@gvnrdao/dh-sdk 0.0.347 → 0.0.348

package/dist/utils/address-conversion.utils.d.ts

@@ -38,16 +38,29 @@ type BitcoinAddressNetwork = 'mainnet' | 'testnet' | 'regtest';
  * @throws if the address is malformed, fails its checksum, or is not on `network`
  */
 export declare function safeValidateBitcoinAddress(address: string, network: BitcoinAddressNetwork): string;
+/**
+ * Why `address` has no canonical spelling, or null when it has one. Pure — for callers that
+ * report failures as values (Result) rather than exceptions.
+ *
+ * BIP-173: a bech32/bech32m string is valid all-lowercase or all-uppercase, never mixed. A mixed
+ * string is not a typo we may repair by lowercasing — it is invalid, and folding it would let a
+ * corrupted address hash to a real allowlist entry. Base58 is case-sensitive by design and is
+ * never folded, so it is never a case error.
+ */
+export declare function bitcoinAddressCaseError(address: string): string | null;
 /**
  * Canonicalize a Bitcoin address so that the SAME string is used on both the
  * approve path (registry.addAddress) and the withdraw path. The on-chain
  * allowlist is keyed by keccak256(bytes(address)), so the two strings MUST
- * byte-match. Bech32 (bc1/tb1/bcrt1) is lower-case canonical, so we lower-case
- * it; Base58 (1.../3.../m.../n.../2...) is case-sensitive and is returned
- * unchanged.
+ * byte-match, and the contract accepts lowercase-only bech32.
+ *
+ * - bech32 (bc1/tb1/bcrt1): lowercase is canonical; an ALL-uppercase string
+ *   (BIP-173 allows it, e.g. QR codes) is lowercased; MIXED case throws.
+ * - base58 (1…/3…/m…/n…/2…): case-sensitive, returned unchanged.
  *
  * @param address Bitcoin address to canonicalize
  * @returns The canonical form to store/compare
+ * @throws on mixed-case bech32 — see `bitcoinAddressCaseError`
  */
 export declare function normalizeBitcoinAddress(address: string): string;
 /**

package/dist/utils/agent-delegation.utils.d.ts

@@ -5,9 +5,21 @@
  * this file owns the feature-specific orchestration (the lit-ops-server mint-agent endpoint).
  */
 /**
- * Mint a fresh per-user AGENT PKP via lit-ops-server and return its Ethereum address, to be
- * registered as the renewal agent in `AgentDelegationRegistry`. Each call yields a unique
- * address (satisfies the registry's AR-1 non-reuse). Throws on failure.
+ * EIP-712 types of the agent's binding consent (`contracts/docs/EIP712_DOMAIN_SPEC.md` §3.9).
+ * Domain: "DiamondHands.Protocol" v1, verifyingContract = the AgentDelegationRegistry proxy.
+ */
+export declare const AGENT_BINDING_CONSENT_TYPES: {
+    AgentBindingConsent: {
+        name: string;
+        type: string;
+    }[];
+};
+/**
+ * Mint a fresh per-user AGENT PKP via lit-ops-server and return its Ethereum address together
+ * with the agent's binding consent — the EIP-712 `AgentBindingConsent(user, agent)` signature
+ * AgentDelegationRegistry 3.0.0's `registerAgent` / `rotateAgent` require (issue #1197). The
+ * server signs it for the authenticated session address only. Each call yields a unique address
+ * (satisfies the registry's AR-1 non-reuse). Throws on failure.
  *
  * @param serviceEndpoint lit-ops-server base URL (the SDK's `serviceEndpoint`).
  * @param authHeader      Optional async/sync provider of auth headers (the SDK's session token).
@@ -17,7 +29,10 @@ export declare function mintAgentPkp(params: {
     serviceEndpoint: string;
     authHeader?: () => Promise<Record<string, string>> | Record<string, string>;
     timeoutMs?: number;
-}): Promise<string>;
+}): Promise<{
+    walletAddress: string;
+    agentConsent: string;
+}>;
 /** `AgentStatus` in `IAgentDelegateRegistryBase.sol`. */
 export declare const AGENT_STATUS: {
     readonly None: 0;

