@gvnrdao/dh-sdk 0.0.318 → 0.0.320

package/dist/index.mjs

@@ -412,7 +412,7 @@ var init_deployment_addresses = __esm({
         LiquidationManagerModule: "0x74B28695352E7bf736D6c9F76ccb7B4439477De9",
         CircuitBreakerModule: "0xF7b545d3a4Ee056D06909AB367E2F7bFFE3cB1BC",
         AdminModule: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
-        PositionManagerViews: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        PositionManagerViews: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
         PositionManager: "0x12A1836e56139ccaD8722B89519d84233efc224B",
         OperationAuthorizationRegistry: "0xD4505645b724754f5170a2027804a4265e860d44",
         ContractVersionRegistry: "0x5e18f77d01940dA5B1D986D373D9A6ad0767008d",
@@ -490,13 +490,13 @@ var init_deployment_addresses = __esm({
           block: 25472957
         },
         PositionManager: {
-          previousImplementation: "0x9f52BaBB40FbFC5863e45B1A4014cB433950c684",
-          newImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
-          upgradedAt: "2026-07-06T08:42:47.000Z",
-          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0x2002827d34A781883Ec4c83c36ECC140c3911F2B in tx 0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6 (block 25472368)",
-          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-          executeTx: "0xa1fbe31cb71736514a868e681573dff22c9fab91d69cec157a24a30e29eadbe6",
-          block: 25472368
+          previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+          newImplementation: "0x2e7170d6Fb15A876dB726732e72e63109bcB916d",
+          upgradedAt: "2026-08-03T08:34:23.000Z",
+          upgradedBy: "AdminModule generic-op 0x69b79a906ed2 (3-of-3 signatures, 24h timelock; proposed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f, executed in the release batch onchain-auth/.safe-batches/mainnet-release-execute-B.json, submitted by EOA 0x2002827d34A781883Ec4c83c36ECC140c3911F2B, tx 0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6, block 25673200)",
+          reason: "2026-08 agent-stack release, Execute B: agent-delegation digest rebind. makePayment/mintUCD/extendPosition now bind their EIP-712 digest to the STORED borrower rather than msg.sender, so a scoped AgentDelegationRegistry grant can submit; withdrawBTC still binds msg.sender and stays non-delegable. Also adds setViews(address), which the same batch used to repoint PM at the replacement PositionManagerViews. NOTE: VERSION reads 1.5.4 on BOTH sides of this upgrade \u2014 verify by implementation ADDRESS, never by VERSION(). NOTE: not the July audit rollout batch \u2014 reconcile-deployment-record.ts --write templates every row with that text; this hand-authored provenance is the accurate one, restore it if --write flattens it again.",
+          executeTx: "0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6",
+          block: 25673200
         },
         LoanOperationsManagerModule: {
           previousImplementation: "0x56671D671e492Dae625413d463D47605Cf54edf6",
@@ -540,6 +540,16 @@ var init_deployment_addresses = __esm({
           reason: "2026-08 agent-stack release: PositionDelegateRegistry VERSION 1.1.0 -> 2.0.0 via upgradeToAndCall + initializeV2(AdminModule, registrar 0x5D54E0BE\u2026, pauser 0xC205Ae99\u2026) \u2014 kill-switch, deny-only registrar, permanent delegate burn. NOTE: not the July audit rollout batch \u2014 reconcile-deployment-record.ts --write templates every row with that text; this hand-authored provenance is the accurate one, restore it if --write flattens it again.",
           executeTx: "0xf0f237f6c4e958c37de556571908283c59c3fba6ebf9fa3cefb956f37e315a10",
           block: 25669024
+        },
+        PositionManagerViews: {
+          previousImplementation: "0x9225647a30bbACA4Acc0491B786869036914242e",
+          newImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+          proxy: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
+          upgradedAt: "2026-08-03T08:34:23.000Z",
+          upgradedBy: "REPLACED, not upgraded. Fresh ERC1967Proxy (atomically initialized) + AdminModule generic-op 0x848a97186f0d PositionManager.setViews(proxy) \u2014 3-of-3, 24h timelock, executed in onchain-auth/.safe-batches/mainnet-release-execute-B.json",
+          reason: "2026-08 agent-stack release. The mainnet PositionManagerViews at 0x9225647a was deployed as a BARE implementation (EIP-1967 slot 0x00), so upgradeToAndCall reverts UUPSUnauthorizedCallContext \u2014 it could never be upgraded. PositionManager.setViews (added in the same Execute B batch) removed the repoint blocker, so Views was replaced behind a new proxy rather than upgraded. This makes the Pashov F3 renewal debt-ceiling check REACHABLE for the first time: ExceedsMaxLoan (0x499e7985) is present in 0xE68DC096 and absent from 0x9225647a. Views holds no protocol state (8 wiring slots + roles + pause), which is what made replacement safe. The old contract is ABANDONED, not decommissioned \u2014 it stays live and callable as the rollback target for setViews. NOTE: VERSION reads 1.1.1 on both sides; verify by address.",
