@gvnrdao/dh-sdk 0.0.336 → 0.0.338

package/dist/deployments.js

@@ -459,13 +459,13 @@ var MAINNET_DEPLOYMENT = {
       block: 25472956
     },
     BTCSpendAuthorizer: {
-      previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-      newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-      upgradedAt: "2026-07-06T10:40:59.000Z",
-      upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-      reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-      executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-      block: 25472957
+      previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+      newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+      upgradedAt: "2026-09-09T12:05:35.000Z",
+      upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+      reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+      executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+      block: 25939703
     },
     PositionManager: {
       previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -568,7 +568,7 @@ var MAINNET_DEPLOYMENT = {
     ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
     ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
     BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-    BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+    BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
     POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
     POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
     POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",

package/dist/deployments.mjs

@@ -426,13 +426,13 @@ var MAINNET_DEPLOYMENT = {
       block: 25472956
     },
     BTCSpendAuthorizer: {
-      previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-      newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-      upgradedAt: "2026-07-06T10:40:59.000Z",
-      upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-      reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-      executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-      block: 25472957
+      previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+      newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+      upgradedAt: "2026-09-09T12:05:35.000Z",
+      upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+      reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+      executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+      block: 25939703
     },
     PositionManager: {
       previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -535,7 +535,7 @@ var MAINNET_DEPLOYMENT = {
     ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
     ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
     BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-    BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+    BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
     POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
     POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
     POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",

