@ixo/openhands-sdk 0.0.0-stage → 0.1.0

package/dist/cjs/chain/guest.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The stranger's path. A throwaway key is minted in the page, the granter bot
+ * issues the capped submit authorization, and the proof goes on chain — no
+ * account, no form, nothing to install. If the work is approved, the payout
+ * lands on the throwaway address, and saving with a passkey turns that address
+ * into a real account by adding a passkey to it. The account appears around
+ * the money.
+ */
+/** The guest funnel's gate: `configure({ granterBotUrl })`, else `NEXT_PUBLIC_GRANTER_BOT_URL`, else "". */
+export declare const granterBotUrl: () => string;
+export declare const guestFunnelAvailable: () => boolean;
+interface GuestKey {
+    mnemonic: string;
+    address: string;
+    /**
+     * Present when the slot was seeded from an auth-hub session: the mnemonic
+     * is then a session key registered on the account at `address` as this
+     * authenticator, not a key whose own address is `address`. It signs as the
+     * account through the smart-account path — see `broadcastAsAccount`.
+     */
+    authenticatorId?: string;
+}
+/**
+ * The gate said no. The message is the gate's code (`stale-proof`,
+ * `needs-account`, …), exactly as before, so every reader of `error.message`
+ * is unchanged; the status and the body ride along for the one reader that
+ * needs more — a stale refusal names the server's clock (`serverNow`), and
+ * the app signs again by it (the youth app's lib/freshProof.ts).
+ */
+export declare class GateRefusal extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, status: number, body: unknown);
+}
+export declare function loadGuestKey(collectionId: string): GuestKey | null;
+/** Submit as a stranger: throwaway key → granter bot → sponsored submit. */
+export declare function guestSubmit(args: {
+    collectionId: string;
+    adminAddress: string;
+    claimId: string;
+    /**
+     * Optional proof that the signer is who the grant will be issued to.
+     *
+     * The gate has always been happy to authorize whoever asked, because the
+     * whole point of the stranger's path is that a stranger may ask. A
+     * campaign that requires an account needs the opposite — a grant issued
+     * only to somebody who can sign for the address on it — and the check has
+     * to happen at the gate, since hiding a button changes nothing about an
+     * HTTP endpoint. Passed straight through; a gate that does not ask for one
+     * ignores it.
+     */
+    proof?: {
+        kind: string;
+        pubkey: string;
+        signature: string;
+        message: string;
+    } | null;
+    /**
+     * Where the gate is, when the app knows better than the environment.
+     *
+     * This package reads `NEXT_PUBLIC_GRANTER_BOT_URL` and cannot know that
+     * the app calling it lives under a path prefix. The youth app moved under
+     * `/cleanup`, every hand-written fetch in it learned the prefix, and this
+     * one — inside the package — kept posting to `/api/grant`: a bare 404 on
+     * the app's own host, and through Jambo's proxy a request that never
+     * reached us at all. The person saw "the submission gate refused" with no
+     * code under it, because a 404 page has none. The prefix is the app's
+     * knowledge, so the app passes the address in.
+     */
+    gateUrl?: string;
+    /**
+     * The clock the fallback proof names its moment by, when the caller knows a
+     * better one than the phone's (the youth app's server-corrected clock,
+     * the youth app's lib/clock.ts). Ignored when `proof` is given. Default: the phone's.
+     */
+    now?: () => number;
+}): Promise<{
+    address: string;
+}>;
+/** After approval: wrap the paid address in a passkey — this IS account creation. */
+export declare function claimWithPasskey(collectionId: string): Promise<{
+    address: string;
+}>;
+/**
+ * Prove control of the guest key this browser holds for an ask.
+ *
+ * The stranger's path already minted a key here to submit with, so the person
+ * asking a question on the thread they worked on needs no prompt, no sign-in
+ * and no new step — they sign with what is already in the page.
+ */
+export declare function proveWithGuestKey(collectionId: string, message: string): Promise<{
+    kind: "adr36";
+    pubkey: string;
+    signature: string;
+} | null>;
+export {};
+//# sourceMappingURL=guest.d.ts.map

package/dist/cjs/chain/guest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest.d.ts","sourceRoot":"","sources":["../../../src/chain/guest.ts"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AAEH,4GAA4G;AAC5G,eAAO,MAAM,aAAa,QAAO,MAA+G,CAAC;AAEjJ,eAAO,MAAM,oBAAoB,QAAO,OAAmC,CAAC;AAE5E,UAAU,QAAQ;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;CAK3D;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAOlE;AAgBD,4EAA4E;AAC5E,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA4D/B;AAED,qFAAqF;AACrF,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAsCzF;AASD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAKnJ"}

