@ixo/openhands-sdk 0.0.0-stage → 0.1.0

package/dist/cjs/udid/verify.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Checking a determination without asking us anything.
+ *
+ * The point of signing is that this can run somewhere we do not control,
+ * against a key published somewhere anyone can read. So the checks are the
+ * blunt ones and they are all of them: the signature is real, the payload is
+ * the shape the standard defines, and it is about the thing the reader
+ * thinks it is about.
+ *
+ * **`aud` is not decoration.** A determination lifted from one collection and
+ * replayed against another verifies perfectly by signature alone; pinning
+ * `expectedAud` is what makes that a forgery rather than a fact.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromB64url = void 0;
+exports.verifyUdid = verifyUdid;
+const canonical_ts_1 = require("./canonical.js");
+const cid_ts_1 = require("./cid.js");
+const schema_ts_1 = require("./schema.js");
+const fromB64url = (text) => {
+    const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+    return Uint8Array.from(atob(padded + "=".repeat((4 - (padded.length % 4)) % 4)), (c) => c.charCodeAt(0));
+};
+exports.fromB64url = fromB64url;
+/**
+ * A compact JWS segment is base64url with no padding and nothing else.
+ *
+ * `atob` is forgiving — it skips ASCII whitespace and tolerates padding — so
+ * without this check two different strings could decode to the same bytes,
+ * verify against the same signature, and carry two different content
+ * addresses. The address is the whole point of `expectedCid`, so the string
+ * has to be exactly one encoding of the bytes it names.
+ */
+const B64URL = /^[A-Za-z0-9_-]+$/;
+/** An Ed25519 signature is exactly 64 bytes; anything else is not one. */
+const ED25519_SIGNATURE_BYTES = 64;
+async function verifyUdid(jws, options) {
+    const parts = jws.split(".");
+    if (parts.length !== 3)
+        return { valid: false, payload: null, reason: "not a compact JWS" };
+    const [header, body, signature] = parts;
+    if (!B64URL.test(header) || !B64URL.test(body) || !B64URL.test(signature)) {
+        return { valid: false, payload: null, reason: "a segment is not strict base64url" };
+    }
+    let head;
+    let payload;
+    try {
+        head = JSON.parse(new TextDecoder().decode(fromB64url(header)));
+        /* The base, never our profile — a verifier that only accepts its own
+           dialect can only ever check itself. */
+        payload = schema_ts_1.UdidBaseSchema.parse(JSON.parse(new TextDecoder().decode(fromB64url(body))));
+    }
+    catch (error) {
+        return { valid: false, payload: null, reason: error instanceof Error ? error.message : "unreadable" };
+    }
+    if (head.alg !== "EdDSA")
+        return { valid: false, payload, reason: `unexpected alg ${String(head.alg)}` };
+    /* RFC 7515 §4.1.11: a `crit` header names extensions the verifier MUST
+       understand. This verifier understands none, so any `crit` is a refusal. */
+    if (head.crit !== undefined)
+        return { valid: false, payload, reason: "header names critical extensions this verifier does not implement" };
+    const signatureBytes = fromB64url(signature);
+    if (signatureBytes.length !== ED25519_SIGNATURE_BYTES)
+        return { valid: false, payload, reason: "signature is not 64 bytes" };
+    const key = await crypto.subtle.importKey("raw", options.publicKeyRaw, { name: "Ed25519" }, false, ["verify"]);
+    const ok = await crypto.subtle.verify({ name: "Ed25519" }, key, signatureBytes, new TextEncoder().encode(`${header}.${body}`));
+    if (!ok)
+        return { valid: false, payload, reason: "signature does not verify" };
+    if (options.expectedAud && payload.aud !== options.expectedAud)
+        return { valid: false, payload, reason: "aud is for something else" };
+    if (options.expectedSub && payload.sub !== options.expectedSub)
+        return { valid: false, payload, reason: "sub is a different claim" };
+    /* `exp` is optional in the standard, and a determination that carries one
+       has said when it stops being one. The base schema passes it through. */
+    const exp = payload.exp;
+    if (exp !== undefined) {
+        if (typeof exp !== "number" || !Number.isFinite(exp))
+            return { valid: false, payload, reason: "exp is not a number" };
+        const now = options.now ?? Math.floor(Date.now() / 1000);
+        if (exp <= now)
+            return { valid: false, payload, reason: "expired" };
+    }
+    if (options.expectedCid) {
+        const cid = await (0, cid_ts_1.cidV1Raw)(new TextEncoder().encode(jws));
+        if (cid !== options.expectedCid)
+            return { valid: false, payload, reason: "these bytes have a different address" };
+    }
+    /* The body must be the canonical form, or two readers could hold two
+       documents that both verify and differ. */
+    const canonical = (0, canonical_ts_1.canonicalJson)(payload);
+    if (new TextDecoder().decode(fromB64url(body)) !== canonical) {
+        return { valid: false, payload, reason: "payload is not in canonical form" };
+    }
+    return { valid: true, payload };
+}
+//# sourceMappingURL=verify.js.map

