@gvnrdao/dh-lit-ops 0.0.73 → 0.0.107

package/dist/modules/lit-ops.module.js

@@ -415,6 +415,29 @@ class LitOps {
         };
         return this.actionExecutor.executeAction(request, litClient);
     }
+    /**
+     * TEST-ONLY: Execute arbitrary local LIT Action code for debugging PKP authorization.
+     *
+     * This helper is intended for Jest / integration tests to run a minimal action
+     * (e.g. sign-only) with either wildcard or CID-scoped session signatures.
+     */
+    async runLocalLitActionCodeForTest(options) {
+        const { code, pkpPublicKey, params, pkpTokenId, cid } = options;
+        const litClient = await this.clientManager.getClient({
+            litNetwork: this.config.network,
+            debug: this.config.debug,
+        });
+        const request = {
+            code,
+            cid, // Optional CID: when provided, session sigs are scoped to this action
+            pkpPublicKey,
+            params,
+            signer: this.config.signer,
+            pkpTokenId,
+        };
+        const result = await this.actionExecutor.executeAction(request, litClient);
+        return result.response;
+    }
     /**
      * Execute a LIT Action from IPFS
      */
@@ -478,8 +501,6 @@ class LitOps {
             pkpPublicKey,
             params,
             signer,
-            // Include pkpTokenId for session signature scoping (required for burned PKPs)
-            pkpTokenId: pkpTokenId || params?.pkpTokenId,
         };
         return this.actionExecutor.executeAction(request, litClient);
     }
@@ -632,7 +653,7 @@ class LitOps {
      * @param signer - The wallet to use for session signatures
      * @returns PKP validation result with signature verification
      */
-    async validatePKPSecurity(targetPkpTokenId, expectedCid, signerPkp, signer) {
+    async validatePKPSecurity(targetPkpTokenId, expectedCid, signerPkp, signer, options) {
         console.log(`🔍 LIT-OPS TRACE: validatePKPSecurity ENTRY`);
         console.log(`   - targetPkpTokenId: "${targetPkpTokenId}"`);
         console.log(`   - targetPkpTokenId type: ${typeof targetPkpTokenId}`);
@@ -651,18 +672,25 @@ class LitOps {
             // Get the PKP validator CID
             const pkpValidatorCid = (this.config.network === "datil"
                 ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
-                : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST).pkpValidator.cid;
+                : (() => {
+                    throw new Error("Unsupported LIT network");
+                })()).pkpValidator.cid;
+            // Convert validator CID to hex format for signature message
+            // The contract expects the validator's CID in the signature, not the PKP's CID
+            // Use registry CID (same as cr-lit branch) - this is the source of truth
+            const validatorCidHex = (0, dh_lit_actions_1.cidToHex)(pkpValidatorCid);
             if (this.config.debug) {
-                console.log(`   PKP Validator CID: ${pkpValidatorCid}`);
+                console.log(`   PKP Validator CID (IPFS): ${pkpValidatorCid}`);
+                console.log(`   Validator CID (hex): ${validatorCidHex}`);
+                console.log(`   PKP's expected CID (hex): ${expectedCid}`);
             }
             // Execute PKP Validator LIT Action
             // NOTE: Even though the validator PKP is burned/immutable (read-only),
             // we still pass its tokenId so the session signature is scoped to the
             // validator resource. The Lit nodes will simply treat the resource as
             // non-signing, but scoping keeps the session principle of least privilege.
-            console.log(`\n🔍 LIT-OPS TRACE: About to call executeActionFromCID with jsParams:`);
-            console.log(`   - targetPkpTokenId: "${targetPkpTokenId}"`);
-            console.log(`   - expectedCid: "${expectedCid}"`);
+            // Normalize signer PKP token ID to hex format for session scoping
+            // NOTE: signerPkp IS the validator PKP (passed from call site)
             let sessionScopedSignerTokenId = signerPkp.tokenId;
             try {
                 const normalizedHex = BigInt(signerPkp.tokenId)
@@ -673,22 +701,28 @@ class LitOps {
             catch (tokenErr) {
                 console.warn("⚠️  Failed to normalize signer PKP tokenId to hex, using raw value", tokenErr);
             }
-            // Convert validator CID to hex format for signature message
-            // The contract expects the validator's CID in the signature, not the PKP's CID
-            const validatorCidHex = (0, dh_lit_actions_1.cidToHex)(pkpValidatorCid);
             if (this.config.debug) {
-                console.log(`   Validator CID (IPFS): ${pkpValidatorCid}`);
-                console.log(`   Validator CID (hex): ${validatorCidHex}`);
-                console.log(`   PKP's expected CID (hex): ${expectedCid}`);
+                console.log(`   Signer PKP (validator) Public Key: ${signerPkp.publicKey.substring(0, 20)}...`);
+                console.log(`   Signer PKP (validator) Token ID: ${signerPkp.tokenId}`);
+                console.log(`   Signer PKP (validator) ETH Address: ${signerPkp.ethAddress}`);
             }
-            const litResult = await this.executeActionFromCID(pkpValidatorCid, signerPkp.publicKey, {
+            console.log(`\n🔍 LIT-OPS TRACE: About to call executeActionFromCID with jsParams:`);
+            console.log(`   - targetPkpTokenId: "${targetPkpTokenId}"`);
+            console.log(`   - expectedCid: "${expectedCid}"`);
+            console.log(`   - certificationCid: "${validatorCidHex}"`);
+            console.log(`   - signerPkp.publicKey: "${signerPkp.publicKey.substring(0, 20)}..."`);
+            // Use signerPkp directly (which IS the validator PKP from call site, matching cr-lit)
+            // The LIT Action will use globalThis.publicKey which is set from pkpPublicKey parameter
+            const litResult = await this.executeActionFromCID(pkpValidatorCid, signerPkp.publicKey, // ✅ Use signerPkp.publicKey (validator PKP, matching cr-lit)
+            {
                 targetPkpTokenId,
                 expectedCid, // PKP's LIT Action CID (for validation check)
-                certificationCid: validatorCidHex, // Validator's CID (for signature message)
+                certificationCid: validatorCidHex, // Validator's CID (for signature message) - from registry
                 message: `PKP validation: ${Date.now()}`,
                 // Ensure the LIT Action knows which network (datil vs datil-test)
                 network: this.config.network,
-            }, signer, sessionScopedSignerTokenId, signerPkp.ethAddress // Required for capacity delegation on Datil
+            }, signer, sessionScopedSignerTokenId, // ✅ Use normalized signerPkp.tokenId for session scoping (matching cr-lit)
+            signerPkp.ethAddress // ✅ Use signerPkp.ethAddress for capacity delegation (matching cr-lit)
             );
             if (this.config.debug) {
                 console.log(`   LIT Action Success: ${litResult.success}`);
@@ -747,7 +781,7 @@ class LitOps {
                             console.log("   🔍 Verifying signature authenticity...");
                         }
                         try {
-                            // Compute PKP address from public key (publicKey already includes 0x prefix)
+                            // Compute validator PKP address from public key (CRITICAL: Use signerPkp.publicKey, matching cr-lit)
                             const cleanPublicKey = signerPkp.publicKey.startsWith("0x")
                                 ? signerPkp.publicKey
                                 : `0x${signerPkp.publicKey}`;
@@ -895,10 +929,24 @@ class LitOps {
                             litActionCids: litActionCids,
                         }),
                     }, timeoutMs);
+                    // Read response body first (whether success or error)
+                    const responseText = await response.text();
+                    let result;
+                    try {
+                        result = JSON.parse(responseText);
+                    }
+                    catch {
+                        // If response is not JSON, treat as plain text error
+                        if (!response.ok) {
+                            throw new Error(`Service request failed: ${response.status} ${response.statusText} - ${responseText}`);
+                        }
+                        throw new Error(`Invalid JSON response from service: ${responseText}`);
+                    }
                     if (!response.ok) {
-                        throw new Error(`Service request failed: ${response.status} ${response.statusText}`);
+                        // Extract error message from JSON response
+                        const errorDetails = result.error || result.message || response.statusText;
+                        throw new Error(`Service request failed: ${response.status} ${errorDetails}`);
                     }
-                    const result = (await response.json());
                     const duration = Date.now() - startTime;
                     // The service may wrap the LitOps result as { success, data }
                     // Unwrap if needed to maintain a stable SDK return shape
@@ -1090,8 +1138,16 @@ class LitOps {
                     console.log(`   - pkpTokenId startsWith '0x': ${pkpData.tokenId.startsWith("0x")}`);
                     console.log(`   - litActionCidHex (expectedCid): "${litActionCidHex}"`);
                     console.log(`   - validatorPkp: "${validatorPkp}"`);
+                    // Get validator version and contract info from config
+                    const validatorVersion = this.config.validatorVersion;
