@ixo/openhands-sdk 0.0.0-stage → 0.2.0

package/dist/esm/campaign/treasurySends.js

@@ -0,0 +1,190 @@
+import { gql, gqlConnection } from "../data/gql.js";
+import { amountIn } from "./pool.js";
+import { askDenom } from "../chain/money.js";
+/*
+ * The memo filter runs IN the query, and the answer is paged to its end.
+ *
+ * This used to fetch the newest 400 treasury sends and look for the memo
+ * among them (scale review D5/D13). That was the last belt against paying a
+ * card buyer twice, and it went blind the moment the treasury made 400 other
+ * sends between the first attempt and the retry — a busy afternoon, not an
+ * edge case. Blocksync filters a message by its transaction's memo
+ * (`transactionByTransactionHash: {memo: …}`), so the index now answers the
+ * question asked instead of a window around it.
+ *
+ * Only transactions that succeeded (`code: 0`) count as sent: a failed
+ * transaction with the right memo moved nothing.
+ */
+const SEND = '"/cosmos.bank.v1beta1.MsgSend"';
+const SEND_FIELDS = "value transactionByTransactionHash { memo hash time code }";
+/** The most rows a memo-prefix read returns; one more throws rather than answering short. */
+export const MAX_SENDS = 10_000;
+function toSend(node, denom) {
+    const tx = node.transactionByTransactionHash;
+    /* The message value is the MsgSend as the index stored it; a shape it does
+       not recognise reads as zero. */
+    const value = node.value;
+    return {
+        memo: (tx?.memo ?? "").trim(),
+        hash: tx?.hash ?? "",
+        at: tx?.time ?? "",
+        from: typeof value?.fromAddress === "string" ? value.fromAddress : "",
+        to: typeof value?.toAddress === "string" ? value.toAddress : "",
+        amountBase: amountIn(value?.amount, denom)
+    };
+}
+/**
+ * The send from `fromAddress` carrying exactly `memo`, newest first, or null.
+ *
+ * Throws when the index cannot answer. Keyed on the sender as well as the
+ * memo, deliberately: anybody can put any memo on a transaction, so a memo
+ * alone is not proof that *the treasury* paid — a stranger's one-coin send
+ * with the right memo would otherwise read as a delivery made.
+ */
+export async function sendWithMemo(fromAddress, memo, denom = askDenom()) {
+    const data = await gql(`query {
+      messages(
+        filter: {typeUrl: {equalTo: ${SEND}}, value: {contains: {fromAddress: ${JSON.stringify(fromAddress)}}}, transactionByTransactionHash: {memo: {equalTo: ${JSON.stringify(memo)}}, code: {equalTo: 0}}},
+        orderBy: ID_DESC,
+        first: 1
+      ) {
+        nodes { ${SEND_FIELDS} }
+      }
+    }`, 
+    /* No caching: this question is asked to decide whether to move money, and
+       a ten-second-old "no" is exactly the answer that pays twice. */
+    0);
+    const node = data.messages?.nodes?.[0];
+    return node ? toSend(node, denom) : null;
+}
+/**
+ * Has this treasury already broadcast a send carrying exactly this memo?
+ *
+ * Throws when the index cannot answer. The caller decides what that means:
+ * the webhook treats it as "not proven paid" and falls through to its own
+ * memory, because refusing to deliver a payment somebody made is worse than
+ * the double-pay this guards against — and the memory catches the common
+ * case anyway.
+ */
+export async function sentWithMemo(fromAddress, memo) {
+    return (await sendWithMemo(fromAddress, memo)) !== null;
+}
+/**
+ * The `MsgSend`s a transaction carried, or null when the index has no such
+ * transaction (or it carried no send). For the retry that already knows the
+ * hash it computed before broadcasting (D5): "did that exact transaction
+ * land, and where did it pay" is a lookup, not a scan.
+ */
+export async function sendByHash(hash) {
+    const wanted = hash.replace(/^0x/i, "").toUpperCase();
+    const data = await gql(`query {
+      messages(filter: {transactionHash: {equalTo: ${JSON.stringify(wanted)}}, typeUrl: {equalTo: ${SEND}}}, orderBy: ID_ASC, first: 100) {
+        nodes { ${SEND_FIELDS} }
+      }
+    }`, 0);
+    const nodes = data.messages?.nodes ?? [];
+    const tx = nodes[0]?.transactionByTransactionHash;
+    if (!tx)
+        return null;
+    return {
+        hash: tx.hash ?? wanted,
+        memo: (tx.memo ?? "").trim(),
+        at: tx.time ?? "",
+        code: typeof tx.code === "number" ? tx.code : null,
+        sends: nodes.map((node) => {
+            const value = node.value;
+            const amount = Array.isArray(value?.amount)
+                ? value.amount
+                    .filter((coin) => typeof coin?.denom === "string" && typeof coin?.amount === "string")
+                    .map((coin) => ({ denom: coin.denom, amount: coin.amount }))
