@ixo/openhands-sdk 0.0.0-stage → 0.2.0

package/dist/esm/chain/bridge.js

@@ -0,0 +1,78 @@
+import { cosmos, ixo, utils } from "@ixo/impactxclient-sdk";
+import { signWithSession } from "./signWith.js";
+/**
+ * Bringing bought PAY onto the key that spends it.
+ *
+ * Topping up through ixo's Stripe checkout does not put PAY in your wallet. It
+ * puts it on the **admin account of a `deed/subscription` entity you own** —
+ * verified 2026-08-23 against a real top-up, which landed 41 PAY on an entity
+ * account rather than the address the buyer expected. That is not a quirk to
+ * work around: an entity account is money the entity module holds for you, and
+ * it moves only when the entity's owner authorises it. Which is the good
+ * property — nobody, including us, can take it.
+ *
+ * So the bridge is two messages the owner signs:
+ *
+ *   MsgGrantEntityAccountAuthz  — a capped `SendAuthorization` on "admin"
+ *   MsgExec( MsgSend )          — pull that much to a key you name
+ *
+ * On this chain the owner may be their own grantee, so one signature does
+ * both, and the grant expires in an hour whatever happens. Proven end to end on
+ * testnet by `scripts/bridge-pay.ts --self-test` before any of this existed.
+ */
+const SEND_AUTHORIZATION = "/cosmos.bank.v1beta1.SendAuthorization";
+const GRANT_MINUTES = 60;
+/**
+ * The two messages, built but unsigned, so a caller can show what will happen
+ * before anything is asked of a passkey.
+ *
+ * `amount` is base units and is also the grant's ceiling: the authorization
+ * cannot move more than this run intends to, so a grant left behind by a failed
+ * broadcast is bounded by the thing the person already agreed to.
+ */
+export function bridgeMsgs(args) {
+    const expiration = utils.proto.toTimestamp(new Date(Date.now() + GRANT_MINUTES * 60 * 1000));
+    return [
+        {
+            typeUrl: "/ixo.entity.v1beta1.MsgGrantEntityAccountAuthz",
+            value: ixo.entity.v1beta1.MsgGrantEntityAccountAuthz.fromPartial({
+                id: args.entityDid,
+                ownerAddress: args.owner,
+                name: "admin",
+                granteeAddress: args.owner,
+                grant: cosmos.authz.v1beta1.Grant.fromPartial({
+                    authorization: {
+                        typeUrl: SEND_AUTHORIZATION,
+                        value: cosmos.bank.v1beta1.SendAuthorization.encode(cosmos.bank.v1beta1.SendAuthorization.fromPartial({ spendLimit: [{ denom: args.denom, amount: args.amount }] })).finish()
+                    },
+                    expiration
+                })
+            })
+        },
+        {
+            typeUrl: "/cosmos.authz.v1beta1.MsgExec",
+            value: cosmos.authz.v1beta1.MsgExec.fromPartial({
+                grantee: args.owner,
+                msgs: [
+                    {
+                        typeUrl: "/cosmos.bank.v1beta1.MsgSend",
+                        value: cosmos.bank.v1beta1.MsgSend.encode(cosmos.bank.v1beta1.MsgSend.fromPartial({ fromAddress: args.adminAccount, toAddress: args.destination, amount: [{ denom: args.denom, amount: args.amount }] })).finish()
+                    }
+                ]
+            })
+        }
+    ];
+}
+/**
+ * Bring it across. One signature, through the one door — a passkey, a phone, or
+ * an auth-hub session key, whichever this account signs with.
+ *
+ * Both messages ride in a single transaction on purpose: a grant that lands
+ * without its exec would leave a live SendAuthorization on the deed, and the
+ * person would have authorised something that never happened.
