@dignetwork/dig-sdk 0.0.1-alpha.99 → 0.1.0

package/LICENSE

@@ -1,7 +1,21 @@
-Copyright 2024 Michael Taylor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+MIT License
+
+Copyright (c) 2026 DIG Network
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,267 @@
+# @dignetwork/dig-sdk
+
+The typed front door for building dapps on the **DIG Network**. One `npm i` gives you:
+
+- **`ChiaProvider`** — a Chia wallet your dapp gets for free. It prefers the injected **DIG Browser**
+  wallet (`window.chia`) and falls back to **WalletConnect → Sage**, behind one normalized
+  CHIP-0002 surface (`getAddress`, `signMessage`, `signCoinSpends`, `takeOffer`, balances, coins).
+- **`DigClient`** — read **verified, encrypted** content by URN. It derives the URN's keys in the
+  browser, verifies inclusion against the on-chain root, and decrypts — the serving host stays
+  blind (it only ever relays opaque ciphertext + proofs).
+- **`@dignetwork/dig-sdk/spend`** — the canonical CHIP-0035 spend builder
+  (`@dignetwork/chip35-dl-coin-wasm`) re-exported. Build store / NFT / CAT spends through the SDK
+  and sign them with the wallet. Spends are **never** hand-rolled.
+- **Framework adapters** — `@dignetwork/dig-sdk/vite` (a Vite plugin) and `@dignetwork/dig-sdk/next`
+  (a Next static-export adapter): inject a `window.chia` dev wallet during `dev`, and ship your
+  build to a DIG capsule on a `publish` script. See **[Framework adapters](#framework-adapters)**.
+- **`@dignetwork/dig-sdk/dig-client`** — the read-crypto on its own (just `DigClient` + the loader +
+  URN helpers), for consumers that want only the read path (e.g. a worker). Same SRI-pinned wasm.
+
+Ships **ESM + CJS + `.d.ts`**, runs in the **browser and Node 18+**, and is **eval-free** (usable
+in CSP-strict contexts).
+
+```bash
+npm i @dignetwork/dig-sdk
+# Optional: only if you use the WalletConnect → Sage fallback
+npm i @walletconnect/sign-client
+```
+
+---
+
+## Read verified, encrypted content in 5 lines
+
+```ts
+import { DigClient } from "@dignetwork/dig-sdk";
+
+const dig = new DigClient();                       // defaults to https://rpc.dig.net
+const { bytes, decrypted, verified } = await dig.read({
+  urn: "urn:dig:chia:<storeId>/index.html",        // the resource to read
+  root: "<onchain-root-hex>",                       // the trust anchor (from the chain)
+});
+console.log(decrypted, verified, new TextDecoder().decode(bytes));
+```
+
+`read()` returns the authenticated **plaintext** when the URN key decrypts the served bytes
+(`decrypted: true`); otherwise it returns the raw ciphertext (a decoy is just opaque bytes — the
+model is oblivious, so a read is never a "not found" verdict). `verified` is the advisory
+inclusion-proof check against `root`. For text, `await dig.readText({ urn, root })` returns the
+decoded string (or throws if it didn't decrypt).
+
+A private store adds a salt — either inline in the URN (`…/secret.txt?salt=<hex>`) or as
+`dig.read({ urn, root, salt })`.
+
+## Connect a wallet + sign
+
+```ts
+import { ChiaProvider } from "@dignetwork/dig-sdk";
+
+// Prefers the injected DIG Browser wallet; falls back to WalletConnect → Sage.
+const provider = await ChiaProvider.connect({
+  mode: "auto",
+  walletConnect: {
+    projectId: "<walletconnect-cloud-project-id>",
+    metadata: {
+      name: "My DIG dapp",
+      description: "Built with @dignetwork/dig-sdk",
+      url: "https://my-dapp.example",
+      icons: ["https://my-dapp.example/icon.png"],
+    },
+    onUri: (uri) => showWalletConnectQr(uri), // render the QR / copy-link for the fallback
+  },
+});
+
+const address = await provider.getAddress();
+const { publicKey, signature } = await provider.signMessage("Login to My DIG dapp");
+// → verify the BLS signature server-side against the CHIP-0002 message hash + publicKey
+```
+
+If you only target the DIG Browser, drop `walletConnect` and use `mode: "injected"` (or `"auto"`,
+which still prefers injected). `provider.backend` tells you which transport connected.
