@ixo/openhands-sdk 0.0.0-stage → 0.1.0

package/dist/cjs/chain/accountProof.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Proving that a key may act for an account — the gate's question.
+ *
+ * A submission grant is issued to an address, and the youth app's gate must
+ * only issue one to somebody who can sign for that address. The obvious
+ * check — sign a fresh message, derive the address from the public key,
+ * compare — is wrong for the one kind of account this app has: an auth-hub
+ * account is a **smart account**, and the key a browser holds for it is a
+ * *session key* the hub registered on chain as a `SignatureVerification`
+ * authenticator. That key's own address is not the account's, and never
+ * will be. Deriving an address from it proves only that some key exists.
+ *
+ * So the check is the chain's own: the signature must verify against the
+ * public key it names, and that public key must be a live authenticator of
+ * the account the grant is for. A plain key whose derived address *is* the
+ * account still passes, because that is the older, simpler case of the same
+ * fact. Pure, so a test can hand it any authenticator list it likes; the
+ * index read lives in `@ixo/openhands-sdk/data/authenticators`.
+ */
+export interface SubmitProof {
+    kind: string;
+    /** Compressed secp256k1 public key, base64. */
+    pubkey: string;
+    /** 64 bytes r‖s, base64. */
+    signature: string;
+    /** The exact words that were signed — see `submitProofMessage`. */
+    message: string;
+}
+/**
+ * A signature is a moment, not a standing permission — but the window is a
+ * day, not five minutes (2026-09-20). Five refused two people whose phones
+ * ran hours wrong, and what a replay inside the window buys is one more
+ * submission grant for an address the replayer cannot sign for, idempotent
+ * and rate-limited. The app now signs with the server's clock anyway
+ * (the youth app's lib/clock.ts); the day is for the phone that never learned it.
+ */
+export declare const PROOF_MAX_AGE_MS: number;
+/** The words a submitter signs: one ask, one address, one moment. */
+export declare const submitProofMessage: (collectionId: string, address: string, now?: number) => string;
+/**
+ * Whether the signed words are the ones this grant is about, and fresh.
+ *
+ * Checked before any cryptography, because a message that names another
+ * ask or another address is refused whoever signed it, and a stale one is
+ * worth nothing even from the right key.
+ */
+export declare function readSubmitProof(message: string, expected: {
+    collectionId: string;
+    address: string;
+}, now?: number, maxAgeMs?: number): "ok" | "mismatch" | "stale";
+/** `0x`-prefixed lowercase hex, the shape the index stores an authenticator's key in. */
+export declare const pubkeyHex: (pubkey: Uint8Array) => string;
+/** The address a plain secp key would sign for. */
+export declare function addressOfPubkey(pubkey: Uint8Array, prefix?: string): string;
+/**
+ * Does this proof let its key act for `address`?
+ *
+ * `authenticatorsOf` answers with the hex public keys of the account's live
+ * `SignatureVerification` authenticators — the index read, injected so the
+ * decision itself needs no network. It is only consulted when the key is
+ * not simply the account's own; a lookup that throws is a refusal, because
+ * "could not check" must never read as "checked".
+ */
+export declare function proofSignsFor(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<boolean>;
+/**
+ * Why this proof does not let its key act for `address` — or null if it does.
+ *
+ * The same walk as `proofSignsFor`, which is now a wrapper on it, but it
+ * says which step failed. The gate answered a single `needs-account` for
+ * four unrelated reasons and logged none of them, so a person with a
+ * perfectly good session who was refused — and one who was refused
+ * thirty-eight seconds before the same session succeeded, on 2026-09-17 at
+ * 09:37 — could be told only "sign in", which they had done.
+ *
+ * `not-authenticator` on an **empty** list is not the same fact as on a
+ * list that has keys in it: an account that has ever signed in holds at
+ * least one authenticator, so an empty answer is far more likely to be the
+ * index than a revoked key. The caller decides what to do about that; this
+ * only reports what it saw, in `live`.
+ */
+export type ProofFault = "bad-shape" | "bad-signature" | "not-authenticator" | "unverifiable";
+export declare function whyNotSigning(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<ProofFault | null>;
+/** The full reading, for a caller that wants to see the authenticator list too. */
+export declare function judgeSigning(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<{
+    fault: ProofFault | null;
+    live: string[] | null;
+}>;
+/**
+ * Sign words with a mnemonic's key — the browser half of `proofSignsFor`.
+ *
+ * The one place a secp key signs a sentence for a server here: the guest
+ * lane's proof, the account's proof, and a credential request all go
+ * through it, so the bytes a verifier expects are produced by exactly one
+ * routine. Standard Cosmos derivation path; the signature is r‖s, base64;
+ * the public key compressed, base64. No `Buffer` — this runs in a phone.
+ */
+export declare function signWords(mnemonic: string, message: string): Promise<{
+    pubkey: string;
+    signature: string;
+}>;
+/**
+ * A signed sentence from an auth-hub account: who, with which key, over
+ * what. The authenticator id rides along for a reader that wants to name
+ * it; verification goes by the public key, which is what the index records.
+ */
+export interface AccountProof {
+    kind: "account";
+    address: string;
+    pubkey: string;
+    signature: string;
+    message: string;
+    authenticatorId?: string;
+}
+/**
+ * Prove an account's session holds a key that may act for it, over these
+ * exact words. Null when the session cannot sign — a name and nothing else.
+ */
+export declare function proveAsAccount(session: {
+    address?: string;
+    sessionKey?: {
+        mnemonic?: string;
+        authenticatorId?: string;
+    };
+} | null, message: string): Promise<AccountProof | null>;
+export type ProofJudgement = "ok" | "refused" | "unverifiable";
+/**
+ * `proofSignsFor` with its third answer told apart.
+ *
+ * A server has two refusals to give, and they must not be the same word:
+ * a key that is not the account's is "no", and an index that could not be
+ * asked is "not now". A person with a perfectly good session should be told
+ * to try again, never to sign in.
+ */
+export declare function judgeAccountProof(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<ProofJudgement>;
+//# sourceMappingURL=accountProof.d.ts.map

