@tollbooth-dpyc/web 1.3.1 → 1.4.1

package/README.md

@@ -10,9 +10,13 @@ features. It is the peer of the `tollbooth-dpyc` Python wheel.
 - **MCP client** — one shared connection to the operator, typed wrappers for
   the standard tools (balance, top-up, statement, price, profile)
 - **React components** — `NpubGate`, `NostrProfilePanel`, `SessionKeyClaim`, `WalletCard`,
-  `WalletPage`, `CouponsPanel`, `TableFilter`, `SortHeader` / `PageControls` /
-  `TableShell`, `ThemeToggle`, `ErrorBoundary`, `AvatarPicker`, `DebugPanel`,
-  `QuoteScroller`, `useSession`, `useTopUp`, `useTheme`, `useDebugLog`
+  `WalletPage`, `CouponsPanel`, `UsageSummary`, `PatronFundingStatus` /
+  `OperatorFundingStatus`, `BuildInfoPanel`, `TimezonePicker`, `TableFilter`,
+  `SortHeader` / `PageControls` / `TableShell`, `ThemeToggle`, `ErrorBoundary`,
+  `AvatarPicker`, `DebugPanel`, `QuoteScroller`, `useSession`, `useTopUp`,
+  `useTheme`, `useTimezone`, `useDebugLog`
+- **Time zone** — the patron's display zone and the conversions every clock
+  needs (render, datetime-local, day-filter bounds), DST-correct
 - **Mechanics, not looks** — the newer components take `classNames` per part
   and add no typography or colour of their own; actions are chips
 - **Debug log** — every call, result and error from `callTool`, scrubbed of
@@ -113,6 +117,63 @@ wrapper takes the same optional `CallOptions` as `callTool`, last
 `useTopUp` is the wallet's top-up on its own (purchase_credits → invoice →
 check_payment, polled while the tab is visible) for a site drawing its own.
 
+### Time zone
+
+The patron picks a display zone once — "auto" (the browser's) or an IANA name,
+never a fixed offset — and every clock follows. It is kept under
+`<prefix>:timezone`; `useTimezone()` re-renders on any change, from this page
+or another tab. Storage stays UTC; convert at the edges:
+
+```tsx
+import { datetimeLocalValueToIso, formatDateTime, isoToDatetimeLocalValue, localDateFilterBounds } from "@tollbooth-dpyc/web";
+import { TimezonePicker, useTimezone } from "@tollbooth-dpyc/web/react";
+
+const [, zone] = useTimezone();
+formatDateTime(post.sent_at, zone);                       // render
+isoToDatetimeLocalValue(post.publish_at, zone);           // → <input type="datetime-local">
+datetimeLocalValueToIso(value, zone);                     // ← back to UTC ISO
+localDateFilterBounds("2026-03-08", "2026-03-08", zone);  // the patron's midnights, as instants
+
+<TimezonePicker label="Display time zone" classNames={{ select: "field" }} />
+```
+
+Around a DST change a missing wall time (02:30 on a spring-forward morning)
+moves an hour on and a doubled one (01:30 on a fall-back night) is the
+earlier; day bounds give the 23- and 25-hour days their true length.
+`displayTimeZone()` is the zone for code outside React.
+
+### Usage, funding, build
+
+```tsx
+import { BuildInfoPanel, OperatorFundingStatus, PatronFundingStatus, UsageSummary } from "@tollbooth-dpyc/web/react";
+
+<UsageSummary days={30} figures={["balance", "deposited", "consumed"]} classNames={{ root: "card p-5", figures: "grid grid-cols-3" }} />
+
+<PatronFundingStatus thresholds={{ low: 100 }} siteRows={xConnectionRows} classNames={{ root: "card p-5", ok: "text-green-600" }} />
+<OperatorFundingStatus authorityThresholds={{ low: 500 }} />
+
+<BuildInfoPanel
+  status={status}
+  frontend={{ version: __APP_VERSION__, commit: __BUILD_COMMIT__, builtAt: __BUILD_TIME__, source: "https://github.com/you/site" }}
+  intro={<p>…the site's own words…</p>}
+/>
+```
+
+- `UsageSummary` reads `account_statement`: balance and lifetime totals, the
+  period's spend, calls and top-ups (from its daily log), and its top tools.