package/dist/cjs/chain/guest.js

@@ -0,0 +1,211 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GateRefusal = exports.guestFunnelAvailable = exports.granterBotUrl = void 0;
+exports.loadGuestKey = loadGuestKey;
+exports.guestSubmit = guestSubmit;
+exports.claimWithPasskey = claimWithPasskey;
+exports.proveWithGuestKey = proveWithGuestKey;
+const proto_signing_1 = require("@cosmjs/proto-signing");
+const impactxclient_sdk_1 = require("@ixo/impactxclient-sdk");
+const broadcast_ts_1 = require("./broadcast.js");
+const iid_ts_1 = require("./iid.js");
+const session_ts_1 = require("./session.js");
+const webauthn_ts_1 = require("./webauthn.js");
+const grantPending_ts_1 = require("./grantPending.js");
+const given_ts_1 = require("../given.js");
+const envRead_ts_1 = require("../envRead.js");
+/**
+ * The stranger's path. A throwaway key is minted in the page, the granter bot
+ * issues the capped submit authorization, and the proof goes on chain — no
+ * account, no form, nothing to install. If the work is approved, the payout
+ * lands on the throwaway address, and saving with a passkey turns that address
+ * into a real account by adding a passkey to it. The account appears around
+ * the money.
+ */
+/** The guest funnel's gate: `configure({ granterBotUrl })`, else `NEXT_PUBLIC_GRANTER_BOT_URL`, else "". */
+const granterBotUrl = () => (0, given_ts_1.givenConfig)().granterBotUrl ?? ((0, envRead_ts_1.hasEnv)() ? process.env.NEXT_PUBLIC_GRANTER_BOT_URL : undefined) ?? "";
+exports.granterBotUrl = granterBotUrl;
+const guestFunnelAvailable = () => Boolean((0, exports.granterBotUrl)());
+exports.guestFunnelAvailable = guestFunnelAvailable;
+const storageKey = (collectionId) => `qi.guest.${collectionId}`;
+/**
+ * The gate said no. The message is the gate's code (`stale-proof`,
+ * `needs-account`, …), exactly as before, so every reader of `error.message`
+ * is unchanged; the status and the body ride along for the one reader that
+ * needs more — a stale refusal names the server's clock (`serverNow`), and
+ * the app signs again by it (the youth app's lib/freshProof.ts).
+ */
+class GateRefusal extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+exports.GateRefusal = GateRefusal;
+function loadGuestKey(collectionId) {
+    try {
+        const raw = window.localStorage.getItem(storageKey(collectionId));
+        return raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function ensureGuestKey(collectionId) {
+    const existing = loadGuestKey(collectionId);
+    if (existing) {
+        const wallet = await proto_signing_1.DirectSecp256k1HdWallet.fromMnemonic(existing.mnemonic, { prefix: "ixo" });
+        return { wallet, address: existing.address, key: existing };
+    }
+    const wallet = await proto_signing_1.DirectSecp256k1HdWallet.generate(12, { prefix: "ixo" });
+    const [account] = await wallet.getAccounts();
+    if (!account)
+        throw new Error("Key generation failed");
+    const key = { mnemonic: wallet.mnemonic, address: account.address };
+    window.localStorage.setItem(storageKey(collectionId), JSON.stringify(key));
+    return { wallet, address: account.address, key };
+}
+/** Submit as a stranger: throwaway key → granter bot → sponsored submit. */
+async function guestSubmit(args) {
+    const gate = (args.gateUrl ?? (0, exports.granterBotUrl)()).replace(/\/$/, "");
+    if (!gate)
+        throw new Error("This ask isn't taking outside answers yet");
+    const { wallet, address, key } = await ensureGuestKey(args.collectionId);
+    /* The gate asks every submission grant to prove the address it is for (workers/src/gate).
+       A guest key IS its address, so it proves itself: fresh words naming this ask and this
+       address, signed with the key already in the page. A caller that proved as an account
+       (a session key acting for a smart account) hands that proof through instead. */
+    const proof = args.proof ?? (await proveWithKey(key.mnemonic, args.collectionId, address, args.now?.()));
+    /* A 202 is the gate's "sent, not yet seen on chain": asked again as it says
+       until it settles, never taken as granted (`grantPending.ts`). */
+    const grant = await (0, grantPending_ts_1.untilSettled)(() => fetch(`${gate}/grant`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ collectionId: args.collectionId, granteeAddress: address, proof }),
+        /* The gate broadcasts a transaction before answering; a minute is the
+           chain's slow day, not ours. */
+        signal: AbortSignal.timeout(60_000)
+    }));
+    if (await (0, grantPending_ts_1.isGrantPending)(grant)) {
+        /* Still on its way after the gate's whole hold: not a refusal. The code is