+ */
+export async function bridgeToKey(session, deed, args, prompt) {
+    const messages = bridgeMsgs({ owner: session.address, entityDid: deed.entityDid, adminAccount: deed.adminAccount, ...args });
+    return signWithSession(session, messages, "Bring PAY into your account", prompt);
+}
+//# sourceMappingURL=bridge.js.map

package/dist/esm/chain/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/chain/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAoB,MAAM,eAAe,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,aAAa,GAAG,EAAE,CAAC;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAoH;IAC7I,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAE7F,OAAO;QACL;YACE,OAAO,EAAE,gDAAgD;YACzD,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC;gBAC/D,EAAE,EAAE,IAAI,CAAC,SAAS;gBAClB,YAAY,EAAE,IAAI,CAAC,KAAK;gBACxB,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,IAAI,CAAC,KAAK;gBAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC5C,aAAa,EAAE;wBACb,OAAO,EAAE,kBAAkB;wBAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CACjD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAChH,CAAC,MAAM,EAAE;qBACX;oBACD,UAAU;iBACX,CAAC;aACH,CAAC;SACH;QACD;YACE,OAAO,EAAE,+BAA+B;YACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC9C,OAAO,EAAE,IAAI,CAAC,KAAK;gBACnB,IAAI,EAAE;oBACJ;wBACE,OAAO,EAAE,8BAA8B;wBACvC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CACvC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAC/J,CAAC,MAAM,EAAE;qBACX;iBACF;aACF,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAkB,EAClB,IAAiD,EACjD,IAA4D,EAC5D,MAAoB;IAEpB,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7H,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC"}

package/dist/esm/chain/broadcast.d.ts

@@ -0,0 +1,40 @@
+import type { EncodeObject, OfflineDirectSigner } from "@cosmjs/proto-signing";
+import type { QiSession } from "./session.ts";
+import { type SignHooks } from "./signWith.ts";
+/** Broadcast signed by a plain secp wallet (account creation, guest submits). */
+export declare function broadcastWithWallet(signer: OfflineDirectSigner, address: string, messages: EncodeObject[], memo: string, hooks?: SignHooks): Promise<import("@cosmjs/stargate").DeliverTxResponse>;
+/**
+ * A tx body, hex-encoded, ready for a phone to decode and render.
+ *
+ * SignX signs a body rather than a set of messages: the phone shows the person
+ * what they are approving from these exact bytes. Encoding here rather than in
+ * the caller means the registry that knows ixo's message types — the same one
+ * a passkey broadcast uses — is the one that produced them.
+ */
+export declare function encodeTxBody(messages: EncodeObject[], memo: string): Promise<string>;
+/**
+ * Broadcast signed by the session's passkey. The TxExtension names which
+ * on-chain authenticator verifies the assertion.
+ */
+export declare function broadcastWithPasskey(session: QiSession, messages: EncodeObject[], memo?: string, hooks?: SignHooks): Promise<import("@cosmjs/stargate").DeliverTxResponse>;
+/**
+ * The key an auth-hub session, or a slot seeded from one, signs with: a
+ * mnemonic the hub registered on the account as an authenticator, and the
+ * id of that authenticator. Never the account's own key.
+ */
+export interface AccountKey {
+    address: string;
+    mnemonic: string;
+    authenticatorId: string;
+}
+/**
+ * Broadcast as an auth-hub account, signed by its session key.
+ *
+ * This is the path the AC round assumed a plain wallet could take and could
+ * not: a session key's own address is not the account's, so cosmjs refused
+ * the signer before anything reached the chain. Wrapped in `SessionKeySigner`
+ * and named in the extension, the same key signs for the account exactly as
+ * the portal and Jambo sign.