+  `figures` picks the numbers, `renderRow` draws a tool row.
+- `PatronFundingStatus`: sign-in proof and credit balance, with tranche expiry;
+  `OperatorFundingStatus`: credentials still to deliver, the Authority balance,
+  the database and background jobs. Every row is read fresh and stamped with
+  when, in the patron's zone. **The operator panel renders nothing — and calls
+  nothing operator-only — unless the signed-in npub equals the `operator_npub`
+  that `session_status` reports.** That is display only; the server enforces
+  its own ACL. `siteRows` adds a site's own checks.
+- `BuildInfoPanel`: the front end's version (yours, passed in), the MCP
+  server's version, wheel and commit linked to its repository (from
+  `service_status`; only https links), the Tollbooth-DPYC™ links, the licence
+  and the patent notice. `children` adds rows after the MCP server section.
+
 ### Debug panel
 
 `callTool` logs to a shared, scrubbed ring buffer; `DebugPanel` shows it as a
@@ -136,7 +197,7 @@ configureDebugLog({ persist: true });   // optional: outlive a reload; max defau
 ```
 
 A site's own `debugPush` lines are scrubbed the same way. Stamps follow the
-zone the site stores under `<prefix>:timezone`, if any.
+patron's display time zone (see Time zone).
 
 ### Quote scroller
 

package/dist/buildInfo.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What `service_status` says about the running build: the server's version,
+ * the tollbooth-dpyc wheel under it, and the commit it was deployed from,
+ * linked to its repository. Framework-free, so it is tested without React.
+ *
+ * Hrefs come from the server, so only an https URL becomes a link; anything
+ * else is shown as text.
+ */
+import type { ServiceStatus } from "./standardTools.ts";
+export interface BuildFacts {
+    version: string | null;
+    sdkVersion: string | null;
+    /** The deployed commit, short (7 characters). */
+    commit: string | null;
+    /** The commit on its host, when the repository is on GitHub. */
+    commitHref: string | null;
+    /** The repository without its scheme, e.g. "github.com/lonniev/excalibur-mcp". */
+    repo: string | null;
+    repoHref: string | null;
+}
+export declare function buildFacts(status: ServiceStatus | null | undefined): BuildFacts;

package/dist/buildInfo.js

@@ -0,0 +1,35 @@
+/**
+ * What `service_status` says about the running build: the server's version,
+ * the tollbooth-dpyc wheel under it, and the commit it was deployed from,
+ * linked to its repository. Framework-free, so it is tested without React.
+ *
+ * Hrefs come from the server, so only an https URL becomes a link; anything
+ * else is shown as text.
+ */
+function httpsUrl(raw) {
+    if (!raw)
+        return null;
+    try {
+        const u = new URL(raw);
+        return u.protocol === "https:" ? u : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function buildFacts(status) {
+    const info = status?.build_info ?? {};
+    const sha = /^[0-9a-f]{7,40}$/i.test(info.fastmcp_cloud_git_commit_sha ?? "")
+        ? info.fastmcp_cloud_git_commit_sha
+        : null;
+    const repoUrl = httpsUrl(info.fastmcp_cloud_git_repo);
+    const repoHref = repoUrl ? repoUrl.href.replace(/\/+$/, "") : null;
+    return {
+        version: status?.version || null,
+        sdkVersion: status?.tollbooth_dpyc_version || null,
+        commit: sha ? sha.slice(0, 7) : null,
+        commitHref: sha && repoUrl?.hostname === "github.com" ? `${repoHref}/commit/${sha}` : null,
+        repo: repoHref ? repoHref.replace(/^https:\/\//, "") : (info.fastmcp_cloud_git_repo || null),
+        repoHref,
+    };
+}

package/dist/client.js

@@ -12,7 +12,7 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { tollboothConfig, toolName } from "./config.js";
-import { debugPush } from "./debugLog.js";
+import { debugPush, redact } from "./debugLog.js";
 import { clearStoredProof, forgetRecentLogin, getStoredNpub, getStoredProof, } from "./identity.js";
 import { signInlineProof } from "./inlineProof.js";
 import { isTransportFailure, NetworkError } from "./networkError.js";
@@ -129,7 +129,7 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     // `args` holds only the caller's own parameters — the envelope is added
     // below — so it is safe to log.
