@gvnrdao/dh-sdk 0.0.301 → 0.0.304

package/dist/index.js

@@ -87,7 +87,8 @@ var init_deployment_addresses = __esm({
         mockUsdtToken: "0xF8b7fB38b17a310960E47805Be9adba0b0e0394D",
         PositionDelegateRegistry: "0x482369De283622E7b05731875ec137d4E3D208F9",
         FeeRecipientRegistry: "0x95795F8403DDb629E8527B2934C4e71f5fC0C374",
-        BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe"
+        BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
+        CarryAgentRegistry: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7"
       },
       upgraded: {
         PositionManager: {
@@ -349,7 +350,9 @@ var init_deployment_addresses = __esm({
         FEE_RECIPIENT_REGISTRY_IMPL: "0xd08513a7cB2dd354B26cDDf549616F12054c34c9",
         OPERATION_AUTHORIZATION_REGISTRY_IMPL: "0xe0D981B60351f0f8fFDA2b50C8180Fb37CeF3883",
         BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
-        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0xFF270BC4470dBA80430Bd1a3a66EB691599354fA"
+        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0xFF270BC4470dBA80430Bd1a3a66EB691599354fA",
+        CARRY_AGENT_REGISTRY: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7",
+        CARRY_AGENT_REGISTRY_IMPL: "0x1b11a3D5e46F3672E643c997f0d569DFf0b64a01"
       }
     };
     SEPOLIA_CONTRACTS = {
@@ -377,7 +380,8 @@ var init_deployment_addresses = __esm({
       mockUsdtToken: "0xF8b7fB38b17a310960E47805Be9adba0b0e0394D",
       PositionDelegateRegistry: "0x482369De283622E7b05731875ec137d4E3D208F9",
       FeeRecipientRegistry: "0x95795F8403DDb629E8527B2934C4e71f5fC0C374",
-      BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe"
+      BitcoinWithdrawalAddressRegistry: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
+      CarryAgentRegistry: "0x5595CB538D44E6Cf179D20364fD631D0477e69f7"
     };
     MAINNET_DEPLOYMENT = {
       network: "mainnet",
@@ -412,10 +416,12 @@ var init_deployment_addresses = __esm({
       upgraded: {
         SimplePSMV2: {
           previousImplementation: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A",
-          newImplementation: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A",
-          upgradedAt: "2026-06-16T17:53:24.979Z",
-          upgradedBy: "0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f",
-          reason: "Initial PSM deploy / artifact sync"
+          newImplementation: "0x8717761444b1822c2E6916aB5bD9ac96c91b6DF5",
+          upgradedAt: "2026-07-06T10:41:35.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x5052d1559d56b8e178699183e56c4fd84a163e987365c5af9c8d669a723c35d6 (block 25472960)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x5052d1559d56b8e178699183e56c4fd84a163e987365c5af9c8d669a723c35d6",
+          block: 25472960
         },
         CollateralManagerModule: {
           previousImplementation: "0x1919860e528Cd2AbbD31a17858c986b8aCc8C185",
@@ -430,6 +436,65 @@ var init_deployment_addresses = __esm({
           upgradedAt: "2026-07-08T20:33:59Z",
           upgradedBy: "AdminModule generic-op 0x2603a486c0f34554b864cc1d909b325c7e105331da10ec0fd7e0b9373fa76207 (3-of-5 ADMIN_ROLE Safes, 24h timelock; executed by 0xfb3B8cbeFB7D666A6Af34C53e189EdC31862a7be in tx 0x430c8e450f12d3d9359cde356ac5e2ef39661d7a89884b5674a596c1090f6cff)",
           reason: "Validator gas fix (#420): BitcoinAddressValidator packed-table lookups; VERSION 1.0.0 -> 1.0.1"
+        },
+        UCDController: {
+          newImplementation: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
+          upgradedBy: "Reconciled from chain \u2014 Upgraded event log unavailable; provenance omitted (never fabricated)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)"
+        },
+        PositionManagerCoreModule: {
+          previousImplementation: "0x6C8b0FB93F8d0239254aefaC24d4264cA2F8AAeB",
+          newImplementation: "0x5067Ea1d40b2Aaf4ad693bD9b6e7463C1A29E849",
+          upgradedAt: "2026-07-06T08:02:35.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xeb2bfe77d46394b6d0afd46beb0a80cd9beb91f6771ccb59ff9fba27d4af4f3d (block 25472167)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xeb2bfe77d46394b6d0afd46beb0a80cd9beb91f6771ccb59ff9fba27d4af4f3d",
+          block: 25472167
+        },
+        LiquidationManagerModule: {
+          previousImplementation: "0xc2f4517eeD7c4c516939a64c7938a6ab432D99c4",
+          newImplementation: "0xe7444C1d9652dAb31BaAdBE4C7c7e7Df3515dA46",
+          upgradedAt: "2026-07-06T10:40:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xc173b97af68cc9172ea0ddc91a2c90bf02eac1505e749d92aa044aa69891f48c (block 25472956)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xc173b97af68cc9172ea0ddc91a2c90bf02eac1505e749d92aa044aa69891f48c",
+          block: 25472956
+        },
+        BTCSpendAuthorizer: {
+          previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
+          newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+          upgradedAt: "2026-07-06T10:40:59.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
+          block: 25472957
+        },
+        PositionManager: {
+          previousImplementation: "0x9f52BaBB40FbFC5863e45B1A4014cB433950c684",
+          newImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+          upgradedAt: "2026-07-06T08:42:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6 (block 25472368)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6",
+          block: 25472368
+        },
+        LoanOperationsManagerModule: {
+          previousImplementation: "0x56671D671e492Dae625413d463D47605Cf54edf6",
+          newImplementation: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
+          upgradedAt: "2026-07-06T10:41:23.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x327ae9f7a3917788d22dfe95611e1afcd18583f210b03a119d9f04eca50b9e7a (block 25472959)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x327ae9f7a3917788d22dfe95611e1afcd18583f210b03a119d9f04eca50b9e7a",
+          block: 25472959
+        },
+        OperationAuthorizationRegistry: {
+          previousImplementation: "0x327662917Ac8EEda47851d74AF6A151348636fCe",
+          newImplementation: "0x493118746840EDB2D396E71632D2E774CA14070e",
+          upgradedAt: "2026-07-06T10:41:47.000Z",
+          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0x9820e259700865a281b8376e248044048ba2fed1d17c811ac66ac54d36711a5b (block 25472961)",
+          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
+          executeTx: "0x9820e259700865a281b8376e248044048ba2fed1d17c811ac66ac54d36711a5b",
+          block: 25472961
         }
       },
       latestEnv: {
@@ -442,9 +507,37 @@ var init_deployment_addresses = __esm({
         BITCOIN_PROVIDER_REGISTRY: "0x4ab3Fb96e02893Ed6FAa61bad1918390c8DbbFFC",
         BITCOIN_PROVIDER_REGISTRY_IMPL: "0x7Bc9473E45fb3EA594e8b13992F57D0444902ddB",
         BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0xf667f77FDba7458345f227eB6Bfe4148243E7270",
-        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x11731bFEC3068F2cc19D016381dfEA3B93013b1C",
+        BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x190c08300Ae650fb88ed8156445BBeb13bE9E8a3",
         SIMPLE_PSM_V2: "0xfE0C14B4E614f40Bf58845b4B04CeD17fd116532",
-        SIMPLE_PSM_V2_IMPL: "0x1a555FB8D6EDdF755a4575E541651EdB8B49a15A"
+        SIMPLE_PSM_V2_IMPL: "0x8717761444b1822c2E6916aB5bD9ac96c91b6DF5",
+        UCD_CONTROLLER: "0x4b4f8063048bCD59D469219E3f07C6aaDF4f6157",
+        UCD_CONTROLLER_IMPL: "0x28B8cAB89D89B3F83581FD2290de2Ce84535bd0A",
+        UCD_TOKEN: "0xaAaB6B05E5EecB015898483d4e6703d7F218850b",
+        UCD_TOKEN_IMPL: "0x5f09C660036021D7e916DF47234C24a2536C3A72",
+        POSITION_MANAGER_CORE_MODULE: "0xd895B685914c1BE4e1c7aab9f89a90c203DE8d22",
+        POSITION_MANAGER_CORE_MODULE_IMPL: "0x5067Ea1d40b2Aaf4ad693bD9b6e7463C1A29E849",
+        TERM_MANAGER_MODULE: "0xDB99CdF883ffa38acD099bC39F8d1f4508c9239E",
+        TERM_MANAGER_MODULE_IMPL: "0x971f63f92990e59270E971612dd399fF2C63B0c3",
+        COLLATERAL_MANAGER_MODULE: "0x2Eb74FEc478218f5C260aAc78Bb8eC297F9d7135",
+        COLLATERAL_MANAGER_MODULE_IMPL: "0x55110B9dd6B2c9f812564e7a1ef42b3c76E1A3Bb",
+        LIQUIDATION_MANAGER_MODULE: "0x74B28695352E7bf736D6c9F76ccb7B4439477De9",
+        LIQUIDATION_MANAGER_MODULE_IMPL: "0xe7444C1d9652dAb31BaAdBE4C7c7e7Df3515dA46",
+        CIRCUIT_BREAKER_MODULE: "0xF7b545d3a4Ee056D06909AB367E2F7bFFE3cB1BC",
+        CIRCUIT_BREAKER_MODULE_IMPL: "0x40e8328D61342C6ADC51dfdC723296c908f95038",
+        ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
+        ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
+        BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+        POSITION_MANAGER_VIEWS: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER_VIEWS_IMPL: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
+        POSITION_MANAGER_IMPL: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+        LOAN_OPERATIONS_MANAGER_MODULE: "0x2561974A40F1AEed1251d0A090A83cF8536FB9E9",
+        LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
+        UPGRADE_VALIDATOR: "0xC46Ae71F22e3741A6CF46E399aE914C4868fEbed",
+        UPGRADE_VALIDATOR_IMPL: "0x4f835e77D1211299a1cbb8Aa2b42d9B390cC95CA",
+        OPERATION_AUTHORIZATION_REGISTRY: "0xD4505645b724754f5170a2027804a4265e860d44",
+        OPERATION_AUTHORIZATION_REGISTRY_IMPL: "0x493118746840EDB2D396E71632D2E774CA14070e"
       }
     };
     MAINNET_CONTRACTS = {
@@ -475,44 +568,44 @@ var init_deployment_addresses = __esm({
     LOCALHOST_DEPLOYMENT = {
       network: "localhost",
       chainId: 31337,
-      timestamp: "2026-03-23T15:33:34.068Z",
+      timestamp: "2026-06-11T12:30:59.589Z",
       deployer: "",
       contracts: {
-        MessageHashBuilder: "0xE6E340D132b5f46d1e472DebcD681B2aBc16e57E",
-        UpgradeValidator: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+        MessageHashBuilder: "0x1613beB3B2C4f22Ee086B2b38C1476A3cE7f78E8",
+        UpgradeValidator: "0x610178dA211FEF7D417bC0e6FeD39F05609AD788",
         UCDToken: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
         UCDController: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-        PositionManagerCoreModule: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-        TermManagerModule: "0x0DCd1Bf9A1b36cE34237eEaFef220932846BCD82",