+          executeTx: "0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6",
+          block: 25673200
         }
       },
       latestEnv: {
@@ -573,10 +583,10 @@ var init_deployment_addresses = __esm({
         ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
         BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
         BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-        POSITION_MANAGER_VIEWS: "0x9225647a30bbACA4Acc0491B786869036914242e",
-        POSITION_MANAGER_VIEWS_IMPL: "0x9225647a30bbACA4Acc0491B786869036914242e",
+        POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
+        POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
         POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
-        POSITION_MANAGER_IMPL: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
+        POSITION_MANAGER_IMPL: "0x2e7170d6Fb15A876dB726732e72e63109bcB916d",
         LOAN_OPERATIONS_MANAGER_MODULE: "0x2561974A40F1AEed1251d0A090A83cF8536FB9E9",
         LOAN_OPERATIONS_MANAGER_MODULE_IMPL: "0x7d90aAB4466f59BA9aC9C7a9BF14dC53734336e7",
         UPGRADE_VALIDATOR: "0xC46Ae71F22e3741A6CF46E399aE914C4868fEbed",
@@ -602,7 +612,7 @@ var init_deployment_addresses = __esm({
       LiquidationManagerModule: "0x74B28695352E7bf736D6c9F76ccb7B4439477De9",
       CircuitBreakerModule: "0xF7b545d3a4Ee056D06909AB367E2F7bFFE3cB1BC",
       AdminModule: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
-      PositionManagerViews: "0x9225647a30bbACA4Acc0491B786869036914242e",
+      PositionManagerViews: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
       PositionManager: "0x12A1836e56139ccaD8722B89519d84233efc224B",
       OperationAuthorizationRegistry: "0xD4505645b724754f5170a2027804a4265e860d44",
       ContractVersionRegistry: "0x5e18f77d01940dA5B1D986D373D9A6ad0767008d",
@@ -6521,6 +6531,7 @@ function sessionStoreKey(address, chainId, endpoint) {
   return STORE_PREFIX + `${address.trim().toLowerCase()}:${chainId}:${endpoint.replace(/\/+$/, "")}`;
 }
 var PENDING_ENVELOPE_TTL_SECONDS = 8 * 60;
+var EOA_PENDING_ENVELOPE_TTL_SECONDS = 60;
 function pendingEnvelopeKey(sessionKey) {
   return sessionKey + ":pending";
 }
@@ -6568,7 +6579,7 @@ var LocalStorageSessionStore = class {
     } catch {
     }
   }
-  loadPending(key) {
+  loadPending(key, maxAgeSeconds = PENDING_ENVELOPE_TTL_SECONDS) {
     let raw;
     try {
       raw = window.localStorage.getItem(pendingEnvelopeKey(key));
@@ -6585,7 +6596,7 @@ var LocalStorageSessionStore = class {
       return null;
     }
     const nowSec = Math.floor(Date.now() / 1e3);
-    if (!isPendingEnvelopeShape(parsed) || nowSec >= parsed.issuedAt + PENDING_ENVELOPE_TTL_SECONDS) {
+    if (!isPendingEnvelopeShape(parsed) || nowSec >= parsed.issuedAt + maxAgeSeconds) {
       this.clearPending(key);
       return null;
     }
@@ -6619,12 +6630,12 @@ var MemorySessionStore = class {
   clear(key) {
     this.entries.delete(key);
   }
-  loadPending(key) {
+  loadPending(key, maxAgeSeconds = PENDING_ENVELOPE_TTL_SECONDS) {
     const envelope = this.pending.get(key);
     if (!envelope)
       return null;
     const nowSec = Math.floor(Date.now() / 1e3);
-    if (nowSec >= envelope.issuedAt + PENDING_ENVELOPE_TTL_SECONDS) {
+    if (nowSec >= envelope.issuedAt + maxAgeSeconds) {
       this.pending.delete(key);
       return null;
     }
@@ -6658,15 +6669,23 @@ var REFRESH_LEEWAY_SECONDS = 30;
 var LOGIN_RETRY_BASE_MS = 3e4;
 var LOGIN_RETRY_MAX_MS = 5 * 6e4;
 var ServerLoginError = class extends Error {
-  constructor(message, status) {
+  constructor(message, status, reason) {
     super(message);
     this.status = status;
+    this.reason = reason;
     this.name = "ServerLoginError";
   }
 };
 function isLoginRejection(error) {
   return error instanceof ServerLoginError && error.status >= 400 && error.status < 500 && error.status !== 429;
 }
+var SPENT_ENVELOPE_REASONS = /* @__PURE__ */ new Set(["replayed_nonce", "expired_issuedAt"]);
+function isSpentEnvelope(error) {
+  if (!isLoginRejection(error))
+    return false;
+  const { reason, status } = error;
+  return reason ? SPENT_ENVELOPE_REASONS.has(reason) : status === 409;
+}
 var ServerSession = class {
   signer;
   serviceEndpoint;
@@ -6697,6 +6716,12 @@ var ServerSession = class {
    * `clear()` can drop the persisted token without an async address lookup.
