Let sponsors request a dataset from the Space, once DataBounty takes requests

README.md

@@ -1,135 +1,141 @@
----
-title: DataBounty
-emoji: 🧭
-colorFrom: green
-colorTo: blue
-sdk: gradio
-sdk_version: 6.30.0
-python_version: "3.12"
-app_file: app.py
-short_description: Contribute and review dataset items, karma and MCP tools
-license: apache-2.0
-pinned: true
-tags:
-  - datasets
-  - data-collection
-  - crowdsourcing
-  - mcp-server
-datasets:
-  - databounty-io/graphql-schema-resolver-execution-validation-cmskdigf
-  - databounty-io/build-competitive-programming-problem-dataset-cmsokff2
-  - databounty-io/regex-pattern-generation-with-verified-match-sets-cmskdvm7
-  - databounty-io/extract-metrics-from-log-fixtures-cmskdlip
-  - databounty-io/python-execution-trace-output-prediction-cmskdimp
-  - databounty-io/python-data-transformation-scripts-cmskdijz
----
-
-# DataBounty
-
-A live window onto [DataBounty](https://databounty.io), the open-source, karma-based platform where the community
-builds datasets, and a place to contribute to it. Sponsors request a dataset, contributors submit items, automated checks validate each
-submission and human validators review the results. Finished datasets are published here on the Hub under
-[databounty-io](https://huggingface.co/databounty-io), with contributor credit.
-
-## What's inside
-
-It looks and works like the console on databounty.io:
-
-- **Contribute**: your karma, every open pool, and your submissions. Open a pool to see what it wants and how items
-  are checked, then add items one at a time or many from a file.
-- **Validate**: review other people's items. Claim an open audit, check each item against the pool's spec and its
-  automated checks, then approve it or reject it with a reason and a note for the contributor.
-- **Sponsor**: how requesting a dataset works, with links to make and track requests on databounty.io. If you
-  requested a pool, its page here also shows you every item in it, and you can dispute an accepted one.
-- **Datasets**: DataBounty releases on the Hub, with download counts.
-- **Leaderboard**: public karma standings and profiles. Private profiles, and any field a member hides, are never shown.
-- **API & MCP**: connect Claude, Cursor or VS Code to DataBounty's own MCP server.
-- **About**: live programme totals, the karma tiers and how it all works.
-
-## Contributing from the Space
-
-Press **sign in with DataBounty** and sign in with your DataBounty account, then approve the Space. On the Space's
-own page, sign-in happens in the same tab. On the huggingface.co page, a small sign-in window opens and closes itself
-when you're done, and the page signs you in where you are. The Space asks for six permissions: read pools and your
-own items, contribute items, review other people's items, see the items in pools you requested, upload files for
-file fields, and set up your account on first sign-in. You can untick any of them, but the Space can't contribute
-without *contribute*, review without *validate*, or show your pools' items without *sponsor*.
-
-Then pick a pool, and add one item with the form or many at once from a JSONL, JSON, CSV or TSV file (there's a
-template to start from). A file is checked row by row before anything is sent. Each pool shows an example item when
-it has one, and its full requirements one click away. **My submissions** shows where each item stands, check by check.
-
-- DataBounty takes items only from accounts with a verified email and a public username. The Space walks you through
-  both on first sign-in. Choosing a username makes your profile public at `databounty.io/<username>` straight away.
-- Your DataBounty tokens stay in the Space's memory and are never written to disk or sent to your browser, which
-  keeps only a random key to them. Signing out revokes the tokens. A restart of the Space signs everyone out.
-- Revisions, contesting a reviewer's verdict, and requesting a dataset happen on [databounty.io](https://databounty.io).
-
-## Reviewing from the Space
-
-Open **Validate** and claim an open audit: a few items from one pool, yours for 24 hours. You never get your own work.
-Go through the items one at a time and approve each one, or reject it with a reason and a note of at least 10
-characters, which is all the contributor sees. Decisions are final. You earn karma for every decision when the audit
-completes, and your validator rank sets how many audits you can hold at once.
-
-## Sponsoring from the Space
-
-Requesting a dataset happens on [databounty.io](https://console.databounty.io/sponsor/create/). Once your pool is
-open, sign in here and open the pool's page: below its details you see every item in it, newest first, with its
-fields, its automated checks and any reviewer flags, and you can filter by where items stand. While an accepted
-item's dispute window is open, you can dispute it with a reason and an explanation of at least 10 characters. An
-admin decides, and the contributor's karma is only reversed if the dispute is upheld. Nobody else sees this view:
-DataBounty shows a pool's items only to the person who requested it.
-
-## Use it from an agent
-
-This Space is also an MCP server:
-
-```text
-https://databounty-io-databounty.hf.space/gradio_api/mcp/
-```
-
-- **Six tools browse, with nothing to set up:** `get_platform_stats`, `search_open_pools`, `get_pool_details`,
-  `list_published_datasets`, `get_karma_leaderboard` and `get_contributor_profile`.
-- **Five tools submit items as you:** `get_my_account`, `get_pool_contract`, `submit_items`,
-  `list_my_submissions` and `check_submission`. They need a DataBounty API key:
-  1. Create one at [console.databounty.io/developers](https://console.databounty.io/developers/) with the
-     **contribute** scope.
-  2. Add it to your MCP client's settings for this server as the `X-DataBounty-Key` header. It never goes in a
-     message or a tool argument, so the model never sees it.
-
-  The Space passes the key to DataBounty for each call and keeps nothing. Revoke it on DataBounty any time.
-- **Two tools for sponsors:** `get_pool_items_as_sponsor` lists the items in a pool you requested, with their
-  checks, and `dispute_accepted_item` disputes an accepted one. They need a key with the **sponsor** scope and
-  work only on your own pools.
-
-Claude Code:
-
-```bash
-claude mcp add --transport http databounty-space https://databounty-io-databounty.hf.space/gradio_api/mcp/ \
-  --header "X-DataBounty-Key: db_live_sk_..."
-```
-
-Cursor (`~/.cursor/mcp.json`):
-
-```json
-{ "mcpServers": { "databounty-space": {
-  "url": "https://databounty-io-databounty.hf.space/gradio_api/mcp/",
-  "headers": { "X-DataBounty-Key": "db_live_sk_..." } } } }
-```
-
-An agent submits at most a pool's per-call limit at once; for more, upload a file on the Space's pool page. The
-Hub prefixes each tool name with the Space name (`DataBounty_submit_items` and so on). Reviewing other people's
-items, and items with files, go through DataBounty's own MCP server at `https://console.databounty.io/mcp`, which
-signs in with OAuth; setup for each client is on [databounty.io/agents](https://databounty.io/agents/).
-
-## Data
-
-Browsing reads DataBounty's public API (`api.databounty.io`) and the Hub, caching responses for about two minutes,
-and stores nothing about visitors. When you sign in, the Space acts for you through DataBounty's MCP server, and only
-when you press a button. Files you attach pass straight through to DataBounty: the Space doesn't keep them.
-
-## Source
-
-Apache-2.0. The code lives in [Databounty-io/databounty](https://github.com/Databounty-io/databounty) under
-`deploy/huggingface/databounty`.
+---
+title: DataBounty
+emoji: 🧭
+colorFrom: green
+colorTo: blue
+sdk: gradio
+sdk_version: 6.30.0
+python_version: "3.12"
+app_file: app.py
+short_description: Contribute and review dataset items, karma and MCP tools
+license: apache-2.0
+pinned: true
+tags:
+  - datasets
+  - data-collection
+  - crowdsourcing
+  - mcp-server
+datasets:
+  - databounty-io/graphql-schema-resolver-execution-validation-cmskdigf
+  - databounty-io/build-competitive-programming-problem-dataset-cmsokff2
+  - databounty-io/regex-pattern-generation-with-verified-match-sets-cmskdvm7
+  - databounty-io/extract-metrics-from-log-fixtures-cmskdlip
+  - databounty-io/python-execution-trace-output-prediction-cmskdimp
+  - databounty-io/python-data-transformation-scripts-cmskdijz
+---
+
+# DataBounty
+
+A live window onto [DataBounty](https://databounty.io), the open-source, karma-based platform where the community
+builds datasets, and a place to contribute to it. Sponsors request a dataset, contributors submit items, automated checks validate each
+submission and human validators review the results. Finished datasets are published here on the Hub under
+[databounty-io](https://huggingface.co/databounty-io), with contributor credit.
+
+## What's inside
+
+It looks and works like the console on databounty.io:
+
+- **Contribute**: your karma, every open pool, and your submissions. Open a pool to see what it wants and how items
+  are checked, then add items one at a time or many from a file.
+- **Validate**: review other people's items. Claim an open audit, check each item against the pool's spec and its
+  automated checks, then approve it or reject it with a reason and a note for the contributor.
+- **Sponsor**: request a dataset, add example items to it and follow it through review. If you requested a pool,
+  its page here also shows you every item in it, and you can dispute an accepted one.
+- **Datasets**: DataBounty releases on the Hub, with download counts.
+- **Leaderboard**: public karma standings and profiles. Private profiles, and any field a member hides, are never shown.
+- **API & MCP**: connect Claude, Cursor or VS Code to DataBounty's own MCP server.
+- **About**: live programme totals, the karma tiers and how it all works.
+
+## Contributing from the Space
+
+Press **sign in with DataBounty** and sign in with your DataBounty account, then approve the Space. On the Space's
+own page, sign-in happens in the same tab. On the huggingface.co page, a small sign-in window opens and closes itself
+when you're done, and the page signs you in where you are. The Space asks for six permissions: read pools and your
+own items, contribute items, review other people's items, see the items in pools you requested, upload files for
+file fields, and set up your account on first sign-in. You can untick any of them, but the Space can't contribute
+without *contribute*, review without *validate*, or show your pools' items without *sponsor*.
+
+Then pick a pool, and add one item with the form or many at once from a JSONL, JSON, CSV or TSV file (there's a
+template to start from). A file is checked row by row before anything is sent. Each pool shows an example item when
+it has one, and its full requirements one click away. **My submissions** shows where each item stands, check by check.
+
+- DataBounty takes items only from accounts with a verified email and a public username. The Space walks you through
+  both on first sign-in. Choosing a username makes your profile public at `databounty.io/<username>` straight away.
+- Your DataBounty tokens stay in the Space's memory and are never written to disk or sent to your browser, which
+  keeps only a random key to them. Signing out revokes the tokens. A restart of the Space signs everyone out.
+- Revisions, contesting a reviewer's verdict, and requesting a dataset happen on [databounty.io](https://databounty.io).
+
+## Reviewing from the Space
+
+Open **Validate** and claim an open audit: a few items from one pool, yours for 24 hours. You never get your own work.
+Go through the items one at a time and approve each one, or reject it with a reason and a note of at least 10
+characters, which is all the contributor sees. Decisions are final. You earn karma for every decision when the audit
+completes, and your validator rank sets how many audits you can hold at once.
+
+## Sponsoring from the Space
+
+To request a dataset, open **Sponsor**, pick a dataset type, and say how many items you want, how hard, and under
+which licence. Then add up to three example items to the request, as JSON files (each request has a template to
+start from). DataBounty's team reviews the request and its examples, and the pool can open once one example is
+approved. **Your requests** shows where each one stands, with any note from the reviewer. Requesting from the
+Space needs DataBounty's request tool; where it isn't live yet, the Sponsor page links to
+[databounty.io](https://console.databounty.io/sponsor/create/) instead.
+
+Once your pool is open, sign in here and open the pool's page: below its details you see every item in it, newest first, with its
+fields, its automated checks and any reviewer flags, and you can filter by where items stand. While an accepted
+item's dispute window is open, you can dispute it with a reason and an explanation of at least 10 characters. An
+admin decides, and the contributor's karma is only reversed if the dispute is upheld. Nobody else sees this view:
+DataBounty shows a pool's items only to the person who requested it.
+
+## Use it from an agent
+
+This Space is also an MCP server:
+
+```text
+https://databounty-io-databounty.hf.space/gradio_api/mcp/
+```
+
+- **Six tools browse, with nothing to set up:** `get_platform_stats`, `search_open_pools`, `get_pool_details`,
+  `list_published_datasets`, `get_karma_leaderboard` and `get_contributor_profile`.
+- **Five tools submit items as you:** `get_my_account`, `get_pool_contract`, `submit_items`,
+  `list_my_submissions` and `check_submission`. They need a DataBounty API key:
+  1. Create one at [console.databounty.io/developers](https://console.databounty.io/developers/) with the
+     **contribute** scope.
+  2. Add it to your MCP client's settings for this server as the `X-DataBounty-Key` header. It never goes in a
+     message or a tool argument, so the model never sees it.
+
+  The Space passes the key to DataBounty for each call and keeps nothing. Revoke it on DataBounty any time.
+- **Two tools for sponsors:** `get_pool_items_as_sponsor` lists the items in a pool you requested, with their
+  checks, and `dispute_accepted_item` disputes an accepted one. They need a key with the **sponsor** scope and
+  work only on your own pools.
+
+Claude Code:
+
+```bash
+claude mcp add --transport http databounty-space https://databounty-io-databounty.hf.space/gradio_api/mcp/ \
+  --header "X-DataBounty-Key: db_live_sk_..."
+```
+
+Cursor (`~/.cursor/mcp.json`):
+
+```json
+{ "mcpServers": { "databounty-space": {
+  "url": "https://databounty-io-databounty.hf.space/gradio_api/mcp/",
+  "headers": { "X-DataBounty-Key": "db_live_sk_..." } } } }
+```
+
+An agent submits at most a pool's per-call limit at once; for more, upload a file on the Space's pool page. The
+Hub prefixes each tool name with the Space name (`DataBounty_submit_items` and so on). Reviewing other people's
+items, and items with files, go through DataBounty's own MCP server at `https://console.databounty.io/mcp`, which
+signs in with OAuth; setup for each client is on [databounty.io/agents](https://databounty.io/agents/).
+
+## Data
+
+Browsing reads DataBounty's public API (`api.databounty.io`) and the Hub, caching responses for about two minutes,
+and stores nothing about visitors. When you sign in, the Space acts for you through DataBounty's MCP server, and only
+when you press a button. Files you attach pass straight through to DataBounty: the Space doesn't keep them.
+
+## Source
+
+Apache-2.0. The code lives in [Databounty-io/databounty](https://github.com/Databounty-io/databounty) under
+`deploy/huggingface/databounty`.