package/dist/index.js

@@ -484,13 +484,13 @@ var init_deployment_addresses = __esm({
           block: 25472956
         },
         BTCSpendAuthorizer: {
-          previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-          newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-          upgradedAt: "2026-07-06T10:40:59.000Z",
-          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-          executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-          block: 25472957
+          previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+          newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+          upgradedAt: "2026-09-09T12:05:35.000Z",
+          upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+          reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+          executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+          block: 25939703
         },
         PositionManager: {
           previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -593,7 +593,7 @@ var init_deployment_addresses = __esm({
         ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
         ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
         BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-        BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
         POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
         POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
         POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
@@ -5573,7 +5573,17 @@ function getSepoliaConfig() {
 function getMainnetConfig() {
   return {
     mode: "service",
-    serviceEndpoint: "https://ops.gvnr.xyz",
+    // Cutover 2026-09-08: the product's own domain. `ops.gvnr.xyz` still serves the same
+    // broker and always will — every already-installed copy of this package calls it, so
+    // it can never be retired. This changes what NEW installs default to, nothing else.
+    //
+    // Safe only because the server accepts the new audience ALREADY: the SDK derives the
+    // login audience from this endpoint (`server-session.ts` — `loginAudience ??
+    // serviceEndpoint`) and lit-ops-server FAILS CLOSED on an unknown one. Verified live
+    // before this edit: DH_ACCEPTED_LOGIN_AUDIENCES on the deployed revision lists
+    // https://ops.diamondhands.credit. Publishing this ahead of that would lock out every
+    // client that installed it.
+    serviceEndpoint: "https://ops.diamondhands.credit",
     chainId: 1,
     name: "mainnet",
     // No default RPC: mainnet runs in service mode (serviceEndpoint above), so
@@ -6876,9 +6886,27 @@ var LOGIN_TYPES_WITH_AUDIENCE = {
     { name: "audience", type: "string" }
   ]
 };
-async function buildSignedLoginPayload(signer, chainId, audience, reuse) {
+var LOGIN_TYPES_WITH_STATEMENT = {
+  DiamondHands: [
+    { name: "statement", type: "string" },
+    { name: "address", type: "address" },
+    { name: "issuedAt", type: "uint256" },
+    { name: "nonce", type: "bytes32" },
+    { name: "audience", type: "string" }
+  ]
+};
+var LOGIN_STATEMENT_TEMPLATE = "{host} is verifying you own this wallet. Signing proves control of the address so we can show your loans and positions. It authorizes no transaction, moves no funds, and costs no gas.";
+function canonicalLoginStatement(audience) {
+  const host = /^https?:\/\/([^/?#]+)/i.exec(audience)?.[1];
+  if (!host)
+    return null;
+  return LOGIN_STATEMENT_TEMPLATE.replace("{host}", host);
+}
+async function buildSignedLoginPayload(signer, chainId, audience, reuse, withStatement = false) {
   const address = await signer.getAddress();
+  const statement = withStatement && audience ? canonicalLoginStatement(audience) : null;
   const message = {
+    ...statement ? { statement } : {},
     address,
     issuedAt: reuse?.issuedAt ?? Math.floor(Date.now() / 1e3),
     nonce: reuse?.nonce ?? (0, import_ethers4.hexlify)((0, import_ethers4.randomBytes)(32)),
@@ -6886,7 +6914,7 @@ async function buildSignedLoginPayload(signer, chainId, audience, reuse) {
   };
   const signature = await signer.signTypedData(
     buildLoginDomain(chainId),
-    audience ? LOGIN_TYPES_WITH_AUDIENCE : LOGIN_TYPES,
+    statement ? LOGIN_TYPES_WITH_STATEMENT : audience ? LOGIN_TYPES_WITH_AUDIENCE : LOGIN_TYPES,
     message
   );
   return { chainId, message, signature };
@@ -7059,6 +7087,8 @@ var ServerSession = class {
   signer;
   serviceEndpoint;
   loginAudience;
+  /** Whether this session's login carries the human-readable statement. */
+  withStatement;
   chainId;
   store;
   onSignaturePrompt;
@@ -7100,6 +7130,13 @@ var ServerSession = class {
       /\/+$/,
       ""
     );
+    const explicitAudience = typeof opts.loginAudience === "string" && opts.loginAudience.length > 0;
+    this.withStatement = opts.withStatement === true && explicitAudience;
+    if (opts.withStatement === true && !explicitAudience) {
+      console.warn(
+        "[dh-sdk] withStatement ignored: it requires an explicit loginAudience, since the servers rebuild the expected sentence from the audience host"
+      );
+    }
     this.chainId = opts.chainId;
     this.store = opts.persistSession === false ? null : opts.sessionStore ?? createDefaultSessionStore();
     this.onSignaturePrompt = opts.onSignaturePrompt;
@@ -7353,12 +7390,16 @@ var ServerSession = class {
             this.signer,
             this.chainId,
             this.loginAudience,
-            reuse
+            reuse,
+            reuse ? reuse.withStatement === true : this.withStatement
           );
           if (storeKey && !reuse) {
             store.savePending?.(storeKey, {
               issuedAt: payload.message.issuedAt,
-              nonce: payload.message.nonce
+              nonce: payload.message.nonce,
+              // Recorded so a resume reproduces this digest even if the
+              // capability flag changes before the owners finish signing.
+              withStatement: this.withStatement
             });
           }
           session = await this.login(payload);
@@ -19699,6 +19740,9 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
         signer: config.authSigner ?? config.contractSigner,
         serviceEndpoint: config.serviceEndpoint,
         loginAudience: config.loginAudience,
+        // Only meaningful alongside an audience; the servers derive the expected
+        // sentence from its host. Defaults off so Node callers are untouched.
+        withStatement: config.loginStatement === true,
         chainId: config.chainId,
         persistSession: config.sessionPersistence?.enabled,
         sessionStore: config.sessionPersistence?.store,

