access source realm

AcceptOwnership completes the handover. Only the offered address can call it, which proves the key exists and can sign before anything irreversible happens.

CancelOwnershipTransfer withdraws a standing offer.

Consume charges an address for metered API usage, up to a cumulative cost-unit total.

The owner passes the caller's running lifetime usage, not a delta: the realm keeps the watermark itself and charges only the part it has not charged before. That makes the call idempotent (a replay is rejected, not re-billed) and means a restored or rolled-back off-chain database cannot double-charge anyone.

A caller with too few credits is charged what they have and the watermark still advances; the event records both what was owed and what was actually taken, so a shortfall is visible rather than silently forgiven.

Forgive advances the billing watermark without charging: usage already covered by an active time-based subscription. Separate from Consume so that "we decided not to bill this" is its own auditable on-chain act rather than an invisible gap in the watermark.

Login does nothing. Sign-In-With-Gno signs (never broadcasts) a call to it so the wallet shows a "Login" to GnoPulse rather than a token transfer; the challenge nonce rides in the tx memo.

Quote is what the payment page reads: the amount to send for one period, and the moment it stops being honoured. Reading it from here rather than from a price feed is what makes the figure on screen and the figure charged the same number.

SetOperator appoints, rotates or (with an empty address) revokes the hot role.

One step, unlike TransferOwnership, and the asymmetry is deliberate: a mistyped owner is permanent and locks the revenue, while a mistyped operator only means quotes stop until the owner sets it again. Making revocation a two-step handshake would be worse than useless, since the address being revoked is the one you no longer trust to act.

SetQuote posts the price of one period in ugnot. Called on a short schedule by the job that already tracks the GNOT price, which converts priceUsdCents off chain and publishes only the result. The previous quote stays payable for quoteGraceSec so payments already in flight are not repriced.

Subscribe buys pro time for the caller at the live quote. Each whole quote sent buys one period; anything left over becomes units at the same rate a top-up gets, rather than being kept, so the payer keeps the value of every ugnot they sent.

Every call is priced at the quote in force when it executes, so a renewal costs what a period costs today. Pinning a renewal to the price paid at first purchase is a known trap: Unlock Protocol does it and a renewal simply reverts once the price has moved.

TopUp buys prepaid credits for the caller.

TransferOwnership OFFERS the realm to newOwner. It does not hand it over: the offer stands until that address claims it with AcceptOwnership. A mistyped address therefore costs nothing, where a single-step transfer would have locked every admin function and the revenue behind an address nobody holds, permanently, because the realm cannot be redeployed.