +3220,7 @@ function mapEntries(rawEntries, chainId) {
           txHashes: entry.transactionHash ? [entry.transactionHash] : [],
           chainId: entry.chainId,
           tokenSymbol: entry?.positions?.[0]?.token_symbol,
-          amount: hasAmount ? String(
-            hexToDecimal(
-              rawAmount2,
-              tokenDecimals(entry?.positions?.[0]?.token_symbol)
-            )
-          ) : void 0
+          amount: transactionAmount
         }
       ],
       rebalanceLog
@@ -3044,9 +3419,9 @@ var isJwtExpired = (token) => {
     const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
     const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
     const decoded = typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8");
-    const claims = JSON.parse(decoded);
-    if (typeof claims.exp !== "number") return false;
-    return Date.now() / 1e3 >= claims.exp - 30;
+    const claims2 = JSON.parse(decoded);
+    if (typeof claims2.exp !== "number") return false;
+    return Date.now() / 1e3 >= claims2.exp - 30;
   } catch {
     return false;
   }
@@ -3287,7 +3662,7 @@ function protocolsPolicyNeedsUpdate(current, desiredProtocols, desiredAutoSelect
 }
 
 // src/lib/agent-accounts.ts
-var SCOPE4 = "agent-accounts";
+var SCOPE5 = "agent-accounts";
 var REQUEST_TIMEOUT_MS3 = 5e3;
 function compact3(obj) {
   const out = {};
@@ -3357,7 +3732,7 @@ async function fetchAgentAccounts(input) {
         signal
       });
       if (!res.ok) {
-        debugLog(SCOPE4, `fetch rejected with ${res.status}`);
+        debugLog(SCOPE5, `fetch rejected with ${res.status}`);
         return null;
       }
       const data = unwrap3(await res.json());
@@ -3372,7 +3747,7 @@ async function fetchAgentAccounts(input) {
       cancel();
     }
   } catch (err) {
-    debugLog(SCOPE4, `fetch failed: ${describeError4(err)}`);
+    debugLog(SCOPE5, `fetch failed: ${describeError4(err)}`);
     return null;
   }
 }
@@ -3403,7 +3778,7 @@ async function reportAgentAccount(input) {
         signal
       });
       if (!res.ok) {
-        debugLog(SCOPE4, `report rejected with ${res.status}`);
+        debugLog(SCOPE5, `report rejected with ${res.status}`);
         return null;
       }
       const data = unwrap3(await res.json());
@@ -3415,7 +3790,7 @@ async function reportAgentAccount(input) {
       cancel();
     }
   } catch (err) {
-    debugLog(SCOPE4, `report failed: ${describeError4(err)}`);
+    debugLog(SCOPE5, `report failed: ${describeError4(err)}`);
     return null;
   }
 }
@@ -3576,6 +3951,17 @@ var ZYFAI_LEDGER_IDLE_CACHE_MS = 6e4;
 var ZYFAI_LEDGER_REUSE_MS = 6e4;
 var WITHDRAW_BALANCE_TIMEOUT_MS = 2e3;
 var PAYOUT_SEARCH_HEAD_LIMIT_MS = 2e3;
+var WITHDRAW_HANDOFF_TIMEOUT_MS = 25e3;
+var PLANNED_HANDOFF_TIMEOUT_MS = 8e3;
+var PLANNED_HANDOFFS_LIMIT = 32;
+var REGISTRATION_HANDOFF_TIMEOUT_MS = 8e3;
+var REGISTRATION_NUDGE_TIMEOUT_MS = 25e3;
+var REGISTRATION_AMOUNT = /^[1-9][0-9]{0,77}$/;
+var TASK_CODE = /^[A-Z0-9_]{1,64}$/;
+var SERVER_LEG_CLEARED_CODE = "ZYFAI_LEG_CLEARED";
+var SESSION_ENDING_CODE = "ZYFAI_SESSION_ENDING";
+var SERVER_LEG_STATES_LIMIT = 2e3;
+var ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
 function settleWithin(value, ms) {
   let timer;
   const limit = new Promise((resolve) => {
@@ -3585,6 +3971,28 @@ function settleWithin(value, ms) {
     if (timer) clearTimeout(timer);
   });
 }
+function depositIdFromLog(logged) {
+  const id = logged?.deposit?.id;
+  return typeof id === "string" && id.length >= 1 && id.length <= 128 ? id : void 0;
+}
+function registrationOutcome(answer, knownTask) {
+  if (answer.type === "unknown") return { kind: "unknown" };
+  if (answer.type === "declined") {
+    return !knownTask && provesNoServerTask(answer.code, true) ? { kind: "local" } : { kind: "unknown", code: answer.code };
+  }
+  if (answer.result.providerDepositId) return { kind: "confirmed", providerDepositId: answer.result.providerDepositId };
+  if (answer.state === "failed" && answer.code && ZYFAI_REGISTRATION_NOT_SENT_CODES.has(answer.code)) return { kind: "local" };
+  if (answer.state === "queued" || answer.state === "running") return { kind: "pending" };
+  return { kind: "unknown", code: answer.code ?? answer.state.toUpperCase(), accepted: true };
+}
+function registrationOutcomeUnknown(code) {
+  const error = new OwneyError(
+    "AGENT_API_ERROR",
+    "Zyfai registration by the server has no known outcome, so this browser does not register the deposit again.",
+    { status: 409, ...code && TASK_CODE.test(code) ? { reason: code } : {} }
+  );
+  return Object.assign(error, { status: 409 });
+}
 function belowMinimumCeiling(rejection, token, decimals) {
   if ((rejection.symbol === "ETH" ? "WETH" : rejection.symbol) !== token) return void 0;
   const ceiling = (display) => {
@@ -3608,6 +4016,8 @@ var ZyfaiAgent = class _ZyfaiAgent {
   referralSource;
   accountReporting;
   id = "zyfai";
+  /** This adapter can hand its withdrawals to our server (part 4). */
+  supportsServerTasks = true;
   supportedChainIds = [8453, 42161, 1];
   supportedAssets = [
     {
@@ -3684,6 +4094,18 @@ var ZyfaiAgent = class _ZyfaiAgent {
   /** A ledger read slower than this counts as "no ledger information" for that read. */
   ledgerBudgetMs = LEDGER_READ_BUDGET_MS;
   balanceSnapshots = /* @__PURE__ */ new WeakMap();
+  /** operationId -> this session's plan-time handoff of that withdrawal (part 4),
+   * read once by its nudge: the `after` legs and the planned share the task
+   * was handed off with ("MAX" or digits). Who owns the leg is
+   * `serverLegStates`, never this record. */
+  plannedHandoffs = /* @__PURE__ */ new Map();
+  /** operationId -> the server ownership of its Zyfai withdrawal leg (T9-I5).
+   * The one source for "may this browser send it" (`mayWithdrawLocally`). */
+  serverLegStates = /* @__PURE__ */ new Map();
+  /** Deposit operations whose registration create was sent in this session:
+   * a retry of one is always handed off again, whatever its session's
+   * lifetime (F-I1(a)), so the server answers the task it may hold. */
+  requestedRegistrations = /* @__PURE__ */ new Set();
   /** A replaced wallet session gets its own vendor client. In-flight calls
    * keep their original client; authentication must never change owners under
    * an operation that is waiting for provider reads or an HTTP response. */
@@ -3894,10 +4316,11 @@ var ZyfaiAgent = class _ZyfaiAgent {
    * Wraps `sdk.connectAccount` with a one-shot retry on auth errors. If the
    * cached JWT is rejected by the backend (revoked, signing-key rotated, etc.)
    * we drop the cache and try again — the second attempt has no cache entry,
-   * so it falls through to a real SIWE prompt. Zyfai labels every HTTP 401 with
-   * an `"Unauthorized: Invalid API key"` error so we can't distinguish revoked
-   * JWT from a misconfigured API key; we retry once either way, and if the
-   * second attempt still fails the original error propagates.
+   * so it falls through to a real SIWE prompt. @zyfai/sdk 0.10.0 labels every
+   * HTTP 401 as an invalid/expired or missing user session ("Unauthorized: …"),
+   * which does not separate a revoked JWT from a misconfigured API key; we
+   * retry once either way, and if the second attempt still fails the original
+   * error propagates.
    */
   async connectAccountWithRetry(provider, chainId, executionSdk = this.sdk) {
     try {
@@ -3934,9 +4357,14 @@ var ZyfaiAgent = class _ZyfaiAgent {
     }
   }
   /** A rejected execution session must not be reused by the next foreground attempt. */
-  invalidateRejectedWithdrawalSession(error, state, chainId, authToken) {
+  invalidateRejectedWithdrawalSession(error, state, chainId, authToken, httpStatus) {
     const message = error instanceof Error ? error.message : "";
-    if (!/(?:^|: )Unauthorized: Invalid API key$/.test(message)) return;
+    if (!isZyfaiSessionRejected(message) || httpStatus !== void 0 && httpStatus !== 401) return;
+    this.dropWithdrawalSession(state, chainId, authToken);
+  }
+  /** Drops the execution session a withdrawal used (Zyfai rejected it), unless
+   * it has already changed. The next foreground connection signs in again. */
+  dropWithdrawalSession(state, chainId, authToken) {
     const internals = this.sdk;
     if (typeof authToken !== "string" || internals.httpClient.authToken !== authToken || this.connectedAddress?.toLowerCase() !== state.walletAddress.toLowerCase() || this.connectedChainId !== chainId) return;
     clearSession(state.walletAddress, chainId);
@@ -4544,7 +4972,7 @@ var ZyfaiAgent = class _ZyfaiAgent {
     await this.ensureSessionKey(ownerAddress, chainId, redeployed.address);
     return redeployed.address;
   }
-  async deposit(state, chainId, amount, asset, depositCallback, onProgress, onBeforeSubmission) {
+  async deposit(state, chainId, amount, asset, depositCallback, onProgress, onBeforeSubmission, context) {
     const validChainId = isValidChainId(chainId);
     const owner = state.walletAddress;
     const provider = state.provider;
@@ -4559,6 +4987,12 @@ var ZyfaiAgent = class _ZyfaiAgent {
     assertCurrent();
     const smartWallet = await this.ensureWalletDeployed(owner, validChainId);
     assertCurrent();
+    let server;
+    if (this.accountReporting.owneyApiKey && typeof context?.operationId === "string" && context.operationId && this.serverTasksOn(this.requestedRegistrations.has(context.operationId))) {
+      server = await this.handOffDepositRegistration(owner, validChainId, asset, amount, smartWallet, context.operationId);
+      assertCurrent();
+    }
+    const mark = server ?? {};
     notifyFunding(onProgress, {
       agentId: this.id,
       chainId,
@@ -4568,7 +5002,8 @@ var ZyfaiAgent = class _ZyfaiAgent {
       intendedAmount: amount,
       transfer: "pending",
       registration: "pending",
-      delivery: "not-applicable"
+      delivery: "not-applicable",
+      ...mark
     });
     const txHash = depositCallback ? await depositCallback(smartWallet, validChainId, amount) : await submitZyfaiDeposit({
       sdk: executionSdk,
@@ -4587,7 +5022,8 @@ var ZyfaiAgent = class _ZyfaiAgent {
         intendedAmount: amount,
         transfer: "pending",
         registration: "pending",
-        delivery: "not-applicable"
+        delivery: "not-applicable",
+        ...mark
       }) : void 0
     });
     let evidence = {
@@ -4600,7 +5036,8 @@ var ZyfaiAgent = class _ZyfaiAgent {
       txHash,
       transfer: "pending",
       registration: "pending",
-      delivery: "not-applicable"
+      delivery: "not-applicable",
+      ...mark
     };
     notifyFunding(onProgress, evidence);
     try {
@@ -4620,11 +5057,32 @@ var ZyfaiAgent = class _ZyfaiAgent {
       throw new OwneyError("AGENT_TRANSACTION_REVERTED", "Zyfai deposit transaction reverted.", { txHash }, this.id);
     if (evidence.transfer !== "confirmed") return { txHash, smartWallet, amount, evidence };
     this.ledgerReads.clear();
+    if (server) {
+      let outcome;
+      try {
+        assertCurrent();
+        outcome = await this.nudgeDepositRegistration(evidence, this.executionSession());
+      } catch {
+        outcome = { kind: "unknown" };
+      }
+      if (outcome.kind !== "local") {
+        evidence = outcome.kind === "confirmed" ? { ...evidence, registration: "confirmed", providerDepositId: outcome.providerDepositId, serverTask: true } : {
+          ...evidence,
+          registration: outcome.kind,
+          ...outcome.kind === "pending" || outcome.accepted ? { serverTask: true } : {}
+        };
+        if (outcome.kind !== "confirmed") this.notePendingRegistration(owner, validChainId, txHash, Date.now(), asset);
+        notifyFunding(onProgress, evidence);
+        return { txHash, smartWallet, amount, evidence };
+      }
+      evidence = { ...evidence, serverTask: false };
+    }
     try {
       assertCurrent();
       const tokenAddress = asset === "WETH" ? WETH_ADDRESS_BY_CHAIN[validChainId] : void 0;
-      await (tokenAddress ? executionSdk.logDeposit(validChainId, txHash, amount, tokenAddress) : executionSdk.logDeposit(validChainId, txHash, amount));
-      evidence = { ...evidence, registration: "confirmed" };
+      const logged = await (tokenAddress ? executionSdk.logDeposit(validChainId, txHash, amount, tokenAddress) : executionSdk.logDeposit(validChainId, txHash, amount));
+      const providerDepositId = depositIdFromLog(logged);
+      evidence = { ...evidence, registration: "confirmed", ...providerDepositId ? { providerDepositId } : {} };
     } catch {
       evidence = { ...evidence, registration: "unknown" };
       this.notePendingRegistration(owner, validChainId, txHash, Date.now(), asset);
@@ -4744,10 +5202,69 @@ var ZyfaiAgent = class _ZyfaiAgent {
       throw unavailable();
     }
   }
-  async withdraw(state, chainId, token, amount, onProgress, _gasMode, _onBeforeSubmission, assertOperation) {
+  /**
+   * Settles Zyfai's own wallet prompts before another agent's owner signature:
+   * the SIWE login and, for a legacy wallet the login reported without a
+   * session key, that key (attempted once per session, like activation). Reads
+   * only the login's cached flags; never withdraws. A rejected prompt throws;
+   * any other session-key failure is left to `withdraw`'s own recovery.
+   */
+  async prepareWithdrawal(state, chainId, _token) {
+    const validChainId = isValidChainId(chainId);
+    await this.ensureConnected(state, validChainId);
+    await this.ensureWithdrawalSessionKey(state.walletAddress, validChainId);
+  }
+  /** The session key a legacy wallet's login reported missing, created once per
+   * session (one prompt). A rejected prompt throws; any other failure is left
+   * to the withdrawal itself. */
+  async ensureWithdrawalSessionKey(owner, validChainId) {
+    const internals = this.sdk;
+    const key2 = `${owner.toLowerCase()}:${validChainId}`;
+    if (internals.isPredeployed !== false || internals.hasActiveSessionKey !== false || this.sessionKeyAttempts.has(key2)) return;
+    this.sessionKeyAttempts.add(key2);
+    try {
+      await this.sdk.createSessionKey(owner, validChainId);
+    } catch (error) {
+      const code = error?.code;
+      if (code === 4001 || code === "ACTION_REJECTED" || error instanceof Error && /user (rejected|denied)|request rejected|action rejected/i.test(error.message)) {
+        this.sessionKeyAttempts.delete(key2);
+        throw error;
+      }
+      console.warn(
+        "[zyfai] session key before withdrawal skipped (non-fatal):",
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+  }
+  async withdraw(state, chainId, token, amount, onProgress, _gasMode, onBeforeSubmission, assertOperation, context) {
     if (amount !== void 0 && (typeof amount !== "string" || !/^[0-9]+$/.test(amount) || BigInt(amount) <= 0n))
       throw new OwneyError("WITHDRAW_INVALID_AMOUNT", "Withdrawal amount must be a positive integer in token base units.", void 0, this.id);
     const validChainId = isValidChainId(chainId);
+    if (this.accountReporting.owneyApiKey && typeof context?.operationId === "string" && context.operationId && // T10-I1: a leg whose mark was cleared is never handed off again.
+    this.serverLegStates.get(context.operationId) !== "cleared" && // F-I2(iii): the opt-in, read now, unless the leg was already handed
+    // off (planned, requested or accepted).
+    this.serverTasksOn(context.planned === true || this.serverLegStates.has(context.operationId))) {
+      const served = await this.withdrawThroughServer(
+        state,
+        validChainId,
+        token,
+        amount,
+        onProgress,
+        onBeforeSubmission,
+        assertOperation,
+        { operationId: context.operationId, planned: context.planned === true }
+      );
+      if (served) return served;
+    }
+    if (typeof context?.operationId === "string" && context.operationId && !this.mayWithdrawLocally(context.operationId))
+      this.serverLegUnresolved(onProgress, {
+        agentId: this.id,
+        chainId,
+        token,
+        walletAddress: state.walletAddress,
+        intendedAmount: amount ?? "MAX",
+        registration: "not-applicable"
+      });
     try {
       await this.ensureConnected(state, validChainId);
     } catch (error) {
@@ -4784,15 +5301,35 @@ var ZyfaiAgent = class _ZyfaiAgent {
       assertCurrent();
       assertOperation?.();
     };
-    let observation = observeWithdrawalSubmission(executionSdk, validChainId, token, assertSubmission);
+    let headRead = Promise.resolve(void 0);
+    let settledHead;
+    const searchHead = () => settledHead ??= settleWithin(headRead, PAYOUT_SEARCH_HEAD_LIMIT_MS);
+    const checkpoint2 = onBeforeSubmission ? async (request2) => {
+      const head = await searchHead();
+      const agentWallet = this.smartWalletCache.get(`${owner.toLowerCase()}_${validChainId}`);
+      await onBeforeSubmission({
+        agentId: this.id,
+        chainId,
+        token,
+        walletAddress: state.walletAddress,
+        intendedAmount: amount ?? "MAX",
+        transfer: "pending",
+        registration: "not-applicable",
+        delivery: "pending",
+        withdrawalRequest: request2,
+        ...agentWallet ? { agentWallet } : {},
+        ...head !== void 0 ? { payoutSearch: { fromBlock: head.toString() } } : {}
+      });
+    } : void 0;
+    let observation = observeWithdrawalSubmission(executionSdk, validChainId, token, assertSubmission, checkpoint2);
     const authToken = internals.httpClient?.authToken;
     let raw2;
-    let headRead = Promise.resolve(void 0);
     try {
       for (let attempt = 0; attempt < 2; attempt++) {
         try {
           assertCurrent();
           headRead = this.readPayoutSearchHead(validChainId);
+          settledHead = void 0;
           raw2 = await executionSdk.withdrawFunds(owner, validChainId, amount, token);
           break;
         } catch (error) {
@@ -4821,7 +5358,7 @@ var ZyfaiAgent = class _ZyfaiAgent {
           assertSubmission();
           await this.recoverWithdrawalSession(state, validChainId, token, owner);
           observation.stop();
-          observation = observeWithdrawalSubmission(executionSdk, validChainId, token, assertSubmission);
+          observation = observeWithdrawalSubmission(executionSdk, validChainId, token, assertSubmission, checkpoint2);
         }
       }
       if (!raw2) throw new OwneyError(
@@ -4832,7 +5369,7 @@ var ZyfaiAgent = class _ZyfaiAgent {
       );
     } catch (error) {
       if (staleSessionError && observation.attempted() === false) error = staleSessionError;
-      this.invalidateRejectedWithdrawalSession(error, state, validChainId, authToken);
+      this.invalidateRejectedWithdrawalSession(error, state, validChainId, authToken, observation.request()?.httpStatus);
       if (observation.attempted() !== void 0) {
         const failed = observation.attempted() === false || observation.rejected();
         notifyFunding(onProgress, {
@@ -4886,7 +5423,7 @@ var ZyfaiAgent = class _ZyfaiAgent {
     if (!raw2.txHash) {
       const acceptedAt = Date.now();
       const agentWallet = this.smartWalletCache.get(`${owner.toLowerCase()}_${validChainId}`);
-      const head = await settleWithin(headRead, PAYOUT_SEARCH_HEAD_LIMIT_MS);
+      const head = await searchHead();
       evidence = {
         ...evidence,
         ...agentWallet ? { agentWallet } : {},
@@ -4898,7 +5435,456 @@ var ZyfaiAgent = class _ZyfaiAgent {
     this.ledgerReads.clear();
     return { ...mapWithdraw(raw2), evidence };
   }
-  /** Registration recovery never signs, transfers, activates, or refreshes authentication. */
+  /**
+   * Hands a planned withdrawal leg to our server at plan time (part 4), before
+   * the earlier wallet-approval legs (`after`) are signed. The server sends it
+   * once they are accepted; the browser nudges it at that point
+   * (`withdraw(…, { operationId, planned: true })`). Uses the current execution
+   * client's session, after `ensureConnected`. Never throws, never prompts
+   * beyond that connection, and never withdraws locally.