+                : [];
+            return { from: typeof value?.fromAddress === "string" ? value.fromAddress : "", to: typeof value?.toAddress === "string" ? value.toAddress : "", amount };
+        })
+    };
+}
+/** Every successful send matching `party`, whose memo starts with `prefix`, paged to the end. */
+async function sendsMatching(party, prefix, maxRows) {
+    const contains = "fromAddress" in party ? `{fromAddress: ${JSON.stringify(party.fromAddress)}}` : `{toAddress: ${JSON.stringify(party.toAddress)}}`;
+    return gqlConnection(`query($first: Int!, $after: Cursor) {
+      messages(
+        filter: {typeUrl: {equalTo: ${SEND}}, value: {contains: ${contains}}, transactionByTransactionHash: {memo: {startsWith: ${JSON.stringify(prefix)}}, code: {equalTo: 0}}},
+        orderBy: ID_DESC,
+        first: $first,
+        after: $after
+      ) {
+        pageInfo { hasNextPage endCursor }
+        nodes { ${SEND_FIELDS} }
+      }
+    }`, "messages", { revalidate: 30, pageSize: 500, maxRows });
+}
+/**
+ * Every send this treasury made whose memo starts with a word — the evidence
+ * behind a backer's credential.
+ *
+ * A backing leaves no claim and no determination: it is a card payment that
+ * became a chain send into a pin's pool. So the transaction *is* the proof,
+ * and a credential that says "this person backed four cleanups" has to be
+ * able to point at four of them. Which is why the memo carries the backer's
+ * address at all.
+ *
+ * Every one, not a window: the memo prefix is filtered by the index and the
+ * answer paged to its end, so an old backing is not dropped for being old. A
+ * history longer than `limit` throws `TruncatedConnection` rather than
+ * quietly counting fewer backings than there were.
+ *
+ * **Ask only for fields a Transaction has** — hash, time, memo. An earlier
+ * draft asked the index for a block timestamp under a name this schema does
+ * not carry, so every call threw; the caller turns a failure into an empty
+ * list, so a backer's record simply read zero and nothing ever said why.
+ *
+ * `amountBase` is what the send carried **in `denom`** — the ask's denom
+ * unless the caller says otherwise — and nothing else it carried. `to` is
+ * where it went, so a reader can check a backing actually reached a pool.
+ */
+export async function sendsWithMemoPrefix(fromAddress, prefix, limit = MAX_SENDS, denom = askDenom()) {
+    const out = [];
+    const seen = new Set();
+    for (const node of await sendsMatching({ fromAddress }, prefix, limit)) {
+        const send = toSend(node, denom);
+        if (!send.memo.startsWith(prefix) || seen.has(send.memo))
+            continue;
+        seen.add(send.memo);
+        out.push({ memo: send.memo, hash: send.hash, at: send.at, to: send.to, amountBase: send.amountBase });
+    }
+    return out;
+}
+/**
+ * Every send *into* an address whose memo starts with a word.
+ *
+ * The mirror of `sendsWithMemoPrefix`, and the round that needed it is the
+ * one where money stopped coming only from us. A card backing is a send the
+ * treasury makes, so asking what the treasury sent finds it. A sponsor's
+ * backing is a send from their own account into the pool, and the treasury
+ * query is blind to it — the pot would grow, the map would be right, and
+ * every screen that names a backer would show nothing.
+ *
+ * So: keyed on the recipient, which for a backing is the pool itself. One
+ * pool's whole funding history, whoever paid it.
+ *
+ * The same paging and the same honesty as its twin: it throws when the index
+ * cannot answer, because a caller that cannot tell "nobody backed this" from
+ * "we could not look" writes the bug this file already carries a scar from.
+ *
+ * **Anybody can send to a pool**, so unlike the treasury's own history this
+ * list is untrusted input: `amountBase` counts only coins in `denom` — the
+ * ask's, unless the caller says otherwise — because a memo on a coin of some
+ * other denom would otherwise read as a contribution of that many base units
+ * of PAY. Nothing is deduplicated: every message the index returns is a
+ * separate send and separate money, including two in one transaction.
+ */
+export async function sendsToWithMemoPrefix(toAddress, prefix, limit = MAX_SENDS, denom = askDenom()) {
+    const out = [];
+    for (const node of await sendsMatching({ toAddress }, prefix, limit)) {
+        const send = toSend(node, denom);
+        if (!send.memo.startsWith(prefix))
+            continue;
+        out.push({ memo: send.memo, hash: send.hash, at: send.at, from: send.from, amountBase: send.amountBase });
+    }
+    return out;
+}
+//# sourceMappingURL=treasurySends.js.map

