@ixo/openhands-sdk 0.0.0-stage → 0.2.0

package/dist/esm/chain/signx.js

@@ -0,0 +1,475 @@
+import { createHash, randomBytes } from "node:crypto";
+export const SIGNX_RELAY = {
+    devnet: "https://signx.devnet.ixo.earth",
+    testnet: "https://signx.testnet.ixo.earth",
+    mainnet: "https://signx.ixo.earth"
+};
+/** The SDK's own constants. `login` is version 1; transact moved to v2. */
+const LOGIN_VERSION = 1;
+/*
+ * **The relay long-polls.** It holds the connection open waiting for the phone
+ * and only answers "not found" after about ten seconds — measured at 10.7s
+ * against signx.testnet.ixo.earth, 2026-08-16. A ten-second client timeout
+ * therefore aborts a request that was about to succeed, every single time, and
+ * the desktop reports the relay unreachable while the phone sits there having
+ * already approved. Thirty seconds clears the hold with room to spare.
+ */
+const RELAY_TIMEOUT_MS = 30_000;
+const ROUTES = { loginFetch: "/login/fetch", matrixLoginFetch: "/matrix/login/fetch" };
+/**
+ * The Matrix half is a **second ceremony**, not a field on the first.
+ *
+ * This cost a long afternoon. `login({ matrix: true })` returns a chain
+ * identity and, on some app versions, a `userId` — but never the access token
+ * or the encrypted vault. Those come from `matrixLogin()`, its own scan with
+ * its own hash, poll route and success event. The portal calls both, which is
+ * why buying works there and did not here; the `matrix` flag on login only
+ * tells the phone that Matrix is wanted, and the credentials arrive separately.
+ *
+ * Read from `@ixo/signx-sdk` 1.3.2 (`module/client.js` → `matrixLogin`), which
+ * is the only authoritative description of this wire — the same source the
+ * login deeplink was copied from field for field.
+ */
+const MATRIX_VERSION = 1;
+const randomHash = () => randomBytes(32).toString("hex");
+/**
+ * The nonce is derived, not remembered.
+ *
+ * Storing it meant one process had to hand it to another: `start` and `poll`
+ * are separate route modules, and in production separate serverless instances,
+ * so a Map between them is empty by the time it is read — a login that never
+ * completes rather than one that occasionally does.
+ *
+ * Deriving it from the hash under a server secret removes the state entirely.
+ * Any instance can recompute it, nobody without the secret can guess it, and
+ * `secureHash` stays exactly what the phone expects: sha256(hash + nonce).
+ */
+const nonceFor = (hash, secret) => createHash("sha256").update(`${secret}:${hash}`).digest("hex");
+/** Whether a hash and secureHash pair is one this deployment actually issued. */
+export const weIssued = (hash, secureHash, secret) => createHash("sha256").update(hash + nonceFor(hash, secret)).digest("hex") === secureHash;
+/**
+ * A mark saying "we produced this string", for anything that has no hash pair
+ * of its own — a transact deeplink, most of all.
+ *
+ * The QR route exists to draw *our* codes. Without a mark it would draw
+ * anybody's: point it at a deeplink you control, embed it in a page wearing our
+ * name, and it is a phishing site with our server rendering the bait. A login
+ * proves itself through `weIssued`; a transact link has nothing to prove itself
+ * with, so it carries this instead.
+ */
+export const stampFor = (value, secret) => createHash("sha256").update(`${secret}:qr:${value}`).digest("hex").slice(0, 32);
+export const stampOk = (value, stamp, secret) => stampFor(value, secret) === stamp;
+/**
+ * Start a login.
+ *
+ * The QR carries `hash` and `secureHash`; the nonce between them is derived
+ * from the server secret and never appears anywhere a client can read it. So a
+ * hash scraped off somebody's screen cannot be turned into a login this
+ * deployment will accept, and `weIssued` can tell ours from a stranger's
+ * without either side remembering anything.
+ */
+export function startLogin(args) {
+    const hash = randomHash();
+    const nonce = nonceFor(hash, args.secret);
+    return {
+        request: {
+            hash,
+            secureHash: createHash("sha256").update(hash + nonce).digest("hex"),
+            type: "SIGN_X_LOGIN",
+            sitename: args.sitename,
+            timeout: new Date(Date.now() + (args.timeoutMs ?? 2 * 60 * 1000)).toISOString(),
+            network: args.network,
+            matrix: args.matrix ?? false,
+            version: LOGIN_VERSION
+        }
+    };
+}
+/**
+ * What the QR encodes — the deeplink the IXO Mobile app opens.