account.py

@@ -1,518 +1,531 @@
-# SPDX-License-Identifier: Apache-2.0
-"""Signing in to DataBounty from the Space, and acting as the person who signed in.
-
-The Space is an OAuth 2.1 public client of DataBounty's MCP authorization server,
-whose endpoints it reads from the server's own metadata document. It identifies
-itself with a Client ID Metadata Document that it serves (/oauth/client-metadata.json),
-so there is no registration step and no client secret to keep.
-
-How a sign-in finishes where it started. Opened at its own address, the Space signs in
-in the same tab. Inside the huggingface.co embed it can't: the embed may open windows
-but not leave the page, and DataBounty's sign-in pages refuse to be framed. There it
-opens a small sign-in window, which closes itself when done.
-
-1. The page keeps a random secret in its own sessionStorage and starts the sign-in
-   with only the secret's hash (/oauth/start?n=<hash>). /oauth/start refuses a start
-   that didn't come from the Space's own page (Sec-Fetch-Site), so nobody can hand
-   someone a link that signs *them* in for the sender to collect.
-2. /oauth/start sets a short-lived, signed, httpOnly cookie holding the `state`, the
-   PKCE verifier and the hash, then sends the browser to DataBounty. The callback
-   accepts only a `state` matching that cookie, so it ties the round trip to the
-   browser that started it.
-3. The callback holds the new session under the hash for a few minutes
-   (hold_sign_in). The page that started it claims it with the secret itself
-   (claim_sign_in): nobody else has that secret, and it is never in a URL.
-4. The page keeps the session handle in its own localStorage and sends it as a
-   bearer token (webapi.py), not in a cookie: inside the embed, the Space's cookies
-   are third-party and most browsers withhold them.
-
-Starting a sign-in keeps nothing on the server, so hitting /oauth/start repeatedly
-cannot crowd out real sign-ins. Tokens never reach the browser: it holds only a
-random session handle. The access and refresh tokens stay in this process's memory,
-so a restart signs everyone out; nothing is written to disk.
-"""
-
-from __future__ import annotations
-
-import base64
-import hashlib
-import hmac
-import itertools
-import json
-import os
-import re
-import secrets
-import threading
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlencode, urlsplit
-
-import httpx
-
-DATABOUNTY_MCP_URL = os.environ.get("DATABOUNTY_MCP_URL", "https://console.databounty.io/mcp").rstrip("/")
-# Only for an upload URL DataBounty returns as a path (local storage); everything else goes through MCP.
-DATABOUNTY_API_URL = os.environ.get("DATABOUNTY_API_URL", "https://api.databounty.io").rstrip("/")
-SPACE_HOST = os.environ.get("SPACE_HOST", "databounty-io-databounty.hf.space")
-SPACE_URL = os.environ.get("SPACE_PUBLIC_URL", f"https://{SPACE_HOST}").rstrip("/")
-
-# DataBounty fetches this URL to learn who the Space is. DATABOUNTY_CLIENT_ID overrides it only for a
-# local run, where DataBounty refuses to fetch a localhost document and a registered client id is used.
-CLIENT_ID = os.environ.get("DATABOUNTY_CLIENT_ID") or f"{SPACE_URL}/oauth/client-metadata.json"
-REDIRECT_URI = f"{SPACE_URL}/oauth/callback"
-# Only what the Space's screens need: read pools and your own items, submit and
-# revise them, upload files for file fields, review other people's items, see the
-# items in a pool you requested, and set up a handle on first sign-in. Each is a
-# box the person can untick.
-SCOPES = "read contribute validate artifact sponsor account"
-
-LOGIN_COOKIE = "dbspace_login"
-LOGIN_TTL_SECONDS = 10 * 60
-SESSION_IDLE_SECONDS = 30 * 24 * 60 * 60
-MAX_SESSIONS = 20_000
-REFRESH_MARGIN_SECONDS = 60
-# How long a finished sign-in waits for the page that started it to claim it.
-CLAIM_TTL_SECONDS = 5 * 60
-_NONCE_HASH = re.compile(r"^[0-9a-f]{64}$")
-TIMEOUT = httpx.Timeout(20.0, connect=10.0)
-USER_AGENT = "databounty-space/1.0 (+https://huggingface.co/spaces/databounty-io/DataBounty)"
-
-# Secure cookies everywhere except a local run over plain http.
-COOKIE_SECURE = SPACE_URL.startswith("https://")
-# Signs the login cookie. A Space secret keeps sign-ins in flight valid across a
-# restart; without one, a restart only means starting that sign-in again.
-_COOKIE_KEY = (os.environ.get("SPACE_COOKIE_SECRET") or secrets.token_urlsafe(32)).encode()
-
-_client = httpx.Client(timeout=TIMEOUT, headers={"User-Agent": USER_AGENT})
-
-
-class SignInError(Exception):
-    """A sign-in that cannot complete, with a message fit to show the person."""
-
-
-class NotSignedIn(Exception):
-    """The session has no usable tokens left; the person has to sign in again."""
-
-
-class ToolError(Exception):
-    """DataBounty refused a tool call. The message is DataBounty's own, written for people."""
-
-    def __init__(self, message: str, code: str | None = None):
-        super().__init__(message)
-        self.code = code
-
-
-def client_metadata() -> dict[str, Any]:
-    """The Client ID Metadata Document DataBounty fetches to learn who this client is."""
-    return {
-        "client_id": CLIENT_ID,
-        "client_name": "DataBounty on Hugging Face",
-        "client_uri": "https://huggingface.co/spaces/databounty-io/DataBounty",
-        "redirect_uris": [REDIRECT_URI],
-        "grant_types": ["authorization_code", "refresh_token"],
-        "response_types": ["code"],
-        "token_endpoint_auth_method": "none",
-        "scope": SCOPES,
-    }
-
-
-_metadata: dict[str, Any] | None = None
-_metadata_at = 0.0
-_metadata_lock = threading.Lock()
-
-
-def server_metadata() -> dict[str, Any]:
-    """DataBounty's authorization server metadata (RFC 8414), cached for an hour."""
-    global _metadata, _metadata_at
-    with _metadata_lock:
-        if _metadata and time.monotonic() - _metadata_at < 3600:
-            return _metadata
-        origin = "{0.scheme}://{0.netloc}".format(urlsplit(DATABOUNTY_MCP_URL))
-        res = _client.get(f"{origin}/.well-known/oauth-authorization-server")
-        res.raise_for_status()
-        doc = res.json()
-        for key in ("issuer", "authorization_endpoint", "token_endpoint"):
-            if not isinstance(doc.get(key), str):
-                raise SignInError("DataBounty's sign-in service is misconfigured. Try again later.")
-        _metadata, _metadata_at = doc, time.monotonic()
-        return doc
-
-
-@dataclass
-class Session:
-    access_token: str
-    refresh_token: str | None
-    expires_at: float
-    scope: str
-    last_used: float = field(default_factory=time.time)
-    me: dict[str, Any] | None = None
-    lock: threading.Lock = field(default_factory=threading.Lock, repr=False)
-
-
-_sessions: dict[str, Session] = {}
-_store_lock = threading.Lock()
-
-
-def _digest(value: str) -> str:
-    return hashlib.sha256(value.encode()).hexdigest()
-
-
-def _prune(now: float) -> None:
-    for key in [k for k, s in _sessions.items() if now - s.last_used > SESSION_IDLE_SECONDS]:
-        _sessions.pop(key, None)
-
-
-def _seal(data: dict[str, Any]) -> str:
-    # Unpadded base64url plus a hex MAC: only characters a cookie may carry unquoted, so the
-    # value never relies on every proxy and client handling a quoted cookie correctly.
-    payload = base64.urlsafe_b64encode(json.dumps(data, separators=(",", ":")).encode()).rstrip(b"=").decode()
-    mac = hmac.new(_COOKIE_KEY, payload.encode(), hashlib.sha256).hexdigest()
-    return f"{payload}.{mac}"
-
-
-def _unseal(value: str | None) -> dict[str, Any] | None:
-    if not value or value.count(".") != 1:
-        return None
-    payload, mac = value.split(".")
-    expected = hmac.new(_COOKIE_KEY, payload.encode(), hashlib.sha256).hexdigest()
-    if not hmac.compare_digest(mac, expected):
-        return None
-    try:
-        data = json.loads(base64.urlsafe_b64decode(payload + "=" * (-len(payload) % 4)))
-    except ValueError:
-        return None
-    return data if isinstance(data, dict) else None
-
-
-def valid_nonce_hash(value: str | None) -> bool:
-    """Whether `value` looks like the SHA-256 hex digest a page sends to /oauth/start."""
-    return bool(value) and bool(_NONCE_HASH.match(value))
-
-
-def begin_sign_in(nonce_hash: str = "", popup: bool = False) -> tuple[str, str]:
-    """A new sign-in: (the URL to send the browser to, the login cookie that binds it to this browser).
-
-    `nonce_hash` is the hash of the starting page's secret, kept for claim_sign_in; `popup`
-    says the sign-in runs in its own small window, which the callback closes when done."""
-    meta = server_metadata()
-    state = secrets.token_urlsafe(32)
-    verifier = secrets.token_urlsafe(48)
-    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
-    cookie = _seal({"s": state, "v": verifier, "t": int(time.time()), "n": nonce_hash, "p": bool(popup)})
-    query = urlencode(
-        {
-            "response_type": "code",
-            "client_id": CLIENT_ID,
-            "redirect_uri": REDIRECT_URI,
-            "scope": SCOPES,
-            "state": state,
-            "code_challenge": challenge,
-            "code_challenge_method": "S256",
-            "resource": DATABOUNTY_MCP_URL,
-        }
-    )
-    return f"{meta['authorization_endpoint']}?{query}", cookie
-
-
-def _token_request(data: dict[str, str]) -> dict[str, Any]:
-    meta = server_metadata()
-    res = _client.post(meta["token_endpoint"], data={**data, "client_id": CLIENT_ID, "resource": DATABOUNTY_MCP_URL})
-    try:
-        body = res.json()
-    except ValueError:
-        body = {}
-    if res.status_code != 200 or not isinstance(body.get("access_token"), str):
-        raise SignInError(str(body.get("error_description") or body.get("error") or f"HTTP {res.status_code}"))
-    return body
-
-
-def complete_sign_in(query: dict[str, str], login_cookie: str | None) -> str:
-    """Finish the round trip that /oauth/start began. Returns the new session id."""
-    started = _unseal(login_cookie)
-    state = query.get("state") or ""
-    if not started or not state or not hmac.compare_digest(state, str(started.get("s", ""))):
-        raise SignInError("This sign-in was not started in this browser, or it expired. Start again from the Space.")
-    if time.time() - float(started.get("t", 0)) > LOGIN_TTL_SECONDS:
-        raise SignInError("This sign-in expired. Start again from the Space.")
-    if query.get("error"):
-        if query["error"] == "access_denied":
-            raise SignInError("You didn't approve the Space, so nothing was connected.")
-        raise SignInError(query.get("error_description") or "DataBounty couldn't complete the sign-in.")
-    meta = server_metadata()
-    # RFC 9207: the response names the server that issued it, so a code from a
-    # different authorization server can never be redeemed here by mistake.
-    if query.get("iss") and query["iss"] != meta["issuer"]:
-        raise SignInError("That sign-in came back from an unexpected server, so it was not used.")
-    code = query.get("code") or ""
-    if not code:
-        raise SignInError("DataBounty didn't return a sign-in code. Start again from the Space.")
-    try:
-        tokens = _token_request(
-            {"grant_type": "authorization_code", "code": code, "redirect_uri": REDIRECT_URI, "code_verifier": str(started["v"])}
-        )
-    except SignInError as exc:
-        raise SignInError(f"DataBounty didn't accept the sign-in ({exc}). Start again from the Space.") from exc
-    session = Session(
-        access_token=tokens["access_token"],
-        refresh_token=tokens.get("refresh_token"),
-        expires_at=time.time() + float(tokens.get("expires_in") or 3600),
-        scope=str(tokens.get("scope") or SCOPES),
-    )
-    session_id = secrets.token_urlsafe(32)
-    with _store_lock:
-        _prune(time.time())
-        if len(_sessions) >= MAX_SESSIONS:
-            oldest = min(_sessions, key=lambda key: _sessions[key].last_used)
-            _sessions.pop(oldest, None)
-        _sessions[_digest(session_id)] = session
-    return session_id
-
-
-def login_context(login_cookie: str | None) -> dict[str, Any]:
-    """What /oauth/start recorded about this sign-in: the page's secret hash and whether it runs in a window."""
-    started = _unseal(login_cookie) or {}
-    return {"n": str(started.get("n") or ""), "p": bool(started.get("p"))}
-
-
-_pending: dict[str, tuple[str, float]] = {}
-
-
-def hold_sign_in(nonce_hash: str, session_id: str) -> None:
-    """Keep a finished sign-in for the page that started it to claim."""
-    now = time.time()
-    with _store_lock:
-        for key in [k for k, (_, at) in _pending.items() if now - at > CLAIM_TTL_SECONDS]:
-            _pending.pop(key, None)
-        _pending[nonce_hash] = (session_id, now)
-
-
-def sign_in_ready(nonce_hash: str | None) -> bool:
-    """Whether a sign-in started with this hash has finished. Says nothing else, so it is safe to poll."""
-    if not valid_nonce_hash(nonce_hash):
-        return False
-    with _store_lock:
-        entry = _pending.get(nonce_hash)
-    return bool(entry) and time.time() - entry[1] <= CLAIM_TTL_SECONDS
-
-
-def claim_sign_in(nonce: str | None) -> str | None:
-    """The session a finished sign-in left for the page holding `nonce`, once. Only the page
-    that started the sign-in has the nonce; everyone else has at most its hash."""
-    if not nonce:
-        return None
-    with _store_lock:
-        entry = _pending.pop(_digest(nonce), None)
-    if not entry or time.time() - entry[1] > CLAIM_TTL_SECONDS:
-        return None
-    return entry[0]
-
-
-def session_for(session_id: str | None) -> Session | None:
-    if not session_id:
-        return None
-    with _store_lock:
-        session = _sessions.get(_digest(session_id))
-    if session:
-        session.last_used = time.time()
-    return session
-
-
-def sign_out(session_id: str | None) -> None:
-    """Forget the session here and revoke its tokens at DataBounty (best effort)."""
-    if not session_id:
-        return
-    with _store_lock:
-        session = _sessions.pop(_digest(session_id), None)
-    if not session:
-        return
-    endpoint = server_metadata().get("revocation_endpoint")
-    if not endpoint:
-        return
-    for token, hint in ((session.refresh_token, "refresh_token"), (session.access_token, "access_token")):
-        if token:
-            try:
-                _client.post(endpoint, data={"token": token, "token_type_hint": hint, "client_id": CLIENT_ID})
-            except httpx.HTTPError:
-                pass
-
-
-def _access_token(session: Session) -> str:
-    """A live access token, refreshed first when it is about to expire."""
-    with session.lock:
-        if session.expires_at - REFRESH_MARGIN_SECONDS > time.time():
-            return session.access_token
-        if not session.refresh_token:
-            raise NotSignedIn()
-        try:
-            tokens = _token_request({"grant_type": "refresh_token", "refresh_token": session.refresh_token})
-        except SignInError as exc:
-            raise NotSignedIn() from exc
-        session.access_token = tokens["access_token"]
-        # Refresh tokens rotate: keep the new one, the old one is now spent.
-        session.refresh_token = tokens.get("refresh_token") or session.refresh_token
-        session.expires_at = time.time() + float(tokens.get("expires_in") or 3600)
-        return session.access_token
-
-
-# --- Calling DataBounty's MCP tools as the signed-in person -------------------------------------
-
-MCP_PROTOCOL = "2026-07-28"
-_rpc_ids = itertools.count(1)
-
-
-def _rpc_body(text: str) -> dict[str, Any]:
-    """The JSON-RPC reply, whether DataBounty answered with plain JSON or a one-event SSE stream."""
-    trimmed = text.lstrip()
-    if trimmed.startswith("{"):
-        return json.loads(trimmed)
-    for line in text.splitlines():
-        line = line.strip()
-        if line.startswith("data:"):
-            return json.loads(line[len("data:"):].strip())
-    raise ToolError("DataBounty sent a reply the Space could not read. Try again.")
-
-
-def _post_tool(token: str, name: str, arguments: dict[str, Any] | None) -> httpx.Response:
-    """One tools/call to DataBounty's MCP server with this bearer token, in the stateless MCP
-    protocol: no handshake and no server-side MCP session to expire."""
-    payload = {
-        "jsonrpc": "2.0",
-        "id": next(_rpc_ids),
-        "method": "tools/call",
-        "params": {
-            "name": name,
-            "arguments": arguments or {},
-            "_meta": {
-                "io.modelcontextprotocol/protocolVersion": MCP_PROTOCOL,
-                "io.modelcontextprotocol/clientCapabilities": {},
-                "io.modelcontextprotocol/clientInfo": {"name": "databounty-hf-space", "version": "1.0.0"},
-            },
-        },
-    }
-    try:
-        return _client.post(
-            DATABOUNTY_MCP_URL,
-            json=payload,
-            headers={
-                "Authorization": f"Bearer {token}",
-                "Accept": "application/json, text/event-stream",
-                "MCP-Protocol-Version": MCP_PROTOCOL,
-                "Mcp-Method": "tools/call",
-                "Mcp-Name": name,
-            },
-        )
-    except httpx.HTTPError as exc:
-        raise ToolError("DataBounty didn't answer in time. Try again in a moment.") from exc
-
-
-def _tool_result(res: httpx.Response) -> Any:
-    """A tool's parsed result, or ToolError with DataBounty's own message. (401 is the caller's.)"""
-    if res.status_code == 429:
-        wait = res.headers.get("Retry-After", "a few")
-        raise ToolError(f"DataBounty is limiting requests right now. Try again in {wait} seconds.")
-    if res.status_code >= 400:
-        try:
-            detail = res.json()
-            message = detail.get("error_description") or detail.get("message") or detail.get("error")
-        except ValueError:
-            message = None
-        raise ToolError(str(message or f"DataBounty refused the request (HTTP {res.status_code})."))
-    body = _rpc_body(res.text)
-    if body.get("error"):
-        raise ToolError(str(body["error"].get("message") or "DataBounty refused the request."))
-    result = body.get("result") or {}
-    content = result.get("content") or [{}]
-    text = content[0].get("text", "") if isinstance(content[0], dict) else ""
-    if result.get("isError"):
-        raise ToolError(text or "DataBounty refused the request.")
-    try:
-        return json.loads(text)
-    except ValueError:
-        return text
-
-
-def call_tool(session: Session, name: str, arguments: dict[str, Any] | None = None) -> Any:
-    """Call one DataBounty tool as this session's person. Returns the tool's parsed result."""
-    for attempt in (1, 2):
-        res = _post_tool(_access_token(session), name, arguments)
-        if res.status_code == 401:
-            if attempt == 1:
-                # Revoked or expired early (another device signed out): refresh once and retry.
-                with session.lock:
-                    session.expires_at = 0
-                continue
-            raise NotSignedIn()
-        return _tool_result(res)
-    raise NotSignedIn()
-
-
-# DataBounty's personal API keys (apps/api services/api-keys.ts KEY_PREFIX). Only strings that
-# look like one are ever forwarded, so a token pasted into the wrong setting goes nowhere.
-API_KEY_PREFIX = "db_live_sk_"
-
-
-def call_tool_with_key(api_key: str, name: str, arguments: dict[str, Any] | None = None) -> Any:
-    """Call one DataBounty tool as the owner of a DataBounty API key (the agent tools in
-    agent_tools.py). The key is used for this one request, and never stored or logged; DataBounty
-    checks it, its scopes and its owner on every call."""
-    if not api_key.startswith(API_KEY_PREFIX):
-        raise NotSignedIn()
-    res = _post_tool(api_key, name, arguments)
-    if res.status_code == 401:
-        raise NotSignedIn()
-    return _tool_result(res)
-
-
-def upload_file(session: Session, bounty_id: str, path: str, filename: str, content_type: str) -> str:
-    """Upload one file for a file field and wait for DataBounty's scan. Returns the artifact id
-    that goes in the item's payload."""
-    data = Path(path).read_bytes()
-    slot = call_tool(
-        session,
-        "prepare_file_upload",
-        {
-            "filename": filename,
-            "contentType": content_type,
-            "kind": "submission_attachment",
-            "sizeBytes": len(data),
-            "checksumSha256": hashlib.sha256(data).hexdigest(),
-            "bountyId": bounty_id,
-        },
-    )
-    upload = slot.get("upload") or {}
-    # A reused slot is the same pending file with a fresh URL: it still needs the bytes.
-    url = str(upload.get("url") or "")
-    if url.startswith("/"):
-        url = f"{DATABOUNTY_API_URL}{url}"
-    try:
-        # A signed form POST: every policy field first, then the file as `file`.
-        res = _client.post(
-            url,
-            data=upload.get("fields") or {},
-            files={"file": (filename, data, content_type)},
-            timeout=httpx.Timeout(120.0, connect=10.0),
-        )
-    except httpx.HTTPError as exc:
-        raise ToolError(f"{filename} could not be uploaded. Try again.") from exc
-    if res.status_code >= 300:
-        raise ToolError(f"{filename} was refused by storage (HTTP {res.status_code}).")
-    file_id = slot.get("fileId") or slot.get("artifactId")
-    call_tool(session, "complete_file_upload", {"fileId": file_id})
-    deadline = time.time() + 120
-    while True:
-        status = call_tool(session, "get_file_status", {"fileId": file_id}) or {}
-        state = status.get("status")
-        if state == "ready":
-            return slot["artifactId"]
-        if state in {"quarantined", "deleted"}:
-            raise ToolError(f"{filename} did not pass DataBounty's file checks, so it can't be attached.")
-        progress = status.get("scanProgress") or {}
-        if progress.get("blocked"):
-            raise ToolError(f"{filename} is stuck in DataBounty's file scan and needs an operator. Try again later.")
-        # Pace by DataBounty's own estimate instead of polling blindly.
-        wait = (status.get("ingest") or {}).get("recheckAfterSeconds")
-        wait = min(max(float(wait), 2.0), 15.0) if isinstance(wait, (int, float)) else 3.0
-        if time.time() + wait > deadline:
-            raise ToolError(f"{filename} is still being checked. Submit again in a minute.")
-        time.sleep(wait)
+# SPDX-License-Identifier: Apache-2.0
+"""Signing in to DataBounty from the Space, and acting as the person who signed in.
+
+The Space is an OAuth 2.1 public client of DataBounty's MCP authorization server,
+whose endpoints it reads from the server's own metadata document. It identifies
+itself with a Client ID Metadata Document that it serves (/oauth/client-metadata.json),
+so there is no registration step and no client secret to keep.
+
+How a sign-in finishes where it started. Opened at its own address, the Space signs in
+in the same tab. Inside the huggingface.co embed it can't: the embed may open windows
+but not leave the page, and DataBounty's sign-in pages refuse to be framed. There it
+opens a small sign-in window, which closes itself when done.
+
+1. The page keeps a random secret in its own sessionStorage and starts the sign-in
+   with only the secret's hash (/oauth/start?n=<hash>). /oauth/start refuses a start
+   that didn't come from the Space's own page (Sec-Fetch-Site), so nobody can hand
+   someone a link that signs *them* in for the sender to collect.
+2. /oauth/start sets a short-lived, signed, httpOnly cookie holding the `state`, the
+   PKCE verifier and the hash, then sends the browser to DataBounty. The callback
+   accepts only a `state` matching that cookie, so it ties the round trip to the
+   browser that started it.
+3. The callback holds the new session under the hash for a few minutes
+   (hold_sign_in). The page that started it claims it with the secret itself
+   (claim_sign_in): nobody else has that secret, and it is never in a URL.
+4. The page keeps the session handle in its own localStorage and sends it as a
+   bearer token (webapi.py), not in a cookie: inside the embed, the Space's cookies
+   are third-party and most browsers withhold them.
+
+Starting a sign-in keeps nothing on the server, so hitting /oauth/start repeatedly
+cannot crowd out real sign-ins. Tokens never reach the browser: it holds only a
+random session handle. The access and refresh tokens stay in this process's memory,
+so a restart signs everyone out; nothing is written to disk.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import itertools
+import json
+import os
+import re
+import secrets
+import threading
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlencode, urlsplit
+
+import httpx
+
+DATABOUNTY_MCP_URL = os.environ.get("DATABOUNTY_MCP_URL", "https://console.databounty.io/mcp").rstrip("/")
+# Only for an upload URL DataBounty returns as a path (local storage); everything else goes through MCP.
+DATABOUNTY_API_URL = os.environ.get("DATABOUNTY_API_URL", "https://api.databounty.io").rstrip("/")
+SPACE_HOST = os.environ.get("SPACE_HOST", "databounty-io-databounty.hf.space")
+SPACE_URL = os.environ.get("SPACE_PUBLIC_URL", f"https://{SPACE_HOST}").rstrip("/")
+
+# DataBounty fetches this URL to learn who the Space is. DATABOUNTY_CLIENT_ID overrides it only for a
+# local run, where DataBounty refuses to fetch a localhost document and a registered client id is used.
+CLIENT_ID = os.environ.get("DATABOUNTY_CLIENT_ID") or f"{SPACE_URL}/oauth/client-metadata.json"
+REDIRECT_URI = f"{SPACE_URL}/oauth/callback"
+# Only what the Space's screens need: read pools and your own items, submit and
+# revise them, upload files for file fields, review other people's items, see the
+# items in a pool you requested, and set up a handle on first sign-in. Each is a
+# box the person can untick.
+SCOPES = "read contribute validate artifact sponsor account"
+
+LOGIN_COOKIE = "dbspace_login"
+LOGIN_TTL_SECONDS = 10 * 60
+SESSION_IDLE_SECONDS = 30 * 24 * 60 * 60
+MAX_SESSIONS = 20_000
+REFRESH_MARGIN_SECONDS = 60
+# How long a finished sign-in waits for the page that started it to claim it.
+CLAIM_TTL_SECONDS = 5 * 60
+_NONCE_HASH = re.compile(r"^[0-9a-f]{64}$")
+TIMEOUT = httpx.Timeout(20.0, connect=10.0)
+USER_AGENT = "databounty-space/1.0 (+https://huggingface.co/spaces/databounty-io/DataBounty)"
+
+# Secure cookies everywhere except a local run over plain http.
+COOKIE_SECURE = SPACE_URL.startswith("https://")
+# Signs the login cookie. A Space secret keeps sign-ins in flight valid across a
+# restart; without one, a restart only means starting that sign-in again.
+_COOKIE_KEY = (os.environ.get("SPACE_COOKIE_SECRET") or secrets.token_urlsafe(32)).encode()
+
+_client = httpx.Client(timeout=TIMEOUT, headers={"User-Agent": USER_AGENT})
+
+
+class SignInError(Exception):
+    """A sign-in that cannot complete, with a message fit to show the person."""
+
+
+class NotSignedIn(Exception):
+    """The session has no usable tokens left; the person has to sign in again."""
+
+
+class ToolError(Exception):
+    """DataBounty refused a tool call. The message is DataBounty's own, written for people."""
+
+    def __init__(self, message: str, code: str | None = None):
+        super().__init__(message)
+        self.code = code
+
+
+def client_metadata() -> dict[str, Any]:
+    """The Client ID Metadata Document DataBounty fetches to learn who this client is."""
+    return {
+        "client_id": CLIENT_ID,
+        "client_name": "DataBounty on Hugging Face",
+        "client_uri": "https://huggingface.co/spaces/databounty-io/DataBounty",
+        "redirect_uris": [REDIRECT_URI],
+        "grant_types": ["authorization_code", "refresh_token"],
+        "response_types": ["code"],
+        "token_endpoint_auth_method": "none",
+        "scope": SCOPES,
+    }
+
+
+_metadata: dict[str, Any] | None = None
+_metadata_at = 0.0
+_metadata_lock = threading.Lock()
+
+
+def server_metadata() -> dict[str, Any]:
+    """DataBounty's authorization server metadata (RFC 8414), cached for an hour."""
+    global _metadata, _metadata_at
+    with _metadata_lock:
+        if _metadata and time.monotonic() - _metadata_at < 3600:
+            return _metadata
+        origin = "{0.scheme}://{0.netloc}".format(urlsplit(DATABOUNTY_MCP_URL))
+        res = _client.get(f"{origin}/.well-known/oauth-authorization-server")
+        res.raise_for_status()
+        doc = res.json()
+        for key in ("issuer", "authorization_endpoint", "token_endpoint"):
+            if not isinstance(doc.get(key), str):
+                raise SignInError("DataBounty's sign-in service is misconfigured. Try again later.")
+        _metadata, _metadata_at = doc, time.monotonic()
+        return doc
+
+
+@dataclass
+class Session:
+    access_token: str
+    refresh_token: str | None
+    expires_at: float
+    scope: str
+    last_used: float = field(default_factory=time.time)
+    me: dict[str, Any] | None = None
+    lock: threading.Lock = field(default_factory=threading.Lock, repr=False)
+
+
+_sessions: dict[str, Session] = {}
+_store_lock = threading.Lock()
+
+
+def _digest(value: str) -> str:
+    return hashlib.sha256(value.encode()).hexdigest()
+
+
+def _prune(now: float) -> None:
+    for key in [k for k, s in _sessions.items() if now - s.last_used > SESSION_IDLE_SECONDS]:
+        _sessions.pop(key, None)
+
+
+def _seal(data: dict[str, Any]) -> str:
+    # Unpadded base64url plus a hex MAC: only characters a cookie may carry unquoted, so the
+    # value never relies on every proxy and client handling a quoted cookie correctly.
+    payload = base64.urlsafe_b64encode(json.dumps(data, separators=(",", ":")).encode()).rstrip(b"=").decode()
+    mac = hmac.new(_COOKIE_KEY, payload.encode(), hashlib.sha256).hexdigest()
+    return f"{payload}.{mac}"
+
+
+def _unseal(value: str | None) -> dict[str, Any] | None:
+    if not value or value.count(".") != 1:
+        return None
+    payload, mac = value.split(".")
+    expected = hmac.new(_COOKIE_KEY, payload.encode(), hashlib.sha256).hexdigest()
+    if not hmac.compare_digest(mac, expected):
+        return None
+    try:
+        data = json.loads(base64.urlsafe_b64decode(payload + "=" * (-len(payload) % 4)))
+    except ValueError:
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def valid_nonce_hash(value: str | None) -> bool:
+    """Whether `value` looks like the SHA-256 hex digest a page sends to /oauth/start."""
+    return bool(value) and bool(_NONCE_HASH.match(value))
+
+
+def begin_sign_in(nonce_hash: str = "", popup: bool = False) -> tuple[str, str]:
+    """A new sign-in: (the URL to send the browser to, the login cookie that binds it to this browser).
+
+    `nonce_hash` is the hash of the starting page's secret, kept for claim_sign_in; `popup`
+    says the sign-in runs in its own small window, which the callback closes when done."""
+    meta = server_metadata()
+    state = secrets.token_urlsafe(32)
+    verifier = secrets.token_urlsafe(48)
+    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
+    cookie = _seal({"s": state, "v": verifier, "t": int(time.time()), "n": nonce_hash, "p": bool(popup)})
+    query = urlencode(
+        {
+            "response_type": "code",
+            "client_id": CLIENT_ID,
+            "redirect_uri": REDIRECT_URI,
+            "scope": SCOPES,
+            "state": state,
+            "code_challenge": challenge,
+            "code_challenge_method": "S256",
+            "resource": DATABOUNTY_MCP_URL,
+        }
+    )
+    return f"{meta['authorization_endpoint']}?{query}", cookie
+
+
+def _token_request(data: dict[str, str]) -> dict[str, Any]:
+    meta = server_metadata()
+    res = _client.post(meta["token_endpoint"], data={**data, "client_id": CLIENT_ID, "resource": DATABOUNTY_MCP_URL})
+    try:
+        body = res.json()
+    except ValueError:
+        body = {}
+    if res.status_code != 200 or not isinstance(body.get("access_token"), str):
+        raise SignInError(str(body.get("error_description") or body.get("error") or f"HTTP {res.status_code}"))
+    return body
+
+
+def complete_sign_in(query: dict[str, str], login_cookie: str | None) -> str:
+    """Finish the round trip that /oauth/start began. Returns the new session id."""
+    started = _unseal(login_cookie)
+    state = query.get("state") or ""
+    if not started or not state or not hmac.compare_digest(state, str(started.get("s", ""))):
+        raise SignInError("This sign-in was not started in this browser, or it expired. Start again from the Space.")
+    if time.time() - float(started.get("t", 0)) > LOGIN_TTL_SECONDS:
+        raise SignInError("This sign-in expired. Start again from the Space.")
+    if query.get("error"):
+        if query["error"] == "access_denied":
+            raise SignInError("You didn't approve the Space, so nothing was connected.")
+        raise SignInError(query.get("error_description") or "DataBounty couldn't complete the sign-in.")
+    meta = server_metadata()
+    # RFC 9207: the response names the server that issued it, so a code from a
+    # different authorization server can never be redeemed here by mistake.
+    if query.get("iss") and query["iss"] != meta["issuer"]:
+        raise SignInError("That sign-in came back from an unexpected server, so it was not used.")
+    code = query.get("code") or ""
+    if not code:
+        raise SignInError("DataBounty didn't return a sign-in code. Start again from the Space.")
+    try:
+        tokens = _token_request(
+            {"grant_type": "authorization_code", "code": code, "redirect_uri": REDIRECT_URI, "code_verifier": str(started["v"])}
+        )
+    except SignInError as exc:
+        raise SignInError(f"DataBounty didn't accept the sign-in ({exc}). Start again from the Space.") from exc
+    session = Session(
+        access_token=tokens["access_token"],
+        refresh_token=tokens.get("refresh_token"),
+        expires_at=time.time() + float(tokens.get("expires_in") or 3600),
+        scope=str(tokens.get("scope") or SCOPES),
+    )
+    session_id = secrets.token_urlsafe(32)
+    with _store_lock:
+        _prune(time.time())
+        if len(_sessions) >= MAX_SESSIONS:
+            oldest = min(_sessions, key=lambda key: _sessions[key].last_used)
+            _sessions.pop(oldest, None)
+        _sessions[_digest(session_id)] = session
+    return session_id
+
+
+def login_context(login_cookie: str | None) -> dict[str, Any]:
+    """What /oauth/start recorded about this sign-in: the page's secret hash and whether it runs in a window."""
+    started = _unseal(login_cookie) or {}
+    return {"n": str(started.get("n") or ""), "p": bool(started.get("p"))}
+
+
+_pending: dict[str, tuple[str, float]] = {}
+
+
+def hold_sign_in(nonce_hash: str, session_id: str) -> None:
+    """Keep a finished sign-in for the page that started it to claim."""
+    now = time.time()
+    with _store_lock:
+        for key in [k for k, (_, at) in _pending.items() if now - at > CLAIM_TTL_SECONDS]:
+            _pending.pop(key, None)
+        _pending[nonce_hash] = (session_id, now)
+
+
+def sign_in_ready(nonce_hash: str | None) -> bool:
+    """Whether a sign-in started with this hash has finished. Says nothing else, so it is safe to poll."""
+    if not valid_nonce_hash(nonce_hash):
+        return False
+    with _store_lock:
+        entry = _pending.get(nonce_hash)
+    return bool(entry) and time.time() - entry[1] <= CLAIM_TTL_SECONDS
+
+
+def claim_sign_in(nonce: str | None) -> str | None:
+    """The session a finished sign-in left for the page holding `nonce`, once. Only the page
+    that started the sign-in has the nonce; everyone else has at most its hash."""
+    if not nonce:
+        return None
+    with _store_lock:
+        entry = _pending.pop(_digest(nonce), None)
+    if not entry or time.time() - entry[1] > CLAIM_TTL_SECONDS:
+        return None
+    return entry[0]
+
+
+def session_for(session_id: str | None) -> Session | None:
+    if not session_id:
+        return None
+    with _store_lock:
+        session = _sessions.get(_digest(session_id))
+    if session:
+        session.last_used = time.time()
+    return session
+
+
+def sign_out(session_id: str | None) -> None:
+    """Forget the session here and revoke its tokens at DataBounty (best effort)."""
+    if not session_id:
+        return
+    with _store_lock:
+        session = _sessions.pop(_digest(session_id), None)
+    if not session:
+        return
+    endpoint = server_metadata().get("revocation_endpoint")
+    if not endpoint:
+        return
+    for token, hint in ((session.refresh_token, "refresh_token"), (session.access_token, "access_token")):
+        if token:
+            try:
+                _client.post(endpoint, data={"token": token, "token_type_hint": hint, "client_id": CLIENT_ID})
+            except httpx.HTTPError:
+                pass
+
+
+def _access_token(session: Session) -> str:
+    """A live access token, refreshed first when it is about to expire."""
+    with session.lock:
+        if session.expires_at - REFRESH_MARGIN_SECONDS > time.time():
+            return session.access_token
+        if not session.refresh_token:
+            raise NotSignedIn()
+        try:
+            tokens = _token_request({"grant_type": "refresh_token", "refresh_token": session.refresh_token})
+        except SignInError as exc:
+            raise NotSignedIn() from exc
+        session.access_token = tokens["access_token"]
+        # Refresh tokens rotate: keep the new one, the old one is now spent.
+        session.refresh_token = tokens.get("refresh_token") or session.refresh_token
+        session.expires_at = time.time() + float(tokens.get("expires_in") or 3600)
+        return session.access_token
+
+
+# --- Calling DataBounty's MCP tools as the signed-in person -------------------------------------
+
+MCP_PROTOCOL = "2026-07-28"
+_rpc_ids = itertools.count(1)
+
+
+def _rpc_body(text: str) -> dict[str, Any]:
+    """The JSON-RPC reply, whether DataBounty answered with plain JSON or a one-event SSE stream."""
+    trimmed = text.lstrip()
+    if trimmed.startswith("{"):
+        return json.loads(trimmed)
+    for line in text.splitlines():
+        line = line.strip()
+        if line.startswith("data:"):
+            return json.loads(line[len("data:"):].strip())
+    raise ToolError("DataBounty sent a reply the Space could not read. Try again.")
+
+
+def _post_tool(token: str, name: str, arguments: dict[str, Any] | None) -> httpx.Response:
+    """One tools/call to DataBounty's MCP server with this bearer token, in the stateless MCP
+    protocol: no handshake and no server-side MCP session to expire."""
+    payload = {
+        "jsonrpc": "2.0",
+        "id": next(_rpc_ids),
+        "method": "tools/call",
+        "params": {
+            "name": name,
+            "arguments": arguments or {},
+            "_meta": {
+                "io.modelcontextprotocol/protocolVersion": MCP_PROTOCOL,
+                "io.modelcontextprotocol/clientCapabilities": {},
+                "io.modelcontextprotocol/clientInfo": {"name": "databounty-hf-space", "version": "1.0.0"},
+            },
+        },
+    }
+    try:
+        return _client.post(
+            DATABOUNTY_MCP_URL,
+            json=payload,
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Accept": "application/json, text/event-stream",
+                "MCP-Protocol-Version": MCP_PROTOCOL,
+                "Mcp-Method": "tools/call",
+                "Mcp-Name": name,
+            },
+        )
+    except httpx.HTTPError as exc:
+        raise ToolError("DataBounty didn't answer in time. Try again in a moment.") from exc
+
+
+def _tool_result(res: httpx.Response) -> Any:
+    """A tool's parsed result, or ToolError with DataBounty's own message. (401 is the caller's.)"""
+    if res.status_code == 429:
+        wait = res.headers.get("Retry-After", "a few")
+        raise ToolError(f"DataBounty is limiting requests right now. Try again in {wait} seconds.")
+    if res.status_code >= 400:
+        try:
+            detail = res.json()
+            message = detail.get("error_description") or detail.get("message") or detail.get("error")
+        except ValueError:
+            message = None
+        raise ToolError(str(message or f"DataBounty refused the request (HTTP {res.status_code})."))
+    body = _rpc_body(res.text)
+    if body.get("error"):
+        raise ToolError(str(body["error"].get("message") or "DataBounty refused the request."))
+    result = body.get("result") or {}
+    content = result.get("content") or [{}]
+    text = content[0].get("text", "") if isinstance(content[0], dict) else ""
+    if result.get("isError"):
+        raise ToolError(text or "DataBounty refused the request.")
+    try:
+        return json.loads(text)
+    except ValueError:
+        return text
+
+
+def call_tool(session: Session, name: str, arguments: dict[str, Any] | None = None) -> Any:
+    """Call one DataBounty tool as this session's person. Returns the tool's parsed result."""
+    for attempt in (1, 2):
+        res = _post_tool(_access_token(session), name, arguments)
+        if res.status_code == 401:
+            if attempt == 1:
+                # Revoked or expired early (another device signed out): refresh once and retry.
+                with session.lock:
+                    session.expires_at = 0
+                continue
+            raise NotSignedIn()
+        return _tool_result(res)
+    raise NotSignedIn()
+
+
+# DataBounty's personal API keys (apps/api services/api-keys.ts KEY_PREFIX). Only strings that
+# look like one are ever forwarded, so a token pasted into the wrong setting goes nowhere.
+API_KEY_PREFIX = "db_live_sk_"
+
+
+def call_tool_with_key(api_key: str, name: str, arguments: dict[str, Any] | None = None) -> Any:
+    """Call one DataBounty tool as the owner of a DataBounty API key (the agent tools in
+    agent_tools.py). The key is used for this one request, and never stored or logged; DataBounty
+    checks it, its scopes and its owner on every call."""
+    if not api_key.startswith(API_KEY_PREFIX):
+        raise NotSignedIn()
+    res = _post_tool(api_key, name, arguments)
+    if res.status_code == 401:
+        raise NotSignedIn()
+    return _tool_result(res)
+
+
+def upload_file(session: Session, bounty_id: str, path: str, filename: str, content_type: str) -> str:
+    """Upload one file for a file field and wait for DataBounty's scan. Returns the artifact id
+    that goes in the item's payload."""
+    file_id = _upload(session, {"kind": "submission_attachment", "bountyId": bounty_id}, path, filename, content_type)
+    deadline = time.time() + 120
+    while True:
+        status = call_tool(session, "get_file_status", {"fileId": file_id}) or {}
+        state = status.get("status")
+        if state == "ready":
+            return file_id
+        if state in {"quarantined", "deleted"}:
+            raise ToolError(f"{filename} did not pass DataBounty's file checks, so it can't be attached.")
+        progress = status.get("scanProgress") or {}
+        if progress.get("blocked"):
+            raise ToolError(f"{filename} is stuck in DataBounty's file scan and needs an operator. Try again later.")
+        # Pace by DataBounty's own estimate instead of polling blindly.
+        wait = (status.get("ingest") or {}).get("recheckAfterSeconds")
+        wait = min(max(float(wait), 2.0), 15.0) if isinstance(wait, (int, float)) else 3.0
+        if time.time() + wait > deadline:
+            raise ToolError(f"{filename} is still being checked. Submit again in a minute.")
+        time.sleep(wait)
+
+
+def upload_sample(session: Session, request_id: str, path: str, filename: str, content_type: str) -> str:
+    """Attach one reference sample (an example item) to the person's own dataset request. DataBounty
+    scans it in the background and an admin reviews it with the request, so this doesn't wait for
+    the scan. Returns its file id."""
+    return _upload(session, {"kind": "sponsor_reference", "datasetRequestId": request_id}, path, filename, content_type)
+
+
+def _upload(session: Session, target: dict[str, Any], path: str, filename: str, content_type: str) -> str:
+    """Upload one file to DataBounty for `target` (its kind and what it belongs to) and complete it.
+    Returns the file id; DataBounty starts its scan."""
+    data = Path(path).read_bytes()
+    slot = call_tool(
+        session,
+        "prepare_file_upload",
+        {
+            "filename": filename,
+            "contentType": content_type,
+            "sizeBytes": len(data),
+            "checksumSha256": hashlib.sha256(data).hexdigest(),
+            **target,
+        },
+    )
+    upload = slot.get("upload") or {}
+    # A reused slot is the same pending file with a fresh URL: it still needs the bytes.
+    url = str(upload.get("url") or "")
+    if url.startswith("/"):
+        url = f"{DATABOUNTY_API_URL}{url}"
+    try:
+        # A signed form POST: every policy field first, then the file as `file`.
+        res = _client.post(
+            url,
+            data=upload.get("fields") or {},
+            files={"file": (filename, data, content_type)},
+            timeout=httpx.Timeout(120.0, connect=10.0),
+        )
+    except httpx.HTTPError as exc:
+        raise ToolError(f"{filename} could not be uploaded. Try again.") from exc
+    if res.status_code >= 300:
+        raise ToolError(f"{filename} was refused by storage (HTTP {res.status_code}).")
+    file_id = str(slot.get("fileId") or slot.get("artifactId") or "")
+    call_tool(session, "complete_file_upload", {"fileId": file_id})
+    return file_id