+
+## Build + sign a store spend
+
+```ts
+import { ChiaProvider } from "@dignetwork/dig-sdk";
+import * as spend from "@dignetwork/dig-sdk/spend"; // the canonical CHIP-0035 builder
+
+spend.init();
+// Build a spend bundle with the wasm builder (e.g. spend.mintStore(...) / spend.updateStoreMetadata(...)),
+// then hand its coin spends to the wallet to sign:
+const provider = await ChiaProvider.connect({ mode: "injected" });
+const aggregatedSignature = await provider.signCoinSpends(/* coinSpends from the builder */ []);
+```
+
+The hub builds spend bundles in-browser via this wasm and pushes them to the wallet for signing —
+your dapp does the same through the SDK.
+
+---
+
+## API surface
+
+### `ChiaProvider`
+
+| Member | Description |
+|---|---|
+| `static connect(options)` | Connect a wallet. `mode`: `"auto"` (default, prefer injected) / `"injected"` / `"walletconnect"`. |
+| `connectWallet(options)` | Convenience alias for `ChiaProvider.connect`. |
+| `backend` / `session` | The connected transport (`"injected"` \| `"walletconnect"`) and session descriptor. |
+| `getAddress()` | The wallet's receive address (cached). |
+| `getPublicKeys()` | The wallet's synthetic public keys. |
+| `signMessage(message, address?)` | Sign a UTF-8 message; returns `{ publicKey, signature }` (0x-normalized). |
+| `signCoinSpends(coinSpends)` | Sign raw CHIP-0035 coin spends (partialSign); returns the aggregated signature hex. |
+| `takeOffer(offer, fee?)` | Accept a Chia offer string (e.g. an NFT offer). |
+| `getXchBalance()` / `getCatBalance(assetId)` | Spendable balances (mojo/base-unit strings). |
+| `getXchCoins(limit?)` / `getCatCoins(assetId, limit?)` | Unspent coins for funding a spend. |
+| `request(method, params?)` | Escape hatch: a raw CHIP-0002 request through the active transport. |
+| `supports(method)` / `disconnect()` | Capability check / teardown. |
+
+Transports are also exported directly (`InjectedTransport`, `WalletConnectTransport`,
+`isInjectedAvailable`, `getInjectedProvider`) for advanced flows (e.g. restoring a WC session via
+`WalletConnectTransport.restore(...)`).
+
+### `DigClient`
+
+| Member | Description |
+|---|---|
+| `new DigClient({ rpc?, fetch? })` | RPC defaults to `https://rpc.dig.net`. |
+| `read({ urn, root?, salt? }, opts?)` | Fetch + verify + decrypt → `{ bytes, verified, decrypted, … }`. |
+| `readText({ urn, root?, salt? }, opts?)` | As `read`, decoded to a UTF-8 string (throws if not decrypted). |
+| `readResource({ storeId, resourceKey, root, salt? }, opts?)` | Read by explicit parts instead of a URN. |
+| `deriveUrnKeys({ urn, salt? })` | The root-independent `{ retrievalKey, decryptionKey }` for a URN. |
+| `retrievalKey(storeId, key)` / `deriveKey(storeId, key, salt?)` | The individual derivations. |
+| `verifyInclusion(ciphertext, proof, root)` / `reconstructUrn(...)` | Lower-level read-crypto. |
+| `wasm()` | The raw SRI-verified read-crypto wasm (`decryptChunk`, `encryptResource`, `version`, …). |
+
+### URN helpers (pure)
+
+`parseUrn`, `isUrn`, `reconstructUrn`, `reconstructUrnWithRoot` and the `ParsedUrn` type — the same
+URN grammar the hub, extension, and companion use.
+
+### Spend builder
+
+`import * as spend from "@dignetwork/dig-sdk/spend"` re-exports
+[`@dignetwork/chip35-dl-coin-wasm`](https://www.npmjs.com/package/@dignetwork/chip35-dl-coin-wasm)
+(≥ 0.5.0): store coins (`mintStore`, `meltStore`, `updateStoreMetadata`, `updateStoreOwnership`,
+`oracleSpend`), assets (`mintNft`, `bulkMint`, `createDid`, `issueCat`), CHIP-0007 metadata
+(`buildChip0007Metadata`, `validateChip0007`, `generateItemMetadata`), offers (`encodeOffer`,
+`decodeOffer`), and helpers (`addFee`, `dataStoreFromSpend`, `hexSpendBundleToCoinSpends`,
+`spendBundleToHex`, `digstoreOwnerHint`, `sha256`, `init`).