package/dist/index.mjs

@@ -490,13 +490,13 @@ var init_deployment_addresses = __esm({
           block: 25472956
         },
         BTCSpendAuthorizer: {
-          previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-          newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-          upgradedAt: "2026-07-06T10:40:59.000Z",
-          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-          executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-          block: 25472957
+          previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+          newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+          upgradedAt: "2026-09-09T12:05:35.000Z",
+          upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+          reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+          executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+          block: 25939703
         },
         PositionManager: {
           previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -599,7 +599,7 @@ var init_deployment_addresses = __esm({
         ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
         ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
         BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-        BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
         POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
         POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
         POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
@@ -5579,7 +5579,17 @@ function getSepoliaConfig() {
 function getMainnetConfig() {
   return {
     mode: "service",
-    serviceEndpoint: "https://ops.gvnr.xyz",
+    // Cutover 2026-09-08: the product's own domain. `ops.gvnr.xyz` still serves the same
+    // broker and always will — every already-installed copy of this package calls it, so
+    // it can never be retired. This changes what NEW installs default to, nothing else.
+    //
+    // Safe only because the server accepts the new audience ALREADY: the SDK derives the
+    // login audience from this endpoint (`server-session.ts` — `loginAudience ??
+    // serviceEndpoint`) and lit-ops-server FAILS CLOSED on an unknown one. Verified live
+    // before this edit: DH_ACCEPTED_LOGIN_AUDIENCES on the deployed revision lists
+    // https://ops.diamondhands.credit. Publishing this ahead of that would lock out every
+    // client that installed it.
+    serviceEndpoint: "https://ops.diamondhands.credit",
     chainId: 1,
     name: "mainnet",
     // No default RPC: mainnet runs in service mode (serviceEndpoint above), so
@@ -6788,9 +6798,27 @@ var LOGIN_TYPES_WITH_AUDIENCE = {
     { name: "audience", type: "string" }
   ]
 };
-async function buildSignedLoginPayload(signer, chainId, audience, reuse) {
+var LOGIN_TYPES_WITH_STATEMENT = {
+  DiamondHands: [
+    { name: "statement", type: "string" },
+    { name: "address", type: "address" },
+    { name: "issuedAt", type: "uint256" },
+    { name: "nonce", type: "bytes32" },
+    { name: "audience", type: "string" }
+  ]
+};
+var LOGIN_STATEMENT_TEMPLATE = "{host} is verifying you own this wallet. Signing proves control of the address so we can show your loans and positions. It authorizes no transaction, moves no funds, and costs no gas.";
+function canonicalLoginStatement(audience) {
+  const host = /^https?:\/\/([^/?#]+)/i.exec(audience)?.[1];
+  if (!host)
+    return null;
+  return LOGIN_STATEMENT_TEMPLATE.replace("{host}", host);
+}
+async function buildSignedLoginPayload(signer, chainId, audience, reuse, withStatement = false) {
   const address = await signer.getAddress();
+  const statement = withStatement && audience ? canonicalLoginStatement(audience) : null;
   const message = {
+    ...statement ? { statement } : {},
     address,
     issuedAt: reuse?.issuedAt ?? Math.floor(Date.now() / 1e3),
     nonce: reuse?.nonce ?? hexlify(randomBytes(32)),
@@ -6798,7 +6826,7 @@ async function buildSignedLoginPayload(signer, chainId, audience, reuse) {
   };
   const signature = await signer.signTypedData(
     buildLoginDomain(chainId),
-    audience ? LOGIN_TYPES_WITH_AUDIENCE : LOGIN_TYPES,
+    statement ? LOGIN_TYPES_WITH_STATEMENT : audience ? LOGIN_TYPES_WITH_AUDIENCE : LOGIN_TYPES,
     message
   );
   return { chainId, message, signature };
@@ -6971,6 +6999,8 @@ var ServerSession = class {
   signer;
   serviceEndpoint;
   loginAudience;
+  /** Whether this session's login carries the human-readable statement. */
+  withStatement;
   chainId;
   store;
   onSignaturePrompt;
@@ -7012,6 +7042,13 @@ var ServerSession = class {
       /\/+$/,
       ""
     );
+    const explicitAudience = typeof opts.loginAudience === "string" && opts.loginAudience.length > 0;
+    this.withStatement = opts.withStatement === true && explicitAudience;
+    if (opts.withStatement === true && !explicitAudience) {
+      console.warn(
+        "[dh-sdk] withStatement ignored: it requires an explicit loginAudience, since the servers rebuild the expected sentence from the audience host"
+      );
+    }
     this.chainId = opts.chainId;
     this.store = opts.persistSession === false ? null : opts.sessionStore ?? createDefaultSessionStore();
     this.onSignaturePrompt = opts.onSignaturePrompt;
@@ -7265,12 +7302,16 @@ var ServerSession = class {
             this.signer,
             this.chainId,
             this.loginAudience,
-            reuse
+            reuse,
+            reuse ? reuse.withStatement === true : this.withStatement
           );
           if (storeKey && !reuse) {
             store.savePending?.(storeKey, {
               issuedAt: payload.message.issuedAt,
-              nonce: payload.message.nonce
+              nonce: payload.message.nonce,
+              // Recorded so a resume reproduces this digest even if the
+              // capability flag changes before the owners finish signing.
+              withStatement: this.withStatement
             });
           }
           session = await this.login(payload);
@@ -19625,6 +19666,9 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
         signer: config.authSigner ?? config.contractSigner,
         serviceEndpoint: config.serviceEndpoint,
         loginAudience: config.loginAudience,
+        // Only meaningful alongside an audience; the servers derive the expected
+        // sentence from its host. Defaults off so Node callers are untouched.
+        withStatement: config.loginStatement === true,
         chainId: config.chainId,
         persistSession: config.sessionPersistence?.enabled,
         sessionStore: config.sessionPersistence?.store,