+           what the screen judges (the youth app's `lib/sendErrors.ts`: try again shortly). */
+        throw new GateRefusal(grantPending_ts_1.GRANT_PENDING, grant.status, await grant.json().catch(() => null));
+    }
+    if (!grant.ok) {
+        const body = (await grant.json().catch(() => null));
+        throw new GateRefusal(body?.error ?? "The answer gate refused. This ask may have closed", grant.status, body);
+    }
+    const submit = impactxclient_sdk_1.ixo.claims.v1beta1.MsgSubmitClaim.encode(impactxclient_sdk_1.ixo.claims.v1beta1.MsgSubmitClaim.fromPartial({
+        adminAddress: args.adminAddress,
+        agentAddress: address,
+        agentDid: (0, iid_ts_1.didOf)(address),
+        claimId: args.claimId,
+        collectionId: args.collectionId
+    })).finish();
+    const messages = [
+        {
+            typeUrl: "/cosmos.authz.v1beta1.MsgExec",
+            value: impactxclient_sdk_1.cosmos.authz.v1beta1.MsgExec.fromPartial({
+                grantee: address,
+                msgs: [{ typeUrl: "/ixo.claims.v1beta1.MsgSubmitClaim", value: submit }]
+            })
+        }
+    ];
+    /* A slot seeded from an auth-hub session holds a session key, not the
+       account's own: it signs as the account through its authenticator. A
+       throwaway key signs for itself, as it always has. */
+    if (key.authenticatorId)
+        await (0, broadcast_ts_1.broadcastAsAccount)({ address, mnemonic: key.mnemonic, authenticatorId: key.authenticatorId }, messages, "Submit evidence");
+    else
+        await (0, broadcast_ts_1.broadcastWithWallet)(wallet, address, messages, "Submit evidence");
+    return { address };
+}
+/** After approval: wrap the paid address in a passkey — this IS account creation. */
+async function claimWithPasskey(collectionId) {
+    const guest = loadGuestKey(collectionId);
+    if (!guest)
+        throw new Error("This browser holds no key for that answer");
+    const wallet = await proto_signing_1.DirectSecp256k1HdWallet.fromMnemonic(guest.mnemonic, { prefix: "ixo" });
+    const [walletAccount] = await wallet.getAccounts();
+    if (!walletAccount)
+        throw new Error("Key restore failed");
+    const credential = await (0, webauthn_ts_1.createCredential)(guest.address, "Openhands account");
+    const authnPubKey = impactxclient_sdk_1.ixo.smartaccount.crypto.AuthnPubKey.encode(impactxclient_sdk_1.ixo.smartaccount.crypto.AuthnPubKey.fromPartial({
+        keyId: credential.credentialId,
+        key: credential.publicKey,
+        coseAlgorithm: credential.coseAlgorithm
+    })).finish();
+    await (0, broadcast_ts_1.broadcastWithWallet)(wallet, guest.address, [
+        (0, iid_ts_1.iidDocumentMsg)(guest.address, walletAccount.pubkey),
+        {
+            typeUrl: "/ixo.smartaccount.v1beta1.MsgAddAuthenticator",
+            value: impactxclient_sdk_1.ixo.smartaccount.v1beta1.MsgAddAuthenticator.fromPartial({
+                sender: guest.address,
+                authenticatorType: "AuthnVerification",
+                data: authnPubKey
+            })
+        }
+    ], "Claim the account with a passkey");
+    const { waitForAuthenticator } = await Promise.resolve().then(() => __importStar(require("./account.js")));
+    const authenticator = await waitForAuthenticator(credential.credentialId);
+    (0, session_ts_1.saveSession)({ address: guest.address, credentialId: credential.credentialId, authenticatorId: authenticator.id });
+    window.localStorage.removeItem(storageKey(collectionId));
+    return { address: guest.address };
+}
+/** The gate's proof, signed by the key that is the address: `submit:<collection>:<address>:<now>`. */
+async function proveWithKey(mnemonic, collectionId, address, at) {
+    const { signWords, submitProofMessage } = await Promise.resolve().then(() => __importStar(require("./accountProof.js")));
+    const message = submitProofMessage(collectionId, address, at);
+    return { kind: "adr36", message, ...(await signWords(mnemonic, message)) };
+}
+/**
+ * Prove control of the guest key this browser holds for an ask.
+ *
+ * The stranger's path already minted a key here to submit with, so the person
+ * asking a question on the thread they worked on needs no prompt, no sign-in
+ * and no new step — they sign with what is already in the page.
+ */
+async function proveWithGuestKey(collectionId, message) {
+    const existing = loadGuestKey(collectionId);
+    if (!existing)
+        return null;
+    const { signWords } = await Promise.resolve().then(() => __importStar(require("./accountProof.js")));
+    return { kind: "adr36", ...(await signWords(existing.mnemonic, message)) };
+}
+//# sourceMappingURL=guest.js.map