package/dist/utils/btc-spend-request-712.d.ts

@@ -0,0 +1,150 @@
+/**
+ * EIP-712 types for the BTC-custody owner authorizations — SDK copy.
+ *
+ * The withdrawal **execute** step and the stale-spend **invalidate** step
+ * (`contracts/docs/EIP712_DOMAIN_SPEC.md` §3.8). Before these types, both were
+ * `personal_sign` over a 32-byte packed hash that no wallet can decode
+ * (watchlist C-46); typed data lets the wallet show the destination, what the
+ * recipient receives, the fee and the total itself.
+ *
+ * ## Why this is a copy, and why that is safe
+ *
+ * The single source lives in `@gvnrdao/dh-lit-actions`
+ * (`lit-actions/src/constants/btc-spend-request-types.ts`), which the
+ * `btc-transaction-signer` / `btc-utxo-invalidator` verifiers read. The SDK's
+ * published `dh-lit-actions` dependency predates it, so this module re-declares
+ * the two field lists; `sdk/tests/shared/unit/btc-spend-request-712.test.ts`
+ * reads the golden vectors (`lit-actions/tests/vectors/btc-spend-request.v1.json`)
+ * and asserts every digest is byte-identical. Fold this into a re-export once
+ * the SDK depends on a `dh-lit-actions` that exports these names.
+ *
+ * ## The message comes from the chain, not the caller
+ *
+ * `readAuthorizedSpend` reads the `BTCSpendAuthorizer` record on the pinned
+ * proxy; the builders take destination, total deduction and outpoint from it.
+ * The Lit Action builds its message from the same record, so the wallet shows
+ * the borrower exactly what the transaction pays — never a server's claim.
+ */
+import { type ContractRunner, type Signer, type TypedDataField } from 'ethers';
+export declare const BTC_SPEND_REQUEST_712_DOMAIN_NAME = "DiamondHands.Protocol";
+export declare const BTC_SPEND_REQUEST_712_DOMAIN_VERSION = "1";
+export type BtcSpendRequest712PrimaryType = 'ExecuteBtcWithdrawalRequest' | 'InvalidateStaleSpendRequest';
+/**
+ * Field lists per primary type. **Order is part of the digest** — a change
+ * lands with the lit-actions constants, the descriptor and a CID rotation.
+ */
+export declare const BTC_SPEND_REQUEST_712_FIELDS: Readonly<Record<BtcSpendRequest712PrimaryType, readonly TypedDataField[]>>;
+export interface BtcSpendRequest712Domain {
+    readonly name: string;
+    readonly version: string;
+    readonly chainId: number;
+    readonly verifyingContract: string;
+}
+/** A complete `eth_signTypedData_v4` payload, without the `EIP712Domain` entry. */
+export interface BtcSpendRequest712Payload {
+    domain: BtcSpendRequest712Domain;
+    types: Record<string, TypedDataField[]>;
+    primaryType: BtcSpendRequest712PrimaryType;
+    message: Record<string, string | number>;
+}
+/** The `BTCSpendAuthorizer.getAuthorizedSpends` row a signature consumes. */
+export interface AuthorizedSpendRecord {
+    txid: string;
+    vout: number;
+    satoshis: bigint;
+    targetAddress: string;
+    targetAmount: bigint;
+    authorizedAt: bigint;
+}
+/** Returns ONLY the requested primary type. @throws on an unknown type. */
+export declare function btcSpendRequest712Types(primaryType: BtcSpendRequest712PrimaryType): Record<string, TypedDataField[]>;
+/** The pinned BTCSpendAuthorizer proxy for a chain. @throws for an unknown chain. */
+export declare function btcSpendAuthorizerAddress(chainId: number): string;
+/** Build the EIP-712 domain: the pinned BTCSpendAuthorizer proxy, never caller-supplied. */
+export declare function buildBtcSpendRequest712Domain(chainId: number): BtcSpendRequest712Domain;
+/** Canonical txid: lowercase, no `0x`, exactly 64 hex. @throws otherwise. */
+export declare function canonicalBtcTxid(txid: unknown): string;
+/**
+ * Read the on-chain spend record for one outpoint from the pinned
+ * BTCSpendAuthorizer. The outpoint is matched in canonical txid form.
+ *