package/dist/interfaces/chunks/config.i.d.ts

@@ -97,6 +97,25 @@ interface BaseSDKConfig {
      * endpoint they call.
      */
     loginAudience?: string;
+    /**
+     * Add the human-readable `statement` to the server-session login — the sentence
+     * a wallet renders instead of four opaque fields.
+     *
+     * OFF by default, and the default is load-bearing. `statement` changes the
+     * EIP-712 digest, and lit-ops-server chooses its field set by presence alone, so
+     * a client that sends one to a server which predates it has EVERY login
+     * rejected. Node callers (CLI, MCP, cr-monitor) have no signing UI to improve
+     * and should leave it off entirely.
+     *
+     * A browser sets this from the same capability flag that gates its own login
+     * statement (`LOGIN_STATEMENT_ENABLED`, served via `/v1/init`), which is what
+     * keeps the two in step: the flag asserts the server accepts statements, and
+     * both logins believe it or neither does.
+     *
+     * Ignored without `loginAudience` — the servers rebuild the expected sentence
+     * from the audience host, so a statement they cannot rebuild is one they reject.
+     */
+    loginStatement?: boolean;
     /**
      * Fires immediately before the server-session login requests a wallet
      * signature — never on the silent re-mint paths. Lets UIs show a

package/dist/safe-delegation.js

@@ -425,13 +425,13 @@ var MAINNET_DEPLOYMENT = {
       block: 25472956
     },
     BTCSpendAuthorizer: {
-      previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-      newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-      upgradedAt: "2026-07-06T10:40:59.000Z",
-      upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-      reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-      executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-      block: 25472957
+      previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+      newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+      upgradedAt: "2026-09-09T12:05:35.000Z",
+      upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+      reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+      executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+      block: 25939703
     },
     PositionManager: {
       previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -534,7 +534,7 @@ var MAINNET_DEPLOYMENT = {
     ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
     ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
     BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-    BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+    BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
     POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
     POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
     POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",

package/dist/safe-delegation.mjs

@@ -398,13 +398,13 @@ var MAINNET_DEPLOYMENT = {
       block: 25472956
     },
     BTCSpendAuthorizer: {
-      previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-      newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-      upgradedAt: "2026-07-06T10:40:59.000Z",
-      upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-      reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-      executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-      block: 25472957
+      previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+      newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+      upgradedAt: "2026-09-09T12:05:35.000Z",
+      upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+      reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+      executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+      block: 25939703
     },
     PositionManager: {
       previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -507,7 +507,7 @@ var MAINNET_DEPLOYMENT = {
     ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
     ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
     BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-    BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+    BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
     POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
     POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
     POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",

package/dist/sign-guard.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `@gvnrdao/dh-sdk/sign-guard` — the client-side guard between an untrusted
+ * lit-ops-server's bytes and a borrower's key.
+ *
+ * A SUBPATH rather than a main-index re-export, on purpose:
+ *
+ *  - it is consumed by the CLI (CJS, node) and the MCP (bundled) and must not
+ *    drag the whole SDK or `@gvnrdao/dh-lit-actions` into either; the files
+ *    under `utils/sign-guard/` import only `ethers` and three pure SDK
+ *    modules, enforced by `scripts/check-sign-guard-imports.mjs`;
+ *  - `TxValidationError` is exported from exactly one entry so `instanceof`
+ *    cannot split across module realms;
+ *  - the frontend shadows the bare `@gvnrdao/dh-sdk` specifier with an ambient
+ *    module; subpaths escape the shim and get the package's own types.
+ *
+ * What is here: the signable-function whitelist and its decoder, the
+ * unsigned-tx validator with its fee ceiling, the quantum/nonce helpers, the
+ * operation-envelope stamper, the three delegated-op specs, the lit-ops
+ * transport with envelope narrowing, the validate → banner → wrap → sign →
+ * broadcast pipeline, and the H-3 extension-fee bound.
+ *
+ * What is deliberately NOT here: how a consumer prompts, prints, stores a
+ * session JWT, reads its fee-ceiling override, or floors priority fees. Those
+ * are consumer policy and stay consumer-side.
+ */
+export * from "./utils/sign-guard";