+   */
+  async handOffPlannedWithdrawal(state, chainId, token, amount, ctx) {
+    const { owneyApiKey, routingApiBaseUrl } = this.accountReporting;
+    if (!this.serverTasksOn(this.serverLegStates.has(ctx.operationId)))
+      return { type: "declined", code: ZYFAI_SERVER_TASKS_OFF_CODE };
+    if (this.serverLegStates.get(ctx.operationId) === "cleared") return { type: "declined", code: SERVER_LEG_CLEARED_CODE };
+    const noSession = { type: "declined", code: "NO_SESSION" };
+    if (!owneyApiKey) return noSession;
+    let validChainId;
+    let session;
+    let agentWallet;
+    try {
+      validChainId = isValidChainId(chainId);
+      await this.ensureConnected(state, validChainId);
+      session = this.executionSession();
+      if (!session) return noSession;
+      if (this.serverLegStates.get(ctx.operationId) === void 0 && !zyfaiSessionOutlivesTask(session, "zyfai_withdrawal")) return { type: "declined", code: SESSION_ENDING_CODE };
+      agentWallet = await this.handoffAgentWallet(state.walletAddress, validChainId);
+    } catch {
+      return noSession;
+    }
+    if (!agentWallet) return { type: "declined", code: "NO_AGENT_WALLET" };
+    try {
+      ctx.beforeRequest?.();
+    } catch {
+    }
+    const afterLostAnswer = this.serverLegStates.get(ctx.operationId) === "requested";
+    this.setServerLegState(ctx.operationId, "requested");
+    let answer = await handOffZyfaiTask(
+      { apiKey: owneyApiKey, baseUrl: routingApiBaseUrl, timeoutMs: PLANNED_HANDOFF_TIMEOUT_MS, zyfaiServerTasks: true },
+      {
+        kind: "zyfai_withdrawal",
+        operationId: ctx.operationId,
+        owner: state.walletAddress,
+        chainId: validChainId,
+        asset: token,
+        amount,
+        agentWallet,
+        after: ctx.after
+      },
+      session
+    );
+    if (answer.type === "declined" && ZYFAI_HANDOFF_NO_TASK_CODES.has(answer.code) && !provesNoServerTask(answer.code, afterLostAnswer)) answer = { type: "unknown" };
+    if (answer.type === "accepted" || answer.type === "declined" && answer.code === "LEG_ALREADY_SENT")
+      this.setServerLegState(ctx.operationId, "accepted");
+    if (answer.type === "declined") {
+      if (answer.code !== "LEG_ALREADY_SENT" && this.serverLegStates.get(ctx.operationId) === "accepted")
+        return { type: "unknown" };
+      if (provesNoServerTask(answer.code, afterLostAnswer)) this.clearServerLeg(ctx.operationId, "no-task-decline");
+      return answer;
+    }
+    this.plannedHandoffs.delete(ctx.operationId);
+    this.plannedHandoffs.set(ctx.operationId, { after: [...ctx.after], amount });
+    while (this.plannedHandoffs.size > PLANNED_HANDOFFS_LIMIT)
+      this.plannedHandoffs.delete(this.plannedHandoffs.keys().next().value);
+    return answer;
+  }
+  /**
+   * F-I2(iii): whether the server path may run. The caller's opt-in is read
+   * now (a function is called) as an operation's first handoff would start.
+   * An operation this session already handed off (`handedOff`: a planned leg,
+   * a leg requested or accepted, a registration already sent) keeps going
+   * through the server even after the opt-in turns off: its nudges, re-runs
+   * and retries, so the server answers the task it may hold and the browser
+   * never sends it too. Without any opt-in (P4-0) nothing was handed off.
+   */
+  serverTasksOn(handedOff = false) {
+    const option = this.accountReporting.zyfaiServerTasks;
+    if (handedOff) return option === true || typeof option === "function";
+    return zyfaiServerTasksEnabled(option);
+  }
+  /** True when this browser may send the operation's Zyfai withdrawal leg
+   * itself: it never handed it off, or the server proved it has no task. */
+  mayWithdrawLocally(operationId) {
+    const current = this.serverLegStates.get(operationId);
+    return current === void 0 || current === "cleared";
+  }
+  /** Moves the leg's server ownership forward: absent -> requested ->
+   * accepted. "accepted" is sticky, and "cleared" is final (such a leg is
+   * never handed off again). Clearing goes through `clearServerLeg`. */
+  setServerLegState(operationId, next) {
+    const current = this.serverLegStates.get(operationId);
+    if (current === "accepted" || current === "cleared" || current === next) return;
+    this.serverLegStates.set(operationId, next);
+    while (this.serverLegStates.size > SERVER_LEG_STATES_LIMIT)
+      this.serverLegStates.delete(this.serverLegStates.keys().next().value);
+  }
+  /** Clears the leg on a proof that the server has no task: a no-task decline
+   * after a request, or nothing ever requested (T8-R4b). Never from accepted.
+   * Returns whether the leg is cleared; the caller then emits
+   * `serverTask: false` and may send locally (T10-I1, T9-I5). */
+  clearServerLeg(operationId, proof) {
+    const current = this.serverLegStates.get(operationId);
+    if (current === "cleared") return true;
+    if (proof === "no-task-decline" ? current !== "requested" : current !== void 0) return false;
+    this.serverLegStates.set(operationId, "cleared");
+    while (this.serverLegStates.size > SERVER_LEG_STATES_LIMIT)
+      this.serverLegStates.delete(this.serverLegStates.keys().next().value);
+    return true;
+  }
+  /** T9-I5: the server may hold this leg's task, so this browser never sends
+   * it. The leg is reported failed with `serverTask: "unknown"` (never
+   * cleared; a re-run hands it off again), and `error`, or an unresolved-leg
+   * error, is thrown. */
+  serverLegUnresolved(onProgress, base7, error) {
+    notifyFunding(onProgress, {
+      ...base7,
+      transfer: "failed",
+      delivery: "failed",
+      withdrawalRequest: { attempted: false },
+      serverTask: "unknown"
+    });
+    throw error ?? new OwneyError(
+      "WITHDRAW_FAILED",
+      "The server may still send this Zyfai withdrawal, so this browser does not send it.",
+      { reason: "ZYFAI_SERVER_LEG_UNRESOLVED", serverTask: true, rejectedBeforeSubmission: true },
+      this.id
+    );
+  }
+  /** The current execution client's session. Never logged or returned. */
+  executionSession() {
+    const token = this.sdk.httpClient?.authToken;
+    return typeof token === "string" && token ? token : void 0;
+  }
+  /** The owner's Zyfai wallet for a handoff (read-only), or undefined. */
+  async handoffAgentWallet(owner, chainId) {
+    if (!ADDRESS_PATTERN.test(owner)) return void 0;
+    try {
+      const wallet = await this.readSmartWallet(owner, chainId);
+      return typeof wallet === "string" && ADDRESS_PATTERN.test(wallet) ? wallet : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Part 4: hands this withdrawal to our server, or nudges the task a plan-time
+   * handoff created (`planned`). The server is the one sender from then on:
+   * this never calls Zyfai's withdraw route, and never sends again after an
+   * ambiguous answer. Returns undefined only when nothing was handed off, or
+   * when the server proved no task exists (a decline in
+   * `ZYFAI_HANDOFF_NO_TASK_CODES`, rulings P4-11, T7-R1, T8-C1 and F-I1(b);
+   * after a lost answer only the server's own declines, F-I2(i)); today's
+   * local path then runs, after the handoff's mark was cleared (T8-C2).
+   */
+  async withdrawThroughServer(state, chainId, token, requestedAmount, onProgress, onBeforeSubmission, assertOperation, context) {
+    const owner = state.walletAddress;
+    const operationId = context.operationId;
+    const plan = context.planned ? this.plannedHandoffs.get(operationId) : void 0;
+    if (context.planned) this.plannedHandoffs.delete(operationId);
+    if (context.planned && this.serverLegStates.get(operationId) === void 0)
+      this.setServerLegState(operationId, "accepted");
+    const planLost = context.planned && this.serverLegStates.get(operationId) === "requested";
+    const serverOwned = () => context.planned || this.serverLegStates.get(operationId) === "accepted";
+    const amount = plan?.amount === "MAX" ? void 0 : plan && /^[1-9][0-9]*$/.test(plan.amount) ? plan.amount : requestedAmount;
+    const route = amount ? { attempted: true, method: "POST", path: "/users/partial-withdraw/v2" } : { attempted: true, method: "GET", path: "/users/withdraw/v2" };
+    const base7 = {
+      agentId: this.id,
+      chainId,
+      token,
+      walletAddress: owner,
+      intendedAmount: amount ?? "MAX",
+      registration: "not-applicable"
+    };
+    let head;
+    const searchHead = () => head ??= settleWithin(this.readPayoutSearchHead(chainId), PAYOUT_SEARCH_HEAD_LIMIT_MS);
+    const accept = async (serverTask, agentWallet2, txHash, providerWithdrawalId) => {
+      const withdrawalRequest = { ...route, ...providerWithdrawalId ? { providerWithdrawalId } : {} };
+      let evidence;
+      if (txHash) {
+        evidence = { ...base7, txHash, transfer: "pending", delivery: "pending", withdrawalRequest, serverTask };
+      } else {
+        const acceptedAt = Date.now();
+        const fromBlock = await searchHead();
+        evidence = {
+          ...base7,
+          transfer: "pending",
+          delivery: "pending",
+          ...agentWallet2 ? { agentWallet: agentWallet2 } : {},
+          withdrawalRequest: { ...withdrawalRequest, acceptedAt },
+          ...fromBlock !== void 0 ? { payoutSearch: { fromBlock: fromBlock.toString() } } : {},
+          serverTask
+        };
+      }
+      notifyFunding(onProgress, evidence);
+      this.ledgerReads.clear();
+      return { ...mapWithdraw({
+        success: true,
+        message: "Withdrawal handed to the server",
+        txHash,
+        type: amount ? "partial" : "full",
+        amount: amount || "all"
+      }), evidence };
+    };
+    try {
+      await this.ensureConnected(state, chainId);
+    } catch (error) {
+      if (serverOwned()) return accept("unknown", void 0);
+      if (!this.mayWithdrawLocally(operationId)) this.serverLegUnresolved(onProgress, base7, error);
+      notifyFunding(onProgress, { ...base7, transfer: "failed", delivery: "failed" });
+      throw error;
+    }
+    const generation = this.connectionGeneration;
+    const internals = this.sdk;
+    const session = this.executionSession();
+    if (session && !context.planned && this.serverLegStates.get(operationId) === void 0 && !zyfaiSessionOutlivesTask(session, "zyfai_withdrawal")) return void 0;
+    const agentWallet = session ? await this.handoffAgentWallet(owner, chainId) : void 0;
+    if (!session || !agentWallet) {
+      if (serverOwned()) return accept("unknown", agentWallet);
+      if (!this.mayWithdrawLocally(operationId)) this.serverLegUnresolved(onProgress, base7);
+      return void 0;
+    }
+    const assertSubmission = () => {
+      const account = internals.walletClient?.account?.address;
+      if (generation !== this.connectionGeneration || this.connectedAddress?.toLowerCase() !== owner.toLowerCase() || this.connectedChainId !== chainId || state.chainId !== null && state.chainId !== chainId || account && account.toLowerCase() !== owner.toLowerCase())
+        throw new OwneyError(
+          "NOT_CONNECTED",
+          "Wallet changed before Zyfai withdrawal submission.",
+          { phase: "prepare", rejectedBeforeSubmission: true },
+          this.id
+        );
+      assertOperation?.();
+    };
+    try {
+      if (!context.planned) await this.ensureWithdrawalSessionKey(owner, chainId);
+      assertSubmission();
+      const fromBlock = await searchHead();
+      await onBeforeSubmission?.({
+        ...base7,
+        transfer: "pending",
+        delivery: "pending",
+        withdrawalRequest: { ...route },
+        agentWallet,
+        ...fromBlock !== void 0 ? { payoutSearch: { fromBlock: fromBlock.toString() } } : {},
+        serverTask: true
+      });
+      assertSubmission();
+    } catch (error) {
+      if (serverOwned()) return accept("unknown", agentWallet);
+      if (!this.clearServerLeg(operationId, "never-requested")) this.serverLegUnresolved(onProgress, base7, error);
+      notifyFunding(onProgress, {
+        ...base7,
+        transfer: "failed",
+        delivery: "failed",
+        withdrawalRequest: { attempted: false },
+        serverTask: false
+      });
+      throw error;
+    }
+    const cfg = {
+      apiKey: this.accountReporting.owneyApiKey,
+      baseUrl: this.accountReporting.routingApiBaseUrl,
+      timeoutMs: WITHDRAW_HANDOFF_TIMEOUT_MS,
+      zyfaiServerTasks: true
+    };
+    const body = {
+      kind: "zyfai_withdrawal",
+      operationId: context.operationId,
+      owner,
+      chainId,
+      asset: token,
+      amount: amount ?? "MAX",
+      agentWallet,
+      ...plan?.after.length ? { after: plan.after } : {},
+      ...context.planned ? { runNow: true } : {}
+    };
+    const requestedBefore = this.serverLegStates.get(operationId) === "requested";
+    let afterUnknown = planLost;
+    this.setServerLegState(operationId, "requested");
+    let answer = await handOffZyfaiTask(cfg, body, session);
+    if (answer.type === "unknown" && !context.planned) {
+      afterUnknown = true;
+      answer = await handOffZyfaiTask(cfg, body, session);
+    }
+    if (answer.type === "declined" && ZYFAI_HANDOFF_NO_TASK_CODES.has(answer.code) && !provesNoServerTask(answer.code, requestedBefore || afterUnknown)) answer = { type: "unknown" };
+    if (answer.type === "accepted" || answer.type === "declined" && answer.code === "LEG_ALREADY_SENT")
+      this.setServerLegState(operationId, "accepted");
+    if (answer.type === "declined") {
+      if (ZYFAI_HANDOFF_NO_TASK_CODES.has(answer.code) && this.clearServerLeg(operationId, "no-task-decline")) {
+        const cleared = { ...base7, transfer: "pending", delivery: "pending", serverTask: false };
+        notifyFunding(onProgress, cleared);
+        try {
+          await onBeforeSubmission?.({ ...cleared, withdrawalRequest: { attempted: false } });
+        } catch (error) {
+          notifyFunding(onProgress, { ...cleared, transfer: "failed", delivery: "failed", withdrawalRequest: { attempted: false } });
+          throw error;
+        }
+        return void 0;
+      }
+      if (this.serverLegStates.get(operationId) === "accepted" || afterUnknown) return accept("unknown", agentWallet);
+      return this.serverWithdrawalNotSent(answer.code, state, chainId, token, session, onProgress, base7, route, "unknown");
+    }
+    if (answer.type === "unknown") return accept("unknown", agentWallet);
+    if (answer.state === "failed" && answer.code && ZYFAI_WITHDRAWAL_NOT_SENT_CODES.has(answer.code))
+      return this.serverWithdrawalNotSent(answer.code, state, chainId, token, session, onProgress, base7, route, true);
+    if (answer.state === "failed" || answer.state === "expired") return accept("unknown", agentWallet);
+    return accept(true, agentWallet, answer.result.txHash, answer.result.providerWithdrawalId);
+  }
+  /** A server answer proving the withdrawal was never sent: today's matching
+   * error, with evidence transfer and delivery `failed`. "Already in progress"
+   * keeps the hold: failure `withdrawal-in-progress`, never rejectedBeforeSubmission.
+   * `serverTask`: true for a task that ended unsent (the server owns the leg's
+   * close), "unknown" for a declined handoff whose code does not prove no task
+   * (never false: such a leg is never cleared, ruling T9-I3). */
+  serverWithdrawalNotSent(code, state, chainId, token, session, onProgress, base7, route, serverTask) {
+    let failure;
+    let error;
+    const sessionUnavailable = () => new OwneyError(
+      "AGENT_AUTH_FAILED",
+      "Zyfai has no active withdrawal session. Its withdrawal was not submitted.",
+      { reason: "ZYFAI_SESSION_UNAVAILABLE", phase: "prepare", chainId, token, serverTask: true, rejectedBeforeSubmission: true },
+      this.id
+    );
+    switch (code) {
+      case "NEEDS_USER_SESSION":
+        failure = "unauthorized";
+        error = sessionUnavailable();
+        this.dropWithdrawalSession(state, chainId, session);
+        break;
+      case "NEEDS_USER_SESSION_KEY":
+        failure = "session-key-missing";
+        error = sessionUnavailable();
+        this.rearmWithdrawalSessionKey(state.walletAddress, chainId);
+        break;
+      case "WITHDRAW_INSUFFICIENT_BALANCE":
+        failure = "insufficient-balance";
+        error = new OwneyError(
+          "WITHDRAW_INSUFFICIENT_BALANCE",
+          "No funds remain in Zyfai for this asset.",
+          { available: "0", chainId, token, rejectedBeforeSubmission: true },
+          this.id
+        );
+        break;
+      case "WITHDRAWAL_IN_PROGRESS":
+      case "ZYFAI_REDEMPTION_IN_FLIGHT":
+        failure = "withdrawal-in-progress";
+        error = new OwneyError(
+          "WITHDRAW_IN_PROGRESS",
+          "A Zyfai withdrawal is already in progress.",
+          { reason: code, chainId, token, serverTask: true },
+          this.id
+        );
+        break;
+      default:
+        failure = code === "ZYFAI_FORBIDDEN" ? "forbidden" : "other";
+        error = new OwneyError(
+          "WITHDRAW_FAILED",
+          "The server did not send the Zyfai withdrawal.",
+          { reason: code, serverTask: true, rejectedBeforeSubmission: true },
+          this.id
+        );
+    }
+    notifyFunding(onProgress, {
+      ...base7,
+      transfer: "failed",
+      delivery: "failed",
+      serverTask,
+      withdrawalRequest: { ...route, failure }
+    });
+    throw error;
+  }
+  /** Zyfai has no session key for this wallet: for a legacy (not pre-deployed)
+   * wallet, forget the login's "active" flag and this session's attempt, so the
+   * next `ensureWithdrawalSessionKey` prompts once. Sends and prompts nothing. */
+  rearmWithdrawalSessionKey(owner, chainId) {
+    const internals = this.sdk;
+    if (internals.isPredeployed !== false || this.connectedAddress?.toLowerCase() !== owner.toLowerCase() || this.connectedChainId !== chainId) return;
+    internals.hasActiveSessionKey = false;
+    this.sessionKeyAttempts.delete(`${owner.toLowerCase()}:${chainId}`);
+  }
+  /** The routing API's handoff config. Only called with the opt-in and the key. */
+  registrationHandoffConfig(timeoutMs) {
+    return {
+      apiKey: this.accountReporting.owneyApiKey,
+      baseUrl: this.accountReporting.routingApiBaseUrl,
+      timeoutMs,
+      zyfaiServerTasks: true
+    };
+  }
+  /**
+   * Part 4: hands a deposit's registration to our server before its transfer.
+   * Undefined when nothing was handed off, or when the server proved it has no
+   * task (a decline in `ZYFAI_HANDOFF_NO_TASK_CODES`, rulings P4-11, T7-R1 and
+   * T8-F2; for a retried create only the server's own declines, F-I2(i)):
+   * today's local registration then runs. Any other answer means the
+   * server holds the registration, or may hold it (an unknown answer, or
+   * another decline), so the browser never registers it except by the
+   * not-sent fallback. Never throws; never logs or returns the session.
+   */
+  async handOffDepositRegistration(owner, chainId, asset, amount, agentWallet, operationId) {
+    const session = this.executionSession();
+    if (!session || !ADDRESS_PATTERN.test(owner) || !ADDRESS_PATTERN.test(agentWallet) || !REGISTRATION_AMOUNT.test(amount) || asset !== "USDC" && asset !== "WETH") return void 0;
+    const retried = this.requestedRegistrations.has(operationId);
+    if (!retried) {
+      if (!zyfaiSessionOutlivesTask(session, "zyfai_deposit_registration")) return void 0;
+      this.requestedRegistrations.add(operationId);
+      while (this.requestedRegistrations.size > SERVER_LEG_STATES_LIMIT)
+        this.requestedRegistrations.delete(this.requestedRegistrations.values().next().value);
+    }
+    const answer = await handOffZyfaiTask(
+      this.registrationHandoffConfig(REGISTRATION_HANDOFF_TIMEOUT_MS),
+      { kind: "zyfai_deposit_registration", operationId, owner, chainId, asset, amount, agentWallet },
+      session
+    );
+    if (answer.type === "declined" && provesNoServerTask(answer.code, retried)) return void 0;
+    if (answer.type === "accepted") return { serverTask: true, serverTaskOperationId: operationId };
+    const lost = answer.type === "unknown" || ZYFAI_HANDOFF_NO_TASK_CODES.has(answer.code);
+    return { serverTask: "unknown", serverTaskOperationId: operationId, serverTaskCreate: lost ? "lost" : "declined" };
+  }
+  /**
+   * Nudges the server's registration task of this deposit evidence (with
+   * `serverTask`) and reads what its answer proves. Without the opt-in (read
+   * now, unless this session sent the registration's create, F-I2(iii)), the
+   * key, a session or the task's identity no nudge is sent and the outcome is
+   * unknown. Never throws; never registers locally.
+   */
+  async nudgeDepositRegistration(evidence, session) {
+    const { owneyApiKey } = this.accountReporting;
+    const operationId = evidence.serverTaskOperationId;
+    const agentWallet = evidence.agentWallet;
+    const chainId = evidence.chainId;
+    if (typeof operationId !== "string" || !operationId || !this.serverTasksOn(this.requestedRegistrations.has(operationId)) || !owneyApiKey || !session || typeof agentWallet !== "string" || !ADDRESS_PATTERN.test(agentWallet) || !ADDRESS_PATTERN.test(evidence.walletAddress) || !REGISTRATION_AMOUNT.test(evidence.intendedAmount) || evidence.token !== "USDC" && evidence.token !== "WETH" || chainId !== 1 && chainId !== 8453 && chainId !== 42161)
+      return { kind: "unknown" };
+    const answer = await handOffZyfaiTask(
+      this.registrationHandoffConfig(REGISTRATION_NUDGE_TIMEOUT_MS),
+      {
+        kind: "zyfai_deposit_registration",
+        operationId,
+        owner: evidence.walletAddress,
+        chainId,
+        asset: evidence.token,
+        amount: evidence.intendedAmount,
+        agentWallet,
+        runNow: true
+      },
+      session
+    );
+    return registrationOutcome(answer, evidence.serverTask === true || evidence.serverTaskCreate !== "lost");
+  }
+  /** Registration recovery never signs, transfers, activates, or refreshes authentication.