package/dist/cjs/udid/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/udid/verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA4CH,gCA2DC;AArGD,iDAA+C;AAC/C,qCAAoC;AACpC,2CAA4D;AAE5D,MAAM,UAAU,GAAG,CAAC,IAAY,EAAc,EAAE;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,CAAC,CAAC;AAgGO,gCAAU;AA9FnB;;;;;;;;GAQG;AACH,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAElC,0EAA0E;AAC1E,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAqB5B,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAAsB;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC5F,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,KAAiC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,IAAuC,CAAC;IAC5C,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAsC,CAAC;QACrG;iDACyC;QACzC,OAAO,GAAG,0BAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACzG;iFAC6E;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IAE3I,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,uBAAuB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAE7H,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,YAA4B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/H,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,GAAG,EACH,cAA8B,EAC9B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAiB,CAC9D,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAE/E,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACtI,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAErI;8EAC0E;IAC1E,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACzD,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAQ,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,OAAO,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACpH,CAAC;IAED;gDAC4C;IAC5C,MAAM,SAAS,GAAG,IAAA,4BAAa,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}

package/dist/cjs/udid/wrapper.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The document the chain points at.
+ *
+ * A bare JWS on chain is honest and unreadable: every existing surface in the
+ * estate — the portal's claim detail, Jambo's credential list, our own
+ * receipt page — fetches a `verificationProof` and expects JSON. So the
+ * on-chain proof is this wrapper, which carries the decoded payload for
+ * anything that only wants to *display* it, and the `jws` plus its address
+ * for anything that wants to *check* it.
+ *
+ * The wrapper is a convenience and says so: `payload` here is a rendering.
+ * The artefact is `jws`, and `cid` is the address the exact bytes live at.
+ */
+/**
+ * The fields a wrapper's reader may rely on — the **base**, not our profile.
+ *
+ * This used to be `UdidPayload`, our own strict shape, and that was wrong in
+ * two ways at once. A determination in somebody else's profile — ixo's evals
+ * engine emits one — is still a determination this wrapper can carry, so
+ * typing it as ours claimed a guarantee the format does not make. And it made
+ * `wrapper.ts` depend on `schema.ts`, which imports zod: a type-only import,
+ * erased at runtime, but `tsc` still resolves it. The youth app builds
+ * standalone from its own package.json, so importing `parseWrapper` there
+ * broke its build on a validation library it neither installs nor needs.
+ *
+ * The index signature is the point: read what the base guarantees, and reach
+ * past it deliberately for anything a particular profile adds.
+ */
+export interface WrappedPayload {
+    iss: string;
+    sub: string;
+    aud: string;
+    iat: number;
+    kind: string;
+    ver: number;
+    sch?: string;
+    act: {
+        cap: string;
+        rub: {
+            id: string;
+        };
+        [key: string]: unknown;
+    };
+    res: {
+        outcome: number;
+        reason?: string;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface UdidWrapper {
+    type: "udid";
+    version: "1.0";
+    kind: "oracle.eval.v1";
+    sch: "oracle.udid.ixo.v1";
+    /** A rendering of the signed bytes, for readers that only display. */
+    payload: WrappedPayload;
+    /** The artefact. Everything else here is derived from it. */
+    jws: string;
+    cid: string;
+    sha256: string;
+    createdAt: string;
+    /**
+     * Everything a stranger needs to check this without asking us anything.
+     *
+     * There is no "where to fetch the signature" here, deliberately: the
+     * signature is the `jws` field above, and `cid` is the content address of
+     * exactly those bytes. A reader holding this document already holds the
+     * artefact, and pointing them at a second copy would only give them a way
+     * to check the wrong one.
+     */
+    verify: {
+        /** Where the issuer's public keys are published, as a JWKS. */
+        issuerKeys: string;
+        /** What `aud` a verifier must pin, or a determination lifted from one
+         *  collection replays perfectly against another. */
+        expectedAud: string;
+    };
+}
+export declare function wrap(args: {
+    payload: WrappedPayload;
+    jws: string;
+    cid: string;
+    sha256: string;
+    createdAt: string;
+    /** Where the issuer's public keys are published. */
+    issuerKeysUrl: string;
+}): UdidWrapper;
+export declare function parseWrapper(text: string): UdidWrapper | null;
+//# sourceMappingURL=wrapper.d.ts.map