package/dist/cjs/chain/guest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest.js","sourceRoot":"","sources":["../../../src/chain/guest.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwDA,oCAOC;AAiBD,kCA+FC;AAGD,4CAsCC;AAgBD,8CAKC;AA7OD,yDAAgE;AAChE,8DAAqD;AAErD,iDAAyE;AACzE,qCAAiD;AACjD,6CAA2C;AAC3C,+CAAiD;AACjD,uDAAgF;AAChF,0CAA0C;AAC1C,8CAAuC;AAEvC;;;;;;;GAOG;AAEH,4GAA4G;AACrG,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,IAAA,sBAAW,GAAE,CAAC,aAAa,IAAI,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;AAApI,QAAA,aAAa,iBAAuH;AAE1I,MAAM,oBAAoB,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,IAAA,qBAAa,GAAE,CAAC,CAAC;AAA/D,QAAA,oBAAoB,wBAA2C;AAc5E,MAAM,UAAU,GAAG,CAAC,YAAoB,EAAE,EAAE,CAAC,YAAY,YAAY,EAAE,CAAC;AAExE;;;;;;GAMG;AACH,MAAa,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAU;IACvB,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AARD,kCAQC;AAED,SAAgB,YAAY,CAAC,YAAoB;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,YAAoB;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,uCAAuB,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,uCAAuB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9E,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,WAAW,CAAC,IAmCjC;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAA,qBAAa,GAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACxE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzE;;;sFAGkF;IAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAEzG;uEACmE;IACnE,MAAM,KAAK,GAAG,MAAM,IAAA,8BAAY,EAAC,GAAG,EAAE,CACpC,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE;QACrB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACzF;yCACiC;QACjC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CACH,CAAC;IACF,IAAI,MAAM,IAAA,gCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;QAChC;8FACsF;QACtF,MAAM,IAAI,WAAW,CAAC,+BAAa,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAC;QACjF,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,mDAAmD,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,MAAM,GAAG,uBAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CACrD,uBAAG,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,OAAO;QACrB,QAAQ,EAAE,IAAA,cAAK,EAAC,OAAO,CAAC;QACxB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CACH,CAAC,MAAM,EAAE,CAAC;IAEX,MAAM,QAAQ,GAAG;QACf;YACE,OAAO,EAAE,+BAA+B;YACxC,KAAK,EAAE,0BAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC9C,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;aACzE,CAAC;SACH;KACF,CAAC;IAEF;;2DAEuD;IACvD,IAAI,GAAG,CAAC,eAAe;QAAE,MAAM,IAAA,iCAAkB,EAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;;QACrJ,MAAM,IAAA,kCAAmB,EAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAE7E,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IACzD,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,uCAAuB,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,IAAA,8BAAgB,EAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,uBAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAC5D,uBAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;QAC9C,KAAK,EAAE,UAAU,CAAC,YAAY;QAC9B,GAAG,EAAE,UAAU,CAAC,SAAS;QACzB,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CACH,CAAC,MAAM,EAAE,CAAC;IAEX,MAAM,IAAA,kCAAmB,EACvB,MAAM,EACN,KAAK,CAAC,OAAO,EACb;QACE,IAAA,uBAAc,EAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;QACnD;YACE,OAAO,EAAE,+CAA+C;YACxD,KAAK,EAAE,uBAAG,CAAC,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC;gBAC9D,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,iBAAiB,EAAE,mBAAmB;gBACtC,IAAI,EAAE,WAAW;aAClB,CAAC;SACH;KACF,EACD,kCAAkC,CACnC,CAAC;IAEF,MAAM,EAAE,oBAAoB,EAAE,GAAG,wDAAa,cAAc,GAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAA,wBAAW,EAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;IAClH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,YAAoB,EAAE,OAAe,EAAE,EAAW;IAC9F,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,OAAe;IAC3E,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/cjs/chain/iid.d.ts