+ *
+ * **Flat query parameters, one per field.** This is not a style choice: the app
+ * parses the link with `Linking.parse(url)` and hands `queryParams` straight to
+ * the screen as its route params, which then waits for `route.params.hash`. A
+ * link carrying one opaque blob gives it `{ data: "eyJ…" }`, no `hash`, and the
+ * phone sits on "Preparing SIGN X…" until it is closed — no error, because
+ * nothing ever got as far as validating.
+ *
+ * That is exactly what ours did. The shape below is copied field for field from
+ * `@ixo/signx-sdk` 1.3.2, `module/utils/encoding.js` → `convertDataToDeeplink`,
+ * which is the only description of this wire that is actually authoritative.
+ *
+ * Values are percent-encoded, which the SDK does not bother with. `Linking.parse`
+ * decodes them, so the phone sees the same strings either way — and a sitename
+ * with a space in it stops being a malformed URL.
+ *
+ * The `impactsx` scheme is the app's registered URL scheme, not its name. The
+ * app is called IXO Mobile everywhere a person can read it; renaming this
+ * string would open nothing.
+ */
+export function deeplinkFor(request, scheme = "impactsx") {
+    /*
+     * Every field below is required, so a blank one is a broken link — and the
+     * old code quietly dropped blanks instead of saying so. A deployment whose
+     * `NEXT_PUBLIC_CHAIN_NETWORK` was an empty string therefore drew a perfectly
+     * valid QR with no `network` in it: the phone scanned, parsed, and refused,
+     * and the only place that refusal appeared was on somebody else's screen.
+     *
+     * Failing here costs a 500 on a route we watch. Failing there costs a person
+     * a trip to their phone to discover it, and tells them nothing about why.
+     */
+    const query = (fields) => {
+        const missing = fields.filter(([, value]) => value === undefined || value === "").map(([key]) => key);
+        if (missing.length > 0)
+            throw new Error(`SignX deeplink is missing ${missing.join(", ")}. Check this deployment's environment`);
+        return fields.map(([key, value]) => `${key}=${encodeURIComponent(String(value))}`).join("&");
+    };
+    if (request.type === "SIGN_X_LOGIN") {
+        const login = request;
+        return `${scheme}://signx?${query([
+            ["hash", login.hash],
+            ["secureHash", login.secureHash],
+            ["type", login.type],
+            ["sitename", login.sitename],
+            ["timeout", login.timeout],
+            ["network", login.network],
+            ["matrix", login.matrix],
+            ["version", login.version]
+        ])}`;
+    }
+    /* The Matrix scan is a login without the `matrix` flag: being Matrix is what
+       the type says, so repeating it as a field would be a second opinion. */
+    if (request.type === "SIGN_X_MATRIX_LOGIN") {
+        const matrix = request;
+        return `${scheme}://signx?${query([
+            ["hash", matrix.hash],
+            ["secureHash", matrix.secureHash],
+            ["type", matrix.type],
+            ["sitename", matrix.sitename],
+            ["timeout", matrix.timeout],
+            ["network", matrix.network],
+            ["version", matrix.version]
+        ])}`;
+    }
+    /* Transact carries no secureHash and no timeout — the session holds both. */
+    const transact = request;
+    return `${scheme}://signx?${query([
+        ["hash", transact.hash],
+        ["type", transact.type],
+        ["sitename", transact.sitename],
+        ["network", transact.network],
+        ["version", transact.version],
+        ["sessionHash", transact.sessionHash]
+    ])}`;
+}
+/** Start the Matrix ceremony. Same envelope as a login, different type. */
+export function startMatrixLogin(args) {
+    const hash = randomHash();
+    const nonce = nonceFor(hash, args.secret);
+    return {
+        request: {
+            hash,
+            secureHash: createHash("sha256").update(hash + nonce).digest("hex"),
+            type: "SIGN_X_MATRIX_LOGIN",
+            sitename: args.sitename,
+            timeout: new Date(Date.now() + (args.timeoutMs ?? 2 * 60 * 1000)).toISOString(),
+            network: args.network,
+            version: MATRIX_VERSION
+        }
+    };
+}
+/**
+ * Has the phone answered the Matrix scan?