+   * For a deposit the server registers (`serverTask`), it nudges the server's
+   * task instead: still pending gives a transient error, and an unknown or
+   * expired outcome the status-409 error. It registers locally only when the
+   * server proved it never sent the registration (ruling A4). */
   async retryDepositRegistration(state, evidence) {
     const executionSdk = this.sdk;
     const internals = executionSdk;
@@ -4909,11 +5895,49 @@ var ZyfaiAgent = class _ZyfaiAgent {
       throw new OwneyError("AGENT_API_ERROR", "Deposit transfer must be verified before registration recovery.");
     }
     const cid = isValidChainId(evidence.chainId);
+    let cleared = {};
+    if (evidence.serverTask === true || evidence.serverTask === "unknown") {
+      const outcome = await this.nudgeDepositRegistration(evidence, internals.httpClient.authToken ?? void 0);
+      if (outcome.kind === "confirmed") {
+        this.pendingRegistrations.get(`${evidence.walletAddress.toLowerCase()}:${cid}`)?.delete(evidence.txHash.toLowerCase());
+        this.ledgerReads.clear();
+        return { ...evidence, registration: "confirmed", providerDepositId: outcome.providerDepositId, serverTask: true };
+      }
+      if (outcome.kind === "pending")
+        throw new OwneyError("AGENT_API_ERROR", "Zyfai registration by the server is temporarily unavailable.");
+      if (outcome.kind === "unknown") throw registrationOutcomeUnknown(outcome.code);
+      cleared = { serverTask: false };
+    }
     const tokenAddress = evidence.token === "WETH" ? WETH_ADDRESS_BY_CHAIN[cid] : void 0;
-    await executionSdk.logDeposit(cid, evidence.txHash, evidence.intendedAmount, tokenAddress);
+    const logged = await executionSdk.logDeposit(cid, evidence.txHash, evidence.intendedAmount, tokenAddress);
+    const providerDepositId = depositIdFromLog(logged);
     this.pendingRegistrations.get(`${evidence.walletAddress.toLowerCase()}:${cid}`)?.delete(evidence.txHash.toLowerCase());
     this.ledgerReads.clear();
-    return { ...evidence, registration: "confirmed" };
+    return { ...evidence, ...cleared, registration: "confirmed", ...providerDepositId ? { providerDepositId } : {} };
+  }
+  /** Reads a deposit's placement status by its id. Never signs, prompts or authenticates:
+   * it uses only a session the vendor client already holds, and any failure is `null`. */
+  async getDepositPlacement(state, depositId) {
+    const internals = this.sdk;
+    const client = internals.httpClient;
+    if (!client?.authToken || typeof client.get !== "function" || this.connectedAddress?.toLowerCase() !== state.walletAddress.toLowerCase()) return null;
+    try {
+      return mapDepositPlacement(await client.get(`/users/deposits/${encodeURIComponent(depositId)}/v2`));
+    } catch {
+      return null;
+    }
+  }
+  /** Reads a withdrawal's lifecycle by its id. Never signs, prompts or authenticates:
+   * it uses only a session the vendor client already holds, and any failure is `null`. */
+  async getWithdrawalLifecycle(state, withdrawalId) {
+    const internals = this.sdk;
+    const client = internals.httpClient;
+    if (!client?.authToken || typeof client.get !== "function" || this.connectedAddress?.toLowerCase() !== state.walletAddress.toLowerCase()) return null;
+    try {
+      return mapWithdrawalLifecycle(await client.get(`/users/withdrawals/${encodeURIComponent(withdrawalId)}`));
+    } catch {
+      return null;
+    }
   }
   // --- IAgent: Portfolio reads ---
   async getFundingWallet(state, chainId) {
@@ -5143,16 +6167,16 @@ var ZyfaiAgent = class _ZyfaiAgent {
       }
       const now = Date.now();
       const pending = [...this.pendingRegistrations.get(scope)?.values() ?? []].map((entry) => entry.at);
-      const active2 = zyfaiHoldActive({
+      const active = zyfaiHoldActive({
         movements,
         pendingRegistrations: pending,
         lastCheckTimestamp: raw2?.data?.lastCheckTimestamp,
         lastLogDate: raw2?.data?.lastLogDate?.[String(chainId)],
         now
       });
-      if (active2) this.holdActiveScopes.add(scope);
+      if (active) this.holdActiveScopes.add(scope);
       else this.holdActiveScopes.delete(scope);
-      if (!active2) {
+      if (!active) {
         this.lastGoodEarnings.set(key2, raw2);
         return { value: raw2, active: false };
       }
@@ -6135,7 +7159,7 @@ function actionEntry(action) {
     rebalanceLog: []
   };
 }
-var TX_HASH = /^0x[a-fA-F0-9]{64}$/;
+var TX_HASH3 = /^0x[a-fA-F0-9]{64}$/;
 function allocationLegs(value, context, requireAmount) {
   if (!Array.isArray(value)) return void 0;
   const legs = [];
@@ -6164,7 +7188,7 @@ function allocationEntry(action, context) {
   if (action.actionType.toLowerCase() !== "autoseek") return void 0;
   const hash2 = action.details?.depositTransactionHash;
   const withdrawHash = action.details?.withdrawTransactionHash;
-  if (typeof hash2 !== "string" || !TX_HASH.test(hash2)) return null;
+  if (typeof hash2 !== "string" || !TX_HASH3.test(hash2)) return null;
   const deposits = allocationLegs(action.details?.deposits, context, true);
   const withdrawals = action.details?.withdrawals == null ? [] : allocationLegs(action.details.withdrawals, context, false);
   if (!deposits?.length || !withdrawals) return null;
@@ -6177,7 +7201,7 @@ function allocationEntry(action, context) {
   }));
   const amountRaw = deposits.reduce((total, leg) => total + leg.rawAmount, 0n);
   const rebalance = withdrawals.length > 0;
-  const hashes = rebalance && typeof withdrawHash === "string" && TX_HASH.test(withdrawHash) && withdrawHash.toLowerCase() !== hash2.toLowerCase() ? [hash2, withdrawHash] : [hash2];
+  const hashes = rebalance && typeof withdrawHash === "string" && TX_HASH3.test(withdrawHash) && withdrawHash.toLowerCase() !== hash2.toLowerCase() ? [hash2, withdrawHash] : [hash2];
   const source = withdrawals.length === 1 ? withdrawals[0] : {
     protocol: [...new Set(withdrawals.map((leg) => leg.protocol))].join(" + "),
     pool: withdrawals.map((leg) => leg.pool).filter(Boolean).join(" + ") || void 0
@@ -6569,6 +7593,7 @@ function operationHash(operation) {
     }
   });
 }
+var YIELDSEEKER_WITHDRAW_SERVER_SUBMIT = 1;
 function sponsorError(message, safeToFallback, details = {}) {
   return new OwneyError(
     "SPONSOR_REQUEST_FAILED",
@@ -6591,6 +7616,22 @@ function assertIntentFresh(expiresAt) {
       { failureCode: "SPONSOR_INTENT_EXPIRED" }
     );
 }
+var PAYMASTER_EXPIRY_MARGIN_SECONDS = 30;
+function paymasterValidUntil(paymasterAndData) {
+  if (paymasterAndData.length < 2 + 64) return void 0;
+  const validUntil = Number.parseInt(paymasterAndData.slice(42, 54), 16);
+  const now = Date.now() / 1e3;
+  return validUntil > now - 86400 && validUntil < now + 86400 ? validUntil : void 0;
+}
+function assertPaymasterFresh(paymasterAndData) {
+  const validUntil = paymasterValidUntil(paymasterAndData);
+  if (validUntil !== void 0 && Date.now() / 1e3 + PAYMASTER_EXPIRY_MARGIN_SECONDS >= validUntil)
+    throw sponsorError(
+      "The withdrawal sponsorship expired while waiting for the signature. Please try again.",
+      true,
+      { failureCode: "SPONSOR_INTENT_EXPIRED" }
+    );
+}
 function providerReason(value) {
   if (typeof value !== "string") return void 0;
   return value.replace(/https?:\/\/\S+/gi, "[url]").replace(/0x[0-9a-fA-F]{40,}/g, "[hex]").replace(/[A-Za-z0-9_+=\/-]{48,}/g, "[token]").slice(0, 300);
@@ -6672,6 +7713,12 @@ async function checkpoint(callback, pending) {
     );
   }
 }
+function reportAccepted(onAccepted, accepted) {
+  try {
+    onAccepted?.(accepted);
+  } catch {
+  }
+}
 function finalPaymasterFields(value) {
   const result = {};
   for (const key2 of [
@@ -6750,15 +7797,57 @@ async function requestIntent(input) {
   url.searchParams.set("intent", intent.intent);
   return { intent, rpcUrl: url.toString() };
 }
+var RPC_TIMEOUT_MS = 15e3;
+var SERVER_SUBMIT_SEND_TIMEOUT_MS = 25e3;
+function postRpc(url, method, params, timeoutMs) {
+  return fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+}
+function rpcRejection(status, payload, method, phase) {
+  const rejection = payload?.error;
+  const diagnostics = rpcDiagnostics(rejection?.data);
+  const executionReverted = rejection?.code === -32521 || diagnostics.failureCode === "SPONSOR_EXECUTION_REVERTED";
+  const details = {
+    statusCode: status,
+    rpcCode: rejection?.code,
+    rpcMethod: method,
+    phase,
+    providerReason: providerReason(rejection?.data?.providerReason) ?? providerReason(rejection?.message),
+    failureCode: "RPC_REJECTED",
+    ...diagnostics
+  };
+  if (phase === "prepare" && executionReverted)
+    return new OwneyError(
+      "WITHDRAW_FAILED",
+      "Yieldseeker withdrawal simulation reverted before submission.",
+      {
+        ...details,
+        failureCode: "SPONSOR_EXECUTION_REVERTED",
+        safeToFallback: false,
+        rejectedBeforeSubmission: true
+      },
+      "yieldseeker"
+    );
+  const definitiveRejection = phase === "send" && !executionReverted && status < 500 && !!rejection && (rejection.data?.rejectedBeforeSubmission === true || [-32501, -32502, -32503, -32504, -32505, -32507].includes(rejection.code ?? 0) || // AA3x: the paymaster failed validation (e.g. AA32 expired), so the
+  // bundler never accepted it. AA2x stays ambiguous (AA25 can mean it ran).
+  /\bAA3\d\b/.test(rejection.message ?? "") || /maxFeePerGas.*(?:too low|lower than|less than|must be at least)/i.test(rejection.message ?? ""));
+  return sponsorError(
+    phase !== "prepare" && !definitiveRejection ? "Sponsored withdrawal submission status is unknown." : "Withdrawal sponsorship was declined before submission.",
+    phase === "prepare" || definitiveRejection,
+    {
+      ...details,
+      ...phase === "prepare" || definitiveRejection ? { rejectedBeforeSubmission: true } : {}
+    }
+  );
+}
 async function rpc(url, method, params, phase) {
   let response;
   try {
-    response = await fetch(url, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
-      signal: AbortSignal.timeout(15e3)
-    });
+    response = await postRpc(url, method, params, RPC_TIMEOUT_MS);
   } catch {
     throw sponsorError(
       "Withdrawal sponsorship request status is unknown.",
@@ -6772,43 +7861,37 @@ async function rpc(url, method, params, phase) {
     );
   }
   const payload = await response.json().catch(() => null);
-  if (!response.ok || payload?.error || payload?.result === void 0) {
-    const rejection = payload?.error;
-    const diagnostics = rpcDiagnostics(rejection?.data);
-    const executionReverted = rejection?.code === -32521 || diagnostics.failureCode === "SPONSOR_EXECUTION_REVERTED";
-    const details = {
-      statusCode: response.status,
-      rpcCode: rejection?.code,
-      rpcMethod: method,
-      phase,
-      providerReason: providerReason(rejection?.data?.providerReason) ?? providerReason(rejection?.message),
-      failureCode: "RPC_REJECTED",
-      ...diagnostics
-    };
-    if (phase === "prepare" && executionReverted)
-      throw new OwneyError(
-        "WITHDRAW_FAILED",
-        "Yieldseeker withdrawal simulation reverted before submission.",
-        {
-          ...details,
-          failureCode: "SPONSOR_EXECUTION_REVERTED",
-          safeToFallback: false,
-          rejectedBeforeSubmission: true
-        },
-        "yieldseeker"
-      );
-    const definitiveRejection = phase === "send" && !executionReverted && response.status < 500 && !!rejection && (rejection.data?.rejectedBeforeSubmission === true || [-32501, -32502, -32503, -32504, -32505, -32507].includes(rejection.code ?? 0) || /maxFeePerGas.*(?:too low|lower than|less than|must be at least)/i.test(rejection.message ?? ""));
-    throw sponsorError(
-      phase !== "prepare" && !definitiveRejection ? "Sponsored withdrawal submission status is unknown." : "Withdrawal sponsorship was declined before submission.",
-      phase === "prepare" || definitiveRejection,
-      {
-        ...details,
-        ...phase === "prepare" || definitiveRejection ? { rejectedBeforeSubmission: true } : {}
-      }
-    );
-  }
+  if (!response.ok || payload?.error || payload?.result === void 0)
+    throw rpcRejection(response.status, payload, method, phase);
   return payload.result;
 }
+async function sendSignedUserOperation(rpcUrl, operation, operationId) {
+  const method = "eth_sendUserOperation";
+  const params = [operation, ENTRY_POINT_V06];
+  if (!operationId) return { type: "accepted", hash: await rpc(rpcUrl, method, params, "send"), serverSubmit: false };
+  const url = new URL(rpcUrl);
+  url.searchParams.set("operationId", operationId);
+  url.searchParams.set("serverSubmit", "1");
+  let response;
+  try {
+    response = await postRpc(url.toString(), method, params, SERVER_SUBMIT_SEND_TIMEOUT_MS);
+  } catch {
+    return { type: "pending", serverSubmit: "unknown" };
+  }
+  const payload = await response.json().catch(() => null);
+  if (!payload) return { type: "pending", serverSubmit: "unknown" };
+  if (response.ok && !payload.error && payload.result !== void 0)
+    return {
+      type: "accepted",
+      hash: payload.result,
+      serverSubmit: payload.owney?.serverSubmit === true && payload.owney.state === "accepted"
+    };
+  const rejection = rpcRejection(response.status, payload, method, "send");
+  if (rejection.details?.rejectedBeforeSubmission === true) throw rejection;
+  if (payload.error?.data?.serverSubmit === true) return { type: "pending", serverSubmit: true };
+  if (response.status >= 500) return { type: "pending", serverSubmit: "unknown" };
+  throw rejection;
+}
 async function waitForTransaction(client, txHash) {
   const receipt = await client.waitForTransactionReceipt({ hash: txHash, confirmations: 1 });
   if (receipt.status !== "success")
@@ -6890,6 +7973,7 @@ async function submitEoa(input) {
   operation = { ...operation, signature };
   await assertOwnerSession(input.state, input.owner);
   assertIntentFresh(input.expiresAt);
+  assertPaymasterFresh(operation.paymasterAndData);
   const userOperation = {
     sender: operation.sender,
     nonce: operation.nonce,
@@ -6906,18 +7990,19 @@ async function submitEoa(input) {
   input.assertCurrent?.();
   await checkpoint(input.onBeforeSubmission, { userOpHash, userOperation });
   input.assertCurrent?.();
-  const submittedHash = await rpc(
-    input.rpcUrl,
-    "eth_sendUserOperation",
-    [operation, ENTRY_POINT_V06],
-    "send"
-  );
-  if (!isHash(submittedHash) || submittedHash.toLowerCase() !== userOpHash.toLowerCase())
-    throw sponsorError(
-      "Bundler returned a different UserOperation hash.",
-      false,
-      { userOpHash, submittedHash, phase: "send", failureCode: "BUNDLER_HASH_MISMATCH" }
-    );
+  const sent = await sendSignedUserOperation(input.rpcUrl, operation, input.operationId);
+  const serverSubmit = sent.type === "pending" ? sent.serverSubmit : sent.serverSubmit ? true : void 0;
+  if (serverSubmit) savePending(input.onPending, { userOpHash, serverSubmit });
+  if (sent.type === "accepted") {
+    const submittedHash = sent.hash;
+    if (!isHash(submittedHash) || submittedHash.toLowerCase() !== userOpHash.toLowerCase())
+      throw sponsorError(
+        "Bundler returned a different UserOperation hash.",
+        false,
+        { userOpHash, submittedHash, phase: "send", failureCode: "BUNDLER_HASH_MISMATCH" }
+      );
+    reportAccepted(input.onAccepted, { userOpHash });
+  }
   const deadline = Date.now() + OBSERVATION_WINDOW_MS;
   let lastReadError;
   for (let poll = 0; poll < 40 && Date.now() < deadline; poll++) {
@@ -6950,6 +8035,7 @@ async function submitEoa(input) {
       userOpHash,
       phase: "observe",
       failureCode: "RECEIPT_UNRESOLVED",
+      ...serverSubmit ? { serverSubmit } : {},
       ...lastReadError instanceof OwneyError ? { lastObservationError: lastReadError.details } : {}
     }
   );
@@ -7010,6 +8096,7 @@ async function submitSmart(input) {
       { callsId: requestedId, phase: "send", failureCode: "WALLET_SEND_UNRESOLVED" }
     );
   savePending(input.onPending, { callsId });
+  reportAccepted(input.onAccepted, { callsId });
   const deadline = Date.now() + OBSERVATION_WINDOW_MS;
   for (let poll = 0; poll < 40 && Date.now() < deadline; poll++) {
     let status;
@@ -7303,6 +8390,9 @@ var YieldseekerAgent = class {
   endpointReadFailures = /* @__PURE__ */ new Map();
   reconcileUntil = /* @__PURE__ */ new Map();
   allocationRefresh = /* @__PURE__ */ new Set();
+  /** Contexts whose next permitted snapshot read is forced once: a funding
+   * invalidation with a tx hash (receipt recovery, a re-armed refresh). */
+  forceNextSnapshot = /* @__PURE__ */ new Set();
   activityRefreshUntil = /* @__PURE__ */ new Map();
   // null means a confirmed movement has no reliable baseline. Do not guess
   // settlement; keep slow reconciliation after the fast window expires.
@@ -7709,6 +8799,7 @@ var YieldseekerAgent = class {
     this.endpointReadFailures.clear();
     this.reconcileUntil.clear();
     this.allocationRefresh.clear();
+    this.forceNextSnapshot.clear();
     this.activityRefreshUntil.clear();
     this.snapshotMovements.clear();
     this.movementEpochs.clear();
@@ -7822,7 +8913,7 @@ var YieldseekerAgent = class {
     notifyFunding(onProgress, evidence);
     return { txHash, smartWallet: context.wallet.walletAddress, amount, evidence };
   }
-  async withdraw(state, chainId, asset, amount, onProgress, gasMode = "auto", onBeforeSubmission, assertOperation) {
+  async withdraw(state, chainId, asset, amount, onProgress, gasMode = "auto", onBeforeSubmission, assertOperation, submission) {
     let ownerTransferAttempted = false;
     let evidence = {
       agentId: this.id,
@@ -7835,12 +8926,23 @@ var YieldseekerAgent = class {
       delivery: "pending"
     };
     try {
-      return await this.withdrawInternal(state, chainId, asset, amount, (next) => {
-        evidence = { ...evidence, ...next };
-        notifyFunding(onProgress, evidence);
-      }, () => {
-        ownerTransferAttempted = true;
-      }, gasMode, onBeforeSubmission, assertOperation);
+      return await this.withdrawInternal(
+        state,
+        chainId,
+        asset,
+        amount,
+        (next) => {
+          evidence = { ...evidence, ...next };
+          notifyFunding(onProgress, evidence);
+        },
+        () => {
+          ownerTransferAttempted = true;
+        },
+        gasMode,
+        onBeforeSubmission,
+        assertOperation,
+        submission?.operationId
+      );
     } catch (error) {
       if (error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED") {
         this.withdrawalVersionCache.clear();
@@ -7856,7 +8958,7 @@ var YieldseekerAgent = class {
       throw error;
     }
   }
-  async withdrawInternal(state, chainId, asset, amount, onProgress, onOwnerTransferAttempted, gasMode = "auto", onBeforeSubmission, assertOperation) {
+  async withdrawInternal(state, chainId, asset, amount, onProgress, onOwnerTransferAttempted, gasMode = "auto", onBeforeSubmission, assertOperation, operationId) {
     this.assertChain(chainId);
     this.assertAsset(asset);
     if (amount !== void 0 && BigInt(amount) <= 0n) {
@@ -7988,13 +9090,13 @@ var YieldseekerAgent = class {
       const verifyKnownPositions = async (blockNumber, values = [...knownPositions.values()], timeoutMs = YIELDSEEKER_MAX_POSITION_VERIFICATION_MS) => {
         const verifiedPositions = [];
         if (timeoutMs <= 0) return { verified: false, positions: verifiedPositions };
-        let active2 = true;
+        let active = true;
         const checks = this.readVaultShares(values.map((position2) => position2.vaultOption), agentWallet, blockNumber).catch(() => []);
         const reads = values.map(async (position2, index) => {
           const address = getAddress6(position2.vaultOption.address);
           try {
             const group = (await checks).slice(index * 2, index * 2 + 2);
-            if (!active2 || group.length !== 2 || group.some((value) => value.status !== "success")) return null;
+            if (!active || group.length !== 2 || group.some((value) => value.status !== "success")) return null;
             this.assertSession(generation, chainId, asset);
             const [underlying, shares] = group.map((value) => value.result);
             if (typeof underlying !== "string" || !isAddress4(underlying) || underlying.toLowerCase() !== metadata.address.toLowerCase() || typeof shares !== "bigint" || shares < 0n) return null;
@@ -8007,7 +9109,7 @@ var YieldseekerAgent = class {
                 shares,
                 blockNumber
               );
-              if (!active2 || value === void 0) return null;
+              if (!active || value === void 0) return null;
               this.assertSession(generation, chainId, asset);
               verified.withdrawableAssetsRaw = value.toString();
               verifiedPositions.push(verified);
@@ -8024,7 +9126,7 @@ var YieldseekerAgent = class {
                     args: [shares],
                     blockNumber
                   });
-                  if (!active2 || typeof value !== "bigint" || value < 0n) return null;
+                  if (!active || typeof value !== "bigint" || value < 0n) return null;
                   this.assertSession(generation, chainId, asset);
                   if (value > 0n && !positiveValue) {
                     positiveValue = true;
@@ -8052,19 +9154,20 @@ var YieldseekerAgent = class {
           }
         });
         const result = await boundedVerification(Promise.all(reads), timeoutMs);
-        active2 = false;
+        active = false;
         this.assertSession(generation, chainId, asset);
         return {
           verified: result !== void 0 && result.every((position2) => position2 !== null),
           positions: [...verifiedPositions]
         };
       };
-      const refreshPositions = async () => {
+      const refreshPositions = async (promptless = false) => {
         this.assertSession(generation, chainId, asset);
         const response = await this.walletRequest(
           state,
           chainId,
-          this.agentPath(context, "vault-positions")
+          this.agentPath(context, "vault-positions"),
+          { promptless }
         );
         this.assertSession(generation, chainId, asset);
         if (!Array.isArray(response?.vaultPositions)) throw this.invalidResponse("vault positions");
@@ -8295,6 +9398,8 @@ var YieldseekerAgent = class {
           agentWallet: getAddress6(context.wallet.walletAddress),
           asset: metadata.address,
           callData: data,
+          // The EOA send opts in to the server-owned send with it.