     if (!quiet)
-        debugPush("call", `${name}(${JSON.stringify(args).slice(0, 140)})`);
+        debugPush("call", `${name}(${redact(JSON.stringify(args)).slice(0, 140)})`);
     const bootstrap = STANDARD_BOOTSTRAP.includes(tool) || cfg.extraBootstrapTools.includes(tool);
     const merged = bootstrap
         ? { ...args }
@@ -154,14 +154,14 @@ export async function callToolWithContent(tool, args = {}, opts = {}) {
     if (result.isError) {
         const text = errorText(result);
         if (!quiet)
-            debugPush("error", `${name}: ${text.slice(0, 200)}`);
+            debugPush("error", `${name}: ${redact(text).slice(0, 200)}`);
         throw new Error(text);
     }
     const { payload, images } = readToolResult(result);
     if (!quiet) {
         const preview = typeof payload === "string" ? payload : JSON.stringify(payload);
         const tail = images.length ? ` +${images.length} image` : "";
-        debugPush(looksFailed(payload) ? "error" : "result", `${name} → ${String(preview).slice(0, 220)}${tail}`);
+        debugPush(looksFailed(payload) ? "error" : "result", `${name} → ${redact(String(preview)).slice(0, 220)}${tail}`);
     }
     if (!opts.bestEffort) {
         const bounced = proofBounceMessage(payload);

package/dist/debugLog.d.ts

@@ -7,8 +7,10 @@
  * that flips the view can still be read and copied afterward.
  *
  * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
- * token, and the value of any secret-named field (dpop_token, proof, poison,
- * password, api_key, …) never reach the buffer, the clipboard or storage.
+ * token, the value of any secret-named field (dpop_token, proof, poison,
+ * password, api_key, …), and a secret inside a URL (a query token, a
+ * bearer-like path segment, userinfo) never reach the buffer, the clipboard
+ * or storage.
  * That is the one guarantee a panel relies on — it renders what is here.
  *
  * Merged from the fleet's copies (goodearth, beesknees, cypher, excalibur,

package/dist/debugLog.js

@@ -7,14 +7,17 @@
  * that flips the view can still be read and copied afterward.
  *
  * Every message is scrubbed on the way in: an nsec, a 64-hex key, a bearer
- * token, and the value of any secret-named field (dpop_token, proof, poison,
- * password, api_key, …) never reach the buffer, the clipboard or storage.
+ * token, the value of any secret-named field (dpop_token, proof, poison,
+ * password, api_key, …), and a secret inside a URL (a query token, a
+ * bearer-like path segment, userinfo) never reach the buffer, the clipboard
+ * or storage.
  * That is the one guarantee a panel relies on — it renders what is here.
  *
  * Merged from the fleet's copies (goodearth, beesknees, cypher, excalibur,
  * optionality, roastify, taxsort). None of them scrubbed; this one does.
  */
 import { tollboothConfig } from "./config.js";
+import { displayTimeZone } from "./timezone.js";
 const DEFAULT_MAX = 200;
 let max = DEFAULT_MAX;
 let persist = false;
@@ -33,7 +36,7 @@ const SECRET_FIELD = "(?:nsec|ncryptsec|dpop_token|proof|poison|password|passphr
 // a bare one up to a delimiter. Stopping at the first quote of either kind let
 // the tail of a secret holding `'` or `\"` through.
 function fieldValue(names) {
-    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])(?:\\\\.|\\\\$|(?!\\2)[^\\\\])*?(?=\\2|$)|[^"'\\\\,}\\]&\\s]+)`, "gi");
+    return new RegExp(`((?:\\\\*["'])?\\b${names}(?:\\\\*["'])?\\s*[:=]\\s*)(?:(\\\\*["'])(?:\\\\.|\\\\$|(?!\\2)[^\\\\])*?(?=\\2|$)|(?!\\[redacted\\])[^"'\\\\,}\\]&\\s]+)`, "gi");
 }
 const FIELD_VALUE = fieldValue(SECRET_FIELD);
 // update_patron_credential / update_operator_credential carry the secret as
@@ -46,6 +49,54 @@ const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]+/g;
 function scrubbed(_match, head, quote) {
     return `${head}${quote ?? ""}${REDACTED}`;
 }
+// ── Secrets inside URLs ────────────────────────────────────────────────────
+//
+// A capability link carries its secret in the URL itself — Good Earth's
+// calendar feed is `https://host/calendar/<32 hex>.ics` — and a link read
+// back in a tool result is logged whole. Three places a URL hides a secret:
+// the userinfo, a query or fragment parameter, and a bearer-like path segment.
