@gvnrdao/dh-sdk 0.0.220 → 0.0.222

package/dist/index.js

@@ -14325,53 +14325,53 @@ var init_deployment_addresses = __esm({
       },
       upgraded: {
         PositionManager: {
-          previousImplementation: "0x2A65512171ef119A838738B578B5cf0631f3Fcd2",
-          newImplementation: "0x1b854fE920AC409b5f407b3ABCd556C998F889E5",
-          upgradedAt: "2026-04-20T16:13:36.993Z",
+          previousImplementation: "0x0e40B4D1708f49319f32d51AF01674c26acACeBF",
+          newImplementation: "0x94096F14f58Cb427B36f2a5aeE24348a26534C74",
+          upgradedAt: "2026-04-30T16:23:00.805Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: PositionManager implementation update"
         },
         LoanOperationsManagerModule: {
-          previousImplementation: "0x9CF63e5673530722CF931B55E0371Ad749fF7F1D",
-          newImplementation: "0x448Fb59Cad99FFe3d0766F6943E4B579A824d46b",
-          upgradedAt: "2026-04-20T16:14:12.783Z",
+          previousImplementation: "0xCf8998a639cC48139C4c61C8B1005EaC40419b88",
+          newImplementation: "0xF79384d5186B6081124a560e181dC5E0Cf0444dD",
+          upgradedAt: "2026-04-30T16:40:12.746Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: LoanOperationsManagerModule implementation update"
         },
         UCDController: {
-          previousImplementation: "0xEE30B47B5Fa46bD9FeA46fB4d2E06EAcF8bBC8ec",
-          newImplementation: "0x9100bc3F3299642387C7aC2c626f8D1bDade6aB5",
-          upgradedAt: "2026-04-20T16:06:00.516Z",
+          previousImplementation: "0xB5322F0D4a07d4342FA38137ebD95ac41D1c6036",
+          newImplementation: "0x2d4d689A70B56b6E0B9F70BffA6265A55173A4A1",
+          upgradedAt: "2026-04-30T08:24:24.765Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: UCDController implementation update"
         },
         TermManagerModule: {
-          previousImplementation: "0x2f4ED39E87fE53CE1ce28fCce3EE18D92663EAB6",
-          newImplementation: "0xa6CECD3f9C581938Dfb8D2423eEAf449BBA5d3aF",
-          upgradedAt: "2026-04-20T16:08:12.566Z",
+          previousImplementation: "0x2EaF1052706120CAa6B6F75354F70f77ef2261eB",
+          newImplementation: "0xcc3D2dD7aAfaE5DE923dfd53833a40077178dd75",
+          upgradedAt: "2026-04-30T16:06:36.895Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: TermManagerModule implementation update"
         },
         CircuitBreakerModule: {
-          previousImplementation: "0x3E33049d74f0028e24b1d2475ed8E3444f265275",
-          newImplementation: "0xa4940082a7b58c45C3885C4B59714C0dD048cDdC",
-          upgradedAt: "2026-04-20T16:10:26.243Z",
+          previousImplementation: "0x8e9e10B14E6a91ec271FBEb4FD3fB1FE06b545dD",
+          newImplementation: "0x485F5E93E479830698Ffdc36957edfcf0084E4c6",
+          upgradedAt: "2026-04-30T16:11:25.723Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: CircuitBreakerModule implementation update"
         },
         AdminModule: {
-          previousImplementation: "0xF298C9CB52DaE62c38392E16d62144C66C2CBe85",
-          newImplementation: "0x8bDe850573a947b816D1EC5C5Ca177853bDfD049",
-          upgradedAt: "2026-04-21T21:58:00.784Z",
+          previousImplementation: "0x67AE2F872c37f33db9bC631e135432B2845d308b",
+          newImplementation: "0xaC7c227EddCE4F03590Ad10e773219Ffc07f9277",
+          upgradedAt: "2026-04-30T16:24:49.030Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
-          reason: "1.0.4: Allow setter functions to be called via executeGenericAdminOperation self-invocation"
+          reason: "Bulk-pause functions and network-aware operationDelay"
         },
         PositionManagerViews: {
-          previousImplementation: "0x0678FB51a9E8Bd51b6919c48eaD52A5cfF2e29C0",
-          newImplementation: "0xE8b4D4b6E3163EdfF8958da4cF8267ACa369D486",
-          upgradedAt: "2026-04-21T21:28:48.774Z",
+          previousImplementation: "0xE8b4D4b6E3163EdfF8958da4cF8267ACa369D486",
+          newImplementation: "0xadF8e0F34082a8fC23e727276e0aEf3af183C8Fd",
+          upgradedAt: "2026-04-30T08:32:48.463Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
-          reason: "1.1.1: Allow admin functions to be called via executeGenericAdminOperation (contract-to-contract calls)"
+          reason: "Shared upgrade script: PositionManagerViews implementation update"
         },
         TestPositionManager: {
           previousImplementation: "0x0B46Ee1a9C6b42559758B7FF78294Cd867BB08f8",
@@ -14381,51 +14381,51 @@ var init_deployment_addresses = __esm({
           reason: "Add setPositionExpiry() for expiry-liquidation E2E testing"
         },
         UCDToken: {
-          previousImplementation: "0x66384F03A8915F17917FDc1596fc4fBD00a481C1",
-          newImplementation: "0x8671127F940e7bCa87Feb3A34A7ca2a50D16e24d",
-          upgradedAt: "2026-04-20T16:06:49.605Z",
+          previousImplementation: "0xEFFF6f32Fc33C4Cb58a4d6858Bf90B8feA7D1D33",
+          newImplementation: "0x155Da00Ee0beb1d9D5BA34Aeb62c9ad4E8227d5D",
+          upgradedAt: "2026-04-30T08:25:01.929Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: UCDToken implementation update"
         },
         PositionManagerCoreModule: {
-          previousImplementation: "0x81f112B85Bc8b54327831DBa1D58b1eb0A166233",
-          newImplementation: "0x19470240A0B939141A5bD6cC7E3d784C37E3840E",
-          upgradedAt: "2026-04-20T16:07:37.424Z",
+          previousImplementation: "0xED380dDdc919b94924cCd5697bEEfdc347Daa9A6",
+          newImplementation: "0x9c7EF89F1F66F78522AA9D45F894f75583edEC3d",
+          upgradedAt: "2026-04-30T16:21:05.763Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: PositionManagerCoreModule implementation update"
         },
         CollateralManagerModule: {
-          previousImplementation: "0xb26039e5FF9771b2899D54b6dE879D493616502c",
-          newImplementation: "0x84C5B89f60415F8df3Fee46Ef1a10a6484aa8e0A",
-          upgradedAt: "2026-04-29T12:13:12.465Z",
+          previousImplementation: "0xd021ca6Dc2377F361E3c64f60C93E0e4075c2840",
+          newImplementation: "0x920e4f52c251B758e351c0d14c4418ad4E5B77ed",
+          upgradedAt: "2026-04-30T16:03:49.056Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: CollateralManagerModule implementation update"
         },
         LiquidationManagerModule: {
-          previousImplementation: "0xcc91578103f2Ec3F2DBbc08C5781e01844fBbCC0",
-          newImplementation: "0xBb625E44d72f3F1acDCbB08F73AFdAc38fCE3F64",
-          upgradedAt: "2026-04-20T16:09:48.898Z",
+          previousImplementation: "0xf74d5437691df92087170861213e26064358A7fb",
+          newImplementation: "0xcdd426D27bB2f54Dba76dF60EF3D14fD5776CEc7",
+          upgradedAt: "2026-04-30T16:09:01.899Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: LiquidationManagerModule implementation update"
         },
         BTCSpendAuthorizer: {
-          previousImplementation: "0xFEd51Bb3A1e389Cbb8181B71Ea39fc29625BD6cf",
-          newImplementation: "0x0B46DCdB63CB9928789ef1979C367da6ef04beAf",
-          upgradedAt: "2026-04-20T16:12:13.836Z",
+          previousImplementation: "0xe7337422e2A4AE7709EFc01fB6C681C8899e673C",
+          newImplementation: "0x605bf1C988bb307AFA07326954D593A71580e99d",