+          operationId,
           onPending: (pending) => {
             submissionEvidence = { ...submissionEvidence, ...pending };
             notifyFunding(onProgress, submissionEvidence);
@@ -8303,6 +9408,11 @@ var YieldseekerAgent = class {
             assertOperation?.();
             await onBeforeSubmission?.({ ...base7, ...pending });
             onOwnerTransferAttempted?.();
+          },
+          // The owner's signed operation was accepted: another agent may start.
+          onAccepted: (accepted) => {
+            submissionEvidence = { ...submissionEvidence, ...accepted, ownerAuthorization: "accepted" };
+            notifyFunding(onProgress, submissionEvidence);
           }
         });
         txHash = submitted.txHash;
@@ -8319,7 +9429,10 @@ var YieldseekerAgent = class {
             value: "0",
             chainId
           },
-          (hash2) => notifyFunding(onProgress, { ...base7, txHash: hash2 }),
+          (hash2) => {
+            submissionEvidence = { ...submissionEvidence, txHash: hash2, ownerAuthorization: "accepted" };
+            notifyFunding(onProgress, submissionEvidence);
+          },
           (value) => {
             receipt = value;
           },
@@ -8350,7 +9463,9 @@ var YieldseekerAgent = class {
         const verificationDeadline = Date.now() + YIELDSEEKER_MAX_POSITION_VERIFICATION_MS;
         const knownAtPayout = new Set(knownPositions.keys());
         const [catalogVerified, knownProof] = await Promise.all([
-          boundedVerification(refreshPositions().then((values) => {
+          // Never a sign-in prompt here: a refused or missing cached sign-in
+          // leaves the catalog unverified, the existing unverified-MAX outcome.
+          boundedVerification(refreshPositions(true).then((values) => {
             rememberPositions(values);
             return true;
           }).catch(() => false)),
@@ -8395,7 +9510,8 @@ var YieldseekerAgent = class {
         );
       const confirmedAmount = evidence.confirmedAmount && /^\d+$/.test(evidence.confirmedAmount) ? BigInt(evidence.confirmedAmount) : void 0;
       const feeIncrease = ownerFunds.fees - initialFunds.fees;
-      const feeAdjustment = amount !== void 0 && receipt && initialFunds.blockNumber !== void 0 && latestUnwindBlock !== void 0 && initialFunds.blockNumber <= latestUnwindBlock && receipt.blockNumber >= latestUnwindBlock && evidence.transfer === "confirmed" && evidence.delivery === "confirmed" && confirmedAmount === payout && feeIncrease > 0n && feeIncrease <= maxFee && requested - payout === feeIncrease ? { grossAmount: requested.toString(), feeAmount: feeIncrease.toString() } : void 0;
+      const feeShortfall = requested - payout;
+      const feeAdjustment = amount !== void 0 && receipt && initialFunds.blockNumber !== void 0 && latestUnwindBlock !== void 0 && initialFunds.blockNumber <= latestUnwindBlock && receipt.blockNumber >= latestUnwindBlock && evidence.transfer === "confirmed" && evidence.delivery === "confirmed" && confirmedAmount === payout && feeIncrease > 0n && feeIncrease <= maxFee && feeShortfall > 0n && feeShortfall <= feeIncrease ? { grossAmount: requested.toString(), feeAmount: feeShortfall.toString() } : void 0;
       return {
         txHash,
         type: amount === void 0 && !completion ? "full" : "partial",
@@ -8457,14 +9573,14 @@ var YieldseekerAgent = class {
   }
   /** Recheck MAX without re-unwinding, paying out, or requesting a signature. */
   async verifyWithdrawalCompletion(state, evidence) {
-    const unknown = (reason2) => ({ status: "unavailable", reason: reason2 });
+    const unknown2 = (reason2) => ({ status: "unavailable", reason: reason2 });
     const proof = evidence.maxCompletion;
-    if (evidence.agentId !== this.id || evidence.walletAddress.toLowerCase() !== state.walletAddress.toLowerCase() || evidence.chainId !== 8453 || !proof || !evidence.agentWallet || !isAddress4(evidence.agentWallet) || !evidence.blockNumber || !/^\d+$/.test(evidence.blockNumber) || evidence.transfer !== "confirmed" || evidence.delivery !== "confirmed" || !this.isTransactionHash(evidence.txHash)) return unknown("PAYOUT_PROOF_UNAVAILABLE");
+    if (evidence.agentId !== this.id || evidence.walletAddress.toLowerCase() !== state.walletAddress.toLowerCase() || evidence.chainId !== 8453 || !proof || !evidence.agentWallet || !isAddress4(evidence.agentWallet) || !evidence.blockNumber || !/^\d+$/.test(evidence.blockNumber) || evidence.transfer !== "confirmed" || evidence.delivery !== "confirmed" || !this.isTransactionHash(evidence.txHash)) return unknown2("PAYOUT_PROOF_UNAVAILABLE");
     this.assertAsset(evidence.token);
     const asset = evidence.token;
     const metadata = YIELDSEEKER_ASSET_METADATA[asset];
     const signature = this.auth.peekToken(state, evidence.chainId);
-    if (!signature) return unknown("AUTHENTICATION_REQUIRED");
+    if (!signature) return unknown2("AUTHENTICATION_REQUIRED");
     let reason = "CATALOG_UNAVAILABLE";
     try {
       return await bounded(async () => {
@@ -8472,7 +9588,7 @@ var YieldseekerAgent = class {
           `/users/${encodeURIComponent(proof.userId)}/agents/${encodeURIComponent(proof.agentId)}/vault-positions`,
           { signature }
         );
-        if (!Array.isArray(response?.vaultPositions)) return unknown("CATALOG_INVALID");
+        if (!Array.isArray(response?.vaultPositions)) return unknown2("CATALOG_INVALID");
         const positions = this.validateWithdrawalPositions(response.vaultPositions, evidence.chainId, asset);
         const vaults = new Map(proof.vaults.map((address) => [address.toLowerCase(), { address }]));
         positions.forEach((p) => vaults.set(p.vaultOption.address.toLowerCase(), p.vaultOption));
@@ -8480,14 +9596,14 @@ var YieldseekerAgent = class {
         if (needsInventory || [...vaults.values()].some((option) => !option.provider)) {
           const catalog = await this.loadVaultOptions(asset).catch(() => []);
           const eligible = catalog.filter((o) => o.chainId === evidence.chainId && o.assetAddress?.toLowerCase() === metadata.address.toLowerCase() && isAddress4(o.address));
-          if (needsInventory && !eligible.length) return unknown("INVENTORY_INCOMPLETE");
+          if (needsInventory && !eligible.length) return unknown2("INVENTORY_INCOMPLETE");
           for (const option of eligible) {
             const key2 = option.address.toLowerCase();
             if (needsInventory || vaults.has(key2)) vaults.set(key2, option);
           }
         }
         if (vaults.size > YIELDSEEKER_WITHDRAWAL_CANDIDATE_LIMIT || [...vaults.keys()].some((a) => !isAddress4(a)))
-          return unknown("INVENTORY_INVALID");
+          return unknown2("INVENTORY_INVALID");
         reason = "VAULT_PROOF_UNAVAILABLE";
         const blockNumber = BigInt(evidence.blockNumber);
         const options = [...vaults.values()];
@@ -8518,7 +9634,7 @@ var YieldseekerAgent = class {
         };
       }, 8e3, () => new Error("MAX proof read timed out"));
     } catch {
-      return unknown(reason);
+      return unknown2(reason);
     }
   }
   async readVaultShares(options, wallet, blockNumber) {
@@ -8599,12 +9715,12 @@ var YieldseekerAgent = class {
       { asset: context.asset, reason: "YIELDSEEKER_LIQUIDITY_UNVERIFIED" },
       this.id
     );
-    let active2 = true;
+    let active = true;
     let knownProof;
     const hasUnverifiedIndexedFunds = (proof) => proof.indexedPositions.some((position2) => !proof.resolvedVaults.includes(position2.vaultOption.address.toLowerCase()) && BigInt(position2.withdrawableAssetsRaw) > 0n);
     const assertReadCurrent = () => {
       this.assertSession(generation, chainId, context.asset);
-      if (!active2 || (this.liquidityVersions.get(contextKey) ?? 0) !== version) throw unavailable();
+      if (!active || (this.liquidityVersions.get(contextKey) ?? 0) !== version) throw unavailable();
     };
     const read2 = async () => {
       const client = this.getReceiptClient();
@@ -8793,7 +9909,7 @@ var YieldseekerAgent = class {
       if (error instanceof OwneyError) throw error;
       throw unavailable();
     } finally {
-      active2 = false;
+      active = false;
       if (timer) clearTimeout(timer);
     }
   }
@@ -8878,6 +9994,7 @@ var YieldseekerAgent = class {
     this.assertAsset(asset);
     const until = Math.min(refreshUntil, Date.now() + YIELDSEEKER_SETTLEMENT_SNAPSHOT_WINDOW_MS);
     const activityUntil = Math.min(refreshUntil, Date.now() + YIELDSEEKER_SETTLEMENT_WINDOW_MS);
+    const hash2 = typeof txHash === "string" && /^0x[0-9a-fA-F]{64}$/.test(txHash);
     this.invalidateSlot(state, chainId, asset, (key2) => {
       const failure = this.snapshotFailures.get(key2);
       this.advancePortfolioVersion(key2);
@@ -8889,6 +10006,7 @@ var YieldseekerAgent = class {
       }
       this.reconcileUntil.set(key2, Math.max(this.reconcileUntil.get(key2) ?? 0, until));
       this.activityRefreshUntil.set(key2, Math.max(this.activityRefreshUntil.get(key2) ?? 0, activityUntil));
+      if (hash2) this.forceNextSnapshot.add(key2);
     });
   }
   endFundingBalanceRefresh(state, chainId, asset, read2) {
@@ -9724,7 +10842,7 @@ var YieldseekerAgent = class {
     return this.walletRequest(
       state,
       chainId,
-      `${this.agentPath(context, "snapshot")}${query(forceRefresh ? { shouldForceRefresh: true } : { shouldOnlyUseRecentValue: true, shouldAllowStaleOnError: true })}`
+      this.snapshotPath(context, forceRefresh)
     ).then((response) => {
       if (!response?.agentSnapshot) {
         throw this.invalidResponse("agent snapshot");
@@ -9754,6 +10872,16 @@ var YieldseekerAgent = class {
       throw error;
     });
   }
+  snapshotPath(context, forceRefresh) {
+    return `${this.agentPath(context, "snapshot")}${query(forceRefresh ? { shouldForceRefresh: true } : { shouldOnlyUseRecentValue: true, shouldAllowStaleOnError: true })}`;
+  }
+  /** True while `walletRequest` would refuse a read of `path`: this user's
+   * rate-limit cooldown or that endpoint's outage cooldown. */
+  readCoolingDown(state, chainId, path) {
+    const userKey = this.userKey(state, chainId);
+    const now = Date.now();
+    return (this.standardReadFailures.get(userKey)?.retryAt ?? 0) > now || (this.endpointReadFailures.get(`${userKey}:${path}`)?.retryAt ?? 0) > now;
+  }
   portfolioSnapshot(state, chainId, context, contextKey) {
     const key2 = `snapshot:${contextKey}`;
     const cached = this.readCache.get(key2);
@@ -9772,6 +10900,7 @@ var YieldseekerAgent = class {
         const settling = inWindow && !this.deferredToLedger(contextKey);
         if (inWindow) this.settlementChecks.set(contextKey, (this.settlementChecks.get(contextKey) ?? 0) + 1);
         const ready = this.readyForces.delete(contextKey) && this.noteReadyForce(contextKey);
+        const movementForce = this.forceNextSnapshot.has(contextKey) && !this.readCoolingDown(state, chainId, this.snapshotPath(context, true)) && this.forceNextSnapshot.delete(contextKey);
         return this.requestPortfolioSnapshot(
           state,
           chainId,
@@ -9779,7 +10908,7 @@ var YieldseekerAgent = class {
           contextKey,
           version,
           generation,
-          allocationChanged || settling || ready
+          allocationChanged || settling || ready || movementForce
         );
       })
     };
@@ -10229,7 +11358,7 @@ var YieldseekerAgent = class {
       }
       const ttl = this.portfolioCacheMs(contextKey);
       this.settlementChecks.set(contextKey, 1);
-      const force = !this.deferredToLedger(contextKey);
+      const force = true;
       await this.cachedRead(
         `snapshot:${contextKey}`,
         ttl,
@@ -10284,13 +11413,22 @@ var YieldseekerAgent = class {
       options.assertCurrent?.();
       return this.api.request(path, { method: options.method, body: options.body, signature: signature2 });
     };
-    let signature = await this.auth.getToken(state, chainId);
+    const cached = options.promptless ? this.auth.peekToken(state, chainId) : void 0;
+    if (options.promptless && !cached)
+      throw new OwneyError(
+        "AGENT_AUTH_FAILED",
+        "No Yieldseeker sign-in is available without a prompt.",
+        { reason: "YIELDSEEKER_SIGN_IN_REQUIRED" },
+        this.id
+      );
+    let signature = cached ?? await this.auth.getToken(state, chainId);
     try {
       return await request2(signature);
     } catch (error) {
       if (!(error instanceof YieldseekerApiError)) throw error;
       if (error.providerCode === "NO_USER") throw error;
       if (!error.isAuthenticationError) throw error;
+      if (options.promptless) throw error;
       signature = await this.auth.refreshToken(state, chainId, signature);
       try {
         return await request2(signature);
@@ -10518,6 +11656,16 @@ var YieldseekerAgent = class {
 };
 
 // src/lib/swap/swap-api.ts
+var FUSION_SECRET_SERVER_PUBLISH = 1;
+var FUSION_SECRET_HANDOFF_TIMEOUT_MS = 5e3;
+function handoffFailure(error) {
+  const statusCode2 = error instanceof OwneyError && typeof error.details?.statusCode === "number" ? error.details.statusCode : void 0;
+  return new OwneyError(
+    error instanceof OwneyError ? error.code : "SWAP_REQUEST_FAILED",
+    "The swap secret handoff did not complete.",
+    statusCode2 === void 0 ? {} : { statusCode: statusCode2 }
+  );
+}
 async function request(baseUrl, apiKey, path, init) {
   const url = `${baseUrl}/api/v1/swap${path}`;
   const controller = new AbortController();
@@ -10530,7 +11678,8 @@ async function request(baseUrl, apiKey, path, init) {
           "Content-Type": "application/json",
           "x-owney-api-key": apiKey
         },
-        ...init ? { body: JSON.stringify(init.body) } : {}
+        ...init ? { body: JSON.stringify(init.body) } : {},
+        ...init?.redirect ? { redirect: init.redirect } : {}
       });
       if (!res.ok) {
         const text = await res.text().catch(() => "");
@@ -10563,7 +11712,7 @@ async function request(baseUrl, apiKey, path, init) {
         );
       }
       return json.data;
-    }, 2e4, () => new OwneyError(
+    }, init?.timeoutMs ?? 2e4, () => new OwneyError(
       "SWAP_REQUEST_FAILED",
       "Swap request timed out. Its outcome may still need confirmation.",
       { requestTimedOut: true, phase: path === "/order" ? "submit" : "read" }
@@ -10647,8 +11796,9 @@ function createSwapApi(baseUrl, apiKey) {
     /**
      * Builds a Fusion+ order server-side and returns EIP-712 typed data.
      *
-     * Only HASHES go over the wire. The preimages never leave the browser —
-     * see swap.secrets.
+     * Only HASHES go over the wire. The preimages leave the browser only
+     * through `handoffSecrets`, and only with the caller's opt-in — see
+     * swap.secrets.
      */
     buildOrder: (params) => request(baseUrl, apiKey, "/order/build", {
       method: "POST",
@@ -10675,6 +11825,23 @@ function createSwapApi(baseUrl, apiKey) {
       method: "POST",
       body: { orderHash, secret }
     }),
+    /**
+     * Hands a signed Fusion+ order's secrets to our routing API, which checks
+     * them against the order and publishes each one only once 1inch reports
+     * its destination escrow ready (part 5). The browser keeps publishing too;
+     * a double publish is a no-op upstream.
+     *
+     * Only our own API: a redirect is refused, since the body carries the
+     * preimages. Bounded to 5 s.
+     */
+    handoffSecrets: (body) => request(baseUrl, apiKey, "/order/secrets", {
+      method: "POST",
+      body,
+      redirect: "error",
+      timeoutMs: FUSION_SECRET_HANDOFF_TIMEOUT_MS
+    }).catch((error) => {
+      throw handoffFailure(error);
+    }),
     /**
      * @param chainId present only for a SAME-CHAIN order. That product keys its
      * orders per chain and the Fusion+ endpoint does not know them, so asking
@@ -10858,14 +12025,14 @@ function swapChain(chainId) {
 }
 
 // src/lib/swap/swap.arrival.ts
-var DEFAULT_TIMEOUT_MS = 18e4;
+var DEFAULT_TIMEOUT_MS2 = 18e4;
 var DEFAULT_POLL_MS = 4e3;
 var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
 async function awaitBalanceIncrease(options) {
   const {
     readBalance,
     baseline,
-    timeoutMs = DEFAULT_TIMEOUT_MS,
+    timeoutMs = DEFAULT_TIMEOUT_MS2,
     pollMs = DEFAULT_POLL_MS
   } = options;
   const deadline = Date.now() + timeoutMs;
@@ -10959,14 +12126,14 @@ var isSwapTerminal = (status) => SWAP_TERMINAL_STATUSES.includes(status);
 var DEFAULT_POLL_MS2 = 5e3;
 var MAX_BACKOFF_MS = 3e4;
 var backoffFor = (failures, base7) => Math.min(base7 * 2 ** Math.min(failures, 5), MAX_BACKOFF_MS);
-var DEFAULT_TIMEOUT_MS2 = 15 * 60 * 1e3;
+var DEFAULT_TIMEOUT_MS3 = 15 * 60 * 1e3;
 async function runFusionOrderInternal(deps, options) {
   const {
     orderHash,
     secrets,
     onStage,
     pollIntervalMs = DEFAULT_POLL_MS2,
-    timeoutMs = DEFAULT_TIMEOUT_MS2
+    timeoutMs = DEFAULT_TIMEOUT_MS3
   } = options;
   const deadline = deps.now() + timeoutMs;
   let partial = options.hasPartialFill === true;
@@ -11047,14 +12214,14 @@ async function runFusionOrderInternal(deps, options) {
   }
 }
 function runFusionOrder(deps, options) {
-  return observeOrder(options.orderHash, () => runFusionOrderInternal(deps, options));
+  return observeOrder(options.orderHash, () => runFusionOrderInternal(deps, options), { wait: options.waitForWatcher === true });
 }
 
 // src/lib/swap/swap.same-chain-runner.ts
 var DEFAULT_POLL_MS3 = 5e3;
 var MAX_BACKOFF_MS2 = 3e4;
 var backoffFor2 = (failures, base7) => Math.min(base7 * 2 ** Math.min(failures, 5), MAX_BACKOFF_MS2);
-var DEFAULT_TIMEOUT_MS3 = 3 * 60 * 1e3;
+var DEFAULT_TIMEOUT_MS4 = 3 * 60 * 1e3;
 function explain(status) {
   switch (status) {
     case "expired":
@@ -11078,7 +12245,7 @@ async function runSameChainOrderInternal(deps, options) {
     orderHash,
     onStage,
     pollIntervalMs = DEFAULT_POLL_MS3,
-    timeoutMs = DEFAULT_TIMEOUT_MS3
+    timeoutMs = DEFAULT_TIMEOUT_MS4
   } = options;
   const deadline = deps.now() + timeoutMs;
   let partial = options.hasPartialFill === true;
@@ -11131,7 +12298,7 @@ async function runSameChainOrderInternal(deps, options) {
   }
 }
 function runSameChainOrder(deps, options) {
-  return observeOrder(options.orderHash, () => runSameChainOrderInternal(deps, options));
+  return observeOrder(options.orderHash, () => runSameChainOrderInternal(deps, options), { wait: options.waitForWatcher === true });
 }
 
 // src/lib/swap/swap.secret-store.ts
@@ -11156,6 +12323,21 @@ function saveOrder(order) {
     return false;
   }
 }
+function loadOrder(orderHash) {
+  const store = storage5();
+  if (!store) return null;
+  try {
+    const raw2 = store.getItem(keyFor2(orderHash));
+    if (!raw2) return null;
+    const parsed = JSON.parse(raw2);
+    if (!Array.isArray(parsed.secrets) || parsed.secrets.length === 0) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
 function clearOrder(orderHash) {
   const store = storage5();
   if (!store) return;
@@ -11234,10 +12416,10 @@ async function affordableAmount(deps, quoted, reserve = 0n) {
 }
 async function executeSwap(deps, options) {
   const { quote, walletAddress, onStage } = options;
-  let active2 = true;
+  let active = true;
   const original = deps;
   const assertActive = () => {
-    if (!active2) throw new OwneyError("SWAP_REQUEST_FAILED", "This swap attempt is no longer active.");
+    if (!active) throw new OwneyError("SWAP_REQUEST_FAILED", "This swap attempt is no longer active.");
   };
   const call = async (work, write = false) => {
     assertActive();
@@ -11298,7 +12480,7 @@ async function executeSwap(deps, options) {
     }
     return { received: arrived.toString(), ...result };
   } finally {
-    active2 = false;
+    active = false;
   }
 }
 async function runClassic(deps, options) {
@@ -11417,6 +12599,7 @@ async function runSameChainFusion(deps, options, walletAddress) {
   }
   await runSameChainOrder(deps.sameChainRunner ?? deps.runner, {
     orderHash: built.orderHash,
+    waitForWatcher: true,
     ...onStage ? { onStage } : {}
   });
   return { orderHash: built.orderHash, spent: amount.toString() };
@@ -11485,67 +12668,118 @@ async function runFusion(deps, options, walletAddress) {
     ...direction ? { direction } : {},
     ...permit ? { permit } : {}
   });
-  const durable = saveOrder({
-    orderHash: built.orderHash,
-    walletAddress,
-    secrets,
-    srcChainId: quote.src.chainId,
-    srcSymbol: quote.src.symbol,
-    dstChainId: quote.dst.chainId,
-    dstSymbol: quote.dst.symbol,
-    amount: amount.toString(),
-    createdAt: Date.now()
-  });
-  debugLog("owney-sdk", "swap: order built", { orderHash: built.orderHash });
-  let signature;
+  const release = claimOrder(built.orderHash);
   try {
-    onStage?.("signing");
-    await deps.ensureChain(quote.src.chainId);
-    signature = await awaitWalletPrompt(() => deps.signTypedData(built.typedData), "sign the swap");
-    options.assertCurrent?.();
-    options.onOrderPrepared?.(built.orderHash, { spent: amount.toString(), expected: built.dstAmount });
-  } catch (error) {
+    const stored = {
+      orderHash: built.orderHash,
+      walletAddress,
+      secrets,
+      srcChainId: quote.src.chainId,
+      srcSymbol: quote.src.symbol,
+      dstChainId: quote.dst.chainId,
+      dstSymbol: quote.dst.symbol,
+      amount: amount.toString(),
+      createdAt: Date.now(),
+      ...options.pendingDeposit ? { pendingDeposit: withinOrderMinimum(options.pendingDeposit, built.dstAmountMin) } : {}
+    };
+    const durable = saveOrder(stored);
+    debugLog("owney-sdk", "swap: order built", { orderHash: built.orderHash });
+    let signature;
+    try {
+      onStage?.("signing");
+      await deps.ensureChain(quote.src.chainId);
+      signature = await awaitWalletPrompt(() => deps.signTypedData(built.typedData), "sign the swap");
+      options.assertCurrent?.();
+      options.onOrderPrepared?.(built.orderHash, { spent: amount.toString(), expected: built.dstAmount });
+    } catch (error) {
+      clearOrder(built.orderHash);
+      throw error;
+    }
+    if (options.secretHandoff && deps.api.handoffSecrets) {
+      if (await tryHandoff(deps, options.secretHandoff, built, quote, secretHashes, secrets))
+        saveOrder({ ...stored, serverSecrets: true });
+    }
+    debugLog("owney-sdk", "swap: signed, submitting to relayer");
+    try {
+      await deps.api.submitOrder({
+        srcChainId: quote.src.chainId,
+        // The ORDER STRUCT, not the typed-data envelope we just signed. Sending
+        // the envelope here gets a bare 500 from the relayer.