+ * @throws if no record exists for the outpoint under this position.
+ */
+export declare function readAuthorizedSpend(params: {
+    runner: ContractRunner;
+    chainId: number;
+    positionId: string;
+    txid: string;
+    vout: number;
+}): Promise<AuthorizedSpendRecord>;
+/** @throws if `record` is not the record for `txid:vout` (canonical txid form). */
+export declare function assertRecordIsOutpoint(record: Pick<AuthorizedSpendRecord, 'txid' | 'vout'>, txid: string, vout: number): void;
+/**
+ * The typed execute payload, built from the on-chain record, the fee the
+ * transaction will pay and the input-set hash. Exported for Safe/precomputed
+ * signing and for tests.
+ *
+ * @throws on a non-integer or negative fee, or one not below the total.
+ */
+export declare function buildExecuteBtcWithdrawalTypedData(params: {
+    chainId: number;
+    positionId: string;
+    record: Pick<AuthorizedSpendRecord, 'txid' | 'vout' | 'targetAddress' | 'targetAmount'>;
+    networkFee: number;
+    inputSetHash: string;
+    quantumTimestamp: number;
+}): BtcSpendRequest712Payload;
+/** The typed invalidate payload over the on-chain record's outpoint. */
+export declare function buildInvalidateStaleSpendTypedData(params: {
+    chainId: number;
+    positionId: string;
+    record: Pick<AuthorizedSpendRecord, 'txid' | 'vout'>;
+    quantumTimestamp: number;
+}): BtcSpendRequest712Payload;
+/** EIP-712 digest of a payload — the hash a contract wallet's `isValidSignature` receives. */
+export declare function btcSpendRequest712Digest(payload: BtcSpendRequest712Payload): string;
+export declare const BTC_SPEND_QUANTUM_SECONDS = 60;
+/**
+ * Optional signer capability: re-stamp at the moment the wallet is actually
+ * asked. The hosted connector implements it, because the borrower may open
+ * the request long after the SDK built it. The signer calls `build` with the
+ * quantum start it stamps (and may call it again to re-stamp) and returns the
+ * signature with the stamp it signed.
+ */
+export interface RestampableTypedDataSigner {
+    dhRestampTypedData(build: (quantumTimestamp: number) => BtcSpendRequest712Payload): Promise<{
+        signature: string;
+        quantumTimestamp: number;
+    }>;
+}
+/**
+ * Latest moment, in seconds after the stamp, at which the SDK still relays a
+ * signature.
+ *
+ * The Lit Action accepts a stamp from the current or previous quantum, but
+ * its shared verifier first waits out the dead zone (seconds 52–59) and then
+ * re-checks the window, so a stamp from quantum S is only accepted when
+ * verification STARTS by second 51 of quantum S+1 — 111 s after the stamp.
+ * Verification starts after the server's chain reads and the signer's own
+ * RPC steps; 90 s leaves ~20 s for that trip. Past it, the refusal is
+ * certain, so nothing is relayed.
+ */
+export declare const BTC_SPEND_RELAY_DEADLINE_SECONDS = 90;
+/**
+ * Sign a BTC spend request as typed data, stamping the CURRENT quantum.
+ *
+ * The verifier accepts a typed execute stamp from the current or previous
+ * quantum (DR-6), so there is no pre-wait: the borrower has between 30 and
+ * 90 s from the prompt (depending on where in the quantum it opens), and a
+ * re-stamping signer that stamps at dispatch gets the full 90 s. After the
+ * wallet returns, a signature older than `BTC_SPEND_RELAY_DEADLINE_SECONDS`,
+ * or stamped in a quantum that has not started, is refused here ("signed too
+ * late") rather than relayed into a certain refusal.
+ *
+ * No `personal_sign` fallback: a signer without `signTypedData` throws.
+ */
+export declare function signBtcSpendRequest712(signer: Signer, build: (quantumTimestamp: number) => BtcSpendRequest712Payload): Promise<{
+    signature: string;
+    quantumTimestamp: number;
+    payload: BtcSpendRequest712Payload;
+}>;

