@fangorn-network/westmarch 2026.10.29 → 2026.11.4-dev

package/src/market/terms.js

@@ -1,200 +0,0 @@
-// Who gets paid, and how much, when something sells.
-//
-// An app owner registers terms; publishers join under them; a buyer pays once.
-// This file is the arithmetic in the middle, and it is the only revenue
-// mechanism in the whole architecture — discovery cannot be charged for (the
-// query never leaves the client and the index holds 4 KB per corpus), so a take
-// at settlement is the business model or there isn't one.
-//
-// Two layers, because they are set by different people at different times:
-//
-//   app terms   the owner's cut, fixed when the app is registered and hashed so
-//               a publisher can prove what they agreed to
-//   lineage     what a publisher owes UPSTREAM, declared per resource when they
-//               publish. Paid out of the publisher's share, never the app's:
-//               a derivative's author pays their sources, and the app's cut does
-//               not shrink because someone built on someone else.
-//
-// That second layer is the point. An agent buys three corpora, synthesises a
-// fourth, publishes it with lineage naming the three, and every later sale of
-// the derivative pays back up the chain. Knowledge in, concept out, concept
-// becomes knowledge someone else builds on — with the money following the
-// citations instead of stopping at the last hop.
-//
-// ponytail: BigInt base units, one level of lineage, no recursion. A derivative
-// OF a derivative declares its own immediate sources and each hop settles on its
-// own sale — walking the tree at settlement time would mean fetching a stranger's
-// terms mid-payment, and a payment that depends on someone else's server being
-// up is a payment that fails.
-
-const BPS = 10000n;
-const ADDR = /^0x[0-9a-fA-F]{40}$/;
-
-const addr = (a) => {
-    const s = String(a ?? "").toLowerCase();
-    if (!ADDR.test(s)) throw new Error(`not an address: ${a}`);
-    return s;
-};
-const bps = (n, what) => {
-    const v = BigInt(n ?? 0);
-    if (v < 0n || v > BPS) throw new Error(`${what} must be 0..10000 bps, got ${n}`);
-    return v;
-};
-
-/**
- * An app's terms, canonical.
- *
- * Canonical because the hash is the thing a publisher agrees to and a buyer can
- * check: same terms must produce the same bytes on any machine, in any key
- * order, forever. So: fixed field order, lowercase addresses, decimal strings
- * for numbers (JSON has no integers), and nothing else in the object.
- */
-export function appTerms({ appId, owner, appBps = 0, currency = "USDC", chainId = 421614 }) {
-    if (!appId) throw new Error("terms need an appId");
-    return {
-        v: 1,
-        appId: String(appId),
-        owner: addr(owner),
-        appBps: String(bps(appBps, "appBps")),
-        currency: String(currency),
-        chainId: Number(chainId),
-    };
-}
-
-/** Canonical bytes → sha-256. Async because that is the only hash both node and
- *  a browser have without a dependency. */
-export async function termsHash(t) {
-    const canon = JSON.stringify(appTerms(t));
-    const d = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canon));
-    return `0x${[...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
-}
-
-/** What a publisher owes upstream for one resource. Deduped by payee — the same
- *  source cited twice is one debt, not two, and merging is the only reading that
- *  cannot be gamed by repeating an entry. */
-export function lineage(entries = []) {
-    const by = new Map();
-    for (const e of entries) {
-        const to = addr(e.to);
-        by.set(to, { to, bps: (by.get(to)?.bps ?? 0n) + bps(e.bps, "lineage bps"), note: e.note ?? by.get(to)?.note ?? "" });
-    }
-    const out = [...by.values()];
-    const total = out.reduce((s, e) => s + e.bps, 0n);
-    if (total > BPS) throw new Error(`lineage owes ${total} bps of the publisher's share — more than all of it`);
-    return out.map((e) => ({ to: e.to, bps: String(e.bps), ...(e.note ? { note: e.note } : {}) }));
-}
-
-/**
- * One payment → the payouts it becomes.
- *
- * Integer base units end to end, and the dust is given to the publisher rather
- * than rounded away: the payouts MUST sum to exactly what the buyer paid, or
- * settlement is inventing or destroying money. Every share rounds down; the
- * publisher absorbs the difference, which is at most one base unit per payee.