+        order: built.order,
+        signature,
+        quoteId: built.quoteId,
+        // Single-fill orders must NOT carry secretHashes — the relayer rejects
+        // them with SECRET_HASHES_NOT_REQUIRED. The one hash is already inside the
+        // order's hashlock, so repeating it here is redundant, and only a
+        // multi-fill order (a Merkle tree of hashes) needs them listed.
+        ...secretHashes.length > 1 ? { secretHashes } : {},
+        ...built.extension ? { extension: built.extension } : {}
+      });
+    } catch (error) {
+      throw submissionUnknown(error, built.orderHash);
+    }
+    debugLog("owney-sdk", "swap: order submitted, polling escrows");
+    try {
+      options.onOrderSubmitted?.(built.orderHash, { spent: amount.toString(), expected: built.dstAmount, durable });
+    } catch {
+    }
+    try {
+      await runFusionOrder(deps.runner, {
+        orderHash: built.orderHash,
+        // This run owns the order: wait out a watcher another tab started.
+        waitForWatcher: true,
+        secrets,
+        ...onStage ? { onStage } : {}
+      });
+    } catch (error) {
+      if (error instanceof OwneyError && error.code === "SWAP_ORDER_REFUNDED" && error.details?.outcome === "refunded") {
+        clearOrder(built.orderHash);
+      }
+      throw error;
+    }
     clearOrder(built.orderHash);
-    throw error;
-  }
-  debugLog("owney-sdk", "swap: signed, submitting to relayer");
+    return { orderHash: built.orderHash, spent: amount.toString() };
+  } finally {
+    release();
+  }
+}
+var HANDOFF_DECLINE_CODES = /* @__PURE__ */ new Set([
+  "FUNDING_TASK_KIND_DISABLED",
+  "SECRETS_INVALID",
+  "SECRET_HASH_MISMATCH",
+  "ORDER_UNREADABLE",
+  "ORDER_HASH_MISMATCH",
+  "HASHLOCK_MISMATCH",
+  "MAKER_MISMATCH",
+  "CHAIN_MISMATCH",
+  "OPERATION_INVALID",
+  "ORDER_CONFLICT"
+]);
+async function tryHandoff(deps, handoff, built, quote, secretHashes, secrets) {
   try {
-    await deps.api.submitOrder({
+    const answer = await bounded(() => deps.api.handoffSecrets({
+      operation: handoff.operation,
+      orderHash: built.orderHash,
       srcChainId: quote.src.chainId,
-      // The ORDER STRUCT, not the typed-data envelope we just signed. Sending
-      // the envelope here gets a bare 500 from the relayer.
+      dstChainId: quote.dst.chainId,
       order: built.order,
-      signature,
-      quoteId: built.quoteId,
-      // Single-fill orders must NOT carry secretHashes — the relayer rejects
-      // them with SECRET_HASHES_NOT_REQUIRED. The one hash is already inside the
-      // order's hashlock, so repeating it here is redundant, and only a
-      // multi-fill order (a Merkle tree of hashes) needs them listed.
-      ...secretHashes.length > 1 ? { secretHashes } : {},
-      ...built.extension ? { extension: built.extension } : {}
-    });
-  } catch (error) {
-    throw submissionUnknown(error, built.orderHash);
-  }
-  debugLog("owney-sdk", "swap: order submitted, polling escrows");
-  try {
-    options.onOrderSubmitted?.(built.orderHash, { spent: amount.toString(), expected: built.dstAmount, durable });
-  } catch {
-  }
-  try {
-    await runFusionOrder(deps.runner, {
-      orderHash: built.orderHash,
-      secrets,
-      ...onStage ? { onStage } : {}
-    });
-  } catch (error) {
-    if (error instanceof OwneyError && error.code === "SWAP_ORDER_REFUNDED" && error.details?.outcome === "refunded") {
-      clearOrder(built.orderHash);
+      extension: built.extension,
+      secretHashes,
+      fusionSecrets: secrets
+    }), FUSION_SECRET_HANDOFF_TIMEOUT_MS, () => new Error("secret handoff timed out"));
+    if (answer?.accepted === true) {
+      debugLog("owney-sdk", "swap: secrets handed to the server", { orderHash: built.orderHash });
+      return true;
     }
-    throw error;
+    const code = typeof answer?.code === "string" && HANDOFF_DECLINE_CODES.has(answer.code) ? answer.code : "OTHER";
+    debugLog("owney-sdk", "swap: secret handoff declined, the browser publishes", { code });
+  } catch {
+    debugLog("owney-sdk", "swap: secret handoff unavailable, the browser publishes");
   }
-  clearOrder(built.orderHash);
-  return { orderHash: built.orderHash, spent: amount.toString() };
+  return false;
+}
+function withinOrderMinimum(deposit, orderMinimum) {
+  return typeof orderMinimum === "string" && /^\d+$/.test(orderMinimum) && /^\d+$/.test(deposit.received) && BigInt(orderMinimum) < BigInt(deposit.received) ? { ...deposit, received: orderMinimum } : deposit;
 }
 function submissionUnknown(error, orderHash) {
   return new OwneyError(
@@ -11568,7 +12802,7 @@ async function awaitWithdrawalPayouts(options) {
   const payouts = new Map(Object.entries(options.results).map(([id, result]) => [id, { result, evidence: result.evidence }]));
   const timeoutMs = Math.max(0, options.timeoutMs ?? 18e4);
   const deadline = options.deadline ?? Date.now() + timeoutMs;
-  let active2 = true;
+  let active = true;
   let timer;
   const incomplete = (reason, agentId) => new OwneyError(
     "WITHDRAW_SWAP_INCOMPLETE",
@@ -11586,7 +12820,7 @@ async function awaitWithdrawalPayouts(options) {
   );
   const assertActive = () => {
     options.assertCurrent();
-    if (!active2 || Date.now() > deadline) throw incomplete("PAYOUT_CONFIRMATION_TIMEOUT");
+    if (!active || Date.now() > deadline) throw incomplete("PAYOUT_CONFIRMATION_TIMEOUT");
   };
   const pause = async () => {
     assertActive();
@@ -11763,7 +12997,7 @@ async function awaitWithdrawalPayouts(options) {
       timer = setTimeout(() => reject(incomplete("PAYOUT_CONFIRMATION_TIMEOUT")), Math.max(0, deadline - Date.now()));
     })]);
   } finally {
-    active2 = false;
+    active = false;
     if (timer) clearTimeout(timer);
   }
 }
@@ -12331,7 +13565,8 @@ import {
   createPublicClient as createPublicClient4,
   createWalletClient as createWalletClient5,
   custom as custom5,
-  erc20Abi as erc20Abi7
+  erc20Abi as erc20Abi7,
+  isAddress as isAddress5
 } from "viem";
 import { base as base6, arbitrum as arbitrum3, mainnet as mainnet3 } from "viem/chains";
 
@@ -12340,21 +13575,42 @@ import {
   keccak256 as keccak2562,
   parseTransaction
 } from "viem";
+var SPONSORED_DEPOSIT_SERVER_BROADCAST = 1;
 async function executeTokenBatch(input, initial) {
   let body = initial, family, ended = false;
   const deadlineAt = Date.now() + 9e4, controller = new AbortController();
   let timer;
-  const pending = () => new OwneyError(
-    "DEPOSIT_IN_PROGRESS",
-    "Deposit is awaiting confirmation. Its transaction is still being checked.",
-    {
-      sponsorPending: true,
-      phase: body.serializedTransaction ? "deposit" : "approval",
-      txHash: body.serializedTransaction ? keccak2562(body.serializedTransaction) : body.serializedPermitTransaction ? keccak2562(body.serializedPermitTransaction) : void 0,
-      notSubmitted: false,
-      safeToFallback: false
-    }
-  );
+  const serverSent = /* @__PURE__ */ new Set();
+  let accepted;
+  let maybeAccepted = !!input.resumeSaved, alreadySending = false;
+  const verifiedFailures = /* @__PURE__ */ new WeakSet();
+  const pending = () => {
+    const deposit = body.serializedTransaction ? keccak2562(body.serializedTransaction) : accepted;
+    const unknown2 = !deposit && maybeAccepted;
+    const deadline = /^\d{1,15}$/.test(body.deadline) ? Number(body.deadline) : void 0;
+    return new OwneyError(
+      "DEPOSIT_IN_PROGRESS",
+      "Deposit is awaiting confirmation. Its transaction is still being checked.",
+      {
+        sponsorPending: true,
+        phase: deposit || unknown2 ? "deposit" : "approval",
+        txHash: deposit ?? (body.serializedPermitTransaction && !unknown2 ? keccak2562(body.serializedPermitTransaction) : void 0),
+        notSubmitted: false,
+        safeToFallback: false,
+        // Only while the current deposit is the one the server will send.
+        ...deposit && serverSent.has(deposit) ? { serverBroadcast: true } : unknown2 ? { serverBroadcast: "unknown" } : {},
+        ...unknown2 && alreadySending ? { code: "DEPOSIT_ALREADY_SENDING" } : {},
+        // The Permit2 deadline (seconds): after it no deposit of this
+        // authorization can execute, which bounds an unknown outcome. Never
+        // after a 409 DEPOSIT_ALREADY_SENDING: this refused authorization is
+        // not the deposit being sent.
+        ...unknown2 && !alreadySending && deadline !== void 0 ? { authorizationDeadline: deadline } : {},
+        // Its Permit2 nonce: with the deadline, the chain shows whether any
+        // deposit of this authorization executed.
+        ...unknown2 && !alreadySending || deposit && serverSent.has(deposit) ? { permit2Nonce: body.nonce } : {}
+      }
+    );
+  };
   const assertCurrent = () => {
     if (ended || Date.now() >= deadlineAt) throw pending();
     input.assertCurrent?.();
@@ -12379,20 +13635,52 @@ async function executeTokenBatch(input, initial) {
     }
     return operationId ? { ...value, operationId } : value;
   };
-  const post2 = () => bounded2(
-    postSponsorBatchTransfer({
-      apiKey: input.apiKey,
-      baseUrl: input.baseUrl,
-      body: withOperationId(body),
-      signal: controller.signal
-    })
-  );
+  const withServerBroadcast = (value) => {
+    const request2 = withOperationId(value);
+    return request2.operationId ? { ...request2, serverBroadcast: true } : request2;
+  };
+  const post2 = async () => {
+    const request2 = withServerBroadcast(body);
+    const flaggedPrepare = request2.serverBroadcast === true && !request2.serializedTransaction && !(request2.erc2612Permit && !request2.serializedPermitTransaction);
+    let result;
+    try {
+      result = await Promise.race([
+        postSponsorBatchTransfer({
+          apiKey: input.apiKey,
+          baseUrl: input.baseUrl,
+          body: request2,
+          signal: controller.signal
+        }),
+        timeout
+      ]);
+    } catch (error) {
+      const details = error instanceof OwneyError ? error.details : void 0;
+      const sending = details?.code === "DEPOSIT_ALREADY_SENDING";
+      if (flaggedPrepare && (ended || !(error instanceof OwneyError) || details?.outcomeUnknown === true || sending)) {
+        maybeAccepted = true;
+        alreadySending = sending;
+      }
+      throw error;
+    }
+    maybeAccepted = false;
+    alreadySending = false;
+    if (result.serverBroadcast === true && result.serializedTransaction && !body.serializedTransaction) {
+      serverSent.add(result.txHash);
+      accepted = result.txHash;
+      try {
+        input.onSubmitted?.(result.txHash, reference(result.txHash), true);
+      } catch {
+      }
+    }
+    assertCurrent();
+    return result;
+  };
   const replacements = { approval: 0, deposit: 0 };
   const unavailable = /* @__PURE__ */ new Set();
   const observedApprovals = /* @__PURE__ */ new Set();
   const checkpointed = /* @__PURE__ */ new Set();
   const accounted = /* @__PURE__ */ new Set();
-  const remember = async (phase, bytes, hash2, predecessorHash) => {
+  const remember = async (phase, bytes, hash2, predecessorHash, submissionAttempted = false) => {
     assertCurrent();
     if (keccak2562(bytes) !== hash2) throw pending();
     const tx = parseTransaction(bytes);
@@ -12411,7 +13699,7 @@ async function executeTokenBatch(input, initial) {
           nonce: String(tx.nonce),
           predecessorHash,
           preparedAt: Date.now(),
-          submissionAttempted: false
+          submissionAttempted
         },
         assertCurrent
       )
@@ -12425,13 +13713,18 @@ async function executeTokenBatch(input, initial) {
   const markSubmission = async (phase) => {
     const hash2 = phase === "deposit" ? family?.current.deposit : family?.current.approval;
     if (!family || !hash2) throw pending();
+    const flag = serverSent.has(hash2) ? [true] : [];
     if (phase === "deposit" && !checkpointed.has(hash2)) {
       try {
         await bounded2(
-          Promise.resolve(input.onBeforeSubmission?.(hash2, reference(hash2)))
+          Promise.resolve(
+            input.onBeforeSubmission?.(hash2, reference(hash2), ...flag)
+          )
         );
+        checkpointed.add(hash2);
       } catch (error) {
-        if (error instanceof OwneyError && error.code === "DEPOSIT_CHECKPOINT_FAILED")
+        if (serverSent.has(hash2)) {
+        } else if (error instanceof OwneyError && error.code === "DEPOSIT_CHECKPOINT_FAILED")
           throw new OwneyError(error.code, error.message, {
             ...error.details,
             notSubmitted: !family.attempts.some(
@@ -12439,9 +13732,8 @@ async function executeTokenBatch(input, initial) {
             ),
             safeToFallback: false
           });
-        throw error;
+        else throw error;
       }
-      checkpointed.add(hash2);
     }
     assertCurrent();
     const attempt = family.attempts.find((a) => a.hash === hash2);
@@ -12456,7 +13748,7 @@ async function executeTokenBatch(input, initial) {
     assertCurrent();
     if (phase === "deposit")
       try {
-        input.onSubmitted?.(hash2, reference(hash2));
+        input.onSubmitted?.(hash2, reference(hash2), ...flag);
       } catch {
       }
     assertCurrent();
@@ -12492,12 +13784,15 @@ async function executeTokenBatch(input, initial) {
       }
       return observation.txHash;
     }
-    if (observation.status === "failed" || observation.status === "expired")
-      throw new OwneyError(
+    if (observation.status === "failed" || observation.status === "expired") {
+      const failure = new OwneyError(
         "SPONSOR_REQUEST_FAILED",
         observation.status === "expired" ? "The deposit authorization expired without transferring funds. Start a new deposit." : "Sponsored deposit transactions reverted. Please retry.",
         { notSubmitted: true, safeToFallback: false }
       );
+      verifiedFailures.add(failure);
+      throw failure;
+    }
   };
   try {
     assertCurrent();
@@ -12513,6 +13808,14 @@ async function executeTokenBatch(input, initial) {
         tokenBatchKey(input),
         JSON.stringify(tokenBatchStoredBody(body))
       );
+    if (/^\d{1,78}$/.test(body.nonce) && /^\d{1,15}$/.test(body.deadline))
+      try {
+        input.onAuthorization?.({
+          permit2Nonce: body.nonce,
+          authorizationDeadline: Number(body.deadline)
+        });
+      } catch {
+      }
     if (family) {
       const winner = await observe();
       if (winner) return winner;
@@ -12536,6 +13839,20 @@ async function executeTokenBatch(input, initial) {
           result = await post2();
         } catch (error) {
           assertCurrent();
+          if (maybeAccepted && alreadySending) {
+            if (family)
+              finishTokenBatchFamily(input, family, {
+                kind: "failed",
+                blockNumber: "0"
+              });
+            else
+              tokenBatchClear(
+                tokenBatchKey(input),
+                JSON.stringify(tokenBatchStoredBody(body))
+              );
+            throw pending();
+          }
+          if (maybeAccepted && !family) throw pending();
           if (!family) {
             tokenBatchClear(
               tokenBatchKey(input),
@@ -12558,7 +13875,9 @@ async function executeTokenBatch(input, initial) {
           await remember(
             "deposit",
             result.serializedTransaction,
-            result.txHash
+            result.txHash,
+            void 0,
+            serverSent.has(result.txHash)
           );
           needsPost = true;
           continue;
@@ -12634,6 +13953,10 @@ async function executeTokenBatch(input, initial) {
         )
       );
     }
+  } catch (error) {
+    if ((serverSent.size || maybeAccepted) && !(error && typeof error === "object" && verifiedFailures.has(error)))
+      throw pending();
+    throw error;
   } finally {
     ended = true;
     if (timer) clearTimeout(timer);
@@ -12663,14 +13986,14 @@ async function releaseExpiredTokenBatch(i) {
   let timer;
   let expired = false;
   const check = async () => {
-    let active2 = read(key2);
-    if (active2 && i.expectedTxHash) {
-      const current = JSON.parse(active2);
+    let active = read(key2);
+    if (active && i.expectedTxHash) {
+      const current = JSON.parse(active);
       if (!current.serializedTransaction || keccak2563(current.serializedTransaction).toLowerCase() !== i.expectedTxHash.toLowerCase())
-        active2 = void 0;
+        active = void 0;
     }
     const archiveKey = i.expectedTxHash ? `${key2}:expired:${i.expectedTxHash.toLowerCase()}` : void 0;
-    const saved = active2 ?? (archiveKey && (expiredRecords.get(archiveKey) ?? (typeof window === "undefined" ? void 0 : window.localStorage.getItem(archiveKey))));
+    const saved = active ?? (archiveKey && (expiredRecords.get(archiveKey) ?? (typeof window === "undefined" ? void 0 : window.localStorage.getItem(archiveKey))));
     if (!saved) return;
     const body = JSON.parse(saved);
     if (!body.serializedTransaction || body.chainId !== i.chainId || !isAddressEqual2(body.from, i.owner) || !isAddressEqual2(body.token, i.token) || !body.transfers?.length) return;
@@ -12694,8 +14017,8 @@ async function releaseExpiredTokenBatch(i) {
       args: [i.owner, nonce >> 8n],
       blockNumber: block.number
     });
-    if (expired || typeof bitmap !== "bigint" || bitmap < 0n || bitmap > MAX_UINT256 || (bitmap & 1n << (nonce & 255n)) !== 0n || active2 && read(key2) !== active2) return;
-    if (active2) {
+    if (expired || typeof bitmap !== "bigint" || bitmap < 0n || bitmap > MAX_UINT256 || (bitmap & 1n << (nonce & 255n)) !== 0n || active && read(key2) !== active) return;
+    if (active) {
       const terminalKey = `${key2}:expired:${txHash.toLowerCase()}`;
       expiredRecords.set(terminalKey, saved);
       let persisted = typeof window === "undefined";
@@ -12732,15 +14055,15 @@ function clear(key2, body) {
 function sponsorTokenBatch(i) {
   const key2 = pendingKey(i);
   const plan = planOf(i.transfers);
-  const active2 = inflight.get(key2);
-  if (active2) {
-    if (active2.plan !== plan)
+  const active = inflight.get(key2);
+  if (active) {
+    if (active.plan !== plan)
       return Promise.reject(
         new Error(
           "A token deposit is already in progress. Wait for its result before depositing again."