package/dist/cjs/udid/wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../../../src/udid/wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAClE,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,KAAK,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,GAAG,EAAE,oBAAoB,CAAC;IAC1B,sEAAsE;IACtE,OAAO,EAAE,cAAc,CAAC;IACxB,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,MAAM,EAAE;QACN,+DAA+D;QAC/D,UAAU,EAAE,MAAM,CAAC;QACnB;4DACoD;QACpD,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,WAAW,CAad;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAO7D"}

package/dist/cjs/udid/wrapper.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * The document the chain points at.
+ *
+ * A bare JWS on chain is honest and unreadable: every existing surface in the
+ * estate — the portal's claim detail, Jambo's credential list, our own
+ * receipt page — fetches a `verificationProof` and expects JSON. So the
+ * on-chain proof is this wrapper, which carries the decoded payload for
+ * anything that only wants to *display* it, and the `jws` plus its address
+ * for anything that wants to *check* it.
+ *
+ * The wrapper is a convenience and says so: `payload` here is a rendering.
+ * The artefact is `jws`, and `cid` is the address the exact bytes live at.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrap = wrap;
+exports.parseWrapper = parseWrapper;
+function wrap(args) {
+    return {
+        type: "udid",
+        version: "1.0",
+        kind: "oracle.eval.v1",
+        sch: "oracle.udid.ixo.v1",
+        payload: args.payload,
+        jws: args.jws,
+        cid: args.cid,
+        sha256: `sha256:${args.sha256}`,
+        createdAt: args.createdAt,
+        verify: { issuerKeys: args.issuerKeysUrl, expectedAud: args.payload.aud }
+    };
+}
+function parseWrapper(text) {
+    try {
+        const doc = JSON.parse(text);
+        return doc?.type === "udid" && typeof doc.jws === "string" ? doc : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=wrapper.js.map

package/dist/cjs/udid/wrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../../../src/udid/wrapper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AA4DH,oBAqBC;AAED,oCAOC;AA9BD,SAAgB,IAAI,CAAC,IAQpB;IACC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;KAC1E,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QAC5C,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cjs/udid.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@ixo/openhands-sdk/udid` — the UDID envelope: schema, canonical form, CIDs, keys, verification and DID resolution.
+ *
+ * Isomorphic by contract: nothing reachable from here imports a `node:`
+ * builtin or a server-only package (`barrels.test.ts` walks the graph and
+ * fails if one appears), so a browser bundle can import this barrel. A module
+ * that needs Node stays reachable only by its own subpath.
+ */
+export * from "./udid/base58.ts";
+export * from "./udid/canonical.ts";
+export * from "./udid/cid.ts";
+export * from "./udid/key.ts";
+export * from "./udid/resolve.ts";
+export * from "./udid/schema.ts";
+export * from "./udid/verify.ts";
+export * from "./udid/wrapper.ts";
+//# sourceMappingURL=udid.d.ts.map