+                    const ethRpcUrl = this.config.ethRpcUrl;
+                    const pkpValidationRegistry = this.config.pkpValidationRegistry;
                     validationResult = await this.validatePKPSecurity(pkpData.tokenId, litActionCidHex, // Pass hex format CID
-                    validatorPkp, signer);
+                    validatorPkp, signer, {
+                        validatorVersion,
+                        ethRpcUrl,
+                        pkpValidationRegistry,
+                    });
                     // If validation succeeds, break out of retry loop
                     if (validationResult.success) {
                         if (this.config.debug && attempt > 1) {
@@ -1247,7 +1303,9 @@ class LitOps {
             console.log("🎯 Creating new Diamond Hands Loan PKP");
             console.log("   Using authorization CID:", (networkOverride ?? this.config.network) === "datil"
                 ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL.authorizationDummy.cid
-                : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST.authorizationDummy.cid);
+                : (() => {
+                    throw new Error("Unsupported LIT network");
+                })());
             console.log(`   Mode: ${this.config.mode}`);
             if (networkOverride) {
                 console.log("   Network override:", networkOverride);
@@ -1260,12 +1318,16 @@ class LitOps {
             throw new Error("Signer is required for standalone mode");
         }
         const selectedNetwork = networkOverride ?? this.config.network;
-        const authDummyCid = (selectedNetwork === "datil"
+        const registry = selectedNetwork === "datil"
             ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
-            : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST).authorizationDummy.cid;
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })();
+        // Vault PKP must authorize btcTransactionSigner for Bitcoin transaction signing
+        const btcTxSignerCid = registry.btcTransactionSigner.cid;
         console.log(`🔍 LIT-OPS TRACE: getNewDiamondHandsLoanPkp - selectedNetwork = "${selectedNetwork}"`);
-        console.log(`🔍 LIT-OPS TRACE: getNewDiamondHandsLoanPkp - authorizationDummy.cid = "${authDummyCid}"`);
-        return this.createAndValidatePkpToLitAction(authDummyCid, effectiveSigner);
+        console.log(`🔍 LIT-OPS TRACE: getNewDiamondHandsLoanPkp - btcTransactionSigner.cid = "${btcTxSignerCid}"`);
+        return this.createAndValidatePkpToLitAction(btcTxSignerCid, effectiveSigner);
     }
     /**
      * Request mint authorization from UCD Mint Validator LIT Action
@@ -1305,6 +1367,125 @@ class LitOps {
         }
         return this.requestMintAuthorizationStandalone(request);
     }
+    /**
+     * DEV ONLY: Run BTC Always Signer LIT Action
+     * Intermediate testing tool for Bitcoin transaction structure validation
+     * Signs Bitcoin transactions WITHOUT authorization checks
+     *
+     * @param request - Bitcoin transaction parameters
+     * @returns Signature result with transaction structure
+     */
+    async runBtcAlwaysSigner(request) {
+        if (this.config.debug) {
+            console.log("🔧 [runBtcAlwaysSigner] DEV MODE ONLY");
+            console.log("   Mode:", this.config.mode);
+        }
+        // Service mode: Call server endpoint
+        if (this.config.mode === "service") {
+            return this.runBtcAlwaysSignerViaService(request);
+        }
+        // Standalone mode: Execute locally
+        return this.runBtcAlwaysSignerStandalone(request);
+    }
+    /**
+     * Run BTC Always Signer via service (SERVICE mode)
+     */
+    async runBtcAlwaysSignerViaService(request) {
+        if (!this.config.serviceEndpoint) {
+            throw new Error("Service endpoint not configured for service mode");
+        }
+        const url = `${this.config.serviceEndpoint}/api/lit/dev/btc-always-signer`;
+        if (this.config.debug) {
+            console.log("🌐 Running BTC always-signer via service:", url);
+            console.log("   Destination:", request.destination);
+            console.log("   Amount:", request.amount);
+        }
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(request),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Service error (${response.status}): ${errorText}`);
+            }
+            const result = (await response.json());
+            if (this.config.debug) {
+                console.log("✅ BTC always-signer completed via service");
+            }
+            return result.data || result;
+        }
+        catch (error) {
+            if (this.config.debug) {
+                console.error("❌ Service BTC always-signer failed:", error);
+            }
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Run BTC Always Signer locally (STANDALONE mode)
+     */
+    async runBtcAlwaysSignerStandalone(request) {
+        // Get always-signer LIT Action CID
+        const alwaysSignerCid = "QmRcQTDiZJq5arXngdxCX1LPnTW1fvx78tBD9vZmMXg8Ly";
+        if (this.config.debug) {
+            console.log("📡 Calling BTC Always Signer LIT Action:");
+            console.log("   CID:", alwaysSignerCid);
+            console.log("   Destination:", request.destination);
+            console.log("   Amount:", request.amount);
+        }
+        try {
+            // Execute LIT Action
+            // NOTE: The always-signer LIT Action expects params in (globalThis as any).params
+            // so we nest the parameters under a 'params' key
+            const result = await this.executeActionFromCID(alwaysSignerCid, request.pkpPublicKey, {
+                params: {
+                    amount: request.amount,
+                    fee: request.fee,
+                    destination: request.destination,
+                    utxo: request.utxo,
+                    network: request.network,
+                    pkpPublicKey: request.pkpPublicKey,
+                },
+            }, this.config.signer, // Use signer from LitOps config
+            undefined, // No PKP token ID needed
+            undefined // No PKP ETH address needed
+            );
+            if (this.config.debug) {
+                console.log("✅ BTC Always Signer executed");
+                console.log("   Success:", result.success);
+            }
+            // Parse response
+            const response = typeof result.response === "string"
+                ? JSON.parse(result.response)
+                : result.response;
+            // Extract actual signature from LIT SDK response
+            // LIT SDK puts signatures in result.signatures.btcTxSig
+            if (result.signatures?.btcTxSig) {
+                response.signature = {
+                    r: result.signatures.btcTxSig.r,
+                    s: result.signatures.btcTxSig.s,
+                    recid: result.signatures.btcTxSig.recid,
+                };
+            }
+            return response;
+        }
+        catch (error) {
+            if (this.config.debug) {
+                console.error("❌ BTC Always Signer failed:", error);
+            }
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
     /**
      * Request mint authorization via lit-ops-server (SERVICE mode)
      */
@@ -1381,15 +1562,26 @@ class LitOps {
         // Get LIT Action info from registry
         const litActions = this.config.network === "datil"
             ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
-            : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST;
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })();
         const litActionInfo = litActions.ucdMintValidator;
         if (!litActionInfo || !litActionInfo.cid || !litActionInfo.pkp) {
             throw new Error("UCD mint validator LIT Action not found in registry");
         }
+        // CRITICAL: Use validator PKP details from registry (not loan PKP)
+        // The validator PKP is the one that signs mint authorization messages
+        const validatorPkpTokenId = litActionInfo.pkp.tokenId;
+        const validatorCid = litActionInfo.cid;
+        const validatorPkpPublicKey = litActionInfo.pkp.publicKey;
+        const validatorPkpEthAddress = litActionInfo.pkp.ethAddress;
         if (this.config.debug) {
             console.log("📡 Calling UCD Mint Validator LIT Action:");
             console.log("   Network:", this.config.network);
-            console.log("   CID:", litActionInfo.cid);
+            console.log("   Validator CID:", validatorCid);
+            console.log("   Validator PKP Token ID:", validatorPkpTokenId);
+            console.log("   Validator PKP Public Key:", validatorPkpPublicKey);
+            console.log("   Validator PKP ETH Address:", validatorPkpEthAddress);
             console.log("   Position:", request.authMessage.positionId);
             console.log("   Amount:", request.authMessage.amount);
             console.log("   Timestamp:", request.authMessage.timestamp);
@@ -1412,7 +1604,7 @@ class LitOps {
                 chain = "sepolia";
                 bitcoinProviderUrl =
                     process.env.BITCOIN_PROVIDER_URL ||
-                        "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api";
+                        "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api/esplora";
                 break;
             case 1337: // Hardhat local testnet (actual deployment chainId)
             case 31337: // Hardhat local testnet (standard default)
@@ -1444,11 +1636,16 @@ class LitOps {
                 action: request.authMessage.action,
                 signature: request.userSignature,
                 mode: request.authMessage.mode,
-                ...(request.authMessage.contracts && {
-                    contracts: request.authMessage.contracts,