+ *
+ * `accessToken` is the test for "answered", exactly as the SDK has it — a reply
+ * without one is the relay still waiting in its own dialect, not a session.
+ */
+export async function fetchMatrixLogin(network, hash, secret) {
+    const response = await fetch(`${SIGNX_RELAY[network]}${ROUTES.matrixLoginFetch}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hash, secureNonce: nonceFor(hash, secret) }),
+        signal: AbortSignal.timeout(RELAY_TIMEOUT_MS),
+        cache: "no-store"
+    });
+    if (response.status >= 500)
+        throw new Error(`signx relay answered ${response.status}`);
+    const body = (await response.json().catch(() => null));
+    if (!body)
+        throw new Error("the signing relay answered with nothing");
+    if (stillWaiting(body))
+        return null;
+    const refused = refusalIn(body);
+    if (refused)
+        throw new SignXRefused(refused);
+    const matrix = unwrap(body);
+    return matrix?.accessToken ? matrix : null;
+}
+/**
+ * Dig the payload out of the relay's envelope.
+ *
+ * It nests twice — `{ success, data: { data: {…} } }` — and the SDK reads
+ * `response.data.data?.data ?? {}` before checking any field
+ * (`main/client.js`, `startPolling`). Reading one level short returns an object
+ * with none of the fields we look for, which is indistinguishable from "not yet"
+ * and polls forever. Both depths are accepted so a relay that ever flattens does
+ * not lock everybody out.
+ */
+/**
+ * **The status is in the body, not the status line.**
+ *
+ * The relay answers `201` for everything, including "nobody has answered yet",
+ * and puts the real outcome inside: `{"success":false,"code":418,"data":{…}}`.
+ * So branching on `response.status` reads a refusal as an answer and an answer
+ * as a refusal, depending on which way you guessed. Observed directly against
+ * `signx.testnet.ixo.earth`, 2026-08-16.
+ */
+/*
+ * **And `418` is the only code that means "not yet".**
+ *
+ * This read *every* `success:false` as waiting, so a session the relay had
+ * dropped, a nonce it refused and a transaction the phone declined were all
+ * indistinguishable from a person who had not picked their phone up yet — the
+ * QR simply stayed on screen until the whole request timed out minutes later,
+ * saying nothing. The relay's own contract is written in the SDK's
+ * `startPolling`: keep polling on 418, throw on anything else.
+ */
+const WAITING_CODE = 418;
+/** Still waiting — and only this. Everything else is an answer of some kind. */
+const stillWaiting = (body) => {
+    const envelope = body;
+    return Boolean(envelope && typeof envelope === "object" && envelope.success === false && envelope.code === WAITING_CODE);
+};
+/**
+ * A refusal the relay is telling us about, or `null` if this is a real answer.
+ *
+ * Two shapes carry one, and the SDK checks both: the outer envelope saying
+ * `success:false` with a code that is not 418 (the session is gone, the nonce
+ * was wrong), and an outer success wrapping an inner `success:false` — which is
+ * how a phone that **declined** comes back. A body we cannot parse at all is
+ * not a refusal: that is a relay we could not read, which the caller treats as
+ * a blip rather than an answer.
+ */
+const refusalIn = (body) => {
+    const envelope = body;
+    if (!envelope || typeof envelope !== "object")
+        return null;
+    const inner = envelope.data;
+    const spoken = inner?.data?.message ?? inner?.message;
+    if (envelope.success === false)
+        return spoken ?? `the signing relay would not answer (code ${envelope.code ?? "?"})`;
+    if (inner && inner.success === false)
+        return spoken ?? "your phone declined this";
+    return null;
+};
+/**
+ * Something the relay told us, as opposed to a relay we could not reach.
+ *
+ * The distinction is the whole point: a refusal is final and should end the
+ * wait with its own words on screen, while an unreachable relay is worth one
+ * more try. Collapsing the two is what left people looking at a dead QR.
+ */
+export class SignXRefused extends Error {
+}
+const unwrap = (body) => {
+    const outer = body && typeof body === "object" && "data" in body ? body.data : body;
+    const inner = outer && typeof outer === "object" && "data" in outer ? outer.data : outer;
+    return (inner ?? outer);
+};
+/**
+ * Ask the relay whether the phone has answered yet.