+ */
+export declare function broadcastAsAccount(key: AccountKey, messages: EncodeObject[], memo?: string, hooks?: SignHooks): Promise<import("@cosmjs/stargate").DeliverTxResponse>;
+//# sourceMappingURL=broadcast.d.ts.map

package/dist/esm/chain/broadcast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broadcast.d.ts","sourceRoot":"","sources":["../../../src/chain/broadcast.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAM/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAgE7D,iFAAiF;AACjF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,yDAUhJ;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1F;AAkCD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,SAAgC,EAAE,KAAK,CAAC,EAAE,SAAS,yDAM/I;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,SAAgC,EAAE,KAAK,CAAC,EAAE,SAAS,yDAK1I"}

package/dist/esm/chain/broadcast.js

@@ -0,0 +1,147 @@
+import { sha256 } from "@cosmjs/crypto";
+import { toHex } from "@cosmjs/encoding";
+import { calculateFee, GasPrice } from "@cosmjs/stargate";
+import { cosmos, createSigningClient, ixo } from "@ixo/impactxclient-sdk";
+import Long from "long";
+import { rpcUrl } from "./env.js";
+import { getFeegrantGranter, ensureGas } from "./query.js";
+import { PasskeySigner, SessionKeySigner } from "./signer.js";
+import { ChainRefusal } from "./signWith.js";
+const GAS_PRICE = GasPrice.fromString("0.025uixo");
+/**
+ * How far above the simulation to set the gas limit.
+ *
+ * cosmjs's `"auto"` uses 1.4, and the worker agent has used **1.8** since it
+ * started hitting `out of gas` on transactions its own simulation had just
+ * approved (`services/worker-agent/src/chain.ts`). The two paths disagreeing
+ * meant the browser — the one a stranger uses, with no retry and no operator
+ * watching — carried the thinner margin. A local run reproduced it: 92,736
+ * wanted against 93,326 used, on a plain `MsgSend`.
+ *
+ * The cost of the wider margin is a fraction of a cent per transaction, since
+ * a Cosmos fee is `gasWanted × gasPrice` whether or not it is used. The cost
+ * of the narrower one is somebody's submission failing after they did the
+ * work.
+ */
+const GAS_MULTIPLIER = 1.8;
+/** The simulated cost of these messages, widened by the multiplier above. */
+async function gasFee(signing, address, messages, memo) {
+    const simulated = await signing.simulate(address, messages, memo);
+    return calculateFee(Math.round(simulated * GAS_MULTIPLIER), GAS_PRICE);
+}
+async function client(signer) {
+    return createSigningClient(rpcUrl(), signer, false, { gasPrice: GAS_PRICE });
+}
+/**
+ * `signAndBroadcast`, split at the one moment a caller moving money needs:
+ * signed, hash known, nothing sent yet (final review 2026-10, WN9e #3).
+ *
+ * The SDK's `signAndBroadcast` is exactly `sign` → `TxRaw.encode` →
+ * `broadcastTx` with the client's own timeouts; this does the same three
+ * steps with `onSigned` between the last two. A Cosmos transaction's hash is
+ * the SHA-256 of its raw bytes, upper-case hex — the same id cosmjs's
+ * `TimeoutError` carries. Without the hook it is the SDK's call unchanged.
+ * A non-zero result is a `ChainRefusal`: it landed and failed, so it is final.
+ */
+async function signThenBroadcast(signing, address, messages, fee, memo, txBodyBytes, hooks) {
+    let result;
+    if (!hooks?.onSigned) {
+        result = await signing.signAndBroadcast(address, messages, fee, memo, undefined, txBodyBytes);
+    }
+    else {
+        const txRaw = await signing.sign(address, messages, fee, memo, undefined, txBodyBytes);
+        const bytes = cosmos.tx.v1beta1.TxRaw.encode(txRaw).finish();
+        await hooks.onSigned(toHex(sha256(bytes)).toUpperCase());
+        result = await signing.broadcastTx(bytes, signing.broadcastTimeoutMs, signing.broadcastPollIntervalMs);
+    }
+    if (result.code !== 0)
+        throw new ChainRefusal(result.code, result.rawLog || `Transaction failed (code ${result.code})`);
+    return result;
+}
+/** Broadcast signed by a plain secp wallet (account creation, guest submits). */
+export async function broadcastWithWallet(signer, address, messages, memo, hooks) {
+    const signing = await client(signer);
+    /* Only a sponsor that can pay for *these* messages — see `pickGranter`. */
+    const granter = await getFeegrantGranter(address, messages.map((one) => one.typeUrl));
+    if (!granter)
+        await ensureGas(address);
+    let fee = await gasFee(signing, address, messages, memo);
+    if (granter)
+        fee = { ...fee, granter };
+    return signThenBroadcast(signing, address, messages, fee, memo, undefined, hooks);
+}
+/**
+ * A tx body, hex-encoded, ready for a phone to decode and render.
