@gvnrdao/dh-sdk 0.0.337 → 0.0.339

package/dist/deployments.js

@@ -459,13 +459,13 @@ var MAINNET_DEPLOYMENT = {
       block: 25472956
     },
     BTCSpendAuthorizer: {
-      previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-      newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-      upgradedAt: "2026-07-06T10:40:59.000Z",
-      upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-      reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-      executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-      block: 25472957
+      previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+      newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+      upgradedAt: "2026-09-09T12:05:35.000Z",
+      upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+      reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+      executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+      block: 25939703
     },
     PositionManager: {
       previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -568,7 +568,7 @@ var MAINNET_DEPLOYMENT = {
     ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
     ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
     BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-    BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+    BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
     POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
     POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
     POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",

package/dist/deployments.mjs

@@ -426,13 +426,13 @@ var MAINNET_DEPLOYMENT = {
       block: 25472956
     },
     BTCSpendAuthorizer: {
-      previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-      newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-      upgradedAt: "2026-07-06T10:40:59.000Z",
-      upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-      reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-      executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-      block: 25472957
+      previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+      newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+      upgradedAt: "2026-09-09T12:05:35.000Z",
+      upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+      reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+      executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+      block: 25939703
     },
     PositionManager: {
       previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -535,7 +535,7 @@ var MAINNET_DEPLOYMENT = {
     ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
     ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
     BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-    BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+    BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
     POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
     POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
     POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",

package/dist/graphs/diamond-hands.d.ts

@@ -3,6 +3,7 @@ import type { LoanData } from "../interfaces";
 import type { GraphPositionWithBorrowerDTO } from "../types/graph-dtos";
 import type { LoanEvents, LoanEventsFilter } from "../types/event-types";
 import type { BitcoinOperations, EnrichedBitcoinBalance } from "../modules/bitcoin/bitcoin-operations.module";
+import { type BorrowerDebtRow } from "../utils/borrower-ucd-debt-summary";
 export interface DiamondHandsGraphConfig {
     endpoint: string;
     requestTimeoutMs?: number;
@@ -321,6 +322,19 @@ export declare class DiamondHandsGraph {
      * Get user positions from subgraph
      */
     private getUserPositionsOnly;
+    /**
+     * Raw `{ id, status, ucdDebt }` for EVERY position of a borrower: one round trip per
+     * 1000 positions, no count walk, no vault RPCs, and no `LoanData` transform (which
+     * coerces wei to a float and leaves `status` a string cast to the numeric enum).
+     *
+     * Deliberately issues the `GetUserPositions` document rather than a leaner one: the
+     * lit-ops graph proxy only passes allowlisted documents (graph-document-policy.ts),
+     * and that one is already listed, so this needs no server change. The extra fields
+     * cost bytes, not round trips.
+     *
+     * Throws past `BORROWER_DEBT_ROWS_MAX_PAGES` — never a partial set.
+     */
+    getBorrowerDebtRows(borrower: string): Promise<BorrowerDebtRow[]>;
     /**
      * Get user positions, plus an accurate total count.
      *

package/dist/index.d.ts

@@ -41,7 +41,7 @@ export type { DhServerLoginMessage, DhServerLoginPayload, } from './utils/eip712
 export { DEFAULT_LIT_NETWORK, VALID_LIT_NETWORKS, SDK_DEFAULTS, } from './constants/chunks/sdk-config';
 export { ALL_CONTRACTS, ALL_DEPLOYMENTS, getContractsByNetwork, getDeploymentByNetwork, LOCALHOST_CONTRACTS, SEPOLIA_CONTRACTS, } from './constants/chunks/deployment-addresses';
 export type { DeploymentContracts, DeploymentData, DeploymentLatestEnv, } from './constants/chunks/deployment-addresses';
-export type { CreateLoanRequest, CreateLoanResult, LoanData, LoanDataDetail, PaginatedLoansResponse, PKPValidationData, BitcoinAddresses, } from './interfaces/chunks/loan-operations.i';
+export type { CreateLoanRequest, CreateLoanResult, LoanData, LoanDataDetail, PaginatedLoansResponse, BorrowerUcdDebtSummary, BorrowerUcdDebtStatusCount, PKPValidationData, BitcoinAddresses, } from './interfaces/chunks/loan-operations.i';
 export type { DiamondHandsSDKConfig, SDKMode, ContractAddresses, BitcoinProviderConfig, } from './interfaces/chunks/config.i';
 export type { PKPData, PKPCreationRequest, PKPCreationResult, PKPValidationResult, } from './interfaces/chunks/pkp-integration.i';
 export type { AuthorizationRequest, AuthorizationResult, BTCDepositRequest, BTCDepositResult, } from './interfaces/chunks/requests.i';

