@ixo/openhands-sdk 0.0.0-stage → 0.1.0

package/dist/cjs/chain/delegate.js

@@ -0,0 +1,245 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AmbiguousDelegation = exports.worksAs = exports.GAS_LOAN_UIXO = exports.DEFAULT_DAYS = exports.WORKS_AS_ME = exports.DELEGATED_MSGS = void 0;
+exports.connectMsgs = connectMsgs;
+exports.disconnectMsgs = disconnectMsgs;
+exports.delegationsAmong = delegationsAmong;
+exports.resolveDelegation = resolveDelegation;
+exports.readDelegation = readDelegation;
+exports.readDelegationFor = readDelegationFor;
+exports.delegatesOf = delegatesOf;
+exports.gasLent = gasLent;
+exports.connectAgent = connectAgent;
+exports.disconnectAgent = disconnectAgent;
+const impactxclient_sdk_1 = require("@ixo/impactxclient-sdk");
+const paged_ts_1 = require("../data/paged.js");
+const env_ts_1 = require("./env.js");
+const iid_ts_1 = require("./iid.js");
+const money_ts_1 = require("./money.js");
+const signWith_ts_1 = require("./signWith.js");
+/**
+ * An agent acting for a person's account — the connection, as the chain
+ * holds it (docs/verified-work-mcp-connect-plan.md).
+ *
+ * The agent keeps a key of its own, but the key holds nothing: no money and
+ * no identity worth anything. What it holds is this person's **grants** —
+ * cosmos `authz` authorizations that let it sign four kinds of message *as
+ * the person*, and a spend cap the chain itself enforces. Every ask it posts
+ * is the person's ask: their entity, their escrow, their name on the card.
+ * Every answer it files is the person's answer, paid to their account. The
+ * grants expire by themselves and one tap revokes them.
+ *
+ * Proved on testnet 2026-10-08 (the probe in the plan): the batch below as
+ * one transaction; an ask posted through `MsgExec` with every inner signer
+ * the person; a claim filed by the agent's own gate grant naming the person
+ * as its agent, accepted by the chain and shown as theirs on the index.
+ *
+ * **What the four typed grants mean, and why no fifth.** Three are the
+ * messages a post signs (entity, collection, the ask's door grants); the
+ * escrow transfer rides on the capped `SendAuthorization`. The fourth,
+ * `MsgSubmitClaim`, can never be exercised on chain — that message's signer
+ * is the ask's admin, never the person — so it is purely the person's
+ * declaration *"this key may work as me"*, which the submission gate checks
+ * before it grants the key an ask. A blanket `MsgExec` grant would let the
+ * agent use anything the person holds, a checker's evaluate grants included;
+ * it is deliberately not here.
+ */
+/** The messages a connected agent may sign as the person. Order is the display order. */
+exports.DELEGATED_MSGS = [
+    "/ixo.entity.v1beta1.MsgCreateEntity",
+    "/ixo.claims.v1beta1.MsgCreateCollection",
+    "/ixo.entity.v1beta1.MsgGrantEntityAccountAuthz",
+    "/ixo.claims.v1beta1.MsgSubmitClaim"
+];
+/** The one grant the gate reads as "may work as me". */
+exports.WORKS_AS_ME = "/ixo.claims.v1beta1.MsgSubmitClaim";
+const GENERIC = "/cosmos.authz.v1beta1.GenericAuthorization";
+const SEND = "/cosmos.bank.v1beta1.SendAuthorization";
+const MSG_SEND = "/cosmos.bank.v1beta1.MsgSend";
+const BASIC_ALLOWANCE = "/cosmos.feegrant.v1beta1.BasicAllowance";
+exports.DEFAULT_DAYS = 30;
+/** Gas the person lends the agent, when they hold the gas coin: enough for a few hundred transactions. */
+exports.GAS_LOAN_UIXO = "300000";
+const DAY_MS = 24 * 3600 * 1000;
+/**
+ * The connect batch: one transaction the person signs once.
+ *
+ * Four typed grants, the spend cap, and — when they hold the gas coin — a
+ * gas allowance, all expiring together. Rebuilt from the same expiry so the
+ * connection ends at one moment, not in pieces.
+ */
+function connectMsgs(principal, agent, terms) {
+    const expiry = impactxclient_sdk_1.utils.proto.toTimestamp(new Date((terms.now ?? Date.now()) + (terms.days ?? exports.DEFAULT_DAYS) * DAY_MS));
+    const grant = (authorization) => ({
+        typeUrl: "/cosmos.authz.v1beta1.MsgGrant",
+        value: impactxclient_sdk_1.cosmos.authz.v1beta1.MsgGrant.fromPartial({ granter: principal, grantee: agent, grant: impactxclient_sdk_1.cosmos.authz.v1beta1.Grant.fromPartial({ authorization, expiration: expiry }) })
+    });
+    const messages = exports.DELEGATED_MSGS.map((msg) => grant({ typeUrl: GENERIC, value: impactxclient_sdk_1.cosmos.authz.v1beta1.GenericAuthorization.encode(impactxclient_sdk_1.cosmos.authz.v1beta1.GenericAuthorization.fromPartial({ msg })).finish() }));
+    messages.push(grant({
+        typeUrl: SEND,
+        value: impactxclient_sdk_1.cosmos.bank.v1beta1.SendAuthorization.encode(impactxclient_sdk_1.cosmos.bank.v1beta1.SendAuthorization.fromPartial({ spendLimit: [{ denom: terms.denom ?? (0, money_ts_1.askDenom)(), amount: terms.capBase }] })).finish()
+    }));
+    if (terms.gasUixo) {
+        messages.push({
+            typeUrl: "/cosmos.feegrant.v1beta1.MsgGrantAllowance",
+            value: impactxclient_sdk_1.cosmos.feegrant.v1beta1.MsgGrantAllowance.fromPartial({
+                granter: principal,
+                grantee: agent,
+                allowance: {
+                    typeUrl: BASIC_ALLOWANCE,
+                    value: impactxclient_sdk_1.cosmos.feegrant.v1beta1.BasicAllowance.encode(impactxclient_sdk_1.cosmos.feegrant.v1beta1.BasicAllowance.fromPartial({ spendLimit: [{ denom: "uixo", amount: terms.gasUixo }], expiration: expiry })).finish()
+                }
+            })
+        });
+    }
+    return messages;
+}
+/**
+ * The disconnect batch: every grant the connection made, revoked. `gas` says
+ * whether a gas allowance was lent — revoking one that was never granted
+ * fails the whole transaction, so the caller says what it read.
+ */
+function disconnectMsgs(principal, agent, gas) {
+    const revoke = (msgTypeUrl) => ({
+        typeUrl: "/cosmos.authz.v1beta1.MsgRevoke",
+        value: impactxclient_sdk_1.cosmos.authz.v1beta1.MsgRevoke.fromPartial({ granter: principal, grantee: agent, msgTypeUrl })
+    });
+    const messages = [...exports.DELEGATED_MSGS.map(revoke), revoke(MSG_SEND)];
+    if (gas)
+        messages.push({ typeUrl: "/cosmos.feegrant.v1beta1.MsgRevokeAllowance", value: impactxclient_sdk_1.cosmos.feegrant.v1beta1.MsgRevokeAllowance.fromPartial({ granter: principal, grantee: agent }) });
+    return messages;
+}
+/**
+ * The connections among some grant rows, pure: a pair is connected when the
+ * grantee holds every typed grant from the granter, none expired. A
+ * connection missing one grant is not a lesser connection — it is none, so a
+ * person who revoked by hand is not half-trusted.
+ */
+function delegationsAmong(rows, now = Date.now()) {
+    const pairs = new Map();
+    for (const row of rows) {
+        if (!row.granter || !row.grantee)