    */
   lastStoreKey = null;
+  /**
+   * Whether the signer is a smart-contract wallet, memoized after the first
+   * `eth_getCode`. Decides which of the server's two first-use windows bounds
+   * envelope reuse; a signer cannot change kind for the life of the session.
+   */
+  contractSigner = null;
   constructor(opts) {
     assertSafeServiceEndpoint(opts.serviceEndpoint);
     this.signer = opts.signer;
@@ -6895,6 +6920,34 @@ var ServerSession = class {
       return null;
     }
   }
+  /**
+   * How long a pending envelope for THIS signer may be reused, in seconds.
+   *
+   * The server grants an EOA 120s to make an envelope's first use and a contract
+   * wallet 600s, so one local TTL is necessarily wrong for one of them. Deployed
+   * code has bytecode; an EOA does not — one `eth_getCode`, memoized, settles it.
+   *
+   * Reports the CONTRACT window when it cannot tell, which is the behavior that
+   * shipped before the split. The asymmetry is intended: guessing "EOA" for a
+   * Safe hands it a new message and orphans the owner signatures already
+   * collected, while guessing "contract" for an EOA now costs one rejected
+   * attempt, because a rejection clears the envelope.
+   */
+  async pendingEnvelopeTtl() {
+    if (this.contractSigner === null) {
+      try {
+        const provider = this.signer.provider;
+        if (!provider)
+          return PENDING_ENVELOPE_TTL_SECONDS;
+        const address = await this.signer.getAddress();
+        const code = await provider.getCode(address);
+        this.contractSigner = typeof code === "string" && code !== "0x";
+      } catch {
+        return PENDING_ENVELOPE_TTL_SECONDS;
+      }
+    }
+    return this.contractSigner ? PENDING_ENVELOPE_TTL_SECONDS : EOA_PENDING_ENVELOPE_TTL_SECONDS;
+  }
   async getOrRefresh() {
     const nowSec = this.now();
     if (this.cached && this.cached.expiresAt - REFRESH_LEEWAY_SECONDS > nowSec) {
@@ -6916,10 +6969,10 @@ var ServerSession = class {
         }
         this.onSignaturePrompt?.();
         let session;
+        const store = this.store;
+        const storeKey = store ? this.lastStoreKey : null;
         try {
-          const store = this.store;
-          const storeKey = store ? this.lastStoreKey : null;
-          const reuse = storeKey ? store.loadPending?.(storeKey) ?? void 0 : void 0;
+          const reuse = storeKey ? store.loadPending?.(storeKey, await this.pendingEnvelopeTtl()) ?? void 0 : void 0;
           const payload = await buildSignedLoginPayload(
             this.signer,
             this.chainId,
@@ -6942,6 +6995,9 @@ var ServerSession = class {
           this.onSignatureResolved?.(true);
         } catch (error) {
           this.onSignatureResolved?.(false);
+          if (storeKey && isSpentEnvelope(error)) {
+            store.clearPending?.(storeKey);
+          }
           const failures = (this.promptBackoff?.failures ?? 0) + 1;
           this.promptBackoff = {
             failures,
@@ -6970,9 +7026,17 @@ var ServerSession = class {
     });
     if (!res.ok) {
       const detail = await res.text().catch(() => "");
+      let reason;
+      try {
+        const parsed = JSON.parse(detail);
+        if (typeof parsed?.reason === "string")
+          reason = parsed.reason;
+      } catch {
+      }
       throw new ServerLoginError(
         `lit-ops-server login failed: HTTP ${res.status} ${detail.slice(0, 200)}`,
-        res.status
+        res.status,
+        reason
       );
     }
     const body = await res.json();
@@ -12627,7 +12691,7 @@ var DiamondHandsGraph = class {
   async getPSMConfiguration() {
     const query = `
       query GetPSMConfiguration {
-        psmConfiguration(id: "psm") {
+        psmConfiguration: psmconfiguration(id: "psm") {
           id
           version
           redeemEnabled