+
+---
+
+## Framework adapters
+
+Make DIG a first-class deploy target for the frameworks you already use. Each adapter does two
+things: injects a **`window.chia` dev wallet** during local `dev` (the same injected-provider
+contract `ChiaProvider` detects in production, so the wallet path runs end-to-end locally), and
+ships your build to a **DIG capsule** via `digstore deploy --json` on a `publish` script.
+
+> Deploying **spends DIG** (each deploy publishes a new capsule), so it is a deliberate, credentialed
+> step — never wired into the default `build`. Config + secrets are read from your project's
+> `dig.toml` and `DIGSTORE_*` env vars, exactly like `digstore deploy`; the deploy key and store
+> salt come from the env only (never argv) so they don't leak. Requires the `digstore` CLI on PATH.
+
+### Vite — `@dignetwork/dig-sdk/vite`
+
+```ts
+// vite.config.ts
+import { defineConfig } from "vite";
+import { digVite } from "@dignetwork/dig-sdk/vite";
+
+export default defineConfig({
+  plugins: [digVite()], // injects the window.chia dev shim during `vite dev`
+});
+```
+
+```jsonc
+// package.json — opt in to deploy with a publish script (after the build)
+{
+  "scripts": {
+    "publish:dig": "vite build && node -e \"import('@dignetwork/dig-sdk/vite').then(m => m.digDeploy())\""
+  }
+}
+```
+
+`digDeploy()` shells out to `digstore deploy --json`, ships the build dir to a new capsule, and
+prints the `dig://` + `https://hub.dig.net/stores/<id>` URL. Disable the dev shim with
+`digVite({ devWallet: false })`; set its mock address with `digVite({ devWalletOptions: { address } })`.
+
+### Next.js (static export) — `@dignetwork/dig-sdk/next`
+
+Next has no Vite-style HTML hook, so the dev shim is a helper you drop into your `<head>` (guarded to
+dev), and `digDeploy()` ships the `out/` static export:
+
+```tsx
+// app/layout.tsx — dev-only window.chia shim
+import { digNextDevShimTag } from "@dignetwork/dig-sdk/next";
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html>
+      <head>
+        {process.env.NODE_ENV !== "production" && (
+          <script dangerouslySetInnerHTML={{ __html: digNextDevShimTag().replace(/^<script>|<\/script>$/g, "") }} />
+        )}
+      </head>
+      <body>{children}</body>
+    </html>
+  );
+}
+```
+
+```jsonc
+// package.json — deploy the static export (next.config: `output: "export"`)
+{
+  "scripts": {
+    "publish:dig": "next build && node -e \"import('@dignetwork/dig-sdk/next').then(m => m.digDeploy())\""
+  }
+}
+```
+
+`digDeploy()` defaults the output dir to `out` (Next's export dir); override any field via
+`digDeploy({ outputDir, storeId, message, … })` or `dig.toml`.
+
+### Configuration
+
+Both adapters resolve config with this precedence: **`digDeploy()` options > `DIGSTORE_*` env >
+`dig.toml` > defaults** (mirroring `digstore deploy`). Common keys: `store-id`, `output-dir`,
+`message`, `network`, `remote` (in `dig.toml`); secrets `DIGSTORE_DEPLOY_KEY` and (private stores)
+`DIGSTORE_STORE_SALT` from the env. The pure building blocks (config resolution, deploy-arg
+construction, the dev-shim string, the `dig.toml` reader) are exported from
+`@dignetwork/dig-sdk/adapters` if you want to compose your own deploy step.
+
+---
+
+## Key concepts
+
+- **URN** — `urn:dig:chia:<storeId>[:<root>]/<resourceKey>[?salt=<hex>]` addresses one resource in
+  a store. The retrieval + decryption keys are **root-independent** (the root is only the trust
+  anchor for verification).
+- **Oblivious / blind host** — the dig RPC returns indistinguishable ciphertext for any retrieval
+  key, so presence is unknowable. The client decrypts what it can; it never asks the host "is this
+  present?".
+- **Trust anchor** — content is verified against an **on-chain root** that *you* resolve from the
+  chain (coinset.org / the store singleton) and pass to `read({ root })`. The serving host can
+  never be the trust anchor.