package/dist/index.js

@@ -484,13 +484,13 @@ var init_deployment_addresses = __esm({
           block: 25472956
         },
         BTCSpendAuthorizer: {
-          previousImplementation: "0xb003ed89F695E8819a85513fE17260b805B3c478",
-          newImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
-          upgradedAt: "2026-07-06T10:40:59.000Z",
-          upgradedBy: "AdminModule/Safe audit-batch upgradeToAndCall; executed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f in tx 0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281 (block 25472957)",
-          reason: "Reconciled from chain \u2014 mainnet audit rollout batch (cross-ref onchain-auth/.safe-batches/mainnet-audit-execute.json)",
-          executeTx: "0xe1b1884a7e76c7fd569522545a04e49d5128d83d27b3892cda59f143b53b5281",
-          block: 25472957
+          previousImplementation: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+          newImplementation: "0x00D7a47798E8ff169104b748131703B78f23390C",
+          upgradedAt: "2026-09-09T12:05:35.000Z",
+          upgradedBy: "AdminModule generic op 0xc0214ff38bb454864a34f6482dcd03570b3fd04171c84be2c20184afb1a2e161 (bsa-1-7-0 ceremony: proposed by seat 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 2026-09-08T11:35:23Z, 3/3 seat signatures, 24h timelock); executeGenericAdminOperation sent by 0xF20986F02420EF443AE9BE5092FB8A4975cF3aA6 in tx 0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c (block 25939703)",
+          reason: "BTCSpendAuthorizer 1.6.0 -> 1.7.0: allow a full-vault sweep (targetAmount == satoshis); TargetMustLeaveFeeRoom -> TargetExceedsInputValue (PR #849; mainnet incidents 2026-09-04 and 2026-09-07). Impl deployed by 0xEba7BfAeB35ee18408b424Ee0BB45AdDf776589f at nonce 430 from source 0a7c535a1 (contracts/src identical to main 99b335f77). Cross-ref onchain-auth/.safe-batches/mainnet-bsa-1-7-0-{propose,sign,execute}.json and docs/mainnet-bsa-1-7-0-ceremony-2026-09-08.md",
+          executeTx: "0x77cd231966c546177bd8f1a07bd4e705afd5c2dfbd110b096836401679c0c69c",
+          block: 25939703
         },
         PositionManager: {
           previousImplementation: "0x600Dc0D1C2c0F94882B6Bc09172f8650047Ad5B1",
@@ -593,7 +593,7 @@ var init_deployment_addresses = __esm({
         ADMIN_MODULE: "0x0023B71B586795eE5fa4E83E384345C1EC8Bb946",
         ADMIN_MODULE_IMPL: "0xb4C5C7E051A1e672F014B25CB5D55B225Aa0D512",
         BTC_SPEND_AUTHORIZER: "0xfBbF108486fa07F1B06a811C5b66ed68DD9c508a",
-        BTC_SPEND_AUTHORIZER_IMPL: "0x40c9e8C46C65E0A57BB63da5368868A9E8Df81A5",
+        BTC_SPEND_AUTHORIZER_IMPL: "0x00D7a47798E8ff169104b748131703B78f23390C",
         POSITION_MANAGER_VIEWS: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
         POSITION_MANAGER_VIEWS_IMPL: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
         POSITION_MANAGER: "0x12A1836e56139ccaD8722B89519d84233efc224B",
@@ -6886,9 +6886,27 @@ var LOGIN_TYPES_WITH_AUDIENCE = {
     { name: "audience", type: "string" }
   ]
 };
-async function buildSignedLoginPayload(signer, chainId, audience, reuse) {
+var LOGIN_TYPES_WITH_STATEMENT = {
+  DiamondHands: [
+    { name: "statement", type: "string" },
+    { name: "address", type: "address" },
