@toon-protocol/rig 2.0.1 → 2.2.0

package/dist/chunk-OIJNRACA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/standalone/standalone-publisher.ts"],"sourcesContent":["/**\n * StandalonePublisher — impl 2 of the {@link Publisher} seam (#228): an\n * EMBEDDED ToonClient constructed from the caller's config (mnemonic +\n * account index, the exact `packages/client/src/config.ts` shape) instead of\n * routing through a running toon-clientd. Made for CI jobs, servers, and\n * one-shot CLI runs where no daemon exists.\n *\n * Paid-write mechanics mirror the production daemon path\n * (`client-mcp/src/daemon/client-runner.ts`) and the proven seed pipeline\n * (`rig/tests/e2e/seed/lib/{publish,git-builder}.ts`):\n *\n *  - one signed balance-proof CLAIM per write (`signBalanceProof(channelId,\n *    fee)` — the ChannelManager accumulates the cumulative watermark),\n *  - publishes route to the relay write destination with a flat per-event\n *    fee (the daemon's `feePerEvent` convention),\n *  - git objects upload as kind:5094 store writes tagged\n *    Git-SHA/Git-Type/Repo, priced at bytes × per-byte rate (the seed\n *    pipeline's bid), routed to the store destination via `proxyPath:\n *    '/store'`, with the Arweave txId decoded from the FULFILL data.\n *\n * Because the embedded client signs claims on the SAME channels a daemon on\n * the same identity would, every paid operation is preceded by the nonce\n * guard (./nonce-guard.ts): refuse if a toon-clientd holds this identity,\n * and hold an exclusive per-pubkey lockfile against other standalone\n * processes for the lifetime of this publisher.\n *\n * Channel REUSE (#262): with a `channelMap` configured, start() resumes the\n * channel recorded for (identity, channel anchor) — `trackChannel` rehydrates\n * the cumulative-claim watermark from the client's channels.json — and\n * records any fresh lazy open, so sequential CLI invocations share ONE\n * on-chain channel instead of stranding a deposit per run (./channel-map.ts).\n */\n\nimport type {\n  PublishEventResult,\n  SignedBalanceProof,\n  ToonClientConfig,\n} from '@toon-protocol/client';\nimport { ToonClient, parseFulfillHttp } from '@toon-protocol/client';\nimport { MAX_OBJECT_SIZE } from '../objects.js';\nimport type { UnsignedEvent } from '../nip34-events.js';\nimport type {\n  FeeRates,\n  GitObjectUpload,\n  PublishReceipt,\n  Publisher,\n  UploadReceipt,\n} from '../publisher.js';\nimport {\n  recordKey,\n  type ChannelMapRecord,\n  type ChannelMapStore,\n  type PersistedChannelContext,\n} from './channel-map.js';\nimport type {\n  ChannelCloseOutcome,\n  ChannelOpenOutcome,\n  ChannelSettleOutcome,\n  WalletBalanceInfo,\n} from './money.js';\nimport { checkDaemonIdentity, NonceLock } from './nonce-guard.js';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** A fully-signed Nostr event (structural subset of nostr-tools' NostrEvent). */\nexport interface SignedNostrEvent extends UnsignedEvent {\n  id: string;\n  pubkey: string;\n  sig: string;\n}\n\n/**\n * The slice of `ToonClient` the publisher drives. Kept structural so tests\n * inject a mock and alternative client builds stay compatible.\n */\nexport interface ToonClientLike {\n  start(): Promise<unknown>;\n  stop(): Promise<void>;\n  isStarted?(): boolean;\n  getPublicKey(): string;\n  signEvent(template: UnsignedEvent): SignedNostrEvent;\n  openChannel(destination?: string): Promise<string>;\n  signBalanceProof(\n    channelId: string,\n    amount: bigint\n  ): Promise<SignedBalanceProof>;\n  publishEvent(\n    event: SignedNostrEvent,\n    options?: {\n      destination?: string;\n      claim?: SignedBalanceProof;\n      ilpAmount?: bigint;\n      proxyPath?: string;\n    }\n  ): Promise<PublishEventResult>;\n  /** On-chain deposit total for a tracked channel (channel-map bookkeeping). */\n  getChannelDepositTotal?(channelId: string): bigint;\n  /** Re-read a RESUMED channel's on-chain deposit (persisted state omits it). */\n  rehydrateChannelDeposit?(\n    channelId: string,\n    opts: { chain: string; tokenNetworkAddress: string }\n  ): Promise<bigint | undefined>;\n  // ── money lifecycle (#263) — optional, matches ToonClient's surface ──────\n  /** Deposit extra collateral (base-unit delta) into an open channel. */\n  depositToChannel?(\n    channelId: string,\n    amount: string | bigint\n  ): Promise<{ channelId: string; txHash?: string; depositTotal: string }>;\n  /** Close a channel — starts the settlement challenge window (on-chain). */\n  closeChannel?(channelId: string): Promise<{\n    channelId: string;\n    txHash?: string;\n    /** Unix SECONDS, string-encoded. */\n    closedAt: string;\n    settleableAt: string;\n  }>;\n  /** Settle a closed channel after its window — releases funds (on-chain). */\n  settleChannel?(\n    channelId: string\n  ): Promise<{ channelId: string; txHash?: string }>;\n  /** Free on-chain wallet-balance read (works on an UNSTARTED client). */\n  getBalances?(): Promise<WalletBalanceInfo[]>;\n}\n\nexport interface StandalonePublisherOptions {\n  /**\n   * ToonClient config (mnemonic + mnemonicAccountIndex + proxy/BTP uplink +\n   * settlement fields — see `packages/client/src/config.ts`). Exactly one of\n   * `clientConfig` | `client` is required.\n   */\n  clientConfig?: ToonClientConfig;\n  /** Pre-built client (tests / advanced callers). */\n  client?: ToonClientLike;\n  /**\n   * ILP route for event publishes (relay `/write`). Default: derived from the\n   * config's `destinationAddress` anchor (`<base>.relay.store` → `<base>.relay`,\n   * matching the daemon's route derivation), else the anchor itself.\n   */\n  publishDestination?: string;\n  /**\n   * ILP route for git-object uploads (store `/store` → Arweave). Default:\n   * derived like `publishDestination` (`<base>.relay.store` → `<base>.store`).\n   */\n  storeDestination?: string;\n  /**\n   * ILP destination the payment channel anchors to. Default: the client\n   * config's `destinationAddress`.\n   */\n  channelDestination?: string;\n  /** Flat fee per published event (daemon `feePerEvent` convention). Default 1n. */\n  eventFee?: bigint;\n  /** Upload fee per object body byte (seed pipeline's bid rate). Default 10n. */\n  uploadFeePerByte?: bigint;\n  /** Daemon control API port probed by the nonce guard. */\n  daemonPort?: number;\n  /** Directory for the per-identity advisory lockfile. */\n  lockDir?: string;\n  /** Fetch impl for the daemon probe (tests). */\n  fetchImpl?: typeof fetch;\n  /**\n   * Peer→channel map store (#262): start() resumes the channel recorded for\n   * (identity, channel anchor) instead of opening a fresh one, and records\n   * any fresh lazy open for the next invocation. Absent (embedded callers\n   * managing their own channel lifecycle): the historical behaviour — open\n   * lazily every run, record nothing.\n   */\n  channelMap?: ChannelMapStore;\n  /**\n   * Per-chain settlement parameters to BACK-FILL into the client's peer\n   * negotiations after start (#264/#260): peers whose kind:10032 announce\n   * carries no `tokenNetworks`/`preferredTokens` negotiate with those fields\n   * empty, and the on-chain channel open then fails (\"tokenNetwork address\n   * is required\"). Values here never override what a peer DID announce —\n   * they only fill gaps, keyed by the negotiated chain id.\n   */\n  negotiationFallbacks?: {\n    tokenNetworks?: Record<string, string>;\n    preferredTokens?: Record<string, string>;\n  };\n  /** Sink for non-fatal channel-persistence warnings (default: stderr). */\n  warn?: (line: string) => void;\n}\n\n/** A relay/store rejected a paid write (fee NOT spent iff the claim failed too). */\nexport class StandalonePublishError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'StandalonePublishError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Route derivation (duplicated from client-mcp daemon/config.ts — that\n// package depends on this one for #227, so importing it back would be\n// circular; keep in sync)\n// ---------------------------------------------------------------------------\n\n/**\n * Derive publish/store routes from the channel anchor. Behind the devnet\n * proxy the anchor is `<base>.relay.store` (e.g. `g.proxy.relay.store`):\n * publishes terminate at `<base>.relay`, uploads at `<base>.store`. Anchors\n * not matching the convention pass through unchanged.