+
+## Read-crypto wasm provenance
+
+`DigClient` runs the **same** `dig_client` read-crypto WASM the DIG Browser, the
+`dig-chrome-extension`, the `dig-companion`, and `hub.dig.net` use. It is vendored under `vendor/`,
+pinned by SHA-256 (`ff486be8…`), and **SRI-verified at load** — a tampered or wrong artifact
+**fails closed** rather than running unverified crypto. See `vendor/PROVENANCE.md`.
+
+### CSP-strict / no-bundler browsers
+
+The wasm is loaded lazily; in a bundler that resolves package files it is found automatically. If
+your environment can't resolve the vendored files (or your CSP blocks runtime fetches), fetch +
+verify the bytes yourself and hand them in **before** the first read:
+
+```ts
+import { configureWasm } from "@dignetwork/dig-sdk";
+configureWasm({ wasmBytes: myVerifiedBytes, glueUrl: "/dig-client/dig_client.mjs" });
+```
+
+## License
+
+MIT

package/dist/adapters.cjs

@@ -0,0 +1,315 @@
+'use strict';
+
+// src/adapters/dig-toml.ts
+var KEY_MAP = {
+  store_id: "storeId",
+  "store-id": "storeId",
+  output_dir: "outputDir",
+  "output-dir": "outputDir",
+  build_command: "buildCommand",
+  "build-command": "buildCommand",
+  message: "message",
+  network: "network",
+  remote: "remote",
+  wait_timeout: "waitTimeout",
+  "wait-timeout": "waitTimeout"
+};
+var APPLY_ORDER = Object.keys(KEY_MAP).sort(
+  (a) => a.includes("-") ? 1 : -1
+);
+function stripComment(line) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "'" && !inDouble) inSingle = !inSingle;
+    else if (ch === '"' && !inSingle) inDouble = !inDouble;
+    else if (ch === "#" && !inSingle && !inDouble) return line.slice(0, i);
+  }
+  return line;
+}
+function unquote(raw) {
+  const v = raw.trim();
+  if (v.startsWith('"') && v.endsWith('"') && v.length >= 2 || v.startsWith("'") && v.endsWith("'") && v.length >= 2) {
+    return v.slice(1, -1);
+  }
+  return v;
+}
+function parseDigToml(text) {
+  const raw = {};
+  for (const lineRaw of text.split(/\r?\n/)) {
+    const line = stripComment(lineRaw).trim();
+    if (!line || line.startsWith("[")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (!(key in KEY_MAP)) continue;
+    raw[key] = unquote(line.slice(eq + 1));
+  }
+  const out = {};
+  for (const key of APPLY_ORDER) {
+    const value = raw[key];
+    const field = KEY_MAP[key];
+    if (value === void 0 || field === void 0) continue;
+    if (field === "waitTimeout") {
+      const n = Number.parseInt(value, 10);
+      if (Number.isFinite(n)) out.waitTimeout = n;
+    } else {
+      out[field] = value;
+    }
+  }
+  return out;
+}
+
+// src/adapters/config.ts
+function envVal(env, key) {
+  const v = env[key];
+  if (v == null) return void 0;
+  const t = v.trim();
+  return t === "" ? void 0 : t;
+}
+function pick(...candidates) {
+  for (const c of candidates) if (c !== void 0) return c;
+  return void 0;
+}
+function resolveDeployConfig(input) {
+  const { options, digToml, env } = input;
+  const storeId = pick(
+    options.storeId,
+    envVal(env, "DIGSTORE_STORE_ID"),
+    digToml.storeId
+  );
+  const outputDir = pick(options.outputDir, envVal(env, "DIGSTORE_OUTPUT_DIR"), digToml.outputDir) ?? "dist";
+  const buildCommand = pick(
+    options.buildCommand,
+    envVal(env, "DIGSTORE_BUILD_COMMAND"),
+    digToml.buildCommand
+  );
+  const message = pick(options.message, envVal(env, "DIGSTORE_MESSAGE"), digToml.message);
+  const network = pick(options.network, envVal(env, "DIGSTORE_NETWORK"), digToml.network) ?? "mainnet";
+  const remote = pick(options.remote, envVal(env, "DIGSTORE_REMOTE"), digToml.remote);
+  const waitFromEnv = envVal(env, "DIGSTORE_WAIT_TIMEOUT");
+  const waitTimeout = pick(
+    options.waitTimeout,
+    waitFromEnv != null ? Number.parseInt(waitFromEnv, 10) : void 0,
+    digToml.waitTimeout
+  );
+  return {
+    storeId,
+    outputDir,
+    buildCommand,
+    message,
+    network,
+    remote,
+    waitTimeout: Number.isFinite(waitTimeout) ? waitTimeout : void 0,
+    // SECRETS — env only.