@@ -12749,7 +12813,7 @@ var DiamondHandsGraph = class {
     const whereClause = whereConditions.length > 0 ? `where: { ${whereConditions.join(", ")} }` : "";
     const query = `
       query GetPSMTransactions($first: Int!, $skip: Int!) {
-        psmTransactions(${whereClause}, first: $first, skip: $skip, orderBy: timestamp, orderDirection: desc) {
+        psmTransactions: psmtransactions(${whereClause}, first: $first, skip: $skip, orderBy: timestamp, orderDirection: desc) {
           id
           type
           user
@@ -12784,7 +12848,7 @@ var DiamondHandsGraph = class {
     const whereClause = whereConditions.length > 0 ? `where: { ${whereConditions.join(", ")} }` : "";
     const query = `
       query GetPSMDailyMetrics($first: Int!) {
-        psmDailyMetrics(${whereClause}, first: $first, orderBy: date, orderDirection: desc) {
+        psmDailyMetrics: psmdailyMetrics(${whereClause}, first: $first, orderBy: date, orderDirection: desc) {
           id
           date
           totalSwapVolume
@@ -13508,7 +13572,7 @@ var DiamondHandsGraph = class {
         }` : ""}
 
         ${includeKind("psm") ? `
-        psmTransactions(
+        psmTransactions: psmtransactions(
           ${buildTimeWhereClause()}
           first: $limit, orderBy: timestamp, orderDirection: $orderDirection
         ) {
@@ -24571,22 +24635,28 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
    * @throws if timeout is reached before subgraph catches up
    */
   // ============================================================================
-  // HIGH-LEVEL API - Agent Delegation (auto-renew) — SEPOLIA ONLY
+  // HIGH-LEVEL API - Agent Delegation (auto-renew)
   // ============================================================================
-  /** Guard: the AgentDelegationRegistry MVP is deployed on Sepolia only. */
-  async assertAgentDelegationSepolia() {
-    const chainId = Number((await this.getProviderOrThrow().getNetwork()).chainId);
-    if (chainId !== 11155111) {
-      throw new SDKError({
-        message: `Agent auto-renew delegation is Sepolia-only (chainId 11155111); got ${chainId}`,
-        category: "NETWORK" /* NETWORK */,
-        severity: "HIGH" /* HIGH */
-      });
-    }
+  /**
+   * Guard: resolve the AgentDelegationRegistry for the configured network.
+   *
+   * Deployment presence IS the availability test — there is deliberately no chainId
+   * allow-list here. The registry is deployed per network (Sepolia 2026-07, mainnet
+   * 2026-08 agent-stack release) and `getNetworkConfig` populates the address from the
+   * generated deployment table, so a chain without a deployment resolves to `""` and
+   * fails closed below. Adding a chain therefore needs no SDK code change — which is
+   * exactly how the previous hardcoded `chainId !== 11155111` gate went stale and kept
+   * the mainnet toggle dark after the registry shipped.
+   *
+   * Callers that need the availability answer WITHOUT throwing (e.g. to decide whether to
+   * render a toggle at all) should ask the deployment table directly rather than calling this
+   * and catching — `ALL_DEPLOYMENTS` is published on the `@gvnrdao/dh-sdk/deployments` subpath.
+   */
+  agentDelegationRegistryOrThrow() {
     const addr = this.config.contractAddresses?.agentDelegationRegistry;
     if (!addr) {
       throw new SDKError({
-        message: "AgentDelegationRegistry address not configured \u2014 provide contractAddresses.agentDelegationRegistry",
+        message: "AgentDelegationRegistry is not available on this network \u2014 no deployment address is configured (contractAddresses.agentDelegationRegistry)",
         category: "CONFIGURATION" /* CONFIGURATION */,
         severity: "HIGH" /* HIGH */
       });
@@ -24598,7 +24668,7 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
    * Pure view — no signer required.