package/dist/cjs/udid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"udid.d.ts","sourceRoot":"","sources":["../../src/udid.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist/cjs/udid.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * `@ixo/openhands-sdk/udid` — the UDID envelope: schema, canonical form, CIDs, keys, verification and DID resolution.
+ *
+ * Isomorphic by contract: nothing reachable from here imports a `node:`
+ * builtin or a server-only package (`barrels.test.ts` walks the graph and
+ * fails if one appears), so a browser bundle can import this barrel. A module
+ * that needs Node stays reachable only by its own subpath.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./udid/base58.js"), exports);
+__exportStar(require("./udid/canonical.js"), exports);
+__exportStar(require("./udid/cid.js"), exports);
+__exportStar(require("./udid/key.js"), exports);
+__exportStar(require("./udid/resolve.js"), exports);
+__exportStar(require("./udid/schema.js"), exports);
+__exportStar(require("./udid/verify.js"), exports);
+__exportStar(require("./udid/wrapper.js"), exports);
+//# sourceMappingURL=udid.js.map

package/dist/cjs/udid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"udid.js","sourceRoot":"","sources":["../../src/udid.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;AAEH,mDAAiC;AACjC,sDAAoC;AACpC,gDAA8B;AAC9B,gDAA8B;AAC9B,oDAAkC;AAClC,mDAAiC;AACjC,mDAAiC;AACjC,oDAAkC"}

package/dist/esm/board.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@ixo/openhands-sdk/board` — the board's pure pieces: query parsing and URLs, assembly, ranking, coverage, series and trust. The loader (`data/board/read`) is subpath-only: it reads the index and reaches the campaign layer.
+ *
+ * Isomorphic by contract: nothing reachable from here imports a `node:`
+ * builtin or a server-only package (`barrels.test.ts` walks the graph and
+ * fails if one appears), so a browser bundle can import this barrel. A module
+ * that needs Node stays reachable only by its own subpath.
+ */
+export * from "./data/board/types.ts";
+export * from "./data/board/query.ts";
+export * from "./data/board/url.ts";
+export * from "./data/board/assemble.ts";
+export * from "./data/board/rank.ts";
+export * from "./data/board/words.ts";
+export { asksNear, busiestPlaces, countedAsks, COVERAGE_DAYS, coverageOf, coverageWords, firstApprovals, PLACE_MIN, PLACES_MAX, POSTING_BACKDATE_MS, toTime, townOf, waitWords, type Coverage, type CoverageAnswer, type CoveragePlace, type CoveragePlacesAnswer } from "./data/board/coverage.ts";
+export * from "./data/board/series.ts";
+export { FAST_MIN_PAID, FAST_MINUTES, medianOf, trustOf, trustWords, TIMED_MIN as TRUST_TIMED_MIN } from "./data/board/trust.ts";
+export { TIMED_MIN as COVERAGE_TIMED_MIN } from "./data/board/coverage.ts";
+export * from "./data/board/facts.ts";
+//# sourceMappingURL=board.d.ts.map

package/dist/esm/board.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../../src/board.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,WAAW,EACX,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,MAAM,EACN,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAClC,cAAc,wBAAwB,CAAC;AAIvC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjI,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,cAAc,uBAAuB,CAAC"}

package/dist/esm/board.js

@@ -0,0 +1,23 @@
+/**
+ * `@ixo/openhands-sdk/board` — the board's pure pieces: query parsing and URLs, assembly, ranking, coverage, series and trust. The loader (`data/board/read`) is subpath-only: it reads the index and reaches the campaign layer.
+ *
+ * Isomorphic by contract: nothing reachable from here imports a `node:`
+ * builtin or a server-only package (`barrels.test.ts` walks the graph and
+ * fails if one appears), so a browser bundle can import this barrel. A module
+ * that needs Node stays reachable only by its own subpath.
+ */
+export * from "./data/board/types.js";
+export * from "./data/board/query.js";
+export * from "./data/board/url.js";
+export * from "./data/board/assemble.js";
+export * from "./data/board/rank.js";
+export * from "./data/board/words.js";
+export { asksNear, busiestPlaces, countedAsks, COVERAGE_DAYS, coverageOf, coverageWords, firstApprovals, PLACE_MIN, PLACES_MAX, POSTING_BACKDATE_MS, toTime, townOf, waitWords } from "./data/board/coverage.js";
+export * from "./data/board/series.js";
+/* `trust` and `coverage` each define a different `TIMED_MIN` (5 and 3), so
+   both are listed by name and the two thresholds are renamed here rather
+   than one silently shadowing the other. The subpaths keep the plain names. */
+export { FAST_MIN_PAID, FAST_MINUTES, medianOf, trustOf, trustWords, TIMED_MIN as TRUST_TIMED_MIN } from "./data/board/trust.js";
+export { TIMED_MIN as COVERAGE_TIMED_MIN } from "./data/board/coverage.js";
+export * from "./data/board/facts.js";
+//# sourceMappingURL=board.js.map