+            continue;
+        const key = `${row.granter} ${row.grantee}`;
+        pairs.set(key, [...(pairs.get(key) ?? []), row]);
+    }
+    const out = [];
+    for (const [key, grants] of pairs) {
+        const live = grants.filter((grant) => !grant.expiration || Date.parse(grant.expiration) > now);
+        const typed = new Map();
+        for (const grant of live)
+            if (grant.authorization?.["@type"] === GENERIC && grant.authorization.msg)
+                typed.set(grant.authorization.msg, grant);
+        if (!exports.DELEGATED_MSGS.every((msg) => typed.has(msg)))
+            continue;
+        const [principal, agent] = key.split(" ");
+        const send = live.find((grant) => grant.authorization?.["@type"] === SEND);
+        const limit = send?.authorization?.spend_limit?.[0];
+        const expiries = exports.DELEGATED_MSGS.map((msg) => typed.get(msg)?.expiration).filter((one) => Boolean(one));
+        out.push({
+            principal,
+            agent,
+            expiresAt: expiries.length ? expiries.sort()[0] : null,
+            cap: limit && Number(limit.amount) > 0 ? { denom: limit.denom, remainingBase: limit.amount } : null
+        });
+    }
+    return out;
+}
+/** Whether `rows` (grants from `principal` to `agent`) say the agent may work as the person. */
+const worksAs = (rows, principal, agent, now = Date.now()) => delegationsAmong(rows, now).some((one) => one.principal === principal && one.agent === agent);
+exports.worksAs = worksAs;
+async function grantRows(path, fetchImpl) {
+    /* Every page. An agent's address is public and anybody may grant to it, so
+       a single page of 200 was a list a stranger could push the real
+       connection off the end of (scale review A11). The read throws at its
+       cap rather than answering with whatever fitted. */
+    return (0, paged_ts_1.pagedRest)(`${(0, env_ts_1.restUrl)()}${path}`, { key: "grants", limit: 200, timeoutMs: 10_000, fetchImpl, init: { cache: "no-store" } });
+}
+/**
+ * More than one account holds a full connection to this agent.
+ *
+ * Granting is permissionless: anybody can sign the connect batch naming a
+ * public agent address, and the chain will hold it. So "the first connection
+ * found" was whoever the node happened to list first — a stranger could make
+ * themselves an agent's principal by granting to it (scale review D8).
+ * Nothing on chain says which of them the agent's owner meant, so the honest
+ * answer is no principal at all, and this error says why.
+ */
+class AmbiguousDelegation extends Error {
+    agent;
+    principals;
+    constructor(agent, principals) {
+        super(`agent ${agent} holds connections from ${principals.length} accounts; refusing to pick one`);
+        this.name = "AmbiguousDelegation";
+        this.agent = agent;
+        this.principals = principals;
+    }
+}
+exports.AmbiguousDelegation = AmbiguousDelegation;
+/**
+ * Whom this agent acts for, with the reason when the answer is nobody.
+ *
+ * `delegation` is set only when exactly one account holds a full connection;
+ * `ambiguous` is set when more than one does. Throws when the node cannot be
+ * read — "could not look" is never "not connected".
+ */
+async function resolveDelegation(agent, fetchImpl = fetch) {
+    const found = delegationsAmong(await grantRows(`/cosmos/authz/v1beta1/grants/grantee/${encodeURIComponent(agent)}`, fetchImpl));
+    if (found.length > 1)
+        return { delegation: null, ambiguous: new AmbiguousDelegation(agent, found.map((one) => one.principal)) };
+    return { delegation: found[0] ?? null, ambiguous: null };
+}
+/**
+ * Whom this agent acts for, or null — null too when more than one account
+ * claims it; `resolveDelegation` says which. Kept for its callers; anything
+ * that already knows the principal it expects should ask `readDelegationFor`.
+ */
+async function readDelegation(agent, fetchImpl = fetch) {
+    return (await resolveDelegation(agent, fetchImpl)).delegation;
+}
+/**
+ * The connection from exactly this principal to this agent, or null.
+ *
+ * Keyed on both ends (`grants?granter=&grantee=`), so it never lists who
+ * else has granted to the agent and a stranger's grant cannot be mistaken for
+ * the person's. This is the read a client should make once it has pinned the
+ * principal at connect: the question is no longer "who is this agent for"
+ * but "is it still for them".
+ *
+ * The keyed endpoint answers grants without their granter and grantee — it
+ * was asked for one pair — so they are put back before the pure reader sees
+ * them.
+ */
+async function readDelegationFor(agent, expectedPrincipal, fetchImpl = fetch) {
+    if (!agent || !expectedPrincipal)
+        return null;
+    const rows = await grantRows(`/cosmos/authz/v1beta1/grants?granter=${encodeURIComponent(expectedPrincipal)}&grantee=${encodeURIComponent(agent)}`, fetchImpl);
+    const paired = rows.map((row) => ({ ...row, granter: expectedPrincipal, grantee: agent }));
+    return delegationsAmong(paired).find((one) => one.principal === expectedPrincipal && one.agent === agent) ?? null;
+}
+/** The agents acting for this person. */
+async function delegatesOf(principal, fetchImpl = fetch) {
+    return delegationsAmong(await grantRows(`/cosmos/authz/v1beta1/grants/granter/${encodeURIComponent(principal)}`, fetchImpl));
+}
+/** Whether a gas allowance from `principal` to `agent` stands — read before revoking, never assumed. */
+async function gasLent(principal, agent, fetchImpl = fetch) {
+    const response = await fetchImpl(`${(0, env_ts_1.restUrl)()}/cosmos/feegrant/v1beta1/allowance/${encodeURIComponent(principal)}/${encodeURIComponent(agent)}`, { signal: AbortSignal.timeout(10_000), cache: "no-store" });
+    return response.ok;
+}
+/* ── signed by the person, through whichever door they sign with ────────── */
+/**
+ * Connect an agent: the person's identity first, then the batch, one tap
+ * each at most. The agent will create entities as this person and file
+ * claims as them, and both name the person's DID — so a person who has
+ * never signed anything here gets their IID document on the way in.
+ */
+async function connectAgent(session, agent, terms, prompt) {
+    await (0, iid_ts_1.ensureIidDocument)(session, prompt);
+    return (0, signWith_ts_1.signWithSession)(session, connectMsgs(session.address, agent, terms), "Connect an agent to this account", prompt);
+}
+/** Disconnect it: every grant revoked, the gas allowance too when one was lent. */
+async function disconnectAgent(session, agent, prompt) {
+    const gas = await gasLent(session.address, agent).catch(() => false);
+    return (0, signWith_ts_1.signWithSession)(session, disconnectMsgs(session.address, agent, gas), "Disconnect the agent", prompt);
+}
+//# sourceMappingURL=delegate.js.map