    */
   async getAutoRenewStatus(positionId, user) {
-    const addr = await this.assertAgentDelegationSepolia();
+    const addr = this.agentDelegationRegistryOrThrow();
     const registry = AgentDelegationRegistry__factory.connect(addr, this.getProviderOrThrow());
     const pid = this.toBytes32(positionId);
     const grant = await registry.getLoanGrant(pid);
@@ -24618,7 +24688,7 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
    * registers it, then records the position's renew grant. Borrower-signed.
    */
   async enableAutoRenew(positionId, options) {
-    const addr = await this.assertAgentDelegationSepolia();
+    const addr = this.agentDelegationRegistryOrThrow();
     const pdrAddr = this.config.contractAddresses?.positionDelegateRegistry;
     if (!pdrAddr) {
       throw new SDKError({
@@ -24658,7 +24728,7 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
   }
   /** Disable auto-renew delegation for a position (clears the grant). Borrower-signed. */
   async disableAutoRenew(positionId) {
-    const addr = await this.assertAgentDelegationSepolia();
+    const addr = this.agentDelegationRegistryOrThrow();
     const signer = this.getSignerOrThrow();
     const user = await signer.getAddress();
     const registry = AgentDelegationRegistry__factory.connect(addr, signer);

package/dist/modules/diamond-hands-sdk.d.ts

@@ -887,8 +887,22 @@ export declare class DiamondHandsSDK {
      * @param options - Override timeout/interval for this call
      * @throws if timeout is reached before subgraph catches up
      */
-    /** Guard: the AgentDelegationRegistry MVP is deployed on Sepolia only. */
-    private assertAgentDelegationSepolia;
+    /**
+     * Guard: resolve the AgentDelegationRegistry for the configured network.
+     *
+     * Deployment presence IS the availability test — there is deliberately no chainId
+     * allow-list here. The registry is deployed per network (Sepolia 2026-07, mainnet
+     * 2026-08 agent-stack release) and `getNetworkConfig` populates the address from the
+     * generated deployment table, so a chain without a deployment resolves to `""` and
+     * fails closed below. Adding a chain therefore needs no SDK code change — which is
+     * exactly how the previous hardcoded `chainId !== 11155111` gate went stale and kept
+     * the mainnet toggle dark after the registry shipped.
+     *
+     * Callers that need the availability answer WITHOUT throwing (e.g. to decide whether to
+     * render a toggle at all) should ask the deployment table directly rather than calling this
+     * and catching — `ALL_DEPLOYMENTS` is published on the `@gvnrdao/dh-sdk/deployments` subpath.
+     */
+    private agentDelegationRegistryOrThrow;
     /**
      * Read a position's auto-renew delegation state (used to drive the Enable/Disable toggle).
      * Pure view — no signer required.

package/dist/utils/server-session-store.d.ts

@@ -44,8 +44,12 @@ export interface ServerSessionStore {
      * so a custom store written before this existed still satisfies the interface;
      * without it the session simply mints a fresh envelope each attempt, which is
      * the pre-existing behavior and only costs a multi-owner Safe a restart.
+     *
+     * `maxAgeSeconds` is supplied by the caller, which knows the signer kind and
+     * therefore which of the server's two first-use windows applies. A store that
+     * ignores it keeps the old single-TTL behavior.
      */
-    loadPending?(key: string): PendingLoginEnvelope | null;
+    loadPending?(key: string, maxAgeSeconds?: number): PendingLoginEnvelope | null;
     savePending?(key: string, envelope: PendingLoginEnvelope): void;
     clearPending?(key: string): void;
 }
@@ -69,12 +73,26 @@ export interface PendingLoginEnvelope {
     nonce: string;
 }
 /**
- * How long an unsigned envelope stays reusable. Must stay UNDER the server's
- * contract-wallet first-use skew (`CONTRACT_ISSUED_AT_SKEW_SECONDS`, 10 min):
- * beyond it the first use is rejected as stale, so reuse would guarantee failure
- * instead of preventing a re-sign.
+ * How long an unsigned envelope stays reusable FOR A CONTRACT WALLET. Must stay
+ * UNDER the server's contract-wallet first-use skew
+ * (`CONTRACT_ISSUED_AT_SKEW_SECONDS`, 10 min): beyond it the first use is
+ * rejected as stale, so reuse would guarantee failure instead of preventing a
+ * re-sign.