- */
-export function splitPayment(amount, { terms, publisher, lineage: up = [] } = {}) {
-    const total = BigInt(amount);
-    if (total < 0n) throw new Error("amount must not be negative");
-    const t = appTerms(terms);
-    const pub = addr(publisher);
-
-    const payouts = [];
-    const appCut = (total * BigInt(t.appBps)) / BPS;
-    if (appCut > 0n) payouts.push({ to: t.owner, amount: appCut, why: `app ${t.appId} (${t.appBps} bps)` });
-
-    // Everything the app did not take is the publisher's, and upstream is paid
-    // out of that — so a publisher who cites nobody keeps it all, and one who
-    // builds on three sources pays them from their own half.
-    const publisherPool = total - appCut;
-    let owed = 0n;
-    for (const e of lineage(up)) {
-        const cut = (publisherPool * BigInt(e.bps)) / BPS;
-        if (cut === 0n) continue;
-        owed += cut;
-        payouts.push({ to: e.to, amount: cut, why: `upstream ${e.note || e.to.slice(0, 10)} (${e.bps} bps of the publisher's share)` });
-    }
-
-    const keeps = publisherPool - owed;
-    payouts.push({ to: pub, amount: keeps, why: "publisher" });
-
-    // Merge payees — an app owner who is also the publisher gets one payout, not
-    // two, and a downstream reconciliation that sees the same address twice has
-    // no way to tell a split from a double-pay.
-    const by = new Map();
-    for (const p of payouts) {
-        const at = by.get(p.to);
-        by.set(p.to, at ? { ...at, amount: at.amount + p.amount, why: `${at.why} + ${p.why}` } : p);
-    }
-    const merged = [...by.values()];
-    const sum = merged.reduce((s, p) => s + p.amount, 0n);
-    if (sum !== total) throw new Error(`payouts sum to ${sum}, buyer paid ${total}`);
-    return merged;
-}
-
-/** Human-readable, for a receipt or a quote. 6-decimal base units — every asset
- *  this settles on is 6-decimal, and a bare "50000" on a buy button is not a
- *  price anyone reads. */
-export const label = (base, currency = "USDC") => `${(Number(base) / 1e6).toFixed(2)} ${currency}`;
-
-// ── self-check: `node src/market/terms.js` ────────────────────────────────────
-if (typeof process !== "undefined" && import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/terms.js")) {
-    const A = "0x" + "a".repeat(40);   // app owner
-    const P = "0x" + "b".repeat(40);   // publisher
-    const S1 = "0x" + "c".repeat(40);  // a source
-    const S2 = "0x" + "d".repeat(40);  // another
-    const T = { appId: "fangorn.tv", owner: A, appBps: 1000 };
-    const at = (ps, to) => ps.find((p) => p.to === to)?.amount ?? 0n;
-
-    // The plain case: 10% to the app, the rest to whoever published it.
-    let ps = splitPayment(1_000_000n, { terms: T, publisher: P });
-    if (at(ps, A) !== 100_000n || at(ps, P) !== 900_000n) throw new Error(`plain split wrong: ${JSON.stringify(ps, (k, v) => typeof v === "bigint" ? String(v) : v)}`);
-
-    // A derivative: two sources, 20% and 5% OF THE PUBLISHER'S SHARE. The app's
-    // cut must not move — that is the whole reason lineage comes out of the
-    // publisher's half.
-    ps = splitPayment(1_000_000n, { terms: T, publisher: P, lineage: [{ to: S1, bps: 2000 }, { to: S2, bps: 500 }] });
-    if (at(ps, A) !== 100_000n) throw new Error("the app's cut must not shrink because the publisher cited someone");
-    if (at(ps, S1) !== 180_000n || at(ps, S2) !== 45_000n) throw new Error(`upstream is a share of 900000: ${at(ps, S1)}/${at(ps, S2)}`);
-    if (at(ps, P) !== 675_000n) throw new Error(`publisher keeps the rest: ${at(ps, P)}`);
-
-    // Money is neither created nor destroyed, at any amount.