+/** Query/fragment parameter names whose value is a secret (matched whole). */
+const URL_SECRET_PARAM = /([?&#;](?:token|access_token|refresh_token|id_token|auth|authorization|key|api_key|apikey|secret|client_secret|password|pass|sig|signature|code|proof|dpop_token|session|sessionid|nsec)=)[^&#;\s"'\\<>]*/gi;
+// A URL up to whitespace, a quote, an escape or an angle bracket — so one
+// inside JSON (or JSON inside JSON) ends at its own closing quote.
+const URL_IN_TEXT = /\b(?:https?|webcal|wss?):\/\/[^\s"'\\<>]+/gi;
+const USERINFO = /^([a-z]+:\/\/)[^/?#@]+@/i;
+/**
+ * A path segment that reads as a bearer secret rather than a name: 32+ hex,
+ * or 24+ base64url characters holding both a letter and a digit and one
+ * unbroken alphanumeric run of 16+ (a slug's words are short; a token's are
+ * not). An npub is public and stays.
+ */
+function isSecretSegment(seg) {
+    if (/^npub1/i.test(seg))
+        return false;
+    if (/^[0-9a-f]{32,}$/i.test(seg))
+        return true;
+    if (!/^[A-Za-z0-9_-]{24,}$/.test(seg))
+        return false;
+    if (!/[0-9]/.test(seg) || !/[A-Za-z]/.test(seg))
+        return false;
+    return /[A-Za-z0-9]{16,}/.test(seg);
+}
+function scrubUrl(url) {
+    const head = url.replace(USERINFO, `$1${REDACTED}@`);
+    const pathStart = head.indexOf("/", head.indexOf("://") + 3);
+    if (pathStart < 0)
+        return head;
+    const tailAt = head.slice(pathStart).search(/[?#]/);
+    const pathEnd = tailAt < 0 ? head.length : pathStart + tailAt;
+    const path = head
+        .slice(pathStart, pathEnd)
+        .split("/")
+        .map((seg) => {
+        // `<token>.ics`: judge the name, keep the extension.
+        const dot = seg.indexOf(".");
+        const name = dot < 0 ? seg : seg.slice(0, dot);
+        return isSecretSegment(name) ? REDACTED + (dot < 0 ? "" : seg.slice(dot)) : seg;
+    })
+        .join("/");
+    return head.slice(0, pathStart) + path + head.slice(pathEnd);
+}
 /**
  * Scrub secrets from a log line. Deliberately over-eager: a 64-hex event id
  * is hidden along with a hex private key, because the two look alike.
@@ -54,7 +105,9 @@ export function redact(message) {
     let out = message
         .replace(NSEC, REDACTED)
         .replace(BEARER, `Bearer ${REDACTED}`)
-        .replace(FIELD_VALUE, scrubbed);
+        .replace(URL_IN_TEXT, scrubUrl)
+        .replace(FIELD_VALUE, scrubbed)
+        .replace(URL_SECRET_PARAM, `$1${REDACTED}`);
     if (HAS_FIELD.test(out))
         out = out.replace(CREDENTIAL_VALUE, scrubbed);
     return out.replace(HEX_KEY, REDACTED);
@@ -108,19 +161,9 @@ function hydrate() {
         return [];
     }
 }
-/**
- * The patron's display zone, if the site stores one under `<prefix>:timezone`
- * ("auto" or absent means the browser's own), so stamps match the rest of the UI.
