@ixo/openhands-sdk 0.0.0-stage → 0.1.0

package/dist/esm/data/openness.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Whether an ask is still accepting submissions — the one question every
+ * surface with a submit button has to answer, answered in one place.
+ *
+ * The chain's `state` is not that answer. An ask that has paid every spot it
+ * holds, or whose end date has passed, still carries state 0 ("open") — the
+ * chain never flips it. Three surfaces each read `state === 0` and each told
+ * a person to go do work the gate would refuse: the button was the first lie,
+ * and the refusal after the click was where the truth finally surfaced. The
+ * difference between those two moments is somebody's afternoon.
+ */
+export interface AskWindow {
+    state: number;
+    quota: string | number;
+    approved: number;
+    /**
+     * The chain's own tally of claims **submitted** — `Collection.count`.
+     *
+     * This is what `x/claims` compares against the quota, and it is not
+     * `approved`. Optional only because older callers predate it; when it is
+     * absent this falls back to `approved`, which is the behaviour that was
+     * wrong — see the rule below.
+     */
+    count?: string | number | null;
+    endDate?: string | null;
+}
+export type Openness = {
+    open: true;
+}
+/** In the order a person would want the reason named: the chain said stop
+ *  (closed, paused), the money ran out (filled), the clock ran out (ended). */
+ | {
+    open: false;
+    why: "closed" | "paused" | "filled" | "ended";
+};
+export declare function askOpenness(ask: AskWindow, now?: Date): Openness;
+/**
+ * Why there is no door, including the reason that is not about this ask at
+ * all: it belongs to another application.
+ */
+export type AskDoor = Openness | {
+    open: false;
+    why: "elsewhere";
+};
+/**
+ * Whether **this deployment** can take an answer to this ask — which is the
+ * question a submit button is really asking, and a strictly harder one than
+ * `askOpenness`.
+ *
+ * The board learned this first. The public index returns every claim
+ * collection on the network, and most belong to other projects: an IXO World
+ * invoice, somebody's device telemetry, a protocol nobody here has heard of.
+ * They are open, they pay, they collect answers — through their own
+ * application. Ours cannot make their claims, and the chain agrees: their
+ * escrow account never granted this deployment's gate the right to admit a
+ * stranger, so every submission from here is refused after the work is done.
+ *
+ * That grant is the whole test. It is not a heuristic about naming or
+ * shape — it is the same fact the gate itself re-checks before it signs, so
+ * a door drawn on this answer is a door that opens.
+ *
+ * **Deliberately not tested: published criteria.** An Openhands ask may
+ * carry no `DoneMeans` and be checked by whoever posted it — the submit page
+ * says so in its own footnote. Reading their absence as "foreign" would take
+ * the door off honest asks whose poster reviews by hand.
+ *
+ * `authorized` is the set `takeableAdmins()` returns: admins that granted
+ * this gate. An RPC that fails yields an empty set, which shows no door — the
+ * safe direction, since the gate would refuse anyway.
+ */
+export declare function askDoor(ask: AskWindow & {
+    admin?: string | null;
+}, authorized: ReadonlySet<string>, now?: Date): AskDoor;
+/**
+ * How an ask stands, in the one sentence a worker needs before deciding.
+ *
+ * Lives beside `askOpenness` and not on the page that shows it, for the same
+ * reason: this is a fact about the ask, derived from the same four numbers,
+ * and `/submit` — the page a stranger opens from a chat link — sits exactly on
+ * the app's first-load ceiling. A sentence the server can write is a sentence
+ * the browser should not carry a rulebook to write for itself.
+ *
+ * Deliberately NOT shared with the share card's standing line. That one is an
+ * offer landing in somebody's chat ("Open to anyone with this link"); this one
+ * is a status line on the page they work from, and it counts the answers
+ * already queued ahead of them. Same facts, different audience, different
+ * register — flattening them would be tidiness at the reader's expense.
+ */
+export declare function standingLine(ask: AskWindow & {
+    count: number;
+    rejected: number;
+}, openness?: AskDoor): string;
+//# sourceMappingURL=openness.d.ts.map

