@gvnrdao/dh-sdk 0.0.347 → 0.0.348

package/dist/interfaces/chunks/loan-operations.i.d.ts

@@ -205,12 +205,6 @@ export interface UCDMintRequest {
     skipValidation?: boolean;
     rpcUrl?: string;
     testBtcPrice?: number;
-    debugOverrides?: {
-        useStubbedBtcData?: boolean;
-        stubbedBtcPriceUsd?: string;
-        stubbedAvailableBtcSats?: string;
-        stubbedAuthorizedSpendsHash?: string;
-    };
     /**
      * Supplies the borrower authorization envelope instead of the connected
      * signer — the seam a delegated Safe uses so its agent signs instantly

package/dist/modules/diamond-hands-sdk.d.ts

@@ -158,17 +158,21 @@ export declare class DiamondHandsSDK {
      * from live chain state so a half-done ceremony resumes.
      *
      * Service-mode only — the server holds the Chipotle account that mints the
-     * PKP and it gates the route to current Safe owners. `knownAgentAddress` is
-     * the caller-persisted agent from an earlier prepare whose ceremony has not
-     * landed yet; echoing it back prevents a duplicate mint after a server
-     * restart.
+     * PKP and it gates the route to current Safe owners. `knownAgentAddress` +
+     * `knownAgentConsent` are the caller-persisted agent and its binding consent
+     * from an earlier prepare whose ceremony has not landed yet; echoing them back
+     * prevents a duplicate mint after a server restart. The server reuses an
+     * address only with a consent that verifies for this Safe (issue #1197).
      */
     prepareSafeAgentModule(request: {
         safeAddress: string;
         knownAgentAddress?: string;
+        knownAgentConsent?: string;
     }): Promise<{
         status: "ready" | "already-delegated";
         agentAddress: string;
+        /** The agent's binding consent in the registration call; null when no registration is needed. */
+        agentConsent: string | null;
         moduleAddress: string;
         validUntil: number | null;
         calls: {

package/dist/modules/withdrawal-address/withdrawal-address.module.d.ts

@@ -56,8 +56,16 @@ export declare class WithdrawalAddressModule {
     private getRegistry;
     /** True iff the registry is wired for this network (enforcement is active). */
     isConfigured(): boolean;
-    /** keccak256 of the canonicalized address — matches the on-chain key. */
+    /**
+     * keccak256 of the canonicalized address — matches the on-chain key.
+     * @throws on mixed-case bech32, which has no canonical spelling (BIP-173).
+     */
     static addressHash(btcAddress: string): string;
+    /**
+     * The canonical spelling the registry keys on, or a VALIDATION failure for mixed-case
+     * bech32 — reported as a value, like every other failure of this module, never thrown.
+     */
+    private canonicalAddress;
     /**
      * Add a Bitcoin address to the caller's allowlist. It becomes usable only
      * after the registry's delay elapses. Returns the submitted tx.