- */
+/** In the patron's display zone (`timezone.ts`), so stamps match the rest of the UI. */
 function stamp(now) {
-    try {
-        const pref = readLocal("timezone");
-        const zone = pref && pref !== "auto" ? pref : undefined;
-        return now.toLocaleTimeString(undefined, zone ? { timeZone: zone } : undefined);
-    }
-    catch {
-        return now.toLocaleTimeString();
-    }
+    return now.toLocaleTimeString(undefined, { timeZone: displayTimeZone() });
 }
 function emit() {
     save();

package/dist/funding.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Funding and credential health as uniform rows, for a patron and for the
+ * operator. Framework-free, so every rule is tested without React or a server.
+ *
+ * Lifted from eXcalibur's `lib/fundingStatus.ts`, keeping its three rules:
+ *   1. No prices — balances and expiries only.
+ *   2. No warning outlives its cause — every row is derived fresh from the
+ *      latest tool answers, and carries the time it was checked.
+ *   3. Compose, don't invent — every input is a field a standard tool already
+ *      returns (check_balance, check_proof_status, session_status,
+ *      service_status, get_operator_onboarding_status, check_authority_balance).
+ *
+ * Three states: ok (working now), warning (will stop on a known date, or
+ * incomplete but not fatal), blocked (stopping work now).
+ */
+import type { CheckBalanceResult, OperatorOnboardingStatus, ServiceStatus, SessionStatusResult } from "./standardTools.ts";
+export type StatusLevel = "ok" | "warning" | "blocked";
+export interface StatusRow {
+    /** Stable key for lists and tests. */
+    id: string;
+    /** What the row is about: "Sign-in proof", "Authority balance", … */
+    dependency: string;
+    state: StatusLevel;
+    /** One line; never a price. */
+    detail: string;
+    /** ISO time of the read that produced the row. */
+    checked_at: string;
+}
+/**
+ * When a balance reads as trouble: at or below `empty` it is blocked, at or
+ * below `low` a warning. Default both 0 — only an empty balance is flagged.
+ */
+export interface BalanceThresholds {
+    low?: number;
+    empty?: number;
+}
+/** How this tab proves who it is. */
+export type ProofKind = {
+    kind: "session_nsec";
+} | {
+    kind: "dm_proof";
+    status: "valid" | "expired" | "unknown";
+    expiresInSec?: number | null;
+} | {
+    kind: "none";
+};
+/** A tranche or proof ending within this window is a warning. */
+export declare const WARNING_WITHIN_MS: number;
+/** The worst state across rows — for a heading's summary mark. */
+export declare function worstState(rows: readonly StatusRow[]): StatusLevel;
+/** "3d", "5h", "12m", "now". */
+export declare function durationText(sec: number): string;
+/** The sign-in proof: a lapsed one drops the patron mid-session. */
+export declare function composeProofRow(proof: ProofKind, checkedAt: string): StatusRow;
+/** The patron's balance and the expiry of its tranches — unused credits evaporate. */
+export declare function composeCreditsRow(bal: CheckBalanceResult, checkedAt: string, thresholds?: BalanceThresholds, nowMs?: number): StatusRow;
+/**
+ * Is the signed-in npub this operator? The rule every copy used: the patron's
+ * npub must equal the operator npub the server reports (`session_status`).
+ * It only decides what a page shows — the server still enforces its own ACL.
+ */
+export declare function isOperator(npub: string, status: Pick<SessionStatusResult, "operator_npub"> | null | undefined): boolean;
+/** The credentials the operator still has to deliver by Secure Courier. */
+export declare function composeOnboardingRow(onb: OperatorOnboardingStatus, checkedAt: string): StatusRow;
+/** The operator's balance at its Authority — what certifies patron top-ups. */
+export declare function composeAuthorityRow(bal: CheckBalanceResult, checkedAt: string, thresholds?: BalanceThresholds): StatusRow;
+/** The operator's database, from `session_status`'s lifecycle and the vault. */
+export declare function composePersistenceRow(life: SessionStatusResult, svc: ServiceStatus, onb: OperatorOnboardingStatus, checkedAt: string): StatusRow;
+/**
+ * Background-job dispatch, for an operator that runs any: null when
+ * `service_status` carries no job diagnostics (the server runs none).
+ */
+export declare function composeDurableJobsRow(svc: ServiceStatus, checkedAt: string): StatusRow | null;

package/dist/funding.js

@@ -0,0 +1,160 @@
+/**
+ * Funding and credential health as uniform rows, for a patron and for the
+ * operator. Framework-free, so every rule is tested without React or a server.