package/dist/cjs/chain/accountProof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountProof.d.ts","sourceRoot":"","sources":["../../../src/chain/accountProof.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,GAAI,cAAc,MAAM,EAAE,SAAS,MAAM,EAAE,YAAgB,KAAG,MAAoD,CAAC;AAElJ;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACnD,GAAG,SAAa,EAChB,QAAQ,SAAmB,GAC1B,IAAI,GAAG,UAAU,GAAG,OAAO,CAQ7B;AAWD,yFAAyF;AACzF,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,MAAkE,CAAC;AAElH,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,SAAQ,GAAG,MAAM,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnJ;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE9F,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GACvD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE5B;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAChC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GACvD,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,CAAC,CAiC9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWjH;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,EAClG,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAI9B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAY9J"}

package/dist/cjs/chain/accountProof.js

@@ -0,0 +1,199 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pubkeyHex = exports.submitProofMessage = exports.PROOF_MAX_AGE_MS = void 0;
+exports.readSubmitProof = readSubmitProof;
+exports.addressOfPubkey = addressOfPubkey;
+exports.proofSignsFor = proofSignsFor;
+exports.whyNotSigning = whyNotSigning;
+exports.judgeSigning = judgeSigning;
+exports.signWords = signWords;
+exports.proveAsAccount = proveAsAccount;
+exports.judgeAccountProof = judgeAccountProof;
+const crypto_1 = require("@cosmjs/crypto");
+const encoding_1 = require("@cosmjs/encoding");
+/**
+ * A signature is a moment, not a standing permission — but the window is a
+ * day, not five minutes (2026-09-20). Five refused two people whose phones
+ * ran hours wrong, and what a replay inside the window buys is one more
+ * submission grant for an address the replayer cannot sign for, idempotent
+ * and rate-limited. The app now signs with the server's clock anyway
+ * (the youth app's lib/clock.ts); the day is for the phone that never learned it.
+ */
+exports.PROOF_MAX_AGE_MS = 24 * 3_600_000;
+/** The words a submitter signs: one ask, one address, one moment. */
+const submitProofMessage = (collectionId, address, now = Date.now()) => `submit:${collectionId}:${address}:${now}`;
+exports.submitProofMessage = submitProofMessage;
+/**
+ * Whether the signed words are the ones this grant is about, and fresh.
+ *
+ * Checked before any cryptography, because a message that names another
+ * ask or another address is refused whoever signed it, and a stale one is
+ * worth nothing even from the right key.
+ */
+function readSubmitProof(message, expected, now = Date.now(), maxAgeMs = exports.PROOF_MAX_AGE_MS) {
+    const parts = message.split(":");
+    if (parts.length !== 4)
+        return "mismatch";
+    const [word, collectionId, address, at] = parts;
+    if (word !== "submit" || collectionId !== expected.collectionId || address !== expected.address)
+        return "mismatch";
+    const signedAt = Number(at);
+    if (!Number.isFinite(signedAt) || Math.abs(now - signedAt) > maxAgeMs)
+        return "stale";
+    return "ok";
+}
+const fromBase64 = (text) => {
+    try {
+        const bytes = Uint8Array.from(Buffer.from(text, "base64"));
+        return bytes.length > 0 ? bytes : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** `0x`-prefixed lowercase hex, the shape the index stores an authenticator's key in. */
+const pubkeyHex = (pubkey) => `0x${Buffer.from(pubkey).toString("hex").toLowerCase()}`;
+exports.pubkeyHex = pubkeyHex;
+/** The address a plain secp key would sign for. */
+function addressOfPubkey(pubkey, prefix = "ixo") {
+    return (0, encoding_1.toBech32)(prefix, new crypto_1.Ripemd160((0, crypto_1.sha256)(pubkey)).digest());
+}
+/**
+ * Does this proof let its key act for `address`?
+ *
+ * `authenticatorsOf` answers with the hex public keys of the account's live
+ * `SignatureVerification` authenticators — the index read, injected so the
+ * decision itself needs no network. It is only consulted when the key is
+ * not simply the account's own; a lookup that throws is a refusal, because
+ * "could not check" must never read as "checked".
+ */
+async function proofSignsFor(proof, address, authenticatorsOf) {
+    return (await whyNotSigning(proof, address, authenticatorsOf)) === null;