+          upgradedAt: "2026-04-30T20:22:12.956Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: BTCSpendAuthorizer implementation update"
         },
         SimplePSMV2: {
-          previousImplementation: "0xD1A16Fb36891b9F27A721ef9Aca4064E39a40B13",
-          newImplementation: "0xBdEFa375db7F9A498B81bcfdDd14FD16D02ca0BF",
-          upgradedAt: "2026-04-20T16:15:12.674Z",
+          previousImplementation: "0xBdEFa375db7F9A498B81bcfdDd14FD16D02ca0BF",
+          newImplementation: "0x4107104fDF61AACC674f1F168c275f034c8112BF",
+          upgradedAt: "2026-04-30T08:35:01.138Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: SimplePSMV2 implementation update"
         },
         UpgradeValidator: {
-          previousImplementation: "0x4a5BE302c4b6531C0205b6432ECcDbE4405505c2",
-          newImplementation: "0x844353ab66C62FfF80377321C5D2331193f888fb",
-          upgradedAt: "2026-04-20T16:15:36.931Z",
+          previousImplementation: "0x974C6F4e0F67Fa9d7Ab1aee8C10Bd85B201ec5D7",
+          newImplementation: "0xEFf189e5872bC7158191eD39d31E745aF2A6FDa7",
+          upgradedAt: "2026-04-30T16:47:01.406Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: UpgradeValidator implementation update"
         },
@@ -14502,26 +14502,26 @@ var init_deployment_addresses = __esm({
         POSITION_MANAGER_VIEWS: "0x3b970E41a0668508B4B2ACb83653b2A402F745AE",
         CIRCUIT_BREAKER_MODULE: "0x3D0B2cAE481821E57BA9CC3807bCC0d0D7F18bd8",
         ADMIN_MODULE: "0xAcd1f07915b17CA3727e7fE89BdF618A1545a1ed",
-        UCD_CONTROLLER_IMPL: "0x9100bc3F3299642387C7aC2c626f8D1bDade6aB5",
-        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0x448Fb59Cad99FFe3d0766F6943E4B579A824d46b",
-        TERM_MANAGER_MODULE_IMPL: "0xa6CECD3f9C581938Dfb8D2423eEAf449BBA5d3aF",
-        CIRCUIT_BREAKER_MODULE_IMPL: "0xa4940082a7b58c45C3885C4B59714C0dD048cDdC",
-        ADMIN_MODULE_IMPL: "0xF1f9C446BfBB942BfB344EDaC20cDeF2A44A56c5",
-        POSITION_MANAGER_VIEWS_IMPL: "0xaBF292941b14c09867A1861B5150187C309E3418",
-        POSITION_MANAGER_IMPL: "0x1b854fE920AC409b5f407b3ABCd556C998F889E5",
+        UCD_CONTROLLER_IMPL: "0x2d4d689A70B56b6E0B9F70BffA6265A55173A4A1",
+        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0xF79384d5186B6081124a560e181dC5E0Cf0444dD",
+        TERM_MANAGER_MODULE_IMPL: "0xcc3D2dD7aAfaE5DE923dfd53833a40077178dd75",
+        CIRCUIT_BREAKER_MODULE_IMPL: "0x8e9e10B14E6a91ec271FBEb4FD3fB1FE06b545dD",
+        ADMIN_MODULE_IMPL: "0x67AE2F872c37f33db9bC631e135432B2845d308b",
+        POSITION_MANAGER_VIEWS_IMPL: "0xadF8e0F34082a8fC23e727276e0aEf3af183C8Fd",
+        POSITION_MANAGER_IMPL: "0x94096F14f58Cb427B36f2a5aeE24348a26534C74",
         SIMPLE_PSM_V2: "0x19EcF7BA26e054fd4Ff06009A03070103dbBB058",
-        SIMPLE_PSM_V2_IMPL: "0xBdEFa375db7F9A498B81bcfdDd14FD16D02ca0BF",
-        UCD_TOKEN_IMPL: "0x8671127F940e7bCa87Feb3A34A7ca2a50D16e24d",
+        SIMPLE_PSM_V2_IMPL: "0x4107104fDF61AACC674f1F168c275f034c8112BF",
+        UCD_TOKEN_IMPL: "0x155Da00Ee0beb1d9D5BA34Aeb62c9ad4E8227d5D",
         POSITION_MANAGER_CORE_MODULE: "0xfFAA39a08887FeFB697eBC8691A8630CbCC33391",
-        POSITION_MANAGER_CORE_MODULE_IMPL: "0x19470240A0B939141A5bD6cC7E3d784C37E3840E",
+        POSITION_MANAGER_CORE_MODULE_IMPL: "0x41168d9BF8e696eBAB05ea539321ac212859d80b",
         COLLATERAL_MANAGER_MODULE: "0x967E92c976Fc0fa8268D37D4d6B7245d912aA7dB",
-        COLLATERAL_MANAGER_MODULE_IMPL: "0xb26039e5FF9771b2899D54b6dE879D493616502c",
+        COLLATERAL_MANAGER_MODULE_IMPL: "0xd021ca6Dc2377F361E3c64f60C93E0e4075c2840",
         LIQUIDATION_MANAGER_MODULE: "0xC4AB00f39e7ceD812F5C67058C9fa44e15d40e76",
-        LIQUIDATION_MANAGER_MODULE_IMPL: "0xBb625E44d72f3F1acDCbB08F73AFdAc38fCE3F64",
+        LIQUIDATION_MANAGER_MODULE_IMPL: "0xf74d5437691df92087170861213e26064358A7fb",
         BTC_SPEND_AUTHORIZER: "0xd7E9Eb5eE53f1d9ee55Dc162bBC7486bE437B6bD",
-        BTC_SPEND_AUTHORIZER_IMPL: "0x0B46DCdB63CB9928789ef1979C367da6ef04beAf",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x4CD021181bD2583d10aB37D27FE2994b75c41b77",
         UPGRADE_VALIDATOR: "0x592e650edD9bA26ecc407989fdd6F9cdcDeC27A6",
-        UPGRADE_VALIDATOR_IMPL: "0x844353ab66C62FfF80377321C5D2331193f888fb",
+        UPGRADE_VALIDATOR_IMPL: "0xEFf189e5872bC7158191eD39d31E745aF2A6FDa7",
         BITCOIN_PROVIDER_REGISTRY: "0xbfA0c48B070D0a9A9CD27469AeacFD2d4261cEE2",
         BITCOIN_PROVIDER_REGISTRY_IMPL: "0x225309A4ae6D146ba93A3278A7b40224FfC81448",
         LIT_ACTION_VALIDATOR: "0x54eECd7C90F8A8fac27749Ba30BbE8AFBAccc856",
@@ -31184,11 +31184,62 @@ async function generatePaymentAuthorization(positionId, amount, chainId, signer)
     signature: signature2
   };
 }
-async function getPKPPublicKeyFromTokenId(pkpTokenId, provider, pkpNftContractAddress) {
+function isChipotlePkpId(pkpTokenId) {
   const rawHex = pkpTokenId.startsWith("0x") ? pkpTokenId.slice(2) : pkpTokenId;
-  if (rawHex.length === 64 && rawHex.startsWith("000000000000000000000000") && rawHex !== "0".repeat(64)) {
+  return rawHex.length === 64 && rawHex.startsWith("000000000000000000000000") && rawHex !== "0".repeat(64);
+}
+async function deriveChipotlePublicKeyViaService(pkpTokenId, fallback) {
+  const url = `${fallback.serviceEndpoint}/api/lit/pkp/derive-public-key`;
+  const controller = new AbortController();
+  const timeout = setTimeout(
+    () => controller.abort(),
+    fallback.timeoutMs ?? 6e4
+  );
+  try {
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (fallback.serviceAuthToken) {
+      headers["Authorization"] = `Bearer ${fallback.serviceAuthToken}`;
+    }
+    const response = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        pkpId: pkpTokenId,
+        ...fallback.borrowerAddress && {
+          borrowerAddress: fallback.borrowerAddress
+        }
+      }),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(
+        `derive-public-key service error (${response.status}): ${errorText}`
+      );
+    }
+    const envelope = await response.json();
+    const publicKey = envelope?.data?.publicKey;
+    if (!envelope?.success || !publicKey) {
+      throw new Error(
+        `derive-public-key returned no publicKey (envelope keys: ${Object.keys(
+          envelope ?? {}
+        ).join(", ")})`
+      );
+    }
+    return publicKey.startsWith("0x") ? publicKey : `0x${publicKey}`;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function getPKPPublicKeyFromTokenId(pkpTokenId, provider, pkpNftContractAddress, chipotleFallback) {
+  if (isChipotlePkpId(pkpTokenId)) {
+    if (chipotleFallback?.serviceEndpoint) {
+      return deriveChipotlePublicKeyViaService(pkpTokenId, chipotleFallback);
+    }
     throw new Error(
-      `pkpId ${pkpTokenId} is a Chipotle wallet address (ABI-encoded ETH address). Chipotle PKPs are not NFTs and have no on-chain public key lookup. Ensure the PKP public key is populated in cache during position creation.`
+      `pkpId ${pkpTokenId} is a Chipotle wallet address (ABI-encoded ETH address). Chipotle PKPs are not NFTs and have no on-chain public key lookup. Provide chipotleFallback.serviceEndpoint to recover via lit-ops-server, or ensure the PKP public key is populated in cache during position creation.`
     );
   }
   if (!provider) {
@@ -31483,7 +31534,7 @@ function extractOptionalLitSignature(raw) {
 