package/dist/cjs/chain/delegate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../../../src/chain/delegate.ts"],"names":[],"mappings":";;;AA8EA,kCA6BC;AAOD,wCAQC;AA2BD,4CAyBC;AA0CD,8CAIC;AAOD,wCAEC;AAeD,8CAKC;AAGD,kCAEC;AAGD,0BAGC;AAUD,oCAGC;AAGD,0CAGC;AAvRD,8DAAuD;AAGvD,+CAA6C;AAE7C,qCAAmC;AACnC,qCAA6C;AAC7C,yCAAsC;AAEtC,+CAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,yFAAyF;AAC5E,QAAA,cAAc,GAAG;IAC5B,qCAAqC;IACrC,yCAAyC;IACzC,gDAAgD;IAChD,oCAAoC;CAC5B,CAAC;AAEX,wDAAwD;AAC3C,QAAA,WAAW,GAAG,oCAAoC,CAAC;AAEhE,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAC7D,MAAM,IAAI,GAAG,wCAAwC,CAAC;AACtD,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAErD,QAAA,YAAY,GAAG,EAAE,CAAC;AAC/B,0GAA0G;AAC7F,QAAA,aAAa,GAAG,QAAQ,CAAC;AAEtC,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAYhC;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,SAAiB,EAAE,KAAa,EAAE,KAAmB;IAC/E,MAAM,MAAM,GAAG,yBAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,oBAAY,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,CAAC,aAAqD,EAAgB,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;KAC/K,CAAC,CAAC;IACH,MAAM,QAAQ,GAAmB,sBAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC1D,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC9J,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC;QACJ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAA,mBAAQ,GAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;KAC/L,CAAC,CACH,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,0BAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC;gBAC3D,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE;oBACT,OAAO,EAAE,eAAe;oBACxB,KAAK,EAAE,0BAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,0BAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;iBAClM;aACF,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,SAAiB,EAAE,KAAa,EAAE,GAAY;IAC3E,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAgB,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,iCAAiC;QAC1C,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;KACtG,CAAC,CAAC;IACH,MAAM,QAAQ,GAAmB,CAAC,GAAG,sBAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,0BAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1L,OAAO,QAAQ,CAAC;AAClB,CAAC;AAqBD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,IAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,SAAS;QAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,aAAa,CAAC,GAAG;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/I,IAAI,CAAC,sBAAc,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,sBAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtH,GAAG,CAAC,IAAI,CAAC;YACP,SAAS;YACT,KAAK;YACL,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI;YACvD,GAAG,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;SACpG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AACzF,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAE,SAAiB,EAAE,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAW,EAAE,CACvG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AADnF,QAAA,OAAO,WAC4E;AAEhG,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAuB;IAC5D;;;yDAGqD;IACrD,OAAO,IAAA,oBAAS,EAAW,GAAG,IAAA,gBAAO,GAAE,GAAG,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AAC9I,CAAC;AAED;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IACnC,KAAK,CAAS;IACd,UAAU,CAAW;IAC9B,YAAY,KAAa,EAAE,UAAoB;QAC7C,KAAK,CAAC,SAAS,KAAK,2BAA2B,UAAU,CAAC,MAAM,iCAAiC,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AATD,kDASC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,YAA0B,KAAK;IACpF,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,SAAS,CAAC,wCAAwC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAChI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IAChI,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,YAA0B,KAAK;IACjF,OAAO,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,iBAAyB,EAAE,YAA0B,KAAK;IAC/G,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,wCAAwC,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9J,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,iBAAiB,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AACpH,CAAC;AAED,yCAAyC;AAClC,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,YAA0B,KAAK;IAClF,OAAO,gBAAgB,CAAC,MAAM,SAAS,CAAC,wCAAwC,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/H,CAAC;AAED,wGAAwG;AACjG,KAAK,UAAU,OAAO,CAAC,SAAiB,EAAE,KAAa,EAAE,YAA0B,KAAK;IAC7F,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAA,gBAAO,GAAE,sCAAsC,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAiB,CAAC,CAAC;IAC5N,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,OAAkB,EAAE,KAAa,EAAE,KAAmB,EAAE,MAAoB;IAC7G,MAAM,IAAA,0BAAiB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,IAAA,6BAAe,EAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;AAC1H,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,eAAe,CAAC,OAAkB,EAAE,KAAa,EAAE,MAAoB;IAC3F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,IAAA,6BAAe,EAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;AAC/G,CAAC"}