package/dist/esm/campaign/treasurySends.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"treasurySends.js","sourceRoot":"","sources":["../../../src/campaign/treasurySends.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAgC7C;;;;;;;;;;;;;GAaG;AACH,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAC9C,MAAM,WAAW,GAAG,4DAA4D,CAAC;AAEjF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAYhC,SAAS,MAAM,CAAC,IAAc,EAAE,KAAa;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,4BAA4B,CAAC;IAC7C;sCACkC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAgF,CAAC;IACpG,OAAO;QACL,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE;QACpB,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE;QAClB,IAAI,EAAE,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QACrE,EAAE,EAAE,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC/D,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,IAAY,EAAE,QAAgB,QAAQ,EAAE;IAC9F,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB;;sCAEkC,IAAI,sCAAsC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,sDAAsD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;kBAInK,WAAW;;MAEvB;IACF;sEACkE;IAClE,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,IAAY;IAClE,OAAO,CAAC,MAAM,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;AAC1D,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB;qDACiD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,yBAAyB,IAAI;kBACtF,WAAW;;MAEvB,EACF,CAAC,CACF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC;IAClD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,MAAM;QACvB,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC5B,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE;QACjB,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAClD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAgF,CAAC;YACpG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzC,CAAC,CAAE,KAAK,CAAC,MAAkD;qBACtD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC;qBACrF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAe,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,CAAC,CAAC;gBACpF,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,KAAK,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAC5J,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,aAAa,CAAC,KAAsD,EAAE,MAAc,EAAE,OAAe;IAClH,MAAM,QAAQ,GAAG,aAAa,IAAI,KAAK,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;IACpJ,OAAO,aAAa,CAClB;;sCAEkC,IAAI,wBAAwB,QAAQ,wDAAwD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;;;;;kBAMtI,WAAW;;MAEvB,EACF,UAAU,EACV,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,MAAc,EACd,KAAK,GAAG,SAAS,EACjB,QAAgB,QAAQ,EAAE;IAE1B,MAAM,GAAG,GAAiF,EAAE,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,aAAa,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,MAAc,EACd,KAAK,GAAG,SAAS,EACjB,QAAgB,QAAQ,EAAE;IAE1B,MAAM,GAAG,GAAmF,EAAE,CAAC;IAC/F,KAAK,MAAM,IAAI,IAAI,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/esm/campaign.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `@ixo/openhands-sdk/campaign` — the cleanup campaign: spots, pins, the fold, pools, pledges, funding, standings, badges and the cleanup rubric. `campaign/rule` hashes with `node:crypto`, so only its TYPES ride here; import `@ixo/openhands-sdk/campaign/rule` for the parser.
+ *
+ * Isomorphic by contract: nothing reachable from here imports a `node:`
+ * builtin or a server-only package (`barrels.test.ts` walks the graph and
+ * fails if one appears), so a browser bundle can import this barrel. A module
+ * that needs Node stays reachable only by its own subpath.
+ */
+export * from "./campaign/spots.ts";
+export * from "./campaign/cleanable.ts";
+export * from "./campaign/pool.ts";
+export * from "./campaign/landing.ts";
+export * from "./campaign/fold.ts";
+export * from "./campaign/standings.ts";
+export * from "./campaign/record.ts";
+export * from "./campaign/badges.ts";
+export * from "./campaign/campaign.ts";
+export * from "./campaign/campaigns.ts";
+export * from "./campaign/pledges.ts";
+export * from "./campaign/pledgesChain.ts";
+export * from "./campaign/funding.ts";
+export * from "./campaign/treasurySends.ts";
+export * from "./campaign/bands.ts";
+export * from "./campaign/spot.ts";
+export * from "./campaign/cleanup.ts";
+export * from "./campaign/field.ts";
+export * from "./campaign/commit.ts";
+export type * from "./campaign/rule.ts";
+//# sourceMappingURL=campaign.d.ts.map