\n */\nexport function deriveRouteDestinations(anchor: string): {\n  publish: string;\n  store: string;\n} {\n  const segs = anchor.split('.');\n  if (segs.at(-1) === 'store' && segs.at(-2) === 'relay') {\n    const base = segs.slice(0, -2).join('.');\n    return { publish: `${base}.relay`, store: `${base}.store` };\n  }\n  return { publish: anchor, store: anchor };\n}\n\n// ---------------------------------------------------------------------------\n// FULFILL → Arweave txId (mirrors @toon-protocol/client blob-storage.ts,\n// whose extractor is not exported; uses the exported parseFulfillHttp)\n// ---------------------------------------------------------------------------\n\n/** Arweave tx IDs are base64url-encoded 32-byte values (43 chars). */\nconst ARWEAVE_TX_ID_REGEX = /^[A-Za-z0-9_-]{43}$/;\n\n/**\n * Decode the Arweave txId from a store-write FULFILL. The deployed payment\n * proxy returns the store's verbatim HTTP/1.1 response\n * (`{\"accept\":true,\"txId\":…}` body); legacy non-proxy providers return bare\n * `base64(utf8(txId))`.\n *\n * @throws {StandalonePublishError} when no valid txId can be extracted.\n */\nexport function extractArweaveTxId(base64Data: string): string {\n  const http = parseFulfillHttp(base64Data);\n\n  if (!http.isHttp) {\n    const legacy = Buffer.from(base64Data, 'base64').toString('utf8');\n    if (!ARWEAVE_TX_ID_REGEX.test(legacy)) {\n      throw new StandalonePublishError(\n        `FULFILL data is not a valid Arweave tx ID: \"${legacy}\"`\n      );\n    }\n    return legacy;\n  }\n\n  if (http.status < 200 || http.status >= 300) {\n    throw new StandalonePublishError(\n      `git-object upload failed: store returned HTTP ${http.status}` +\n        (http.body ? ` - ${http.body}` : '')\n    );\n  }\n\n  let parsed: { accept?: boolean; txId?: unknown; data?: unknown; error?: unknown };\n  try {\n    parsed = JSON.parse(http.body) as typeof parsed;\n  } catch {\n    throw new StandalonePublishError(\n      `git-object upload response body was not valid JSON: \"${http.body}\"`\n    );\n  }\n\n  if (parsed.accept === false) {\n    const reason = typeof parsed.error === 'string' ? `: ${parsed.error}` : '';\n    throw new StandalonePublishError(\n      `git-object upload rejected by store (accept:false)${reason}`\n    );\n  }\n\n  if (typeof parsed.txId === 'string' && ARWEAVE_TX_ID_REGEX.test(parsed.txId)) {\n    return parsed.txId;\n  }\n  if (typeof parsed.data === 'string' && parsed.data.length > 0) {\n    const decoded = Buffer.from(parsed.data, 'base64').toString('utf8');\n    if (ARWEAVE_TX_ID_REGEX.test(decoded)) return decoded;\n  }\n\n  throw new StandalonePublishError(\n    `git-object upload response did not contain a valid Arweave tx ID: \"${http.body}\"`\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Channel-resume introspection (#262)\n//\n// The peer negotiation table and the ChannelManager's peer→channel map are\n// PRIVATE on ToonClient, so resuming a channel reaches into them through a\n// structural runtime cast — the exact pattern the daemon uses\n// (client-mcp/src/daemon/client-runner.ts, openOrResumeApexChannel /\n// routeChildPeersThroughApexChannel). Keep the shapes in sync with\n// @toon-protocol/client's ToonClient/ChannelManager.\n// ---------------------------------------------------------------------------\n\n/** The slice of a `PeerNegotiation` the channel map records. */\ninterface NegotiationLike {\n  chain: string;\n  chainType: string;\n  chainId: number | string;\n  settlementAddress: string;\n  tokenAddress?: string;\n  tokenNetwork?: string;\n}\n\ninterface ChannelInternals {\n  peerNegotiations?: Map<string, NegotiationLike>;\n  channelManager?: {\n    trackChannel?: (\n      channelId: string,\n      context: PersistedChannelContext\n    ) => void;\n    peerChannels?: Map<string, string>;\n  };\n  /**\n   * The client's on-chain channel client caches per-channel chain context at\n   * OPEN time only; close/settle/deposit on a channel resumed from the map\n   * would throw \"No on-chain context\" without re-seeding it (#263). Same\n   * structural-cast contract as the rest of this block — keep in sync with\n   * `@toon-protocol/client`'s OnChainChannelClient.\n   */\n  onChainChannelClient?: {\n    channelContext?: Map<\n      string,\n      { chain: string; tokenNetworkAddress: string; tokenAddress?: string }\n    >;\n  };\n}\n\n/** Best-effort access to the client's private negotiation/channel state. */\nfunction channelInternals(client: ToonClientLike): ChannelInternals {\n  const c = client as unknown as ChannelInternals;\n  const negotiations =\n    c.peerNegotiations instanceof Map ? c.peerNegotiations : undefined;\n  const cm =\n    c.channelManager &&\n    typeof c.channelManager.trackChannel === 'function' &&\n    c.channelManager.peerChannels instanceof Map\n      ? c.channelManager\n      : undefined;\n  const onChain =\n    c.onChainChannelClient &&\n    c.onChainChannelClient.channelContext instanceof Map\n      ? c.onChainChannelClient\n      : undefined;\n  return {\n    ...(negotiations ? { peerNegotiations: negotiations } : {}),\n    ...(cm ? { channelManager: cm } : {}),\n    ...(onChain ? { onChainChannelClient: onChain } : {}),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// StandalonePublisher\n// ---------------------------------------------------------------------------\n\nexport class StandalonePublisher implements Publisher {\n  private readonly client: ToonClientLike;\n  private readonly ownsClient: boolean;\n  private readonly publishDestination: string | undefined;\n  private readonly storeDestination: string | undefined;\n  private readonly channelDestination: string | undefined;\n  private readonly eventFee: bigint;\n  private readonly uploadFeePerByte: bigint;\n  private readonly daemonPort: number | undefined;\n  private readonly lockDir: string | undefined;\n  private readonly fetchImpl: typeof fetch | undefined;\n  private readonly channelMap: ChannelMapStore | undefined;\n  /** ILP anchor the channel is keyed by in the map (peer/apex destination). */\n  private readonly channelAnchor: string | undefined;\n  private readonly negotiationFallbacks:\n    | StandalonePublisherOptions['negotiationFallbacks']\n    | undefined;\n  private readonly warn: (line: string) => void;\n\n  private lock: NonceLock | undefined;\n  private channelId: string | undefined;\n  private readyPromise: Promise<void> | undefined;\n  /** Guard + client start only (no channel) — see {@link startClientOnly}. */\n  private clientReadyPromise: Promise<void> | undefined;\n  /** True when the last start() RESUMED the recorded channel (#263). */\n  private lastOpenResumed = false;\n\n  constructor(options: StandalonePublisherOptions) {\n    if (options.client && options.clientConfig) {\n      throw new Error(\n        'StandalonePublisher: provide either `clientConfig` or `client`, not both'\n      );\n    }\n    if (options.client) {\n      this.client = options.client;\n      this.ownsClient = false;\n    } else if (options.clientConfig) {\n      this.client = new ToonClient(options.clientConfig);\n      this.ownsClient = true;\n    } else {\n      throw new Error(\n        'StandalonePublisher: one of `clientConfig` (mnemonic-based ToonClient config) or `client` is required'\n      );\n    }\n\n    // Routes: explicit option → derived from the channel anchor (same\n    // `<base>.relay.store` convention the daemon resolves).\n    const anchor =\n      options.channelDestination ?? options.clientConfig?.destinationAddress;\n    const routes = anchor ? deriveRouteDestinations(anchor) : undefined;\n    this.publishDestination = options.publishDestination ?? routes?.publish;\n    this.storeDestination = options.storeDestination ?? routes?.store;\n    this.channelDestination = options.channelDestination;\n\n    this.eventFee = options.eventFee ?? 1n;\n    this.uploadFeePerByte = options.uploadFeePerByte ?? 10n;\n    this.daemonPort = options.daemonPort;\n    this.lockDir = options.lockDir;\n    this.fetchImpl = options.fetchImpl;\n    this.channelMap = options.channelMap;\n    this.channelAnchor = anchor;\n    this.negotiationFallbacks = options.negotiationFallbacks;\n    this.warn =\n      options.warn ?? ((line) => process.stderr.write(`${line}\\n`));\n  }\n\n  /** Hex Nostr pubkey of the embedded identity (available before start). */\n  getPublicKey(): string {\n    return this.client.getPublicKey();\n  }\n\n  /**\n   * Run the nonce guard, start the embedded client, and open (or resume) the\n   * payment channel. Called lazily by the first paid operation; safe to call\n   * eagerly to fail fast. Idempotent.