package/dist/esm/data/openness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openness.d.ts","sourceRoot":"","sources":["../../../src/data/openness.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE;AAChB;+EAC+E;GAC7E;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAA;CAAE,CAAC;AAEnE,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,IAAiB,GAAG,QAAQ,CAsC5E;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAMpI;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,GAAE,OAA0B,GAAG,MAAM,CA8C/H"}

package/dist/esm/data/openness.js

@@ -0,0 +1,140 @@
+import { chainTime } from "./format.js";
+export function askOpenness(ask, now = new Date()) {
+    /* The chain's own word wins first: these states are explicit acts. */
+    if (ask.state === 2)
+        return { open: false, why: "closed" };
+    if (ask.state === 1)
+        return { open: false, why: "paused" };
+    /*
+     * **Filled counts submissions, because the chain counts submissions.**
+     *
+     * This counted approvals, and the chain does not. `x/claims` compares the
+     * quota against `Collection.count`, which increments the moment a claim is
+     * submitted — approved, rejected or still waiting. So an ask whose spots had
+     * all been used up by refusals read `open: true` here and answered
+     * *"collection for claim's quota has been reached"* on chain.
+     *
+     * Found the only way this kind of thing is found: on a phone, on a preview
+     * build, by somebody who had already walked to the mess and photographed it.
+     * The submit button was the first lie and the chain's refusal was where the
+     * truth arrived — which is the exact failure this whole function exists to
+     * prevent, in the one direction it had not been pointed.
+     *
+     * `approved` remains the fallback for callers that cannot supply the count:
+     * it under-reports fullness, which is the old bug, but a missing field must
+     * not make a working ask look closed.
+     *
+     * A quota of zero — or the millions some asks use to mean "no limit" — never
+     * fills; the same rule the submit page's spot counter follows.
+     */
+    const limit = Number(ask.quota) || 0;
+    const used = ask.count === undefined || ask.count === null ? ask.approved : Number(ask.count);
+    if (limit > 0 && Number.isFinite(used) && used >= limit)
+        return { open: false, why: "filled" };
+    /* The gate mints authorizations that expire at endDate, so past it every
+       submission fails on chain. Parsed as chain time: blocksync writes these
+       with no zone. */
+    const ends = chainTime(ask.endDate);
+    if (ends && ends.getTime() <= now.getTime())
+        return { open: false, why: "ended" };
+    return { open: true };
+}
+/**
+ * Whether **this deployment** can take an answer to this ask — which is the
+ * question a submit button is really asking, and a strictly harder one than
+ * `askOpenness`.
+ *
+ * The board learned this first. The public index returns every claim
+ * collection on the network, and most belong to other projects: an IXO World
+ * invoice, somebody's device telemetry, a protocol nobody here has heard of.
+ * They are open, they pay, they collect answers — through their own
+ * application. Ours cannot make their claims, and the chain agrees: their
+ * escrow account never granted this deployment's gate the right to admit a
+ * stranger, so every submission from here is refused after the work is done.
+ *
+ * That grant is the whole test. It is not a heuristic about naming or
+ * shape — it is the same fact the gate itself re-checks before it signs, so
+ * a door drawn on this answer is a door that opens.
+ *
+ * **Deliberately not tested: published criteria.** An Openhands ask may
+ * carry no `DoneMeans` and be checked by whoever posted it — the submit page
+ * says so in its own footnote. Reading their absence as "foreign" would take
+ * the door off honest asks whose poster reviews by hand.
+ *
+ * `authorized` is the set `takeableAdmins()` returns: admins that granted
+ * this gate. An RPC that fails yields an empty set, which shows no door — the
+ * safe direction, since the gate would refuse anyway.
+ */
+export function askDoor(ask, authorized, now = new Date()) {
+    /* The chain's own word and the clock first: an ask that is closed is closed
+       whoever posted it, and "closed" is the more useful thing to be told. */
+    const openness = askOpenness(ask, now);
+    if (!openness.open)
+        return openness;
+    return ask.admin && authorized.has(ask.admin) ? { open: true } : { open: false, why: "elsewhere" };
+}
+/**
+ * How an ask stands, in the one sentence a worker needs before deciding.
+ *
+ * Lives beside `askOpenness` and not on the page that shows it, for the same
+ * reason: this is a fact about the ask, derived from the same four numbers,
+ * and `/submit` — the page a stranger opens from a chat link — sits exactly on
+ * the app's first-load ceiling. A sentence the server can write is a sentence
+ * the browser should not carry a rulebook to write for itself.
+ *
+ * Deliberately NOT shared with the share card's standing line. That one is an
+ * offer landing in somebody's chat ("Open to anyone with this link"); this one
+ * is a status line on the page they work from, and it counts the answers
+ * already queued ahead of them. Same facts, different audience, different
+ * register — flattening them would be tidiness at the reader's expense.
+ */
+export function standingLine(ask, openness = askOpenness(ask)) {
+    if (!openness.open) {
+        /*
+         * The one reason that is not about this ask running out of anything. An
+         * ask posted by another application is still open, still paying, still
+         * collecting answers — just not through this door.
+         */
+        if (openness.why === "elsewhere")
+            return "Posted somewhere else. It takes answers there, not here.";
+        /*
+         * "Filled" is two different facts and a worker deserves the right one.
+         *
+         * A quota used up by approvals means the money went out. A quota used up
+         * by refusals means the spots are gone and nobody was paid — the chain
+         * counts a submission whatever became of it. Saying "every payout has been
+         * made" about an ask that paid nobody is a sentence that reads as a
+         * shrug and is actually a falsehood.
+         */
+        if (openness.why === "filled") {
+            return ask.approved > 0
+                ? "Every payout on this ask has been made."
+                : "This ask has taken all the answers it can, and none was approved.";
+        }
+        if (openness.why === "ended")
+            return "This ask ended before being filled.";
+        return "This ask is closed.";
+    }
+    const limit = Number(ask.quota) || 0;
+    /*
+     * Counted down from submissions, not approvals — the same correction the
+     * fill rule needed. A refused answer took a spot with it, and a worker
+     * deciding whether to walk somewhere is entitled to know that before the
+     * walk rather than after.
+     */
+    const spotsLeft = limit > 0 ? limit - ask.count : null;
+    /* What is queued ahead of you is the first thing worth knowing — it is the
+       difference between "the money is there" and "the money is spoken for". */
+    const waiting = ask.count - ask.approved - ask.rejected;
+    const others = waiting > 0 ? `${waiting} ${waiting === 1 ? "answer is" : "answers are"} waiting for review · ` : "";
+    if (spotsLeft === 1)
+        return `${others}first one approved is paid`;
+    /* Some asks set a limit in the millions, which is a way of saying "no
+       limit". Counting down from it is noise dressed as precision. */
+    if (spotsLeft !== null && limit <= 25)
+        return `${others}${spotsLeft} of ${limit} spots still pay`;
+    if (spotsLeft !== null)
+        return `${others}open to more answers`;
+    return others.replace(/ · $/, "");
+}
+//# sourceMappingURL=openness.js.map