+ *
+ * Lifted from eXcalibur's `lib/fundingStatus.ts`, keeping its three rules:
+ *   1. No prices — balances and expiries only.
+ *   2. No warning outlives its cause — every row is derived fresh from the
+ *      latest tool answers, and carries the time it was checked.
+ *   3. Compose, don't invent — every input is a field a standard tool already
+ *      returns (check_balance, check_proof_status, session_status,
+ *      service_status, get_operator_onboarding_status, check_authority_balance).
+ *
+ * Three states: ok (working now), warning (will stop on a known date, or
+ * incomplete but not fatal), blocked (stopping work now).
+ */
+/** A tranche or proof ending within this window is a warning. */
+export const WARNING_WITHIN_MS = 48 * 60 * 60 * 1000;
+const RANK = { ok: 0, warning: 1, blocked: 2 };
+/** The worst state across rows — for a heading's summary mark. */
+export function worstState(rows) {
+    return rows.reduce((w, r) => (RANK[r.state] > RANK[w] ? r.state : w), "ok");
+}
+/** "3d", "5h", "12m", "now". */
+export function durationText(sec) {
+    if (sec <= 0)
+        return "now";
+    const h = Math.floor(sec / 3600);
+    if (h >= 48)
+        return `${Math.floor(h / 24)}d`;
+    if (h >= 1)
+        return `${h}h`;
+    return `${Math.max(1, Math.floor(sec / 60))}m`;
+}
+function row(id, dependency, state, detail, checked_at) {
+    return { id, dependency, state, detail, checked_at };
+}
+function sats(n) {
+    return `${n.toLocaleString()} sats`;
+}
+// ── Patron ──────────────────────────────────────────────────────────────────
+/** The sign-in proof: a lapsed one drops the patron mid-session. */
+export function composeProofRow(proof, checkedAt) {
+    const r = (state, detail) => row("npub-proof", "Sign-in proof", state, detail, checkedAt);
+    if (proof.kind === "session_nsec")
+        return r("ok", "This tab's session key signs a fresh proof on every call — no expiry.");
+    if (proof.kind === "none")
+        return r("blocked", "No proof on hand — sign in again.");
+    if (proof.status === "expired")
+        return r("blocked", "Proof has expired — sign in again to resume paid calls.");
+    if (proof.status === "unknown")
+        return r("warning", "No server-side proof record — the next paid call may ask you to sign in again.");
+    const sec = proof.expiresInSec;
+    if (sec != null && sec * 1000 < WARNING_WITHIN_MS)
+        return r("warning", `Proof valid — expires in about ${durationText(sec)}.`);
+    return r("ok", sec != null && sec > 0 ? `Proof valid — expires in about ${durationText(sec)}.` : "Proof valid.");
+}
+/** The patron's balance and the expiry of its tranches — unused credits evaporate. */
+export function composeCreditsRow(bal, checkedAt, thresholds = {}, nowMs = Date.now()) {
+    const r = (state, detail) => row("credits", "Credit balance", state, detail, checkedAt);
+    if (bal.vault_unavailable)
+        return r("warning", bal.warning || "The ledger is unavailable — the balance may be stale. Retry shortly.");
+    if (bal.error)
+        return r("warning", bal.error);
+    const { low = 0, empty = 0 } = thresholds;
+    const balance = bal.balance_api_sats ?? 0;
+    if (balance <= empty)
+        return r("blocked", `${balance > 0 ? `Only ${sats(balance)} left` : "Balance is empty"} — top up before paid calls will succeed.`);
+    const next = Date.parse(bal.next_expiration_iso ?? "");
+    const expiresInMs = Number.isNaN(next) ? null : next - nowMs;
+    if (expiresInMs != null && expiresInMs <= 0)
+        return r("warning", `${sats(balance)} on hand — a tranche is at or past expiry.`);
+    const expiring = bal.expiring_within_24h_sats ?? 0;
+    if ((expiresInMs != null && expiresInMs < WARNING_WITHIN_MS) || expiring > 0) {
+        const when = expiresInMs != null ? `next expiry in about ${durationText(Math.floor(expiresInMs / 1000))}` : "tranches expire within 24h";
+        const howMuch = expiring > 0 ? `${sats(expiring)} expiring; ` : "";
+        return r("warning", `${sats(balance)} on hand — ${howMuch}${when}. Unused credits evaporate.`);
+    }
+    if (balance <= low)
+        return r("warning", `${sats(balance)} on hand — running low.`);
+    const tranches = bal.active_tranches ?? 0;
+    return r("ok", `${sats(balance)} · ${tranches} active tranche${tranches === 1 ? "" : "s"}.`);
+}
+// ── Operator ────────────────────────────────────────────────────────────────
+/**
+ * Is the signed-in npub this operator? The rule every copy used: the patron's
+ * npub must equal the operator npub the server reports (`session_status`).