package/dist/esm/board.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board.js","sourceRoot":"","sources":["../../src/board.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,WAAW,EACX,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,MAAM,EACN,MAAM,EACN,SAAS,EAKV,MAAM,0BAA0B,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC;;+EAE+E;AAC/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjI,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,cAAc,uBAAuB,CAAC"}

package/dist/esm/campaign/badges.d.ts

@@ -0,0 +1,30 @@
+/**
+ * What somebody has to show for it.
+ *
+ * A badge is a **count of approved claims**, never a number we keep — so it
+ * is re-derivable by anyone who can read the chain, which is what makes it
+ * portable to any surface that ever wants to render it. Nothing is issued
+ * here: a badge is a reading of the chain, and the signed credential that
+ * makes one portable is minted elsewhere from these same counts.
+ *
+ * The table is the one place a threshold lives, so `/me`, a certificate page
+ * and a share card can never disagree about what somebody earned.
+ */
+export type { Record_ } from "./record.ts";
+import type { Record_ } from "./record.ts";
+export interface Badge {
+    key: string;
+    emoji: string;
+    /** The plain English label. A youth app may render its own wording from
+     *  `key`; a credential and a share card need words that travel. */
+    title: string;
+    /** What earns it. */
+    need: (record: Record_) => boolean;
+    /** How far along, for a ring on a page that shows one. */
+    progress: (record: Record_) => number;
+    /** The line a card says about it. */
+    count: (record: Record_) => number;
+}
+export declare const BADGES: Badge[];
+export declare const badgeFor: (key: string) => Badge | null;
+//# sourceMappingURL=badges.d.ts.map

package/dist/esm/campaign/badges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"badges.d.ts","sourceRoot":"","sources":["../../../src/campaign/badges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd;uEACmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IACtC,qCAAqC;IACrC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;CACpC;AAID,eAAO,MAAM,MAAM,EAAE,KAAK,EAiDzB,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,KAAK,MAAM,KAAG,KAAK,GAAG,IAAqD,CAAC"}

package/dist/esm/campaign/badges.js

@@ -0,0 +1,65 @@
+/**
+ * What somebody has to show for it.
+ *
+ * A badge is a **count of approved claims**, never a number we keep — so it
+ * is re-derivable by anyone who can read the chain, which is what makes it
+ * portable to any surface that ever wants to render it. Nothing is issued
+ * here: a badge is a reading of the chain, and the signed credential that
+ * makes one portable is minted elsewhere from these same counts.
+ *
+ * The table is the one place a threshold lives, so `/me`, a certificate page
+ * and a share card can never disagree about what somebody earned.
+ */
+const ratio = (have, want) => Math.max(0, Math.min(1, have / want));
+export const BADGES = [
+    {
+        key: "first-find",
+        emoji: "🔎",
+        title: "First find",
+        need: (r) => r.spotted >= 1,
+        progress: (r) => ratio(r.spotted, 1),
+        count: (r) => r.spotted
+    },
+    {
+        key: "spotter-5",
+        emoji: "🕵️",
+        title: "Five finds",
+        need: (r) => r.spotted >= 5,
+        progress: (r) => ratio(r.spotted, 5),
+        count: (r) => r.spotted
+    },
+    {
+        key: "cleaner-1",
+        emoji: "🧹",
+        title: "Cleaned one",
+        need: (r) => r.cleaned >= 1,
+        progress: (r) => ratio(r.cleaned, 1),
+        count: (r) => r.cleaned
+    },
+    {
+        key: "cleaner-5",
+        emoji: "🌟",
+        title: "Cleaned five",
+        need: (r) => r.cleaned >= 5,
+        progress: (r) => ratio(r.cleaned, 5),
+        count: (r) => r.cleaned
+    },
+    {
+        key: "backer-1",
+        emoji: "💚",
+        title: "Backed a cleanup",
+        need: (r) => r.backed >= 1,
+        progress: (r) => ratio(r.backed, 1),
+        count: (r) => r.backed
+    },
+    {
+        key: "crew-1",
+        emoji: "🙋",
+        title: "Joined a crew",
+        need: (r) => r.committed >= 1,
+        progress: (r) => ratio(r.committed, 1),
+        count: (r) => r.committed
+    }
+];
+export const badgeFor = (key) => BADGES.find((one) => one.key === key) ?? null;
+//# sourceMappingURL=badges.js.map