package/dist/esm/campaign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign.d.ts","sourceRoot":"","sources":["../../src/campaign.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,mBAAmB,oBAAoB,CAAC"}

package/dist/esm/campaign.js

@@ -0,0 +1,28 @@
+/**
+ * `@ixo/openhands-sdk/campaign` — the cleanup campaign: spots, pins, the fold, pools, pledges, funding, standings, badges and the cleanup rubric. `campaign/rule` hashes with `node:crypto`, so only its TYPES ride here; import `@ixo/openhands-sdk/campaign/rule` for the parser.
+ *
+ * Isomorphic by contract: nothing reachable from here imports a `node:`
+ * builtin or a server-only package (`barrels.test.ts` walks the graph and
+ * fails if one appears), so a browser bundle can import this barrel. A module
+ * that needs Node stays reachable only by its own subpath.
+ */
+export * from "./campaign/spots.js";
+export * from "./campaign/cleanable.js";
+export * from "./campaign/pool.js";
+export * from "./campaign/landing.js";
+export * from "./campaign/fold.js";
+export * from "./campaign/standings.js";
+export * from "./campaign/record.js";
+export * from "./campaign/badges.js";
+export * from "./campaign/campaign.js";
+export * from "./campaign/campaigns.js";
+export * from "./campaign/pledges.js";
+export * from "./campaign/pledgesChain.js";
+export * from "./campaign/funding.js";
+export * from "./campaign/treasurySends.js";
+export * from "./campaign/bands.js";
+export * from "./campaign/spot.js";
+export * from "./campaign/cleanup.js";
+export * from "./campaign/field.js";
+export * from "./campaign/commit.js";
+//# sourceMappingURL=campaign.js.map

package/dist/esm/campaign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign.js","sourceRoot":"","sources":["../../src/campaign.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC"}

package/dist/esm/chain/account.d.ts

@@ -0,0 +1,47 @@
+import { type QiSession } from "./session.ts";
+/**
+ * Poll until the index shows an authenticator the chain already accepted.
+ *
+ * The budget is a parameter because the two callers pay for it differently.
+ * When somebody is watching a spinner, a long wait is the cost of the wait
+ * itself; when the wait happens behind a screen they are reading anyway — the
+ * recovery key — it is free, so it should be generous.
+ */
+export declare function waitForAuthenticator(keyId: string, budgetMs?: number): Promise<{
+    address: string;
+    id: string;
+}>;
+export interface CreatedAccount {
+    address: string;
+    /** The recovery key. Shown once by the caller, then let go. */
+    mnemonic: string;
+    /** What `settleNewAccount` needs to finish the job. */
+    credentialId: string;
+}
+export declare function createAccount(label?: string): Promise<CreatedAccount>;
+/**
+ * Finish the job the index was holding up: find the authenticator the chain
+ * already accepted and save the session.
+ *
+ * Called after the recovery key is on screen, so its wait costs the person
+ * nothing and can afford to be patient. If it never lands they are not
+ * stranded — the passkey is on chain, and signing in finds it.
+ */
+export declare function settleNewAccount(address: string, credentialId: string): Promise<QiSession>;
+export declare function signIn(): Promise<QiSession>;
+/**
+ * Prove control of a passkey account.
+ *
+ * The account holds no key in the browser — the mnemonic was shown once and
+ * stored nowhere — so this is a WebAuthn assertion over the message digest.
+ * The server checks it against the authenticator the chain has on record,
+ * which is the same record the chain itself checks every transaction against.
+ */
+export declare function proveWithPasskey(session: QiSession, message: string): Promise<{
+    kind: "webauthn";
+    credentialId: string;
+    authenticatorData: string;
+    clientDataJSON: string;
+    webauthnSignature: string;
+} | null>;
+//# sourceMappingURL=account.d.ts.map