package/dist/cjs/chain/encoding.d.ts

@@ -0,0 +1,7 @@
+/** Byte/string helpers. Browser-native — no Buffer anywhere in qi-chain. */
+export declare function bytesToBase64(bytes: Uint8Array): string;
+export declare function base64ToBytes(base64: string): Uint8Array;
+export declare function bytesToBase64url(bytes: ArrayBuffer | Uint8Array): string;
+export declare function base64urlToBytes(base64url: string): Uint8Array;
+export declare function utf8ToBase64(text: string): string;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/cjs/chain/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../../src/chain/encoding.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAGxD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAGxE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAG9D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/cjs/chain/encoding.js

@@ -0,0 +1,29 @@
+"use strict";
+/** Byte/string helpers. Browser-native — no Buffer anywhere in qi-chain. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bytesToBase64 = bytesToBase64;
+exports.base64ToBytes = base64ToBytes;
+exports.bytesToBase64url = bytesToBase64url;
+exports.base64urlToBytes = base64urlToBytes;
+exports.utf8ToBase64 = utf8ToBase64;
+function bytesToBase64(bytes) {
+    let binary = "";
+    bytes.forEach((byte) => (binary += String.fromCharCode(byte)));
+    return btoa(binary);
+}
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function bytesToBase64url(bytes) {
+    const array = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    return bytesToBase64(array).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlToBytes(base64url) {
+    const padded = base64url.replace(/-/g, "+").replace(/_/g, "/");
+    return base64ToBytes(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+}
+function utf8ToBase64(text) {
+    return bytesToBase64(new TextEncoder().encode(text));
+}
+//# sourceMappingURL=encoding.js.map

package/dist/cjs/chain/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../../src/chain/encoding.ts"],"names":[],"mappings":";AAAA,4EAA4E;;AAE5E,sCAIC;AAED,sCAGC;AAED,4CAGC;AAED,4CAGC;AAED,oCAEC;AAvBD,SAAgB,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAA+B;IAC9D,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY;IACvC,OAAO,aAAa,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/cjs/chain/env.d.ts