-        LoanOperationsManagerModule: "0x68B1D87F95878fE05B998F19b66F4baba5De1aed",
+        PositionManagerCoreModule: "0xA51c1fc2f0D1a1b8494Ed1FE312d7C3a78Ed91C0",
+        TermManagerModule: "0x9A676e781A523b5d0C0e43731313A708CB607508",
+        LoanOperationsManagerModule: "0x3Aa5ebB10DC797CAC828524e59A333d0A371443c",
         BTCSpendAuthorizer: "0x59b670e9fA9D0A427751Af201D676719a970857b",
         CollateralManagerModule: "0xa85233C63b9Ee964Add6F2cffe00Fd84eb32338f",
         LiquidationManagerModule: "0x7a2088a1bFc9d81c55368AE168C2C02570cB814F",
-        CircuitBreakerModule: "0x0B306BF915C4d645ff596e518fAf3F9669b97016",
+        CircuitBreakerModule: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
         AdminModule: "0xc5a5C42992dECbae36851359345FE25997F5C42d",
-        PositionManagerViews: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
-        PositionManager: "0x84eA74d481Ee0A5332c457a4d796187F6Ba67fEB",
-        OperationAuthorizationRegistry: "0x7969c5eD335650692Bc04293B07F5BF2e7A673C0",
-        PKPValidation: "0xcbEAF3BDe82155F56486Fb5a1072cb8baAf547cc"
+        PositionManagerViews: "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE",
+        PositionManager: "0xf5059a5D33d5853360D16C683c16e67980206f36",
+        OperationAuthorizationRegistry: "0xF8e31cb472bc70500f08Cd84917E5A1912Ec8397",
+        PKPValidation: "0xc0F115A19107322cFBf1cDBC7ea011C19EbDB4F8"
       }
     };
     LOCALHOST_CONTRACTS = {
-      MessageHashBuilder: "0xE6E340D132b5f46d1e472DebcD681B2aBc16e57E",
-      UpgradeValidator: "0x8A791620dd6260079BF849Dc5567aDC3F2FdC318",
+      MessageHashBuilder: "0x1613beB3B2C4f22Ee086B2b38C1476A3cE7f78E8",
+      UpgradeValidator: "0x610178dA211FEF7D417bC0e6FeD39F05609AD788",
       UCDToken: "0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512",
       UCDController: "0xCf7Ed3AccA5a467e9e704C703E8D87F634fB0Fc9",
-      PositionManagerCoreModule: "0xB7f8BC63BbcaD18155201308C8f3540b07f84F5e",
-      TermManagerModule: "0x0DCd1Bf9A1b36cE34237eEaFef220932846BCD82",
-      LoanOperationsManagerModule: "0x68B1D87F95878fE05B998F19b66F4baba5De1aed",
+      PositionManagerCoreModule: "0xA51c1fc2f0D1a1b8494Ed1FE312d7C3a78Ed91C0",
+      TermManagerModule: "0x9A676e781A523b5d0C0e43731313A708CB607508",
+      LoanOperationsManagerModule: "0x3Aa5ebB10DC797CAC828524e59A333d0A371443c",
       BTCSpendAuthorizer: "0x59b670e9fA9D0A427751Af201D676719a970857b",
       CollateralManagerModule: "0xa85233C63b9Ee964Add6F2cffe00Fd84eb32338f",
       LiquidationManagerModule: "0x7a2088a1bFc9d81c55368AE168C2C02570cB814F",
-      CircuitBreakerModule: "0x0B306BF915C4d645ff596e518fAf3F9669b97016",
+      CircuitBreakerModule: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
       AdminModule: "0xc5a5C42992dECbae36851359345FE25997F5C42d",
-      PositionManagerViews: "0x959922bE3CAee4b8Cd9a407cc3ac1C251C2007B1",
-      PositionManager: "0x84eA74d481Ee0A5332c457a4d796187F6Ba67fEB",
-      OperationAuthorizationRegistry: "0x7969c5eD335650692Bc04293B07F5BF2e7A673C0",
-      PKPValidation: "0xcbEAF3BDe82155F56486Fb5a1072cb8baAf547cc"
+      PositionManagerViews: "0x9A9f2CCfdE556A7E9Ff0848998Aa4a0CFD8863AE",
+      PositionManager: "0xf5059a5D33d5853360D16C683c16e67980206f36",
+      OperationAuthorizationRegistry: "0xF8e31cb472bc70500f08Cd84917E5A1912Ec8397",
+      PKPValidation: "0xc0F115A19107322cFBf1cDBC7ea011C19EbDB4F8"
     };
     ALL_DEPLOYMENTS = {
       sepolia: SEPOLIA_DEPLOYMENT,
@@ -1204,30 +1297,30 @@ var require_pkg_src = __commonJS({
         }
       },
       btcTransactionSigner: {
-        cid: "QmcPG9C5Yx9JGrBKCfSVWbKuiRXn8XFwb91yNxQqY4VSJD",
+        cid: "QmSJkQAw5SJ39EGEwzWZJ39ApNN4834VgKS5rhm25YCgfk",
         authorizedCidHex: cidToHex(
-          "QmcPG9C5Yx9JGrBKCfSVWbKuiRXn8XFwb91yNxQqY4VSJD"
+          "QmSJkQAw5SJ39EGEwzWZJ39ApNN4834VgKS5rhm25YCgfk"
         ),
         name: "Btc Transaction Signer",
         description: "Production Btc Transaction Signer",
-        version: "1.0.1",
+        version: "1.1.1",
         deployed: true,
-        deployedAt: 1783451891948,
-        size: 43688,
-        hash: "1ea0f0ac66cc68fc9b098dabb3c5e3ba96c25f13b133b95a06eac477028fdb1a"
+        deployedAt: 1784316496778,
+        size: 63679,
+        hash: "b12aa725797af5ef07f8e6945f05741f583d6e479a4670b1121e97c58fe63191"
       },
       ucdMintValidator: {
-        cid: "QmPir8F8jmJ4ssQpEC3xFxkEnZxMHcgS6VxBQE1jkTLj5K",
+        cid: "QmYVRMfiSC641JPbE819szSDw3YrG6uSrZc27CZkyYTGtW",
         authorizedCidHex: cidToHex(
-          "QmPir8F8jmJ4ssQpEC3xFxkEnZxMHcgS6VxBQE1jkTLj5K"
+          "QmYVRMfiSC641JPbE819szSDw3YrG6uSrZc27CZkyYTGtW"
         ),
         name: "Ucd Mint Validator",
         description: "Production Ucd Mint Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542207366,
-        size: 72074,
-        hash: "567a51d3beaedbda4f0af2636835ca8a2af89c2264e91f8dc31f522c1a424b7b",
+        deployedAt: 1784316505431,
+        size: 80381,
+        hash: "132a0a8e6e9a1b85d02e00c0e57eaa371d825717255a28c9e644e4b521760026",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x041ab17cd91fc5c0b761eea6092d032807561b621b82c488826776e04a9158d61ba64d809a4729f0501289d980732cb06d8dfd06999dd9c8efd2f495dad78b31bb",
@@ -1235,17 +1328,17 @@ var require_pkg_src = __commonJS({
         }
       },
       processPaymentValidator: {
-        cid: "QmVq19NXJEpMMvaWQdsU5czLoqh28WGWoGgKMSYFaCmfa9",
+        cid: "QmadmdFDH6sS7YLusUuuLkkt7n51iUj1bJ5KKTLhmro2iQ",
         authorizedCidHex: cidToHex(
-          "QmVq19NXJEpMMvaWQdsU5czLoqh28WGWoGgKMSYFaCmfa9"
+          "QmadmdFDH6sS7YLusUuuLkkt7n51iUj1bJ5KKTLhmro2iQ"
         ),
         name: "Process Payment Validator",
         description: "Production Process Payment Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542209526,
-        size: 68239,
-        hash: "ada27fea57aa3f3b861c49e75ed1f80b72500fdccc1d6e88ee1a3c1396b81867",
+        deployedAt: 1784316520125,
+        size: 76534,
+        hash: "dbdf43d3f1636e0ee883d349ca28f24c5c38ed7e062b76ca75498aaf5fe594ea",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x04cfccb9b6c7addc79469c0e9fafebef4c70801302c62cdb26b610723a9b8527d23f98a40158c7340d83fd0e62d02b5ec74c12f7a86d98e8c6973b4811110f19ad",
@@ -1253,17 +1346,17 @@ var require_pkg_src = __commonJS({
         }
       },
       extendPositionValidator: {
-        cid: "QmP2u3bgKLtfqsFMp6Li72zMY8ZZH3ttAqp9W2wwonUmcb",
+        cid: "QmespREceysQ7WPqGKg1VpHB3hf8zsreMY8HSjiQ2xoAN4",
         authorizedCidHex: cidToHex(
-          "QmP2u3bgKLtfqsFMp6Li72zMY8ZZH3ttAqp9W2wwonUmcb"
+          "QmespREceysQ7WPqGKg1VpHB3hf8zsreMY8HSjiQ2xoAN4"
         ),
         name: "Extend Position Validator",
         description: "Production Extend Position Validator",
-        version: "1.0.1",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542211640,
-        size: 66543,
-        hash: "0db666fa2888e9acea13d8e4d79edd4ca252f5a4bb06d97e53aa14a9a34b7143",
+        deployedAt: 1784316534278,
+        size: 74352,
+        hash: "c17bfc9abef16f2372316a14c14281e2acc98afdd1662d095360f1d1c5383f1d",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x04e52338f6a0c3362800f1a94c4c8f08be5030dde0fa217388c53d1c1a4790f4443c9f2886b2d2d8f4b75a9a156e9b028011b1a1cf7648da0e556aa980ec692836",
@@ -1271,17 +1364,17 @@ var require_pkg_src = __commonJS({
         }
       },
       btcWithdrawal: {
-        cid: "QmXtmLdGuEqMKKAtV7d8sHpUV32Kt74na4dRQdpWLasbHJ",
+        cid: "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2",
         authorizedCidHex: cidToHex(
-          "QmXtmLdGuEqMKKAtV7d8sHpUV32Kt74na4dRQdpWLasbHJ"
+          "QmYG1o9qMBZsEMDE9DNsJMzQmvxfj6jTu9V37WwuJZAtC2"
         ),
         name: "Btc Withdrawal",
         description: "Production Btc Withdrawal",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542212709,
-        size: 79782,
-        hash: "e824eb473df8eba3a025ac3adc46730dbf89f90884d7c05a78cc07b90d6bc4df",
+        deployedAt: 1784316549409,
+        size: 90692,
+        hash: "ca7276763142fe1fc812b70f6319973000faf338a91c531f898f8f6406035c64",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -1289,17 +1382,17 @@ var require_pkg_src = __commonJS({
         }
       },
       liquidationValidator: {
-        cid: "QmVicBXuZVY8t4DXLPjvXjzLqnBtnogAh5HT7BaL9VeDwF",
+        cid: "QmZJnGq2HEYW1XYZPSodyRCrbDhTcLDT8x4z76EiPg8Xcx",
         authorizedCidHex: cidToHex(
-          "QmVicBXuZVY8t4DXLPjvXjzLqnBtnogAh5HT7BaL9VeDwF"
+          "QmZJnGq2HEYW1XYZPSodyRCrbDhTcLDT8x4z76EiPg8Xcx"
         ),
         name: "Liquidation Validator",
         description: "Production Liquidation Validator",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542213421,
-        size: 58444,
-        hash: "0f42e9f8984433fef95875d35eb3c8d985e7ce15ad309e6aa1093d6fd1ba0bb5",
+        deployedAt: 1784316560010,
+        size: 66523,
+        hash: "f74d0163c47d7db04d1547f72c3a9bc1e5b499669089cc6464479a361462ce81",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x041a241de58976c13e3d7ca5a18e494f7330151e3818706135d50176e78ffb673e58b11f0b67a87c73fade6c6b27d6e7a7377ea9f4c10bf31880f1d725f18cc6f8",
@@ -1325,17 +1418,17 @@ var require_pkg_src = __commonJS({
         }
       },
       loanVaultBtcBalance: {
-        cid: "QmUmqL4LcjDSpw2TtuWMcw8xYk8hPxgagY2qHDU8Mx1PLG",
+        cid: "QmVKSkgY8e5X6v6yRD4H2wpU2oX2kbeKYh4fjPepg71mqu",
         authorizedCidHex: cidToHex(
-          "QmUmqL4LcjDSpw2TtuWMcw8xYk8hPxgagY2qHDU8Mx1PLG"
+          "QmVKSkgY8e5X6v6yRD4H2wpU2oX2kbeKYh4fjPepg71mqu"
         ),
         name: "Loan Vault Btc Balance",
         description: "Production Loan Vault Btc Balance",
-        version: "1.0.0",
+        version: "1.2.1",
         deployed: true,
-        deployedAt: 1781542215432,
-        size: 48397,
-        hash: "da3750a70e532b87f3590a3e2d8c2d51e700589f6e111bb291384ab01304af35",
+        deployedAt: 1784316574669,
+        size: 56477,
+        hash: "917535f2911055b2ade2204fd868dd8b7294c7ade23e82aea488aeb0872e35d7",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x043616787c5432415c24378c4ef48de2bcd6bb7b575b837e3cff09171802662da7105d79586c7659677a0ecbaddac4cce06cb2a11f69a16fa0c4d7002ac7d51a4d",
@@ -1349,17 +1442,17 @@ var require_pkg_src = __commonJS({
       // Requires BitcoinProviderRegistry.addAllowedCid(chainId, keccak256(utf8(cid)))
       // on each target chain (the action decrypts registry slots). No OAR entry.