package/dist/utils/btc-withdrawal-message.d.ts

@@ -1,11 +1,17 @@
 /**
- * Helpers for building the EIP-191 `execute-btc-withdrawal` envelope that the
+ * Helpers for building the `execute-btc-withdrawal` envelope that the
  * `btc-transaction-signer` LIT Action verifies.
  *
  * Pulled out of the CLI's executePendingWithdrawal util so the SDK and CLI
  * use the same logic and signing rules.
+ *
+ * Since A-2 (EIP712_DOMAIN_SPEC.md §3.8) the borrower signs an EIP-712
+ * `ExecuteBtcWithdrawalRequest` the wallet can display — destination, what
+ * the recipient receives, the fee and the total — instead of `personal_sign`
+ * over a 32-byte hash. The envelope shape sent to the server is unchanged.
  */
-import { type Signer } from "ethers";
+import { type ContractRunner, type Signer } from "ethers";
+import { type AuthorizedSpendRecord } from "./btc-spend-request-712";
 export interface BtcExecuteSignParams {
     positionId: string;
     txid: string;
@@ -37,17 +43,17 @@ export interface BtcExecuteSignedEnvelope {
     txid: string;
     vout: number;
     satoshis: number;
-    /** Bitcoin destination address bound into the signature. */
+    /** Bitcoin destination — the on-chain record's `targetAddress`. */
     targetAddress: string;
-    /** Authorized withdrawal amount (sats) bound into the signature. */
+    /** Total deduction in sats — the on-chain record's `targetAmount`. */
     targetAmount: number;
     networkFee: number;
     chainId: number;
-    /** Quantum-aligned timestamp (start of a 60s quantum). */
+    /** Quantum-aligned timestamp (start of a 60s quantum) the signature binds. */
     timestamp: number;
-    /** EIP-191 signature over the message hash. */
+    /** EIP-712 `ExecuteBtcWithdrawalRequest` signature. */
     userSignature: string;
-    /** Address recovered from the signer (borrower). */
+    /** Address of the signer (borrower, or PKP owner for a liquidated position). */
     borrowerAddress: string;
     /**
      * The FULL input set bound into the signature (P6/#8). The server must
@@ -57,30 +63,37 @@ export interface BtcExecuteSignedEnvelope {
     utxos: BtcExecuteInput[];
 }
 /**
- * Build the quantum-aligned timestamp + EIP-191 signature the
- * `/api/lit/pending-withdrawals/execute` endpoint expects.
- *
- * Audit CRIT-1: the signed message now binds `targetAddress` and `targetAmount`
- * in addition to the UTXO identifier. The previous shape bound only the UTXO,
- * delegating destination/amount enforcement to the Lit Action's on-chain
- * `getAuthorizedSpends` lookup. That single defense was reliable in practice
- * but the user-signed message is now self-describing — the Lit Action
- * cross-checks the user-signed values against the on-chain authorizer record
- * and refuses any disagreement, so a bug or future loosening of one side does
- * not silently redirect funds.
+ * Where the on-chain spend record comes from: a chain reader (the builder
+ * reads `BTCSpendAuthorizer.getAuthorizedSpends` itself) or a record the
+ * caller already read from the chain. Exactly one.
+ */
+export type AuthorizedSpendSource = {
+    provider: ContractRunner;
+    authorizedSpend?: never;
+} | {
+    authorizedSpend: AuthorizedSpendRecord;
+    provider?: never;
+};
+/**
+ * Build and sign the envelope the `/api/lit/pending-withdrawals/execute`
+ * endpoint expects.
  *
- * Caller passes the UTXO satoshis (from Phase 1 result) AND the user-authorized
- * destination + amount; this helper returns everything the server needs to
- * delegate to the BTC signer LIT Action.
+ * The destination and total come from the ON-CHAIN `BTCSpendAuthorizer`
+ * record for the outpoint, never from the caller: the borrower's wallet
+ * displays them, and the Lit Action builds the identical typed message from
+ * the same record. Caller-supplied `targetAddress` / `targetAmount` (e.g. from
+ * a server's pending-withdrawals list) are ASSERTIONS — a disagreement with
+ * the record throws before anything is signed.
  *
- * Wire-compat: this is a coordinated breaking change — the new SDK signatures
- * are not accepted by an older btc-transaction-signer Lit Action, and the new
- * Lit Action does not accept older SDK signatures. Deploy together.
+ * The stamp is the current quantum start; the signer accepts the current or
+ * previous quantum, so a borrower has 60–120 s to read and approve.
  */
-export declare function buildBtcExecuteEnvelope(params: BtcExecuteSignParams & {
+export declare function buildBtcExecuteEnvelope(params: BtcExecuteSignParams & AuthorizedSpendSource & {
     satoshis: number;
-    targetAddress: string;
-    targetAmount: number;
+    /** Expected destination; must equal the on-chain record. */
+    targetAddress?: string;
+    /** Expected total in sats; must equal the on-chain record. */
+    targetAmount?: number;
     /**
      * FULL input set the phase-2 signer may spend (P6/#8). Omit for the
      * common single-UTXO withdrawal — it defaults to exactly the authorized