+    deployKey: envVal(env, "DIGSTORE_DEPLOY_KEY"),
+    salt: envVal(env, "DIGSTORE_STORE_SALT")
+  };
+}
+
+// src/adapters/deploy.ts
+function buildDeployArgs(cfg, opts = {}) {
+  const argv = ["deploy", "--json"];
+  if (cfg.storeId) argv.push("--store-id", cfg.storeId);
+  if (cfg.outputDir) argv.push("--output-dir", cfg.outputDir);
+  if (!opts.skipBuild && cfg.buildCommand) argv.push("--build-command", cfg.buildCommand);
+  if (cfg.message) argv.push("--message", cfg.message);
+  if (cfg.network) argv.push("--network", cfg.network);
+  if (cfg.remote) argv.push("--remote", cfg.remote);
+  if (cfg.waitTimeout != null) argv.push("--wait-timeout", String(cfg.waitTimeout));
+  return argv;
+}
+function buildDeployEnv(cfg) {
+  const env = {};
+  if (cfg.deployKey) env.DIGSTORE_DEPLOY_KEY = cfg.deployKey;
+  if (cfg.salt) env.DIGSTORE_STORE_SALT = cfg.salt;
+  return env;
+}
+var CAPSULE_RE = /^([0-9a-f]{64}):([0-9a-f]{64})$/i;
+function parseDeployResult(stdout) {
+  const lines = stdout.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.startsWith("{") && l.endsWith("}"));
+  if (lines.length === 0) {
+    throw new Error(
+      `could not parse digstore deploy output (no JSON object found). Output was:
+${stdout.slice(0, 500)}`
+    );
+  }
+  let obj;
+  let fallback;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (line === void 0) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (typeof parsed.capsule === "string") {
+      obj = parsed;
+      break;
+    }
+    if (!fallback) fallback = parsed;
+  }
+  if (!obj) {
+    if (fallback) {
+      throw new Error(
+        `digstore deploy did not report a capsule (deploy may have failed). Output:
+${JSON.stringify(fallback)}`
+      );
+    }
+    throw new Error(`could not parse digstore deploy output as JSON:
+${stdout.slice(0, 500)}`);
+  }
+  const capsule = obj.capsule;
+  const m = CAPSULE_RE.exec(capsule);
+  if (!m || m[1] === void 0 || m[2] === void 0) {
+    throw new Error(`digstore deploy reported a malformed capsule "${capsule}" (expected storeId:root)`);
+  }
+  const storeId = m[1].toLowerCase();
+  const root = (typeof obj.root === "string" ? obj.root : m[2]).toLowerCase();
+  return {
+    capsule,
+    storeId,
+    root,
+    // dig:// names the store on the network (resolves to its latest published version).
+    digUrl: `dig://${storeId}`,
+    // Mirrors digstore deploy.rs::hub_url — the public DIGHub view of an owned store.