package/dist/esm/chain/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/chain/account.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAqC3D;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBrH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA+C3E;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAKhG;AAED,wBAAsB,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,CAQjD;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,SAAS,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAmB1I"}

package/dist/esm/chain/account.js

@@ -0,0 +1,156 @@
+import { DirectSecp256k1HdWallet } from "@cosmjs/proto-signing";
+import { ixo } from "@ixo/impactxclient-sdk";
+import { broadcastWithWallet } from "./broadcast.js";
+import { iidDocumentMsg } from "./iid.js";
+import { saveSession } from "./session.js";
+import { createCredential, discoverCredentialId } from "./webauthn.js";
+import { givenConfig } from "../given.js";
+import { hasEnv } from "../envRead.js";
+/**
+ * An account appears around a person, not before them. The address is a plain
+ * secp account whose mnemonic doubles as the recovery key (shown once, stored
+ * nowhere); the passkey is added as a smart-account authenticator on top, so
+ * A passkey signs everything from then on and the mnemonic can restore access
+ * if every synced passkey is lost.
+ */
+/**
+ * Ask the index which account a passkey belongs to.
+ *
+ * Throws when the index cannot be reached and answers `null` only when it
+ * genuinely has no such authenticator. The distinction matters: this used to
+ * swallow transport failures into the same `null`, so an unreachable index and
+ * a chain the index has not caught up with produced identical advice, and only
+ * one of them is fixed by waiting.
+ */
+async function authenticatorByKeyId(keyId) {
+    const response = await fetch(givenConfig().graphqlUrl ?? (hasEnv() ? process.env.NEXT_PUBLIC_GRAPHQL_URL : undefined) ?? "", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            query: `query { smartAccountAuthenticators(filter: {keyId: {equalTo: ${JSON.stringify(keyId)}}}) { nodes { address id } } }`
+        }),
+        signal: AbortSignal.timeout(15_000)
+    });
+    if (!response.ok)
+        throw new Error(`The index answered ${response.status}`);
+    const json = (await response.json());
+    return json.data?.smartAccountAuthenticators?.nodes?.[0] ?? null;
+}
+/**
+ * Poll until the index shows an authenticator the chain already accepted.
+ *
+ * The budget is a parameter because the two callers pay for it differently.
+ * When somebody is watching a spinner, a long wait is the cost of the wait
+ * itself; when the wait happens behind a screen they are reading anyway — the
+ * recovery key — it is free, so it should be generous.
+ */
+export async function waitForAuthenticator(keyId, budgetMs = 30_000) {
+    const deadline = Date.now() + budgetMs;
+    let reached = false;
+    while (Date.now() < deadline) {
+        try {
+            const found = await authenticatorByKeyId(keyId);
+            reached = true;
+            if (found)
+                return found;
+        }
+        catch {
+            /* Unreachable rather than not-yet-indexed. Keep trying — a blip should
+               not end this — but remember, so the message can say which it was. */
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1500));
+    }
+    throw new Error(reached
+        ? "The account is on chain but the index hasn't caught up. Sign in with your passkey in a moment"
+        : "The account is on chain, but the network index can't be reached right now. Sign in with your passkey once it is back");
+}
+export async function createAccount(label) {
+    const wallet = await DirectSecp256k1HdWallet.generate(12, { prefix: "ixo" });
+    const [account] = await wallet.getAccounts();
+    if (!account)
+        throw new Error("Key generation failed");
+    const address = account.address;
+    const credential = await createCredential(address, label);