package/dist/esm/campaign/badges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badges.js","sourceRoot":"","sources":["../../../src/campaign/badges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,MAAM,GAAY;IAC7B;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;KACxB;IACD;QACE,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;KACxB;IACD;QACE,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;KACxB;IACD;QACE,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;KACxB;IACD;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,kBAAkB;QACzB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM;KACvB;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;KAC1B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC"}

package/dist/esm/campaign/bands.d.ts

@@ -0,0 +1,161 @@
+/**
+ * What a mess is, and what clearing it is worth — the tables alone.
+ *
+ * Split out of `spot.ts` so a phone can carry the prices without the ask.
+ * The mapping ask's terms are a page of criterion prose, and three client
+ * surfaces — the map's pin card, the grown-up assessment picker, and the
+ * youth app's emoji vocabulary — need only these three tables and the
+ * arithmetic over them. `spot.ts` re-exports every name here, so nothing
+ * that already imports from it has to know this file exists.
+ *
+ * A spot needs a number before anybody can watch a thermometer fill, and the
+ * only person who knows that number is standing in front of it. So the estimate
+ * is not a separate step — it is three questions on the mapping form, and this
+ * file turns their answers into money.
+ *
+ * **Bands, not measurements.** A person can see "about a car boot" and cannot
+ * see 0.5 m³; a liar has to jump a whole category rather than shade a figure;
+ * and a model asked to check the estimate against the photograph can tell a
+ * bagful from a truckload while it could never tell 8 m³ from 11.
+ *
+ * **Every figure here is a placeholder** until somebody who has actually run a
+ * municipal cleanup spends an afternoon on them. They are in one table on
+ * purpose: a number nobody can find is a number nobody corrects.
+ */
+/**
+ * How much there is. `base` is what clearing it is worth before the
+ * multipliers — the crew, the hours and the trips it implies.
+ */
+export declare const VOLUME: {
+    readonly bagful: {
+        readonly base: number;
+        readonly says: "a bagful";
+    };
+    readonly boot: {
+        readonly base: number;
+        readonly says: "a car boot";
+    };
+    readonly trailer: {
+        readonly base: number;
+        readonly says: "a trailer";
+    };
+    readonly truck: {
+        readonly base: number;
+        readonly says: "a truck";
+    };
+    /**
+     * Priced, and **never offered to a crowd**. A site this size needs a
+     * coordinator, a vehicle and usually the municipality; putting it on a map as
+     * a thing a volunteer can take is how somebody gets hurt or gives up. It
+     * routes to the professionals path, same as anything hazardous.
+     */
+    readonly bigger: {
+        readonly base: number;
+        readonly says: "bigger than a truck";
+    };
+};
+/** What it is. Disposal is not free, and some of it is not close to free. */
+export declare const WASTE: {
+    readonly household: {
+        readonly factor: 1;
+        readonly says: "household";
+    };
+    readonly garden: {
+        readonly factor: 0.8;
+        readonly says: "garden";
+    };
+    readonly rubble: {
+        readonly factor: 1.5;
+        readonly says: "rubble";
+    };
+    /** Tyres, mattresses, electronics — the things a tip charges to take. */
+    readonly awkward: {
+        readonly factor: 2;
+        readonly says: "tyres, mattresses or electronics";
+    };
+};
+/** Getting to it, because carrying is most of the work. */
+export declare const ACCESS: {
+    readonly roadside: {
+        readonly factor: 1;
+        readonly says: "roadside";
+    };
+    readonly carry: {
+        readonly factor: 1.3;
+        readonly says: "a carry";
+    };
+    readonly hard: {
+        readonly factor: 1.8;
+        readonly says: "steep or water's edge";
+    };
+};
+/**
+ * The assessment as a person would say it — "a car boot of household,
+ * roadside" — from the same tables that price it, so the words and the