       btcAddressBalance: {
-        cid: "QmWRDAg7ZCBFFhGfdXR7aUtQsG5qqBb1yVdLCxh8dPD7G5",
+        cid: "QmcYFLDbhQArk5gQK44Xj8CnYEAbnaNsei92sUHpRuFmZA",
         authorizedCidHex: cidToHex(
-          "QmWRDAg7ZCBFFhGfdXR7aUtQsG5qqBb1yVdLCxh8dPD7G5"
+          "QmcYFLDbhQArk5gQK44Xj8CnYEAbnaNsei92sUHpRuFmZA"
         ),
         name: "Btc Address Balance",
         description: "Address-only signed total BTC balance via registry consensus (no positionId, no price)",
-        version: "0.1.0",
+        version: "0.2.1",
         deployed: true,
-        deployedAt: 1781542217452,
-        size: 25519,
-        hash: "000e2f8bdbccdc95b0db0fb3f12412e2e76eea16a8456d37914d324437ae291c",
+        deployedAt: 1784316590403,
+        size: 26986,
+        hash: "49fb14265f3208916f12806df04492900bd08fb1b14d9651ee6278cd9ae4a428",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x0498cbb31facfa26e3ec83ccdabfe4fe341ca0282e0c3cb81da7113723b9726e1e49efa92165cc3faa66ced4454cea56dbab12267852d6525a55d7c4f128b912cd",
@@ -1393,17 +1486,17 @@ var require_pkg_src = __commonJS({
         hash: "03ee5be239c91c735d2c95db89a0d1b77e602cfc18af8eb64b3281fddcd90a72"
       },
       staleSpendRecoveryValidator: {
-        cid: "QmWqJZqoKUqMaGTXe9WUSwdDyeBwXJ9dnR3ioFnVK4RkN5",
+        cid: "QmcLrhiM1JwVi5w3QFxBYi1V4DaFT3Kk9MhPywyMnTsEwK",
         authorizedCidHex: cidToHex(
-          "QmWqJZqoKUqMaGTXe9WUSwdDyeBwXJ9dnR3ioFnVK4RkN5"
+          "QmcLrhiM1JwVi5w3QFxBYi1V4DaFT3Kk9MhPywyMnTsEwK"
         ),
         name: "Stale Spend Recovery Validator",
         description: "Production Stale Spend Recovery Validator",
-        version: "1.0.0",
+        version: "1.1.2",
         deployed: true,
-        deployedAt: 1781542219438,
-        size: 34413,
-        hash: "26b11730cf5d9eb4af0b1fe65192d26ccee50369c0472211a0ea11e26ef51cc5",
+        deployedAt: 1784316604502,
+        size: 36785,
+        hash: "28bfe44970541fefe3bae8bd54f25e8775d7cc61b5832a40ba1c18587b6b6358",
         validatorWalletAddress: "0x82DB9F515957aA380B596C6eA2Bd30CEF181f236",
         pkp: {
           publicKey: "0x046da0ad6da7dd4a0063cbeac6f2bdb6a9889c2178b23470833356a8ee5630f7f0eee0db348d9d9aaaadd23eccf0063c8f68ee5e446abe30b882bf1de4c932bc21",
@@ -2191,6 +2284,20 @@ ${errorReport}`);
       /* REGTEST */
       // Local development
     };
+    var CHAIN_TO_CHAIN_ID = {
+      [
+        "ethereum"
+        /* ETHEREUM */
+      ]: 1,
+      [
+        "sepolia"
+        /* SEPOLIA */
+      ]: 11155111,
+      [
+        "hardhat"
+        /* HARDHAT */
+      ]: 1337
+    };
     function validateChain(chain) {
       const normalized = chain.toLowerCase().trim();
       if (normalized === "sepolia") {
@@ -2487,6 +2594,27 @@ ${errorReport}`);
     function createProtocolParametersModule(config) {
       return new ProtocolParametersModule(config);
     }
+    function parseVaultAddress(rawVaultAddress, chain) {
+      try {
+        const parsed = JSON.parse(rawVaultAddress);
+        if (typeof parsed === "object" && parsed !== null) {
+          const chainLower = chain.toLowerCase();
+          if (chainLower === "sepolia") {
+            return parsed.regtest || parsed.testnet || parsed.mainnet;
+          }
+          const bitcoinNetwork = getBitcoinNetworkForChain(chain);
+          if (bitcoinNetwork === "regtest") {
+            return parsed.regtest || parsed.testnet || parsed.mainnet;
+          }
+          if (bitcoinNetwork === "testnet") {
+            return parsed.testnet || parsed.regtest || parsed.mainnet;
+          }
+          return parsed.mainnet;
+        }
+      } catch (e) {
+      }
+      return rawVaultAddress;
+    }
     var VaultSnapshotModule = class {
       constructor(config) {
         this.config = config;
@@ -2594,112 +2722,11 @@ ${errorReport}`);
           timestamp: Date.now()
         };
       }
-      /**
-       * Fast vault snapshot using balance method only (no UTXO validation)
-       * This is optimized for speed and should be used when UTXO details are not needed.
-       *
-       * WARNING: This method skips UTXO validation. Use ONLY for non-critical operations.
-       * For authorization/security operations, ALWAYS use getVaultSnapshot().
-       *
-       * @param positionId - Position to snapshot
-       * @returns Complete VaultSnapshot with all metrics (using fast balance method)
-       */
-      async getVaultSnapshotFast(positionId) {
-        const positionState = await this.queryPositionState(positionId);
-        console.log(
-          `[Vault Snapshot] Raw vault address from contract: "${positionState.vaultAddress}"`
-        );
-        const useStubbedBtcData = this.config.debugOverrides?.useStubbedBtcData === true;
-        const [balanceResult, btcPriceUsd] = useStubbedBtcData ? this.buildStubbedBtcSnapshotInputs(positionState) : await Promise.all([
-          this.config.vaultBalance.calculateTrustedBalance(
-            positionId,
-            positionState.vaultAddress,
-            true
-            // Always skip UTXO validation for fast path
-          ),
-          this.config.priceOracle.getBTCPrice()
-        ]);
-        const protocolParams = createProtocolParametersModule({
-          termManagerAddress: this.config.termManagerAddress,
-          loanOpsManagerAddress: this.config.loanOpsManagerAddress,
-          liquidationManagerAddress: this.config.liquidationManagerAddress,
-          chain: this.config.chain,
-          chainId: this.config.chainId || 1,
-          // Default to mainnet if not provided
-          rpcUrl: this.config.rpcUrl
-        });
-        const termForFees = this.config.termOverride ?? positionState.selectedTerm;
-        const [liquidationThresholdBps, maxEscalatedThresholdBps, termFees] = await Promise.all([
-          protocolParams.getLiquidationThreshold(),
-          protocolParams.getMaxEscalatedThreshold(),
-          protocolParams.getTermFees(termForFees)
-        ]);
-        const termStatus = calculateTermStatus(
-          positionState.termStartTimestamp,
-          positionState.selectedTerm
-        );
-        const currentLiquidationThreshold = calculateLiquidationThreshold(
-          termStatus.isExpired,
-          termStatus.daysIntoGracePeriod,
-          liquidationThresholdBps,
-          maxEscalatedThresholdBps
-        );
-        const collateralMetrics = calculateCollateralMetrics(
-          balanceResult.availableBalance,
-          btcPriceUsd,
-          positionState.ucdDebt
-        );
-        const isLiquidatable = collateralMetrics.collateralRatioBps < currentLiquidationThreshold;
-        const marginToLiquidationBps = collateralMetrics.collateralRatioBps - currentLiquidationThreshold;
-        return {
-          // Raw state
-          positionId: positionState.positionId,
-          pkpId: positionState.pkpId,
-          borrower: positionState.borrower,
-          vaultAddress: positionState.vaultAddress,
-          ucdDebt: positionState.ucdDebt,
-          termStartTimestamp: positionState.termStartTimestamp,
-          selectedTerm: positionState.selectedTerm,
-          status: positionState.status,
-          // Loan status enum value (0-7)
-          expiryAt: positionState.expiryAt,
-          // Loan expiry timestamp
-          previousExpiryAt: positionState.previousExpiryAt,
-          // expiryAt before last renewal; 0 if never renewed
-          totalTerm: positionState.totalTerm,
-          // total accumulated loan months; 0 before first renewal
-          lastRenewedAt: positionState.lastRenewedAt,
-          // timestamp of most recent renewal; createdAt at origination; 0 for pre-H-5 positions
-          // Bitcoin state
-          totalBTCSats: balanceResult.totalBalance,
-          totalUTXOs: balanceResult.totalUTXOs,
-          authorizedSpendsSats: balanceResult.authorizedBalance,
-          authorizedSpendsHash: balanceResult.authorizedSpendsHash,
-          availableBTCSats: balanceResult.availableBalance,
-          availableUTXOs: balanceResult.availableUTXOs,
-          // Price data
-          btcPriceUsd,
-          // Calculated metrics
-          collateralValueUsd: collateralMetrics.collateralValueUsd,
-          collateralRatioBps: collateralMetrics.collateralRatioBps,
-          // Term status
-          termDurationDays: termStatus.termDurationDays,
-          termLengthDays: termStatus.termLengthDays,
-          isExpired: termStatus.isExpired,
-          daysUntilExpiry: termStatus.daysUntilExpiry,
-          daysIntoGracePeriod: termStatus.daysIntoGracePeriod,
-          // Liquidation risk
-          currentLiquidationThreshold,
-          isLiquidatable,
-          marginToLiquidationBps,
-          // Protocol parameters (from smart contracts)
-          liquidationThresholdBps,
-          originationFeeBps: termFees.originationFeeBps,
-          extensionFeeBps: termFees.extensionFeeBps,
-          // Metadata
-          timestamp: Date.now()
-        };
-      }
+      // NOTE (remediation P1/#5): `getVaultSnapshotFast` — a snapshot built on the
+      // skip-UTXO-validation balance path — was deleted. It had zero callers, and
+      // a snapshot whose balance skipped UTXO validation + consensus must never
+      // exist within reach of a signing flow. Every snapshot now runs the full
+      // validation path above.
       buildStubbedBtcSnapshotInputs(positionState) {
         const stubbedAvailableBtcSats = BigInt(
           this.config.debugOverrides?.stubbedAvailableBtcSats ?? "10000000"
@@ -2828,14 +2855,20 @@ ${errorReport}`);
           expiryAt,
           selectedTermMonths
         );
+        const parsedVaultAddress = parseVaultAddress(
+          position.vaultAddress,
+          validateChain(this.config.chain)
+        );
+        if (typeof parsedVaultAddress !== "string" || parsedVaultAddress.length === 0) {
+          throw new Error(
+            `Position ${positionIdBytes32} vaultAddress has no entry for chain "${this.config.chain}"`
+          );
+        }
         return {
           positionId: position.positionId,
           pkpId: position.pkpId,
           borrower: position.borrower,
-          vaultAddress: this.parseVaultAddress(
-            position.vaultAddress,
-            validateChain(this.config.chain)
-          ),
+          vaultAddress: parsedVaultAddress,
           ucdDebt: BigInt(position.ucdDebt.toString()),
           termStartTimestamp,
           selectedTerm: selectedTermMonths,
@@ -2846,36 +2879,8 @@ ${errorReport}`);
           lastRenewedAt
         };
       }
-      /**
-       * Parse vault address based on format and network
-       *
-       * Supports two formats:
-       * 1. Single string: "mqM3ZR2N6DzZkafSdFqxEAkWovAU3uYTAN"
-       * 2. JSON object: {"mainnet":"bc1q...","testnet":"mqM3ZR2N6DzZkafSdFqxEAkWovAU3uYTAN"}
-       *
-       * @param rawVaultAddress Raw vault address from contract
-       * @param chain EVM chain (sepolia, ethereum)
-       * @returns Parsed Bitcoin address for the appropriate network
-       */
-      parseVaultAddress(rawVaultAddress, chain) {
-        try {
-          const parsed = JSON.parse(rawVaultAddress);
-          if (typeof parsed === "object" && parsed !== null) {
-            const chainLower = chain.toLowerCase();
-            if (chainLower === "sepolia") {
-              return parsed.regtest || parsed.testnet || parsed.mainnet;
-            }
-            const bitcoinNetwork = getBitcoinNetworkForChain(chain);
-            if (bitcoinNetwork === "testnet") {
-              return parsed.testnet || parsed.regtest || parsed.mainnet;
-            } else {
-              return parsed.mainnet;
-            }
-          }
-        } catch (e) {
-        }
-        return rawVaultAddress;
-      }
+      // parseVaultAddress moved to `modules/vault-address.ts` (shared with the
+      // phase-2 signer for the P6/#7b vault-identity binding).
       /**
        * Quick check if position is liquidatable
        *
@@ -3213,6 +3218,13 @@ ${auth.clientId}`;
           return {};
       }
     }
+    function assertSaneSatoshis(value, context) {
+      if (!Number.isSafeInteger(value) || value < 0 || value > MAX_BTC_AMOUNT) {
+        throw new Error(
+          `${context}: satoshi value ${value} is not a sane amount (must be an integer in [0, ${MAX_BTC_AMOUNT}])`
+        );
+      }
+    }
     var BitcoinDataProvider = class {
       constructor(config) {
         this.config = config;
@@ -3359,13 +3371,16 @@ ${auth.clientId}`;
           address
         );
         const utxos = unspentOutputs.map(
-          (utxo) => ({
-            txid: utxo.txid,
-            vout: utxo.vout,
-            satoshis: BigInt(Math.round(utxo.amount * 1e8)),
-            // BTC to satoshis as bigint
-            confirmations: utxo.confirmations
-          })
+          (utxo) => {
+            const satNumber = Math.round(utxo.amount * 1e8);
+            assertSaneSatoshis(satNumber, `fetchUTXOsFromRPC ${utxo.txid}:${utxo.vout}`);
+            return {
+              txid: utxo.txid,
+              vout: utxo.vout,
+              satoshis: BigInt(satNumber),
+              confirmations: utxo.confirmations
+            };
+          }
         );
         return utxos;
       }
@@ -3407,6 +3422,7 @@ ${auth.clientId}`;
               "Invalid UTXO row: missing txid, vout/n, or value/satoshis"
             );
           }
+          assertSaneSatoshis(satRaw, `parseBlockstreamUTXOs ${txid}:${vout}`);
           utxos.push({
             txid,
             vout,
@@ -3585,7 +3601,10 @@ ${auth.clientId}`;
               `Invalid response: missing required fields. funded_txo_sum: ${fundedTxoSum}, spent_txo_sum: ${spentTxoSum}`
             );
           }
+          assertSaneSatoshis(fundedTxoSum, `getBalance ${cleanAddress} funded_txo_sum`);
+          assertSaneSatoshis(spentTxoSum, `getBalance ${cleanAddress} spent_txo_sum`);
           const confirmedBalance = fundedTxoSum - spentTxoSum;
+          assertSaneSatoshis(confirmedBalance, `getBalance ${cleanAddress} confirmed balance`);
           const balance = BigInt(confirmedBalance);
           this.logger.log("3", `Balance: ${balance.toString()} sats`);
           this.logger.log(
@@ -4064,20 +4083,590 @@ ${auth.clientId}`;
         return priceWith8Decimals;
       }
     };
+    var MAX_CLASSIFIED_PARENTS = 5;
+    var CLASSIFICATION_CONCURRENCY = 2;
+    var CONFIRMATION_SKEW_TOLERANCE = 3;
+    async function mapWithConcurrency(items, limit, fn) {
+      const results = new Array(items.length);
+      let next = 0;
+      const workers = Array.from(
+        { length: Math.min(limit, items.length) },
+        async () => {
+          while (true) {
+            const i = next++;
+            if (i >= items.length) {
+              return;
+            }
+            results[i] = await fn(items[i]);
+          }
+        }
+      );
+      await Promise.all(workers);
+      return results;
+    }
+    function findOutputClaimMismatch(claimedUtxos, outputs, cleanVaultAddress) {
+      for (const claim of claimedUtxos) {
+        const output = outputs.find((o) => o.index === claim.vout);
+        if (!output) {
+          return `claimed output ${claim.txid}:${claim.vout} not present in parent tx`;
+        }
+        if (output.scriptpubkey_address !== cleanVaultAddress) {
+          return `claimed output ${claim.txid}:${claim.vout} pays ${output.scriptpubkey_address ?? "<no address>"}, not the vault`;
+        }
+        if (output.value === void 0 || output.value !== claim.satoshis) {
+          return `claimed output ${claim.txid}:${claim.vout} value ${output.value?.toString() ?? "<missing>"} != reported ${claim.satoshis.toString()}`;
+        }
+      }
+      return null;
+    }
+    function stripNetworkPrefix(address) {
+      const prefixPattern = /^(REGTEST_|TESTNET_|MAINNET_)/;
+      return address.replace(prefixPattern, "");
+    }
+    var VaultBalanceConsensus = class {
+      /**
+       * @param minConsensusProviders Policy floor (`policy.minConsensusProviders`,
+       *   remediation P1/#1). Both consensus passes THROW when fewer providers are
+       *   configured than the floor demands — below it the cross-checks cannot run
+       *   and neither trusting the primary (inflation) nor excluding UTXOs
+       *   (deflation → wrongful liquidation) is a safe direction. A floor of 1
+       *   (hardhat / single-provider sepolia) preserves the trust-primary /
+       *   exclude-unconfirmed baseline unchanged.