 // src/modules/contract/contract-manager.module.ts
 var POSITION_MANAGER_ABI = [
-  "function createPosition(bytes32 pkpId, bytes calldata validatorSignature, string mainnetVaultAddress, string regtestVaultAddress, uint256 selectedTermMonths, uint256 validatorVersion) external returns (bytes32 positionId)",
+  "function createPosition(bytes32 pkpId, bytes calldata validatorSignature, string mainnetVaultAddress, string regtestVaultAddress, uint256 selectedTermMonths, uint256 validatorVersion, bytes calldata pkpPublicKey) external returns (bytes32 positionId)",
   "function mintUCD(bytes32 positionId, uint256 mintAmount, uint256 mintFee, uint256 newDebt, uint256 newCollateral, uint256 btcPrice, bytes32 authorizedSpendsHash, bytes32 ucdDebtHash, bytes32 contractHash, uint256 quantumTimestamp, bytes calldata mintValidatorSignature) external returns (bool)",
   "function makePayment(bytes32 positionId, uint256 paymentAmount, uint256 quantumTimestamp, uint256 btcPrice, bytes calldata paymentValidatorSignature) external returns (bool)",
   "function extendPosition(bytes32 positionId, uint256 selectedTerm, uint256 quantumTimestamp, uint256 btcPrice, uint256 availableBTCBalance, uint256 proRataRenewalFee, bytes calldata extensionValidatorSignature) external returns (bool)",
@@ -33132,6 +33183,10 @@ var LoanCreator = class {
         ethers_exports.utils.hexlify(BigInt(pkpData.tokenId)),
         32
       );
+      const pkpPublicKeyUncompressed = ethers_exports.utils.computePublicKey(
+        pkpData.publicKey,
+        false
+      );
       console.log("\n\u{1F50D} PKP TOKEN ID CONVERSION TRACE (SDK):");
       console.log("==========================================");
       console.log(
@@ -33182,7 +33237,8 @@ var LoanCreator = class {
           mainnetVaultAddress,
           regtestVaultAddress,
           request.selectedTerm,
-          validatorVersion
+          validatorVersion,
+          pkpPublicKeyUncompressed
         ]);
         console.log("\u{1F50D} ENCODED CALLDATA (first 256 chars):", encoded.substring(0, 256));
         console.log("\u{1F50D} ENCODED CALLDATA full length:", encoded.length);
@@ -33195,7 +33251,8 @@ var LoanCreator = class {
         mainnetVaultAddress,
         regtestVaultAddress,
         request.selectedTerm,
-        validatorVersion
+        validatorVersion,
+        pkpPublicKeyUncompressed
       );
       if (!tx) {
         return failure(
@@ -33747,8 +33804,8 @@ var LoanQuery = class {
         batch.map(async (loan) => {
           try {
             const rawId = loan.pkpId?.startsWith("0x") ? loan.pkpId.slice(2) : loan.pkpId;
-            const isChipotlePkpId = typeof rawId === "string" && rawId.length === 40 && !rawId.toLowerCase().startsWith("04");
-            if (isChipotlePkpId) {
+            const isChipotlePkpId2 = typeof rawId === "string" && rawId.length === 40 && !rawId.toLowerCase().startsWith("04");
+            if (isChipotlePkpId2) {
               if (this.config.positionManagerCoreAddress && this.config.provider) {
                 const pmContract = new ethers_exports.Contract(
                   this.config.positionManagerCoreAddress,
@@ -36898,7 +36955,7 @@ function formatLoanCreationMessage(positionId, pkpId, vaultAddress) {
 }
 function formatBTCWithdrawalFailureMessage(withdrawalAmount, btcVault, btcDestinationAddress, loanId) {
   const formattedAmount = formatBTCAmount(withdrawalAmount);
-  return `There was a failure withdrawing ${formattedAmount} from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}`;
+  return `\u274C BTC withdrawal FAILED: ${formattedAmount} from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}`;
 }
 function formatLoanRenewalMessage(positionId, txHash) {
   return `Loan id ${positionId} was successfully renewed. Tx: https://sepolia.etherscan.io/tx/${txHash}`;
@@ -36912,9 +36969,10 @@ function formatBalanceConfirmationMessage(loanId) {
 function formatBalanceConfirmationFailureMessage(loanId) {
   return `FAILED to update to PENDING_MINT for loan id ${loanId}`;
 }
-function formatBTCWithdrawalSuccessMessage(withdrawalAmount, btcVault, btcDestinationAddress, loanId) {
+function formatBTCWithdrawalSuccessMessage(withdrawalAmount, btcVault, btcDestinationAddress, loanId, btcTxId) {
   const formattedAmount = formatBTCAmount(withdrawalAmount);
-  return `${formattedAmount} was withdrawn from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}`;
+  const txSuffix = btcTxId ? ` (tx: ${btcTxId})` : "";
+  return `\u2705 BTC withdrawal SUCCEEDED: ${formattedAmount} sent from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}${txSuffix}`;
 }
 function formatLiquidationSkippedMessage(loanId, ratio, threshold, btcVault, btcVaultBalance, ucdDebt, btcPrice) {
   const formattedPrice = formatBTCPrice(btcPrice);
@@ -37644,6 +37702,18 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
    * Check if SDK is ready for operations
    */
   async _relayNotification(message) {
+    const handler = this.config.notificationHandler;
+    if (typeof handler === "function") {
+      try {
+        await handler(message);
+      } catch (err) {
+        if (this.config.debug) {
+          log.warn("notificationHandler threw", {
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+    }
     if (this.config.mode !== "service")
       return;
     const endpoint = this.config.serviceEndpoint;
@@ -37954,7 +38024,8 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
             pkpPublicKey = await getPKPPublicKeyFromTokenId(
               position2.pkpId,
               this.getProviderOrThrow(),
-              nagaPkpNftAddress
+              nagaPkpNftAddress,
+              this.getChipotlePublicKeyFallback()
             );
             pkpEthAddress = ethers_exports.utils.computeAddress(pkpPublicKey);
             pkpCache.set(request.positionId, {
@@ -39057,7 +39128,8 @@ Error data: ${errorData || "none"}`
           const pkpPublicKey = await getPKPPublicKeyFromTokenId(
             position.pkpId,
             this.getProviderOrThrow(),
-            nagaPkpNftAddressLiq
+            nagaPkpNftAddressLiq,
+            this.getChipotlePublicKeyFallback()
           );
           const pkpEthAddress = ethers_exports.utils.computeAddress(pkpPublicKey);
           pkpData = {
@@ -40239,7 +40311,14 @@ Error data: ${errorData || "none"}`
         LoanOperationsManagerModule: this.config.contractAddresses?.loanOperationsManager || "",
         TermManagerModule: this.config.contractAddresses?.termManager || "",
         LiquidationManagerModule: this.config.contractAddresses?.liquidationManager || "",
-        ...this.config.contractAddresses?.btcSpendAuthorizer ? { BTCSpendAuthorizer: this.config.contractAddresses.btcSpendAuthorizer } : {}
+        ...this.config.contractAddresses?.btcSpendAuthorizer ? { BTCSpendAuthorizer: this.config.contractAddresses.btcSpendAuthorizer } : {},
+        // Required on non-hardhat chains by Lit Actions after audit C-1/H-6:
+        // the Bitcoin provider whitelist now lives on-chain. Other SDK paths
+        // (mintUCD, extendPosition, withdrawBTC) already forward this; keep
+        // confirmBalance aligned so Sepolia behaves identically to Hardhat.
+        ...this.config.contractAddresses?.bitcoinProviderRegistry ? {
+          BitcoinProviderRegistry: this.config.contractAddresses.bitcoinProviderRegistry
+        } : {}
       };
       const chainId = await this.config.provider?.getNetwork().then((n) => n.chainId) || 11155111;
       const chain = chainId === 11155111 ? "sepolia" : chainId === 1337 ? "hardhat" : "sepolia";
@@ -41140,7 +41219,8 @@ Error data: ${errorData || "none"}`
             pkpPublicKey = await getPKPPublicKeyFromTokenId(
               position.pkpId,
               this.getProviderOrThrow(),
-              nagaPkpNftAddress
+              nagaPkpNftAddress,
+              this.getChipotlePublicKeyFallback()
             );
             pkpEthAddress = ethers_exports.utils.computeAddress(pkpPublicKey);
             pkpCache.set(positionId, {
@@ -41610,22 +41690,6 @@ Error data: ${errorData || "none"}`
           gasUsed: receipt.gasUsed?.toString() || "unknown"
         });
       }
-      try {
-        const position = await this.getPosition(positionId);
-        const btcAmount = (Number(withdrawalAmount) / 1e8).toFixed(8);
-        const message = formatBTCWithdrawalSuccessMessage(
-          btcAmount,
-          position?.vaultAddress || "unknown",
-          validationResponse.destinationAddress,
-          positionId
-        );
-        await this._relayNotification(message);
-      } catch (telegramError) {
-        console.error(
-          "Telegram notification failed:",
-          telegramError instanceof Error ? telegramError.message : String(telegramError)
-        );
-      }
       return {
         success: true,
         positionId,
@@ -41798,7 +41862,8 @@ Error data: ${errorData || "none"}`
           pkpPublicKey = await getPKPPublicKeyFromTokenId(
             pkpId,
             this.getProviderOrThrow(),
-            nagaPkpNftAddress
+            nagaPkpNftAddress,
+            this.getChipotlePublicKeyFallback()
           );
           pkpCache.set(request.positionId, {
             publicKey: pkpPublicKey,
@@ -41977,13 +42042,37 @@ Error data: ${errorData || "none"}`
         if (utxoListResponse.ok) {
           const utxoList = await utxoListResponse.json();
           if (Array.isArray(utxoList)) {
-            allUTXOs = utxoList.filter((u) => u.status?.confirmed === true).map((u) => ({
-              txid: u.txid,
-              vout: u.vout,
-              value: u.value,
-              // satoshis
-              scriptPubKey: derivedScriptPubKey
-            }));
+            const confirmed = utxoList.filter((u) => u.status?.confirmed === true);
+            const verified = [];
+            for (const u of confirmed) {
+              try {
+                const txResp = await fetch(`${bitcoinRpcUrl}/tx/${u.txid}`);
+                if (!txResp.ok)
+                  continue;
+                const txData = await txResp.json();
+                if (!Array.isArray(txData.vout))
+                  continue;
+                let voutIdx = u.vout;
+                const voutData = txData.vout[voutIdx];
+                const spk = voutData?.scriptpubkey || voutData?.scriptPubKey || voutData?.scriptpubkey_hex;
+                if (spk !== derivedScriptPubKey) {
+                  const correctIdx = txData.vout.findIndex(
+                    (v) => (v.scriptpubkey || v.scriptPubKey || v.scriptpubkey_hex) === derivedScriptPubKey
+                  );
+                  if (correctIdx < 0)
+                    continue;
+                  voutIdx = correctIdx;
+                }
+                verified.push({
+                  txid: u.txid,
+                  vout: voutIdx,
+                  value: txData.vout[voutIdx].value,
+                  scriptPubKey: derivedScriptPubKey
+                });
+              } catch {
+              }
+            }
+            allUTXOs = verified;
             if (this.config.debug) {
               log.info(`\u2705 Fetched ${allUTXOs.length} confirmed UTXO(s) for consolidation`, {
                 vaultAddress,
@@ -42514,6 +42603,27 @@ Error data: ${errorData || "none"}`
           txid: executionResult.txid
         });
       }
+      try {
+        const btcAmount = (Number(withdrawalAmount) / 1e8).toFixed(8);
+        const message = executionResult.success ? formatBTCWithdrawalSuccessMessage(
+          btcAmount,
+          vaultAddress,
+          withdrawalAddress,
+          positionId,
+          executionResult.txid
+        ) : formatBTCWithdrawalFailureMessage(
+          btcAmount,
+          vaultAddress,
+          withdrawalAddress,
+          positionId
+        );
+        await this._relayNotification(message);
+      } catch (telegramError) {
+        console.error(
+          "Telegram notification failed:",
+          telegramError instanceof Error ? telegramError.message : String(telegramError)
+        );
+      }
       const transfers = [
         {
           success: executionResult.success,
@@ -42921,6 +43031,19 @@ Error data: ${errorData || "none"}`
   // ============================================================================
   // PRIVATE HELPER METHODS
   // ============================================================================
+  /**
+   * Build the Chipotle service-mode fallback config for getPKPPublicKeyFromTokenId.
+   * Returns undefined in standalone mode so the helper falls back to throwing.
+   */
+  getChipotlePublicKeyFallback() {
+    if (!this.config.serviceEndpoint)
+      return void 0;
+    return {
+      serviceEndpoint: this.config.serviceEndpoint,
+      serviceAuthToken: this.config.serviceAuthToken,
+      debug: this.config.debug
+    };
+  }
   /**
    * Get provider or throw error
    */