         )
       );
-    return active2.promise;
+    return active.promise;
   }
   const promise = execute(i, key2, plan).finally(() => inflight.delete(key2));
   inflight.set(key2, { plan, promise });
@@ -12752,8 +14075,15 @@ async function execute(i, key2, plan) {
   ) || new Set(i.transfers.map((t) => t.to.toLowerCase())).size !== i.transfers.length)
     throw new Error("Invalid token deposit shares.");
   const send = (body) => executeTokenBatch(i, body);
+  if (!i.resumeTxHash) await dropExpiredHashlessTokenBatch(i, i.pub);
   const family = await loadTokenBatchFamily(i, i.resumeTxHash);
   const saved = family ? JSON.stringify(family.body) : read(key2);
+  if (!saved && i.resumeSaved)
+    throw new OwneyError(
+      "DEPOSIT_IN_PROGRESS",
+      "The saved deposit is no longer available. Check its status before depositing again.",
+      { notSubmitted: false, safeToFallback: false }
+    );
   if (saved) {
     const previous = JSON.parse(saved);
     if (previous.chainId !== i.chainId || !isAddressEqual2(previous.from, i.owner) || !isAddressEqual2(previous.token, i.token) || planOf(previous.transfers) !== plan)
@@ -12863,10 +14193,13 @@ function makeSponsoredTokenCallback(deps) {
       pub,
       wallet,
       onApproved: deps.onApproved,
-      onSubmitted: (hash2, reference) => deps.onSubmitted?.(hash2, transfers, reference),
-      onBeforeSubmission: (hash2, reference) => deps.onBeforeSubmission?.(hash2, transfers, reference),
+      // Rest arguments keep the callbacks' arity: the flag appears only when set.
+      onSubmitted: (hash2, ...rest) => deps.onSubmitted?.(hash2, transfers, ...rest),
+      onBeforeSubmission: (hash2, ...rest) => deps.onBeforeSubmission?.(hash2, transfers, ...rest),
       assertCurrent: deps.assertCurrent,
       resumeTxHash: deps.resumeTxHash,
+      ...deps.resumeSaved ? { resumeSaved: true } : {},
+      ...deps.onAuthorization ? { onAuthorization: deps.onAuthorization } : {},
       operationId: deps.operationId
     });
   };
@@ -13173,6 +14506,33 @@ function sponsoredTokensFor(asset) {
 function shouldFallbackToUserPaid(error, asset, appCallback) {
   return (asset === "WETH" || asset === "USDC") && appCallback === void 0 && error instanceof OwneyError && error.code === "SPONSOR_REQUEST_FAILED" && error.details?.safeToFallback === true;
 }
+function serverBroadcastOf(error) {
+  const flag = (value) => {
+    const details = value?.details;
+    return details?.serverBroadcast === true || details?.serverBroadcast === "unknown" ? details.serverBroadcast : void 0;
+  };
+  return flag(error) ?? flag(error?.details?.cause);
+}
+function authorizationDeadlineOf(error) {
+  const read2 = (value) => {
+    const deadline = value?.details?.authorizationDeadline;
+    return typeof deadline === "number" && Number.isSafeInteger(deadline) && deadline > 0 ? deadline : void 0;
+  };
+  return read2(error) ?? read2(error?.details?.cause);
+}
+function alreadySendingOf(error) {
+  const code = (value) => value?.details?.code;
+  return code(error) === "DEPOSIT_ALREADY_SENDING" || code(error?.details?.cause) === "DEPOSIT_ALREADY_SENDING";
+}
+function permit2NonceOf(error) {
+  const read2 = (value) => {
+    const nonce = value?.details?.permit2Nonce;
+    return typeof nonce === "string" && /^\d{1,78}$/.test(nonce) ? nonce : void 0;
+  };
+  return read2(error) ?? read2(error?.details?.cause);
+}
+var serverMayOwn = (leg) => leg !== void 0 && leg.settled !== null;
+var SERVER_HANDOFF_WAIT_MS = 1e4;
 var OwneySDK = class {
   agents = /* @__PURE__ */ new Map();
   activeAgents = /* @__PURE__ */ new Set();
@@ -13201,13 +14561,21 @@ var OwneySDK = class {
   ledger;
   reservationMode;
   reservationTransport;
+  /** The caller's Zyfai server tasks opt-in: `true`, a function read each
+   * time a handoff would start (F-I2(iii)), or undefined (off). */
+  zyfaiServerTasks;
+  /** The caller opted in to the Fusion+ secret handoff (`fusionSecretHandoff: true`). */
+  fusionSecretHandoff;
   cachedSponsoredCallback = null;
   cachedWethSponsoredCallback = null;
   paymasterServiceUrl;
   cachedSponsoredCallsCallbacks = /* @__PURE__ */ new Map();
   agentReads = new AgentReads();
   depositFamilyReads = /* @__PURE__ */ new Map();
-  recoveredFundingReads = /* @__PURE__ */ new Set();
+  /** Movements (owner, chain, agent, token, tx hash) whose balance refresh this
+   * session started: true when it armed the refresh, false when its deadline
+   * had passed (it only dropped the cache and forced one snapshot read). */
+  recoveredFundingReads = /* @__PURE__ */ new Map();
   fundingBalanceChecks = /* @__PURE__ */ new WeakMap();
   activationChecks = /* @__PURE__ */ new Map();
   // Protect the SDK entry point as well as the mini-app hook. This owns only
@@ -13245,6 +14613,8 @@ var OwneySDK = class {
     });
     this.reservationMode = config.withdrawalReservation === "fail-closed" || config.withdrawalReservation === "off" ? config.withdrawalReservation : "fail-open";
     this.reservationTransport = { apiKey: config.apiKey, baseUrl: config.routingApiBaseUrl, appName: config.appName };
+    this.zyfaiServerTasks = config.zyfaiServerTasks === true || typeof config.zyfaiServerTasks === "function" ? config.zyfaiServerTasks : void 0;
+    this.fusionSecretHandoff = config.fusionSecretHandoff === true;
   }
   /** Finishes a funding-ledger operation on success and adds its reference to
    * the result. The result object is copied, never mutated or replaced.
@@ -13310,16 +14680,34 @@ var OwneySDK = class {
       return void 0;
     }
   }
+  /**
+   * Part 5: the swap's ledger identity, for the executor's Fusion+ secret
+   * handoff. Only with the `fusionSecretHandoff` opt-in and an open operation;
+   * otherwise undefined, and the executor sends nothing. Owner and token are
+   * lowercased, as the ledger reports them.
+   */
+  secretHandoffFor(op, input) {
+    if (!this.fusionSecretHandoff || !op || !input || input.kind !== "swap_deposit" && input.kind !== "withdraw_swap")
+      return void 0;
+    return { operation: {
+      clientOperationId: op.operationId,
+      kind: input.kind,
+      owner: input.owner.toLowerCase(),
+      chainId: input.chainId,
+      token: input.token.toLowerCase()
+    } };
+  }
   closeSwapLedger(op) {
     if (op && this.openSwapLedgers.get(op.operationId) === op) this.openSwapLedgers.delete(op.operationId);
   }
-  /** Reports one agent's withdrawal evidence as its leg. Never throws. */
-  ledgerWithdrawalLeg(op, evidence) {
+  /** Reports one agent's withdrawal evidence as its leg (with `errorCode`, when
+   * given). Never throws. */
+  ledgerWithdrawalLeg(op, evidence, errorCode) {
     if (!op) return;
     try {
       const leg = ledgerLegFromEvidence(evidence, "withdraw");
       const rail = withdrawalLedgerRail(evidence);
-      if (leg) op.leg(rail ? { ...leg, rail } : leg);
+      if (leg) op.leg({ ...rail ? { ...leg, rail } : leg, ...errorCode ? { errorCode } : {} });
       if (leg?.status === "confirmed") this.ledgerProviderSamples(op, evidence, "withdraw");
     } catch {
     }
@@ -13554,8 +14942,8 @@ var OwneySDK = class {
     return createPaidRpcClient(VIEM_CHAIN2[chainId], this.rpcUrls);
   }
   /** Builds the default USDC batch callback for the connected wallet. */
-  getDefaultSponsoredCallback(onApproved, onSubmitted, resumeTxHash, onBeforeSubmission, assertSubmissionCurrent, operationId) {
-    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId && this.cachedSponsoredCallback)
+  getDefaultSponsoredCallback(onApproved, onSubmitted, resumeTxHash, onBeforeSubmission, assertSubmissionCurrent, operationId, resumeSaved, onAuthorization) {
+    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId && !resumeSaved && !onAuthorization && this.cachedSponsoredCallback)
       return this.cachedSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const connection = this.requireState();
@@ -13569,6 +14957,8 @@ var OwneySDK = class {
       onSubmitted,
       onBeforeSubmission,
       resumeTxHash,
+      ...resumeSaved ? { resumeSaved: true } : {},
+      ...onAuthorization ? { onAuthorization } : {},
       operationId,
       assertCurrent: () => {
         assertSubmissionCurrent?.();
@@ -13589,7 +14979,7 @@ var OwneySDK = class {
         transport: custom5(provider)
       })
     });
-    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId) this.cachedSponsoredCallback = callback;
+    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId && !resumeSaved && !onAuthorization) this.cachedSponsoredCallback = callback;
     return callback;
   }
   /** Builds the wallet-native sponsored calls callback for compatible paymasters. */
@@ -13618,8 +15008,8 @@ var OwneySDK = class {
    * Mirrors `getDefaultSponsoredCallback()` but signs a Permit2
    * single-use batch authorization instead of an EIP-3009 authorization.
    */
-  getDefaultWethSponsoredCallback(onApproved, onSubmitted, resumeTxHash, onBeforeSubmission, assertSubmissionCurrent, operationId) {
-    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId && this.cachedWethSponsoredCallback)
+  getDefaultWethSponsoredCallback(onApproved, onSubmitted, resumeTxHash, onBeforeSubmission, assertSubmissionCurrent, operationId, resumeSaved, onAuthorization) {
+    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId && !resumeSaved && !onAuthorization && this.cachedWethSponsoredCallback)
       return this.cachedWethSponsoredCallback;
     const provider = this.requireConnectedProvider();
     const connection = this.requireState();
@@ -13633,6 +15023,8 @@ var OwneySDK = class {
       onSubmitted,
       onBeforeSubmission,
       resumeTxHash,
+      ...resumeSaved ? { resumeSaved: true } : {},
+      ...onAuthorization ? { onAuthorization } : {},
       operationId,
       assertCurrent: () => {
         assertSubmissionCurrent?.();
@@ -13653,7 +15045,7 @@ var OwneySDK = class {
         transport: custom5(provider)
       })
     });
-    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId) this.cachedWethSponsoredCallback = callback;
+    if (!onApproved && !onSubmitted && !resumeTxHash && !onBeforeSubmission && !assertSubmissionCurrent && !operationId && !resumeSaved && !onAuthorization) this.cachedWethSponsoredCallback = callback;
     return callback;
   }
   getAgent(agentId) {
@@ -13667,12 +15059,12 @@ var OwneySDK = class {
     return [...this.getActiveAgents().keys()].sort();
   }
   getActiveAgents() {
-    const active2 = /* @__PURE__ */ new Map();
+    const active = /* @__PURE__ */ new Map();
     for (const id of this.activeAgents) {
       const agent = this.agents.get(id);
-      if (agent) active2.set(id, agent);
+      if (agent) active.set(id, agent);
     }
-    return active2;
+    return active;
   }
   /**
    * Read the org's agent policy once and reuse it. fetchOrgAgentConfig never
@@ -13771,7 +15163,13 @@ var OwneySDK = class {
           this.routingApiBaseUrl
         ) : this.rpcUrls,
         this.referralSource,
-        { owneyApiKey: this.apiKey, routingApiBaseUrl: this.routingApiBaseUrl }
+        {
+          owneyApiKey: this.apiKey,
+          routingApiBaseUrl: this.routingApiBaseUrl,
+          // Only an explicit opt-in lets the agent hand the Zyfai session to
+          // Owney; a function is passed as it is and read per handoff.
+          ...this.zyfaiServerTasks !== void 0 ? { zyfaiServerTasks: this.zyfaiServerTasks } : {}
+        }
       );
     }
     if (agentId === "yieldseeker") {
@@ -13993,10 +15391,21 @@ var OwneySDK = class {
       } catch {
       }
     };
-    const onSubmitted = (hash2, destinations, depositAuthorization) => {
+    let permit;
+    const onAuthorization = (value) => {
+      permit = value;
+    };
+    const permitFields = () => permit ? { permit2Nonce: permit.permit2Nonce, authorizationDeadline: permit.authorizationDeadline } : {};
+    const onSubmitted = (hash2, destinations, depositAuthorization, serverBroadcast) => {
       for (const destination of destinations) {
         const evidence = prepared.get(destination.to.toLowerCase());
-        if (evidence) notifyFunding(onProgress, { ...evidence, txHash: hash2, ...depositAuthorization ? { depositAuthorization } : {}, transfer: "pending" });
+        if (evidence) notifyFunding(onProgress, {
+          ...evidence,
+          txHash: hash2,
+          ...depositAuthorization ? { depositAuthorization } : {},
+          ...serverBroadcast ? { serverBroadcast, ...permitFields() } : {},
+          transfer: "pending"
+        });
       }
     };
     const onCallsProgress = (callsId, destinations, transfer) => {
@@ -14005,6 +15414,7 @@ var OwneySDK = class {
         if (evidence) notifyFunding(onProgress, { ...evidence, callsId, transfer });
       }
     };
+    const serverTaskContext = (agent) => this.zyfaiServerTasks !== void 0 && agent.supportsServerTasks === true && ledgerOp ? { operationId: ledgerOp.operationId } : void 0;
     const ledgerDone = (result) => this.ledgerSucceeded(ledgerOp, result);
     const ledgerFailed = (error) => this.ledgerFailed(ledgerOp, error);
     if (BigInt(amount) === 0n) {
@@ -14040,7 +15450,7 @@ var OwneySDK = class {
       });
       await checkpoint2(evidence);
     } : void 0;
-    const checkpointHash = checkpointDestinations ? (hash2, destinations, depositAuthorization) => checkpointDestinations(destinations, { txHash: hash2, depositAuthorization }) : void 0;
+    const checkpointHash = checkpointDestinations ? (hash2, destinations, depositAuthorization, serverBroadcast) => checkpointDestinations(destinations, { txHash: hash2, depositAuthorization, ...serverBroadcast ? { serverBroadcast, ...permitFields() } : {} }) : void 0;
     const checkpointCalls = checkpointDestinations ? (id, destinations) => checkpointDestinations(destinations, { callsId: id }) : void 0;
     const checkpointPaid = checkpoint2 ? (evidence) => checkpoint2([evidence]) : void 0;
     const customCallback = depositCallback && checkpointDestinations ? makeVerificationAwareDepositCallback(async (to, cid, value, verification) => {
@@ -14048,9 +15458,10 @@ var OwneySDK = class {
       await checkpointDestinations([{ to, amount: value }], {});
       return depositCallback(to, cid, value);
     }) : depositCallback;
-    if (options.resumeTxHash && (depositCallback || this.paymasterServiceUrl || !/^0x[\da-f]{64}$/i.test(options.resumeTxHash)))
+    if (options.resumeTxHash && (depositCallback || this.paymasterServiceUrl || !/^0x[\da-f]{64}$/i.test(options.resumeTxHash)) || options.resumeSavedBatch && (options.resumeTxHash || depositCallback || this.paymasterServiceUrl))
       throw new OwneyError("DEPOSIT_IN_PROGRESS", "This deposit cannot resume the saved relayer transaction.");
-    const effectiveCallback = customCallback ?? (this.paymasterServiceUrl ? this.getDefaultSponsoredCallsCallback(asset, onApproved, onSubmitted, onCallsProgress, checkpointCalls) : asset === "WETH" ? this.getDefaultWethSponsoredCallback(onApproved, onSubmitted, options.resumeTxHash, checkpointHash, options.assertSubmissionCurrent, ledgerOperationId) : this.getDefaultSponsoredCallback(onApproved, onSubmitted, options.resumeTxHash, checkpointHash, options.assertSubmissionCurrent, ledgerOperationId));
+    const effectiveCallback = customCallback ?? (this.paymasterServiceUrl ? this.getDefaultSponsoredCallsCallback(asset, onApproved, onSubmitted, onCallsProgress, checkpointCalls) : asset === "WETH" ? this.getDefaultWethSponsoredCallback(onApproved, onSubmitted, options.resumeTxHash, checkpointHash, options.assertSubmissionCurrent, ledgerOperationId, options.resumeSavedBatch, onAuthorization) : this.getDefaultSponsoredCallback(onApproved, onSubmitted, options.resumeTxHash, checkpointHash, options.assertSubmissionCurrent, ledgerOperationId, options.resumeSavedBatch, onAuthorization));
+    let resumedDeadline;
     try {
       const ledgerToken = SupportedAssets.find((value) => value.chainId === chainId && value.symbol === asset);
       ledgerOp = this.startLedger({
@@ -14065,16 +15476,19 @@ var OwneySDK = class {
     } catch {
     }
     try {
-      if (options.resumeTxHash) {
+      if (options.resumeTxHash || options.resumeSavedBatch) {
         const token = SupportedAssets.find((value) => value.chainId === chainId && value.symbol === asset);
-        const family = token && await loadTokenBatchFamily({
+        const scope = token && {
           apiKey: this.apiKey,
           baseUrl: this.routingApiBaseUrl,
           owner: state.walletAddress,
           chainId,
           token: token.address
-        }, options.resumeTxHash);
-        const pending = family && { transfers: family.body.transfers };
+        };
+        const family = scope && (options.resumeTxHash ? await loadTokenBatchFamily(scope, options.resumeTxHash) : { body: await savedTokenBatchBody(scope, this.getPaidRpcClient(chainId)) });
+        if (options.resumeSavedBatch && family?.body && /^\d{1,15}$/.test(family.body.deadline))
+          resumedDeadline = Number(family.body.deadline);
+        const pending = family?.body && { transfers: family.body.transfers };
         const invalid2 = () => new OwneyError("DEPOSIT_IN_PROGRESS", "The saved deposit does not match this request. Check its status before depositing again.");
         if (!pending || pending.transfers.some((transfer) => !/^\d+$/.test(transfer.amount) || BigInt(transfer.amount) <= 0n) || pending.transfers.reduce((sum, transfer) => sum + BigInt(transfer.amount), 0n) !== BigInt(amount)) throw invalid2();
         const candidates = agentId ? [this.getAgent(agentId)] : this.getEligibleAgents(chainId, asset);
@@ -14094,12 +15508,10 @@ var OwneySDK = class {
           return {
             id: agent.id,
             amount: transfer.amount,
-            run: (callback) => withFailureReporting(
-              this.apiKey,
-              agent.id,
-              () => agent.deposit(state, chainId, transfer.amount, asset, callback, onProgress),
-              this.routingApiBaseUrl
-            )
+            run: (callback) => withFailureReporting(this.apiKey, agent.id, () => {
+              const context = serverTaskContext(agent);
+              return context ? agent.deposit(state, chainId, transfer.amount, asset, callback, onProgress, void 0, context) : agent.deposit(state, chainId, transfer.amount, asset, callback, onProgress);
+            }, this.routingApiBaseUrl)
           };
         });
         const batchTransfer2 = getDepositBatchTransfer(effectiveCallback);
@@ -14138,7 +15550,8 @@ var OwneySDK = class {
           onProgress,
           () => paidFallbackAgents.add(agent.id),
           !!options.resumeTxHash,
-          checkpointPaid
+          checkpointPaid,
+          serverTaskContext(agent)
         ));
       }
       const totalAmount = BigInt(amount);
@@ -14200,7 +15613,10 @@ var OwneySDK = class {
             run: (callback) => withFailureReporting(
               this.apiKey,
               agent.id,
-              () => agent.deposit(state, chainId, amount2, asset, callback, onProgress),
+              () => {
+                const context = serverTaskContext(agent);
+                return context ? agent.deposit(state, chainId, amount2, asset, callback, onProgress, void 0, context) : agent.deposit(state, chainId, amount2, asset, callback, onProgress);
+              },
               this.routingApiBaseUrl
             )
           })),
@@ -14241,7 +15657,8 @@ var OwneySDK = class {
             onProgress,
             () => paidFallbackAgents.add(agent.id),
             !!options.resumeTxHash,
-            checkpointPaid
+            checkpointPaid,
+            serverTaskContext(agent)
           );
         } catch (error) {
           if (Object.keys(agentResults).length === 0) throw error;
@@ -14261,7 +15678,22 @@ var OwneySDK = class {
       }
       return ledgerDone({ agentResults });
     } catch (error) {
-      if (checkpointFailure && !(error instanceof OwneyError && error.details?.notSubmitted === false)) {
+      if (options.resumeSavedBatch && !serverBroadcastOf(error))
+        error = new OwneyError(
+          "DEPOSIT_IN_PROGRESS",
+          "Deposit is awaiting confirmation. Its transaction is still being checked.",
+          {
+            sponsorPending: true,
+            phase: "deposit",
+            notSubmitted: false,
+            safeToFallback: false,
+            serverBroadcast: "unknown",
+            ...resumedDeadline !== void 0 ? { authorizationDeadline: resumedDeadline } : {},
+            cause: error
+          }
+        );
+      const serverMaySend = serverBroadcastOf(error);
+      if (checkpointFailure && !serverMaySend && !(error instanceof OwneyError && error.details?.notSubmitted === false)) {
         error = error instanceof OwneyError && error.code === "DEPOSIT_PARTIAL_FAILURE" ? new OwneyError(
           error.code,
           "Some deposits completed before another agent could be submitted.",
@@ -14279,6 +15711,19 @@ var OwneySDK = class {
             const rejected = error instanceof OwneyError && error.details?.notSubmitted === true;
             if (!rejected && paidFallbackAgents.has(id) || evidence?.transfer === "confirmed" || evidence?.transfer === "failed") continue;
             if (!rejected && (evidence?.txHash || evidence?.userOpHash || evidence?.callsId)) continue;
+            if (serverMaySend) {
+              const refused = alreadySendingOf(error);
+              const deadline = refused ? void 0 : authorizationDeadlineOf(error) ?? permit?.authorizationDeadline;
+              const nonce = refused ? void 0 : permit2NonceOf(error) ?? permit?.permit2Nonce;
+              if (evidence) notifyFunding(onProgress, {
+                ...evidence,
+                serverBroadcast: evidence.serverBroadcast ?? "unknown",
+                ...deadline !== void 0 && !evidence.authorizationDeadline ? { authorizationDeadline: deadline } : {},
+                ...nonce !== void 0 && !evidence.permit2Nonce ? { permit2Nonce: nonce } : {},
+                transfer: "pending"
+              });
+              continue;
+            }
             notifyFunding(onProgress, { ...evidence ?? {
               agentId: id,
               chainId,
@@ -14325,11 +15770,11 @@ var OwneySDK = class {
    * propagates unchanged. Scoped per agent invocation so one agent's failure
    * doesn't force a retry of sibling agents in a multi-agent split.