\n   */\n  start(): Promise<void> {\n    this.readyPromise ??= (async () => {\n      await this.startClientOnly();\n      try {\n        this.channelId = await this.openOrResumeChannel();\n      } catch (err) {\n        // Release the identity lock on a failed channel open (pre-#263\n        // behaviour): nothing holds claims yet, so another process may go.\n        this.lock?.release();\n        this.lock = undefined;\n        this.clientReadyPromise = undefined;\n        throw err;\n      }\n    })().catch((err: unknown) => {\n      // Let a later call retry (e.g. after the conflicting daemon stops).\n      this.readyPromise = undefined;\n      throw err;\n    });\n    return this.readyPromise;\n  }\n\n  /**\n   * Run the nonce guard and start the embedded client WITHOUT touching the\n   * payment channel (#263): `channel close`/`settle` operate on a RECORDED\n   * channel and must never open a fresh one as a side effect of starting.\n   * Idempotent; `start()` layers the channel open/resume on top of this.\n   */\n  startClientOnly(): Promise<void> {\n    this.clientReadyPromise ??= this.doStartClient().catch((err: unknown) => {\n      this.clientReadyPromise = undefined;\n      throw err;\n    });\n    return this.clientReadyPromise;\n  }\n\n  private async doStartClient(): Promise<void> {\n    const pubkey = this.client.getPublicKey();\n\n    // Guard 1: refuse while a toon-clientd holds this identity.\n    await checkDaemonIdentity(pubkey, {\n      ...(this.daemonPort !== undefined ? { port: this.daemonPort } : {}),\n      ...(this.fetchImpl ? { fetchImpl: this.fetchImpl } : {}),\n    });\n\n    // Guard 2: exclusive advisory lock against other standalone processes.\n    this.lock = await NonceLock.acquire(pubkey, {\n      ...(this.lockDir !== undefined ? { dir: this.lockDir } : {}),\n    });\n\n    try {\n      if (this.client.isStarted?.() !== true) {\n        await this.client.start();\n      }\n      // #264: back-fill negotiation gaps as soon as the client's bootstrap\n      // negotiation exists — before any channel open (start()) or recorded-\n      // channel operation reads them.\n      this.applyNegotiationFallbacks();\n    } catch (err) {\n      this.lock.release();\n      this.lock = undefined;\n      throw err;\n    }\n  }\n\n  /**\n   * Back-fill negotiated peer metadata the announce did not carry\n   * (#264/#260 root cause 3): after the client's bootstrap negotiation, any\n   * peer negotiation missing `tokenNetwork`/`tokenAddress` gets the derived\n   * per-chain fallback for its negotiated chain, BEFORE the lazy channel\n   * open reads them. Announced values are never overridden.\n   */\n  private applyNegotiationFallbacks(): void {\n    const fallbacks = this.negotiationFallbacks;\n    if (!fallbacks) return;\n    const negotiations = channelInternals(this.client).peerNegotiations;\n    if (!negotiations) {\n      this.warn(\n        'rig: settlement fallbacks configured but the client does not ' +\n          'expose negotiation internals — on-chain channel opening may fail ' +\n          'if the peer announced no TokenNetwork'\n      );\n      return;\n    }\n    for (const negotiation of negotiations.values()) {\n      if (!negotiation.tokenNetwork) {\n        const tokenNetwork = fallbacks.tokenNetworks?.[negotiation.chain];\n        if (tokenNetwork) negotiation.tokenNetwork = tokenNetwork;\n      }\n      if (!negotiation.tokenAddress) {\n        const tokenAddress = fallbacks.preferredTokens?.[negotiation.chain];\n        if (tokenAddress) negotiation.tokenAddress = tokenAddress;\n      }\n    }\n  }\n\n  /**\n   * Open the payment channel — or, when the channel map has a record for\n   * (identity, anchor), RESUME the recorded on-chain channel (#262).\n   *\n   * Resume seeds the client's ChannelManager (`trackChannel` rehydrates the\n   * cumulative-claim watermark from channels.json; `peerChannels` makes the\n   * subsequent `openChannel` return the same id instead of opening on-chain).\n   * A fresh open is RECORDED so the next invocation resumes it. A corrupt map\n   * file throws BEFORE anything is opened — never a silent duplicate open.\n   */\n  private async openOrResumeChannel(): Promise<string> {\n    const map = this.channelMap;\n    if (!map) {\n      // No persistence configured: historical lazy open, nothing recorded.\n      return this.client.openChannel(this.channelDestination);\n    }\n    if (!this.channelAnchor) {\n      this.warn(\n        'rig: no channel anchor destination configured — the peer→channel ' +\n          'mapping cannot be persisted, so this run may open a fresh channel'\n      );\n      return this.client.openChannel(this.channelDestination);\n    }\n\n    const anchor = this.channelAnchor;\n    const identity = this.client.getPublicKey();\n    // Corruption check happens HERE, before any on-chain open (throws).\n    const candidates = map.listFor(identity, anchor);\n    const internals = channelInternals(this.client);\n    const resumed = await this.resumeRecordedChannel(map, candidates, internals);\n\n    // Idempotent — returns the (resumed or existing) channel for the peer if\n    // one is tracked, else opens lazily on-chain.\n    const channelId = await this.client.openChannel(this.channelDestination);\n\n    if (resumed && channelId === resumed.channelId) {\n      this.lastOpenResumed = true;\n      map.touch(recordKey(resumed));\n    } else {\n      this.lastOpenResumed = false;\n      this.recordOpenedChannel(map, internals, identity, anchor, channelId);\n    }\n    return channelId;\n  }\n\n  /**\n   * Try to resume one recorded channel: the first candidate whose peer is\n   * still negotiated on the SAME chain + tokenNetwork and whose watermark\n   * does not show it closed/settled. Returns the resumed record, if any.\n   */\n  private async resumeRecordedChannel(\n    map: ChannelMapStore,\n    candidates: ChannelMapRecord[],\n    internals: ChannelInternals\n  ): Promise<ChannelMapRecord | undefined> {\n    if (candidates.length === 0) return undefined;\n    const cm = internals.channelManager;\n    if (!cm?.trackChannel || !cm.peerChannels) {\n      this.warn(\n        'rig: a recorded channel exists but the client does not expose ' +\n          'channel internals to resume it — a fresh channel may be opened'\n      );\n      return undefined;\n    }\n\n    for (const record of candidates) {\n      // The peer must still be negotiated on the recorded chain/tokenNetwork;\n      // a rotated peer identity or re-negotiated settlement gets a fresh\n      // channel (recorded under its own key) instead of stale claims.\n      const negotiation = internals.peerNegotiations?.get(record.peerId);\n      if (\n        !negotiation ||\n        negotiation.chain !== record.chain ||\n        (negotiation.tokenNetwork ?? '') !== record.tokenNetwork\n      ) {\n        continue;\n      }\n\n      // Never resume a channel the withdraw flow already closed/settled.\n      const watermark = map.readWatermark(record.channelId);\n      if (\n        watermark?.closedAt !== undefined ||\n        watermark?.settledAt !== undefined\n      ) {\n        continue;\n      }\n      if (!watermark) {\n        // Fresh channels are seeded at record time, so a missing entry means\n        // the watermark store was lost. Resuming from nonce 0 fails SAFE: a\n        // regressed cumulative claim is rejected by the peer (no double\n        // spend), but warn so the failure is diagnosable.\n        this.warn(\n          `rig: resuming channel ${record.channelId} with no local claim ` +\n            `watermark (${map.watermarkPath}) — if this channel was claimed ` +\n            'against before, the peer will reject the stale claims; remove ' +\n            `its entry from ${map.mapPath} to open a fresh channel instead`\n        );\n      }\n\n      // trackChannel rehydrates nonce/cumulative from the watermark store;\n      // seeding peerChannels makes ensureChannel/openChannel reuse the id.\n      cm.trackChannel(record.channelId, record.context);\n      cm.peerChannels.set(record.peerId, record.channelId);\n\n      // Persisted channel state omits the on-chain deposit — re-read it so\n      // fee/balance accounting is right (EVM only; mirrors the daemon).