@@ -0,0 +1,50 @@
+import { type Network, network } from "../network.ts";
+export { network };
+/** The chain endpoints each network uses when nothing overrides them. The only copy of this table. */
+export interface ChainEndpoints {
+    rpcUrl: string;
+    restUrl: string;
+    graphqlUrl: string;
+    relayerNodeDid: string;
+    faucetUrl: string | null;
+}
+export declare const chainEndpointsFor: (net: Network) => Readonly<ChainEndpoints>;
+/**
+ * Where we talk to the chain.
+ *
+ * This used to fall back to `""`, and an empty fallback is not a fallback: it
+ * is a failure deferred to whoever signs next. CosmJS takes a protocol-less
+ * URL, decides a bare string must be a websocket, and says *"Base URL is
+ * missing a protocol. Expected 'ws://' or 'wss://'."* — which names neither
+ * the chain, nor the setting, nor the deployment that lacks it. Somebody
+ * trying to fund an agent read that.
+ *
+ * So the network picks the endpoint, exactly as the REST and store readers
+ * already do, and the env var is an override rather than a requirement. A
+ * deployment with no configuration now works instead of failing at the last
+ * step of a signing flow.
+ */
+export declare const rpcUrl: () => string;
+/**
+ * Passkeys bind to this for life. Default is the browser's own hostname —
+ * which makes localhost, previews and the production domain all work without
+ * config. The env var exists only for a future apex/subdomain split.
+ */
+export declare function rpId(): string | undefined;
+/** The chain's own REST API — what is true at this block, not what the index has read yet. */
+export declare const restUrl: () => string;
+/** No environment variable ever existed for this; `configure({ faucetUrl })` or the network's own. */
+export declare const faucetUrl: () => string | null;
+/**
+ * Where we read the chain's index. Same rule as the RPC: the network picks
+ * the endpoint, and the env var is an override.
+ */
+export declare const graphqlUrl: () => string;
+/**
+ * The relayer node every entity we mint names. A DID, so it cannot be
+ * guessed from the network name the way a URL can — hence the table. The
+ * testnet value used to be hardcoded everywhere, which meant a devnet
+ * deployment minted entities that pointed at a relayer on another chain.
+ */
+export declare const relayerNode: () => string;
+//# sourceMappingURL=env.d.ts.map

package/dist/cjs/chain/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/chain/env.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAOtD,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB,sGAAsG;AACtG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AA2BD,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,QAAQ,CAAC,cAAc,CAAmB,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,MAAM,QAAO,MACuI,CAAC;AAElK;;;;GAIG;AACH,wBAAgB,IAAI,IAAI,MAAM,GAAG,SAAS,CAIzC;AAED,8FAA8F;AAC9F,eAAO,MAAM,OAAO,QAAO,MACwH,CAAC;AAEpJ,sGAAsG;AACtG,eAAO,MAAM,SAAS,QAAO,MAAM,GAAG,IAGrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,QAAO,MAGuG,CAAC;AAEtI;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAO,MACqH,CAAC"}