+ *
+ * `null` means "not yet", which is the ordinary case and not an error — a
+ * person takes seconds to find their phone. Only a relay that refuses or
+ * answers nonsense throws.
+ */
+export async function fetchLogin(network, hash, secret) {
+    const response = await fetch(`${SIGNX_RELAY[network]}${ROUTES.loginFetch}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        /*
+         * **`secureNonce`, not just the hash.** The phone only ever saw
+         * `secureHash = sha256(hash + nonce)`; the nonce itself is the secret that
+         * proves we are the site that issued this login, and the relay will not
+         * release the account details without it. Polling with the hash alone gets
+         * a polite "nothing here" forever — the login succeeds on the phone and the
+         * desktop never finds out.
+         *
+         * Derived rather than remembered, which is the whole trick that lets start
+         * and poll be different serverless instances.
+         */
+        body: JSON.stringify({ hash, secureNonce: nonceFor(hash, secret) }),
+        signal: AbortSignal.timeout(RELAY_TIMEOUT_MS),
+        cache: "no-store"
+    });
+    /* Only a transport-level failure is a failure; everything else is in the body. */
+    if (response.status >= 500)
+        throw new Error(`signx relay answered ${response.status}`);
+    const body = (await response.json().catch(() => null));
+    if (!body)
+        throw new Error("the signing relay answered with nothing");
+    if (stillWaiting(body))
+        return null;
+    const refused = refusalIn(body);
+    if (refused)
+        throw new SignXRefused(refused);
+    const user = unwrap(body);
+    /* An answer without an address is the relay saying "still waiting" in its own
+       dialect, not a user we can sign in. */
+    return user?.address && user.did ? user : null;
+}
+// ------------------------------------------------------------------ transact
+/**
+ * Asking the phone to sign and broadcast.
+ *
+ * Every shape here was read out of `@ixo/signx-sdk` 1.3.2's own compiled
+ * source (`main/client.js`, `main/utils/encoding.js`) rather than from prose,
+ * because the phone recomputes the per-transaction hash and rejects anything
+ * that does not match byte for byte. Transact is **version 2**; login is still
+ * version 1. (INFRA §1.1 says the SDK uses v1 transact shapes — that is wrong
+ * for 1.3.2, whose own constants route through `/transaction/v2/*`.)
+ *
+ * The phone decodes the body, renders the messages on its own screen, signs,
+ * **and broadcasts itself**. So we never hold a key and never see one — what
+ * comes back is a result, not a signature.
+ */
+const TRANSACT_VERSION = 2;
+const TRANSACT_ROUTES = {
+    create: "/transaction/v2/create",
+    add: "/transaction/v2/add",
+    response: "/transaction/v2/response",
+    next: "/transaction/v2/next"
+};
+/**
+ * The per-transaction hash the phone recomputes.
+ *
+ * Keys are sorted before stringify — the SDK does this deliberately so both
+ * ends agree regardless of property order. Reproduce it exactly or the phone
+ * silently refuses the transaction.
+ */
+export function hashTransactData(data) {
+    const formatted = { address: data.address, did: data.did, pubkey: data.pubkey, txBodyHex: data.txBodyHex, timestamp: data.timestamp };
+    return createHash("sha256").update(JSON.stringify(formatted, Object.keys(formatted).sort())).digest("hex");
+}
+/**
+ * Open a transact session on the relay and return what the QR should carry.
+ *
+ * `secureNonce` is derived from the session hash under the server secret, the
+ * same trick login uses: `start` and `poll` are different route modules and,
+ * in production, different serverless instances, so anything remembered
+ * between them is gone by the time it is read.
+ */
+export async function startTransact(args) {
+    if (!args.account.address || !args.account.did || !args.account.pubkey)
+        throw new Error("account details missing");
+    if (args.txBodyHexes.length === 0)
+        throw new Error("no transactions to sign");
+    const timestamp = args.timestamp ?? new Date().toISOString();
+    const transactions = args.txBodyHexes.map((txBodyHex, index) => ({
+        hash: hashTransactData({ ...args.account, txBodyHex, timestamp }),
+        txBodyHex,
+        timestamp,
+        sequence: index + 1
+    }));
+    /*
+     * **The session hash is derived, not invented.**
+     *
+     * `sessionHash = sha256(firstTransactionHash + secureNonce)` — the SDK's
+     * `transact()`, and the relay checks it: a session hash that is not that
+     * function of the transaction it carries is refused with "Invalid request,
+     * hash mismatch". We used a random hash, so the session was never created at
+     * all, and the phone scanned a QR pointing at nothing: "Transaction session
+     * not found".