+    { name: "issuedAt", type: "uint256" },
+    { name: "nonce", type: "bytes32" },
+    { name: "audience", type: "string" }
+  ]
+};
+var LOGIN_STATEMENT_TEMPLATE = "{host} is verifying you own this wallet. Signing proves control of the address so we can show your loans and positions. It authorizes no transaction, moves no funds, and costs no gas.";
+function canonicalLoginStatement(audience) {
+  const host = /^https?:\/\/([^/?#]+)/i.exec(audience)?.[1];
+  if (!host)
+    return null;
+  return LOGIN_STATEMENT_TEMPLATE.replace("{host}", host);
+}
+async function buildSignedLoginPayload(signer, chainId, audience, reuse, withStatement = false) {
   const address = await signer.getAddress();
+  const statement = withStatement && audience ? canonicalLoginStatement(audience) : null;
   const message = {
+    ...statement ? { statement } : {},
     address,
     issuedAt: reuse?.issuedAt ?? Math.floor(Date.now() / 1e3),
     nonce: reuse?.nonce ?? (0, import_ethers4.hexlify)((0, import_ethers4.randomBytes)(32)),
@@ -6896,7 +6914,7 @@ async function buildSignedLoginPayload(signer, chainId, audience, reuse) {
   };
   const signature = await signer.signTypedData(
     buildLoginDomain(chainId),
-    audience ? LOGIN_TYPES_WITH_AUDIENCE : LOGIN_TYPES,
+    statement ? LOGIN_TYPES_WITH_STATEMENT : audience ? LOGIN_TYPES_WITH_AUDIENCE : LOGIN_TYPES,
     message
   );
   return { chainId, message, signature };
@@ -7069,6 +7087,8 @@ var ServerSession = class {
   signer;
   serviceEndpoint;
   loginAudience;
+  /** Whether this session's login carries the human-readable statement. */
+  withStatement;
   chainId;
   store;
   onSignaturePrompt;
@@ -7110,6 +7130,13 @@ var ServerSession = class {
       /\/+$/,
       ""
     );
+    const explicitAudience = typeof opts.loginAudience === "string" && opts.loginAudience.length > 0;
+    this.withStatement = opts.withStatement === true && explicitAudience;
+    if (opts.withStatement === true && !explicitAudience) {
+      console.warn(
+        "[dh-sdk] withStatement ignored: it requires an explicit loginAudience, since the servers rebuild the expected sentence from the audience host"
+      );
+    }
     this.chainId = opts.chainId;
     this.store = opts.persistSession === false ? null : opts.sessionStore ?? createDefaultSessionStore();
     this.onSignaturePrompt = opts.onSignaturePrompt;
@@ -7363,12 +7390,16 @@ var ServerSession = class {
             this.signer,
             this.chainId,
             this.loginAudience,
-            reuse
+            reuse,
+            reuse ? reuse.withStatement === true : this.withStatement
           );
           if (storeKey && !reuse) {
             store.savePending?.(storeKey, {
               issuedAt: payload.message.issuedAt,
-              nonce: payload.message.nonce
+              nonce: payload.message.nonce,
+              // Recorded so a resume reproduces this digest even if the
+              // capability flag changes before the owners finish signing.
+              withStatement: this.withStatement
             });
           }
           session = await this.login(payload);
@@ -10434,6 +10465,101 @@ var LoanStatus = /* @__PURE__ */ ((LoanStatus2) => {
 