databounty.py

@@ -1,426 +1,442 @@
-# SPDX-License-Identifier: Apache-2.0
-"""Read-only client for DataBounty's public API and the Hugging Face Hub.
-
-Everything here reads public data: the same unauthenticated endpoints that
-databounty.io renders from. Each response is kept in a small in-process cache
-for CACHE_TTL_SECONDS, so a burst of visitors, or an agent calling the MCP tools
-in a loop, never turns into a burst of upstream requests. Errors are never
-cached, so a recovered upstream is picked up on the next call.
-
-Profiles are read only from /v1/profiles/handle/:handle, which answers 404 for a
-private profile and leaves out every field the member chose to hide. Nothing
-here calls /v1/community/members/:handle, which applies neither rule.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import threading
-import time
-from collections import OrderedDict
-from collections.abc import Callable
-from typing import Any
-from urllib.parse import quote
-
-import httpx
-from huggingface_hub import HfApi
-
-API_URL = os.environ.get("DATABOUNTY_API_URL", "https://api.databounty.io").rstrip("/")
-SITE_URL = os.environ.get("DATABOUNTY_SITE_URL", "https://databounty.io").rstrip("/")
-APP_URL = os.environ.get("DATABOUNTY_APP_URL", "https://console.databounty.io").rstrip("/")
-HF_ORG = os.environ.get("DATABOUNTY_HF_ORG", "databounty-io")
-CACHE_TTL_SECONDS = float(os.environ.get("CACHE_TTL_SECONDS", "120"))
-
-# DataBounty's own MCP server. The dashboard origin proxies /mcp to the API, and
-# the API binds every OAuth credential to that origin, so this is the URL
-# clients must use (not API_URL).
-MCP_URL = f"{APP_URL}/mcp"
-
-DOMAINS = ("coding", "legal", "healthcare", "finance", "science")
-DIFFICULTIES = ("beginner", "intermediate", "advanced")
-TIERS = ("dharma", "bodhi", "moksha", "nirvana")
-
-# Same rule the dashboard applies when a member claims a handle.
-_HANDLE = re.compile(r"^[a-z0-9-]{3,20}$")
-_POOL_ID = re.compile(r"^[A-Za-z0-9_-]{1,64}$")
-_PROFILE_URL = re.compile(r"^(?:https?://)?(?:www\.)?databounty\.io/+@?([^/?#]+)/*$", re.IGNORECASE)
-_BADGE_STEP = re.compile(r"^(?P<ladder>.+)_(?P<value>\d+)$")
-
-_PAGE_SIZE = {"/v1/community/catalog": 100, "/v1/community/pools": 50}
-_MAX_PAGES = 5
-_CACHE_MAX_ENTRIES = 256
-
-
-class UpstreamError(RuntimeError):
-    """DataBounty's API could not be reached, or answered with an error."""
-
-
-_http = httpx.Client(
-    base_url=API_URL,
-    timeout=httpx.Timeout(15.0, connect=5.0),
-    headers={
-        "Accept": "application/json",
-        "User-Agent": "databounty-space/1.0 (+https://huggingface.co/spaces/databounty-io/DataBounty)",
-    },
-)
-_hub = HfApi()
-_cache: OrderedDict[tuple, tuple[float, Any]] = OrderedDict()
-_lock = threading.Lock()
-
-
-def _cached(key: tuple, load: Callable[[], Any]) -> Any:
-    now = time.monotonic()
-    with _lock:
-        hit = _cache.get(key)
-        if hit is not None and now - hit[0] < CACHE_TTL_SECONDS:
-            _cache.move_to_end(key)
-            return hit[1]
-    value = load()  # raises on failure, so errors never reach the cache
-    with _lock:
-        _cache[key] = (now, value)
-        _cache.move_to_end(key)
-        # Keys include free-text search terms, so bound the cache rather than
-        # let a stream of unique queries grow it forever.
-        while len(_cache) > _CACHE_MAX_ENTRIES:
-            _cache.popitem(last=False)
-    return value
-
-
-def _get(path: str, params: dict[str, Any] | None = None, *, not_found_ok: bool = False) -> Any:
-    query = {k: v for k, v in (params or {}).items() if v not in (None, "")}
-
-    def load() -> Any:
-        try:
-            resp = _http.get(path, params=query)
-        except httpx.HTTPError as exc:
-            raise UpstreamError(f"DataBounty's API could not be reached ({type(exc).__name__}).") from exc
-        if resp.status_code == 404 and not_found_ok:
-            return None
-        if resp.status_code >= 400:
-            raise UpstreamError(f"DataBounty's API answered HTTP {resp.status_code} for {path}.")
-        try:
-            return resp.json()
-        except ValueError as exc:
-            raise UpstreamError(f"DataBounty's API returned an unreadable response for {path}.") from exc
-
-    return _cached(("api", path, tuple(sorted(query.items()))), load)
-
-
-def _all_pages(path: str, key: str) -> list[dict[str, Any]]:
-    rows: list[dict[str, Any]] = []
-    cursor = None
-    for _ in range(_MAX_PAGES):
-        page = _get(path, {"limit": _PAGE_SIZE[path], "cursor": cursor}) or {}
-        rows.extend(page.get(key) or [])
-        cursor = page.get("nextCursor")
-        if not cursor:
-            break
-    return rows
-
-
-def _int(value: Any) -> int:
-    # Counts arrive as numbers or as numeric strings (targetItems is a BigInt
-    # serialised as text), so accept both.
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        return 0
-
-
-def _pct(part: int, whole: int) -> float | None:
-    return round(100 * part / whole, 1) if whole else None
-
-
-def _date(value: Any) -> str | None:
-    return value[:10] if isinstance(value, str) and len(value) >= 10 else None
-
-
-# --- Programme totals and karma tiers -----------------------------------------
-
-
-def stats() -> dict[str, Any]:
-    """Programme totals, the karma tier ladder and the top of the leaderboard."""
-    return _get("/v1/community/stats") or {}
-
-
-def tiers() -> list[dict[str, Any]]:
-    """The live karma tier ladder, lowest threshold first."""
-    return sorted(stats().get("tiers") or [], key=lambda t: _int(t.get("minKarma")))
-
-
-def tier_for(karma: int, ladder: list[dict[str, Any]]) -> dict[str, Any] | None:
-    current = None
-    for tier in ladder:
-        if karma >= _int(tier.get("minKarma")):
-            current = tier
-    return current
-
-
-# --- Pools and datasets ---------------------------------------------------------
-
-
-def _programme(row: dict[str, Any]) -> dict[str, Any]:
-    dataset_type = row.get("datasetType") or {}
-    pricing = row.get("karmaPricing") or {}
-    target = _int(row.get("targetItems"))
-    accepted = _int(row.get("acceptedItems"))
-    cleared = _int(row.get("clearedItems"))
-    pool_id = str(row.get("id") or "")
-    return {
-        "id": pool_id,
-        "title": row.get("title") or "",
-        "status": row.get("status") or "",
-        "dataset_type": dataset_type.get("name") or "",
-        "domain": dataset_type.get("domain") or "",
-        "category": row.get("datasetCategory") or "",
-        "language": row.get("language") or "",
-        "difficulty": row.get("difficulty") or "",
-        "trust_tier": dataset_type.get("trustTier") or "",
-        "target_items": target,
-        "accepted_items": accepted,
-        # Cleared items passed the automated checks and hold a slot in the pool;
-        # the ones not yet accepted are waiting on a human validator.
-        "in_review_items": max(cleared - accepted, 0),
-        "progress_pct": _pct(accepted, target),
-        "karma_per_accepted_item": pricing.get("contributorPerItem"),
-        "validator_karma_per_audited_item": pricing.get("validatorPerAuditedItem"),
-        "audit_coverage_pct": row.get("auditCoveragePct"),
-        "license": row.get("communityLicense") or "",
-        "page_url": f"{SITE_URL}/pools/{pool_id}/",
-        "contribute_url": f"{APP_URL}/contributor/pool/{pool_id}/",
-    }
-
-
-def _catalog() -> list[dict[str, Any]]:
-    return _cached(("catalog",), lambda: _all_pages("/v1/community/catalog", "bounties"))
-
-
-def open_pools(query: str = "", domain: str = "", difficulty: str = "") -> list[dict[str, Any]]:
-    """Pools currently open for contribution, optionally filtered.
-
-    "Open" is whatever the platform's own open-pools endpoint lists; the catalog
-    supplies the descriptive fields that endpoint leaves out.
-    """
-    open_ids = {row.get("id") for row in _all_pages("/v1/community/pools", "pools")}
-    needle = query.strip().lower()
-    pools = []
-    for row in _catalog():
-        if row.get("id") not in open_ids:
-            continue
-        pool = _programme(row)
-        if domain and pool["domain"] != domain:
-            continue
-        if difficulty and pool["difficulty"] != difficulty:
-            continue
-        haystack = " ".join((pool["title"], pool["dataset_type"], pool["language"], row.get("description") or ""))
-        if needle and needle not in haystack.lower():
-            continue
-        pools.append(pool)
-    return pools
-
-
-def pool_details(pool_id: str) -> dict[str, Any] | None:
-    """One pool's full public record, or None when the id is unknown."""
-    pool_id = (pool_id or "").strip()
-    if not _POOL_ID.match(pool_id):
-        raise ValueError("That doesn't look like a DataBounty pool id.")
-    row = (_get(f"/v1/community/catalog/{quote(pool_id, safe='')}", not_found_ok=True) or {}).get("bounty")
-    if not row:
-        return None
-    pool = _programme(row)
-    dataset_type = row.get("datasetType") or {}
-    pool.update(
-        description=row.get("description") or "",
-        contributors=row.get("contributorCount"),
-        validators=row.get("validatorCount"),
-        duplicate_rate=row.get("duplicateRate"),
-        created_at=_date(row.get("createdAt")),
-        fields=[
-            {
-                "key": field.get("key"),
-                "label": field.get("label") or field.get("key"),
-                "role": field.get("role"),
-                "required": bool(field.get("required")),
-                "help": field.get("help") or "",
-            }
-            for field in dataset_type.get("fields") or []
-        ],
-        example_items=[
-            sample["fields"]
-            for sample in dataset_type.get("sampleAssets") or []
-            if isinstance(sample, dict) and isinstance(sample.get("fields"), dict) and sample["fields"]
-        ][:3],
-        hugging_face_dataset=row.get("huggingFaceDataset"),
-    )
-    return pool
-
-
-def _hub_datasets() -> dict[str, dict[str, Any]]:
-    def load() -> dict[str, dict[str, Any]]:
-        return {
-            info.id: {"downloads": info.downloads, "likes": info.likes}
-            for info in _hub.list_datasets(author=HF_ORG, full=True)
-        }
-
-    try:
-        return _cached(("hub", HF_ORG), load)
-    except Exception:
-        # Download counts are decoration; the catalog is the source of truth,
-        # so a Hub hiccup must not take the datasets list down with it.
-        return {}
-
-
-def published_datasets() -> list[dict[str, Any]]:
-    """Datasets DataBounty has published, newest first, with Hub download counts."""
-    hub = _hub_datasets()
-    datasets = []
-    for row in _catalog():
-        if row.get("publicationStatus") != "published":
-            continue
-        pool = _programme(row)
-        targets = (row.get("publication") or {}).get("targets") or []
-
-        def published_url(target: str) -> str | None:
-            return next(
-                (t.get("url") for t in targets if t.get("target") == target and t.get("state") == "published" and t.get("url")),
-                None,
-            )
-
-        repo_id = row.get("huggingFaceDataset") or None
-        counts = hub.get(repo_id or "", {})
-        datasets.append(
-            {
-                "title": pool["title"],
-                "dataset_type": pool["dataset_type"],
-                "items": pool["accepted_items"],
-                "license": pool["license"],
-                "difficulty": pool["difficulty"],
-                "published_on": _date(row.get("deliveredAt")),
-                "hugging_face_id": repo_id,
-                "hugging_face_url": published_url("huggingface") or (f"https://huggingface.co/datasets/{repo_id}" if repo_id else None),
-                "github_url": published_url("github"),
-                "downloads": counts.get("downloads"),
-                "likes": counts.get("likes"),
-                "page_url": pool["page_url"],
-            }
-        )
-    datasets.sort(key=lambda d: d["published_on"] or "", reverse=True)
-    return datasets
-
-
-# --- People -----------------------------------------------------------------------
-
-
-def leaderboard(limit: int = 50, tier: str = "", query: str = "") -> list[dict[str, Any]]:
-    """The all-time karma leaderboard.
-
-    The API already leaves out members who hide their karma, so this never
-    shows more than databounty.io's own leaderboard does.
-    """
-    params = {
-        "limit": max(1, min(_int(limit) or 50, 100)),
-        "tier": tier if tier in TIERS else None,
-        "q": query.strip()[:60] or None,
-    }
-    rows = (_get("/v1/community/leaderboard", params) or {}).get("leaderboard") or []
-    ladder = tiers()
-    board = []
-    for row in rows:
-        karma = _int(row.get("karma"))
-        handle = row.get("handle")
-        board.append(
-            {
-                "rank": row.get("rank"),
-                "handle": handle,
-                "display_name": row.get("displayName") or handle,
-                "karma": karma,
-                "accepted_items": row.get("acceptedItems"),
-                "tier": (tier_for(karma, ladder) or {}).get("label"),
-                "profile_url": f"{SITE_URL}/{handle}/" if handle else None,
-            }
-        )
-    return board
-
-
-def normalize_handle(handle: str) -> str:
-    """Accept "starlord", "@starlord" or a pasted databounty.io profile URL."""
-    value = (handle or "").strip()
-    match = _PROFILE_URL.match(value)
-    if match:
-        value = match.group(1)
-    value = value.lstrip("@").lower()
-    if not _HANDLE.match(value):
-        raise ValueError("Handles are 3-20 characters long and use lowercase letters, digits and hyphens.")
-    return value
-
-
-def _badge_labels(badges: list[dict[str, Any]]) -> list[str]:
-    """Readable badge labels, keeping only the highest step of each tiered badge.
-
-    Tiered badges (10, 25, 100 audits and so on) share a "{value} ..." label and
-    carry their threshold as the id suffix (bdg_audits_100), which is how the
-    catalog is seeded. The public profile response does not include the
-    threshold itself, so the suffix is the only place to read it from.
-    """
-    highest: dict[str, tuple[int, str]] = {}
-    plain: list[str] = []
-    for badge in badges:
-        label = badge.get("label") or ""
-        step = _BADGE_STEP.match(badge.get("id") or "")
-        if "{value}" in label and step:
-            value = int(step.group("value"))
-            if value > highest.get(step.group("ladder"), (-1, ""))[0]:
-                highest[step.group("ladder")] = (value, label.replace("{value}", f"{value:,}"))
-        elif label:
-            plain.append(" ".join(label.replace("{value}", "").split()))
-    return [label for _, label in highest.values()] + plain
-
-
-def contributor(handle: str) -> dict[str, Any] | None:
-    """A contributor's public profile, or None if there is no public profile.
-
-    Fields the member chose to hide are absent upstream and come back as None
-    here, so callers must treat every field except the handle as optional.
-    """
-    handle = normalize_handle(handle)
-    data = _get(f"/v1/profiles/handle/{quote(handle, safe='')}", not_found_ok=True)
-    if not data:
-        return None
-    tier = data.get("tier") if isinstance(data.get("tier"), dict) else None
-    return {
-        "handle": data.get("handle") or handle,
-        "display_name": data.get("displayName") or data.get("handle") or handle,
-        "member_since": _date(data.get("memberSince")),
-        "karma": data.get("karma"),
-        "tier": tier.get("label") if tier else None,
-        "tier_color": tier.get("color") if tier else None,
-        "badges": _badge_labels(data["badges"]) if "badges" in data else None,
-        "accepted_items": data.get("acceptedItems"),
-        "audits": data.get("audits"),
-        "datasets_contributed_to": (
-            [{"title": d.get("title"), "items": d.get("items")} for d in data["datasets"]] if "datasets" in data else None
-        ),
-        "published_credits": [
-            {"title": c.get("title"), "hugging_face_url": c.get("hfUrl")}
-            for c in data.get("publishedCredits") or []
-            if c.get("hfUrl")
-        ],
-        "profile_url": f"{SITE_URL}/{handle}/",
-    }
-
-
-# --- Agents -------------------------------------------------------------------------
-
-
-def platform_mcp_tools() -> list[dict[str, str]]:
-    """DataBounty's own MCP tool catalog, with the credential scope each one needs."""
-    tools = (_get("/mcp/tools") or {}).get("tools") or []
-    return [
-        {
-            "name": tool.get("name") or "",
-            "scope": tool.get("scope") or "",
-            "description": " ".join((tool.get("description") or "").split()),
-        }
-        for tool in tools
-    ]
+# SPDX-License-Identifier: Apache-2.0
+"""Read-only client for DataBounty's public API and the Hugging Face Hub.
+
+Everything here reads public data: the same unauthenticated endpoints that
+databounty.io renders from. Each response is kept in a small in-process cache
+for CACHE_TTL_SECONDS, so a burst of visitors, or an agent calling the MCP tools
+in a loop, never turns into a burst of upstream requests. Errors are never
+cached, so a recovered upstream is picked up on the next call.
+
+Profiles are read only from /v1/profiles/handle/:handle, which answers 404 for a
+private profile and leaves out every field the member chose to hide. Nothing
+here calls /v1/community/members/:handle, which applies neither rule.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import threading
+import time
+from collections import OrderedDict
+from collections.abc import Callable
+from typing import Any
+from urllib.parse import quote
+
+import httpx
+from huggingface_hub import HfApi
+
+API_URL = os.environ.get("DATABOUNTY_API_URL", "https://api.databounty.io").rstrip("/")
+SITE_URL = os.environ.get("DATABOUNTY_SITE_URL", "https://databounty.io").rstrip("/")
+APP_URL = os.environ.get("DATABOUNTY_APP_URL", "https://console.databounty.io").rstrip("/")
+HF_ORG = os.environ.get("DATABOUNTY_HF_ORG", "databounty-io")
+CACHE_TTL_SECONDS = float(os.environ.get("CACHE_TTL_SECONDS", "120"))
+
+# DataBounty's own MCP server. The dashboard origin proxies /mcp to the API, and
+# the API binds every OAuth credential to that origin, so this is the URL
+# clients must use (not API_URL).
+MCP_URL = f"{APP_URL}/mcp"
+
+DOMAINS = ("coding", "legal", "healthcare", "finance", "science")
+DIFFICULTIES = ("beginner", "intermediate", "advanced")
+TIERS = ("dharma", "bodhi", "moksha", "nirvana")
+
+# Same rule the dashboard applies when a member claims a handle.
+_HANDLE = re.compile(r"^[a-z0-9-]{3,20}$")
+_POOL_ID = re.compile(r"^[A-Za-z0-9_-]{1,64}$")
+_PROFILE_URL = re.compile(r"^(?:https?://)?(?:www\.)?databounty\.io/+@?([^/?#]+)/*$", re.IGNORECASE)
+_BADGE_STEP = re.compile(r"^(?P<ladder>.+)_(?P<value>\d+)$")
+
+_PAGE_SIZE = {"/v1/community/catalog": 100, "/v1/community/pools": 50}
+_MAX_PAGES = 5
+_CACHE_MAX_ENTRIES = 256
+
+
+class UpstreamError(RuntimeError):
+    """DataBounty's API could not be reached, or answered with an error."""
+
+
+_http = httpx.Client(
+    base_url=API_URL,
+    timeout=httpx.Timeout(15.0, connect=5.0),
+    headers={
+        "Accept": "application/json",
+        "User-Agent": "databounty-space/1.0 (+https://huggingface.co/spaces/databounty-io/DataBounty)",
+    },
+)
+_hub = HfApi()
+_cache: OrderedDict[tuple, tuple[float, Any]] = OrderedDict()
+_lock = threading.Lock()
+
+
+def _cached(key: tuple, load: Callable[[], Any]) -> Any:
+    now = time.monotonic()
+    with _lock:
+        hit = _cache.get(key)
+        if hit is not None and now - hit[0] < CACHE_TTL_SECONDS:
+            _cache.move_to_end(key)
+            return hit[1]
+    value = load()  # raises on failure, so errors never reach the cache
+    with _lock:
+        _cache[key] = (now, value)
+        _cache.move_to_end(key)
+        # Keys include free-text search terms, so bound the cache rather than
+        # let a stream of unique queries grow it forever.
+        while len(_cache) > _CACHE_MAX_ENTRIES:
+            _cache.popitem(last=False)
+    return value
+
+
+def _get(path: str, params: dict[str, Any] | None = None, *, not_found_ok: bool = False) -> Any:
+    query = {k: v for k, v in (params or {}).items() if v not in (None, "")}
+
+    def load() -> Any:
+        try:
+            resp = _http.get(path, params=query)
+        except httpx.HTTPError as exc:
+            raise UpstreamError(f"DataBounty's API could not be reached ({type(exc).__name__}).") from exc
+        if resp.status_code == 404 and not_found_ok:
+            return None
+        if resp.status_code >= 400:
+            raise UpstreamError(f"DataBounty's API answered HTTP {resp.status_code} for {path}.")
+        try:
+            return resp.json()
+        except ValueError as exc:
+            raise UpstreamError(f"DataBounty's API returned an unreadable response for {path}.") from exc
+
+    return _cached(("api", path, tuple(sorted(query.items()))), load)
+
+
+def _all_pages(path: str, key: str) -> list[dict[str, Any]]:
+    rows: list[dict[str, Any]] = []
+    cursor = None
+    for _ in range(_MAX_PAGES):
+        page = _get(path, {"limit": _PAGE_SIZE[path], "cursor": cursor}) or {}
+        rows.extend(page.get(key) or [])
+        cursor = page.get("nextCursor")
+        if not cursor:
+            break
+    return rows
+
+
+def _int(value: Any) -> int:
+    # Counts arrive as numbers or as numeric strings (targetItems is a BigInt
+    # serialised as text), so accept both.
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return 0
+
+
+def _pct(part: int, whole: int) -> float | None:
+    return round(100 * part / whole, 1) if whole else None
+
+
+def _date(value: Any) -> str | None:
+    return value[:10] if isinstance(value, str) and len(value) >= 10 else None
+
+
+# --- Programme totals and karma tiers -----------------------------------------
+
+
+def stats() -> dict[str, Any]:
+    """Programme totals, the karma tier ladder and the top of the leaderboard."""
+    return _get("/v1/community/stats") or {}
+
+
+def tiers() -> list[dict[str, Any]]:
+    """The live karma tier ladder, lowest threshold first."""
+    return sorted(stats().get("tiers") or [], key=lambda t: _int(t.get("minKarma")))
+
+
+def tier_for(karma: int, ladder: list[dict[str, Any]]) -> dict[str, Any] | None:
+    current = None
+    for tier in ladder:
+        if karma >= _int(tier.get("minKarma")):
+            current = tier
+    return current
+
+
+# --- Pools and datasets ---------------------------------------------------------
+
+
+def _programme(row: dict[str, Any]) -> dict[str, Any]:
+    dataset_type = row.get("datasetType") or {}
+    pricing = row.get("karmaPricing") or {}
+    target = _int(row.get("targetItems"))
+    accepted = _int(row.get("acceptedItems"))
+    cleared = _int(row.get("clearedItems"))
+    pool_id = str(row.get("id") or "")
+    return {
+        "id": pool_id,
+        "title": row.get("title") or "",
+        "status": row.get("status") or "",
+        "dataset_type": dataset_type.get("name") or "",
+        "domain": dataset_type.get("domain") or "",
+        "category": row.get("datasetCategory") or "",
+        "language": row.get("language") or "",
+        "difficulty": row.get("difficulty") or "",
+        "trust_tier": dataset_type.get("trustTier") or "",
+        "target_items": target,
+        "accepted_items": accepted,
+        # Cleared items passed the automated checks and hold a slot in the pool;
+        # the ones not yet accepted are waiting on a human validator.
+        "in_review_items": max(cleared - accepted, 0),
+        "progress_pct": _pct(accepted, target),
+        "karma_per_accepted_item": pricing.get("contributorPerItem"),
+        "validator_karma_per_audited_item": pricing.get("validatorPerAuditedItem"),
+        "audit_coverage_pct": row.get("auditCoveragePct"),
+        "license": row.get("communityLicense") or "",
+        "page_url": f"{SITE_URL}/pools/{pool_id}/",
+        "contribute_url": f"{APP_URL}/contributor/pool/{pool_id}/",
+    }
+
+
+def _catalog() -> list[dict[str, Any]]:
+    return _cached(("catalog",), lambda: _all_pages("/v1/community/catalog", "bounties"))
+
+
+def open_pools(query: str = "", domain: str = "", difficulty: str = "") -> list[dict[str, Any]]:
+    """Pools currently open for contribution, optionally filtered.
+
+    "Open" is whatever the platform's own open-pools endpoint lists; the catalog
+    supplies the descriptive fields that endpoint leaves out.
+    """
+    open_ids = {row.get("id") for row in _all_pages("/v1/community/pools", "pools")}
+    needle = query.strip().lower()
+    pools = []
+    for row in _catalog():
+        if row.get("id") not in open_ids:
+            continue
+        pool = _programme(row)
+        if domain and pool["domain"] != domain:
+            continue
+        if difficulty and pool["difficulty"] != difficulty:
+            continue
+        haystack = " ".join((pool["title"], pool["dataset_type"], pool["language"], row.get("description") or ""))
+        if needle and needle not in haystack.lower():
+            continue
+        pools.append(pool)
+    return pools
+
+
+def pool_details(pool_id: str) -> dict[str, Any] | None:
+    """One pool's full public record, or None when the id is unknown."""
+    pool_id = (pool_id or "").strip()
+    if not _POOL_ID.match(pool_id):
+        raise ValueError("That doesn't look like a DataBounty pool id.")
+    row = (_get(f"/v1/community/catalog/{quote(pool_id, safe='')}", not_found_ok=True) or {}).get("bounty")
+    if not row:
+        return None
+    pool = _programme(row)
+    dataset_type = row.get("datasetType") or {}
+    pool.update(
+        description=row.get("description") or "",
+        contributors=row.get("contributorCount"),
+        validators=row.get("validatorCount"),
+        duplicate_rate=row.get("duplicateRate"),
+        created_at=_date(row.get("createdAt")),
+        fields=[
+            {
+                "key": field.get("key"),
+                "label": field.get("label") or field.get("key"),
+                "role": field.get("role"),
+                "required": bool(field.get("required")),
+                "help": field.get("help") or "",
+            }
+            for field in dataset_type.get("fields") or []
+        ],
+        example_items=[
+            sample["fields"]
+            for sample in dataset_type.get("sampleAssets") or []
+            if isinstance(sample, dict) and isinstance(sample.get("fields"), dict) and sample["fields"]
+        ][:3],
+        hugging_face_dataset=row.get("huggingFaceDataset"),
+    )
+    return pool
+
+
+def _hub_datasets() -> dict[str, dict[str, Any]]:
+    def load() -> dict[str, dict[str, Any]]:
+        return {
+            info.id: {"downloads": info.downloads, "likes": info.likes}
+            for info in _hub.list_datasets(author=HF_ORG, full=True)
+        }
+
+    try:
+        return _cached(("hub", HF_ORG), load)
+    except Exception:
+        # Download counts are decoration; the catalog is the source of truth,
+        # so a Hub hiccup must not take the datasets list down with it.
+        return {}
+
+
+def published_datasets() -> list[dict[str, Any]]:
+    """Datasets DataBounty has published, newest first, with Hub download counts."""
+    hub = _hub_datasets()
+    datasets = []
+    for row in _catalog():
+        if row.get("publicationStatus") != "published":
+            continue
+        pool = _programme(row)
+        targets = (row.get("publication") or {}).get("targets") or []
+
+        def published_url(target: str) -> str | None:
+            return next(
+                (t.get("url") for t in targets if t.get("target") == target and t.get("state") == "published" and t.get("url")),
+                None,
+            )
+
+        repo_id = row.get("huggingFaceDataset") or None
+        counts = hub.get(repo_id or "", {})
+        datasets.append(
+            {
+                "title": pool["title"],
+                "dataset_type": pool["dataset_type"],
+                "items": pool["accepted_items"],
+                "license": pool["license"],
+                "difficulty": pool["difficulty"],
+                "published_on": _date(row.get("deliveredAt")),
+                "hugging_face_id": repo_id,
+                "hugging_face_url": published_url("huggingface") or (f"https://huggingface.co/datasets/{repo_id}" if repo_id else None),
+                "github_url": published_url("github"),
+                "downloads": counts.get("downloads"),
+                "likes": counts.get("likes"),
+                "page_url": pool["page_url"],
+            }
+        )
+    datasets.sort(key=lambda d: d["published_on"] or "", reverse=True)
+    return datasets
+
+
+# --- People -----------------------------------------------------------------------
+
+
+def leaderboard(limit: int = 50, tier: str = "", query: str = "") -> list[dict[str, Any]]:
+    """The all-time karma leaderboard.
+
+    The API already leaves out members who hide their karma, so this never
+    shows more than databounty.io's own leaderboard does.
+    """
+    params = {
+        "limit": max(1, min(_int(limit) or 50, 100)),
+        "tier": tier if tier in TIERS else None,
+        "q": query.strip()[:60] or None,
+    }
+    rows = (_get("/v1/community/leaderboard", params) or {}).get("leaderboard") or []
+    ladder = tiers()
+    board = []
+    for row in rows:
+        karma = _int(row.get("karma"))
+        handle = row.get("handle")
+        board.append(
+            {
+                "rank": row.get("rank"),
+                "handle": handle,
+                "display_name": row.get("displayName") or handle,
+                "karma": karma,
+                "accepted_items": row.get("acceptedItems"),
+                "tier": (tier_for(karma, ladder) or {}).get("label"),
+                "profile_url": f"{SITE_URL}/{handle}/" if handle else None,
+            }
+        )
+    return board
+
+
+def normalize_handle(handle: str) -> str:
+    """Accept "starlord", "@starlord" or a pasted databounty.io profile URL."""
+    value = (handle or "").strip()
+    match = _PROFILE_URL.match(value)
+    if match:
+        value = match.group(1)
+    value = value.lstrip("@").lower()
+    if not _HANDLE.match(value):
+        raise ValueError("Handles are 3-20 characters long and use lowercase letters, digits and hyphens.")
+    return value
+
+
+def _badge_labels(badges: list[dict[str, Any]]) -> list[str]:
+    """Readable badge labels, keeping only the highest step of each tiered badge.
+
+    Tiered badges (10, 25, 100 audits and so on) share a "{value} ..." label and
+    carry their threshold as the id suffix (bdg_audits_100), which is how the
+    catalog is seeded. The public profile response does not include the
+    threshold itself, so the suffix is the only place to read it from.
+    """
+    highest: dict[str, tuple[int, str]] = {}
+    plain: list[str] = []
+    for badge in badges:
+        label = badge.get("label") or ""
+        step = _BADGE_STEP.match(badge.get("id") or "")
+        if "{value}" in label and step:
+            value = int(step.group("value"))
+            if value > highest.get(step.group("ladder"), (-1, ""))[0]:
+                highest[step.group("ladder")] = (value, label.replace("{value}", f"{value:,}"))
+        elif label:
+            plain.append(" ".join(label.replace("{value}", "").split()))
+    return [label for _, label in highest.values()] + plain
+
+
+def contributor(handle: str) -> dict[str, Any] | None:
+    """A contributor's public profile, or None if there is no public profile.
+
+    Fields the member chose to hide are absent upstream and come back as None
+    here, so callers must treat every field except the handle as optional.
+    """
+    handle = normalize_handle(handle)
+    data = _get(f"/v1/profiles/handle/{quote(handle, safe='')}", not_found_ok=True)
+    if not data:
+        return None
+    tier = data.get("tier") if isinstance(data.get("tier"), dict) else None
+    return {
+        "handle": data.get("handle") or handle,
+        "display_name": data.get("displayName") or data.get("handle") or handle,
+        "member_since": _date(data.get("memberSince")),
+        "karma": data.get("karma"),
+        "tier": tier.get("label") if tier else None,
+        "tier_color": tier.get("color") if tier else None,
+        "badges": _badge_labels(data["badges"]) if "badges" in data else None,
+        "accepted_items": data.get("acceptedItems"),
+        "audits": data.get("audits"),
+        "datasets_contributed_to": (
+            [{"title": d.get("title"), "items": d.get("items")} for d in data["datasets"]] if "datasets" in data else None
+        ),
+        "published_credits": [
+            {"title": c.get("title"), "hugging_face_url": c.get("hfUrl")}
+            for c in data.get("publishedCredits") or []
+            if c.get("hfUrl")
+        ],
+        "profile_url": f"{SITE_URL}/{handle}/",
+    }
+
+
+# --- Requesting a dataset ------------------------------------------------------------
+
+
+def request_catalog() -> dict[str, Any]:
+    """DataBounty's planner catalog: the dataset types open for requests, with the languages,
+    difficulty levels and hand-check shares each one offers, and how many reference samples a
+    request wants. Public, like the rest of what the Space reads here."""
+    return _get("/v1/planner/catalog") or {}
+
+
+def requesting_open() -> bool:
+    """Whether DataBounty takes dataset requests from other apps (its request_dataset MCP tool).
+    Until it does, the Space links to databounty.io instead."""
+    return any(tool["name"] == "request_dataset" for tool in platform_mcp_tools())
+
+
+# --- Agents -------------------------------------------------------------------------
+
+
+def platform_mcp_tools() -> list[dict[str, str]]:
+    """DataBounty's own MCP tool catalog, with the credential scope each one needs."""
+    tools = (_get("/mcp/tools") or {}).get("tools") or []
+    return [
+        {
+            "name": tool.get("name") or "",
+            "scope": tool.get("scope") or "",
+            "description": " ".join((tool.get("description") or "").split()),
+        }
+        for tool in tools
+    ]