package/dist/safe-delegation.js

@@ -330,7 +330,7 @@ var SEPOLIA_DEPLOYMENT = {
     BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
     BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x76E0a2c9d89562fD7c50b5f554d7fa25957e39Db",
     AGENT_DELEGATION_REGISTRY: "0x6AE7fc6bE0925126b9D25b1B7Ce5AD5d127ec025",
-    AGENT_DELEGATION_REGISTRY_IMPL: "0xE931E4b9ceF2A48Ac7D57192da4B523756cFC310",
+    AGENT_DELEGATION_REGISTRY_IMPL: "0x56a5af2C1549EFf70feD1F3BB8E1997717A84973",
     DH_AGENT_DELEGATE: "0xa5A14489ae883960df6E1463A41a47aBE9Ecc5AF"
   }
 };
@@ -483,14 +483,26 @@ var MAINNET_DEPLOYMENT = {
       block: 25669024
     },
     PositionManagerViews: {
-      previousImplementation: "0x9225647a30bbACA4Acc0491B786869036914242e",
-      newImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+      previousImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+      newImplementation: "0x8fe7aF14dB9Bef814c4c8fBc0ce206Cb17F25E8e",
       proxy: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
-      upgradedAt: "2026-08-03T08:34:23.000Z",
-      upgradedBy: "REPLACED, not upgraded. Fresh ERC1967Proxy (atomically initialized) + AdminModule generic-op 0x848a97186f0d PositionManager.setViews(proxy) \u2014 3-of-3, 24h timelock, executed in onchain-auth/.safe-batches/mainnet-release-execute-B.json",
-      reason: "2026-08 agent-stack release. The mainnet PositionManagerViews at 0x9225647a was deployed as a BARE implementation (EIP-1967 slot 0x00), so upgradeToAndCall reverts UUPSUnauthorizedCallContext \u2014 it could never be upgraded. PositionManager.setViews (added in the same Execute B batch) removed the repoint blocker, so Views was replaced behind a new proxy rather than upgraded. This makes the Pashov F3 renewal debt-ceiling check REACHABLE for the first time: ExceedsMaxLoan (0x499e7985) is present in 0xE68DC096 and absent from 0x9225647a. Views holds no protocol state (8 wiring slots + roles + pause), which is what made replacement safe. The old contract is ABANDONED, not decommissioned \u2014 it stays live and callable as the rollback target for setViews. NOTE: VERSION reads 1.1.1 on both sides; verify by address.",
-      executeTx: "0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6",
-      block: 25673200
+      upgradedAt: "2026-10-17T12:16:35.000Z",
+      upgradedBy: "AdminModule generic-op 0x60494d283c30afb95748d8c1bb95b800ab8f17d2a2a45fb04784ebde7b05393c upgradeToAndCall(0x8fe7aF14, initializeV2(AdminModule)) \u2014 3-of-3 signatures (0x3030C041, 0x52b67f31, 0xfb3B8cbe), 24h timelock; proposed by Safe 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 in tx 0xffe3dd376736d542a89f944290b876d8eb8e5c3df8fc8349bc34a963106dd0f2, executed from Safe 0x52b67f31Ca7A58Ef20322512EB359b7D4758C868 via onchain-auth/.safe-batches/mainnet-pmv-backing-view-execute.json",
+      reason: "PoR vault-address gaps (tasks/vault-address-por-gaps-plan-2026-10-02.md, runbook tasks/RUNBOOK-pmv-backing-view-mainnet-2026-10-02.md). VERSION 1.1.1 -> 1.1.2: adds getBackingVaults (paged backing set: positions with ucdDebt > 0 and their stored vault addresses), locks the implementation (_disableInitializers constructor), and the call data initializeV2(AdminModule) consumes the previously OPEN reinitializer(2) (Cloudflare audit finding) without changing adminModule. No storage layout change. Post-upgrade: scripts/audit/backing-vaults-verify.ts PASS @ block 26226360 (72 positions, 15 backing vaults, view == independent scan; Initializable version 2; impl locked). Pre-proposed rollback op 0x43f50eb30d360a779f24c8229dd2d3b56a5d9eb40f056d3cd13047e5f0f51e84 (1/3 sigs) is to be cancelled by the proposer Safe via mainnet-pmv-backing-view-cancel-REVERT.json.",
+      executeTx: "0xbb36e557141827a0de990b7124ef8615352a2eb8c197efb3ce3a63998994fef5",
+      block: 26212216,
+      history: [
+        {
+          previousImplementation: "0x9225647a30bbACA4Acc0491B786869036914242e",
+          newImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+          proxy: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
+          upgradedAt: "2026-08-03T08:34:23.000Z",
+          upgradedBy: "REPLACED, not upgraded. Fresh ERC1967Proxy (atomically initialized) + AdminModule generic-op 0x848a97186f0d PositionManager.setViews(proxy) \u2014 3-of-3, 24h timelock, executed in onchain-auth/.safe-batches/mainnet-release-execute-B.json",
+          reason: "2026-08 agent-stack release. The mainnet PositionManagerViews at 0x9225647a was deployed as a BARE implementation (EIP-1967 slot 0x00), so upgradeToAndCall reverts UUPSUnauthorizedCallContext \u2014 it could never be upgraded. PositionManager.setViews (added in the same Execute B batch) removed the repoint blocker, so Views was replaced behind a new proxy rather than upgraded. This makes the Pashov F3 renewal debt-ceiling check REACHABLE for the first time: ExceedsMaxLoan (0x499e7985) is present in 0xE68DC096 and absent from 0x9225647a. Views holds no protocol state (8 wiring slots + roles + pause), which is what made replacement safe. The old contract is ABANDONED, not decommissioned \u2014 it stays live and callable as the rollback target for setViews. NOTE: VERSION reads 1.1.1 on both sides; verify by address.",
+          executeTx: "0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6",
+          block: 25673200
+        }
+      ]
     },
     AgentDelegationRegistry: {
       newImplementation: "0xa9fF405Edd4329fc3159a64F56B37EBD253e4928",