 // src/modules/loan/loan-query.module.ts
 var import_ethers12 = require("ethers");
+
+// src/constants/chunks/sdk-limits.ts
+var THE_GRAPH_MAX_BATCH_SIZE = 1e3;
+
+// src/utils/borrower-ucd-debt-summary.ts
+var BORROWER_DEBT_ROWS_PAGE_SIZE = THE_GRAPH_MAX_BATCH_SIZE;
+var BORROWER_DEBT_ROWS_MAX_PAGES = 10;
+async function collectBorrowerDebtRows(fetchPage) {
+  const pageSize = BORROWER_DEBT_ROWS_PAGE_SIZE;
+  const rows = [];
+  for (let page = 0; page < BORROWER_DEBT_ROWS_MAX_PAGES; page++) {
+    const batch = await fetchPage(page * pageSize, pageSize);
+    if (batch.length > pageSize) {
+      throw new Error(
+        `Borrower debt page ${page} returned ${batch.length} rows for first: ${pageSize}`
+      );
+    }
+    rows.push(...batch);
+    if (batch.length < pageSize) {
+      return rows;
+    }
+  }
+  throw new Error(
+    `Borrower debt rows exceeded ${BORROWER_DEBT_ROWS_MAX_PAGES} pages of ${pageSize} (${rows.length} rows so far); refusing to return a partial total`
+  );
+}
+function parseSubgraphLoanStatus(label) {
+  if (typeof label !== "string") {
+    throw new Error(`Subgraph loan status is not a string: ${String(label)}`);
+  }
+  const value = LoanStatus[label];
+  if (typeof value !== "number") {
+    throw new Error(`Unknown subgraph loan status label: "${label}"`);
+  }
+  return value;
+}
+function parseSubgraphWei(row) {
+  const raw = row.ucdDebt || "0";
+  if (typeof raw !== "string") {
+    throw new Error(
+      `ucdDebt on position ${row.id} is not a string: ${String(raw)}`
+    );
+  }
+  let wei;
+  try {
+    wei = BigInt(raw);
+  } catch (error) {
+    throw new Error(
+      `ucdDebt on position ${row.id} is not an integer wei string: "${raw}"`,
+      { cause: error }
+    );
+  }
+  if (wei < 0n) {
+    throw new Error(`Negative ucdDebt on position ${row.id}: ${raw}`);
+  }
+  return wei;
+}
+var WEI_PER_UCD = 10n ** 18n;
+function weiToHumanUcdString(wei) {
+  if (wei < 0n) {
+    throw new Error(`Cannot render negative wei: ${wei}`);
+  }
+  const whole = wei / WEI_PER_UCD;
+  const frac = (wei % WEI_PER_UCD).toString().padStart(18, "0").replace(/0+$/, "");
+  return frac.length > 0 ? `${whole}.${frac}` : `${whole}`;
+}
+var STATUS_ORDINALS = Object.values(LoanStatus).filter((v) => typeof v === "number").sort((a, b) => a - b);
+function buildBorrowerUcdDebtSummary(borrower, rows, fetchedAt = Date.now()) {
+  let totalWei = 0n;
+  const counts = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    totalWei += parseSubgraphWei(row);
+    const status = parseSubgraphLoanStatus(row.status);
+    counts.set(status, (counts.get(status) ?? 0) + 1);
+  }
+  const byStatus = [];
+  for (const status of STATUS_ORDINALS) {