-    for (const amt of [0n, 1n, 3n, 7n, 999n, 1_000_001n, 123_456_789n]) {
-        const out = splitPayment(amt, { terms: T, publisher: P, lineage: [{ to: S1, bps: 3333 }, { to: S2, bps: 3333 }] });
-        const sum = out.reduce((s, p) => s + p.amount, 0n);
-        if (sum !== amt) throw new Error(`${amt} split into ${sum}`);
-        if (out.some((p) => p.amount < 0n)) throw new Error(`negative payout at ${amt}`);
-    }
-
-    // Dust goes to the publisher, never to rounding.
-    ps = splitPayment(7n, { terms: { ...T, appBps: 3333 }, publisher: P });
-    if (at(ps, A) !== 2n || at(ps, P) !== 5n) throw new Error(`dust must land on the publisher: ${JSON.stringify(ps.map((p) => [p.to.slice(0, 4), String(p.amount)]))}`);
-
-    // One payee, one payout: an app owner who publishes under their own app.
-    ps = splitPayment(1_000_000n, { terms: T, publisher: A });
-    if (ps.length !== 1 || at(ps, A) !== 1_000_000n) throw new Error("the same address must be paid once, not twice");
-
-    // Citing the same source twice is one debt.
-    ps = splitPayment(1_000_000n, { terms: T, publisher: P, lineage: [{ to: S1, bps: 1000 }, { to: S1, bps: 1000 }] });
-    if (at(ps, S1) !== 180_000n) throw new Error(`a repeated citation must merge, not double-pay: ${at(ps, S1)}`);
-
-    // Terms are refused, not silently clamped.
-    for (const bad of [{ ...T, appBps: 10001 }, { ...T, appBps: -1 }, { ...T, owner: "0xnope" }, { appId: "", owner: A }]) {
-        let threw = false;
-        try { splitPayment(1n, { terms: bad, publisher: P }); } catch { threw = true; }
-        if (!threw) throw new Error(`bad terms must throw: ${JSON.stringify(bad)}`);
-    }
-    let threw = false;
-    try { lineage([{ to: S1, bps: 6000 }, { to: S2, bps: 6000 }]); } catch { threw = true; }
-    if (!threw) throw new Error("a publisher cannot owe more than they have");
-
-    // The hash is what a publisher agreed to: stable across key order, and it
-    // moves the moment a single term does.
-    const h1 = await termsHash(T);
-    const h2 = await termsHash({ owner: A, appBps: 1000, appId: "fangorn.tv" });
-    if (h1 !== h2) throw new Error("key order must not change the hash");
-    if (h1 === await termsHash({ ...T, appBps: 1001 })) throw new Error("a changed cut must change the hash");
-    if (!/^0x[0-9a-f]{64}$/.test(h1)) throw new Error(`hash shape: ${h1}`);
-
-    console.log("terms.js self-check ok — app cut fixed, lineage paid from the publisher's share, payouts always sum to what was paid, "
-        + "dust to the publisher, repeated payees merged, bad terms refused, terms hash canonical");
-}

package/src/publish/cli.js

@@ -1,336 +0,0 @@
-#!/usr/bin/env node
-// The publisher's CLI. Everything an app's publish UI does, with a local key.
-//
-// WHY THIS IS NOT IN AN APP
-// -------------------------
-// A publisher should not have to clone the app they are publishing to. The
-// browser flow costs one file-picker click and one wallet confirmation PER FILE,
-// which makes seeding a library impossible and publishing from a chat message
-// impossible for the same reason — but the deeper problem is that it made the
-// app's repo a dependency of publishing to it.
-//
-// So this is a CLIENT of the relay's HTTP surface and of nothing else. The only
-// app-specific thing it needs is `ns` — the namespace folded into every
-// resourceId — and the relay declares that itself, so a publisher needs a URL, a
-// key, and a price.
-//
-//   PUBLISHER_PRIVATE_KEY=0x… westmarch-publish <relay> <path…> [flags]
-//
-//   --ns=name          app namespace. Defaults to what the relay declares.
-//                      NEVER guessed: it is folded into every resourceId, so a
-//                      wrong one mints ids nobody can buy from and orphans a
-//                      library that already exists.
