@gvnrdao/dh-lit-ops 0.0.55 → 0.0.73

package/dist/modules/lit-ops.module.js

@@ -56,6 +56,38 @@ const session_signature_manager_module_1 = require("./session-signature-manager.
 const capacity_master_module_1 = require("./capacity-master.module");
 class LitOps {
     constructor(config) {
+        // CRITICAL VALIDATION: Reject datil-test immediately with terrifying error
+        if (config.network === "datil-test") {
+            throw new Error("\n\n" +
+                "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n" +
+                "❌ ❌ ❌  FATAL ERROR: datil-test IS NOT SUPPORTED  ❌ ❌ ❌\n" +
+                "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n" +
+                "\n" +
+                "The 'datil-test' network has been PERMANENTLY REMOVED from this codebase.\n" +
+                "\n" +
+                "WHY THIS ERROR EXISTS:\n" +
+                "  • datil-test was unstable and caused production failures\n" +
+                "  • datil-test is deprecated by LIT Protocol\n" +
+                "  • Using datil-test was masking real production issues\n" +
+                "\n" +
+                "WHAT YOU MUST DO:\n" +
+                "  1. Change ALL 'datil-test' references to 'datil'\n" +
+                "  2. Use capacity credits for testing on datil network\n" +
+                "  3. Test with the ACTUAL production network (datil)\n" +
+                "\n" +
+                "WHERE TO LOOK:\n" +
+                "  • Configuration files (.env, config files)\n" +
+                "  • Test files (*.test.ts)\n" +
+                "  • SDK initialization code\n" +
+                "  • LitOps/LIT Protocol integration points\n" +
+                "\n" +
+                "EXAMPLE FIX:\n" +
+                "  ❌ BAD:  network: 'datil-test'\n" +
+                "  ✅ GOOD: network: 'datil'\n" +
+                "\n" +
+                "This is NOT negotiable. datil-test support will NEVER return.\n" +
+                "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n");
+        }
         this.config = {
             domain: "diamond-hands.local",
             sessionExpirationMinutes: 30, // Extended from 15 to 30 for longer retry cycles
@@ -290,8 +322,7 @@ class LitOps {
      * Execute a LIT Action from CID
      */
     async executeActionFromCID(cid, pkpPublicKey, params, signer, pkpTokenId, // Optional PKP token ID for session signature scoping
-    pkpEthAddress, // Optional PKP Ethereum address for capacity credit delegation
-    additionalPkpTokenIds // Additional PKP token IDs for multi-PKP operations
+    pkpEthAddress // Optional PKP Ethereum address for capacity credit delegation
     ) {
         const litClient = await this.clientManager.getClient({
             litNetwork: this.config.network,
@@ -304,7 +335,6 @@ class LitOps {
             signer,
             pkpTokenId, // Pass through pkpTokenId for session signature scoping
             pkpEthAddress, // Pass through pkpEthAddress for capacity delegation
-            additionalPkpTokenIds, // Pass through additional PKP token IDs for multi-PKP operations
         };
         return this.actionExecutor.executeAction(request, litClient);
     }
@@ -448,6 +478,8 @@ class LitOps {
             pkpPublicKey,
             params,
             signer,
+            // Include pkpTokenId for session signature scoping (required for burned PKPs)
+            pkpTokenId: pkpTokenId || params?.pkpTokenId,
         };
         return this.actionExecutor.executeAction(request, litClient);
     }
@@ -605,12 +637,10 @@ class LitOps {
         console.log(`   - targetPkpTokenId: "${targetPkpTokenId}"`);
         console.log(`   - targetPkpTokenId type: ${typeof targetPkpTokenId}`);
         console.log(`   - targetPkpTokenId length: ${targetPkpTokenId.length}`);
-        console.log(`   - targetPkpTokenId startsWith '0x': ${targetPkpTokenId.startsWith('0x')}`);
+        console.log(`   - targetPkpTokenId startsWith '0x': ${targetPkpTokenId.startsWith("0x")}`);
         console.log(`   - expectedCid (WILL BE PASSED TO LIT ACTION): "${expectedCid}"`);
         console.log(`   - signerPkp.tokenId: "${signerPkp.tokenId}"`);
         console.log(`   - signerPkp.ethAddress: "${signerPkp.ethAddress}"`);
-        console.log(`   - signerPkp.publicKey: "${signerPkp.publicKey?.substring(0, 50)}..."`);
-        console.log(`   - signerPkp.publicKey full: "${signerPkp.publicKey}"`);
         if (this.config.debug) {
             console.log("\n🔍 LitOps.validatePKPSecurity");
             console.log(`   Target PKP: ${targetPkpTokenId}`);
@@ -619,49 +649,46 @@ class LitOps {
         }
         try {
             // Get the PKP validator CID
-            // CRITICAL: Ensure datil network uses DH_LIT_ACTIONS_DATIL (not DATIL_TEST)
-            const isDatil = this.config.network === "datil";
-            const registry = isDatil ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST;
-            // Validation: Ensure we're using the correct registry for datil network
-            if (isDatil && registry !== dh_lit_actions_1.DH_LIT_ACTIONS_DATIL) {
-                throw new Error(`Network mismatch: Expected DH_LIT_ACTIONS_DATIL for datil network, but got different registry`);
-            }
-            const pkpValidatorCid = registry.pkpValidator.cid;
-            // Validation: Ensure datil network uses the correct validator CID (version 2.0.0)