+ * money can never describe two different messes. This is the phrase the
+ * mapping claim already used of itself; a cleanup posted against the pin
+ * should speak of the mess, not of the coordinates (the position lives in
+ * the terms' own radius gate and on every map). Unknown bands fall through
+ * to null: a title is not the place to guess.
+ */
+export declare function spotPhrase(assessment: {
+    volume?: string;
+    waste?: string;
+    wastes?: readonly string[];
+    access?: string;
+} | null | undefined): string | null;
+/**
+ * Every kind of waste the finder saw, dearest first in effect.
+ *
+ * A mess is usually mixed (IXO-4928), and the picker took one answer
+ * because the single answer priced the spot. The pool made that
+ * unnecessary — what a cleaner is paid is what people put in — so the
+ * question can be asked honestly now.
+ *
+ * `wastes` is additive and `waste` stays: it becomes the **dominant** pick,
+ * the one with the highest disposal factor. Every reader that has ever
+ * existed goes on working unchanged, an assessment written before this
+ * reads as one kind, and `spotTarget` prices at the dearest thing present —
+ * which is the right direction for a ceiling that is never what gets paid.
+ */
+export declare function dominantWaste(wastes: readonly string[]): Waste | null;
+/**
+ * What an assessment says was in the mess, however it was written.
+ *
+ * One reader for both shapes: the list when there is one, the single band
+ * when there is not, and nothing when neither is a band this table knows.
+ */
+export declare function wastesOf(assessment: {
+    waste?: string;
+    wastes?: readonly string[];
+} | null | undefined): Waste[];
+export type Volume = keyof typeof VOLUME;
+export type Waste = keyof typeof WASTE;
+export type Access = keyof typeof ACCESS;
+export interface Assessment {
+    volume: Volume;
+    /** The dominant kind — the dearest of `wastes` when there are several. */
+    waste: Waste;
+    /** Every kind the finder saw, when they said. Absent means "just `waste`". */
+    wastes?: Waste[];
+    access: Access;
+}
+export declare function isAssessment(value: unknown): value is Assessment;
+/**
+ * What this spot is worth clearing, in base units — **a ceiling, not a price.**
+ *
+ * What actually gets paid is settled by what reached the disposal point. That
+ * distinction is the whole defence against an inflated estimate: reporting "a
+ * truck" raises the target and never the reporter's own fee, so the map ends up
+ * saying *"estimated: a trailer · hauled: two bags"* against a name, on a
+ * record nobody can edit. Self-correcting beats policed.
+ *
+ * Throws on an unknown band rather than treating it as free. A typo that costs
+ * nothing is a typo nobody finds.
+ */
+export declare function spotTarget(assessment: Assessment): number;
+/** The same fact as a sentence, for a pin somebody is deciding whether to back. */
+export declare function spotSays(assessment: Assessment): string;
+/** Work a crowd should not be sent at: too big, whatever it is made of. */
+export declare const needsProfessionals: (assessment: Assessment) => boolean;
+//# sourceMappingURL=bands.d.ts.map

package/dist/esm/campaign/bands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bands.d.ts","sourceRoot":"","sources":["../../../src/campaign/bands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;IAKjB;;;;;OAKG;;;;;CAEK,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,KAAK;;;;;;;;;;;;;IAIhB,yEAAyE;;;;;CAEjE,CAAC;AAEX,2DAA2D;AAC3D,eAAO,MAAM,MAAM;;;;;;;;;;;;;CAIT,CAAC;AAEX;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAKzJ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,GAAG,IAAI,CAOrE;AAKD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,EAAE,CAM/G;AASD,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,MAAM,CAAC;AACzC,MAAM,MAAM,KAAK,GAAG,MAAM,OAAO,KAAK,CAAC;AACvC,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,MAAM,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,KAAK,CAAC;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAiBD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAGhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAWzD;AAED,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,YAAY,UAAU,KAAG,OAAyC,CAAC"}