@@ -0,0 +1,26 @@
+import type { EncodeObject } from "@cosmjs/proto-signing";
+import { type PhonePrompt } from "./signWith.ts";
+import type { QiSession } from "./session.ts";
+/**
+ * The chain's identity layer: several messages (MsgCreateEntity among them)
+ * refuse a signer whose DID document doesn't exist yet. New Openhands accounts get
+ * theirs in the very first transaction; accounts from before that get one
+ * lazily, the first time they post.
+ */
+export declare const didOf: (address: string) => string;
+export declare function iidDocumentMsg(address: string, pubkey: Uint8Array): EncodeObject;
+/** The secp pubkey the account announced with its first tx. */
+/** The account's public key as hex — the shape SignX's transact payload wants. */
+export declare function pubkeyHexFor(address: string): Promise<string>;
+export declare function accountPubkey(address: string): Promise<Uint8Array>;
+export declare function hasIidDocument(address: string): Promise<boolean>;
+/**
+ * Register the account's identity on chain, if it has none.
+ *
+ * Signed through the session's own door, not a passkey. This runs **first**
+ * inside `createAskEntity`, so while it was passkey-only a connected account
+ * posting its first ask failed here — before any signing prompt appeared, with
+ * an error about a credential it does not have and was never going to.
+ */
+export declare function ensureIidDocument(session: QiSession, prompt?: PhonePrompt): Promise<void>;
+//# sourceMappingURL=iid.d.ts.map

package/dist/cjs/chain/iid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iid.d.ts","sourceRoot":"","sources":["../../../src/chain/iid.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;GAKG;AAEH,eAAO,MAAM,KAAK,GAAI,SAAS,MAAM,KAAG,MAA4C,CAAC;AAErF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,YAAY,CAWhF;AAED,+DAA+D;AAC/D,kFAAkF;AAClF,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOxE;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtE;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/F"}

package/dist/cjs/chain/iid.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.didOf = void 0;
+exports.iidDocumentMsg = iidDocumentMsg;
+exports.pubkeyHexFor = pubkeyHexFor;
+exports.accountPubkey = accountPubkey;
+exports.hasIidDocument = hasIidDocument;
+exports.ensureIidDocument = ensureIidDocument;
+const impactxclient_sdk_1 = require("@ixo/impactxclient-sdk");
+const signWith_ts_1 = require("./signWith.js");
+const query_ts_1 = require("./query.js");
+/**
+ * The chain's identity layer: several messages (MsgCreateEntity among them)
+ * refuse a signer whose DID document doesn't exist yet. New Openhands accounts get
+ * theirs in the very first transaction; accounts from before that get one
+ * lazily, the first time they post.
+ */
+const didOf = (address) => impactxclient_sdk_1.utils.did.generateSecpDid(address);
+exports.didOf = didOf;
+function iidDocumentMsg(address, pubkey) {
+    const did = (0, exports.didOf)(address);
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgCreateIidDocument",
+        value: impactxclient_sdk_1.ixo.iid.v1beta1.MsgCreateIidDocument.fromPartial({
+            id: did,
+            verifications: impactxclient_sdk_1.customMessages.iid.createIidVerificationMethods({ did, pubkey, address, controller: did, type: "secp" }),
+            signer: address,
+            controllers: [did]
+        })
+    };
+}
+/** The secp pubkey the account announced with its first tx. */
+/** The account's public key as hex — the shape SignX's transact payload wants. */
+async function pubkeyHexFor(address) {
+    return Buffer.from(await accountPubkey(address)).toString("hex");
+}
+async function accountPubkey(address) {
+    const client = await (0, query_ts_1.getQueryClient)();
+    const { account } = await client.cosmos.auth.v1beta1.account({ address });
+    if (!account)
+        throw new Error("Account not found on chain");
+    const base = impactxclient_sdk_1.cosmos.auth.v1beta1.BaseAccount.decode(account.value);
+    if (!base.pubKey?.value?.length)
+        throw new Error("The account has no public key on chain yet");
+    return impactxclient_sdk_1.cosmos.crypto.secp256k1.PubKey.decode(base.pubKey.value).key;
+}
+async function hasIidDocument(address) {
+    try {
+        const client = await (0, query_ts_1.getQueryClient)();
+        const result = await client.ixo.iid.v1beta1.iidDocument({ id: (0, exports.didOf)(address) });
+        return Boolean(result?.iidDocument);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Register the account's identity on chain, if it has none.
+ *
+ * Signed through the session's own door, not a passkey. This runs **first**
+ * inside `createAskEntity`, so while it was passkey-only a connected account
+ * posting its first ask failed here — before any signing prompt appeared, with
+ * an error about a credential it does not have and was never going to.
+ */
+async function ensureIidDocument(session, prompt) {
+    if (await hasIidDocument(session.address))
+        return;
+    const pubkey = await accountPubkey(session.address);
+    await (0, signWith_ts_1.signWithSession)(session, [iidDocumentMsg(session.address, pubkey)], "Register identity", prompt);
+}
+//# sourceMappingURL=iid.js.map