-            const EXPECTED_DATIL_VALIDATOR_CID = "QmfQjsJTxpd26tBXh5qobxncBeq2iWCPUNDTfUgVGqLis1";
-            if (isDatil && pkpValidatorCid !== EXPECTED_DATIL_VALIDATOR_CID) {
-                throw new Error(`Invalid validator CID for datil network: Expected ${EXPECTED_DATIL_VALIDATOR_CID} (version 2.0.0), but got ${pkpValidatorCid}`);
-            }
-            // Get validator CID in hex format for signature (contract expects this CID in signature)
-            const validatorCidHex = (0, dh_lit_actions_1.cidToHex)(pkpValidatorCid);
+            const pkpValidatorCid = (this.config.network === "datil"
+                ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
+                : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST).pkpValidator.cid;
             if (this.config.debug) {
-                console.log(`   Network: ${this.config.network}`);
-                console.log(`   Registry: ${isDatil ? "DH_LIT_ACTIONS_DATIL" : "DH_LIT_ACTIONS_DATIL_TEST"}`);
                 console.log(`   PKP Validator CID: ${pkpValidatorCid}`);
-                console.log(`   Validator Version: ${registry.pkpValidator.version}`);
-                console.log(`   Validator CID (hex, for signature): ${validatorCidHex}`);
             }
             // Execute PKP Validator LIT Action
-            // NOTE: We do NOT pass the validator PKP token ID here because the validator
-            // performs READ-ONLY operations (no signing). Passing undefined for pkpTokenId
-            // will skip adding LitPKPResource to the session signature, which is correct
-            // for burned/immutable validator PKPs that can't sign via session signatures.
+            // NOTE: Even though the validator PKP is burned/immutable (read-only),
+            // we still pass its tokenId so the session signature is scoped to the
+            // validator resource. The Lit nodes will simply treat the resource as
+            // non-signing, but scoping keeps the session principle of least privilege.
             console.log(`\n🔍 LIT-OPS TRACE: About to call executeActionFromCID with jsParams:`);
             console.log(`   - targetPkpTokenId: "${targetPkpTokenId}"`);
             console.log(`   - expectedCid: "${expectedCid}"`);
-            // Match main branch pattern: do NOT pass pkpEthAddress
-            // Capacity credits are owned by the signer (serverWallet), so auth-manager
-            // will delegate to signer.getAddress() which is correct
+            let sessionScopedSignerTokenId = signerPkp.tokenId;
+            try {
+                const normalizedHex = BigInt(signerPkp.tokenId)
+                    .toString(16)
+                    .padStart(64, "0");
+                sessionScopedSignerTokenId = `0x${normalizedHex}`;
+            }
+            catch (tokenErr) {
+                console.warn("⚠️  Failed to normalize signer PKP tokenId to hex, using raw value", tokenErr);
+            }
+            // Convert validator CID to hex format for signature message
+            // The contract expects the validator's CID in the signature, not the PKP's CID
+            const validatorCidHex = (0, dh_lit_actions_1.cidToHex)(pkpValidatorCid);
+            if (this.config.debug) {
+                console.log(`   Validator CID (IPFS): ${pkpValidatorCid}`);
+                console.log(`   Validator CID (hex): ${validatorCidHex}`);
+                console.log(`   PKP's expected CID (hex): ${expectedCid}`);
+            }
             const litResult = await this.executeActionFromCID(pkpValidatorCid, signerPkp.publicKey, {
                 targetPkpTokenId,
-                expectedCid, // Expected to be in hex format
-                certificationCid: validatorCidHex, // Validator CID for signature (contract expects this)
+                expectedCid, // PKP's LIT Action CID (for validation check)
+                certificationCid: validatorCidHex, // Validator's CID (for signature message)
                 message: `PKP validation: ${Date.now()}`,
                 // Ensure the LIT Action knows which network (datil vs datil-test)
                 network: this.config.network,
-            }, signer
-            // Intentionally NOT passing signerPkp.tokenId - validator is read-only
-            // Intentionally NOT passing pkpEthAddress - match main branch pattern
+            }, signer, sessionScopedSignerTokenId, signerPkp.ethAddress // Required for capacity delegation on Datil
             );
             if (this.config.debug) {
                 console.log(`   LIT Action Success: ${litResult.success}`);
@@ -710,14 +737,8 @@ class LitOps {
                     // For signing errors, we skip signature verification (architectural limitation)
                     if (isSigningError) {
                         signatureValid = true; // Mark as valid since validation succeeded
-                        // Compute PKP address from public key for consistency
-                        const cleanPublicKey = signerPkp.publicKey.startsWith("0x")
-                            ? signerPkp.publicKey
-                            : `0x${signerPkp.publicKey}`;
-                        pkpAddress = ethers_1.ethers.utils.computeAddress(cleanPublicKey);
                         if (this.config.debug) {
                             console.log("   ℹ️  Signature verification skipped - burned PKP limitation");
-                            console.log(`   PKP Address: ${pkpAddress}`);
                         }
                     }