package/dist/index.mjs

@@ -14331,53 +14331,53 @@ var init_deployment_addresses = __esm({
       },
       upgraded: {
         PositionManager: {
-          previousImplementation: "0x2A65512171ef119A838738B578B5cf0631f3Fcd2",
-          newImplementation: "0x1b854fE920AC409b5f407b3ABCd556C998F889E5",
-          upgradedAt: "2026-04-20T16:13:36.993Z",
+          previousImplementation: "0x0e40B4D1708f49319f32d51AF01674c26acACeBF",
+          newImplementation: "0x94096F14f58Cb427B36f2a5aeE24348a26534C74",
+          upgradedAt: "2026-04-30T16:23:00.805Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: PositionManager implementation update"
         },
         LoanOperationsManagerModule: {
-          previousImplementation: "0x9CF63e5673530722CF931B55E0371Ad749fF7F1D",
-          newImplementation: "0x448Fb59Cad99FFe3d0766F6943E4B579A824d46b",
-          upgradedAt: "2026-04-20T16:14:12.783Z",
+          previousImplementation: "0xCf8998a639cC48139C4c61C8B1005EaC40419b88",
+          newImplementation: "0xF79384d5186B6081124a560e181dC5E0Cf0444dD",
+          upgradedAt: "2026-04-30T16:40:12.746Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: LoanOperationsManagerModule implementation update"
         },
         UCDController: {
-          previousImplementation: "0xEE30B47B5Fa46bD9FeA46fB4d2E06EAcF8bBC8ec",
-          newImplementation: "0x9100bc3F3299642387C7aC2c626f8D1bDade6aB5",
-          upgradedAt: "2026-04-20T16:06:00.516Z",
+          previousImplementation: "0xB5322F0D4a07d4342FA38137ebD95ac41D1c6036",
+          newImplementation: "0x2d4d689A70B56b6E0B9F70BffA6265A55173A4A1",
+          upgradedAt: "2026-04-30T08:24:24.765Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: UCDController implementation update"
         },
         TermManagerModule: {
-          previousImplementation: "0x2f4ED39E87fE53CE1ce28fCce3EE18D92663EAB6",
-          newImplementation: "0xa6CECD3f9C581938Dfb8D2423eEAf449BBA5d3aF",
-          upgradedAt: "2026-04-20T16:08:12.566Z",
+          previousImplementation: "0x2EaF1052706120CAa6B6F75354F70f77ef2261eB",
+          newImplementation: "0xcc3D2dD7aAfaE5DE923dfd53833a40077178dd75",
+          upgradedAt: "2026-04-30T16:06:36.895Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: TermManagerModule implementation update"
         },
         CircuitBreakerModule: {
-          previousImplementation: "0x3E33049d74f0028e24b1d2475ed8E3444f265275",
-          newImplementation: "0xa4940082a7b58c45C3885C4B59714C0dD048cDdC",
-          upgradedAt: "2026-04-20T16:10:26.243Z",
+          previousImplementation: "0x8e9e10B14E6a91ec271FBEb4FD3fB1FE06b545dD",
+          newImplementation: "0x485F5E93E479830698Ffdc36957edfcf0084E4c6",
+          upgradedAt: "2026-04-30T16:11:25.723Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: CircuitBreakerModule implementation update"
         },
         AdminModule: {
-          previousImplementation: "0xF298C9CB52DaE62c38392E16d62144C66C2CBe85",
-          newImplementation: "0x8bDe850573a947b816D1EC5C5Ca177853bDfD049",
-          upgradedAt: "2026-04-21T21:58:00.784Z",
+          previousImplementation: "0x67AE2F872c37f33db9bC631e135432B2845d308b",
+          newImplementation: "0xaC7c227EddCE4F03590Ad10e773219Ffc07f9277",
+          upgradedAt: "2026-04-30T16:24:49.030Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
-          reason: "1.0.4: Allow setter functions to be called via executeGenericAdminOperation self-invocation"
+          reason: "Bulk-pause functions and network-aware operationDelay"
         },
         PositionManagerViews: {
-          previousImplementation: "0x0678FB51a9E8Bd51b6919c48eaD52A5cfF2e29C0",
-          newImplementation: "0xE8b4D4b6E3163EdfF8958da4cF8267ACa369D486",
-          upgradedAt: "2026-04-21T21:28:48.774Z",
+          previousImplementation: "0xE8b4D4b6E3163EdfF8958da4cF8267ACa369D486",
+          newImplementation: "0xadF8e0F34082a8fC23e727276e0aEf3af183C8Fd",
+          upgradedAt: "2026-04-30T08:32:48.463Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
-          reason: "1.1.1: Allow admin functions to be called via executeGenericAdminOperation (contract-to-contract calls)"
+          reason: "Shared upgrade script: PositionManagerViews implementation update"
         },
         TestPositionManager: {
           previousImplementation: "0x0B46Ee1a9C6b42559758B7FF78294Cd867BB08f8",
@@ -14387,51 +14387,51 @@ var init_deployment_addresses = __esm({
           reason: "Add setPositionExpiry() for expiry-liquidation E2E testing"
         },
         UCDToken: {
-          previousImplementation: "0x66384F03A8915F17917FDc1596fc4fBD00a481C1",
-          newImplementation: "0x8671127F940e7bCa87Feb3A34A7ca2a50D16e24d",
-          upgradedAt: "2026-04-20T16:06:49.605Z",
+          previousImplementation: "0xEFFF6f32Fc33C4Cb58a4d6858Bf90B8feA7D1D33",
+          newImplementation: "0x155Da00Ee0beb1d9D5BA34Aeb62c9ad4E8227d5D",
+          upgradedAt: "2026-04-30T08:25:01.929Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: UCDToken implementation update"
         },
         PositionManagerCoreModule: {
-          previousImplementation: "0x81f112B85Bc8b54327831DBa1D58b1eb0A166233",
-          newImplementation: "0x19470240A0B939141A5bD6cC7E3d784C37E3840E",
-          upgradedAt: "2026-04-20T16:07:37.424Z",
+          previousImplementation: "0xED380dDdc919b94924cCd5697bEEfdc347Daa9A6",
+          newImplementation: "0x9c7EF89F1F66F78522AA9D45F894f75583edEC3d",
+          upgradedAt: "2026-04-30T16:21:05.763Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: PositionManagerCoreModule implementation update"
         },
         CollateralManagerModule: {
-          previousImplementation: "0xb26039e5FF9771b2899D54b6dE879D493616502c",
-          newImplementation: "0x84C5B89f60415F8df3Fee46Ef1a10a6484aa8e0A",
-          upgradedAt: "2026-04-29T12:13:12.465Z",
+          previousImplementation: "0xd021ca6Dc2377F361E3c64f60C93E0e4075c2840",
+          newImplementation: "0x920e4f52c251B758e351c0d14c4418ad4E5B77ed",
+          upgradedAt: "2026-04-30T16:03:49.056Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: CollateralManagerModule implementation update"
         },
         LiquidationManagerModule: {
-          previousImplementation: "0xcc91578103f2Ec3F2DBbc08C5781e01844fBbCC0",
-          newImplementation: "0xBb625E44d72f3F1acDCbB08F73AFdAc38fCE3F64",
-          upgradedAt: "2026-04-20T16:09:48.898Z",
+          previousImplementation: "0xf74d5437691df92087170861213e26064358A7fb",
+          newImplementation: "0xcdd426D27bB2f54Dba76dF60EF3D14fD5776CEc7",
+          upgradedAt: "2026-04-30T16:09:01.899Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: LiquidationManagerModule implementation update"
         },
         BTCSpendAuthorizer: {
-          previousImplementation: "0xFEd51Bb3A1e389Cbb8181B71Ea39fc29625BD6cf",
-          newImplementation: "0x0B46DCdB63CB9928789ef1979C367da6ef04beAf",
-          upgradedAt: "2026-04-20T16:12:13.836Z",
+          previousImplementation: "0xe7337422e2A4AE7709EFc01fB6C681C8899e673C",
+          newImplementation: "0x605bf1C988bb307AFA07326954D593A71580e99d",
+          upgradedAt: "2026-04-30T20:22:12.956Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: BTCSpendAuthorizer implementation update"