+       */
+      constructor(primaryProvider, providerConfigs, minConsensusProviders) {
+        this.primaryProvider = primaryProvider;
+        this.providerConfigs = providerConfigs;
+        this.minConsensusProviders = minConsensusProviders;
+        this.readers = this.buildReaders();
+      }
+      /**
+       * Fail-closed floor check shared by both consensus passes. Only floors above
+       * 1 can bite: a floor of 1 with zero configs means "no esplora access
+       * configured" (dev/test), where the documented pre-gate behaviour —
+       * trust-primary confirmed set, exclude unconfirmed — remains correct.
+       */
+      assertProviderFloor(pass) {
+        const configured = this.providerConfigs?.length ?? 0;
+        if (this.minConsensusProviders > 1 && configured < this.minConsensusProviders) {
+          throw new Error(
+            `${pass}: this chain requires at least ${this.minConsensusProviders} Bitcoin providers for consensus; ${configured} configured. Refusing to proceed without cross-check.`
+          );
+        }
+      }
+      /**
+       * Build one data reader per configured provider (primary first). Index 0
+       * reuses the injected primary instance; the rest are constructed from their
+       * configs so cross-check reads hit the right endpoint. Null when no providers
+       * are configured — both passes then fall back to primary-only behaviour.
+       */
+      buildReaders() {
+        const configs = this.providerConfigs;
+        if (!configs || configs.length === 0) {
+          return null;
+        }
+        return configs.map(
+          (cfg, i) => i === 0 ? this.primaryProvider : new BitcoinDataProvider({
+            providerUrl: cfg.providerUrl,
+            auth: cfg.auth,
+            ...cfg.timeout ? { timeout: cfg.timeout } : {}
+          })
+        );
+      }
+      /**
+       * Confirmed-UTXO-set consensus across every registered provider (strict).
+       *
+       * The signed balance is dominated by the primary's confirmed UTXOs, but the
+       * UTXO set — txid, vout, and value — is read only from the primary; the
+       * `assertBitcoinBalanceConsensus` check the validators run compares
+       * `chain_stats` totals, not individual outpoints. So a compromised primary
+       * can add a fabricated confirmed UTXO, or inflate a real one's value, and the
+       * balance consensus still passes (it serves honest `chain_stats`). This
+       * closes that: each UTXO the primary reports at or above `minConfirmations`
+       * must be present with the EXACT same value on every registered provider.
+       *
+       * Semantics:
+       *  - Absent on any provider, or value mismatch → THROW (fail-closed). Confirmed
+       *    transactions are fully propagated, so absence is unambiguous forgery, not
+       *    a race.
+       *  - Present + value-matched everywhere: the UTXO counts as confirmed only if
+       *    it meets `minConfirmations` on ALL providers (gated on the minimum
+       *    reported depth). A UTXO just past the boundary on the primary but a block
+       *    behind on a lagging provider is DEMOTED — excluded until it matures —
+       *    rather than signed over. A depth spread beyond CONFIRMATION_SKEW_TOLERANCE
+       *    is not benign skew but a provider lying about depth (to inflate a shallow
+       *    UTXO past the gate, or deflate a deep one into a wrongful liquidation) →
+       *    THROW.
+       *  - SYMMETRIC (finding #6): a confirmed outpoint any secondary reports that
+       *    the primary omits entirely, reports with a different value, or reports
+       *    at a depth more than the skew tolerance BELOW the secondary's → THROW.
+       *    Without this, a compromised primary deflates the balance by omission and
+       *    forces a wrongful liquidation.
+       *
+       * Below `minConsensusProviders` this THROWS (P1/#1). With a floor of 1 and
+       * 0/1 providers configured, no cross-check is possible and the primary's
+       * confirmed UTXOs are returned unchanged (behaviour identical to before
+       * this gate).
+       *
+       * Cross-checking `chain_stats` totals against the confirmed-UTXO sum was
+       * considered and rejected: `getBalance` reads mempool-blind `chain_stats`
+       * while `getUTXOSet` removes mempool-spent outputs, so the two legitimately
+       * diverge during any pending spend — precisely the self-change window — and
+       * that comparison would false-fail there. Outpoint-set consensus asserts
+       * agreement only on confirmed outpoints, which the mempool does not touch.
+       *
+       * @returns Set of "txid:vout" keys admitted as confirmed-with-consensus.
+       */
+      async confirmedUtxoConsensus(primaryUtxos, vaultAddress, minConfirmations) {
+        const providerConfigs = this.providerConfigs;
+        const readers = this.readers;
+        this.assertProviderFloor("confirmedUtxoConsensus");
+        const confirmedKeys = /* @__PURE__ */ new Set();
+        const primaryConfirmed = primaryUtxos.filter(
+          (utxo) => utxo.confirmations >= minConfirmations
+        );
+        for (const utxo of primaryConfirmed) {
+          confirmedKeys.add(`${utxo.txid}:${utxo.vout}`);
+        }
+        if (!providerConfigs || providerConfigs.length <= 1 || !readers) {
+          return confirmedKeys;
+        }
+        const providerName = (i) => providerConfigs[i].name || providerConfigs[i].providerUrl;
+        const settled = await Promise.allSettled(
+          readers.slice(1).map((reader) => reader.getUTXOSet(vaultAddress, minConfirmations))
+        );
+        const failures = settled.map((r, i) => ({ r, name: providerName(i + 1) })).filter(
+          (x) => x.r.status === "rejected"
+        ).map(
+          ({ r, name }) => `${name} \u2192 ${r.reason?.message ?? String(r.reason)}`
+        );
+        if (failures.length > 0) {
+          throw new Error(
+            `Confirmed UTXO set read failed for ${vaultAddress} on ${failures.length}/${providerConfigs.length - 1} secondary provider(s): ${failures.join("; ")}`
+          );
+        }
+        const secondaryMaps = settled.map((r) => {
+          const map2 = /* @__PURE__ */ new Map();
+          for (const utxo of r.value.utxos) {
+            map2.set(`${utxo.txid}:${utxo.vout}`, {
+              value: utxo.satoshis,
+              confirmations: utxo.confirmations
+            });
+          }
+          return map2;
+        });
+        const demoted = [];
+        for (const utxo of primaryConfirmed) {
+          const key = `${utxo.txid}:${utxo.vout}`;
+          let minConfs = utxo.confirmations;
+          let maxConfs = utxo.confirmations;
+          for (let s = 0; s < secondaryMaps.length; s++) {
+            const entry = secondaryMaps[s].get(key);
+            const name = providerName(s + 1);
+            if (!entry) {
+              throw new Error(
+                `Confirmed UTXO ${key} present on ${providerName(0)} but absent on ${name}; refusing to sign (possible fabricated UTXO).`
+              );
+            }
+            if (entry.value !== utxo.satoshis) {
+              throw new Error(
+                `Confirmed UTXO ${key} value mismatch: ${providerName(0)}=${utxo.satoshis.toString()} vs ${name}=${entry.value.toString()}; refusing to sign.`
+              );
+            }
+            if (entry.confirmations < minConfs)
+              minConfs = entry.confirmations;
+            if (entry.confirmations > maxConfs)
+              maxConfs = entry.confirmations;
+          }
+          if (maxConfs - minConfs > CONFIRMATION_SKEW_TOLERANCE) {
+            throw new Error(
+              `Confirmed UTXO ${key} confirmation spread ${maxConfs - minConfs} exceeds tolerance ${CONFIRMATION_SKEW_TOLERANCE} (min ${minConfs}, max ${maxConfs}); providers disagree on depth, refusing to sign.`
+            );
+          }
+          if (minConfs < minConfirmations) {
+            confirmedKeys.delete(key);
+            demoted.push(key);
+          }
+        }
+        if (demoted.length > 0) {
+          litDebugLog(
+            `[VaultBalance] confirmed-consensus: ${demoted.length} UTXO(s) demoted pending provider tip skew (excluded until matured): ${demoted.join(", ")}`
+          );
+        }
+        const primaryByKey = new Map(
+          primaryUtxos.map((utxo) => [`${utxo.txid}:${utxo.vout}`, utxo])
+        );
+        for (let s = 0; s < secondaryMaps.length; s++) {
+          const name = providerName(s + 1);
+          for (const [key, entry] of secondaryMaps[s]) {
+            if (entry.confirmations < minConfirmations)
+              continue;
+            const primaryUtxo = primaryByKey.get(key);
+            if (!primaryUtxo) {
+              throw new Error(
+                `Confirmed UTXO ${key} present on ${name} (${entry.confirmations} confs) but absent on ${providerName(0)}; refusing to sign (possible omitted UTXO / balance deflation \u2014 may be transient during an in-flight vault spend).`
+              );
+            }
+            if (primaryUtxo.satoshis !== entry.value) {
+              throw new Error(
+                `Confirmed UTXO ${key} value mismatch: ${providerName(0)}=${primaryUtxo.satoshis.toString()} vs ${name}=${entry.value.toString()}; refusing to sign.`
+              );
+            }
+            if (entry.confirmations - primaryUtxo.confirmations > CONFIRMATION_SKEW_TOLERANCE) {
+              throw new Error(
+                `Confirmed UTXO ${key} depth disagreement: ${providerName(0)}=${primaryUtxo.confirmations} vs ${name}=${entry.confirmations} exceeds tolerance ${CONFIRMATION_SKEW_TOLERANCE}; the primary may be under-reporting depth to suppress collateral, refusing to sign.`
+              );
+            }
+          }
+        }
+        return confirmedKeys;
+      }
+      /**
+       * Classify unconfirmed UTXOs as protocol self-change.
+       *
+       * A UTXO below minConfirmations counts as confirmed-equivalent ONLY when the
+       * transaction that created it spends exclusively vault-owned, confirmed
+       * outputs. Such a transaction can only have been signed by the vault's PKP,
+       * so no third party can RBF-replace or double-spend it — the reversal risk
+       * the confirmation gate exists to close does not apply. Any non-vault input,
+       * unconfirmed funding tx, or coinbase input disqualifies the UTXO
+       * (fail-safe: exclusion, never inclusion).
+       *
+       * Multi-provider consensus (audit C-1/C-2 parity): the parent-tx proof is
+       * verified independently against EVERY configured provider and admitted
+       * only on unanimity. The confirmed-balance consensus the validators run
+       * covers `chain_stats` only, so without this the primary provider alone
+       * could fabricate an unconfirmed UTXO plus a self-consistent parent proof
+       * and inflate the signed balance. Any provider failure or verdict
+       * disagreement THROWS (fail-closed) — exclusion on a suppressed proof
+       * would deflate the balance and open a wrongful-liquidation window, so
+       * neither direction may proceed without agreement.
+       *
+       * The same per-provider `/tx` fetch also returns the parent's outputs, and
+       * every provider must corroborate each claimed UTXO (index, vault address,
+       * exact value) before admission — the UTXO list itself comes only from the
+       * primary, so an unchecked claim would let it attach a fabricated or
+       * inflated output to a genuine self-spend.
+       *
+       * Fetch cost: zero when every UTXO is confirmed (the common case); otherwise
+       * per provider: one tx lookup per classified parent (vins + vouts in one
+       * response), plus per distinct funding tx a confirmation check and — only
+       * when the provider omits vin prevout data — an output lookup. Classified
+       * parents are capped at MAX_CLASSIFIED_PARENTS (largest claimed value
+       * first, deterministic) and evaluated CLASSIFICATION_CONCURRENCY at a time,
+       * so third-party dust spam cannot amplify into provider rate-limiting and
+       * an action-wide outage.