package/dist/esm/data/openness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openness.js","sourceRoot":"","sources":["../../../src/data/openness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAoCxC,MAAM,UAAU,WAAW,CAAC,GAAc,EAAE,MAAY,IAAI,IAAI,EAAE;IAChE,sEAAsE;IACtE,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9F,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAE/F;;uBAEmB;IACnB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAElF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,OAAO,CAAC,GAA0C,EAAE,UAA+B,EAAE,MAAY,IAAI,IAAI,EAAE;IACzH;8EAC0E;IAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,GAAoD,EAAE,WAAoB,WAAW,CAAC,GAAG,CAAC;IACrH,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB;;;;WAIG;QACH,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW;YAAE,OAAO,0DAA0D,CAAC;QACpG;;;;;;;;WAQG;QACH,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,GAAG,CAAC;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,mEAAmE,CAAC;QAC1E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO;YAAE,OAAO,qCAAqC,CAAC;QAC3E,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC;;;;;OAKG;IACH,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvD;gFAC4E;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpH,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,GAAG,MAAM,4BAA4B,CAAC;IAClE;sEACkE;IAClE,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,MAAM,GAAG,SAAS,OAAO,KAAK,kBAAkB,CAAC;IAClG,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,GAAG,MAAM,sBAAsB,CAAC;IAC/D,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/esm/data/oracleInfo.d.ts