requesting.py

@@ -0,0 +1,209 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Requesting a dataset from the Space: the form's choices, a request's arguments, and how a
+person's requests read back.
+
+Plain data in, plain data out, like contribute.py, validate.py and sponsor.py. The choices come from
+DataBounty's public planner catalog (the dataset types open for requests, with the languages and
+difficulty levels each can honour). A request goes to DataBounty's request_dataset tool, which checks
+it all again, and an admin reviews it before a pool opens. The defaults are the console planner's.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+# The licences DataBounty can publish a dataset under (its lib/publication/license-texts.ts). It
+# refuses any other.
+LICENCES = [
+    ("CC-BY-4.0", "CC BY 4.0", "Anyone may use it, crediting the contributors."),
+    ("CC-BY-SA-4.0", "CC BY-SA 4.0", "Credit the contributors, and share changes under the same licence."),
+    ("CC0-1.0", "CC0 1.0", "Public domain: no conditions at all."),
+    ("ODC-By-1.0", "ODC-By 1.0", "Open data licence, crediting the contributors."),
+]
+MIXES = {"mostly_beginner": "Mostly beginner", "balanced": "Balanced", "mostly_advanced": "Mostly advanced"}
+DEFAULTS = {"targetItems": 500, "difficultyMix": "balanced", "auditCoveragePct": 25, "proposedLicense": "CC-BY-4.0"}
+TITLE_LENGTH = (5, 120)
+DESCRIPTION_LENGTH = (20, 2000)
+TARGET_ITEMS = (10, 100_000)
+SHORT_TEXT = 60  # language and framework
+# Characters DataBounty refuses in a request's text (control and bidirectional-override characters).
+UNSAFE = re.compile("[\u0000-\u001f\u007f-\u009f‎‏‪-‮⁦-⁩]")
+KEY = re.compile(r"^[A-Za-z0-9_.:-]{8,200}$")
+
+# Where a request stands, from the requester's side: (label, tone).
+REQUEST_STATUS = {
+    "submitted": ("Waiting for review", "info"),
+    "under_review": ("In review", "review"),
+    "changes_requested": ("Changes asked for", "warn"),
+    "approved": ("Approved", "ok"),
+    "implemented": ("Pool is open", "ok"),
+    "declined": ("Declined", "bad"),
+    "disputed": ("Disputed", "warn"),
+}
+# DataBounty freezes a request's reference samples once it's decided (services/artifacts.ts).
+SAMPLES_OPEN = {"submitted", "under_review", "changes_requested"}
+
+
+def mixes_for(levels: Any) -> list[str]:
+    """The difficulty mixes a dataset type can honour, by DataBounty's own rule (coherenceProblems in
+    services/planner.ts): mostly beginner needs a beginner level, mostly advanced an advanced or an
+    expert one. A type that declares no levels takes any mix."""
+    levels = {str(level) for level in levels or []}
+    if not levels:
+        return list(MIXES)
+    allowed = {"balanced"}
+    if "beginner" in levels:
+        allowed.add("mostly_beginner")
+    if levels & {"advanced", "expert"}:
+        allowed.add("mostly_advanced")
+    return [mix for mix in MIXES if mix in allowed]
+
+
+def type_option(t: dict[str, Any]) -> dict[str, Any]:
+    """One dataset type, as the form offers it."""
+    support = t.get("languageSupport") or {}
+    mode = support.get("mode") if support.get("mode") in {"fixed", "choice", "any", "none"} else "any"
+    languages = [str(l.get("label") or l.get("id") or "") for l in support.get("languages") or [] if isinstance(l, dict)]
+    audit = sorted({int(a) for a in t.get("auditOptions") or [] if isinstance(a, (int, float)) and 0 <= a <= 100})
+    return {
+        "id": str(t.get("id") or ""),
+        "name": str(t.get("name") or t.get("id") or ""),
+        "description": " ".join(str(t.get("description") or "").split()),
+        "category": str(t.get("category") or "other").replace("_", " "),
+        "languageMode": mode,
+        "languages": [l for l in languages if l],
+        "mixes": [{"value": m, "label": MIXES[m]} for m in mixes_for(t.get("difficultyLevels"))],
+        "auditOptions": audit or [DEFAULTS["auditCoveragePct"]],
+        # The item's field keys, for a sample template.
+        "fields": [str(f["key"]) for f in t.get("fields") or [] if isinstance(f, dict) and f.get("key")],
+    }
+
+
+def catalog_view(data: dict[str, Any]) -> dict[str, Any]:
+    """The request form's choices, from DataBounty's planner catalog."""
+    types = [
+        type_option(t)
+        for t in data.get("datasetTypes") or []
+        if isinstance(t, dict) and t.get("id") and (t.get("status") or "active") == "active"
+    ]
+    types.sort(key=lambda t: (t["category"], t["name"].lower()))
+    gate = data.get("sampleGate") or {}
+    wanted = gate.get("min")
+    return {
+        "types": types,
+        "sampleMin": wanted if isinstance(wanted, int) and wanted > 0 else 3,
+        "licences": [{"value": v, "label": label, "hint": hint} for v, label, hint in LICENCES],
+        "defaults": DEFAULTS,
+    }
+
+
+def _text(body: dict[str, Any], key: str) -> str:
+    return " ".join(str(body.get(key) or "").split()) if key != "description" else str(body.get(key) or "").strip()
+
+
+def request_arguments(body: dict[str, Any], types: dict[str, dict[str, Any]]) -> tuple[dict[str, Any] | None, str]:
+    """request_dataset's arguments for this form, or what to fix first. DataBounty checks it all again."""
+    t = types.get(str(body.get("datasetTypeId") or ""))
+    if not t:
+        return None, "Choose a dataset type."
+    title, description = _text(body, "title"), _text(body, "description")
+    language, framework = _text(body, "language"), _text(body, "framework")
+    if len(title) < TITLE_LENGTH[0]:
+        return None, f"Give the request a title of at least {TITLE_LENGTH[0]} characters."
+    if len(title) > TITLE_LENGTH[1]:
+        return None, f"Keep the title under {TITLE_LENGTH[1]} characters."
+    if len(description) < DESCRIPTION_LENGTH[0]:
+        return None, f"Describe the dataset in at least {DESCRIPTION_LENGTH[0]} characters."
+    if len(description) > DESCRIPTION_LENGTH[1]:
+        return None, f"Keep the description under {DESCRIPTION_LENGTH[1]} characters."
+    if any(UNSAFE.search(value) for value in (title, language, framework)):
+        return None, "Remove the hidden control characters from the title, language or framework."
+    if len(language) > SHORT_TEXT or len(framework) > SHORT_TEXT:
+        return None, f"Keep the language and framework under {SHORT_TEXT} characters."
+    try:
+        items = int(body.get("targetItems"))
+    except (TypeError, ValueError):
+        items = 0
+    if not TARGET_ITEMS[0] <= items <= TARGET_ITEMS[1]:
+        return None, f"Ask for between {TARGET_ITEMS[0]} and {TARGET_ITEMS[1]:,} items."
+    mix = str(body.get("difficultyMix") or "")
+    if mix not in {m["value"] for m in t["mixes"]}:
+        return None, "Choose a difficulty this dataset type offers."
+    try:
+        audit = int(body.get("auditCoveragePct"))
+    except (TypeError, ValueError):
+        audit = -1
+    if not 0 <= audit <= 100:
+        return None, "Choose how many items validators check by hand."
+    licence = str(body.get("proposedLicense") or "")
+    if licence not in {v for v, _, _ in LICENCES}:
+        return None, "Choose a licence."
+
+    arguments: dict[str, Any] = {
+        "datasetTypeId": t["id"],
+        "title": title,
+        "description": description,
+        "targetItems": items,
+        "difficultyMix": mix,
+        "auditCoveragePct": audit,
+        "proposedLicense": licence,
+    }
+    if t["languageMode"] == "fixed" and t["languages"]:
+        arguments["language"] = t["languages"][0]
+    elif t["languageMode"] == "choice":
+        match = next((l for l in t["languages"] if l.lower() == language.lower()), None)
+        if not match:
+            return None, f"Choose the language: {', '.join(t['languages'])}."
+        arguments["language"] = match
+    elif t["languageMode"] == "any" and language:
+        arguments["language"] = language
+    if framework:
+        arguments["framework"] = framework
+    key = str(body.get("idempotencyKey") or "")
+    if KEY.match(key):
+        arguments["idempotencyKey"] = key  # the same form sent twice files one request
+    return arguments, ""
+
+
+def _count(value: Any) -> int:
+    return value if isinstance(value, int) and value > 0 else 0
+
+
+def request_row(r: dict[str, Any], type_names: dict[str, str] | None = None) -> dict[str, Any]:
+    """One of the person's requests, from list_my_dataset_requests."""
+    status = str(r.get("status") or "")
+    label, tone = REQUEST_STATUS.get(status, (status.replace("_", " ").capitalize() or "Unknown", "info"))
+    gate = r.get("sampleGate") or {}
+    approved, pending, rejected = _count(gate.get("approved")), _count(gate.get("pending")), _count(gate.get("rejected"))
+    wanted = _count(gate.get("min")) or 3
+    limit = _count(gate.get("max")) or wanted
+    if gate.get("ok"):
+        sample_text = "Example items approved."
+    elif approved:
+        sample_text = f"{approved} of {wanted} example items approved" + (f", {pending} waiting for review." if pending else ".")
+    elif pending:
+        sample_text = f"{pending} example item{'s' if pending != 1 else ''} waiting for review. The pool can open once one is approved."
+    else:
+        sample_text = f"Add up to {limit} example items. The pool can open once an admin approves one."
+    type_id = str(r.get("datasetTypeId") or "")
+    return {
+        "id": r.get("id"),
+        "title": r.get("title") or "",
+        "typeId": type_id,
+        "type": (type_names or {}).get(type_id) or type_id.replace("_", " "),
+        "status": status,
+        "statusLabel": label,
+        "statusTone": tone,
+        "date": str(r.get("createdAt") or "")[:10],
+        "targetItems": r.get("targetItems"),
+        "difficulty": MIXES.get(str(r.get("difficultyMix") or ""), ""),
+        "language": r.get("language") or "",
+        "licence": r.get("proposedLicense") or "",
+        "adminNote": r.get("adminNote") or "",
+        "samples": {"approved": approved, "pending": pending, "rejected": rejected, "wanted": wanted, "ok": bool(gate.get("ok"))},
+        "sampleText": sample_text,
+        # A rejected sample frees its slot, as DataBounty counts them.
+        "canAddSample": status in SAMPLES_OPEN and approved + pending < limit,
+        "poolId": r.get("mintedBountyId") or "",
+    }