                     else if (litResult.signatures &&
@@ -857,10 +878,9 @@ class LitOps {
             }
             const retries = this.config.pkpServiceRetryCount ?? 2;
             const retryDelay = this.config.pkpServiceRetryDelayMs ?? 2000;
-            const timeoutMs = this.config.pkpServiceTimeoutMs ?? 480000; // 8 minutes to match server timeout
+            const timeoutMs = this.config.pkpServiceTimeoutMs ?? 120000;
             let attempt = 0;
             let lastError = null;
-            let rateLimitDetected = false;
             while (attempt <= retries) {
                 if (this.config.debug) {
                     console.log(`   🌐 Service mode: calling ${this.config.serviceEndpoint}/api/lit/pkp/create-diamond-hands-loan (attempt ${attempt + 1}/${retries + 1})`);
@@ -876,37 +896,7 @@ class LitOps {
                         }),
                     }, timeoutMs);
                     if (!response.ok) {
-                        const errorText = await response.text();
-                        let errorMessage = `Service request failed: ${response.status} ${response.statusText}`;
-                        // Try to parse error text as JSON to extract error message
-                        let parsedError = null;
-                        try {
-                            parsedError = JSON.parse(errorText);
-                            if (parsedError.error) {
-                                errorMessage = `${errorMessage} - ${parsedError.error}`;
-                            }
-                            else if (parsedError.message) {
-                                errorMessage = `${errorMessage} - ${parsedError.message}`;
-                            }
-                            else if (errorText && errorText.length > 0) {
-                                errorMessage = `${errorMessage} - ${errorText}`;
-                            }
-                        }
-                        catch {
-                            // Not JSON, use raw text if available
-                            if (errorText && errorText.length > 0) {
-                                errorMessage = `${errorMessage} - ${errorText}`;
-                            }
-                        }
-                        // Check for rate limit errors
-                        const isRateLimit = response.status === 429 ||
-                            errorText.toLowerCase().includes('rate_limit') ||
-                            errorText.toLowerCase().includes('rate limit');
-                        if (isRateLimit) {
-                            rateLimitDetected = true;
-                            errorMessage = `Rate limit exceeded: ${errorText || errorMessage}`;
-                        }
-                        throw new Error(errorMessage);
+                        throw new Error(`Service request failed: ${response.status} ${response.statusText}`);
                     }
                     const result = (await response.json());
                     const duration = Date.now() - startTime;
@@ -937,21 +927,14 @@ class LitOps {
                         message.includes("NodeJsTimeoutError") ||
                         message.includes("Gateway") ||
                         message.includes("502");
-                    const isRateLimit = rateLimitDetected ||
-                        message.toLowerCase().includes('rate_limit') ||
-                        message.toLowerCase().includes('rate limit');
                     if (this.config.debug) {
-                        console.error(`❌ Service request failed on attempt ${attempt + 1}/${retries + 1}:\n   Message: ${message}`);
+                        console.error(`❌ Service request failed on attempt ${attempt + 1}/$${retries + 1}:\n   Message: ${message}`);
                     }
-                    // For rate limit errors, use exponential backoff with longer delays
-                    if (attempt < retries && (isTimeout || isRateLimit)) {
-                        const backoffDelay = isRateLimit
-                            ? Math.min(retryDelay * Math.pow(3, attempt), 60000) // Exponential backoff: 2s, 6s, 18s, max 60s
-                            : retryDelay;
+                    if (attempt < retries && isTimeout) {
                         if (this.config.debug) {
-                            console.log(`   Retrying after ${backoffDelay}ms due to ${isRateLimit ? 'rate limit' : 'transient'} error...`);
+                            console.log(`   Retrying after ${retryDelay}ms due to transient error...`);
                         }
-                        await new Promise((resolve) => setTimeout(resolve, backoffDelay));
+                        await new Promise((resolve) => setTimeout(resolve, retryDelay));
                         attempt++;
                         continue;
                     }
@@ -1045,138 +1028,13 @@ class LitOps {
                     console.log(`   ℹ️  Continuing to validation anyway - may fail if propagation incomplete`);
                 }
             }
-            // Robust pre-validation: wait for mint receipt + confirmations on Yellowstone
-            // This avoids racing propagation by keying off confirmed blocks
-            try {
-                const ethers5 = await Promise.resolve().then(() => __importStar(require("ethers")));
-                const rpcUrl = this.config.network === "datil"
-                    ? "https://yellowstone-rpc.litprotocol.com"