+    const count = counts.get(status);
+    if (count === void 0) {
+      continue;
+    }
+    byStatus.push({ status, statusLabel: LoanStatus[status], count });
+  }
+  return {
+    borrower: borrower.toLowerCase(),
+    loanCount: rows.length,
+    totalUcdDebt: totalWei.toString(),
+    totalUcdDebtHuman: weiToHumanUcdString(totalWei),
+    byStatus,
+    source: "subgraph",
+    fetchedAt
+  };
+}
+
+// src/modules/loan/loan-query.module.ts
 var POSITION_CORE_ABI = [
   "function getPositionDetails(bytes32) view returns (tuple(bytes32 positionId, bytes32 pkpId, uint256 ucdDebt, string vaultAddress, address borrower, uint40 createdAt, uint40 lastUpdated, uint16 selectedTerm, uint40 expiryAt, uint8 status, uint40 previousExpiryAt, uint16 totalTerm))"
 ];
@@ -10826,6 +10952,43 @@ var LoanQuery = class {
   async getLoansByBorrower(borrower, pagination, orderBy, orderDirection) {
     return this.getLoans({ borrower, orderBy, orderDirection }, pagination);
   }
+  /**
+   * Combined UCD debt + by-status counts for a borrower from ONE pass over the
+   * subgraph's raw rows (`graphClient.getBorrowerDebtRows`): BigInt wei sum, strict
+   * status labels, `source: "subgraph"`.
+   *
+   * INDEXED figure, not a transaction input — the subgraph lags writes. Anything that
+   * sizes a repayment reads the chain (`getPositionDetailsView`). Fails loud: a page
+   * failure or the page cap is a SUBGRAPH-category failure carrying the cause; there
+   * is no partial total.
+   */
+  async getBorrowerUcdDebtSummary(borrower) {
+    const trimmed = typeof borrower === "string" ? borrower.trim() : "";
+    if (!(0, import_ethers12.isAddress)(trimmed)) {
+      return failure(
+        new SDKError({
+          message: `Borrower must be an EVM address for a UCD debt summary, got "${trimmed}"`,
+          category: "VALIDATION" /* VALIDATION */,
+          severity: "LOW" /* LOW */,
+          context: { borrower: trimmed }
+        })
+      );
+    }
+    return tryCatchAsync(
+      async () => {
+        const rows = await this.config.graphClient.getBorrowerDebtRows(trimmed);
+        return buildBorrowerUcdDebtSummary(trimmed, rows);
+      },
+      (error) => error instanceof SDKError ? error : new SDKError({
+        message: `Borrower UCD debt summary failed for ${trimmed}: ${error instanceof Error ? error.message : String(error)}`,
+        category: "SUBGRAPH" /* SUBGRAPH */,
+        severity: "MEDIUM" /* MEDIUM */,
+        originalError: error instanceof Error ? error : void 0,
+        cause: error,
+        context: { borrower: trimmed }
+      })
+    );
+  }
   /**
    * Get active loans (status = ACTIVE)
    *
@@ -12360,10 +12523,36 @@ var GraphClient = class {
   }
 };
 