web/app.css

@@ -1,424 +1,439 @@
-/* SPDX-License-Identifier: Apache-2.0 */
-/* The DataBounty console's look, for the Space. Tokens are the console's own
-   (apps/web/app/globals.css): ink on paper, white cards, lime accent, a dark sidebar. */
-
-:root {
-  --ink: #14170f;
-  --ink-soft: #6b7360;
-  --paper: #f3f4f0;
-  --panel: #f7f8f4;
-  --line: #e4e6df;
-  --line-soft: #eef0e8;
-  --line-strong: #868d80;
-  --lime: #a3f60a;
-  --lime-ink: #4f7a00;
-  --dark: #0a0c0a;
-  --dark-line: #1c2a19;
-  --dark-line-soft: #2a3a26;
-  --dark-text: #eef2ec;
-  --dark-muted: #a4ad9c;
-  --dark-soft: #8a9382;
-  --dark-track: #152012;
-  --dark-nav-hover: #12160f;
-  --nav-active: #1a2810;
-  --karma: #7c5cc4;
-  --karma-soft: #f0ebfa;
-  --karma-border: #e2d8f6;
-  --accent-strong: #5f7a1e;
-  --accent-strong-hover: #4d6418;
-  --accent-soft: #f2f7e4;
-  --accent-soft-border: #d5deba;
-  --success: #1f8a5b;
-  --success-soft: #e6f5ec;
-  --success-border: #bfe6cd;
-  --danger: #c2334d;
-  --danger-soft: #fbe7ea;
-  --danger-border: #f2c4cd;
-  --warn: #8a6412;
-  --warn-soft: #fbf6e9;
-  --warn-border: #eadbb5;
-  --info: #2f5f96;
-  --info-soft: #eef4fb;
-  --info-border: #d4e3f5;
-  --font-sans: "Geist", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
-  --font-mono: "Geist Mono", ui-monospace, "SFMono-Regular", Menlo, Consolas, monospace;
-}
-
-* { box-sizing: border-box; }
-html, body { margin: 0; }
-body {
-  background: var(--paper);
-  color: var(--ink);
-  font-family: var(--font-sans);
-  font-size: 14px;
-  line-height: 1.5;
-  font-feature-settings: "tnum" 1;
-  -webkit-font-smoothing: antialiased;
-}
-a { color: inherit; }
-a.plain { text-decoration: none; }
-a.plain:hover { text-decoration: underline; text-underline-offset: 3px; }
-a.pill.plain:hover { text-decoration: none; border-color: var(--karma); }
-button, input, select, textarea { font: inherit; color: inherit; }
-::selection { background: var(--lime); color: var(--dark); }
-[hidden] { display: none !important; }
-.i { width: 15px; height: 15px; flex: none; vertical-align: -2px; }
-
-/* --- Shell ----------------------------------------------------------------------------------- */
-.shell { display: grid; grid-template-columns: 240px minmax(0, 1fr); min-height: 100vh; }
-.sidebar {
-  position: sticky; top: 0; height: 100vh;
-  display: flex; flex-direction: column;
-  background: var(--dark); color: var(--dark-text);
-  border-right: 1px solid var(--dark-line);
-}
-.brand {
-  display: flex; align-items: center; gap: 9px;
-  padding: 20px 20px 19px; border-bottom: 1px solid var(--dark-line);
-  text-decoration: none;
-}
-.brand img { width: 22px; height: 22px; }
-.brand span { font-family: var(--font-mono); font-weight: 700; font-size: 17px; letter-spacing: -0.03em; color: #fff; }
-.brand span b { color: var(--lime); font-weight: 700; }
-.nav { display: grid; gap: 3px; padding: 16px 12px; }
-.nav a {
-  display: flex; align-items: center; gap: 12px;
-  padding: 10px 12px; border-radius: 8px;
-  font-family: var(--font-mono); font-size: 13px; color: var(--dark-muted); text-decoration: none;
-  transition: background .12s, color .12s;
-}
-.nav a:hover { background: var(--dark-nav-hover); color: var(--dark-text); }
-.nav a.active { background: var(--nav-active); color: var(--lime); }
-.nav .badge { margin-left: auto; min-width: 18px; padding: 0 6px; border-radius: 999px; background: var(--lime); color: var(--dark); font-size: 10px; font-weight: 700; line-height: 18px; text-align: center; }
-.side-bottom { margin-top: auto; padding: 12px; border-top: 1px solid var(--dark-line); display: grid; gap: 8px; }
-.side-karma { border: 1px solid var(--dark-line-soft); border-radius: 10px; padding: 11px 13px; background: #0c100b; }
-.side-karma .row { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
-.micro-dark { font-family: var(--font-mono); font-size: 10px; letter-spacing: .07em; text-transform: uppercase; color: var(--dark-soft); }
-.side-karma .pts { font-family: var(--font-mono); font-weight: 600; font-size: 14px; color: #fff; }
-.side-karma .to { font-family: var(--font-mono); font-size: 11px; color: var(--dark-soft); }
-.chip-dark { font-family: var(--font-mono); font-size: 10px; padding: 1px 7px; border-radius: 999px; background: #1f2a17; color: var(--dark-muted); }
-.bar-dark { height: 3px; margin-top: 9px; border-radius: 999px; background: var(--dark-track); overflow: hidden; }
-.bar-dark span { display: block; height: 100%; background: var(--lime); }
-.user-chip { display: flex; align-items: center; gap: 10px; padding: 6px 4px; }
-.avatar {
-  width: 32px; height: 32px; flex: none; border-radius: 50%;
-  display: grid; place-items: center;
-  background: #161b13; border: 1px solid var(--dark-line-soft);
-  font-family: var(--font-mono); font-weight: 600; font-size: 13px; color: #fff;
-}
-.user-chip .who { min-width: 0; }
-.user-chip b { display: block; font-family: var(--font-mono); font-size: 12.5px; font-weight: 600; color: #fff; }
-.user-chip span { display: block; font-family: var(--font-mono); font-size: 11px; color: var(--dark-soft); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.side-link { border: 0; background: none; padding: 4px; color: var(--dark-soft); font-family: var(--font-mono); font-size: 11.5px; text-align: left; cursor: pointer; }
-.side-link:hover { color: var(--lime); }
-.side-signin { display: grid; gap: 8px; padding: 4px; }
-.side-signin p { margin: 0; font-size: 12px; color: var(--dark-soft); line-height: 1.45; }
-.top-action { display: none; }
-
-.main { min-width: 0; }
-.page { max-width: 1120px; padding: 34px 40px 72px; animation: fade .18s ease-out; }
-@keyframes fade { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: none; } }
-@media (prefers-reduced-motion: reduce) { .page { animation: none; } }
-
-/* --- Type ------------------------------------------------------------------------------------- */
-.page-head { margin-bottom: 22px; }
-h1.title { margin: 0 0 6px; font-family: var(--font-mono); font-weight: 600; font-size: 23px; letter-spacing: -0.02em; overflow-wrap: anywhere; }
-.sub { margin: 0; color: var(--ink-soft); font-size: 14px; }
-h2.section { margin: 34px 0 4px; font-family: var(--font-mono); font-weight: 600; font-size: 16px; letter-spacing: -0.01em; }
-.section-sub { margin: 0 0 14px; color: var(--ink-soft); font-size: 13px; }
-.micro { font-family: var(--font-mono); font-size: 10px; letter-spacing: .07em; text-transform: uppercase; color: var(--ink-soft); }
-.mono { font-family: var(--font-mono); }
-.small { font-size: 11.5px; }
-.muted { color: var(--ink-soft); }
-.strong { font-weight: 600; }
-.karma-text { color: var(--karma); }
-.back { display: inline-flex; align-items: center; gap: 6px; margin-bottom: 14px; font-family: var(--font-mono); font-size: 12px; color: var(--ink-soft); text-decoration: none; }
-.back:hover { color: var(--ink); }
-
-/* --- Surfaces ----------------------------------------------------------------------------------- */
-.card { background: #fff; border: 1px solid var(--line); border-radius: 14px; }
-.pad { padding: 20px 22px; }
-.stack { display: grid; gap: 12px; }
-.row { display: flex; align-items: center; gap: 10px; }
-.between { justify-content: space-between; }
-.wrap { flex-wrap: wrap; }
-.grow { flex: 1; min-width: 0; }
-
-.pill {
-  display: inline-flex; align-items: center; gap: 5px;
-  padding: 1px 9px; border-radius: 999px; border: 1px solid var(--line);
-  background: var(--panel); color: var(--ink-soft);
-  font-family: var(--font-mono); font-size: 11px; line-height: 1.7; white-space: nowrap;
-}
-.pill-karma, .pill-review { background: var(--karma-soft); border-color: var(--karma-border); color: var(--karma); }
-.pill-ok { background: var(--success-soft); border-color: var(--success-border); color: var(--success); }
-.pill-warn { background: var(--warn-soft); border-color: var(--warn-border); color: var(--warn); }
-.pill-bad { background: var(--danger-soft); border-color: var(--danger-border); color: var(--danger); }
-.pill-info { background: var(--info-soft); border-color: var(--info-border); color: var(--info); }
-.pill-lime { background: var(--accent-soft); border-color: var(--accent-soft-border); color: var(--accent-strong); }
-.dot { width: 7px; height: 7px; border-radius: 50%; background: currentColor; display: inline-block; }
-
-.btn {
-  display: inline-flex; align-items: center; justify-content: center; gap: 8px;
-  padding: 9px 16px; border-radius: 8px; border: 1px solid var(--line-strong);
-  background: #fff; color: var(--ink); text-decoration: none; cursor: pointer;
-  font-family: var(--font-mono); font-size: 12.5px; font-weight: 500; white-space: nowrap;
-  transition: background .12s, border-color .12s, opacity .12s;
-}
-.btn:hover { border-color: var(--ink); }
-.btn-primary { background: var(--ink); border-color: var(--ink); color: var(--lime); }
-.btn-primary:hover { background: #000; border-color: #000; }
-.btn-submit { background: var(--accent-strong); border-color: var(--accent-strong); color: #fff; }
-.btn-submit:hover { background: var(--accent-strong-hover); border-color: var(--accent-strong-hover); }
-.btn-lime { background: var(--lime); border-color: var(--lime); color: var(--dark); }
-.btn-lime:hover { background: #b8ff3d; border-color: #b8ff3d; }
-.btn-sm { padding: 6px 11px; font-size: 11.5px; }
-.btn-wide { width: 100%; }
-.btn[disabled], .btn[aria-disabled="true"] { opacity: .45; cursor: not-allowed; pointer-events: none; }
-
-.input, .select, .textarea {
-  width: 100%; padding: 10px 12px; border-radius: 8px;
-  border: 1px solid var(--line); background: #fff; outline: none;
-  font-size: 14px; transition: border-color .12s, box-shadow .12s;
-}
-.input::placeholder, .textarea::placeholder { font-family: var(--font-mono); font-size: 12.5px; color: #9aa08d; }
-.input:focus, .select:focus, .textarea:focus { border-color: var(--ink); box-shadow: 0 0 0 3px rgba(20, 23, 15, .06); }
-.select { appearance: none; padding-right: 34px; font-family: var(--font-mono); font-size: 12.5px; cursor: pointer;
-  background: #fff url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%236b7360' stroke-width='2'%3E%3Cpath d='m6 9 6 6 6-6'/%3E%3C/svg%3E") no-repeat right 12px center; }
-.textarea { resize: vertical; min-height: 92px; }
-.textarea.code {
-  min-height: 170px; background: var(--panel); tab-size: 4;
-  font-family: var(--font-mono); font-size: 12.5px; line-height: 1.6; white-space: pre;
-}
-.search { position: relative; }
-.search .i { position: absolute; left: 12px; top: 50%; transform: translateY(-50%); color: var(--ink-soft); }
-.search .input { padding-left: 34px; font-family: var(--font-mono); font-size: 12.5px; }
-
-.progress { height: 4px; border-radius: 999px; background: var(--line-soft); overflow: hidden; }
-.progress span { display: block; height: 100%; min-width: 3px; border-radius: inherit; background: var(--ink); }
-
-/* --- Workspace ------------------------------------------------------------------------------------- */
-.karma-card { display: grid; grid-template-columns: auto auto 1fr auto; align-items: center; gap: 22px; padding: 20px 22px; }
-.karma-icon { width: 42px; height: 42px; border-radius: 10px; display: grid; place-items: center; background: var(--karma-soft); color: var(--karma); }
-.karma-icon .i { width: 19px; height: 19px; }
-.karma-num { display: flex; align-items: baseline; gap: 7px; }
-.karma-num b { font-family: var(--font-mono); font-size: 26px; font-weight: 600; line-height: 1; }
-.chip { padding: 1px 8px; border-radius: 6px; background: var(--line-soft); font-family: var(--font-mono); font-size: 11px; color: var(--ink); }
-.karma-next .row { justify-content: space-between; margin-bottom: 7px; }
-.stats { display: grid; grid-template-columns: repeat(4, 1fr); margin-top: 14px; overflow: hidden; }
-.stat { padding: 14px 16px; border-left: 1px solid var(--line); border-bottom: 2px solid transparent; }
-.stat:first-child { border-left: 0; }
-.stat .micro { display: flex; align-items: center; gap: 6px; }
-.stat .micro .i { width: 12px; height: 12px; }
-.stat b { display: block; margin-top: 6px; font-family: var(--font-mono); font-size: 21px; font-weight: 600; line-height: 1.1; }
-.stat-ok { border-bottom-color: #8fbb3a; } .stat-ok b { color: var(--accent-strong); }
-.stat-warn { border-bottom-color: #d9a43a; } .stat-warn b { color: var(--warn); }
-
-.signin-card { display: grid; grid-template-columns: auto 1fr auto; align-items: center; gap: 20px; padding: 22px 24px; }
-.signin-card img { width: 40px; height: 40px; }
-.signin-card h2 { margin: 0 0 3px; font-family: var(--font-mono); font-size: 16px; font-weight: 600; }
-.signin-card p { margin: 0; color: var(--ink-soft); font-size: 13.5px; }
-.signin-actions { display: grid; gap: 6px; justify-items: end; }
-.signin-actions .note { font-size: 11.5px; color: var(--ink-soft); max-width: 260px; text-align: right; }
-.setup-card { padding: 20px 22px; }
-.setup-card h2 { margin: 0 0 4px; font-family: var(--font-mono); font-size: 16px; font-weight: 600; }
-.setup-card p { margin: 0 0 14px; color: var(--ink-soft); font-size: 13.5px; }
-.setup-card .row .input { max-width: 280px; }
-
-.filters { display: grid; grid-template-columns: minmax(200px, 320px) 200px 1fr; gap: 8px; align-items: center; margin-bottom: 12px; }
-.filters .count { justify-self: end; font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-soft); }
-.rows { display: grid; gap: 12px; }
-.pool-row, .sub-row {
-  position: relative; display: grid; gap: 9px; padding: 18px 50px 18px 20px;
-  text-decoration: none; transition: border-color .12s, box-shadow .12s;
-}
-.pool-row:hover, .sub-row:hover { border-color: #cfd3c6; box-shadow: 0 1px 2px rgba(20, 23, 15, .04); }
-.pool-row .head, .sub-row .head { display: flex; align-items: center; gap: 9px; flex-wrap: wrap; }
-.pool-title, .sub-title { font-weight: 600; font-size: 14.5px; }
-.pool-row .cap { display: grid; grid-template-columns: auto 1fr auto; align-items: center; gap: 12px; }
-.pool-row .cap .progress { height: 3px; }
-.row-arrow { position: absolute; right: 20px; top: 20px; color: var(--ink-soft); }
-.tabs-pills { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 12px; }
-.tabs-pills button {
-  padding: 5px 13px; border-radius: 999px; border: 1px solid var(--line); background: #fff;
-  font-family: var(--font-mono); font-size: 12px; color: var(--ink-soft); cursor: pointer;
-}
-.tabs-pills button.on { background: var(--ink); border-color: var(--ink); color: var(--lime); }
-.empty { padding: 26px; text-align: center; color: var(--ink-soft); font-size: 13.5px; }
-.btn.more { justify-self: center; margin-top: 2px; }
-
-/* --- Pool page ----------------------------------------------------------------------------------------- */
-.cap-card { padding: 18px 22px; }
-.cap-card .row { justify-content: space-between; flex-wrap: wrap; }
-.contract { margin-top: 14px; padding: 22px; }
-.contract h3 { margin: 4px 0 10px; font-size: 16px; font-weight: 600; }
-.chips { display: flex; flex-wrap: wrap; gap: 6px; }
-.tip { margin: 12px 0 0; color: var(--ink-soft); font-size: 13.5px; }
-.contract-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; margin-top: 16px; }
-.mini { border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; background: var(--panel); }
-.mini .micro { margin-bottom: 8px; }
-.kv { display: flex; justify-content: space-between; gap: 14px; padding: 4px 0; font-size: 13.5px; }
-.kv span:last-child { font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-soft); text-align: right; }
-.steps { margin: 0; padding: 0; list-style: none; display: grid; gap: 6px; font-size: 13px; color: var(--ink-soft); }
-.steps b { color: var(--ink); font-family: var(--font-mono); font-size: 12px; font-weight: 600; }
-details.disclose { margin-top: 12px; border: 1px solid var(--line); border-radius: 10px; background: #fff; }
-details.disclose > summary {
-  display: flex; align-items: center; gap: 8px; padding: 11px 14px; cursor: pointer; list-style: none;
-  font-family: var(--font-mono); font-size: 12.5px;
-}
-details.disclose > summary::-webkit-details-marker { display: none; }
-details.disclose > summary::after { content: "+"; margin-left: auto; color: var(--ink-soft); }
-details.disclose[open] > summary::after { content: "−"; }
-details.disclose > .body { padding: 2px 14px 14px; border-top: 1px solid var(--line-soft); }
-.spec { margin-top: 12px; }
-.spec .micro { margin-bottom: 4px; }
-.spec p { margin: 0; font-size: 13px; color: var(--ink-soft); line-height: 1.6; }
-pre.block {
-  margin: 4px 0 0; padding: 11px 13px; border-radius: 8px; border: 1px solid var(--line-soft);
-  background: var(--panel); font-family: var(--font-mono); font-size: 12px; line-height: 1.6;
-  white-space: pre-wrap; word-break: break-word; max-height: 320px; overflow: auto;
-}
-.seg { display: inline-flex; gap: 3px; padding: 3px; margin: 22px 0 12px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
-.seg button { padding: 6px 14px; border: 0; border-radius: 7px; background: transparent; font-family: var(--font-mono); font-size: 12.5px; color: var(--ink-soft); cursor: pointer; }
-.seg button.on { background: #fff; color: var(--ink); box-shadow: 0 1px 2px rgba(20, 23, 15, .1); }
-.seg-row { display: flex; align-items: center; justify-content: space-between; gap: 12px; flex-wrap: wrap; }
-.form { display: grid; gap: 18px; padding: 22px; }
-.field { display: grid; gap: 7px; }
-.field-label { display: flex; align-items: center; gap: 7px; flex-wrap: wrap; }
-.req { color: var(--danger); font-weight: 700; }
-.opt { font-family: var(--font-mono); font-size: 10.5px; color: var(--ink-soft); }
-.key-chip, .lang-chip { padding: 0 7px; border-radius: 5px; border: 1px solid var(--line); background: var(--panel); font-family: var(--font-mono); font-size: 10.5px; color: var(--ink-soft); line-height: 1.8; }
-.lang-chip { border-color: var(--accent-soft-border); background: var(--accent-soft); color: var(--accent-strong); }
-.hint { font-size: 12.5px; color: var(--ink-soft); }
-.two { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; }
-.attest { display: grid; gap: 9px; padding: 14px 16px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
-.attest label { display: flex; align-items: flex-start; gap: 10px; font-size: 13.5px; cursor: pointer; }
-.attest input { width: 15px; height: 15px; margin-top: 2px; accent-color: var(--accent-strong); }
-.stage-bar { display: flex; align-items: center; gap: 10px; padding: 12px 16px; border-radius: 10px; background: var(--ink); color: #dfe5d8; font-family: var(--font-mono); font-size: 12px; }
-.stage-bar .i { color: var(--lime); }
-.form-foot { display: flex; align-items: center; justify-content: space-between; gap: 12px; padding-top: 4px; border-top: 1px solid var(--line-soft); }
-.dropzone {
-  display: grid; place-items: center; gap: 6px; padding: 28px; margin-top: 12px;
-  border: 1.5px dashed var(--line-strong); border-radius: 12px; background: var(--panel);
-  color: var(--ink-soft); font-family: var(--font-mono); font-size: 12.5px; cursor: pointer; text-align: center;
-}
-.dropzone:hover, .dropzone.over { border-color: var(--ink); color: var(--ink); }
-.dropzone input { display: none; }
-table.list { width: 100%; border-collapse: collapse; font-size: 13px; }
-table.list th { padding: 10px 14px; text-align: left; font-family: var(--font-mono); font-size: 10px; font-weight: 500; letter-spacing: .07em; text-transform: uppercase; color: var(--ink-soft); border-bottom: 1px solid var(--line); background: var(--panel); }
-table.list td { padding: 11px 14px; border-bottom: 1px solid var(--line-soft); vertical-align: middle; }
-table.list tr:last-child td { border-bottom: 0; }
-table.list tr.click { cursor: pointer; }
-table.list tr.click:hover td { background: var(--panel); }
-.table-wrap { overflow: auto; max-height: 420px; border: 1px solid var(--line); border-radius: 12px; background: #fff; }
-.ok-text { color: var(--success); } .bad-text { color: var(--danger); }
-
-/* --- Notices, checks, toast ----------------------------------------------------------------------------------- */
-.notice { padding: 12px 16px; border-radius: 10px; border: 1px solid var(--line); background: var(--panel); font-size: 13.5px; }
-.notice b { font-family: var(--font-mono); font-size: 12.5px; }
-.notice-ok { background: var(--success-soft); border-color: var(--success-border); }
-.notice-warn { background: var(--warn-soft); border-color: var(--warn-border); }
-.notice-bad { background: var(--danger-soft); border-color: var(--danger-border); }
-.checks { list-style: none; margin: 16px 0 0; padding: 0; display: grid; gap: 4px; }
-.check { display: flex; gap: 12px; align-items: flex-start; padding: 10px 0; border-top: 1px solid var(--line-soft); }
-.check:first-child { border-top: 0; }
-.check-icon { width: 22px; height: 22px; flex: none; border-radius: 50%; display: grid; place-items: center; }
-.check-icon .i { width: 12px; height: 12px; }
-.check-pass .check-icon { background: var(--success-soft); color: var(--success); }
-.check-fail .check-icon { background: var(--danger-soft); color: var(--danger); }
-.check-wait .check-icon { background: var(--line-soft); color: var(--ink-soft); }
-.check-note .check-icon { background: var(--warn-soft); color: var(--warn); }
-.check b { display: block; font-size: 13.5px; font-weight: 600; }
-.check span { font-size: 12.5px; color: var(--ink-soft); }
-.toast {
-  position: fixed; right: 20px; bottom: 20px; z-index: 50; max-width: 380px;
-  padding: 12px 16px; border-radius: 10px; background: var(--ink); color: #fff; font-size: 13px;
-  box-shadow: 0 10px 30px rgba(0, 0, 0, .18);
-}
-.skeleton { height: 92px; border-radius: 14px; background: linear-gradient(90deg, #fff 0%, #f6f7f2 50%, #fff 100%); background-size: 200% 100%; border: 1px solid var(--line); animation: shimmer 1.2s infinite; }
-@keyframes shimmer { from { background-position: 200% 0; } to { background-position: -200% 0; } }
-
-/* --- Other pages ------------------------------------------------------------------------------------------------ */
-.tiles { display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr)); gap: 12px; }
-.tile { padding: 16px 18px; }
-.tile b { display: block; margin-top: 6px; font-family: var(--font-mono); font-size: 22px; font-weight: 600; }
-.tiers { display: flex; flex-wrap: wrap; gap: 8px; }
-.how { margin: 0; padding: 0; list-style: none; counter-reset: how; display: grid; gap: 10px; }
-.how li { counter-increment: how; display: grid; grid-template-columns: 30px 1fr; gap: 12px; align-items: start; font-size: 14px; }
-.how li::before { content: counter(how); width: 26px; height: 26px; border-radius: 50%; display: grid; place-items: center; background: var(--ink); color: var(--lime); font-family: var(--font-mono); font-size: 12px; font-weight: 600; }
-.code-box { position: relative; }
-.code-box pre.block { padding-right: 76px; }
-.code-box .btn { position: absolute; right: 8px; top: 8px; }
-.profile-head { display: flex; align-items: center; gap: 16px; }
-.profile-head .avatar { width: 52px; height: 52px; font-size: 18px; background: var(--ink); color: var(--lime); border: 0; }
-
-/* --- Reviewing ------------------------------------------------------------------------------------------------- */
-.btn-danger { background: var(--danger); border-color: var(--danger); color: #fff; }
-.btn-danger:hover { background: #a82a42; border-color: #a82a42; }
-.pool-row.has-action { padding-right: 104px; }
-.row-action { position: absolute; right: 18px; top: 15px; }
-.audit-grid { display: grid; grid-template-columns: 230px minmax(0, 1fr); gap: 14px; margin-top: 14px; align-items: start; }
-.item-list { display: grid; gap: 2px; padding: 8px; position: sticky; top: 16px; max-height: calc(100vh - 32px); overflow: auto; }
-.item-list button {
-  display: flex; align-items: center; gap: 9px; width: 100%; padding: 8px 9px; border: 0; border-radius: 8px;
-  background: none; color: var(--ink-soft); font-size: 13px; text-align: left; cursor: pointer;
-}
-.item-list button:hover { background: var(--panel); color: var(--ink); }
-.item-list button.on { background: var(--nav-active); color: var(--lime); }
-.item-list .t { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.mark { width: 22px; height: 22px; flex: none; border-radius: 50%; display: grid; place-items: center; background: var(--line-soft); color: var(--ink-soft); font-family: var(--font-mono); font-size: 10.5px; }
-.mark .i { width: 12px; height: 12px; }
-.mark.ok { background: var(--success-soft); color: var(--success); }
-.mark.flagged { background: var(--danger-soft); color: var(--danger); }
-.item-card { display: grid; gap: 16px; padding: 22px; }
-.item-card h2 { margin: 0; font-size: 17px; font-weight: 600; }
-.item-card pre.block { margin-top: 6px; }
-.files { list-style: none; margin: 6px 0 8px; padding: 0; display: grid; gap: 4px; font-size: 13px; }
-.files li { display: flex; align-items: center; gap: 7px; }
-.decide { display: grid; gap: 14px; padding: 16px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
-.decide .reject { display: grid; gap: 8px; padding-top: 14px; border-top: 1px solid var(--line); }
-.item-nav { display: flex; justify-content: space-between; gap: 8px; }
-.sponsor-card { margin-top: 14px; padding: 20px 22px; border-color: var(--karma-border); }
-.sponsor-card details.disclose > summary { gap: 10px; }
-
-/* --- Small screens ------------------------------------------------------------------------------------------------ */
-@media (max-width: 600px) { .hide-sm { display: none; } }
-@media (max-width: 900px) {
-  .shell { grid-template-columns: minmax(0, 1fr); }
-  .sidebar { position: sticky; top: 0; z-index: 20; min-width: 0; height: auto; flex-direction: row; align-items: center; border-right: 0; border-bottom: 1px solid var(--dark-line); }
-  .brand { border-bottom: 0; padding: 12px 14px; }
-  .brand span { font-size: 15px; }
-  .nav { display: flex; overflow-x: auto; padding: 8px; gap: 2px; flex: 1; min-width: 0; scrollbar-width: none; }
-  .nav a { padding: 8px 10px; font-size: 12px; white-space: nowrap; }
-  .nav a .i { display: none; }
-  .side-bottom { display: none; }
-  .top-action {
-    display: inline-flex; align-items: center; flex: none; margin-right: 10px; padding: 7px 10px;
-    border: 1px solid var(--dark-line-soft); border-radius: 8px; background: none; cursor: pointer;
-    color: var(--lime); font-family: var(--font-mono); font-size: 12px;
-  }
-  .page { padding: 22px 16px 60px; }
-  .karma-card { grid-template-columns: auto 1fr; }
-  .karma-next { grid-column: 1 / -1; }
-  .stats { grid-template-columns: repeat(2, 1fr); }
-  .stat:nth-child(3) { border-left: 0; }
-  .filters { grid-template-columns: 1fr 1fr; }
-  .filters .search { grid-column: 1 / -1; }
-  .signin-card { grid-template-columns: auto 1fr; }
-  .signin-actions { grid-column: 1 / -1; justify-items: stretch; }
-  .signin-actions .note { text-align: left; max-width: none; }
-  .contract-grid, .two { grid-template-columns: 1fr; }
-  .pool-row .cap { grid-template-columns: 1fr auto; }
-  .pool-row .cap .progress { grid-column: 1 / -1; grid-row: 2; }
-  h1.title { font-size: 20px; }
-  .kv { flex-direction: column; gap: 0; }
-  .kv span:last-child { text-align: left; }
-  .form, .contract { padding: 18px 16px; }
-  .form-foot { flex-direction: column; align-items: stretch; }
-  .form-foot .btn { width: 100%; }
-  .audit-grid { grid-template-columns: minmax(0, 1fr); }
-  .item-list { position: static; max-height: none; display: flex; overflow-x: auto; }
-  .item-list button { width: auto; flex: none; }
-  .item-list .t { display: none; }
-  .item-card { padding: 18px 16px; }
-}
+/* SPDX-License-Identifier: Apache-2.0 */
+/* The DataBounty console's look, for the Space. Tokens are the console's own
+   (apps/web/app/globals.css): ink on paper, white cards, lime accent, a dark sidebar. */
+
+:root {
+  --ink: #14170f;
+  --ink-soft: #6b7360;
+  --paper: #f3f4f0;
+  --panel: #f7f8f4;
+  --line: #e4e6df;
+  --line-soft: #eef0e8;
+  --line-strong: #868d80;
+  --lime: #a3f60a;
+  --lime-ink: #4f7a00;
+  --dark: #0a0c0a;
+  --dark-line: #1c2a19;
+  --dark-line-soft: #2a3a26;
+  --dark-text: #eef2ec;
+  --dark-muted: #a4ad9c;
+  --dark-soft: #8a9382;
+  --dark-track: #152012;
+  --dark-nav-hover: #12160f;
+  --nav-active: #1a2810;
+  --karma: #7c5cc4;
+  --karma-soft: #f0ebfa;
+  --karma-border: #e2d8f6;
+  --accent-strong: #5f7a1e;
+  --accent-strong-hover: #4d6418;
+  --accent-soft: #f2f7e4;
+  --accent-soft-border: #d5deba;
+  --success: #1f8a5b;
+  --success-soft: #e6f5ec;
+  --success-border: #bfe6cd;
+  --danger: #c2334d;
+  --danger-soft: #fbe7ea;
+  --danger-border: #f2c4cd;
+  --warn: #8a6412;
+  --warn-soft: #fbf6e9;
+  --warn-border: #eadbb5;
+  --info: #2f5f96;
+  --info-soft: #eef4fb;
+  --info-border: #d4e3f5;
+  --font-sans: "Geist", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+  --font-mono: "Geist Mono", ui-monospace, "SFMono-Regular", Menlo, Consolas, monospace;
+}
+
+* { box-sizing: border-box; }
+html, body { margin: 0; }
+body {
+  background: var(--paper);
+  color: var(--ink);
+  font-family: var(--font-sans);
+  font-size: 14px;
+  line-height: 1.5;
+  font-feature-settings: "tnum" 1;
+  -webkit-font-smoothing: antialiased;
+}
+a { color: inherit; }
+a.plain { text-decoration: none; }
+a.plain:hover { text-decoration: underline; text-underline-offset: 3px; }
+a.pill.plain:hover { text-decoration: none; border-color: var(--karma); }
+button, input, select, textarea { font: inherit; color: inherit; }
+::selection { background: var(--lime); color: var(--dark); }
+[hidden] { display: none !important; }
+.i { width: 15px; height: 15px; flex: none; vertical-align: -2px; }
+
+/* --- Shell ----------------------------------------------------------------------------------- */
+.shell { display: grid; grid-template-columns: 240px minmax(0, 1fr); min-height: 100vh; }
+.sidebar {
+  position: sticky; top: 0; height: 100vh;
+  display: flex; flex-direction: column;
+  background: var(--dark); color: var(--dark-text);
+  border-right: 1px solid var(--dark-line);
+}
+.brand {
+  display: flex; align-items: center; gap: 9px;
+  padding: 20px 20px 19px; border-bottom: 1px solid var(--dark-line);
+  text-decoration: none;
+}
+.brand img { width: 22px; height: 22px; }
+.brand span { font-family: var(--font-mono); font-weight: 700; font-size: 17px; letter-spacing: -0.03em; color: #fff; }
+.brand span b { color: var(--lime); font-weight: 700; }
+.nav { display: grid; gap: 3px; padding: 16px 12px; }
+.nav a {
+  display: flex; align-items: center; gap: 12px;
+  padding: 10px 12px; border-radius: 8px;
+  font-family: var(--font-mono); font-size: 13px; color: var(--dark-muted); text-decoration: none;
+  transition: background .12s, color .12s;
+}
+.nav a:hover { background: var(--dark-nav-hover); color: var(--dark-text); }
+.nav a.active { background: var(--nav-active); color: var(--lime); }
+.nav .badge { margin-left: auto; min-width: 18px; padding: 0 6px; border-radius: 999px; background: var(--lime); color: var(--dark); font-size: 10px; font-weight: 700; line-height: 18px; text-align: center; }
+.side-bottom { margin-top: auto; padding: 12px; border-top: 1px solid var(--dark-line); display: grid; gap: 8px; }
+.side-karma { border: 1px solid var(--dark-line-soft); border-radius: 10px; padding: 11px 13px; background: #0c100b; }
+.side-karma .row { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+.micro-dark { font-family: var(--font-mono); font-size: 10px; letter-spacing: .07em; text-transform: uppercase; color: var(--dark-soft); }
+.side-karma .pts { font-family: var(--font-mono); font-weight: 600; font-size: 14px; color: #fff; }
+.side-karma .to { font-family: var(--font-mono); font-size: 11px; color: var(--dark-soft); }
+.chip-dark { font-family: var(--font-mono); font-size: 10px; padding: 1px 7px; border-radius: 999px; background: #1f2a17; color: var(--dark-muted); }
+.bar-dark { height: 3px; margin-top: 9px; border-radius: 999px; background: var(--dark-track); overflow: hidden; }
+.bar-dark span { display: block; height: 100%; background: var(--lime); }
+.user-chip { display: flex; align-items: center; gap: 10px; padding: 6px 4px; }
+.avatar {
+  width: 32px; height: 32px; flex: none; border-radius: 50%;
+  display: grid; place-items: center;
+  background: #161b13; border: 1px solid var(--dark-line-soft);
+  font-family: var(--font-mono); font-weight: 600; font-size: 13px; color: #fff;
+}
+.user-chip .who { min-width: 0; }
+.user-chip b { display: block; font-family: var(--font-mono); font-size: 12.5px; font-weight: 600; color: #fff; }
+.user-chip span { display: block; font-family: var(--font-mono); font-size: 11px; color: var(--dark-soft); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.side-link { border: 0; background: none; padding: 4px; color: var(--dark-soft); font-family: var(--font-mono); font-size: 11.5px; text-align: left; cursor: pointer; }
+.side-link:hover { color: var(--lime); }
+.side-signin { display: grid; gap: 8px; padding: 4px; }
+.side-signin p { margin: 0; font-size: 12px; color: var(--dark-soft); line-height: 1.45; }
+.top-action { display: none; }
+
+.main { min-width: 0; }
+.page { max-width: 1120px; padding: 34px 40px 72px; animation: fade .18s ease-out; }
+@keyframes fade { from { opacity: 0; transform: translateY(4px); } to { opacity: 1; transform: none; } }
+@media (prefers-reduced-motion: reduce) { .page { animation: none; } }
+
+/* --- Type ------------------------------------------------------------------------------------- */
+.page-head { margin-bottom: 22px; }
+h1.title { margin: 0 0 6px; font-family: var(--font-mono); font-weight: 600; font-size: 23px; letter-spacing: -0.02em; overflow-wrap: anywhere; }
+.sub { margin: 0; color: var(--ink-soft); font-size: 14px; }
+h2.section { margin: 34px 0 4px; font-family: var(--font-mono); font-weight: 600; font-size: 16px; letter-spacing: -0.01em; }
+.section-sub { margin: 0 0 14px; color: var(--ink-soft); font-size: 13px; }
+.micro { font-family: var(--font-mono); font-size: 10px; letter-spacing: .07em; text-transform: uppercase; color: var(--ink-soft); }
+.mono { font-family: var(--font-mono); }
+.small { font-size: 11.5px; }
+.muted { color: var(--ink-soft); }
+.strong { font-weight: 600; }
+.karma-text { color: var(--karma); }
+.back { display: inline-flex; align-items: center; gap: 6px; margin-bottom: 14px; font-family: var(--font-mono); font-size: 12px; color: var(--ink-soft); text-decoration: none; }
+.back:hover { color: var(--ink); }
+
+/* --- Surfaces ----------------------------------------------------------------------------------- */
+.card { background: #fff; border: 1px solid var(--line); border-radius: 14px; }
+.pad { padding: 20px 22px; }
+.stack { display: grid; gap: 12px; }
+.row { display: flex; align-items: center; gap: 10px; }
+.between { justify-content: space-between; }
+.wrap { flex-wrap: wrap; }
+.grow { flex: 1; min-width: 0; }
+
+.pill {
+  display: inline-flex; align-items: center; gap: 5px;
+  padding: 1px 9px; border-radius: 999px; border: 1px solid var(--line);
+  background: var(--panel); color: var(--ink-soft);
+  font-family: var(--font-mono); font-size: 11px; line-height: 1.7; white-space: nowrap;
+}
+.pill-karma, .pill-review { background: var(--karma-soft); border-color: var(--karma-border); color: var(--karma); }
+.pill-ok { background: var(--success-soft); border-color: var(--success-border); color: var(--success); }
+.pill-warn { background: var(--warn-soft); border-color: var(--warn-border); color: var(--warn); }
+.pill-bad { background: var(--danger-soft); border-color: var(--danger-border); color: var(--danger); }
+.pill-info { background: var(--info-soft); border-color: var(--info-border); color: var(--info); }
+.pill-lime { background: var(--accent-soft); border-color: var(--accent-soft-border); color: var(--accent-strong); }
+.dot { width: 7px; height: 7px; border-radius: 50%; background: currentColor; display: inline-block; }
+
+.btn {
+  display: inline-flex; align-items: center; justify-content: center; gap: 8px;
+  padding: 9px 16px; border-radius: 8px; border: 1px solid var(--line-strong);
+  background: #fff; color: var(--ink); text-decoration: none; cursor: pointer;
+  font-family: var(--font-mono); font-size: 12.5px; font-weight: 500; white-space: nowrap;
+  transition: background .12s, border-color .12s, opacity .12s;
+}
+.btn:hover { border-color: var(--ink); }
+.btn-primary { background: var(--ink); border-color: var(--ink); color: var(--lime); }
+.btn-primary:hover { background: #000; border-color: #000; }
+.btn-submit { background: var(--accent-strong); border-color: var(--accent-strong); color: #fff; }
+.btn-submit:hover { background: var(--accent-strong-hover); border-color: var(--accent-strong-hover); }
+.btn-lime { background: var(--lime); border-color: var(--lime); color: var(--dark); }
+.btn-lime:hover { background: #b8ff3d; border-color: #b8ff3d; }
+.btn-sm { padding: 6px 11px; font-size: 11.5px; }
+.btn-wide { width: 100%; }
+.btn[disabled], .btn[aria-disabled="true"] { opacity: .45; cursor: not-allowed; pointer-events: none; }
+
+.input, .select, .textarea {
+  width: 100%; padding: 10px 12px; border-radius: 8px;
+  border: 1px solid var(--line); background: #fff; outline: none;
+  font-size: 14px; transition: border-color .12s, box-shadow .12s;
+}
+.input::placeholder, .textarea::placeholder { font-family: var(--font-mono); font-size: 12.5px; color: #9aa08d; }
+.input:focus, .select:focus, .textarea:focus { border-color: var(--ink); box-shadow: 0 0 0 3px rgba(20, 23, 15, .06); }
+.select { appearance: none; padding-right: 34px; font-family: var(--font-mono); font-size: 12.5px; cursor: pointer;
+  background: #fff url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%236b7360' stroke-width='2'%3E%3Cpath d='m6 9 6 6 6-6'/%3E%3C/svg%3E") no-repeat right 12px center; }
+.textarea { resize: vertical; min-height: 92px; }
+.textarea.code {
+  min-height: 170px; background: var(--panel); tab-size: 4;
+  font-family: var(--font-mono); font-size: 12.5px; line-height: 1.6; white-space: pre;
+}
+.search { position: relative; }
+.search .i { position: absolute; left: 12px; top: 50%; transform: translateY(-50%); color: var(--ink-soft); }
+.search .input { padding-left: 34px; font-family: var(--font-mono); font-size: 12.5px; }
+
+.progress { height: 4px; border-radius: 999px; background: var(--line-soft); overflow: hidden; }
+.progress span { display: block; height: 100%; min-width: 3px; border-radius: inherit; background: var(--ink); }
+
+/* --- Workspace ------------------------------------------------------------------------------------- */
+.karma-card { display: grid; grid-template-columns: auto auto 1fr auto; align-items: center; gap: 22px; padding: 20px 22px; }
+.karma-icon { width: 42px; height: 42px; border-radius: 10px; display: grid; place-items: center; background: var(--karma-soft); color: var(--karma); }
+.karma-icon .i { width: 19px; height: 19px; }
+.karma-num { display: flex; align-items: baseline; gap: 7px; }
+.karma-num b { font-family: var(--font-mono); font-size: 26px; font-weight: 600; line-height: 1; }
+.chip { padding: 1px 8px; border-radius: 6px; background: var(--line-soft); font-family: var(--font-mono); font-size: 11px; color: var(--ink); }
+.karma-next .row { justify-content: space-between; margin-bottom: 7px; }
+.stats { display: grid; grid-template-columns: repeat(4, 1fr); margin-top: 14px; overflow: hidden; }
+.stat { padding: 14px 16px; border-left: 1px solid var(--line); border-bottom: 2px solid transparent; }
+.stat:first-child { border-left: 0; }
+.stat .micro { display: flex; align-items: center; gap: 6px; }
+.stat .micro .i { width: 12px; height: 12px; }
+.stat b { display: block; margin-top: 6px; font-family: var(--font-mono); font-size: 21px; font-weight: 600; line-height: 1.1; }
+.stat-ok { border-bottom-color: #8fbb3a; } .stat-ok b { color: var(--accent-strong); }
+.stat-warn { border-bottom-color: #d9a43a; } .stat-warn b { color: var(--warn); }
+
+.signin-card { display: grid; grid-template-columns: auto 1fr auto; align-items: center; gap: 20px; padding: 22px 24px; }
+.signin-card img { width: 40px; height: 40px; }
+.signin-card h2 { margin: 0 0 3px; font-family: var(--font-mono); font-size: 16px; font-weight: 600; }
+.signin-card p { margin: 0; color: var(--ink-soft); font-size: 13.5px; }
+.signin-actions { display: grid; gap: 6px; justify-items: end; }
+.signin-actions .note { font-size: 11.5px; color: var(--ink-soft); max-width: 260px; text-align: right; }
+.setup-card { padding: 20px 22px; }
+.setup-card h2 { margin: 0 0 4px; font-family: var(--font-mono); font-size: 16px; font-weight: 600; }
+.setup-card p { margin: 0 0 14px; color: var(--ink-soft); font-size: 13.5px; }
+.setup-card .row .input { max-width: 280px; }
+
+.filters { display: grid; grid-template-columns: minmax(200px, 320px) 200px 1fr; gap: 8px; align-items: center; margin-bottom: 12px; }
+.filters .count { justify-self: end; font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-soft); }
+.rows { display: grid; gap: 12px; }
+.pool-row, .sub-row {
+  position: relative; display: grid; gap: 9px; padding: 18px 50px 18px 20px;
+  text-decoration: none; transition: border-color .12s, box-shadow .12s;
+}
+.pool-row:hover, .sub-row:hover { border-color: #cfd3c6; box-shadow: 0 1px 2px rgba(20, 23, 15, .04); }
+.pool-row .head, .sub-row .head { display: flex; align-items: center; gap: 9px; flex-wrap: wrap; }
+.pool-title, .sub-title { font-weight: 600; font-size: 14.5px; }
+.pool-row .cap { display: grid; grid-template-columns: auto 1fr auto; align-items: center; gap: 12px; }
+.pool-row .cap .progress { height: 3px; }
+.row-arrow { position: absolute; right: 20px; top: 20px; color: var(--ink-soft); }
+.tabs-pills { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 12px; }
+.tabs-pills button {
+  padding: 5px 13px; border-radius: 999px; border: 1px solid var(--line); background: #fff;
+  font-family: var(--font-mono); font-size: 12px; color: var(--ink-soft); cursor: pointer;
+}
+.tabs-pills button.on { background: var(--ink); border-color: var(--ink); color: var(--lime); }
+.empty { padding: 26px; text-align: center; color: var(--ink-soft); font-size: 13.5px; }
+.btn.more { justify-self: center; margin-top: 2px; }
+
+/* --- Pool page ----------------------------------------------------------------------------------------- */
+.cap-card { padding: 18px 22px; }
+.cap-card .row { justify-content: space-between; flex-wrap: wrap; }
+.contract { margin-top: 14px; padding: 22px; }
+.contract h3 { margin: 4px 0 10px; font-size: 16px; font-weight: 600; }
+.chips { display: flex; flex-wrap: wrap; gap: 6px; }
+.tip { margin: 12px 0 0; color: var(--ink-soft); font-size: 13.5px; }
+.contract-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; margin-top: 16px; }
+.mini { border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; background: var(--panel); }
+.mini .micro { margin-bottom: 8px; }
+.kv { display: flex; justify-content: space-between; gap: 14px; padding: 4px 0; font-size: 13.5px; }
+.kv span:last-child { font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-soft); text-align: right; }
+.steps { margin: 0; padding: 0; list-style: none; display: grid; gap: 6px; font-size: 13px; color: var(--ink-soft); }
+.steps b { color: var(--ink); font-family: var(--font-mono); font-size: 12px; font-weight: 600; }
+details.disclose { margin-top: 12px; border: 1px solid var(--line); border-radius: 10px; background: #fff; }
+details.disclose > summary {
+  display: flex; align-items: center; gap: 8px; padding: 11px 14px; cursor: pointer; list-style: none;
+  font-family: var(--font-mono); font-size: 12.5px;
+}
+details.disclose > summary::-webkit-details-marker { display: none; }
+details.disclose > summary::after { content: "+"; margin-left: auto; color: var(--ink-soft); }
+details.disclose[open] > summary::after { content: "−"; }
+details.disclose > .body { padding: 2px 14px 14px; border-top: 1px solid var(--line-soft); }
+.spec { margin-top: 12px; }
+.spec .micro { margin-bottom: 4px; }
+.spec p { margin: 0; font-size: 13px; color: var(--ink-soft); line-height: 1.6; }
+pre.block {
+  margin: 4px 0 0; padding: 11px 13px; border-radius: 8px; border: 1px solid var(--line-soft);
+  background: var(--panel); font-family: var(--font-mono); font-size: 12px; line-height: 1.6;
+  white-space: pre-wrap; word-break: break-word; max-height: 320px; overflow: auto;
+}
+.seg { display: inline-flex; gap: 3px; padding: 3px; margin: 22px 0 12px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
+.seg button { padding: 6px 14px; border: 0; border-radius: 7px; background: transparent; font-family: var(--font-mono); font-size: 12.5px; color: var(--ink-soft); cursor: pointer; }
+.seg button.on { background: #fff; color: var(--ink); box-shadow: 0 1px 2px rgba(20, 23, 15, .1); }
+.seg-row { display: flex; align-items: center; justify-content: space-between; gap: 12px; flex-wrap: wrap; }
+.form { display: grid; gap: 18px; padding: 22px; }
+.field { display: grid; gap: 7px; }
+.field-label { display: flex; align-items: center; gap: 7px; flex-wrap: wrap; }
+.req { color: var(--danger); font-weight: 700; }
+.opt { font-family: var(--font-mono); font-size: 10.5px; color: var(--ink-soft); }
+.key-chip, .lang-chip { padding: 0 7px; border-radius: 5px; border: 1px solid var(--line); background: var(--panel); font-family: var(--font-mono); font-size: 10.5px; color: var(--ink-soft); line-height: 1.8; }
+.lang-chip { border-color: var(--accent-soft-border); background: var(--accent-soft); color: var(--accent-strong); }
+.hint { font-size: 12.5px; color: var(--ink-soft); }
+.two { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; }
+.attest { display: grid; gap: 9px; padding: 14px 16px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
+.attest label { display: flex; align-items: flex-start; gap: 10px; font-size: 13.5px; cursor: pointer; }
+.attest input { width: 15px; height: 15px; margin-top: 2px; accent-color: var(--accent-strong); }
+.stage-bar { display: flex; align-items: center; gap: 10px; padding: 12px 16px; border-radius: 10px; background: var(--ink); color: #dfe5d8; font-family: var(--font-mono); font-size: 12px; }
+.stage-bar .i { color: var(--lime); }
+.form-foot { display: flex; align-items: center; justify-content: space-between; gap: 12px; padding-top: 4px; border-top: 1px solid var(--line-soft); }
+.dropzone {
+  display: grid; place-items: center; gap: 6px; padding: 28px; margin-top: 12px;
+  border: 1.5px dashed var(--line-strong); border-radius: 12px; background: var(--panel);
+  color: var(--ink-soft); font-family: var(--font-mono); font-size: 12.5px; cursor: pointer; text-align: center;
+}
+.dropzone:hover, .dropzone.over { border-color: var(--ink); color: var(--ink); }
+.dropzone input { display: none; }
+table.list { width: 100%; border-collapse: collapse; font-size: 13px; }
+table.list th { padding: 10px 14px; text-align: left; font-family: var(--font-mono); font-size: 10px; font-weight: 500; letter-spacing: .07em; text-transform: uppercase; color: var(--ink-soft); border-bottom: 1px solid var(--line); background: var(--panel); }
+table.list td { padding: 11px 14px; border-bottom: 1px solid var(--line-soft); vertical-align: middle; }
+table.list tr:last-child td { border-bottom: 0; }
+table.list tr.click { cursor: pointer; }
+table.list tr.click:hover td { background: var(--panel); }
+.table-wrap { overflow: auto; max-height: 420px; border: 1px solid var(--line); border-radius: 12px; background: #fff; }
+.ok-text { color: var(--success); } .bad-text { color: var(--danger); }
+
+/* --- Notices, checks, toast ----------------------------------------------------------------------------------- */
+.notice { padding: 12px 16px; border-radius: 10px; border: 1px solid var(--line); background: var(--panel); font-size: 13.5px; }
+.notice b { font-family: var(--font-mono); font-size: 12.5px; }
+.notice-ok { background: var(--success-soft); border-color: var(--success-border); }
+.notice-warn { background: var(--warn-soft); border-color: var(--warn-border); }
+.notice-bad { background: var(--danger-soft); border-color: var(--danger-border); }
+.checks { list-style: none; margin: 16px 0 0; padding: 0; display: grid; gap: 4px; }
+.check { display: flex; gap: 12px; align-items: flex-start; padding: 10px 0; border-top: 1px solid var(--line-soft); }
+.check:first-child { border-top: 0; }
+.check-icon { width: 22px; height: 22px; flex: none; border-radius: 50%; display: grid; place-items: center; }
+.check-icon .i { width: 12px; height: 12px; }
+.check-pass .check-icon { background: var(--success-soft); color: var(--success); }
+.check-fail .check-icon { background: var(--danger-soft); color: var(--danger); }
+.check-wait .check-icon { background: var(--line-soft); color: var(--ink-soft); }
+.check-note .check-icon { background: var(--warn-soft); color: var(--warn); }
+.check b { display: block; font-size: 13.5px; font-weight: 600; }
+.check span { font-size: 12.5px; color: var(--ink-soft); }
+.toast {
+  position: fixed; right: 20px; bottom: 20px; z-index: 50; max-width: 380px;
+  padding: 12px 16px; border-radius: 10px; background: var(--ink); color: #fff; font-size: 13px;
+  box-shadow: 0 10px 30px rgba(0, 0, 0, .18);
+}
+.skeleton { height: 92px; border-radius: 14px; background: linear-gradient(90deg, #fff 0%, #f6f7f2 50%, #fff 100%); background-size: 200% 100%; border: 1px solid var(--line); animation: shimmer 1.2s infinite; }
+@keyframes shimmer { from { background-position: 200% 0; } to { background-position: -200% 0; } }
+
+/* --- Other pages ------------------------------------------------------------------------------------------------ */
+.tiles { display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr)); gap: 12px; }
+.tile { padding: 16px 18px; }
+.tile b { display: block; margin-top: 6px; font-family: var(--font-mono); font-size: 22px; font-weight: 600; }
+.tiers { display: flex; flex-wrap: wrap; gap: 8px; }
+.how { margin: 0; padding: 0; list-style: none; counter-reset: how; display: grid; gap: 10px; }
+.how li { counter-increment: how; display: grid; grid-template-columns: 30px 1fr; gap: 12px; align-items: start; font-size: 14px; }
+.how li::before { content: counter(how); width: 26px; height: 26px; border-radius: 50%; display: grid; place-items: center; background: var(--ink); color: var(--lime); font-family: var(--font-mono); font-size: 12px; font-weight: 600; }
+.code-box { position: relative; }
+.code-box pre.block { padding-right: 76px; }
+.code-box .btn { position: absolute; right: 8px; top: 8px; }
+.profile-head { display: flex; align-items: center; gap: 16px; }
+.profile-head .avatar { width: 52px; height: 52px; font-size: 18px; background: var(--ink); color: var(--lime); border: 0; }
+
+/* --- Reviewing ------------------------------------------------------------------------------------------------- */
+.btn-danger { background: var(--danger); border-color: var(--danger); color: #fff; }
+.btn-danger:hover { background: #a82a42; border-color: #a82a42; }
+.pool-row.has-action { padding-right: 104px; }
+.row-action { position: absolute; right: 18px; top: 15px; }
+.audit-grid { display: grid; grid-template-columns: 230px minmax(0, 1fr); gap: 14px; margin-top: 14px; align-items: start; }
+.item-list { display: grid; gap: 2px; padding: 8px; position: sticky; top: 16px; max-height: calc(100vh - 32px); overflow: auto; }
+.item-list button {
+  display: flex; align-items: center; gap: 9px; width: 100%; padding: 8px 9px; border: 0; border-radius: 8px;
+  background: none; color: var(--ink-soft); font-size: 13px; text-align: left; cursor: pointer;
+}
+.item-list button:hover { background: var(--panel); color: var(--ink); }
+.item-list button.on { background: var(--nav-active); color: var(--lime); }
+.item-list .t { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.mark { width: 22px; height: 22px; flex: none; border-radius: 50%; display: grid; place-items: center; background: var(--line-soft); color: var(--ink-soft); font-family: var(--font-mono); font-size: 10.5px; }
+.mark .i { width: 12px; height: 12px; }
+.mark.ok { background: var(--success-soft); color: var(--success); }
+.mark.flagged { background: var(--danger-soft); color: var(--danger); }
+.item-card { display: grid; gap: 16px; padding: 22px; }
+.item-card h2 { margin: 0; font-size: 17px; font-weight: 600; }
+.item-card pre.block { margin-top: 6px; }
+.files { list-style: none; margin: 6px 0 8px; padding: 0; display: grid; gap: 4px; font-size: 13px; }
+.files li { display: flex; align-items: center; gap: 7px; }
+.decide { display: grid; gap: 14px; padding: 16px; border: 1px solid var(--line); border-radius: 10px; background: var(--panel); }
+.decide .reject { display: grid; gap: 8px; padding-top: 14px; border-top: 1px solid var(--line); }
+.item-nav { display: flex; justify-content: space-between; gap: 8px; }
+.sponsor-card { margin-top: 14px; padding: 20px 22px; border-color: var(--karma-border); }
+.sponsor-card details.disclose > summary { gap: 10px; }
+
+/* --- Small screens ------------------------------------------------------------------------------------------------ */
+@media (max-width: 600px) { .hide-sm { display: none; } }
+@media (max-width: 900px) {
+  .shell { grid-template-columns: minmax(0, 1fr); }
+  .sidebar { position: sticky; top: 0; z-index: 20; min-width: 0; height: auto; flex-direction: row; align-items: center; border-right: 0; border-bottom: 1px solid var(--dark-line); }
+  .brand { border-bottom: 0; padding: 12px 14px; }
+  .brand span { font-size: 15px; }
+  .nav { display: flex; overflow-x: auto; padding: 8px; gap: 2px; flex: 1; min-width: 0; scrollbar-width: none; }
+  .nav a { padding: 8px 10px; font-size: 12px; white-space: nowrap; }
+  .nav a .i { display: none; }
+  .side-bottom { display: none; }
+  .top-action {
+    display: inline-flex; align-items: center; flex: none; margin-right: 10px; padding: 7px 10px;
+    border: 1px solid var(--dark-line-soft); border-radius: 8px; background: none; cursor: pointer;
+    color: var(--lime); font-family: var(--font-mono); font-size: 12px;
+  }
+  .page { padding: 22px 16px 60px; }
+  .karma-card { grid-template-columns: auto 1fr; }
+  .karma-next { grid-column: 1 / -1; }
+  .stats { grid-template-columns: repeat(2, 1fr); }
+  .stat:nth-child(3) { border-left: 0; }
+  .filters { grid-template-columns: 1fr 1fr; }
+  .filters .search { grid-column: 1 / -1; }
+  .signin-card { grid-template-columns: auto 1fr; }
+  .signin-actions { grid-column: 1 / -1; justify-items: stretch; }
+  .signin-actions .note { text-align: left; max-width: none; }
+  .contract-grid, .two { grid-template-columns: 1fr; }
+  .pool-row .cap { grid-template-columns: 1fr auto; }
+  .pool-row .cap .progress { grid-column: 1 / -1; grid-row: 2; }
+  h1.title { font-size: 20px; }
+  .kv { flex-direction: column; gap: 0; }
+  .kv span:last-child { text-align: left; }
+  .form, .contract { padding: 18px 16px; }
+  .form-foot { flex-direction: column; align-items: stretch; }
+  .form-foot .btn { width: 100%; }
+  .audit-grid { grid-template-columns: minmax(0, 1fr); }
+  .item-list { position: static; max-height: none; display: flex; overflow-x: auto; }
+  .item-list button { width: auto; flex: none; }
+  .item-list .t { display: none; }
+  .item-card { padding: 18px 16px; }
+}
+
+/* Requesting a dataset (Sponsor) */
+.request-card { display: grid; gap: 10px; padding: 16px 18px; }
+.request-card .head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.request-card .head .pool-title { flex: 1 1 auto; min-width: 0; overflow-wrap: anywhere; }
+.request-card .row { gap: 8px; }
+.admin-note { border-left: 3px solid var(--warn-border); background: var(--warn-soft); border-radius: 0 8px 8px 0; padding: 8px 12px; }
+.admin-note p { margin: 4px 0 0; font-size: 13px; }
+.sample-line { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.slots { display: inline-flex; gap: 5px; }
+.slot { width: 10px; height: 10px; border-radius: 50%; border: 1.5px solid var(--line-strong); background: transparent; }
+.slot-ok { background: var(--success); border-color: var(--success); }
+.slot-wait { background: var(--warn-soft); border-color: var(--warn); }
+label.btn input[type=file] { display: none; }
+label.btn.busy { opacity: 0.6; pointer-events: none; }