-                    : "https://yellowstone-rpc.litprotocol.com"; // Same for both currently
-                const mintTxHash = pkpData.mintTransactionHash;
-                const confirmationsTarget = this.config.yellowstoneConfirmations ?? 2; // Reduced from 3 to 2 to reduce polling
-                const receiptPollMs = this.config.yellowstoneReceiptPollMs ?? 10000; // Increased from 5s to 10s to reduce rate limit pressure
-                const receiptTimeoutMs = this.config.yellowstoneReceiptTimeoutMs ?? 180000; // 2 minutes
-                if (this.config.debug) {
-                    console.log("\n   ⏳ Waiting for PKP mint transaction receipt and confirmations...");
-                    console.log(`   - mintTxHash: ${mintTxHash}`);
-                    console.log(`   - confirmationsTarget: ${confirmationsTarget}`);
-                    console.log(`   - poll interval: ${receiptPollMs}ms, timeout: ${receiptTimeoutMs}ms`);
-                }
-                const startedAt = Date.now();
-                let receipt = null;
-                // Poll for receipt
-                while (Date.now() - startedAt < receiptTimeoutMs) {
-                    const receiptPayload = {
-                        method: "eth_getTransactionReceipt",
-                        params: [mintTxHash],
-                        id: 1,
-                        jsonrpc: "2.0",
-                    };
-                    const resp = await fetch(rpcUrl, {
-                        method: "POST",
-                        headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify(receiptPayload),
-                    });
-                    const json = (await resp.json());
-                    if (json && json.result) {
-                        receipt = json.result;
-                        break;
-                    }
-                    await new Promise((r) => setTimeout(r, receiptPollMs));
-                }
-                if (!receipt) {
-                    if (this.config.debug) {
-                        console.log("   ⚠️  Mint receipt not found within timeout; continuing optimistically");
-                    }
-                }
-                else {
-                    // Wait for confirmations
-                    const mintedAtBlock = ethers5.BigNumber.from(receipt.blockNumber).toNumber();
-                    if (this.config.debug) {
-                        console.log(`   ✅ Mint receipt found at block ${mintedAtBlock}`);
-                    }
-                    let currentBlock = mintedAtBlock;
-                    while (currentBlock < mintedAtBlock + confirmationsTarget) {
-                        const blockNumPayload = { method: "eth_blockNumber", params: [], id: 1, jsonrpc: "2.0" };
-                        const bResp = await fetch(rpcUrl, {
-                            method: "POST",
-                            headers: { "Content-Type": "application/json" },
-                            body: JSON.stringify(blockNumPayload),
-                        });
-                        const bJson = (await bResp.json());
-                        if (bJson && bJson.result) {
-                            currentBlock = ethers5.BigNumber.from(bJson.result).toNumber();
-                            if (this.config.debug) {
-                                console.log(`   ⛓️  Yellowstone block: ${currentBlock} (target >= ${mintedAtBlock + confirmationsTarget})`);
-                            }
-                            if (currentBlock >= mintedAtBlock + confirmationsTarget) {
-                                break;
-                            }
-                        }
-                        // Use same polling interval as receipt polling (10s) to reduce rate limit pressure
-                        await new Promise((r) => setTimeout(r, receiptPollMs));
-                    }
-                    if (this.config.debug) {
-                        console.log("   ✅ Required confirmations reached; proceeding to existence check");
-                    }
-                }
-            }
-            catch (confirmWaitError) {
-                if (this.config.debug) {
-                    console.log("   ⚠️  Error during receipt/confirmation wait:", confirmWaitError);
-                    console.log("   Continuing with existence check regardless");
-                }
-            }
-            // Step 1.75: Verify PKP existence using ownerOf() (more reliable than exists())
+            // Additional delay after burn verification for network consensus
             if (this.config.debug) {
-                console.log("\n   Step 1.75: Pre-validation PKP ownerOf() check on Chronicle Yellowstone...");
-            }
-            try {
-                const ethers5 = await Promise.resolve().then(() => __importStar(require("ethers")));
-                const pkpTokenIdBN = ethers5.BigNumber.from(pkpData.tokenId);
-                const ownerOfCalldata = ethers5.utils.concat([
-                    ethers5.utils.id("ownerOf(uint256)").substring(0, 10),
-                    ethers5.utils.defaultAbiCoder.encode(["uint256"], [pkpTokenIdBN]),
-                ]);
-                const rpcUrl = this.config.network === "datil"
-                    ? "https://yellowstone-rpc.litprotocol.com"
-                    : "https://yellowstone-rpc.litprotocol.com";
-                const pkpNftAddress = process.env.LIT_PKP_NFT_ADDRESS && process.env.LIT_PKP_NFT_ADDRESS.trim() !== ""