  */
 export declare const PENDING_ENVELOPE_TTL_SECONDS: number;
+/**
+ * The same, for an EOA — which the server gives only `ISSUED_AT_SKEW_SECONDS`
+ * (120s) to make its FIRST use.
+ *
+ * Between 120s and 8 minutes a reused EOA envelope is still "live" locally and
+ * certain to be refused by the server, so the contract-wallet TTL is not a safe
+ * over-estimate for a key-holding wallet — it is a window in which every retry
+ * re-signs a message that cannot be accepted. 60s leaves a full minute of the
+ * server's window for the prompt and the round trip, and an EOA gives up
+ * nothing by re-minting: it signs in one click, so it has no equivalent of the
+ * cross-session ceremony this reuse exists for.
+ */
+export declare const EOA_PENDING_ENVELOPE_TTL_SECONDS = 60;
 /** Storage key for the pending envelope matching a session key. */
 export declare function pendingEnvelopeKey(sessionKey: string): string;
 export declare function isPendingEnvelopeShape(value: any): value is PendingLoginEnvelope;
@@ -82,7 +100,7 @@ export declare class LocalStorageSessionStore implements ServerSessionStore {
     load(key: string): PersistedServerSession | null;
     save(key: string, session: PersistedServerSession): void;
     clear(key: string): void;
-    loadPending(key: string): PendingLoginEnvelope | null;
+    loadPending(key: string, maxAgeSeconds?: number): PendingLoginEnvelope | null;
     savePending(key: string, envelope: PendingLoginEnvelope): void;
     clearPending(key: string): void;
 }
@@ -92,7 +110,7 @@ export declare class MemorySessionStore implements ServerSessionStore {
     load(key: string): PersistedServerSession | null;
     save(key: string, session: PersistedServerSession): void;
     clear(key: string): void;
-    loadPending(key: string): PendingLoginEnvelope | null;
+    loadPending(key: string, maxAgeSeconds?: number): PendingLoginEnvelope | null;
     savePending(key: string, envelope: PendingLoginEnvelope): void;
     clearPending(key: string): void;
 }

package/dist/utils/server-session.d.ts

@@ -62,10 +62,15 @@ export interface ServerSessionOptions {
     /** Override for tests. */
     fetchImpl?: typeof fetch;
 }
-/** Login failure carrying the HTTP status so callers can tell rejection from outage. */
+/**
+ * Login failure carrying the HTTP status — and the server's machine-readable
+ * `reason` where it sent one — so callers can tell rejection from outage, and
+ * one kind of rejection from another.
+ */
 export declare class ServerLoginError extends Error {
     readonly status: number;
-    constructor(message: string, status: number);
+    readonly reason?: string | undefined;
+    constructor(message: string, status: number, reason?: string | undefined);
 }
 export declare class ServerSession {
     private readonly signer;
@@ -97,6 +102,12 @@ export declare class ServerSession {
      * `clear()` can drop the persisted token without an async address lookup.
      */
     private lastStoreKey;
+    /**
+     * Whether the signer is a smart-contract wallet, memoized after the first
+     * `eth_getCode`. Decides which of the server's two first-use windows bounds
+     * envelope reuse; a signer cannot change kind for the life of the session.
+     */
+    private contractSigner;
     constructor(opts: ServerSessionOptions);
     /**
      * Returns a JWT good for at least `REFRESH_LEEWAY_SECONDS` more seconds.
@@ -160,6 +171,20 @@ export declare class ServerSession {
      * and the store are skipped if a `clearPersisted()` landed meanwhile.
      */
     private tryResolveSilently;
+    /**
+     * How long a pending envelope for THIS signer may be reused, in seconds.
+     *
+     * The server grants an EOA 120s to make an envelope's first use and a contract
+     * wallet 600s, so one local TTL is necessarily wrong for one of them. Deployed
+     * code has bytecode; an EOA does not — one `eth_getCode`, memoized, settles it.
+     *
+     * Reports the CONTRACT window when it cannot tell, which is the behavior that
+     * shipped before the split. The asymmetry is intended: guessing "EOA" for a
+     * Safe hands it a new message and orphans the owner signatures already
+     * collected, while guessing "contract" for an EOA now costs one rejected
+     * attempt, because a rejection clears the envelope.
+     */
+    private pendingEnvelopeTtl;
     private getOrRefresh;
     private login;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gvnrdao/dh-sdk",
-  "version": "0.0.318",
+  "version": "0.0.320",
   "description": "TypeScript SDK for Diamond Hands Protocol - Bitcoin-backed lending with LIT Protocol PKPs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",