web/app.js

@@ -1138,15 +1138,57 @@ function drawSponsorPanel(c, data, filter, live) {
 }
 
 // --- Sponsoring ----------------------------------------------------------------------------------------
-// Requesting a dataset happens on databounty.io: DataBounty's API doesn't offer it to other apps.
+
+const sponsorHead = () => html`<header class="page-head"><h1 class="title">Sponsor a dataset</h1><p class="sub">Ask the community for the dataset you need. Contributors build it, validators check it, and it's published openly.</p></header>`;
+
+function howSponsoring(min) {
+  return html`<h2 class="section">How it works</h2>
+    <div class="card pad"><ol class="how">
+      <li><span><b>You describe the dataset:</b> its type, how many items, the difficulty and the licence.</span></li>
+      <li><span><b>You add up to ${min} example items</b>, so contributors can see what a good one looks like.</span></li>
+      <li><span><b>DataBounty's team reviews the request</b> and its examples, then opens a pool for it.</span></li>
+      <li><span><b>Contributors submit items.</b> Each one is checked automatically, then reviewed by validators.</span></li>
+      <li><span><b>You can review items in your pool</b>, and dispute an accepted one while its dispute window is open.</span></li>
+      <li><span><b>The finished dataset is published</b> on the Hugging Face Hub, crediting every contributor.</span></li>
+    </ol></div>`;
+}
 
 async function pageSponsor() {
   const live = ticket();
+  let opts = null;
+  try { opts = await api("/api/requesting"); } catch { opts = null; }
+  if (!live()) return;
+  // Until DataBounty takes requests from other apps, they're made on databounty.io.
+  if (!opts || !opts.open) { await pageSponsorLink(live); return; }
+  const page = $("#page");
+  const me = state.me;
+  if (!me) {
+    mount(page, html`${sponsorHead()}${signInCard("Sign in to request a dataset", "Describe the dataset you need. DataBounty's team reviews your request, and the community builds it.")}${howSponsoring(opts.sampleMin)}`);
+    return;
+  }
+  if (me.step !== "ready") { mount(page, html`${sponsorHead()}${setupCard(me)}`); wireSetup(); return; }
+  if (!me.canSponsor) {
+    mount(page, html`${sponsorHead()}<div class="card setup-card"><h2>Allow sponsoring</h2><p>You signed in before the Space could request datasets for you. Sign out, sign in again, and keep <b>sponsor</b> ticked.</p><button class="btn" data-action="sign-out">sign out</button></div>`);
+    return;
+  }
+  mount(page, html`${sponsorHead()}
+    <h2 class="section">Your requests</h2>
+    <p class="section-sub">An admin reviews each request with its example items. Its pool can open once one example is approved.</p>
+    <div id="my-requests"><div class="skeleton"></div></div>
+    <h2 class="section">Request a dataset</h2>
+    <p class="section-sub">Pick the kind of items you need, then say how many and how hard.</p>
+    ${requestForm(opts)}
+    ${howSponsoring(opts.sampleMin)}`);
+  wireRequestForm(opts, live);
+  renderMyRequests(opts, live);
+}
+
+async function pageSponsorLink(live) {
   const data = await overview();
   if (!live()) return;
   const app = safeUrl(data.appUrl || "https://console.databounty.io");
   mount($("#page"), html`
-    <header class="page-head"><h1 class="title">Sponsor a dataset</h1><p class="sub">Ask the community for the dataset you need. Contributors build it, validators check it, and it's published openly.</p></header>
+    ${sponsorHead()}
     <div class="card signin-card">
       <img src="/static/logo.svg" alt="">
       <div><h2>Request a dataset</h2><p>Describe what each item needs, how many you want and how hard they should be. Requests are made on databounty.io.</p></div>
@@ -1168,6 +1210,179 @@ async function pageSponsor() {
     </div>`);
 }
 