-                    ? process.env.LIT_PKP_NFT_ADDRESS
-                    : (this.config.network === "datil"
-                        ? dh_lit_actions_1.SEPOLIA_DEPLOYMENT.litProtocol?.pkpNftContract
-                        : dh_lit_actions_1.LOCALHOST_DEPLOYMENT.litProtocol?.pkpNftContract);
-                const ownerRpcPayload = {
-                    method: "eth_call",
-                    params: [
-                        {
-                            to: pkpNftAddress,
-                            data: ethers5.utils.hexlify(ownerOfCalldata),
-                        },
-                        "latest",
-                    ],
-                    id: 1,
-                    jsonrpc: "2.0",
-                };
-                const ownerResponse = await fetch(rpcUrl, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify(ownerRpcPayload),
-                });
-                const ownerResult = (await ownerResponse.json());
-                if (ownerResult.error || !ownerResult.result || ownerResult.result === '0x') {
-                    throw new Error(`ownerOf() failed or returned empty (likely propagation): ${ownerResult.error?.message || ownerResult.error || 'empty result'}`);
-                }
-                const owner = ethers5.utils.defaultAbiCoder.decode(["address"], ownerResult.result)[0];
-                if (this.config.debug) {
-                    console.log(`   ✅ ownerOf() returned: ${owner}`);
-                }
+                console.log("\n   ⏳ Additional delay for network consensus (10 seconds)...");
             }
-            catch (preValidationError) {
-                if (this.config.debug) {
-                    console.error(`   ❌ Pre-validation ownerOf() check failed:`, preValidationError);
-                }
-                // Do not hard-fail here; proceed to validator with retry logic
+            await new Promise((resolve) => setTimeout(resolve, 10000));
+            if (this.config.debug) {
+                console.log(`   ✅ Network propagation and consensus complete`);
             }
             // Step 2: Validate PKP security using pkp-validator LIT Action
             const step2Start = Date.now();
@@ -1202,64 +1060,24 @@ class LitOps {
             // }
             // Use production deployments
             validatorPkp = dh_lit_actions_1.DATIL_DEPLOYMENTS.pkpValidator.pkp;
-            // Log validator PKP data for debugging
-            console.log(`🔍 LIT-OPS TRACE: Validator PKP Source Check:`);
-            console.log(`   - DATIL_DEPLOYMENTS.pkpValidator.pkp exists:`, !!validatorPkp);
-            console.log(`   - DATIL_DEPLOYMENTS.pkpValidator.cid:`, dh_lit_actions_1.DATIL_DEPLOYMENTS.pkpValidator.cid);
-            if (validatorPkp) {
-                console.log(`   - validatorPkp.ethAddress:`, validatorPkp.ethAddress);
-                console.log(`   - validatorPkp.publicKey:`, validatorPkp.publicKey?.substring(0, 50) + '...');
-                console.log(`   - validatorPkp.tokenId:`, validatorPkp.tokenId);
-            }
-            else {
-                console.log(`   - DATIL_DEPLOYMENTS.pkpValidator keys:`, Object.keys(dh_lit_actions_1.DATIL_DEPLOYMENTS.pkpValidator));
-            }
             if (this.config.debug) {
                 console.log("   Using production validator PKP", validatorPkp);
             }
             if (!validatorPkp) {
                 throw new Error("PKP validator PKP not found in dh-lit-actions package");
             }
-            // TWO DIFFERENT CIDs ARE USED IN PKP VALIDATION:
-            // 1. Authorization CID - validates loan PKP has correct operational CID (auth dummy)
-            // 2. Validator CID - used by validator PKP to sign certification for on-chain contract
-            // OPERATIONAL VALIDATION: Check loan PKP has authorization dummy CID
-            // IMPORTANT: Loan PKPs are authorized with operational CIDs (auth dummy + UCD mint)
-            // They do NOT have the validator CID - that's only for the centralized validator PKP
-            // We validate that the loan PKP has the expected authorization dummy CID
-            const authorizationCid = cids[0]; // First CID in array (authorization dummy)
-            if (!authorizationCid) {
-                throw new Error("Authorization CID not found in cids array");
-            }
-            console.log(`🔍 LIT-OPS TRACE: authorizationCid (first in array) = "${authorizationCid}"`);
-            console.log(`🔍 LIT-OPS TRACE: Authorized actions cids array:`, cids);
-            const litActionCidHex = (0, dh_lit_actions_1.cidToHex)(authorizationCid);
+            // Convert IPFS CID to hex format for validation (using first CID)
+            const firstCid = cids[0];
+            console.log(`🔍 LIT-OPS TRACE: firstCid (cids[0]) = "${firstCid}"`);
+            console.log(`🔍 LIT-OPS TRACE: All cids array:`, cids);
+            const litActionCidHex = (0, dh_lit_actions_1.cidToHex)(firstCid);
             console.log(`🔍 LIT-OPS TRACE: litActionCidHex after cidToHex() = "${litActionCidHex}"`);
             if (this.config.debug) {
-                console.log(`      Converting CID: ${authorizationCid} → ${litActionCidHex}`);
-            }
-            // CERTIFICATION SIGNATURE: Get validator CID for on-chain contract signature
-            // The on-chain contract expects the validator PKP to sign with the VALIDATOR CID
-            // NOT the authorization CID! This is the CID registered in cidForVersion mapping.