-                }),
             },
             amount: request.authMessage.amount,
+            // Contract addresses must be at top level to become globalThis.contractAddresses in LIT Action
+            ...(request.authMessage.contractAddresses && {
+                contractAddresses: request.authMessage.contractAddresses,
+            }),
+            // Price providers with API keys for faster price fetching
+            ...(request.priceProviders && {
+                priceProviders: request.priceProviders,
+            }),
         };
         // Add custom RPC URL for local development (ngrok tunnels)
         if (request.customRpcUrl) {
@@ -1457,14 +1654,115 @@ class LitOps {
                 console.log("   Custom RPC URL:", request.customRpcUrl);
             }
         }
-        // Execute LIT Action (single attempt - retry logic is in SDK layer)
-        const result = await this.actionExecutor.executeAction({
-            cid: litActionInfo.cid,
-            pkpPublicKey: litActionInfo.pkp.publicKey,
-            params: litActionParams,
-            signer: this.config.signer,
-        }, litClient);
+        // Verify PKP authorization before executing LIT Action
+        // Use validator PKP details (not loan PKP)
+        if (validatorCid && validatorPkpTokenId) {
+            console.log("[LitOps] ======= PKP Authorization Check =======");
+            console.log("[LitOps] Validator PKP Token ID:", validatorPkpTokenId);
+            console.log("[LitOps] Validator Lit Action CID:", validatorCid);
+            try {
+                const pkpAuthorizer = new pkp_authorizer_module_1.PKPAuthorizer({
+                    debug: this.config.debug,
+                    signer: this.config.signer,
+                    network: this.config.network, // Pass LIT network (e.g., 'datil') for PKP authorization check
+                });
+                const isPermitted = await pkpAuthorizer.isActionPermitted(validatorPkpTokenId, validatorCid);
+                console.log("[LitOps] PKP Authorization Status:", isPermitted ? "✅ AUTHORIZED" : "❌ NOT AUTHORIZED");
+                if (!isPermitted) {
+                    console.warn("[LitOps] ⚠️  PKP is not authorized for this Lit Action CID");
+                    console.warn("[LitOps]   This may cause signing to fail or timeout");
+                    console.warn("[LitOps]   Session signatures may use wildcard authorization instead");
+                }
+                // Get comprehensive permission check for debugging
+                const permissionCheck = await pkpAuthorizer.checkPermissions(validatorPkpTokenId, validatorCid);
+                console.log("[LitOps] Permitted Actions Count:", permissionCheck.permittedActions.length);
+                console.log("[LitOps] CID in Permitted List:", permissionCheck.isPermitted);
+                if (permissionCheck.permittedActions.length > 0) {
+                    console.log("[LitOps] Sample Permitted Actions:", permissionCheck.permittedActions.slice(0, 3));
+                }
+            }
+            catch (authError) {
+                console.warn("[LitOps] ⚠️  Failed to check PKP authorization:", authError instanceof Error ? authError.message : String(authError));
+                console.warn("[LitOps]   Continuing with execution - may use wildcard authorization");
+            }
+            console.log("[LitOps] ================================");
+        }
+        else {
+            console.log("[LitOps] ⚠️  Skipping PKP authorization check (CID or tokenId missing)");
+            if (!validatorCid) {
+                console.log("[LitOps]   Validator CID:", validatorCid);
+            }
+            if (!validatorPkpTokenId) {
+                console.log("[LitOps]   Validator PKP Token ID:", validatorPkpTokenId);
+            }
+        }
+        // CRITICAL: Use validator PKP token ID (not loan PKP)
+        // Session signatures must authorize the validator PKP to sign, not the loan PKP
+        // PKP token ID should already be in decimal format from the registry
+        // Don't normalize it - session-signature-manager will handle the conversion to hex
+        // The registry stores token IDs as decimal strings, and session-signature-manager
+        // expects decimal input which it then converts to hex for LitPKPResource
+        const normalizedPkpTokenId = validatorPkpTokenId;
+        // Check if we should use local code execution
+        // CRITICAL: If we have a registry CID, always use IPFS mode
+        // Never use local code when we have a deployed registry CID
+        const useLocalCode = this.config.litActionExecution === 'local' && !validatorCid;
+        if (this.config.debug) {
+            console.log("🔍 [DEBUG] litActionExecution config:", this.config.litActionExecution);
+            console.log("🔍 [DEBUG] Validator CID available:", validatorCid);
+            console.log("🔍 [DEBUG] useLocalCode:", useLocalCode, "(ignored if registry CID exists)");
+        }
+        let result;
+        if (useLocalCode) {
+            // Only use local code if NO registry CID is available (shouldn't happen in production)
+            // Read code from local dist file
+            const fs = require('fs');
+            const path = require('path');
+            // Try multiple possible paths
+            const possiblePaths = [
+                path.join(__dirname, '../../lit-actions/dist/ucd-mint-validator.action.js'),
+                path.join(process.cwd(), 'lit-actions/dist/ucd-mint-validator.action.js'),
+                path.join(process.cwd(), '../lit-actions/dist/ucd-mint-validator.action.js'),
+            ];
+            let codePath;
+            for (const p of possiblePaths) {
+                if (fs.existsSync(p)) {
+                    codePath = p;
+                    break;
+                }
+            }
+            if (!codePath) {
+                throw new Error(`Local LIT action code not found. Tried: ${possiblePaths.join(', ')}. Please build lit-actions first.`);
+            }
+            const code = fs.readFileSync(codePath, 'utf8');
+            if (this.config.debug) {
+                console.log("📦 Using LOCAL LIT Action code (not IPFS)");
+                console.log("   Code path:", codePath);
+                console.log("   Code size:", code.length, "bytes");
+            }
+            result = await this.executeActionFromCode(code, validatorPkpPublicKey, // Use validator PKP public key
+            litActionParams, this.config.signer, normalizedPkpTokenId, // Validator PKP token ID
+            validatorCid // Validator CID for authorization validation
+            );
+        }
+        else {
+            // Always use IPFS mode when we have a registry CID
+            // This ensures the Lit SDK uses the correct CID from the registry for authorization
+            // Execute LIT Action (single attempt - retry logic is in SDK layer)
+            // CRITICAL: Pass validator PKP token ID for session signature PKP scoping (fixes signEcdsa timeout)
+            // Use normalized decimal format for consistent conversion in session-signature-manager
+            result = await this.actionExecutor.executeAction({
+                cid: validatorCid, // Use validator CID from registry
+                pkpPublicKey: validatorPkpPublicKey, // Use validator PKP public key
+                params: litActionParams,
+                signer: this.config.signer,
+                pkpTokenId: normalizedPkpTokenId, // Validator PKP token ID (decimal string)
+                pkpEthAddress: validatorPkpEthAddress, // Validator PKP ETH address for capacity credit delegation
+            }, litClient);
+        }
         if (this.config.debug) {
+            console.log("📋 [DEBUG] litActionParams passed to LIT Action:", JSON.stringify(litActionParams, null, 2));
+            console.log("📋 [DEBUG] contractAddresses in litActionParams:", litActionParams.contractAddresses);
             console.log("📥 LIT Action response:", {
                 success: result.success,
                 hasSignature: !!result.signatures,
@@ -1492,65 +1790,20 @@ class LitOps {
             console.log("🔍 responseData (FULL OBJECT):", JSON.stringify(responseData, null, 2));
             console.log("🔍 responseData keys:", Object.keys(responseData || {}));
         }
-        // Extract actual signature from Lit Action execution result
-        // The signature is in result.signatures.ucdMintAuth.signature (not in response JSON)
-        let actualSignature;
-        try {
-            if (result.signatures && typeof result.signatures === 'object') {
-                const signatures = result.signatures;
-                if (signatures.ucdMintAuth && signatures.ucdMintAuth.signature) {
-                    const sig = signatures.ucdMintAuth.signature;
-                    if (typeof sig === 'string' && sig !== 'success') {
-                        actualSignature = sig;
-                        if (this.config.debug) {
-                            console.log('✅ Extracted signature from Lit Action execution result', {
-                                signatureLength: actualSignature.length,
-                                signaturePreview: actualSignature.substring(0, 20) + '...',
-                            });
-                        }
-                    }
-                    else if (this.config.debug) {
-                        console.warn('⚠️  Signature in Lit Action result is not a valid string', {
-                            signatureType: typeof sig,
-                            signatureValue: sig,
-                        });
-                    }
-                }
-                else if (this.config.debug) {
-                    console.warn('⚠️  No ucdMintAuth signature found in Lit Action execution result', {