+    hubUrl: `https://hub.dig.net/stores/${storeId}`,
+    pushed: typeof obj.pushed === "boolean" ? obj.pushed : void 0
+  };
+}
+
+// src/provider/injected.ts
+var INJECTED_TOPIC = "injected";
+
+// src/adapters/dev-shim.ts
+var DEV_SHIM_MARKER = "dig-sdk:dev-wallet-shim";
+var DEFAULT_DEV_ADDRESS = "xch1dev0000000000000000000000000000000000000000000000000000devshim";
+function lit(s) {
+  return JSON.stringify(s);
+}
+function devShimScript(options = {}) {
+  const address = options.address ?? DEFAULT_DEV_ADDRESS;
+  return [
+    `/* ${DEV_SHIM_MARKER} \u2014 DEV ONLY. A stub wallet for local development; NOT a real wallet. */`,
+    `(function () {`,
+    `  "use strict";`,
+    `  if (typeof window === "undefined") return;`,
+    `  // A real injected wallet (DIG Browser / extension) always wins \u2014 never clobber it.`,
+    `  if (window.chia) return;`,
+    `  var DEV_ADDRESS = ${lit(address)};`,
+    `  var TOPIC = ${lit(INJECTED_TOPIC)};`,
+    `  function ok(data) { return Promise.resolve({ data: data }); }`,
+    `  function nope(method) {`,
+    `    return Promise.reject(new Error(`,
+    `      "[" + ${lit(DEV_SHIM_MARKER)} + "] '" + method + "' needs a real wallet; the dev shim does not sign. " +`,
+    `      "Open in the DIG Browser or connect a wallet to sign for real."));`,
+    `  }`,
+    `  window.chia = {`,
+    `    isDIG: true,        // detected by the SDK's injected-provider check`,
+    `    isDevShim: true,    // so the app can tell it is the dev stub`,
+    `    topic: TOPIC,`,
+    `    connect: function () { return Promise.resolve(true); },`,
+    `    request: function (args) {`,
+    `      var method = args && args.method ? String(args.method) : "";`,
+    `      switch (method) {`,
+    `        case "chip0002_connect": return ok(true);`,
+    `        case "chip0002_getPublicKeys": return ok([]);`,
+    `        case "getAddress":`,
+    `        case "chia_getAddress": return ok(DEV_ADDRESS);`,
+    `        default:`,
+    `          // Signing / spend methods must not be faked.`,
+    `          return nope(method);`,
+    `      }`,
+    `    },`,
+    `    on: function () {},`,
+    `    off: function () {},`,
+    `  };`,
+    `  if (window.console && window.console.info) {`,
+    `    window.console.info("[" + ${lit(DEV_SHIM_MARKER)} + "] installed a DEV window.chia (mock address " + DEV_ADDRESS + ").");`,
+    `  }`,
+    `})();`
+  ].join("\n");
+}
+
+// src/adapters/run.ts
+async function readDigToml(cwd) {
+  const { readFile } = await import('fs/promises');
+  const path = await import('path');
+  try {
+    const text = await readFile(path.join(cwd, "dig.toml"), "utf8");
+    return parseDigToml(text);
+  } catch {
+    return {};
+  }
+}
+async function runDeploy(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const bin = options.digstoreBin ?? "digstore";
+  const log = options.logger ?? ((l) => console.log(l));
+  const digToml = await readDigToml(cwd);
+  const cfg = resolveDeployConfig({
+    options: {
+      storeId: options.storeId,
+      outputDir: options.outputDir,
+      buildCommand: options.buildCommand,
+      message: options.message,
+      network: options.network,
+      remote: options.remote,
+      waitTimeout: options.waitTimeout
+    },
+    digToml,
+    env: process.env
+  });
+  const argv = buildDeployArgs(cfg, { skipBuild: options.skipBuild });
+  const childEnv = { ...process.env, ...buildDeployEnv(cfg) };
+  log(`\u25B6 digstore ${argv.filter((a) => a !== cfg.deployKey && a !== cfg.salt).join(" ")}`);
+  const { spawn } = await import('child_process');
+  const stdout = await new Promise((resolve, reject) => {
+    const child = spawn(bin, argv, {
+      cwd,
+      env: childEnv,
+      // digstore reads no stdin here; capture stdout (the JSON) and stream stderr through.
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false
+    });
+    let out = "";
+    let err = "";
+    child.stdout.on("data", (d) => {
+      out += d.toString();
+    });
+    child.stderr.on("data", (d) => {
+      err += d.toString();
+    });
+    child.on("error", (e) => {
+      reject(
+        new Error(
+          `could not run "${bin}" \u2014 is digstore installed and on PATH? (${e.message})`
+        )
+      );
+    });
+    child.on("close", (code) => {
+      if (code === 0) resolve(out);
+      else reject(new Error(`digstore deploy failed (exit ${code}).
+${err || out}`));
+    });
+  });
+  const result = parseDeployResult(stdout);
+  log(`\u2713 deployed capsule ${result.capsule}`);
+  log(`  dig://  ${result.digUrl}`);
+  log(`  view    ${result.hubUrl}`);
+  return result;
+}
+
+exports.DEV_SHIM_MARKER = DEV_SHIM_MARKER;
+exports.buildDeployArgs = buildDeployArgs;
+exports.buildDeployEnv = buildDeployEnv;
+exports.devShimScript = devShimScript;
+exports.parseDeployResult = parseDeployResult;
+exports.parseDigToml = parseDigToml;
+exports.resolveDeployConfig = resolveDeployConfig;
+exports.runDeploy = runDeploy;
+//# sourceMappingURL=adapters.cjs.map
+//# sourceMappingURL=adapters.cjs.map