-            const validatorCid = (this.config.network === "datil"
-                ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
-                : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST).pkpValidator.cid;
-            const validatorCidHex = (0, dh_lit_actions_1.cidToHex)(validatorCid);
-            console.log(`🔍 LIT-OPS TRACE: validatorCid (for signature) = "${validatorCid}"`);
-            console.log(`🔍 LIT-OPS TRACE: validatorCidHex (for signature) = "${validatorCidHex}"`);
-            if (this.config.debug) {
-                console.log(`      Validator CID for signature: ${validatorCid} → ${validatorCidHex}`);
-            }
-            // Wait for PKP to propagate on the network before validation
-            // This helps avoid "execution reverted" errors when checking PKP existence
-            if (this.config.debug) {
-                console.log("\n   ⏳ Waiting 5 seconds for PKP network propagation before validation...");
+                console.log(`      Converting CID: ${firstCid} → ${litActionCidHex}`);
             }
-            await new Promise((resolve) => setTimeout(resolve, 5000));
             // Attempt validation with retry logic for network propagation issues
             let validationResult;
-            const maxValidationRetries = 5; // Increased from 3 to 5 for better reliability
-            const retryDelays = [2000, 4000, 8000, 16000]; // Exponential backoff: 2s, 4s, 8s, 16s
+            const maxValidationRetries = 2;
             let lastValidationError = null;
             for (let attempt = 1; attempt <= maxValidationRetries; attempt++) {
                 try {
@@ -1283,11 +1101,11 @@ class LitOps {
                     }
                     // Validation returned but marked as unsuccessful
                     lastValidationError = new Error(`PKP validation failed: ${validationResult.error || "Unknown validation error"}`);
-                    // If not the last attempt, wait before retrying with exponential backoff
+                    // If not the last attempt, wait before retrying
                     if (attempt < maxValidationRetries) {
-                        const retryDelay = retryDelays[attempt - 1]; // Exponential backoff
+                        const retryDelay = 10000; // 10 seconds between validation retries
                         if (this.config.debug) {
-                            console.log(`   ⏳ Exponential backoff: Waiting ${retryDelay}ms before retry ${attempt + 1}/${maxValidationRetries}...`);
+                            console.log(`   ⏳ Waiting ${retryDelay}ms before retry...`);
                         }
                         await new Promise((resolve) => setTimeout(resolve, retryDelay));
                     }
@@ -1307,11 +1125,11 @@ class LitOps {
                             console.log(`   ℹ️  This appears to be a network propagation issue`);
                         }
                     }
-                    // If this is a propagation error and not the last attempt, retry with exponential backoff
+                    // If this is a propagation error and not the last attempt, retry
                     if (isPropagationError && attempt < maxValidationRetries) {
-                        const retryDelay = retryDelays[attempt - 1]; // Exponential backoff
+                        const retryDelay = 15000; // 15 seconds for propagation issues
                         if (this.config.debug) {
-                            console.log(`   ⏳ Exponential backoff: Waiting ${retryDelay}ms for network propagation before retry ${attempt + 1}/${maxValidationRetries}...`);
+                            console.log(`   ⏳ Waiting ${retryDelay}ms for network propagation before retry...`);
                         }
                         await new Promise((resolve) => setTimeout(resolve, retryDelay));
                         continue;
@@ -1481,7 +1299,7 @@ class LitOps {
             console.log("   Has clientManager:", !!this.clientManager);
             console.log("   clientManager type:", typeof this.clientManager);
             if (this.clientManager) {
-                console.log("   clientManager keys:", Object.keys(this.clientManager).join(', '));
+                console.log("   clientManager keys:", Object.keys(this.clientManager).join(", "));
                 console.log("   Has getClient:", typeof this.clientManager.getClient);
             }
         }
@@ -1498,7 +1316,7 @@ class LitOps {
         if (this.config.debug) {
             console.log("🌐 Requesting mint authorization via service:", url);
             console.log("   Position ID:", request.authMessage.positionId);
-            console.log("   Amount:", request.authMessage.requestedAmount);
+            console.log("   Amount:", request.authMessage.amount);
         }
         try {
             const response = await fetch(url, {
@@ -1509,6 +1327,8 @@ class LitOps {
                 body: JSON.stringify({
                     authMessage: request.authMessage,
                     userSignature: request.userSignature,
+                    customRpcUrl: request.customRpcUrl,
+                    customBitcoinRpcUrl: request.customBitcoinRpcUrl,
                 }),
             });
             if (!response.ok) {
@@ -1571,46 +1391,77 @@ class LitOps {
             console.log("   Network:", this.config.network);
             console.log("   CID:", litActionInfo.cid);
             console.log("   Position:", request.authMessage.positionId);
-            console.log("   Amount:", request.authMessage.requestedAmount);
-            console.log("   Quantum:", request.authMessage.quantumTimestamp);
+            console.log("   Amount:", request.authMessage.amount);
+            console.log("   Timestamp:", request.authMessage.timestamp);
         }
         // Get LIT client for execution
         const litClient = await this.clientManager.getClient({
             litNetwork: this.config.network,
             debug: this.config.debug,
         });
-        // Determine chain from chainId in authMessage
+        // Determine chain and Bitcoin provider from chainId in authMessage
         let chain;
+        let bitcoinProviderUrl;
         switch (request.authMessage.chainId) {
-            case 1:
+            case 1: // Ethereum mainnet
                 chain = "ethereum";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "https://mempool.space/api";
                 break;
-            case 11155111:
+            case 11155111: // Sepolia testnet
                 chain = "sepolia";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL ||
+                        "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api";
                 break;
-            case 31337: // Hardhat local testnet