+ *
+ * SignX signs a body rather than a set of messages: the phone shows the person
+ * what they are approving from these exact bytes. Encoding here rather than in
+ * the caller means the registry that knows ixo's message types — the same one
+ * a passkey broadcast uses — is the one that produced them.
+ */
+export async function encodeTxBody(messages, memo) {
+    /* A registry, not a client: encoding a body needs the ixo message types and
+       nothing else — no signer, no RPC, no network. Building a signing client
+       just to reach `.registry` would have meant handing it a signer it would
+       never use. */
+    const { createRegistry } = await import("@ixo/impactxclient-sdk");
+    const bytes = createRegistry().encodeTxBody({ messages, memo });
+    return Buffer.from(bytes).toString("hex");
+}
+/**
+ * Broadcast as a smart account, through one of its authenticators.
+ *
+ * The `TxExtension` names which on-chain authenticator verifies the
+ * signature, and the fee is simulated up front because the chain can't
+ * simulate around the extension. Shared by the passkey path and the auth-hub
+ * session-key path, which differ only in what does the signing.
+ */
+async function broadcastWithAuthenticator(signer, address, authenticatorId, messages, memo, hooks) {
+    const granter = await getFeegrantGranter(address, messages.map((one) => one.typeUrl));
+    if (!granter)
+        await ensureGas(address);
+    const signing = await client(signer);
+    const selected = Long.fromString(authenticatorId);
+    const txBodyBytes = signing.registry.encodeTxBody({
+        messages,
+        memo,
+        nonCriticalExtensionOptions: [
+            {
+                typeUrl: "/ixo.smartaccount.v1beta1.TxExtension",
+                value: ixo.smartaccount.v1beta1.TxExtension.encode({ selectedAuthenticators: messages.map(() => selected) }).finish()
+            }
+        ]
+    });
+    let fee = await gasFee(signing, address, messages, memo);
+    if (granter)
+        fee = { ...fee, granter };
+    return signThenBroadcast(signing, address, [], fee, memo, txBodyBytes, hooks);
+}
+/**
+ * Broadcast signed by the session's passkey. The TxExtension names which
+ * on-chain authenticator verifies the assertion.
+ */
+export async function broadcastWithPasskey(session, messages, memo = "Signed on Openhands Network", hooks) {
+    /* Narrowed rather than assumed: since the identity ladder a session may sign
+       through SignX or the auth hub instead, and those never reach this path.
+       `signWithSession` is the dispatcher that picks. */
+    if (!session.credentialId || !session.authenticatorId)
+        throw new Error("this session does not sign with a passkey");
+    return broadcastWithAuthenticator(new PasskeySigner(session.address, session.credentialId), session.address, session.authenticatorId, messages, memo, hooks);
+}
+/**
+ * Broadcast as an auth-hub account, signed by its session key.
+ *
+ * This is the path the AC round assumed a plain wallet could take and could
+ * not: a session key's own address is not the account's, so cosmjs refused
+ * the signer before anything reached the chain. Wrapped in `SessionKeySigner`
+ * and named in the extension, the same key signs for the account exactly as
+ * the portal and Jambo sign.