         },
         SimplePSMV2: {
-          previousImplementation: "0xD1A16Fb36891b9F27A721ef9Aca4064E39a40B13",
-          newImplementation: "0xBdEFa375db7F9A498B81bcfdDd14FD16D02ca0BF",
-          upgradedAt: "2026-04-20T16:15:12.674Z",
+          previousImplementation: "0xBdEFa375db7F9A498B81bcfdDd14FD16D02ca0BF",
+          newImplementation: "0x4107104fDF61AACC674f1F168c275f034c8112BF",
+          upgradedAt: "2026-04-30T08:35:01.138Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: SimplePSMV2 implementation update"
         },
         UpgradeValidator: {
-          previousImplementation: "0x4a5BE302c4b6531C0205b6432ECcDbE4405505c2",
-          newImplementation: "0x844353ab66C62FfF80377321C5D2331193f888fb",
-          upgradedAt: "2026-04-20T16:15:36.931Z",
+          previousImplementation: "0x974C6F4e0F67Fa9d7Ab1aee8C10Bd85B201ec5D7",
+          newImplementation: "0xEFf189e5872bC7158191eD39d31E745aF2A6FDa7",
+          upgradedAt: "2026-04-30T16:47:01.406Z",
           upgradedBy: "0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6",
           reason: "Shared upgrade script: UpgradeValidator implementation update"
         },
@@ -14508,26 +14508,26 @@ var init_deployment_addresses = __esm({
         POSITION_MANAGER_VIEWS: "0x3b970E41a0668508B4B2ACb83653b2A402F745AE",
         CIRCUIT_BREAKER_MODULE: "0x3D0B2cAE481821E57BA9CC3807bCC0d0D7F18bd8",
         ADMIN_MODULE: "0xAcd1f07915b17CA3727e7fE89BdF618A1545a1ed",
-        UCD_CONTROLLER_IMPL: "0x9100bc3F3299642387C7aC2c626f8D1bDade6aB5",
-        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0x448Fb59Cad99FFe3d0766F6943E4B579A824d46b",
-        TERM_MANAGER_MODULE_IMPL: "0xa6CECD3f9C581938Dfb8D2423eEAf449BBA5d3aF",
-        CIRCUIT_BREAKER_MODULE_IMPL: "0xa4940082a7b58c45C3885C4B59714C0dD048cDdC",
-        ADMIN_MODULE_IMPL: "0xF1f9C446BfBB942BfB344EDaC20cDeF2A44A56c5",
-        POSITION_MANAGER_VIEWS_IMPL: "0xaBF292941b14c09867A1861B5150187C309E3418",
-        POSITION_MANAGER_IMPL: "0x1b854fE920AC409b5f407b3ABCd556C998F889E5",
+        UCD_CONTROLLER_IMPL: "0x2d4d689A70B56b6E0B9F70BffA6265A55173A4A1",
+        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0xF79384d5186B6081124a560e181dC5E0Cf0444dD",
+        TERM_MANAGER_MODULE_IMPL: "0xcc3D2dD7aAfaE5DE923dfd53833a40077178dd75",
+        CIRCUIT_BREAKER_MODULE_IMPL: "0x8e9e10B14E6a91ec271FBEb4FD3fB1FE06b545dD",
+        ADMIN_MODULE_IMPL: "0x67AE2F872c37f33db9bC631e135432B2845d308b",
+        POSITION_MANAGER_VIEWS_IMPL: "0xadF8e0F34082a8fC23e727276e0aEf3af183C8Fd",
+        POSITION_MANAGER_IMPL: "0x94096F14f58Cb427B36f2a5aeE24348a26534C74",
         SIMPLE_PSM_V2: "0x19EcF7BA26e054fd4Ff06009A03070103dbBB058",
-        SIMPLE_PSM_V2_IMPL: "0xBdEFa375db7F9A498B81bcfdDd14FD16D02ca0BF",
-        UCD_TOKEN_IMPL: "0x8671127F940e7bCa87Feb3A34A7ca2a50D16e24d",
+        SIMPLE_PSM_V2_IMPL: "0x4107104fDF61AACC674f1F168c275f034c8112BF",
+        UCD_TOKEN_IMPL: "0x155Da00Ee0beb1d9D5BA34Aeb62c9ad4E8227d5D",
         POSITION_MANAGER_CORE_MODULE: "0xfFAA39a08887FeFB697eBC8691A8630CbCC33391",
-        POSITION_MANAGER_CORE_MODULE_IMPL: "0x19470240A0B939141A5bD6cC7E3d784C37E3840E",
+        POSITION_MANAGER_CORE_MODULE_IMPL: "0x41168d9BF8e696eBAB05ea539321ac212859d80b",
         COLLATERAL_MANAGER_MODULE: "0x967E92c976Fc0fa8268D37D4d6B7245d912aA7dB",
-        COLLATERAL_MANAGER_MODULE_IMPL: "0xb26039e5FF9771b2899D54b6dE879D493616502c",
+        COLLATERAL_MANAGER_MODULE_IMPL: "0xd021ca6Dc2377F361E3c64f60C93E0e4075c2840",
         LIQUIDATION_MANAGER_MODULE: "0xC4AB00f39e7ceD812F5C67058C9fa44e15d40e76",
-        LIQUIDATION_MANAGER_MODULE_IMPL: "0xBb625E44d72f3F1acDCbB08F73AFdAc38fCE3F64",
+        LIQUIDATION_MANAGER_MODULE_IMPL: "0xf74d5437691df92087170861213e26064358A7fb",
         BTC_SPEND_AUTHORIZER: "0xd7E9Eb5eE53f1d9ee55Dc162bBC7486bE437B6bD",
-        BTC_SPEND_AUTHORIZER_IMPL: "0x0B46DCdB63CB9928789ef1979C367da6ef04beAf",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x4CD021181bD2583d10aB37D27FE2994b75c41b77",
         UPGRADE_VALIDATOR: "0x592e650edD9bA26ecc407989fdd6F9cdcDeC27A6",
-        UPGRADE_VALIDATOR_IMPL: "0x844353ab66C62FfF80377321C5D2331193f888fb",
+        UPGRADE_VALIDATOR_IMPL: "0xEFf189e5872bC7158191eD39d31E745aF2A6FDa7",
         BITCOIN_PROVIDER_REGISTRY: "0xbfA0c48B070D0a9A9CD27469AeacFD2d4261cEE2",
         BITCOIN_PROVIDER_REGISTRY_IMPL: "0x225309A4ae6D146ba93A3278A7b40224FfC81448",
         LIT_ACTION_VALIDATOR: "0x54eECd7C90F8A8fac27749Ba30BbE8AFBAccc856",
@@ -31112,11 +31112,62 @@ async function generatePaymentAuthorization(positionId, amount, chainId, signer)
     signature: signature2
   };
 }
-async function getPKPPublicKeyFromTokenId(pkpTokenId, provider, pkpNftContractAddress) {
+function isChipotlePkpId(pkpTokenId) {
   const rawHex = pkpTokenId.startsWith("0x") ? pkpTokenId.slice(2) : pkpTokenId;
-  if (rawHex.length === 64 && rawHex.startsWith("000000000000000000000000") && rawHex !== "0".repeat(64)) {
+  return rawHex.length === 64 && rawHex.startsWith("000000000000000000000000") && rawHex !== "0".repeat(64);
+}
+async function deriveChipotlePublicKeyViaService(pkpTokenId, fallback) {
+  const url = `${fallback.serviceEndpoint}/api/lit/pkp/derive-public-key`;
+  const controller = new AbortController();
+  const timeout = setTimeout(
+    () => controller.abort(),
+    fallback.timeoutMs ?? 6e4
+  );
+  try {
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (fallback.serviceAuthToken) {
+      headers["Authorization"] = `Bearer ${fallback.serviceAuthToken}`;
+    }
+    const response = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        pkpId: pkpTokenId,
+        ...fallback.borrowerAddress && {
+          borrowerAddress: fallback.borrowerAddress
+        }
+      }),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(
+        `derive-public-key service error (${response.status}): ${errorText}`
+      );
+    }
+    const envelope = await response.json();
+    const publicKey = envelope?.data?.publicKey;
+    if (!envelope?.success || !publicKey) {
+      throw new Error(
+        `derive-public-key returned no publicKey (envelope keys: ${Object.keys(
+          envelope ?? {}
+        ).join(", ")})`
+      );
+    }
+    return publicKey.startsWith("0x") ? publicKey : `0x${publicKey}`;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function getPKPPublicKeyFromTokenId(pkpTokenId, provider, pkpNftContractAddress, chipotleFallback) {
+  if (isChipotlePkpId(pkpTokenId)) {
+    if (chipotleFallback?.serviceEndpoint) {
+      return deriveChipotlePublicKeyViaService(pkpTokenId, chipotleFallback);
+    }
     throw new Error(
-      `pkpId ${pkpTokenId} is a Chipotle wallet address (ABI-encoded ETH address). Chipotle PKPs are not NFTs and have no on-chain public key lookup. Ensure the PKP public key is populated in cache during position creation.`
+      `pkpId ${pkpTokenId} is a Chipotle wallet address (ABI-encoded ETH address). Chipotle PKPs are not NFTs and have no on-chain public key lookup. Provide chipotleFallback.serviceEndpoint to recover via lit-ops-server, or ensure the PKP public key is populated in cache during position creation.`
     );
   }
   if (!provider) {
@@ -31411,7 +31462,7 @@ function extractOptionalLitSignature(raw) {
 