-                        signaturesKeys: Object.keys(signatures),
-                    });
-                }
-            }
-            else if (this.config.debug) {
-                console.warn('⚠️  Lit Action execution result has no signatures object', {
-                    hasSignatures: !!result.signatures,
-                    signaturesType: typeof result.signatures,
-                });
-            }
-        }
-        catch (sigError) {
-            // Don't fail authorization if signature extraction fails - signature is optional
-            if (this.config.debug) {
-                console.warn('⚠️  Error extracting signature from Lit Action result (non-fatal)', {
-                    error: sigError instanceof Error ? sigError.message : String(sigError),
-                });
-            }
-        }
-        // Ensure signature is a hex string (add 0x prefix if missing)
-        if (actualSignature && !actualSignature.startsWith("0x")) {
-            actualSignature = "0x" + actualSignature;
-        }
         // Return standardized response
         const returnValue = {
             approved: responseData?.approved ?? false,
-            signature: actualSignature, // Return extracted hex string directly (matching pkp-authorization.module.ts pattern)
+            signature: result.signatures
+                ? JSON.stringify(result.signatures)
+                : undefined,
             mintAmount: responseData?.mintAmount,
             mintFee: responseData?.mintFee,
             newDebt: responseData?.newDebt,
             newCollateral: responseData?.newCollateral,
             btcPrice: responseData?.btcPrice,
             authorizedSpendsHash: responseData?.authorizedSpendsHash,
+            ucdDebtHash: responseData?.ucdDebtHash,
+            contractBundleHash: responseData?.contractBundleHash,
             timestamp: responseData?.timestamp,
             reason: responseData?.reason,
             failedStep: responseData?.failedStep,
@@ -1563,6 +1816,1013 @@ class LitOps {
         }
         return returnValue;
     }
+    /**
+     * Request extend position authorization from Extend Position Validator LIT Action
+     *
+     * In SERVICE mode: Delegates to lit-ops-server
+     * In STANDALONE mode: Executes LIT action locally
+     *
+     * @param request - Authorization request with authMessage and userSignature
+     * @returns Extend authorization response from LIT Action
+     */
+    async requestExtendAuthorization(request) {
+        // In SERVICE mode, delegate to lit-ops-server
+        if (this.config.mode === "service") {
+            return this.requestExtendAuthorizationViaService(request);
+        }
+        return this.requestExtendAuthorizationStandalone(request);
+    }
+    /**
+     * Request extend authorization via lit-ops-server (SERVICE mode)
+     */
+    async requestExtendAuthorizationViaService(request) {
+        if (!this.config.serviceEndpoint) {
+            throw new Error("Service endpoint not configured for service mode");
+        }
+        const url = `${this.config.serviceEndpoint}/api/lit/extend/authorize`;
+        if (this.config.debug) {
+            console.log("🌐 Requesting extend authorization via service:", url);
+            console.log("   Position ID:", request.authMessage.positionId);
+            console.log("   New Term:", request.authMessage.newTerm);
+        }
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    authMessage: request.authMessage,
+                    userSignature: request.userSignature,
+                    customRpcUrl: request.customRpcUrl,
+                    customBitcoinRpcUrl: request.customBitcoinRpcUrl,
+                }),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Service error (${response.status}): ${errorText}`);
+            }
+            const envelope = await response.json();
+            if (envelope.success && envelope.data) {
+                return envelope.data;
+            }
+            else if (!envelope.success && envelope.error) {
+                return {
+                    approved: false,
+                    error: envelope.error,
+                    reason: "Service returned error",
+                };
+            }
+            return envelope;
+        }
+        catch (error) {
+            if (this.config.debug) {
+                console.error("❌ Service extend authorization failed:", error);
+            }
+            return {
+                approved: false,
+                error: error instanceof Error ? error.message : String(error),
+                reason: "Service request failed",
+            };
+        }
+    }
+    /**
+     * Request extend authorization locally (STANDALONE mode)
+     */
+    async requestExtendAuthorizationStandalone(request) {
+        // Get LIT Action info from registry
+        const litActions = this.config.network === "datil"
+            ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })();
+        // Note: extendPositionValidator needs to be added to registry
+        // For now, we'll throw an error if not found
+        const litActionInfo = litActions.extendPositionValidator;
+        if (!litActionInfo || !litActionInfo.cid || !litActionInfo.pkp) {
+            throw new Error("Extend position validator LIT Action not found in registry");
+        }
+        if (this.config.debug) {
+            console.log("📡 Calling Extend Position Validator LIT Action:");
+            console.log("   Network:", this.config.network);
+            console.log("   CID:", litActionInfo.cid);
+            console.log("   Position:", request.authMessage.positionId);
+            console.log("   New Term:", request.authMessage.newTerm);
+        }
+        // Verify PKP authorization before executing LIT Action
+        if (litActionInfo.cid && litActionInfo.pkp.tokenId) {
+            console.log("[LitOps] ======= PKP Authorization Check =======");
+            console.log("[LitOps] PKP Token ID:", litActionInfo.pkp.tokenId);
+            console.log("[LitOps] Lit Action CID:", litActionInfo.cid);
+            try {
+                const pkpAuthorizer = new pkp_authorizer_module_1.PKPAuthorizer({
+                    debug: this.config.debug,
+                    signer: this.config.signer,
+                    network: this.config.network, // Pass LIT network (e.g., 'datil') for PKP authorization check
+                });
+                const isPermitted = await pkpAuthorizer.isActionPermitted(litActionInfo.pkp.tokenId, litActionInfo.cid);
+                console.log("[LitOps] PKP Authorization Status:", isPermitted ? "✅ AUTHORIZED" : "❌ NOT AUTHORIZED");
+                if (!isPermitted) {
+                    console.warn("[LitOps] ⚠️  PKP is not authorized for this Lit Action CID");
+                    console.warn("[LitOps]   This may cause signing to fail or timeout");
+                    console.warn("[LitOps]   Session signatures may use wildcard authorization instead");
+                }
+                // Get comprehensive permission check for debugging
+                const permissionCheck = await pkpAuthorizer.checkPermissions(litActionInfo.pkp.tokenId, litActionInfo.cid);
+                console.log("[LitOps] Permitted Actions Count:", permissionCheck.permittedActions.length);
+                console.log("[LitOps] CID in Permitted List:", permissionCheck.isPermitted);
+                if (permissionCheck.permittedActions.length > 0) {
+                    console.log("[LitOps] Sample Permitted Actions:", permissionCheck.permittedActions.slice(0, 3));
+                }
+            }
+            catch (authError) {
+                console.warn("[LitOps] ⚠️  Failed to check PKP authorization:", authError instanceof Error ? authError.message : String(authError));
+                console.warn("[LitOps]   Continuing with execution - may use wildcard authorization");
+            }
+            console.log("[LitOps] ================================");
+        }
+        else {
+            console.log("[LitOps] ⚠️  Skipping PKP authorization check (CID or tokenId missing)");
+            if (!litActionInfo.cid) {
+                console.log("[LitOps]   CID:", litActionInfo.cid);
+            }
+            if (!litActionInfo.pkp.tokenId) {
+                console.log("[LitOps]   PKP Token ID:", litActionInfo.pkp.tokenId);
+            }
+        }
+        // Get LIT client for execution
+        const litClient = await this.clientManager.getClient({
+            litNetwork: this.config.network,
+            debug: this.config.debug,
+        });
+        // Determine chain and Bitcoin provider from chainId
+        let chain;
+        let bitcoinProviderUrl;
+        switch (request.authMessage.chainId) {
+            case 1: // Ethereum mainnet
+                chain = "ethereum";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "https://mempool.space/api";
+                break;
+            case 11155111: // Sepolia testnet
+                chain = "sepolia";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL ||
+                        "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api/esplora";
+                break;
+            case 1337: // Hardhat local testnet (actual deployment chainId)
+            case 31337: // Hardhat local testnet (standard default)
+                chain = "hardhat";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "http://127.0.0.1:18443";
+                break;
+            default:
+                throw new Error(`Unsupported chainId: ${request.authMessage.chainId}`);
+        }
+        if (request.customBitcoinRpcUrl) {
+            bitcoinProviderUrl = request.customBitcoinRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom Bitcoin RPC URL:", request.customBitcoinRpcUrl);