+     *
+     * The nonce comes off the **transaction** hash rather than the session hash,
+     * which it has to — the session hash is downstream of it. That keeps the
+     * stateless trick intact: `poll` recomputes the same nonce from the same
+     * transaction hash without either route remembering anything.
+     */
+    const firstHash = transactions[0].hash;
+    const secureNonce = nonceFor(firstHash, args.secret);
+    const sessionHash = createHash("sha256").update(firstHash + secureNonce).digest("hex");
+    const response = await fetch(`${SIGNX_RELAY[args.network]}${TRANSACT_ROUTES.create}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            hash: sessionHash,
+            address: args.account.address,
+            did: args.account.did,
+            pubkey: args.account.pubkey,
+            transactions: { hash: sessionHash, secureNonce, transactions }
+        }),
+        signal: AbortSignal.timeout(RELAY_TIMEOUT_MS),
+        cache: "no-store"
+    });
+    if (response.status >= 500)
+        throw new Error(`signx relay refused the transaction: ${response.status}`);
+    /*
+     * The relay answers 201 whether it accepted the session or not, and says
+     * which in the body. Trusting the status line meant every refusal read as a
+     * success and the failure only surfaced later, on somebody's phone.
+     */
+    const body = (await response.json().catch(() => null));
+    if (!body?.success)
+        throw new Error(body?.data?.message ?? "the signing relay would not open a session");
+    /*
+     * **The relay says which transaction the phone will be shown, and it has to
+     * be ours.** The SDK polls `activeTransaction.hash` rather than the hash it
+     * computed itself, which only matters when the two differ — a relay still
+     * holding an earlier session for this account hands that one back, the phone
+     * signs it, and we poll a hash nobody is ever going to answer. There is no
+     * symptom for that beyond a QR that never goes away, so it is named here.
+     */
+    const active = body.data?.activeTransaction?.hash;
+    if (active && active !== firstHash)
+        throw new Error("the signing relay is still holding an earlier request. Give it a moment and try again");
+    return {
+        sessionHash,
+        transactionHash: firstHash,
+        request: {
+            sessionHash,
+            hash: firstHash,
+            type: "SIGN_X_TRANSACT",
+            sitename: args.sitename,
+            network: args.network,
+            version: TRANSACT_VERSION
+        }
+    };
+}
+/**
+ * Poll for what the phone did.
+ *
+ * `null` is "not yet" — the relay answers **418** for that, which is the one
+ * status here that is neither success nor failure.
+ *
+ * The trap worth naming: **a broadcast that landed with `code ≠ 0` still
+ * arrives on the success channel** (INFRA §1.1, from the mobile source). So a
+ * caller must check `code`, and `signWithSession` does.
+ */
+export async function pollTransact(args) {
+    const response = await fetch(`${SIGNX_RELAY[args.network]}${TRANSACT_ROUTES.response}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hash: args.transactionHash, secureNonce: nonceFor(args.transactionHash, args.secret) }),
+        signal: AbortSignal.timeout(RELAY_TIMEOUT_MS),
+        cache: "no-store"
+    });
+    if (response.status >= 500)
+        throw new Error(`signx relay answered ${response.status}`);
+    const body = (await response.json().catch(() => null));
+    if (!body)
+        throw new Error("the signing relay answered with nothing");
+    /* 418 is "not signed yet" and arrives in the body with success:false. */
+    if (stillWaiting(body))
+        return null;
+    const refused = refusalIn(body);
+    if (refused)
+        throw new SignXRefused(refused);
+    const data = unwrap(body);
+    /* An answer with no code is not "not yet" — it is an answer we cannot read,
+       and returning null for it dropped the caller back into a silent wait. The
+       relay has spoken by here; if we cannot make sense of it, say so. */
+    if (!data || typeof data.code !== "number")
+        throw new SignXRefused("the relay answered without a signing result");
+    return data;
+}
+//# sourceMappingURL=signx.js.map

package/dist/esm/chain/signx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signx.js","sourceRoot":"","sources":["../../../src/chain/signx.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAqBtD,MAAM,CAAC,MAAM,WAAW,GAAiC;IACvD,MAAM,EAAE,gCAAgC;IACxC,OAAO,EAAE,iCAAiC;IAC1C,OAAO,EAAE,yBAAyB;CACnC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,qBAAqB,EAAW,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAezB,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEjE;;;;;;;;;;;GAWG;AACH,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1H,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,UAAkB,EAAE,MAAc,EAAW,EAAE,CACpF,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEnJ,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC;AAEpH;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuG;IAGhI,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO;QACL,OAAO,EAAE;YACP,IAAI;YACJ,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAC/E,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO,EAAE,aAAa;SACvB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAqE,EAAE,MAAM,GAAG,UAAU;IACpH;;;;;;;;;OASG;IACH,MAAM,KAAK,GAAG,CAAC,MAAyD,EAAU,EAAE;QAClF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACtG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAEhI,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAuB,CAAC;QACtC,