+    const authnPubKey = ixo.smartaccount.crypto.AuthnPubKey.encode(ixo.smartaccount.crypto.AuthnPubKey.fromPartial({
+        keyId: credential.credentialId,
+        key: credential.publicKey,
+        coseAlgorithm: credential.coseAlgorithm
+    })).finish();
+    await broadcastWithWallet(wallet, address, [
+        iidDocumentMsg(address, account.pubkey),
+        {
+            typeUrl: "/ixo.smartaccount.v1beta1.MsgAddAuthenticator",
+            value: ixo.smartaccount.v1beta1.MsgAddAuthenticator.fromPartial({
+                sender: address,
+                authenticatorType: "AuthnVerification",
+                data: authnPubKey
+            })
+        }
+    ], "Create Openhands account");
+    /*
+     * Returns the moment the chain has it — the index read-back is deliberately
+     * NOT part of this function.
+     *
+     * It used to be, and that cost somebody their recovery key: the wait timed
+     * out after eighteen seconds, the error propagated, and the return statement
+     * carrying `wallet.mnemonic` never ran. The account was on chain and usable
+     * by passkey, but the words that restore it if every synced passkey is lost
+     * were generated, written into the account, and dropped — unrecoverably, and
+     * without anyone being told. An index lagging behind a block must never cost
+     * a person their backup. The session can be rebuilt by signing in; a
+     * mnemonic cannot be rebuilt by anything.
+     */
+    return { address, mnemonic: wallet.mnemonic, credentialId: credential.credentialId };
+}
+/**
+ * Finish the job the index was holding up: find the authenticator the chain
+ * already accepted and save the session.
+ *
+ * Called after the recovery key is on screen, so its wait costs the person
+ * nothing and can afford to be patient. If it never lands they are not
+ * stranded — the passkey is on chain, and signing in finds it.
+ */
+export async function settleNewAccount(address, credentialId) {
+    const authenticator = await waitForAuthenticator(credentialId, 90_000);
+    const session = { address, credentialId, authenticatorId: authenticator.id };
+    saveSession(session);
+    return session;
+}
+export async function signIn() {
+    const credentialId = await discoverCredentialId();
+    const authenticator = await authenticatorByKeyId(credentialId);
+    if (!authenticator)
+        throw new Error("This passkey doesn't belong to an Openhands account on this network");
+    const session = { address: authenticator.address, credentialId, authenticatorId: authenticator.id };
+    saveSession(session);
+    return session;
+}
+/**
+ * Prove control of a passkey account.
+ *
+ * The account holds no key in the browser — the mnemonic was shown once and
+ * stored nowhere — so this is a WebAuthn assertion over the message digest.
+ * The server checks it against the authenticator the chain has on record,
+ * which is the same record the chain itself checks every transaction against.
+ */
+export async function proveWithPasskey(session, message) {
+    const { sha256 } = await import("@cosmjs/crypto");
+    const { assertWithCredential } = await import("./webauthn.js");
+    if (!session.credentialId)
+        return null;
+    const digest = sha256(new TextEncoder().encode(message));
+    const idBytes = Uint8Array.from(atob(session.credentialId.replace(/-/g, "+").replace(/_/g, "/")), (character) => character.charCodeAt(0));
+    const assertion = await assertWithCredential(session.credentialId, digest, idBytes).catch(() => null);
+    if (!assertion)
+        return null;
+    /* assertWithCredential already hands these back base64-encoded — the chain
+       path needs them that way too, so there is nothing to convert. */
+    return {
+        kind: "webauthn",
+        credentialId: session.credentialId,
+        authenticatorData: assertion.authenticatorData,
+        clientDataJSON: assertion.clientDataJSON,
+        webauthnSignature: assertion.signature
+    };
+}
+//# sourceMappingURL=account.js.map