 // src/modules/contract/contract-manager.module.ts
 var POSITION_MANAGER_ABI = [
-  "function createPosition(bytes32 pkpId, bytes calldata validatorSignature, string mainnetVaultAddress, string regtestVaultAddress, uint256 selectedTermMonths, uint256 validatorVersion) external returns (bytes32 positionId)",
+  "function createPosition(bytes32 pkpId, bytes calldata validatorSignature, string mainnetVaultAddress, string regtestVaultAddress, uint256 selectedTermMonths, uint256 validatorVersion, bytes calldata pkpPublicKey) external returns (bytes32 positionId)",
   "function mintUCD(bytes32 positionId, uint256 mintAmount, uint256 mintFee, uint256 newDebt, uint256 newCollateral, uint256 btcPrice, bytes32 authorizedSpendsHash, bytes32 ucdDebtHash, bytes32 contractHash, uint256 quantumTimestamp, bytes calldata mintValidatorSignature) external returns (bool)",
   "function makePayment(bytes32 positionId, uint256 paymentAmount, uint256 quantumTimestamp, uint256 btcPrice, bytes calldata paymentValidatorSignature) external returns (bool)",
   "function extendPosition(bytes32 positionId, uint256 selectedTerm, uint256 quantumTimestamp, uint256 btcPrice, uint256 availableBTCBalance, uint256 proRataRenewalFee, bytes calldata extensionValidatorSignature) external returns (bool)",
@@ -33060,6 +33111,10 @@ var LoanCreator = class {
         ethers_exports.utils.hexlify(BigInt(pkpData.tokenId)),
         32
       );
+      const pkpPublicKeyUncompressed = ethers_exports.utils.computePublicKey(
+        pkpData.publicKey,
+        false
+      );
       console.log("\n\u{1F50D} PKP TOKEN ID CONVERSION TRACE (SDK):");
       console.log("==========================================");
       console.log(
@@ -33110,7 +33165,8 @@ var LoanCreator = class {
           mainnetVaultAddress,
           regtestVaultAddress,
           request.selectedTerm,
-          validatorVersion
+          validatorVersion,
+          pkpPublicKeyUncompressed
         ]);
         console.log("\u{1F50D} ENCODED CALLDATA (first 256 chars):", encoded.substring(0, 256));
         console.log("\u{1F50D} ENCODED CALLDATA full length:", encoded.length);
@@ -33123,7 +33179,8 @@ var LoanCreator = class {
         mainnetVaultAddress,
         regtestVaultAddress,
         request.selectedTerm,
-        validatorVersion
+        validatorVersion,
+        pkpPublicKeyUncompressed
       );
       if (!tx) {
         return failure(
@@ -33675,8 +33732,8 @@ var LoanQuery = class {
         batch.map(async (loan) => {
           try {
             const rawId = loan.pkpId?.startsWith("0x") ? loan.pkpId.slice(2) : loan.pkpId;
-            const isChipotlePkpId = typeof rawId === "string" && rawId.length === 40 && !rawId.toLowerCase().startsWith("04");
-            if (isChipotlePkpId) {
+            const isChipotlePkpId2 = typeof rawId === "string" && rawId.length === 40 && !rawId.toLowerCase().startsWith("04");
+            if (isChipotlePkpId2) {
               if (this.config.positionManagerCoreAddress && this.config.provider) {
                 const pmContract = new ethers_exports.Contract(
                   this.config.positionManagerCoreAddress,
@@ -36826,7 +36883,7 @@ function formatLoanCreationMessage(positionId, pkpId, vaultAddress) {
 }
 function formatBTCWithdrawalFailureMessage(withdrawalAmount, btcVault, btcDestinationAddress, loanId) {
   const formattedAmount = formatBTCAmount(withdrawalAmount);
-  return `There was a failure withdrawing ${formattedAmount} from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}`;
+  return `\u274C BTC withdrawal FAILED: ${formattedAmount} from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}`;
 }
 function formatLoanRenewalMessage(positionId, txHash) {
   return `Loan id ${positionId} was successfully renewed. Tx: https://sepolia.etherscan.io/tx/${txHash}`;
@@ -36840,9 +36897,10 @@ function formatBalanceConfirmationMessage(loanId) {
 function formatBalanceConfirmationFailureMessage(loanId) {
   return `FAILED to update to PENDING_MINT for loan id ${loanId}`;
 }
-function formatBTCWithdrawalSuccessMessage(withdrawalAmount, btcVault, btcDestinationAddress, loanId) {
+function formatBTCWithdrawalSuccessMessage(withdrawalAmount, btcVault, btcDestinationAddress, loanId, btcTxId) {
   const formattedAmount = formatBTCAmount(withdrawalAmount);
-  return `${formattedAmount} was withdrawn from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}`;
+  const txSuffix = btcTxId ? ` (tx: ${btcTxId})` : "";
+  return `\u2705 BTC withdrawal SUCCEEDED: ${formattedAmount} sent from ${btcVault} to ${btcDestinationAddress} for loan id: ${loanId}${txSuffix}`;
 }
 function formatLiquidationSkippedMessage(loanId, ratio, threshold, btcVault, btcVaultBalance, ucdDebt, btcPrice) {
   const formattedPrice = formatBTCPrice(btcPrice);
@@ -37572,6 +37630,18 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
    * Check if SDK is ready for operations
    */
   async _relayNotification(message) {
+    const handler = this.config.notificationHandler;
+    if (typeof handler === "function") {
+      try {
+        await handler(message);
+      } catch (err) {
+        if (this.config.debug) {
+          log.warn("notificationHandler threw", {
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+    }
     if (this.config.mode !== "service")
       return;
     const endpoint = this.config.serviceEndpoint;
@@ -37882,7 +37952,8 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
             pkpPublicKey = await getPKPPublicKeyFromTokenId(
               position2.pkpId,
               this.getProviderOrThrow(),
-              nagaPkpNftAddress
+              nagaPkpNftAddress,
+              this.getChipotlePublicKeyFallback()
             );
             pkpEthAddress = ethers_exports.utils.computeAddress(pkpPublicKey);
             pkpCache.set(request.positionId, {
@@ -38985,7 +39056,8 @@ Error data: ${errorData || "none"}`
           const pkpPublicKey = await getPKPPublicKeyFromTokenId(
             position.pkpId,
             this.getProviderOrThrow(),
-            nagaPkpNftAddressLiq
+            nagaPkpNftAddressLiq,
+            this.getChipotlePublicKeyFallback()
           );
           const pkpEthAddress = ethers_exports.utils.computeAddress(pkpPublicKey);
           pkpData = {
@@ -40167,7 +40239,14 @@ Error data: ${errorData || "none"}`
         LoanOperationsManagerModule: this.config.contractAddresses?.loanOperationsManager || "",