\n      // #279 latency trim: skipped when the record already carries a\n      // depositTotal — deposits only change through rig's own flows (open\n      // --deposit / a later resume), which update the record; this is\n      // display/accounting state, not the claim watermark, so a stale value\n      // can never double-spend (the peer enforces the cumulative claim).\n      if (\n        record.context.chainType === 'evm' &&\n        record.depositTotal === undefined &&\n        this.client.rehydrateChannelDeposit\n      ) {\n        try {\n          const deposit = await this.client.rehydrateChannelDeposit(\n            record.channelId,\n            {\n              chain: record.chain,\n              tokenNetworkAddress: record.context.tokenNetworkAddress,\n            }\n          );\n          if (deposit !== undefined) {\n            map.touch(recordKey(record), {\n              depositTotal: deposit.toString(),\n            });\n          }\n        } catch (err) {\n          this.warn(\n            `rig: deposit re-read for resumed channel ${record.channelId} ` +\n              `failed: ${err instanceof Error ? err.message : String(err)}`\n          );\n        }\n      }\n      return record;\n    }\n    return undefined;\n  }\n\n  /** Record a freshly opened channel (+ seed its claim watermark at 0/0). */\n  private recordOpenedChannel(\n    map: ChannelMapStore,\n    internals: ChannelInternals,\n    identity: string,\n    destination: string,\n    channelId: string\n  ): void {\n    let peerId: string | undefined;\n    for (const [peer, channel] of internals.channelManager?.peerChannels ??\n      []) {\n      if (channel === channelId) {\n        peerId = peer;\n        break;\n      }\n    }\n    const negotiation =\n      peerId !== undefined\n        ? internals.peerNegotiations?.get(peerId)\n        : undefined;\n    if (peerId === undefined || !negotiation) {\n      this.warn(\n        `rig: opened channel ${channelId} but could not record the ` +\n          'peer→channel mapping (client does not expose negotiation ' +\n          'internals) — the NEXT invocation may open another channel'\n      );\n      return;\n    }\n\n    let depositTotal: bigint | undefined;\n    try {\n      depositTotal = this.client.getChannelDepositTotal?.(channelId);\n    } catch {\n      // deposit unknown — recorded without it; a later resume re-reads it\n    }\n\n    map.record({\n      channelId,\n      peerId,\n      identity,\n      destination,\n      chain: negotiation.chain,\n      tokenNetwork: negotiation.tokenNetwork ?? '',\n      // Context mirrors the daemon's persistApexChannel shape — exactly what\n      // trackChannel needs on resume.\n      context: {\n        chainType: negotiation.chainType,\n        chainId:\n          typeof negotiation.chainId === 'number' ? negotiation.chainId : 0,\n        tokenNetworkAddress: negotiation.tokenNetwork ?? '',\n        ...(negotiation.tokenAddress\n          ? { tokenAddress: negotiation.tokenAddress }\n          : {}),\n        recipient: negotiation.settlementAddress,\n      },\n      ...(depositTotal !== undefined && depositTotal > 0n\n        ? { depositTotal: depositTotal.toString() }\n        : {}),\n    });\n    // Seed nonce 0 / cumulative 0 so a later resume can tell \"never claimed\n    // against\" apart from \"watermark lost\" (which only fails claim-rejected).\n    map.seedWatermark(channelId);\n  }\n\n  /** Release the identity lock and stop the embedded client (if we own it). */\n  async stop(): Promise<void> {\n    this.lock?.release();\n    this.lock = undefined;\n    this.readyPromise = undefined;\n    this.clientReadyPromise = undefined;\n    this.channelId = undefined;\n    // Never stop a client that was never started (`ToonClient.stop()` throws\n    // INVALID_STATE) — e.g. after a free `rig balance` read (#263).\n    if (this.ownsClient && this.client.isStarted?.() !== false) {\n      await this.client.stop();\n    }\n  }\n\n  // ── Money lifecycle (#263) ──────────────────────────────────────────────────\n\n  /**\n   * Explicit `rig channel open`: the SAME resume-or-open path the lazy paid\n   * writes use (guard → start → resume the recorded channel or open + record\n   * a fresh one), surfaced with a receipt — plus an optional extra collateral\n   * deposit on top of the open/resume.\n   */\n  async openChannelExplicit(opts?: {\n    /** Extra collateral to deposit AFTER the open/resume (base units). */\n    deposit?: bigint;\n  }): Promise<ChannelOpenOutcome> {\n    await this.start();\n    const channelId = this.requireChannel();\n    const identity = this.client.getPublicKey();\n    const destination = this.channelAnchor ?? '';\n    const record =\n      this.channelMap && this.channelAnchor\n        ? this.channelMap\n            .listFor(identity, this.channelAnchor)\n            .find((r) => r.channelId === channelId)\n        : undefined;\n\n    const outcome: ChannelOpenOutcome = {\n      channelId,\n      resumed: this.lastOpenResumed,\n      destination,\n      ...(record ? { chain: record.chain, peerId: record.peerId } : {}),\n      ...(record?.depositTotal !== undefined\n        ? { depositTotal: record.depositTotal }\n        : {}),\n    };\n\n    if (opts?.deposit !== undefined && opts.deposit > 0n) {\n      if (!this.client.depositToChannel) {\n        throw new StandalonePublishError(\n          'this client build does not support channel deposits ' +\n            '(depositToChannel is unavailable)'\n        );\n      }\n      const deposited = await this.client.depositToChannel(\n        channelId,\n        opts.deposit\n      );\n      outcome.depositAdded = opts.deposit.toString();\n      outcome.depositTotal = deposited.depositTotal;\n      if (deposited.txHash) outcome.depositTxHash = deposited.txHash;\n      if (record) {\n        this.channelMap?.touch(recordKey(record), {\n          depositTotal: deposited.depositTotal,\n        });\n      }\n    }\n    return outcome;\n  }\n\n  /**\n   * Adopt a RECORDED channel into the running client so on-chain close/\n   * settle/deposit can act on it: `trackChannel` rehydrates the claim\n   * watermark + withdraw timers from channels.json, `peerChannels` binds the\n   * peer, and the on-chain client's context cache is re-seeded (it only\n   * learns context at open time — a resumed channel would otherwise throw\n   * \"No on-chain context\").\n   */\n  private adoptRecordedChannel(record: ChannelMapRecord): void {\n    const internals = channelInternals(this.client);\n    const cm = internals.channelManager;\n    if (cm?.trackChannel && cm.peerChannels) {\n      cm.trackChannel(record.channelId, record.context);\n      cm.peerChannels.set(record.peerId, record.channelId);\n    }\n    const contextCache = internals.onChainChannelClient?.channelContext;\n    if (contextCache && !contextCache.has(record.channelId)) {\n      contextCache.set(record.channelId, {\n        chain: record.chain,\n        tokenNetworkAddress: record.context.tokenNetworkAddress,\n        ...(record.context.tokenAddress\n          ? { tokenAddress: record.context.tokenAddress }\n          : {}),\n      });\n    }\n  }\n\n  /**\n   * Close a recorded channel: starts the on-chain settlement challenge\n   * window. The client persists `closedAt`/`settleableAt` into the claim\n   * watermark store, which is exactly where `rig channel list`/`balance`\n   * derive the closing/settleable/settled status from. Guard + client start,\n   * but NEVER a channel open ({@link startClientOnly}).\n   */\n  async closeRecordedChannel(\n    record: ChannelMapRecord\n  ): Promise<ChannelCloseOutcome> {\n    await this.startClientOnly();\n    if (!this.client.closeChannel) {\n      throw new StandalonePublishError(\n        'this client build does not support closing channels ' +\n          '(closeChannel is unavailable)'\n      );\n    }\n    this.adoptRecordedChannel(record);\n    const result = await this.client.closeChannel(record.channelId);\n    this.channelMap?.touch(recordKey(record));\n    return result;\n  }\n\n  /**\n   * Settle a recorded channel after its challenge window — releases the\n   * remaining collateral. The client enforces the `now >= settleableAt` time\n   * guard BEFORE spending gas (a too-early call throws its retryable\n   * SettleTooEarlyError) and persists `settledAt` into the watermark store.