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC;YAChC,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;YAChC,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC5B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACxB,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;SAC3B,CAAC,EAAE,CAAC;IACP,CAAC;IAED;8EAC0E;IAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,OAA6B,CAAC;QAC7C,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC;YAChC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;YACjC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC7B,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;SAC5B,CAAC,EAAE,CAAC;IACP,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAmC,CAAC;IACrD,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC;QAChC,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC/B,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC7B,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC7B,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;KACtC,CAAC,EAAE,CAAC;AACP,CAAC;AAaD,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,IAAqF;IACpH,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO;QACL,OAAO,EAAE;YACP,IAAI;YACJ,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAC/E,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,cAAc;SACxB;KACF,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAqB,EAAE,IAAY,EAAE,MAAc;IACxF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,EAAE;QAChF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,KAAK,EAAE,UAAU;KACH,CAAC,CAAC;IAElB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACtE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,MAAM,CAAc,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAmBD;;;;;;;;;GASG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC;AAQzB,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,IAAa,EAAW,EAAE;IAC9C,MAAM,QAAQ,GAAG,IAAuB,CAAC;IACzC,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AAC3H,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,SAAS,GAAG,CAAC,IAAa,EAAiB,EAAE;IACjD,MAAM,QAAQ,GAAG,IAAuB,CAAC;IACzC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAI,KAAK,EAAE,IAAyC,EAAE,OAAO,IAAI,KAAK,EAAE,OAAO,CAAC;IAC5F,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,MAAM,IAAI,4CAA4C,QAAQ,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;IACrH,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,MAAM,IAAI,0BAA0B,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,MAAM,GAAG,CAAI,IAAa,EAAiB,EAAE;IACjD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,IAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACjH,OAAO,CAAC,KAAK,IAAI,KAAK,CAAkB,CAAC;AAC3C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAqB,EAAE,IAAY,EAAE,MAAc;IAClF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C;;;;;;;;;;WAUG;QACH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,KAAK,EAAE,UAAU;KACH,CAAC,CAAC;IAElB,kFAAkF;IAClF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACtE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,MAAM,CAAY,IAAI,CAAC,CAAC;IAErC;6CACyC;IACzC,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,wBAAwB;IAChC,GAAG,EAAE,qBAAqB;IAC1B,QAAQ,EAAE,0BAA0B;IACpC,IAAI,EAAE,sBAAsB;CACpB,CAAC;AASX;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA4F;IAC3H,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACtI,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtH,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAOnC;IACC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnH,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,gBAAgB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACjE,SAAS;QACT,SAAS;QACT,QAAQ,EAAE,KAAK,GAAG,CAAC;KACpB,CAAC,CAAC,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;IACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE;QACpF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE;SAC/D,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,KAAK,EAAE,UAAU;KACH,CAAC,CAAC;IAElB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvG;;;;OAIG;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAqG,CAAC;IAC3J,IAAI,CAAC,IAAI,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,4CAA4C,CAAC,CAAC;IAEzG;;;;;;;OAOG;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC;IAClD,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAE7I,OAAO;QACL,WAAW;QACX,eAAe,EAAE,SAAS;QAC1B,OAAO,EAAE;YACP,WAAW;YACX,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,gBAAgB;SAC1B;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAA6F;IAC9H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9G,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7C,KAAK,EAAE,UAAU;KACH,CAAC,CAAC;IAElB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAEtE,yEAAyE;IACzE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,MAAM,CAAiB,IAAI,CAAC,CAAC;IAC1C;;0EAEsE;IACtE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,YAAY,CAAC,6CAA6C,CAAC,CAAC;IAClH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/esm/chain/sponsor.d.ts

@@ -0,0 +1,2 @@
+export declare function ensureSponsored(address: string, site?: string, forMessages?: string[]): Promise<boolean>;
+//# sourceMappingURL=sponsor.d.ts.map

package/dist/esm/chain/sponsor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sponsor.d.ts","sourceRoot":"","sources":["../../../src/chain/sponsor.ts"],"names":[],"mappings":"AAyCA,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAK,EAAE,WAAW,GAAE,MAAM,EAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtH"}

package/dist/esm/chain/sponsor.js

@@ -0,0 +1,73 @@
+import { getFeegrantGranter, getUixoBalance } from "./query.js";
+/**
+ * Gas for somebody who holds money but not the gas coin.