-//   --dir=sub/folder   stage under this folder instead of the library root
-//   --price=1000       USDC base units per file (default: the relay's)
-//   --desc="…"         description for every file in this run
-//   --catalog-only     publish as FREE catalog entries: committed to the graph,
-//                      searchable, but never encrypted, uploaded or minted as a
-//                      resource. One commitStateRoot covers a graph of any size,
-//                      so this is what makes bulk ingest cost one transaction
-//                      instead of one per file.
-//   --register         send the one-time, fee-paying register() tx if needed
-//   --setup            onboard only — terms and registration. Publishes nothing,
-//                      and without --register sends nothing at all: it reports
-//                      what is missing and what it would cost. Ends with one
-//                      `SETUP <json>` line for a caller to parse.
-//   --selfcheck        run the offline self-check and exit
-//
-// A description is the highest-signal thing a file carries — for an image it is
-// the ONLY thing, since nothing in a JPEG's bytes says what it is. So per-file
-// descriptions come from a `<file>.txt` sidecar when one exists (--desc is the
-// fallback for the rest).
-//
-// The key comes from the environment and never from argv — argv is visible in
-// `ps` to every process on the box.
-
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { basename, join, relative, resolve, sep } from "node:path";
-import { createPublicClient, createWalletClient, defineChain, http } from "viem";
-import { privateKeyToAccount } from "viem/accounts";
-import { encryptAndUpload } from "../market/settle.js";
-import { resourceIdFor } from "./envelope.js";
-import { newUid, readManifest, writeManifest } from "./manifest.js";
-
-// ── argv ──────────────────────────────────────────────────────────────────────
-
-const flags = {};
-const args = [];
-for (const a of process.argv.slice(2)) {
-    const m = /^--([^=]+)(?:=([\s\S]*))?$/.exec(a);
-    if (m) flags[m[1]] = m[2] ?? true;
-    else args.push(a);
-}
-
-// ── file collection ───────────────────────────────────────────────────────────
-
-/** Sidecars and dotfiles are not products. A `.txt` NEXT TO a file it describes
- *  is a caption; an orphan `.txt` is a document someone may want to sell. */
-export const skip = (name, isSidecar) =>
-    name.startsWith(".") || name.endsWith(".vtt") || isSidecar;
-
-function collect(abs, root = abs) {
-    const st = statSync(abs);
-    if (st.isDirectory()) {
-        return readdirSync(abs).sort().flatMap((n) => collect(join(abs, n), root));
-    }
-    const name = basename(abs);
-    const described = name.endsWith(".txt") && existsSync(abs.slice(0, -4));
-    if (skip(name, described)) return [];
-    const rel = (root === abs ? name : relative(root, abs)).split(sep).join("/");
-    return [{ abs, rel }];
-}
-
-/** `<file>.txt` beside the file, else --desc, else nothing. */
-const descFor = (abs) => {
-    const side = `${abs}.txt`;
-    if (existsSync(side)) return readFileSync(side, "utf8").trim().slice(0, 2000);
-    return typeof flags.desc === "string" ? flags.desc : null;
-};
-
-// ── relay client ──────────────────────────────────────────────────────────────
-
-function client(relay) {
-    let token = null;
-    // Origin is sent explicitly and identically on every request: the relay
-    // derives both the SIWE message's domain and the terms URL from it, so a
-    // nonce issued under one origin and a terms acceptance under another would
-    // sign two different documents.