+}
+async function whyNotSigning(proof, address, authenticatorsOf) {
+    return (await judgeSigning(proof, address, authenticatorsOf)).fault;
+}
+/** The full reading, for a caller that wants to see the authenticator list too. */
+async function judgeSigning(proof, address, authenticatorsOf) {
+    const pubkey = fromBase64(proof.pubkey);
+    const signature = fromBase64(proof.signature);
+    if (!pubkey || !signature || signature.length !== 64 || pubkey.length !== 33)
+        return { fault: "bad-shape", live: null };
+    let verified;
+    try {
+        /*
+         * `fromFixedLength` trims the leading zero bytes of r and s. Built from the
+         * raw 32-byte halves, the signature's DER carried a zero byte before a
+         * small first byte, which the strict parser refuses as non-minimal, and
+         * one proof in eighty (r or s under 2^248) was refused as "bad-signature"
+         * though the key had signed exactly these words (2026-10-13).
+         */
+        verified = crypto_1.Secp256k1.verifySignature(crypto_1.Secp256k1Signature.fromFixedLength(signature), (0, crypto_1.sha256)(new TextEncoder().encode(proof.message)), pubkey);
+    }
+    catch {
+        return { fault: "bad-signature", live: null };
+    }
+    if (!verified)
+        return { fault: "bad-signature", live: null };
+    /* The older, simpler case: the key simply is the account. */
+    if (addressOfPubkey(pubkey) === address)
+        return { fault: null, live: null };
+    let live;
+    try {
+        live = await authenticatorsOf(address);
+    }
+    catch {
+        /* "Could not check" must never read as "checked". */
+        return { fault: "unverifiable", live: null };
+    }
+    const mine = (0, exports.pubkeyHex)(pubkey);
+    return { fault: live.some((key) => key.toLowerCase() === mine) ? null : "not-authenticator", live };
+}
+/**
+ * Sign words with a mnemonic's key — the browser half of `proofSignsFor`.
+ *
+ * The one place a secp key signs a sentence for a server here: the guest
+ * lane's proof, the account's proof, and a credential request all go
+ * through it, so the bytes a verifier expects are produced by exactly one
+ * routine. Standard Cosmos derivation path; the signature is r‖s, base64;
+ * the public key compressed, base64. No `Buffer` — this runs in a phone.
+ */
+async function signWords(mnemonic, message) {
+    const { Bip39, EnglishMnemonic, Slip10, Slip10Curve, stringToPath } = await Promise.resolve().then(() => __importStar(require("@cosmjs/crypto")));
+    const seed = await Bip39.mnemonicToSeed(new EnglishMnemonic(mnemonic));
+    const { privkey } = Slip10.derivePath(Slip10Curve.Secp256k1, seed, stringToPath("m/44'/118'/0'/0/0"));
+    const { pubkey } = crypto_1.Secp256k1.makeKeypair(privkey);
+    const signature = crypto_1.Secp256k1.createSignature((0, crypto_1.sha256)(new TextEncoder().encode(message)), privkey);
+    const toBase64 = (bytes) => btoa(String.fromCharCode(...bytes));
+    return {
+        pubkey: toBase64(crypto_1.Secp256k1.compressPubkey(pubkey)),
+        signature: toBase64(new Uint8Array([...signature.r(32), ...signature.s(32)]))
+    };
+}
+/**
+ * Prove an account's session holds a key that may act for it, over these
+ * exact words. Null when the session cannot sign — a name and nothing else.
+ */
+async function proveAsAccount(session, message) {
+    if (!session?.address || !session.sessionKey?.mnemonic)
+        return null;
+    const signed = await signWords(session.sessionKey.mnemonic, message);
+    return { kind: "account", address: session.address, ...signed, message, ...(session.sessionKey.authenticatorId ? { authenticatorId: session.sessionKey.authenticatorId } : {}) };
+}
+/**
+ * `proofSignsFor` with its third answer told apart.
+ *
+ * A server has two refusals to give, and they must not be the same word:
+ * a key that is not the account's is "no", and an index that could not be
+ * asked is "not now". A person with a perfectly good session should be told
+ * to try again, never to sign in.
+ */
+async function judgeAccountProof(proof, address, authenticatorsOf) {
+    let unverifiable = false;
+    const lookup = async (who) => {
+        try {
+            return await authenticatorsOf(who);
+        }
+        catch (error) {
+            unverifiable = true;
+            throw error;
+        }
+    };
+    if (await proofSignsFor(proof, address, lookup))
+        return "ok";
+    return unverifiable ? "unverifiable" : "refused";
+}
+//# sourceMappingURL=accountProof.js.map