@@ -0,0 +1,20 @@
+/**
+ * What the oracle charges, asked of the oracle itself.
+ *
+ * An eval-oracle serves `GET /v1/info` with its address and its
+ * `pricing.evaluation` — the smallest evaluation leg a collection may carry
+ * before it refuses to register. Reading it here means the composer quotes
+ * the price the oracle will actually hold an ask to, rather than a number a
+ * deployment typed once. Server-side only; a browser never calls the oracle.
+ */
+export interface OracleInfo {
+    address: string;
+    name: string;
+    /** The minimum evaluation leg, in base units of `denom`. */
+    priceBase: number;
+    denom: string;
+}
+export type FetchJson = (url: string) => Promise<unknown>;
+/** Null when there is no oracle URL, it does not answer, or its answer names no price. */
+export declare function oracleInfo(baseUrl: string, read?: FetchJson): Promise<OracleInfo | null>;
+//# sourceMappingURL=oracleInfo.d.ts.map

package/dist/esm/data/oracleInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracleInfo.d.ts","sourceRoot":"","sources":["../../../src/data/oracleInfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAO1D,0FAA0F;AAC1F,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,SAAqB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAezG"}

package/dist/esm/data/oracleInfo.js

@@ -0,0 +1,35 @@
+/**
+ * What the oracle charges, asked of the oracle itself.
+ *
+ * An eval-oracle serves `GET /v1/info` with its address and its
+ * `pricing.evaluation` — the smallest evaluation leg a collection may carry
+ * before it refuses to register. Reading it here means the composer quotes
+ * the price the oracle will actually hold an ask to, rather than a number a
+ * deployment typed once. Server-side only; a browser never calls the oracle.
+ */
+const TIMEOUT_MS = 5_000;
+const fetchJson = async (url) => {
+    const response = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS), headers: { accept: "application/json" } });
+    return response.ok ? response.json() : null;
+};
+/** Null when there is no oracle URL, it does not answer, or its answer names no price. */
+export async function oracleInfo(baseUrl, read = fetchJson) {
+    const base = (baseUrl || "").replace(/\/$/, "");
+    if (!/^https?:\/\//.test(base))
+        return null;
+    let doc;
+    try {
+        doc = await read(`${base}/v1/info`);
+    }
+    catch {
+        return null;
+    }
+    const info = doc;
+    const address = typeof info?.address === "string" ? info.address : "";
+    const denom = typeof info?.pricing?.evaluation?.denom === "string" ? info.pricing.evaluation.denom : "";
+    const amount = Number(info?.pricing?.evaluation?.minAmount);
+    if (!address || !denom || !Number.isFinite(amount) || amount < 0)
+        return null;
+    return { address, name: typeof info?.name === "string" && info.name ? info.name : "oracle", priceBase: Math.round(amount), denom };
+}
+//# sourceMappingURL=oracleInfo.js.map

package/dist/esm/data/oracleInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracleInfo.js","sourceRoot":"","sources":["../../../src/data/oracleInfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,MAAM,UAAU,GAAG,KAAK,CAAC;AAIzB,MAAM,SAAS,GAAc,KAAK,EAAE,GAAG,EAAE,EAAE;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACxH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,OAAkB,SAAS;IAC3E,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,GAAwH,CAAC;IACtI,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;AACrI,CAAC"}