         TermManagerModule: this.config.contractAddresses?.termManager || "",
         LiquidationManagerModule: this.config.contractAddresses?.liquidationManager || "",
-        ...this.config.contractAddresses?.btcSpendAuthorizer ? { BTCSpendAuthorizer: this.config.contractAddresses.btcSpendAuthorizer } : {}
+        ...this.config.contractAddresses?.btcSpendAuthorizer ? { BTCSpendAuthorizer: this.config.contractAddresses.btcSpendAuthorizer } : {},
+        // Required on non-hardhat chains by Lit Actions after audit C-1/H-6:
+        // the Bitcoin provider whitelist now lives on-chain. Other SDK paths
+        // (mintUCD, extendPosition, withdrawBTC) already forward this; keep
+        // confirmBalance aligned so Sepolia behaves identically to Hardhat.
+        ...this.config.contractAddresses?.bitcoinProviderRegistry ? {
+          BitcoinProviderRegistry: this.config.contractAddresses.bitcoinProviderRegistry
+        } : {}
       };
       const chainId = await this.config.provider?.getNetwork().then((n) => n.chainId) || 11155111;
       const chain = chainId === 11155111 ? "sepolia" : chainId === 1337 ? "hardhat" : "sepolia";
@@ -41068,7 +41147,8 @@ Error data: ${errorData || "none"}`
             pkpPublicKey = await getPKPPublicKeyFromTokenId(
               position.pkpId,
               this.getProviderOrThrow(),
-              nagaPkpNftAddress
+              nagaPkpNftAddress,
+              this.getChipotlePublicKeyFallback()
             );
             pkpEthAddress = ethers_exports.utils.computeAddress(pkpPublicKey);
             pkpCache.set(positionId, {
@@ -41538,22 +41618,6 @@ Error data: ${errorData || "none"}`
           gasUsed: receipt.gasUsed?.toString() || "unknown"
         });
       }
-      try {
-        const position = await this.getPosition(positionId);
-        const btcAmount = (Number(withdrawalAmount) / 1e8).toFixed(8);
-        const message = formatBTCWithdrawalSuccessMessage(
-          btcAmount,
-          position?.vaultAddress || "unknown",
-          validationResponse.destinationAddress,
-          positionId
-        );
-        await this._relayNotification(message);
-      } catch (telegramError) {
-        console.error(
-          "Telegram notification failed:",
-          telegramError instanceof Error ? telegramError.message : String(telegramError)
-        );
-      }
       return {
         success: true,
         positionId,
@@ -41726,7 +41790,8 @@ Error data: ${errorData || "none"}`
           pkpPublicKey = await getPKPPublicKeyFromTokenId(
             pkpId,
             this.getProviderOrThrow(),
-            nagaPkpNftAddress
+            nagaPkpNftAddress,
+            this.getChipotlePublicKeyFallback()
           );
           pkpCache.set(request.positionId, {
             publicKey: pkpPublicKey,
@@ -41905,13 +41970,37 @@ Error data: ${errorData || "none"}`
         if (utxoListResponse.ok) {
           const utxoList = await utxoListResponse.json();
           if (Array.isArray(utxoList)) {
-            allUTXOs = utxoList.filter((u) => u.status?.confirmed === true).map((u) => ({
-              txid: u.txid,
-              vout: u.vout,
-              value: u.value,
-              // satoshis
-              scriptPubKey: derivedScriptPubKey
-            }));
+            const confirmed = utxoList.filter((u) => u.status?.confirmed === true);
+            const verified = [];
+            for (const u of confirmed) {
+              try {
+                const txResp = await fetch(`${bitcoinRpcUrl}/tx/${u.txid}`);
+                if (!txResp.ok)
+                  continue;
+                const txData = await txResp.json();
+                if (!Array.isArray(txData.vout))
+                  continue;
+                let voutIdx = u.vout;
+                const voutData = txData.vout[voutIdx];
+                const spk = voutData?.scriptpubkey || voutData?.scriptPubKey || voutData?.scriptpubkey_hex;
+                if (spk !== derivedScriptPubKey) {
+                  const correctIdx = txData.vout.findIndex(
+                    (v) => (v.scriptpubkey || v.scriptPubKey || v.scriptpubkey_hex) === derivedScriptPubKey
+                  );
+                  if (correctIdx < 0)
+                    continue;
+                  voutIdx = correctIdx;
+                }
+                verified.push({
+                  txid: u.txid,
+                  vout: voutIdx,
+                  value: txData.vout[voutIdx].value,
+                  scriptPubKey: derivedScriptPubKey
+                });
+              } catch {
+              }
+            }
+            allUTXOs = verified;
             if (this.config.debug) {
               log.info(`\u2705 Fetched ${allUTXOs.length} confirmed UTXO(s) for consolidation`, {
                 vaultAddress,
@@ -42442,6 +42531,27 @@ Error data: ${errorData || "none"}`
           txid: executionResult.txid
         });
       }
+      try {
+        const btcAmount = (Number(withdrawalAmount) / 1e8).toFixed(8);
+        const message = executionResult.success ? formatBTCWithdrawalSuccessMessage(
+          btcAmount,
+          vaultAddress,
+          withdrawalAddress,
+          positionId,
+          executionResult.txid
+        ) : formatBTCWithdrawalFailureMessage(
+          btcAmount,
+          vaultAddress,
+          withdrawalAddress,
+          positionId
+        );
+        await this._relayNotification(message);
+      } catch (telegramError) {
+        console.error(
+          "Telegram notification failed:",
+          telegramError instanceof Error ? telegramError.message : String(telegramError)
+        );
+      }
       const transfers = [
         {
           success: executionResult.success,
@@ -42849,6 +42959,19 @@ Error data: ${errorData || "none"}`
   // ============================================================================
   // PRIVATE HELPER METHODS
   // ============================================================================
+  /**
+   * Build the Chipotle service-mode fallback config for getPKPPublicKeyFromTokenId.
+   * Returns undefined in standalone mode so the helper falls back to throwing.
+   */
+  getChipotlePublicKeyFallback() {
+    if (!this.config.serviceEndpoint)
+      return void 0;
+    return {
+      serviceEndpoint: this.config.serviceEndpoint,
+      serviceAuthToken: this.config.serviceAuthToken,
+      debug: this.config.debug
+    };
+  }
   /**
    * Get provider or throw error
    */