+const TYPE_HINT = "What kind of items contributors make. Each type comes with its own automated checks.";
+
+function requestForm(opts) {
+  const groups = {};
+  opts.types.forEach((t) => { (groups[t.category] = groups[t.category] || []).push(t); });
+  const d = opts.defaults;
+  const label = (name, mark) => html`<div class="field-label"><span class="micro">${name}</span>${mark === "req" ? html`<span class="req">*</span>` : mark === "opt" ? html`<span class="opt">optional</span>` : ""}</div>`;
+  return html`<form class="card form" id="request-form" novalidate>
+    <div class="field">${label("dataset type", "req")}
+      <select class="select" id="rq-type"><option value="">Pick a dataset type…</option>${Object.entries(groups).map(([category, types]) => html`<optgroup label="${cap(category)}">${types.map((t) => html`<option value="${t.id}">${t.name}</option>`)}</optgroup>`)}</select>
+      <div class="hint" id="rq-type-hint">${TYPE_HINT}</div></div>
+    <div class="field">${label("title", "req")}<input class="input" id="rq-title" maxlength="120" placeholder="e.g. Python CLI parsers with tricky flags"></div>
+    <div class="field">${label("description", "req")}<textarea class="textarea" id="rq-description" maxlength="2000" placeholder="What the dataset is for, and what a good item looks like."></textarea></div>
+    <div class="two">
+      <div class="field" id="rq-language-field"></div>
+      <div class="field">${label("framework", "opt")}<input class="input" id="rq-framework" maxlength="60" placeholder="e.g. Django"></div>
+    </div>
+    <div class="two">
+      <div class="field">${label("items wanted", "req")}<input class="input" id="rq-items" type="number" min="10" max="100000" step="10" value="${d.targetItems}"></div>
+      <div class="field">${label("difficulty", "req")}<select class="select" id="rq-mix" disabled><option value="">Pick a type first</option></select></div>
+    </div>
+    <div class="two">
+      <div class="field">${label("hand-checked", "")}<select class="select" id="rq-audit" disabled><option value="">Pick a type first</option></select><div class="hint">The share of accepted items a validator also checks by hand.</div></div>
+      <div class="field">${label("licence", "req")}<select class="select" id="rq-licence">${opts.licences.map((l) => html`<option value="${l.value}" ${l.value === d.proposedLicense ? raw("selected") : ""}>${l.label}</option>`)}</select><div class="hint" id="rq-licence-hint"></div></div>
+    </div>
+    <div class="form-foot"><span class="mono small muted" id="rq-missing"></span><button class="btn btn-submit" id="rq-submit" type="submit" disabled>${icon("send")} Send request</button></div>
+    <div id="rq-result"></div>
+  </form>`;
+}
+
+function languageField(t) {
+  const label = (mark) => html`<div class="field-label"><span class="micro">language</span>${mark}</div>`;
+  if (!t) return html`${label("")}<input class="input" id="rq-language" disabled placeholder="Pick a type first">`;
+  if (t.languageMode === "none") return html`${label("")}<input class="input" id="rq-language" disabled value="None needed"><div class="hint">Items of this type have no code to run.</div>`;
+  if (t.languageMode === "fixed") return html`${label("")}<input class="input" id="rq-language" disabled value="${t.languages[0] || ""}"><div class="hint">This type checks items in ${t.languages[0] || "one language"} only.</div>`;
+  if (t.languageMode === "choice") return html`${label(html`<span class="req">*</span>`)}<select class="select" id="rq-language"><option value="">Pick one…</option>${t.languages.map((l) => html`<option value="${l}">${l}</option>`)}</select><div class="hint">The languages this type can run and check.</div>`;
+  return html`${label(html`<span class="opt">optional</span>`)}<input class="input" id="rq-language" maxlength="60" placeholder="e.g. Python">`;
+}
+
+const newRequestKey = () => (window.crypto && crypto.randomUUID ? crypto.randomUUID() : `rq-${Date.now()}-${Math.random().toString(36).slice(2, 12)}`);
+
+function wireRequestForm(opts, live) {
+  const form = $("#request-form");
+  const button = $("#rq-submit");
+  const out = $("#rq-result");
+  const types = Object.fromEntries(opts.types.map((t) => [t.id, t]));
+  // One key per request: sending the same form twice (a double click, a retry) files it once.
+  let key = newRequestKey();
+  let busy = false;
+  const current = () => types[$("#rq-type").value];
+  const pickType = () => {
+    const t = current();
+    $("#rq-type-hint").textContent = t ? t.description || TYPE_HINT : TYPE_HINT;
+    mount($("#rq-language-field"), languageField(t));
+    const mix = $("#rq-mix");
+    mount(mix, t ? t.mixes.map((m) => html`<option value="${m.value}" ${m.value === opts.defaults.difficultyMix ? raw("selected") : ""}>${m.label}</option>`) : html`<option value="">Pick a type first</option>`);
+    mix.disabled = !t;
+    const audit = $("#rq-audit");
+    const preferred = t && t.auditOptions.includes(opts.defaults.auditCoveragePct) ? opts.defaults.auditCoveragePct : t ? t.auditOptions[0] : null;
+    mount(audit, t ? t.auditOptions.map((n) => html`<option value="${n}" ${n === preferred ? raw("selected") : ""}>${n}%</option>`) : html`<option value="">Pick a type first</option>`);
+    audit.disabled = !t;
+  };
+  const licenceHint = () => {
+    const l = opts.licences.find((x) => x.value === $("#rq-licence").value);
+    $("#rq-licence-hint").textContent = l ? l.hint : "";
+  };
+  const missing = () => {
+    const t = current();
+    if (!t) return "Choose a dataset type.";
+    if ($("#rq-title").value.trim().length < 5) return "Give it a title of 5 characters or more.";
+    if ($("#rq-description").value.trim().length < 20) return "Describe the dataset in 20 characters or more.";
+    if (t.languageMode === "choice" && !$("#rq-language").value) return "Choose the language.";
+    const n = Number($("#rq-items").value);
+    if (!Number.isInteger(n) || n < 10 || n > 100000) return "Ask for 10 to 100,000 items.";
+    return "";
+  };
+  const update = () => {
+    const m = missing();
+    $("#rq-missing").textContent = m || "ready to send";
+    button.disabled = busy || Boolean(m);
+  };
+  $("#rq-type").addEventListener("change", pickType);
+  $("#rq-licence").addEventListener("change", licenceHint);
+  form.addEventListener("input", update);
+  form.addEventListener("change", update);
+  form.addEventListener("submit", async (e) => {
+    e.preventDefault();
+    if (busy || missing()) return;
+    const body = {
+      datasetTypeId: current().id,
+      title: $("#rq-title").value,
+      description: $("#rq-description").value,
+      language: $("#rq-language").value,
+      framework: $("#rq-framework").value,
+      targetItems: Number($("#rq-items").value),
+      difficultyMix: $("#rq-mix").value,
+      auditCoveragePct: Number($("#rq-audit").value),
+      proposedLicense: $("#rq-licence").value,
+      idempotencyKey: key,
+    };
+    busy = true;
+    button.disabled = true;
+    mount(button, html`${icon("refresh")} Sending…`);
+    try {
+      await api("/api/requests", { method: "POST", body });
+      mount(out, notice("ok", html`<b>Request sent ✓</b> Now add example items to it under Your requests, so the team can see what a good item looks like.`));
+      form.reset();
+      key = newRequestKey();
+      pickType();
+      licenceHint();
+      await renderMyRequests(opts, live);
+    } catch (err) {
+      mount(out, notice("bad", html`<b>Not sent.</b> ${err.message}`));
+    } finally {
+      busy = false;
+      mount(button, html`${icon("send")} Send request`);
+      update();
+      out.scrollIntoView({ behavior: "smooth", block: "nearest" });
+    }
+  });
+  pickType();
+  licenceHint();
+  update();
+}
+
+async function renderMyRequests(opts, live) {
+  let data;
+  try { data = await api("/api/requests/mine"); } catch (e) {
+    if (live() && $("#my-requests")) mount($("#my-requests"), notice("warn", e.message));
+    return;
+  }
+  const box = $("#my-requests");
+  if (!live() || !box) return;
+  if (!data.requests.length) { mount(box, html`<div class="card empty">No requests yet. Start one below.</div>`); return; }
+  mount(box, html`<div class="rows">${data.requests.map(requestCard)}</div>${data.more ? html`<p class="hint" style="margin:10px 2px 0">Showing your newest 50.</p>` : ""}`);
+  $$("[data-sample]", box).forEach((input) => input.addEventListener("change", () => addSample(input, opts, live)));
+}
+
+function requestCard(r) {
+  const s = r.samples;
+  const dots = Array.from({ length: s.wanted }, (_, i) => html`<span class="slot ${i < s.approved ? "slot-ok" : i < s.approved + s.pending ? "slot-wait" : ""}"></span>`);
+  const facts = [r.type, r.targetItems ? `${fmt(r.targetItems)} items` : "", r.difficulty, r.language, r.date].filter(Boolean).join(" · ");
+  return html`<div class="card request-card" data-request="${r.id}">
+    <div class="head"><span class="pool-title">${r.title}</span><span class="pill pill-${r.statusTone}">${r.statusLabel}</span></div>
+    <div class="mono small muted">${facts}</div>
+    ${r.adminNote ? html`<div class="admin-note"><div class="micro">from the reviewer</div><p>${r.adminNote}</p></div>` : ""}
+    <div class="sample-line"><span class="slots" aria-hidden="true">${dots}</span><span class="small">${r.sampleText}</span></div>
+    ${r.canAddSample || r.poolId ? html`<div class="row wrap">
+      ${r.canAddSample ? html`<label class="btn btn-sm btn-primary">${icon("upload")} add an example item<input type="file" accept=".json,.jsonl,.ndjson" data-sample="${r.id}" hidden></label>
+        <a class="btn btn-sm" href="/api/requesting/${encodeURIComponent(r.typeId)}/example.json" download>${icon("download")} example template</a>` : ""}
+      ${r.poolId ? html`<a class="btn btn-sm" href="#/pool/${encodeURIComponent(r.poolId)}">open your pool ${icon("arrow")}</a>` : ""}
+    </div>` : ""}
+  </div>`;
+}
+
+async function addSample(input, opts, live) {
+  const file = input.files && input.files[0];
+  if (!file) return;
+  const label = input.closest("label");
+  if (label) label.classList.add("busy");
+  const form = new FormData();
+  form.append("file", file);
+  try {
+    await api(`/api/requests/${encodeURIComponent(input.dataset.sample)}/samples`, { method: "POST", form });
+    toast("Example added. DataBounty checks the file, then an admin reviews it.");
+    await renderMyRequests(opts, live);
+  } catch (e) {
+    toast(e.message);
+    if (label) label.classList.remove("busy");
+    input.value = "";
+  }
+}
+
 // --- Datasets, leaderboard, profiles ------------------------------------------------------------------
 
 const codeBox = (text) => html`<div class="code-box"><pre class="block">${text}</pre><button class="btn btn-sm" data-action="copy" data-copy="${text}">${icon("copy")} copy</button></div>`;

web/index.html

@@ -10,7 +10,7 @@
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500;600;700&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="/static/app.css?v=7">
+  <link rel="stylesheet" href="/static/app.css?v=8">
 </head>
 <body>
   <div class="shell">
@@ -19,6 +19,6 @@
   </div>
   <div class="toast" id="toast" role="status" aria-live="polite" hidden></div>
   <noscript><p style="padding:24px;font-family:sans-serif">This page needs JavaScript. You can also contribute at <a href="https://databounty.io">databounty.io</a>.</p></noscript>
-  <script src="/static/app.js?v=7" defer></script>
+  <script src="/static/app.js?v=8" defer></script>
 </body>
 </html>