+            }
+        }
+        const litActionParams = {
+            chain,
+            bitcoinProviderUrl,
+            auth: {
+                positionId: request.authMessage.positionId,
+                timestamp: request.authMessage.timestamp,
+                chainId: request.authMessage.chainId,
+                newTerm: request.authMessage.newTerm,
+                action: request.authMessage.action,
+                signature: request.userSignature,
+                mode: request.authMessage.mode,
+            },
+            selectedTerm: request.authMessage.newTerm,
+            // Contract addresses must be at top level to become globalThis.contractAddresses in LIT Action
+            ...(request.authMessage.contractAddresses && {
+                contractAddresses: request.authMessage.contractAddresses,
+            }),
+            // Price providers with API keys for faster price fetching
+            ...(request.priceProviders && {
+                priceProviders: request.priceProviders,
+            }),
+        };
+        // Debug: Log priceProviders to verify they're being passed
+        if (this.config.debug) {
+            console.log("   Price Providers:", request.priceProviders);
+            console.log("   Price Providers in litActionParams:", litActionParams.priceProviders);
+        }
+        if (request.customRpcUrl) {
+            litActionParams.customRpcUrl = request.customRpcUrl;
+        }
+        // PKP token ID should already be in decimal format from the registry
+        // Don't normalize it - session-signature-manager will handle the conversion to hex
+        // The registry stores token IDs as decimal strings, and session-signature-manager
+        // expects decimal input which it then converts to hex for LitPKPResource
+        const normalizedPkpTokenId = litActionInfo.pkp.tokenId;
+        // Check if we should use local code execution
+        // CRITICAL: If we have a registry CID, always use IPFS mode
+        // Never use local code when we have a deployed registry CID
+        const useLocalCode = this.config.litActionExecution === 'local' && !litActionInfo.cid;
+        if (this.config.debug) {
+            console.log("🔍 [DEBUG] litActionExecution config:", this.config.litActionExecution);
+            console.log("🔍 [DEBUG] Registry CID available:", litActionInfo.cid);
+            console.log("🔍 [DEBUG] useLocalCode:", useLocalCode, "(ignored if registry CID exists)");
+        }
+        let result;
+        if (useLocalCode) {
+            // Only use local code if NO registry CID is available (shouldn't happen in production)
+            // Read code from local dist file
+            const fs = require('fs');
+            const path = require('path');
+            // Try multiple possible paths
+            const possiblePaths = [
+                path.join(__dirname, '../../lit-actions/dist/extend-position-validator.action.js'),
+                path.join(process.cwd(), 'lit-actions/dist/extend-position-validator.action.js'),
+                path.join(process.cwd(), '../lit-actions/dist/extend-position-validator.action.js'),
+            ];
+            let codePath;
+            for (const p of possiblePaths) {
+                if (fs.existsSync(p)) {
+                    codePath = p;
+                    break;
+                }
+            }
+            if (!codePath) {
+                throw new Error(`Local LIT action code not found. Tried: ${possiblePaths.join(', ')}. Please build lit-actions first.`);
+            }
+            const code = fs.readFileSync(codePath, 'utf8');
+            if (this.config.debug) {
+                console.log("📦 Using LOCAL LIT Action code (not IPFS)");
+                console.log("   Code path:", codePath);
+                console.log("   Code size:", code.length, "bytes");
+            }
+            result = await this.executeActionFromCode(code, litActionInfo.pkp.publicKey, litActionParams, this.config.signer, normalizedPkpTokenId, // Normalized to decimal string for consistent handling
+            litActionInfo.cid // Still provide CID for authorization validation
+            );
+        }
+        else {
+            // Always use IPFS mode when we have a registry CID
+            // This ensures the Lit SDK uses the correct CID from the registry for authorization
+            // Execute LIT Action (single attempt - retry logic is in SDK layer)
+            // CRITICAL: Pass pkpTokenId for session signature PKP scoping (fixes signEcdsa timeout)
+            // Use normalized decimal format for consistent conversion in session-signature-manager
+            result = await this.actionExecutor.executeAction({
+                cid: litActionInfo.cid, // Use registry CID
+                pkpPublicKey: litActionInfo.pkp.publicKey,
+                params: litActionParams,
+                signer: this.config.signer,
+                pkpTokenId: normalizedPkpTokenId, // Normalized to decimal string for consistent handling
+                pkpEthAddress: litActionInfo.pkp.ethAddress, // Required for capacity credit delegation
+            }, litClient);
+        }
+        let responseData = result.response;
+        if (typeof result.response === "string") {
+            try {
+                responseData = JSON.parse(result.response);
+            }
+            catch (e) {
+                // Ignore parse errors
+            }
+        }
+        // Handle signature: prefer LIT SDK format (result.signatures), fall back to responseData.signature
+        let signature;
+        if (result.signatures) {
+            signature = JSON.stringify(result.signatures);
+        }
+        else if (responseData?.signature) {
+            signature = responseData.signature;
+        }
+        return {
+            approved: responseData?.approved ?? false,
+            signature,
+            btcPrice: responseData?.btcPrice,
+            availableBTCBalance: responseData?.availableBTCBalance,
+            extensionFee: responseData?.extensionFee,
+            newTotalDebt: responseData?.newTotalDebt,
+            newCollateralRatioBps: responseData?.newCollateralRatioBps,
+            quantumTimestamp: responseData?.quantumTimestamp,
+            timestamp: responseData?.timestamp,
+            reason: responseData?.reason,
+            failedStep: responseData?.failedStep,
+            error: result.error,
+        };
+    }
+    /**
+     * Request BTC withdrawal authorization (dual-mode)
+     *
+     * @param request - Authorization request with authMessage and userSignature
+     * @returns Withdrawal authorization response from LIT Action
+     */
+    async requestWithdrawalAuthorization(request) {
+        // In SERVICE mode, delegate to lit-ops-server
+        if (this.config.mode === "service") {
+            if (this.config.debug) {
+                console.log("🌐 [requestWithdrawalAuthorization] Using SERVICE mode - delegating to server");
+            }
+            return this.requestWithdrawalAuthorizationViaService(request);
+        }
+        // STANDALONE mode: Execute LIT action locally
+        if (this.config.debug) {
+            console.log("🔧 [requestWithdrawalAuthorization] Using STANDALONE mode - executing locally");
+        }
+        return this.requestWithdrawalAuthorizationStandalone(request);
+    }
+    /**
+     * Request withdrawal authorization via lit-ops-server (SERVICE mode)
+     */
+    async requestWithdrawalAuthorizationViaService(request) {
+        if (!this.config.serviceEndpoint) {
+            throw new Error("Service endpoint not configured for service mode");
+        }
+        const url = `${this.config.serviceEndpoint}/api/lit/withdrawal/authorize`;
+        if (this.config.debug) {
+            console.log("🌐 Requesting withdrawal authorization via service:", url);
+            console.log("   Position ID:", request.authMessage.positionId);
+            console.log("   Amount:", request.authMessage.amount);
+            console.log("   Address:", request.authMessage.withdrawalAddress);
+        }
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    authMessage: request.authMessage,
+                    userSignature: request.userSignature,
+                    customRpcUrl: request.customRpcUrl,
+                    customBitcoinRpcUrl: request.customBitcoinRpcUrl,
+                }),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Service error (${response.status}): ${errorText}`);
+            }
+            const envelope = await response.json();
+            if (this.config.debug) {
+                console.log("📥 Service response:", envelope);
+            }
+            // Return the result from service
+            return {
+                approved: envelope.approved ?? false,
+                signature: envelope.signature,
+                totalDeduction: envelope.totalDeduction,
+                remainingCollateral: envelope.remainingCollateral,
+                newCollateralRatioBps: envelope.newCollateralRatioBps,
+                destinationAddress: envelope.destinationAddress,
+                btcPrice: envelope.btcPrice,
+                timestamp: envelope.timestamp,
+                reason: envelope.reason,
+                failedStep: envelope.failedStep,
+                error: envelope.error,
+            };
+        }
+        catch (error) {
+            console.error("❌ Service request failed:", error);
+            return {
+                approved: false,
+                error: error instanceof Error ? error.message : String(error),
+                reason: "Service request failed",
+            };
+        }
+    }
+    /**
+     * Request withdrawal authorization locally (STANDALONE mode)
+     */
+    async requestWithdrawalAuthorizationStandalone(request) {