package/dist/esm/chain/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/chain/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAkB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC;;;;;;GAMG;AAGH;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAAa;IAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QAC3H,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,gEAAgE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gCAAgC;SAC7H,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8F,CAAC;IAClI,OAAO,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa,EAAE,QAAQ,GAAG,MAAM;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP;mFACuE;QACzE,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,KAAK,CACb,OAAO;QACL,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC,sHAAsH,CAC3H,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAC5D,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;QAC9C,KAAK,EAAE,UAAU,CAAC,YAAY;QAC9B,GAAG,EAAE,UAAU,CAAC,SAAS;QACzB,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CACH,CAAC,MAAM,EAAE,CAAC;IAEX,MAAM,mBAAmB,CACvB,MAAM,EACN,OAAO,EACP;QACE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;QACvC;YACE,OAAO,EAAE,+CAA+C;YACxD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC;gBAC9D,MAAM,EAAE,OAAO;gBACf,iBAAiB,EAAE,mBAAmB;gBACtC,IAAI,EAAE,WAAW;aAClB,CAAC;SACH;KACF,EACD,0BAA0B,CAC3B,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,YAAoB;IAC1E,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,OAAO,GAAc,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;IACxF,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAE3G,MAAM,OAAO,GAAc,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;IAC/G,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAkB,EAClB,OAAe;IAEf,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B;uEACmE;IACnE,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,iBAAiB,EAAE,SAAS,CAAC,SAAS;KACvC,CAAC;AACJ,CAAC"}