-                chain = "sepolia"; // Use sepolia config for local testing
+            case 1337: // Hardhat local testnet (actual deployment chainId)
+            case 31337: // Hardhat local testnet (standard default)
+                chain = "hardhat"; // Use hardhat identifier for local testing
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "http://127.0.0.1:18443"; // Local Bitcoin regtest
                 break;
             default:
                 throw new Error(`Unsupported chainId: ${request.authMessage.chainId}`);
         }
-        // Bitcoin provider URL (use env or default to mempool.space for now)
-        const bitcoinProviderUrl = process.env.BITCOIN_PROVIDER_URL || "https://mempool.space/api";
+        // Override with custom Bitcoin RPC URL if provided (for local development)
+        if (request.customBitcoinRpcUrl) {
+            bitcoinProviderUrl = request.customBitcoinRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom Bitcoin RPC URL:", request.customBitcoinRpcUrl);
+            }
+        }
         // Execute LIT Action
-        // authMessage already contains quantumTimestamp calculated by SDK
+        // authMessage already contains timestamp calculated by SDK
         // lit-ops just forwards - no business logic
+        const litActionParams = {
+            chain,
+            bitcoinProviderUrl,
+            auth: {
+                positionId: request.authMessage.positionId,
+                timestamp: request.authMessage.timestamp,
+                chainId: request.authMessage.chainId,
+                amount: request.authMessage.amount,
+                action: request.authMessage.action,
+                signature: request.userSignature,
+                mode: request.authMessage.mode,
+                ...(request.authMessage.contracts && {
+                    contracts: request.authMessage.contracts,
+                }),
+            },
+            amount: request.authMessage.amount,
+        };
+        // Add custom RPC URL for local development (ngrok tunnels)
+        if (request.customRpcUrl) {
+            litActionParams.customRpcUrl = request.customRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom RPC URL:", request.customRpcUrl);
+            }
+        }
+        // Execute LIT Action (single attempt - retry logic is in SDK layer)
         const result = await this.actionExecutor.executeAction({
             cid: litActionInfo.cid,
             pkpPublicKey: litActionInfo.pkp.publicKey,
-            params: {
-                chain,
-                bitcoinProviderUrl,
-                auth: {
-                    message: request.authMessage,
-                    signature: request.userSignature,
-                },
-                amount: request.authMessage.requestedAmount,
-            },
+            params: litActionParams,
             signer: this.config.signer,
         }, litClient);
         if (this.config.debug) {
@@ -1624,7 +1475,7 @@ class LitOps {
         }
         // Parse response if it's a string (LIT Actions return JSON as string)
         let responseData = result.response;
-        if (typeof result.response === 'string') {
+        if (typeof result.response === "string") {
             try {
                 responseData = JSON.parse(result.response);
                 if (this.config.debug) {
@@ -1641,12 +1492,59 @@ class LitOps {
             console.log("🔍 responseData (FULL OBJECT):", JSON.stringify(responseData, null, 2));
             console.log("🔍 responseData keys:", Object.keys(responseData || {}));
         }
+        // Extract actual signature from Lit Action execution result
+        // The signature is in result.signatures.ucdMintAuth.signature (not in response JSON)
+        let actualSignature;
+        try {
+            if (result.signatures && typeof result.signatures === 'object') {
+                const signatures = result.signatures;
+                if (signatures.ucdMintAuth && signatures.ucdMintAuth.signature) {
+                    const sig = signatures.ucdMintAuth.signature;
+                    if (typeof sig === 'string' && sig !== 'success') {
+                        actualSignature = sig;
+                        if (this.config.debug) {
+                            console.log('✅ Extracted signature from Lit Action execution result', {
+                                signatureLength: actualSignature.length,
+                                signaturePreview: actualSignature.substring(0, 20) + '...',
+                            });
+                        }
+                    }
+                    else if (this.config.debug) {
+                        console.warn('⚠️  Signature in Lit Action result is not a valid string', {
+                            signatureType: typeof sig,
+                            signatureValue: sig,
+                        });
+                    }
+                }
+                else if (this.config.debug) {
+                    console.warn('⚠️  No ucdMintAuth signature found in Lit Action execution result', {
+                        signaturesKeys: Object.keys(signatures),
+                    });
+                }
+            }
+            else if (this.config.debug) {
+                console.warn('⚠️  Lit Action execution result has no signatures object', {
+                    hasSignatures: !!result.signatures,
+                    signaturesType: typeof result.signatures,
+                });
+            }
+        }
+        catch (sigError) {
+            // Don't fail authorization if signature extraction fails - signature is optional
+            if (this.config.debug) {
+                console.warn('⚠️  Error extracting signature from Lit Action result (non-fatal)', {
+                    error: sigError instanceof Error ? sigError.message : String(sigError),
+                });
+            }
+        }
+        // Ensure signature is a hex string (add 0x prefix if missing)
+        if (actualSignature && !actualSignature.startsWith("0x")) {
+            actualSignature = "0x" + actualSignature;
+        }
         // Return standardized response
         const returnValue = {
             approved: responseData?.approved ?? false,
-            signature: result.signatures
-                ? JSON.stringify(result.signatures)
-                : undefined,
+            signature: actualSignature, // Return extracted hex string directly (matching pkp-authorization.module.ts pattern)
             mintAmount: responseData?.mintAmount,
             mintFee: responseData?.mintFee,
             newDebt: responseData?.newDebt,
@@ -1829,6 +1727,126 @@ class LitOps {
             results,
         };
     }
+    /**
+     * NOLA (No LIT Action) - Vault Snapshot
+     *
+     * Cost-optimized data access for position health metrics.