-    const headers = (extra = {}) => ({ Origin: relay, ...(token ? { Authorization: `Bearer ${token}` } : {}), ...extra });
-    const j = async (res) => {
-        const body = await res.json().catch(() => ({}));
-        if (!res.ok) throw new Error(body.error ?? `${res.status} ${res.statusText}`);
-        return body;
-    };
-    return {
-        setToken: (t) => { token = t; },
-        get: (path) => fetch(`${relay}${path}`, { headers: headers() }).then(j),
-        post: (path, body) => fetch(`${relay}${path}`, {
-            method: "POST", headers: headers({ "Content-Type": "application/json" }), body: JSON.stringify(body),
-        }).then(j),
-        prepare: (library) => fetch(`${relay}/api/publish/prepare`, {
-            method: "POST", headers: headers({ "Content-Type": "application/json" }), body: JSON.stringify({ library }),
-        }).then(j),
-    };
-}
-
-// ── main ──────────────────────────────────────────────────────────────────────
-
-async function main() {
-    const [relayArg, ...paths] = args;
-    if (!relayArg) {
-        console.error("usage: PUBLISHER_PRIVATE_KEY=0x… westmarch-publish <relay> <path…> [--ns=] [--dir=] [--price=] [--desc=] [--register] [--setup]");
-        process.exit(2);
-    }
-    const relay = relayArg.replace(/\/$/, "");
-
-    const key = process.env.PUBLISHER_PRIVATE_KEY;
-    if (!/^0x[0-9a-fA-F]{64}$/.test(key ?? "")) throw new Error("PUBLISHER_PRIVATE_KEY must be a 0x-prefixed 32-byte hex key (env only — never argv)");
-    const account = privateKeyToAccount(key);
-    const api = client(relay);
-
-    const cfg = await api.get("/api/config");
-    if (cfg.readOnly) throw new Error(`${relay} is read-only — it serves a published catalog but accepts no publishes. Point at the relay for the app you are publishing to.`);
-
-    // Never defaulted, never guessed. `ns` is folded into every resourceId this
-    // wallet mints, so the wrong one produces ids that address nobody's bytes and
-    // a manifest key that reads back as an empty library.
-    const ns = typeof flags.ns === "string" ? flags.ns : cfg.ns;
-    if (!ns) throw new Error(`${relay} does not declare an app namespace (config.ns) — pass --ns=<name> explicitly, and be sure it is the one this app already publishes under`);
-
-    const chain = defineChain({
-        id: cfg.chainId,
-        name: `chain-${cfg.chainId}`,
-        nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
-        rpcUrls: { default: { http: [cfg.rpc] } },
-    });
-    const wallet = createWalletClient({ account, chain, transport: http(cfg.rpc) });
-    const node = createPublicClient({ chain, transport: http(cfg.rpc) });
-    const send = async (tx) => {
-        const hash = await wallet.sendTransaction({ to: tx.to, data: tx.data, ...(tx.value ? { value: BigInt(tx.value) } : {}) });
-        const rc = await node.waitForTransactionReceipt({ hash });
-        if (rc.status !== "success") throw new Error(`tx reverted: ${hash}`);
-        return hash;
-    };
-
-    // ── sign in ───────────────────────────────────────────────────────────────
-    // This signature is also the rights attestation the relay appends to its log
-    // before minting a session. Automating it does not make it mean less: the
-    // key holder is asserting they are licensed to distribute what follows.
-    const { nonce, message } = await api.post("/api/session/nonce", { address: account.address });
-    const { token } = await api.post("/api/session", { nonce, signature: await account.signMessage({ message }) });
-    api.setToken(token);
-    console.log(`signed in as ${account.address} — publishing to ${relay} as "${ns}"`);
-
-    // ── terms + registration ──────────────────────────────────────────────────
-    let reg = await api.get("/api/registration");
-    if (!reg.acceptedTerms) {
-        const t = await api.get("/api/terms");
-        await api.post("/api/terms/accept", { signature: await account.signMessage({ message: t.message }) });
-        console.log(`accepted publisher terms (${t.hash.slice(0, 12)}…) — ${t.url}`);
-        reg = await api.get("/api/registration");
-    }
-    if (!reg.registered) {
-        // Registration costs a fee in ETH and is irreversible, so it is never
-        // sent implicitly. Two txs, in the order the relay gave: global standing
-        // in the data registry, then membership of this app. Both are needed —
-        // commitStateRoot cross-calls the app registry, so stopping after the
-        // first buys a revert at the end of the publish instead of an error here.
-        const total = BigInt(reg.fee ?? 0) + BigInt(reg.appFee ?? 0);
-        if (!flags.register) {
-            if (!flags.setup) throw new Error(`${account.address} is not a registered publisher. Re-run with --register to send ${reg.txs.length} registration tx(s) (fee: ${total} wei), or register at https://fangorn.network`);
-        } else {
-            console.log(`registering as a publisher (${reg.txs.length} tx, fee ${total} wei)…`);
-            for (const tx of reg.txs) await send(tx);
-            reg = await api.get("/api/registration");
-        }
-    }
-
-    // ── setup mode ────────────────────────────────────────────────────────────
-    // Onboarding a publisher — terms, registration txs, and a bucket to put bytes
-    // in — used to be reachable only by attempting a publish and reading the
-    // error. A caller that wants to ASK "am I set up?" had nothing to call.