package/dist/utils/sign-guard/index.d.ts

@@ -8,3 +8,4 @@ export { REQUEST_TIMEOUT_MS, LitOpsHttpError, LitOpsTransportError, fetchWithTim
 export { signAndBroadcast, type SignGuardSigner } from "./sign-and-broadcast";
 export { computeExtendFeeUpperBound, type ExtendFeeBound } from "./extend-fee-bound";
 export { buildPsmApproveTx, buildPsmSwapTx, buildPsmRedeemTx, planPsmExchange, executePsmPlan, psmExchangeReadsFromProvider, type PsmUnsignedTx, type PsmLeg, type PsmExchangeAddresses, type PsmExchangeReads, type PsmExchangePlan, } from "./psm-exchange";
+export { assertSignableTypedData, SIGNABLE_TYPED_DATA, TypedDataRefused, } from "./typed-data-guard";

package/dist/utils/sign-guard/typed-data-guard.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Typed-data allowlist — the check between an EIP-712 request and a
+ * borrower's wallet (A-2 plan, Step 8).
+ *
+ * A typed-data signature is only as safe as the struct it covers. Without a
+ * guard, any party that can put a request in front of the signer (a hostile
+ * server, a prompt-injected tool call) could ask for an EIP-2612 `Permit` or
+ * any other contract's typed data, and the borrower would see a well-formed
+ * prompt for something the protocol never asks for. This guard admits ONLY
+ * the typed requests Diamond Hands clients make, each pinned to its own
+ * domain, exact ordered field list and exact message keys, and returns the
+ * human label a signing card should show for it.
+ *
+ * Inventory (2026-10-19, every typed request a connector / CLI signer is
+ * asked for): the server login `DiamondHands` (three field-list variants:
+ * base, `audience`, `statement`+`audience`; `sdk/src/utils/eip712-login.ts`),
+ * the four loan `*Request` types under the LoanOperationsManager domain
+ * (`sdk/src/utils/borrower-authorization-712.ts`), and the two BTC-custody
+ * `*Request` types under the BTCSpendAuthorizer domain
+ * (`sdk/src/utils/btc-spend-request-712.ts`).
+ *
+ * PURE: imports only `ethers` and the address table
+ * (`scripts/check-sign-guard-imports.mjs`), so the field lists are declared
+ * here and `tests/shared/unit/sign-guard/typed-data-guard.test.ts` holds them
+ * in lockstep with the modules that build the requests.
+ */
+type Fields = ReadonlyArray<{
+    readonly name: string;
+    readonly type: string;
+}>;
+type DomainKind = "login" | "loan-operations" | "btc-spend-authorizer";
+interface AllowedType {
+    readonly label: string;
+    readonly domain: DomainKind;
+    /** Accepted field lists, each exact and ordered. */
+    readonly variants: ReadonlyArray<Fields>;
+}
+/**
+ * Every typed request a Diamond Hands client may put in front of a wallet.
+ * Deep-frozen: it is exported (tests and consumers read it), and a writable
+ * export would let any caller widen the guard's policy.
+ */
+export declare const SIGNABLE_TYPED_DATA: Readonly<Record<string, AllowedType>>;
+/** Refusal for a typed request outside the allowlist; the wallet is never asked. */
+export declare class TypedDataRefused extends Error {
+    constructor(reason: string);
+}
+/**
+ * Admit a typed-data request or throw `TypedDataRefused`.
+ *
+ * Checks, all required: the primary type `TypedDataEncoder.getPrimaryType`
+ * derives equals the one sent; it is on the allowlist and is the ONLY struct
+ * (besides an `EIP712Domain` entry); its field list is one allowed variant,
+ * exact and ordered; the domain has exactly the keys its kind allows (login:
+ * name, version, chainId; protocol: + verifyingContract; never `salt`), the
+ * expected name and version, `chainId` equal to the session's as a number,
+ * and the pinned contract for that kind; the message has exactly the field
+ * names as keys.
+ *
+ * @returns the human action label for the signing card.
+ */
+export declare function assertSignableTypedData(chainId: number, domain: Record<string, unknown>, types: Record<string, ReadonlyArray<{
+    name: string;
+    type: string;
+}>>, primaryType: string, message: Record<string, unknown>): {
+    label: string;
+};
+export {};