+ * It only decides what a page shows — the server still enforces its own ACL.
+ */
+export function isOperator(npub, status) {
+    return !!npub && npub === status?.operator_npub;
+}
+/** The credentials the operator still has to deliver by Secure Courier. */
+export function composeOnboardingRow(onb, checkedAt) {
+    const r = (state, detail) => row("credentials", "Operator credentials", state, detail, checkedAt);
+    if (onb.vault_situation)
+        return r("warning", onb.vault_situation);
+    if (onb.error)
+        return r("warning", onb.error);
+    const missing = (onb.missing ?? []).map((m) => m.field);
+    if (missing.length)
+        return r("blocked", `Missing via Secure Courier: ${missing.join(", ")}.`);
+    const optional = (onb.optional_missing ?? []).map((m) => m.field);
+    if (optional.length)
+        return r("warning", `Optional, not delivered: ${optional.join(", ")}.`);
+    if (onb.ready)
+        return r("ok", "Every required credential is delivered.");
+    return r("warning", onb.summary || "Couldn't tell which credentials are delivered.");
+}
+/** The operator's balance at its Authority — what certifies patron top-ups. */
+export function composeAuthorityRow(bal, checkedAt, thresholds = {}) {
+    const r = (state, detail) => row("authority-balance", "Authority balance", state, detail, checkedAt);
+    if (bal.success === false || bal.error)
+        return r("warning", bal.error || "Authority balance check failed.");
+    const balance = bal.balance_api_sats;
+    if (balance == null)
+        return r("warning", "The Authority did not return a balance.");
+    const { low = 0, empty = 0 } = thresholds;
+    if (balance <= empty)
+        return r("blocked", "Tax balance is empty — patron top-ups cannot be certified until you fund the Authority.");
+    if (balance <= low)
+        return r("warning", `${sats(balance)} left to certify patron purchases — running low.`);
+    return r("ok", `${sats(balance)} available to certify patron purchases.`);
+}
+/** The operator's database, from `session_status`'s lifecycle and the vault. */
+export function composePersistenceRow(life, svc, onb, checkedAt) {
+    const r = (state, detail) => row("persistence", "Neon persistence", state, detail, checkedAt);
+    const lc = life.lifecycle;
+    if (lc === "quota_exceeded")
+        return r("blocked", life.message || "Database quota exceeded — paid tools are locked until capacity is restored.");
+    if (lc === "misconfigured")
+        return r("blocked", life.message || "Persistence misconfigured — repair the database before paid tools will work.");
+    if (lc === "warming_up" || lc === "not_registered" || lc === "no_identity")
+        return r("warning", life.message || `Operator lifecycle: ${lc}.`);
+    if (svc.vault_configured === false || onb.vault_ok === false)
+        return r("blocked", "The vault is not configured — the operator cannot serve paid calls.");
+    return r("ok", lc ? `Lifecycle ${lc} — vault reachable.` : "Vault reachable.");
+}
+/**
+ * Background-job dispatch, for an operator that runs any: null when
+ * `service_status` carries no job diagnostics (the server runs none).