-    //
-    // Without --register it is a dry run: it says what is missing and what the
-    // fees would be, and sends nothing. The last line is `SETUP <json>` so a
-    // caller parses one line instead of scraping prose.
-    if (flags.setup) {
-        const state = { address: account.address, ns, registered: !!reg.registered, acceptedTerms: true };
-        const w = await api.get("/api/worker").catch(() => null);
-        // Null until this wallet is a registered publisher — the relay withholds
-        // both, which is the only way storage can be "not ready" now.
-        state.workerUrl = w?.workerUrl ?? null;
-        state.storage = !!w?.workerUrl;
-        if (!reg.registered) {
-            state.fee = (BigInt(reg.fee ?? 0) + BigInt(reg.appFee ?? 0)).toString();
-            state.txs = reg.txs?.length ?? 0;
-        }
-        console.log(`SETUP ${JSON.stringify(state)}`);
-        return;
-    }
-
-    // ── stage ─────────────────────────────────────────────────────────────────
-    const under = typeof flags.dir === "string" ? flags.dir.replace(/^\/+|\/+$/g, "") : "";
-    const files = paths.flatMap((p) => collect(resolve(p)));
-    if (paths.length && !files.length) throw new Error("nothing to upload — every path was a dotfile, a .vtt or a description sidecar");
-
-    // The manifest lives in the bucket, not on the relay, so this client reads
-    // it, edits it and writes it back. Both the worker and this wallet's upload
-    // token come from the relay, which stores neither: the URL is its own config
-    // and the token is derived from the address.
-    const { workerUrl, uploadToken } = await api.get("/api/worker");
-    if (!workerUrl) throw new Error(`${account.address} has no storage — it is not a registered Fangorn publisher yet (run with --setup --register, or sign up at https://fangorn.network)`);
-    const store = { ns, workerUrl, uploadToken, owner: account.address };
-    const manifest = await readManifest(store);
-
-    for (const f of files) {
-        const rel = under ? `${under}/${f.rel}` : f.rel;
-        const entry = (manifest.files[rel] ??= { uid: newUid() });
-        if (flags["catalog-only"]) entry.forSale = false;
-        else if (flags.price) entry.price = String(flags.price);
-        const desc = descFor(f.abs);
-        if (desc) entry.desc = desc;
-
-        // A free catalog entry is committed to the graph but never encrypted,
-        // uploaded or minted — which is what makes bulk ingest cost one commit
-        // instead of one createResource per file.
-        if (entry.forSale === false) {
-            console.log(`↑ ${rel} … ok (free entry)${desc ? " (described)" : ""}`);
-            continue;
-        }
-        process.stdout.write(`↑ ${rel} … `);
-        const out = await encryptAndUpload({
-            file: f.abs, workerUrl, uploadToken,
-            resourceId: entry.published?.resourceId ?? resourceIdFor(ns, account.address, entry.uid),
-        });
-        entry.published = { ...out, resourceId: entry.published?.resourceId, workerUrl, mime: entry.mime };
-        // Written per file: a run that dies partway must not lose the pointers
-        // already paid for in bandwidth.
-        await writeManifest({ ...store, manifest });
-        console.log(`ok${desc ? " (described)" : ""}`);
-    }
-
-    // ── publish ───────────────────────────────────────────────────────────────
-    const library = Object.entries(manifest.files).map(([path, f]) => ({
-        path, type: "video", uid: f.uid, price: f.price, mime: f.mime,
-        desc: f.desc, forSale: f.forSale, cues: f.cues, published: f.published,
-    }));
-    const prep = await api.prepare(library);
-
-    for (const [i, c] of prep.creates.entries()) {
-        console.log(`createResource ${i + 1}/${prep.creates.length} — ${c.path}`);
-        await send(c);
-    }
-
-    // No vectors. A publisher builds and publishes the graph; embedding is not
-    // its job and never was. The commit route still takes a `vectors` map because
-    // an app's own browser flow may fill it, and an empty one is the ordinary
-    // case, not a degraded one.