-// src/constants/chunks/sdk-limits.ts
-var THE_GRAPH_MAX_BATCH_SIZE = 1e3;
-
 // src/graphs/diamond-hands.ts
+var GET_USER_POSITIONS_DOCUMENT = `
+      query GetUserPositions($borrower: Bytes!, $first: Int, $skip: Int, $orderBy: Position_orderBy, $orderDirection: OrderDirection) {
+        user(id: $borrower) {
+          id
+          positions(first: $first, skip: $skip, orderBy: $orderBy, orderDirection: $orderDirection) {
+            id
+            pkpId
+            borrower {
+              createdAt
+              id
+            }
+            # btcAmount removed - balance is now queried on-chain via lit-actions with signature validation
+            ucdMinted
+            ucdPaid
+            ucdDebt
+            collateralRatio
+            requestedCollateralRatio
+            selectedTerm
+            status
+            createdAt
+            createdAtBlock
+            lastUpdated
+            originalTerm
+            remainingDebt
+            expiryAt
+          }
+        }
+      }
+    `;
 function normalizePkpId2(pkpId) {
   const raw = pkpId.startsWith("0x") ? pkpId.slice(2) : pkpId;
   if (raw.length === 64 && raw.startsWith("000000000000000000000000") && raw !== "0".repeat(64)) {
@@ -12681,35 +12870,7 @@ var DiamondHandsGraph = class {
    * Get user positions from subgraph
    */
   async getUserPositionsOnly(userAddress, first, skip, orderBy, orderDirection) {
-    const query = `
-      query GetUserPositions($borrower: Bytes!, $first: Int, $skip: Int, $orderBy: Position_orderBy, $orderDirection: OrderDirection) {
-        user(id: $borrower) {
-          id
-          positions(first: $first, skip: $skip, orderBy: $orderBy, orderDirection: $orderDirection) {
-            id
-            pkpId
-            borrower {
-              createdAt
-              id
-            }
-            # btcAmount removed - balance is now queried on-chain via lit-actions with signature validation
-            ucdMinted
-            ucdPaid
-            ucdDebt
-            collateralRatio
-            requestedCollateralRatio
-            selectedTerm
-            status
-            createdAt
-            createdAtBlock
-            lastUpdated
-            originalTerm
-            remainingDebt
-            expiryAt
-          }
-        }
-      }
-    `;
+    const query = GET_USER_POSITIONS_DOCUMENT;
     const variables = {
       borrower: userAddress.toLowerCase(),
       first: first || void 0,
@@ -12727,6 +12888,45 @@ var DiamondHandsGraph = class {
     }
     return positions;
   }
+  /**
+   * Raw `{ id, status, ucdDebt }` for EVERY position of a borrower: one round trip per
+   * 1000 positions, no count walk, no vault RPCs, and no `LoanData` transform (which
+   * coerces wei to a float and leaves `status` a string cast to the numeric enum).
+   *
+   * Deliberately issues the `GetUserPositions` document rather than a leaner one: the
+   * lit-ops graph proxy only passes allowlisted documents (graph-document-policy.ts),
+   * and that one is already listed, so this needs no server change. The extra fields
+   * cost bytes, not round trips.
+   *
+   * Throws past `BORROWER_DEBT_ROWS_MAX_PAGES` — never a partial set.
+   */
+  async getBorrowerDebtRows(borrower) {
+    const borrowerId = borrower.toLowerCase();
+    return collectBorrowerDebtRows(async (skip, first) => {
+      const result = await this.client.execute(GET_USER_POSITIONS_DOCUMENT, {
+        borrower: borrowerId,
+        first,
+        skip,
+        orderBy: "id",
+        orderDirection: "asc"
+      });
+      if (result?.user == null) {
+        if (skip > 0) {
+          throw new Error(
+            `getBorrowerDebtRows: user ${borrowerId} vanished from the subgraph at skip ${skip}`
+          );
+        }
+        return [];
+      }
+      const positions = result.user.positions;
+      if (!Array.isArray(positions)) {
+        throw new Error(
+          `getBorrowerDebtRows: subgraph returned no positions array for ${borrowerId} at skip ${skip}`
+        );
+      }
+      return positions.filter((p) => p != null);
+    });
+  }
   /**
    * Get user positions, plus an accurate total count.
    *
@@ -19709,6 +19909,9 @@ var DiamondHandsSDK = class _DiamondHandsSDK {
         signer: config.authSigner ?? config.contractSigner,
         serviceEndpoint: config.serviceEndpoint,
         loginAudience: config.loginAudience,
+        // Only meaningful alongside an audience; the servers derive the expected
+        // sentence from its host. Defaults off so Node callers are untouched.
+        withStatement: config.loginStatement === true,
         chainId: config.chainId,
         persistSession: config.sessionPersistence?.enabled,
         sessionStore: config.sessionPersistence?.store,
@@ -25674,6 +25877,18 @@ Message: ${causeMessage}${quantumContext}${mintDebtDiagnostics}`
   async getLoansByBorrower(borrower, pagination, orderBy, orderDirection) {
     return this.loanQuery.getLoansByBorrower(borrower, pagination, orderBy, orderDirection);
   }
+  /**
+   * Combined UCD debt (canonical wei string + display string) and by-status loan
+   * counts for a borrower, from one pass over the subgraph. `source: "subgraph"` —
+   * an INDEXED, informational figure that lags writes; never size a transaction
+   * from it (repayments read the chain via `getPositionDetailsView`).
+   *
+   * Fails loud with a SUBGRAPH-category `SDKError` (cause attached) on any page
+   * failure or past 10,000 positions; never returns a partial total.
+   */
+  async getBorrowerUcdDebtSummary(borrower) {
+    return this.loanQuery.getBorrowerUcdDebtSummary(borrower);
+  }
   /**
    * Get all active loans
    *