package/dist/esm/data/oracles.d.ts

@@ -0,0 +1,44 @@
+/** Server-side reads of the oracles on chain. Never imported by client code. */
+import { type CardService } from "../rubric/card.ts";
+/**
+ * Who is offering to work, read from the chain rather than from a deploy.
+ *
+ * The checker used to be one address in `NEXT_PUBLIC_CHECKER_ADDRESS`, which
+ * meant hiring a different one was a redeploy and hiring somebody else's was
+ * impossible. An oracle entity carrying an Agent Card is the shop window: it
+ * says who the agent is, what it will do, and what it charges, and anyone can
+ * read it without asking us.
+ *
+ * "The authorization is the job offer" was the E-round's rule for how an agent
+ * finds work. This is its mirror: the card is how work finds an agent.
+ */
+export interface Oracle {
+    did: string;
+    /** The account that actually signs — the entity's owner, and the grantee named on an ask. */
+    address: string;
+    name: string;
+    description: string;
+    services: CardService[];
+    /** The cheapest service price in uixo, when the card names one. */
+    priceUixo: number | null;
+    /** Which criterion kinds it claims it can settle. */
+    serves: ("measure" | "judge" | "attest")[];
+}
+/**
+ * Every oracle on the network that publishes a card.
+ *
+ * An oracle without a card is not an error and not hidden — it simply has not
+ * said what it offers, so there is nothing honest to render for it. A card that
+ * will not load is the same case: the entity is still on chain, and the next
+ * read may well get it.
+ */
+export declare function loadOracles(limit?: number): Promise<Oracle[]>;
+/**
+ * The oracles that will rule on work. A checker must be able to settle machine-
+ * checked criteria at minimum — an agent that can only judge prose cannot be
+ * trusted with an ask whose terms include a measurement.
+ */
+export declare function loadCheckers(limit?: number): Promise<Oracle[]>;
+/** One oracle by the address that signs for it. */
+export declare function oracleByAddress(address: string): Promise<Oracle | null>;
+//# sourceMappingURL=oracles.d.ts.map

package/dist/esm/data/oracles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracles.d.ts","sourceRoot":"","sources":["../../../src/data/oracles.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAKhF,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrF;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mEAAmE;IACnE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,MAAM,EAAE,CAAC,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC;CAC5C;AAoDD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAuDhE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGjE;AAED,mDAAmD;AACnD,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI7E"}