package/dist/cjs/chain/iid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iid.js","sourceRoot":"","sources":["../../../src/chain/iid.ts"],"names":[],"mappings":";;;AAgBA,wCAWC;AAID,oCAEC;AAED,sCAOC;AAED,wCAQC;AAUD,8CAIC;AAjED,8DAA4E;AAE5E,+CAAkE;AAClE,yCAA4C;AAG5C;;;;;GAKG;AAEI,MAAM,KAAK,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,yBAAK,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAAxE,QAAA,KAAK,SAAmE;AAErF,SAAgB,cAAc,CAAC,OAAe,EAAE,MAAkB;IAChE,MAAM,GAAG,GAAG,IAAA,aAAK,EAAC,OAAO,CAAC,CAAC;IAC3B,OAAO;QACL,OAAO,EAAE,uCAAuC;QAChD,KAAK,EAAE,uBAAG,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,GAAG;YACP,aAAa,EAAE,kCAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACvH,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,CAAC,GAAG,CAAC;SACnB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,kFAAkF;AAC3E,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,GAAE,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,0BAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/F,OAAO,0BAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;AACtE,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAc,GAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,IAAA,aAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CAAC,OAAkB,EAAE,MAAoB;IAC9E,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IAClD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAA,6BAAe,EAAC,OAAO,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;AACzG,CAAC"}

package/dist/cjs/chain/money.d.ts

@@ -0,0 +1,48 @@
+/**
+ * What an ask is denominated in, and how a denom is spoken.
+ *
+ * One value, read once, threaded through every place that writes a payment
+ * leg — the browser composer, the worker agent, the seed script. Before this
+ * existed the denom was three string literals in `ask.ts` and three more in
+ * the worker's `chain.ts`, which is exactly how two posting paths drift.
+ *
+ * Gas is NOT this. The chain's fee token is `uixo` on every network whatever
+ * an ask pays in, and `broadcast.ts` names it directly.
+ */
+import type { AskDenom } from "../config.ts";
+/** The denoms an ask may be posted in. `upay` is ixo's PAY — 1 PAY = 1 USD. */
+export type { AskDenom };
+/**
+ * The denom NEW asks are posted in. Defaults to `uixo` so nothing changes
+ * until a deployment says otherwise; the board keeps rendering older asks in
+ * whatever they were posted in, because a denom is a property of the ask and
+ * never of the reader.
+ */
+export declare const askDenom: () => AskDenom;
+/** Base units per display unit. Both denoms are 6-decimal micro units. */
+export declare const MICRO = 1000000;
+/**
+ * `2.01` → `"2010000"`: a display amount in base units, without losing one.
+ *
+ * This floored `display * MICRO`, and binary floating point cannot hold most
+ * decimals: `2.01 * 1e6` is `2009999.9999999998`, so 2.01 PAY became
+ * 2,009,999 base units — a unit short of what the person typed (scale review
+ * D20). Rounding alone is not the answer either, because it would turn real
+ * sub-unit dust into a unit nobody paid for (`0.0000005` would become `1`).
+ *
+ * So: snap to the nearest base unit when the product is within floating-point
+ * error of it — that error is the only reason it is not already an integer —
+ * and floor otherwise, so genuine dust still rounds down rather than inventing
+ * a unit. Refuses a negative, non-finite or unsafe amount instead of
+ * producing a string the chain would reject or misread.
+ */
+export declare function baseFromPay(display: number): string;
+/** `0.5` → `"500000"`. The older name for `baseFromPay`, kept for its callers; same rule for every denom here. */
+export declare const toBase: (display: number) => string;
+/**
+ * PAY is pegged by ixo at 1 PAY = 1 USD, so a PAY amount can honestly wear a
+ * dollar face. IXO floats, so it never can — the face is only honest where
+ * the peg is.
+ */
+export declare const isPegged: (denom: string) => boolean;
+//# sourceMappingURL=money.d.ts.map

package/dist/cjs/chain/money.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../../../src/chain/money.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,+EAA+E;AAC/E,YAAY,EAAE,QAAQ,EAAE,CAAC;AAEzB;;;;;GAKG;AAMH,eAAO,MAAM,QAAQ,QAAO,QAG3B,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,KAAK,UAAY,CAAC;AAE/B;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,kHAAkH;AAClH,eAAO,MAAM,MAAM,GAAI,SAAS,MAAM,KAAG,MAA8B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,KAAG,OAA2B,CAAC"}