+ */
+export async function broadcastAsAccount(key, messages, memo = "Signed on Openhands Network", hooks) {
+    if (!key.address || !key.mnemonic || !key.authenticatorId)
+        throw new Error("an account key needs an address, a session mnemonic and an authenticator id");
+    const { DirectSecp256k1HdWallet } = await import("@cosmjs/proto-signing");
+    const wallet = await DirectSecp256k1HdWallet.fromMnemonic(key.mnemonic, { prefix: "ixo" });
+    return broadcastWithAuthenticator(new SessionKeySigner(wallet, key.address), key.address, key.authenticatorId, messages, memo, hooks);
+}
+//# sourceMappingURL=broadcast.js.map

package/dist/esm/chain/broadcast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broadcast.js","sourceRoot":"","sources":["../../../src/chain/broadcast.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAe,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAE7D,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,6EAA6E;AAC7E,KAAK,UAAU,MAAM,CAAC,OAA2C,EAAE,OAAe,EAAE,QAAwB,EAAE,IAAY;IACxH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClE,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAA2B;IAC/C,OAAO,mBAAmB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAA2C,EAC3C,OAAe,EACf,QAAwB,EACxB,GAAW,EACX,IAAY,EACZ,WAAmC,EACnC,KAA4B;IAE5B,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAA6D,CAAC,CAAC,MAAM,EAAE,CAAC;QACrH,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,4BAA4B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACxH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA2B,EAAE,OAAe,EAAE,QAAwB,EAAE,IAAY,EAAE,KAAiB;IAC/I,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,2EAA2E;IAC3E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAEvC,IAAI,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO;QAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;IAEvC,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAwB,EAAE,IAAY;IACvE;;;oBAGgB;IAChB,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,0BAA0B,CAAC,MAA2B,EAAE,OAAe,EAAE,eAAuB,EAAE,QAAwB,EAAE,IAAY,EAAE,KAAiB;IACxK,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAChD,QAAQ;QACR,IAAI;QACJ,2BAA2B,EAAE;YAC3B;gBACE,OAAO,EAAE,uCAAuC;gBAChD,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;aACtH;SACF;KACqD,CAAC,CAAC;IAE1D,IAAI,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO;QAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC;IAEvC,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAkB,EAAE,QAAwB,EAAE,IAAI,GAAG,6BAA6B,EAAE,KAAiB;IAC9I;;yDAEqD;IACrD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpH,OAAO,0BAA0B,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/J,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,QAAwB,EAAE,IAAI,GAAG,6BAA6B,EAAE,KAAiB;IACzI,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC1J,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,OAAO,0BAA0B,CAAC,IAAI,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACxI,CAAC"}

package/dist/esm/chain/delegate.d.ts

@@ -0,0 +1,154 @@
+import type { EncodeObject } from "@cosmjs/proto-signing";
+import type { QiSession } from "./session.ts";
+import { type PhonePrompt } from "./signWith.ts";
+/**
+ * An agent acting for a person's account — the connection, as the chain
+ * holds it (docs/verified-work-mcp-connect-plan.md).
+ *
+ * The agent keeps a key of its own, but the key holds nothing: no money and
+ * no identity worth anything. What it holds is this person's **grants** —
+ * cosmos `authz` authorizations that let it sign four kinds of message *as
+ * the person*, and a spend cap the chain itself enforces. Every ask it posts
+ * is the person's ask: their entity, their escrow, their name on the card.
+ * Every answer it files is the person's answer, paid to their account. The
+ * grants expire by themselves and one tap revokes them.
+ *
+ * Proved on testnet 2026-10-08 (the probe in the plan): the batch below as
+ * one transaction; an ask posted through `MsgExec` with every inner signer
+ * the person; a claim filed by the agent's own gate grant naming the person
+ * as its agent, accepted by the chain and shown as theirs on the index.