+       *
+       * See docs/vault-balance-confirmed-gate-plan-2026-07-14.md §3.1.
+       *
+       * @param utxos - Full UTXO set for the vault address
+       * @param vaultAddress - Bitcoin address of the vault (may carry network prefix)
+       * @param minConfirmations - Confirmation threshold for the chain
+       * @returns Set of "txid:vout" keys for UTXOs verified as self-change
+       */
+      async classifySelfChange(utxos, vaultAddress, minConfirmations) {
+        const providerConfigs = this.providerConfigs;
+        const readers = this.readers;
+        const selfChange = /* @__PURE__ */ new Set();
+        const unconfirmed = utxos.filter(
+          (utxo) => utxo.confirmations < minConfirmations
+        );
+        if (unconfirmed.length === 0) {
+          return selfChange;
+        }
+        this.assertProviderFloor("classifySelfChange");
+        if (!providerConfigs || providerConfigs.length === 0 || !readers) {
+          litDebugLog(
+            `[VaultBalance] ${unconfirmed.length} unconfirmed UTXO(s) excluded: no bitcoinProviderConfigs for self-change classification`
+          );
+          return selfChange;
+        }
+        const cleanVaultAddress = stripNetworkPrefix(vaultAddress);
+        const claimsByParent = /* @__PURE__ */ new Map();
+        for (const utxo of unconfirmed) {
+          const claims = claimsByParent.get(utxo.txid) ?? [];
+          claims.push(utxo);
+          claimsByParent.set(utxo.txid, claims);
+        }
+        const claimedSum = (txid) => claimsByParent.get(txid).reduce((sum, utxo) => sum + utxo.satoshis, 0n);
+        const rankedParents = [...claimsByParent.keys()].sort((a, b) => {
+          const diff = claimedSum(b) - claimedSum(a);
+          if (diff !== 0n) {
+            return diff > 0n ? 1 : -1;
+          }
+          return a < b ? -1 : a > b ? 1 : 0;
+        });
+        const parentTxids = rankedParents.slice(0, MAX_CLASSIFIED_PARENTS);
+        const skippedParents = rankedParents.length - parentTxids.length;
+        if (skippedParents > 0) {
+          litDebugLog(
+            `[VaultBalance] self-change: ${skippedParents} parent tx(s) beyond the ${MAX_CLASSIFIED_PARENTS}-parent classification budget excluded (mempool-spam bound; largest claimed value classified first)`
+          );
+        }
+        const verdicts = await mapWithConcurrency(
+          parentTxids,
+          CLASSIFICATION_CONCURRENCY,
+          async (parentTxid) => ({
+            parentTxid,
+            verified: await this.verifyParentIsSelfSpendConsensus(
+              parentTxid,
+              claimsByParent.get(parentTxid),
+              cleanVaultAddress,
+              minConfirmations,
+              providerConfigs,
+              readers
+            )
+          })
+        );
+        const verifiedParents = new Set(
+          verdicts.filter((v) => v.verified).map((v) => v.parentTxid)
+        );
+        for (const utxo of unconfirmed) {
+          if (verifiedParents.has(utxo.txid)) {
+            selfChange.add(`${utxo.txid}:${utxo.vout}`);
+          }
+        }
+        if (verifiedParents.size > 0) {
+          litDebugLog(
+            `[VaultBalance] self-change: ${selfChange.size}/${unconfirmed.length} unconfirmed UTXO(s) verified as protocol change by ${providerConfigs.length} provider(s)`
+          );
+        }
+        return selfChange;
+      }
+      /**
+       * Run the self-spend proof against every configured provider and require
+       * unanimity. Fail-closed: a provider request failure or a verdict
+       * disagreement throws and aborts the balance calculation — see
+       * classifySelfChange for why exclusion is not a safe fallback here.
+       *
+       * When the parent IS a unanimous self-spend, every provider's view of the
+       * parent's OUTPUTS must additionally corroborate the primary's claimed
+       * UTXOs (index exists, pays the vault, exact value). Without this, a
+       * compromised primary could attach a fabricated or value-inflated output
+       * to a genuine self-spend the honest providers happily verify.
+       *
+       * @returns True when every provider verified the parent and corroborated
+       *          the claimed outputs, false when every provider rejected the
+       *          parent (genuine third-party deposit)
+       */
+      async verifyParentIsSelfSpendConsensus(parentTxid, claimedUtxos, cleanVaultAddress, minConfirmations, providerConfigs, readers) {
+        const providerName = (i) => providerConfigs[i].name || providerConfigs[i].providerUrl;
+        const settled = await Promise.allSettled(
+          providerConfigs.map(
+            (cfg, i) => this.evaluateParentForProvider(
+              parentTxid,
+              claimedUtxos,
+              cleanVaultAddress,
+              minConfirmations,
+              readers[i],
+              cfg
+            )
+          )
+        );
+        const failures = settled.map((r, i) => ({ r, name: providerName(i) })).filter(
+          (x) => x.r.status === "rejected"
+        ).map(
+          ({ r, name }) => `${name} \u2192 ${r.reason?.message ?? String(r.reason)}`
+        );
+        if (failures.length > 0) {
+          throw new Error(
+            `Self-change classification failed for tx ${parentTxid} on ${failures.length}/${providerConfigs.length} provider(s): ${failures.join("; ")}`
+          );
+        }
+        const evaluations = settled.map(
+          (r) => r.value
+        );
+        const votes = evaluations.map((e) => e.selfSpend);
+        const disagreements = votes.map((vote, i) => ({ vote, name: providerName(i) })).filter((x) => x.vote !== votes[0]).map(
+          (x) => `${providerName(0)}=${votes[0]} vs ${x.name}=${x.vote}`
+        );
+        if (disagreements.length > 0) {
+          throw new Error(
+            `Self-change consensus mismatch for tx ${parentTxid}: ${disagreements.join("; ")}. A provider may be compromised or out of sync; refusing to sign.`
+          );
+        }
+        if (!votes[0]) {
+          return false;
+        }
+        const outputMismatches = evaluations.map((e, i) => e.outputMismatch ? `${providerName(i)} \u2192 ${e.outputMismatch}` : null).filter((m) => m !== null);
+        if (outputMismatches.length > 0) {
+          throw new Error(
+            `Self-change output claim mismatch for tx ${parentTxid}: ${outputMismatches.join("; ")}. The reported UTXO set contradicts the parent transaction; refusing to sign.`
+          );
+        }
+        return true;
+      }
+      /**
+       * Single provider's evaluation of a parent tx: the self-spend proof plus —
+       * when the proof holds — corroboration of the claimed outputs against this
+       * provider's view of the parent's vout set. The output check is skipped for
+       * non-self-spend parents (their UTXOs are excluded regardless, and a
+       * third-party deposit's values are not ours to police).
+       */
+      async evaluateParentForProvider(parentTxid, claimedUtxos, cleanVaultAddress, minConfirmations, reader, providerConfig) {
+        const parentTx = await this.fetchParentTransaction(
+          parentTxid,
+          providerConfig
+        );
+        if (!parentTx || parentTx.inputs.length === 0) {
+          return { selfSpend: false, outputMismatch: null };
+        }
+        const selfSpend = await this.verifyInputsAreSelfSpend(
+          parentTx.inputs,
+          cleanVaultAddress,
+          minConfirmations,
+          reader
+        );
+        const outputMismatch = selfSpend ? findOutputClaimMismatch(claimedUtxos, parentTx.outputs, cleanVaultAddress) : null;
+        return { selfSpend, outputMismatch };
+      }
+      /**
+       * Verify that a transaction's inputs spend exclusively vault-owned,
+       * confirmed outputs, using a single provider's view of the chain.
+       *
+       * @param inputs - Parsed inputs of the parent transaction
+       * @param cleanVaultAddress - Vault address with network prefix stripped
+       * @param minConfirmations - Required depth for every funding transaction
+       * @param reader - Data provider for funding-tx lookups (same provider the inputs came from)
+       * @returns True only when every input is a confirmed, vault-owned outpoint
+       */
+      async verifyInputsAreSelfSpend(inputs, cleanVaultAddress, minConfirmations, reader) {
+        const fundingTxids = [...new Set(inputs.map((input) => input.txid))];
+        const outputsByFundingTx = /* @__PURE__ */ new Map();
+        const needsOutputLookup = fundingTxids.filter(
+          (fundingTxid) => inputs.some(
+            (input) => input.txid === fundingTxid && input.prevoutAddress === void 0
+          )
+        );
+        await Promise.all(
+          needsOutputLookup.map(async (fundingTxid) => {
+            outputsByFundingTx.set(
+              fundingTxid,
+              await reader.getTransactionOutputs(fundingTxid)
+            );
+          })
+        );
+        for (const input of inputs) {
+          let ownerAddress = input.prevoutAddress;
+          if (ownerAddress === void 0) {
+            const outputs = outputsByFundingTx.get(input.txid);
+            ownerAddress = outputs?.find(
+              (output) => output.index === input.vout
+            )?.scriptpubkey_address;
+          }
+          if (ownerAddress !== cleanVaultAddress) {
+            return false;
+          }
+        }
+        const fundingStatuses = await Promise.all(
+          fundingTxids.map((fundingTxid) => reader.getTransaction(fundingTxid))
+        );
+        for (const status of fundingStatuses) {
+          if (!status || status.confirmations < minConfirmations) {
+            return false;
+          }
+        }
+        return true;
+      }
+      /**
+       * Fetch a parent transaction's inputs (vins) and outputs (vouts) via Esplora.
+       *
+       * A module-private fetch (not a `BitcoinDataProvider` method) so editing this
+       * consensus logic does not rebundle the shared provider module's other
+       * importers — see this file's header for the ripple-set constraint.
+       *
+       * @param txid - Transaction ID
+       * @param providerConfig - Esplora endpoint to query (one of the configured
+       *          consensus providers)
+       * @returns Parsed inputs + outputs, or null ONLY when the tx is provably not
+       *          a self-spend candidate (coinbase-funded). Provider inability —
+       *          404, malformed vin rows, missing vin array — THROWS (review
+       *          2026-07-15 P1): the parent of a UTXO the primary lists must
+       *          exist, so "can't fetch it" is a provider failure, and treating it
+       *          as a false self-change vote would silently deflate collateral
+       *          (wrongful-liquidation direction) if every provider failed the
+       *          same way.
+       */
+      async fetchParentTransaction(txid, providerConfig) {
+        if (!providerConfig.providerUrl) {
+          return null;
+        }
+        const timeout = providerConfig.timeout || 15e3;
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        try {
+          const response = await fetch(`${providerConfig.providerUrl}/tx/${txid}`, {
+            signal: controller.signal,
+            headers: await authHeaders(providerConfig.auth, timeout)
+          });
+          if (!response.ok) {
+            if (response.status === 404) {
+              throw new Error(
+                `parent tx ${txid} not found on this provider \u2014 cannot verify the self-change proof`
+              );
+            }
+            throw new Error(
+              `Bitcoin provider error: ${response.status} ${response.statusText}`
+            );
+          }
+          const data = await response.json();
+          if (!data.vin || !Array.isArray(data.vin) || data.vin.length === 0) {
+            throw new Error(
+              `provider returned tx ${txid} without a vin array \u2014 malformed response`
+            );
+          }
+          const inputs = [];
+          for (const vin of data.vin) {
+            if (vin.is_coinbase) {
+              return null;
+            }
+            if (vin.txid === void 0 || vin.vout === void 0) {
+              throw new Error(
+                `provider returned tx ${txid} with a malformed vin row (missing txid/vout)`
+              );
+            }
+            inputs.push({
+              txid: vin.txid,
+              vout: vin.vout,
+              prevoutAddress: vin.prevout?.scriptpubkey_address
+            });
+          }
+          const outputs = Array.isArray(data.vout) ? data.vout.map((vout, index) => ({
+            index,
+            scriptpubkey_address: vout?.scriptpubkey_address,
+            value: typeof vout?.value === "number" ? BigInt(vout.value) : void 0
+          })) : [];
+          return { inputs, outputs };
+        } catch (error) {
+          if (isAbortError(error)) {
+            throw new Error(`Request timeout after ${timeout}ms`);
+          }
+          throw error;
+        } finally {
+          clearTimeout(timeoutId);
+        }
+      }
+    };
     var VaultBalanceModule = class {
       constructor(config) {
+        if (!Number.isInteger(config.minConfirmations) || config.minConfirmations < 1) {
+          throw new Error(
+            `VaultBalanceModule: minConfirmations must be a positive integer (got ${config.minConfirmations}). Pass the policy-derived balance-confirmation threshold \u2014 there is no default.`
+          );
+        }
         this.config = config;
         this.bitcoinProvider = config.bitcoinProvider;
       }
       /**
-       * Calculate balance (fast path - no UTXO validation)
+       * Calculate balance (arithmetic only - no UTXO validation)
        *
-       * Fast balance-only calculation that skips UTXO validation.
-       * Uses simple arithmetic: Total Balance - Authorized Balance = Available Balance
+       * Balance-only calculation: Total Balance - Authorized Balance = Available.
        *
-       * Use this when you only need the balance amount and don't need:
-       * - Individual UTXO details
-       * - Validation that authorized UTXOs were actually spent
+       * ⚠️ SECURITY (remediation P1/#5): this result skips UTXO validation, the
+       * confirmed-consensus gate, and self-change proofing. It must NEVER feed a
+       * signed BalanceConfirmation or any authorization decision. No production
+       * action calls it (the `skipUTXOValidation` fast path that used to route
+       * here was deleted); it exists for read-only diagnostics and tests. Adding
+       * a production caller requires Master sign-off.