package/dist/cjs/chain/accountProof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountProof.js","sourceRoot":"","sources":["../../../src/chain/accountProof.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,0CAaC;AAeD,0CAEC;AAWD,sCAEC;AAoBD,sCAMC;AAGD,oCAqCC;AAWD,8BAWC;AAoBD,wCAOC;AAYD,8CAYC;AA3OD,2CAAkF;AAClF,+CAA4C;AAgC5C;;;;;;;GAOG;AACU,QAAA,gBAAgB,GAAG,EAAE,GAAG,SAAS,CAAC;AAE/C,qEAAqE;AAC9D,MAAM,kBAAkB,GAAG,CAAC,YAAoB,EAAE,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE,CAAC,UAAU,YAAY,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;AAArI,QAAA,kBAAkB,sBAAmH;AAElJ;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,OAAe,EACf,QAAmD,EACnD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,QAAQ,GAAG,wBAAgB;IAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1C,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IAChD,IAAI,IAAI,KAAK,QAAQ,IAAI,YAAY,KAAK,QAAQ,CAAC,YAAY,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IACnH,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,QAAQ;QAAE,OAAO,OAAO,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAqB,EAAE;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,yFAAyF;AAClF,MAAM,SAAS,GAAG,CAAC,MAAkB,EAAU,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAArG,QAAA,SAAS,aAA4F;AAElH,mDAAmD;AACnD,SAAgB,eAAe,CAAC,MAAkB,EAAE,MAAM,GAAG,KAAK;IAChE,OAAO,IAAA,mBAAQ,EAAC,MAAM,EAAE,IAAI,kBAAS,CAAC,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,aAAa,CAAC,KAAkB,EAAE,OAAe,EAAE,gBAAwD;IAC/H,OAAO,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,KAAK,IAAI,CAAC;AAC1E,CAAC;AAoBM,KAAK,UAAU,aAAa,CACjC,KAAkB,EAClB,OAAe,EACf,gBAAwD;IAExD,OAAO,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,YAAY,CAChC,KAAkB,EAClB,OAAe,EACf,gBAAwD;IAExD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAExH,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH;;;;;;WAMG;QACH,QAAQ,GAAG,kBAAS,CAAC,eAAe,CAAC,2BAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAA,eAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE7D,6DAA6D;IAC7D,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE5E,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;QACrD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,iBAAS,EAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;AACtG,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAe;IAC/D,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;IACrG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,kBAAS,CAAC,eAAe,CAAC,IAAA,eAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,kBAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,SAAS,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KAC9E,CAAC;AACJ,CAAC;AAgBD;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,OAAkG,EAClG,OAAe;IAEf,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACnL,CAAC;AAID;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,OAAe,EAAE,gBAAwD;IACnI,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,IAAI,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC"}