    */
-  async depositWithFallback(agent, state, chainId, amount, asset, effectiveCallback, appCallback, onProgress, onPaidFallback, resumeOnly = false, onBeforeSubmission) {
+  async depositWithFallback(agent, state, chainId, amount, asset, effectiveCallback, appCallback, onProgress, onPaidFallback, resumeOnly = false, onBeforeSubmission, serverTaskContext) {
     const attempt = (callback) => withFailureReporting(
       this.apiKey,
       agent.id,
-      () => onBeforeSubmission ? agent.deposit(state, chainId, amount, asset, callback, onProgress, onBeforeSubmission) : onProgress ? agent.deposit(state, chainId, amount, asset, callback, onProgress) : agent.deposit(state, chainId, amount, asset, callback),
+      () => serverTaskContext ? agent.deposit(state, chainId, amount, asset, callback, onProgress, onBeforeSubmission, serverTaskContext) : onBeforeSubmission ? agent.deposit(state, chainId, amount, asset, callback, onProgress, onBeforeSubmission) : onProgress ? agent.deposit(state, chainId, amount, asset, callback, onProgress) : agent.deposit(state, chainId, amount, asset, callback),
       this.routingApiBaseUrl
     );
     let approvalAttempted = false;
@@ -14626,11 +16071,36 @@ var OwneySDK = class {
     const key2 = `${state.walletAddress.toLowerCase()}:${chainId}:${evidence.agentId}:${evidence.token}:${evidence.txHash}`;
     if (options.refreshBalance !== false && (verified.transfer === "confirmed" || verified.transfer === "failed" && verified.confirmedAmount === "0") && !this.recoveredFundingReads.has(key2)) {
       agent.invalidateFundingRead?.(state, chainId, evidence.token, options.balanceRefreshUntil, evidence.txHash);
-      this.recoveredFundingReads.add(key2);
-      if (this.recoveredFundingReads.size > 256) this.recoveredFundingReads.delete(this.recoveredFundingReads.values().next().value);
+      const until = options.balanceRefreshUntil;
+      this.noteFundingRefresh(key2, until === void 0 || until > Date.now());
     }
     return verified;
   }
+  noteFundingRefresh(key2, armed) {
+    this.recoveredFundingReads.delete(key2);
+    this.recoveredFundingReads.set(key2, armed);
+    if (this.recoveredFundingReads.size > 256) this.recoveredFundingReads.delete(this.recoveredFundingReads.keys().next().value);
+  }
+  /**
+   * Re-arms an agent's balance refresh after a confirmed deposit or withdrawal
+   * the caller already verified (e.g. after a page reload, which loses the
+   * refresh the SDK started in memory). Same refresh as receipt recovery
+   * (`inspectFunding`), without a receipt read, and shared with it: once per
+   * movement (`txHash`) in this SDK session, unless that recovery came after
+   * its own deadline and so armed nothing. `until` bounds it (the agent caps
+   * it further). Returns false when the agent has no such refresh or `until`
+   * has passed; throws when not connected or on another chain. Never prompts.
+   */
+  refreshAgentBalanceAfterMovement(input) {
+    const { state, chainId } = this.captureReadScope(input.chainId);
+    const agent = this.getAgent(input.agentId);
+    if (typeof agent.invalidateFundingRead !== "function" || !Number.isFinite(input.until) || input.until <= Date.now()) return false;
+    const key2 = input.txHash ? `${state.walletAddress.toLowerCase()}:${chainId}:${input.agentId}:${input.token}:${input.txHash}` : void 0;
+    if (key2 && this.recoveredFundingReads.get(key2) === true) return true;
+    agent.invalidateFundingRead(state, chainId, input.token, input.until, input.txHash);
+    if (key2) this.noteFundingRefresh(key2, true);
+    return true;
+  }
   /**
    * Lists on-chain payout candidates for a withdrawal the provider accepted
    * without a hash: ERC-20 `Transfer` logs on the evidence's token that reach
@@ -14752,22 +16222,25 @@ var OwneySDK = class {
     try {
       if (this.paymasterServiceUrl || !evidences.length || !/^\d+$/.test(amount)) return false;
       const first = evidences[0];
-      if (!first.txHash) return false;
+      const saved = !first.txHash && evidences.every((e) => !e.txHash && (e.serverBroadcast === "unknown" || e.serverBroadcast === true) && typeof e.authorizationDeadline === "number");
+      if (!first.txHash && !saved) return false;
       const { state, chainId, assertCurrent } = this.captureReadScope(first.chainId);
       const token = SupportedAssets.find((value) => value.chainId === chainId && value.symbol === first.token);
       if (!token) return false;
-      const family = await loadTokenBatchFamily({
+      const scope = {
         apiKey: this.apiKey,
         baseUrl: this.routingApiBaseUrl,
         owner: state.walletAddress,
         chainId,
         token: token.address
-      }, first.txHash);
-      const transfers = family?.body.transfers;
-      if (!family || !transfers || transfers.length !== evidences.length || transfers.reduce((n, t) => n + BigInt(t.amount), 0n).toString() !== amount) return false;
+      };
+      const family = saved ? void 0 : await loadTokenBatchFamily(scope, first.txHash);
+      const savedBody = saved ? await savedTokenBatchBody(scope, this.getPaidRpcClient(chainId)) : void 0;
+      const transfers = saved ? savedBody?.transfers : family?.body.transfers;
+      if (!family && !savedBody || !transfers || transfers.length !== evidences.length || transfers.reduce((n, t) => n + BigInt(t.amount), 0n).toString() !== amount) return false;
       const destinations = /* @__PURE__ */ new Set();
       for (const e of evidences) {
-        if (e.chainId !== chainId || e.token !== first.token || e.walletAddress.toLowerCase() !== state.walletAddress.toLowerCase() || e.callsId || e.userOpHash || !family.attempts.some((a) => a.phase === "deposit" && a.hash.toLowerCase() === e.txHash?.toLowerCase()) || e.depositAuthorization && e.depositAuthorization.authorizationId !== family.authorizationId) return false;
+        if (e.chainId !== chainId || e.token !== first.token || e.walletAddress.toLowerCase() !== state.walletAddress.toLowerCase() || e.callsId || e.userOpHash || (family ? !family.attempts.some((a) => a.phase === "deposit" && a.hash.toLowerCase() === e.txHash?.toLowerCase()) || e.depositAuthorization && e.depositAuthorization.authorizationId !== family.authorizationId : String(e.authorizationDeadline) !== savedBody.deadline)) return false;
         const agent = this.getAgent(e.agentId);
         const wallet = agent.getFundingWallet ? await agent.getFundingWallet(state, chainId, e.token) : (await agent.getUserProfile(state, chainId)).smartWallet;
         assertCurrent();
@@ -14780,6 +16253,62 @@ var OwneySDK = class {
       return false;
     }
   }
+  /** Whether a Permit2 deposit authorization can still execute and whether it
+   * did: `expired` when the finalized block is more than 300 s past
+   * `deadline` (chain time), `used` when the owner's Permit2 nonce bit is set
+   * at that block. Null when anything cannot be read. Never throws. */
+  async checkDepositAuthorization(input) {
+    try {
+      const { chainId, owner, permit2Nonce, deadline } = input;
+      if (!SupportedAssets.some((asset) => asset.chainId === chainId) || !isAddress5(owner) || typeof permit2Nonce !== "string" || !/^\d{1,78}$/.test(permit2Nonce) || !Number.isSafeInteger(deadline) || deadline <= 0) return null;
+      const nonce = BigInt(permit2Nonce);
+      if (nonce >= 1n << 256n) return null;
+      const pub = this.getPaidRpcClient(chainId);
+      const block = await pub.getBlock({ blockTag: "finalized" });
+      if (typeof block?.timestamp !== "bigint" || typeof block.number !== "bigint") return null;
+      const bitmap = await pub.readContract({
+        address: BATCH_PERMIT2_ADDRESS,
+        abi: PERMIT2_BATCH_ABI,
+        functionName: "nonceBitmap",
+        args: [owner, nonce >> 8n],
+        blockNumber: block.number
+      });
+      if (typeof bitmap !== "bigint" || bitmap < 0n) return null;
+      return { expired: block.timestamp > BigInt(deadline) + 300n, used: (bitmap & 1n << (nonce & 255n)) !== 0n };
+    } catch {
+      return null;
+    }
+  }
+  /** Drops the saved signed body of a hashless deposit the server may have
+   * been sending (`serverBroadcast` 'unknown'/true, no hash) once the app has
+   * settled it another way: by the ledger's hash or its expired deadline.
+   * Only the body with this Permit2 deadline and these exact shares is
+   * dropped, so it never resumes or blocks a different deposit. Never throws. */
+  async discardSavedDepositBatch(evidences) {
+    try {
+      if (this.paymasterServiceUrl || !evidences.length) return false;
+      const first = evidences[0];
+      const deadline = first.authorizationDeadline;
+      if (typeof deadline !== "number" || !Number.isSafeInteger(deadline) || deadline <= 0) return false;
+      const { state, chainId } = this.captureReadScope(first.chainId);
+      const token = SupportedAssets.find((value) => value.chainId === chainId && value.symbol === first.token);
+      if (!token) return false;
+      if (evidences.some((e) => e.chainId !== chainId || e.token !== first.token || e.authorizationDeadline !== deadline || e.walletAddress.toLowerCase() !== state.walletAddress.toLowerCase() || !e.agentWallet || e.serverBroadcast !== "unknown" && e.serverBroadcast !== true)) return false;
+      return await discardHashlessTokenBatch(
+        {
+          apiKey: this.apiKey,
+          baseUrl: this.routingApiBaseUrl,
+          owner: state.walletAddress,
+          chainId,
+          token: token.address
+        },
+        String(deadline),
+        (body) => evidences.every((e) => body.transfers.some((t) => t.to.toLowerCase() === e.agentWallet.toLowerCase() && t.amount === e.intendedAmount))
+      );
+    } catch {
+      return false;
+    }
+  }
   /** Validate signed journal membership, never just a caller-supplied family ID. */
   async validateDepositReplacement(previous, next) {
     try {
@@ -14872,6 +16401,22 @@ var OwneySDK = class {
     if (verified.agentId !== "zyfai") return verified;
     return this.getAgent("zyfai").retryDepositRegistration(state, verified);
   }
+  /** A Zyfai withdrawal's lifecycle by the id recorded on its evidence. Never signs,
+   * prompts or authenticates; `null` when unavailable or not this wallet's Zyfai withdrawal. */
+  async getZyfaiWithdrawal(evidence) {
+    const state = this.state;
+    const id = evidence.withdrawalRequest?.providerWithdrawalId;
+    if (evidence.agentId !== "zyfai" || !id || !state || state.walletAddress.toLowerCase() !== evidence.walletAddress.toLowerCase()) return null;
+    return this.getAgent("zyfai").getWithdrawalLifecycle(state, id);
+  }
+  /** A Zyfai deposit's placement status by the id recorded on its evidence. Never signs,
+   * prompts or authenticates; `null` when unavailable or not this wallet's Zyfai deposit. */
+  async getZyfaiDeposit(evidence) {
+    const state = this.state;
+    const id = evidence.providerDepositId;
+    if (evidence.agentId !== "zyfai" || !id || !state || state.walletAddress.toLowerCase() !== evidence.walletAddress.toLowerCase()) return null;
+    return this.getAgent("zyfai").getDepositPlacement(state, id);
+  }
   // --- Fund operations ---
   /** On-chain version and ownership status for this owner's Yieldseeker agent. */
   async getYieldseekerWalletStatus(asset) {
@@ -15454,6 +16999,17 @@ var OwneySDK = class {
             onStage: (stage) => options.onStage(order.orderHash, stage)
           } : {}
         });
+        const deposit = order.pendingDeposit;
+        if (deposit && typeof deposit.received === "string" && typeof deposit.symbol === "string" && typeof deposit.chainId === "number" && loadOrder(order.orderHash))
+          savePendingDeposit({
+            id: `${deposit.chainId}-${deposit.symbol}-${order.orderHash}`,
+            received: deposit.received,
+            symbol: deposit.symbol,
+            chainId: deposit.chainId,
+            createdAt: Date.now(),
+            ...typeof deposit.agentId === "string" ? { agentId: deposit.agentId } : {},
+            ...typeof deposit.operationId === "string" ? { operationId: deposit.operationId } : {}
+          });
         clearOrder(order.orderHash);
         updateWithdrawSwap(order.orderHash, { status: "landed" });
         return { orderHash: order.orderHash, status: "completed" };
@@ -15624,14 +17180,16 @@ var OwneySDK = class {
         options.to.symbol
       );
     }
-    const ledgerOp = this.openSwapLedger(() => ({
+    let ledgerInput;
+    const ledgerOp = this.openSwapLedger(() => ledgerInput = {
       operationId: options.operationId,
       kind: "swap_deposit",
       owner: state.walletAddress,
       chainId: options.to.chainId,
       token: SupportedAssets.find((value) => value.chainId === options.to.chainId && value.symbol === options.to.symbol)?.address ?? "",
       asset: options.to.symbol.toLowerCase()
-    }));
+    });
+    const secretHandoff = this.secretHandoffFor(ledgerOp, ledgerInput);
     try {
       const api = this.swapApi();
       const quoted = await api.quote({
@@ -15659,6 +17217,17 @@ var OwneySDK = class {
           ...options.assertCurrent ? { assertCurrent: options.assertCurrent } : {},
           ...options.slippage === void 0 ? {} : { slippage: options.slippage },
           ...options.onSwapProgress ? { onStage: options.onSwapProgress } : {},
+          // Stored with a cross-chain order, so a resume that finishes the swap
+          // can still lead to the deposit (ROUT-625). The guaranteed minimum,
+          // never the quoted amount.
+          pendingDeposit: {
+            received: quote.dstAmountMin,
+            symbol: options.to.symbol,
+            chainId: quote.dst.chainId,
+            ...options.agentId ? { agentId: options.agentId } : {},
+            ...ledgerOp ? { operationId: ledgerOp.operationId } : {}
+          },
+          ...secretHandoff ? { secretHandoff } : {},
           ...ledgerOp ? { onOrderSubmitted: (orderHash) => {
             swapIds.orderHash = orderHash;
             this.ledgerSwap(ledgerOp, quote, { status: "submitted", orderHash });
@@ -15678,6 +17247,7 @@ var OwneySDK = class {
         receivedDstAmountRaw: swap.received
       });
       options.onSwapProgress?.("depositing");
+      const backgroundDepositId = swap.orderHash ? `${quote.dst.chainId}-${options.to.symbol}-${swap.orderHash}` : void 0;
       try {
         options.assertCurrent?.();
         await this.ensureSwapChain(quote.dst.chainId);
@@ -15707,10 +17277,13 @@ var OwneySDK = class {
           ...options.assertCurrent ? { assertSubmissionCurrent: options.assertCurrent } : {},
           ...ledgerOp ? { operationId: ledgerOp.operationId } : {}
         });
+        if (backgroundDepositId) clearPendingDeposit(backgroundDepositId);
         return this.ledgerSucceeded(ledgerOp, { swap, deposit, deposited: amount });
       } catch (error) {
         const pending = {
-          id: `${quote.dst.chainId}-${options.to.symbol}-${Date.now()}`,
+          // Keyed by the order when there is one, so it replaces any record a
+          // background resume wrote for the same order rather than doubling it.
+          id: backgroundDepositId ?? `${quote.dst.chainId}-${options.to.symbol}-${Date.now()}`,
           received: swap.received,
           symbol: options.to.symbol,
           chainId: quote.dst.chainId,
@@ -15866,7 +17439,7 @@ var OwneySDK = class {
     const state = this.requireState();
     const activeChainId = this.requireChainId();
     const revision = this.connectionRevision;
-    let active2 = true;
+    let active = true;
     let record2;
     let ledgerOp;
     let hadDurableRecord = false;
@@ -15874,7 +17447,7 @@ var OwneySDK = class {
     let confirmationDeadline = Infinity;
     const assertCurrent = () => {
       options.assertCurrent?.();
-      if (!active2) throw new OwneyError("WITHDRAW_SWAP_INCOMPLETE", "This withdrawal attempt is no longer active.", { swapSubmitted: false });
+      if (!active) throw new OwneyError("WITHDRAW_SWAP_INCOMPLETE", "This withdrawal attempt is no longer active.", { swapSubmitted: false });
       if (this.state !== state || this.connectionRevision !== revision || state.chainId !== activeChainId)
         throw new OwneyError("NOT_CONNECTED", "Wallet changed during withdrawal and swap.");
     };
@@ -15919,9 +17492,10 @@ var OwneySDK = class {
       const saved = options.recoveryId ? listWithdrawSwaps(Date.now(), true).find((row) => row.orderHash === options.recoveryId) : void 0;
       if (options.recoveryId && (!saved?.recovery?.results || saved.recovery.phase !== "ready" || saved.walletAddress?.toLowerCase() !== state.walletAddress.toLowerCase() || saved.srcChainId !== activeChainId || saved.srcSymbol !== asset.symbol || saved.dstChainId !== options.to.chainId || saved.dstSymbol !== options.to.symbol))
         throw new OwneyError("WITHDRAW_SWAP_INCOMPLETE", "This withdrawal is not ready to continue.");
+      let ledgerInput;
       ledgerOp = this.openSwapLedger(() => {
         const requestedRaw = saved ? saved.recovery.requested : options.amount === void 0 ? void 0 : parseUnits4(options.amount, asset.decimals).toString();
-        return {
+        return ledgerInput = {
           operationId: saved?.operationId ?? options.operationId,
           kind: "withdraw_swap",
           owner: state.walletAddress,
@@ -15932,6 +17506,7 @@ var OwneySDK = class {
           ...requestedRaw === void 0 ? {} : { requestedAmountRaw: requestedRaw }
         };
       });
+      const secretHandoff = this.secretHandoffFor(ledgerOp, ledgerInput);
       const prepareTimeout = () => new OwneyError(
         "WITHDRAW_SWAP_INCOMPLETE",
         "Could not read the source wallet. No new withdrawal was submitted.",
@@ -15991,7 +17566,7 @@ var OwneySDK = class {
         evidence.set(next.agentId, next);
         if (record2?.recovery) {
           record2.recovery.evidence[next.agentId] = next;
-          if (active2) saveWithdrawSwap(record2);
+          if (active) saveWithdrawSwap(record2);
           else {
             const latest = listWithdrawSwaps(Date.now(), true).find((row) => row.recovery?.attemptId === record2.recovery.attemptId);
             if (latest?.recovery) updateWithdrawSwap(latest.orderHash, { recovery: {
@@ -16107,6 +17682,7 @@ var OwneySDK = class {
           quote,
           walletAddress: state.walletAddress,
           direction: "withdraw",
+          ...secretHandoff ? { secretHandoff } : {},
           ...options.slippage === void 0 ? {} : { slippage: options.slippage },
           ...options.onSwapProgress ? { onStage: options.onSwapProgress } : {},
           onOrderPrepared: (orderHash, details) => {
@@ -16195,7 +17771,7 @@ var OwneySDK = class {
       this.ledgerFailed(ledgerOp, error);
       throw error;
     } finally {
-      active2 = false;
+      active = false;
       releaseSubmission();
       this.closeSwapLedger(ledgerOp);
     }
@@ -16243,11 +17819,13 @@ var OwneySDK = class {
       });
     } catch {
     }
-    const ledgerLeg = (evidence) => this.ledgerWithdrawalLeg(ledgerOp, evidence);
+    const ledgerLeg = (evidence, errorCode) => this.ledgerWithdrawalLeg(ledgerOp, evidence, errorCode);
     let hold;
     let reservationRejected = false;
     let innerStarted = false;
     const reservationLegs = /* @__PURE__ */ new Map();
+    const plannedLegs = /* @__PURE__ */ new Map();
+    const serverLegs = /* @__PURE__ */ new Map();
     const reservation = {
       dispatching: (id) => hold?.dispatch(id),
       settled: (id, leg) => {
@@ -16257,11 +17835,22 @@ var OwneySDK = class {
     const settleHold = () => {
       if (!hold) return;
       hold.stopHeartbeat();
-      this.settleWithdrawalReservation(hold, ids, attempted, reservationLegs);
+      const serverOwned = new Set(ids.filter((id) => !attempted.has(id) && serverMayOwn(serverLegs.get(id))));
+      this.settleWithdrawalReservation(hold, ids, attempted, reservationLegs, serverOwned);
     };
     const runAgents = () => {
       innerStarted = true;
-      const inner = this.withdrawFromAgents(options, state, chainId, attempted, ledgerLeg, reservation);
+      const inner = this.withdrawFromAgents(
+        options,
+        state,
+        chainId,
+        attempted,
+        ledgerLeg,
+        reservation,
+        plannedLegs,
+        (timeoutMs) => ledgerOp?.settle?.(timeoutMs),
+        serverLegs
+      );
       void inner.then(settleHold, settleHold);
       return inner;
     };
@@ -16285,7 +17874,9 @@ var OwneySDK = class {
     } catch (error) {
       if (!reservationRejected) {
         for (const id of ids) if (!attempted.has(id)) {
-          notifyFunding(options.onProgress, {
+          if (serverMayOwn(serverLegs.get(id))) continue;
+          const planned = plannedLegs.get(id);
+          notifyFunding(options.onProgress, planned ? { ...planned, transfer: "failed", delivery: "failed" } : {
             agentId: id,
             chainId,
             token: options.asset,
@@ -16407,12 +17998,13 @@ var OwneySDK = class {
    * - a throw without submission evidence: `not_submitted`;
    * - Zyfai "withdrawal already in progress": kept, dispatch `provider_in_progress`.