        *
        * @param positionId - The position ID to check
        * @param vaultAddress - Bitcoin address of the vault
@@ -4124,17 +4713,18 @@ ${auth.clientId}`;
        * 1. Authorized transaction not found on network (not broadcasted)
        * 2. Authorized transaction has insufficient confirmations (network updating)
        *
+       * NOTE: the `skipUTXOValidation` fast path was removed (remediation P1/#5).
+       * Every trusted-balance read runs full UTXO validation + consensus; a
+       * balance that skipped validation must never feed a signed
+       * BalanceConfirmation.
+       *
        * @param positionId - The position ID to check
        * @param vaultAddress - Bitcoin address of the vault
-       * @param skipUTXOValidation - If true, use fast balance-only path (skips UTXO validation)
        * @returns Complete breakdown of vault balance
        * @throws Error if authorized spends are in invalid state
        */
-      async calculateTrustedBalance(positionId, vaultAddress, skipUTXOValidation) {
-        if (skipUTXOValidation) {
-          return await this.calculateBalance(positionId, vaultAddress);
-        }
-        const minConfirmations = this.config.minConfirmations || 6;
+      async calculateTrustedBalance(positionId, vaultAddress) {
+        const minConfirmations = this.config.minConfirmations;
         const utxoSet = await this.bitcoinProvider.getUTXOSet(
           vaultAddress,
           minConfirmations
@@ -4154,8 +4744,25 @@ ${auth.clientId}`;
           (sum, spend) => sum + spend.satoshis,
           0n
         );
+        const consensus = new VaultBalanceConsensus(
+          this.bitcoinProvider,
+          this.config.bitcoinProviderConfigs,
+          // Absent ⇒ 1: dev/test constructions without a policy keep the
+          // single-provider baseline; validators pass policy.minConsensusProviders.
+          this.config.minConsensusProviders ?? 1
+        );
+        const confirmedConsensusKeys = await consensus.confirmedUtxoConsensus(
+          utxoSet.utxos,
+          vaultAddress,
+          minConfirmations
+        );
+        const selfChangeKeys = await consensus.classifySelfChange(
+          utxoSet.utxos,
+          vaultAddress,
+          minConfirmations
+        );
         const availableUTXOs = utxoSet.utxos.filter(
-          (utxo) => !this.isUTXOAuthorized(utxo, authorizedSpends)
+          (utxo) => (confirmedConsensusKeys.has(`${utxo.txid}:${utxo.vout}`) || selfChangeKeys.has(`${utxo.txid}:${utxo.vout}`)) && !this.isUTXOAuthorized(utxo, authorizedSpends)
         );
         const availableBalance = availableUTXOs.reduce(
           (sum, utxo) => sum + utxo.satoshis,
@@ -4387,6 +4994,76 @@ ${auth.clientId}`;
     function createVaultBalanceModule(config) {
       return new VaultBalanceModule(config);
     }
+    var POLICY_BY_CHAIN = {
+      [
+        "hardhat"
+        /* HARDHAT */
+      ]: {
+        chain: "hardhat",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "hardhat"
+          /* HARDHAT */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "hardhat"
+          /* HARDHAT */
+        ],
+        allowArbitraryBitcoinProvider: true,
+        allowArbitraryEvmRpc: true,
+        allowDevSinglePriceProvider: true,
+        minBitcoinBalanceConfirmations: 1,
+        minBitcoinSpendConfirmations: 1,
+        minConsensusProviders: 1
+      },
+      [
+        "sepolia"
+        /* SEPOLIA */
+      ]: {
+        chain: "sepolia",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "sepolia"
+          /* SEPOLIA */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "sepolia"
+          /* SEPOLIA */
+        ],
+        allowArbitraryBitcoinProvider: false,
+        allowArbitraryEvmRpc: false,
+        allowDevSinglePriceProvider: false,
+        minBitcoinBalanceConfirmations: 1,
+        minBitcoinSpendConfirmations: 1,
+        minConsensusProviders: 1
+      },
+      [
+        "ethereum"
+        /* ETHEREUM */
+      ]: {
+        chain: "ethereum",
+        chainId: CHAIN_TO_CHAIN_ID[
+          "ethereum"
+          /* ETHEREUM */
+        ],
+        bitcoinNetwork: CHAIN_TO_BITCOIN_NETWORK[
+          "ethereum"
+          /* ETHEREUM */
+        ],
+        allowArbitraryBitcoinProvider: false,
+        allowArbitraryEvmRpc: false,
+        allowDevSinglePriceProvider: false,
+        minBitcoinBalanceConfirmations: 6,
+        minBitcoinSpendConfirmations: 6,
+        minConsensusProviders: 2
+      }
+    };
+    function getChainPolicy(chain) {
+      const validated = validateChain(chain);
+      const policy = POLICY_BY_CHAIN[validated];
+      if (!policy) {
+        throw new Error(`No chain policy registered for "${chain}"`);
+      }
+      return policy;
+    }
     async function executeVaultSnapshot(params) {
       global.ethers = {
         ...import_ethers16.ethers,
@@ -4431,7 +5108,7 @@ ${auth.clientId}`;
         // Default to mainnet if not provided
         rpcUrl: params.rpcUrl,
         bitcoinProvider,
-        minConfirmations: params.minConfirmations || 6
+        minConfirmations: params.minConfirmations ?? getChainPolicy(params.chain).minBitcoinBalanceConfirmations
       });
       const vaultSnapshot = createVaultSnapshotModule({
         contractAddress: params.contractAddress,
@@ -4665,7 +5342,8 @@ function getSepoliaConfig() {
       contractVersionRegistry: SEPOLIA_CONTRACTS.ContractVersionRegistry || "",
       feeRecipientRegistry: SEPOLIA_CONTRACTS.FeeRecipientRegistry || "",
       positionDelegateRegistry: SEPOLIA_CONTRACTS.PositionDelegateRegistry || "",
-      bitcoinWithdrawalAddressRegistry: SEPOLIA_CONTRACTS.BitcoinWithdrawalAddressRegistry || ""
+      bitcoinWithdrawalAddressRegistry: SEPOLIA_CONTRACTS.BitcoinWithdrawalAddressRegistry || "",
+      carryAgentRegistry: SEPOLIA_CONTRACTS.CarryAgentRegistry || ""
     },
     subgraphs: {
       // Lazy getter for the same module-init snapshot reason as serviceEndpoint.
@@ -4705,7 +5383,8 @@ function getMainnetConfig() {
       contractVersionRegistry: MAINNET_CONTRACTS.ContractVersionRegistry || "",
       feeRecipientRegistry: MAINNET_CONTRACTS.FeeRecipientRegistry || "",
       positionDelegateRegistry: MAINNET_CONTRACTS.PositionDelegateRegistry || "",
-      bitcoinWithdrawalAddressRegistry: MAINNET_CONTRACTS.BitcoinWithdrawalAddressRegistry || ""
+      bitcoinWithdrawalAddressRegistry: MAINNET_CONTRACTS.BitcoinWithdrawalAddressRegistry || "",
+      carryAgentRegistry: MAINNET_CONTRACTS.CarryAgentRegistry || ""
     },
     subgraphs: {
       diamondHandsUrl: "https://gateway-arbitrum.network.thegraph.com/api/subgraphs/id/CCTPsdYqco2jChDLLBQTbdJWwoukVoMt1cXeR9ti6r9A"
@@ -5824,26 +6503,144 @@ async function buildSignedLoginPayload(signer, chainId, audience) {
   return { chainId, message, signature };
 }
 
+// src/utils/server-session-store.ts
+var REAUTH_WINDOW_SECONDS = 24 * 60 * 60;
+var SAFETY_MARGIN_SECONDS = 5 * 60;
+var STORE_PREFIX = "dh-server-session:";
+function sessionStoreKey(address, chainId, endpoint) {
+  return STORE_PREFIX + `${address.trim().toLowerCase()}:${chainId}:${endpoint.replace(/\/+$/, "")}`;
+}
+function isPayloadShape(value) {
+  return !!value && typeof value === "object" && typeof value.chainId === "number" && typeof value.signature === "string" && !!value.message && typeof value.message.address === "string" && typeof value.message.issuedAt === "number" && typeof value.message.nonce === "string";
+}
+function isPersistedShape(value) {
+  return !!value && typeof value === "object" && value.version === 1 && typeof value.address === "string" && typeof value.chainId === "number" && typeof value.endpoint === "string" && isPayloadShape(value.payload) && (value.token === void 0 || typeof value.token === "string") && (value.tokenExpiresAt === void 0 || typeof value.tokenExpiresAt === "number");
+}
+var LocalStorageSessionStore = class {
+  load(key) {
+    let raw;
+    try {
+      raw = window.localStorage.getItem(key);
+    } catch {
+      return null;
+    }
+    if (!raw)
+      return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      this.clear(key);
+      return null;
+    }
+    if (!isPersistedShape(parsed)) {
+      this.clear(key);
+      return null;
+    }
+    return parsed;
+  }
+  save(key, session) {
+    try {
+      window.localStorage.setItem(key, JSON.stringify(session));
+    } catch {
+    }
+  }
+  clear(key) {
+    try {
+      window.localStorage.removeItem(key);
+    } catch {
+    }
+  }
+};
+var MemorySessionStore = class {
+  entries = /* @__PURE__ */ new Map();
+  load(key) {
+    return this.entries.get(key) ?? null;
+  }
+  save(key, session) {
+    this.entries.set(key, session);
+  }
+  clear(key) {
+    this.entries.delete(key);
+  }
+};
+function localStorageUsable() {
+  try {
+    if (typeof window === "undefined" || !window.localStorage)
+      return false;
+    const probe = "__dh_server_session_probe__";
+    window.localStorage.setItem(probe, "1");
+    window.localStorage.removeItem(probe);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createDefaultSessionStore() {
+  return localStorageUsable() ? new LocalStorageSessionStore() : new MemorySessionStore();
+}
+
 // src/utils/server-session.ts
 var REFRESH_LEEWAY_SECONDS = 30;
+var ServerLoginError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "ServerLoginError";
+  }
+};
+function isLoginRejection(error) {
+  return error instanceof ServerLoginError && error.status >= 400 && error.status < 500 && error.status !== 429;
+}
 var ServerSession = class {
   signer;
   serviceEndpoint;
   chainId;
+  store;
+  onSignaturePrompt;
   now;
   fetchImpl;
   cached = null;
   inFlight = null;
+  /**
+   * Bumped by `clearPersisted()` (logout / disconnect). An in-flight
+   * `getOrRefresh()` captures this at start and refuses to write its freshly
+   * minted token back to `this.cached`/the store if the value changed
+   * meanwhile — so a refresh racing a sign-out can't silently "un-clear" the
+   * credential it was told to drop.
+   */
+  generation = 0;
+  /**
+   * Store key for the current signer, memoized on first use so the sync
+   * `clear()` can drop the persisted token without an async address lookup.
+   */
+  lastStoreKey = null;
   constructor(opts) {
     assertSafeServiceEndpoint(opts.serviceEndpoint);
     this.signer = opts.signer;
     this.serviceEndpoint = opts.serviceEndpoint.replace(/\/+$/, "");
     this.chainId = opts.chainId;
+    this.store = opts.persistSession === false ? null : opts.sessionStore ?? createDefaultSessionStore();
+    this.onSignaturePrompt = opts.onSignaturePrompt;
     this.now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
     this.fetchImpl = opts.fetchImpl ?? ((...a) => fetch(...a));
   }
-  /** Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds. */
-  async getValidToken() {
+  /**
+   * Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds.
+   * Pass `{ silent: true }` to forbid a fresh wallet signature: it resolves ONLY
+   * from a live cached token or the persisted re-mint envelope, never prompting
+   * and never joining a prompt-capable in-flight refresh (used by `logout()`,
+   * which must never pop the wallet during sign-out). Rejects when only a fresh
+   * signature could produce a token.
+   */
+  async getValidToken(opts) {
+    if (opts?.silent) {
+      const session2 = await this.tryResolveSilently(this.generation);
+      if (!session2) {
+        throw new Error("ServerSession: no existing session to refresh");
+      }
+      return session2.token;
+    }
     const session = await this.getOrRefresh();
     return session.token;
   }
@@ -5851,19 +6648,61 @@ var ServerSession = class {
   async getAuthHeader() {
     return { Authorization: `Bearer ${await this.getValidToken()}` };
   }
-  /** Drop the cached token (e.g. on 401 from server). Next call re-logs in. */
+  /**
+   * Drop the cached token (e.g. on 401 from server). The persisted envelope is
+   * kept — the next call re-mints silently — but its stored token copy is
+   * dropped too so a dead JWT can't be re-adopted from the store.
+   */
   clear() {
     this.cached = null;
     this.inFlight = null;
+    if (!this.store || !this.lastStoreKey)
+      return;
+    const persisted = this.store.load(this.lastStoreKey);
+    if (persisted?.token) {
+      this.store.save(this.lastStoreKey, {
+        ...persisted,
+        token: void 0,
+        tokenExpiresAt: void 0
+      });
+    }
+  }
+  /**
+   * Drop the session AND the persisted re-mint envelope (wallet disconnect /
+   * explicit sign-out paths — anything that must remove the 24h credential
+   * from storage).