package/dist/cjs/chain/allowance.d.ts

@@ -0,0 +1,17 @@
+import type { EncodeObject } from "@cosmjs/proto-signing";
+import { type PhonePrompt } from "./signWith.ts";
+import type { QiSession } from "./session.ts";
+export interface Allowance {
+    worker: string;
+    remainingUixo: number;
+    expiresAt: string | null;
+}
+export declare function grantAllowanceMsg(granter: string, worker: string, amountUixo: string, expiry?: Date): EncodeObject;
+export declare function revokeAllowanceMsg(granter: string, worker: string): EncodeObject;
+/** One passkey tap: your agent can spend up to this, starting now. */
+export declare function grantAllowance(session: QiSession, worker: string, amountUixo: string, prompt?: PhonePrompt, memoText?: string): Promise<import("./signWith.ts").SignResult>;
+/** One passkey tap: it can't any more. */
+export declare function revokeAllowance(session: QiSession, worker: string, prompt?: PhonePrompt): Promise<import("./signWith.ts").SignResult>;
+/** What is actually left — read from the chain, never from a local record. */
+export declare function readAllowance(granter: string, worker: string): Promise<Allowance | null>;
+//# sourceMappingURL=allowance.d.ts.map

package/dist/cjs/chain/allowance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowance.d.ts","sourceRoot":"","sources":["../../../src/chain/allowance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiB9C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,OAAwC,GAAG,YAAY,CAiBnJ;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAKhF;AAED,sEAAsE;AACtE,wBAAsB,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,QAAQ,SAAmB,+CAM7I;AAED,0CAA0C;AAC1C,wBAAsB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,+CAE7F;AAED,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAmB9F"}

package/dist/cjs/chain/allowance.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grantAllowanceMsg = grantAllowanceMsg;
+exports.revokeAllowanceMsg = revokeAllowanceMsg;
+exports.grantAllowance = grantAllowance;
+exports.revokeAllowance = revokeAllowance;
+exports.readAllowance = readAllowance;
+const impactxclient_sdk_1 = require("@ixo/impactxclient-sdk");
+const signWith_ts_1 = require("./signWith.js");
+const query_ts_1 = require("./query.js");
+const money_ts_1 = require("./money.js");
+/**
+ * Giving an agent money to work with, without giving it your account.
+ *
+ * The cap is the chain's own `SendAuthorization`: your agent may move up to
+ * this much of your balance and not one uixo more, it expires by itself, and
+ * one message ends it. Where the money goes is the agent's rule, not the
+ * chain's — but every IXO of it lands on a public receipt, which is the part
+ * that actually keeps an agent honest.
+ */
+const MSG_SEND = "/cosmos.bank.v1beta1.MsgSend";
+const SEND_AUTHORIZATION = "/cosmos.bank.v1beta1.SendAuthorization";
+const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+function grantAllowanceMsg(granter, worker, amountUixo, expiry = new Date(Date.now() + THIRTY_DAYS_MS)) {
+    return {
+        typeUrl: "/cosmos.authz.v1beta1.MsgGrant",
+        value: impactxclient_sdk_1.cosmos.authz.v1beta1.MsgGrant.fromPartial({
+            granter,
+            grantee: worker,
+            grant: impactxclient_sdk_1.cosmos.authz.v1beta1.Grant.fromPartial({
+                authorization: {
+                    typeUrl: SEND_AUTHORIZATION,
+                    value: impactxclient_sdk_1.cosmos.bank.v1beta1.SendAuthorization.encode(impactxclient_sdk_1.cosmos.bank.v1beta1.SendAuthorization.fromPartial({ spendLimit: [{ denom: (0, money_ts_1.askDenom)(), amount: amountUixo }] })).finish()
+                },
+                expiration: impactxclient_sdk_1.utils.proto.toTimestamp(expiry)
+            })
+        })
+    };
+}
+function revokeAllowanceMsg(granter, worker) {
+    return {
+        typeUrl: "/cosmos.authz.v1beta1.MsgRevoke",
+        value: impactxclient_sdk_1.cosmos.authz.v1beta1.MsgRevoke.fromPartial({ granter, grantee: worker, msgTypeUrl: MSG_SEND })
+    };
+}
+/** One passkey tap: your agent can spend up to this, starting now. */
+async function grantAllowance(session, worker, amountUixo, prompt, memoText = "Fund the agent") {
+    /* The memo is the grant's own receipt. A campaign pledge sends
+       `<campaign>:pledge:<claimId>` here, which is what makes the pledge
+       ledger reconstructible from chain history alone — the recovery path
+       pledges.ts documents, real only if the transaction actually carries it. */
+    return (0, signWith_ts_1.signWithSession)(session, [grantAllowanceMsg(session.address, worker, amountUixo)], memoText, prompt);
+}
+/** One passkey tap: it can't any more. */
+async function revokeAllowance(session, worker, prompt) {
+    return (0, signWith_ts_1.signWithSession)(session, [revokeAllowanceMsg(session.address, worker)], "Stop the agent spending", prompt);
+}
+/** What is actually left — read from the chain, never from a local record. */
+async function readAllowance(granter, worker) {
+    try {
+        const client = await (0, query_ts_1.getQueryClient)();
+        const { grants } = await client.cosmos.authz.v1beta1.grants({ granter, grantee: worker, msgTypeUrl: MSG_SEND });
+        for (const grant of grants ?? []) {
+            if (grant.authorization?.typeUrl !== SEND_AUTHORIZATION)
+                continue;
+            const decoded = impactxclient_sdk_1.cosmos.bank.v1beta1.SendAuthorization.decode(grant.authorization.value);
+            const uixo = decoded.spendLimit.find((coin) => coin.denom === (0, money_ts_1.askDenom)());
+            const seconds = grant.expiration?.seconds;
+            return {
+                worker,
+                remainingUixo: Number(uixo?.amount ?? 0),
+                expiresAt: seconds ? new Date(Number(seconds) * 1000).toISOString() : null
+            };
+        }
+    }
+    catch {
+        // No allowance is a normal state, not an error.
+    }
+    return null;
+}
+//# sourceMappingURL=allowance.js.map

package/dist/cjs/chain/allowance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowance.js","sourceRoot":"","sources":["../../../src/chain/allowance.ts"],"names":[],"mappings":";;AA4BA,8CAiBC;AAED,gDAKC;AAGD,wCAMC;AAGD,0CAEC;AAGD,sCAmBC;AAvFD,8DAAuD;AAEvD,+CAAkE;AAClE,yCAA4C;AAE5C,yCAAsC;AAEtC;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAQhD,SAAgB,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,UAAkB,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IACnI,OAAO;QACL,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,OAAO;YACP,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC5C,aAAa,EAAE;oBACb,OAAO,EAAE,kBAAkB;oBAC3B,KAAK,EAAE,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CACjD,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAA,mBAAQ,GAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAC/G,CAAC,MAAM,EAAE;iBACX;gBACD,UAAU,EAAE,yBAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;aAC5C,CAAC;SACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAe,EAAE,MAAc;IAChE,OAAO;QACL,OAAO,EAAE,iCAAiC;QAC1C,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;KACtG,CAAC;AACJ,CAAC;AAED,sEAAsE;AAC/D,KAAK,UAAU,cAAc,CAAC,OAAkB,EAAE,MAAc,EAAE,UAAkB,EAAE,MAAoB,EAAE,QAAQ,GAAG,gBAAgB;IAC5I;;;iFAG6E;IAC7E,OAAO,IAAA,6BAAe,EAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC9G,CAAC;AAED,0CAA0C;AACnC,KAAK,UAAU,eAAe,CAAC,OAAkB,EAAE,MAAc,EAAE,MAAoB;IAC5F,OAAO,IAAA,6BAAe,EAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;AACpH,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,GAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChH,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,aAAa,EAAE,OAAO,KAAK,kBAAkB;gBAAE,SAAS;YAClE,MAAM,OAAO,GAAG,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAA,mBAAQ,GAAE,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;YAC1C,OAAO;gBACL,MAAM;gBACN,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;gBACxC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;aAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cjs/chain/allowanceRead.d.ts