\n   */\n  async settleRecordedChannel(\n    record: ChannelMapRecord\n  ): Promise<ChannelSettleOutcome> {\n    await this.startClientOnly();\n    if (!this.client.settleChannel) {\n      throw new StandalonePublishError(\n        'this client build does not support settling channels ' +\n          '(settleChannel is unavailable)'\n      );\n    }\n    this.adoptRecordedChannel(record);\n    const result = await this.client.settleChannel(record.channelId);\n    this.channelMap?.touch(recordKey(record));\n    return result;\n  }\n\n  /**\n   * On-chain wallet balances for the embedded identity — a FREE read on the\n   * UNSTARTED client (no nonce guard, no uplink, no channel): the client\n   * reads the settlement chain its channels actually use (its EVM key is\n   * derived at construction; Solana/Mina keys only exist after a start, so\n   * those chains appear once a start-requiring command ran — same\n   * best-effort contract as the client's own getBalances).\n   */\n  async readWalletBalances(): Promise<WalletBalanceInfo[]> {\n    if (!this.client.getBalances) return [];\n    return await this.client.getBalances();\n  }\n\n  // ── Publisher ─────────────────────────────────────────────────────────────\n\n  /**\n   * Fee rates for `planPush` estimation: the flat per-event fee and the\n   * per-byte upload rate this publisher pays (daemon `feePerEvent` and seed\n   * bid-rate conventions; override via options).\n   */\n  getFeeRates(): Promise<FeeRates> {\n    return Promise.resolve({\n      uploadFeePerByte: this.uploadFeePerByte,\n      eventFee: this.eventFee,\n    });\n  }\n\n  /**\n   * Upload one git object as a kind:5094 store write (Git-SHA/Git-Type/Repo\n   * tagged — the proven seed-pipeline shape), signing one balance-proof claim\n   * for `body.length × uploadFeePerByte`.\n   */\n  async uploadGitObject(upload: GitObjectUpload): Promise<UploadReceipt> {\n    if (upload.body.length > MAX_OBJECT_SIZE) {\n      throw new StandalonePublishError(\n        `git object ${upload.sha} exceeds the ${MAX_OBJECT_SIZE}-byte limit: ${upload.body.length} bytes`\n      );\n    }\n    await this.start();\n    const channelId = this.requireChannel();\n\n    const fee = BigInt(upload.body.length) * this.uploadFeePerByte;\n    const event = this.client.signEvent({\n      kind: 5094,\n      content: '',\n      created_at: nowSeconds(),\n      tags: [\n        ['i', upload.body.toString('base64'), 'blob'],\n        ['bid', fee.toString(), 'usdc'],\n        ['output', 'application/octet-stream'],\n        ['Git-SHA', upload.sha],\n        ['Git-Type', upload.type],\n        ['Repo', upload.repoId],\n      ],\n    });\n\n    const claim = await this.client.signBalanceProof(channelId, fee);\n    const result = await this.client.publishEvent(event, {\n      ...(this.storeDestination ? { destination: this.storeDestination } : {}),\n      claim,\n      ilpAmount: fee,\n      // The store backend serves POST /store (not the relay's /write).\n      proxyPath: '/store',\n    });\n    if (!result.success) {\n      throw new StandalonePublishError(\n        `git-object upload rejected (${upload.sha}): ${result.error ?? 'store rejected the write'}`\n      );\n    }\n    if (!result.data) {\n      throw new StandalonePublishError(\n        `git-object upload FULFILL carried no data (${upload.sha}); expected the Arweave tx ID`\n      );\n    }\n    return { txId: extractArweaveTxId(result.data), feePaid: fee };\n  }\n\n  /**\n   * Sign the event with the embedded identity and pay-to-publish it through\n   * the relay write route, one claim for the flat per-event fee.\n   *\n   * `relayUrls` is the interface's plural forward-compat surface (parked\n   * #84): the standalone impl routes over ILP to its single configured\n   * publish destination, so more than one relay is refused rather than\n   * silently half-published.\n   */\n  async publishEvent(\n    event: UnsignedEvent,\n    relayUrls: string[]\n  ): Promise<PublishReceipt> {\n    if (relayUrls.length > 1) {\n      throw new StandalonePublishError(\n        `multi-relay publish is not supported yet (got ${relayUrls.length} relays) — the standalone publisher routes to a single relay destination (#84 parked)`\n      );\n    }\n    await this.start();\n    const channelId = this.requireChannel();\n\n    const signed = this.client.signEvent(event);\n    const fee = this.eventFee;\n    const claim = await this.client.signBalanceProof(channelId, fee);\n    const result = await this.client.publishEvent(signed, {\n      ...(this.publishDestination\n        ? { destination: this.publishDestination }\n        : {}),\n      claim,\n      ilpAmount: fee,\n    });\n    if (!result.success) {\n      throw new StandalonePublishError(\n        `publish rejected (kind ${event.kind}): ${result.error ?? 'relay rejected the event'}`\n      );\n    }\n    return { eventId: result.eventId ?? signed.id, feePaid: fee };\n  }\n\n  private requireChannel(): string {\n    if (!this.channelId) {\n      throw new StandalonePublishError(\n        'no payment channel open — start() did not complete'\n      );\n    }\n    return this.channelId;\n  }\n}\n\nfunction nowSeconds(): number {\n  return Math.floor(Date.now() / 1000);\n}\n"],"mappings":";;;;;;;;;;AAsCA,SAAS,YAAY,wBAAwB;AAoJtC,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAcO,SAAS,wBAAwB,QAGtC;AACA,QAAM,OAAO,OAAO,MAAM,GAAG;AAC7B,MAAI,KAAK,GAAG,EAAE,MAAM,WAAW,KAAK,GAAG,EAAE,MAAM,SAAS;AACtD,UAAM,OAAO,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG;AACvC,WAAO,EAAE,SAAS,GAAG,IAAI,UAAU,OAAO,GAAG,IAAI,SAAS;AAAA,EAC5D;AACA,SAAO,EAAE,SAAS,QAAQ,OAAO,OAAO;AAC1C;AAQA,IAAM,sBAAsB;AAUrB,SAAS,mBAAmB,YAA4B;AAC7D,QAAM,OAAO,iBAAiB,UAAU;AAExC,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,SAAS,OAAO,KAAK,YAAY,QAAQ,EAAE,SAAS,MAAM;AAChE,QAAI,CAAC,oBAAoB,KAAK,MAAM,GAAG;AACrC,YAAM,IAAI;AAAA,QACR,+CAA+C,MAAM;AAAA,MACvD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,SAAS,OAAO,KAAK,UAAU,KAAK;AAC3C,UAAM,IAAI;AAAA,MACR,iDAAiD,KAAK,MAAM,MACzD,KAAK,OAAO,MAAM,KAAK,IAAI,KAAK;AAAA,IACrC;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,KAAK,IAAI;AAAA,EAC/B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,wDAAwD,KAAK,IAAI;AAAA,IACnE;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,OAAO;AAC3B,UAAM,SAAS,OAAO,OAAO,UAAU,WAAW,KAAK,OAAO,KAAK,KAAK;AACxE,UAAM,IAAI;AAAA,MACR,qDAAqD,MAAM;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI,OAAO,OAAO,SAAS,YAAY,oBAAoB,KAAK,OAAO,IAAI,GAAG;AAC5E,WAAO,OAAO;AAAA,EAChB;AACA,MAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,GAAG;AAC7D,UAAM,UAAU,OAAO,KAAK,OAAO,MAAM,QAAQ,EAAE,SAAS,MAAM;AAClE,QAAI,oBAAoB,KAAK,OAAO,EAAG,QAAO;AAAA,EAChD;AAEA,QAAM,IAAI;AAAA,IACR,sEAAsE,KAAK,IAAI;AAAA,EACjF;AACF;AAgDA,SAAS,iBAAiB,QAA0C;AAClE,QAAM,IAAI;AACV,QAAM,eACJ,EAAE,4BAA4B,MAAM,EAAE,mBAAmB;AAC3D,QAAM,KACJ,EAAE,kBACF,OAAO,EAAE,eAAe,iBAAiB,cACzC,EAAE,eAAe,wBAAwB,MACrC,EAAE,iBACF;AACN,QAAM,UACJ,EAAE,wBACF,EAAE,qBAAqB,0BAA0B,MAC7C,EAAE,uBACF;AACN,SAAO;AAAA,IACL,GAAI,eAAe,EAAE,kBAAkB,aAAa,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;AAAA,IACnC,GAAI,UAAU,EAAE,sBAAsB,QAAQ,IAAI,CAAC;AAAA,EACrD;AACF;AAMO,IAAM,sBAAN,MAA+C;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EAGA;AAAA,EAET;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA,kBAAkB;AAAA,EAE1B,YAAY,SAAqC;AAC/C,QAAI,QAAQ,UAAU,QAAQ,cAAc;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ;AAClB,WAAK,SAAS,QAAQ;AACtB,WAAK,aAAa;AAAA,IACpB,WAAW,QAAQ,cAAc;AAC/B,WAAK,SAAS,IAAI,WAAW,QAAQ,YAAY;AACjD,WAAK,aAAa;AAAA,IACpB,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAIA,UAAM,SACJ,QAAQ,sBAAsB,QAAQ,cAAc;AACtD,UAAM,SAAS,SAAS,wBAAwB,MAAM,IAAI;AAC1D,SAAK,qBAAqB,QAAQ,sBAAsB,QAAQ;AAChE,SAAK,mBAAmB,QAAQ,oBAAoB,QAAQ;AAC5D,SAAK,qBAAqB,QAAQ;AAElC,SAAK,WAAW,QAAQ,YAAY;AACpC,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,aAAa,QAAQ;AAC1B,SAAK,UAAU,QAAQ;AACvB,SAAK,YAAY,QAAQ;AACzB,SAAK,aAAa,QAAQ;AAC1B,SAAK,gBAAgB;AACrB,SAAK,uBAAuB,QAAQ;AACpC,SAAK,OACH,QAAQ,SAAS,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAAA,EAC/D;AAAA;AAAA,EAGA,eAAuB;AACrB,WAAO,KAAK,OAAO,aAAa;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAuB;AACrB,SAAK,kBAAkB,YAAY;AACjC,YAAM,KAAK,gBAAgB;AAC3B,UAAI;AACF,aAAK,YAAY,MAAM,KAAK,oBAAoB;AAAA,MAClD,SAAS,KAAK;AAGZ,aAAK,MAAM,QAAQ;AACnB,aAAK,OAAO;AACZ,aAAK,qBAAqB;AAC1B,cAAM;AAAA,MACR;AAAA,IACF,GAAG,EAAE,MAAM,CAAC,QAAiB;AAE3B,WAAK,eAAe;AACpB,YAAM;AAAA,IACR,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBAAiC;AAC/B,SAAK,uBAAuB,KAAK,cAAc,EAAE,MAAM,CAAC,QAAiB;AACvE,WAAK,qBAAqB;AAC1B,YAAM;AAAA,IACR,CAAC;AACD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,gBAA+B;AAC3C,UAAM,SAAS,KAAK,OAAO,aAAa;AAGxC,UAAM,oBAAoB,QAAQ;AAAA,MAChC,GAAI,KAAK,eAAe,SAAY,EAAE,MAAM,KAAK,WAAW,IAAI,CAAC;AAAA,MACjE,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACxD,CAAC;AAGD,SAAK,OAAO,MAAM,UAAU,QAAQ,QAAQ;AAAA,MAC1C,GAAI,KAAK,YAAY,SAAY,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC5D,CAAC;AAED,QAAI;AACF,UAAI,KAAK,OAAO,YAAY,MAAM,MAAM;AACtC,cAAM,KAAK,OAAO,MAAM;AAAA,MAC1B;AAIA,WAAK,0BAA0B;AAAA,IACjC,SAAS,KAAK;AACZ,WAAK,KAAK,QAAQ;AAClB,WAAK,OAAO;AACZ,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,4BAAkC;AACxC,UAAM,YAAY,KAAK;AACvB,QAAI,CAAC,UAAW;AAChB,UAAM,eAAe,iBAAiB,KAAK,MAAM,EAAE;AACnD,QAAI,CAAC,cAAc;AACjB,WAAK;AAAA,QACH;AAAA,MAGF;AACA;AAAA,IACF;AACA,eAAW,eAAe,aAAa,OAAO,GAAG;AAC/C,UAAI,CAAC,YAAY,cAAc;AAC7B,cAAM,eAAe,UAAU,gBAAgB,YAAY,KAAK;AAChE,YAAI,aAAc,aAAY,eAAe;AAAA,MAC/C;AACA,UAAI,CAAC,YAAY,cAAc;AAC7B,cAAM,eAAe,UAAU,kBAAkB,YAAY,KAAK;AAClE,YAAI,aAAc,aAAY,eAAe;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,sBAAuC;AACnD,UAAM,MAAM,KAAK;AACjB,QAAI,CAAC,KAAK;AAER,aAAO,KAAK,OAAO,YAAY,KAAK,kBAAkB;AAAA,IACxD;AACA,QAAI,CAAC,KAAK,eAAe;AACvB,WAAK;AAAA,QACH;AAAA,MAEF;AACA,aAAO,KAAK,OAAO,YAAY,KAAK,kBAAkB;AAAA,IACxD;AAEA,UAAM,SAAS,KAAK;AACpB,UAAM,WAAW,KAAK,OAAO,aAAa;AAE1C,UAAM,aAAa,IAAI,QAAQ,UAAU,MAAM;AAC/C,UAAM,YAAY,iBAAiB,KAAK,MAAM;AAC9C,UAAM,UAAU,MAAM,KAAK,sBAAsB,KAAK,YAAY,SAAS;AAI3E,UAAM,YAAY,MAAM,KAAK,OAAO,YAAY,KAAK,kBAAkB;AAEvE,QAAI,WAAW,cAAc,QAAQ,WAAW;AAC9C,WAAK,kBAAkB;AACvB,UAAI,MAAM,UAAU,OAAO,CAAC;AAAA,IAC9B,OAAO;AACL,WAAK,kBAAkB;AACvB,WAAK,oBAAoB,KAAK,WAAW,UAAU,QAAQ,SAAS;AAAA,IACtE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,sBACZ,KACA,YACA,WACuC;AACvC,QAAI,WAAW,WAAW,EAAG,QAAO;AACpC,UAAM,KAAK,UAAU;AACrB,QAAI,CAAC,IAAI,gBAAgB,CAAC,GAAG,cAAc;AACzC,WAAK;AAAA,QACH;AAAA,MAEF;AACA,aAAO;AAAA,IACT;AAEA,eAAW,UAAU,YAAY;AAI/B,YAAM,cAAc,UAAU,kBAAkB,IAAI,OAAO,MAAM;AACjE,UACE,CAAC,eACD,YAAY,UAAU,OAAO,UAC5B,YAAY,gBAAgB,QAAQ,OAAO,cAC5C;AACA;AAAA,MACF;AAGA,YAAM,YAAY,IAAI,cAAc,OAAO,SAAS;AACpD,UACE,WAAW,aAAa,UACxB,WAAW,cAAc,QACzB;AACA;AAAA,MACF;AACA,UAAI,CAAC,WAAW;AAKd,aAAK;AAAA,UACH,yBAAyB,OAAO,SAAS,mCACzB,IAAI,aAAa,qHAEb,IAAI,OAAO;AAAA,QACjC;AAAA,MACF;AAIA,SAAG,aAAa,OAAO,WAAW,OAAO,OAAO;AAChD,SAAG,aAAa,IAAI,OAAO,QAAQ,OAAO,SAAS;AASnD,UACE,OAAO,QAAQ,cAAc,SAC7B,OAAO,iBAAiB,UACxB,KAAK,OAAO,yBACZ;AACA,YAAI;AACF,gBAAM,UAAU,MAAM,KAAK,OAAO;AAAA,YAChC,OAAO;AAAA,YACP;AAAA,cACE,OAAO,OAAO;AAAA,cACd,qBAAqB,OAAO,QAAQ;AAAA,YACtC;AAAA,UACF;AACA,cAAI,YAAY,QAAW;AACzB,gBAAI,MAAM,UAAU,MAAM,GAAG;AAAA,cAC3B,cAAc,QAAQ,SAAS;AAAA,YACjC,CAAC;AAAA,UACH;AAAA,QACF,SAAS,KAAK;AACZ,eAAK;AAAA,YACH,4CAA4C,OAAO,SAAS,YAC/C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UAC/D;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,oBACN,KACA,WACA,UACA,aACA,WACM;AACN,QAAI;AACJ,eAAW,CAAC,MAAM,OAAO,KAAK,UAAU,gBAAgB,gBACtD,CAAC,GAAG;AACJ,UAAI,YAAY,WAAW;AACzB,iBAAS;AACT;AAAA,MACF;AAAA,IACF;AACA,UAAM,cACJ,WAAW,SACP,UAAU,kBAAkB,IAAI,MAAM,IACtC;AACN,QAAI,WAAW,UAAa,CAAC,aAAa;AACxC,WAAK;AAAA,QACH,uBAAuB,SAAS;AAAA,MAGlC;AACA;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,qBAAe,KAAK,OAAO,yBAAyB,SAAS;AAAA,IAC/D,QAAQ;AAAA,IAER;AAEA,QAAI,OAAO;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,YAAY;AAAA,MACnB,cAAc,YAAY,gBAAgB;AAAA;AAAA;AAAA,MAG1C,SAAS;AAAA,QACP,WAAW,YAAY;AAAA,QACvB,SACE,OAAO,YAAY,YAAY,WAAW,YAAY,UAAU;AAAA,QAClE,qBAAqB,YAAY,gBAAgB;AAAA,QACjD,GAAI,YAAY,eACZ,EAAE,cAAc,YAAY,aAAa,IACzC,CAAC;AAAA,QACL,WAAW,YAAY;AAAA,MACzB;AAAA,MACA,GAAI,iBAAiB,UAAa,eAAe,KAC7C,EAAE,cAAc,aAAa,SAAS,EAAE,IACxC,CAAC;AAAA,IACP,CAAC;AAGD,QAAI,cAAc,SAAS;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAM,OAAsB;AAC1B,SAAK,MAAM,QAAQ;AACnB,SAAK,OAAO;AACZ,SAAK,eAAe;AACpB,SAAK,qBAAqB;AAC1B,SAAK,YAAY;AAGjB,QAAI,KAAK,cAAc,KAAK,OAAO,YAAY,MAAM,OAAO;AAC1D,YAAM,KAAK,OAAO,KAAK;AAAA,IACzB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,oBAAoB,MAGM;AAC9B,UAAM,KAAK,MAAM;AACjB,UAAM,YAAY,KAAK,eAAe;AACtC,UAAM,WAAW,KAAK,OAAO,aAAa;AAC1C,UAAM,cAAc,KAAK,iBAAiB;AAC1C,UAAM,SACJ,KAAK,cAAc,KAAK,gBACpB,KAAK,WACF,QAAQ,UAAU,KAAK,aAAa,EACpC,KAAK,CAAC,MAAM,EAAE,cAAc,SAAS,IACxC;AAEN,UAAM,UAA8B;AAAA,MAClC;AAAA,MACA,SAAS,KAAK;AAAA,MACd;AAAA,MACA,GAAI,SAAS,EAAE,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,MAC/D,GAAI,QAAQ,iBAAiB,SACzB,EAAE,cAAc,OAAO,aAAa,IACpC,CAAC;AAAA,IACP;AAEA,QAAI,MAAM,YAAY,UAAa,KAAK,UAAU,IAAI;AACpD,UAAI,CAAC,KAAK,OAAO,kBAAkB;AACjC,cAAM,IAAI;AAAA,UACR;AAAA,QAEF;AAAA,MACF;AACA,YAAM,YAAY,MAAM,KAAK,OAAO;AAAA,QAClC;AAAA,QACA,KAAK;AAAA,MACP;AACA,cAAQ,eAAe,KAAK,QAAQ,SAAS;AAC7C,cAAQ,eAAe,UAAU;AACjC,UAAI,UAAU,OAAQ,SAAQ,gBAAgB,UAAU;AACxD,UAAI,QAAQ;AACV,aAAK,YAAY,MAAM,UAAU,MAAM,GAAG;AAAA,UACxC,cAAc,UAAU;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,qBAAqB,QAAgC;AAC3D,UAAM,YAAY,iBAAiB,KAAK,MAAM;AAC9C,UAAM,KAAK,UAAU;AACrB,QAAI,IAAI,gBAAgB,GAAG,cAAc;AACvC,SAAG,aAAa,OAAO,WAAW,OAAO,OAAO;AAChD,SAAG,aAAa,IAAI,OAAO,QAAQ,OAAO,SAAS;AAAA,IACrD;AACA,UAAM,eAAe,UAAU,sBAAsB;AACrD,QAAI,gBAAgB,CAAC,aAAa,IAAI,OAAO,SAAS,GAAG;AACvD,mBAAa,IAAI,OAAO,WAAW;AAAA,QACjC,OAAO,OAAO;AAAA,QACd,qBAAqB,OAAO,QAAQ;AAAA,QACpC,GAAI,OAAO,QAAQ,eACf,EAAE,cAAc,OAAO,QAAQ,aAAa,IAC5C,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,qBACJ,QAC8B;AAC9B,UAAM,KAAK,gBAAgB;AAC3B,QAAI,CAAC,KAAK,OAAO,cAAc;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,SAAK,qBAAqB,MAAM;AAChC,UAAM,SAAS,MAAM,KAAK,OAAO,aAAa,OAAO,SAAS;AAC9D,SAAK,YAAY,MAAM,UAAU,MAAM,CAAC;AACxC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,sBACJ,QAC+B;AAC/B,UAAM,KAAK,gBAAgB;AAC3B,QAAI,CAAC,KAAK,OAAO,eAAe;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,SAAK,qBAAqB,MAAM;AAChC,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,OAAO,SAAS;AAC/D,SAAK,YAAY,MAAM,UAAU,MAAM,CAAC;AACxC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,qBAAmD;AACvD,QAAI,CAAC,KAAK,OAAO,YAAa,QAAO,CAAC;AACtC,WAAO,MAAM,KAAK,OAAO,YAAY;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,cAAiC;AAC/B,WAAO,QAAQ,QAAQ;AAAA,MACrB,kBAAkB,KAAK;AAAA,MACvB,UAAU,KAAK;AAAA,IACjB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBAAgB,QAAiD;AACrE,QAAI,OAAO,KAAK,SAAS,iBAAiB;AACxC,YAAM,IAAI;AAAA,QACR,cAAc,OAAO,GAAG,gBAAgB,eAAe,gBAAgB,OAAO,KAAK,MAAM;AAAA,MAC3F;AAAA,IACF;AACA,UAAM,KAAK,MAAM;AACjB,UAAM,YAAY,KAAK,eAAe;AAEtC,UAAM,MAAM,OAAO,OAAO,KAAK,MAAM,IAAI,KAAK;AAC9C,UAAM,QAAQ,KAAK,OAAO,UAAU;AAAA,MAClC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY,WAAW;AAAA,MACvB,MAAM;AAAA,QACJ,CAAC,KAAK,OAAO,KAAK,SAAS,QAAQ,GAAG,MAAM;AAAA,QAC5C,CAAC,OAAO,IAAI,SAAS,GAAG,MAAM;AAAA,QAC9B,CAAC,UAAU,0BAA0B;AAAA,QACrC,CAAC,WAAW,OAAO,GAAG;AAAA,QACtB,CAAC,YAAY,OAAO,IAAI;AAAA,QACxB,CAAC,QAAQ,OAAO,MAAM;AAAA,MACxB;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,MAAM,KAAK,OAAO,iBAAiB,WAAW,GAAG;AAC/D,UAAM,SAAS,MAAM,KAAK,OAAO,aAAa,OAAO;AAAA,MACnD,GAAI,KAAK,mBAAmB,EAAE,aAAa,KAAK,iBAAiB,IAAI,CAAC;AAAA,MACtE;AAAA,MACA,WAAW;AAAA;AAAA,MAEX,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,GAAG,MAAM,OAAO,SAAS,0BAA0B;AAAA,MAC3F;AAAA,IACF;AACA,QAAI,CAAC,OAAO,MAAM;AAChB,YAAM,IAAI;AAAA,QACR,8CAA8C,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AACA,WAAO,EAAE,MAAM,mBAAmB,OAAO,IAAI,GAAG,SAAS,IAAI;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aACJ,OACA,WACyB;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,iDAAiD,UAAU,MAAM;AAAA,MACnE;AAAA,IACF;AACA,UAAM,KAAK,MAAM;AACjB,UAAM,YAAY,KAAK,eAAe;AAEtC,UAAM,SAAS,KAAK,OAAO,UAAU,KAAK;AAC1C,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,MAAM,KAAK,OAAO,iBAAiB,WAAW,GAAG;AAC/D,UAAM,SAAS,MAAM,KAAK,OAAO,aAAa,QAAQ;AAAA,MACpD,GAAI,KAAK,qBACL,EAAE,aAAa,KAAK,mBAAmB,IACvC,CAAC;AAAA,MACL;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,0BAA0B,MAAM,IAAI,MAAM,OAAO,SAAS,0BAA0B;AAAA,MACtF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,WAAW,OAAO,IAAI,SAAS,IAAI;AAAA,EAC9D;AAAA,EAEQ,iBAAyB;AAC/B,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AACF;AAEA,SAAS,aAAqB;AAC5B,SAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrC;","names":[]}

package/dist/{chunk-LFGDLD6J.js → chunk-PS5QOT62.js}

@@ -1,9 +1,13 @@
 import {
+  ARWEAVE_FETCH_TIMEOUT_MS,
+  ARWEAVE_GATEWAYS,
   buildRepoAnnouncement,
-  buildRepoRefs
-} from "./chunk-HPSOQP7Q.js";
+  buildRepoRefs,
+  isValidArweaveTxId
+} from "./chunk-JBB7HBQC.js";
 import {
-  MAX_OBJECT_SIZE
+  MAX_OBJECT_SIZE,
+  hashGitObject
 } from "./chunk-X2CZPPDM.js";
 
 // src/repo-reader.ts
@@ -409,6 +413,443 @@ var GitRepoReader = class {
   }
 };
 
+// src/object-fetch.ts
+var DEFAULT_CONCURRENCY = 8;
+var ObjectIntegrityError = class extends Error {
+  constructor(objects) {
+    super(
+      `${objects.length} downloaded object(s) failed SHA-1 verification \u2014 the gateway content does not match the announced git SHA(s): ` + objects.map((o) => `${o.sha} (tx ${o.txId})`).join(", ") + ". Refusing to write corrupt/tampered objects."