+   */
+  async clearPersisted() {
+    this.generation += 1;
+    this.cached = null;
+    this.inFlight = null;
+    if (!this.store)
+      return;
+    try {
+      if (this.lastStoreKey) {
+        this.store.clear(this.lastStoreKey);
+      } else {
+        const address = (await this.signer.getAddress()).toLowerCase();
+        this.store.clear(
+          sessionStoreKey(address, this.chainId, this.serviceEndpoint)
+        );
+      }
+    } catch {
+    } finally {
+      this.generation += 1;
+      this.cached = null;
+    }
   }
   /**
-   * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`).
-   * Clears the local cache regardless of server response so the client stops
-   * presenting the token.
+   * Revoke the current session JWT on lit-ops-server (`POST /api/auth/logout`)
+   * — which also tombstones the envelope's re-mint window server-side — and
+   * remove the persisted credential locally. Clears the local cache regardless
+   * of server response so the client stops presenting the token.
    */
   async logout() {
-    const token = this.cached?.token ?? await this.getValidToken().catch(() => null);
-    this.clear();
+    const cached = this.cached;
+    const token = cached && cached.expiresAt > this.now() ? cached.token : await this.getValidToken({ silent: true }).catch(() => null);
+    await this.clearPersisted();
     if (!token)
       return;
     const res = await this.fetchImpl(`${this.serviceEndpoint}/api/auth/logout`, {
@@ -5877,6 +6716,50 @@ var ServerSession = class {
       );
     }
   }
+  /**
+   * Resolve a session WITHOUT ever prompting for a wallet signature: a live
+   * cached token, else the persisted JWT (adopted if still fresh, otherwise
+   * silently re-minted from the envelope). Returns `null` only when a fresh
+   * wallet signature would be required (dead/absent envelope). Never touches
+   * `this.inFlight`, so a silent caller (logout) can resolve independently
+   * instead of being dragged into a prompt-capable refresh already in flight.
+   *
+   * `gen` is the caller's clear-generation snapshot: writes to `this.cached`
+   * and the store are skipped if a `clearPersisted()` landed meanwhile.
+   */
+  async tryResolveSilently(gen) {
+    const nowSec = this.now();
+    if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
+      return this.cached;
+    }
+    const persisted = await this.loadPersisted();
+    if (!persisted)
+      return null;
+    if (persisted.token && typeof persisted.tokenExpiresAt === "number" && persisted.tokenExpiresAt - REFRESH_LEEWAY_SECONDS > this.now()) {
+      const adopted = {
+        token: persisted.token,
+        expiresAt: persisted.tokenExpiresAt
+      };
+      if (gen === this.generation)
+        this.cached = adopted;
+      return adopted;
+    }
+    try {
+      const session = await this.login(persisted.payload);
+      if (gen === this.generation) {
+        this.persist(persisted.payload, session);
+        this.cached = session;
+      }
+      return session;
+    } catch (error) {
+      if (!isLoginRejection(error))
+        throw error;
+      if (gen === this.generation && this.store && this.lastStoreKey) {
+        this.store.clear(this.lastStoreKey);
+      }
+      return null;
+    }
+  }
   async getOrRefresh() {
     const nowSec = this.now();
     if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
@@ -5884,39 +6767,97 @@ var ServerSession = class {
     }
     if (this.inFlight)
       return this.inFlight;
+    const gen = this.generation;
+    const notCleared = () => gen === this.generation;
     this.inFlight = (async () => {
       try {
+        const existing = await this.tryResolveSilently(gen);
+        if (existing)
+          return existing;
+        this.onSignaturePrompt?.();
         const payload = await buildSignedLoginPayload(
           this.signer,
           this.chainId,
           this.serviceEndpoint
         );
-        const res = await this.fetchImpl(
-          `${this.serviceEndpoint}/api/auth/login`,
-          {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(payload)
-          }
-        );
-        if (!res.ok) {
-          const detail = await res.text().catch(() => "");
-          throw new Error(
-            `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`
-          );
+        const session = await this.login(payload);
+        if (notCleared()) {
+          this.persist(payload, session);
+          this.cached = session;
         }
-        const body = await res.json();
-        if (!body?.token || !body?.expiresAt) {
-          throw new Error("lit-ops-server login returned malformed response");
-        }
-        this.cached = { token: body.token, expiresAt: body.expiresAt };
-        return this.cached;
+        return session;
       } finally {
-        this.inFlight = null;
+        if (notCleared())
+          this.inFlight = null;
       }
     })();
     return this.inFlight;
   }
+  async login(payload) {
+    const res = await this.fetchImpl(`${this.serviceEndpoint}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new ServerLoginError(
+        `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`,
+        res.status
+      );
+    }
+    const body = await res.json();
+    if (!body?.token || !body?.expiresAt) {
+      throw new Error("lit-ops-server login returned malformed response");
+    }
+    return { token: body.token, expiresAt: body.expiresAt };
+  }
+  /**
+   * Load the persisted session for the current signer, validating that it
+   * belongs to this address/chain/endpoint and that the envelope is still
+   * inside the re-auth window (with a safety margin). Invalid or expired
+   * entries are evicted.
+   */
+  async loadPersisted() {
+    if (!this.store)
+      return null;
+    try {
+      const address = (await this.signer.getAddress()).toLowerCase();
+      const key = sessionStoreKey(address, this.chainId, this.serviceEndpoint);
+      this.lastStoreKey = key;
+      const persisted = this.store.load(key);
+      if (!persisted)
+        return null;
+      const withinWindow = this.now() < persisted.payload.message.issuedAt + REAUTH_WINDOW_SECONDS - SAFETY_MARGIN_SECONDS;
+      if (persisted.address !== address || persisted.chainId !== this.chainId || persisted.endpoint !== this.serviceEndpoint || persisted.payload.message.address.toLowerCase() !== address || !withinWindow) {
+        this.store.clear(key);
+        return null;
+      }
+      return persisted;
+    } catch {
+      return null;
+    }
+  }
+  /** Best-effort save of the envelope + live JWT for silent recovery. */
+  persist(payload, session) {
+    if (!this.store)
+      return;
+    const address = payload.message.address.toLowerCase();
+    try {
+      const key = sessionStoreKey(address, this.chainId, this.serviceEndpoint);
+      this.lastStoreKey = key;
+      this.store.save(key, {
+        version: 1,
+        address,
+        chainId: this.chainId,
+        endpoint: this.serviceEndpoint,
+        payload,
+        token: session.token,
+        tokenExpiresAt: session.expiresAt
+      });
+    } catch {
+    }
+  }
 };
 
 // src/utils/quantum-revert.utils.ts
@@ -6039,6 +6980,36 @@ async function assertSafeQuantumSubmission(opts) {
 var import_ethers6 = require("ethers");
 var QUANTUM_SECONDS = 60;
 var QUANTUM_SAFE_THRESHOLD = 40;
+function hashBtcInputSet(utxos) {
+  if (!Array.isArray(utxos) || utxos.length === 0) {
+    throw new Error("hashBtcInputSet: at least one input is required");
+  }
+  const normalized = utxos.map((u) => {
+    const txid = String(u.txid).toLowerCase().replace(/^0x/, "");
+    const vout = Number(u.vout);
+    const value = Number(u.value);
+    if (!/^[0-9a-f]{64}$/.test(txid)) {
+      throw new Error(`hashBtcInputSet: invalid txid "${u.txid}"`);
+    }
+    if (!Number.isSafeInteger(vout) || vout < 0) {
+      throw new Error(`hashBtcInputSet: invalid vout ${u.vout} for ${txid}`);
+    }
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new Error(`hashBtcInputSet: invalid value ${u.value} for ${txid}:${vout}`);
+    }
+    return { txid, vout, value };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const u of normalized) {
+    const key = `${u.txid}:${u.vout}`;
+    if (seen.has(key)) {
+      throw new Error(`hashBtcInputSet: duplicate outpoint ${key}`);
+    }
+    seen.add(key);
+  }
+  const canonical = normalized.sort((a, b) => a.txid < b.txid ? -1 : a.txid > b.txid ? 1 : a.vout - b.vout).map((u) => `${u.txid}:${u.vout}:${u.value}`).join("|");
+  return (0, import_ethers6.keccak256)((0, import_ethers6.toUtf8Bytes)(canonical));
+}
 async function buildBtcExecuteEnvelope(params) {
   const {
     positionId,
@@ -6059,6 +7030,17 @@ async function buildBtcExecuteEnvelope(params) {
       "buildBtcExecuteEnvelope: targetAmount must be a positive number of satoshis"
     );
   }
+  const utxos = params.utxos && params.utxos.length > 0 ? params.utxos : [{ txid, vout, value: satoshis }];
+  const normTxid = (t) => String(t).toLowerCase().replace(/^0x/, "");
+  const authorizedInSet = utxos.some(
+    (u) => normTxid(u.txid) === normTxid(txid) && Number(u.vout) === Number(vout)
+  );
+  if (!authorizedInSet) {
+    throw new Error(
+      `buildBtcExecuteEnvelope: the authorized UTXO ${txid}:${vout} must be part of utxos[]`
+    );
+  }
+  const utxosHash = hashBtcInputSet(utxos);
   const nowSec = Date.now() / 1e3;
   const currentQuantumStart = Math.floor(nowSec / QUANTUM_SECONDS) * QUANTUM_SECONDS;
   const secsIntoQuantum = nowSec - currentQuantumStart;
@@ -6095,6 +7077,8 @@ async function buildBtcExecuteEnvelope(params) {
       // targetAddress (BTC destination)
       "uint256",
       // targetAmount (sats authorized to recipient)
+      "bytes32",
+      // utxosHash (canonical hash of the FULL input set — P6/#8)
       "bytes32"
       // actionHash
     ],
@@ -6106,6 +7090,7 @@ async function buildBtcExecuteEnvelope(params) {
       networkFee,
       targetAddress,
       targetAmount,
+      utxosHash,
       actionHash
     ]
   );
@@ -6122,7 +7107,8 @@ async function buildBtcExecuteEnvelope(params) {
     chainId,
     timestamp,
     userSignature,
-    borrowerAddress
+    borrowerAddress,
+    utxos
   };
 }
 
@@ -8938,6 +9924,56 @@ var LoanQuery = class {
       })
     );
   }
+  /**
+   * Get loan-event history for every position owned by a wallet.
+   *
+   * Composes getUserPositions + getLoanEvents (the subgraph has no wallet-scoped
+   * event collection). Each returned LoanEvents carries its own positionId, so
+   * callers can flatten and merge into a single per-wallet timeline.
+   *
+   * Bitcoin deposits never appear in the subgraph — merge those in from an
+   * Esplora source on the consumer side.
+   *
+   * @param userAddress - Loan-owner wallet address.
+   * @param filter - Optional per-position event filter (same semantics as getLoanEvents).
+   * @returns One LoanEvents object per position (empty array if the wallet has none).
+   *
+   * @example
+   * ```typescript
+   * const result = await loanQuery.getWalletLoanEvents('0x830b...');
+   * if (result.success) {
+   *   const allEvents = result.value; // LoanEvents[] — one per position
+   * }
+   * ```
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    if (this.config.debug) {
+      log.info("\u{1F50D} Querying wallet loan events", { userAddress, filter });
+    }
+    return tryCatchAsync(
+      async () => {
+        const perPosition = await this.config.graphClient.getWalletLoanEvents(
+          userAddress,
+          filter
+        );
+        if (this.config.debug) {
+          log.info("\u2705 Retrieved wallet loan events", {
+            userAddress,
+            positions: perPosition.length,
+            totalEvents: perPosition.reduce((n, p) => n + p.totalEvents, 0)
+          });
+        }
+        return perPosition;
+      },
+      (error) => new SDKError({
+        message: "Failed to query wallet loan events",
+        category: "SUBGRAPH" /* SUBGRAPH */,
+        severity: "MEDIUM" /* MEDIUM */,
+        originalError: error instanceof Error ? error : new Error(String(error)),
+        context: { userAddress, filter }
+      })
+    );
+  }
   /**
    * Clear loan cache
    *
@@ -11679,6 +12715,39 @@ var DiamondHandsGraph = class {
       totalEvents
     };
   }
+  /**
+   * Get the full loan-event history for every position owned by a wallet.
+   *
+   * The subgraph has no wallet-scoped event collection (`User` only derives
+   * `positions`), so this composes the two existing wallet/position queries:
+   * `getUserPositions(wallet)` to enumerate the wallet's positions, then
+   * `getLoanEvents(positionId, filter)` per position. Each returned `LoanEvents`
+   * already carries its own `positionId`, so callers can flatten and merge into
+   * a single timeline.
+   *
+   * Note: Bitcoin deposits are UTXOs on the Bitcoin network and never appear in
+   * the EVM subgraph — surface those from an Esplora source and merge separately.
+   *
+   * @param userAddress - The loan-owner wallet address.
+   * @param filter - Optional per-position event filter (same semantics as getLoanEvents).
+   * @returns One LoanEvents object per position; empty array if the wallet has none.
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    const { positions } = await this.getUserPositions(userAddress);
+    const positionIds = positions.map((p) => p?.id != null ? String(p.id) : "").filter((id) => id.length > 0);
+    if (positionIds.length === 0)
+      return [];
+    const CONCURRENCY = 5;
+    const results = [];
+    for (let i = 0; i < positionIds.length; i += CONCURRENCY) {
+      const batch = positionIds.slice(i, i + CONCURRENCY);
+      const settled = await Promise.all(
+        batch.map((positionId) => this.getLoanEvents(positionId, filter))
+      );
+      results.push(...settled);
+    }
+    return results;
+  }
   // ============================================================================
   // Protocol-wide Events
   // ============================================================================
@@ -15091,6 +16160,27 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       return {};
     return this.serverSession.getAuthHeader();
   }
+  /**
+   * Sign out of the lit-ops-server session for the current auth signer. Call on
+   * wallet disconnect or explicit sign-out so the credential does not outlive
+   * the wallet connection. No-op in standalone mode.