package/dist/esm/chain/accountProof.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Proving that a key may act for an account — the gate's question.
+ *
+ * A submission grant is issued to an address, and the youth app's gate must
+ * only issue one to somebody who can sign for that address. The obvious
+ * check — sign a fresh message, derive the address from the public key,
+ * compare — is wrong for the one kind of account this app has: an auth-hub
+ * account is a **smart account**, and the key a browser holds for it is a
+ * *session key* the hub registered on chain as a `SignatureVerification`
+ * authenticator. That key's own address is not the account's, and never
+ * will be. Deriving an address from it proves only that some key exists.
+ *
+ * So the check is the chain's own: the signature must verify against the
+ * public key it names, and that public key must be a live authenticator of
+ * the account the grant is for. A plain key whose derived address *is* the
+ * account still passes, because that is the older, simpler case of the same
+ * fact. Pure, so a test can hand it any authenticator list it likes; the
+ * index read lives in `@ixo/openhands-sdk/data/authenticators`.
+ */
+export interface SubmitProof {
+    kind: string;
+    /** Compressed secp256k1 public key, base64. */
+    pubkey: string;
+    /** 64 bytes r‖s, base64. */
+    signature: string;
+    /** The exact words that were signed — see `submitProofMessage`. */
+    message: string;
+}
+/**
+ * A signature is a moment, not a standing permission — but the window is a
+ * day, not five minutes (2026-09-20). Five refused two people whose phones
+ * ran hours wrong, and what a replay inside the window buys is one more
+ * submission grant for an address the replayer cannot sign for, idempotent
+ * and rate-limited. The app now signs with the server's clock anyway
+ * (the youth app's lib/clock.ts); the day is for the phone that never learned it.
+ */
+export declare const PROOF_MAX_AGE_MS: number;
+/** The words a submitter signs: one ask, one address, one moment. */
+export declare const submitProofMessage: (collectionId: string, address: string, now?: number) => string;
+/**
+ * Whether the signed words are the ones this grant is about, and fresh.
+ *
+ * Checked before any cryptography, because a message that names another
+ * ask or another address is refused whoever signed it, and a stale one is
+ * worth nothing even from the right key.
+ */
+export declare function readSubmitProof(message: string, expected: {
+    collectionId: string;
+    address: string;
+}, now?: number, maxAgeMs?: number): "ok" | "mismatch" | "stale";
+/** `0x`-prefixed lowercase hex, the shape the index stores an authenticator's key in. */
+export declare const pubkeyHex: (pubkey: Uint8Array) => string;
+/** The address a plain secp key would sign for. */
+export declare function addressOfPubkey(pubkey: Uint8Array, prefix?: string): string;
+/**
+ * Does this proof let its key act for `address`?
+ *
+ * `authenticatorsOf` answers with the hex public keys of the account's live
+ * `SignatureVerification` authenticators — the index read, injected so the
+ * decision itself needs no network. It is only consulted when the key is
+ * not simply the account's own; a lookup that throws is a refusal, because
+ * "could not check" must never read as "checked".
+ */
+export declare function proofSignsFor(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<boolean>;
+/**
+ * Why this proof does not let its key act for `address` — or null if it does.
+ *
+ * The same walk as `proofSignsFor`, which is now a wrapper on it, but it
+ * says which step failed. The gate answered a single `needs-account` for
+ * four unrelated reasons and logged none of them, so a person with a
+ * perfectly good session who was refused — and one who was refused
+ * thirty-eight seconds before the same session succeeded, on 2026-09-17 at
+ * 09:37 — could be told only "sign in", which they had done.
+ *
+ * `not-authenticator` on an **empty** list is not the same fact as on a
+ * list that has keys in it: an account that has ever signed in holds at
+ * least one authenticator, so an empty answer is far more likely to be the
+ * index than a revoked key. The caller decides what to do about that; this
+ * only reports what it saw, in `live`.
+ */
+export type ProofFault = "bad-shape" | "bad-signature" | "not-authenticator" | "unverifiable";
+export declare function whyNotSigning(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<ProofFault | null>;
+/** The full reading, for a caller that wants to see the authenticator list too. */
+export declare function judgeSigning(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<{
+    fault: ProofFault | null;
+    live: string[] | null;
+}>;
+/**
+ * Sign words with a mnemonic's key — the browser half of `proofSignsFor`.
+ *
+ * The one place a secp key signs a sentence for a server here: the guest
+ * lane's proof, the account's proof, and a credential request all go
+ * through it, so the bytes a verifier expects are produced by exactly one
+ * routine. Standard Cosmos derivation path; the signature is r‖s, base64;
+ * the public key compressed, base64. No `Buffer` — this runs in a phone.
+ */
+export declare function signWords(mnemonic: string, message: string): Promise<{
+    pubkey: string;
+    signature: string;
+}>;
+/**
+ * A signed sentence from an auth-hub account: who, with which key, over
+ * what. The authenticator id rides along for a reader that wants to name
+ * it; verification goes by the public key, which is what the index records.
+ */
+export interface AccountProof {
+    kind: "account";
+    address: string;
+    pubkey: string;
+    signature: string;
+    message: string;
+    authenticatorId?: string;
+}
+/**
+ * Prove an account's session holds a key that may act for it, over these
+ * exact words. Null when the session cannot sign — a name and nothing else.
+ */
+export declare function proveAsAccount(session: {
+    address?: string;
+    sessionKey?: {
+        mnemonic?: string;
+        authenticatorId?: string;
+    };
+} | null, message: string): Promise<AccountProof | null>;
+export type ProofJudgement = "ok" | "refused" | "unverifiable";
+/**
+ * `proofSignsFor` with its third answer told apart.
+ *
+ * A server has two refusals to give, and they must not be the same word:
+ * a key that is not the account's is "no", and an index that could not be
+ * asked is "not now". A person with a perfectly good session should be told
+ * to try again, never to sign in.
+ */
+export declare function judgeAccountProof(proof: SubmitProof, address: string, authenticatorsOf: (address: string) => Promise<string[]>): Promise<ProofJudgement>;
+//# sourceMappingURL=accountProof.d.ts.map

package/dist/esm/chain/accountProof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountProof.d.ts","sourceRoot":"","sources":["../../../src/chain/accountProof.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,GAAI,cAAc,MAAM,EAAE,SAAS,MAAM,EAAE,YAAgB,KAAG,MAAoD,CAAC;AAElJ;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACnD,GAAG,SAAa,EAChB,QAAQ,SAAmB,GAC1B,IAAI,GAAG,UAAU,GAAG,OAAO,CAQ7B;AAWD,yFAAyF;AACzF,eAAO,MAAM,SAAS,GAAI,QAAQ,UAAU,KAAG,MAAkE,CAAC;AAElH,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,SAAQ,GAAG,MAAM,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnJ;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,eAAe,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE9F,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GACvD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE5B;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAChC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GACvD,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAAE,CAAC,CAiC9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWjH;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,EAClG,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAI9B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAY9J"}