    */
-  settleWithdrawalReservation(hold, ids, attempted, legs) {
+  settleWithdrawalReservation(hold, ids, attempted, legs, keep) {
     try {
       if ([...attempted].some((id) => !legs.has(id))) return;
       const releases = /* @__PURE__ */ new Map();
       for (const id of new Set(ids)) {
         if (!RESERVATION_AGENTS.includes(id)) continue;
+        if (keep?.has(id)) continue;
         const leg = legs.get(id);
         const outcome = attempted.has(id) && leg ? reservationLegOutcome(leg) : "not_submitted";
         if (outcome === "keep") continue;
@@ -16443,6 +18035,31 @@ var OwneySDK = class {
     } catch {
     }
   }
+  /**
+   * Reports a withdrawal step the app closed as never sent (a reload before its
+   * request was saved) as a failed ledger leg with `NOT_SUBMITTED`, so other
+   * devices and later recovery stop treating it as in flight. Refuses any step
+   * with a hash or a saved request. Never touches the hold; never throws.
+   */
+  async reportWithdrawalNotSubmitted(operationId, evidence) {
+    try {
+      if (typeof operationId !== "string" || !operationId || !evidence || evidence.transfer !== "failed" || evidence.txHash || evidence.userOpHash || evidence.callsId || evidence.withdrawalRequest?.attempted === true) return;
+      const leg = ledgerLegFromEvidence(evidence, "withdraw");
+      if (leg?.status !== "failed") return;
+      const token = SupportedAssets.find((value) => value.chainId === evidence.chainId && value.symbol === evidence.token);
+      const op = this.ledger.resume({
+        operationId,
+        kind: "withdraw",
+        owner: evidence.walletAddress,
+        chainId: evidence.chainId,
+        token: token?.address ?? "",
+        asset: String(evidence.token).toLowerCase()
+      });
+      op.leg({ ...leg, errorCode: "NOT_SUBMITTED" });
+      op.finish({});
+    } catch {
+    }
+  }
   /**
    * Reports a withdrawal leg that was proven after its call ended (a hashless
    * Zyfai payout found on chain or in history) to the funding ledger, then
@@ -16492,7 +18109,36 @@ var OwneySDK = class {
     } catch {
     }
   }
-  async withdrawFromAgents(options, state, chainId, attempted, ledgerLeg, reservation) {
+  /**
+   * Reports a deposit leg that the app's recovery verified on chain after its
+   * call ended to the funding ledger. Only evidence whose transfer is confirmed
+   * with a transaction hash is reported; anything else is ignored. The ledger
+   * PATCHes the existing operation (creating it only on a 404) and the server
+   * re-verifies the hash. Deposits hold no reservation, so nothing is released.
+   * Never throws.
+   */
+  async reportDepositRecovery(operationId, evidence) {
+    try {
+      if (typeof operationId !== "string" || !operationId || !evidence || evidence.transfer !== "confirmed") return;
+      const leg = ledgerLegFromEvidence(evidence, "deposit");
+      if (leg?.status !== "confirmed" || !leg.txHash) return;
+      const rail = depositLedgerRail(evidence);
+      const token = SupportedAssets.find((value) => value.chainId === evidence.chainId && value.symbol === evidence.token);
+      const op = this.ledger.resume({
+        operationId,
+        kind: "deposit",
+        owner: evidence.walletAddress,
+        chainId: evidence.chainId,
+        token: token?.address ?? "",
+        asset: String(evidence.token).toLowerCase()
+      });
+      op.leg(rail ? { ...leg, rail } : leg);
+      op.finish({});
+      this.ledgerProviderSamples(op, evidence, "deposit");
+    } catch {
+    }
+  }
+  async withdrawFromAgents(options, state, chainId, attempted, ledgerLeg, reservation, plannedLegs, settleLedger, serverLegs = /* @__PURE__ */ new Map()) {
     const { asset, amount, agentId, onAgentResult } = options;
     const notifyAgentResult = (id, result) => {
       try {
@@ -16538,7 +18184,22 @@ var OwneySDK = class {
           { asset, amount, agentErrors: agentErrors2, agentFailures, pendingSubmissions: pending }
         );
     };
-    const submit = async (agent, requested2) => {
+    const awaitServerHandoffs = async () => {
+      const pending = [...serverLegs.values()].filter((leg) => leg.settled === void 0).map((leg) => leg.answer);
+      if (!pending.length) return;
+      let timer;
+      await Promise.race([
+        Promise.all(pending),
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, SERVER_HANDOFF_WAIT_MS);
+        })
+      ]);
+      clearTimeout(timer);
+    };
+    const submit = async (agent, requested2, onAccepted) => {
+      const plannedTask = serverLegs.get(agent.id);
+      const serverTask = plannedTask ? await plannedTask.answer : void 0;
+      if (serverTask) await settleLedger?.(3e3);
       if (this.state !== state || this.state.chainId !== chainId)
         throw new OwneyError("NOT_CONNECTED", "Wallet connection changed before withdrawal submission.");
       attempted.add(agent.id);
@@ -16560,6 +18221,7 @@ var OwneySDK = class {
         submissionEvidence.set(agent.id, evidence);
         notifyFunding(options.onProgress, evidence);
         ledgerLeg?.(evidence);
+        if (onAccepted && evidence.ownerAuthorization === "accepted" && evidence.transfer !== "failed" && (evidence.userOpHash || evidence.callsId || evidence.txHash)) onAccepted();
       };
       progress(evidence);
       adapterReported = false;
@@ -16574,14 +18236,26 @@ var OwneySDK = class {
           reservation?.dispatching(agent.id);
         } catch {
         }
-        const result = options.onBeforeSubmission || options.assertCurrent ? await agent.withdraw(
+        const context = typeof options.operationId === "string" ? { operationId: options.operationId, ...serverTask ? { planned: true } : {} } : void 0;
+        const onBeforeSubmission = options.onBeforeSubmission ? (next) => options.onBeforeSubmission({ ...evidence, ...next }) : void 0;
+        const result = context ? await agent.withdraw(
+          state,
+          chainId,
+          token,
+          requested2,
+          progress,
+          options.gasMode ?? "auto",
+          onBeforeSubmission,
+          options.assertCurrent,
+          context
+        ) : options.onBeforeSubmission || options.assertCurrent ? await agent.withdraw(
           state,
           chainId,
           token,
           requested2,
           progress,
           options.gasMode ?? "auto",
-          options.onBeforeSubmission ? (next) => options.onBeforeSubmission({ ...evidence, ...next }) : void 0,
+          onBeforeSubmission,
           options.assertCurrent
         ) : await (options.gasMode === void 0 ? agent.withdraw(state, chainId, token, requested2, progress) : agent.withdraw(state, chainId, token, requested2, progress, options.gasMode));
         settled({
@@ -16592,6 +18266,10 @@ var OwneySDK = class {
       } catch (error) {
         if (!adapterReported && !evidence.txHash && !evidence.userOpHash && !evidence.callsId && (this.isUserRejectedWithdrawal(error) || /insufficient (balance|funds)/i.test(error instanceof Error ? error.message : "")))
           progress({ ...evidence, transfer: "failed", delivery: "failed" });
+        else if (error instanceof OwneyError && error.details?.rejectedBeforeSubmission === true && evidence.transfer !== "confirmed")
+          progress({ ...evidence, transfer: "failed", delivery: "failed" });
+        if (serverLegs.size && requested2 === void 0 && agent.withdrawalRequiresWalletApproval && error instanceof OwneyError && error.code === "WITHDRAW_INSUFFICIENT_BALANCE" && error.details?.available === "0" && evidence.transfer === "failed" && !evidence.txHash && !evidence.userOpHash && !evidence.callsId)
+          ledgerLeg?.(evidence, "WITHDRAW_INSUFFICIENT_BALANCE");
         settled({ settled: "threw", evidence });
         throw error;
       }
@@ -16617,40 +18295,151 @@ var OwneySDK = class {
       notifyAgentResult(agent.id, result);
       return result;
     }
+    const dispatch = async (agent, requested2) => {
+      let accept;
+      const accepted = new Promise((resolve) => {
+        accept = () => resolve(true);
+      });
+      const outcome = submit(agent, requested2, agent.withdrawalRequiresWalletApproval ? accept : void 0);
+      const handedOver = await Promise.race([accepted, outcome.then(() => false, () => false)]);
+      return { outcome, handedOver };
+    };
+    const prepareLaterAgents = async (agents) => {
+      if (!agents.some((agent) => agent.withdrawalRequiresWalletApproval)) return;
+      for (const agent of agents) {
+        if (agent.withdrawalRequiresWalletApproval || typeof agent.prepareWithdrawal !== "function") continue;
+        try {
+          await agent.prepareWithdrawal(state, chainId, token);
+        } catch (error) {
+          if (this.isUserRejectedWithdrawal(error)) throw error;
+          console.warn(`withdraw preparation failed for agent "${agent.id}":`, error);
+        }
+      }
+    };
+    const recordPlan = (legs) => {
+      if (legs.length < 2) return;
+      const handOffs = [];
+      for (const [index, [agent, intendedAmount]] of legs.entries()) {
+        const planned = {
+          agentId: agent.id,
+          chainId,
+          token,
+          walletAddress: state.walletAddress,
+          intendedAmount,
+          transfer: "pending",
+          registration: "not-applicable",
+          delivery: "pending",
+          planned: true
+        };
+        plannedLegs?.set(planned.agentId, planned);
+        notifyFunding(options.onProgress, planned);
+        const after = legs.slice(0, index).filter(([earlier]) => earlier.withdrawalRequiresWalletApproval).map(([earlier]) => `agent:${earlier.id}`);
+        if (agent.supportsServerTasks === true && typeof agent.handOffPlannedWithdrawal === "function" && after.length && zyfaiServerTasksEnabled(this.zyfaiServerTasks)) handOffs.push([agent, planned, after]);
+      }
+      const operationId = options.operationId;
+      if (typeof operationId !== "string" || !operationId) return;
+      for (const [agent, planned, after] of handOffs) {
+        const leg = { answer: Promise.resolve(void 0), share: planned.intendedAmount };
+        leg.answer = (async () => {
+          let serverTask;
+          let noTask = false;
+          try {
+            const answer = await agent.handOffPlannedWithdrawal(
+              state,
+              chainId,
+              token,
+              planned.intendedAmount,
+              {
+                operationId,
+                after,
+                // T10-I1: saved before the request leaves, as the dispatch
+                // handoff's checkpoint is, so a reload while the server
+                // answers finds a leg the server may own.
+                beforeRequest: () => notifyFunding(options.onProgress, { ...planned, serverTask: "unknown" })
+              }
+            );
+            serverTask = answer.type === "accepted" ? true : answer.type === "unknown" || answer.code === "LEG_ALREADY_SENT" ? "unknown" : void 0;
+            noTask = answer.type === "declined" && ZYFAI_HANDOFF_NO_TASK_CODES.has(answer.code);
+          } catch {
+            serverTask = "unknown";
+          }
+          leg.settled = serverTask ?? null;
+          if (serverTask) {
+            const marked = { ...planned, serverTask };
+            plannedLegs?.set(planned.agentId, marked);
+            notifyFunding(options.onProgress, marked);
+          } else if (noTask) {
+            notifyFunding(options.onProgress, { ...planned, serverTask: false });
+          }
+          return serverTask;
+        })();
+        serverLegs.set(planned.agentId, leg);
+      }
+    };
     const eligibleAgents = this.getEligibleAgents(chainId, asset).filter((agent) => !options.excludeAgentIds?.includes(agent.id));
     const withdrawalAgents = this.orderAgentsForWithdrawal(eligibleAgents);
     if (!amount) {
       const results2 = {};
       const agentErrors2 = {};
       const incompleteWithdrawals = {};
-      for (const agent of withdrawalAgents) {
-        try {
-          results2[agent.id] = await submit(agent);
-          notifyAgentResult(agent.id, results2[agent.id]);
-        } catch (err) {
+      const failed2 = (agent, err, handedOver) => {
+        if (!handedOver) {
           if (err instanceof OwneyError && err.code === "SPONSOR_REQUEST_FAILED" && err.details?.safeToFallback === true) throw err;
           if (this.isUserRejectedWithdrawal(err)) throw err;
-          if (err instanceof OwneyError && err.code === "WITHDRAW_INSUFFICIENT_BALANCE" && err.details?.available === "0" && submissionEvidence.get(agent.id)?.transfer === "failed") continue;
-          if (agent.id === "yieldseeker" && err instanceof OwneyError && err.code === "WITHDRAW_PARTIAL_FAILURE" && err.details?.reason === "YIELDSEEKER_MAX_INCOMPLETE") {
-            incompleteWithdrawals[agent.id] = { positionsStatus: err.details.positionsStatus };
-            const evidence = submissionEvidence.get(agent.id);
-            if (evidence?.agentId === agent.id && evidence.chainId === chainId && evidence.token === token && evidence.walletAddress.toLowerCase() === state.walletAddress.toLowerCase() && evidence.intendedAmount === "MAX" && evidence.transfer === "confirmed" && evidence.delivery === "confirmed" && evidence.txHash && /^0x[\da-f]{64}$/i.test(evidence.txHash) && evidence.confirmedAmount && /^\d+$/.test(evidence.confirmedAmount) && BigInt(evidence.confirmedAmount) > 0n) {
-              results2[agent.id] = { txHash: evidence.txHash, type: "partial", amount: evidence.confirmedAmount, evidence };
-              notifyAgentResult(agent.id, results2[agent.id]);
-            }
+        }
+        if (err instanceof OwneyError && err.code === "WITHDRAW_INSUFFICIENT_BALANCE" && err.details?.available === "0" && submissionEvidence.get(agent.id)?.transfer === "failed") return;
+        if (agent.id === "yieldseeker" && err instanceof OwneyError && err.code === "WITHDRAW_PARTIAL_FAILURE" && err.details?.reason === "YIELDSEEKER_MAX_INCOMPLETE") {
+          incompleteWithdrawals[agent.id] = { positionsStatus: err.details.positionsStatus };
+          const evidence = submissionEvidence.get(agent.id);
+          if (evidence?.agentId === agent.id && evidence.chainId === chainId && evidence.token === token && evidence.walletAddress.toLowerCase() === state.walletAddress.toLowerCase() && evidence.intendedAmount === "MAX" && evidence.transfer === "confirmed" && evidence.delivery === "confirmed" && evidence.txHash && /^0x[\da-f]{64}$/i.test(evidence.txHash) && evidence.confirmedAmount && /^\d+$/.test(evidence.confirmedAmount) && BigInt(evidence.confirmedAmount) > 0n) {
+            results2[agent.id] = { txHash: evidence.txHash, type: "partial", amount: evidence.confirmedAmount, evidence };
+            notifyAgentResult(agent.id, results2[agent.id]);
+          }
+        }
+        console.error(`withdraw failed for agent "${agent.id}":`, err);
+        agentErrors2[agent.id] = err instanceof Error ? err.message : String(err);
+        recordAgentFailure(agent.id, err);
+        const code = err instanceof OwneyError ? err.code : "SDK_AGENT_FAILURE";
+        void reportAgentFailure(
+          this.apiKey,
+          agent.id,
+          code,
+          this.routingApiBaseUrl
+        );
+      };
+      const handedOverLegs2 = [];
+      const settleHandedOver2 = async () => {
+        for (const { agent, outcome } of handedOverLegs2.splice(0)) {
+          try {
+            results2[agent.id] = await outcome;
+            notifyAgentResult(agent.id, results2[agent.id]);
+          } catch (err) {
+            failed2(agent, err, true);
+          }
+        }
+      };
+      await prepareLaterAgents(withdrawalAgents);
+      recordPlan(withdrawalAgents.map((agent) => [agent, "MAX"]));
+      try {
+        for (const agent of withdrawalAgents) {
+          const leg = await dispatch(agent);
+          if (leg.handedOver) {
+            handedOverLegs2.push({ agent, outcome: leg.outcome });
+            continue;
+          }
+          try {
+            results2[agent.id] = await leg.outcome;
+            notifyAgentResult(agent.id, results2[agent.id]);
+          } catch (err) {
+            failed2(agent, err, false);
           }
-          console.error(`withdraw failed for agent "${agent.id}":`, err);
-          agentErrors2[agent.id] = err instanceof Error ? err.message : String(err);
-          recordAgentFailure(agent.id, err);
-          const code = err instanceof OwneyError ? err.code : "SDK_AGENT_FAILURE";
-          void reportAgentFailure(
-            this.apiKey,
-            agent.id,
-            code,
-            this.routingApiBaseUrl
-          );
         }
+      } catch (error) {
+        if (serverLegs.size) await awaitServerHandoffs();
+        await settleHandedOver2();
+        throw error;
       }
+      await settleHandedOver2();
       if (Object.keys(results2).length === 0) {
         throwUnconfirmed(agentErrors2);
         if (Object.keys(agentErrors2).length === 0)
@@ -16795,32 +18584,65 @@ var OwneySDK = class {
     const agentErrors = {
       ...aggregated.agentErrors ?? {}
     };
-    for (let i = 0; i < orderedPlans.length; i++) {
-      const p = orderedPlans[i];
-      assertPlan();
-      if (p.planned <= 0n) continue;
-      try {
-        results[p.agent.id] = await submit(p.agent, p.planned.toString());
-        notifyAgentResult(p.agent.id, results[p.agent.id]);
-      } catch (err) {
+    const failed = (p, index, err, handedOver) => {
+      if (!handedOver) {
         if (err instanceof OwneyError && err.code === "SPONSOR_REQUEST_FAILED" && err.details?.safeToFallback === true) throw err;
         if (this.isUserRejectedWithdrawal(err)) throw err;
-        console.error(`withdraw failed for agent "${p.agent.id}":`, err);
-        agentErrors[p.agent.id] = err instanceof Error ? err.message : String(err);
-        recordAgentFailure(p.agent.id, err);
-        const code = err instanceof OwneyError ? err.code : "SDK_AGENT_FAILURE";
-        void reportAgentFailure(
-          this.apiKey,
-          p.agent.id,
-          code,
-          this.routingApiBaseUrl
-        );
-        const failedAmount = p.planned;
-        p.planned = 0n;
-        if (submissionEvidence.get(p.agent.id)?.transfer === "failed")
-          redistributeShare(orderedPlans, i, failedAmount);
       }
+      console.error(`withdraw failed for agent "${p.agent.id}":`, err);
+      agentErrors[p.agent.id] = err instanceof Error ? err.message : String(err);
+      recordAgentFailure(p.agent.id, err);
+      const code = err instanceof OwneyError ? err.code : "SDK_AGENT_FAILURE";
+      void reportAgentFailure(
+        this.apiKey,
+        p.agent.id,
+        code,
+        this.routingApiBaseUrl
+      );
+      const failedAmount = p.planned;
+      p.planned = 0n;
+      if (!handedOver && submissionEvidence.get(p.agent.id)?.transfer === "failed")
+        redistributeShare(orderedPlans, index, failedAmount);
+    };
+    const handedOverLegs = [];
+    const settleHandedOver = async () => {
+      for (const { plan, index, outcome } of handedOverLegs.splice(0)) {
+        try {
+          results[plan.agent.id] = await outcome;
+          notifyAgentResult(plan.agent.id, results[plan.agent.id]);
+        } catch (err) {
+          failed(plan, index, err, true);
+        }
+      }
+    };
+    const dispatchedPlans = orderedPlans.filter((plan) => plan.planned > 0n);
+    await prepareLaterAgents(dispatchedPlans.map((plan) => plan.agent));
+    recordPlan(dispatchedPlans.map((plan) => [plan.agent, plan.planned.toString()]));
+    try {
+      for (let i = 0; i < orderedPlans.length; i++) {
+        const p = orderedPlans[i];
+        assertPlan();
+        if (p.planned <= 0n) continue;
+        const serverLeg = serverLegs.get(p.agent.id);
+        if (serverLeg && await serverLeg.answer && /^[1-9][0-9]*$/.test(serverLeg.share)) p.planned = BigInt(serverLeg.share);
+        const leg = await dispatch(p.agent, p.planned.toString());
+        if (leg.handedOver) {
+          handedOverLegs.push({ plan: p, index: i, outcome: leg.outcome });
+          continue;
+        }
+        try {
+          results[p.agent.id] = await leg.outcome;
+          notifyAgentResult(p.agent.id, results[p.agent.id]);
+        } catch (err) {
+          failed(p, i, err, false);
+        }
+      }
+    } catch (error) {
+      if (serverLegs.size) await awaitServerHandoffs();
+      await settleHandedOver();
+      throw error;
     }
+    await settleHandedOver();
     if (Object.keys(results).length === 0) {
       throwUnconfirmed(agentErrors);
       throw new OwneyError(
@@ -17756,12 +19578,20 @@ function createOwneySIWX(config) {
 export {
   AgentChainIncompatibleError,
   AgentNotFoundError,
+  FUNDING_DEPOSIT_RECOVERY_REPORT,
+  FUSION_SECRET_SERVER_PUBLISH,
   InvalidHistoryCursorError,
   NotConnectedError,
   OwneyError,
   OwneySDK,
   SDK_VERSION,
+  SPONSORED_DEPOSIT_SERVER_BROADCAST,
+  YIELDSEEKER_WITHDRAW_SERVER_SUBMIT,
   YieldseekerAgent,
+  ZYFAI_REGISTRATION_NOT_SENT_CODES,
+  ZYFAI_SERVER_TASKS,
+  ZYFAI_WITHDRAWAL_NOT_SENT_CODES,
+  ZYFAI_WITHDRAW_DISPATCH_CHECKPOINT,
   clearWithdrawSwap,
   createOwneySIWX,
   listPendingDeposits,