package/dist/esm/data/oracles.js

@@ -0,0 +1,110 @@
+/** Server-side reads of the oracles on chain. Never imported by client code. */
+/* Relative rather than the `@ixo/openhands-sdk/rubric` alias so this module also runs
+   under plain Node type-stripping — the probe script and any future agent-side
+   caller resolve it without Next's path mapping. */
+import { parseAgentCard } from "../rubric/card.js";
+import { clampText, fetchPublicJson } from "./outbound.js";
+import { gql } from "./gql.js";
+const CARD_TIMEOUT_MS = 8000;
+/*
+ * A card is a stranger's document at a stranger's address.
+ *
+ * Both halves matter. The address is published on chain by whoever minted the
+ * oracle entity, so fetching it is our server going where somebody else chose —
+ * the same shape as the Profile URL, and bounded by the same rule. And the
+ * strings inside it are rendered in the checker picker on /ask and on an
+ * agent's record, so they are cut to a length a page can hold.
+ *
+ * The service list is capped too. A card claiming ten thousand services is not
+ * an offer, and the picker would try to draw all of them.
+ */
+const NAME_MAX = 60;
+const DESCRIPTION_MAX = 200;
+const SERVICES_MAX = 20;
+async function fetchCard(url) {
+    const card = parseAgentCard(await fetchPublicJson(url, { timeoutMs: CARD_TIMEOUT_MS, revalidate: 300 }));
+    if (!card)
+        return null;
+    const subject = card.credentialSubject;
+    return {
+        ...card,
+        credentialSubject: {
+            ...subject,
+            name: clampText(subject.name, NAME_MAX) ?? "",
+            description: clampText(subject.description, DESCRIPTION_MAX) ?? "",
+            services: (subject.services ?? []).slice(0, SERVICES_MAX).map((service) => ({
+                ...service,
+                name: clampText(service.name, NAME_MAX) ?? "",
+                description: clampText(service.description, DESCRIPTION_MAX) ?? ""
+            }))
+        }
+    };
+}
+/**
+ * Every oracle on the network that publishes a card.
+ *
+ * An oracle without a card is not an error and not hidden — it simply has not
+ * said what it offers, so there is nothing honest to render for it. A card that
+ * will not load is the same case: the entity is still on chain, and the next
+ * read may well get it.
+ */
+export async function loadOracles(limit = 200) {
+    /*
+     * Every active oracle, not a page of them. Blocksync sorts ids lexically, so
+     * a `first: 30` returns the alphabetically-first thirty rather than the most
+     * relevant thirty — the same trap that once made ten asks on the board render
+     * as "Ask #id". There are 66 oracles on testnet and 2 publish a card, so the
+     * honest read is: take them all, then fetch only the cards that exist.
+     */
+    const data = await gql(`query { entities(filter: {type: {equalTo: "oracle"}, status: {equalTo: 0}}, first: ${limit}) { nodes { id type status owner } } }`, 60).catch(() => null);
+    const entities = data?.entities?.nodes ?? [];
+    if (entities.length === 0)
+        return [];
+    const ids = entities.map((entity) => JSON.stringify(entity.id)).join(",");
+    const iidData = await gql(`query { iids(filter: {id: {in: [${ids}]}}, first: ${limit}) { nodes { id linkedResource } } }`, 60).catch(() => null);
+    const resources = new Map((iidData?.iids?.nodes ?? []).map((node) => [node.id, node.linkedResource ?? []]));
+    const owners = new Map(entities.map((entity) => [entity.id, entity.owner ?? ""]));
+    /* Only entities that actually anchor a card cost an HTTP fetch. */
+    const carded = entities.filter((entity) => (resources.get(entity.id) ?? []).some((resource) => resource.id.endsWith("#acard") || resource.type === "agentCard"));
+    const cards = await Promise.all(carded.map(async (entity) => {
+        const acard = (resources.get(entity.id) ?? []).find((resource) => resource.id.endsWith("#acard") || resource.type === "agentCard");
+        if (!acard?.serviceEndpoint)
+            return null;
+        const card = await fetchCard(acard.serviceEndpoint);
+        if (!card)
+            return null;
+        const services = card.credentialSubject.services ?? [];
+        const prices = services.map((service) => service.price?.amount).filter((amount) => typeof amount === "number" && amount > 0);
+        const serves = new Set();
+        for (const service of services)
+            for (const kind of service.serves ?? ["measure"])
+                serves.add(kind);
+        return {
+            did: entity.id,
+            address: owners.get(entity.id) ?? "",
+            name: card.credentialSubject.name,
+            description: card.credentialSubject.description,
+            services,
+            priceUixo: prices.length ? Math.min(...prices) : null,
+            serves: [...serves]
+        };
+    }));
+    return cards.filter((oracle) => Boolean(oracle) && Boolean(oracle?.address));
+}
+/**
+ * The oracles that will rule on work. A checker must be able to settle machine-
+ * checked criteria at minimum — an agent that can only judge prose cannot be
+ * trusted with an ask whose terms include a measurement.
+ */
+export async function loadCheckers(limit = 200) {
+    const oracles = await loadOracles(limit);
+    return oracles.filter((oracle) => oracle.serves.includes("measure") && oracle.services.some((service) => service.id.startsWith("check")));
+}
+/** One oracle by the address that signs for it. */
+export async function oracleByAddress(address) {
+    if (!address)
+        return null;
+    const oracles = await loadOracles(200).catch(() => []);
+    return oracles.find((oracle) => oracle.address === address) ?? null;
+}
+//# sourceMappingURL=oracles.js.map