package/dist/cjs/chain/env.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relayerNode = exports.graphqlUrl = exports.faucetUrl = exports.restUrl = exports.rpcUrl = exports.chainEndpointsFor = exports.network = void 0;
+exports.rpId = rpId;
+const given_ts_1 = require("../given.js");
+const network_ts_1 = require("../network.js");
+Object.defineProperty(exports, "network", { enumerable: true, get: function () { return network_ts_1.network; } });
+const envRead_ts_1 = require("../envRead.js");
+const ENDPOINTS = {
+    devnet: {
+        rpcUrl: "https://devnet.ixo.earth/rpc/",
+        restUrl: "https://devnet.ixo.earth/rest",
+        graphqlUrl: "https://devnet-blocksync-graphql.ixo.earth/graphql",
+        /* A DID, so it cannot be guessed from the network name the way a URL can. */
+        relayerNodeDid: "did:ixo:entity:2f22535f8b179a51d77a0e302e68d35d",
+        faucetUrl: "https://faucet.devnet.ixo.earth"
+    },
+    testnet: {
+        rpcUrl: "https://testnet.ixo.earth/rpc/",
+        restUrl: "https://testnet.ixo.earth/rest",
+        graphqlUrl: "https://testnet-blocksync-graphql.ixo.earth/graphql",
+        relayerNodeDid: "did:ixo:entity:3d079ebc0b332aad3305bb4a51c72edb",
+        faucetUrl: "https://faucet.testnet.ixo.earth"
+    },
+    mainnet: {
+        rpcUrl: "https://impacthub.ixo.world/rpc/",
+        restUrl: "https://impacthub.ixo.world/rest",
+        graphqlUrl: "https://blocksync-graphql.ixo.earth/graphql",
+        relayerNodeDid: "did:ixo:entity:2f22535f8b179a51d77a0e302e68d35d",
+        faucetUrl: null
+    }
+};
+const chainEndpointsFor = (net) => ENDPOINTS[net];
+exports.chainEndpointsFor = chainEndpointsFor;
+/**
+ * Where we talk to the chain.
+ *
+ * This used to fall back to `""`, and an empty fallback is not a fallback: it
+ * is a failure deferred to whoever signs next. CosmJS takes a protocol-less
+ * URL, decides a bare string must be a websocket, and says *"Base URL is
+ * missing a protocol. Expected 'ws://' or 'wss://'."* — which names neither
+ * the chain, nor the setting, nor the deployment that lacks it. Somebody
+ * trying to fund an agent read that.
+ *
+ * So the network picks the endpoint, exactly as the REST and store readers
+ * already do, and the env var is an override rather than a requirement. A
+ * deployment with no configuration now works instead of failing at the last
+ * step of a signing flow.
+ */
+const rpcUrl = () => (0, given_ts_1.givenConfig)().rpcUrl ?? ((0, envRead_ts_1.hasEnv)() ? (0, envRead_ts_1.firstSet)(process.env.NEXT_PUBLIC_RPC_URL, process.env.NEXT_PUBLIC_RPC_ENDPOINT) : undefined) ?? ENDPOINTS[(0, network_ts_1.network)()].rpcUrl;
+exports.rpcUrl = rpcUrl;
+/**
+ * Passkeys bind to this for life. Default is the browser's own hostname —
+ * which makes localhost, previews and the production domain all work without
+ * config. The env var exists only for a future apex/subdomain split.
+ */
+function rpId() {
+    const given = (0, given_ts_1.givenConfig)();
+    if ("authnRpId" in given)
+        return given.authnRpId || undefined;
+    return ((0, envRead_ts_1.hasEnv)() ? process.env.NEXT_PUBLIC_AUTHN_RP_ID : undefined) || undefined;
+}
+/** The chain's own REST API — what is true at this block, not what the index has read yet. */
+const restUrl = () => ((0, given_ts_1.givenConfig)().restUrl ?? ((0, envRead_ts_1.hasEnv)() ? (0, envRead_ts_1.firstSet)(process.env.NEXT_PUBLIC_REST_URL) : undefined) ?? ENDPOINTS[(0, network_ts_1.network)()].restUrl).replace(/\/$/, "");
+exports.restUrl = restUrl;
+/** No environment variable ever existed for this; `configure({ faucetUrl })` or the network's own. */
+const faucetUrl = () => {
+    const given = (0, given_ts_1.givenConfig)().faucetUrl;
+    return given !== undefined ? given : ENDPOINTS[(0, network_ts_1.network)()].faucetUrl;
+};
+exports.faucetUrl = faucetUrl;
+/**
+ * Where we read the chain's index. Same rule as the RPC: the network picks
+ * the endpoint, and the env var is an override.
+ */
+const graphqlUrl = () => 
+/* The data layer's `gql()` has no default and refuses to guess; the chain
+   layer always fell back to the network's own index. Both kept. */
+((0, given_ts_1.givenConfig)().graphqlUrl ?? ((0, envRead_ts_1.hasEnv)() ? process.env.NEXT_PUBLIC_GRAPHQL_URL : undefined) ?? "") || ENDPOINTS[(0, network_ts_1.network)()].graphqlUrl;
+exports.graphqlUrl = graphqlUrl;
+/**
+ * The relayer node every entity we mint names. A DID, so it cannot be
+ * guessed from the network name the way a URL can — hence the table. The
+ * testnet value used to be hardcoded everywhere, which meant a devnet
+ * deployment minted entities that pointed at a relayer on another chain.
+ */
+const relayerNode = () => (0, given_ts_1.givenConfig)().relayerNodeDid ?? ((0, envRead_ts_1.hasEnv)() ? (0, envRead_ts_1.firstSet)(process.env.NEXT_PUBLIC_RELAYER_NODE_DID) : undefined) ?? ENDPOINTS[(0, network_ts_1.network)()].relayerNodeDid;
+exports.relayerNode = relayerNode;
+//# sourceMappingURL=env.js.map

package/dist/cjs/chain/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/chain/env.ts"],"names":[],"mappings":";;;AAqEA,oBAIC;AAzED,0CAA0C;AAC1C,8CAAsD;AAO7C,wFAPc,oBAAO,OAOd;AANhB,8CAAiD;AAiBjD,MAAM,SAAS,GAAwD;IACrE,MAAM,EAAE;QACN,MAAM,EAAE,+BAA+B;QACvC,OAAO,EAAE,+BAA+B;QACxC,UAAU,EAAE,oDAAoD;QAChE,6EAA6E;QAC7E,cAAc,EAAE,iDAAiD;QACjE,SAAS,EAAE,iCAAiC;KAC7C;IACD,OAAO,EAAE;QACP,MAAM,EAAE,gCAAgC;QACxC,OAAO,EAAE,gCAAgC;QACzC,UAAU,EAAE,qDAAqD;QACjE,cAAc,EAAE,iDAAiD;QACjE,SAAS,EAAE,kCAAkC;KAC9C;IACD,OAAO,EAAE;QACP,MAAM,EAAE,kCAAkC;QAC1C,OAAO,EAAE,kCAAkC;QAC3C,UAAU,EAAE,6CAA6C;QACzD,cAAc,EAAE,iDAAiD;QACjE,SAAS,EAAE,IAAI;KAChB;CACF,CAAC;AAEK,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAA4B,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAA/E,QAAA,iBAAiB,qBAA8D;AAE5F;;;;;;;;;;;;;;GAcG;AACI,MAAM,MAAM,GAAG,GAAW,EAAE,CACjC,IAAA,sBAAW,GAAE,CAAC,MAAM,IAAI,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,IAAA,qBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAA,oBAAO,GAAE,CAAC,CAAC,MAAM,CAAC;AADrJ,QAAA,MAAM,UAC+I;AAElK;;;;GAIG;AACH,SAAgB,IAAI;IAClB,MAAM,KAAK,GAAG,IAAA,sBAAW,GAAE,CAAC;IAC5B,IAAI,WAAW,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9D,OAAO,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;AACnF,CAAC;AAED,8FAA8F;AACvF,MAAM,OAAO,GAAG,GAAW,EAAE,CAClC,CAAC,IAAA,sBAAW,GAAE,CAAC,OAAO,IAAI,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,IAAA,qBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAA,oBAAO,GAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AADvI,QAAA,OAAO,WACgI;AAEpJ,sGAAsG;AAC/F,MAAM,SAAS,GAAG,GAAkB,EAAE;IAC3C,MAAM,KAAK,GAAG,IAAA,sBAAW,GAAE,CAAC,SAAS,CAAC;IACtC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAA,oBAAO,GAAE,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC,CAAC;AAHW,QAAA,SAAS,aAGpB;AAEF;;;GAGG;AACI,MAAM,UAAU,GAAG,GAAW,EAAE;AACrC;mEACmE;AACnE,CAAC,IAAA,sBAAW,GAAE,CAAC,UAAU,IAAI,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,IAAA,oBAAO,GAAE,CAAC,CAAC,UAAU,CAAC;AAHzH,QAAA,UAAU,cAG+G;AAEtI;;;;;GAKG;AACI,MAAM,WAAW,GAAG,GAAW,EAAE,CACtC,IAAA,sBAAW,GAAE,CAAC,cAAc,IAAI,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,IAAA,qBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAA,oBAAO,GAAE,CAAC,CAAC,cAAc,CAAC;AADxI,QAAA,WAAW,eAC6H"}