package/dist/interfaces/chunks/config.i.d.ts

@@ -138,6 +138,19 @@ interface BaseSDKConfig {
     };
     defaultSelectedTermMonths?: number;
     temperSignaturesTest?: boolean;
+    /**
+     * Optional in-process notification sink invoked alongside the existing service-mode
+     * HTTP relay. Fires in BOTH `standalone` and `service` mode so consumers can observe
+     * lifecycle events (e.g. loan renewal, mint, payment, withdrawal) without depending
+     * on `lit-ops-server`. The SDK already emits messages via `formatLoan*Message` helpers
+     * — this hook just exposes them locally. Errors thrown by the handler are swallowed
+     * so notification failures cannot break business operations.
+     *
+     * @example
+     *   const notifications: string[] = [];
+     *   sdkConfig.notificationHandler = (msg) => { notifications.push(msg); };
+     */
+    notificationHandler?: (message: string) => void | Promise<void>;
 }
 /**
  * Service Mode Configuration

package/dist/interfaces/chunks/contract-types.i.d.ts

@@ -12,7 +12,7 @@ import type { BigNumber } from "ethers";
  * Based on contracts/src/interfaces/IPositionManager.sol
  */
 export interface PositionManager extends ethers5.Contract {
-    createPosition(pkpId: string, validatorSignature: string, mainnetVaultAddress: string, regtestVaultAddress: string, selectedTermMonths: number | BigNumber, validatorVersion: number | BigNumber): Promise<ethers5.ContractTransaction>;
+    createPosition(pkpId: string, validatorSignature: string, mainnetVaultAddress: string, regtestVaultAddress: string, selectedTermMonths: number | BigNumber, validatorVersion: number | BigNumber, pkpPublicKey: string): Promise<ethers5.ContractTransaction>;
     mintUCD(positionId: string, mintAmount: BigNumber, mintFee: BigNumber, newDebt: BigNumber, newCollateral: BigNumber, btcPrice: BigNumber, authorizedSpendsHash: string, ucdDebtHash: string, contractHash: string, quantumTimestamp: BigNumber, mintValidatorSignature: string): Promise<ethers5.ContractTransaction>;
     liquidatePosition(positionId: string, btcPrice: BigNumber, quantumTimestamp: BigNumber, liquidationValidatorSignature: string): Promise<ethers5.ContractTransaction>;
     getPosition(positionId: string): Promise<{

package/dist/modules/diamond-hands-sdk.d.ts

@@ -589,6 +589,11 @@ export declare class DiamondHandsSDK {
      *          Will be integrated into core methods in Round 2
      */
     private extractLitActionError;
+    /**
+     * Build the Chipotle service-mode fallback config for getPKPPublicKeyFromTokenId.
+     * Returns undefined in standalone mode so the helper falls back to throwing.
+     */
+    private getChipotlePublicKeyFallback;
     /**
      * Get provider or throw error
      */

package/dist/utils/mint-authorization.utils.d.ts

@@ -132,24 +132,40 @@ export declare function generatePaymentAuthorization(positionId: string, amount:
  * - LIT Action validates recovered address === position owner
  */
 export declare function generateExtendAuthorization(positionId: string, selectedTerm: number, chainId: number, signer: ethers5.Signer): Promise<ExtendOwnerAuthorization>;
+/**
+ * Optional Chipotle service fallback for `getPKPPublicKeyFromTokenId`.
+ *
+ * Chipotle PKPs have no on-chain `getPubkey(tokenId)` lookup, so when the
+ * SDK's in-memory `pkp-data` cache is empty (page reload, new device, cleared
+ * browser data) we recover the public key by re-running pkp-validator via the
+ * lit-ops-server `/api/lit/pkp/derive-public-key` endpoint. Chipotle key
+ * derivation is deterministic from `pkpId`, so this returns the same key.
+ */
+export interface ChipotleServiceFallback {
+    serviceEndpoint: string;
+    serviceAuthToken?: string;
+    borrowerAddress?: string;
+    timeoutMs?: number;
+    debug?: boolean;
+}
 /**
  * Get PKP public key from PKP token ID.
  *
- * Only valid for datil/naga-era PKPs minted as NFTs on Chronicle Yellowstone.
- * The caller must supply both the provider (connected to the PKP NFT's chain)
- * and the PKP NFT contract address for that chain.
+ * For datil/naga-era PKPs minted as NFTs on Chronicle Yellowstone: looks up
+ * via `getPubkey(tokenId)` on the supplied PKP NFT contract.
  *
- * Chipotle PKPs are wallet addresses returned by the Chipotle REST API — they
- * are not NFTs and cannot be looked up via this function. Passing a Chipotle
- * pkpId (ABI-encoded ETH address, e.g. 0x000...00<20-byte-addr>) throws an
- * explicit error so callers surface a clear diagnostic.
+ * For Chipotle PKPs (ABI-encoded ETH address): there is no on-chain lookup, so
+ * if `chipotleFallback.serviceEndpoint` is configured, the public key is
+ * derived by calling lit-ops-server. If the fallback is not configured, this
+ * throws with a clear diagnostic.
  *
  * @param pkpTokenId - PKP token ID (bytes32 hex string)
- * @param provider - Ethereum provider connected to the PKP NFT chain
- * @param pkpNftContractAddress - PKP NFT contract address on that chain (required)
+ * @param provider - Ethereum provider connected to the PKP NFT chain (datil/naga only)
+ * @param pkpNftContractAddress - PKP NFT contract address on that chain (datil/naga only)
+ * @param chipotleFallback - Service-mode fallback used when pkpTokenId is a Chipotle id
  * @returns PKP public key as hex string with '0x' prefix
  */
-export declare function getPKPPublicKeyFromTokenId(pkpTokenId: string, provider?: ethers5.providers.Provider, pkpNftContractAddress?: string): Promise<string>;
+export declare function getPKPPublicKeyFromTokenId(pkpTokenId: string, provider?: ethers5.providers.Provider, pkpNftContractAddress?: string, chipotleFallback?: ChipotleServiceFallback): Promise<string>;
 /**
  * Withdraw Owner Authorization Interface (matches lit-actions)
  */

package/dist/utils/telegram-messaging.utils.d.ts

@@ -132,7 +132,7 @@ export declare function formatBalanceConfirmationFailureMessage(loanId: string):
  * @param loanId - Position/loan ID
  * @returns Formatted message string
  */
-export declare function formatBTCWithdrawalSuccessMessage(withdrawalAmount: number | string, btcVault: string, btcDestinationAddress: string, loanId: string): string;
+export declare function formatBTCWithdrawalSuccessMessage(withdrawalAmount: number | string, btcVault: string, btcDestinationAddress: string, loanId: string, btcTxId?: string): string;
 /**
  * Format a liquidation skipped notification message
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gvnrdao/dh-sdk",
-  "version": "0.0.220",
+  "version": "0.0.222",
   "description": "TypeScript SDK for Diamond Hands Protocol - Bitcoin-backed lending with LIT Protocol PKPs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -70,8 +70,8 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@gvnrdao/dh-lit-actions": "^0.0.284",
-    "@gvnrdao/dh-lit-ops": "^0.0.256",
+    "@gvnrdao/dh-lit-actions": "^0.0.285",
+    "@gvnrdao/dh-lit-ops": "^0.0.258",
     "@noble/hashes": "^1.5.0",
     "axios": "^1.15.2",
     "bech32": "^2.0.0",