package/dist/cjs/chain/money.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * What an ask is denominated in, and how a denom is spoken.
+ *
+ * One value, read once, threaded through every place that writes a payment
+ * leg — the browser composer, the worker agent, the seed script. Before this
+ * existed the denom was three string literals in `ask.ts` and three more in
+ * the worker's `chain.ts`, which is exactly how two posting paths drift.
+ *
+ * Gas is NOT this. The chain's fee token is `uixo` on every network whatever
+ * an ask pays in, and `broadcast.ts` names it directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPegged = exports.toBase = exports.MICRO = exports.askDenom = void 0;
+exports.baseFromPay = baseFromPay;
+const given_ts_1 = require("../given.js");
+/**
+ * The denom NEW asks are posted in. Defaults to `uixo` so nothing changes
+ * until a deployment says otherwise; the board keeps rendering older asks in
+ * whatever they were posted in, because a denom is a property of the ask and
+ * never of the reader.
+ */
+/*
+ * Resolved as `config().askDenom` is (`configure()`, then the literal env read
+ * Next inlines), without importing the whole resolver: `toBase` and friends
+ * ride into browser pages, and the resolver's tables would ride with them.
+ */
+const askDenom = () => {
+    const env = typeof process === "undefined" || !process.env ? undefined : process.env.NEXT_PUBLIC_ASK_DENOM;
+    return (0, given_ts_1.givenConfig)().askDenom ?? (env === "upay" ? "upay" : "uixo");
+};
+exports.askDenom = askDenom;
+/** Base units per display unit. Both denoms are 6-decimal micro units. */
+exports.MICRO = 1_000_000;
+/**
+ * `2.01` → `"2010000"`: a display amount in base units, without losing one.
+ *
+ * This floored `display * MICRO`, and binary floating point cannot hold most
+ * decimals: `2.01 * 1e6` is `2009999.9999999998`, so 2.01 PAY became
+ * 2,009,999 base units — a unit short of what the person typed (scale review
+ * D20). Rounding alone is not the answer either, because it would turn real
+ * sub-unit dust into a unit nobody paid for (`0.0000005` would become `1`).
+ *
+ * So: snap to the nearest base unit when the product is within floating-point
+ * error of it — that error is the only reason it is not already an integer —
+ * and floor otherwise, so genuine dust still rounds down rather than inventing
+ * a unit. Refuses a negative, non-finite or unsafe amount instead of
+ * producing a string the chain would reject or misread.
+ */
+function baseFromPay(display) {
+    if (!Number.isFinite(display) || display < 0)
+        throw new RangeError(`not an amount: ${display}`);
+    const scaled = display * exports.MICRO;
+    if (scaled > Number.MAX_SAFE_INTEGER)
+        throw new RangeError(`amount too large to express exactly: ${display}`);
+    const nearest = Math.round(scaled);
+    /* A few ulps of the product: the size of the error multiplying by 1e6 can
+       introduce, and far smaller than any real fraction of a base unit. */
+    const noise = Math.max(1e-9, Math.abs(scaled) * Number.EPSILON * 16);
+    return String(Math.abs(scaled - nearest) <= noise ? nearest : Math.floor(scaled));
+}
+/** `0.5` → `"500000"`. The older name for `baseFromPay`, kept for its callers; same rule for every denom here. */
+const toBase = (display) => baseFromPay(display);
+exports.toBase = toBase;
+/**
+ * PAY is pegged by ixo at 1 PAY = 1 USD, so a PAY amount can honestly wear a
+ * dollar face. IXO floats, so it never can — the face is only honest where
+ * the peg is.
+ */
+const isPegged = (denom) => denom === "upay";
+exports.isPegged = isPegged;
+//# sourceMappingURL=money.js.map

package/dist/cjs/chain/money.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.js","sourceRoot":"","sources":["../../../src/chain/money.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0CH,kCASC;AAhDD,0CAA0C;AAK1C;;;;;GAKG;AACH;;;;GAIG;AACI,MAAM,QAAQ,GAAG,GAAa,EAAE;IACrC,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3G,OAAO,IAAA,sBAAW,GAAE,CAAC,QAAQ,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC,CAAC;AAHW,QAAA,QAAQ,YAGnB;AAEF,0EAA0E;AAC7D,QAAA,KAAK,GAAG,SAAS,CAAC;AAE/B;;;;;;;;;;;;;;GAcG;AACH,SAAgB,WAAW,CAAC,OAAe;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,OAAO,GAAG,aAAK,CAAC;IAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,UAAU,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC;2EACuE;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,kHAAkH;AAC3G,MAAM,MAAM,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AAA3D,QAAA,MAAM,UAAqD;AAExE;;;;GAIG;AACI,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;AAAxD,QAAA,QAAQ,YAAgD"}