+        // Get LIT Action info from registry
+        const litActions = this.config.network === "datil"
+            ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })();
+        const litActionInfo = litActions.btcWithdrawal;
+        if (!litActionInfo || !litActionInfo.cid || !litActionInfo.pkp) {
+            throw new Error("BTC withdrawal LIT Action not found in registry");
+        }
+        if (this.config.debug) {
+            console.log("📡 Calling BTC Withdrawal LIT Action:");
+            console.log("   Network:", this.config.network);
+            console.log("   CID:", litActionInfo.cid);
+            console.log("   Position:", request.authMessage.positionId);
+            console.log("   Amount:", request.authMessage.amount);
+            console.log("   Address:", request.authMessage.withdrawalAddress);
+            console.log("   Timestamp:", request.authMessage.timestamp);
+        }
+        // Get LIT client for execution
+        const litClient = await this.clientManager.getClient({
+            litNetwork: this.config.network,
+            debug: this.config.debug,
+        });
+        // Determine chain and Bitcoin provider from chainId
+        let chain;
+        let bitcoinProviderUrl;
+        switch (request.authMessage.chainId) {
+            case 1: // Ethereum mainnet
+                chain = "ethereum";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "https://mempool.space/api";
+                break;
+            case 11155111: // Sepolia testnet
+                chain = "sepolia";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL ||
+                        "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api/esplora";
+                break;
+            case 1337: // Hardhat local testnet (actual deployment chainId)
+            case 31337: // Hardhat local testnet (standard default)
+                chain = "hardhat";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "http://127.0.0.1:18443";
+                break;
+            default:
+                throw new Error(`Unsupported chainId: ${request.authMessage.chainId}`);
+        }
+        // Override with custom Bitcoin RPC URL if provided
+        if (request.customBitcoinRpcUrl) {
+            bitcoinProviderUrl = request.customBitcoinRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom Bitcoin RPC URL:", request.customBitcoinRpcUrl);
+            }
+        }
+        // Execute LIT Action
+        const litActionParams = {
+            chain,
+            bitcoinProviderUrl,
+            auth: {
+                positionId: request.authMessage.positionId,
+                timestamp: request.authMessage.timestamp,
+                chainId: request.authMessage.chainId,
+                destinationAddress: request.authMessage.withdrawalAddress,
+                amount: request.authMessage.amount,
+                action: request.authMessage.action,
+                signature: request.userSignature,
+                mode: request.authMessage.mode,
+            },
+            // Always pass contractAddresses (undefined in prod mode)
+            contractAddresses: request.authMessage.contractAddresses,
+        };
+        // Add custom RPC URL for local development
+        if (request.customRpcUrl) {
+            litActionParams.customRpcUrl = request.customRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom RPC URL:", request.customRpcUrl);
+            }
+        }
+        // PKP token ID should already be in decimal format from the registry
+        // Don't normalize it - session-signature-manager will handle the conversion to hex
+        // The registry stores token IDs as decimal strings, and session-signature-manager
+        // expects decimal input which it then converts to hex for LitPKPResource
+        const normalizedPkpTokenId = litActionInfo.pkp.tokenId;
+        // Execute LIT Action
+        // CRITICAL: Pass pkpTokenId for session signature PKP scoping (fixes signEcdsa timeout)
+        // Use normalized decimal format for consistent conversion in session-signature-manager
+        const result = await this.actionExecutor.executeAction({
+            cid: litActionInfo.cid,
+            pkpPublicKey: litActionInfo.pkp.publicKey,
+            params: litActionParams,
+            signer: this.config.signer,
+            pkpTokenId: normalizedPkpTokenId, // Normalized to decimal string for consistent handling
+            pkpEthAddress: litActionInfo.pkp.ethAddress, // Required for capacity credit delegation
+        }, litClient);
+        if (this.config.debug) {
+            console.log("📥 LIT Action response:", {
+                success: result.success,
+                hasSignature: !!result.signatures,
+                error: result.error,
+            });
+            console.log("📥 LIT Action result.response (raw):", result.response);
+        }
+        // Parse response if it's a string
+        let responseData = result.response;
+        if (typeof result.response === "string") {
+            try {
+                responseData = JSON.parse(result.response);
+                if (this.config.debug) {
+                    console.log("📥 Parsed response data:", responseData);
+                }
+            }
+            catch (e) {
+                if (this.config.debug) {
+                    console.error("❌ Failed to parse response string:", e);
+                }
+            }
+        }
+        // Return standardized response including UTXO data from Bitcoin network query
+        const returnValue = {
+            approved: responseData?.approved ?? false,
+            signature: result.signatures
+                ? JSON.stringify(result.signatures)
+                : undefined,
+            actionHash: responseData?.actionHash,
+            authorizedSpendsHash: responseData?.authorizedSpendsHash,
+            ucdDebtHash: responseData?.ucdDebtHash,
+            totalDeduction: responseData?.totalDeduction,
+            remainingCollateral: responseData?.remainingCollateral,
+            newCollateralRatioBps: responseData?.newCollateralRatioBps,
+            destinationAddress: responseData?.destinationAddress,
+            btcPrice: responseData?.btcPrice,
+            timestamp: responseData?.timestamp,
+            utxoTxid: responseData?.utxoTxid, // Real Bitcoin UTXO txid from network query
+            utxoVout: responseData?.utxoVout, // Real Bitcoin UTXO vout from network query
+            utxoSatoshis: responseData?.utxoSatoshis, // UTXO value for validation
+            reason: responseData?.reason,
+            failedStep: responseData?.failedStep,
+            error: result.error,
+        };
+        if (this.config.debug) {
+            console.log("🎁 STANDALONE RETURN VALUE:", JSON.stringify(returnValue, null, 2));
+        }
+        return returnValue;
+    }
+    /**
+     * Request payment authorization from Process Payment Validator LIT Action
+     *
+     * In SERVICE mode: Delegates to lit-ops-server
+     * In STANDALONE mode: Executes LIT action locally
+     *
+     * @param request - Payment authorization request
+     * @returns Payment authorization response from LIT Action
+     */
+    async requestPaymentAuthorization(request) {
+        // In SERVICE mode, delegate to lit-ops-server
+        if (this.config.mode === "service") {
+            return this.requestPaymentAuthorizationViaService(request);
+        }
+        return this.requestPaymentAuthorizationStandalone(request);
+    }
+    /**
+     * Request payment authorization via lit-ops-server (SERVICE mode)
+     */
+    async requestPaymentAuthorizationViaService(request) {
+        if (!this.config.serviceEndpoint) {
+            throw new Error("Service endpoint not configured for service mode");
+        }
+        const url = `${this.config.serviceEndpoint}/api/lit/payment/authorize`;
+        if (this.config.debug) {
+            console.log("🌐 Requesting payment authorization via service:", url);
+            console.log("   Position ID:", request.positionId);
+            console.log("   Payment Amount:", request.paymentAmount);
+            console.log("   Price Providers:", request.priceProviders);
+        }
+        const requestBody = {
+            positionId: request.positionId,
+            paymentAmount: request.paymentAmount,
+            chainId: request.chainId,
+            mode: request.mode,
+            contractAddresses: request.contractAddresses,
+            customRpcUrl: request.customRpcUrl,
+            customBitcoinRpcUrl: request.customBitcoinRpcUrl,
+            priceProviders: request.priceProviders,
+        };
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(requestBody),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Service error (${response.status}): ${errorText}`);
+            }
+            const envelope = await response.json();
+            if (envelope.success && envelope.data) {
+                return envelope.data;
+            }
+            else if (!envelope.success && envelope.error) {
+                return {
+                    approved: false,
+                    error: envelope.error,
+                    reason: "Service returned error",
+                };
+            }
+            return envelope;
+        }
+        catch (error) {
+            if (this.config.debug) {
+                console.error("❌ Service payment authorization failed:", error);
+            }
+            return {
+                approved: false,
+                error: error instanceof Error ? error.message : String(error),
+                reason: "Service request failed",
+            };
+        }
+    }
+    /**
+     * Sign Bitcoin transaction for BTC withdrawal execution (Phase 2)
+     *
+     * Dual-mode method: Delegates to service endpoint or executes locally