package/dist/utils/stale-spend-invalidate-message.d.ts

@@ -1,15 +1,20 @@
 /**
- * Borrower authorization envelope for the btc-utxo-invalidator Lit Action —
- * the SDK-side mirror of `AuthorizationModule.verifyRecoveryAuthorization`
- * (lit-actions/src/modules/authorization.module.ts:539). Field order and
- * types MUST match byte-for-byte; the action recomputes this hash and
- * EIP-191-recovers the borrower/delegate from it.
+ * Borrower authorization envelope for the btc-utxo-invalidator Lit Action.
  *
- * NOTE: the lit-actions side hashes with ethers v5 `solidityKeccak256`, this
- * side with v6 `solidityPackedKeccak256` — identical packed encoding; the
- * unit test asserts byte-equality of the preimages so drift cannot sneak in.
+ * Since A-2 (EIP712_DOMAIN_SPEC.md §3.8) the borrower signs an EIP-712
+ * `InvalidateStaleSpendRequest` over the on-chain record's outpoint, which
+ * the wallet can display, instead of `personal_sign` over a 32-byte hash.
+ *
+ * `buildInvalidateMessageHash` is kept: it is the legacy packed hash the Lit
+ * Action still accepts until the legacy arm is switched off, and the
+ * cross-package parity suites pin it. Field order and types MUST match
+ * `AuthorizationModule.verifyRecoveryAuthorization`
+ * (lit-actions/src/modules/authorization.module.ts) byte-for-byte; the
+ * lit-actions side hashes with ethers v5 `solidityKeccak256`, this side with
+ * v6 `solidityPackedKeccak256` — identical packed encoding.
  */
-import { type Signer } from "ethers";
+import { type ContractRunner, type Signer } from "ethers";
+import { type AuthorizedSpendRecord } from "./btc-spend-request-712";
 /** Must equal RECOVERY_INVALIDATE_ACTION_STRING in lit-actions constants. */
 export declare const RECOVERY_INVALIDATE_ACTION = "btc-utxo-invalidator";
 export interface InvalidateStaleSpendEnvelope {
@@ -20,10 +25,11 @@ export interface InvalidateStaleSpendEnvelope {
     timestamp: number;
     chainId: number;
     action: typeof RECOVERY_INVALIDATE_ACTION;
+    /** EIP-712 `InvalidateStaleSpendRequest` signature. */
     signature: string;
     borrowerAddress: string;
 }
-/** The exact packed hash `verifyRecoveryAuthorization` recomputes in-TEE. */
+/** The legacy packed hash `verifyRecoveryAuthorization` recomputes in-TEE. */
 export declare function buildInvalidateMessageHash(params: {
     positionId: string;
     timestamp: number;
@@ -32,10 +38,11 @@ export declare function buildInvalidateMessageHash(params: {