package/dist/cjs/chain/oracle.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The nudge to the Openhands oracle.
+ *
+ * The oracle finds new asks and new claims on its own, by cron, but a cron is
+ * a wait. Openhands knows the moment an ask is posted and the moment a claim
+ * lands, so it says so: one POST, no body, no auth, best effort. The oracle
+ * verifies everything against the chain before acting, which is why the call
+ * carries nothing worth forging and why a lost call costs only the wait until
+ * the next cron tick. Nothing here may ever block or fail the user's flow.
+ *
+ *   hire — after tap 2 resolves the collection id: the oracle mints its own
+ *          evaluate grant and registers the collection with the engine.
+ *   scan — after a MsgSubmitClaim: the oracle pulls the claim and decides it.
+ */
+export type OracleEvent = "hire" | "scan";
+/** Unset means no oracle is wired to this deployment, and every nudge is a no-op. */
+export declare const oracleUrl: () => string;
+export interface NotifyOptions {
+    baseUrl?: string;
+    fetch?: typeof fetch;
+}
+/** True when the oracle answered 2xx; false on every other outcome, never a throw. */
+export declare function notifyOracle(event: OracleEvent, collectionId: string, options?: NotifyOptions): Promise<boolean>;
+//# sourceMappingURL=oracle.d.ts.map

package/dist/cjs/chain/oracle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracle.d.ts","sourceRoot":"","sources":["../../../src/chain/oracle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,SAAS,QAAO,MAA2H,CAAC;AAIzJ,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,sFAAsF;AACtF,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB1H"}

package/dist/cjs/chain/oracle.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * The nudge to the Openhands oracle.
+ *
+ * The oracle finds new asks and new claims on its own, by cron, but a cron is
+ * a wait. Openhands knows the moment an ask is posted and the moment a claim
+ * lands, so it says so: one POST, no body, no auth, best effort. The oracle
+ * verifies everything against the chain before acting, which is why the call
+ * carries nothing worth forging and why a lost call costs only the wait until
+ * the next cron tick. Nothing here may ever block or fail the user's flow.
+ *
+ *   hire — after tap 2 resolves the collection id: the oracle mints its own
+ *          evaluate grant and registers the collection with the engine.
+ *   scan — after a MsgSubmitClaim: the oracle pulls the claim and decides it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oracleUrl = void 0;
+exports.notifyOracle = notifyOracle;
+const given_ts_1 = require("../given.js");
+const envRead_ts_1 = require("../envRead.js");
+/** Unset means no oracle is wired to this deployment, and every nudge is a no-op. */
+const oracleUrl = () => ((0, given_ts_1.givenConfig)().oracleUrl ?? ((0, envRead_ts_1.hasEnv)() ? process.env.NEXT_PUBLIC_ORACLE_URL : undefined) ?? "").replace(/\/$/, "");
+exports.oracleUrl = oracleUrl;
+const TIMEOUT_MS = 5_000;
+/** True when the oracle answered 2xx; false on every other outcome, never a throw. */
+async function notifyOracle(event, collectionId, options = {}) {
+    const base = (options.baseUrl ?? (0, exports.oracleUrl)()).replace(/\/$/, "");
+    if (!base || !/^\d+$/.test(collectionId))
+        return false;
+    const send = options.fetch ?? globalThis.fetch;
+    if (typeof send !== "function")
+        return false;
+    try {
+        const response = await send(`${base}/openhands/${event}/${collectionId}`, {
+            method: "POST",
+            /* Survives the page moving on right after a submit. */
+            keepalive: true,
+            signal: AbortSignal.timeout(TIMEOUT_MS)
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=oracle.js.map

package/dist/cjs/chain/oracle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oracle.js","sourceRoot":"","sources":["../../../src/chain/oracle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAkBH,oCAgBC;AAhCD,0CAA0C;AAC1C,8CAAuC;AAIvC,qFAAqF;AAC9E,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,CAAC,IAAA,sBAAW,GAAE,CAAC,SAAS,IAAI,CAAC,IAAA,mBAAM,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAA5I,QAAA,SAAS,aAAmI;AAEzJ,MAAM,UAAU,GAAG,KAAK,CAAC;AAOzB,sFAAsF;AAC/E,KAAK,UAAU,YAAY,CAAC,KAAkB,EAAE,YAAoB,EAAE,UAAyB,EAAE;IACtG,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,IAAA,iBAAS,GAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,cAAc,KAAK,IAAI,YAAY,EAAE,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,uDAAuD;YACvD,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}