package/dist/cjs/chain/gate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The subset of `admins` that has given `gate` the power to authorize
+ * strangers.
+ *
+ * A query that fails is reported as unauthorized rather than thrown, because
+ * every caller is deciding what to show rather than what to permit — the gate
+ * itself re-checks before it signs anything. Failing closed here would hide
+ * real work over a flaky RPC; failing open would let someone through, which is
+ * why this is not the thing that grants.
+ */
+export declare function takeableAdmins(admins: string[], gate: string): Promise<Set<string>>;
+//# sourceMappingURL=gate.d.ts.map

package/dist/cjs/chain/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../../src/chain/gate.ts"],"names":[],"mappings":"AA4BA;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAiBzF"}

package/dist/cjs/chain/gate.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.takeableAdmins = takeableAdmins;
+const query_ts_1 = require("./query.js");
+/**
+ * Which asks a stranger can actually get into.
+ *
+ * There are three different questions hiding behind the word "open", and this
+ * is the third one:
+ *
+ * 1. The chain's `state` — which it never changes once an ask exists.
+ * 2. `askOpenness` — filled, expired, paused. Written when we learned that (1)
+ *    was not enough, because the board was offering work the gate would refuse.
+ * 3. **This.** Whether the ask's poster ever granted *this deployment's gate*
+ *    the right to let a stranger submit. Asks posted through the app always
+ *    do; nothing else on a shared testnet ever does.
+ *
+ * That third one turned out to matter more than expected. The testnet index is
+ * shared: `claimCollections` returns every collection on the network, and most
+ * of them belong to other projects who have never heard of Openhands. Measured
+ * 2026-08-23, twenty-five distinct admins held open collections on the board
+ * and eight of them had authorized our gate.
+ *
+ * One query per **admin**, not per ask, because a poster's several asks share
+ * one meta-authorization — and the whole board is 25 queries in about 200 ms
+ * when they go out together.
+ */
+const META_AUTHZ_TYPE = "/ixo.claims.v1beta1.CreateClaimAuthorizationAuthorization";
+/**
+ * The subset of `admins` that has given `gate` the power to authorize
+ * strangers.
+ *
+ * A query that fails is reported as unauthorized rather than thrown, because
+ * every caller is deciding what to show rather than what to permit — the gate
+ * itself re-checks before it signs anything. Failing closed here would hide
+ * real work over a flaky RPC; failing open would let someone through, which is
+ * why this is not the thing that grants.
+ */
+async function takeableAdmins(admins, gate) {
+    if (!gate)
+        return new Set();
+    const unique = [...new Set(admins.filter(Boolean))];
+    const client = await (0, query_ts_1.getQueryClient)();
+    const answers = await Promise.all(unique.map(async (admin) => {
+        try {
+            const { grants } = await client.cosmos.authz.v1beta1.grants({ granter: admin, grantee: gate, msgTypeUrl: "" });
+            return (grants ?? []).some((grant) => grant.authorization?.typeUrl === META_AUTHZ_TYPE) ? admin : null;
+        }
+        catch {
+            return null;
+        }
+    }));
+    return new Set(answers.filter(Boolean));
+}
+//# sourceMappingURL=gate.js.map

package/dist/cjs/chain/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../src/chain/gate.ts"],"names":[],"mappings":";;AAsCA,wCAiBC;AAvDD,yCAA4C;AAE5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,eAAe,GAAG,2DAA2D,CAAC;AAEpF;;;;;;;;;GASG;AACI,KAAK,UAAU,cAAc,CAAC,MAAgB,EAAE,IAAY;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,GAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/G,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC;AACtD,CAAC"}