package/dist/safe-delegation.mjs

@@ -303,7 +303,7 @@ var SEPOLIA_DEPLOYMENT = {
     BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY: "0x6376D392097F0A81e51BD83960A97EA20eaf1dbe",
     BITCOIN_WITHDRAWAL_ADDRESS_REGISTRY_IMPL: "0x76E0a2c9d89562fD7c50b5f554d7fa25957e39Db",
     AGENT_DELEGATION_REGISTRY: "0x6AE7fc6bE0925126b9D25b1B7Ce5AD5d127ec025",
-    AGENT_DELEGATION_REGISTRY_IMPL: "0xE931E4b9ceF2A48Ac7D57192da4B523756cFC310",
+    AGENT_DELEGATION_REGISTRY_IMPL: "0x56a5af2C1549EFf70feD1F3BB8E1997717A84973",
     DH_AGENT_DELEGATE: "0xa5A14489ae883960df6E1463A41a47aBE9Ecc5AF"
   }
 };
@@ -456,14 +456,26 @@ var MAINNET_DEPLOYMENT = {
       block: 25669024
     },
     PositionManagerViews: {
-      previousImplementation: "0x9225647a30bbACA4Acc0491B786869036914242e",
-      newImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+      previousImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+      newImplementation: "0x8fe7aF14dB9Bef814c4c8fBc0ce206Cb17F25E8e",
       proxy: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
-      upgradedAt: "2026-08-03T08:34:23.000Z",
-      upgradedBy: "REPLACED, not upgraded. Fresh ERC1967Proxy (atomically initialized) + AdminModule generic-op 0x848a97186f0d PositionManager.setViews(proxy) \u2014 3-of-3, 24h timelock, executed in onchain-auth/.safe-batches/mainnet-release-execute-B.json",
-      reason: "2026-08 agent-stack release. The mainnet PositionManagerViews at 0x9225647a was deployed as a BARE implementation (EIP-1967 slot 0x00), so upgradeToAndCall reverts UUPSUnauthorizedCallContext \u2014 it could never be upgraded. PositionManager.setViews (added in the same Execute B batch) removed the repoint blocker, so Views was replaced behind a new proxy rather than upgraded. This makes the Pashov F3 renewal debt-ceiling check REACHABLE for the first time: ExceedsMaxLoan (0x499e7985) is present in 0xE68DC096 and absent from 0x9225647a. Views holds no protocol state (8 wiring slots + roles + pause), which is what made replacement safe. The old contract is ABANDONED, not decommissioned \u2014 it stays live and callable as the rollback target for setViews. NOTE: VERSION reads 1.1.1 on both sides; verify by address.",
-      executeTx: "0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6",
-      block: 25673200
+      upgradedAt: "2026-10-17T12:16:35.000Z",
+      upgradedBy: "AdminModule generic-op 0x60494d283c30afb95748d8c1bb95b800ab8f17d2a2a45fb04784ebde7b05393c upgradeToAndCall(0x8fe7aF14, initializeV2(AdminModule)) \u2014 3-of-3 signatures (0x3030C041, 0x52b67f31, 0xfb3B8cbe), 24h timelock; proposed by Safe 0x3030C0414B6d95aA9d5A57269E51a347fCBaB472 in tx 0xffe3dd376736d542a89f944290b876d8eb8e5c3df8fc8349bc34a963106dd0f2, executed from Safe 0x52b67f31Ca7A58Ef20322512EB359b7D4758C868 via onchain-auth/.safe-batches/mainnet-pmv-backing-view-execute.json",
