@gvnrdao/dh-sdk 0.0.271 → 0.0.272

package/dist/modules/diamond-hands-sdk.d.ts

@@ -742,6 +742,25 @@ export declare class DiamondHandsSDK {
         balanceBtc: string;
         btcPrice: string;
     }, SDKError>>;
+    /**
+     * Get a PKP-signed TOTAL confirmed Bitcoin balance for a raw vault ADDRESS
+     * (no positionId) via the `btc-address-balance` LIT Action.
+     *
+     * Exercises the balance-query path (BitcoinProviderRegistry decrypt →
+     * cross-provider consensus → PKP signature) using only an address. This is
+     * NOT a protocol trusted/available balance: authorized spends are not
+     * subtracted, and the returned signature is an `AddressBalanceAttestation`
+     * (NOT a `BalanceConfirmation` — it is not consumable by
+     * `PositionManager.updateBalance`).
+     */
+    getAddressBalance(vaultAddress: string): Promise<Result<{
+        vaultAddress: string;
+        totalBalanceSats: string;
+        totalBalanceBtc: string;
+        providerCount: number;
+        signature: string;
+        validatorPkp: string;
+    }, SDKError>>;
     /**
      * Mint mock BTC tokens (test networks only)
      *

package/dist/utils/eip712-login.d.ts

@@ -8,6 +8,8 @@ export interface DhServerLoginMessage {
     address: string;
     issuedAt: number;
     nonce: string;
+    /** Audit M-8: service endpoint URL this login targets (replay-binds to one service). */
+    audience?: string;
 }
 export interface DhServerLoginPayload {
     chainId: number;
@@ -20,8 +22,13 @@ export declare function buildLoginDomain(chainId: number): {
     chainId: number;
 };
 export declare const LOGIN_TYPES: Record<string, TypedDataField[]>;
+/** Audit M-8: login types with the audience binding. */
+export declare const LOGIN_TYPES_WITH_AUDIENCE: Record<string, TypedDataField[]>;
 /**
  * Sign a fresh login envelope. Caller POSTs the returned `payload` to the
  * server's `/api/auth/login` route.
+ *
+ * Audit M-8: pass `audience` (the service endpoint URL being logged into) to bind the login to
+ * one service. Omit it for legacy compatibility during the migration window.
  */
-export declare function buildSignedLoginPayload(signer: Signer, chainId: number): Promise<DhServerLoginPayload>;
+export declare function buildSignedLoginPayload(signer: Signer, chainId: number, audience?: string): Promise<DhServerLoginPayload>;

package/dist/utils/service-endpoint-policy.d.ts

@@ -1,7 +1,12 @@
 /**
  * Refuses to send session JWTs or signed auth payloads over plaintext HTTP
  * unless the endpoint is loopback. https://* is always allowed; http://localhost,
- * http://127.0.0.1, http://[::1], and *.localhost (with optional port/path) are
- * allowed for local development; everything else throws.
+ * http://127.0.0.1 (and the 127.0.0.0/8 range), and http://[::1] are allowed for
+ * local development; everything else throws.
+ *
+ * Audit L-10: the previous `*.localhost` wildcard was dropped. `.localhost` is reserved to
+ * loopback by RFC 6761, but not every resolver honours it strictly — a hostile or misconfigured
+ * DNS could resolve `foo.localhost` to an off-host IP and exfiltrate the cleartext token. Exact
+ * loopback literals + the numeric 127.0.0.0/8 range can't be DNS-hijacked.
  */
 export declare function assertSafeServiceEndpoint(endpoint: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gvnrdao/dh-sdk",
-  "version": "0.0.271",
+  "version": "0.0.272",
   "description": "TypeScript SDK for Diamond Hands Protocol - Bitcoin-backed lending with LIT Protocol PKPs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -81,8 +81,8 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@gvnrdao/dh-lit-actions": "^0.0.304",
-    "@gvnrdao/dh-lit-ops": "^0.0.291",
+    "@gvnrdao/dh-lit-actions": "^0.0.305",
+    "@gvnrdao/dh-lit-ops": "^0.0.292",
     "@noble/hashes": "^1.5.0",
     "axios": "^1.15.2",
     "bech32": "^2.0.0",