+ *
+ * **What the four typed grants mean, and why no fifth.** Three are the
+ * messages a post signs (entity, collection, the ask's door grants); the
+ * escrow transfer rides on the capped `SendAuthorization`. The fourth,
+ * `MsgSubmitClaim`, can never be exercised on chain — that message's signer
+ * is the ask's admin, never the person — so it is purely the person's
+ * declaration *"this key may work as me"*, which the submission gate checks
+ * before it grants the key an ask. A blanket `MsgExec` grant would let the
+ * agent use anything the person holds, a checker's evaluate grants included;
+ * it is deliberately not here.
+ */
+/** The messages a connected agent may sign as the person. Order is the display order. */
+export declare const DELEGATED_MSGS: readonly ["/ixo.entity.v1beta1.MsgCreateEntity", "/ixo.claims.v1beta1.MsgCreateCollection", "/ixo.entity.v1beta1.MsgGrantEntityAccountAuthz", "/ixo.claims.v1beta1.MsgSubmitClaim"];
+/** The one grant the gate reads as "may work as me". */
+export declare const WORKS_AS_ME = "/ixo.claims.v1beta1.MsgSubmitClaim";
+export declare const DEFAULT_DAYS = 30;
+/** Gas the person lends the agent, when they hold the gas coin: enough for a few hundred transactions. */
+export declare const GAS_LOAN_UIXO = "300000";
+export interface ConnectTerms {
+    /** The spend cap, in base units of `denom`. */
+    capBase: string;
+    denom?: string;
+    days?: number;
+    /** Lend this much `uixo` for gas; omit when the person holds none (a PAY-only account). */
+    gasUixo?: string | null;
+    now?: number;
+}
+/**
+ * The connect batch: one transaction the person signs once.
+ *
+ * Four typed grants, the spend cap, and — when they hold the gas coin — a
+ * gas allowance, all expiring together. Rebuilt from the same expiry so the
+ * connection ends at one moment, not in pieces.
+ */
+export declare function connectMsgs(principal: string, agent: string, terms: ConnectTerms): EncodeObject[];
+/**
+ * The disconnect batch: every grant the connection made, revoked. `gas` says
+ * whether a gas allowance was lent — revoking one that was never granted
+ * fails the whole transaction, so the caller says what it read.
+ */
+export declare function disconnectMsgs(principal: string, agent: string, gas: boolean): EncodeObject[];
+/** One authz grant as the REST gateway prints it. */
+export interface GrantRow {
+    granter?: string;
+    grantee?: string;
+    expiration?: string | null;
+    authorization?: {
+        "@type"?: string;
+        msg?: string;
+        spend_limit?: {
+            denom: string;
+            amount: string;
+        }[];
+    } | null;
+}
+export interface Delegation {
+    principal: string;
+    agent: string;
+    /** The soonest expiry among the typed grants. */
+    expiresAt: string | null;
+    /** What is left of the spend cap, as the chain decrements it; null when the cap is gone. */
+    cap: {
+        denom: string;
+        remainingBase: string;
+    } | null;
+}
+/**
+ * The connections among some grant rows, pure: a pair is connected when the
+ * grantee holds every typed grant from the granter, none expired. A
+ * connection missing one grant is not a lesser connection — it is none, so a
+ * person who revoked by hand is not half-trusted.
+ */
+export declare function delegationsAmong(rows: GrantRow[], now?: number): Delegation[];
+/** Whether `rows` (grants from `principal` to `agent`) say the agent may work as the person. */
+export declare const worksAs: (rows: GrantRow[], principal: string, agent: string, now?: number) => boolean;
+/**
+ * More than one account holds a full connection to this agent.
+ *
+ * Granting is permissionless: anybody can sign the connect batch naming a
+ * public agent address, and the chain will hold it. So "the first connection
+ * found" was whoever the node happened to list first — a stranger could make
+ * themselves an agent's principal by granting to it (scale review D8).
+ * Nothing on chain says which of them the agent's owner meant, so the honest
+ * answer is no principal at all, and this error says why.