+     */
+    async signBTCTransaction(request) {
+        // In SERVICE mode, delegate to lit-ops-server
+        if (this.config.mode === "service") {
+            if (this.config.debug) {
+                console.log("🌐 [signBTCTransaction] Using SERVICE mode - delegating to server");
+            }
+            return this.signBTCTransactionViaService(request);
+        }
+        // STANDALONE mode: Execute LIT action locally
+        if (this.config.debug) {
+            console.log("🔧 [signBTCTransaction] Using STANDALONE mode - executing locally");
+        }
+        return this.signBTCTransactionStandalone(request);
+    }
+    /**
+     * Sign Bitcoin transaction via lit-ops-server (SERVICE mode)
+     */
+    async signBTCTransactionViaService(request) {
+        if (!this.config.serviceEndpoint) {
+            throw new Error("Service endpoint not configured for service mode");
+        }
+        const url = `${this.config.serviceEndpoint}/api/lit/btc/sign-transaction`;
+        if (this.config.debug) {
+            console.log("🌐 Signing BTC transaction via service:", url);
+            console.log("   Position ID:", request.auth.positionId);
+            console.log("   UTXO:", `${request.auth.utxo.txid}:${request.auth.utxo.vout}`);
+            console.log("   Network Fee:", request.auth.networkFee);
+        }
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(request),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Service error (${response.status}): ${errorText}`);
+            }
+            const envelope = await response.json();
+            if (this.config.debug) {
+                console.log("📥 Service response:", envelope);
+            }
+            return {
+                success: envelope.success ?? false,
+                unsignedTxHex: envelope.unsignedTxHex,
+                sigHash: envelope.sigHash,
+                signature: envelope.signature,
+                pkpPublicKey: envelope.pkpPublicKey,
+                pkpBtcAddress: envelope.pkpBtcAddress,
+                destination: envelope.destination,
+                userReceivesAmount: envelope.userReceivesAmount,
+                networkFee: envelope.networkFee,
+                changeAmount: envelope.changeAmount,
+                utxo: envelope.utxo,
+                authorization: envelope.authorization,
+                timestamp: envelope.timestamp,
+                action: envelope.action,
+                error: envelope.error,
+                failedStep: envelope.failedStep,
+            };
+        }
+        catch (error) {
+            console.error("❌ Service request failed:", error);
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Request payment authorization locally (STANDALONE mode)
+     */
+    async requestPaymentAuthorizationStandalone(request) {
+        // Get LIT Action info from registry
+        const litActions = this.config.network === "datil"
+            ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })();
+        const litActionInfo = litActions.processPaymentValidator;
+        if (!litActionInfo || !litActionInfo.cid || !litActionInfo.pkp) {
+            throw new Error("Process payment validator LIT Action not found in registry");
+        }
+        if (this.config.debug) {
+            console.log("📡 Calling Process Payment Validator LIT Action:");
+            console.log("   Network:", this.config.network);
+            console.log("   CID:", litActionInfo.cid);
+            console.log("   Position:", request.positionId);
+            console.log("   Payment Amount:", request.paymentAmount);
+        }
+        // Verify PKP authorization before executing LIT Action
+        if (litActionInfo.cid && litActionInfo.pkp.tokenId) {
+            console.log("[LitOps] ======= PKP Authorization Check =======");
+            console.log("[LitOps] PKP Token ID:", litActionInfo.pkp.tokenId);
+            console.log("[LitOps] Lit Action CID:", litActionInfo.cid);
+            try {
+                const pkpAuthorizer = new pkp_authorizer_module_1.PKPAuthorizer({
+                    debug: this.config.debug,
+                    signer: this.config.signer,
+                    network: this.config.network, // Pass LIT network (e.g., 'datil') for PKP authorization check
+                });
+                const isPermitted = await pkpAuthorizer.isActionPermitted(litActionInfo.pkp.tokenId, litActionInfo.cid);
+                console.log("[LitOps] PKP Authorization Status:", isPermitted ? "✅ AUTHORIZED" : "❌ NOT AUTHORIZED");
+                if (!isPermitted) {
+                    console.warn("[LitOps] ⚠️  PKP is not authorized for this Lit Action CID");
+                    console.warn("[LitOps]   This may cause signing to fail or timeout");
+                    console.warn("[LitOps]   Session signatures may use wildcard authorization instead");
+                }
+                // Get comprehensive permission check for debugging
+                const permissionCheck = await pkpAuthorizer.checkPermissions(litActionInfo.pkp.tokenId, litActionInfo.cid);
+                console.log("[LitOps] Permitted Actions Count:", permissionCheck.permittedActions.length);
+                console.log("[LitOps] CID in Permitted List:", permissionCheck.isPermitted);
+                if (permissionCheck.permittedActions.length > 0) {
+                    console.log("[LitOps] Sample Permitted Actions:", permissionCheck.permittedActions.slice(0, 3));
+                }
+            }
+            catch (authError) {
+                console.warn("[LitOps] ⚠️  Failed to check PKP authorization:", authError instanceof Error ? authError.message : String(authError));
+                console.warn("[LitOps]   Continuing with execution - may use wildcard authorization");
+            }
+            console.log("[LitOps] ================================");
+        }
+        else {
+            console.log("[LitOps] ⚠️  Skipping PKP authorization check (CID or tokenId missing)");
+            if (!litActionInfo.cid) {
+                console.log("[LitOps]   CID:", litActionInfo.cid);
+            }
+            if (!litActionInfo.pkp.tokenId) {
+                console.log("[LitOps]   PKP Token ID:", litActionInfo.pkp.tokenId);
+            }
+        }
+        // PKP token ID should already be in decimal format from the registry
+        // Don't normalize it - session-signature-manager will handle the conversion to hex
+        // The registry stores token IDs as decimal strings, and session-signature-manager
+        // expects decimal input which it then converts to hex for LitPKPResource
+        const normalizedPkpTokenId = litActionInfo.pkp.tokenId;
+        // Get LIT client for execution
+        const litClient = await this.clientManager.getClient({
+            litNetwork: this.config.network,
+            debug: this.config.debug,
+        });
+        // Determine chain and Bitcoin provider from chainId
+        let chain;
+        let bitcoinProviderUrl;
+        switch (request.chainId) {
+            case 1:
+                chain = "ethereum";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "https://mempool.space/api";
+                break;
+            case 11155111:
+                chain = "sepolia";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL ||
+                        "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api/esplora";
+                break;
+            case 1337:
+            case 31337:
+                chain = "hardhat";
+                bitcoinProviderUrl =
+                    process.env.BITCOIN_PROVIDER_URL || "http://127.0.0.1:18443";
+                break;
+            default:
+                throw new Error(`Unsupported chainId: ${request.chainId}`);
+        }
+        if (request.customBitcoinRpcUrl) {
+            bitcoinProviderUrl = request.customBitcoinRpcUrl;
+        }
+        // Support both legacy `contracts` (standalone) and newer `contractAddresses`
+        const contractAddresses = request.contractAddresses ?? request.contracts;
+        const litActionParams = {
+            chain,
+            bitcoinProviderUrl,
+            positionId: request.positionId,
+            paymentAmount: request.paymentAmount,
+            ...(contractAddresses && {
+                contractAddresses,
+            }),
+            ...(request.priceProviders && {
+                priceProviders: request.priceProviders,
+            }),
+        };
+        if (request.customRpcUrl) {
+            litActionParams.customRpcUrl = request.customRpcUrl;
+        }
+        // Check if we should use local code execution
+        // CRITICAL: If we have a registry CID, always use IPFS mode
+        // Never use local code when we have a deployed registry CID
+        const useLocalCode = this.config.litActionExecution === 'local' && !litActionInfo.cid;
+        if (this.config.debug) {
+            console.log("🔍 [DEBUG] litActionExecution config:", this.config.litActionExecution);
+            console.log("🔍 [DEBUG] Registry CID available:", litActionInfo.cid);
+            console.log("🔍 [DEBUG] useLocalCode:", useLocalCode, "(ignored if registry CID exists)");
+        }
+        let result;
+        if (useLocalCode) {
+            // Only use local code if NO registry CID is available (shouldn't happen in production)
+            // Read code from local dist file
+            const fs = require('fs');
+            const path = require('path');
+            // Try multiple possible paths
+            const possiblePaths = [
+                path.join(__dirname, '../../lit-actions/dist/process-payment-validator.action.js'),
+                path.join(process.cwd(), 'lit-actions/dist/process-payment-validator.action.js'),