package/dist/esm/data/oracles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracles.js","sourceRoot":"","sources":["../../../src/data/oracles.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF;;oDAEoD;AACpD,OAAO,EAAE,cAAc,EAAoC,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAwC/B,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACvC,OAAO;QACL,GAAG,IAAI;QACP,iBAAiB,EAAE;YACjB,GAAG,OAAO;YACV,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YAC7C,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,EAAE;YAClE,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1E,GAAG,OAAO;gBACV,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;gBAC7C,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,EAAE;aACnE,CAAC,CAAC;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAK,GAAG,GAAG;IAC3C;;;;;;OAMG;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,sFAAsF,KAAK,wCAAwC,EACnI,EAAE,CACH,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,mCAAmC,GAAG,eAAe,KAAK,qCAAqC,EAC/F,EAAE,CACH,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAElF,mEAAmE;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,CACrH,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QACnI,IAAI,CAAC,KAAK,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/I,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnG,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI;YACjC,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,WAAW;YAC/C,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YACrD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;SACH,CAAC;IACrB,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAK,GAAG,GAAG;IAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC"}

package/dist/esm/data/outbound.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Where this server is willing to go, and how much it will believe when it
+ * gets there.
+ *
+ * Openhands reads the whole network. Most of what it renders was written by
+ * somebody else: an entity's name, an agent's card, the URLs both of those
+ * point at. That is the product working — a stranger's oracle should be
+ * hireable without asking us — and it means our server routinely makes requests
+ * an untrusted party chose the address of, and renders strings an untrusted
+ * party wrote.
+ *
+ * Neither of those is a bug. Doing them unbounded is. This is the one place
+ * that says what the bounds are, so a third caller does not invent a third
+ * answer.
+ */
+/**
+ * `https` only. Not prudishness — plain http is how you reach the addresses
+ * above without TLS complaining, and there is no public document that needs it.
+ *
+ * What this does **not** stop is DNS rebinding: a hostname that answers with a
+ * public address when checked and a private one when fetched. Closing that
+ * needs resolution-time pinning, which is a bigger machine than the risk here
+ * justifies — every response below is parsed as JSON and a handful of known
+ * fields are read out of it.
+ */
+export declare const reachable: (url: string) => boolean;
+/**
+ * Fetch a small public JSON document, or nothing.
+ *
+ * Nothing is the answer to every failure — refused address, bad status, a
+ * redirect that lands somewhere the address check would have refused, a body
+ * too big to be the document it claims to be, malformed JSON. None of these are
+ * errors worth propagating: a name or a card is decoration on a page whose
+ * subject is money, and the page has to render without it.
+ */
+export declare function fetchPublicJson(url: string, options?: {
+    timeoutMs?: number;
+    maxBytes?: number;
+    revalidate?: number;
+}): Promise<unknown | null>;
+/**
+ * A string somebody else wrote, made safe to put on a page.
+ *
+ * Control characters out — that is how a name becomes two lines, or borrows the
+ * shape of a label the page uses for something it verified — and a ceiling,
+ * because past a certain length it is not a name, it is a way of ruining a page
+ * that does not belong to whoever wrote it.
+ */
+export declare const clampText: (raw: unknown, max: number) => string | null;
+//# sourceMappingURL=outbound.d.ts.map

package/dist/esm/data/outbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../../src/data/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,OAQvC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAqBxJ;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,KAAK,OAAO,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,IAM9D,CAAC"}