-    // The pin is authorized by the publisher's own signature against their own
-    // storage quota. The challenge carries an Issued-At the gate only honours for
-    // a few minutes, so it is fetched here and not at the start of the run.
-    //
-    // `storageGate: null` is not a broken relay — it is one pinning directly on
-    // its own account, which ignores storageAuth entirely. Asking a gate that
-    // isn't there for a challenge failed a publish the relay would have accepted,
-    // and blamed a service that was never in the path.
-    let storageAuth;
-    if (cfg.storageGate) {
-        const gate = await fetch(cfg.storageGate, {
-            method: "POST", headers: { "content-type": "application/json" },
-            body: JSON.stringify({ address: account.address, size: 1 }),
-        }).then((r) => r.json()).catch(() => ({}));
-        if (!gate.challenge) throw new Error(`storage gate issued no challenge — ${cfg.storageGate} may be down`);
-        storageAuth = { message: gate.challenge, signature: await account.signMessage({ message: gate.challenge }) };
-    } else {
-        console.log("relay pins on its own account — no storage gate to authorize against");
-    }
-
-    const sealed = await api.post("/api/publish/commit", { vectors: {}, storageAuth });
-    console.log("commitStateRoot…");
-    await send(sealed.commitTx);
-    for (const [path, ptr] of Object.entries(sealed.published)) {
-        manifest.files[path].published = { ...(manifest.files[path].published ?? {}), ...ptr };
-    }
-    await writeManifest({ ...store, manifest });
-    await api.post("/api/settle", {});
-
-    const { vertices, edges } = sealed.staged;
-    console.log(`published — ${vertices} vertices, ${edges} edges`);
-    for (const [path, ptr] of Object.entries(sealed.published)) console.log(`  ${path}  ${ptr.resourceId}`);
-}
-
-// ── self-check: `node src/publish/cli.js --selfcheck` (offline) ──────────────────
-
-if (flags.selfcheck) {
-    const assert = (cond, msg) => { if (!cond) throw new Error(msg); };
-
-    // Collection: sidecars are descriptions, not products; a .txt with no file
-    // beside it still sells; nested paths keep their shape.
-    const here = new Set(["/lib/a.jpg", "/lib/notes.txt", "/lib/sub/b.mp3"]);
-    const survives = (name, abs) => !skip(name, name.endsWith(".txt") && here.has(abs.slice(0, -4)));
-    assert(survives("a.jpg", "/lib/a.jpg"), "a real file was skipped");
-    assert(!survives("a.jpg.txt", "/lib/a.jpg.txt"), "a description sidecar was published as a file");
-    assert(survives("notes.txt", "/lib/notes.txt"), "an orphan .txt should publish as a text file");
-    assert(!survives(".hidden", "/lib/.hidden"), "a dotfile was published");
-    assert(!survives("c.mp4.vtt", "/lib/c.mp4.vtt"), "a .vtt was published — /api/upload rejects these");
-
-    // A read-only relay and a relay that declares no namespace must both fail
-    // BEFORE anything is signed, uploaded or sent — and say which it was.
-    const real = globalThis.fetch;
-    const runAgainst = async (config) => {
-        globalThis.fetch = async (url) => String(url).endsWith("/api/config")
-            ? { ok: true, json: async () => config }
-            : { ok: false, json: async () => ({ error: "should never be reached" }) };
-        process.env.PUBLISHER_PRIVATE_KEY = `0x${"11".repeat(32)}`;
-        args.length = 0; args.push("http://relay", "/tmp");
-        return main().then(() => "no error", (e) => e.message);
-    };
-    try {
-        assert(/read-only/.test(await runAgainst({ readOnly: true })), "a read-only relay must be refused by name");
-        assert(/namespace/.test(await runAgainst({ chainId: 1, rpc: "http://r" })), "a relay declaring no ns must be refused, not guessed at");
-    } finally { globalThis.fetch = real; delete process.env.PUBLISHER_PRIVATE_KEY; }
-
-    console.log("cli.js self-check ok — sidecars, read-only relay refused, missing ns refused");
-} else {
-    await main().catch((e) => { console.error(`✗ ${e.message}`); process.exit(1); });
-}