+ */
+export declare class AmbiguousDelegation extends Error {
+    readonly agent: string;
+    readonly principals: string[];
+    constructor(agent: string, principals: string[]);
+}
+/**
+ * Whom this agent acts for, with the reason when the answer is nobody.
+ *
+ * `delegation` is set only when exactly one account holds a full connection;
+ * `ambiguous` is set when more than one does. Throws when the node cannot be
+ * read — "could not look" is never "not connected".
+ */
+export declare function resolveDelegation(agent: string, fetchImpl?: typeof fetch): Promise<{
+    delegation: Delegation | null;
+    ambiguous: AmbiguousDelegation | null;
+}>;
+/**
+ * Whom this agent acts for, or null — null too when more than one account
+ * claims it; `resolveDelegation` says which. Kept for its callers; anything
+ * that already knows the principal it expects should ask `readDelegationFor`.
+ */
+export declare function readDelegation(agent: string, fetchImpl?: typeof fetch): Promise<Delegation | null>;
+/**
+ * The connection from exactly this principal to this agent, or null.
+ *
+ * Keyed on both ends (`grants?granter=&grantee=`), so it never lists who
+ * else has granted to the agent and a stranger's grant cannot be mistaken for
+ * the person's. This is the read a client should make once it has pinned the
+ * principal at connect: the question is no longer "who is this agent for"
+ * but "is it still for them".
+ *
+ * The keyed endpoint answers grants without their granter and grantee — it
+ * was asked for one pair — so they are put back before the pure reader sees
+ * them.
+ */
+export declare function readDelegationFor(agent: string, expectedPrincipal: string, fetchImpl?: typeof fetch): Promise<Delegation | null>;
+/** The agents acting for this person. */
+export declare function delegatesOf(principal: string, fetchImpl?: typeof fetch): Promise<Delegation[]>;
+/** Whether a gas allowance from `principal` to `agent` stands — read before revoking, never assumed. */
+export declare function gasLent(principal: string, agent: string, fetchImpl?: typeof fetch): Promise<boolean>;
+/**
+ * Connect an agent: the person's identity first, then the batch, one tap
+ * each at most. The agent will create entities as this person and file
+ * claims as them, and both name the person's DID — so a person who has
+ * never signed anything here gets their IID document on the way in.
+ */
+export declare function connectAgent(session: QiSession, agent: string, terms: ConnectTerms, prompt?: PhonePrompt): Promise<import("./signWith.ts").SignResult>;
+/** Disconnect it: every grant revoked, the gas allowance too when one was lent. */
+export declare function disconnectAgent(session: QiSession, agent: string, prompt?: PhonePrompt): Promise<import("./signWith.ts").SignResult>;
+//# sourceMappingURL=delegate.d.ts.map

package/dist/esm/chain/delegate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../../src/chain/delegate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAO1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,yFAAyF;AACzF,eAAO,MAAM,cAAc,qLAKjB,CAAC;AAEX,wDAAwD;AACxD,eAAO,MAAM,WAAW,uCAAuC,CAAC;AAOhE,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,0GAA0G;AAC1G,eAAO,MAAM,aAAa,WAAW,CAAC;AAItC,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,YAAY,EAAE,CA6BjG;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,YAAY,EAAE,CAQ7F;AAID,qDAAqD;AACrD,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9G;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4FAA4F;IAC5F,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAa,GAAG,UAAU,EAAE,CAyBjF;AAED,gGAAgG;AAChG,eAAO,MAAM,OAAO,GAAI,MAAM,QAAQ,EAAE,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,EAAE,YAAgB,KAAG,OACA,CAAC;AAUhG;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAClB,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;CAMhD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CAIzK;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAE/G;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAK7I;AAED,yCAAyC;AACzC,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3G;AAED,wGAAwG;AACxG,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjH;AAID;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,+CAG9G;AAED,mFAAmF;AACnF,wBAAsB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,+CAG5F"}