+    );
+    this.objects = objects;
+    this.name = "ObjectIntegrityError";
+  }
+  objects;
+};
+var OBJECT_TYPES2 = [
+  "blob",
+  "tree",
+  "commit",
+  "tag"
+];
+function verifyObjectBody(expectedSha, bytes) {
+  const body = Buffer.from(bytes);
+  for (const type of OBJECT_TYPES2) {
+    if (hashGitObject(type, body).sha === expectedSha) {
+      return { sha: expectedSha, type, body };
+    }
+  }
+  return null;
+}
+async function fetchTxBytes(txId, options = {}) {
+  if (!isValidArweaveTxId(txId)) return null;
+  const gateways = options.gateways ?? ARWEAVE_GATEWAYS;
+  const fetchFn = options.fetchFn ?? fetch;
+  const timeoutMs = options.timeoutMs ?? ARWEAVE_FETCH_TIMEOUT_MS;
+  for (const gateway of gateways) {
+    try {
+      const response = await fetchFn(`${gateway}/${txId}`, {
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (!response.ok) continue;
+      return new Uint8Array(await response.arrayBuffer());
+    } catch {
+    }
+  }
+  return null;
+}
+async function downloadGitObjects(entries, options = {}) {
+  const queue = [...entries];
+  const total = queue.length;
+  const concurrency = Math.max(1, options.concurrency ?? DEFAULT_CONCURRENCY);
+  const objects = /* @__PURE__ */ new Map();
+  const unavailable = [];
+  const corrupt = [];
+  let done = 0;
+  const worker = async () => {
+    for (; ; ) {
+      const next = queue.shift();
+      if (!next) return;
+      const [sha, txId] = next;
+      const bytes = await fetchTxBytes(txId, options);
+      if (bytes === null) {
+        unavailable.push({ sha, txId });
+      } else {
+        const verified = verifyObjectBody(sha, bytes);
+        if (verified === null) {
+          corrupt.push({ sha, txId });
+        } else {
+          objects.set(sha, verified);
+        }
+      }
+      done += 1;
+      options.onObject?.(done, total);
+    }
+  };
+  await Promise.all(
+    Array.from({ length: Math.min(concurrency, total) }, () => worker())
+  );
+  if (corrupt.length > 0) throw new ObjectIntegrityError(corrupt);
+  return { objects, unavailable };
+}
+var FULL_SHA_RE2 = /^[0-9a-f]{40}$/;
+var GITLINK_MODE = "160000";
+function bytesToHex(bytes) {
+  let hex = "";
+  for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
+function referencedShas(object) {
+  switch (object.type) {
+    case "blob":
+      return [];
+    case "tree": {
+      const refs = [];
+      const data = object.body;
+      let offset = 0;
+      while (offset < data.length) {
+        const spaceIdx = data.indexOf(32, offset);
+        if (spaceIdx === -1) break;
+        const mode = data.subarray(offset, spaceIdx).toString("utf-8");
+        const nulIdx = data.indexOf(0, spaceIdx + 1);
+        if (nulIdx === -1 || nulIdx + 21 > data.length) break;
+        const sha = bytesToHex(data.subarray(nulIdx + 1, nulIdx + 21));
+        if (mode !== GITLINK_MODE) refs.push(sha);
+        offset = nulIdx + 21;
+      }
+      return refs;
+    }
+    case "commit": {
+      const refs = [];
+      const text = object.body.toString("utf-8");
+      const headerEnd = text.indexOf("\n\n");
+      const header = headerEnd === -1 ? text : text.slice(0, headerEnd);
+      for (const line of header.split("\n")) {
+        if (line.startsWith("tree ")) refs.push(line.slice(5).trim());
+        else if (line.startsWith("parent ")) refs.push(line.slice(7).trim());
+      }
+      return refs.filter((sha) => FULL_SHA_RE2.test(sha));
+    }
+    case "tag": {
+      const text = object.body.toString("utf-8");
+      const match = /^object ([0-9a-f]{40})$/m.exec(text);
+      return match?.[1] ? [match[1]] : [];
+    }
+  }
+}
+function walkClosure(tips, objects, presentLocally = /* @__PURE__ */ new Set()) {
+  const reachable = /* @__PURE__ */ new Set();
+  const missing = /* @__PURE__ */ new Set();
+  const stack = [...new Set(tips)];
+  while (stack.length > 0) {
+    const sha = stack.pop();
+    if (reachable.has(sha) || missing.has(sha)) continue;
+    if (presentLocally.has(sha)) continue;
+    const object = objects.get(sha);
+    if (!object) {
+      missing.add(sha);
+      continue;
+    }
+    reachable.add(sha);
+    for (const ref of referencedShas(object)) {
+      if (!reachable.has(ref) && !missing.has(ref)) stack.push(ref);
+    }
+  }
+  return { reachable, missing: [...missing] };
+}
+
+// src/read-pipeline.ts
+var MAX_PASSES = 64;
+async function collectRepoObjects(options) {
+  const { tips, shaToTxId, resolveMissing } = options;
+  const present = options.presentLocally ?? /* @__PURE__ */ new Set();
+  const txIds = new Map(shaToTxId);
+  const resolverAsked = /* @__PURE__ */ new Set();
+  const undownloadable = /* @__PURE__ */ new Map();
+  const objects = /* @__PURE__ */ new Map();
+  const initial = [];
+  for (const [sha, txId] of txIds) {
+    if (!present.has(sha)) initial.push([sha, txId]);
+  }
+  const bulk = await downloadGitObjects(initial, options);
+  for (const [sha, object] of bulk.objects) objects.set(sha, object);
+  for (const { sha, txId } of bulk.unavailable) undownloadable.set(sha, txId);
+  for (let pass = 0; pass < MAX_PASSES; pass++) {
+    const closure = walkClosure(tips, objects, present);
+    const open = closure.missing.filter((sha) => !undownloadable.has(sha));
+    if (open.length === 0) break;
+    const toResolve = open.filter(
+      (sha) => !txIds.has(sha) && !resolverAsked.has(sha)
+    );
+    for (const sha of toResolve) resolverAsked.add(sha);
+    if (toResolve.length > 0) {
+      const resolved = await resolveMissing(toResolve);
+      for (const [sha, txId] of resolved) txIds.set(sha, txId);
+    }
+    const batch = [];
+    for (const sha of open) {
+      const txId = txIds.get(sha);
+      if (txId !== void 0 && !objects.has(sha)) batch.push([sha, txId]);
+    }
+    if (batch.length === 0) break;
+    const result = await downloadGitObjects(batch, options);
+    for (const [sha, object] of result.objects) objects.set(sha, object);
+    for (const { sha, txId } of result.unavailable)
+      undownloadable.set(sha, txId);
+    if (result.objects.size === 0) break;
+  }
+  const finalClosure = walkClosure(tips, objects, present);
+  const missing = finalClosure.missing.map((sha) => ({
+    sha,
+    txId: txIds.get(sha) ?? null
+  }));
+  const reachable = finalClosure.reachable;
+  const skippedUnavailable = [...undownloadable].filter(
+    ([sha]) => !reachable.has(sha) && !finalClosure.missing.includes(sha)
+  ).map(([sha, txId]) => ({ sha, txId }));
+  return { objects, missing, skippedUnavailable };
+}
+function missingObjectsMessage(missing, context) {
+  const listed = missing.slice(0, 20).map(
+    (m) => `  ${m.sha}${m.txId ? `  (tx ${m.txId})` : "  (no Arweave tx found)"}`
+  ).join("\n");
+  const more = missing.length > 20 ? `
+  \u2026 and ${missing.length - 20} more` : "";
+  return `${context}: ${missing.length} required object(s) could not be downloaded:
+${listed}${more}
+Recently pushed objects can take 10-20 minutes to become fetchable from Arweave gateways \u2014 if this repo was just pushed, retry in a few minutes. Nothing was written.`;
+}
+
+// src/materialize.ts
+import { execFile as execFile2, spawn as spawn2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+var ObjectWriteMismatchError = class extends Error {
+  constructor(expectedSha, writtenSha) {