package/dist/esm/data/outbound.js

@@ -0,0 +1,96 @@
+/**
+ * Where this server is willing to go, and how much it will believe when it
+ * gets there.
+ *
+ * Openhands reads the whole network. Most of what it renders was written by
+ * somebody else: an entity's name, an agent's card, the URLs both of those
+ * point at. That is the product working — a stranger's oracle should be
+ * hireable without asking us — and it means our server routinely makes requests
+ * an untrusted party chose the address of, and renders strings an untrusted
+ * party wrote.
+ *
+ * Neither of those is a bug. Doing them unbounded is. This is the one place
+ * that says what the bounds are, so a third caller does not invent a third
+ * answer.
+ */
+/**
+ * Hosts that are ours rather than the internet's.
+ *
+ * Reaching one of these on a stranger's instruction is the shape of an SSRF:
+ * cloud metadata at `169.254.169.254`, a database on `10.x`, a homeserver on
+ * localhost. None of them can be a legitimate profile or agent card.
+ */
+const PRIVATE_HOST = /^(localhost|0\.0\.0\.0|\[?::1\]?|10\.\d+\.\d+\.\d+|127\.\d+\.\d+\.\d+|169\.254\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|\[?f[cd][0-9a-f]{2}:|\[?fe80:)/i;
+/**
+ * `https` only. Not prudishness — plain http is how you reach the addresses
+ * above without TLS complaining, and there is no public document that needs it.
+ *
+ * What this does **not** stop is DNS rebinding: a hostname that answers with a
+ * public address when checked and a private one when fetched. Closing that
+ * needs resolution-time pinning, which is a bigger machine than the risk here
+ * justifies — every response below is parsed as JSON and a handful of known
+ * fields are read out of it.
+ */
+export const reachable = (url) => {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:")
+            return false;
+        return !PRIVATE_HOST.test(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Fetch a small public JSON document, or nothing.
+ *
+ * Nothing is the answer to every failure — refused address, bad status, a
+ * redirect that lands somewhere the address check would have refused, a body
+ * too big to be the document it claims to be, malformed JSON. None of these are
+ * errors worth propagating: a name or a card is decoration on a page whose
+ * subject is money, and the page has to render without it.
+ */
+export async function fetchPublicJson(url, options = {}) {
+    const { timeoutMs = 8000, maxBytes = 64 * 1024, revalidate = 300 } = options;
+    if (!reachable(url))
+        return null;
+    try {
+        /* `next` is Next's own addition to RequestInit and is absent from the plain
+           Node lib these files are also typechecked against. */
+        const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs), redirect: "follow", next: { revalidate } });
+        if (!response.ok)
+            return null;
+        /* A redirect can land somewhere the first check would have refused, so the
+           address actually reached is checked too. */
+        if (response.url && !reachable(response.url))
+            return null;
+        if (Number(response.headers.get("content-length") ?? 0) > maxBytes)
+            return null;
+        const text = await response.text();
+        if (text.length > maxBytes)
+            return null;
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A string somebody else wrote, made safe to put on a page.
+ *
+ * Control characters out — that is how a name becomes two lines, or borrows the
+ * shape of a label the page uses for something it verified — and a ceiling,
+ * because past a certain length it is not a name, it is a way of ruining a page
+ * that does not belong to whoever wrote it.
+ */
+export const clampText = (raw, max) => {
+    if (typeof raw !== "string")
+        return null;
+    // eslint-disable-next-line no-control-regex -- stripping them is the point
+    const text = raw.replace(/[\u0000-\u001f\u007f\u2028\u2029]/g, " ").replace(/\s+/g, " ").trim();
+    if (!text)
+        return null;
+    return text.length <= max ? text : `${text.slice(0, max)}…`;
+};
+//# sourceMappingURL=outbound.js.map

package/dist/esm/data/outbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.js","sourceRoot":"","sources":["../../../src/data/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;GAMG;AACH,MAAM,YAAY,GAChB,+KAA+K,CAAC;AAElL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,UAA0E,EAAE;IAC7H,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,IAAI,CAAC;QACH;gEACwD;QACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAiB,CAAC,CAAC;QACvI,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B;sDAC8C;QAC9C,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEhF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAY,EAAE,GAAW,EAAiB,EAAE;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,2EAA2E;IAC3E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AAC9D,CAAC,CAAC"}