+                path.join(process.cwd(), '../lit-actions/dist/process-payment-validator.action.js'),
+            ];
+            let codePath;
+            for (const p of possiblePaths) {
+                if (fs.existsSync(p)) {
+                    codePath = p;
+                    break;
+                }
+            }
+            if (!codePath) {
+                throw new Error(`Local LIT action code not found. Tried: ${possiblePaths.join(', ')}. Please build lit-actions first.`);
+            }
+            const code = fs.readFileSync(codePath, 'utf8');
+            if (this.config.debug) {
+                console.log("📦 Using LOCAL LIT Action code (not IPFS)");
+                console.log("   Code path:", codePath);
+                console.log("   Code size:", code.length, "bytes");
+            }
+            result = await this.executeActionFromCode(code, litActionInfo.pkp.publicKey, litActionParams, this.config.signer, normalizedPkpTokenId, // Normalized to decimal string for consistent handling
+            litActionInfo.cid // Still provide CID for authorization validation
+            );
+        }
+        else {
+            // Always use IPFS mode when we have a registry CID
+            // This ensures the Lit SDK uses the correct CID from the registry for authorization
+            // Execute LIT Action (single attempt - retry logic is in SDK layer)
+            // CRITICAL: Pass pkpTokenId for session signature PKP scoping (fixes signEcdsa timeout)
+            // Use normalized decimal format for consistent conversion in session-signature-manager
+            result = await this.actionExecutor.executeAction({
+                cid: litActionInfo.cid, // Use registry CID
+                pkpPublicKey: litActionInfo.pkp.publicKey,
+                params: litActionParams,
+                signer: this.config.signer,
+                pkpTokenId: normalizedPkpTokenId, // Normalized to decimal string for consistent handling
+                pkpEthAddress: litActionInfo.pkp.ethAddress, // Required for capacity credit delegation
+            }, litClient);
+        }
+        let responseData = result.response;
+        if (typeof result.response === "string") {
+            try {
+                responseData = JSON.parse(result.response);
+            }
+            catch (e) {
+                // Ignore parse errors
+            }
+        }
+        // Handle signature: prefer LIT SDK format (result.signatures), fall back to responseData.signature
+        let signature;
+        if (result.signatures) {
+            signature = JSON.stringify(result.signatures);
+        }
+        else if (responseData?.signature) {
+            signature = responseData.signature;
+        }
+        return {
+            approved: responseData?.approved ?? false,
+            signature,
+            btcPrice: responseData?.btcPrice,
+            paymentAmount: responseData?.paymentAmount,
+            timestamp: responseData?.timestamp,
+            reason: responseData?.reason,
+            failedStep: responseData?.failedStep,
+            error: result.error,
+        };
+    }
+    /**
+     * Sign Bitcoin transaction locally (STANDALONE mode)
+     */
+    async signBTCTransactionStandalone(request) {
+        // Get LIT Action info from registry
+        const litActions = this.config.network === "datil"
+            ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })();
+        const litActionInfo = litActions.btcTransactionSigner;
+        if (!litActionInfo || !litActionInfo.cid) {
+            throw new Error("BTC transaction signer LIT Action not found in registry");
+        }
+        if (this.config.debug) {
+            console.log("📡 Calling BTC Transaction Signer LIT Action:");
+            console.log("   Network:", this.config.network);
+            console.log("   CID:", litActionInfo.cid);
+            console.log("   Position:", request.auth.positionId);
+            console.log("   UTXO:", `${request.auth.utxo.txid}:${request.auth.utxo.vout}`);
+            console.log("   Network Fee:", request.auth.networkFee);
+        }
+        // Get LIT client for execution
+        const litClient = await this.clientManager.getClient({
+            litNetwork: this.config.network,
+            debug: this.config.debug,
+        });
+        // Build LIT Action parameters
+        // Determine Bitcoin provider URL based on network
+        let bitcoinProviderUrl;
+        const chainId = request.auth.chainId;
+        switch (chainId) {
+            case 1: // Ethereum mainnet
+                bitcoinProviderUrl = process.env.BITCOIN_PROVIDER_URL || "https://mempool.space/api";
+                break;
+            case 11155111: // Sepolia testnet
+                bitcoinProviderUrl = process.env.BITCOIN_PROVIDER_URL || "https://diamond-hands-btc-faucet-6b39a1072059.herokuapp.com/api";
+                break;
+            case 1337: // Hardhat local testnet (actual deployment chainId)
+            case 31337: // Hardhat local testnet (standard default)
+                bitcoinProviderUrl = process.env.BITCOIN_PROVIDER_URL || "http://127.0.0.1:18443";
+                break;
+            default:
+                throw new Error(`Unsupported chainId: ${chainId}`);
+        }
+        // Override with custom Bitcoin RPC URL if provided (for local development with ngrok)
+        if (request.customBitcoinRpcUrl) {
+            bitcoinProviderUrl = request.customBitcoinRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom Bitcoin RPC URL (override):", request.customBitcoinRpcUrl);
+            }
+        }
+        const litActionParams = {
+            chain: request.chain,
+            bitcoinNetwork: request.bitcoinNetwork,
+            bitcoinProviderUrl, // For Bitcoin UTXO queries
+            auth: request.auth,
+            publicKey: request.publicKey,
+            contracts: request.contracts,
+        };
+        // Add custom EVM RPC URL for local development (Hardhat)
+        if (request.customRpcUrl) {
+            litActionParams.customRpcUrl = request.customRpcUrl;
+            if (this.config.debug) {
+                console.log("   Custom EVM RPC URL:", request.customRpcUrl);
+            }
+        }
+        if (this.config.debug) {
+            console.log("   Bitcoin Provider URL:", bitcoinProviderUrl);
+        }
+        // Execute LIT Action
+        const result = await this.actionExecutor.executeAction({
+            cid: litActionInfo.cid,
+            pkpPublicKey: request.publicKey,
+            params: litActionParams,
+            signer: this.config.signer,
+        }, litClient);
+        if (this.config.debug) {
+            console.log("📥 LIT Action response:", {
+                success: result.success,
+                hasSignature: !!result.signatures,
+                error: result.error,
+            });
+        }
+        // Parse response if it's a string
+        let responseData = result.response;
+        if (typeof result.response === "string") {
+            try {
+                responseData = JSON.parse(result.response);
+                if (this.config.debug) {
+                    console.log("📥 Parsed response data:", responseData);
+                }
+            }
+            catch (e) {
+                if (this.config.debug) {
+                    console.error("❌ Failed to parse response string:", e);
+                }
+            }
+        }
+        // Extract combined signature from LIT SDK result
+        // LIT SDK returns signatures in result.signatures.btcTxSig after combination
+        let combinedSignature;
+        if (result.signatures && typeof result.signatures === 'object') {
+            const btcTxSig = result.signatures.btcTxSig;
+            if (btcTxSig && btcTxSig.signature) {
+                // LIT SDK combined signature
+                combinedSignature = btcTxSig.signature;
+                if (this.config.debug && combinedSignature) {
+                    console.log("✅ Extracted combined signature from LIT SDK:", {
+                        signatureLength: combinedSignature.length,
+                        signatureStart: combinedSignature.substring(0, 20) + "..."
+                    });
+                }
+            }
+        }
+        // Return standardized response
+        return {
+            success: responseData?.success ?? false,
+            unsignedTxHex: responseData?.unsignedTxHex,
+            sigHash: responseData?.sigHash,
+            signature: combinedSignature || responseData?.signature,
+            pkpPublicKey: responseData?.pkpPublicKey,
+            pkpBtcAddress: responseData?.pkpBtcAddress,
+            destination: responseData?.destination,
+            userReceivesAmount: responseData?.userReceivesAmount,
+            networkFee: responseData?.networkFee,
+            changeAmount: responseData?.changeAmount,
+            utxo: responseData?.utxo,
+            authorization: responseData?.authorization,
+            timestamp: responseData?.timestamp,
+            action: responseData?.action,
+            error: result.error || responseData?.error,
+            failedStep: responseData?.failedStep,
+        };
+    }
     /**
      * Get trustless BTC price from Price Oracle LIT Action
      *
@@ -1579,7 +2839,9 @@ class LitOps {
         // Get LIT Action info from registry
         const litActions = (this.config.network === "datil"
             ? dh_lit_actions_1.DH_LIT_ACTIONS_DATIL
-            : dh_lit_actions_1.DH_LIT_ACTIONS_DATIL_TEST);
+            : (() => {
+                throw new Error("Unsupported LIT network");
+            })());
         console.log("litActions in getActions", litActions);
         const litActionInfo = litActions.priceOracle;
         if (!litActionInfo || !litActionInfo.cid) {