     utxoVout: number;
 }): string;
 /**
- * Build + sign the invalidate envelope with a quantum-aligned timestamp.
- * The signature is scoped to exactly one (positionId, utxoTxid, utxoVout)
- * recovery on one chain and cannot be replayed as any other authorization
- * (the action string is pinned into the hash).
+ * Build + sign the invalidate envelope. The outpoint the wallet displays is
+ * the on-chain record's: the builder reads it (or takes a record the caller
+ * already read from the chain) and refuses an outpoint with no record. The
+ * signature is scoped to exactly one (positionId, outpoint) recovery on one
+ * chain, and its primary type cannot be replayed as any other authorization.
  */
 export declare function buildInvalidateStaleSpendEnvelope(params: {
     positionId: string;
@@ -43,4 +50,10 @@ export declare function buildInvalidateStaleSpendEnvelope(params: {
     utxoVout: number;
     chainId: number;
     signer: Signer;
-}): Promise<InvalidateStaleSpendEnvelope>;
+} & ({
+    provider: ContractRunner;
+    authorizedSpend?: never;
+} | {
+    authorizedSpend: AuthorizedSpendRecord;
+    provider?: never;
+})): Promise<InvalidateStaleSpendEnvelope>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gvnrdao/dh-sdk",
-  "version": "0.0.347",
+  "version": "0.0.348",
   "description": "TypeScript SDK for Diamond Hands Protocol",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -77,9 +77,10 @@
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
     "authorize:pkp": "node scripts/authorize-pkp-actions.js",
-    "lint": "eslint src --ext .ts && npm run lint:server-boundary && npm run lint:sign-guard",
+    "lint": "eslint src --ext .ts && npm run lint:server-boundary && npm run lint:sign-guard && npm run lint:no-blind-sign",
     "lint:server-boundary": "node scripts/check-pkp-mint-server-imports.mjs",
     "lint:sign-guard": "node scripts/check-sign-guard-imports.mjs",
+    "lint:no-blind-sign": "node scripts/check-no-blind-borrower-sign.mjs",
     "clean": "rm -rf dist && rm -rf browser/dist",
     "gen:contract-errors": "node scripts/gen-contract-errors.mjs"
   },
@@ -100,8 +101,8 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@gvnrdao/dh-lit-actions": "^0.0.324",
-    "@gvnrdao/dh-lit-ops": "^0.0.321",
+    "@gvnrdao/dh-lit-actions": "^0.0.325",
+    "@gvnrdao/dh-lit-ops": "^0.0.322",
     "@noble/hashes": "^1.5.0",
     "axios": "^1.17.0",
     "bech32": "^2.0.0",