+      reason: "PoR vault-address gaps (tasks/vault-address-por-gaps-plan-2026-10-02.md, runbook tasks/RUNBOOK-pmv-backing-view-mainnet-2026-10-02.md). VERSION 1.1.1 -> 1.1.2: adds getBackingVaults (paged backing set: positions with ucdDebt > 0 and their stored vault addresses), locks the implementation (_disableInitializers constructor), and the call data initializeV2(AdminModule) consumes the previously OPEN reinitializer(2) (Cloudflare audit finding) without changing adminModule. No storage layout change. Post-upgrade: scripts/audit/backing-vaults-verify.ts PASS @ block 26226360 (72 positions, 15 backing vaults, view == independent scan; Initializable version 2; impl locked). Pre-proposed rollback op 0x43f50eb30d360a779f24c8229dd2d3b56a5d9eb40f056d3cd13047e5f0f51e84 (1/3 sigs) is to be cancelled by the proposer Safe via mainnet-pmv-backing-view-cancel-REVERT.json.",
+      executeTx: "0xbb36e557141827a0de990b7124ef8615352a2eb8c197efb3ce3a63998994fef5",
+      block: 26212216,
+      history: [
+        {
+          previousImplementation: "0x9225647a30bbACA4Acc0491B786869036914242e",
+          newImplementation: "0xE68DC096A65Ecddbc6A9b5c6e5f878e2CE143Bfe",
+          proxy: "0x8B57954eA338c6A6bfF1457f71080e25baFF3937",
+          upgradedAt: "2026-08-03T08:34:23.000Z",
+          upgradedBy: "REPLACED, not upgraded. Fresh ERC1967Proxy (atomically initialized) + AdminModule generic-op 0x848a97186f0d PositionManager.setViews(proxy) \u2014 3-of-3, 24h timelock, executed in onchain-auth/.safe-batches/mainnet-release-execute-B.json",
+          reason: "2026-08 agent-stack release. The mainnet PositionManagerViews at 0x9225647a was deployed as a BARE implementation (EIP-1967 slot 0x00), so upgradeToAndCall reverts UUPSUnauthorizedCallContext \u2014 it could never be upgraded. PositionManager.setViews (added in the same Execute B batch) removed the repoint blocker, so Views was replaced behind a new proxy rather than upgraded. This makes the Pashov F3 renewal debt-ceiling check REACHABLE for the first time: ExceedsMaxLoan (0x499e7985) is present in 0xE68DC096 and absent from 0x9225647a. Views holds no protocol state (8 wiring slots + roles + pause), which is what made replacement safe. The old contract is ABANDONED, not decommissioned \u2014 it stays live and callable as the rollback target for setViews. NOTE: VERSION reads 1.1.1 on both sides; verify by address.",
+          executeTx: "0xf1f8d5fc13f45d7a3f932bf1a2d6e29381fdd41cd31298ad785bf7688df07fe6",
+          block: 25673200
+        }
+      ]
     },
     AgentDelegationRegistry: {
       newImplementation: "0xa9fF405Edd4329fc3159a64F56B37EBD253e4928",