+     * Executes vault-snapshot logic in Node.js without paying for LIT Action execution.
+     *
+     * Modes:
+     * - Standalone: Calls executeVaultSnapshot directly with provided RPC URLs
+     * - Service: Sends request to lit-ops-server which provides credentials
+     *
+     * @param params - Position and network configuration
+     * @returns Complete VaultSnapshot with position health data
+     /
+    async getVaultSnapshot(params: {
+      positionId: string;
+      network: "sepolia" | "ethereum" | "localhost";
+      // Standalone mode requires these:
+      contractAddress?: string;
+      termManagerAddress?: string;
+      loanOpsManagerAddress?: string;
+      chainId?: number;
+      rpcUrl?: string;
+      bitcoinProviderUrl?: string;
+      minConfirmations?: number;
+    }) {
+      if (this.config.mode === "standalone") {
+        // Standalone mode: Direct execution with provided credentials
+        if (
+          !params.contractAddress ||
+          !params.rpcUrl ||
+          !params.bitcoinProviderUrl
+        ) {
+          throw new Error(
+            "Standalone mode requires: contractAddress, rpcUrl, bitcoinProviderUrl"
+          );
+        }
+        if (!params.termManagerAddress || !params.loanOpsManagerAddress) {
+          throw new Error(
+            "Standalone mode requires: termManagerAddress, loanOpsManagerAddress"
+          );
+        }
+  
+        // Import NOLA executor
+        const { executeVaultSnapshot } = await import("@gvnrdao/dh-lit-actions");
+  
+        // Execute directly
+        return await executeVaultSnapshot({
+          positionId: params.positionId,
+          contractAddress: params.contractAddress,
+          termManagerAddress: params.termManagerAddress,
+          loanOpsManagerAddress: params.loanOpsManagerAddress,
+          chain: params.network,
+          chainId: params.chainId,
+          rpcUrl: params.rpcUrl,
+          bitcoinProviderUrl: params.bitcoinProviderUrl,
+          minConfirmations: params.minConfirmations || 6,
+        });
+      } else {
+        // Service mode: Call lit-ops-server endpoint
+        if (!this.config.serviceEndpoint) {
+          throw new Error("serviceEndpoint is required for service mode");
+        }
+  
+        const response = await fetch(
+          `${this.config.serviceEndpoint}/api/lit/nola/vault-snapshot`,
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+              positionId: params.positionId,
+              network: params.network,
+            }),
+          }
+        );
+  
+        if (!response.ok) {
+          const errorText = await response.text();
+          throw new Error(
+            `NOLA service request failed: ${response.status} ${errorText}`
+          );
+        }
+  
+        const apiResponse: any = await response.json();
+  
+        // Convert string BigInts back to BigInt type
+        const convertStringsToBigInt = (obj: any): any => {
+          if (obj === null || obj === undefined) return obj;
+  
+          if (typeof obj === "string") {
+            // Check if string is a valid BigInt representation
+            if (/^\d+$/.test(obj)) {
+              try {
+                return BigInt(obj);
+              } catch {
+                return obj;
+              }
+            }
+            return obj;
+          }
+  
+          if (Array.isArray(obj)) {
+            return obj.map(convertStringsToBigInt);
+          }
+  
+          if (typeof obj === "object") {
+            const converted: any = {};
+            for (const key in obj) {
+              converted[key] = convertStringsToBigInt(obj[key]);
+            }
+            return converted;
+          }
+  
+          return obj;
+        };
+  
+        return convertStringsToBigInt(apiResponse.data); // Unwrap and convert
+      }
+    } */
     async disconnect() {
         // Ensure capacity module timers are cleaned up first
         try {