+ *
+ * Gas is `uixo` on every network, whatever an ask pays in. So on a PAY board
+ * the person who just bought credit with a card holds money and **cannot
+ * sign** — not the draw that brings it to their key, not the ask they bought
+ * it for. On testnet the faucet hides this (`ensureGas`); on mainnet there is
+ * no faucet and the whole path dies at the first signature.
+ *
+ * `broadcast.ts` already spends a feegrant when one exists, so nothing
+ * downstream changes: this only makes sure one exists before the first
+ * signature of a money path. The gate decides whether to give it — and refuses
+ * anybody who cannot prove they hold PAY or have credit waiting.
+ *
+ * Silent by design at every failure. This is a **convenience over the top of**
+ * the ordinary path: on testnet the faucet still runs, and a refusal here must
+ * never be what stops somebody who could have signed anyway. The transaction
+ * that follows is the real test, and it says its own error properly.
+ */
+/** Enough gas to not need help. Matches `ensureGas`'s own threshold. */
+const ENOUGH_UIXO = 100_000;
+const WAIT_MS = 800;
+const TRIES = 12;
+/**
+ * `site` is for callers that are not a browser — the MCP server runs in Node,
+ * where a relative URL has nothing to be relative to. Empty (the browser's
+ * case) keeps the same-origin fetch every other app route uses.
+ */
+/**
+ * What the sponsorship must be able to pay for when the caller does not say.
+ *
+ * "Some granter exists" is not "sponsored": this granter stands behind three
+ * doors, and the gate's submit-only gas or a union grant cannot pay to post
+ * an ask. Callers about to sign something else — a draw, a pledge — say so.
+ */
+const POSTS_ASKS = ["/ixo.entity.v1beta1.MsgCreateEntity"];
+export async function ensureSponsored(address, site = "", forMessages = POSTS_ASKS) {
+    if (!address)
+        return false;
+    try {
+        /* Already able to pay, or already sponsored by someone. Either way, done —
+           and asking again would have the gate pay twice for one person's gas. */
+        if ((await getUixoBalance(address)) > ENOUGH_UIXO)
+            return false;
+        if (await getFeegrantGranter(address, forMessages))
+            return true;
+        const response = await fetch(`${site}/api/grant`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ kind: "poster", address }),
+            signal: AbortSignal.timeout(60_000)
+        });
+        if (!response.ok)
+            return false;
+        /*
+         * Wait for the grant to be readable, not just broadcast. The signature
+         * that follows reads the feegrant itself, and a block that has not been
+         * indexed yet reads exactly like no grant at all — which would send the
+         * caller down the faucet path it just paid to avoid.
+         */
+        for (let attempt = 0; attempt < TRIES; attempt += 1) {
+            if (await getFeegrantGranter(address, forMessages))
+                return true;
+            await new Promise((wait) => setTimeout(wait, WAIT_MS));
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=sponsor.js.map

package/dist/esm/chain/sponsor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sponsor.js","sourceRoot":"","sources":["../../../src/chain/sponsor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,wEAAwE;AACxE,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,KAAK,GAAG,EAAE,CAAC;AAEjB;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAAI,GAAG,EAAE,EAAE,cAAwB,UAAU;IAClG,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,CAAC;QACH;kFAC0E;QAC1E,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,WAAW;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACjD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE/B;;;;;WAKG;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}