+    super(
+      `git hash-object wrote ${writtenSha} where ${expectedSha} was expected \u2014 object content does not round-trip; aborting`
+    );
+    this.expectedSha = expectedSha;
+    this.writtenSha = writtenSha;
+    this.name = "ObjectWriteMismatchError";
+  }
+  expectedSha;
+  writtenSha;
+};
+var FULL_SHA_RE3 = /^[0-9a-f]{40}$/;
+function isSafeRefname(refname) {
+  if (!refname.startsWith("refs/") || refname.length > 1024) return false;
+  if (/[\u0000-\u0020~^:?*[\\\u007f]/.test(refname)) return false;
+  if (refname.includes("..") || refname.includes("@{")) return false;
+  if (refname.endsWith("/") || refname.endsWith(".")) return false;
+  for (const part of refname.split("/")) {
+    if (part === "" || part.startsWith(".") || part.startsWith("-"))
+      return false;
+    if (part.endsWith(".lock")) return false;
+  }
+  return true;
+}
+function assertSafeRefname(refname) {
+  if (!isSafeRefname(refname)) {
+    throw new Error(
+      `unsafe ref name from remote state: ${JSON.stringify(refname)} \u2014 refusing`
+    );
+  }
+}
+function assertFullSha2(sha) {
+  if (!FULL_SHA_RE3.test(sha)) {
+    throw new Error(`not a full 40-hex SHA-1: ${JSON.stringify(sha)}`);
+  }
+}
+async function runGit(repoPath, args) {
+  try {
+    const { stdout } = await execFileAsync2("git", args, {
+      cwd: repoPath,
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024
+    });
+    return stdout;
+  } catch (err) {
+    const e = err;
+    throw new Error(
+      `git ${args[0]} failed${typeof e.code === "number" ? ` (exit ${e.code})` : ""}: ${(e.stderr ?? e.message ?? "").trim()}`
+    );
+  }
+}
+async function writeGitObject(repoPath, object) {
+  assertFullSha2(object.sha);
+  const written = await new Promise((resolve, reject) => {
+    const child = spawn2(
+      "git",
+      ["hash-object", "-w", "--stdin", "-t", object.type],
+      { cwd: repoPath, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (err) => {
+      reject(new Error(`failed to spawn git hash-object: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code !== 0) {
+        return reject(
+          new Error(`git hash-object failed (exit ${code}): ${stderr.trim()}`)
+        );
+      }
+      resolve(stdout.trim());
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.write(object.body);
+    child.stdin.end();
+  });
+  if (written !== object.sha) {
+    throw new ObjectWriteMismatchError(object.sha, written);
+  }
+}
+async function writeGitObjects(repoPath, objects) {
+  let count = 0;
+  for (const object of objects) {
+    await writeGitObject(repoPath, object);
+    count += 1;
+  }
+  return count;
+}
+async function updateRef(repoPath, refname, sha) {
+  assertSafeRefname(refname);
+  assertFullSha2(sha);
+  await runGit(repoPath, ["update-ref", refname, sha]);
+}
+async function setHeadSymref(repoPath, refname) {
+  assertSafeRefname(refname);
+  await runGit(repoPath, ["symbolic-ref", "HEAD", refname]);
+}
+
+// src/npub.ts
+var BECH32_CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+function bech32Polymod(values) {
+  const GEN = [996825010, 642813549, 513874426, 1027748829, 705979059];
+  let chk = 1;
+  for (const v of values) {
+    const b = chk >> 25;
+    chk = (chk & 33554431) << 5 ^ v;
+    for (let i = 0; i < 5; i++) {
+      chk ^= b >> i & 1 ? GEN[i] : 0;
+    }
+  }
+  return chk;
+}
+function bech32HrpExpand(hrp) {
+  const ret = [];
+  for (let i = 0; i < hrp.length; i++) {
+    ret.push(hrp.charCodeAt(i) >> 5);
+  }
+  ret.push(0);
+  for (let i = 0; i < hrp.length; i++) {
+    ret.push(hrp.charCodeAt(i) & 31);
+  }
+  return ret;
+}
+function bech32CreateChecksum(hrp, data) {
+  const values = bech32HrpExpand(hrp).concat(data).concat([0, 0, 0, 0, 0, 0]);
+  const polymod = bech32Polymod(values) ^ 1;
+  const ret = [];
+  for (let i = 0; i < 6; i++) {
+    ret.push(polymod >> 5 * (5 - i) & 31);
+  }
+  return ret;
+}
+function convertBits(data, fromBits, toBits, pad) {
+  let acc = 0;
+  let bits = 0;
+  const ret = [];
+  const maxv = (1 << toBits) - 1;
+  for (const value of data) {
+    acc = acc << fromBits | value;
+    bits += fromBits;
+    while (bits >= toBits) {
+      bits -= toBits;
+      ret.push(acc >> bits & maxv);
+    }
+  }
+  if (pad && bits > 0) {
+    ret.push(acc << toBits - bits & maxv);
+  }
+  return ret;
+}
+function hexToBytes(hex) {
+  const bytes = [];
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes.push(parseInt(hex.slice(i, i + 2), 16));
+  }
+  return bytes;
+}
+function hexToNpub(hexPubkey) {
+  const hrp = "npub";
+  const bytes = hexToBytes(hexPubkey);
+  const words = convertBits(bytes, 8, 5, true);
+  const checksum = bech32CreateChecksum(hrp, words);
+  const combined = words.concat(checksum);
+  return hrp + "1" + combined.map((d) => BECH32_CHARSET[d]).join("");
+}
+function npubToHex(npub) {
+  const lower = npub.toLowerCase();
+  if (lower !== npub && npub.toUpperCase() !== npub) {
+    throw new Error("npub: mixed case");
+  }
+  if (!lower.startsWith("npub1")) {
+    throw new Error("npub: invalid prefix");
+  }
+  if (lower.length !== 63) {
+    throw new Error("npub: invalid length");
+  }
+  const data = [];
+  for (let i = 5; i < lower.length; i++) {
+    const idx = BECH32_CHARSET.indexOf(lower[i]);
+    if (idx === -1) throw new Error("npub: invalid character");
+    data.push(idx);
+  }
+  const hrpExpanded = bech32HrpExpand("npub");
+  if (bech32Polymod(hrpExpanded.concat(data)) !== 1) {
+    throw new Error("npub: invalid checksum");
+  }
+  const words = data.slice(0, -6);
+  const bytes = convertBits(words, 5, 8, false);
+  if (bytes.length !== 32) {
+    throw new Error("npub: invalid data length");
+  }
+  const totalBits = words.length * 5;
+  const trailingBits = totalBits - bytes.length * 8;
+  if (trailingBits > 0) {
+    const lastWord = words[words.length - 1];
+    const mask = (1 << trailingBits) - 1;
+    if ((lastWord & mask) !== 0) {
+      throw new Error("npub: non-zero padding bits");
+    }
+  }
+  return bytes.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+var HEX64_RE = /^[0-9a-f]{64}$/;
+function ownerToHex(owner) {
+  if (HEX64_RE.test(owner)) return owner;
+  if (owner.startsWith("npub1")) {
+    try {
+      return npubToHex(owner);
+    } catch (err) {
+      throw new Error(
+        `invalid owner ${JSON.stringify(owner)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  throw new Error(
+    `invalid owner ${JSON.stringify(owner)}: expected a 64-char lowercase hex pubkey or an npub1\u2026 string`
+  );
+}
+
 // src/routes.ts
 function serializeFeeEstimate(plan) {
   return {
@@ -695,6 +1136,25 @@ async function executePush(options) {
 export {
   GitError,
   GitRepoReader,
+  DEFAULT_CONCURRENCY,
+  ObjectIntegrityError,
+  verifyObjectBody,
+  fetchTxBytes,
+  downloadGitObjects,
+  referencedShas,
+  walkClosure,
+  collectRepoObjects,
+  missingObjectsMessage,
+  ObjectWriteMismatchError,
+  isSafeRefname,
+  runGit,
+  writeGitObject,
+  writeGitObjects,
+  updateRef,
+  setHeadSymref,
+  hexToNpub,
+  npubToHex,
+  ownerToHex,
   serializeFeeEstimate,
   serializePushPlan,
   serializeEventReceipt,
@@ -704,4 +1164,4 @@ export {
   planPush,
   executePush
 };
-//# sourceMappingURL=chunk-LFGDLD6J.js.map
+//# sourceMappingURL=chunk-PS5QOT62.js.map