+   *
+   * Attempts a server-side revocation first (`ServerSession.logout()` — which
+   * tombstones the envelope's 24h re-mint window and invalidates the JWT), then
+   * always removes the local credential. If the revocation call fails (offline,
+   * server down, wallet already disconnected) we still clear locally so the
+   * session cannot silently re-mint after sign-out; `logout()` is best-effort
+   * and never prompts the wallet.
+   */
+  async clearServerSession() {
+    if (!this.serverSession)
+      return;
+    try {
+      await this.serverSession.logout();
+    } catch {
+      await this.serverSession.clearPersisted();
+    }
+  }
   /**
    * Audit H-9: invalidate the LoanQuery cache so subsequent reads return
    * the post-write state. We clear the entire loan-query cache (not just
@@ -15202,7 +16292,10 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
       this.serverSession = new ServerSession({
         signer: config.authSigner ?? config.contractSigner,
         serviceEndpoint: config.serviceEndpoint,
-        chainId: config.chainId
+        chainId: config.chainId,
+        persistSession: config.sessionPersistence?.enabled,
+        sessionStore: config.sessionPersistence?.store,
+        onSignaturePrompt: config.onSessionSignaturePrompt
       });
     }
     const contractManagerResult = createContractManager({
@@ -17843,9 +18936,12 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
         userSignature: auth.signature,
         rpcUrl: _rpcUrl || this.config.ethRpcUrl,
         // Forward a Bitcoin provider so the validator reaches a reachable esplora on Hardhat
-        // (lit-ops maps it to the validator's devBitcoinProviderUrl); ignored off-hardhat. Prefer
+        // Hardhat-ONLY: gives the validator a reachable esplora (lit-ops maps it to the
+        // validator's devBitcoinProviderUrl). Never emitted on prod chains, where the provider
+        // is resolved from the on-chain BitcoinProviderRegistry and this field is server-ignored
+        // — emitting it there only misleads readers into thinking it is caller-controlled. Prefer
         // a per-request override (mirrors the mint path's customBitcoinRpcUrl) over the config default.
-        ...(_bitcoinRpcUrl || this.config.bitcoinProviders?.[0]?.url) && {
+        ...this.config.chain === "hardhat" && (_bitcoinRpcUrl || this.config.bitcoinProviders?.[0]?.url) && {
           bitcoinProviderUrl: _bitcoinRpcUrl || this.config.bitcoinProviders[0].url
         },
         ...this.config.priceProviders && {
@@ -18626,9 +19722,10 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
           rpcUrl: this.config.ethRpcUrl,
           // Pass the SDK's RPC URL to LIT Action
           ...request.rpcUrl && { rpcUrl: request.rpcUrl },
-          // Forward the configured Bitcoin provider so the validator reaches a reachable esplora on
-          // Hardhat (lit-ops maps it to the validator's devBitcoinProviderUrl); ignored off-hardhat.
-          ...this.config.bitcoinProviders?.[0]?.url && {
+          // Hardhat-ONLY: gives the validator a reachable esplora (lit-ops maps it to the
+          // validator's devBitcoinProviderUrl). Never emitted on prod chains, where the provider
+          // comes from the on-chain BitcoinProviderRegistry and this field is server-ignored.
+          ...this.config.chain === "hardhat" && this.config.bitcoinProviders?.[0]?.url && {
             bitcoinProviderUrl: this.config.bitcoinProviders[0].url
           },
           ...this.config.priceProviders && {
@@ -19687,6 +20784,42 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       };
     }
   }
+  /**
+   * TEMPORARY (multi-UTXO withdrawal fix, Phase A): fetch the vault's confirmed
+   * UTXO set from lit-ops-server (`GET /api/lit/vault-utxos`) so the caller can
+   * assemble and sign the FULL input set for a multi-UTXO consolidation
+   * withdrawal. Phase 1 only returns ONE representative UTXO, so a vault whose
+   * balance is spread across several UTXOs otherwise fails the Phase-2 signer
+   * with "Insufficient UTXO value ... across 1 input(s)".
+   *
+   * Returns `[]` on any failure (non-service mode, network error, bad shape) so
+   * callers transparently fall back to the single authorized UTXO. Superseded
+   * by the btc-withdrawal Lit Action returning its own confirmedUTXOs (Phase B).
+   */
+  async fetchConfirmedVaultUtxos(positionId) {
+    if (this.config.mode !== "service" || !this.config.serviceEndpoint)
+      return [];
+    try {
+      const pid = positionId.startsWith("0x") ? positionId : `0x${positionId}`;
+      const resp = await fetch(
+        `${this.config.serviceEndpoint}/api/lit/vault-utxos?positionId=${encodeURIComponent(pid)}`,
+        { method: "GET", headers: { ...await this.getAuthHeader() } }
+      );
+      if (!resp.ok)
+        return [];
+      const json = await resp.json();
+      if (!json.success || !Array.isArray(json.data?.utxos))
+        return [];
+      return json.data.utxos.map((u) => ({
+        txid: String(u.txid),
+        vout: Number(u.vout),
+        value: Number(u.value),
+        confirmations: Number(u.confirmations ?? 0)
+      }));
+    } catch {
+      return [];
+    }
+  }
   /**
    * Execute Bitcoin withdrawal (Phase 2)
    *
@@ -19756,7 +20889,8 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
         targetAmount: request.targetAmount,
         networkFee: request.networkFee,
         chainId,
-        signer
+        signer,
+        ...request.utxos ? { utxos: request.utxos } : {}
       });
       const headers = {
         "Content-Type": "application/json",
@@ -19787,7 +20921,10 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
               userSignature: envelope.userSignature,
               borrowerAddress: envelope.borrowerAddress,
               chainId: envelope.chainId,
-              timestamp: envelope.timestamp
+              timestamp: envelope.timestamp,
+              // P6/#8: the exact input set hashed into the user signature.
+              // The server must forward this set verbatim to the signer.
+              utxos: envelope.utxos
             })
           }
         );
@@ -20127,10 +21264,13 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
             }
           },
           rpcUrl,
-          ...sdkBitcoinProviderUrl && { bitcoinProviderUrl: sdkBitcoinProviderUrl },
+          // Hardhat-ONLY: never emitted on prod chains (server-ignored there; provider comes
+          // from the on-chain BitcoinProviderRegistry). The stale-spend action reads
+          // `devBitcoinProviderUrl` directly on Hardhat — this legacy alias is redundant but
+          // kept behind the Hardhat gate so no prod request carries the caller-looking field.
+          ...this.config.chain === "hardhat" && sdkBitcoinProviderUrl && { bitcoinProviderUrl: sdkBitcoinProviderUrl },
           // Hardhat (chainId 1337/31337) has no on-chain BitcoinProviderRegistry —
-          // Lit Actions read `devBitcoinProviderUrl` from globalThis. Always pass;
-          // non-hardhat chains ignore it. (Single source of truth: bitcoinProviderUrl.)
+          // Lit Actions read `devBitcoinProviderUrl` from globalThis. Non-hardhat chains ignore it.
           ...sdkBitcoinProviderUrl && { devBitcoinProviderUrl: sdkBitcoinProviderUrl },
           ...params.minConfirmations !== void 0 && {
             minConfirmations: params.minConfirmations
@@ -20296,13 +21436,44 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       if (this.config.debug) {
         log.info("\u{1F50D} Found vault UTXO for execution", { utxoIdentifier });
       }
+      let executionUtxos;
+      const gatheredUtxos = await this.fetchConfirmedVaultUtxos(positionId);
+      if (gatheredUtxos.length > 0) {
+        const normTxid = (t) => String(t).toLowerCase().replace(/^0x/, "");
+        const byOutpoint = /* @__PURE__ */ new Map();
+        for (const u of gatheredUtxos) {
+          const txid = normTxid(u.txid);
+          byOutpoint.set(`${txid}:${u.vout}`, {
+            txid,
+            vout: Number(u.vout),
+            value: Number(u.value)
+          });
+        }
+        const repKey = `${normTxid(authResult.utxoTxid)}:${authResult.utxoVout}`;
+        if (!byOutpoint.has(repKey)) {
+          byOutpoint.set(repKey, {
+            txid: normTxid(authResult.utxoTxid),
+            vout: Number(authResult.utxoVout),
+            value: Number(authResult.utxoSatoshis)
+          });
+        }
+        if (byOutpoint.size > 1) {
+          executionUtxos = Array.from(byOutpoint.values());
+          if (this.config.debug) {
+            log.info("\u{1F9E9} Multi-UTXO withdrawal: signing full input set", {
+              inputs: executionUtxos.length
+            });
+          }
+        }
+      }
       const executionResult = await this.executeBTCWithdrawal({
         positionId,
         utxoIdentifier,
         utxoSatoshis: Number(authResult.utxoSatoshis),
         networkFee,
         destination: withdrawalAddress,
-        targetAmount: withdrawalAmount
+        targetAmount: withdrawalAmount,
+        ...executionUtxos ? { utxos: executionUtxos } : {}
       });
       if (this.config.debug) {
         log.info("\u2705 Phase 2 complete: Bitcoin transaction executed", {
@@ -20453,6 +21624,15 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
   async getLoanEvents(positionId, filter) {
     return this.loanQuery.getLoanEvents(positionId, filter);
   }
+  /**
+   * Get loan-event history for every position owned by a wallet.
+   * Composes getUserPositions + getLoanEvents; returns one LoanEvents per
+   * position (each carrying its own positionId). Bitcoin deposits are not on the
+   * subgraph — merge those in from an Esplora source on the consumer side.
+   */
+  async getWalletLoanEvents(userAddress, filter) {
+    return this.loanQuery.getWalletLoanEvents(userAddress, filter);
+  }
   /**
    * Get protocol-wide events across all indexed entity types.
    * Returns a merged, sorted discriminated-union timeline.
@@ -20909,6 +22089,38 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
       }));
     }
   }
+  /**
+   * List a vault address's PENDING (not-yet-confirmed) incoming BTC deposits.
+   *
+   * A deposit is "pending" until it reaches the protocol's minimum confirmation
+   * depth (6) — the confirmed balance endpoints (`getVaultBalance` /
+   * `getAddressBalance`) omit anything shallower, so this surfaces in-flight
+   * deposits (0–5 confirmations). Server-delegated: lit-ops-server queries its
+   * configured premium Esplora provider (`/api/lit/pending-deposits`). Requires
+   * service mode.
+   */
+  async getPendingDeposits(vaultAddress) {
+    this.ensureInitialized();
+    if (!isServiceModeConfig(this.config)) {
+      throw new Error("getPendingDeposits requires service mode \u2014 standalone mode is not supported");
+    }
+    const trimmedAddress = vaultAddress?.trim();
+    if (!trimmedAddress) {
+      throw new Error("vaultAddress is required");
+    }
+    const serviceEndpoint = this.config.serviceEndpoint;
+    const url = `${serviceEndpoint}/api/lit/pending-deposits?vaultAddress=${encodeURIComponent(trimmedAddress)}`;
+    const response = await fetch(url, {
+      headers: await this.getAuthHeader()
+    });
+    if (!response.ok) {
+      throw new Error(`Pending deposits request failed: ${response.status} ${response.statusText}`);
+    }
+    const json = await response.json();
+    if (!json.success)
+      throw new Error(json.error ?? "Pending deposits request failed");
+    return json.data ?? [];
+  }
   // ============================================================================
   // HIGH-LEVEL API - Mock Token Operations (Test Networks Only)
   // ============================================================================
@@ -21404,6 +22616,20 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
     if (this.config.debug) {
       log.info(`\u{1F310} Calling liquidation server endpoint: ${endpoint}`);
     }
+    const signer = this.getSignerOrThrow();
+    const intentSigner = await signer.getAddress();
+    const chainId = Number(
+      (await this.getProviderOrThrow().getNetwork()).chainId
+    );
+    const rawPositionId = /^0x/i.test(params.positionId.trim()) ? params.positionId.trim().slice(2) : params.positionId.trim();
+    const canonicalPositionId = "0x" + rawPositionId.padStart(64, "0").toLowerCase();
+    const intentTimestamp = Math.floor(Date.now() / 1e3);
+    const intentActionHash = (0, import_ethers14.keccak256)((0, import_ethers14.toUtf8Bytes)("liquidate-position"));
+    const intentHash = (0, import_ethers14.solidityPackedKeccak256)(
+      ["bytes32", "uint256", "uint256", "address", "bytes32"],
+      [canonicalPositionId, intentTimestamp, chainId, intentSigner, intentActionHash]
+    );
+    const intentSignature = await signer.signMessage((0, import_ethers14.getBytes)(intentHash));
     const response = await fetch(endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -21419,6 +22645,11 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
           UCDController: params.contractAddresses.ucdController,
           LiquidationManagerModule: params.contractAddresses.liquidationManager
         },
+        liquidatorIntent: {
+          timestamp: intentTimestamp,
+          chainId,
+          signature: intentSignature
+        },
         rpcUrl: params.rpcUrl || this.config.ethRpcUrl,
         priceProviders: this.config.priceProviders,
         pkpTokenId: params.pkpData.tokenId,