package/dist/cjs/chain/grantPending.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A gate grant that is still on its way (final review 2026-10, WN9a/WN9e).
+ *
+ * The gate's doors (submit, union, poster) answer `202 {pending: true, code:
+ * "grant-pending", hash}` with `retry-after: 15` when the grant's broadcast
+ * left but was not yet seen on chain. That is success in progress, not an
+ * error — and a 202 is `response.ok`, so a caller that only checked `ok`
+ * went straight on to sign against a grant that was not there yet. The
+ * answer is to ask the same door again after `retry-after`: inside the gate's
+ * ninety-second pending hold it answers 202 again without sending anything,
+ * and after the hold the chain's own read decides (granted, or a real answer).
+ */
+export declare const GRANT_PENDING = "grant-pending";
+/** Longer than the gate's 90 s hold plus one retry, so the last ask is answered by the chain's read. */
+export declare const GRANT_PENDING_MAX_WAIT_MS = 120000;
+/** Whether this answer is the gate's "sent, not yet seen". Reads a clone, so the caller can still read the body. */
+export declare function isGrantPending(response: Response): Promise<boolean>;
+/** The wait the gate asked for, in ms: its `retry-after` seconds, clamped to 1–30, 15 when it named none. */
+export declare function pendingRetryMs(response: Response): number;
+export interface UntilSettledOptions {
+    sleep?: (ms: number) => Promise<void>;
+    maxWaitMs?: number;
+}
+/**
+ * Send, and while the gate says "pending", wait as it asks and send the same
+ * request again. Returns the first answer that is not pending — or the last
+ * pending one once `maxWaitMs` is spent, which the caller reports as "still
+ * on its way, try again shortly" rather than as a refusal.
+ */
+export declare function untilSettled(send: () => Promise<Response>, options?: UntilSettledOptions): Promise<Response>;
+//# sourceMappingURL=grantPending.d.ts.map

package/dist/cjs/chain/grantPending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantPending.d.ts","sourceRoot":"","sources":["../../../src/chain/grantPending.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,wGAAwG;AACxG,eAAO,MAAM,yBAAyB,SAAU,CAAC;AAGjD,oHAAoH;AACpH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAIzE;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAGzD;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAYtH"}

package/dist/cjs/chain/grantPending.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * A gate grant that is still on its way (final review 2026-10, WN9a/WN9e).
+ *
+ * The gate's doors (submit, union, poster) answer `202 {pending: true, code:
+ * "grant-pending", hash}` with `retry-after: 15` when the grant's broadcast
+ * left but was not yet seen on chain. That is success in progress, not an
+ * error — and a 202 is `response.ok`, so a caller that only checked `ok`
+ * went straight on to sign against a grant that was not there yet. The
+ * answer is to ask the same door again after `retry-after`: inside the gate's
+ * ninety-second pending hold it answers 202 again without sending anything,
+ * and after the hold the chain's own read decides (granted, or a real answer).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GRANT_PENDING_MAX_WAIT_MS = exports.GRANT_PENDING = void 0;
+exports.isGrantPending = isGrantPending;
+exports.pendingRetryMs = pendingRetryMs;
+exports.untilSettled = untilSettled;
+exports.GRANT_PENDING = "grant-pending";
+/** Longer than the gate's 90 s hold plus one retry, so the last ask is answered by the chain's read. */
+exports.GRANT_PENDING_MAX_WAIT_MS = 120_000;
+const DEFAULT_RETRY_S = 15;
+/** Whether this answer is the gate's "sent, not yet seen". Reads a clone, so the caller can still read the body. */
+async function isGrantPending(response) {
+    if (response.status !== 202)
+        return false;
+    const body = (await response.clone().json().catch(() => null));
+    return body?.pending === true || body?.code === exports.GRANT_PENDING;
+}
+/** The wait the gate asked for, in ms: its `retry-after` seconds, clamped to 1–30, 15 when it named none. */
+function pendingRetryMs(response) {
+    const seconds = Number(response.headers.get("retry-after"));
+    return Math.min(30, Math.max(1, Number.isFinite(seconds) && seconds > 0 ? seconds : DEFAULT_RETRY_S)) * 1000;
+}
+/**
+ * Send, and while the gate says "pending", wait as it asks and send the same
+ * request again. Returns the first answer that is not pending — or the last
+ * pending one once `maxWaitMs` is spent, which the caller reports as "still
+ * on its way, try again shortly" rather than as a refusal.
+ */
+async function untilSettled(send, options = {}) {
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const maxWaitMs = options.maxWaitMs ?? exports.GRANT_PENDING_MAX_WAIT_MS;
+    let waited = 0;
+    for (;;) {
+        const response = await send();
+        if (!(await isGrantPending(response)))
+            return response;
+        const wait = pendingRetryMs(response);
+        if (waited + wait > maxWaitMs)
+            return response;
+        await sleep(wait);
+        waited += wait;
+    }
+}
+//# sourceMappingURL=grantPending.js.map

package/dist/cjs/chain/grantPending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantPending.js","sourceRoot":"","sources":["../../../src/chain/grantPending.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAQH,wCAIC;AAGD,wCAGC;AAaD,oCAYC;AAzCY,QAAA,aAAa,GAAG,eAAe,CAAC;AAC7C,wGAAwG;AAC3F,QAAA,yBAAyB,GAAG,OAAO,CAAC;AACjD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,oHAAoH;AAC7G,KAAK,UAAU,cAAc,CAAC,QAAkB;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAiD,CAAC;IAC/G,OAAO,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,IAAI,EAAE,IAAI,KAAK,qBAAa,CAAC;AAChE,CAAC;AAED,6GAA6G;AAC7G,SAAgB,cAAc,CAAC,QAAkB;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,CAAC;AAC/G,CAAC;AAOD;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAAC,IAA6B,EAAE,UAA+B,EAAE;IACjG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,iCAAyB,CAAC;IACjE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;AACH,CAAC"}