+ */
+export function composeDurableJobsRow(svc, checkedAt) {
+    const dj = svc.durable_jobs;
+    const aj = svc.async_jobs;
+    if (!dj && !aj)
+        return null;
+    const r = (state, detail) => row("durable-jobs", "Durable job dispatch", state, detail, checkedAt);
+    if (dj?.detached_executor_error)
+        return r("blocked", `Detached executor error: ${dj.detached_executor_error}`);
+    const active = !!dj?.detached_executor_active;
+    const resolved = dj?.detached_executor_resolved !== false;
+    const durable = aj?.durable_across_recycles;
+    if (active && resolved && durable !== false)
+        return r("ok", `Detached executor active${aj?.backend ? ` · docket ${aj.backend}` : ""}.`);
+    if (active && durable === false)
+        return r("warning", "The executor is up, but the job backend does not survive a recycle — long jobs may be lost.");
+    if (!active)
+        return r("warning", "In-process jobs only — a long job may be cut off by a recycle.");
+    return r("warning", "Detached executor present but not fully resolved.");
+}

package/dist/index.d.ts

@@ -15,6 +15,10 @@ export { isTransportFailure } from "./networkError.ts";
 export * from "./wallet.ts";
 export * from "./table.ts";
 export * from "./theme.ts";
+export * from "./timezone.ts";
+export { usageFacts, type ToolSpend, type UsageFacts } from "./usage.ts";
+export { buildFacts, type BuildFacts } from "./buildInfo.ts";
+export * from "./funding.ts";
 export { errorReport } from "./errorReport.ts";
 export { loadQuotes, peekQuotes, shuffle, validQuotes, type Quote } from "./quotes.ts";
 export { captureGlobalErrors, clearDebug, configureDebugLog, debugEntries, debugLogText, debugPush, debugSeverity, onDebug, redact, type DebugEntry, type DebugLogOptions, type DebugSeverity, } from "./debugLog.ts";

package/dist/index.js

@@ -14,6 +14,10 @@ export { isTransportFailure } from "./networkError.js";
 export * from "./wallet.js";
 export * from "./table.js";
 export * from "./theme.js";
+export * from "./timezone.js";
+export { usageFacts } from "./usage.js";
+export { buildFacts } from "./buildInfo.js";
+export * from "./funding.js";
 export { errorReport } from "./errorReport.js";
 export { loadQuotes, peekQuotes, shuffle, validQuotes } from "./quotes.js";
 export { captureGlobalErrors, clearDebug, configureDebugLog, debugEntries, debugLogText, debugPush, debugSeverity, onDebug, redact, } from "./debugLog.js";

package/dist/react/BuildInfoPanel.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Build & license: what is running and under what terms — the front end's
+ * version and commit (the site's, passed in, since only its bundler knows
+ * them), the MCP server's version, wheel and deployed commit linked to its
+ * repository (from `service_status`), the Tollbooth-DPYC™ links, the licence,
+ * and the patent and trademark notice.
+ *
+ * Mechanics only: every visual choice is the site's, through `classNames`;
+ * `intro` carries the site's own words and `children` any rows of its own,
+ * drawn after the MCP server section. Pass `status` when the site already
+ * holds a `service_status` answer; without it the panel asks once.
+ */
+import { type ReactNode } from "react";
+import { type ServiceStatus } from "../standardTools.ts";
+export interface BuildInfoFrontend {
+    version?: string;
+    commit?: string;
+    builtAt?: string;
+    /** The front end's repository, an https URL. */
+    source?: string;
+}
+export interface BuildInfoLicence {
+    name: string;
+    href?: string;
+}
+export interface BuildInfoPanelClassNames {
+    root?: string;
+    heading?: string;
+    intro?: string;
+    /** Each section's label: Frontend, MCP server, … */
+    section?: string;
+    row?: string;
+    label?: string;
+    value?: string;
+    /** Added to a value that is a link. */
+    link?: string;
+}
+export interface BuildInfoPanelProps {
+    /** A `service_status` answer the site already has; omitted, the panel fetches one. */
+    status?: ServiceStatus | null;
+    frontend?: BuildInfoFrontend;
+    /** Default "Build & license". */
+    heading?: ReactNode;
+    intro?: ReactNode;
+    /** Default Apache 2.0, the licence of every DPYC repository. */
+    licence?: BuildInfoLicence;
+    children?: ReactNode;
+    classNames?: BuildInfoPanelClassNames;
+}
+export default function BuildInfoPanel({ status, frontend, heading, intro, licence, children, classNames: c, }: BuildInfoPanelProps): import("react").JSX.Element;