webapi.py

@@ -1,536 +1,619 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The JSON API behind the Space's web page (web/app.js): contributing, reviewing, and public reads.
-
-Public reads come straight from databounty.py. Anything done as a person goes through account.py
-with the session handle the page sends as `Authorization: Bearer <handle>`. The page keeps that
-handle in its own storage (account.py explains why not a cookie), and a handle only ever reaches
-the page through claim_sign_in, which only the page that started the sign-in can complete.
-"""
-
-from __future__ import annotations
-
-import json
-import re
-import tempfile
-from pathlib import Path
-from typing import Any
-
-from fastapi import APIRouter, Request
-from fastapi.responses import JSONResponse, Response
-
-import account
-import contribute
-import databounty as db
-import items as checks
-import sponsor
-import validate
-
-NO_STORE = {"Cache-Control": "no-store"}
-MAX_FILE_BYTES = 100 * 1024 * 1024
-
-router = APIRouter(prefix="/api")
-
-
-class ApiError(Exception):
-    """An answer for the page: an HTTP status and a message written for people."""
-
-    def __init__(self, status: int, message: str, *, needs: str = ""):
-        super().__init__(message)
-        self.status = status
-        self.message = message
-        self.needs = needs  # what the page should offer next, e.g. "claim"
-
-
-def api_error(_request: Request, exc: ApiError) -> JSONResponse:
-    body = {"error": exc.message, **({"needs": exc.needs} if exc.needs else {})}
-    return JSONResponse(body, status_code=exc.status, headers=NO_STORE)
-
-
-def _ok(data: Any) -> JSONResponse:
-    return JSONResponse(data, headers=NO_STORE)
-
-
-def _public(load):
-    try:
-        return load()
-    except db.UpstreamError as exc:
-        raise ApiError(502, str(exc)) from exc
-
-
-def _bearer(request: Request) -> str:
-    header = request.headers.get("authorization", "")
-    return header[7:].strip() if header.lower().startswith("bearer ") else ""
-
-
-def _session(request: Request) -> tuple[str, account.Session]:
-    session_id = _bearer(request)
-    session = account.session_for(session_id) if session_id else None
-    if session is None:
-        raise ApiError(401, "Sign in to continue.")
-    return session_id, session
-
-
-def _call(session: account.Session, name: str, arguments: dict[str, Any] | None = None) -> Any:
-    try:
-        return account.call_tool(session, name, arguments)
-    except account.NotSignedIn as exc:
-        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
-    except account.ToolError as exc:
-        raise ApiError(400, str(exc)) from exc
-
-
-async def _json(request: Request) -> dict[str, Any]:
-    try:
-        body = await request.json()
-    except ValueError as exc:
-        raise ApiError(400, "Send a JSON body.") from exc
-    return body if isinstance(body, dict) else {}
-
-
-# --- Public ---------------------------------------------------------------------------------------
-
-
-@router.get("/overview")
-def overview():
-    return _ok({"stats": _public(db.stats), "tiers": _public(db.tiers), "hfOrg": db.HF_ORG, "siteUrl": db.SITE_URL, "appUrl": db.APP_URL})
-
-
-@router.get("/pools")
-def pools(q: str = "", domain: str = "", difficulty: str = ""):
-    return _ok({"pools": _public(lambda: db.open_pools(q, domain.lower(), difficulty.lower()))})
-
-
-@router.get("/datasets")
-def datasets():
-    return _ok({"datasets": _public(db.published_datasets)})
-
-
-@router.get("/leaderboard")
-def leaderboard(tier: str = "", q: str = ""):
-    return _ok({"rows": _public(lambda: db.leaderboard(limit=100, tier=tier.lower(), query=q))})
-
-
-@router.get("/profiles/{handle}")
-def profile(handle: str):
-    try:
-        person = _public(lambda: db.contributor(handle))
-    except ValueError as exc:
-        raise ApiError(400, str(exc)) from exc
-    if person is None:
-        raise ApiError(404, "There's no public profile with that handle. Members can keep their profile private.")
-    return _ok(person)
-
-
-@router.get("/tools")
-def tools():
-    return _ok({"tools": _public(db.platform_mcp_tools), "mcpUrl": db.MCP_URL})
-
-
-# --- Session and account ------------------------------------------------------------------------------
-
-
-@router.post("/session/claim")
-async def claim_session(request: Request):
-    nonce = str((await _json(request)).get("nonce") or "")
-    session_id = account.claim_sign_in(nonce)
-    if not session_id:
-        raise ApiError(404, "That sign-in isn't ready, or it was already used.")
-    return _ok({"session": session_id})
-
-
-@router.post("/session/sign-out")
-def sign_out(request: Request):
-    account.sign_out(_bearer(request) or None)
-    return _ok({"ok": True})
-
-
-@router.get("/me")
-def me(request: Request):
-    _, session = _session(request)
-    who = _call(session, "whoami")
-    session.me = who
-    scopes = set(session.scope.split())
-    step = (
-        "permission" if "contribute" not in scopes
-        else "verify_email" if not who.get("emailVerified")
-        else "choose_handle" if not who.get("handle")
-        else "finish_setup" if not who.get("onboarded")
-        else "ready"
-    )
-    suggestion = ""
-    if step == "choose_handle" and "account" in scopes:
-        try:
-            suggested = account.call_tool(session, "suggest_handles", {"baseName": who.get("displayName") or "", "count": 3})
-            suggestion = suggested[0] if isinstance(suggested, list) and suggested else ""
-        except (account.ToolError, account.NotSignedIn):
-            suggestion = ""
-    return _ok({
-        "displayName": who.get("displayName") or "",
-        "handle": who.get("handle") or "",
-        "email": who.get("email") or "",
-        "karma": who.get("karmaTotal") if isinstance(who.get("karmaTotal"), (int, float)) else 0,
-        "step": step,
-        "suggestedHandle": suggestion,
-        "profileUrl": f"{db.SITE_URL}/{who.get('handle')}/" if who.get("handle") else "",
-        # Sign-ins from before the Space asked for `validate` or `sponsor` can't use those screens.
-        "canReview": "validate" in scopes,
-        "canSponsor": "sponsor" in scopes,
-        "reviewer": validate.rank_view(who),
-    })
-
-
-@router.post("/me/handle-check")
-async def handle_check(request: Request):
-    _, session = _session(request)
-    handle = str((await _json(request)).get("handle") or "").strip().lower().lstrip("@")
-    if not handle:
-        raise ApiError(400, "Type a username first.")
-    result = _call(session, "get_handle_availability", {"handle": handle})
-    return _ok({"handle": handle, "available": bool(result.get("available")), "reason": result.get("reason") or ""})
-
-
-@router.post("/me/finish-setup")
-async def finish_setup(request: Request):
-    _, session = _session(request)
-    handle = str((await _json(request)).get("handle") or "").strip().lower().lstrip("@")
-    who = session.me or _call(session, "whoami")
-    if not who.get("handle"):
-        if not handle:
-            raise ApiError(400, "Type the username you want first.")
-        result = _call(session, "get_handle_availability", {"handle": handle})
-        if not result.get("available"):
-            raise ApiError(409, f"@{handle} isn't available: {result.get('reason') or 'it is taken'}.")
-        _call(session, "claim_handle", {"handle": handle})
-    _call(session, "complete_onboarding", {"persona": "contributor"})
-    session.me = None
-    return _ok({"ok": True})
-
-
-@router.post("/me/resend-verification")
-def resend_verification(request: Request):
-    _, session = _session(request)
-    result = _call(session, "resend_email_verification") or {}
-    return _ok({"alreadyVerified": result.get("status") == "already_verified"})
-
-
-# --- Pools ---------------------------------------------------------------------------------------------
-
-
-def _contract(session: account.Session, pool_id: str) -> dict[str, Any]:
-    return contribute.contract_view(_call(session, "get_pool_contract", {"bountyId": pool_id}), pool_id)
-
-
-@router.get("/pools/{pool_id}/contract")
-def contract(pool_id: str, request: Request):
-    session = account.session_for(_bearer(request)) if _bearer(request) else None
-    if session is not None:
-        return _ok(_contract(session, pool_id))
-    try:
-        details = _public(lambda: db.pool_details(pool_id))
-    except ValueError as exc:
-        raise ApiError(400, str(exc)) from exc
-    if details is None:
-        raise ApiError(404, "That pool is no longer listed.")
-    return _ok(contribute.public_contract_view(details))
-
-
-@router.get("/pools/{pool_id}/template.csv")
-def template(pool_id: str):
-    try:
-        details = _public(lambda: db.pool_details(pool_id))
-    except ValueError as exc:
-        raise ApiError(400, str(exc)) from exc
-    if details is None:
-        raise ApiError(404, "That pool is no longer listed.")
-    text = contribute.template_csv(details.get("fields") or [])
-    if not text:
-        raise ApiError(404, "This pool takes files, so add its items one at a time.")
-    slug = re.sub(r"[^a-z0-9]+", "-", str(details.get("title") or "pool").lower()).strip("-")[:48] or "pool"
-    return Response(
-        text,
-        media_type="text/csv; charset=utf-8",
-        headers={"Content-Disposition": f'attachment; filename="{slug}-template.csv"', **NO_STORE},
-    )
-
-
-async def _save(upload: Any) -> tuple[str, str, str]:
-    """An uploaded file, to a temporary path: (path, filename, content type)."""
-    data = await upload.read()
-    if len(data) > MAX_FILE_BYTES:
-        raise ApiError(413, f"{upload.filename} is larger than {MAX_FILE_BYTES // (1024 * 1024)} MB.")
-    suffix = Path(upload.filename or "upload").suffix[:16]
-    with tempfile.NamedTemporaryFile(delete=False, suffix=suffix, prefix="databounty-space-") as handle:
-        handle.write(data)
-    return handle.name, Path(upload.filename or "upload").name, upload.content_type or "application/octet-stream"
-
-
-@router.post("/pools/{pool_id}/items")
-async def submit_item(pool_id: str, request: Request):
-    _, session = _session(request)
-    # Closing the form deletes the uploads' temporary files.
-    async with request.form() as form:
-        return await _submit_item(session, pool_id, form)
-
-
-async def _submit_item(session: account.Session, pool_id: str, form: Any) -> JSONResponse:
-    method = str(form.get("method") or "")
-    if method not in contribute.GENERATION_METHODS:
-        raise ApiError(400, "Choose how you made this item.")
-    try:
-        values = json.loads(str(form.get("values") or "{}"))
-    except ValueError as exc:
-        raise ApiError(400, "The form's values didn't arrive in one piece. Try again.") from exc
-    files: dict[str, list[Any]] = {}
-    for name, value in form.multi_items():
-        if name.startswith("file:") and getattr(value, "filename", None):
-            files.setdefault(name[5:], []).append(value)
-
-    contract_data = _contract(session, pool_id)
-    if not contract_data["open"]:
-        raise ApiError(409, "This pool isn't taking items right now.")
-    payload, problems = contribute.item_payload(contract_data["fields"], values if isinstance(values, dict) else {}, {k: len(v) for k, v in files.items()})
-    if problems:
-        raise ApiError(400, " ".join(problems))
-
-    saved: list[str] = []
-    try:
-        for spec in contract_data["fields"]:
-            uploads = files.get(spec["key"]) or []
-            if spec["role"] != "file" or not uploads:
-                continue
-            ids = []
-            for upload in uploads:
-                path, filename, content_type = await _save(upload)
-                saved.append(path)
-                try:
-                    ids.append(account.upload_file(session, pool_id, path, filename, content_type))
-                except account.NotSignedIn as exc:
-                    raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
-                except account.ToolError as exc:
-                    raise ApiError(400, str(exc)) from exc
-            payload[spec["key"]] = ids if spec["maxCount"] > 1 else ids[0]
-    finally:
-        for path in saved:
-            Path(path).unlink(missing_ok=True)
-
-    title = " ".join(str(form.get("title") or "").split())[:120] or contribute.title_for(payload)
-    if len(title) < 3:
-        title = f"{title} item".strip()
-    result = _call(
-        session,
-        "submit_pool_items",
-        {"bountyId": pool_id, "items": [{"title": title, "payloadJson": payload, "generationMethod": method}]},
-    )
-    subs = result.get("submissions") or []
-    duplicate = bool(subs) and all(s.get("status") == "rejected" and s.get("duplicateOfSubmissionId") for s in subs)
-    return _ok({"duplicate": duplicate, "submissions": [{"id": s.get("id"), "status": s.get("status")} for s in subs], "karma": contract_data["karma"]})
-
-
-@router.post("/pools/{pool_id}/bulk/preview")
-async def bulk_preview(pool_id: str, request: Request):
-    _, session = _session(request)
-    async with request.form() as form:
-        upload = form.get("file")
-        if not getattr(upload, "filename", None):
-            raise ApiError(400, "Choose a file first.")
-        data = await upload.read()
-    fields = _contract(session, pool_id)["fields"]
-    try:
-        rows = checks.parse_bulk(data, upload.filename)
-    except ValueError as exc:
-        raise ApiError(400, str(exc)) from exc
-    if len(rows) > contribute.MAX_BULK_ROWS:
-        raise ApiError(400, f"That file has {len(rows):,} rows. Upload up to {contribute.MAX_BULK_ROWS} at a time.")
-    for row in rows:
-        if row.payload is not None:
-            row.payload = checks.coerce_for_contract(fields, row.payload)
-    checks.check_rows(rows, fields)
-    return _ok({
-        "rows": [
-            {
-                "number": row.number,
-                "ok": row.ok,
-                "problem": "" if row.ok else (row.error or "; ".join(row.problems)),
-                "title": contribute.title_for(row.payload, row.number),
-                "payload": row.payload,
-            }
-            for row in rows
-        ],
-        "hasFileFields": any(spec["role"] == "file" for spec in fields),
-    })
-
-
-@router.post("/pools/{pool_id}/bulk/send")
-async def bulk_send(pool_id: str, request: Request):
-    _, session = _session(request)
-    body = await _json(request)
-    method = str(body.get("method") or "")
-    if method not in contribute.GENERATION_METHODS:
-        raise ApiError(400, "Choose how you made these items.")
-    contract_data = _contract(session, pool_id)
-    if not contract_data["open"]:
-        raise ApiError(409, "This pool isn't taking items right now.")
-    # Every row is checked again here: the page's copy is only a preview.
-    items, skipped = [], 0
-    for row in body.get("rows") or []:
-        payload = row.get("payload") if isinstance(row, dict) else None
-        if not isinstance(payload, dict) or checks.item_problems(contract_data["fields"], payload):
-            skipped += 1
-            continue
-        number = int(row.get("number") or 0)
-        title = " ".join(str(row.get("title") or "").split())[:120] or contribute.title_for(payload, number)
-        items.append({"title": title, "payloadJson": payload, "generationMethod": method})
-    if not items:
-        raise ApiError(400, "None of those rows are ready to send.")
-    sent = duplicates = 0
-    problem = ""
-    size = max(1, contract_data["maxItems"])
-    for start in range(0, len(items), size):
-        try:
-            result = account.call_tool(session, "submit_pool_items", {"bountyId": pool_id, "items": items[start : start + size]})
-        except account.NotSignedIn:
-            problem = "Your sign-in ended, so the rest weren't sent. Sign in again to continue."
-            break
-        except account.ToolError as exc:
-            problem = f"Items {start + 1} onwards weren't sent: {exc}"
-            break
-        created = result.get("submissions") or []
-        sent += len(created)
-        duplicates += sum(1 for s in created if s.get("status") == "rejected" and s.get("duplicateOfSubmissionId"))
-        if result.get("stoppedAtCapacity"):
-            problem = "The pool filled up, so the rest weren't sent."
-            break
-    return _ok({"sent": sent, "duplicates": duplicates, "skipped": skipped, "problem": problem, "karma": contract_data["karma"]})
-
-
-# --- Submissions ------------------------------------------------------------------------------------------
-
-
-@router.get("/submissions")
-def submissions(request: Request):
-    _, session = _session(request)
-    data = _call(session, "list_my_submissions", {"limit": 50}) or {}
-    rows = [contribute.submission_row(item) for item in data.get("items") or []]
-    return _ok({"items": rows, "total": data.get("total") if isinstance(data.get("total"), int) else len(rows)})
-
-
-@router.get("/submissions/{submission_id}")
-def submission(submission_id: str, request: Request):
-    _, session = _session(request)
-    return _ok(contribute.submission_view(_call(session, "check_submission", {"submissionId": submission_id}), db.APP_URL))
-
-
-# --- Reviewing --------------------------------------------------------------------------------------
-# A review is an audit: a few items from one pool, held by one reviewer for 24 hours.
-
-
-def _reviewer(request: Request) -> account.Session:
-    _, session = _session(request)
-    if "validate" not in session.scope.split():
-        raise ApiError(403, "The Space isn't allowed to review for you. Sign out, then sign in again and keep validate ticked.")
-    return session
-
-
-@router.get("/audits")
-def audits(request: Request, q: str = ""):
-    session = _reviewer(request)
-    search = " ".join(q.split())[:120]
-    data = _call(session, "list_audits", {"limit": 50, **({"search": search} if search else {})}) or {}
-    rows = [validate.audit_row(a) for a in data.get("audits") or []]
-    return _ok({
-        "audits": rows,
-        "total": data.get("total") if isinstance(data.get("total"), int) else len(rows),
-        # Audits holding the reviewer's own work, which they can't review.
-        "hidden": data.get("conflictExcluded") if isinstance(data.get("conflictExcluded"), int) else 0,
-    })
-
-
-@router.get("/audits/mine")
-def my_audits(request: Request, status: str = "claimed"):
-    session = _reviewer(request)
-    status = status if status in ("claimed", "overdue_review", "completed") else "claimed"
-    data = _call(session, "list_my_audits", {"status": status, "limit": 50}) or {}
-    rows = [validate.audit_row(a) for a in data.get("audits") or []]
-    return _ok({"audits": rows, "total": data.get("total") if isinstance(data.get("total"), int) else len(rows)})
-
-
-@router.post("/audits/{audit_id}/claim")
-def claim_audit(audit_id: str, request: Request):
-    session = _reviewer(request)
-    window = (_call(session, "claim_audit", {"windowId": audit_id}) or {}).get("window") or {}
-    return _ok({"id": window.get("id") or audit_id, "deadline": window.get("claimExpiresAt")})
-
-
-@router.get("/audits/{audit_id}")
-def audit(audit_id: str, request: Request):
-    session = _reviewer(request)
-    try:
-        detail = account.call_tool(session, "get_audit", {"windowId": audit_id})
-    except account.NotSignedIn as exc:
-        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
-    except account.ToolError as exc:
-        # The items stay hidden until the reviewer holds the audit (DataBounty's rule).
-        if "claim_audit" in str(exc) or "Claim this audit" in str(exc):
-            raise ApiError(409, "Claim this audit to see its items. It's yours for 24 hours.", needs="claim") from exc
-        raise ApiError(400, str(exc)) from exc
-    return _ok(validate.audit_view(detail or {}, db.APP_URL))
-
-
-@router.post("/audits/{audit_id}/decisions")
-async def decide(audit_id: str, request: Request):
-    session = _reviewer(request)
-    decision, problem = validate.decision(await _json(request))
-    if problem:
-        raise ApiError(400, problem)
-    result = _call(session, "submit_decisions", {"windowId": audit_id, "decisions": [decision]}) or {}
-    return _ok({"ok": True, "decided": result.get("decisionsCount", 1)})
-
-
-# --- Sponsoring ----------------------------------------------------------------------------------------
-# Only a pool's requester can see its items (DataBounty's rule), so the page asks on every pool and
-# shows the panel only when DataBounty says yes. Requesting a dataset stays on databounty.io.
-
-
-def _sponsor(request: Request) -> account.Session:
-    _, session = _session(request)
-    if "sponsor" not in session.scope.split():
-        raise ApiError(403, "Sign out, then sign in again and keep sponsor ticked, to see your pools here.", needs="sponsor_scope")
-    return session
-
-
-def _sponsor_call(session: account.Session, name: str, arguments: dict[str, Any]) -> Any:
-    try:
-        return account.call_tool(session, name, arguments)
-    except account.NotSignedIn as exc:
-        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
-    except account.ToolError as exc:
-        message = str(exc)
-        if "owner" in message.lower() or "forbidden" in message.lower():
-            raise ApiError(403, "Only the person who requested this pool can see its items.", needs="not_sponsor") from exc
-        raise ApiError(400, message) from exc
-
-
-@router.get("/pools/{pool_id}/sponsor")
-def sponsor_pool(pool_id: str, request: Request, status: str = "", q: str = ""):
-    session = _sponsor(request)
-    arguments: dict[str, Any] = {"bountyId": pool_id, "limit": 50}
-    if status.strip():
-        arguments["status"] = status.strip()
-    if q.strip():
-        arguments["search"] = " ".join(q.split())[:120]
-    data = _sponsor_call(session, "get_sponsor_submission_evidence", arguments) or {}
-    try:
-        specs = (db.pool_details(pool_id) or {}).get("fields") or []
-    except (ValueError, db.UpstreamError):
-        specs = []  # labels are a nicety; the items still show under their keys
-    return _ok(sponsor.pool_view(data, specs))
-
-
-@router.post("/sponsor/submissions/{submission_id}/dispute")
-async def sponsor_dispute(submission_id: str, request: Request):
-    session = _sponsor(request)
-    arguments, problem = sponsor.dispute(await _json(request))
-    if problem:
-        raise ApiError(400, problem)
-    _sponsor_call(session, "dispute_accepted_submission", {"submissionId": submission_id, **arguments})
-    return _ok({"ok": True})
+# SPDX-License-Identifier: Apache-2.0
+"""The JSON API behind the Space's web page (web/app.js): contributing, reviewing, and public reads.
+
+Public reads come straight from databounty.py. Anything done as a person goes through account.py
+with the session handle the page sends as `Authorization: Bearer <handle>`. The page keeps that
+handle in its own storage (account.py explains why not a cookie), and a handle only ever reaches
+the page through claim_sign_in, which only the page that started the sign-in can complete.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse, Response
+
+import account
+import contribute
+import databounty as db
+import items as checks
+import requesting
+import sponsor
+import validate
+
+NO_STORE = {"Cache-Control": "no-store"}
+MAX_FILE_BYTES = 100 * 1024 * 1024
+
+router = APIRouter(prefix="/api")
+
+
+class ApiError(Exception):
+    """An answer for the page: an HTTP status and a message written for people."""
+
+    def __init__(self, status: int, message: str, *, needs: str = ""):
+        super().__init__(message)
+        self.status = status
+        self.message = message
+        self.needs = needs  # what the page should offer next, e.g. "claim"
+
+
+def api_error(_request: Request, exc: ApiError) -> JSONResponse:
+    body = {"error": exc.message, **({"needs": exc.needs} if exc.needs else {})}
+    return JSONResponse(body, status_code=exc.status, headers=NO_STORE)
+
+
+def _ok(data: Any) -> JSONResponse:
+    return JSONResponse(data, headers=NO_STORE)
+
+
+def _public(load):
+    try:
+        return load()
+    except db.UpstreamError as exc:
+        raise ApiError(502, str(exc)) from exc
+
+
+def _bearer(request: Request) -> str:
+    header = request.headers.get("authorization", "")
+    return header[7:].strip() if header.lower().startswith("bearer ") else ""
+
+
+def _session(request: Request) -> tuple[str, account.Session]:
+    session_id = _bearer(request)
+    session = account.session_for(session_id) if session_id else None
+    if session is None:
+        raise ApiError(401, "Sign in to continue.")
+    return session_id, session
+
+
+def _call(session: account.Session, name: str, arguments: dict[str, Any] | None = None) -> Any:
+    try:
+        return account.call_tool(session, name, arguments)
+    except account.NotSignedIn as exc:
+        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
+    except account.ToolError as exc:
+        raise ApiError(400, str(exc)) from exc
+
+
+async def _json(request: Request) -> dict[str, Any]:
+    try:
+        body = await request.json()
+    except ValueError as exc:
+        raise ApiError(400, "Send a JSON body.") from exc
+    return body if isinstance(body, dict) else {}
+
+
+# --- Public ---------------------------------------------------------------------------------------
+
+
+@router.get("/overview")
+def overview():
+    return _ok({"stats": _public(db.stats), "tiers": _public(db.tiers), "hfOrg": db.HF_ORG, "siteUrl": db.SITE_URL, "appUrl": db.APP_URL})
+
+
+@router.get("/pools")
+def pools(q: str = "", domain: str = "", difficulty: str = ""):
+    return _ok({"pools": _public(lambda: db.open_pools(q, domain.lower(), difficulty.lower()))})
+
+
+@router.get("/datasets")
+def datasets():
+    return _ok({"datasets": _public(db.published_datasets)})
+
+
+@router.get("/leaderboard")
+def leaderboard(tier: str = "", q: str = ""):
+    return _ok({"rows": _public(lambda: db.leaderboard(limit=100, tier=tier.lower(), query=q))})
+
+
+@router.get("/profiles/{handle}")
+def profile(handle: str):
+    try:
+        person = _public(lambda: db.contributor(handle))
+    except ValueError as exc:
+        raise ApiError(400, str(exc)) from exc
+    if person is None:
+        raise ApiError(404, "There's no public profile with that handle. Members can keep their profile private.")
+    return _ok(person)
+
+
+@router.get("/tools")
+def tools():
+    return _ok({"tools": _public(db.platform_mcp_tools), "mcpUrl": db.MCP_URL})
+
+
+# --- Session and account ------------------------------------------------------------------------------
+
+
+@router.post("/session/claim")
+async def claim_session(request: Request):
+    nonce = str((await _json(request)).get("nonce") or "")
+    session_id = account.claim_sign_in(nonce)
+    if not session_id:
+        raise ApiError(404, "That sign-in isn't ready, or it was already used.")
+    return _ok({"session": session_id})
+
+
+@router.post("/session/sign-out")
+def sign_out(request: Request):
+    account.sign_out(_bearer(request) or None)
+    return _ok({"ok": True})
+
+
+@router.get("/me")
+def me(request: Request):
+    _, session = _session(request)
+    who = _call(session, "whoami")
+    session.me = who
+    scopes = set(session.scope.split())
+    step = (
+        "permission" if "contribute" not in scopes
+        else "verify_email" if not who.get("emailVerified")
+        else "choose_handle" if not who.get("handle")
+        else "finish_setup" if not who.get("onboarded")
+        else "ready"
+    )
+    suggestion = ""
+    if step == "choose_handle" and "account" in scopes:
+        try:
+            suggested = account.call_tool(session, "suggest_handles", {"baseName": who.get("displayName") or "", "count": 3})
+            suggestion = suggested[0] if isinstance(suggested, list) and suggested else ""
+        except (account.ToolError, account.NotSignedIn):
+            suggestion = ""
+    return _ok({
+        "displayName": who.get("displayName") or "",
+        "handle": who.get("handle") or "",
+        "email": who.get("email") or "",
+        "karma": who.get("karmaTotal") if isinstance(who.get("karmaTotal"), (int, float)) else 0,
+        "step": step,
+        "suggestedHandle": suggestion,
+        "profileUrl": f"{db.SITE_URL}/{who.get('handle')}/" if who.get("handle") else "",
+        # Sign-ins from before the Space asked for `validate` or `sponsor` can't use those screens.
+        "canReview": "validate" in scopes,
+        "canSponsor": "sponsor" in scopes,
+        "reviewer": validate.rank_view(who),
+    })
+
+
+@router.post("/me/handle-check")
+async def handle_check(request: Request):
+    _, session = _session(request)
+    handle = str((await _json(request)).get("handle") or "").strip().lower().lstrip("@")
+    if not handle:
+        raise ApiError(400, "Type a username first.")
+    result = _call(session, "get_handle_availability", {"handle": handle})
+    return _ok({"handle": handle, "available": bool(result.get("available")), "reason": result.get("reason") or ""})
+
+
+@router.post("/me/finish-setup")
+async def finish_setup(request: Request):
+    _, session = _session(request)
+    handle = str((await _json(request)).get("handle") or "").strip().lower().lstrip("@")
+    who = session.me or _call(session, "whoami")
+    if not who.get("handle"):
+        if not handle:
+            raise ApiError(400, "Type the username you want first.")
+        result = _call(session, "get_handle_availability", {"handle": handle})
+        if not result.get("available"):
+            raise ApiError(409, f"@{handle} isn't available: {result.get('reason') or 'it is taken'}.")
+        _call(session, "claim_handle", {"handle": handle})
+    _call(session, "complete_onboarding", {"persona": "contributor"})
+    session.me = None
+    return _ok({"ok": True})
+
+
+@router.post("/me/resend-verification")
+def resend_verification(request: Request):
+    _, session = _session(request)
+    result = _call(session, "resend_email_verification") or {}
+    return _ok({"alreadyVerified": result.get("status") == "already_verified"})
+
+
+# --- Pools ---------------------------------------------------------------------------------------------
+
+
+def _contract(session: account.Session, pool_id: str) -> dict[str, Any]:
+    return contribute.contract_view(_call(session, "get_pool_contract", {"bountyId": pool_id}), pool_id)
+
+
+@router.get("/pools/{pool_id}/contract")
+def contract(pool_id: str, request: Request):
+    session = account.session_for(_bearer(request)) if _bearer(request) else None
+    if session is not None:
+        return _ok(_contract(session, pool_id))
+    try:
+        details = _public(lambda: db.pool_details(pool_id))
+    except ValueError as exc:
+        raise ApiError(400, str(exc)) from exc
+    if details is None:
+        raise ApiError(404, "That pool is no longer listed.")
+    return _ok(contribute.public_contract_view(details))
+
+
+@router.get("/pools/{pool_id}/template.csv")
+def template(pool_id: str):
+    try:
+        details = _public(lambda: db.pool_details(pool_id))
+    except ValueError as exc:
+        raise ApiError(400, str(exc)) from exc
+    if details is None:
+        raise ApiError(404, "That pool is no longer listed.")
+    text = contribute.template_csv(details.get("fields") or [])
+    if not text:
+        raise ApiError(404, "This pool takes files, so add its items one at a time.")
+    slug = re.sub(r"[^a-z0-9]+", "-", str(details.get("title") or "pool").lower()).strip("-")[:48] or "pool"
+    return Response(
+        text,
+        media_type="text/csv; charset=utf-8",
+        headers={"Content-Disposition": f'attachment; filename="{slug}-template.csv"', **NO_STORE},
+    )
+
+
+async def _save(upload: Any) -> tuple[str, str, str]:
+    """An uploaded file, to a temporary path: (path, filename, content type)."""
+    data = await upload.read()
+    if len(data) > MAX_FILE_BYTES:
+        raise ApiError(413, f"{upload.filename} is larger than {MAX_FILE_BYTES // (1024 * 1024)} MB.")
+    suffix = Path(upload.filename or "upload").suffix[:16]
+    with tempfile.NamedTemporaryFile(delete=False, suffix=suffix, prefix="databounty-space-") as handle:
+        handle.write(data)
+    return handle.name, Path(upload.filename or "upload").name, upload.content_type or "application/octet-stream"
+
+
+@router.post("/pools/{pool_id}/items")
+async def submit_item(pool_id: str, request: Request):
+    _, session = _session(request)
+    # Closing the form deletes the uploads' temporary files.
+    async with request.form() as form:
+        return await _submit_item(session, pool_id, form)
+
+
+async def _submit_item(session: account.Session, pool_id: str, form: Any) -> JSONResponse:
+    method = str(form.get("method") or "")
+    if method not in contribute.GENERATION_METHODS:
+        raise ApiError(400, "Choose how you made this item.")
+    try:
+        values = json.loads(str(form.get("values") or "{}"))
+    except ValueError as exc:
+        raise ApiError(400, "The form's values didn't arrive in one piece. Try again.") from exc
+    files: dict[str, list[Any]] = {}
+    for name, value in form.multi_items():
+        if name.startswith("file:") and getattr(value, "filename", None):
+            files.setdefault(name[5:], []).append(value)
+
+    contract_data = _contract(session, pool_id)
+    if not contract_data["open"]:
+        raise ApiError(409, "This pool isn't taking items right now.")
+    payload, problems = contribute.item_payload(contract_data["fields"], values if isinstance(values, dict) else {}, {k: len(v) for k, v in files.items()})
+    if problems:
+        raise ApiError(400, " ".join(problems))
+
+    saved: list[str] = []
+    try:
+        for spec in contract_data["fields"]:
+            uploads = files.get(spec["key"]) or []
+            if spec["role"] != "file" or not uploads:
+                continue
+            ids = []
+            for upload in uploads:
+                path, filename, content_type = await _save(upload)
+                saved.append(path)
+                try:
+                    ids.append(account.upload_file(session, pool_id, path, filename, content_type))
+                except account.NotSignedIn as exc:
+                    raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
+                except account.ToolError as exc:
+                    raise ApiError(400, str(exc)) from exc
+            payload[spec["key"]] = ids if spec["maxCount"] > 1 else ids[0]
+    finally:
+        for path in saved:
+            Path(path).unlink(missing_ok=True)
+
+    title = " ".join(str(form.get("title") or "").split())[:120] or contribute.title_for(payload)
+    if len(title) < 3:
+        title = f"{title} item".strip()
+    result = _call(
+        session,
+        "submit_pool_items",
+        {"bountyId": pool_id, "items": [{"title": title, "payloadJson": payload, "generationMethod": method}]},
+    )
+    subs = result.get("submissions") or []
+    duplicate = bool(subs) and all(s.get("status") == "rejected" and s.get("duplicateOfSubmissionId") for s in subs)
+    return _ok({"duplicate": duplicate, "submissions": [{"id": s.get("id"), "status": s.get("status")} for s in subs], "karma": contract_data["karma"]})
+
+
+@router.post("/pools/{pool_id}/bulk/preview")
+async def bulk_preview(pool_id: str, request: Request):
+    _, session = _session(request)
+    async with request.form() as form:
+        upload = form.get("file")
+        if not getattr(upload, "filename", None):
+            raise ApiError(400, "Choose a file first.")
+        data = await upload.read()
+    fields = _contract(session, pool_id)["fields"]
+    try:
+        rows = checks.parse_bulk(data, upload.filename)
+    except ValueError as exc:
+        raise ApiError(400, str(exc)) from exc
+    if len(rows) > contribute.MAX_BULK_ROWS:
+        raise ApiError(400, f"That file has {len(rows):,} rows. Upload up to {contribute.MAX_BULK_ROWS} at a time.")
+    for row in rows:
+        if row.payload is not None:
+            row.payload = checks.coerce_for_contract(fields, row.payload)
+    checks.check_rows(rows, fields)
+    return _ok({
+        "rows": [
+            {
+                "number": row.number,
+                "ok": row.ok,
+                "problem": "" if row.ok else (row.error or "; ".join(row.problems)),
+                "title": contribute.title_for(row.payload, row.number),
+                "payload": row.payload,
+            }
+            for row in rows
+        ],
+        "hasFileFields": any(spec["role"] == "file" for spec in fields),
+    })
+
+
+@router.post("/pools/{pool_id}/bulk/send")
+async def bulk_send(pool_id: str, request: Request):
+    _, session = _session(request)
+    body = await _json(request)
+    method = str(body.get("method") or "")
+    if method not in contribute.GENERATION_METHODS:
+        raise ApiError(400, "Choose how you made these items.")
+    contract_data = _contract(session, pool_id)
+    if not contract_data["open"]:
+        raise ApiError(409, "This pool isn't taking items right now.")
+    # Every row is checked again here: the page's copy is only a preview.
+    items, skipped = [], 0
+    for row in body.get("rows") or []:
+        payload = row.get("payload") if isinstance(row, dict) else None
+        if not isinstance(payload, dict) or checks.item_problems(contract_data["fields"], payload):
+            skipped += 1
+            continue
+        number = int(row.get("number") or 0)
+        title = " ".join(str(row.get("title") or "").split())[:120] or contribute.title_for(payload, number)
+        items.append({"title": title, "payloadJson": payload, "generationMethod": method})
+    if not items:
+        raise ApiError(400, "None of those rows are ready to send.")
+    sent = duplicates = 0
+    problem = ""
+    size = max(1, contract_data["maxItems"])
+    for start in range(0, len(items), size):
+        try:
+            result = account.call_tool(session, "submit_pool_items", {"bountyId": pool_id, "items": items[start : start + size]})
+        except account.NotSignedIn:
+            problem = "Your sign-in ended, so the rest weren't sent. Sign in again to continue."
+            break
+        except account.ToolError as exc:
+            problem = f"Items {start + 1} onwards weren't sent: {exc}"
+            break
+        created = result.get("submissions") or []
+        sent += len(created)
+        duplicates += sum(1 for s in created if s.get("status") == "rejected" and s.get("duplicateOfSubmissionId"))
+        if result.get("stoppedAtCapacity"):
+            problem = "The pool filled up, so the rest weren't sent."
+            break
+    return _ok({"sent": sent, "duplicates": duplicates, "skipped": skipped, "problem": problem, "karma": contract_data["karma"]})
+
+
+# --- Submissions ------------------------------------------------------------------------------------------
+
+
+@router.get("/submissions")
+def submissions(request: Request):
+    _, session = _session(request)
+    data = _call(session, "list_my_submissions", {"limit": 50}) or {}
+    rows = [contribute.submission_row(item) for item in data.get("items") or []]
+    return _ok({"items": rows, "total": data.get("total") if isinstance(data.get("total"), int) else len(rows)})
+
+
+@router.get("/submissions/{submission_id}")
+def submission(submission_id: str, request: Request):
+    _, session = _session(request)
+    return _ok(contribute.submission_view(_call(session, "check_submission", {"submissionId": submission_id}), db.APP_URL))
+
+
+# --- Reviewing --------------------------------------------------------------------------------------
+# A review is an audit: a few items from one pool, held by one reviewer for 24 hours.
+
+
+def _reviewer(request: Request) -> account.Session:
+    _, session = _session(request)
+    if "validate" not in session.scope.split():
+        raise ApiError(403, "The Space isn't allowed to review for you. Sign out, then sign in again and keep validate ticked.")
+    return session
+
+
+@router.get("/audits")
+def audits(request: Request, q: str = ""):
+    session = _reviewer(request)
+    search = " ".join(q.split())[:120]
+    data = _call(session, "list_audits", {"limit": 50, **({"search": search} if search else {})}) or {}
+    rows = [validate.audit_row(a) for a in data.get("audits") or []]
+    return _ok({
+        "audits": rows,
+        "total": data.get("total") if isinstance(data.get("total"), int) else len(rows),
+        # Audits holding the reviewer's own work, which they can't review.
+        "hidden": data.get("conflictExcluded") if isinstance(data.get("conflictExcluded"), int) else 0,
+    })
+
+
+@router.get("/audits/mine")
+def my_audits(request: Request, status: str = "claimed"):
+    session = _reviewer(request)
+    status = status if status in ("claimed", "overdue_review", "completed") else "claimed"
+    data = _call(session, "list_my_audits", {"status": status, "limit": 50}) or {}
+    rows = [validate.audit_row(a) for a in data.get("audits") or []]
+    return _ok({"audits": rows, "total": data.get("total") if isinstance(data.get("total"), int) else len(rows)})
+
+
+@router.post("/audits/{audit_id}/claim")
+def claim_audit(audit_id: str, request: Request):
+    session = _reviewer(request)
+    window = (_call(session, "claim_audit", {"windowId": audit_id}) or {}).get("window") or {}
+    return _ok({"id": window.get("id") or audit_id, "deadline": window.get("claimExpiresAt")})
+
+
+@router.get("/audits/{audit_id}")
+def audit(audit_id: str, request: Request):
+    session = _reviewer(request)
+    try:
+        detail = account.call_tool(session, "get_audit", {"windowId": audit_id})
+    except account.NotSignedIn as exc:
+        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
+    except account.ToolError as exc:
+        # The items stay hidden until the reviewer holds the audit (DataBounty's rule).
+        if "claim_audit" in str(exc) or "Claim this audit" in str(exc):
+            raise ApiError(409, "Claim this audit to see its items. It's yours for 24 hours.", needs="claim") from exc
+        raise ApiError(400, str(exc)) from exc
+    return _ok(validate.audit_view(detail or {}, db.APP_URL))
+
+
+@router.post("/audits/{audit_id}/decisions")
+async def decide(audit_id: str, request: Request):
+    session = _reviewer(request)
+    decision, problem = validate.decision(await _json(request))
+    if problem:
+        raise ApiError(400, problem)
+    result = _call(session, "submit_decisions", {"windowId": audit_id, "decisions": [decision]}) or {}
+    return _ok({"ok": True, "decided": result.get("decisionsCount", 1)})
+
+
+# --- Sponsoring ----------------------------------------------------------------------------------------
+# Only a pool's requester can see its items (DataBounty's rule), so the page asks on every pool and
+# shows the panel only when DataBounty says yes. Requesting a dataset stays on databounty.io.
+
+
+def _sponsor(request: Request) -> account.Session:
+    _, session = _session(request)
+    if "sponsor" not in session.scope.split():
+        raise ApiError(403, "Sign out, then sign in again and keep sponsor ticked, to see your pools here.", needs="sponsor_scope")
+    return session
+
+
+def _sponsor_call(session: account.Session, name: str, arguments: dict[str, Any]) -> Any:
+    try:
+        return account.call_tool(session, name, arguments)
+    except account.NotSignedIn as exc:
+        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
+    except account.ToolError as exc:
+        message = str(exc)
+        if "owner" in message.lower() or "forbidden" in message.lower():
+            raise ApiError(403, "Only the person who requested this pool can see its items.", needs="not_sponsor") from exc
+        raise ApiError(400, message) from exc
+
+
+@router.get("/pools/{pool_id}/sponsor")
+def sponsor_pool(pool_id: str, request: Request, status: str = "", q: str = ""):
+    session = _sponsor(request)
+    arguments: dict[str, Any] = {"bountyId": pool_id, "limit": 50}
+    if status.strip():
+        arguments["status"] = status.strip()
+    if q.strip():
+        arguments["search"] = " ".join(q.split())[:120]
+    data = _sponsor_call(session, "get_sponsor_submission_evidence", arguments) or {}
+    try:
+        specs = (db.pool_details(pool_id) or {}).get("fields") or []
+    except (ValueError, db.UpstreamError):
+        specs = []  # labels are a nicety; the items still show under their keys
+    return _ok(sponsor.pool_view(data, specs))
+
+
+@router.post("/sponsor/submissions/{submission_id}/dispute")
+async def sponsor_dispute(submission_id: str, request: Request):
+    session = _sponsor(request)
+    arguments, problem = sponsor.dispute(await _json(request))
+    if problem:
+        raise ApiError(400, problem)
+    _sponsor_call(session, "dispute_accepted_submission", {"submissionId": submission_id, **arguments})
+    return _ok({"ok": True})
+
+
+# --- Requesting a dataset (sponsors) -------------------------------------------------------------------
+# The request goes to DataBounty's request_dataset tool, which checks it again; an admin reviews it,
+# and its reference samples, before a pool opens. Until DataBounty has that tool, the page links to
+# databounty.io instead (`open` below).
+
+SAMPLE_TYPES = {".json": "application/json", ".jsonl": "application/x-ndjson", ".ndjson": "application/x-ndjson"}
+
+
+def _request_options() -> dict[str, Any]:
+    return requesting.catalog_view(_public(db.request_catalog))
+
+
+@router.get("/requesting")
+def requesting_options():
+    view = _request_options()
+    try:
+        view["open"] = db.requesting_open()
+    except db.UpstreamError:
+        view["open"] = False  # can't tell: keep the link to databounty.io
+    return _ok(view)
+
+
+@router.get("/requesting/{type_id}/example.json")
+def example_template(type_id: str):
+    """An empty example item for a dataset type, to fill in and attach to a request."""
+    t = next((t for t in _request_options()["types"] if t["id"] == type_id), None)
+    if not t:
+        raise ApiError(404, "That dataset type isn't open for requests.")
+    body = json.dumps({key: "" for key in t["fields"]}, indent=2) + "\n"
+    slug = re.sub(r"[^a-z0-9_-]+", "-", type_id.lower()).strip("-") or "dataset"
+    return Response(
+        body,
+        media_type="application/json",
+        headers={"Content-Disposition": f'attachment; filename="{slug}-example.json"', **NO_STORE},
+    )
+
+
+@router.post("/requests")
+async def file_request(request: Request):
+    session = _sponsor(request)
+    types = {t["id"]: t for t in _request_options()["types"]}
+    arguments, problem = requesting.request_arguments(await _json(request), types)
+    if problem:
+        raise ApiError(400, problem)
+    result = _sponsor_call(session, "request_dataset", arguments) or {}
+    filed = result.get("request") or {}
+    return _ok({"id": filed.get("id"), "alreadyFiled": bool(result.get("alreadyFiled"))})
+
+
+@router.get("/requests/mine")
+def my_requests(request: Request):
+    session = _sponsor(request)
+    data = _sponsor_call(session, "list_my_dataset_requests", {"limit": 50}) or {}
+    try:
+        names = {t["id"]: t["name"] for t in _request_options()["types"]}
+    except ApiError:
+        names = {}  # names are a nicety; the requests still show
+    rows = [requesting.request_row(r, names) for r in data.get("requests") or [] if isinstance(r, dict)]
+    return _ok({"requests": rows, "more": bool(data.get("nextCursor"))})
+
+
+@router.post("/requests/{request_id}/samples")
+async def add_sample(request_id: str, request: Request):
+    session = _sponsor(request)
+    async with request.form() as form:
+        upload = form.get("file")
+        if upload is None or not getattr(upload, "filename", ""):
+            raise ApiError(400, "Choose a file with an example item.")
+        path, filename, content_type = await _save(upload)
+    try:
+        # Browsers rarely name a JSON Lines file's type; DataBounty checks the pair.
+        content_type = SAMPLE_TYPES.get(Path(filename).suffix.lower(), content_type)
+        account.upload_sample(session, request_id, path, filename, content_type)
+    except account.NotSignedIn as exc:
+        raise ApiError(401, "Your sign-in ended. Sign in again to continue.") from exc
+    except account.ToolError as exc:
+        raise ApiError(400, f"{filename}: {exc}") from exc
+    finally:
+        Path(path).unlink(missing_ok=True)
+    return _ok({"ok": True})