@@ -0,0 +1,2 @@
+export declare function readAllowanceBase(granter: string, grantee: string, denom?: string): Promise<number>;
+//# sourceMappingURL=allowanceRead.d.ts.map

package/dist/cjs/chain/allowanceRead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowanceRead.d.ts","sourceRoot":"","sources":["../../../src/chain/allowanceRead.ts"],"names":[],"mappings":"AA8BA,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BrH"}

package/dist/cjs/chain/allowanceRead.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readAllowanceBase = readAllowanceBase;
+const impactxclient_sdk_1 = require("@ixo/impactxclient-sdk");
+const money_ts_1 = require("./money.js");
+const query_ts_1 = require("./query.js");
+/**
+ * What a granter still lets a grantee spend, in base units of the board's coin.
+ *
+ * A read-only sliver of `allowance.ts`, split out so a server route can ask
+ * the question without pulling in the browser's signing ceremony. The denom
+ * is the deployment's, never `uixo` by habit — that assumption has cost this
+ * repo three separate rounds.
+ */
+const MSG_SEND = "/cosmos.bank.v1beta1.MsgSend";
+const SEND_AUTHORIZATION = "/cosmos.bank.v1beta1.SendAuthorization";
+/**
+ * Zero and unreachable are different answers, and conflating them was a
+ * dropped pledge waiting to happen: the funding pass treats 0 as "this
+ * backer revoked" and journals the lapse, so a flaky RPC read that swallowed
+ * its error into 0 would lapse real money on a hiccup. It also hung a whole
+ * funding round for five minutes once, because the query carried no deadline.
+ * Now: an absent grant is honestly 0; a read that cannot complete THROWS,
+ * and the caller decides what a round without answers should do (stop, say
+ * so, run again next tick).
+ */
+/** The chain's "no such grant" — code 6 on the wire, this sentence in the message. */
+const isNotFound = (error) => /authorization not found|code = NotFound|\(6\)/i.test(error instanceof Error ? error.message : String(error));
+async function readAllowanceBase(granter, grantee, denom = (0, money_ts_1.askDenom)()) {
+    const asked = (async () => {
+        const client = await (0, query_ts_1.getQueryClient)();
+        /*
+         * Absent is zero; unreachable is a throw — and the chain does not make
+         * that distinction for us. `grants` filtered by message type answers a
+         * missing (or REVOKED) grant with gRPC NotFound, "authorization not
+         * found for /cosmos.bank.v1beta1.MsgSend type", not with an empty list.
+         * Read as an error, a backer revoking their pledge would have taken the
+         * whole pass down instead of being dropped and named — found on the
+         * chain round, probing a key that had simply never granted anything.
+         */
+        const { grants } = await client.cosmos.authz.v1beta1.grants({ granter, grantee, msgTypeUrl: MSG_SEND }).catch((error) => {
+            if (isNotFound(error))
+                return { grants: [] };
+            throw error;
+        });
+        for (const grant of grants ?? []) {
+            if (grant.authorization?.typeUrl !== SEND_AUTHORIZATION)
+                continue;
+            const decoded = impactxclient_sdk_1.cosmos.bank.v1beta1.SendAuthorization.decode(grant.authorization.value);
+            return Number(decoded.spendLimit.find((coin) => coin.denom === denom)?.amount ?? 0);
+        }
+        return 0;
+    })();
+    return Promise.race([
+        asked,
+        new Promise((_, reject) => setTimeout(() => reject(new Error(`allowance read for ${granter.slice(0, 12)}… timed out`)), 8000))
+    ]);
+}
+//# sourceMappingURL=allowanceRead.js.map

package/dist/cjs/chain/allowanceRead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowanceRead.js","sourceRoot":"","sources":["../../../src/chain/allowanceRead.ts"],"names":[],"mappings":";;AA8BA,8CA4BC;AA1DD,8DAAgD;AAEhD,yCAAsC;AACtC,yCAA4C;AAE5C;;;;;;;GAOG;AAEH,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAEpE;;;;;;;;;GASG;AACH,sFAAsF;AACtF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,gDAAgD,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvJ,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB,IAAA,mBAAQ,GAAE;IAClG,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,GAAE,CAAC;QACtC;;;;;;;;WAQG;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/H,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,aAAa,EAAE,OAAO,KAAK,kBAAkB;gBAAE,SAAS;YAClE,MAAM,OAAO,GAAG,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACxF,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,KAAK;QACL,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;KACtI,CAAC,CAAC;AACL,CAAC"}